From f58fb5379b64d6e52e102d758ec59ffeb5fd6e45 Mon Sep 17 00:00:00 2001
From: afarukcali <afarukcali@gmail.com>
Date: Tue, 20 Jan 2026 14:13:22 +0300
Subject: [PATCH 1/5] Merge branch 'main' into feat/wasm-r&d

---
 .github/actions/coverage/action.yml           |   12 +
 .github/workflows/release.yml                 |    4 +-
 .gitignore                                    |    4 +
 CHANGELOG.md                                  |   62 +-
 Cargo.lock                                    | 3707 ++++++++----
 Cargo.toml                                    |   16 +-
 Cross.toml                                    |    5 +
 README.md                                     |   18 +-
 cli/Cargo.toml                                |    8 +-
 cli/README.md                                 |   16 +-
 cli/src/cli_conf.rs                           |   61 +-
 cli/src/completion/mod.rs                     |   14 +-
 cli/src/conf/conf_get.rs                      |   18 +-
 cli/src/conf/conf_set.rs                      |   68 +-
 cli/src/conf/mod.rs                           |   35 +-
 cli/src/crypto/crypto_auth.rs                 |    6 +-
 cli/src/crypto/crypto_generate_id_key.rs      |    1 +
 cli/src/crypto/crypto_init_key.rs             |    1 +
 cli/src/crypto/crypto_key_status.rs           |    3 +-
 cli/src/dag/dag_execute.rs                    |  428 +-
 cli/src/dag/dag_inspect_execution.rs          |   10 +-
 cli/src/dag/dag_publish.rs                    |    4 +-
 cli/src/dag/mod.rs                            |   27 +-
 cli/src/display.rs                            |    2 +-
 cli/src/error.rs                              |    2 +-
 cli/src/gas/gas_add_budget.rs                 |    6 +-
 cli/src/gas/mod.rs                            |   14 +-
 cli/src/gas/tickets/expiry/buy_ticket.rs      |   85 +-
 cli/src/gas/tickets/expiry/disable.rs         |   79 +-
 cli/src/gas/tickets/expiry/enable.rs          |   85 +-
 .../tickets/limited_invocations/buy_ticket.rs |   85 +-
 .../tickets/limited_invocations/disable.rs    |   80 +-
 .../gas/tickets/limited_invocations/enable.rs |   79 +-
 cli/src/main.rs                               |   15 +-
 cli/src/network/mod.rs                        |    2 +-
 cli/src/network/network_create.rs             |  130 +-
 cli/src/prelude.rs                            |   48 +-
 cli/src/scheduler/helpers.rs                  |   53 +
 cli/src/scheduler/mod.rs                      |   28 +
 cli/src/scheduler/occurrence/mod.rs           |   73 +
 .../scheduler/occurrence/occurrence_add.rs    |   57 +
 cli/src/scheduler/periodic/mod.rs             |   71 +
 .../scheduler/periodic/periodic_disable.rs    |   38 +
 cli/src/scheduler/periodic/periodic_set.rs    |   57 +
 cli/src/scheduler/task/mod.rs                 |  213 +
 cli/src/scheduler/task/task_create.rs         |  207 +
 cli/src/scheduler/task/task_inspect.rs        |   66 +
 cli/src/scheduler/task/task_metadata.rs       |   46 +
 cli/src/scheduler/task/task_state.rs          |   70 +
 cli/src/sui.rs                                |  888 +--
 cli/src/tool/mod.rs                           |  258 +-
 cli/src/tool/templates/move/.gitignore.jinja  |    2 +
 cli/src/tool/templates/move/Move.toml.jinja   |   16 +
 cli/src/tool/templates/move/tests.move.jinja  |   19 +
 cli/src/tool/templates/move/tool.move.jinja   |  121 +
 cli/src/tool/templates/rust/Cargo.toml.jinja  |    4 +-
 cli/src/tool/tool_claim_collateral.rs         |   81 +-
 cli/src/tool/tool_list.rs                     |  138 +-
 cli/src/tool/tool_new.rs                      |  104 +-
 cli/src/tool/tool_register.rs                 |  312 -
 cli/src/tool/tool_register_offchain.rs        |  262 +
 cli/src/tool/tool_register_onchain.rs         | 1285 ++++
 cli/src/tool/tool_set_invocation_cost.rs      |   87 +-
 cli/src/tool/tool_unregister.rs               |   88 +-
 cli/src/tool/tool_validate.rs                 |   45 +-
 cli/src/utils/secrets/aes_gcm_encryption.rs   |    8 +-
 cli/src/utils/secrets/master_key.rs           |    9 +
 cli/src/workflow/mod.rs                       |  401 ++
 codecov.yml                                   |    1 +
 docs/cli.md                                   |  152 +-
 docs/client.md                                |  230 +-
 docs/guides/dag-construction.md               |    2 +-
 docs/guides/onchain-tool-development.md       |  376 ++
 docs/guides/setup.md                          |   94 +-
 docs/index.md                                 |    3 +-
 docs/toolkit-rust.md                          |    2 +-
 rust-toolchain.toml                           |    2 +-
 sdk/Cargo.toml                                |  105 +-
 sdk/README.md                                 |    2 +-
 sdk/build.rs                                  |    4 +-
 sdk/src/crypto/double_ratchet.rs              |   78 +-
 sdk/src/crypto/session.rs                     |  128 +-
 sdk/src/crypto/x3dh.rs                        |   11 +-
 .../dag/_dags/conditional_onchain_tool.json   |   79 +
 sdk/src/dag/_dags/double_onchain_tool.json    |   56 +
 sdk/src/dag/_dags/guide_onchain_tool.json     |   66 +
 sdk/src/dag/_dags/single_onchain_tool.json    |   22 +
 sdk/src/dag/validator.rs                      |   25 +-
 sdk/src/events.rs                             |  450 --
 sdk/src/events/fetching.rs                    |  316 +
 sdk/src/events/graphql/events_query.graphql   |   24 +
 sdk/src/events/graphql/events_query.rs        |   14 +
 sdk/src/events/graphql/mod.rs                 |    1 +
 sdk/src/events/graphql/schema-1.61.2.graphql  | 5370 +++++++++++++++++
 sdk/src/events/mod.rs                         |  650 ++
 sdk/src/events/parsing.rs                     |  956 +++
 sdk/src/idents/mod.rs                         |   32 +-
 sdk/src/idents/move_std.rs                    |   64 +-
 sdk/src/idents/primitives.rs                  |  160 +-
 sdk/src/idents/sui_framework.rs               |  141 +-
 sdk/src/idents/tap.rs                         |    6 +-
 sdk/src/idents/workflow.rs                    |  721 ++-
 sdk/src/lib.rs                                |   16 +-
 sdk/src/nexus/client.rs                       |  584 +-
 sdk/src/nexus/crawler.rs                      |  917 +++
 sdk/src/nexus/crypto.rs                       |  276 +-
 sdk/src/nexus/gas.rs                          |  130 +-
 sdk/src/nexus/mod.rs                          |    3 +
 sdk/src/nexus/scheduler.rs                    | 1464 +++++
 sdk/src/nexus/signer.rs                       |  215 +
 sdk/src/nexus/workflow.rs                     |  593 +-
 sdk/src/object_crawler/fetching.rs            |  233 -
 sdk/src/object_crawler/mod.rs                 |    3 -
 sdk/src/object_crawler/wrappers.rs            |  504 --
 sdk/src/onchain_schema_gen/input.rs           |  201 +
 sdk/src/onchain_schema_gen/mod.rs             |   14 +
 sdk/src/onchain_schema_gen/output.rs          |  216 +
 sdk/src/onchain_schema_gen/types.rs           |  450 ++
 sdk/src/sui.rs                                |  130 +-
 sdk/src/test_utils/containers.rs              |  121 +-
 sdk/src/test_utils/contracts.rs               |  187 +-
 sdk/src/test_utils/faucet.rs                  |    2 +-
 sdk/src/test_utils/gas.rs                     |   47 +-
 sdk/src/test_utils/mod.rs                     |    1 -
 sdk/src/test_utils/nexus_mocks.rs             |   48 +-
 sdk/src/test_utils/sui_mocks.rs               |  781 ++-
 sdk/src/test_utils/wallet.rs                  |  103 -
 sdk/src/tool_fqn.rs                           |    2 +-
 sdk/src/tool_ref.rs                           |  415 ++
 sdk/src/transactions/crypto.rs                |  435 +-
 sdk/src/transactions/dag.rs                   |  533 +-
 sdk/src/transactions/gas.rs                   |  500 +-
 sdk/src/transactions/mod.rs                   |    3 +
 sdk/src/transactions/scheduler.rs             | 1733 ++++++
 sdk/src/transactions/tool.rs                  |  564 +-
 sdk/src/types/json_dag.rs                     |    8 +-
 sdk/src/types/mod.rs                          |    6 +
 sdk/src/types/nexus_data.rs                   |  297 +-
 sdk/src/types/nexus_data_parser.rs            |  146 +-
 sdk/src/types/nexus_objects.rs                |  193 +-
 sdk/src/types/ports_data.rs                   |    2 +-
 sdk/src/types/runtime_vertex.rs               |   25 +-
 sdk/src/types/scheduler.rs                    |  463 ++
 sdk/src/types/secret_value.rs                 |   75 +
 sdk/src/types/serde_parsers.rs                |  196 +-
 sdk/src/types/storage_kind.rs                 |    2 +-
 sdk/src/types/tool_meta.rs                    |    2 +-
 sdk/src/types/type_name.rs                    |   14 +
 sdk/src/walrus/client.rs                      |    6 +-
 sdk/tests/move/object_crawler_test/Move.toml  |    2 +-
 .../object_crawler_test/sources/main.move     |   21 +-
 sdk/tests/move/onchain_tool_test/Move.toml    |   10 +
 .../sources/onchain_tool.move                 |  104 +
 sdk/tests/object_crawler_test.rs              |  445 +-
 sdk/tests/scheduler_test.rs                   |  115 +
 toolkit-rust/README.md                        |    2 +-
 toolkit-rust/src/runtime.rs                   |   14 +
 toolkit-rust/tests/integration.rs             |   25 +
 tools/exchanges-coinbase/src/main.rs          |    1 +
 .../src/tools/get_product_stats.rs            |    1 +
 tools/http/src/errors.rs                      |   63 +-
 tools/http/src/http.rs                        |   41 +-
 tools/http/src/http_client.rs                 |    8 +-
 tools/http/src/models.rs                      |    9 +-
 .../get_conversation_messages.rs              |    2 +-
 .../get_conversation_messages_by_id.rs        |    2 +-
 tools/social-twitter/src/list/get_list.rs     |    2 +-
 .../src/list/get_list_members.rs              |    1 -
 .../src/list/get_list_tweets.rs               |    2 +-
 .../social-twitter/src/list/get_user_lists.rs |    2 +-
 .../social-twitter/src/list/remove_member.rs  |    1 -
 tools/social-twitter/src/list/update_list.rs  |    1 -
 tools/social-twitter/src/main.rs              |   10 +
 tools/social-twitter/src/media/models.rs      |    7 +-
 .../social-twitter/src/media/upload_media.rs  |    7 +-
 .../src/tweet/get_mentioned_tweets.rs         |    1 +
 .../src/tweet/get_recent_search_tweets.rs     |    2 +-
 .../src/tweet/get_recent_tweet_count.rs       |    6 -
 tools/social-twitter/src/tweet/get_tweet.rs   |    1 +
 tools/social-twitter/src/tweet/get_tweets.rs  |    1 +
 .../src/tweet/get_user_tweets.rs              |    1 +
 tools/social-twitter/src/tweet/models.rs      |   17 +-
 tools/social-twitter/src/tweet/post_tweet.rs  |    5 +-
 .../social-twitter/src/user/get_user_by_id.rs |    1 +
 .../src/user/get_user_by_username.rs          |    1 +
 185 files changed, 26795 insertions(+), 7688 deletions(-)
 create mode 100644 Cross.toml
 create mode 100644 cli/src/scheduler/helpers.rs
 create mode 100644 cli/src/scheduler/mod.rs
 create mode 100644 cli/src/scheduler/occurrence/mod.rs
 create mode 100644 cli/src/scheduler/occurrence/occurrence_add.rs
 create mode 100644 cli/src/scheduler/periodic/mod.rs
 create mode 100644 cli/src/scheduler/periodic/periodic_disable.rs
 create mode 100644 cli/src/scheduler/periodic/periodic_set.rs
 create mode 100644 cli/src/scheduler/task/mod.rs
 create mode 100644 cli/src/scheduler/task/task_create.rs
 create mode 100644 cli/src/scheduler/task/task_inspect.rs
 create mode 100644 cli/src/scheduler/task/task_metadata.rs
 create mode 100644 cli/src/scheduler/task/task_state.rs
 create mode 100644 cli/src/tool/templates/move/.gitignore.jinja
 create mode 100644 cli/src/tool/templates/move/Move.toml.jinja
 create mode 100644 cli/src/tool/templates/move/tests.move.jinja
 create mode 100644 cli/src/tool/templates/move/tool.move.jinja
 delete mode 100644 cli/src/tool/tool_register.rs
 create mode 100644 cli/src/tool/tool_register_offchain.rs
 create mode 100644 cli/src/tool/tool_register_onchain.rs
 create mode 100644 cli/src/workflow/mod.rs
 create mode 100644 docs/guides/onchain-tool-development.md
 create mode 100644 sdk/src/dag/_dags/conditional_onchain_tool.json
 create mode 100644 sdk/src/dag/_dags/double_onchain_tool.json
 create mode 100644 sdk/src/dag/_dags/guide_onchain_tool.json
 create mode 100644 sdk/src/dag/_dags/single_onchain_tool.json
 delete mode 100644 sdk/src/events.rs
 create mode 100644 sdk/src/events/fetching.rs
 create mode 100644 sdk/src/events/graphql/events_query.graphql
 create mode 100644 sdk/src/events/graphql/events_query.rs
 create mode 100644 sdk/src/events/graphql/mod.rs
 create mode 100644 sdk/src/events/graphql/schema-1.61.2.graphql
 create mode 100644 sdk/src/events/mod.rs
 create mode 100644 sdk/src/events/parsing.rs
 create mode 100644 sdk/src/nexus/crawler.rs
 create mode 100644 sdk/src/nexus/scheduler.rs
 create mode 100644 sdk/src/nexus/signer.rs
 delete mode 100644 sdk/src/object_crawler/fetching.rs
 delete mode 100644 sdk/src/object_crawler/mod.rs
 delete mode 100644 sdk/src/object_crawler/wrappers.rs
 create mode 100644 sdk/src/onchain_schema_gen/input.rs
 create mode 100644 sdk/src/onchain_schema_gen/mod.rs
 create mode 100644 sdk/src/onchain_schema_gen/output.rs
 create mode 100644 sdk/src/onchain_schema_gen/types.rs
 delete mode 100644 sdk/src/test_utils/wallet.rs
 create mode 100644 sdk/src/tool_ref.rs
 create mode 100644 sdk/src/transactions/scheduler.rs
 create mode 100644 sdk/src/types/scheduler.rs
 create mode 100644 sdk/src/types/secret_value.rs
 create mode 100644 sdk/tests/move/onchain_tool_test/Move.toml
 create mode 100644 sdk/tests/move/onchain_tool_test/sources/onchain_tool.move
 create mode 100644 sdk/tests/scheduler_test.rs

diff --git a/.github/actions/coverage/action.yml b/.github/actions/coverage/action.yml
index 259d89c6..efadc06f 100644
--- a/.github/actions/coverage/action.yml
+++ b/.github/actions/coverage/action.yml
@@ -20,9 +20,21 @@ inputs:
 runs:
   using: "composite"
   steps:
+    - name: Configure iptables for Docker
+      shell: bash
+      run: |
+        sudo update-alternatives --set iptables /usr/sbin/iptables-legacy
+        sudo update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy
+
     - name: Set up Docker
       uses: docker/setup-docker-action@v4
 
+    - name: Restart Docker to reinitialize iptables
+      shell: bash
+      run: |
+        sudo systemctl restart docker
+        sleep 5
+
     - name: Install Rust Toolchain
       uses: actions-rust-lang/setup-rust-toolchain@v1
       with:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 49935d2a..f3393cea 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -87,7 +87,7 @@ jobs:
       - name: Install build dependencies
         if: ${{ runner.os == 'Linux' }}
         run: |
-          sudo apt install -y libssl-dev musl-tools pkg-config
+          sudo apt install -y libssl-dev musl-tools pkg-config libdbus-1-dev
 
       - name: Cache Build
         uses: Swatinem/rust-cache@v2
@@ -109,7 +109,7 @@ jobs:
 
       - name: Package
         run: |
-          tar -cv CHANGELOG.md LICENSE.txt README.md \
+          tar -cv CHANGELOG.md LICENSE README.md \
             -C target/${{ matrix.target }}/release/ nexus |
             gzip --best > \
             nexus-cli-${{ steps.get_version.outputs.value }}-${{ matrix.target }}.tar.gz
diff --git a/.gitignore b/.gitignore
index 5a6a27ad..e66214bc 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,6 +2,8 @@
 target
 sdk/tests/move/object_crawler_test/build
 sdk/tests/move/object_crawler_test/Move.lock
+sdk/tests/move/onchain_tool_test/build
+sdk/tests/move/onchain_tool_test/Move.lock
 
 # WASM build outputs
 cli-wasm/pkg/
@@ -16,3 +18,5 @@ cli-wasm/pkg-bundler/
 
 # macOS
 .DS_Store
+
+**/Move.lock
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7e62c4c8..720704e8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,23 +5,75 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## Unreleased
+## [`0.5.0`] - 2026-01-16
 
-## [`0.3.0`] - 2025-11-10
+### `nexus-cli`
+
+#### Added
+
+- `nexus scheduler` command group for on-chain task management:
+  - `nexus scheduler task create` / `inspect` / `metadata` / `pause` / `resume` / `cancel`
+  - `nexus scheduler occurrence add`
+  - `nexus scheduler periodic set` / `disable`
+- `ToolRef` to combine offchain url and onchain move module id
+- add `--verbose` flag for debug log output
+
+### `nexus-sdk`
+
+#### Changed
+
+- leader and crypto caps in PTB templates are now party objects
+- added `ToolRegistryCreated` as tracked event
+- combined some functions in tool_registry.move
+- set Rust toolchain back to `stable`
+
+## [`0.4.0`] - 2026-01-07
 
 ### `nexus-cli`
 
 #### Added
 
-- `nexus dag inspect-execution` now also shows the data storage kind for each port
+- `--priority-fee-per-gas-unit` flag on `nexus dag execute` to forward a priority fee with DAG executions
+- `nexus tool register onchain` command to register onchain tools
+- onchain tool development guide
+- `nexus tool new` onchain tool move template
 
 #### Changed
 
-- `nexus dag inspect-execution` now uses new `NexusData` implementation that supports remote storage
-- `nexus dag execute` now uses new `NexusData` implementation that supports remote storage
+- CLI now uses GRPC behind the scenes to communicate with the Sui blockchain
+- CLI now uses the `EventFetcher` to fetche evens where necessary from Sui GraphQL
+
+### `nexus-sdk`
+
+#### Added
+
+- support for `scheduler` transactions and events
+- onchain schema generation
+- `EventFetcher` under `nexus` module to fetch events from Sui GraphQL
+
+#### Changed
+
+- `crypto auth` now uses the new handshake algorithm
+- `nexus tool register` now has two subcommands for both types of tools
+- wrap large numbers as JSON strings to preserve precision for u128/u256 in nexus parser
+- all identifiers and transaction templates now use new `sui-rust-sdk` types
+- `NexusClient` uses GRPC client under the hood
+- `ObjectCrawler` moved under `nexus` module and uses GRPC
+- `onchain_schema_gen` module now uses GRPC
+- all types in the SDK changed to use `sui-rust-sdk` types instead of `sui-sdk`
+
+#### Removed
+
+- dependency on `sui-sdk` crate in favour of `sui-rust-sdk`
+
+## [`0.3.0`] - 2025-11-10
+
+### `nexus-cli`
 
 #### Fixed
 
+- `nexus dag inspect-execution` now uses new `NexusData` implementation that supports remote storage
+- `nexus dag execute` now uses new `NexusData` implementation that supports remote storage
 - `nexus crypto init-key --force` wipes the old `crypto` state from config before rotating the key to avoid parsing errors
 
 ### `nexus-sdk`
diff --git a/Cargo.lock b/Cargo.lock
index fee1368b..b29ed9be 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2,6 +2,16 @@
 # It is not intended for manual editing.
 version = 4
 
+[[package]]
+name = "Inflector"
+version = "0.11.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fe438c63458706e03479442743baae6c88256498e6431708f6dfc520a26515d3"
+dependencies = [
+ "lazy_static",
+ "regex",
+]
+
 [[package]]
 name = "addchain"
 version = "0.2.0"
@@ -15,18 +25,18 @@ dependencies = [
 
 [[package]]
 name = "addr2line"
-version = "0.24.2"
+version = "0.25.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dfbe277e56a376000877090da837660b4427aad530e3028d44e0bffe4f89a1c1"
+checksum = "1b5d307320b3181d6d7954e663bd7c774a838b8220fe0593c86d9fb09f498b4b"
 dependencies = [
  "gimli",
 ]
 
 [[package]]
 name = "adler2"
-version = "2.0.0"
+version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "512761e0bb2578dd7380c6baaa0f4ce03e84f95e960231d1dec8bf4d7d6e2627"
+checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
 
 [[package]]
 name = "aead"
@@ -63,6 +73,21 @@ dependencies = [
  "subtle",
 ]
 
+[[package]]
+name = "aes-gcm-siv"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae0784134ba9375416d469ec31e7c5f9fa94405049cf08c5ce5b4698be673e0d"
+dependencies = [
+ "aead",
+ "aes",
+ "cipher",
+ "ctr",
+ "polyval",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "aes-siv"
 version = "0.7.0"
@@ -81,23 +106,23 @@ dependencies = [
 
 [[package]]
 name = "ahash"
-version = "0.8.11"
+version = "0.8.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e89da841a80418a9b391ebaea17f5c112ffaaa96f621d2c285b5174da76b9011"
+checksum = "5a15f179cd60c4584b8a8c596927aadc462e27f2ca70c04e0071964a73ba7a75"
 dependencies = [
  "cfg-if",
- "getrandom 0.2.15",
+ "getrandom 0.3.4",
  "once_cell",
  "serde",
  "version_check",
- "zerocopy 0.7.35",
+ "zerocopy",
 ]
 
 [[package]]
 name = "aho-corasick"
-version = "1.1.3"
+version = "1.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e60d3430d3a69478ad0993f19238d2df97c507009a52b3c10addcd7f6bcb916"
+checksum = "ddd31a130427c27518df266943a5308ed92d4b226cc639f5a8f1002816174301"
 dependencies = [
  "memchr",
 ]
@@ -124,16 +149,34 @@ dependencies = [
 ]
 
 [[package]]
-name = "allocator-api2"
-version = "0.2.21"
+name = "allocative"
+version = "0.3.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"
+checksum = "8fac2ce611db8b8cee9b2aa886ca03c924e9da5e5295d0dbd0526e5d0b0710f7"
+dependencies = [
+ "allocative_derive",
+ "bumpalo",
+ "ctor",
+ "hashbrown 0.14.5",
+ "num-bigint 0.4.6",
+]
 
 [[package]]
-name = "android-tzdata"
-version = "0.1.1"
+name = "allocative_derive"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fe233a377643e0fc1a56421d7c90acdec45c291b30345eb9f08e8d0ddce5a4ab"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.111",
+]
+
+[[package]]
+name = "allocator-api2"
+version = "0.2.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e999941b234f3131b00bc13c22d06e8c5ff726d1b6318ac7eb276997bbb4fef0"
+checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"
 
 [[package]]
 name = "android_system_properties"
@@ -156,7 +199,7 @@ dependencies = [
  "ed25519",
  "futures",
  "hex",
- "http 1.3.1",
+ "http 1.4.0",
  "matchit 0.5.0",
  "pin-project-lite",
  "pkcs8 0.10.2",
@@ -169,7 +212,7 @@ dependencies = [
  "rustls-webpki",
  "serde",
  "serde_json",
- "socket2",
+ "socket2 0.5.10",
  "tap",
  "thiserror 1.0.69",
  "tokio",
@@ -197,11 +240,20 @@ dependencies = [
  "uuid",
 ]
 
+[[package]]
+name = "annotate-snippets"
+version = "0.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccaf7e9dfbb6ab22c82e473cd1a8a7bd313c19a5b7e40970f3d89ef5a5c9e81e"
+dependencies = [
+ "unicode-width 0.1.14",
+]
+
 [[package]]
 name = "anstream"
-version = "0.6.18"
+version = "0.6.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8acc5369981196006228e28809f761875c0327210a891e941f4c683b3a99529b"
+checksum = "43d5b281e737544384e969a5ccad3f1cdd24b48086a0fc1b2a5262a26b8f4f4a"
 dependencies = [
  "anstyle",
  "anstyle-parse",
@@ -214,55 +266,71 @@ dependencies = [
 
 [[package]]
 name = "anstyle"
-version = "1.0.10"
+version = "1.0.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "55cc3b69f167a1ef2e161439aa98aed94e6028e5f9a59be9a6ffb47aef1651f9"
+checksum = "5192cca8006f1fd4f7237516f40fa183bb07f8fbdfedaa0036de5ea9b0b45e78"
 
 [[package]]
 name = "anstyle-parse"
-version = "0.2.6"
+version = "0.2.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b2d16507662817a6a20a9ea92df6652ee4f94f914589377d69f3b21bc5798a9"
+checksum = "4e7644824f0aa2c7b9384579234ef10eb7efb6a0deb83f9630a49594dd9c15c2"
 dependencies = [
  "utf8parse",
 ]
 
 [[package]]
 name = "anstyle-query"
-version = "1.1.2"
+version = "1.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "79947af37f4177cfead1110013d678905c37501914fba0efea834c3fe9a8d60c"
+checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
 dependencies = [
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
 name = "anstyle-wincon"
-version = "3.0.7"
+version = "3.0.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca3534e77181a9cc07539ad51f2141fe32f6c3ffd4df76db8ad92346b003ae4e"
+checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
 dependencies = [
  "anstyle",
+ "once_cell_polyfill",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "antithesis_sdk"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dafc0460f582169b1414074fd82bedbda60456fb4df0a78dc7fef1306e732ea3"
+dependencies = [
+ "libc",
+ "libloading",
+ "linkme",
  "once_cell",
- "windows-sys 0.59.0",
+ "rand 0.8.5",
+ "rustc_version_runtime",
+ "serde",
+ "serde_json",
 ]
 
 [[package]]
 name = "anyhow"
-version = "1.0.97"
+version = "1.0.100"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dcfed56ad506cb2c684a14971b8861fdc3baaaae314b9e5f9bb532cbe3ba7a4f"
+checksum = "a23eb6b1614318a8071c9b2521f36b424b2c83db5eb3a0fead4a6c0809af6e61"
 dependencies = [
  "backtrace",
 ]
 
 [[package]]
-name = "arc-swap"
-version = "1.7.1"
+name = "ar_archive_writer"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "69f7f8c3906b62b754cd5326047894316021dcfe5a194c8ea52bdd94934a3457"
+checksum = "f0c269894b6fe5e9d7ada0cf69b5bf847ff35bc25fc271f08e1d080fce80339a"
 dependencies = [
- "serde",
+ "object 0.32.2",
 ]
 
 [[package]]
@@ -303,7 +371,7 @@ dependencies = [
  "blake2",
  "derivative",
  "digest 0.10.7",
- "sha2 0.10.8",
+ "sha2 0.10.9",
 ]
 
 [[package]]
@@ -405,6 +473,17 @@ dependencies = [
  "tracing",
 ]
 
+[[package]]
+name = "ark-secp256k1"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c02e954eaeb4ddb29613fee20840c2bbc85ca4396d53e33837e11905363c5f2"
+dependencies = [
+ "ark-ec",
+ "ark-ff",
+ "ark-std",
+]
+
 [[package]]
 name = "ark-secp256r1"
 version = "0.4.0"
@@ -473,6 +552,15 @@ version = "0.7.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7c02d123df017efcdfbd739ef81735b36c5ba83ec3c59c80a9d7ecc718f92e50"
 
+[[package]]
+name = "ascii-canvas"
+version = "3.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8824ecca2e851cec16968d54a01dd372ef8f95b244fb84b84e70128be347c3c6"
+dependencies = [
+ "term",
+]
+
 [[package]]
 name = "asn1-rs"
 version = "0.7.1"
@@ -485,7 +573,7 @@ dependencies = [
  "nom",
  "num-traits",
  "rusticata-macros",
- "thiserror 2.0.12",
+ "thiserror 2.0.17",
  "time",
 ]
 
@@ -497,8 +585,8 @@ checksum = "3109e49b1e4909e9db6515a30c633684d68cdeaa252f215214cb4fa1a5bfee2c"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.100",
- "synstructure 0.13.1",
+ "syn 2.0.111",
+ "synstructure 0.13.2",
 ]
 
 [[package]]
@@ -509,7 +597,7 @@ checksum = "7b18050c2cd6fe86c3a76584ef5e0baf286d038cda203eb6223df2cc413565f7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.100",
+ "syn 2.0.111",
 ]
 
 [[package]]
@@ -524,14 +612,14 @@ dependencies = [
 
 [[package]]
 name = "assert_fs"
-version = "1.1.2"
+version = "1.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7efdb1fdb47602827a342857666feb372712cbc64b414172bd6b167a02927674"
+checksum = "a652f6cb1f516886fcfee5e7a5c078b9ade62cfcb889524efe5a64d682dd27a9"
 dependencies = [
  "anstyle",
  "doc-comment",
  "globwalk",
- "predicates",
+ "predicates 3.1.3",
  "predicates-core",
  "predicates-tree",
  "tempfile",
@@ -545,18 +633,15 @@ checksum = "9b34d609dfbaf33d6889b2b7106d3ca345eacad44200913df5ba02bfd31d2ba9"
 
 [[package]]
 name = "async-compression"
-version = "0.4.22"
+version = "0.4.35"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "59a194f9d963d8099596278594b3107448656ba73831c9d8c783e613ce86da64"
+checksum = "07a926debf178f2d355197f9caddb08e54a9329d44748034bba349c5848cb519"
 dependencies = [
- "brotli",
- "flate2",
+ "compression-codecs",
+ "compression-core",
  "futures-core",
- "memchr",
  "pin-project-lite",
  "tokio",
- "zstd",
- "zstd-safe",
 ]
 
 [[package]]
@@ -577,7 +662,7 @@ dependencies = [
  "secrecy",
  "serde",
  "serde_json",
- "thiserror 2.0.12",
+ "thiserror 2.0.17",
  "tokio",
  "tokio-stream",
  "tokio-util",
@@ -603,18 +688,18 @@ checksum = "c7c24de15d275a1ecfd47a380fb4d5ec9bfe0933f309ed5e705b775596a3574d"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.100",
+ "syn 2.0.111",
 ]
 
 [[package]]
 name = "async-trait"
-version = "0.1.88"
+version = "0.1.89"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e539d3fca749fcee5236ab05e93a52867dd549cc157c8cb7f99595f3cedffdb5"
+checksum = "9035ad2d096bed7955a320ee7e2230574d28fd3c3a0f186cbea1ff3c7eed5dbb"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.100",
+ "syn 2.0.111",
 ]
 
 [[package]]
@@ -631,42 +716,41 @@ checksum = "7460f7dd8e100147b82a63afca1a20eb6c231ee36b90ba7272e14951cb58af59"
 
 [[package]]
 name = "autocfg"
-version = "1.4.0"
+version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ace50bade8e6234aa140d9a2f552bbee1db4d353f69b8217bc503490fc1a9f26"
+checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
 
 [[package]]
 name = "axum"
-version = "0.7.9"
+version = "0.8.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "edca88bc138befd0323b20752846e6587272d3b03b0343c8ea28a6f819e6e71f"
+checksum = "5b098575ebe77cb6d14fc7f32749631a6e44edbef6b796f89b020e99ba20d425"
 dependencies = [
- "async-trait",
  "axum-core",
  "axum-macros",
  "base64 0.22.1",
  "bytes",
+ "form_urlencoded",
  "futures-util",
- "http 1.3.1",
+ "http 1.4.0",
  "http-body 1.0.1",
  "http-body-util",
- "hyper 1.6.0",
+ "hyper 1.8.1",
  "hyper-util",
  "itoa",
- "matchit 0.7.3",
+ "matchit 0.8.4",
  "memchr",
  "mime",
  "percent-encoding",
  "pin-project-lite",
- "rustversion",
- "serde",
+ "serde_core",
  "serde_json",
  "serde_path_to_error",
  "serde_urlencoded",
  "sha1",
  "sync_wrapper",
  "tokio",
- "tokio-tungstenite 0.24.0",
+ "tokio-tungstenite 0.28.0",
  "tower 0.5.2",
  "tower-layer",
  "tower-service",
@@ -674,19 +758,17 @@ dependencies = [
 
 [[package]]
 name = "axum-core"
-version = "0.4.5"
+version = "0.5.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09f2bd6146b97ae3359fa0cc6d6b376d9539582c7b4220f041a33ec24c226199"
+checksum = "59446ce19cd142f8833f856eb31f3eb097812d1479ab224f54d72428ca21ea22"
 dependencies = [
- "async-trait",
  "bytes",
- "futures-util",
- "http 1.3.1",
+ "futures-core",
+ "http 1.4.0",
  "http-body 1.0.1",
  "http-body-util",
  "mime",
  "pin-project-lite",
- "rustversion",
  "sync_wrapper",
  "tower-layer",
  "tower-service",
@@ -694,36 +776,13 @@ dependencies = [
 
 [[package]]
 name = "axum-macros"
-version = "0.4.2"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "57d123550fa8d071b7255cb0cc04dc302baa6c8c4a79f55701552684d8399bce"
+checksum = "604fde5e028fea851ce1d8570bbdc034bec850d157f7569d10f347d06808c05c"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.100",
-]
-
-[[package]]
-name = "axum-server"
-version = "0.6.1"
-source = "git+https://github.com/bmwill/axum-server.git?rev=f44323e271afdd1365fd0c8b0a4c0bbdf4956cb7#f44323e271afdd1365fd0c8b0a4c0bbdf4956cb7"
-dependencies = [
- "arc-swap",
- "bytes",
- "futures-util",
- "http 1.3.1",
- "http-body 1.0.1",
- "http-body-util",
- "hyper 1.6.0",
- "hyper-util",
- "pin-project-lite",
- "rustls",
- "rustls-pemfile",
- "rustls-pki-types",
- "tokio",
- "tokio-rustls",
- "tower 0.4.13",
- "tower-service",
+ "syn 2.0.111",
 ]
 
 [[package]]
@@ -733,7 +792,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b62ddb9cb1ec0a098ad4bbf9344d0713fa193ae1a80af55febcff2627b6a00c1"
 dependencies = [
  "futures-core",
- "getrandom 0.2.15",
+ "getrandom 0.2.16",
  "instant",
  "pin-project-lite",
  "rand 0.8.5",
@@ -754,17 +813,17 @@ dependencies = [
 
 [[package]]
 name = "backtrace"
-version = "0.3.74"
+version = "0.3.76"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8d82cb332cdfaed17ae235a638438ac4d4839913cc2af585c3c6746e8f8bee1a"
+checksum = "bb531853791a215d7c62a30daf0dde835f381ab5de4589cfe7c649d2cbe92bd6"
 dependencies = [
  "addr2line",
  "cfg-if",
  "libc",
  "miniz_oxide",
- "object",
+ "object 0.37.3",
  "rustc-demangle",
- "windows-targets 0.52.6",
+ "windows-link",
 ]
 
 [[package]]
@@ -785,6 +844,16 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4c7f02d4ea65f2c1853089ffd8d2787bdbc63de2f0d29dedbcf8ccdfa0ccd4cf"
 
+[[package]]
+name = "base256emoji"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5e9430d9a245a77c92176e649af6e275f20839a48389859d1661e9a128d077c"
+dependencies = [
+ "const-str 0.4.3",
+ "match-lookup",
+]
+
 [[package]]
 name = "base64"
 version = "0.13.1"
@@ -805,9 +874,9 @@ checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 
 [[package]]
 name = "base64ct"
-version = "1.7.3"
+version = "1.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "89e25b6adfb930f02d1981565a6e5d9c547ac15a96606256d3b59040e5cd4ca3"
+checksum = "0e050f626429857a27ddccb31e0aca21356bfa709c04041aefddac081a8f068a"
 
 [[package]]
 name = "bcs"
@@ -825,6 +894,12 @@ version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d86b93f97252c47b41663388e6d155714a9d0c398b99f1005cbc5f978b29f445"
 
+[[package]]
+name = "beef"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a8241f3ebb85c056b509d4327ad0358fbbba6ffb340bf388f26350aeda225b1"
+
 [[package]]
 name = "bellpepper"
 version = "0.4.1"
@@ -871,10 +946,10 @@ dependencies = [
 
 [[package]]
 name = "bin-version"
-version = "1.45.3"
-source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.45.3#643cae13d71392a164f427024d899ea49fc97a23"
+version = "1.61.2"
+source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.61.2#6c229fe6c04fb21ec98751c798e57e9a00e028e2"
 dependencies = [
- "const-str",
+ "const-str 0.5.7",
  "git-version",
 ]
 
@@ -895,25 +970,40 @@ checksum = "b30ed1d6f8437a487a266c8293aeb95b61a23261273e3e02912cdb8b68bf798b"
 dependencies = [
  "bs58 0.4.0",
  "hmac",
- "k256",
+ "k256 0.11.6",
  "once_cell",
  "pbkdf2",
  "rand_core 0.6.4",
  "ripemd",
- "sha2 0.10.8",
+ "sha2 0.10.9",
  "subtle",
  "zeroize",
 ]
 
+[[package]]
+name = "bit-set"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0700ddab506f33b20a03b13996eccd309a48e5ff77d0d95926aa0210fb4e95f1"
+dependencies = [
+ "bit-vec 0.6.3",
+]
+
 [[package]]
 name = "bit-set"
 version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "08807e080ed7f9d5433fa9b275196cfc35414f66a0c79d864dc51a0d825231a3"
 dependencies = [
- "bit-vec",
+ "bit-vec 0.8.0",
 ]
 
+[[package]]
+name = "bit-vec"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "349f9b6a179ed607305526ca489b34ad0a41aed5f7980fa90eb03160b69598fb"
+
 [[package]]
 name = "bit-vec"
 version = "0.8.0"
@@ -943,9 +1033,9 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
 [[package]]
 name = "bitflags"
-version = "2.9.0"
+version = "2.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c8214115b7bf84099f1309324e63141d4c5d7cc26862f97a0a857dbefe165bd"
+checksum = "812e12b5285cc515a9c72a5c1d3b6d46a19dac5acfef5265968c166106e31dd3"
 
 [[package]]
 name = "bitmaps"
@@ -1053,9 +1143,9 @@ dependencies = [
 
 [[package]]
 name = "blst"
-version = "0.3.14"
+version = "0.3.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "47c79a94619fade3c0b887670333513a67ac28a6a7e653eb260bf0d4103db38d"
+checksum = "dcdb4c7013139a150f9fc55d123186dbfaba0d912817466282c73ac49e71fb45"
 dependencies = [
  "cc",
  "glob",
@@ -1081,9 +1171,9 @@ dependencies = [
 
 [[package]]
 name = "bnum"
-version = "0.12.1"
+version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f781dba93de3a5ef6dc5b17c9958b208f6f3f021623b360fb605ea51ce443f10"
+checksum = "119771309b95163ec7aaf79810da82f7cd0599c19722d48b9c03894dca833966"
 
 [[package]]
 name = "bollard"
@@ -1098,9 +1188,9 @@ dependencies = [
  "futures-util",
  "hex",
  "home",
- "http 1.3.1",
+ "http 1.4.0",
  "http-body-util",
- "hyper 1.6.0",
+ "hyper 1.8.1",
  "hyper-named-pipe",
  "hyper-rustls",
  "hyper-util",
@@ -1116,7 +1206,7 @@ dependencies = [
  "serde_json",
  "serde_repr",
  "serde_urlencoded",
- "thiserror 2.0.12",
+ "thiserror 2.0.17",
  "tokio",
  "tokio-util",
  "tower-service",
@@ -1137,15 +1227,15 @@ dependencies = [
 
 [[package]]
 name = "borrow-or-share"
-version = "0.2.2"
+version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3eeab4423108c5d7c744f4d234de88d18d636100093ae04caf4825134b9c3a32"
+checksum = "dc0b364ead1874514c8c2855ab558056ebfeb775653e7ae45ff72f28f8f3166c"
 
 [[package]]
 name = "brotli"
-version = "7.0.0"
+version = "8.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cc97b8f16f944bba54f0433f07e30be199b6dc2bd25937444bbad560bcea29bd"
+checksum = "4bd8b9603c7aa97359dbd97ecf258968c95f3adddd6db2f7e7a5bef101c84560"
 dependencies = [
  "alloc-no-stdlib",
  "alloc-stdlib",
@@ -1154,9 +1244,9 @@ dependencies = [
 
 [[package]]
 name = "brotli-decompressor"
-version = "4.0.2"
+version = "5.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "74fa05ad7d803d413eb8380983b092cbbaf9a85f151b871360e7b00cd7060b37"
+checksum = "874bb8112abecc98cbd6d81ea4fa7e94fb9449648c93cc89aa40c81c24d7de03"
 dependencies = [
  "alloc-no-stdlib",
  "alloc-stdlib",
@@ -1182,9 +1272,9 @@ dependencies = [
 
 [[package]]
 name = "bstr"
-version = "1.12.0"
+version = "1.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "234113d19d0d7d613b40e86fb654acf958910802bcceab913a4f9e7cda03b1a4"
+checksum = "63044e1ae8e69f3b5a92c736ca6269b8d12fa7efe39bf34ddb06d102cf0e2cab"
 dependencies = [
  "memchr",
  "serde",
@@ -1192,9 +1282,9 @@ dependencies = [
 
 [[package]]
 name = "bumpalo"
-version = "3.17.0"
+version = "3.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1628fb46dfa0b37568d12e5edd512553eccf6a22a78e8bde00bb4aed84d5bdbf"
+checksum = "46c5e41b57b8bba42a04676d81cb89e9ee8e859a1a66f80a5a72e1cb76b34d43"
 
 [[package]]
 name = "byte-slice-cast"
@@ -1204,15 +1294,15 @@ checksum = "7575182f7272186991736b70173b0ea045398f984bf5ebbb3804736ce1330c9d"
 
 [[package]]
 name = "bytecount"
-version = "0.6.8"
+version = "0.6.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ce89b21cab1437276d2650d57e971f9d548a2d9037cc231abdc0562b97498ce"
+checksum = "175812e0be2bccb6abe50bb8d566126198344f707e304f45c648fd8f2cc0365e"
 
 [[package]]
 name = "bytemuck"
-version = "1.22.0"
+version = "1.24.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6b1fc10dbac614ebc03540c9dbd60e83887fda27794998c6528f1782047d540"
+checksum = "1fbdf580320f38b612e485521afda1ee26d10cc9884efaaa750d383e13e3c5f4"
 
 [[package]]
 name = "byteorder"
@@ -1222,13 +1312,22 @@ checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
 
 [[package]]
 name = "bytes"
-version = "1.10.1"
+version = "1.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d71b6127be86fdcfddb610f7182ac57211d4b18a3e9c82eb2d17662f2227ad6a"
+checksum = "b35204fbdc0b3f4446b89fc1ac2cf84a8a68971995d0bf2e925ec7cd960f9cb3"
 dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "bytestring"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "113b4343b5f6617e7ad401ced8de3cc8b012e73a594347c307b90db3e9271289"
+dependencies = [
+ "bytes",
+]
+
 [[package]]
 name = "cbc"
 version = "0.1.2"
@@ -1240,10 +1339,11 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.2.18"
+version = "1.2.49"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "525046617d8376e3db1deffb079e91cef90a89fc3ca5c185bbf8c9ecdd15cd5c"
+checksum = "90583009037521a116abf44494efecd645ba48b6622457080f080b85544e2215"
 dependencies = [
+ "find-msvc-tools",
  "jobserver",
  "libc",
  "shlex",
@@ -1257,9 +1357,15 @@ checksum = "6d43a04d8753f35258c91f8ec639f792891f748a1edbd759cf1dcea3382ad83c"
 
 [[package]]
 name = "cfg-if"
-version = "1.0.0"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+
+[[package]]
+name = "cfg_aliases"
+version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+checksum = "fd16c4719339c4530435d38e511904438d07cce7950afa3718a84ac36c10e89e"
 
 [[package]]
 name = "cfg_aliases"
@@ -1293,17 +1399,16 @@ dependencies = [
 
 [[package]]
 name = "chrono"
-version = "0.4.39"
+version = "0.4.42"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7e36cc9d416881d2e24f9a963be5fb1cd90966419ac844274161d10488b3e825"
+checksum = "145052bdd345b87320e369255277e3fb5152762ad123a901ef5c262dd38fe8d2"
 dependencies = [
- "android-tzdata",
  "iana-time-zone",
  "js-sys",
  "num-traits",
  "serde",
  "wasm-bindgen",
- "windows-targets 0.52.6",
+ "windows-link",
 ]
 
 [[package]]
@@ -1346,19 +1451,30 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.5.35"
+version = "4.5.53"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d8aa86934b44c19c50f87cc2790e19f54f7a67aedb64101c2e1a2e5ecfb73944"
+checksum = "c9e340e012a1bf4935f5282ed1436d1489548e8f72308207ea5df0e23d2d03f8"
 dependencies = [
  "clap_builder",
  "clap_derive",
 ]
 
+[[package]]
+name = "clap-verbosity"
+version = "2.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d7bf75a8e0407a558bd7e8e7919baa352e21fb0c1c7702a63c853f2277c4c63"
+dependencies = [
+ "clap",
+ "log",
+ "serde",
+]
+
 [[package]]
 name = "clap_builder"
-version = "4.5.35"
+version = "4.5.53"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2414dbb2dd0695280da6ea9261e327479e9d37b0630f6b53ba2a11c60c679fd9"
+checksum = "d76b5d13eaa18c901fd2f7fca939fefe3a0727a953561fefdf3b2922b8569d00"
 dependencies = [
  "anstream",
  "anstyle",
@@ -1369,30 +1485,39 @@ dependencies = [
 
 [[package]]
 name = "clap_complete"
-version = "4.5.48"
+version = "4.5.61"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "be8c97f3a6f02b9e24cadc12aaba75201d18754b53ea0a9d99642f806ccdb4c9"
+checksum = "39615915e2ece2550c0149addac32fb5bd312c657f43845bb9088cb9c8a7c992"
 dependencies = [
  "clap",
 ]
 
 [[package]]
 name = "clap_derive"
-version = "4.5.32"
+version = "4.5.49"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09176aae279615badda0765c0c0b3f6ed53f4709118af73cf4655d85d1530cd7"
+checksum = "2a0b5487afeab2deb2ff4e03a807ad1a03ac532ff5a2cee5d86884440c7f7671"
 dependencies = [
  "heck 0.5.0",
  "proc-macro2",
  "quote",
- "syn 2.0.100",
+ "syn 2.0.111",
 ]
 
 [[package]]
 name = "clap_lex"
-version = "0.7.4"
+version = "0.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1d728cc89cf3aee9ff92b05e62b19ee65a02b5702cff7d5a377e32c6ae29d8d"
+
+[[package]]
+name = "clipboard-win"
+version = "5.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f46ad14479a25103f283c0f10005961cf086d8dc42205bb44c46ac563475dca6"
+checksum = "bde03770d3df201d4fb868f2c9c59e66a3e4e2bd06692a0fe701e7103c7e84d4"
+dependencies = [
+ "error-code",
+]
 
 [[package]]
 name = "cmac"
@@ -1405,6 +1530,12 @@ dependencies = [
  "digest 0.10.7",
 ]
 
+[[package]]
+name = "cmp_any"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e9b18233253483ce2f65329a24072ec414db782531bdbb7d0bbc4bd2ce6b7e21"
+
 [[package]]
 name = "codespan"
 version = "0.11.1"
@@ -1428,9 +1559,9 @@ dependencies = [
 
 [[package]]
 name = "colorchoice"
-version = "1.0.3"
+version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b63caa9aa9397e2d9480a9b13673856c78d8ac123288526c37d7839f2a86990"
+checksum = "b05b61dc5112cbb17e4b6cd61790d9845d13888356391624cbe7e41efeac1e75"
 
 [[package]]
 name = "colored"
@@ -1461,10 +1592,30 @@ dependencies = [
  "memchr",
 ]
 
+[[package]]
+name = "compression-codecs"
+version = "0.4.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34a3cbbb8b6eca96f3a5c4bf6938d5b27ced3675d69f95bb51948722870bc323"
+dependencies = [
+ "brotli",
+ "compression-core",
+ "flate2",
+ "memchr",
+ "zstd",
+ "zstd-safe",
+]
+
+[[package]]
+name = "compression-core"
+version = "0.4.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75984efb6ed102a0d42db99afb6c1948f0380d1d91808d5529916e6c08b49d8d"
+
 [[package]]
 name = "consensus-config"
 version = "0.1.0"
-source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.45.3#643cae13d71392a164f427024d899ea49fc97a23"
+source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.61.2#6c229fe6c04fb21ec98751c798e57e9a00e028e2"
 dependencies = [
  "fastcrypto",
  "mysten-network",
@@ -1473,6 +1624,17 @@ dependencies = [
  "shared-crypto",
 ]
 
+[[package]]
+name = "consensus-types"
+version = "0.1.0"
+source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.61.2#6c229fe6c04fb21ec98751c798e57e9a00e028e2"
+dependencies = [
+ "base64 0.21.7",
+ "consensus-config",
+ "fastcrypto",
+ "serde",
+]
+
 [[package]]
 name = "console"
 version = "0.15.11"
@@ -1482,7 +1644,7 @@ dependencies = [
  "encode_unicode",
  "libc",
  "once_cell",
- "unicode-width 0.2.0",
+ "unicode-width 0.2.2",
  "windows-sys 0.59.0",
 ]
 
@@ -1502,6 +1664,12 @@ version = "0.9.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
 
+[[package]]
+name = "const-str"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f421161cb492475f1661ddc9815a745a1c894592070661180fdec3d4872e9c3"
+
 [[package]]
 name = "const-str"
 version = "0.5.7"
@@ -1520,6 +1688,15 @@ version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6245d59a3e82a7fc217c5828a6692dbc6dfb63a0c8c90495621f7b9d79704a0e"
 
+[[package]]
+name = "convert_case"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec182b0ca2f35d8fc196cf3404988fd8b8c739a4d270ff118a398feb0cbec1ca"
+dependencies = [
+ "unicode-segmentation",
+]
+
 [[package]]
 name = "convert_case"
 version = "0.7.1"
@@ -1541,9 +1718,9 @@ dependencies = [
 
 [[package]]
 name = "core-foundation"
-version = "0.10.0"
+version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b55271e5c8c478ad3f38ad24ef34923091e0548492a266d19b3c0b4d82574c63"
+checksum = "b2a6cd9ae233e7f62ba4e9353e81a88df7fc8a5987b8d445b4d90c879bd156f6"
 dependencies = [
  "core-foundation-sys",
  "libc",
@@ -1585,13 +1762,28 @@ dependencies = [
 
 [[package]]
 name = "crc32fast"
-version = "1.4.2"
+version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a97769d94ddab943e4510d138150169a2758b5ef3eb191a9ee688de3e23ef7b3"
+checksum = "9481c1c90cbf2ac953f07c8d4a58aa3945c425b7185c9154d67a65e4230da511"
 dependencies = [
  "cfg-if",
 ]
 
+[[package]]
+name = "critical-section"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "790eea4361631c5e7d22598ecd5723ff611904e3344ce8720784c93e3d83d40b"
+
+[[package]]
+name = "crossbeam-channel"
+version = "0.5.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "82b8f8f868b36967f9606790d1903570de9ceaf870a7bf9fbbd3016d636a2cb2"
+dependencies = [
+ "crossbeam-utils",
+]
+
 [[package]]
 name = "crossbeam-deque"
 version = "0.8.6"
@@ -1619,9 +1811,9 @@ checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28"
 
 [[package]]
 name = "crunchy"
-version = "0.2.3"
+version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "43da5946c66ffcc7745f48db692ffbb10a83bfe0afd96235c5c2a4fb23994929"
+checksum = "460fbee9c2c2f33933d720630a6a0bac33ba7053db5344fac858d4b8952d77d5"
 
 [[package]]
 name = "crypto-bigint"
@@ -1649,9 +1841,9 @@ dependencies = [
 
 [[package]]
 name = "crypto-common"
-version = "0.1.6"
+version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3"
+checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
 dependencies = [
  "generic-array",
  "rand_core 0.6.4",
@@ -1660,25 +1852,35 @@ dependencies = [
 
 [[package]]
 name = "csv"
-version = "1.3.1"
+version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "acdc4883a9c96732e4733212c01447ebd805833b7275a73ca3ee080fd77afdaf"
+checksum = "52cd9d68cf7efc6ddfaaee42e7288d3a99d613d4b50f76ce9827ae0c6e14f938"
 dependencies = [
  "csv-core",
  "itoa",
  "ryu",
- "serde",
+ "serde_core",
 ]
 
 [[package]]
 name = "csv-core"
-version = "0.1.12"
+version = "0.1.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d02f3b0da4c6504f86e9cd789d8dbafab48c2321be74e9987593de5a894d93d"
+checksum = "704a3c26996a80471189265814dbc2c257598b96b8a7feae2d31ace646bb9782"
 dependencies = [
  "memchr",
 ]
 
+[[package]]
+name = "ctor"
+version = "0.1.26"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d2301688392eb071b0bf1a37be05c469d3cc4dbbd95df672fe28ab021e6a096"
+dependencies = [
+ "quote",
+ "syn 1.0.109",
+]
+
 [[package]]
 name = "ctr"
 version = "0.9.2"
@@ -1712,7 +1914,7 @@ checksum = "f46882e17999c6cc590af592290432be3bce0428cb0d5f8b6715e4dc7b383eb3"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.100",
+ "syn 2.0.111",
 ]
 
 [[package]]
@@ -1748,6 +1950,16 @@ dependencies = [
  "darling_macro 0.20.11",
 ]
 
+[[package]]
+name = "darling"
+version = "0.21.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9cdf337090841a411e2a7f3deb9187445851f91b309c0c0a29e05f74a00a48c0"
+dependencies = [
+ "darling_core 0.21.3",
+ "darling_macro 0.21.3",
+]
+
 [[package]]
 name = "darling_core"
 version = "0.14.4"
@@ -1773,7 +1985,21 @@ dependencies = [
  "proc-macro2",
  "quote",
  "strsim 0.11.1",
- "syn 2.0.100",
+ "syn 2.0.111",
+]
+
+[[package]]
+name = "darling_core"
+version = "0.21.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1247195ecd7e3c85f83c8d2a366e4210d588e802133e1e355180a9870b517ea4"
+dependencies = [
+ "fnv",
+ "ident_case",
+ "proc-macro2",
+ "quote",
+ "strsim 0.11.1",
+ "syn 2.0.111",
 ]
 
 [[package]]
@@ -1795,7 +2021,18 @@ checksum = "fc34b93ccb385b40dc71c6fceac4b2ad23662c7eeb248cf10d529b7e055b6ead"
 dependencies = [
  "darling_core 0.20.11",
  "quote",
- "syn 2.0.100",
+ "syn 2.0.111",
+]
+
+[[package]]
+name = "darling_macro"
+version = "0.21.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d38308df82d1080de0afee5d069fa14b0326a88c14f15c5ccda35b4a6c414c81"
+dependencies = [
+ "darling_core 0.21.3",
+ "quote",
+ "syn 2.0.111",
 ]
 
 [[package]]
@@ -1813,15 +2050,15 @@ dependencies = [
 
 [[package]]
 name = "data-encoding"
-version = "2.8.0"
+version = "2.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "575f75dfd25738df5b91b8e43e14d44bda14637a58fae779fd2b064f8bf3e010"
+checksum = "2a2330da5de22e8a3cb63252ce2abb30116bf5265e89c0e01bc17015ce30a476"
 
 [[package]]
 name = "data-encoding-macro"
-version = "0.1.17"
+version = "0.1.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9f9724adfcf41f45bf652b3995837669d73c4d49a1b5ac1ff82905ac7d9b5558"
+checksum = "47ce6c96ea0102f01122a185683611bd5ac8d99e62bc59dd12e6bda344ee673d"
 dependencies = [
  "data-encoding",
  "data-encoding-macro-internal",
@@ -1829,12 +2066,12 @@ dependencies = [
 
 [[package]]
 name = "data-encoding-macro-internal"
-version = "0.1.15"
+version = "0.1.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "18e4fdb82bd54a12e42fb58a800dcae6b9e13982238ce2296dc3570b92148e1f"
+checksum = "8d162beedaa69905488a8da94f5ac3edb4dd4788b732fadb7bd120b2625c1976"
 dependencies = [
  "data-encoding",
- "syn 2.0.100",
+ "syn 2.0.111",
 ]
 
 [[package]]
@@ -1864,9 +2101,21 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "708b509edf7889e53d7efb0ffadd994cc6c2345ccb62f55cfd6b0682165e4fa6"
 dependencies = [
  "dbus",
+ "openssl",
  "zeroize",
 ]
 
+[[package]]
+name = "debugserver-types"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2bf6834a70ed14e8e4e41882df27190bea150f1f6ecf461f1033f8739cd8af4a"
+dependencies = [
+ "schemafy",
+ "serde",
+ "serde_json",
+]
+
 [[package]]
 name = "der"
 version = "0.6.1"
@@ -1880,9 +2129,9 @@ dependencies = [
 
 [[package]]
 name = "der"
-version = "0.7.9"
+version = "0.7.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f55bf8e7b65898637379c1b74eb1551107c8294ed26d855ceb9fd1a09cfc9bc0"
+checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb"
 dependencies = [
  "const-oid",
  "pem-rfc7468 0.7.0",
@@ -1905,12 +2154,12 @@ dependencies = [
 
 [[package]]
 name = "deranged"
-version = "0.4.0"
+version = "0.5.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c9e6a11ca8224451684bc0d7d5a7adbf8f2fd6887261a1cfc3c0432f9d4068e"
+checksum = "ececcb659e7ba858fb4f10388c250a7252eb0a27373f1a72b8748afdd248e587"
 dependencies = [
  "powerfmt",
- "serde",
+ "serde_core",
 ]
 
 [[package]]
@@ -1953,7 +2202,7 @@ dependencies = [
  "darling 0.20.11",
  "proc-macro2",
  "quote",
- "syn 2.0.100",
+ "syn 2.0.111",
 ]
 
 [[package]]
@@ -1963,20 +2212,20 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ab63b0e2bf4d5928aff72e83a7dace85d7bba5fe12dcc3c5a572d78caffd3f3c"
 dependencies = [
  "derive_builder_core",
- "syn 2.0.100",
+ "syn 2.0.111",
 ]
 
 [[package]]
 name = "derive_more"
-version = "0.99.19"
+version = "0.99.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3da29a38df43d6f156149c9b43ded5e018ddff2a855cf2cfd62e8cd7d079c69f"
+checksum = "6edb4b64a43d977b8e99788fe3a04d483834fba1215a7e02caa415b626497f7f"
 dependencies = [
  "convert_case 0.4.0",
  "proc-macro2",
  "quote",
  "rustc_version",
- "syn 2.0.100",
+ "syn 2.0.111",
 ]
 
 [[package]]
@@ -1994,12 +2243,19 @@ version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cb7330aeadfbe296029522e6c40f315320aba36fc43a5b3632f3795348f3bd22"
 dependencies = [
+ "convert_case 0.6.0",
  "proc-macro2",
  "quote",
- "syn 2.0.100",
+ "syn 2.0.111",
  "unicode-xid",
 ]
 
+[[package]]
+name = "diff"
+version = "0.1.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "56254986775e3233ffa9c4d7d3faaf6d36a2c09d30b20687e9f88bc8bafc16c8"
+
 [[package]]
 name = "difflib"
 version = "0.4.0"
@@ -2095,8 +2351,8 @@ checksum = "e01a3366d27ee9890022452ee61b2b63a67e6f13f58900b651ff5665f0bb1fab"
 dependencies = [
  "libc",
  "option-ext",
- "redox_users 0.5.0",
- "windows-sys 0.59.0",
+ "redox_users 0.5.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -2110,6 +2366,16 @@ dependencies = [
  "winapi",
 ]
 
+[[package]]
+name = "display_container"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0a110a75c96bedec8e65823dea00a1d710288b7a369d95fd8a0f5127639466fa"
+dependencies = [
+ "either",
+ "indenter",
+]
+
 [[package]]
 name = "displaydoc"
 version = "0.2.5"
@@ -2118,37 +2384,63 @@ checksum = "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.100",
+ "syn 2.0.111",
 ]
 
 [[package]]
 name = "doc-comment"
-version = "0.3.3"
+version = "0.3.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fea41bba32d969b513997752735605054bc0dfa92b4c56bf1189f2e174be7a10"
+checksum = "780955b8b195a21ab8e4ac6b60dd1dbdcec1dc6c51c0617964b08c81785e12c9"
 
 [[package]]
 name = "docker_credential"
-version = "1.3.1"
+version = "1.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "31951f49556e34d90ed28342e1df7e1cb7a229c4cab0aecc627b5d91edd41d07"
+checksum = "1d89dfcba45b4afad7450a99b39e751590463e45c04728cf555d36bb66940de8"
 dependencies = [
  "base64 0.21.7",
  "serde",
  "serde_json",
 ]
 
+[[package]]
+name = "downcast"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1435fa1053d8b2fbbe9be7e97eca7f33d37b28409959813daefc1446a14247f1"
+
 [[package]]
 name = "dunce"
 version = "1.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813"
 
+[[package]]
+name = "dupe"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ed2bc011db9c93fbc2b6cdb341a53737a55bafb46dbb74cf6764fc33a2fbf9c"
+dependencies = [
+ "dupe_derive",
+]
+
+[[package]]
+name = "dupe_derive"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "83e195b4945e88836d826124af44fdcb262ec01ef94d44f14f4fb5103f19892a"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.111",
+]
+
 [[package]]
 name = "dyn-clone"
-version = "1.0.19"
+version = "1.0.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1c7a8fb8a9fbf66c1f703fe16184d10ca0ee9d23be5b4436400408ba54a95005"
+checksum = "d0881ea181b1df73ff77ffaaf9c7544ecc11e82fba9b5f27b262a3c73a332555"
 
 [[package]]
 name = "ecdsa"
@@ -2168,7 +2460,7 @@ version = "0.16.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ee27f32b5c5292967d2d4a9d7f1e0b0aed2c15daded5a60300e4abb9d8020bca"
 dependencies = [
- "der 0.7.9",
+ "der 0.7.10",
  "digest 0.10.7",
  "elliptic-curve 0.13.8",
  "rfc6979 0.4.0",
@@ -2204,14 +2496,14 @@ dependencies = [
 
 [[package]]
 name = "ed25519-dalek"
-version = "2.1.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4a3daa8e81a3963a60642bcc1f90a670680bd4a77535faa384e9d1c79d620871"
+checksum = "70e796c081cee67dc755e1a36a0a172b897fab85fc3f6bc48307991f64e4eca9"
 dependencies = [
  "curve25519-dalek",
  "ed25519",
  "serde",
- "sha2 0.10.8",
+ "sha2 0.10.9",
  "subtle",
  "zeroize",
 ]
@@ -2270,6 +2562,15 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "ena"
+version = "0.14.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d248bdd43ce613d87415282f69b9bb99d947d290b10962dd6c56233312c2ad5"
+dependencies = [
+ "log",
+]
+
 [[package]]
 name = "encode_unicode"
 version = "1.0.0"
@@ -2285,6 +2586,12 @@ dependencies = [
  "cfg-if",
 ]
 
+[[package]]
+name = "endian-type"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c34f04666d835ff5d62e058c3995147c06f42fe86ff053337632bca83e42702d"
+
 [[package]]
 name = "enum-as-inner"
 version = "0.6.1"
@@ -2294,13 +2601,13 @@ dependencies = [
  "heck 0.5.0",
  "proc-macro2",
  "quote",
- "syn 2.0.100",
+ "syn 2.0.111",
 ]
 
 [[package]]
 name = "enum-compat-util"
 version = "0.1.0"
-source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.45.3#643cae13d71392a164f427024d899ea49fc97a23"
+source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.61.2#6c229fe6c04fb21ec98751c798e57e9a00e028e2"
 dependencies = [
  "serde_yaml",
 ]
@@ -2314,14 +2621,14 @@ dependencies = [
  "once_cell",
  "proc-macro2",
  "quote",
- "syn 2.0.100",
+ "syn 2.0.111",
 ]
 
 [[package]]
 name = "env_filter"
-version = "0.1.3"
+version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "186e05a59d4c50738528153b83b0b0194d3a29507dfec16eccd4b342903397d0"
+checksum = "1bf3c259d255ca70051b30e2e95b5446cdb8949ac4cd22c0d7fd634d89f568e2"
 dependencies = [
  "log",
  "regex",
@@ -2355,16 +2662,31 @@ dependencies = [
  "typeid",
 ]
 
+[[package]]
+name = "erased-serde"
+version = "0.3.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c138974f9d5e7fe373eb04df7cae98833802ae4b11c24ac7039a21d5af4b26c"
+dependencies = [
+ "serde",
+]
+
 [[package]]
 name = "errno"
-version = "0.3.11"
+version = "0.3.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "976dd42dc7e85965fe702eb8164f21f450704bdde31faefd6471dba214cb594e"
+checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "error-code"
+version = "3.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dea2df4cf52843e0452895c455a1a2cfbb842a1e7329671acf418fdc53ed4c59"
+
 [[package]]
 name = "etcetera"
 version = "0.8.0"
@@ -2378,9 +2700,9 @@ dependencies = [
 
 [[package]]
 name = "ethnum"
-version = "1.5.0"
+version = "1.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b90ca2580b73ab6a1f724b76ca11ab632df820fd6040c336200d2c1df7b3c82c"
+checksum = "ca81e6b4777c89fd810c25a4be2b1bd93ea034fbe58e6a75216a34c6b82c539b"
 
 [[package]]
 name = "eventsource-stream"
@@ -2395,17 +2717,17 @@ dependencies = [
 
 [[package]]
 name = "exchanges-coinbase"
-version = "0.3.0"
+version = "0.5.0"
 dependencies = [
  "chrono",
  "mockito",
  "nexus-sdk",
  "nexus-toolkit",
  "reqwest",
- "schemars 1.0.0-alpha.17",
+ "schemars 1.1.0",
  "serde",
  "serde_json",
- "thiserror 2.0.12",
+ "thiserror 2.0.17",
  "tokio",
 ]
 
@@ -2425,24 +2747,39 @@ version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6e24cb5a94bcae1e5408b0effca5cd7172ea3c5755049c5f3af4cd283a165298"
 dependencies = [
- "bit-set",
+ "bit-set 0.8.0",
  "regex-automata",
- "regex-syntax",
+ "regex-syntax 0.8.8",
+]
+
+[[package]]
+name = "fastbloom"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "18c1ddb9231d8554c2d6bdf4cfaabf0c59251658c68b6c95cd52dd0c513a912a"
+dependencies = [
+ "getrandom 0.3.4",
+ "libm",
+ "rand 0.9.2",
+ "siphasher",
 ]
 
 [[package]]
 name = "fastcrypto"
-version = "0.1.8"
-source = "git+https://github.com/MystenLabs/fastcrypto?rev=69d496c71fb37e3d22fe85e5bbfd4256d61422b9#69d496c71fb37e3d22fe85e5bbfd4256d61422b9"
+version = "0.1.9"
+source = "git+https://github.com/MystenLabs/fastcrypto?rev=09f86974195ec85d8aae386b1909d341d3ccfe52#09f86974195ec85d8aae386b1909d341d3ccfe52"
 dependencies = [
  "aes",
  "aes-gcm",
+ "aes-gcm-siv",
  "ark-ec",
  "ark-ff",
+ "ark-secp256k1",
  "ark-secp256r1",
  "ark-serialize",
  "auto_ops",
  "base64ct",
+ "bcs",
  "bech32",
  "bincode",
  "blake2",
@@ -2451,7 +2788,7 @@ dependencies = [
  "cbc",
  "ctr",
  "curve25519-dalek-ng",
- "derive_more 0.99.19",
+ "derive_more 0.99.20",
  "digest 0.10.7",
  "ecdsa 0.16.9",
  "ed25519-consensus",
@@ -2474,7 +2811,7 @@ dependencies = [
  "serde",
  "serde_json",
  "serde_with",
- "sha2 0.10.8",
+ "sha2 0.10.9",
  "sha3",
  "signature 2.2.0",
  "static_assertions",
@@ -2487,7 +2824,7 @@ dependencies = [
 [[package]]
 name = "fastcrypto-derive"
 version = "0.1.3"
-source = "git+https://github.com/MystenLabs/fastcrypto?rev=69d496c71fb37e3d22fe85e5bbfd4256d61422b9#69d496c71fb37e3d22fe85e5bbfd4256d61422b9"
+source = "git+https://github.com/MystenLabs/fastcrypto?rev=09f86974195ec85d8aae386b1909d341d3ccfe52#09f86974195ec85d8aae386b1909d341d3ccfe52"
 dependencies = [
  "quote",
  "syn 1.0.109",
@@ -2496,7 +2833,7 @@ dependencies = [
 [[package]]
 name = "fastcrypto-tbls"
 version = "0.1.0"
-source = "git+https://github.com/MystenLabs/fastcrypto?rev=69d496c71fb37e3d22fe85e5bbfd4256d61422b9#69d496c71fb37e3d22fe85e5bbfd4256d61422b9"
+source = "git+https://github.com/MystenLabs/fastcrypto?rev=09f86974195ec85d8aae386b1909d341d3ccfe52#09f86974195ec85d8aae386b1909d341d3ccfe52"
 dependencies = [
  "bcs",
  "digest 0.10.7",
@@ -2505,6 +2842,7 @@ dependencies = [
  "itertools 0.10.5",
  "rand 0.8.5",
  "serde",
+ "serde-big-array",
  "sha3",
  "tap",
  "tracing",
@@ -2515,7 +2853,7 @@ dependencies = [
 [[package]]
 name = "fastcrypto-zkp"
 version = "0.1.3"
-source = "git+https://github.com/MystenLabs/fastcrypto?rev=69d496c71fb37e3d22fe85e5bbfd4256d61422b9#69d496c71fb37e3d22fe85e5bbfd4256d61422b9"
+source = "git+https://github.com/MystenLabs/fastcrypto?rev=09f86974195ec85d8aae386b1909d341d3ccfe52#09f86974195ec85d8aae386b1909d341d3ccfe52"
 dependencies = [
  "ark-bn254",
  "ark-ec",
@@ -2526,7 +2864,7 @@ dependencies = [
  "ark-snark",
  "bcs",
  "byte-slice-cast",
- "derive_more 0.99.19",
+ "derive_more 0.99.20",
  "fastcrypto",
  "ff 0.13.1",
  "im",
@@ -2549,6 +2887,17 @@ version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "37909eebbb50d72f9059c3b6d82c0463f2ff062c9e95845c43a6c9c0355411be"
 
+[[package]]
+name = "fd-lock"
+version = "4.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ce92ff622d6dadf7349484f42c93271a0d49b7cc4d466a936405bacbe10aa78"
+dependencies = [
+ "cfg-if",
+ "rustix",
+ "windows-sys 0.59.0",
+]
+
 [[package]]
 name = "ff"
 version = "0.12.1"
@@ -2595,16 +2944,22 @@ checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d"
 
 [[package]]
 name = "filetime"
-version = "0.2.25"
+version = "0.2.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "35c0522e981e68cbfa8c3f978441a5f34b30b96e146b33cd3359176b50fe8586"
+checksum = "bc0505cd1b6fa6580283f6bdf70a73fcf4aba1184038c90902b92b3dd0df63ed"
 dependencies = [
  "cfg-if",
  "libc",
  "libredox",
- "windows-sys 0.59.0",
+ "windows-sys 0.60.2",
 ]
 
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a3076410a55c90011c298b04d0cfa770b00fa04e1e3c97d3f6c9de105a03844"
+
 [[package]]
 name = "fixed-hash"
 version = "0.7.0"
@@ -2619,9 +2974,9 @@ dependencies = [
 
 [[package]]
 name = "fixedbitset"
-version = "0.2.0"
+version = "0.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "37ab347416e802de484e4d03c7316c48f1ecb56574dfd4a46a80f173ce1de04d"
+checksum = "0ce7134b9999ecaf8bcd65542e436736ef32ddca1b3e06094cb6ec5755203b80"
 
 [[package]]
 name = "fixedbitset"
@@ -2631,14 +2986,23 @@ checksum = "1d674e81391d1e1ab681a28d99df07927c6d4aa5b027d7da16ba32d1d21ecd99"
 
 [[package]]
 name = "flate2"
-version = "1.1.1"
+version = "1.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ced92e76e966ca2fd84c8f7aa01a4aea65b0eb6648d72f7c8f3e2764a67fece"
+checksum = "bfe33edd8e85a12a67454e37f8c75e730830d83e313556ab9ebf9ee7fbeb3bfb"
 dependencies = [
  "crc32fast",
  "miniz_oxide",
 ]
 
+[[package]]
+name = "float-cmp"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "98de4bbd547a563b716d8dfa9aad1cb19bfab00f4fa09a6a4ed21dbcf44ce9c4"
+dependencies = [
+ "num-traits",
+]
+
 [[package]]
 name = "fluent-uri"
 version = "0.3.2"
@@ -2685,9 +3049,9 @@ checksum = "00b0228411908ca8685dba7fc2cdd70ec9990a6e753e89b6ac91a84c40fbaf4b"
 
 [[package]]
 name = "form_urlencoded"
-version = "1.2.1"
+version = "1.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e13624c2627564efccf4934284bdd98cbaa14e79b0b5a141218e507b3a823456"
+checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
 dependencies = [
  "percent-encoding",
 ]
@@ -2702,6 +3066,12 @@ dependencies = [
  "num",
 ]
 
+[[package]]
+name = "fragile"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "28dd6caf6059519a65843af8fe2a3ae298b14b80179855aeb4adc2c1934ee619"
+
 [[package]]
 name = "funty"
 version = "1.1.0"
@@ -2770,7 +3140,7 @@ checksum = "162ee34ebcb7c64a8abebc059ce0fee27c2262618d7b60ed8faf72fef13c3650"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.100",
+ "syn 2.0.111",
 ]
 
 [[package]]
@@ -2809,6 +3179,15 @@ dependencies = [
  "slab",
 ]
 
+[[package]]
+name = "fxhash"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c31b6d751ae2c7f11320402d34e41349dd1016f8d5d45e48c4312bc8625af50c"
+dependencies = [
+ "byteorder",
+]
+
 [[package]]
 name = "generic-array"
 version = "0.14.7"
@@ -2823,28 +3202,28 @@ dependencies = [
 
 [[package]]
 name = "getrandom"
-version = "0.2.15"
+version = "0.2.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c4567c8db10ae91089c99af84c68c38da3ec2f087c3f82960bcdbf3656b6f4d7"
+checksum = "335ff9f135e4384c8150d6f27c6daed433577f86b4750418338c01a1a2528592"
 dependencies = [
  "cfg-if",
  "js-sys",
  "libc",
- "wasi 0.11.0+wasi-snapshot-preview1",
+ "wasi",
  "wasm-bindgen",
 ]
 
 [[package]]
 name = "getrandom"
-version = "0.3.2"
+version = "0.3.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "73fea8450eea4bac3940448fb7ae50d91f034f941199fcd9d909a5a07aa455f0"
+checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
 dependencies = [
  "cfg-if",
  "js-sys",
  "libc",
  "r-efi",
- "wasi 0.14.2+wasi-0.2.4",
+ "wasip2",
  "wasm-bindgen",
 ]
 
@@ -2860,9 +3239,9 @@ dependencies = [
 
 [[package]]
 name = "gimli"
-version = "0.31.1"
+version = "0.32.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07e28edb80900c19c28f1072f2e8aeca7fa06b23cd4169cefe1af5aa3260783f"
+checksum = "e629b9b98ef3dd8afe6ca2bd0f89306cec16d43d907889945bc5d6687f2f13c7"
 
 [[package]]
 name = "git-version"
@@ -2881,26 +3260,26 @@ checksum = "53010ccb100b96a67bc32c0175f0ed1426b31b655d562898e57325f81c023ac0"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.100",
+ "syn 2.0.111",
 ]
 
 [[package]]
 name = "glob"
-version = "0.3.2"
+version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a8d1add55171497b4705a648c6b583acafb01d58050a51727785f0b2c8e0a2b2"
+checksum = "0cc23270f6e1808e30a928bdc84dea0b9b4136a8bc82338574f23baf47bbd280"
 
 [[package]]
 name = "globset"
-version = "0.4.16"
+version = "0.4.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "54a1028dfc5f5df5da8a56a73e6c153c9a9708ec57232470703592a3f18e49f5"
+checksum = "52dfc19153a48bde0cbd630453615c8151bce3a5adfac7a0aebfbf0a1e1f57e3"
 dependencies = [
  "aho-corasick",
  "bstr",
  "log",
  "regex-automata",
- "regex-syntax",
+ "regex-syntax 0.8.8",
 ]
 
 [[package]]
@@ -2909,7 +3288,7 @@ version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0bf760ebf69878d9fd8f110c89703d90ce35095324d1f1edcb595c63945ee757"
 dependencies = [
- "bitflags 2.9.0",
+ "bitflags 2.10.0",
  "ignore",
  "walkdir",
 ]
@@ -2934,6 +3313,64 @@ dependencies = [
  "spinning_top",
 ]
 
+[[package]]
+name = "graphql-introspection-query"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f2a4732cf5140bd6c082434494f785a19cfb566ab07d1382c3671f5812fed6d"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "graphql-parser"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a818c0d883d7c0801df27be910917750932be279c7bc82dc541b8769425f409"
+dependencies = [
+ "combine",
+ "thiserror 1.0.69",
+]
+
+[[package]]
+name = "graphql_client"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a50cfdc7f34b7f01909d55c2dcb71d4c13cbcbb4a1605d6c8bd760d654c1144b"
+dependencies = [
+ "graphql_query_derive",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "graphql_client_codegen"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e27ed0c2cf0c0cc52c6bcf3b45c907f433015e580879d14005386251842fb0a"
+dependencies = [
+ "graphql-introspection-query",
+ "graphql-parser",
+ "heck 0.4.1",
+ "lazy_static",
+ "proc-macro2",
+ "quote",
+ "serde",
+ "serde_json",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "graphql_query_derive"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "83febfa838f898cfa73dfaa7a8eb69ff3409021ac06ee94cfb3d622f6eeb1a97"
+dependencies = [
+ "graphql_client_codegen",
+ "proc-macro2",
+ "syn 1.0.109",
+]
+
 [[package]]
 name = "group"
 version = "0.12.1"
@@ -2954,15 +3391,15 @@ dependencies = [
  "ff 0.13.1",
  "rand 0.8.5",
  "rand_core 0.6.4",
- "rand_xorshift",
+ "rand_xorshift 0.3.0",
  "subtle",
 ]
 
 [[package]]
 name = "h2"
-version = "0.3.26"
+version = "0.3.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "81fe527a889e1532da5c525686d96d4c2e74cdd345badf8dfef9f6b39dd5f5e8"
+checksum = "0beca50380b1fc32983fc1cb4587bfa4bb9e78fc259aad4a0032d2080309222d"
 dependencies = [
  "bytes",
  "fnv",
@@ -2970,7 +3407,7 @@ dependencies = [
  "futures-sink",
  "futures-util",
  "http 0.2.12",
- "indexmap 2.9.0",
+ "indexmap 2.12.1",
  "slab",
  "tokio",
  "tokio-util",
@@ -2979,17 +3416,17 @@ dependencies = [
 
 [[package]]
 name = "h2"
-version = "0.4.8"
+version = "0.4.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5017294ff4bb30944501348f6f8e42e6ad28f42c8bbef7a74029aff064a4e3c2"
+checksum = "f3c0b69cfcb4e1b9f1bf2f53f95f766e4661169728ec61cd3fe5a0166f2d1386"
 dependencies = [
  "atomic-waker",
  "bytes",
  "fnv",
  "futures-core",
  "futures-sink",
- "http 1.3.1",
- "indexmap 2.9.0",
+ "http 1.4.0",
+ "indexmap 2.12.1",
  "slab",
  "tokio",
  "tokio-util",
@@ -2998,12 +3435,13 @@ dependencies = [
 
 [[package]]
 name = "half"
-version = "2.6.0"
+version = "2.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "459196ed295495a68f7d7fe1d84f6c4b7ff0e21fe3017b2f283c6fac3ad803c9"
+checksum = "6ea2d84b969582b4b1864a92dc5d27cd2b77b622a8d79306834f1be5ba20d84b"
 dependencies = [
  "cfg-if",
  "crunchy",
+ "zerocopy",
 ]
 
 [[package]]
@@ -3026,18 +3464,28 @@ name = "hashbrown"
 version = "0.14.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
+dependencies = [
+ "ahash",
+ "allocator-api2",
+]
 
 [[package]]
 name = "hashbrown"
-version = "0.15.2"
+version = "0.15.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf151400ff0baff5465007dd2f3e717f3fe502074ca563069ce3a6629d07b289"
+checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
 dependencies = [
  "allocator-api2",
  "equivalent",
  "foldhash",
 ]
 
+[[package]]
+name = "hashbrown"
+version = "0.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
+
 [[package]]
 name = "hdrhistogram"
 version = "7.5.4"
@@ -3086,9 +3534,9 @@ checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
 
 [[package]]
 name = "hermit-abi"
-version = "0.3.9"
+version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d231dfb89cfffdbc30e7fc41579ed6066ad03abda9e567ccafae602b97ec5024"
+checksum = "fc0fef456e4baa96da950455cd02c081ca953b141298e41db3fc7e36b1da849c"
 
 [[package]]
 name = "hex"
@@ -3107,9 +3555,9 @@ checksum = "6fe2267d4ed49bc07b63801559be28c718ea06c4738b7a03c94df7386d2cde46"
 
 [[package]]
 name = "hickory-proto"
-version = "0.24.4"
+version = "0.25.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92652067c9ce6f66ce53cc38d1169daa36e6e7eb7dd3b63b5103bd9d97117248"
+checksum = "f8a6fe56c0038198998a6f217ca4e7ef3a5e51f46163bd6dd60b5c71ca6c6502"
 dependencies = [
  "async-trait",
  "cfg-if",
@@ -3121,8 +3569,9 @@ dependencies = [
  "idna",
  "ipnet",
  "once_cell",
- "rand 0.8.5",
- "thiserror 1.0.69",
+ "rand 0.9.2",
+ "ring",
+ "thiserror 2.0.17",
  "tinyvec",
  "tokio",
  "tracing",
@@ -3131,21 +3580,21 @@ dependencies = [
 
 [[package]]
 name = "hickory-resolver"
-version = "0.24.4"
+version = "0.25.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cbb117a1ca520e111743ab2f6688eddee69db4e0ea242545a604dce8a66fd22e"
+checksum = "dc62a9a99b0bfb44d2ab95a7208ac952d31060efc16241c87eaf36406fecf87a"
 dependencies = [
  "cfg-if",
  "futures-util",
  "hickory-proto",
  "ipconfig",
- "lru-cache",
+ "moka",
  "once_cell",
  "parking_lot",
- "rand 0.8.5",
+ "rand 0.9.2",
  "resolv-conf",
  "smallvec",
- "thiserror 1.0.69",
+ "thiserror 2.0.17",
  "tokio",
  "tracing",
 ]
@@ -3176,22 +3625,11 @@ checksum = "77e806677ce663d0a199541030c816847b36e8dc095f70dae4a4f4ad63da5383"
 
 [[package]]
 name = "home"
-version = "0.5.11"
+version = "0.5.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "589533453244b0995c858700322199b2becb13b627df2851f64a2775d024abcf"
+checksum = "cc627f471c528ff0c4a49e1d5e60450c8f6461dd6d10ba9dcd3a61d3dff7728d"
 dependencies = [
- "windows-sys 0.59.0",
-]
-
-[[package]]
-name = "hostname"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a56f203cd1c76362b69e3863fd987520ac36cf70a8c92627449b2f64a8cf7d65"
-dependencies = [
- "cfg-if",
- "libc",
- "windows-link",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -3207,7 +3645,7 @@ dependencies = [
 
 [[package]]
 name = "http"
-version = "0.3.0"
+version = "0.5.0"
 dependencies = [
  "backon",
  "base64 0.21.7",
@@ -3216,22 +3654,21 @@ dependencies = [
  "nexus-sdk",
  "nexus-toolkit",
  "reqwest",
- "schemars 1.0.0-alpha.17",
+ "schemars 1.1.0",
  "serde",
  "serde_json",
- "thiserror 2.0.12",
+ "thiserror 2.0.17",
  "tokio",
  "url",
 ]
 
 [[package]]
 name = "http"
-version = "1.3.1"
+version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f4a85d31aea989eead29a3aaf9e1115a180df8282431156e533de47660892565"
+checksum = "e3ba2a386d7f85a81f119ad7498ebe444d2e22c2af0b86b069416ace48b3311a"
 dependencies = [
  "bytes",
- "fnv",
  "itoa",
 ]
 
@@ -3253,7 +3690,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1efedce1fb8e6913f23e0c92de8e62cd5b772a67e7b3946df930a62566c93184"
 dependencies = [
  "bytes",
- "http 1.3.1",
+ "http 1.4.0",
 ]
 
 [[package]]
@@ -3264,7 +3701,7 @@ checksum = "b021d93e26becf5dc7e1b75b1bed1fd93124b374ceb73f43d4d4eafec896a64a"
 dependencies = [
  "bytes",
  "futures-core",
- "http 1.3.1",
+ "http 1.4.0",
  "http-body 1.0.1",
  "pin-project-lite",
 ]
@@ -3289,9 +3726,9 @@ checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
 
 [[package]]
 name = "humantime"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b112acc8b3adf4b107a8ec20977da0273a8c386765a3ec0229bd500a1443f9f"
+checksum = "135b12329e5e3ce057a9f972339ea52bc954fe1e9358ef27f95e89716fbc5424"
 
 [[package]]
 name = "hyper"
@@ -3303,14 +3740,14 @@ dependencies = [
  "futures-channel",
  "futures-core",
  "futures-util",
- "h2 0.3.26",
+ "h2 0.3.27",
  "http 0.2.12",
  "http-body 0.4.6",
  "httparse",
  "httpdate",
  "itoa",
  "pin-project-lite",
- "socket2",
+ "socket2 0.5.10",
  "tokio",
  "tower-service",
  "tracing",
@@ -3319,20 +3756,22 @@ dependencies = [
 
 [[package]]
 name = "hyper"
-version = "1.6.0"
+version = "1.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cc2b571658e38e0c01b1fdca3bbbe93c00d3d71693ff2770043f8c29bc7d6f80"
+checksum = "2ab2d4f250c3d7b1c9fcdff1cece94ea4e2dfbec68614f7b87cb205f24ca9d11"
 dependencies = [
+ "atomic-waker",
  "bytes",
  "futures-channel",
- "futures-util",
- "h2 0.4.8",
- "http 1.3.1",
+ "futures-core",
+ "h2 0.4.12",
+ "http 1.4.0",
  "http-body 1.0.1",
  "httparse",
  "httpdate",
  "itoa",
  "pin-project-lite",
+ "pin-utils",
  "smallvec",
  "tokio",
  "want",
@@ -3345,7 +3784,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "73b7d8abf35697b81a825e386fc151e0d503e8cb5fcb93cc8669c376dfd6f278"
 dependencies = [
  "hex",
- "hyper 1.6.0",
+ "hyper 1.8.1",
  "hyper-util",
  "pin-project-lite",
  "tokio",
@@ -3355,13 +3794,12 @@ dependencies = [
 
 [[package]]
 name = "hyper-rustls"
-version = "0.27.5"
+version = "0.27.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d191583f3da1305256f22463b9bb0471acad48a4e534a5218b9963e9c1f59b2"
+checksum = "e3c93eb611681b207e1fe55d5a71ecf91572ec8a6705cdb6857f7d8d5242cf58"
 dependencies = [
- "futures-util",
- "http 1.3.1",
- "hyper 1.6.0",
+ "http 1.4.0",
+ "hyper 1.8.1",
  "hyper-util",
  "log",
  "rustls",
@@ -3379,7 +3817,7 @@ version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2b90d566bffbce6a75bd8b09a05aa8c2cb1fabb6cb348f8840c9e4c90a0d83b0"
 dependencies = [
- "hyper 1.6.0",
+ "hyper 1.8.1",
  "hyper-util",
  "pin-project-lite",
  "tokio",
@@ -3394,7 +3832,7 @@ checksum = "70206fc6890eaca9fde8a0bf71caa2ddfc9fe045ac9e5c70df101a7dbde866e0"
 dependencies = [
  "bytes",
  "http-body-util",
- "hyper 1.6.0",
+ "hyper 1.8.1",
  "hyper-util",
  "native-tls",
  "tokio",
@@ -3404,22 +3842,28 @@ dependencies = [
 
 [[package]]
 name = "hyper-util"
-version = "0.1.11"
+version = "0.1.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "497bbc33a26fdd4af9ed9c70d63f61cf56a938375fbb32df34db9b1cd6d643f2"
+checksum = "727805d60e7938b76b826a6ef209eb70eaa1812794f9424d4a4e2d740662df5f"
 dependencies = [
+ "base64 0.22.1",
  "bytes",
  "futures-channel",
+ "futures-core",
  "futures-util",
- "http 1.3.1",
+ "http 1.4.0",
  "http-body 1.0.1",
- "hyper 1.6.0",
+ "hyper 1.8.1",
+ "ipnet",
  "libc",
+ "percent-encoding",
  "pin-project-lite",
- "socket2",
+ "socket2 0.6.1",
+ "system-configuration",
  "tokio",
  "tower-service",
  "tracing",
+ "windows-registry",
 ]
 
 [[package]]
@@ -3430,7 +3874,7 @@ checksum = "986c5ce3b994526b3cd75578e62554abd09f0899d6206de48b3e96ab34ccc8c7"
 dependencies = [
  "hex",
  "http-body-util",
- "hyper 1.6.0",
+ "hyper 1.8.1",
  "hyper-util",
  "pin-project-lite",
  "tokio",
@@ -3439,9 +3883,9 @@ dependencies = [
 
 [[package]]
 name = "iana-time-zone"
-version = "0.1.63"
+version = "0.1.64"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b0c919e5debc312ad217002b8048a17b7d83f80703865bbfcfebb0458b0b27d8"
+checksum = "33e57f83510bb73707521ebaffa789ec8caf86f9657cad665b092b581d40e9fb"
 dependencies = [
  "android_system_properties",
  "core-foundation-sys",
@@ -3463,21 +3907,22 @@ dependencies = [
 
 [[package]]
 name = "icu_collections"
-version = "1.5.0"
+version = "2.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "db2fa452206ebee18c4b5c2274dbf1de17008e874b4dc4f0aea9d01ca79e4526"
+checksum = "4c6b649701667bbe825c3b7e6388cb521c23d88644678e83c0c4d0a621a34b43"
 dependencies = [
  "displaydoc",
+ "potential_utf",
  "yoke",
  "zerofrom",
  "zerovec",
 ]
 
 [[package]]
-name = "icu_locid"
-version = "1.5.0"
+name = "icu_locale_core"
+version = "2.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "13acbb8371917fc971be86fc8057c41a64b521c184808a698c02acc242dbf637"
+checksum = "edba7861004dd3714265b4db54a3c390e880ab658fec5f7db895fae2046b5bb6"
 dependencies = [
  "displaydoc",
  "litemap",
@@ -3486,99 +3931,61 @@ dependencies = [
  "zerovec",
 ]
 
-[[package]]
-name = "icu_locid_transform"
-version = "1.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "01d11ac35de8e40fdeda00d9e1e9d92525f3f9d887cdd7aa81d727596788b54e"
-dependencies = [
- "displaydoc",
- "icu_locid",
- "icu_locid_transform_data",
- "icu_provider",
- "tinystr",
- "zerovec",
-]
-
-[[package]]
-name = "icu_locid_transform_data"
-version = "1.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7515e6d781098bf9f7205ab3fc7e9709d34554ae0b21ddbcb5febfa4bc7df11d"
-
 [[package]]
 name = "icu_normalizer"
-version = "1.5.0"
+version = "2.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "19ce3e0da2ec68599d193c93d088142efd7f9c5d6fc9b803774855747dc6a84f"
+checksum = "5f6c8828b67bf8908d82127b2054ea1b4427ff0230ee9141c54251934ab1b599"
 dependencies = [
- "displaydoc",
  "icu_collections",
  "icu_normalizer_data",
  "icu_properties",
  "icu_provider",
  "smallvec",
- "utf16_iter",
- "utf8_iter",
- "write16",
  "zerovec",
 ]
 
 [[package]]
 name = "icu_normalizer_data"
-version = "1.5.1"
+version = "2.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c5e8338228bdc8ab83303f16b797e177953730f601a96c25d10cb3ab0daa0cb7"
+checksum = "7aedcccd01fc5fe81e6b489c15b247b8b0690feb23304303a9e560f37efc560a"
 
 [[package]]
 name = "icu_properties"
-version = "1.5.1"
+version = "2.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "93d6020766cfc6302c15dbbc9c8778c37e62c14427cb7f6e601d849e092aeef5"
+checksum = "020bfc02fe870ec3a66d93e677ccca0562506e5872c650f893269e08615d74ec"
 dependencies = [
- "displaydoc",
  "icu_collections",
- "icu_locid_transform",
+ "icu_locale_core",
  "icu_properties_data",
  "icu_provider",
- "tinystr",
+ "zerotrie",
  "zerovec",
 ]
 
 [[package]]
 name = "icu_properties_data"
-version = "1.5.1"
+version = "2.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85fb8799753b75aee8d2a21d7c14d9f38921b54b3dbda10f5a3c7a7b82dba5e2"
+checksum = "616c294cf8d725c6afcd8f55abc17c56464ef6211f9ed59cccffe534129c77af"
 
 [[package]]
 name = "icu_provider"
-version = "1.5.0"
+version = "2.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ed421c8a8ef78d3e2dbc98a973be2f3770cb42b606e3ab18d6237c4dfde68d9"
+checksum = "85962cf0ce02e1e0a629cc34e7ca3e373ce20dda4c4d7294bbd0bf1fdb59e614"
 dependencies = [
  "displaydoc",
- "icu_locid",
- "icu_provider_macros",
- "stable_deref_trait",
- "tinystr",
+ "icu_locale_core",
  "writeable",
  "yoke",
  "zerofrom",
+ "zerotrie",
  "zerovec",
 ]
 
-[[package]]
-name = "icu_provider_macros"
-version = "1.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ec89e9337638ecdc08744df490b221a7399bf8d164eb52a665454e60e075ad6"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.100",
-]
-
 [[package]]
 name = "ident_case"
 version = "1.0.1"
@@ -3587,9 +3994,9 @@ checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
 
 [[package]]
 name = "idna"
-version = "1.0.3"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "686f825264d630750a544639377bae737628043f20d38bbc029e8f29ea968a7e"
+checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de"
 dependencies = [
  "idna_adapter",
  "smallvec",
@@ -3598,9 +4005,9 @@ dependencies = [
 
 [[package]]
 name = "idna_adapter"
-version = "1.2.0"
+version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "daca1df1c957320b2cf139ac61e7bd64fed304c5040df000a745aa1de3b4ef71"
+checksum = "3acae9609540aa318d1bc588455225fb2085b9ed0c4f6bd0d9d5bcd86f1a0344"
 dependencies = [
  "icu_normalizer",
  "icu_properties",
@@ -3608,9 +4015,9 @@ dependencies = [
 
 [[package]]
 name = "ignore"
-version = "0.4.23"
+version = "0.4.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6d89fd380afde86567dfba715db065673989d6253f42b88179abd3eae47bda4b"
+checksum = "d3d782a365a015e0f5c04902246139249abf769125006fbe7649e2ee88169b4a"
 dependencies = [
  "crossbeam-deque",
  "globset",
@@ -3662,14 +4069,14 @@ checksum = "a0eb5a3343abf848c0984fe4604b2b105da9539376e24fc0a3b0007411ae4fd9"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.100",
+ "syn 2.0.111",
 ]
 
 [[package]]
 name = "indenter"
-version = "0.3.3"
+version = "0.3.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce23b50ad8242c51a442f3ff322d56b02f08852c77e4c0b4d3fd684abc89c683"
+checksum = "964de6e86d545b246d84badc0fef527924ace5134f30641c203ef52ba83f58d5"
 
 [[package]]
 name = "indexmap"
@@ -3684,13 +4091,14 @@ dependencies = [
 
 [[package]]
 name = "indexmap"
-version = "2.9.0"
+version = "2.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cea70ddb795996207ad57735b50c5982d8844f38ba9ee5f1aedcfb708a2aa11e"
+checksum = "0ad4bb2b565bca0645f4d68c5c9af97fba094e9791da685bf83cb5f3ce74acf2"
 dependencies = [
  "equivalent",
- "hashbrown 0.15.2",
+ "hashbrown 0.16.1",
  "serde",
+ "serde_core",
 ]
 
 [[package]]
@@ -3702,7 +4110,7 @@ dependencies = [
  "console",
  "number_prefix",
  "portable-atomic",
- "unicode-width 0.2.0",
+ "unicode-width 0.2.2",
  "web-time",
 ]
 
@@ -3724,16 +4132,12 @@ dependencies = [
 
 [[package]]
 name = "insta"
-version = "1.42.2"
+version = "1.44.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50259abbaa67d11d2bcafc7ba1d094ed7a0c70e3ce893f0d0997f73558cb3084"
+checksum = "b5c943d4415edd8153251b6f197de5eb1640e56d84e8d9159bea190421c73698"
 dependencies = [
  "console",
- "linked-hash-map",
  "once_cell",
- "pest",
- "pest_derive",
- "pin-project",
  "serde",
  "similar",
 ]
@@ -3747,14 +4151,23 @@ dependencies = [
  "cfg-if",
 ]
 
+[[package]]
+name = "inventory"
+version = "0.3.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc61209c082fbeb19919bee74b176221b27223e27b65d781eb91af24eb1fb46e"
+dependencies = [
+ "rustversion",
+]
+
 [[package]]
 name = "ipconfig"
 version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b58db92f96b720de98181bbbe63c831e87005ab460c1bf306eb2622b4707997f"
 dependencies = [
- "socket2",
- "widestring 1.2.0",
+ "socket2 0.5.10",
+ "widestring 1.2.1",
  "windows-sys 0.48.0",
  "winreg",
 ]
@@ -3767,19 +4180,30 @@ checksum = "469fb0b9cefa57e3ef31275ee7cacb78f2fdca44e4765491884a2b119d4eb130"
 
 [[package]]
 name = "iri-string"
-version = "0.7.8"
+version = "0.7.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dbc5ebe9c3a1a7a5127f920a418f7585e9e758e911d0466ed004f393b0e380b2"
+checksum = "4f867b9d1d896b67beb18518eda36fdb77a32ea590de864f1325b294a6d14397"
 dependencies = [
  "memchr",
  "serde",
 ]
 
+[[package]]
+name = "is-terminal"
+version = "0.4.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3640c1c38b8e4e43584d8df18be5fc6b0aa314ce6ebf51b53313d4306cca8e46"
+dependencies = [
+ "hermit-abi",
+ "libc",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "is_terminal_polyfill"
-version = "1.70.1"
+version = "1.70.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7943c866cc5cd64cbc25b2e01621d07fa8eb2a1a23160ee81ce38704e97b8ecf"
+checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"
 
 [[package]]
 name = "itertools"
@@ -3825,26 +4249,26 @@ checksum = "4a5f13b858c8d314ee3e8f639011f7ccefe71f97f96e50151fb991f267928e2c"
 
 [[package]]
 name = "jiff"
-version = "0.2.6"
+version = "0.2.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1f33145a5cbea837164362c7bd596106eb7c5198f97d1ba6f6ebb3223952e488"
+checksum = "49cce2b81f2098e7e3efc35bc2e0a6b7abec9d34128283d7a26fa8f32a6dbb35"
 dependencies = [
  "jiff-static",
  "log",
  "portable-atomic",
  "portable-atomic-util",
- "serde",
+ "serde_core",
 ]
 
 [[package]]
 name = "jiff-static"
-version = "0.2.6"
+version = "0.2.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "43ce13c40ec6956157a3635d97a1ee2df323b263f09ea14165131289cb0f5c19"
+checksum = "980af8b43c3ad5d8d349ace167ec8170839f753a42d233ba19e08afe1850fa69"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.100",
+ "syn 2.0.111",
 ]
 
 [[package]]
@@ -3871,19 +4295,19 @@ checksum = "8eaf4bc02d17cbdd7ff4c7438cafcdf7fb9a4613313ad11b4f8fefe7d3fa0130"
 
 [[package]]
 name = "jobserver"
-version = "0.1.33"
+version = "0.1.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "38f262f097c174adebe41eb73d66ae9c06b2844fb0da69969647bbddd9b0538a"
+checksum = "9afb3de4395d6b3e67a780b6de64b51c978ecf11cb9a462c66be7d4ca9039d33"
 dependencies = [
- "getrandom 0.3.2",
+ "getrandom 0.3.4",
  "libc",
 ]
 
 [[package]]
 name = "js-sys"
-version = "0.3.77"
+version = "0.3.83"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1cfaf33c695fc6e08064efbc1f72ec937429614f25eef83af942d0e227c3a28f"
+checksum = "464a3709c7f55f1f721e5389aa6ea4e3bc6aba669353300af094b29ffbdde1d8"
 dependencies = [
  "once_cell",
  "wasm-bindgen",
@@ -3898,11 +4322,23 @@ dependencies = [
  "tabled",
 ]
 
+[[package]]
+name = "jsonrpc"
+version = "0.1.0"
+source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.61.2#6c229fe6c04fb21ec98751c798e57e9a00e028e2"
+dependencies = [
+ "serde",
+ "serde_json",
+ "thiserror 1.0.69",
+ "tokio",
+ "tracing",
+]
+
 [[package]]
 name = "jsonrpsee"
-version = "0.24.9"
+version = "0.24.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "37b26c20e2178756451cfeb0661fb74c47dd5988cb7e3939de7e9241fd604d42"
+checksum = "e281ae70cc3b98dac15fced3366a880949e65fc66e345ce857a5682d152f3e62"
 dependencies = [
  "jsonrpsee-core",
  "jsonrpsee-http-client",
@@ -3916,13 +4352,13 @@ dependencies = [
 
 [[package]]
 name = "jsonrpsee-client-transport"
-version = "0.24.9"
+version = "0.24.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bacb85abf4117092455e1573625e21b8f8ef4dec8aff13361140b2dc266cdff2"
+checksum = "cc4280b709ac3bb5e16cf3bad5056a0ec8df55fa89edfe996361219aadc2c7ea"
 dependencies = [
  "base64 0.22.1",
  "futures-util",
- "http 1.3.1",
+ "http 1.4.0",
  "jsonrpsee-core",
  "pin-project",
  "rustls",
@@ -3939,15 +4375,15 @@ dependencies = [
 
 [[package]]
 name = "jsonrpsee-core"
-version = "0.24.9"
+version = "0.24.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "456196007ca3a14db478346f58c7238028d55ee15c1df15115596e411ff27925"
+checksum = "348ee569eaed52926b5e740aae20863762b16596476e943c9e415a6479021622"
 dependencies = [
  "async-trait",
  "bytes",
  "futures-timer",
  "futures-util",
- "http 1.3.1",
+ "http 1.4.0",
  "http-body 1.0.1",
  "http-body-util",
  "jsonrpsee-types",
@@ -3965,14 +4401,14 @@ dependencies = [
 
 [[package]]
 name = "jsonrpsee-http-client"
-version = "0.24.9"
+version = "0.24.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c872b6c9961a4ccc543e321bb5b89f6b2d2c7fe8b61906918273a3333c95400c"
+checksum = "f50c389d6e6a52eb7c3548a6600c90cf74d9b71cb5912209833f00a5479e9a01"
 dependencies = [
  "async-trait",
  "base64 0.22.1",
  "http-body 1.0.1",
- "hyper 1.6.0",
+ "hyper 1.8.1",
  "hyper-rustls",
  "hyper-util",
  "jsonrpsee-core",
@@ -3990,28 +4426,28 @@ dependencies = [
 
 [[package]]
 name = "jsonrpsee-proc-macros"
-version = "0.24.9"
+version = "0.24.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e65763c942dfc9358146571911b0cd1c361c2d63e2d2305622d40d36376ca80"
+checksum = "7398cddf5013cca4702862a2692b66c48a3bd6cf6ec681a47453c93d63cf8de5"
 dependencies = [
  "heck 0.5.0",
- "proc-macro-crate 3.3.0",
+ "proc-macro-crate 3.4.0",
  "proc-macro2",
  "quote",
- "syn 2.0.100",
+ "syn 2.0.111",
 ]
 
 [[package]]
 name = "jsonrpsee-server"
-version = "0.24.9"
+version = "0.24.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "55e363146da18e50ad2b51a0a7925fc423137a0b1371af8235b1c231a0647328"
+checksum = "21429bcdda37dcf2d43b68621b994adede0e28061f816b038b0f18c70c143d51"
 dependencies = [
  "futures-util",
- "http 1.3.1",
+ "http 1.4.0",
  "http-body 1.0.1",
  "http-body-util",
- "hyper 1.6.0",
+ "hyper 1.8.1",
  "hyper-util",
  "jsonrpsee-core",
  "jsonrpsee-types",
@@ -4030,11 +4466,11 @@ dependencies = [
 
 [[package]]
 name = "jsonrpsee-types"
-version = "0.24.9"
+version = "0.24.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08a8e70baf945b6b5752fc8eb38c918a48f1234daf11355e07106d963f860089"
+checksum = "b0f05e0028e55b15dbd2107163b3c744cd3bb4474f193f95d9708acbf5677e44"
 dependencies = [
- "http 1.3.1",
+ "http 1.4.0",
  "serde",
  "serde_json",
  "thiserror 1.0.69",
@@ -4042,11 +4478,11 @@ dependencies = [
 
 [[package]]
 name = "jsonrpsee-ws-client"
-version = "0.24.9"
+version = "0.24.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "01b3323d890aa384f12148e8d2a1fd18eb66e9e7e825f9de4fa53bcc19b93eef"
+checksum = "78fc744f17e7926d57f478cf9ca6e1ee5d8332bf0514860b1a3cdf1742e614cc"
 dependencies = [
- "http 1.3.1",
+ "http 1.4.0",
  "jsonrpsee-client-transport",
  "jsonrpsee-core",
  "jsonrpsee-types",
@@ -4071,7 +4507,7 @@ dependencies = [
  "once_cell",
  "percent-encoding",
  "referencing",
- "regex-syntax",
+ "regex-syntax 0.8.8",
  "reqwest",
  "serde",
  "serde_json",
@@ -4087,10 +4523,22 @@ dependencies = [
  "cfg-if",
  "ecdsa 0.14.8",
  "elliptic-curve 0.12.3",
- "sha2 0.10.8",
+ "sha2 0.10.9",
  "sha3",
 ]
 
+[[package]]
+name = "k256"
+version = "0.13.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6e3919bbaa2945715f0bb6d3934a173d1e9a59ac23767fbaaef277265a7411b"
+dependencies = [
+ "cfg-if",
+ "ecdsa 0.16.9",
+ "elliptic-curve 0.13.8",
+ "sha2 0.10.9",
+]
+
 [[package]]
 name = "keccak"
 version = "0.1.5"
@@ -4102,24 +4550,57 @@ dependencies = [
 
 [[package]]
 name = "keyring"
-version = "3.6.2"
+version = "3.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1961983669d57bdfe6c0f3ef8e4c229b5ef751afcc7d87e4271d2f71f6ccfa8b"
+checksum = "eebcc3aff044e5944a8fbaf69eb277d11986064cba30c468730e8b9909fb551c"
 dependencies = [
  "byteorder",
  "dbus-secret-service",
  "linux-keyutils",
  "log",
+ "openssl",
  "security-framework 2.11.1",
- "security-framework 3.2.0",
- "windows-sys 0.59.0",
+ "security-framework 3.5.1",
+ "windows-sys 0.60.2",
+ "zeroize",
+]
+
+[[package]]
+name = "lalrpop"
+version = "0.19.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0a1cbf952127589f2851ab2046af368fd20645491bb4b376f04b7f94d7a9837b"
+dependencies = [
+ "ascii-canvas",
+ "bit-set 0.5.3",
+ "diff",
+ "ena",
+ "is-terminal",
+ "itertools 0.10.5",
+ "lalrpop-util",
+ "petgraph 0.6.5",
+ "regex",
+ "regex-syntax 0.6.29",
+ "string_cache",
+ "term",
+ "tiny-keccak",
+ "unicode-xid",
+]
+
+[[package]]
+name = "lalrpop-util"
+version = "0.19.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3c48237b9604c5a4702de6b824e02006c3214327564636aef27c1028a8fa0ed"
+dependencies = [
+ "regex",
 ]
 
 [[package]]
 name = "lazy-regex"
-version = "3.4.1"
+version = "3.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "60c7310b93682b36b98fa7ea4de998d3463ccbebd94d935d6b48ba5b6ffa7126"
+checksum = "191898e17ddee19e60bccb3945aa02339e81edd4a8c50e21fd4d48cdecda7b29"
 dependencies = [
  "lazy-regex-proc_macros",
  "once_cell",
@@ -4128,14 +4609,14 @@ dependencies = [
 
 [[package]]
 name = "lazy-regex-proc_macros"
-version = "3.4.1"
+version = "3.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ba01db5ef81e17eb10a5e0f2109d1b3a3e29bac3070fdbd7d156bf7dbd206a1"
+checksum = "c35dc8b0da83d1a9507e12122c80dea71a9c7c613014347392483a83ea593e04"
 dependencies = [
  "proc-macro2",
  "quote",
  "regex",
- "syn 2.0.100",
+ "syn 2.0.111",
 ]
 
 [[package]]
@@ -4147,6 +4628,15 @@ dependencies = [
  "spin",
 ]
 
+[[package]]
+name = "lcov"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ccfa6d5e585a884db65b37f38184e4364eaf74d884ac35d0a90fe9baf80b723"
+dependencies = [
+ "thiserror 1.0.69",
+]
+
 [[package]]
 name = "leb128"
 version = "0.2.5"
@@ -4155,9 +4645,9 @@ checksum = "884e2677b40cc8c339eaefcb701c32ef1fd2493d71118dc0ca4b6a736c93bd67"
 
 [[package]]
 name = "libc"
-version = "0.2.171"
+version = "0.2.178"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c19937216e9d3aa9956d9bb8dfc0b0c8beb6058fc4f7a4dc4d850edf86a237d6"
+checksum = "37c93d8daa9d8a012fd8ab92f088405fb202ea0b6ab73ee2482ae66af4f42091"
 
 [[package]]
 name = "libdbus-sys"
@@ -4165,24 +4655,35 @@ version = "0.2.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5cbe856efeb50e4681f010e9aaa2bf0a644e10139e54cde10fc83a307c23bd9f"
 dependencies = [
+ "cc",
  "pkg-config",
 ]
 
+[[package]]
+name = "libloading"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d7c4b02199fee7c5d21a5ae7d8cfa79a6ef5bb2fc834d6e9058e89c825efdc55"
+dependencies = [
+ "cfg-if",
+ "windows-link",
+]
+
 [[package]]
 name = "libm"
-version = "0.2.11"
+version = "0.2.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8355be11b20d696c8f18f6cc018c4e372165b1fa8126cef092399c9951984ffa"
+checksum = "f9fbbcab51052fe104eb5e5d351cf728d30a5be1fe14d9be8a3b097481fb97de"
 
 [[package]]
 name = "libredox"
-version = "0.1.3"
+version = "0.1.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0ff37bd590ca25063e35af745c343cb7a0271906fb7b37e4813e8f79f00268d"
+checksum = "416f7e718bdb06000964960ffa43b4335ad4012ae8b99060261aa4a8088d5ccb"
 dependencies = [
- "bitflags 2.9.0",
+ "bitflags 2.10.0",
  "libc",
- "redox_syscall 0.5.11",
+ "redox_syscall 0.5.18",
 ]
 
 [[package]]
@@ -4191,31 +4692,51 @@ version = "0.5.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0717cef1bc8b636c6e1c1bbdefc09e6322da8a9321966e8928ef80d20f7f770f"
 
+[[package]]
+name = "linkme"
+version = "0.3.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e3283ed2d0e50c06dd8602e0ab319bb048b6325d0bba739db64ed8205179898"
+dependencies = [
+ "linkme-impl",
+]
+
+[[package]]
+name = "linkme-impl"
+version = "0.3.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5cec0ec4228b4853bb129c84dbf093a27e6c7a20526da046defc334a1b017f7"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.111",
+]
+
 [[package]]
 name = "linux-keyutils"
 version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "761e49ec5fd8a5a463f9b84e877c373d888935b71c6be78f3767fe2ae6bed18e"
 dependencies = [
- "bitflags 2.9.0",
+ "bitflags 2.10.0",
  "libc",
 ]
 
 [[package]]
 name = "linux-raw-sys"
-version = "0.9.4"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cd945864f07fe9f5371a27ad7b52a172b4b499999f1d97574c9fa68373937e12"
+checksum = "df1d3c3b53da64cf5760482273a98e575c651a67eec7f77df96b5b642de8f039"
 
 [[package]]
 name = "litemap"
-version = "0.7.5"
+version = "0.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23fb14cb19457329c82206317a5663005a4d404783dc74f4252769b0d5f42856"
+checksum = "6373607a59f0be73a39b6fe456b8192fcc3585f602af20751600e974dd455e77"
 
 [[package]]
 name = "llm-openai-chat-completion"
-version = "0.3.0"
+version = "0.5.0"
 dependencies = [
  "anyhow",
  "async-openai",
@@ -4229,32 +4750,54 @@ dependencies = [
  "portpicker",
  "reqwest",
  "rstest",
- "schemars 1.0.0-alpha.17",
+ "schemars 1.1.0",
  "serde",
  "serde_json",
  "serial_test",
- "strum 0.27.1",
- "strum_macros 0.27.1",
+ "strum 0.27.2",
+ "strum_macros 0.27.2",
  "tokio",
 ]
 
 [[package]]
 name = "lock_api"
-version = "0.4.12"
+version = "0.4.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07af8b9cdd281b7915f413fa73f29ebd5d55d0d3f0155584dade1ff18cea1b17"
+checksum = "224399e74b87b5f3557511d98dff8b14089b3dadafcab6bb93eab67d3aace965"
 dependencies = [
- "autocfg",
  "scopeguard",
 ]
 
 [[package]]
 name = "log"
-version = "0.4.27"
+version = "0.4.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "13dc2df351e3202783a1fe0d44375f7295ffb4049267b0f3018346dc122a1d94"
+checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897"
 dependencies = [
- "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "logos"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf8b031682c67a8e3d5446840f9573eb7fe26efe7ec8d195c9ac4c0647c502f1"
+dependencies = [
+ "logos-derive",
+]
+
+[[package]]
+name = "logos-derive"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1d849148dbaf9661a6151d1ca82b13bb4c4c128146a88d05253b38d4e2f496c"
+dependencies = [
+ "beef",
+ "fnv",
+ "proc-macro2",
+ "quote",
+ "regex-syntax 0.6.29",
+ "syn 1.0.109",
 ]
 
 [[package]]
@@ -4272,16 +4815,26 @@ version = "0.12.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "234cf4f4a04dc1f57e24b96cc0cd600cf2af460d4161ac5ecdd0af8e1f3b2a38"
 dependencies = [
- "hashbrown 0.15.2",
+ "hashbrown 0.15.5",
 ]
 
 [[package]]
-name = "lru-cache"
+name = "lru-slab"
 version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "31e24f1ad8321ca0e8a1e0ac13f23cb668e6f5466c2c57319f6a5cf1cc8e3b1c"
+checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154"
+
+[[package]]
+name = "lsp-types"
+version = "0.94.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c66bfd44a06ae10647fe3f8214762e9369fd4248df1350924b4ef9e770a85ea1"
 dependencies = [
- "linked-hash-map",
+ "bitflags 1.3.2",
+ "serde",
+ "serde_json",
+ "serde_repr",
+ "url",
 ]
 
 [[package]]
@@ -4297,6 +4850,23 @@ dependencies = [
  "url",
 ]
 
+[[package]]
+name = "maplit"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3e2e65a1a2e43cfcb47a895c4c8b10d1f4a61097f9f254f183aee60cad9c651d"
+
+[[package]]
+name = "match-lookup"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1265724d8cb29dbbc2b0f06fffb8bf1a8c0cf73a78eede9ba73a4a66c52a981e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+]
+
 [[package]]
 name = "matchit"
 version = "0.5.0"
@@ -4305,17 +4875,17 @@ checksum = "73cbba799671b762df5a175adf59ce145165747bb891505c43d09aefbbf38beb"
 
 [[package]]
 name = "matchit"
-version = "0.7.3"
+version = "0.8.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e7465ac9959cc2b1404e8e2367b43684a6d13790fe23056cc8c6c5a6b7bcb94"
+checksum = "47e1ffaa40ddd1f3ed91f717a33c8c0ee23fff369e3aa8772b9605cc1d22f4c3"
 
 [[package]]
 name = "math"
-version = "0.3.0"
+version = "0.5.0"
 dependencies = [
  "nexus-sdk",
  "nexus-toolkit",
- "schemars 1.0.0-alpha.17",
+ "schemars 1.1.0",
  "serde",
  "tokio",
 ]
@@ -4332,9 +4902,18 @@ dependencies = [
 
 [[package]]
 name = "memchr"
-version = "2.7.4"
+version = "2.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f52b00d39961fc5b2736ea853c9cc86238e165017a493d1d5c8eac6bdc4cc273"
+
+[[package]]
+name = "memoffset"
+version = "0.6.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78ca9ab1a0babb1e7d5695e3530886289c18cf2f87ec19a575a0abdce112e3a3"
+checksum = "5aa361d4faea93603064a027415f07bd8e1d5c88c9fbf68bf56a285428fd79ce"
+dependencies = [
+ "autocfg",
+]
 
 [[package]]
 name = "mime"
@@ -4354,9 +4933,9 @@ dependencies = [
 
 [[package]]
 name = "minijinja"
-version = "2.9.0"
+version = "2.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "98642a6dfca91122779a307b77cd07a4aa951fbe32232aaf5bad9febc66be754"
+checksum = "0adbe6e92a6ce0fd6c4aac593fdfd3e3950b0f61b1a63aa9731eb6fd85776fa3"
 dependencies = [
  "serde",
 ]
@@ -4369,41 +4948,96 @@ checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
 
 [[package]]
 name = "miniz_oxide"
-version = "0.8.8"
+version = "0.8.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3be647b768db090acb35d5ec5db2b0e1f1de11133ca123b9eacf5137868f892a"
+checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
 dependencies = [
  "adler2",
+ "simd-adler32",
 ]
 
 [[package]]
 name = "mio"
-version = "1.0.3"
+version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2886843bf800fba2e3377cff24abf6379b4c4d5c6681eaf9ea5b0d15090450bd"
+checksum = "a69bcab0ad47271a0234d9422b131806bf3968021e5dc9328caf2d4cd58557fc"
 dependencies = [
  "libc",
- "wasi 0.11.0+wasi-snapshot-preview1",
- "windows-sys 0.52.0",
+ "wasi",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "mockall"
+version = "0.11.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c84490118f2ee2d74570d114f3d0493cbf02790df303d2707606c3e14e07c96"
+dependencies = [
+ "cfg-if",
+ "downcast",
+ "fragile",
+ "lazy_static",
+ "mockall_derive 0.11.4",
+ "predicates 2.1.5",
+ "predicates-tree",
+]
+
+[[package]]
+name = "mockall"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f58d964098a5f9c6b63d0798e5372fd04708193510a7af313c22e9f29b7b620b"
+dependencies = [
+ "cfg-if",
+ "downcast",
+ "fragile",
+ "mockall_derive 0.14.0",
+ "predicates 3.1.3",
+ "predicates-tree",
+]
+
+[[package]]
+name = "mockall_derive"
+version = "0.11.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22ce75669015c4f47b289fd4d4f56e894e4c96003ffdf3ac51313126f94c6cbb"
+dependencies = [
+ "cfg-if",
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "mockall_derive"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca41ce716dda6a9be188b385aa78ee5260fc25cd3802cb2a8afdc6afbe6b6dbf"
+dependencies = [
+ "cfg-if",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.111",
 ]
 
 [[package]]
 name = "mockito"
-version = "1.7.0"
+version = "1.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7760e0e418d9b7e5777c0374009ca4c93861b9066f18cb334a20ce50ab63aa48"
+checksum = "7e0603425789b4a70fcc4ac4f5a46a566c116ee3e2a6b768dc623f7719c611de"
 dependencies = [
  "assert-json-diff",
  "bytes",
  "colored 3.0.0",
- "futures-util",
- "http 1.3.1",
+ "futures-core",
+ "http 1.4.0",
  "http-body 1.0.1",
  "http-body-util",
- "hyper 1.6.0",
+ "hyper 1.8.1",
  "hyper-util",
  "log",
- "rand 0.9.0",
+ "pin-project-lite",
+ "rand 0.9.2",
  "regex",
  "serde_json",
  "serde_urlencoded",
@@ -4412,26 +5046,42 @@ dependencies = [
 ]
 
 [[package]]
-name = "move-abstract-interpreter"
-version = "0.1.0"
-source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.45.3#643cae13d71392a164f427024d899ea49fc97a23"
+name = "moka"
+version = "0.12.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8261cd88c312e0004c1d51baad2980c66528dfdb2bee62003e643a4d8f86b077"
 dependencies = [
- "move-binary-format",
- "move-bytecode-verifier-meter",
+ "crossbeam-channel",
+ "crossbeam-epoch",
+ "crossbeam-utils",
+ "equivalent",
+ "parking_lot",
+ "portable-atomic",
+ "rustc_version",
+ "smallvec",
+ "tagptr",
+ "uuid",
 ]
 
+[[package]]
+name = "move-abstract-interpreter"
+version = "0.1.0"
+source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.61.2#6c229fe6c04fb21ec98751c798e57e9a00e028e2"
+
 [[package]]
 name = "move-abstract-stack"
 version = "0.0.1"
-source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.45.3#643cae13d71392a164f427024d899ea49fc97a23"
+source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.61.2#6c229fe6c04fb21ec98751c798e57e9a00e028e2"
 
 [[package]]
 name = "move-binary-format"
 version = "0.0.3"
-source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.45.3#643cae13d71392a164f427024d899ea49fc97a23"
+source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.61.2#6c229fe6c04fb21ec98751c798e57e9a00e028e2"
 dependencies = [
  "anyhow",
  "enum-compat-util",
+ "indexmap 2.12.1",
+ "move-abstract-interpreter",
  "move-core-types",
  "move-proc-macros",
  "ref-cast",
@@ -4442,12 +5092,12 @@ dependencies = [
 [[package]]
 name = "move-borrow-graph"
 version = "0.0.1"
-source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.45.3#643cae13d71392a164f427024d899ea49fc97a23"
+source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.61.2#6c229fe6c04fb21ec98751c798e57e9a00e028e2"
 
 [[package]]
 name = "move-bytecode-source-map"
 version = "0.1.0"
-source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.45.3#643cae13d71392a164f427024d899ea49fc97a23"
+source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.61.2#6c229fe6c04fb21ec98751c798e57e9a00e028e2"
 dependencies = [
  "anyhow",
  "bcs",
@@ -4463,20 +5113,20 @@ dependencies = [
 [[package]]
 name = "move-bytecode-utils"
 version = "0.1.0"
-source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.45.3#643cae13d71392a164f427024d899ea49fc97a23"
+source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.61.2#6c229fe6c04fb21ec98751c798e57e9a00e028e2"
 dependencies = [
  "anyhow",
- "indexmap 2.9.0",
+ "indexmap 2.12.1",
  "move-binary-format",
  "move-core-types",
- "petgraph 0.5.1",
+ "petgraph 0.8.3",
  "serde-reflection",
 ]
 
 [[package]]
 name = "move-bytecode-verifier"
 version = "0.1.0"
-source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.45.3#643cae13d71392a164f427024d899ea49fc97a23"
+source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.61.2#6c229fe6c04fb21ec98751c798e57e9a00e028e2"
 dependencies = [
  "move-abstract-interpreter",
  "move-abstract-stack",
@@ -4484,14 +5134,15 @@ dependencies = [
  "move-borrow-graph",
  "move-bytecode-verifier-meter",
  "move-core-types",
+ "move-regex-borrow-graph",
  "move-vm-config",
- "petgraph 0.5.1",
+ "petgraph 0.8.3",
 ]
 
 [[package]]
 name = "move-bytecode-verifier-meter"
 version = "0.1.0"
-source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.45.3#643cae13d71392a164f427024d899ea49fc97a23"
+source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.61.2#6c229fe6c04fb21ec98751c798e57e9a00e028e2"
 dependencies = [
  "move-binary-format",
  "move-core-types",
@@ -4501,7 +5152,7 @@ dependencies = [
 [[package]]
 name = "move-command-line-common"
 version = "0.1.0"
-source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.45.3#643cae13d71392a164f427024d899ea49fc97a23"
+source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.61.2#6c229fe6c04fb21ec98751c798e57e9a00e028e2"
 dependencies = [
  "anyhow",
  "bcs",
@@ -4512,6 +5163,7 @@ dependencies = [
  "move-binary-format",
  "move-core-types",
  "once_cell",
+ "packed_struct",
  "serde",
  "sha2 0.9.9",
  "vfs",
@@ -4521,7 +5173,7 @@ dependencies = [
 [[package]]
 name = "move-compiler"
 version = "0.0.1"
-source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.45.3#643cae13d71392a164f427024d899ea49fc97a23"
+source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.61.2#6c229fe6c04fb21ec98751c798e57e9a00e028e2"
 dependencies = [
  "anyhow",
  "bcs",
@@ -4530,7 +5182,8 @@ dependencies = [
  "dunce",
  "hex",
  "insta",
- "lsp-types",
+ "lsp-types 0.95.1",
+ "move-abstract-interpreter",
  "move-binary-format",
  "move-borrow-graph",
  "move-bytecode-source-map",
@@ -4542,7 +5195,7 @@ dependencies = [
  "move-proc-macros",
  "move-symbol-pool",
  "once_cell",
- "petgraph 0.5.1",
+ "petgraph 0.8.3",
  "rayon",
  "regex",
  "serde",
@@ -4556,13 +5209,14 @@ dependencies = [
 [[package]]
 name = "move-core-types"
 version = "0.0.4"
-source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.45.3#643cae13d71392a164f427024d899ea49fc97a23"
+source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.61.2#6c229fe6c04fb21ec98751c798e57e9a00e028e2"
 dependencies = [
  "anyhow",
  "bcs",
  "enum-compat-util",
  "ethnum",
  "hex",
+ "indexmap 2.12.1",
  "leb128",
  "move-proc-macros",
  "num",
@@ -4580,28 +5234,32 @@ dependencies = [
 [[package]]
 name = "move-coverage"
 version = "0.1.0"
-source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.45.3#643cae13d71392a164f427024d899ea49fc97a23"
+source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.61.2#6c229fe6c04fb21ec98751c798e57e9a00e028e2"
 dependencies = [
  "anyhow",
  "bcs",
  "clap",
  "codespan",
  "colored 2.2.0",
- "indexmap 2.9.0",
+ "indexmap 2.12.1",
+ "lcov",
  "move-abstract-interpreter",
  "move-binary-format",
  "move-bytecode-source-map",
+ "move-bytecode-verifier",
  "move-command-line-common",
+ "move-compiler",
  "move-core-types",
  "move-ir-types",
- "petgraph 0.5.1",
+ "move-trace-format",
+ "petgraph 0.8.3",
  "serde",
 ]
 
 [[package]]
 name = "move-disassembler"
 version = "0.1.0"
-source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.45.3#643cae13d71392a164f427024d899ea49fc97a23"
+source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.61.2#6c229fe6c04fb21ec98751c798e57e9a00e028e2"
 dependencies = [
  "anyhow",
  "bcs",
@@ -4622,7 +5280,7 @@ dependencies = [
 [[package]]
 name = "move-docgen"
 version = "0.1.0"
-source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.45.3#643cae13d71392a164f427024d899ea49fc97a23"
+source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.61.2#6c229fe6c04fb21ec98751c798e57e9a00e028e2"
 dependencies = [
  "anyhow",
  "clap",
@@ -4645,7 +5303,7 @@ dependencies = [
 [[package]]
 name = "move-ir-to-bytecode"
 version = "0.1.0"
-source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.45.3#643cae13d71392a164f427024d899ea49fc97a23"
+source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.61.2#6c229fe6c04fb21ec98751c798e57e9a00e028e2"
 dependencies = [
  "anyhow",
  "codespan-reporting",
@@ -4663,7 +5321,7 @@ dependencies = [
 [[package]]
 name = "move-ir-to-bytecode-syntax"
 version = "0.1.0"
-source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.45.3#643cae13d71392a164f427024d899ea49fc97a23"
+source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.61.2#6c229fe6c04fb21ec98751c798e57e9a00e028e2"
 dependencies = [
  "anyhow",
  "hex",
@@ -4676,7 +5334,7 @@ dependencies = [
 [[package]]
 name = "move-ir-types"
 version = "0.1.0"
-source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.45.3#643cae13d71392a164f427024d899ea49fc97a23"
+source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.61.2#6c229fe6c04fb21ec98751c798e57e9a00e028e2"
 dependencies = [
  "hex",
  "move-command-line-common",
@@ -4689,12 +5347,13 @@ dependencies = [
 [[package]]
 name = "move-model-2"
 version = "0.1.0"
-source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.45.3#643cae13d71392a164f427024d899ea49fc97a23"
+source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.61.2#6c229fe6c04fb21ec98751c798e57e9a00e028e2"
 dependencies = [
  "anyhow",
  "bcs",
  "codespan",
  "codespan-reporting",
+ "indexmap 2.12.1",
  "move-binary-format",
  "move-bytecode-source-map",
  "move-command-line-common",
@@ -4704,6 +5363,7 @@ dependencies = [
  "move-ir-types",
  "move-symbol-pool",
  "num",
+ "pretty_simple",
  "serde",
  "vfs",
 ]
@@ -4711,11 +5371,12 @@ dependencies = [
 [[package]]
 name = "move-package"
 version = "0.1.0"
-source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.45.3#643cae13d71392a164f427024d899ea49fc97a23"
+source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.61.2#6c229fe6c04fb21ec98751c798e57e9a00e028e2"
 dependencies = [
  "anyhow",
  "clap",
  "colored 2.2.0",
+ "dunce",
  "itertools 0.10.5",
  "move-binary-format",
  "move-bytecode-source-map",
@@ -4729,14 +5390,14 @@ dependencies = [
  "move-symbol-pool",
  "named-lock",
  "once_cell",
- "petgraph 0.5.1",
+ "petgraph 0.8.3",
  "regex",
  "serde",
  "serde_yaml",
  "sha2 0.9.9",
  "tempfile",
  "toml 0.5.11",
- "toml_edit 0.14.4",
+ "toml_edit 0.22.27",
  "treeline",
  "vfs",
  "walkdir",
@@ -4746,27 +5407,51 @@ dependencies = [
 [[package]]
 name = "move-proc-macros"
 version = "0.1.0"
-source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.45.3#643cae13d71392a164f427024d899ea49fc97a23"
+source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.61.2#6c229fe6c04fb21ec98751c798e57e9a00e028e2"
 dependencies = [
  "enum-compat-util",
  "quote",
- "syn 2.0.100",
+ "syn 2.0.111",
 ]
 
 [[package]]
-name = "move-symbol-pool"
-version = "0.1.0"
-source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.45.3#643cae13d71392a164f427024d899ea49fc97a23"
+name = "move-regex-borrow-graph"
+version = "0.0.1"
+source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.61.2#6c229fe6c04fb21ec98751c798e57e9a00e028e2"
 dependencies = [
- "once_cell",
- "phf",
+ "itertools 0.10.5",
+ "move-binary-format",
+ "move-core-types",
+ "petgraph 0.8.3",
+ "proptest",
+]
+
+[[package]]
+name = "move-symbol-pool"
+version = "0.1.0"
+source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.61.2#6c229fe6c04fb21ec98751c798e57e9a00e028e2"
+dependencies = [
+ "once_cell",
+ "phf",
+ "serde",
+]
+
+[[package]]
+name = "move-trace-format"
+version = "0.0.1"
+source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.61.2#6c229fe6c04fb21ec98751c798e57e9a00e028e2"
+dependencies = [
+ "move-binary-format",
+ "move-core-types",
  "serde",
+ "serde_json",
+ "zstd",
 ]
 
 [[package]]
 name = "move-vm-config"
 version = "0.1.0"
-source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.45.3#643cae13d71392a164f427024d899ea49fc97a23"
+source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.61.2#6c229fe6c04fb21ec98751c798e57e9a00e028e2"
 dependencies = [
  "move-binary-format",
  "once_cell",
@@ -4775,8 +5460,9 @@ dependencies = [
 [[package]]
 name = "move-vm-profiler"
 version = "0.1.0"
-source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.45.3#643cae13d71392a164f427024d899ea49fc97a23"
+source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.61.2#6c229fe6c04fb21ec98751c798e57e9a00e028e2"
 dependencies = [
+ "move-trace-format",
  "move-vm-config",
  "once_cell",
  "serde",
@@ -4787,7 +5473,7 @@ dependencies = [
 [[package]]
 name = "move-vm-test-utils"
 version = "0.1.0"
-source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.45.3#643cae13d71392a164f427024d899ea49fc97a23"
+source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.61.2#6c229fe6c04fb21ec98751c798e57e9a00e028e2"
 dependencies = [
  "anyhow",
  "move-binary-format",
@@ -4801,7 +5487,7 @@ dependencies = [
 [[package]]
 name = "move-vm-types"
 version = "0.1.0"
-source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.45.3#643cae13d71392a164f427024d899ea49fc97a23"
+source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.61.2#6c229fe6c04fb21ec98751c798e57e9a00e028e2"
 dependencies = [
  "bcs",
  "move-binary-format",
@@ -4814,7 +5500,7 @@ dependencies = [
 [[package]]
 name = "msim-macros"
 version = "0.1.0"
-source = "git+https://github.com/MystenLabs/mysten-sim.git?rev=9f175e3517812929ad6bdd8db443f1bbd8107965#9f175e3517812929ad6bdd8db443f1bbd8107965"
+source = "git+https://github.com/MystenLabs/mysten-sim.git?rev=427147994705914a2f5afa42bc140794e31113b9#427147994705914a2f5afa42bc140794e31113b9"
 dependencies = [
  "darling 0.14.4",
  "proc-macro2",
@@ -4861,11 +5547,12 @@ dependencies = [
 
 [[package]]
 name = "multibase"
-version = "0.9.1"
+version = "0.9.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b3539ec3c1f04ac9748a260728e855f261b4977f5c3406612c884564f329404"
+checksum = "8694bb4835f452b0e3bb06dbebb1d6fc5385b6ca1caf2e55fd165c042390ec77"
 dependencies = [
  "base-x",
+ "base256emoji",
  "data-encoding",
  "data-encoding-macro",
 ]
@@ -4898,18 +5585,22 @@ dependencies = [
 [[package]]
 name = "mysten-common"
 version = "0.1.0"
-source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.45.3#643cae13d71392a164f427024d899ea49fc97a23"
+source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.61.2#6c229fe6c04fb21ec98751c798e57e9a00e028e2"
 dependencies = [
+ "antithesis_sdk",
  "anyhow",
+ "either",
  "fastcrypto",
  "futures",
  "mysten-metrics",
+ "once_cell",
  "parking_lot",
- "prometheus",
+ "rand 0.8.5",
  "reqwest",
+ "serde_json",
  "snap",
- "sui-tls",
- "sui-types",
+ "sui-macros",
+ "tempfile",
  "tokio",
  "tracing",
 ]
@@ -4917,7 +5608,7 @@ dependencies = [
 [[package]]
 name = "mysten-metrics"
 version = "0.7.0"
-source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.45.3#643cae13d71392a164f427024d899ea49fc97a23"
+source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.61.2#6c229fe6c04fb21ec98751c798e57e9a00e028e2"
 dependencies = [
  "async-trait",
  "axum",
@@ -4938,23 +5629,30 @@ dependencies = [
 [[package]]
 name = "mysten-network"
 version = "0.2.0"
-source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.45.3#643cae13d71392a164f427024d899ea49fc97a23"
+source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.61.2#6c229fe6c04fb21ec98751c798e57e9a00e028e2"
 dependencies = [
  "anemo",
  "anemo-tower",
+ "anyhow",
  "async-stream",
  "bcs",
  "bytes",
+ "dashmap",
  "eyre",
+ "fastcrypto",
  "futures",
- "http 1.3.1",
+ "http 1.4.0",
  "http-body 1.0.1",
  "hyper-rustls",
  "hyper-util",
  "multiaddr",
+ "mysten-metrics",
  "once_cell",
  "pin-project-lite",
  "prometheus",
+ "quinn-proto",
+ "rand 0.8.5",
+ "rustls",
  "serde",
  "snap",
  "sui-http",
@@ -4963,8 +5661,8 @@ dependencies = [
  "tokio-stream",
  "tonic",
  "tonic-health",
- "tower 0.4.13",
- "tower-http",
+ "tower 0.5.2",
+ "tower-http 0.5.2",
  "tracing",
 ]
 
@@ -5018,22 +5716,31 @@ dependencies = [
  "trait-set",
 ]
 
+[[package]]
+name = "new_debug_unreachable"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "650eef8c711430f1a879fdd01d4745a7deea475becfb90269c06775983bbf086"
+
 [[package]]
 name = "nexus-cli"
-version = "0.3.0"
+version = "0.5.0"
 dependencies = [
  "aes-gcm",
  "anyhow",
  "argon2",
  "assert_fs",
  "assert_matches",
+ "base64 0.21.7",
  "bincode",
  "chrono",
  "clap",
+ "clap-verbosity",
  "clap_complete",
  "colored 3.0.0",
  "convert_case 0.7.1",
  "directories",
+ "env_logger",
  "hex",
  "home",
  "indicatif",
@@ -5048,14 +5755,14 @@ dependencies = [
  "reqwest",
  "rpassword",
  "rstest",
- "schemars 1.0.0-alpha.17",
+ "schemars 1.1.0",
  "serde",
  "serde_json",
  "serial_test",
  "tempfile",
- "thiserror 2.0.12",
+ "thiserror 2.0.17",
  "tokio",
- "toml 0.8.20",
+ "toml 0.8.23",
  "warp",
  "x25519-dalek",
  "zeroize",
@@ -5063,7 +5770,7 @@ dependencies = [
 
 [[package]]
 name = "nexus-sdk"
-version = "0.3.0"
+version = "0.5.0"
 dependencies = [
  "aead",
  "aes-gcm",
@@ -5071,6 +5778,7 @@ dependencies = [
  "anyhow",
  "assert_matches",
  "base64 0.21.7",
+ "bcs",
  "bincode",
  "blake3",
  "chacha20poly1305",
@@ -5080,14 +5788,18 @@ dependencies = [
  "enum_dispatch",
  "futures",
  "futures-util",
+ "graphql_client",
  "hex",
  "hkdf",
  "hmac",
  "lazy-regex",
  "lru 0.12.5",
+ "mockall 0.14.0",
  "mockito",
- "move-core-types",
+ "move-package",
  "petgraph 0.7.1",
+ "portpicker",
+ "prost-types",
  "rand 0.8.5",
  "rand_core 0.6.4",
  "regex",
@@ -5096,20 +5808,22 @@ dependencies = [
  "serde-big-array",
  "serde_bytes",
  "serde_json",
- "sha2 0.10.8",
- "shared-crypto",
+ "serde_repr",
+ "sha2 0.10.9",
  "subtle",
- "sui-config",
- "sui-keys",
+ "sui-crypto",
  "sui-move-build",
  "sui-package-management",
- "sui-sdk",
+ "sui-rpc 0.1.0",
+ "sui-sdk-types 0.1.0",
+ "sui-transaction-builder 0.1.0",
  "tempfile",
  "testcontainers-modules",
- "thiserror 2.0.12",
+ "thiserror 2.0.17",
  "tokio",
  "tokio-retry",
- "toml 0.8.20",
+ "toml 0.8.23",
+ "tonic",
  "x25519-dalek",
  "xeddsa",
  "zeroize",
@@ -5143,14 +5857,14 @@ dependencies = [
 
 [[package]]
 name = "nexus-toolkit"
-version = "0.3.0"
+version = "0.5.0"
 dependencies = [
  "anyhow",
  "env_logger",
  "log",
  "nexus-sdk",
  "reqwest",
- "schemars 1.0.0-alpha.17",
+ "schemars 1.1.0",
  "serde",
  "serde_json",
  "serde_path_to_error",
@@ -5158,6 +5872,27 @@ dependencies = [
  "warp",
 ]
 
+[[package]]
+name = "nibble_vec"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77a5d83df9f36fe23f0c3648c6bbb8b0298bb5f1939c8f2704431371f4b84d43"
+dependencies = [
+ "smallvec",
+]
+
+[[package]]
+name = "nix"
+version = "0.28.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ab2156c4fce2f8df6c499cc1c763e4394b7482525bf2a9701c9d79d215f519e4"
+dependencies = [
+ "bitflags 2.10.0",
+ "cfg-if",
+ "cfg_aliases 0.1.1",
+ "libc",
+]
+
 [[package]]
 name = "no-std-compat"
 version = "0.4.1"
@@ -5186,6 +5921,12 @@ version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "38bf9645c8b145698bb0b18a4637dcacbc421ea49bef2317e4fd8065a387cf21"
 
+[[package]]
+name = "normalize-line-endings"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61807f77802ff30975e01f4f071c8ba10c022052f98b3294119f3e615d13e5be"
+
 [[package]]
 name = "num"
 version = "0.4.3"
@@ -5224,11 +5965,10 @@ dependencies = [
 
 [[package]]
 name = "num-bigint-dig"
-version = "0.8.4"
+version = "0.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc84195820f291c7697304f3cbdadd1cb7199c0efc917ff5eafd71225c136151"
+checksum = "e661dda6640fad38e827a6d4a310ff4763082116fe217f279885c97f511bb0b7"
 dependencies = [
- "byteorder",
  "lazy_static",
  "libm",
  "num-integer",
@@ -5303,9 +6043,9 @@ dependencies = [
 
 [[package]]
 name = "num_cpus"
-version = "1.16.0"
+version = "1.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4161fcb6d602d4d2081af7c3a45852d875a03dd337a6bfdd6e06407b61342a43"
+checksum = "91df4bbde75afed763b708b7eee1e8e7651e02d97f6d5dd763e89367e957b23b"
 dependencies = [
  "hermit-abi",
  "libc",
@@ -5329,7 +6069,7 @@ dependencies = [
  "proc-macro-crate 1.1.3",
  "proc-macro2",
  "quote",
- "syn 2.0.100",
+ "syn 2.0.111",
 ]
 
 [[package]]
@@ -5368,18 +6108,27 @@ version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7dfe4c99deecc1a12b90d134256879897827028925bce89cea2f51469599dd91"
 dependencies = [
- "proc-macro-crate 3.3.0",
+ "proc-macro-crate 3.4.0",
  "proc-macro-error",
  "proc-macro2",
  "quote",
- "syn 2.0.100",
+ "syn 2.0.111",
 ]
 
 [[package]]
 name = "object"
-version = "0.36.7"
+version = "0.32.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62948e14d923ea95ea2c7c86c71013138b66525b86bdc08d2dcc262bdb497b87"
+checksum = "a6a622008b6e321afc04970976f62ee297fdbaa6f95318ca343e3eebb9648441"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "object"
+version = "0.37.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff76201f031d8863c38aa7f905eca4f53abbfa15f609db4277d44cd8938f33fe"
 dependencies = [
  "memchr",
 ]
@@ -5397,7 +6146,7 @@ dependencies = [
  "futures",
  "httparse",
  "humantime",
- "hyper 1.6.0",
+ "hyper 1.8.1",
  "itertools 0.13.0",
  "md-5",
  "parking_lot",
@@ -5430,6 +6179,16 @@ name = "once_cell"
 version = "1.21.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
+dependencies = [
+ "critical-section",
+ "portable-atomic",
+]
+
+[[package]]
+name = "once_cell_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
 
 [[package]]
 name = "opaque-debug"
@@ -5439,11 +6198,11 @@ checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
 
 [[package]]
 name = "openssl"
-version = "0.10.72"
+version = "0.10.75"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fedfea7d58a1f73118430a55da6a286e7b044961736ce96a16a17068ea25e5da"
+checksum = "08838db121398ad17ab8531ce9de97b244589089e290a384c900cb9ff7434328"
 dependencies = [
- "bitflags 2.9.0",
+ "bitflags 2.10.0",
  "cfg-if",
  "foreign-types",
  "libc",
@@ -5460,7 +6219,7 @@ checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.100",
+ "syn 2.0.111",
 ]
 
 [[package]]
@@ -5471,18 +6230,18 @@ checksum = "d05e27ee213611ffe7d6348b942e8f942b37114c00cc03cec254295a4a17852e"
 
 [[package]]
 name = "openssl-src"
-version = "300.5.0+3.5.0"
+version = "300.5.4+3.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e8ce546f549326b0e6052b649198487d91320875da901e7bd11a06d1ee3f9c2f"
+checksum = "a507b3792995dae9b0df8a1c1e3771e8418b7c2d9f0baeba32e6fe8b06c7cb72"
 dependencies = [
  "cc",
 ]
 
 [[package]]
 name = "openssl-sys"
-version = "0.9.107"
+version = "0.9.111"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8288979acd84749c744a9014b4382d42b8f7b2592847b5afb2ed29e5d16ede07"
+checksum = "82cab2d520aa75e3c58898289429321eb788c3106963d0dc886ec7a5f4adc321"
 dependencies = [
  "cc",
  "libc",
@@ -5518,7 +6277,7 @@ dependencies = [
  "proc-macro-error",
  "proc-macro2",
  "quote",
- "syn 2.0.100",
+ "syn 2.0.111",
 ]
 
 [[package]]
@@ -5536,7 +6295,7 @@ dependencies = [
  "ecdsa 0.16.9",
  "elliptic-curve 0.13.8",
  "primeorder",
- "sha2 0.10.8",
+ "sha2 0.10.9",
 ]
 
 [[package]]
@@ -5548,7 +6307,29 @@ dependencies = [
  "ecdsa 0.16.9",
  "elliptic-curve 0.13.8",
  "primeorder",
- "sha2 0.10.8",
+ "sha2 0.10.9",
+]
+
+[[package]]
+name = "packed_struct"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "36b29691432cc9eff8b282278473b63df73bea49bc3ec5e67f31a3ae9c3ec190"
+dependencies = [
+ "bitvec 1.0.1",
+ "packed_struct_codegen",
+ "serde",
+]
+
+[[package]]
+name = "packed_struct_codegen"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9cd6706dfe50d53e0f6aa09e12c034c44faacd23e966ae5a209e8bdb8f179f98"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
 ]
 
 [[package]]
@@ -5599,9 +6380,9 @@ dependencies = [
 
 [[package]]
 name = "parking_lot"
-version = "0.12.3"
+version = "0.12.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1bf18183cf54e8d6059647fc3063646a1801cf30896933ec2311622cc4b9a27"
+checksum = "93857453250e3077bd71ff98b6a65ea6621a19bb0f559a85248955ac12c45a1a"
 dependencies = [
  "lock_api",
  "parking_lot_core",
@@ -5609,15 +6390,15 @@ dependencies = [
 
 [[package]]
 name = "parking_lot_core"
-version = "0.9.10"
+version = "0.9.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e401f977ab385c9e4e3ab30627d6f26d00e2c73eef317493c4ec6d468726cf8"
+checksum = "2621685985a2ebf1c516881c026032ac7deafcda1a2c9b7850dc81e3dfcb64c1"
 dependencies = [
  "cfg-if",
  "libc",
- "redox_syscall 0.5.11",
+ "redox_syscall 0.5.18",
  "smallvec",
- "windows-targets 0.52.6",
+ "windows-link",
 ]
 
 [[package]]
@@ -5628,7 +6409,7 @@ checksum = "914a1c2265c98e2446911282c6ac86d8524f495792c38c5bd884f80499c7538a"
 dependencies = [
  "parse-display-derive",
  "regex",
- "regex-syntax",
+ "regex-syntax 0.8.8",
 ]
 
 [[package]]
@@ -5640,9 +6421,9 @@ dependencies = [
  "proc-macro2",
  "quote",
  "regex",
- "regex-syntax",
+ "regex-syntax 0.8.8",
  "structmeta",
- "syn 2.0.100",
+ "syn 2.0.111",
 ]
 
 [[package]]
@@ -5651,17 +6432,17 @@ version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "77144664f6aac5f629d7efa815f5098a054beeeca6ccafee5ec453fd2b0c53f9"
 dependencies = [
- "bitflags 2.9.0",
+ "bitflags 2.10.0",
  "ciborium",
  "coset",
  "data-encoding",
- "getrandom 0.2.15",
+ "getrandom 0.2.16",
  "hmac",
- "indexmap 2.9.0",
+ "indexmap 2.12.1",
  "rand 0.8.5",
  "serde",
  "serde_json",
- "sha2 0.10.8",
+ "sha2 0.10.9",
  "strum 0.25.0",
  "typeshare",
  "zeroize",
@@ -5712,12 +6493,12 @@ dependencies = [
 
 [[package]]
 name = "pem"
-version = "3.0.5"
+version = "3.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "38af38e8470ac9dee3ce1bae1af9c1671fffc44ddfd8bd1d0a3445bf349a8ef3"
+checksum = "1d30c53c26bc5b31a98cd02d20f25a7c8567146caf63ed593a9d87b2775291be"
 dependencies = [
  "base64 0.22.1",
- "serde",
+ "serde_core",
 ]
 
 [[package]]
@@ -5740,73 +6521,40 @@ dependencies = [
 
 [[package]]
 name = "percent-encoding"
-version = "2.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3148f5046208a5d56bcfc03053e3ca6334e51da8dfb19b6cdc8b306fae3283e"
-
-[[package]]
-name = "pest"
-version = "2.8.0"
+version = "2.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "198db74531d58c70a361c42201efde7e2591e976d518caf7662a47dc5720e7b6"
-dependencies = [
- "memchr",
- "thiserror 2.0.12",
- "ucd-trie",
-]
-
-[[package]]
-name = "pest_derive"
-version = "2.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d725d9cfd79e87dccc9341a2ef39d1b6f6353d68c4b33c177febbe1a402c97c5"
-dependencies = [
- "pest",
- "pest_generator",
-]
-
-[[package]]
-name = "pest_generator"
-version = "2.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "db7d01726be8ab66ab32f9df467ae8b1148906685bbe75c82d1e65d7f5b3f841"
-dependencies = [
- "pest",
- "pest_meta",
- "proc-macro2",
- "quote",
- "syn 2.0.100",
-]
+checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
 
 [[package]]
-name = "pest_meta"
-version = "2.8.0"
+name = "petgraph"
+version = "0.6.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f9f832470494906d1fca5329f8ab5791cc60beb230c74815dff541cbd2b5ca0"
+checksum = "b4c5cc86750666a3ed20bdaf5ca2a0344f9c67674cae0515bec2da16fbaa47db"
 dependencies = [
- "once_cell",
- "pest",
- "sha2 0.10.8",
+ "fixedbitset 0.4.2",
+ "indexmap 2.12.1",
 ]
 
 [[package]]
 name = "petgraph"
-version = "0.5.1"
+version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "467d164a6de56270bd7c4d070df81d07beace25012d5103ced4e9ff08d6afdb7"
+checksum = "3672b37090dbd86368a4145bc067582552b29c27377cad4e0a306c97f9bd7772"
 dependencies = [
- "fixedbitset 0.2.0",
- "indexmap 1.9.3",
+ "fixedbitset 0.5.7",
+ "indexmap 2.12.1",
 ]
 
 [[package]]
 name = "petgraph"
-version = "0.7.1"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3672b37090dbd86368a4145bc067582552b29c27377cad4e0a306c97f9bd7772"
+checksum = "8701b58ea97060d5e5b155d383a69952a60943f0e6dfe30b04c287beb0b27455"
 dependencies = [
  "fixedbitset 0.5.7",
- "indexmap 2.9.0",
+ "hashbrown 0.15.5",
+ "indexmap 2.12.1",
+ "serde",
 ]
 
 [[package]]
@@ -5839,7 +6587,7 @@ dependencies = [
  "phf_shared",
  "proc-macro2",
  "quote",
- "syn 2.0.100",
+ "syn 2.0.111",
 ]
 
 [[package]]
@@ -5868,7 +6616,7 @@ checksum = "6e918e4ff8c4549eb882f14b3a4bc8c8bc93de829416eacf579f1207a8fbf861"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.100",
+ "syn 2.0.111",
 ]
 
 [[package]]
@@ -5911,7 +6659,7 @@ version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7"
 dependencies = [
- "der 0.7.9",
+ "der 0.7.10",
  "spki 0.7.3",
 ]
 
@@ -5946,9 +6694,9 @@ dependencies = [
 
 [[package]]
 name = "portable-atomic"
-version = "1.11.0"
+version = "1.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "350e9b48cbc6b0e028b0473b114454c6316e57336ee184ceab6e53f72c178b3e"
+checksum = "f84267b20a16ea918e43c6a88433c2d54fa145c92a811b5b047ccbe153674483"
 
 [[package]]
 name = "portable-atomic-util"
@@ -5968,6 +6716,15 @@ dependencies = [
  "rand 0.8.5",
 ]
 
+[[package]]
+name = "potential_utf"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b73949432f5e2a09657003c25bca5e19a0e9c84f8058ca374f49e0ebe605af77"
+dependencies = [
+ "zerovec",
+]
+
 [[package]]
 name = "powerfmt"
 version = "0.2.0"
@@ -5980,7 +6737,27 @@ version = "0.2.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
 dependencies = [
- "zerocopy 0.8.24",
+ "zerocopy",
+]
+
+[[package]]
+name = "precomputed-hash"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "925383efa346730478fb4838dbe9137d2a47675ad789c546d150a6e1dd4ab31c"
+
+[[package]]
+name = "predicates"
+version = "2.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59230a63c37f3e18569bdb90e4a89cbf5bf8b06fea0b84e65ea10cc4df47addd"
+dependencies = [
+ "difflib",
+ "float-cmp",
+ "itertools 0.10.5",
+ "normalize-line-endings",
+ "predicates-core",
+ "regex",
 ]
 
 [[package]]
@@ -6010,6 +6787,16 @@ dependencies = [
  "termtree",
 ]
 
+[[package]]
+name = "pretty_simple"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce5f33f1e15ede98d6bf380779f1d4cd90ca3f0943c0aab6637c60fcdd7d9024"
+dependencies = [
+ "insta",
+ "once_cell",
+]
+
 [[package]]
 name = "primeorder"
 version = "0.13.6"
@@ -6043,11 +6830,11 @@ dependencies = [
 
 [[package]]
 name = "proc-macro-crate"
-version = "3.3.0"
+version = "3.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "edce586971a4dfaa28950c6f18ed55e0406c1ab88bbce2c6f6293a7aaba73d35"
+checksum = "219cb19e96be00ab2e37d6e299658a0cfa83e52429179969b0f0121b4ac46983"
 dependencies = [
- "toml_edit 0.22.24",
+ "toml_edit 0.23.9",
 ]
 
 [[package]]
@@ -6076,9 +6863,9 @@ dependencies = [
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.94"
+version = "1.0.103"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a31971752e70b8b2686d7e46ec17fb38dad4051d94024c88df49b667caea9c84"
+checksum = "5ee95bc4ef87b8d5ba32e8b7714ccc834865276eab0aed5c9958d00ec45f49e8"
 dependencies = [
  "unicode-ident",
 ]
@@ -6101,7 +6888,7 @@ dependencies = [
 [[package]]
 name = "prometheus-closure-metric"
 version = "0.1.0"
-source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.45.3#643cae13d71392a164f427024d899ea49fc97a23"
+source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.61.2#6c229fe6c04fb21ec98751c798e57e9a00e028e2"
 dependencies = [
  "anyhow",
  "prometheus",
@@ -6110,19 +6897,18 @@ dependencies = [
 
 [[package]]
 name = "proptest"
-version = "1.6.0"
+version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "14cae93065090804185d3b75f0bf93b8eeda30c7a9b4a33d3bdb3988d6229e50"
+checksum = "bee689443a2bd0a16ab0348b52ee43e3b2d1b1f931c8aa5c9f8de4c86fbe8c40"
 dependencies = [
- "bit-set",
- "bit-vec",
- "bitflags 2.9.0",
- "lazy_static",
+ "bit-set 0.8.0",
+ "bit-vec 0.8.0",
+ "bitflags 2.10.0",
  "num-traits",
- "rand 0.8.5",
- "rand_chacha 0.3.1",
- "rand_xorshift",
- "regex-syntax",
+ "rand 0.9.2",
+ "rand_chacha 0.9.0",
+ "rand_xorshift 0.4.0",
+ "regex-syntax 0.8.8",
  "rusty-fork",
  "tempfile",
  "unarray",
@@ -6136,14 +6922,14 @@ checksum = "4ee1c9ac207483d5e7db4940700de86a9aae46ef90c48b57f99fe7edb8345e49"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.100",
+ "syn 2.0.111",
 ]
 
 [[package]]
 name = "prost"
-version = "0.13.5"
+version = "0.14.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2796faa41db3ec313a31f7624d9286acf277b52de526150b7e69f3debf891ee5"
+checksum = "7231bd9b3d3d33c86b58adbac74b5ec0ad9f496b19d22801d773636feaa95f3d"
 dependencies = [
  "bytes",
  "prost-derive",
@@ -6151,22 +6937,22 @@ dependencies = [
 
 [[package]]
 name = "prost-derive"
-version = "0.13.5"
+version = "0.14.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a56d757972c98b346a9b766e3f02746cde6dd1cd1d1d563472929fdd74bec4d"
+checksum = "9120690fafc389a67ba3803df527d0ec9cbbc9cc45e4cc20b332996dfb672425"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
  "proc-macro2",
  "quote",
- "syn 2.0.100",
+ "syn 2.0.111",
 ]
 
 [[package]]
 name = "prost-types"
-version = "0.13.5"
+version = "0.14.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "52c2c1bf36ddb1a1c396b3601a3cec27c2462e45f07c386894ec3ccf5332bd16"
+checksum = "b9b4db3d6da204ed77bb26ba83b6122a73aeb2e87e25fbf7ad2e84c4ccbf8f72"
 dependencies = [
  "prost",
 ]
@@ -6182,24 +6968,25 @@ dependencies = [
 
 [[package]]
 name = "psm"
-version = "0.1.25"
+version = "0.1.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f58e5423e24c18cc840e1c98370b3993c6649cd1678b4d24318bcf0a083cbe88"
+checksum = "d11f2fedc3b7dafdc2851bc52f277377c5473d378859be234bc7ebb593144d01"
 dependencies = [
+ "ar_archive_writer",
  "cc",
 ]
 
 [[package]]
 name = "quanta"
-version = "0.12.5"
+version = "0.12.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3bd1fe6824cea6538803de3ff1bc0cf3949024db3d43c9643024bfb33a807c0e"
+checksum = "f3ab5a9d756f0d97bdc89019bd2e4ea098cf9cde50ee7564dde6b81ccc8f06c7"
 dependencies = [
  "crossbeam-utils",
  "libc",
  "once_cell",
  "raw-cpuid",
- "wasi 0.11.0+wasi-snapshot-preview1",
+ "wasi",
  "web-sys",
  "winapi",
 ]
@@ -6212,9 +6999,9 @@ checksum = "a1d01941d82fa2ab50be1e79e6714289dd7cde78eba4c074bc5a4374f650dfe0"
 
 [[package]]
 name = "quick-xml"
-version = "0.37.4"
+version = "0.37.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4ce8c88de324ff838700f36fb6ab86c96df0e3c4ab6ef3a9b2044465cce1369"
+checksum = "331e97a1af0bf59823e6eadffe373d7b27f485be8748f71471c662c1f269b7fb"
 dependencies = [
  "memchr",
  "serde",
@@ -6222,20 +7009,20 @@ dependencies = [
 
 [[package]]
 name = "quinn"
-version = "0.11.7"
+version = "0.11.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c3bd15a6f2967aef83887dcb9fec0014580467e33720d073560cf015a5683012"
+checksum = "b9e20a958963c291dc322d98411f541009df2ced7b5a4f2bd52337638cfccf20"
 dependencies = [
  "bytes",
- "cfg_aliases",
+ "cfg_aliases 0.2.1",
  "futures-io",
  "pin-project-lite",
  "quinn-proto",
  "quinn-udp",
  "rustc-hash 2.1.1",
  "rustls",
- "socket2",
- "thiserror 2.0.12",
+ "socket2 0.6.1",
+ "thiserror 2.0.17",
  "tokio",
  "tracing",
  "web-time",
@@ -6243,19 +7030,21 @@ dependencies = [
 
 [[package]]
 name = "quinn-proto"
-version = "0.11.10"
+version = "0.11.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b820744eb4dc9b57a3398183639c511b5a26d2ed702cedd3febaa1393caa22cc"
+checksum = "f1906b49b0c3bc04b5fe5d86a77925ae6524a19b816ae38ce1e426255f1d8a31"
 dependencies = [
  "bytes",
- "getrandom 0.3.2",
- "rand 0.9.0",
+ "fastbloom",
+ "getrandom 0.3.4",
+ "lru-slab",
+ "rand 0.9.2",
  "ring",
  "rustc-hash 2.1.1",
  "rustls",
  "rustls-pki-types",
  "slab",
- "thiserror 2.0.12",
+ "thiserror 2.0.17",
  "tinyvec",
  "tracing",
  "web-time",
@@ -6263,32 +7052,32 @@ dependencies = [
 
 [[package]]
 name = "quinn-udp"
-version = "0.5.11"
+version = "0.5.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "541d0f57c6ec747a90738a52741d3221f7960e8ac2f0ff4b1a63680e033b4ab5"
+checksum = "addec6a0dcad8a8d96a771f815f0eaf55f9d1805756410b39f5fa81332574cbd"
 dependencies = [
- "cfg_aliases",
+ "cfg_aliases 0.2.1",
  "libc",
  "once_cell",
- "socket2",
+ "socket2 0.6.1",
  "tracing",
- "windows-sys 0.59.0",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
 name = "quote"
-version = "1.0.40"
+version = "1.0.42"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1885c039570dc00dcb4ff087a89e185fd56bae234ddc7f056a945bf36467248d"
+checksum = "a338cc41d27e6cc6dce6cefc13a0729dfbb81c262b1f519331575dd80ef3067f"
 dependencies = [
  "proc-macro2",
 ]
 
 [[package]]
 name = "r-efi"
-version = "5.2.0"
+version = "5.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "74765f6d916ee2faa39bc8e68e4f3ed8949b48cccdac59983d287a7cb71ce9c5"
+checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
 
 [[package]]
 name = "radium"
@@ -6302,6 +7091,16 @@ version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dc33ff2d4973d518d823d61aa239014831e521c75da58e3df4840d3f47749d09"
 
+[[package]]
+name = "radix_trie"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c069c179fcdc6a2fe24d8d18305cf085fdbd4f922c041943e203685d6a1c58fd"
+dependencies = [
+ "endian-type",
+ "nibble_vec",
+]
+
 [[package]]
 name = "rand"
 version = "0.8.5"
@@ -6315,13 +7114,12 @@ dependencies = [
 
 [[package]]
 name = "rand"
-version = "0.9.0"
+version = "0.9.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3779b94aeb87e8bd4e834cee3650289ee9e0d5677f976ecdb6d219e5f4f6cd94"
+checksum = "6db2770f06117d490610c7488547d543617b21bfa07796d7a12f6f1bd53850d1"
 dependencies = [
  "rand_chacha 0.9.0",
  "rand_core 0.9.3",
- "zerocopy 0.8.24",
 ]
 
 [[package]]
@@ -6350,7 +7148,7 @@ version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
 dependencies = [
- "getrandom 0.2.15",
+ "getrandom 0.2.16",
 ]
 
 [[package]]
@@ -6359,7 +7157,7 @@ version = "0.9.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "99d9a13982dcf210057a8a78572b2217b667c3beacbf3a0d8b454f6f82837d38"
 dependencies = [
- "getrandom 0.3.2",
+ "getrandom 0.3.4",
 ]
 
 [[package]]
@@ -6371,6 +7169,15 @@ dependencies = [
  "rand_core 0.6.4",
 ]
 
+[[package]]
+name = "rand_xorshift"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "513962919efc330f829edb2535844d1b912b0fbe2ca165d613e4e8788bb05a5a"
+dependencies = [
+ "rand_core 0.9.3",
+]
+
 [[package]]
 name = "rand_xoshiro"
 version = "0.6.0"
@@ -6382,18 +7189,18 @@ dependencies = [
 
 [[package]]
 name = "raw-cpuid"
-version = "11.5.0"
+version = "11.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c6df7ab838ed27997ba19a4664507e6f82b41fe6e20be42929332156e5e85146"
+checksum = "498cd0dc59d73224351ee52a95fee0f1a617a2eae0e7d9d720cc622c73a54186"
 dependencies = [
- "bitflags 2.9.0",
+ "bitflags 2.10.0",
 ]
 
 [[package]]
 name = "rayon"
-version = "1.10.0"
+version = "1.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b418a60154510ca1a002a752ca9714984e21e4241e804d32555251faf8b78ffa"
+checksum = "368f01d005bf8fd9b1206fb6fa653e6c4a81ceb1466406b81792d87c5677a58f"
 dependencies = [
  "either",
  "rayon-core",
@@ -6401,9 +7208,9 @@ dependencies = [
 
 [[package]]
 name = "rayon-core"
-version = "1.12.1"
+version = "1.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1465873a3dfdaa8ae7cb14b4383657caab0b3e8a0aa9ae8e04b044854c8dfce2"
+checksum = "22e18b0f0062d30d4230b2e85ff77fdfe4326feb054b9783a3460d8435c8ab91"
 dependencies = [
  "crossbeam-deque",
  "crossbeam-utils",
@@ -6430,7 +7237,7 @@ checksum = "f2a62d85ed81ca5305dc544bd42c8804c5060b78ffa5ad3c64b0fb6a8c13d062"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.100",
+ "syn 2.0.111",
 ]
 
 [[package]]
@@ -6444,11 +7251,11 @@ dependencies = [
 
 [[package]]
 name = "redox_syscall"
-version = "0.5.11"
+version = "0.5.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2f103c6d277498fbceb16e84d317e2a400f160f46904d5f5410848c829511a3"
+checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
 dependencies = [
- "bitflags 2.9.0",
+ "bitflags 2.10.0",
 ]
 
 [[package]]
@@ -6457,40 +7264,40 @@ version = "0.4.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ba009ff324d1fc1b900bd1fdb31564febe58a8ccc8a6fdbb93b543d33b13ca43"
 dependencies = [
- "getrandom 0.2.15",
+ "getrandom 0.2.16",
  "libredox",
  "thiserror 1.0.69",
 ]
 
 [[package]]
 name = "redox_users"
-version = "0.5.0"
+version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd6f9d3d47bdd2ad6945c5015a226ec6155d0bcdfd8f7cd29f86b71f8de99d2b"
+checksum = "a4e608c6638b9c18977b00b475ac1f28d14e84b27d8d42f70e0bf1e3dec127ac"
 dependencies = [
- "getrandom 0.2.15",
+ "getrandom 0.2.16",
  "libredox",
- "thiserror 2.0.12",
+ "thiserror 2.0.17",
 ]
 
 [[package]]
 name = "ref-cast"
-version = "1.0.24"
+version = "1.0.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4a0ae411dbe946a674d89546582cea4ba2bb8defac896622d6496f14c23ba5cf"
+checksum = "f354300ae66f76f1c85c5f84693f0ce81d747e2c3f21a45fef496d89c960bf7d"
 dependencies = [
  "ref-cast-impl",
 ]
 
 [[package]]
 name = "ref-cast-impl"
-version = "1.0.24"
+version = "1.0.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1165225c21bff1f3bbce98f5a1f889949bc902d3575308cc7b0de30b4f6d27c7"
+checksum = "b7186006dcb21920990093f30e3dea63b7d6e977bf1256be20c3563a5db070da"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.100",
+ "syn 2.0.111",
 ]
 
 [[package]]
@@ -6508,32 +7315,38 @@ dependencies = [
 
 [[package]]
 name = "regex"
-version = "1.11.1"
+version = "1.12.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b544ef1b4eac5dc2db33ea63606ae9ffcfac26c1416a2806ae0bf5f56b201191"
+checksum = "843bc0191f75f3e22651ae5f1e72939ab2f72a4bc30fa80a066bd66edefc24d4"
 dependencies = [
  "aho-corasick",
  "memchr",
  "regex-automata",
- "regex-syntax",
+ "regex-syntax 0.8.8",
 ]
 
 [[package]]
 name = "regex-automata"
-version = "0.4.9"
+version = "0.4.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "809e8dc61f6de73b46c85f4c96486310fe304c434cfa43669d7b40f711150908"
+checksum = "5276caf25ac86c8d810222b3dbb938e512c55c6831a10f3e6ed1c93b84041f1c"
 dependencies = [
  "aho-corasick",
  "memchr",
- "regex-syntax",
+ "regex-syntax 0.8.8",
 ]
 
 [[package]]
 name = "regex-syntax"
-version = "0.8.5"
+version = "0.6.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f162c6dd7b008981e4d40210aca20b4bd0f9b60ca9271061b07f78537722f2e1"
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b15c43186be67a4fd63bee50d0303afffcef381492ebe2c5d87f324e1b8815c"
+checksum = "7a2d987857b319362043e95f5353c0535c1f58eec5336fdfcf626430af7def58"
 
 [[package]]
 name = "relative-path"
@@ -6543,9 +7356,9 @@ checksum = "ba39f3699c378cd8970968dcbff9c43159ea4cfbd88d43c00b22f2ef10a435d2"
 
 [[package]]
 name = "reqwest"
-version = "0.12.15"
+version = "0.12.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d19c46a6fdd48bc4dab94b6103fccc55d34c67cc0ad04653aad4ea2a07cd7bbb"
+checksum = "b6eff9328d40131d43bd911d42d79eb6a47312002a4daefc9e37f17e74a7701a"
 dependencies = [
  "base64 0.22.1",
  "bytes",
@@ -6553,16 +7366,15 @@ dependencies = [
  "futures-channel",
  "futures-core",
  "futures-util",
- "h2 0.4.8",
+ "h2 0.4.12",
  "hickory-resolver",
- "http 1.3.1",
+ "http 1.4.0",
  "http-body 1.0.1",
  "http-body-util",
- "hyper 1.6.0",
+ "hyper 1.8.1",
  "hyper-rustls",
  "hyper-tls",
  "hyper-util",
- "ipnet",
  "js-sys",
  "log",
  "mime",
@@ -6574,18 +7386,17 @@ dependencies = [
  "quinn",
  "rustls",
  "rustls-native-certs",
- "rustls-pemfile",
  "rustls-pki-types",
  "serde",
  "serde_json",
  "serde_urlencoded",
  "sync_wrapper",
- "system-configuration",
  "tokio",
  "tokio-native-tls",
  "tokio-rustls",
  "tokio-util",
  "tower 0.5.2",
+ "tower-http 0.6.8",
  "tower-service",
  "url",
  "wasm-bindgen",
@@ -6593,7 +7404,6 @@ dependencies = [
  "wasm-streams",
  "web-sys",
  "webpki-roots",
- "windows-registry",
 ]
 
 [[package]]
@@ -6614,12 +7424,9 @@ dependencies = [
 
 [[package]]
 name = "resolv-conf"
-version = "0.7.1"
+version = "0.7.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "48375394603e3dd4b2d64371f7148fd8c7baa2680e28741f2cb8d23b59e3d4c4"
-dependencies = [
- "hostname",
-]
+checksum = "1e061d1b48cb8d38042de4ae0a7a6401009d6143dc80d2e2d6f31f0bdd6470c7"
 
 [[package]]
 name = "rfc6979"
@@ -6650,7 +7457,7 @@ checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
 dependencies = [
  "cc",
  "cfg-if",
- "getrandom 0.2.15",
+ "getrandom 0.2.16",
  "libc",
  "untrusted",
  "windows-sys 0.52.0",
@@ -6675,6 +7482,16 @@ dependencies = [
  "byteorder",
 ]
 
+[[package]]
+name = "roaring"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f08d6a905edb32d74a5d5737a0c9d7e950c312f3c46cb0ca0a2ca09ea11878a0"
+dependencies = [
+ "bytemuck",
+ "byteorder",
+]
+
 [[package]]
 name = "route-recognizer"
 version = "0.3.1"
@@ -6707,7 +7524,7 @@ dependencies = [
  "pkcs1",
  "pkcs8 0.9.0",
  "rand_core 0.6.4",
- "sha2 0.10.8",
+ "sha2 0.10.9",
  "signature 2.2.0",
  "subtle",
  "zeroize",
@@ -6733,13 +7550,13 @@ checksum = "1f168d99749d307be9de54d23fd226628d99768225ef08f6ffb52e0182a27746"
 dependencies = [
  "cfg-if",
  "glob",
- "proc-macro-crate 3.3.0",
+ "proc-macro-crate 3.4.0",
  "proc-macro2",
  "quote",
  "regex",
  "relative-path",
  "rustc_version",
- "syn 2.0.100",
+ "syn 2.0.111",
  "unicode-ident",
 ]
 
@@ -6755,9 +7572,9 @@ dependencies = [
 
 [[package]]
 name = "rustc-demangle"
-version = "0.1.24"
+version = "0.1.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "719b953e2095829ee67db738b3bfa9fa368c94900df327b3f07fe6e794d2fe1f"
+checksum = "56f7d92ca342cea22a06f2121d944b4fd82af56988c270852495420f961d4ace"
 
 [[package]]
 name = "rustc-hash"
@@ -6787,32 +7604,42 @@ dependencies = [
 ]
 
 [[package]]
-name = "rusticata-macros"
-version = "4.1.0"
+name = "rustc_version_runtime"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "faf0c4a6ece9950b9abdb62b1cfcf2a68b3b67a10ba445b3bb85be2a293d0632"
+checksum = "2dd18cd2bae1820af0b6ad5e54f4a51d0f3fcc53b05f845675074efcc7af071d"
+dependencies = [
+ "rustc_version",
+ "semver",
+]
+
+[[package]]
+name = "rusticata-macros"
+version = "4.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "faf0c4a6ece9950b9abdb62b1cfcf2a68b3b67a10ba445b3bb85be2a293d0632"
 dependencies = [
  "nom",
 ]
 
 [[package]]
 name = "rustix"
-version = "1.0.5"
+version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d97817398dd4bb2e6da002002db259209759911da105da92bec29ccb12cf58bf"
+checksum = "cd15f8a2c5551a84d56efdc1cd049089e409ac19a3072d5037a17fd70719ff3e"
 dependencies = [
- "bitflags 2.9.0",
+ "bitflags 2.10.0",
  "errno",
  "libc",
  "linux-raw-sys",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
 name = "rustls"
-version = "0.23.25"
+version = "0.23.35"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "822ee9188ac4ec04a2f0531e55d035fb2de73f18b41a63c70c2712503b6fb13c"
+checksum = "533f54bc6a7d4f647e46ad909549eda97bf5afc1585190ef692b4286b198bd8f"
 dependencies = [
  "log",
  "once_cell",
@@ -6825,14 +7652,14 @@ dependencies = [
 
 [[package]]
 name = "rustls-native-certs"
-version = "0.8.1"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7fcff2dd52b58a8d98a70243663a0d234c4e2b79235637849d15913394a247d3"
+checksum = "9980d917ebb0c0536119ba501e90834767bffc3d60641457fd84a1f3fd337923"
 dependencies = [
  "openssl-probe",
  "rustls-pki-types",
  "schannel",
- "security-framework 3.2.0",
+ "security-framework 3.5.1",
 ]
 
 [[package]]
@@ -6846,20 +7673,21 @@ dependencies = [
 
 [[package]]
 name = "rustls-pki-types"
-version = "1.11.0"
+version = "1.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "917ce264624a4b4db1c364dcc35bfca9ded014d0a958cd47ad3e960e988ea51c"
+checksum = "708c0f9d5f54ba0272468c1d306a52c495b31fa155e91bc25371e6df7996908c"
 dependencies = [
  "web-time",
+ "zeroize",
 ]
 
 [[package]]
 name = "rustls-platform-verifier"
-version = "0.5.1"
+version = "0.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4a5467026f437b4cb2a533865eaa73eb840019a0916f4b9ec563c6e617e086c9"
+checksum = "19787cda76408ec5404443dc8b31795c87cd8fec49762dc75fa727740d34acc1"
 dependencies = [
- "core-foundation 0.10.0",
+ "core-foundation 0.10.1",
  "core-foundation-sys",
  "jni",
  "log",
@@ -6868,9 +7696,9 @@ dependencies = [
  "rustls-native-certs",
  "rustls-platform-verifier-android",
  "rustls-webpki",
- "security-framework 3.2.0",
+ "security-framework 3.5.1",
  "security-framework-sys",
- "webpki-root-certs",
+ "webpki-root-certs 0.26.11",
  "windows-sys 0.59.0",
 ]
 
@@ -6882,9 +7710,9 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f"
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.1"
+version = "0.103.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fef8b8769aaccf73098557a87cd1816b4f9c7c16811c9c77142aa695c16f2c03"
+checksum = "2ffdfa2f5286e2247234e03f680868ac2815974dc39e00ea15adc445d0aafe52"
 dependencies = [
  "ring",
  "rustls-pki-types",
@@ -6893,15 +7721,15 @@ dependencies = [
 
 [[package]]
 name = "rustversion"
-version = "1.0.20"
+version = "1.0.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eded382c5f5f786b989652c49544c4877d9f015cc22e145a5ea8ea66c2921cd2"
+checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
 
 [[package]]
 name = "rusty-fork"
-version = "0.3.0"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb3dcc6e454c328bb824492db107ab7c0ae8fcffe4ad210136ef014458c1bc4f"
+checksum = "cc6bf79ff24e648f6da1f8d1f011e9cac26491b619e6b9280f2b47f1774e6ee2"
 dependencies = [
  "fnv",
  "quick-error",
@@ -6909,6 +7737,28 @@ dependencies = [
  "wait-timeout",
 ]
 
+[[package]]
+name = "rustyline"
+version = "14.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7803e8936da37efd9b6d4478277f4b2b9bb5cdb37a113e8d63222e58da647e63"
+dependencies = [
+ "bitflags 2.10.0",
+ "cfg-if",
+ "clipboard-win",
+ "fd-lock",
+ "home",
+ "libc",
+ "log",
+ "memchr",
+ "nix",
+ "radix_trie",
+ "unicode-segmentation",
+ "unicode-width 0.1.14",
+ "utf8parse",
+ "windows-sys 0.52.0",
+]
+
 [[package]]
 name = "ryu"
 version = "1.0.20"
@@ -6935,11 +7785,53 @@ dependencies = [
 
 [[package]]
 name = "schannel"
-version = "0.1.27"
+version = "0.1.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1f29ebaa345f945cec9fbbc532eb307f0fdad8161f281b6369539c8d84876b3d"
+checksum = "891d81b926048e76efe18581bf793546b4c0eaf8448d72be8de2bbee5fd166e1"
 dependencies = [
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "schemafy"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8aea5ba40287dae331f2c48b64dbc8138541f5e97ee8793caa7948c1f31d86d5"
+dependencies = [
+ "Inflector",
+ "schemafy_core",
+ "schemafy_lib",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "serde_repr",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "schemafy_core"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41781ae092f4fd52c9287efb74456aea0d3b90032d2ecad272bd14dbbcb0511b"
+dependencies = [
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "schemafy_lib"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e953db32579999ca98c451d80801b6f6a7ecba6127196c5387ec0774c528befa"
+dependencies = [
+ "Inflector",
+ "proc-macro2",
+ "quote",
+ "schemafy_core",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "syn 1.0.109",
 ]
 
 [[package]]
@@ -6957,13 +7849,25 @@ dependencies = [
 
 [[package]]
 name = "schemars"
-version = "1.0.0-alpha.17"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "88ef2a6523400a2228db974a8ddc9e1d3deaa04f51bddd7832ef8d7e531bafcc"
+checksum = "4cd191f9397d57d581cddd31014772520aa448f65ef991055d7f61582c65165f"
 dependencies = [
  "dyn-clone",
  "ref-cast",
- "schemars_derive 1.0.0-alpha.17",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "schemars"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9558e172d4e8533736ba97870c4b2cd63f84b382a3d6eb063da41b91cce17289"
+dependencies = [
+ "dyn-clone",
+ "ref-cast",
+ "schemars_derive 1.1.0",
  "serde",
  "serde_json",
 ]
@@ -6977,19 +7881,19 @@ dependencies = [
  "proc-macro2",
  "quote",
  "serde_derive_internals",
- "syn 2.0.100",
+ "syn 2.0.111",
 ]
 
 [[package]]
 name = "schemars_derive"
-version = "1.0.0-alpha.17"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c6d4e1945a3c9e58edaa708449b026519f7f4197185e1b5dbc689615c1ad724d"
+checksum = "301858a4023d78debd2353c7426dc486001bddc91ae31a76fb1f55132f7e2633"
 dependencies = [
  "proc-macro2",
  "quote",
  "serde_derive_internals",
- "syn 2.0.100",
+ "syn 2.0.111",
 ]
 
 [[package]]
@@ -7006,9 +7910,9 @@ checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
 [[package]]
 name = "sdd"
-version = "3.0.8"
+version = "3.0.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "584e070911c7017da6cb2eb0788d09f43d789029b5877d3e5ecc8acf86ceee21"
+checksum = "490dcfcbfef26be6800d11870ff2df8774fa6e86d047e3e8c8a76b25655e41ca"
 
 [[package]]
 name = "sec1"
@@ -7030,7 +7934,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d3e97a565f76233a6003f9f5c54be1d9c5bdfa3eccfb189469f11ec4901c47dc"
 dependencies = [
  "base16ct 0.2.0",
- "der 0.7.9",
+ "der 0.7.10",
  "generic-array",
  "pkcs8 0.10.2",
  "subtle",
@@ -7050,9 +7954,9 @@ dependencies = [
 
 [[package]]
 name = "secp256k1-sys"
-version = "0.8.1"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70a129b9e9efbfb223753b9163c4ab3b13cff7fd9c7f010fbac25ab4099fa07e"
+checksum = "4473013577ec77b4ee3668179ef1186df3146e2cf2d927bd200974c6fe60fd99"
 dependencies = [
  "cc",
 ]
@@ -7073,7 +7977,7 @@ version = "2.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "897b2245f0b511c87893af39b033e5ca9cce68824c4d7e7630b5a1d339658d02"
 dependencies = [
- "bitflags 2.9.0",
+ "bitflags 2.10.0",
  "core-foundation 0.9.4",
  "core-foundation-sys",
  "libc",
@@ -7082,12 +7986,12 @@ dependencies = [
 
 [[package]]
 name = "security-framework"
-version = "3.2.0"
+version = "3.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "271720403f46ca04f7ba6f55d438f8bd878d6b8ca0a1046e8228c4145bcbb316"
+checksum = "b3297343eaf830f66ede390ea39da1d462b6b0c1b000f420d0a83f898bbbe6ef"
 dependencies = [
- "bitflags 2.9.0",
- "core-foundation 0.10.0",
+ "bitflags 2.10.0",
+ "core-foundation 0.10.1",
  "core-foundation-sys",
  "libc",
  "security-framework-sys",
@@ -7095,9 +7999,9 @@ dependencies = [
 
 [[package]]
 name = "security-framework-sys"
-version = "2.14.0"
+version = "2.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49db231d56a190491cb4aeda9527f1ad45345af50b0851622a7adb8c03b01c32"
+checksum = "cc1f0cbffaac4852523ce30d8bd3c5cdc873501d96ff467ca09b6767bb8cd5c0"
 dependencies = [
  "core-foundation-sys",
  "libc",
@@ -7105,16 +8009,17 @@ dependencies = [
 
 [[package]]
 name = "semver"
-version = "1.0.26"
+version = "1.0.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56e6fa9c48d24d85fb3de5ad847117517440f6beceb7798af16b4a87d616b8d0"
+checksum = "d767eb0aabc880b29956c35734170f26ed551a859dbd361d140cdbeca61ab1e2"
 
 [[package]]
 name = "serde"
-version = "1.0.219"
+version = "1.0.228"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f0e2c6ed6606019b4e29e69dbaba95b11854410e5347d525002456dbbb786b6"
+checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
 dependencies = [
+ "serde_core",
  "serde_derive",
 ]
 
@@ -7149,13 +8054,14 @@ dependencies = [
 
 [[package]]
 name = "serde-reflection"
-version = "0.5.0"
+version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e5bef77b40d103fda6c10d29c21f5c78c980e8570e1a290a648a9ff5011f96e1"
+checksum = "bfe23e63efbe7af1bc1859ead4a05014bdd5478be550762a40f6fcf91ad5473c"
 dependencies = [
  "erased-discriminant",
  "once_cell",
  "serde",
+ "serde_json",
  "thiserror 1.0.69",
  "typeid",
 ]
@@ -7173,22 +8079,32 @@ dependencies = [
 
 [[package]]
 name = "serde_bytes"
-version = "0.11.17"
+version = "0.11.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8437fd221bde2d4ca316d61b90e337e9e702b3820b87d63caa9ba6c02bd06d96"
+checksum = "a5d440709e79d88e51ac01c4b72fc6cb7314017bb7da9eeff678aa94c10e3ea8"
 dependencies = [
  "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
+dependencies = [
+ "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.219"
+version = "1.0.228"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b0276cf7f2c73365f7157c8123c21cd9a50fbbd844757af28ca1f5925fc2a00"
+checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.100",
+ "syn 2.0.111",
 ]
 
 [[package]]
@@ -7199,30 +8115,32 @@ checksum = "18d26a20a969b9e3fdf2fc2d9f21eda6c40e2de84c9408bb5d3b05d499aae711"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.100",
+ "syn 2.0.111",
 ]
 
 [[package]]
 name = "serde_json"
-version = "1.0.140"
+version = "1.0.145"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "20068b6e96dc6c9bd23e01df8827e6c7e1f2fddd43c21810382803c136b99373"
+checksum = "402a6f66d8c709116cf22f558eab210f5a50187f702eb4d7e5ef38d9a7f1c79c"
 dependencies = [
- "indexmap 2.9.0",
+ "indexmap 2.12.1",
  "itoa",
  "memchr",
  "ryu",
  "serde",
+ "serde_core",
 ]
 
 [[package]]
 name = "serde_path_to_error"
-version = "0.1.17"
+version = "0.1.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "59fab13f937fa393d08645bf3a84bdfe86e296747b506ada67bb15f10f218b2a"
+checksum = "10a9ff822e371bb5403e391ecd83e182e0e77ba7f6fe0160b795797109d1b457"
 dependencies = [
  "itoa",
  "serde",
+ "serde_core",
 ]
 
 [[package]]
@@ -7233,14 +8151,14 @@ checksum = "175ee3e80ae9982737ca543e96133087cbd9a485eecc3bc4de9c1a37b47ea59c"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.100",
+ "syn 2.0.111",
 ]
 
 [[package]]
 name = "serde_spanned"
-version = "0.6.8"
+version = "0.6.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87607cb1398ed59d48732e575a4c28a7a8ebf2454b964fe3f224f2afc07909e1"
+checksum = "bf41e0cfaf7226dca15e8197172c295a782857fcb97fad1808a166870dee75a3"
 dependencies = [
  "serde",
 ]
@@ -7259,17 +8177,18 @@ dependencies = [
 
 [[package]]
 name = "serde_with"
-version = "3.12.0"
+version = "3.16.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6b6f7f2fcb69f747921f79f3926bd1e203fce4fef62c268dd3abfb6d86029aa"
+checksum = "4fa237f2807440d238e0364a218270b98f767a00d3dada77b1c53ae88940e2e7"
 dependencies = [
  "base64 0.22.1",
  "chrono",
  "hex",
  "indexmap 1.9.3",
- "indexmap 2.9.0",
- "serde",
- "serde_derive",
+ "indexmap 2.12.1",
+ "schemars 0.9.0",
+ "schemars 1.1.0",
+ "serde_core",
  "serde_json",
  "serde_with_macros",
  "time",
@@ -7277,14 +8196,14 @@ dependencies = [
 
 [[package]]
 name = "serde_with_macros"
-version = "3.12.0"
+version = "3.16.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8d00caa5193a3c8362ac2b73be6b9e768aa5a4b2f721d8f4b339600c3cb51f8e"
+checksum = "52a8e3ca0ca629121f70ab50f95249e5a6f925cc0f6ffe8256c45b728875706c"
 dependencies = [
- "darling 0.20.11",
+ "darling 0.21.3",
  "proc-macro2",
  "quote",
- "syn 2.0.100",
+ "syn 2.0.111",
 ]
 
 [[package]]
@@ -7321,7 +8240,7 @@ checksum = "5d69265a08751de7844521fd15003ae0a888e035773ba05695c5c759a6f89eef"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.100",
+ "syn 2.0.111",
 ]
 
 [[package]]
@@ -7350,9 +8269,9 @@ dependencies = [
 
 [[package]]
 name = "sha2"
-version = "0.10.8"
+version = "0.10.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "793db75ad2bcafc3ffa7c68b215fee268f537982cd901d132f89c6343f3a3dc8"
+checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
 dependencies = [
  "cfg-if",
  "cpufeatures",
@@ -7372,7 +8291,7 @@ dependencies = [
 [[package]]
 name = "shared-crypto"
 version = "0.0.0"
-source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.45.3#643cae13d71392a164f427024d899ea49fc97a23"
+source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.61.2#6c229fe6c04fb21ec98751c798e57e9a00e028e2"
 dependencies = [
  "bcs",
  "eyre",
@@ -7389,9 +8308,9 @@ checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
 
 [[package]]
 name = "signal-hook-registry"
-version = "1.4.2"
+version = "1.4.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9e9e0b4211b72e7b8b6e85c807d36c212bdb33ea8587f7569562a84df5465b1"
+checksum = "7664a098b8e616bdfcc2dc0e9ac44eb231eedf41db4e9fe95d8d32ec728dedad"
 dependencies = [
  "libc",
 ]
@@ -7416,6 +8335,12 @@ dependencies = [
  "rand_core 0.6.4",
 ]
 
+[[package]]
+name = "simd-adler32"
+version = "0.3.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e320a6c5ad31d271ad523dcf3ad13e2767ad8b1cb8f047f75a8aeaf8da139da2"
+
 [[package]]
 name = "similar"
 version = "2.7.0"
@@ -7446,12 +8371,9 @@ dependencies = [
 
 [[package]]
 name = "slab"
-version = "0.4.9"
+version = "0.4.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f92a496fb766b417c996b9c5e57daf2f7ad3b0bebe1ccfca4856390e3d3bb67"
-dependencies = [
- "autocfg",
-]
+checksum = "7a2ae44ef20feb57a68b23d846850f861394c2e02dc425a50098ae8c90267589"
 
 [[package]]
 name = "slip10_ed25519"
@@ -7464,29 +8386,29 @@ dependencies = [
 
 [[package]]
 name = "smallvec"
-version = "1.15.0"
+version = "1.15.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8917285742e9f3e1683f0a9c4e6b57960b7314d0b08d30d1ecd426713ee2eee9"
+checksum = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03"
 
 [[package]]
 name = "snafu"
-version = "0.8.5"
+version = "0.8.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "223891c85e2a29c3fe8fb900c1fae5e69c2e42415e3177752e8718475efa5019"
+checksum = "6e84b3f4eacbf3a1ce05eac6763b4d629d60cbc94d632e4092c54ade71f1e1a2"
 dependencies = [
  "snafu-derive",
 ]
 
 [[package]]
 name = "snafu-derive"
-version = "0.8.5"
+version = "0.8.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "03c3c6b7927ffe7ecaa769ee0e3994da3b8cafc8f444578982c83ecb161af917"
+checksum = "c1c97747dbf44bb1ca44a561ece23508e99cb592e862f22222dcf42f51d1e451"
 dependencies = [
  "heck 0.5.0",
  "proc-macro2",
  "quote",
- "syn 2.0.100",
+ "syn 2.0.111",
 ]
 
 [[package]]
@@ -7497,7 +8419,7 @@ checksum = "1b6b67fb9a61334225b5b790716f609cd58395f895b3fe8b328786812a40bc3b"
 
 [[package]]
 name = "social-twitter"
-version = "0.3.0"
+version = "0.5.0"
 dependencies = [
  "base64 0.13.1",
  "chrono",
@@ -7506,23 +8428,33 @@ dependencies = [
  "nexus-toolkit",
  "oauth1-request",
  "reqwest",
- "schemars 1.0.0-alpha.17",
+ "schemars 1.1.0",
  "serde",
  "serde_json",
- "thiserror 2.0.12",
+ "thiserror 2.0.17",
  "tokio",
 ]
 
 [[package]]
 name = "socket2"
-version = "0.5.9"
+version = "0.5.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4f5fd57c80058a56cf5c777ab8a126398ece8e442983605d280a44ce79d0edef"
+checksum = "e22376abed350d73dd1cd119b57ffccad95b4e585a7cda43e286245ce23c0678"
 dependencies = [
  "libc",
  "windows-sys 0.52.0",
 ]
 
+[[package]]
+name = "socket2"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "17129e116933cf371d018bb80ae557e889637989d8638274fb25622827b03881"
+dependencies = [
+ "libc",
+ "windows-sys 0.60.2",
+]
+
 [[package]]
 name = "soketto"
 version = "0.8.1"
@@ -7532,7 +8464,7 @@ dependencies = [
  "base64 0.22.1",
  "bytes",
  "futures",
- "http 1.3.1",
+ "http 1.4.0",
  "httparse",
  "log",
  "rand 0.8.5",
@@ -7571,20 +8503,20 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
 dependencies = [
  "base64ct",
- "der 0.7.9",
+ "der 0.7.10",
 ]
 
 [[package]]
 name = "stable_deref_trait"
-version = "1.2.0"
+version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a8f112729512f8e442d81f95a8a7ddf2b7c6b8a1a6f509a95864142b30cab2d3"
+checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
 
 [[package]]
 name = "stacker"
-version = "0.1.20"
+version = "0.1.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "601f9201feb9b09c00266478bf459952b9ef9a6b94edb2f21eba14ab681a60a9"
+checksum = "e1f8b29fb42aafcea4edeeb6b2f2d7ecd0d969c48b4cf0d2e64aafc471dd6e59"
 dependencies = [
  "cc",
  "cfg-if",
@@ -7593,12 +8525,114 @@ dependencies = [
  "windows-sys 0.59.0",
 ]
 
+[[package]]
+name = "starlark"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f53849859f05d9db705b221bd92eede93877fd426c1b4a3c3061403a5912a8f"
+dependencies = [
+ "allocative",
+ "anyhow",
+ "bumpalo",
+ "cmp_any",
+ "debugserver-types",
+ "derivative",
+ "derive_more 1.0.0",
+ "display_container",
+ "dupe",
+ "either",
+ "erased-serde",
+ "hashbrown 0.14.5",
+ "inventory",
+ "itertools 0.13.0",
+ "maplit",
+ "memoffset",
+ "num-bigint 0.4.6",
+ "num-traits",
+ "once_cell",
+ "paste",
+ "ref-cast",
+ "regex",
+ "rustyline",
+ "serde",
+ "serde_json",
+ "starlark_derive",
+ "starlark_map",
+ "starlark_syntax",
+ "static_assertions",
+ "strsim 0.10.0",
+ "textwrap",
+ "thiserror 1.0.69",
+]
+
+[[package]]
+name = "starlark_derive"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fe58bc6c8b7980a1fe4c9f8f48200c3212db42ebfe21ae6a0336385ab53f082a"
+dependencies = [
+ "dupe",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.111",
+]
+
+[[package]]
+name = "starlark_map"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92659970f120df0cc1c0bb220b33587b7a9a90e80d4eecc5c5af5debb950173d"
+dependencies = [
+ "allocative",
+ "dupe",
+ "equivalent",
+ "fxhash",
+ "hashbrown 0.14.5",
+ "serde",
+]
+
+[[package]]
+name = "starlark_syntax"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fe53b3690d776aafd7cb6b9fed62d94f83280e3b87d88e3719cc0024638461b3"
+dependencies = [
+ "allocative",
+ "annotate-snippets",
+ "anyhow",
+ "derivative",
+ "derive_more 1.0.0",
+ "dupe",
+ "lalrpop",
+ "lalrpop-util",
+ "logos",
+ "lsp-types 0.94.1",
+ "memchr",
+ "num-bigint 0.4.6",
+ "num-traits",
+ "once_cell",
+ "starlark_map",
+ "thiserror 1.0.69",
+]
+
 [[package]]
 name = "static_assertions"
 version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
 
+[[package]]
+name = "string_cache"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf776ba3fa74f83bf4b63c3dcbbf82173db2632ed8452cb2d891d33f459de70f"
+dependencies = [
+ "new_debug_unreachable",
+ "parking_lot",
+ "phf_shared",
+ "precomputed-hash",
+]
+
 [[package]]
 name = "strsim"
 version = "0.10.0"
@@ -7620,7 +8654,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "structmeta-derive",
- "syn 2.0.100",
+ "syn 2.0.111",
 ]
 
 [[package]]
@@ -7631,16 +8665,7 @@ checksum = "152a0b65a590ff6c3da95cabe2353ee04e6167c896b28e3b14478c2636c922fc"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.100",
-]
-
-[[package]]
-name = "strum"
-version = "0.24.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "063e6045c0e62079840579a7e47a355ae92f60eb74daaf156fb1e84ba164e63f"
-dependencies = [
- "strum_macros 0.24.3",
+ "syn 2.0.111",
 ]
 
 [[package]]
@@ -7654,21 +8679,11 @@ dependencies = [
 
 [[package]]
 name = "strum"
-version = "0.27.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f64def088c51c9510a8579e3c5d67c65349dcf755e5479ad3d010aa6454e2c32"
-
-[[package]]
-name = "strum_macros"
-version = "0.24.3"
+version = "0.27.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e385be0d24f186b4ce2f9982191e7101bb737312ad61c1f2f984f34bcf85d59"
+checksum = "af23d6f6c1a224baef9d3f61e287d2761385a5b88fdab4eb4c6f11aeb54c4bcf"
 dependencies = [
- "heck 0.4.1",
- "proc-macro2",
- "quote",
- "rustversion",
- "syn 1.0.109",
+ "strum_macros 0.27.2",
 ]
 
 [[package]]
@@ -7681,20 +8696,19 @@ dependencies = [
  "proc-macro2",
  "quote",
  "rustversion",
- "syn 2.0.100",
+ "syn 2.0.111",
 ]
 
 [[package]]
 name = "strum_macros"
-version = "0.27.1"
+version = "0.27.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c77a8c5abcaf0f9ce05d62342b7d298c346515365c36b673df4ebe3ced01fde8"
+checksum = "7695ce3845ea4b33927c055a39dc438a45b059f7c1b3d91d38d10355fb8cbca7"
 dependencies = [
  "heck 0.5.0",
  "proc-macro2",
  "quote",
- "rustversion",
- "syn 2.0.100",
+ "syn 2.0.111",
 ]
 
 [[package]]
@@ -7712,7 +8726,7 @@ checksum = "734676eb262c623cec13c3155096e08d1f8f29adce39ba17948b18dad1e54142"
 [[package]]
 name = "sui-config"
 version = "0.0.0"
-source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.45.3#643cae13d71392a164f427024d899ea49fc97a23"
+source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.61.2#6c229fe6c04fb21ec98751c798e57e9a00e028e2"
 dependencies = [
  "anemo",
  "anyhow",
@@ -7731,19 +8745,37 @@ dependencies = [
  "rand 0.8.5",
  "reqwest",
  "serde",
+ "serde_json",
  "serde_with",
  "serde_yaml",
+ "starlark",
  "sui-keys",
  "sui-protocol-config",
- "sui-rpc-api",
  "sui-types",
+ "thiserror 1.0.69",
  "tracing",
 ]
 
+[[package]]
+name = "sui-crypto"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7129cfd679e3f2c0e6a163c706c926d14900fd2e05d29529175e34644850b4d5"
+dependencies = [
+ "ed25519-dalek",
+ "k256 0.13.4",
+ "p256",
+ "pem-rfc7468 0.7.0",
+ "pkcs8 0.10.2",
+ "rand_core 0.6.4",
+ "signature 2.2.0",
+ "sui-sdk-types 0.1.0",
+]
+
 [[package]]
 name = "sui-enum-compat-util"
 version = "0.1.0"
-source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.45.3#643cae13d71392a164f427024d899ea49fc97a23"
+source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.61.2#6c229fe6c04fb21ec98751c798e57e9a00e028e2"
 dependencies = [
  "serde_yaml",
 ]
@@ -7751,7 +8783,7 @@ dependencies = [
 [[package]]
 name = "sui-framework"
 version = "0.1.0"
-source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.45.3#643cae13d71392a164f427024d899ea49fc97a23"
+source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.61.2#6c229fe6c04fb21ec98751c798e57e9a00e028e2"
 dependencies = [
  "bcs",
  "move-binary-format",
@@ -7764,8 +8796,8 @@ dependencies = [
 
 [[package]]
 name = "sui-framework-snapshot"
-version = "1.45.3"
-source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.45.3#643cae13d71392a164f427024d899ea49fc97a23"
+version = "1.61.2"
+source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.61.2#6c229fe6c04fb21ec98751c798e57e9a00e028e2"
 dependencies = [
  "anyhow",
  "bcs",
@@ -7780,27 +8812,27 @@ dependencies = [
 [[package]]
 name = "sui-http"
 version = "0.0.0"
-source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.45.3#643cae13d71392a164f427024d899ea49fc97a23"
+source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.61.2#6c229fe6c04fb21ec98751c798e57e9a00e028e2"
 dependencies = [
  "bytes",
- "http 1.3.1",
+ "http 1.4.0",
  "http-body 1.0.1",
  "http-body-util",
- "hyper 1.6.0",
+ "hyper 1.8.1",
  "hyper-util",
  "pin-project-lite",
- "socket2",
+ "socket2 0.5.10",
  "tokio",
  "tokio-rustls",
  "tokio-util",
- "tower 0.4.13",
+ "tower 0.5.2",
  "tracing",
 ]
 
 [[package]]
 name = "sui-json"
 version = "0.0.0"
-source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.45.3#643cae13d71392a164f427024d899ea49fc97a23"
+source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.61.2#6c229fe6c04fb21ec98751c798e57e9a00e028e2"
 dependencies = [
  "anyhow",
  "bcs",
@@ -7817,7 +8849,7 @@ dependencies = [
 [[package]]
 name = "sui-json-rpc-api"
 version = "0.0.0"
-source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.45.3#643cae13d71392a164f427024d899ea49fc97a23"
+source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.61.2#6c229fe6c04fb21ec98751c798e57e9a00e028e2"
 dependencies = [
  "anyhow",
  "fastcrypto",
@@ -7837,7 +8869,7 @@ dependencies = [
 [[package]]
 name = "sui-json-rpc-types"
 version = "0.0.0"
-source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.45.3#643cae13d71392a164f427024d899ea49fc97a23"
+source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.61.2#6c229fe6c04fb21ec98751c798e57e9a00e028e2"
 dependencies = [
  "anyhow",
  "bcs",
@@ -7848,6 +8880,7 @@ dependencies = [
  "json_to_table",
  "move-binary-format",
  "move-bytecode-utils",
+ "move-command-line-common",
  "move-core-types",
  "move-disassembler",
  "move-ir-types",
@@ -7869,11 +8902,17 @@ dependencies = [
 [[package]]
 name = "sui-keys"
 version = "0.0.0"
-source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.45.3#643cae13d71392a164f427024d899ea49fc97a23"
+source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.61.2#6c229fe6c04fb21ec98751c798e57e9a00e028e2"
 dependencies = [
  "anyhow",
+ "async-trait",
+ "base64 0.21.7",
+ "bcs",
  "bip32",
+ "colored 2.2.0",
  "fastcrypto",
+ "jsonrpc",
+ "mockall 0.11.4",
  "rand 0.8.5",
  "regex",
  "serde",
@@ -7883,12 +8922,13 @@ dependencies = [
  "slip10_ed25519",
  "sui-types",
  "tiny-bip39",
+ "tokio",
 ]
 
 [[package]]
 name = "sui-macros"
 version = "0.7.0"
-source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.45.3#643cae13d71392a164f427024d899ea49fc97a23"
+source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.61.2#6c229fe6c04fb21ec98751c798e57e9a00e028e2"
 dependencies = [
  "futures",
  "once_cell",
@@ -7898,8 +8938,8 @@ dependencies = [
 
 [[package]]
 name = "sui-move-build"
-version = "1.45.3"
-source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.45.3#643cae13d71392a164f427024d899ea49fc97a23"
+version = "1.61.2"
+source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.61.2#6c229fe6c04fb21ec98751c798e57e9a00e028e2"
 dependencies = [
  "anyhow",
  "fastcrypto",
@@ -7912,6 +8952,7 @@ dependencies = [
  "move-ir-types",
  "move-package",
  "move-symbol-pool",
+ "mysten-common",
  "serde-reflection",
  "sui-package-management",
  "sui-protocol-config",
@@ -7922,8 +8963,8 @@ dependencies = [
 
 [[package]]
 name = "sui-open-rpc"
-version = "1.45.3"
-source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.45.3#643cae13d71392a164f427024d899ea49fc97a23"
+version = "1.61.2"
+source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.61.2#6c229fe6c04fb21ec98751c798e57e9a00e028e2"
 dependencies = [
  "bcs",
  "schemars 0.8.22",
@@ -7935,7 +8976,7 @@ dependencies = [
 [[package]]
 name = "sui-open-rpc-macros"
 version = "0.1.0"
-source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.45.3#643cae13d71392a164f427024d899ea49fc97a23"
+source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.61.2#6c229fe6c04fb21ec98751c798e57e9a00e028e2"
 dependencies = [
  "derive-syn-parse",
  "itertools 0.13.0",
@@ -7947,8 +8988,8 @@ dependencies = [
 
 [[package]]
 name = "sui-package-management"
-version = "1.45.3"
-source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.45.3#643cae13d71392a164f427024d899ea49fc97a23"
+version = "1.61.2"
+source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.61.2#6c229fe6c04fb21ec98751c798e57e9a00e028e2"
 dependencies = [
  "anyhow",
  "move-core-types",
@@ -7966,7 +9007,7 @@ dependencies = [
 [[package]]
 name = "sui-package-resolver"
 version = "0.1.0"
-source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.45.3#643cae13d71392a164f427024d899ea49fc97a23"
+source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.61.2#6c229fe6c04fb21ec98751c798e57e9a00e028e2"
 dependencies = [
  "async-trait",
  "bcs",
@@ -7976,7 +9017,6 @@ dependencies = [
  "move-command-line-common",
  "move-core-types",
  "serde",
- "sui-rpc-api",
  "sui-types",
  "thiserror 1.0.69",
  "tokio",
@@ -7985,22 +9025,24 @@ dependencies = [
 [[package]]
 name = "sui-proc-macros"
 version = "0.7.0"
-source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.45.3#643cae13d71392a164f427024d899ea49fc97a23"
+source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.61.2#6c229fe6c04fb21ec98751c798e57e9a00e028e2"
 dependencies = [
  "msim-macros",
  "proc-macro2",
  "quote",
  "sui-enum-compat-util",
- "syn 2.0.100",
+ "syn 2.0.111",
 ]
 
 [[package]]
 name = "sui-protocol-config"
 version = "0.1.0"
-source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.45.3#643cae13d71392a164f427024d899ea49fc97a23"
+source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.61.2#6c229fe6c04fb21ec98751c798e57e9a00e028e2"
 dependencies = [
  "clap",
- "insta",
+ "fastcrypto",
+ "move-binary-format",
+ "move-core-types",
  "move-vm-config",
  "schemars 0.8.22",
  "serde",
@@ -8013,7 +9055,7 @@ dependencies = [
 [[package]]
 name = "sui-protocol-config-macros"
 version = "0.1.0"
-source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.45.3#643cae13d71392a164f427024d899ea49fc97a23"
+source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.61.2#6c229fe6c04fb21ec98751c798e57e9a00e028e2"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -8021,52 +9063,52 @@ dependencies = [
 ]
 
 [[package]]
-name = "sui-rpc-api"
+name = "sui-rpc"
+version = "0.0.8"
+source = "git+https://github.com/MystenLabs/sui-rust-sdk.git?rev=fb62af78b30f5dc64eeaec0094ab95b5ce5b7ce2#fb62af78b30f5dc64eeaec0094ab95b5ce5b7ce2"
+dependencies = [
+ "base64 0.22.1",
+ "bcs",
+ "bytes",
+ "futures",
+ "http 1.4.0",
+ "prost",
+ "prost-types",
+ "serde",
+ "serde_json",
+ "sui-sdk-types 0.0.8",
+ "tap",
+ "tokio",
+ "tonic",
+ "tonic-prost",
+]
+
+[[package]]
+name = "sui-rpc"
 version = "0.1.0"
-source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.45.3#643cae13d71392a164f427024d899ea49fc97a23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a931ef96b890a118f12b6fa1dda727b8b6df82af3bdb5568c5257078a54c5ba8"
 dependencies = [
- "anyhow",
- "async-stream",
- "async-trait",
- "axum",
- "base64 0.21.7",
+ "base64 0.22.1",
  "bcs",
  "bytes",
- "fastcrypto",
- "http 1.3.1",
- "itertools 0.13.0",
- "mime",
- "move-binary-format",
- "move-core-types",
- "mysten-network",
- "prometheus",
+ "futures",
+ "http 1.4.0",
  "prost",
  "prost-types",
- "rand 0.8.5",
- "roaring",
  "serde",
  "serde_json",
- "serde_with",
- "sui-protocol-config",
- "sui-sdk-types",
- "sui-transaction-builder 0.1.0",
- "sui-types",
+ "sui-sdk-types 0.1.0",
  "tap",
- "thiserror 1.0.69",
  "tokio",
- "tokio-stream",
  "tonic",
- "tonic-health",
- "tonic-reflection",
- "tower 0.4.13",
- "tracing",
- "url",
+ "tonic-prost",
 ]
 
 [[package]]
 name = "sui-sdk"
-version = "1.45.3"
-source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.45.3#643cae13d71392a164f427024d899ea49fc97a23"
+version = "1.61.2"
+source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.61.2#6c229fe6c04fb21ec98751c798e57e9a00e028e2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -8098,16 +9140,18 @@ dependencies = [
 
 [[package]]
 name = "sui-sdk-types"
-version = "0.0.2"
-source = "git+https://github.com/MystenLabs/sui-rust-sdk.git?rev=5e11579031793f086178332219f5847ec94da0c4#5e11579031793f086178332219f5847ec94da0c4"
+version = "0.0.8"
+source = "git+https://github.com/MystenLabs/sui-rust-sdk.git?rev=fb62af78b30f5dc64eeaec0094ab95b5ce5b7ce2#fb62af78b30f5dc64eeaec0094ab95b5ce5b7ce2"
 dependencies = [
  "base64ct",
  "bcs",
  "blake2",
  "bnum",
  "bs58 0.5.1",
- "hex",
- "roaring",
+ "bytes",
+ "bytestring",
+ "itertools 0.14.0",
+ "roaring 0.11.2",
  "serde",
  "serde_derive",
  "serde_json",
@@ -8116,31 +9160,32 @@ dependencies = [
 ]
 
 [[package]]
-name = "sui-tls"
-version = "0.0.0"
-source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.45.3#643cae13d71392a164f427024d899ea49fc97a23"
-dependencies = [
- "anyhow",
- "arc-swap",
- "axum",
- "axum-server",
- "ed25519",
- "fastcrypto",
- "pkcs8 0.10.2",
- "rcgen",
- "reqwest",
- "rustls",
- "rustls-webpki",
- "tokio",
- "tokio-rustls",
- "tower-layer",
- "x509-parser",
+name = "sui-sdk-types"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df9497600faf5a1fb07a2db85902515867ad30474abf959de1a7d1fa473c4a28"
+dependencies = [
+ "base64ct",
+ "bcs",
+ "blake2",
+ "bnum",
+ "bs58 0.5.1",
+ "bytes",
+ "bytestring",
+ "itertools 0.14.0",
+ "rand_core 0.6.4",
+ "roaring 0.11.2",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "serde_with",
+ "winnow",
 ]
 
 [[package]]
 name = "sui-transaction-builder"
 version = "0.0.0"
-source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.45.3#643cae13d71392a164f427024d899ea49fc97a23"
+source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.61.2#6c229fe6c04fb21ec98751c798e57e9a00e028e2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -8157,32 +9202,36 @@ dependencies = [
 [[package]]
 name = "sui-transaction-builder"
 version = "0.1.0"
-source = "git+https://github.com/MystenLabs/sui-rust-sdk.git?rev=5e11579031793f086178332219f5847ec94da0c4#5e11579031793f086178332219f5847ec94da0c4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef2fbae254130adbcfc9a29ceaecc4b278e85358a60c977c83c47b8eab7b3180"
 dependencies = [
  "base64ct",
  "bcs",
  "serde",
  "serde_json",
  "serde_with",
- "sui-sdk-types",
- "thiserror 2.0.12",
+ "sui-sdk-types 0.1.0",
+ "thiserror 2.0.17",
 ]
 
 [[package]]
 name = "sui-types"
 version = "0.1.0"
-source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.45.3#643cae13d71392a164f427024d899ea49fc97a23"
+source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.61.2#6c229fe6c04fb21ec98751c798e57e9a00e028e2"
 dependencies = [
  "anemo",
  "anyhow",
  "async-trait",
+ "base64 0.21.7",
  "bcs",
  "better_any",
  "bincode",
  "byteorder",
+ "bytes",
  "chrono",
  "ciborium",
  "consensus-config",
+ "consensus-types",
  "derive_more 1.0.0",
  "enum_dispatch",
  "eyre",
@@ -8190,14 +9239,16 @@ dependencies = [
  "fastcrypto-tbls",
  "fastcrypto-zkp",
  "im",
- "indexmap 2.9.0",
+ "indexmap 2.12.1",
  "itertools 0.13.0",
  "lru 0.10.1",
  "move-binary-format",
  "move-bytecode-utils",
  "move-core-types",
+ "move-trace-format",
  "move-vm-profiler",
  "move-vm-test-utils",
+ "mysten-common",
  "mysten-metrics",
  "mysten-network",
  "nonempty",
@@ -8211,8 +9262,10 @@ dependencies = [
  "prometheus",
  "proptest",
  "proptest-derive",
+ "prost",
+ "prost-types",
  "rand 0.8.5",
- "roaring",
+ "roaring 0.10.12",
  "rustls-pemfile",
  "schemars 0.8.22",
  "serde",
@@ -8222,12 +9275,13 @@ dependencies = [
  "shared-crypto",
  "signature 1.6.4",
  "static_assertions",
- "strum 0.24.1",
- "strum_macros 0.24.3",
+ "strum 0.27.2",
+ "strum_macros 0.27.2",
  "sui-enum-compat-util",
  "sui-macros",
  "sui-protocol-config",
- "sui-sdk-types",
+ "sui-rpc 0.0.8",
+ "sui-sdk-types 0.0.8",
  "tap",
  "thiserror 1.0.69",
  "tonic",
@@ -8239,12 +9293,12 @@ dependencies = [
 [[package]]
 name = "sui-verifier-latest"
 version = "0.1.0"
-source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.45.3#643cae13d71392a164f427024d899ea49fc97a23"
+source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.61.2#6c229fe6c04fb21ec98751c798e57e9a00e028e2"
 dependencies = [
- "move-abstract-interpreter",
  "move-abstract-stack",
  "move-binary-format",
  "move-bytecode-utils",
+ "move-bytecode-verifier",
  "move-bytecode-verifier-meter",
  "move-core-types",
  "move-vm-config",
@@ -8265,9 +9319,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.100"
+version = "2.0.111"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b09a44accad81e1ba1cd74a32461ba89dee89095ba17b32f5d03683b1b1fc2a0"
+checksum = "390cc9a294ab71bdb1aa2e99d13be9c753cd2d7bd6560c77118597410c4d2e87"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -8297,13 +9351,13 @@ dependencies = [
 
 [[package]]
 name = "synstructure"
-version = "0.13.1"
+version = "0.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8af7666ab7b6390ab78131fb5b0fce11d6b7a6951602017c35fa82800708971"
+checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.100",
+ "syn 2.0.111",
 ]
 
 [[package]]
@@ -8312,7 +9366,7 @@ version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3c879d448e9d986b661742763247d3693ed13609438cf3d006f51f5368a5ba6b"
 dependencies = [
- "bitflags 2.9.0",
+ "bitflags 2.10.0",
  "core-foundation 0.9.4",
  "system-configuration-sys",
 ]
@@ -8351,6 +9405,12 @@ dependencies = [
  "syn 1.0.109",
 ]
 
+[[package]]
+name = "tagptr"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b2093cf4c8eb1e67749a6762251bc9cd836b6fc171623bd0a9d324d37af2417"
+
 [[package]]
 name = "tap"
 version = "1.0.1"
@@ -8359,30 +9419,41 @@ checksum = "55937e1799185b12863d447f42597ed69d9928686b8d88a1df17376a097d8369"
 
 [[package]]
 name = "tempfile"
-version = "3.19.1"
+version = "3.23.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7437ac7763b9b123ccf33c338a5cc1bac6f69b45a136c19bdd8a65e3916435bf"
+checksum = "2d31c77bdf42a745371d260a26ca7163f1e0924b64afa0b688e61b5a9fa02f16"
 dependencies = [
  "fastrand",
- "getrandom 0.3.2",
+ "getrandom 0.3.4",
  "once_cell",
  "rustix",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
 name = "templating-jinja"
-version = "0.3.0"
+version = "0.5.0"
 dependencies = [
  "minijinja",
  "nexus-sdk",
  "nexus-toolkit",
- "schemars 1.0.0-alpha.17",
+ "schemars 1.1.0",
  "serde",
  "serde_json",
  "tokio",
 ]
 
+[[package]]
+name = "term"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c59df8ac95d96ff9bede18eb7300b0fda5e5d8d90960e76f8e14ae765eedbf1f"
+dependencies = [
+ "dirs-next",
+ "rustversion",
+ "winapi",
+]
+
 [[package]]
 name = "termcolor"
 version = "1.4.1"
@@ -8394,12 +9465,12 @@ dependencies = [
 
 [[package]]
 name = "terminal_size"
-version = "0.4.2"
+version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "45c6481c4829e4cc63825e62c49186a34538b7b2750b73b266581ffb612fb5ed"
+checksum = "60b8cb979cb11c32ce1603f8137b22262a9d131aaa5c37b5678025f22b8becd0"
 dependencies = [
  "rustix",
- "windows-sys 0.59.0",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -8430,7 +9501,7 @@ dependencies = [
  "serde",
  "serde_json",
  "serde_with",
- "thiserror 2.0.12",
+ "thiserror 2.0.17",
  "tokio",
  "tokio-stream",
  "tokio-tar",
@@ -8441,12 +9512,21 @@ dependencies = [
 [[package]]
 name = "testcontainers-modules"
 version = "0.11.6"
-source = "git+https://github.com/Talus-Network/testcontainers-rs-modules-community?branch=feat%2Fadd-sui-support#2a59cac5f48ff020d02d4a1d6fada8100e960690"
+source = "git+https://github.com/Talus-Network/testcontainers-rs-modules-community?branch=feat%2Fadd-sui-support#d49fb6d4bd73abb8fb768cd1ceefc303d4d84e1a"
 dependencies = [
  "reqwest",
  "testcontainers",
 ]
 
+[[package]]
+name = "textwrap"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d326610f408c7a4eb6f51c37c330e496b08506c9457c9d34287ecc38809fb060"
+dependencies = [
+ "unicode-width 0.1.14",
+]
+
 [[package]]
 name = "thiserror"
 version = "1.0.69"
@@ -8458,11 +9538,11 @@ dependencies = [
 
 [[package]]
 name = "thiserror"
-version = "2.0.12"
+version = "2.0.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "567b8a2dae586314f7be2a752ec7474332959c6460e02bde30d702a66d488708"
+checksum = "f63587ca0f12b72a0600bcba1d40081f830876000bb46dd2337a3051618f4fc8"
 dependencies = [
- "thiserror-impl 2.0.12",
+ "thiserror-impl 2.0.17",
 ]
 
 [[package]]
@@ -8473,18 +9553,18 @@ checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.100",
+ "syn 2.0.111",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "2.0.12"
+version = "2.0.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f7cf42b4507d8ea322120659672cf1b9dbb93f8f2d4ecfd6e51350ff5b17a1d"
+checksum = "3ff15c8ecd7de3849db632e14d18d2571fa09dfc5ed93479bc4485c7a517c913"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.100",
+ "syn 2.0.111",
 ]
 
 [[package]]
@@ -8498,9 +9578,9 @@ dependencies = [
 
 [[package]]
 name = "time"
-version = "0.3.41"
+version = "0.3.44"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a7619e19bc266e0f9c5e6686659d394bc57973859340060a69221e57dbc0c40"
+checksum = "91e7d9e3bb61134e77bde20dd4825b97c010155709965fedf0f49bb138e52a9d"
 dependencies = [
  "deranged",
  "itoa",
@@ -8513,15 +9593,15 @@ dependencies = [
 
 [[package]]
 name = "time-core"
-version = "0.1.4"
+version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c9e9a38711f559d9e3ce1cdb06dd7c5b8ea546bc90052da6d06bb76da74bb07c"
+checksum = "40868e7c1d2f0b8d73e4a8c7f0ff63af4f6d19be117e90bd73eb1d62cf831c6b"
 
 [[package]]
 name = "time-macros"
-version = "0.2.22"
+version = "0.2.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3526739392ec93fd8b359c8e98514cb3e8e021beb4e5f597b00a0221f8ed8a49"
+checksum = "30cfb0125f12d9c277f35663a0a33f8c30190f4e4574868a330595412d34ebf3"
 dependencies = [
  "num-conv",
  "time-core",
@@ -8539,18 +9619,27 @@ dependencies = [
  "pbkdf2",
  "rand 0.8.5",
  "rustc-hash 1.1.0",
- "sha2 0.10.8",
+ "sha2 0.10.9",
  "thiserror 1.0.69",
  "unicode-normalization",
  "wasm-bindgen",
  "zeroize",
 ]
 
+[[package]]
+name = "tiny-keccak"
+version = "2.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2c9d3793400a45f954c52e73d068316d76b6f4e36977e3fcebb13a2721e80237"
+dependencies = [
+ "crunchy",
+]
+
 [[package]]
 name = "tinystr"
-version = "0.7.6"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9117f5d4db391c1cf6927e7bea3db74b9a1c1add8f7eda9ffd5364f40f57b82f"
+checksum = "42d3e9c45c09de15d06dd8acf5f4e0e399e85927b7f00711024eb7ae10fa4869"
 dependencies = [
  "displaydoc",
  "zerovec",
@@ -8558,9 +9647,9 @@ dependencies = [
 
 [[package]]
 name = "tinyvec"
-version = "1.9.0"
+version = "1.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09b3661f17e86524eccd4371ab0429194e0d7c008abb45f7a7495b1719463c71"
+checksum = "bfa5fdc3bce6191a1dbc8c02d5c8bffcf557bafa17c124c5264a458f1b0613fa"
 dependencies = [
  "tinyvec_macros",
 ]
@@ -8573,31 +9662,30 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.44.2"
+version = "1.48.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6b88822cbe49de4185e3a4cbf8321dd487cf5fe0c5c65695fef6346371e9c48"
+checksum = "ff360e02eab121e0bc37a2d3b4d4dc622e6eda3a8e5253d5435ecf5bd4c68408"
 dependencies = [
- "backtrace",
  "bytes",
  "libc",
  "mio",
  "parking_lot",
  "pin-project-lite",
  "signal-hook-registry",
- "socket2",
+ "socket2 0.6.1",
  "tokio-macros",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
 name = "tokio-macros"
-version = "2.5.0"
+version = "2.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e06d43f1345a3bcd39f6a56dbb7dcab2ba47e68e8ac134855e7e2bdbaf8cab8"
+checksum = "af407857209536a95c8e56f8231ef2c2e2aff839b22e07a1ffcbc617e9db9fa5"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.100",
+ "syn 2.0.111",
 ]
 
 [[package]]
@@ -8623,9 +9711,9 @@ dependencies = [
 
 [[package]]
 name = "tokio-rustls"
-version = "0.26.2"
+version = "0.26.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e727b36a1a0e8b74c376ac2211e40c2c8af09fb4013c60d910495810f008e9b"
+checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61"
 dependencies = [
  "rustls",
  "tokio",
@@ -8672,21 +9760,21 @@ dependencies = [
 
 [[package]]
 name = "tokio-tungstenite"
-version = "0.24.0"
+version = "0.28.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "edc5f74e248dc973e0dbb7b74c7e0d6fcc301c694ff50049504004ef4d0cdcd9"
+checksum = "d25a406cddcc431a75d3d9afc6a7c0f7428d4891dd973e4d54c56b46127bf857"
 dependencies = [
  "futures-util",
  "log",
  "tokio",
- "tungstenite 0.24.0",
+ "tungstenite 0.28.0",
 ]
 
 [[package]]
 name = "tokio-util"
-version = "0.7.14"
+version = "0.7.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6b9590b93e6fcc1739458317cccd391ad3955e2bde8913edf6f95f9e65a8f034"
+checksum = "2efa149fe76073d6e8fd97ef4f4eca7b67f599660115591483572e406e165594"
 dependencies = [
  "bytes",
  "futures-core",
@@ -8707,77 +9795,100 @@ dependencies = [
 
 [[package]]
 name = "toml"
-version = "0.8.20"
+version = "0.8.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cd87a5cdd6ffab733b2f74bc4fd7ee5fff6634124999ac278c35fc78c6120148"
+checksum = "dc1beb996b9d83529a9e75c17a1686767d148d70663143c7854d8b4a09ced362"
 dependencies = [
  "serde",
  "serde_spanned",
- "toml_datetime",
- "toml_edit 0.22.24",
+ "toml_datetime 0.6.11",
+ "toml_edit 0.22.27",
 ]
 
 [[package]]
 name = "toml_datetime"
-version = "0.6.8"
+version = "0.6.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0dd7358ecb8fc2f8d014bf86f6f638ce72ba252a2c3a2572f2a795f1d23efb41"
+checksum = "22cddaf88f4fbc13c51aebbf5f8eceb5c7c5a9da2ac40a13519eb5b0a0e8f11c"
 dependencies = [
  "serde",
 ]
 
 [[package]]
-name = "toml_edit"
-version = "0.14.4"
+name = "toml_datetime"
+version = "0.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5376256e44f2443f8896ac012507c19a012df0fe8758b55246ae51a2279db51f"
+checksum = "f2cdb639ebbc97961c51720f858597f7f24c4fc295327923af55b74c3c724533"
 dependencies = [
- "combine",
- "indexmap 1.9.3",
- "itertools 0.10.5",
- "serde",
+ "serde_core",
 ]
 
 [[package]]
 name = "toml_edit"
-version = "0.22.24"
+version = "0.22.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "17b4795ff5edd201c7cd6dca065ae59972ce77d1b80fa0a84d94950ece7d1474"
+checksum = "41fe8c660ae4257887cf66394862d21dbca4a6ddd26f04a3560410406a2f819a"
 dependencies = [
- "indexmap 2.9.0",
+ "indexmap 2.12.1",
  "serde",
  "serde_spanned",
- "toml_datetime",
+ "toml_datetime 0.6.11",
+ "toml_write",
+ "winnow",
+]
+
+[[package]]
+name = "toml_edit"
+version = "0.23.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d7cbc3b4b49633d57a0509303158ca50de80ae32c265093b24c414705807832"
+dependencies = [
+ "indexmap 2.12.1",
+ "toml_datetime 0.7.3",
+ "toml_parser",
+ "winnow",
+]
+
+[[package]]
+name = "toml_parser"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0cbe268d35bdb4bb5a56a2de88d0ad0eb70af5384a99d648cd4b3d04039800e"
+dependencies = [
  "winnow",
 ]
 
+[[package]]
+name = "toml_write"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d99f8c9a7727884afe522e9bd5edbfc91a3312b36a77b5fb8926e4c31a41801"
+
 [[package]]
 name = "tonic"
-version = "0.12.3"
+version = "0.14.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "877c5b330756d856ffcc4553ab34a5684481ade925ecc54bcd1bf02b1d0d4d52"
+checksum = "eb7613188ce9f7df5bfe185db26c5814347d110db17920415cf2fbcad85e7203"
 dependencies = [
- "async-stream",
  "async-trait",
  "axum",
  "base64 0.22.1",
  "bytes",
- "h2 0.4.8",
- "http 1.3.1",
+ "h2 0.4.12",
+ "http 1.4.0",
  "http-body 1.0.1",
  "http-body-util",
- "hyper 1.6.0",
+ "hyper 1.8.1",
  "hyper-timeout",
  "hyper-util",
  "percent-encoding",
  "pin-project",
- "prost",
- "rustls-pemfile",
- "socket2",
+ "socket2 0.6.1",
+ "sync_wrapper",
  "tokio",
  "tokio-rustls",
  "tokio-stream",
- "tower 0.4.13",
+ "tower 0.5.2",
  "tower-layer",
  "tower-service",
  "tracing",
@@ -8787,27 +9898,25 @@ dependencies = [
 
 [[package]]
 name = "tonic-health"
-version = "0.12.3"
+version = "0.14.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1eaf34ddb812120f5c601162d5429933c9b527d901ab0e7f930d3147e33a09b2"
+checksum = "2a82868bf299e0a1d2e8dce0dc33a46c02d6f045b2c1f1d6cc8dc3d0bf1812ef"
 dependencies = [
- "async-stream",
  "prost",
  "tokio",
  "tokio-stream",
  "tonic",
+ "tonic-prost",
 ]
 
 [[package]]
-name = "tonic-reflection"
-version = "0.12.3"
+name = "tonic-prost"
+version = "0.14.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "878d81f52e7fcfd80026b7fdb6a9b578b3c3653ba987f87f0dce4b64043cba27"
+checksum = "66bd50ad6ce1252d87ef024b3d64fe4c3cf54a86fb9ef4c631fdd0ded7aeaa67"
 dependencies = [
+ "bytes",
  "prost",
- "prost-types",
- "tokio",
- "tokio-stream",
  "tonic",
 ]
 
@@ -8840,11 +9949,16 @@ checksum = "d039ad9159c98b70ecfd540b2573b97f7f52c3e8d9f8ad57a24b916a536975f9"
 dependencies = [
  "futures-core",
  "futures-util",
+ "hdrhistogram",
+ "indexmap 2.12.1",
  "pin-project-lite",
+ "slab",
  "sync_wrapper",
  "tokio",
+ "tokio-util",
  "tower-layer",
  "tower-service",
+ "tracing",
 ]
 
 [[package]]
@@ -8855,11 +9969,11 @@ checksum = "1e9cd434a998747dd2c4276bc96ee2e0c7a2eadf3cae88e52be55a05fa9053f5"
 dependencies = [
  "async-compression",
  "base64 0.21.7",
- "bitflags 2.9.0",
+ "bitflags 2.10.0",
  "bytes",
  "futures-core",
  "futures-util",
- "http 1.3.1",
+ "http 1.4.0",
  "http-body 1.0.1",
  "http-body-util",
  "http-range-header",
@@ -8878,6 +9992,24 @@ dependencies = [
  "uuid",
 ]
 
+[[package]]
+name = "tower-http"
+version = "0.6.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d4e6559d53cc268e5031cd8429d05415bc4cb4aefc4aa5d6cc35fbf5b924a1f8"
+dependencies = [
+ "bitflags 2.10.0",
+ "bytes",
+ "futures-util",
+ "http 1.4.0",
+ "http-body 1.0.1",
+ "iri-string",
+ "pin-project-lite",
+ "tower 0.5.2",
+ "tower-layer",
+ "tower-service",
+]
+
 [[package]]
 name = "tower-layer"
 version = "0.3.3"
@@ -8892,9 +10024,9 @@ checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
 
 [[package]]
 name = "tracing"
-version = "0.1.41"
+version = "0.1.43"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "784e0ac535deb450455cbfa28a6f0df145ea1bb7ae51b821cf5e7927fdcfbdd0"
+checksum = "2d15d90a0b5c19378952d479dc858407149d7bb45a14de0142f6c534b16fc647"
 dependencies = [
  "log",
  "pin-project-lite",
@@ -8904,20 +10036,20 @@ dependencies = [
 
 [[package]]
 name = "tracing-attributes"
-version = "0.1.28"
+version = "0.1.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "395ae124c09f9e6918a2310af6038fba074bcf474ac352496d5910dd59a2226d"
+checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.100",
+ "syn 2.0.111",
 ]
 
 [[package]]
 name = "tracing-core"
-version = "0.1.33"
+version = "0.1.35"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e672c95779cf947c5311f83787af4fa8fffd12fb27e4993211a84bdfd9610f9c"
+checksum = "7a04e24fab5c89c6a36eb8558c9656f30d81de51dfa4d3b45f26b21d61fa0a6c"
 dependencies = [
  "once_cell",
 ]
@@ -8954,7 +10086,7 @@ dependencies = [
  "byteorder",
  "bytes",
  "data-encoding",
- "http 1.3.1",
+ "http 1.4.0",
  "httparse",
  "log",
  "rand 0.8.5",
@@ -8966,26 +10098,25 @@ dependencies = [
 
 [[package]]
 name = "tungstenite"
-version = "0.24.0"
+version = "0.28.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "18e5b8366ee7a95b16d32197d0b2604b43a0be89dc5fac9f8e96ccafbaedda8a"
+checksum = "8628dcc84e5a09eb3d8423d6cb682965dea9133204e8fb3efee74c2a0c259442"
 dependencies = [
- "byteorder",
  "bytes",
  "data-encoding",
- "http 1.3.1",
+ "http 1.4.0",
  "httparse",
  "log",
- "rand 0.8.5",
+ "rand 0.9.2",
  "sha1",
- "thiserror 1.0.69",
+ "thiserror 2.0.17",
  "utf-8",
 ]
 
 [[package]]
 name = "typed-store-error"
 version = "0.4.0"
-source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.45.3#643cae13d71392a164f427024d899ea49fc97a23"
+source = "git+https://github.com/MystenLabs/sui?tag=mainnet-v1.61.2#6c229fe6c04fb21ec98751c798e57e9a00e028e2"
 dependencies = [
  "serde",
  "thiserror 1.0.69",
@@ -8999,9 +10130,9 @@ checksum = "bc7d623258602320d5c55d1bc22793b57daff0ec7efc270ea7d55ce1d5f5471c"
 
 [[package]]
 name = "typenum"
-version = "1.18.0"
+version = "1.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1dccffe3ce07af9386bfd29e80c0ab1a8205a2fc34e4bcd40364df902cfa8f3f"
+checksum = "562d481066bde0658276a35467c4af00bdc6ee726305698a55b86e61d7ad82bb"
 
 [[package]]
 name = "typeshare"
@@ -9022,15 +10153,9 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a615d6c2764852a2e88a4f16e9ce1ea49bb776b5872956309e170d63a042a34f"
 dependencies = [
  "quote",
- "syn 2.0.100",
+ "syn 2.0.111",
 ]
 
-[[package]]
-name = "ucd-trie"
-version = "0.1.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2896d95c02a80c6d6a5d6e953d479f5ddf2dfdb6a244441010e373ac0fb88971"
-
 [[package]]
 name = "uint"
 version = "0.9.5"
@@ -9063,15 +10188,15 @@ checksum = "75b844d17643ee918803943289730bec8aac480150456169e647ed0b576ba539"
 
 [[package]]
 name = "unicode-ident"
-version = "1.0.18"
+version = "1.0.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a5f39404a5da50712a4c1eecf25e90dd62b613502b7e925fd4e4d19b5c96512"
+checksum = "9312f7c4f6ff9069b165498234ce8be658059c6728633667c526e27dc2cf1df5"
 
 [[package]]
 name = "unicode-normalization"
-version = "0.1.24"
+version = "0.1.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5033c97c4262335cded6d6fc3e5c18ab755e1a3dc96376350f3d8e9f009ad956"
+checksum = "5fd4f6878c9cb28d874b009da9e8d183b5abc80117c40bbd187a1fde336be6e8"
 dependencies = [
  "tinyvec",
 ]
@@ -9090,9 +10215,9 @@ checksum = "7dd6e30e90baa6f72411720665d41d89b9a3d039dc45b8faea1ddd07f617f6af"
 
 [[package]]
 name = "unicode-width"
-version = "0.2.0"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fc81956842c57dac11422a97c3b8195a1ff727f06e85c84ed2e8aa277c9a0fd"
+checksum = "b4ac048d71ede7ee76d585517add45da530660ef4390e49b098733c6e897f254"
 
 [[package]]
 name = "unicode-xid"
@@ -9124,9 +10249,9 @@ checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
 
 [[package]]
 name = "url"
-version = "2.5.4"
+version = "2.5.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32f8b686cadd1473f4bd0117a5d28d36b1ade384ea9b5069a1c40aefed7fda60"
+checksum = "08bc136a29a3d1758e07a9cca267be308aeebf5cfd5a10f3f67ab2097683ef5b"
 dependencies = [
  "form_urlencoded",
  "idna",
@@ -9140,12 +10265,6 @@ version = "0.7.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "09cc8ee72d2a9becf2f2febe0205bbed8fc6615b7cb429ad062dc7b7ddd036a9"
 
-[[package]]
-name = "utf16_iter"
-version = "1.0.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8232dd3cdaed5356e0f716d285e4b40b932ac434100fe9b7e0e8e935b9e6246"
-
 [[package]]
 name = "utf8_iter"
 version = "1.0.4"
@@ -9160,12 +10279,14 @@ checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
 
 [[package]]
 name = "uuid"
-version = "1.16.0"
+version = "1.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "458f7a779bf54acc9f347480ac654f68407d3aab21269a6e3c9f922acd9e2da9"
+checksum = "e2e054861b4bd027cd373e18e8d8d8e6548085000e41290d95ce0c373a654b4a"
 dependencies = [
- "getrandom 0.3.2",
- "rand 0.9.0",
+ "getrandom 0.3.4",
+ "js-sys",
+ "rand 0.9.2",
+ "wasm-bindgen",
 ]
 
 [[package]]
@@ -9181,12 +10302,13 @@ dependencies = [
 
 [[package]]
 name = "variant_count"
-version = "1.1.0"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aae2faf80ac463422992abf4de234731279c058aaf33171ca70277c98406b124"
+checksum = "a1935e10c6f04d22688d07c0790f2fc0e1b1c5c2c55bc0cc87ed67656e587dd8"
 dependencies = [
+ "proc-macro2",
  "quote",
- "syn 1.0.109",
+ "syn 2.0.111",
 ]
 
 [[package]]
@@ -9244,7 +10366,7 @@ dependencies = [
 
 [[package]]
 name = "walrus"
-version = "0.3.0"
+version = "0.5.0"
 dependencies = [
  "anyhow",
  "jsonschema",
@@ -9252,10 +10374,10 @@ dependencies = [
  "nexus-sdk",
  "nexus-toolkit",
  "reqwest",
- "schemars 1.0.0-alpha.17",
+ "schemars 1.1.0",
  "serde",
  "serde_json",
- "thiserror 2.0.12",
+ "thiserror 2.0.17",
  "tokio",
 ]
 
@@ -9299,17 +10421,17 @@ dependencies = [
 
 [[package]]
 name = "wasi"
-version = "0.11.0+wasi-snapshot-preview1"
+version = "0.11.1+wasi-snapshot-preview1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
+checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
 
 [[package]]
-name = "wasi"
-version = "0.14.2+wasi-0.2.4"
+name = "wasip2"
+version = "1.0.1+wasi-0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9683f9a5a998d873c0d21fcbe3c083009670149a8fab228644b8bd36b2c48cb3"
+checksum = "0562428422c63773dad2c345a1882263bbf4d65cf3f42e90921f787ef5ad58e7"
 dependencies = [
- "wit-bindgen-rt",
+ "wit-bindgen",
 ]
 
 [[package]]
@@ -9320,35 +10442,22 @@ checksum = "b8dad83b4f25e74f184f64c43b150b91efe7647395b42289f38e50566d82855b"
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.100"
+version = "0.2.106"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1edc8929d7499fc4e8f0be2262a241556cfc54a0bea223790e71446f2aab1ef5"
+checksum = "0d759f433fa64a2d763d1340820e46e111a7a5ab75f993d1852d70b03dbb80fd"
 dependencies = [
  "cfg-if",
  "once_cell",
  "rustversion",
  "wasm-bindgen-macro",
-]
-
-[[package]]
-name = "wasm-bindgen-backend"
-version = "0.2.100"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f0a0651a5c2bc21487bde11ee802ccaf4c51935d0d3d42a6101f98161700bc6"
-dependencies = [
- "bumpalo",
- "log",
- "proc-macro2",
- "quote",
- "syn 2.0.100",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-futures"
-version = "0.4.50"
+version = "0.4.56"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "555d470ec0bc3bb57890405e5d4322cc9ea83cebb085523ced7be4144dac1e61"
+checksum = "836d9622d604feee9e5de25ac10e3ea5f2d65b41eac0d9ce72eb5deae707ce7c"
 dependencies = [
  "cfg-if",
  "js-sys",
@@ -9359,9 +10468,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.100"
+version = "0.2.106"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7fe63fc6d09ed3792bd0897b314f53de8e16568c2b3f7982f468c0bf9bd0b407"
+checksum = "48cb0d2638f8baedbc542ed444afc0644a29166f1595371af4fecf8ce1e7eeb3"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -9369,22 +10478,22 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.100"
+version = "0.2.106"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ae87ea40c9f689fc23f209965b6fb8a99ad69aeeb0231408be24920604395de"
+checksum = "cefb59d5cd5f92d9dcf80e4683949f15ca4b511f4ac0a6e14d4e1ac60c6ecd40"
 dependencies = [
+ "bumpalo",
  "proc-macro2",
  "quote",
- "syn 2.0.100",
- "wasm-bindgen-backend",
+ "syn 2.0.111",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.100"
+version = "0.2.106"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a05d73b933a847d6cccdda8f838a22ff101ad9bf93e33684f39c1f5f0eece3d"
+checksum = "cbc538057e648b67f72a982e708d485b2efa771e1ac05fec311f9f63e5800db4"
 dependencies = [
  "unicode-ident",
 ]
@@ -9404,9 +10513,9 @@ dependencies = [
 
 [[package]]
 name = "web-sys"
-version = "0.3.77"
+version = "0.3.83"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33b6dd2ef9186f1f2072e409e99cd22a975331a6b3591b12c764e0e55c60d5d2"
+checksum = "9b32828d774c412041098d182a8b38b16ea816958e07cf40eec2bc080ae137ac"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
@@ -9424,29 +10533,38 @@ dependencies = [
 
 [[package]]
 name = "webpki-root-certs"
-version = "0.26.8"
+version = "0.26.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09aed61f5e8d2c18344b3faa33a4c837855fe56642757754775548fee21386c4"
+checksum = "75c7f0ef91146ebfb530314f5f1d24528d7f0767efbfd31dce919275413e393e"
+dependencies = [
+ "webpki-root-certs 1.0.4",
+]
+
+[[package]]
+name = "webpki-root-certs"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee3e3b5f5e80bc89f30ce8d0343bf4e5f12341c51f3e26cbeecbc7c85443e85b"
 dependencies = [
  "rustls-pki-types",
 ]
 
 [[package]]
 name = "webpki-roots"
-version = "0.26.8"
+version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2210b291f7ea53617fbafcc4939f10914214ec15aace5ba62293a668f322c5c9"
+checksum = "b2878ef029c47c6e8cf779119f20fcf52bde7ad42a731b2a304bc221df17571e"
 dependencies = [
  "rustls-pki-types",
 ]
 
 [[package]]
 name = "whoami"
-version = "1.6.0"
+version = "1.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6994d13118ab492c3c80c1f81928718159254c53c472bf9ce36f8dae4add02a7"
+checksum = "5d4a4db5077702ca3015d3d02d74974948aba2ad9e12ab7df718ee64ccd7e97d"
 dependencies = [
- "redox_syscall 0.5.11",
+ "libredox",
  "wasite",
  "web-sys",
 ]
@@ -9459,9 +10577,9 @@ checksum = "17882f045410753661207383517a6f62ec3dbeb6a4ed2acce01f0728238d1983"
 
 [[package]]
 name = "widestring"
-version = "1.2.0"
+version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd7cf3379ca1aac9eea11fba24fd7e315d621f8dfe35c8d7d2be8b793726e07d"
+checksum = "72069c3113ab32ab29e5584db3c6ec55d416895e60715417b5b883a357c3e471"
 
 [[package]]
 name = "winapi"
@@ -9481,11 +10599,11 @@ checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
 
 [[package]]
 name = "winapi-util"
-version = "0.1.9"
+version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf221c93e13a30d793f7645a0e7762c55d169dbb0a49671918a2319d289b10bb"
+checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -9496,79 +10614,70 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windows-core"
-version = "0.61.0"
+version = "0.62.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4763c1de310c86d75a878046489e2e5ba02c649d185f21c67d4cf8a56d098980"
+checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb"
 dependencies = [
  "windows-implement",
  "windows-interface",
  "windows-link",
  "windows-result",
- "windows-strings 0.4.0",
+ "windows-strings",
 ]
 
 [[package]]
 name = "windows-implement"
-version = "0.60.0"
+version = "0.60.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a47fddd13af08290e67f4acabf4b459f647552718f683a7b415d290ac744a836"
+checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.100",
+ "syn 2.0.111",
 ]
 
 [[package]]
 name = "windows-interface"
-version = "0.59.1"
+version = "0.59.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bd9211b69f8dcdfa817bfd14bf1c97c9188afa36f4750130fcdf3f400eca9fa8"
+checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.100",
+ "syn 2.0.111",
 ]
 
 [[package]]
 name = "windows-link"
-version = "0.1.1"
+version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "76840935b766e1b0a05c0066835fb9ec80071d4c09a16f6bd5f7e655e3c14c38"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
 
 [[package]]
 name = "windows-registry"
-version = "0.4.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4286ad90ddb45071efd1a66dfa43eb02dd0dfbae1545ad6cc3c51cf34d7e8ba3"
+checksum = "02752bf7fbdcce7f2a27a742f798510f3e5ad88dbe84871e5168e2120c3d5720"
 dependencies = [
+ "windows-link",
  "windows-result",
- "windows-strings 0.3.1",
- "windows-targets 0.53.0",
+ "windows-strings",
 ]
 
 [[package]]
 name = "windows-result"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c64fd11a4fd95df68efcfee5f44a294fe71b8bc6a91993e2791938abcc712252"
-dependencies = [
- "windows-link",
-]
-
-[[package]]
-name = "windows-strings"
-version = "0.3.1"
+version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87fa48cc5d406560701792be122a10132491cff9d0aeb23583cc2dcafc847319"
+checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5"
 dependencies = [
  "windows-link",
 ]
 
 [[package]]
 name = "windows-strings"
-version = "0.4.0"
+version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a2ba9642430ee452d5a7aa78d72907ebe8cfda358e8cb7918a2050581322f97"
+checksum = "7837d08f69c77cf6b07689544538e017c1bfcf57e34b4c0ff58e6c2cd3b37091"
 dependencies = [
  "windows-link",
 ]
@@ -9609,6 +10718,24 @@ dependencies = [
  "windows-targets 0.52.6",
 ]
 
+[[package]]
+name = "windows-sys"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2f500e4d28234f72040990ec9d39e3a6b950f9f22d3dba18416c35882612bcb"
+dependencies = [
+ "windows-targets 0.53.5",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
+dependencies = [
+ "windows-link",
+]
+
 [[package]]
 name = "windows-targets"
 version = "0.42.2"
@@ -9657,18 +10784,19 @@ dependencies = [
 
 [[package]]
 name = "windows-targets"
-version = "0.53.0"
+version = "0.53.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b1e4c7e8ceaaf9cb7d7507c974735728ab453b67ef8f18febdd7c11fe59dca8b"
+checksum = "4945f9f551b88e0d65f3db0bc25c33b8acea4d9e41163edf90dcd0b19f9069f3"
 dependencies = [
- "windows_aarch64_gnullvm 0.53.0",
- "windows_aarch64_msvc 0.53.0",
- "windows_i686_gnu 0.53.0",
- "windows_i686_gnullvm 0.53.0",
- "windows_i686_msvc 0.53.0",
- "windows_x86_64_gnu 0.53.0",
- "windows_x86_64_gnullvm 0.53.0",
- "windows_x86_64_msvc 0.53.0",
+ "windows-link",
+ "windows_aarch64_gnullvm 0.53.1",
+ "windows_aarch64_msvc 0.53.1",
+ "windows_i686_gnu 0.53.1",
+ "windows_i686_gnullvm 0.53.1",
+ "windows_i686_msvc 0.53.1",
+ "windows_x86_64_gnu 0.53.1",
+ "windows_x86_64_gnullvm 0.53.1",
+ "windows_x86_64_msvc 0.53.1",
 ]
 
 [[package]]
@@ -9691,9 +10819,9 @@ checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
 
 [[package]]
 name = "windows_aarch64_gnullvm"
-version = "0.53.0"
+version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "86b8d5f90ddd19cb4a147a5fa63ca848db3df085e25fee3cc10b39b6eebae764"
+checksum = "a9d8416fa8b42f5c947f8482c43e7d89e73a173cead56d044f6a56104a6d1b53"
 
 [[package]]
 name = "windows_aarch64_msvc"
@@ -9715,9 +10843,9 @@ checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
 
 [[package]]
 name = "windows_aarch64_msvc"
-version = "0.53.0"
+version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c7651a1f62a11b8cbd5e0d42526e55f2c99886c77e007179efff86c2b137e66c"
+checksum = "b9d782e804c2f632e395708e99a94275910eb9100b2114651e04744e9b125006"
 
 [[package]]
 name = "windows_i686_gnu"
@@ -9739,9 +10867,9 @@ checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
 
 [[package]]
 name = "windows_i686_gnu"
-version = "0.53.0"
+version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1dc67659d35f387f5f6c479dc4e28f1d4bb90ddd1a5d3da2e5d97b42d6272c3"
+checksum = "960e6da069d81e09becb0ca57a65220ddff016ff2d6af6a223cf372a506593a3"
 
 [[package]]
 name = "windows_i686_gnullvm"
@@ -9751,9 +10879,9 @@ checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
 
 [[package]]
 name = "windows_i686_gnullvm"
-version = "0.53.0"
+version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ce6ccbdedbf6d6354471319e781c0dfef054c81fbc7cf83f338a4296c0cae11"
+checksum = "fa7359d10048f68ab8b09fa71c3daccfb0e9b559aed648a8f95469c27057180c"
 
 [[package]]
 name = "windows_i686_msvc"
@@ -9775,9 +10903,9 @@ checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
 
 [[package]]
 name = "windows_i686_msvc"
-version = "0.53.0"
+version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "581fee95406bb13382d2f65cd4a908ca7b1e4c2f1917f143ba16efe98a589b5d"
+checksum = "1e7ac75179f18232fe9c285163565a57ef8d3c89254a30685b57d83a38d326c2"
 
 [[package]]
 name = "windows_x86_64_gnu"
@@ -9799,9 +10927,9 @@ checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
 
 [[package]]
 name = "windows_x86_64_gnu"
-version = "0.53.0"
+version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2e55b5ac9ea33f2fc1716d1742db15574fd6fc8dadc51caab1c16a3d3b4190ba"
+checksum = "9c3842cdd74a865a8066ab39c8a7a473c0778a3f29370b5fd6b4b9aa7df4a499"
 
 [[package]]
 name = "windows_x86_64_gnullvm"
@@ -9823,9 +10951,9 @@ checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
 
 [[package]]
 name = "windows_x86_64_gnullvm"
-version = "0.53.0"
+version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0a6e035dd0599267ce1ee132e51c27dd29437f63325753051e71dd9e42406c57"
+checksum = "0ffa179e2d07eee8ad8f57493436566c7cc30ac536a3379fdf008f47f6bb7ae1"
 
 [[package]]
 name = "windows_x86_64_msvc"
@@ -9847,15 +10975,15 @@ checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
 
 [[package]]
 name = "windows_x86_64_msvc"
-version = "0.53.0"
+version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "271414315aff87387382ec3d271b52d7ae78726f5d44ac98b4f4030c91880486"
+checksum = "d6bbff5f0aada427a1e5a6da5f1f98158182f26556f345ac9e04d36d0ebed650"
 
 [[package]]
 name = "winnow"
-version = "0.7.6"
+version = "0.7.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "63d3fcd9bba44b03821e7d699eeee959f3126dcc4aa8e4ae18ec617c2a5cea10"
+checksum = "5a5364e9d77fcdeeaa6062ced926ee3381faa2ee02d3eb83a5c27a8825540829"
 dependencies = [
  "memchr",
 ]
@@ -9871,25 +10999,16 @@ dependencies = [
 ]
 
 [[package]]
-name = "wit-bindgen-rt"
-version = "0.39.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6f42320e61fe2cfd34354ecb597f86f413484a798ba44a8ca1165c58d42da6c1"
-dependencies = [
- "bitflags 2.9.0",
-]
-
-[[package]]
-name = "write16"
-version = "1.0.0"
+name = "wit-bindgen"
+version = "0.46.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d1890f4022759daae28ed4fe62859b1236caebfc61ede2f63ed4e695f3f6d936"
+checksum = "f17a85883d4e6d00e8a97c586de764dabcc06133f7f1d55dce5cdc070ad7fe59"
 
 [[package]]
 name = "writeable"
-version = "0.5.5"
+version = "0.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e9df38ee2d2c3c5948ea468a8406ff0db0b29ae1ffde1bcf20ef305bcc95c51"
+checksum = "9edde0db4769d2dc68579893f2306b26c6ecfbe0ef499b013d731b7b9247e0b9"
 
 [[package]]
 name = "wyz"
@@ -9932,15 +11051,15 @@ dependencies = [
  "oid-registry",
  "ring",
  "rusticata-macros",
- "thiserror 2.0.12",
+ "thiserror 2.0.17",
  "time",
 ]
 
 [[package]]
 name = "xattr"
-version = "1.5.0"
+version = "1.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d65cbf2f12c15564212d48f4e3dfb87923d25d611f2aed18f4cb23f0413d89e"
+checksum = "32e45ad4206f6d2479085147f02bc2ef834ac85886624a23575ae137c8aa8156"
 dependencies = [
  "libc",
  "rustix",
@@ -9953,11 +11072,11 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2460c9a9c9d1331ff6801e87badb517faa6b6758e5fb585eb27daf7622c6d5ad"
 dependencies = [
  "curve25519-dalek",
- "derive_more 0.99.19",
+ "derive_more 0.99.20",
  "ed25519",
  "ed25519-dalek",
  "rand 0.8.5",
- "sha2 0.10.8",
+ "sha2 0.10.9",
  "x25519-dalek",
  "zeroize",
 ]
@@ -9982,11 +11101,10 @@ dependencies = [
 
 [[package]]
 name = "yoke"
-version = "0.7.5"
+version = "0.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "120e6aef9aa629e3d4f52dc8cc43a015c7724194c97dfaf45180d2daf2b77f40"
+checksum = "72d6e5c6afb84d73944e5cedb052c4680d5657337201555f9f2a16b7406d4954"
 dependencies = [
- "serde",
  "stable_deref_trait",
  "yoke-derive",
  "zerofrom",
@@ -9994,54 +11112,34 @@ dependencies = [
 
 [[package]]
 name = "yoke-derive"
-version = "0.7.5"
+version = "0.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2380878cad4ac9aac1e2435f3eb4020e8374b5f13c296cb75b4620ff8e229154"
+checksum = "b659052874eb698efe5b9e8cf382204678a0086ebf46982b79d6ca3182927e5d"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.100",
- "synstructure 0.13.1",
-]
-
-[[package]]
-name = "zerocopy"
-version = "0.7.35"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b9b4fd18abc82b8136838da5d50bae7bdea537c574d8dc1a34ed098d6c166f0"
-dependencies = [
- "zerocopy-derive 0.7.35",
+ "syn 2.0.111",
+ "synstructure 0.13.2",
 ]
 
 [[package]]
 name = "zerocopy"
-version = "0.8.24"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2586fea28e186957ef732a5f8b3be2da217d65c5969d4b1e17f973ebbe876879"
-dependencies = [
- "zerocopy-derive 0.8.24",
-]
-
-[[package]]
-name = "zerocopy-derive"
-version = "0.7.35"
+version = "0.8.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa4f8080344d4671fb4e831a13ad1e68092748387dfc4f55e356242fae12ce3e"
+checksum = "fd74ec98b9250adb3ca554bdde269adf631549f51d8a8f8f0a10b50f1cb298c3"
 dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.100",
+ "zerocopy-derive",
 ]
 
 [[package]]
 name = "zerocopy-derive"
-version = "0.8.24"
+version = "0.8.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a996a8f63c5c4448cd959ac1bab0aaa3306ccfd060472f85943ee0750f0169be"
+checksum = "d8a8d209fdf45cf5138cbb5a506f6b52522a25afccc534d1475dad8e31105c6a"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.100",
+ "syn 2.0.111",
 ]
 
 [[package]]
@@ -10061,15 +11159,15 @@ checksum = "d71e5d6e06ab090c67b5e44993ec16b72dcbaabc526db883a360057678b48502"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.100",
- "synstructure 0.13.1",
+ "syn 2.0.111",
+ "synstructure 0.13.2",
 ]
 
 [[package]]
 name = "zeroize"
-version = "1.8.1"
+version = "1.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ced3678a2879b30306d323f4542626697a464a97c0a07c9aebf7ebca65cd4dde"
+checksum = "b97154e67e32c85465826e8bcc1c59429aaaf107c1e4a9e53c8d8ccd5eff88d0"
 dependencies = [
  "zeroize_derive",
 ]
@@ -10082,14 +11180,25 @@ checksum = "ce36e65b0d2999d2aafac989fb249189a141aee1f53c612c1f37d72631959f69"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.100",
+ "syn 2.0.111",
+]
+
+[[package]]
+name = "zerotrie"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2a59c17a5562d507e4b54960e8569ebee33bee890c70aa3fe7b97e85a9fd7851"
+dependencies = [
+ "displaydoc",
+ "yoke",
+ "zerofrom",
 ]
 
 [[package]]
 name = "zerovec"
-version = "0.10.4"
+version = "0.11.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aa2b893d79df23bfb12d5461018d408ea19dfafe76c2c7ef6d4eba614f8ff079"
+checksum = "6c28719294829477f525be0186d13efa9a3c602f7ec202ca9e353d310fb9a002"
 dependencies = [
  "yoke",
  "zerofrom",
@@ -10098,13 +11207,13 @@ dependencies = [
 
 [[package]]
 name = "zerovec-derive"
-version = "0.10.3"
+version = "0.11.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6eafa6dfb17584ea3e2bd6e76e0cc15ad7af12b09abdd1ca55961bed9b1063c6"
+checksum = "eadce39539ca5cb3985590102671f2567e659fca9666581ad3411d59207951f3"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.100",
+ "syn 2.0.111",
 ]
 
 [[package]]
@@ -10127,9 +11236,9 @@ dependencies = [
 
 [[package]]
 name = "zstd-sys"
-version = "2.0.15+zstd.1.5.7"
+version = "2.0.16+zstd.1.5.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eb81183ddd97d0c74cedf1d50d85c8d08c1b8b68ee863bdee9e706eedba1a237"
+checksum = "91e19ebc2adc8f83e43039e79776e3fda8ca919132d68a1fed6a5faca2683748"
 dependencies = [
  "cc",
  "pkg-config",
diff --git a/Cargo.toml b/Cargo.toml
index 33b6827d..84f3db3a 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -4,7 +4,7 @@ members = ["toolkit-rust", "cli", "sdk-wasm", "sdk", "tools/*"]
 
 [workspace.package]
 edition = "2021"
-version = "0.3.0"
+version = "0.5.0"
 repository = "https://github.com/Talus-Network/nexus-sdk"
 homepage = "https://talus.network"
 license = "Apache-2.0"
@@ -23,17 +23,20 @@ aes-siv = "0.7"
 anyhow = "1.0.97"
 argon2 = "0.5"
 base64 = "0.21"
+bcs = "0.1.6"
 bip32 = "0.4.0"
 bincode = "1"
 chrono = { version = "0.4", features = ["serde"] }
 clap = { version = "4.5.32", features = ["derive"] }
 clap_complete = "4.5.48"
+clap-verbosity = "2.1.0"
 colored = "3.0.0"
 convert_case = "0.7.1"
 directories = "5"
 enum_dispatch = "0.3.13"
 env_logger = "0.11.7"
 futures = "0.3.31"
+graphql_client = "0.14"
 hex = "0.4"
 home = "0.5.11"
 indicatif = "0.17.11"
@@ -42,29 +45,32 @@ keyring = "3.6"
 lazy-regex = "3.4.1"
 log = "^0.4.26"
 minijinja = "2.8.0"
+mockall = "0.14.0"
 mockito = "1.7.0"
 openssl = { version = "0.10", features = ["vendored"] }
 petgraph = "0.7.1"
 portpicker = "0.1.1"
+prost-types = "0.14.1"
 rand = { version = "0.8", default-features = false, features = ["std"] }
 regex = "1.11.1"
-reqwest = "0.12.14"
+reqwest = { version = "0.12.14", features = ["json", "stream"] }
 rpassword = "7.4.0"
 rstest = "0.25.0"
 # Keep an eye for the full release here. We need v1 for draft2020-12 schema.
 schemars = "1.0.0-alpha.17"
-serde = { version = "1.0.219", features = ["derive"] }
+serde = { version = "1.0", features = ["derive"] }
 serde-big-array = "0.5.1"
-serde_json = "1.0.140"
+serde_json = "1.0"
 serde_path_to_error = "0.1.17"
 serial_test = "3.2.0"
 strum = "0.27"
 strum_macros = "0.27"
 tempfile = "3.19.0"
 thiserror = "2.0.12"
-tokio = { version = "1.44.1", features = ["full"] }
+tokio = { version = "1.48.0", features = ["full"] }
 tokio-retry = "0.3.0"
 toml = "0.8.20"
+tonic = "0.14"
 warp = "0.3.7"
 zeroize = "1.7"
 
diff --git a/Cross.toml b/Cross.toml
new file mode 100644
index 00000000..91c03ceb
--- /dev/null
+++ b/Cross.toml
@@ -0,0 +1,5 @@
+[target.x86_64-unknown-linux-gnu]
+pre-build = [
+    "dpkg --add-architecture $CROSS_DEB_ARCH",
+    "apt-get update && apt-get install -y pkg-config libssl-dev:$CROSS_DEB_ARCH libdbus-1-dev:$CROSS_DEB_ARCH",
+]
diff --git a/README.md b/README.md
index fe9ed105..73a4f667 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,8 @@
 # Nexus SDK
 
 [![Contributor Covenant](https://img.shields.io/badge/Contributor%20Covenant-2.1-4baaaa.svg)](CODE_OF_CONDUCT.md)
+[![License](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](https://github.com/Talus-Network/nexus-sdk/blob/main/LICENSE)
+[![Actions](https://img.shields.io/badge/GitHub_Actions-Active-brightgreen)](https://github.com/Talus-Network/nexus-sdk/actions)
 [![codecov](https://codecov.io/gh/Talus-Network/nexus-sdk/graph/badge.svg?token=Q9I01BXJSE)](https://codecov.io/gh/Talus-Network/nexus-sdk)
 
 The **Nexus SDK** is a collection of tools that simplifies building with **Nexus**, the Agentic Workflow Engine. Developers can quickly create [Talus agents][talus-agents] or [Talus tools][talus-tools].
@@ -50,7 +52,7 @@ To install directly from the source using `cargo`, run:
 ```bash
 cargo install nexus-cli \
   --git https://github.com/talus-network/nexus-sdk \
-  --tag v0.3.0 \
+  --tag v0.5.0 \
   --locked
 ```
 
@@ -65,11 +67,15 @@ Nexus CLI
 Usage: nexus [OPTIONS] <COMMAND>
 
 Commands:
-  tool     Manage Nexus Tools
-  conf     Manage Nexus Configuration
-  dag      Validate, publish and execute Nexus DAGs
-  network  Mange Nexus networks and leader caps
-  help     Print this message or the help of the given subcommand(s)
+  tool        Manage Nexus Tools
+  conf        Manage Nexus Configuration
+  dag         Validate, publish and execute Nexus DAGs
+  scheduler   Manage scheduler tasks and occurrences
+  gas         Manage Nexus gas budgets and tickets
+  network     Manage Nexus networks and leader caps
+  crypto      Manage Nexus crypto
+  completion  Provide shell completions
+  help        Print this message or the help of the given subcommand(s)
 
 Options:
       --json     Change the output format to JSON
diff --git a/cli/Cargo.toml b/cli/Cargo.toml
index c79bdd45..58ab1154 100644
--- a/cli/Cargo.toml
+++ b/cli/Cargo.toml
@@ -18,11 +18,14 @@ path = "src/main.rs"
 
 [dependencies]
 anyhow.workspace = true
+base64.workspace = true
 chrono.workspace = true
 clap.workspace = true
 clap_complete.workspace = true
+clap-verbosity.workspace = true
 colored.workspace = true
 convert_case.workspace = true
+env_logger.workspace = true
 home.workspace = true
 indicatif.workspace = true
 minijinja.workspace = true
@@ -58,7 +61,10 @@ keyring = { workspace = true, features = ["windows-native"] }
 
 [target.'cfg(any(target_os = "linux", target_os = "freebsd", target_os = "openbsd"))'.dependencies]
 # `-sync-persistent` requires `apt-get install -y libdbus-1-dev` in CI
-keyring = { workspace = true, features = ["linux-native-sync-persistent"] }
+keyring = { workspace = true, features = [
+    "linux-native-sync-persistent",
+    "vendored",
+] }
 
 # === Nexus deps ===
 [dependencies.nexus-sdk]
diff --git a/cli/README.md b/cli/README.md
index b6d6cc28..7e646a42 100644
--- a/cli/README.md
+++ b/cli/README.md
@@ -36,7 +36,7 @@ To install directly from the source using `cargo`, run:
 ```bash
 cargo install nexus-cli \
   --git https://github.com/talus-network/nexus-sdk \
-  --tag v0.3.0 \
+  --tag v0.5.0 \
   --locked
 ```
 
@@ -51,11 +51,15 @@ Nexus CLI
 Usage: nexus [OPTIONS] <COMMAND>
 
 Commands:
-  tool     Manage Nexus Tools
-  conf     Manage Nexus Configuration
-  dag      Validate, publish and execute Nexus DAGs
-  network  Mange Nexus networks and leader caps
-  help     Print this message or the help of the given subcommand(s)
+  tool        Manage Nexus Tools
+  conf        Manage Nexus Configuration
+  dag         Validate, publish and execute Nexus DAGs
+  scheduler   Manage scheduler tasks and occurrences
+  gas         Manage Nexus gas budgets and tickets
+  network     Manage Nexus networks and leader caps
+  crypto      Manage Nexus crypto
+  completion  Provide shell completions
+  help        Print this message or the help of the given subcommand(s)
 
 Options:
       --json     Change the output format to JSON
diff --git a/cli/src/cli_conf.rs b/cli/src/cli_conf.rs
index 9027fdf4..53c9f9fb 100644
--- a/cli/src/cli_conf.rs
+++ b/cli/src/cli_conf.rs
@@ -1,6 +1,6 @@
 use {
     crate::prelude::*,
-    nexus_sdk::types::{StorageConf, StorageKind},
+    nexus_sdk::types::{SecretValue, StorageConf, StorageKind},
     std::sync::Arc,
     tokio::sync::Mutex,
 };
@@ -46,24 +46,15 @@ impl CliConf {
     }
 }
 
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, Default)]
 pub(crate) struct SuiConf {
+    /// Sui private key base64 encoded bytes.
     #[serde(default)]
-    pub(crate) net: SuiNet,
-    #[serde(default = "default_sui_wallet_path")]
-    pub(crate) wallet_path: PathBuf,
+    pub(crate) pk: Option<SecretValue>,
     #[serde(default)]
     pub(crate) rpc_url: Option<reqwest::Url>,
-}
-
-impl Default for SuiConf {
-    fn default() -> Self {
-        Self {
-            net: SuiNet::Localnet,
-            wallet_path: default_sui_wallet_path(),
-            rpc_url: None,
-        }
-    }
+    #[serde(default)]
+    pub(crate) gql_url: Option<reqwest::Url>,
 }
 
 /// Remote data storage configuration.
@@ -79,12 +70,12 @@ pub(crate) struct DataStorageConf {
     pub(crate) preferred_remote_storage: Option<StorageKind>,
 }
 
-impl Into<StorageConf> for DataStorageConf {
-    fn into(self) -> StorageConf {
+impl From<DataStorageConf> for StorageConf {
+    fn from(val: DataStorageConf) -> StorageConf {
         StorageConf {
-            walrus_aggregator_url: self.walrus_aggregator_url.map(|url| url.to_string()),
-            walrus_publisher_url: self.walrus_publisher_url.map(|url| url.to_string()),
-            walrus_save_for_epochs: self.walrus_save_for_epochs,
+            walrus_aggregator_url: val.walrus_aggregator_url.map(|url| url.to_string()),
+            walrus_publisher_url: val.walrus_publisher_url.map(|url| url.to_string()),
+            walrus_save_for_epochs: val.walrus_save_for_epochs,
         }
     }
 }
@@ -124,9 +115,9 @@ impl CryptoConf {
         let conf_path = path.unwrap_or(&default_path);
 
         let crypto_conf = CryptoConf::load_from_path(conf_path).await?;
-        Ok(crypto_conf
+        crypto_conf
             .identity_key
-            .ok_or_else(|| anyhow!("No identity key found"))?)
+            .ok_or_else(|| anyhow!("No identity key found"))
     }
 
     /// Update the identity key in the configuration.
@@ -220,27 +211,33 @@ impl CryptoConf {
     }
 }
 
-// == Used by serde ==
-
-fn default_sui_wallet_path() -> PathBuf {
-    let config_dir = sui::config_dir().expect("Unable to determine SUI config directory");
-    config_dir.join(sui::CLIENT_CONFIG)
-}
-
 #[cfg(test)]
+#[allow(clippy::single_component_path_imports)]
 mod tests {
-    use {super::*, nexus_sdk::crypto::x3dh::PreKeyBundle, serial_test::serial, tempfile};
+    use {super::*, nexus_sdk::crypto::x3dh::PreKeyBundle, serial_test::serial, std::fs};
 
     fn setup_env() -> tempfile::TempDir {
         std::env::set_var("NEXUS_CLI_STORE_PASSPHRASE", "test_passphrase");
         let secret_home = tempfile::tempdir().unwrap();
-        std::env::set_var("XDG_CONFIG_HOME", secret_home.path());
-        std::env::set_var("XDG_DATA_HOME", secret_home.path());
+
+        // Use dedicated sub-directories to avoid interfering with the caller's real home.
+        let home_dir = secret_home.path().join("home");
+        let xdg_config_dir = secret_home.path().join("xdg_config");
+        let xdg_data_dir = secret_home.path().join("xdg_data");
+
+        fs::create_dir_all(&home_dir).unwrap();
+        fs::create_dir_all(&xdg_config_dir).unwrap();
+        fs::create_dir_all(&xdg_data_dir).unwrap();
+
+        std::env::set_var("HOME", &home_dir);
+        std::env::set_var("XDG_CONFIG_HOME", &xdg_config_dir);
+        std::env::set_var("XDG_DATA_HOME", &xdg_data_dir);
         secret_home
     }
 
     fn cleanup_env() {
         std::env::remove_var("NEXUS_CLI_STORE_PASSPHRASE");
+        std::env::remove_var("HOME");
         std::env::remove_var("XDG_CONFIG_HOME");
         std::env::remove_var("XDG_DATA_HOME");
     }
diff --git a/cli/src/completion/mod.rs b/cli/src/completion/mod.rs
index 63c02d82..e47dd782 100644
--- a/cli/src/completion/mod.rs
+++ b/cli/src/completion/mod.rs
@@ -1,6 +1,6 @@
 use {
     crate::{prelude::*, Cli},
-    std::io::Write,
+    std::io::{self, Write},
 };
 
 #[derive(Args)]
@@ -10,6 +10,13 @@ pub(crate) struct CompletionCommand {
 }
 
 pub(crate) fn handle(command: CompletionCommand) -> AnyResult<(), NexusCliError> {
+    handle_with_writer(command, &mut io::stdout())
+}
+
+fn handle_with_writer(
+    command: CompletionCommand,
+    writer: &mut dyn Write,
+) -> AnyResult<(), NexusCliError> {
     let mut cli_command = Cli::command();
     let bin_name = env!("CARGO_CRATE_NAME").to_string();
 
@@ -18,7 +25,7 @@ pub(crate) fn handle(command: CompletionCommand) -> AnyResult<(), NexusCliError>
     clap_complete::generate(command.shell, &mut cli_command, bin_name, &mut buffer);
 
     // Best-effort write to stdout; ignore EPIPE/BrokenPipe to avoid crashing when the reader closes early.
-    let _ = std::io::stdout().write_all(&buffer);
+    let _ = writer.write_all(&buffer);
 
     Ok(())
 }
@@ -38,7 +45,8 @@ mod tests {
             let cli = Cli::parse_from(&args);
             match cli.command {
                 Command::Completion(cc) => {
-                    handle(cc).unwrap();
+                    let mut sink = std::io::sink();
+                    handle_with_writer(cc, &mut sink).unwrap();
                 }
                 _ => unreachable!("This should have been a completion command!"),
             }
diff --git a/cli/src/conf/conf_get.rs b/cli/src/conf/conf_get.rs
index 282bcb54..35bdb84d 100644
--- a/cli/src/conf/conf_get.rs
+++ b/cli/src/conf/conf_get.rs
@@ -4,9 +4,8 @@ use crate::{command_title, prelude::*};
 pub(crate) async fn get_nexus_conf(conf_path: PathBuf) -> AnyResult<CliConf, NexusCliError> {
     let conf = CliConf::load_from_path(&conf_path).await.map_err(|e| {
         NexusCliError::Any(anyhow!(
-            "Failed to load Nexus CLI configuration from {}: {}",
+            "Failed to load Nexus CLI configuration from {}: {e}",
             conf_path.display(),
-            e
         ))
     })?;
 
@@ -21,16 +20,17 @@ mod tests {
 
     #[tokio::test]
     async fn test_get_nexus_conf() {
-        let tempdir = tempfile::tempdir().unwrap().into_path();
+        let mut rng = rand::thread_rng();
+        let tempdir = tempfile::tempdir().unwrap().keep();
         let path = tempdir.join("conf.toml");
 
         assert!(!tokio::fs::try_exists(&path).await.unwrap());
 
         let nexus_objects = NexusObjects {
-            workflow_pkg_id: sui::ObjectID::random(),
-            primitives_pkg_id: sui::ObjectID::random(),
-            interface_pkg_id: sui::ObjectID::random(),
-            network_id: sui::ObjectID::random(),
+            workflow_pkg_id: sui::types::Address::generate(&mut rng),
+            primitives_pkg_id: sui::types::Address::generate(&mut rng),
+            interface_pkg_id: sui::types::Address::generate(&mut rng),
+            network_id: sui::types::Address::generate(&mut rng),
             tool_registry: sui_mocks::mock_sui_object_ref(),
             default_tap: sui_mocks::mock_sui_object_ref(),
             gas_service: sui_mocks::mock_sui_object_ref(),
@@ -38,9 +38,9 @@ mod tests {
         };
 
         let sui_conf = SuiConf {
-            net: SuiNet::Mainnet,
-            wallet_path: tempdir.join("wallet"),
+            pk: Some("123".to_string().into()),
             rpc_url: Some(reqwest::Url::parse("https://mainnet.sui.io").unwrap()),
+            gql_url: Some(reqwest::Url::parse("https://mainnet.sui.io/graphql").unwrap()),
         };
 
         let tools = HashMap::new();
diff --git a/cli/src/conf/conf_set.rs b/cli/src/conf/conf_set.rs
index 524b3ed8..0cc4d038 100644
--- a/cli/src/conf/conf_set.rs
+++ b/cli/src/conf/conf_set.rs
@@ -1,16 +1,17 @@
 use {
-    crate::{command_title, display::json_output, loading, prelude::*, sui::resolve_wallet_path},
+    crate::{command_title, display::json_output, loading, prelude::*},
     nexus_sdk::{
-        types::StorageKind,
+        types::{SecretValue, StorageKind},
         walrus::{WALRUS_AGGREGATOR_URL, WALRUS_PUBLISHER_URL},
     },
 };
 
 /// Set the Nexus CLI configuration from the provided arguments.
+#[allow(clippy::too_many_arguments)]
 pub(crate) async fn set_nexus_conf(
-    sui_net: Option<SuiNet>,
-    sui_wallet_path: Option<PathBuf>,
+    sui_pk: Option<String>,
     sui_rpc_url: Option<reqwest::Url>,
+    sui_gql_url: Option<reqwest::Url>,
     nexus_objects_path: Option<PathBuf>,
     data_storage_walrus_aggregator_url: Option<reqwest::Url>,
     data_storage_walrus_publisher_url: Option<reqwest::Url>,
@@ -30,26 +31,24 @@ pub(crate) async fn set_nexus_conf(
     if let Some(objects_path) = nexus_objects_path {
         let content = std::fs::read_to_string(&objects_path).map_err(|e| {
             NexusCliError::Any(anyhow!(
-                "Failed to read objects file {}: {}",
+                "Failed to read objects file {}: {e}",
                 objects_path.display(),
-                e
             ))
         })?;
 
         let objects: NexusObjects = toml::from_str(&content).map_err(|e| {
             NexusCliError::Any(anyhow!(
-                "Failed to parse objects file {}: {}",
+                "Failed to parse objects file {}: {e}",
                 objects_path.display(),
-                e
             ))
         })?;
 
         conf.nexus = Some(objects);
     }
 
-    conf.sui.net = sui_net.unwrap_or(conf.sui.net);
-    conf.sui.wallet_path = resolve_wallet_path(sui_wallet_path, &conf.sui)?;
+    conf.sui.pk = sui_pk.map(SecretValue::from).or(conf.sui.pk);
     conf.sui.rpc_url = sui_rpc_url.or(conf.sui.rpc_url);
+    conf.sui.gql_url = sui_gql_url.or(conf.sui.gql_url);
 
     // Preferred remote storage cannot be inline.
     if matches!(
@@ -101,17 +100,18 @@ mod tests {
 
     #[tokio::test]
     async fn test_conf_loads_and_saves() {
-        let tempdir = tempfile::tempdir().unwrap().into_path();
+        let tempdir = tempfile::tempdir().unwrap().keep();
         let path = tempdir.join("conf.toml");
         let objects_path = tempdir.join("objects.toml");
+        let mut rng = rand::thread_rng();
 
         assert!(!tokio::fs::try_exists(&path).await.unwrap());
 
         let nexus_objects_instance = NexusObjects {
-            workflow_pkg_id: sui::ObjectID::random(),
-            primitives_pkg_id: sui::ObjectID::random(),
-            interface_pkg_id: sui::ObjectID::random(),
-            network_id: sui::ObjectID::random(),
+            workflow_pkg_id: sui::types::Address::generate(&mut rng),
+            primitives_pkg_id: sui::types::Address::generate(&mut rng),
+            interface_pkg_id: sui::types::Address::generate(&mut rng),
+            network_id: sui::types::Address::generate(&mut rng),
             tool_registry: sui_mocks::mock_sui_object_ref(),
             default_tap: sui_mocks::mock_sui_object_ref(),
             gas_service: sui_mocks::mock_sui_object_ref(),
@@ -129,10 +129,10 @@ mod tests {
 
         // Command saves values.
         let result = set_nexus_conf(
-            Some(SuiNet::Mainnet),
-            Some(tempdir.join("wallet")),
+            Some("123".to_string().into()),
             Some(reqwest::Url::parse("https://mainnet.sui.io").unwrap()),
-            Some(tempdir.join("objects.toml")),
+            Some(reqwest::Url::parse("https://mainnet.sui.io/graphql").unwrap()),
+            Some(objects_path),
             Some(reqwest::Url::parse("https://aggregator.url").unwrap()),
             Some(reqwest::Url::parse("https://publisher.url").unwrap()),
             Some(42),
@@ -148,12 +148,15 @@ mod tests {
         let conf = CliConf::load_from_path(&path).await.unwrap();
         let objects = conf.nexus.unwrap();
 
-        assert_eq!(conf.sui.net, SuiNet::Mainnet);
-        assert_eq!(conf.sui.wallet_path, tempdir.join("wallet"));
+        assert_eq!(conf.sui.pk, Some("123".to_string().into()));
         assert_eq!(
             conf.sui.rpc_url,
             Some(reqwest::Url::parse("https://mainnet.sui.io").unwrap())
         );
+        assert_eq!(
+            conf.sui.gql_url,
+            Some(reqwest::Url::parse("https://mainnet.sui.io/graphql").unwrap())
+        );
         assert_eq!(objects, nexus_objects_instance);
         assert_eq!(
             conf.data_storage.walrus_aggregator_url,
@@ -171,8 +174,8 @@ mod tests {
 
         // Overriding one value will save that one value and leave other values intact.
         let result = set_nexus_conf(
-            Some(SuiNet::Testnet),
             None,
+            Some(reqwest::Url::parse("https://testnet.sui.io").unwrap()),
             None,
             None,
             None,
@@ -189,11 +192,14 @@ mod tests {
         let conf = CliConf::load_from_path(&path).await.unwrap();
         let objects = conf.nexus.unwrap();
 
-        assert_eq!(conf.sui.net, SuiNet::Testnet);
-        assert_eq!(conf.sui.wallet_path, tempdir.join("wallet"));
+        assert_eq!(conf.sui.pk, Some("123".to_string().into()));
         assert_eq!(
             conf.sui.rpc_url,
-            Some(reqwest::Url::parse("https://mainnet.sui.io").unwrap())
+            Some(reqwest::Url::parse("https://testnet.sui.io").unwrap())
+        );
+        assert_eq!(
+            conf.sui.gql_url,
+            Some(reqwest::Url::parse("https://mainnet.sui.io/graphql").unwrap())
         );
         assert_eq!(objects, nexus_objects_instance);
         assert_eq!(
@@ -213,14 +219,14 @@ mod tests {
 
     #[tokio::test]
     async fn test_data_storage_testnet_preset() {
-        let tempdir = tempfile::tempdir().unwrap().into_path();
+        let tempdir = tempfile::tempdir().unwrap().keep();
         let path = tempdir.join("conf_testnet.toml");
 
         // Run with data_storage_testnet = true
         let result = set_nexus_conf(
-            Some(SuiNet::Testnet),
-            Some(tempdir.join("wallet")),
+            None,
             Some(reqwest::Url::parse("https://testnet.sui.io").unwrap()),
+            Some(reqwest::Url::parse("https://testnet.sui.io/graphql").unwrap()),
             None,
             None,
             None,
@@ -251,13 +257,13 @@ mod tests {
 
     #[tokio::test]
     async fn test_inline_preferred_storage_error() {
-        let tempdir = tempfile::tempdir().unwrap().into_path();
+        let tempdir = tempfile::tempdir().unwrap().keep();
         let path = tempdir.join("conf_inline.toml");
 
         let result = set_nexus_conf(
-            Some(SuiNet::Mainnet),
-            Some(tempdir.join("wallet")),
-            Some(reqwest::Url::parse("https://mainnet.sui.io").unwrap()),
+            None,
+            Some(reqwest::Url::parse("https://testnet.sui.io").unwrap()),
+            Some(reqwest::Url::parse("https://testnet.sui.io/graphql").unwrap()),
             None,
             None,
             None,
diff --git a/cli/src/conf/mod.rs b/cli/src/conf/mod.rs
index f0679580..8bde4d43 100644
--- a/cli/src/conf/mod.rs
+++ b/cli/src/conf/mod.rs
@@ -8,6 +8,7 @@ use {
     nexus_sdk::{types::StorageKind, walrus::WALRUS_MAX_EPOCHS},
 };
 
+#[allow(clippy::large_enum_variant)]
 #[derive(Subcommand, Clone, Debug)]
 pub(crate) enum ConfCommand {
     #[command(about = "Print the current Nexus CLI configuration")]
@@ -26,25 +27,23 @@ pub(crate) enum ConfCommand {
     #[command(about = "Update the Nexus CLI configuration")]
     Set {
         #[arg(
-            long = "sui.net",
-            help = "Set the Sui network",
-            value_enum,
-            value_name = "NET"
-        )]
-        sui_net: Option<SuiNet>,
-        #[arg(
-            long = "sui.wallet-path",
-            help = "Set the Sui wallet path",
-            value_name = "PATH",
-            value_parser = ValueParser::from(expand_tilde)
+            long = "sui.pk",
+            help = "Set the Sui private key base64 encoded bytes",
+            value_name = "BASE64"
         )]
-        sui_wallet_path: Option<PathBuf>,
+        sui_pk: Option<String>,
         #[arg(
             long = "sui.rpc-url",
-            help = "Set a custom RPC URL for the Sui node",
+            help = "Set a Sui node RPC URL",
             value_name = "URL"
         )]
         sui_rpc_url: Option<reqwest::Url>,
+        #[arg(
+            long = "sui.gql-url",
+            help = "Set a Sui indexer GraphQL URL",
+            value_name = "URL"
+        )]
+        sui_gql_url: Option<reqwest::Url>,
         #[arg(
             long = "nexus.objects",
             help = "Path to a TOML file containing Nexus objects",
@@ -107,7 +106,7 @@ pub(crate) async fn handle(command: ConfCommand) -> AnyResult<(), NexusCliError>
 
             if !JSON_MODE.load(std::sync::atomic::Ordering::Relaxed) {
                 let conf = toml::to_string_pretty(&conf).map_err(|e| {
-                    NexusCliError::Any(anyhow!("Failed to serialize configuration to JSON: {}", e))
+                    NexusCliError::Any(anyhow!("Failed to serialize configuration to JSON: {e}"))
                 })?;
 
                 println!("{conf}");
@@ -116,9 +115,9 @@ pub(crate) async fn handle(command: ConfCommand) -> AnyResult<(), NexusCliError>
             Ok(())
         }
         ConfCommand::Set {
-            sui_net,
-            sui_wallet_path,
+            sui_pk,
             sui_rpc_url,
+            sui_gql_url,
             nexus_objects_path,
             data_storage_walrus_aggregator_url,
             data_storage_walrus_publisher_url,
@@ -128,9 +127,9 @@ pub(crate) async fn handle(command: ConfCommand) -> AnyResult<(), NexusCliError>
             conf_path,
         } => {
             set_nexus_conf(
-                sui_net,
-                sui_wallet_path,
+                sui_pk,
                 sui_rpc_url,
+                sui_gql_url,
                 nexus_objects_path,
                 data_storage_walrus_aggregator_url,
                 data_storage_walrus_publisher_url,
diff --git a/cli/src/crypto/crypto_auth.rs b/cli/src/crypto/crypto_auth.rs
index 3aa798b4..2c3b01d4 100644
--- a/cli/src/crypto/crypto_auth.rs
+++ b/cli/src/crypto/crypto_auth.rs
@@ -6,18 +6,18 @@ use {
 pub(crate) async fn crypto_auth(gas: GasArgs) -> AnyResult<(), NexusCliError> {
     command_title!("Establishing a secure session with the network");
 
-    let (nexus_client, _) = get_nexus_client(gas.sui_gas_coin, gas.sui_gas_budget).await?;
+    let nexus_client = get_nexus_client(gas.sui_gas_coin, gas.sui_gas_budget).await?;
 
     // Fetch or create an identity key.
     if CryptoConf::get_identity_key(None).await.is_err() {
         CryptoConf::set_identity_key(IdentityKey::generate(), None)
             .await
-            .map_err(|e| NexusCliError::Any(e))?;
+            .map_err(NexusCliError::Any)?;
     }
 
     let ik = CryptoConf::get_identity_key(None)
         .await
-        .map_err(|e| NexusCliError::Any(e))?;
+        .map_err(NexusCliError::Any)?;
 
     // Perform the handshake.
     let handshake_handle = loading!("Establishing secure session...");
diff --git a/cli/src/crypto/crypto_generate_id_key.rs b/cli/src/crypto/crypto_generate_id_key.rs
index 0732ccda..f628e4d0 100644
--- a/cli/src/crypto/crypto_generate_id_key.rs
+++ b/cli/src/crypto/crypto_generate_id_key.rs
@@ -45,6 +45,7 @@ mod tests {
 
         // Isolate XDG config so salt lives under the temp dir
         let tmp_xdg = TempDir::new().expect("temp xdg");
+
         env::set_var("XDG_CONFIG_HOME", tmp_xdg.path());
 
         // Ensure no lingering keyring entries
diff --git a/cli/src/crypto/crypto_init_key.rs b/cli/src/crypto/crypto_init_key.rs
index 5139dc92..9c821dc8 100644
--- a/cli/src/crypto/crypto_init_key.rs
+++ b/cli/src/crypto/crypto_init_key.rs
@@ -94,6 +94,7 @@ mod tests {
 
         // Isolate XDG config so salt lives under the temp dir
         let tmp_xdg = TempDir::new().expect("temp xdg");
+
         env::set_var("XDG_CONFIG_HOME", tmp_xdg.path());
 
         // Ensure no lingering keyring entries
diff --git a/cli/src/crypto/crypto_key_status.rs b/cli/src/crypto/crypto_key_status.rs
index cdd5abc7..160a7287 100644
--- a/cli/src/crypto/crypto_key_status.rs
+++ b/cli/src/crypto/crypto_key_status.rs
@@ -17,9 +17,10 @@ pub fn crypto_key_status() -> AnyResult<(), NexusCliError> {
 
     let status = if std::env::var("NEXUS_CLI_STORE_PASSPHRASE").is_ok() {
         "source: ENV var"
-    } else if let Ok(_) = Entry::new(SERVICE, "passphrase")
+    } else if Entry::new(SERVICE, "passphrase")
         .map_err(|e| NexusCliError::Any(e.into()))?
         .get_password()
+        .is_ok()
     {
         "source: key-ring pass-phrase"
     } else if let Ok(hex) = Entry::new(SERVICE, USER)
diff --git a/cli/src/dag/dag_execute.rs b/cli/src/dag/dag_execute.rs
index ec399c09..38333984 100644
--- a/cli/src/dag/dag_execute.rs
+++ b/cli/src/dag/dag_execute.rs
@@ -7,33 +7,32 @@ use {
         notify_success,
         prelude::*,
         sui::*,
+        workflow,
     },
     anyhow::anyhow,
-    nexus_sdk::{
-        nexus::error::NexusError,
-        object_crawler::{fetch_one, Structure, VecMap, VecSet},
-        types::{hint_remote_fields, PortsData, StorageKind, TypeName},
-    },
+    nexus_sdk::{nexus::error::NexusError, types::EncryptionMode},
     std::sync::Arc,
 };
 
 /// Execute a Nexus DAG based on the provided object ID and initial input data.
+#[allow(clippy::too_many_arguments)]
 pub(crate) async fn execute_dag(
-    dag_id: sui::ObjectID,
+    dag_id: sui::types::Address,
     entry_group: String,
     input_json: serde_json::Value,
     remote: Vec<String>,
     inspect: bool,
-    sui_gas_coin: Option<sui::ObjectID>,
+    priority_fee_per_gas_unit: u64,
+    sui_gas_coin: Option<sui::types::Address>,
     sui_gas_budget: u64,
 ) -> AnyResult<(), NexusCliError> {
     command_title!("Executing Nexus DAG '{dag_id}'");
 
-    let (nexus_client, sui) = get_nexus_client(sui_gas_coin, sui_gas_budget).await?;
+    let nexus_client = get_nexus_client(sui_gas_coin, sui_gas_budget).await?;
 
     // Build the remote storage conf.
     let conf = CliConf::load().await.unwrap_or_default();
-    let preferred_remote_storage = conf.data_storage.preferred_remote_storage.clone();
+    let preferred_remote_storage = conf.data_storage.preferred_remote_storage;
     let storage_conf = conf.data_storage.clone().into();
 
     // Get the active session for potential encryption
@@ -49,12 +48,20 @@ pub(crate) async fn execute_dag(
     )?;
 
     // Fetch information about entry ports that need to be encrypted.
-    let encrypt = fetch_encrypted_entry_ports(&sui, entry_group.clone(), &dag_id).await?;
+    let encrypt =
+        workflow::fetch_encrypted_entry_ports(nexus_client.crawler(), entry_group.clone(), &dag_id)
+            .await?;
 
     // Encrypt ports that need to be encrypted and store ports remote if they
     // need to be stored remotely.
-    let input_data =
-        process_entry_ports(&input_json, preferred_remote_storage, &encrypt, &remote).await?;
+    let input_data = workflow::process_entry_ports(
+        &input_json,
+        preferred_remote_storage,
+        &encrypt,
+        &remote,
+        EncryptionMode::Standard,
+    )
+    .await?;
 
     let tx_handle = loading!("Crafting and executing transaction...");
 
@@ -63,6 +70,7 @@ pub(crate) async fn execute_dag(
         .execute(
             dag_id,
             input_data,
+            priority_fee_per_gas_unit,
             Some(&entry_group),
             &storage_conf,
             Arc::clone(&session),
@@ -105,10 +113,10 @@ pub(crate) async fn execute_dag(
     // Update the session in the configuration.
     CryptoConf::release_session(session, None)
         .await
-        .map_err(|e| NexusCliError::Any(anyhow!("Failed to release session: {}", e)))?;
+        .map_err(|e| NexusCliError::Any(anyhow!("Failed to release session: {e}")))?;
 
     if inspect {
-        inspect_dag_execution(result.execution_object_id, result.tx_digest).await?;
+        inspect_dag_execution(result.execution_object_id, result.tx_checkpoint).await?;
     } else {
         json_output(
             &json!({ "digest": result.tx_digest, "execution_id": result.execution_object_id }),
@@ -117,395 +125,3 @@ pub(crate) async fn execute_dag(
 
     Ok(())
 }
-
-/// Process entry ports: encrypt and/or store remotely as needed. `input` must
-/// be at least a 2-level JSON object (vertex -> port -> value).
-async fn process_entry_ports(
-    input: &serde_json::Value,
-    preferred_remote_storage: Option<StorageKind>,
-    encrypt: &HashMap<String, Vec<String>>,
-    remote: &Vec<String>,
-) -> Result<HashMap<String, PortsData>, NexusCliError> {
-    let Some(vertices) = input.as_object() else {
-        return Err(NexusCliError::Any(anyhow!(
-            "Input JSON must be an object with vertex names as keys."
-        )));
-    };
-
-    let mut result = HashMap::new();
-
-    for (vertex, data) in vertices {
-        let Some(ports) = data.as_object() else {
-            return Err(NexusCliError::Any(anyhow!(
-                "Input JSON for vertex '{vertex}' must be an object with port names as keys."
-            )));
-        };
-
-        // Figure out which ports need to be encrypted and stored remotely for
-        // this vertex.
-        let encrypt_fields = encrypt.get(vertex);
-        let remote_fields = ports
-            .iter()
-            .filter_map(|(port, _)| {
-                let handle = format!("{vertex}.{port}");
-                if remote.contains(&handle) {
-                    Some(port.clone())
-                } else {
-                    None
-                }
-            })
-            .collect::<Vec<_>>();
-
-        // Convert this json into a map of port -> NexusData.
-        let nexus_data_map = types::json_to_nexus_data_map(
-            data,
-            encrypt_fields.unwrap_or(&vec![]),
-            &remote_fields,
-            preferred_remote_storage.clone(),
-        )
-        .map_err(NexusCliError::Any)?;
-
-        result.insert(vertex.clone(), PortsData::from_map(nexus_data_map));
-    }
-
-    // Hint the user if they should use remote storage and for what fields.
-    let flattened = vertices
-        .iter()
-        .flat_map(|(vertex, ports)| {
-            ports
-                .as_object()
-                .expect("Must be an object")
-                .iter()
-                .map(|(port, data)| (format!("{}.{}", vertex.clone(), port.clone()), data))
-        })
-        .collect::<HashMap<String, &serde_json::Value>>();
-
-    let remote_hints = hint_remote_fields(&json!(flattened)).unwrap_or_default();
-
-    if !remote_hints.is_empty() {
-        return Err(NexusCliError::Any(anyhow!(
-            "Some input fields must be stored remotely to fit within transaction size limits. Please add the following argument to your command:\n\n{command} {fields}",
-            command = "--remote",
-            fields = remote_hints.join(",")
-        )));
-    }
-
-    Ok(result)
-}
-
-/// Fetches the encrypted entry ports for a DAG.
-async fn fetch_encrypted_entry_ports(
-    sui: &sui::Client,
-    entry_group: String,
-    dag_id: &sui::ObjectID,
-) -> AnyResult<HashMap<String, Vec<String>>, NexusCliError> {
-    #[derive(Clone, Debug, PartialEq, Eq, Hash, Deserialize)]
-    struct EntryPort {
-        name: String,
-        encrypted: bool,
-    }
-
-    #[derive(Clone, Debug, Deserialize)]
-    struct Dag {
-        entry_groups:
-            VecMap<Structure<TypeName>, VecMap<Structure<TypeName>, VecSet<Structure<EntryPort>>>>,
-    }
-
-    let result = fetch_one::<Structure<Dag>>(sui, *dag_id)
-        .await
-        .map_err(|e| NexusCliError::Any(anyhow!(e)))?;
-
-    // Get the relevant entry group.
-    let group: TypeName = TypeName {
-        name: entry_group.clone(),
-    };
-
-    let entry_group = result
-        .data
-        .into_inner()
-        .entry_groups
-        .into_inner()
-        .remove(&group.into())
-        .ok_or_else(|| {
-            NexusCliError::Any(anyhow!("Entry group '{entry_group}' not found in DAG"))
-        })?;
-
-    // Collapse into a more readable format.
-    Ok(entry_group
-        .into_inner()
-        .into_iter()
-        .filter_map(|(vertex, ports)| {
-            let encrypted_ports: Vec<String> = ports
-                .into_inner()
-                .into_iter()
-                .filter_map(|port| {
-                    let port = port.into_inner();
-
-                    if port.encrypted {
-                        Some(port.name)
-                    } else {
-                        None
-                    }
-                })
-                .collect();
-
-            if encrypted_ports.is_empty() {
-                return None; // Skip vertices with no encrypted ports
-            }
-
-            Some((vertex.into_inner().name, encrypted_ports))
-        })
-        .collect::<HashMap<_, _>>())
-}
-
-#[cfg(test)]
-mod tests {
-    use {
-        super::*,
-        assert_matches::assert_matches,
-        mockito::{Server, ServerGuard},
-        nexus_sdk::{
-            test_utils::nexus_mocks,
-            types::{DataStorage, Storable, StorageConf},
-            walrus::{BlobObject, BlobStorage, NewlyCreated, StorageInfo},
-        },
-        serde_json::json,
-        std::collections::HashMap,
-    };
-
-    /// Setup mock server for Walrus testing
-    async fn setup_mock_server_and_conf() -> anyhow::Result<(ServerGuard, StorageConf)> {
-        // Create mock server
-        let server = Server::new_async().await;
-        let server_url = server.url();
-
-        // Create a Walrus client that points to our mock server
-        let storage_conf = StorageConf {
-            walrus_publisher_url: Some(server_url.clone()),
-            walrus_aggregator_url: Some(server_url),
-            walrus_save_for_epochs: Some(2),
-        };
-
-        Ok((server, storage_conf))
-    }
-
-    #[tokio::test]
-    async fn test_process_entry_ports_success_no_encrypt_no_remote() {
-        let input = json!({
-            "vertex1": {
-                "port1": "value1",
-                "port2": "value2"
-            }
-        });
-        let (_, storage_conf) = setup_mock_server_and_conf()
-            .await
-            .expect("Server must start");
-        let (session, _) = nexus_mocks::mock_session();
-        let encrypt = HashMap::new();
-        let remote = vec![];
-
-        let result = process_entry_ports(&input, None, &encrypt, &remote)
-            .await
-            .expect("Should succeed");
-
-        let vertex = result
-            .get("vertex1")
-            .expect("vertex1 missing")
-            .clone()
-            .commit_all(&storage_conf, Arc::clone(&session))
-            .await
-            .expect("commit_all failed");
-        let port1 = vertex.get("port1").expect("port1 missing");
-        let port2 = vertex.get("port2").expect("port2 missing");
-
-        // Both should be Inline and not encrypted
-        assert_matches!(port1, DataStorage::Inline(_));
-        assert_eq!(port1.as_json(), &json!("value1"));
-        assert!(!port1.is_encrypted());
-
-        assert_matches!(port2, DataStorage::Inline(_));
-        assert_eq!(port2.as_json(), &json!("value2"));
-        assert!(!port2.is_encrypted());
-    }
-
-    #[tokio::test]
-    async fn test_process_entry_ports_encrypt_only() {
-        let input = json!({
-            "vertex1": {
-                "port1": "secret_value",
-                "port2": "plain_value"
-            }
-        });
-        let (_, storage_conf) = setup_mock_server_and_conf()
-            .await
-            .expect("Server must start");
-        let (session, _) = nexus_mocks::mock_session();
-        let mut encrypt = HashMap::new();
-        encrypt.insert("vertex1".to_string(), vec!["port1".to_string()]);
-        let remote = vec![];
-
-        let result = process_entry_ports(&input, None, &encrypt, &remote)
-            .await
-            .expect("Should succeed");
-
-        let vertex = result
-            .get("vertex1")
-            .expect("vertex1 missing")
-            .clone()
-            .commit_all(&storage_conf, Arc::clone(&session))
-            .await
-            .expect("commit_all failed");
-        let port1 = vertex.get("port1").expect("port1 missing");
-        let port2 = vertex.get("port2").expect("port2 missing");
-
-        // port1 should be encrypted
-        assert!(port1.is_encrypted());
-        // port2 should not be encrypted
-        assert!(!port2.is_encrypted());
-    }
-
-    #[tokio::test]
-    async fn test_process_entry_ports_remote_only() {
-        let input = json!({
-            "vertex1": {
-                "port1": "remote_value",
-                "port2": "local_value"
-            }
-        });
-        let (mut server, storage_conf) = setup_mock_server_and_conf()
-            .await
-            .expect("Server must start");
-        let (session, _) = nexus_mocks::mock_session();
-        let encrypt = HashMap::new();
-        let remote = vec!["vertex1.port1".to_string()];
-
-        // Setup mock Walrus response
-        let mock_put_response = StorageInfo {
-            newly_created: Some(NewlyCreated {
-                blob_object: BlobObject {
-                    blob_id: "json_blob_id".to_string(),
-                    id: "json_object_id".to_string(),
-                    storage: BlobStorage { end_epoch: 200 },
-                },
-            }),
-            already_certified: None,
-        };
-
-        let mock_put = server
-            .mock("PUT", "/v1/blobs?epochs=2")
-            .with_status(200)
-            .with_header("content-type", "application/json")
-            .with_body(serde_json::to_string(&mock_put_response).expect("Must serialize"))
-            .create_async()
-            .await;
-
-        let result = process_entry_ports(&input, None, &encrypt, &remote)
-            .await
-            .expect("Should succeed");
-
-        let vertex = result
-            .get("vertex1")
-            .expect("vertex1 missing")
-            .clone()
-            .commit_all(&storage_conf, Arc::clone(&session))
-            .await
-            .expect("commit_all failed");
-        let port1 = vertex.get("port1").expect("port1 missing");
-        let port2 = vertex.get("port2").expect("port2 missing");
-
-        // port1 should be walrus
-        assert_matches!(port1, DataStorage::Walrus(_));
-        // port2 should be Inline
-        assert_matches!(port2, DataStorage::Inline(_));
-
-        // Verify the request was made
-        mock_put.assert_async().await;
-    }
-
-    #[tokio::test]
-    async fn test_process_entry_ports_encrypt_and_remote() {
-        let input = json!({
-            "vertex1": {
-                "port1": "secret_remote_value",
-                "port2": "plain_local_value"
-            }
-        });
-        let (mut server, storage_conf) = setup_mock_server_and_conf()
-            .await
-            .expect("Server must start");
-        let (session, _) = nexus_mocks::mock_session();
-        let mut encrypt = HashMap::new();
-        encrypt.insert("vertex1".to_string(), vec!["port1".to_string()]);
-        let remote = vec!["vertex1.port1".to_string()];
-
-        // Setup mock Walrus response
-        let mock_put_response = StorageInfo {
-            newly_created: Some(NewlyCreated {
-                blob_object: BlobObject {
-                    blob_id: "json_blob_id".to_string(),
-                    id: "json_object_id".to_string(),
-                    storage: BlobStorage { end_epoch: 200 },
-                },
-            }),
-            already_certified: None,
-        };
-
-        let mock_put = server
-            .mock("PUT", "/v1/blobs?epochs=2")
-            .with_status(200)
-            .with_header("content-type", "application/json")
-            .with_body(serde_json::to_string(&mock_put_response).expect("Must serialize"))
-            .create_async()
-            .await;
-
-        let result = process_entry_ports(&input, None, &encrypt, &remote)
-            .await
-            .expect("Should succeed");
-
-        let vertex = result
-            .get("vertex1")
-            .expect("vertex1 missing")
-            .clone()
-            .commit_all(&storage_conf, Arc::clone(&session))
-            .await
-            .expect("commit_all failed");
-        let port1 = vertex.get("port1").expect("port1 missing");
-        let port2 = vertex.get("port2").expect("port2 missing");
-
-        // port1 should be encrypted and walrus
-        assert!(port1.is_encrypted());
-        assert_matches!(port1, DataStorage::Walrus(_));
-        // port2 should be Inline and not encrypted
-        assert_matches!(port2, DataStorage::Inline(_));
-        assert!(!port2.is_encrypted());
-
-        // Verify the request was made
-        mock_put.assert_async().await;
-    }
-
-    #[tokio::test]
-    async fn test_process_entry_ports_invalid_input_not_object() {
-        let input = json!("not_an_object");
-        let encrypt = HashMap::new();
-        let remote = vec![];
-
-        let result = process_entry_ports(&input, None, &encrypt, &remote).await;
-        assert!(result.is_err());
-        let err_msg = format!("{}", result.unwrap_err());
-        assert!(err_msg.contains("Input JSON must be an object"));
-    }
-
-    #[tokio::test]
-    async fn test_process_entry_ports_invalid_vertex_not_object() {
-        let input = json!({
-            "vertex1": "not_an_object"
-        });
-        let encrypt = HashMap::new();
-        let remote = vec![];
-
-        let result = process_entry_ports(&input, None, &encrypt, &remote).await;
-        assert!(result.is_err());
-        let err_msg = format!("{}", result.unwrap_err());
-        assert!(err_msg.contains("must be an object with port names as keys"));
-    }
-}
diff --git a/cli/src/dag/dag_inspect_execution.rs b/cli/src/dag/dag_inspect_execution.rs
index ae97fdde..254a0efc 100644
--- a/cli/src/dag/dag_inspect_execution.rs
+++ b/cli/src/dag/dag_inspect_execution.rs
@@ -15,16 +15,16 @@ use {
 /// Inspect a Nexus DAG execution process based on the provided object ID and
 /// execution digest.
 pub(crate) async fn inspect_dag_execution(
-    dag_execution_id: sui::ObjectID,
-    execution_digest: sui::TransactionDigest,
+    dag_execution_id: sui::types::Address,
+    execution_checkpoint: u64,
 ) -> AnyResult<(), NexusCliError> {
     command_title!("Inspecting Nexus DAG Execution '{dag_execution_id}'");
 
-    let (nexus_client, _) = get_nexus_client(None, sui::MIST_PER_SUI / 10).await?;
+    let nexus_client = get_nexus_client(None, DEFAULT_GAS_BUDGET).await?;
 
     let mut result = nexus_client
         .workflow()
-        .inspect_execution(dag_execution_id, execution_digest, None)
+        .inspect_execution(dag_execution_id, execution_checkpoint, None)
         .await
         .map_err(NexusCliError::Nexus)?;
 
@@ -162,7 +162,7 @@ pub(crate) async fn inspect_dag_execution(
     // Update the session in the configuration.
     CryptoConf::release_session(session, None)
         .await
-        .map_err(|e| NexusCliError::Any(anyhow!("Failed to release session: {}", e)))?;
+        .map_err(|e| NexusCliError::Any(anyhow!("Failed to release session: {e}")))?;
 
     json_output(&json_trace)?;
 
diff --git a/cli/src/dag/dag_publish.rs b/cli/src/dag/dag_publish.rs
index 65662854..631623c7 100644
--- a/cli/src/dag/dag_publish.rs
+++ b/cli/src/dag/dag_publish.rs
@@ -12,14 +12,14 @@ use crate::{
 /// performs validation on the DAG before publishing.
 pub(crate) async fn publish_dag(
     path: PathBuf,
-    sui_gas_coin: Option<sui::ObjectID>,
+    sui_gas_coin: Option<sui::types::Address>,
     sui_gas_budget: u64,
 ) -> AnyResult<(), NexusCliError> {
     let dag = validate_dag(path).await?;
 
     command_title!("Publishing Nexus DAG");
 
-    let (nexus_client, _) = get_nexus_client(sui_gas_coin, sui_gas_budget).await?;
+    let nexus_client = get_nexus_client(sui_gas_coin, sui_gas_budget).await?;
 
     let tx_handle = loading!("Crafting and executing transaction...");
 
diff --git a/cli/src/dag/mod.rs b/cli/src/dag/mod.rs
index 0ccb7fcc..948f775b 100644
--- a/cli/src/dag/mod.rs
+++ b/cli/src/dag/mod.rs
@@ -53,7 +53,7 @@ pub(crate) enum DagCommand {
             help = "The object ID of the Nexus DAG",
             value_name = "OBJECT_ID"
         )]
-        dag_id: sui::ObjectID,
+        dag_id: sui::types::Address,
         /// The entry group to invoke.
         #[arg(
             long = "entry-group",
@@ -88,6 +88,14 @@ pub(crate) enum DagCommand {
             help = "Whether to inspect the DAG execution process. If not provided, command returns after submitting the transaction."
         )]
         inspect: bool,
+        /// Priority fee per gas unit for the DAG execution.
+        #[arg(
+            long = "priority-fee-per-gas-unit",
+            help = "Priority fee per gas unit to pass to the DAG execution. Defaults to 0 when omitted.",
+            value_name = "AMOUNT",
+            default_value_t = 0u64
+        )]
+        priority_fee_per_gas_unit: u64,
         #[command(flatten)]
         gas: GasArgs,
     },
@@ -103,15 +111,14 @@ pub(crate) enum DagCommand {
             help = "The object ID of the Nexus DAGExecution object.",
             value_name = "OBJECT_ID"
         )]
-        dag_execution_id: sui::ObjectID,
+        dag_execution_id: sui::types::Address,
         /// The entry group to invoke.
         #[arg(
-            long = "execution-digest",
-            short = 'd',
-            help = "The transaction digest of the execution.",
-            value_name = "DIGEST"
+            long = "execution-checkpoint",
+            short = 'c',
+            help = "The checkpoint of the transaction that triggered the execution."
         )]
-        execution_digest: sui::TransactionDigest,
+        execution_checkpoint: u64,
     },
 }
 
@@ -134,6 +141,7 @@ pub(crate) async fn handle(command: DagCommand) -> AnyResult<(), NexusCliError>
             input_json,
             remote,
             inspect,
+            priority_fee_per_gas_unit,
             gas,
         } => {
             // Optional: Check auth at CLI level instead of inside execute_dag
@@ -145,6 +153,7 @@ pub(crate) async fn handle(command: DagCommand) -> AnyResult<(), NexusCliError>
                 input_json,
                 remote,
                 inspect,
+                priority_fee_per_gas_unit,
                 gas.sui_gas_coin,
                 gas.sui_gas_budget,
             )
@@ -154,7 +163,7 @@ pub(crate) async fn handle(command: DagCommand) -> AnyResult<(), NexusCliError>
         // == `$ nexus dag inspect-execution` ==
         DagCommand::InspectExecution {
             dag_execution_id,
-            execution_digest,
-        } => inspect_dag_execution(dag_execution_id, execution_digest).await,
+            execution_checkpoint,
+        } => inspect_dag_execution(dag_execution_id, execution_checkpoint).await,
     }
 }
diff --git a/cli/src/display.rs b/cli/src/display.rs
index 65990eba..233e1a52 100644
--- a/cli/src/display.rs
+++ b/cli/src/display.rs
@@ -156,7 +156,7 @@ pub(crate) fn json_output<T: Serialize>(data: &T) -> AnyResult<(), NexusCliError
 
     match serde_json::to_string_pretty(data) {
         Ok(json) => {
-            println!("{}", json);
+            println!("{json}");
 
             Ok(())
         }
diff --git a/cli/src/error.rs b/cli/src/error.rs
index 5830677e..7bc3486d 100644
--- a/cli/src/error.rs
+++ b/cli/src/error.rs
@@ -17,7 +17,7 @@ pub(crate) enum NexusCliError {
     #[error("{error}{separator}\n{0}", error = "HTTP Error".red().bold(), separator = separator())]
     Http(reqwest::Error),
     #[error("{error}{separator}\n{0}", error = "Sui Error".red().bold(), separator = separator())]
-    Sui(sui::Error),
+    Rpc(anyhow::Error),
     #[error("{error}{separator}\n{0}", error = "Nexus Client Error".red().bold(), separator = separator())]
     Nexus(NexusError),
 }
diff --git a/cli/src/gas/gas_add_budget.rs b/cli/src/gas/gas_add_budget.rs
index 0041c24c..3c96f4d6 100644
--- a/cli/src/gas/gas_add_budget.rs
+++ b/cli/src/gas/gas_add_budget.rs
@@ -2,8 +2,8 @@ use crate::{command_title, display::json_output, loading, notify_success, prelud
 
 /// Upload `coin` as a gas budget for the Nexus workflow.
 pub(crate) async fn add_gas_budget(
-    coin: sui::ObjectID,
-    sui_gas_coin: Option<sui::ObjectID>,
+    coin: sui::types::Address,
+    sui_gas_coin: Option<sui::types::Address>,
     sui_gas_budget: u64,
 ) -> AnyResult<(), NexusCliError> {
     command_title!("Adding '{coin}' as gas budget for Nexus");
@@ -14,7 +14,7 @@ pub(crate) async fn add_gas_budget(
         )));
     }
 
-    let (nexus_client, _) = get_nexus_client(sui_gas_coin, sui_gas_budget).await?;
+    let nexus_client = get_nexus_client(sui_gas_coin, sui_gas_budget).await?;
 
     let tx_handle = loading!("Crafting and executing transaction...");
 
diff --git a/cli/src/gas/mod.rs b/cli/src/gas/mod.rs
index a2243583..3a52a7f2 100644
--- a/cli/src/gas/mod.rs
+++ b/cli/src/gas/mod.rs
@@ -17,7 +17,7 @@ pub(crate) enum GasCommand {
             help = "Owned SUI coin object ID to use as budget",
             value_name = "OBJECT_ID"
         )]
-        coin: sui::ObjectID,
+        coin: sui::types::Address,
         #[command(flatten)]
         gas: GasArgs,
     },
@@ -49,7 +49,7 @@ pub(crate) enum ExpiryCommand {
             help = "The OwnerCap<OverGas> object ID that must be owned by the sender.",
             value_name = "OBJECT_ID"
         )]
-        owner_cap: Option<sui::ObjectID>,
+        owner_cap: Option<sui::types::Address>,
         #[arg(
             long = "cost-per-minute",
             short = 'c',
@@ -76,7 +76,7 @@ pub(crate) enum ExpiryCommand {
             help = "The OwnerCap<OverGas> object ID that must be owned by the sender.",
             value_name = "OBJECT_ID"
         )]
-        owner_cap: Option<sui::ObjectID>,
+        owner_cap: Option<sui::types::Address>,
         #[command(flatten)]
         gas: GasArgs,
     },
@@ -103,7 +103,7 @@ pub(crate) enum ExpiryCommand {
             help = "Owned SUI coin object ID to use to pay for the ticket",
             value_name = "OBJECT_ID"
         )]
-        coin: sui::ObjectID,
+        coin: sui::types::Address,
         #[command(flatten)]
         gas: GasArgs,
     },
@@ -126,7 +126,7 @@ pub(crate) enum LimitedInvocationsCommand {
             help = "The OwnerCap<OverGas> object ID that must be owned by the sender.",
             value_name = "OBJECT_ID"
         )]
-        owner_cap: Option<sui::ObjectID>,
+        owner_cap: Option<sui::types::Address>,
         #[arg(
             long = "cost-per-invocation",
             short = 'c',
@@ -165,7 +165,7 @@ pub(crate) enum LimitedInvocationsCommand {
             help = "The OwnerCap<OverGas> object ID that must be owned by the sender.",
             value_name = "OBJECT_ID"
         )]
-        owner_cap: Option<sui::ObjectID>,
+        owner_cap: Option<sui::types::Address>,
         #[command(flatten)]
         gas: GasArgs,
     },
@@ -192,7 +192,7 @@ pub(crate) enum LimitedInvocationsCommand {
             help = "Owned SUI coin object ID to use to pay for the ticket",
             value_name = "OBJECT_ID"
         )]
-        coin: sui::ObjectID,
+        coin: sui::types::Address,
         #[command(flatten)]
         gas: GasArgs,
     },
diff --git a/cli/src/gas/tickets/expiry/buy_ticket.rs b/cli/src/gas/tickets/expiry/buy_ticket.rs
index 6b08632c..b9536515 100644
--- a/cli/src/gas/tickets/expiry/buy_ticket.rs
+++ b/cli/src/gas/tickets/expiry/buy_ticket.rs
@@ -1,5 +1,5 @@
 use {
-    crate::{command_title, display::json_output, loading, prelude::*, sui::*},
+    crate::{command_title, display::json_output, loading, notify_success, prelude::*, sui::*},
     nexus_sdk::transactions::gas,
 };
 
@@ -8,44 +8,42 @@ use {
 pub(crate) async fn buy_expiry_gas_ticket(
     tool_fqn: ToolFqn,
     minutes: u64,
-    coin: sui::ObjectID,
-    sui_gas_coin: Option<sui::ObjectID>,
+    coin: sui::types::Address,
+    sui_gas_coin: Option<sui::types::Address>,
     sui_gas_budget: u64,
 ) -> AnyResult<(), NexusCliError> {
     command_title!("Buying an expiry gas ticket for '{minutes}' minutes for tool '{tool_fqn}'");
 
-    // Load CLI configuration.
-    let mut conf = CliConf::load().await.unwrap_or_default();
-
-    // Nexus objects must be present in the configuration.
-    let objects = &get_nexus_objects(&mut conf).await?;
-
-    // Create wallet context, Sui client and find the active address.
-    let mut wallet = create_wallet_context(&conf.sui.wallet_path, conf.sui.net).await?;
-    let sui = build_sui_client(&conf.sui).await?;
-    let address = wallet.active_address().map_err(NexusCliError::Any)?;
-
-    // Fetch gas coin object.
-    let gas_coin = fetch_gas_coin(&sui, address, sui_gas_coin).await?;
-
-    // Fetch the coin to pay for the ticket with.
-    let pay_with_coin = fetch_object_by_id(&sui, coin).await?;
-
-    if pay_with_coin.object_id == gas_coin.coin_object_id {
+    if Some(coin) == sui_gas_coin {
         return Err(NexusCliError::Any(anyhow!(
-            "Gas and payment coins must be different."
+            "The coin used to pay for the ticket cannot be the same as the gas coin."
         )));
     }
 
-    // Fetch reference gas price.
-    let reference_gas_price = fetch_reference_gas_price(&sui).await?;
+    let nexus_client = get_nexus_client(sui_gas_coin, sui_gas_budget).await?;
+    let signer = nexus_client.signer();
+    let gas_config = nexus_client.gas_config();
+    let address = signer.get_active_address();
+    let nexus_objects = &*nexus_client.get_nexus_objects();
+    let crawler = nexus_client.crawler();
+
+    let pay_with_coin = crawler
+        .get_object_metadata(coin)
+        .await
+        .map(|resp| resp.object_ref())
+        .map_err(|e| {
+            NexusCliError::Any(anyhow!(
+                "Failed to fetch coin object metadata for '{coin}': {e}"
+            ))
+        })?;
 
     // Craft the transaction.
     let tx_handle = loading!("Crafting transaction...");
 
-    let mut tx = sui::ProgrammableTransactionBuilder::new();
+    let mut tx = sui::tx::TransactionBuilder::new();
 
-    if let Err(e) = gas::buy_expiry_gas_ticket(&mut tx, objects, &tool_fqn, &pay_with_coin, minutes)
+    if let Err(e) =
+        gas::buy_expiry_gas_ticket(&mut tx, nexus_objects, &tool_fqn, &pay_with_coin, minutes)
     {
         tx_handle.error();
 
@@ -54,16 +52,33 @@ pub(crate) async fn buy_expiry_gas_ticket(
 
     tx_handle.success();
 
-    let tx_data = sui::TransactionData::new_programmable(
-        address,
-        vec![gas_coin.object_ref()],
-        tx.finish(),
-        sui_gas_budget,
-        reference_gas_price,
-    );
+    let mut gas_coin = gas_config.acquire_gas_coin().await;
+
+    tx.set_sender(address);
+    tx.set_gas_budget(gas_config.get_budget());
+    tx.set_gas_price(nexus_client.get_reference_gas_price());
 
-    // Sign and send the TX.
-    let response = sign_and_execute_transaction(&sui, &wallet, tx_data).await?;
+    tx.add_gas_objects(vec![sui::tx::Input::owned(
+        *gas_coin.object_id(),
+        gas_coin.version(),
+        *gas_coin.digest(),
+    )]);
+
+    let tx = tx.finish().map_err(|e| NexusCliError::Any(e.into()))?;
+
+    let signature = signer.sign_tx(&tx).await.map_err(NexusCliError::Nexus)?;
+
+    let response = signer
+        .execute_tx(tx, signature, &mut gas_coin)
+        .await
+        .map_err(NexusCliError::Nexus)?;
+
+    gas_config.release_gas_coin(gas_coin).await;
+
+    notify_success!(
+        "Transaction digest: {digest}",
+        digest = response.digest.to_string().truecolor(100, 100, 100)
+    );
 
     json_output(&json!({ "digest": response.digest }))?;
 
diff --git a/cli/src/gas/tickets/expiry/disable.rs b/cli/src/gas/tickets/expiry/disable.rs
index 7a6bd4e3..5512e289 100644
--- a/cli/src/gas/tickets/expiry/disable.rs
+++ b/cli/src/gas/tickets/expiry/disable.rs
@@ -1,49 +1,49 @@
 use {
-    crate::{command_title, display::json_output, loading, prelude::*, sui::*},
+    crate::{command_title, display::json_output, loading, notify_success, prelude::*, sui::*},
     nexus_sdk::transactions::gas,
 };
 
 /// Disable the expiry gas extension for the specified tool.
 pub(crate) async fn disable_expiry_extension(
     tool_fqn: ToolFqn,
-    owner_cap: Option<sui::ObjectID>,
-    sui_gas_coin: Option<sui::ObjectID>,
+    owner_cap: Option<sui::types::Address>,
+    sui_gas_coin: Option<sui::types::Address>,
     sui_gas_budget: u64,
 ) -> AnyResult<(), NexusCliError> {
     command_title!("Disabling the expiry gas extension for tool '{tool_fqn}'");
 
-    // Load CLI configuration.
-    let mut conf = CliConf::load().await.unwrap_or_default();
+    let nexus_client = get_nexus_client(sui_gas_coin, sui_gas_budget).await?;
+    let signer = nexus_client.signer();
+    let gas_config = nexus_client.gas_config();
+    let address = signer.get_active_address();
+    let nexus_objects = &*nexus_client.get_nexus_objects();
+    let crawler = nexus_client.crawler();
 
-    // Nexus objects must be present in the configuration.
-    let objects = &get_nexus_objects(&mut conf).await?;
-
-    // Create wallet context, Sui client and find the active address.
-    let mut wallet = create_wallet_context(&conf.sui.wallet_path, conf.sui.net).await?;
-    let sui = build_sui_client(&conf.sui).await?;
-    let address = wallet.active_address().map_err(NexusCliError::Any)?;
-
-    // Fetch gas coin object.
-    let gas_coin = fetch_gas_coin(&sui, address, sui_gas_coin).await?;
+    let conf = CliConf::load().await.unwrap_or_default();
 
     // Use the provided or saved `owner_cap` object ID and fetch the object.
-    let Some(owner_cap) = owner_cap.or(conf.tools.get(&tool_fqn).map(|t| t.over_gas)) else {
+    let Some(owner_cap) = owner_cap.or(conf.tools.get(&tool_fqn).and_then(|t| t.over_gas)) else {
         return Err(NexusCliError::Any(anyhow!(
             "No OwnerCap object ID found for tool '{tool_fqn}'."
         )));
     };
 
-    let owner_cap = fetch_object_by_id(&sui, owner_cap).await?;
-
-    // Fetch reference gas price.
-    let reference_gas_price = fetch_reference_gas_price(&sui).await?;
+    let owner_cap = crawler
+        .get_object_metadata(owner_cap)
+        .await
+        .map(|resp| resp.object_ref())
+        .map_err(|e| {
+            NexusCliError::Any(anyhow!(
+                "Failed to fetch OwnerCap object metadata for '{owner_cap}': {e}"
+            ))
+        })?;
 
     // Craft the transaction.
     let tx_handle = loading!("Crafting transaction...");
 
-    let mut tx = sui::ProgrammableTransactionBuilder::new();
+    let mut tx = sui::tx::TransactionBuilder::new();
 
-    if let Err(e) = gas::disable_expiry(&mut tx, objects, &tool_fqn, &owner_cap) {
+    if let Err(e) = gas::disable_expiry(&mut tx, nexus_objects, &tool_fqn, &owner_cap) {
         tx_handle.error();
 
         return Err(NexusCliError::Any(e));
@@ -51,16 +51,33 @@ pub(crate) async fn disable_expiry_extension(
 
     tx_handle.success();
 
-    let tx_data = sui::TransactionData::new_programmable(
-        address,
-        vec![gas_coin.object_ref()],
-        tx.finish(),
-        sui_gas_budget,
-        reference_gas_price,
-    );
+    let mut gas_coin = gas_config.acquire_gas_coin().await;
+
+    tx.set_sender(address);
+    tx.set_gas_budget(gas_config.get_budget());
+    tx.set_gas_price(nexus_client.get_reference_gas_price());
+
+    tx.add_gas_objects(vec![sui::tx::Input::owned(
+        *gas_coin.object_id(),
+        gas_coin.version(),
+        *gas_coin.digest(),
+    )]);
 
-    // Sign and send the TX.
-    let response = sign_and_execute_transaction(&sui, &wallet, tx_data).await?;
+    let tx = tx.finish().map_err(|e| NexusCliError::Any(e.into()))?;
+
+    let signature = signer.sign_tx(&tx).await.map_err(NexusCliError::Nexus)?;
+
+    let response = signer
+        .execute_tx(tx, signature, &mut gas_coin)
+        .await
+        .map_err(NexusCliError::Nexus)?;
+
+    gas_config.release_gas_coin(gas_coin).await;
+
+    notify_success!(
+        "Transaction digest: {digest}",
+        digest = response.digest.to_string().truecolor(100, 100, 100)
+    );
 
     json_output(&json!({ "digest": response.digest }))?;
 
diff --git a/cli/src/gas/tickets/expiry/enable.rs b/cli/src/gas/tickets/expiry/enable.rs
index 313831ca..5359e4d7 100644
--- a/cli/src/gas/tickets/expiry/enable.rs
+++ b/cli/src/gas/tickets/expiry/enable.rs
@@ -1,50 +1,56 @@
 use {
-    crate::{command_title, display::json_output, loading, prelude::*, sui::*},
+    crate::{command_title, display::json_output, loading, notify_success, prelude::*, sui::*},
     nexus_sdk::transactions::gas,
 };
 
 /// Enable the expiry gas extension for the specified tool.
 pub(crate) async fn enable_expiry_extension(
     tool_fqn: ToolFqn,
-    owner_cap: Option<sui::ObjectID>,
+    owner_cap: Option<sui::types::Address>,
     cost_per_minute: u64,
-    sui_gas_coin: Option<sui::ObjectID>,
+    sui_gas_coin: Option<sui::types::Address>,
     sui_gas_budget: u64,
 ) -> AnyResult<(), NexusCliError> {
     command_title!("Enabling the expiry gas extension for tool '{tool_fqn}' with cost '{cost_per_minute}' MIST per minute");
 
-    // Load CLI configuration.
-    let mut conf = CliConf::load().await.unwrap_or_default();
+    let nexus_client = get_nexus_client(sui_gas_coin, sui_gas_budget).await?;
+    let signer = nexus_client.signer();
+    let gas_config = nexus_client.gas_config();
+    let address = signer.get_active_address();
+    let nexus_objects = &*nexus_client.get_nexus_objects();
+    let crawler = nexus_client.crawler();
 
-    // Nexus objects must be present in the configuration.
-    let objects = &get_nexus_objects(&mut conf).await?;
-
-    // Create wallet context, Sui client and find the active address.
-    let mut wallet = create_wallet_context(&conf.sui.wallet_path, conf.sui.net).await?;
-    let sui = build_sui_client(&conf.sui).await?;
-    let address = wallet.active_address().map_err(NexusCliError::Any)?;
-
-    // Fetch gas coin object.
-    let gas_coin = fetch_gas_coin(&sui, address, sui_gas_coin).await?;
+    let conf = CliConf::load().await.unwrap_or_default();
 
     // Use the provided or saved `owner_cap` object ID and fetch the object.
-    let Some(owner_cap) = owner_cap.or(conf.tools.get(&tool_fqn).map(|t| t.over_gas)) else {
+    let Some(owner_cap) = owner_cap.or(conf.tools.get(&tool_fqn).and_then(|t| t.over_gas)) else {
         return Err(NexusCliError::Any(anyhow!(
             "No OwnerCap object ID found for tool '{tool_fqn}'."
         )));
     };
 
-    let owner_cap = fetch_object_by_id(&sui, owner_cap).await?;
-
-    // Fetch reference gas price.
-    let reference_gas_price = fetch_reference_gas_price(&sui).await?;
+    let owner_cap = crawler
+        .get_object_metadata(owner_cap)
+        .await
+        .map(|resp| resp.object_ref())
+        .map_err(|e| {
+            NexusCliError::Any(anyhow!(
+                "Failed to fetch OwnerCap object metadata for '{owner_cap}': {e}"
+            ))
+        })?;
 
     // Craft the transaction.
     let tx_handle = loading!("Crafting transaction...");
 
-    let mut tx = sui::ProgrammableTransactionBuilder::new();
+    let mut tx = sui::tx::TransactionBuilder::new();
 
-    if let Err(e) = gas::enable_expiry(&mut tx, objects, &tool_fqn, &owner_cap, cost_per_minute) {
+    if let Err(e) = gas::enable_expiry(
+        &mut tx,
+        nexus_objects,
+        &tool_fqn,
+        &owner_cap,
+        cost_per_minute,
+    ) {
         tx_handle.error();
 
         return Err(NexusCliError::Any(e));
@@ -52,16 +58,33 @@ pub(crate) async fn enable_expiry_extension(
 
     tx_handle.success();
 
-    let tx_data = sui::TransactionData::new_programmable(
-        address,
-        vec![gas_coin.object_ref()],
-        tx.finish(),
-        sui_gas_budget,
-        reference_gas_price,
-    );
+    let mut gas_coin = gas_config.acquire_gas_coin().await;
+
+    tx.set_sender(address);
+    tx.set_gas_budget(gas_config.get_budget());
+    tx.set_gas_price(nexus_client.get_reference_gas_price());
+
+    tx.add_gas_objects(vec![sui::tx::Input::owned(
+        *gas_coin.object_id(),
+        gas_coin.version(),
+        *gas_coin.digest(),
+    )]);
 
-    // Sign and send the TX.
-    let response = sign_and_execute_transaction(&sui, &wallet, tx_data).await?;
+    let tx = tx.finish().map_err(|e| NexusCliError::Any(e.into()))?;
+
+    let signature = signer.sign_tx(&tx).await.map_err(NexusCliError::Nexus)?;
+
+    let response = signer
+        .execute_tx(tx, signature, &mut gas_coin)
+        .await
+        .map_err(NexusCliError::Nexus)?;
+
+    gas_config.release_gas_coin(gas_coin).await;
+
+    notify_success!(
+        "Transaction digest: {digest}",
+        digest = response.digest.to_string().truecolor(100, 100, 100)
+    );
 
     json_output(&json!({ "digest": response.digest }))?;
 
diff --git a/cli/src/gas/tickets/limited_invocations/buy_ticket.rs b/cli/src/gas/tickets/limited_invocations/buy_ticket.rs
index 0390285b..d1d9e05c 100644
--- a/cli/src/gas/tickets/limited_invocations/buy_ticket.rs
+++ b/cli/src/gas/tickets/limited_invocations/buy_ticket.rs
@@ -1,5 +1,5 @@
 use {
-    crate::{command_title, display::json_output, loading, prelude::*, sui::*},
+    crate::{command_title, display::json_output, loading, notify_success, prelude::*, sui::*},
     nexus_sdk::transactions::gas,
 };
 
@@ -8,46 +8,44 @@ use {
 pub(crate) async fn buy_limited_invocations_gas_ticket(
     tool_fqn: ToolFqn,
     invocations: u64,
-    coin: sui::ObjectID,
-    sui_gas_coin: Option<sui::ObjectID>,
+    coin: sui::types::Address,
+    sui_gas_coin: Option<sui::types::Address>,
     sui_gas_budget: u64,
 ) -> AnyResult<(), NexusCliError> {
     command_title!("Buying a limited invocations gas ticket for '{invocations}' invocations for tool '{tool_fqn}'");
 
-    // Load CLI configuration.
-    let mut conf = CliConf::load().await.unwrap_or_default();
-
-    // Nexus objects must be present in the configuration.
-    let objects = &get_nexus_objects(&mut conf).await?;
-
-    // Create wallet context, Sui client and find the active address.
-    let mut wallet = create_wallet_context(&conf.sui.wallet_path, conf.sui.net).await?;
-    let sui = build_sui_client(&conf.sui).await?;
-    let address = wallet.active_address().map_err(NexusCliError::Any)?;
-
-    // Fetch gas coin object.
-    let gas_coin = fetch_gas_coin(&sui, address, sui_gas_coin).await?;
-
-    // Fetch the coin to pay for the ticket with.
-    let pay_with_coin = fetch_object_by_id(&sui, coin).await?;
-
-    if pay_with_coin.object_id == gas_coin.coin_object_id {
+    if Some(coin) == sui_gas_coin {
         return Err(NexusCliError::Any(anyhow!(
-            "Gas and payment coins must be different."
+            "The coin used to pay for the ticket cannot be the same as the gas coin."
         )));
     }
 
-    // Fetch reference gas price.
-    let reference_gas_price = fetch_reference_gas_price(&sui).await?;
+    let nexus_client = get_nexus_client(sui_gas_coin, sui_gas_budget).await?;
+    let signer = nexus_client.signer();
+    let gas_config = nexus_client.gas_config();
+    let address = signer.get_active_address();
+    let nexus_objects = &*nexus_client.get_nexus_objects();
+    let crawler = nexus_client.crawler();
+
+    // Fetch the coin to pay for the ticket with.
+    let pay_with_coin = crawler
+        .get_object_metadata(coin)
+        .await
+        .map(|resp| resp.object_ref())
+        .map_err(|e| {
+            NexusCliError::Any(anyhow!(
+                "Failed to fetch coin object metadata for '{coin}': {e}"
+            ))
+        })?;
 
     // Craft the transaction.
     let tx_handle = loading!("Crafting transaction...");
 
-    let mut tx = sui::ProgrammableTransactionBuilder::new();
+    let mut tx = sui::tx::TransactionBuilder::new();
 
     if let Err(e) = gas::buy_limited_invocations_gas_ticket(
         &mut tx,
-        objects,
+        nexus_objects,
         &tool_fqn,
         &pay_with_coin,
         invocations,
@@ -59,16 +57,33 @@ pub(crate) async fn buy_limited_invocations_gas_ticket(
 
     tx_handle.success();
 
-    let tx_data = sui::TransactionData::new_programmable(
-        address,
-        vec![gas_coin.object_ref()],
-        tx.finish(),
-        sui_gas_budget,
-        reference_gas_price,
-    );
+    let mut gas_coin = gas_config.acquire_gas_coin().await;
+
+    tx.set_sender(address);
+    tx.set_gas_budget(gas_config.get_budget());
+    tx.set_gas_price(nexus_client.get_reference_gas_price());
+
+    tx.add_gas_objects(vec![sui::tx::Input::owned(
+        *gas_coin.object_id(),
+        gas_coin.version(),
+        *gas_coin.digest(),
+    )]);
+
+    let tx = tx.finish().map_err(|e| NexusCliError::Any(e.into()))?;
 
-    // Sign and send the TX.
-    let response = sign_and_execute_transaction(&sui, &wallet, tx_data).await?;
+    let signature = signer.sign_tx(&tx).await.map_err(NexusCliError::Nexus)?;
+
+    let response = signer
+        .execute_tx(tx, signature, &mut gas_coin)
+        .await
+        .map_err(NexusCliError::Nexus)?;
+
+    gas_config.release_gas_coin(gas_coin).await;
+
+    notify_success!(
+        "Transaction digest: {digest}",
+        digest = response.digest.to_string().truecolor(100, 100, 100)
+    );
 
     json_output(&json!({ "digest": response.digest }))?;
 
diff --git a/cli/src/gas/tickets/limited_invocations/disable.rs b/cli/src/gas/tickets/limited_invocations/disable.rs
index 2951205a..a82cfaa7 100644
--- a/cli/src/gas/tickets/limited_invocations/disable.rs
+++ b/cli/src/gas/tickets/limited_invocations/disable.rs
@@ -1,5 +1,5 @@
 use {
-    crate::{command_title, display::json_output, loading, prelude::*, sui::*},
+    crate::{command_title, display::json_output, loading, notify_success, prelude::*, sui::*},
     nexus_sdk::transactions::gas,
 };
 
@@ -7,44 +7,45 @@ use {
 /// TODO: https://github.com/Talus-Network/nexus/issues/418
 pub(crate) async fn disable_limited_invocations_extension(
     tool_fqn: ToolFqn,
-    owner_cap: Option<sui::ObjectID>,
-    sui_gas_coin: Option<sui::ObjectID>,
+    owner_cap: Option<sui::types::Address>,
+    sui_gas_coin: Option<sui::types::Address>,
     sui_gas_budget: u64,
 ) -> AnyResult<(), NexusCliError> {
     command_title!("Disabling the limited invocations gas extension for tool '{tool_fqn}'");
 
-    // Load CLI configuration.
-    let mut conf = CliConf::load().await.unwrap_or_default();
+    let nexus_client = get_nexus_client(sui_gas_coin, sui_gas_budget).await?;
+    let signer = nexus_client.signer();
+    let gas_config = nexus_client.gas_config();
+    let address = signer.get_active_address();
+    let nexus_objects = &*nexus_client.get_nexus_objects();
+    let crawler = nexus_client.crawler();
 
-    // Nexus objects must be present in the configuration.
-    let objects = &get_nexus_objects(&mut conf).await?;
-
-    // Create wallet context, Sui client and find the active address.
-    let mut wallet = create_wallet_context(&conf.sui.wallet_path, conf.sui.net).await?;
-    let sui = build_sui_client(&conf.sui).await?;
-    let address = wallet.active_address().map_err(NexusCliError::Any)?;
-
-    // Fetch gas coin object.
-    let gas_coin = fetch_gas_coin(&sui, address, sui_gas_coin).await?;
+    let conf = CliConf::load().await.unwrap_or_default();
 
     // Use the provided or saved `owner_cap` object ID and fetch the object.
-    let Some(owner_cap) = owner_cap.or(conf.tools.get(&tool_fqn).map(|t| t.over_gas)) else {
+    let Some(owner_cap) = owner_cap.or(conf.tools.get(&tool_fqn).and_then(|t| t.over_gas)) else {
         return Err(NexusCliError::Any(anyhow!(
             "No OwnerCap object ID found for tool '{tool_fqn}'."
         )));
     };
 
-    let owner_cap = fetch_object_by_id(&sui, owner_cap).await?;
-
-    // Fetch reference gas price.
-    let reference_gas_price = fetch_reference_gas_price(&sui).await?;
+    let owner_cap = crawler
+        .get_object_metadata(owner_cap)
+        .await
+        .map(|resp| resp.object_ref())
+        .map_err(|e| {
+            NexusCliError::Any(anyhow!(
+                "Failed to fetch OwnerCap object metadata for '{owner_cap}': {e}"
+            ))
+        })?;
 
     // Craft the transaction.
     let tx_handle = loading!("Crafting transaction...");
 
-    let mut tx = sui::ProgrammableTransactionBuilder::new();
+    let mut tx = sui::tx::TransactionBuilder::new();
 
-    if let Err(e) = gas::disable_limited_invocations(&mut tx, objects, &tool_fqn, &owner_cap) {
+    if let Err(e) = gas::disable_limited_invocations(&mut tx, nexus_objects, &tool_fqn, &owner_cap)
+    {
         tx_handle.error();
 
         return Err(NexusCliError::Any(e));
@@ -52,16 +53,33 @@ pub(crate) async fn disable_limited_invocations_extension(
 
     tx_handle.success();
 
-    let tx_data = sui::TransactionData::new_programmable(
-        address,
-        vec![gas_coin.object_ref()],
-        tx.finish(),
-        sui_gas_budget,
-        reference_gas_price,
-    );
+    let mut gas_coin = gas_config.acquire_gas_coin().await;
+
+    tx.set_sender(address);
+    tx.set_gas_budget(gas_config.get_budget());
+    tx.set_gas_price(nexus_client.get_reference_gas_price());
+
+    tx.add_gas_objects(vec![sui::tx::Input::owned(
+        *gas_coin.object_id(),
+        gas_coin.version(),
+        *gas_coin.digest(),
+    )]);
 
-    // Sign and send the TX.
-    let response = sign_and_execute_transaction(&sui, &wallet, tx_data).await?;
+    let tx = tx.finish().map_err(|e| NexusCliError::Any(e.into()))?;
+
+    let signature = signer.sign_tx(&tx).await.map_err(NexusCliError::Nexus)?;
+
+    let response = signer
+        .execute_tx(tx, signature, &mut gas_coin)
+        .await
+        .map_err(NexusCliError::Nexus)?;
+
+    gas_config.release_gas_coin(gas_coin).await;
+
+    notify_success!(
+        "Transaction digest: {digest}",
+        digest = response.digest.to_string().truecolor(100, 100, 100)
+    );
 
     json_output(&json!({ "digest": response.digest }))?;
 
diff --git a/cli/src/gas/tickets/limited_invocations/enable.rs b/cli/src/gas/tickets/limited_invocations/enable.rs
index 4d97dbf2..8d4cf283 100644
--- a/cli/src/gas/tickets/limited_invocations/enable.rs
+++ b/cli/src/gas/tickets/limited_invocations/enable.rs
@@ -1,5 +1,5 @@
 use {
-    crate::{command_title, display::json_output, loading, prelude::*, sui::*},
+    crate::{command_title, display::json_output, loading, notify_success, prelude::*, sui::*},
     nexus_sdk::transactions::gas,
 };
 
@@ -7,49 +7,49 @@ use {
 /// TODO: https://github.com/Talus-Network/nexus/issues/418
 pub(crate) async fn enable_limited_invocations_extension(
     tool_fqn: ToolFqn,
-    owner_cap: Option<sui::ObjectID>,
+    owner_cap: Option<sui::types::Address>,
     cost_per_invocation: u64,
     min_invocations: u64,
     max_invocations: u64,
-    sui_gas_coin: Option<sui::ObjectID>,
+    sui_gas_coin: Option<sui::types::Address>,
     sui_gas_budget: u64,
 ) -> AnyResult<(), NexusCliError> {
     command_title!("Enabling the limited invocations gas extension for tool '{tool_fqn}' with cost '{cost_per_invocation}' MIST per invocation (min: {min_invocations}, max: {max_invocations})");
 
-    // Load CLI configuration.
-    let mut conf = CliConf::load().await.unwrap_or_default();
+    let nexus_client = get_nexus_client(sui_gas_coin, sui_gas_budget).await?;
+    let signer = nexus_client.signer();
+    let gas_config = nexus_client.gas_config();
+    let address = signer.get_active_address();
+    let nexus_objects = &*nexus_client.get_nexus_objects();
+    let crawler = nexus_client.crawler();
 
-    // Nexus objects must be present in the configuration.
-    let objects = &get_nexus_objects(&mut conf).await?;
-
-    // Create wallet context, Sui client and find the active address.
-    let mut wallet = create_wallet_context(&conf.sui.wallet_path, conf.sui.net).await?;
-    let sui = build_sui_client(&conf.sui).await?;
-    let address = wallet.active_address().map_err(NexusCliError::Any)?;
-
-    // Fetch gas coin object.
-    let gas_coin = fetch_gas_coin(&sui, address, sui_gas_coin).await?;
+    let conf = CliConf::load().await.unwrap_or_default();
 
     // Use the provided or saved `owner_cap` object ID and fetch the object.
-    let Some(owner_cap) = owner_cap.or(conf.tools.get(&tool_fqn).map(|t| t.over_gas)) else {
+    let Some(owner_cap) = owner_cap.or(conf.tools.get(&tool_fqn).and_then(|t| t.over_gas)) else {
         return Err(NexusCliError::Any(anyhow!(
             "No OwnerCap object ID found for tool '{tool_fqn}'."
         )));
     };
 
-    let owner_cap = fetch_object_by_id(&sui, owner_cap).await?;
-
-    // Fetch reference gas price.
-    let reference_gas_price = fetch_reference_gas_price(&sui).await?;
+    let owner_cap = crawler
+        .get_object_metadata(owner_cap)
+        .await
+        .map(|resp| resp.object_ref())
+        .map_err(|e| {
+            NexusCliError::Any(anyhow!(
+                "Failed to fetch OwnerCap object metadata for '{owner_cap}': {e}"
+            ))
+        })?;
 
     // Craft the transaction.
     let tx_handle = loading!("Crafting transaction...");
 
-    let mut tx = sui::ProgrammableTransactionBuilder::new();
+    let mut tx = sui::tx::TransactionBuilder::new();
 
     if let Err(e) = gas::enable_limited_invocations(
         &mut tx,
-        objects,
+        nexus_objects,
         &tool_fqn,
         &owner_cap,
         cost_per_invocation,
@@ -63,16 +63,33 @@ pub(crate) async fn enable_limited_invocations_extension(
 
     tx_handle.success();
 
-    let tx_data = sui::TransactionData::new_programmable(
-        address,
-        vec![gas_coin.object_ref()],
-        tx.finish(),
-        sui_gas_budget,
-        reference_gas_price,
-    );
+    let mut gas_coin = gas_config.acquire_gas_coin().await;
+
+    tx.set_sender(address);
+    tx.set_gas_budget(gas_config.get_budget());
+    tx.set_gas_price(nexus_client.get_reference_gas_price());
+
+    tx.add_gas_objects(vec![sui::tx::Input::owned(
+        *gas_coin.object_id(),
+        gas_coin.version(),
+        *gas_coin.digest(),
+    )]);
 
-    // Sign and send the TX.
-    let response = sign_and_execute_transaction(&sui, &wallet, tx_data).await?;
+    let tx = tx.finish().map_err(|e| NexusCliError::Any(e.into()))?;
+
+    let signature = signer.sign_tx(&tx).await.map_err(NexusCliError::Nexus)?;
+
+    let response = signer
+        .execute_tx(tx, signature, &mut gas_coin)
+        .await
+        .map_err(NexusCliError::Nexus)?;
+
+    gas_config.release_gas_coin(gas_coin).await;
+
+    notify_success!(
+        "Transaction digest: {digest}",
+        digest = response.digest.to_string().truecolor(100, 100, 100)
+    );
 
     json_output(&json!({ "digest": response.digest }))?;
 
diff --git a/cli/src/main.rs b/cli/src/main.rs
index bcf4684b..c0f058e9 100644
--- a/cli/src/main.rs
+++ b/cli/src/main.rs
@@ -8,9 +8,11 @@ mod error;
 mod gas;
 mod network;
 mod prelude;
+mod scheduler;
 mod sui;
 mod tool;
 mod utils;
+mod workflow;
 
 use crate::prelude::*;
 
@@ -24,6 +26,10 @@ struct Cli {
         help = "Change the output format to JSON"
     )]
     json: bool,
+
+    #[command(flatten)]
+    verbose: clap_verbosity::Verbosity<clap_verbosity::ErrorLevel>,
+
     #[command(subcommand)]
     command: Command,
 }
@@ -36,6 +42,8 @@ enum Command {
     Conf(conf::ConfCommand),
     #[command(subcommand, about = "Validate, publish and execute Nexus DAGs")]
     Dag(dag::DagCommand),
+    #[command(subcommand, about = "Manage scheduler tasks and occurrences")]
+    Scheduler(scheduler::SchedulerCommand),
     #[command(subcommand, about = "Manage Nexus gas budgets and tickets")]
     Gas(gas::GasCommand),
     #[command(subcommand, about = "Manage Nexus networks and leader caps")]
@@ -56,7 +64,7 @@ async fn main() {
             // to display the CLI help or version.
             match e.kind() {
                 clap::error::ErrorKind::DisplayHelp | clap::error::ErrorKind::DisplayVersion => {
-                    println!("{}", e);
+                    println!("{e}");
 
                     std::process::exit(0);
                 }
@@ -73,6 +81,10 @@ async fn main() {
         }
     };
 
+    env_logger::builder()
+        .filter(None, cli.verbose.log_level_filter())
+        .init();
+
     JSON_MODE.store(cli.json, Ordering::Relaxed);
 
     // Send each sub-command to the respective handler.
@@ -82,6 +94,7 @@ async fn main() {
         Command::Dag(dag) => dag::handle(dag).await,
         Command::Network(network) => network::handle(network).await,
         Command::Gas(gas) => gas::handle(gas).await,
+        Command::Scheduler(scheduler) => scheduler::handle(scheduler).await,
         Command::Crypto(crypto) => crypto::handle(crypto).await,
         Command::Completion(completion) => completion::handle(completion),
     };
diff --git a/cli/src/network/mod.rs b/cli/src/network/mod.rs
index f8f2b142..f44c7417 100644
--- a/cli/src/network/mod.rs
+++ b/cli/src/network/mod.rs
@@ -16,7 +16,7 @@ pub(crate) enum NetworkCommand {
             num_args = 0..,
             value_name = "ADDRESSES"
         )]
-        addresses: Vec<sui::ObjectID>,
+        addresses: Vec<sui::types::Address>,
         /// How many leader caps to assign to each address
         #[arg(
             long = "count-leader-caps",
diff --git a/cli/src/network/network_create.rs b/cli/src/network/network_create.rs
index 8414f4f9..8d3d8655 100644
--- a/cli/src/network/network_create.rs
+++ b/cli/src/network/network_create.rs
@@ -1,17 +1,17 @@
 use {
     crate::{command_title, display::json_output, loading, notify_success, prelude::*, sui::*},
     nexus_sdk::{
-        events::{NexusEvent, NexusEventKind},
-        idents::workflow,
+        events::NexusEventKind,
+        idents::{sui_framework, workflow},
     },
 };
 
 /// Create a new Nexus network and assign `count_leader_caps` leader caps to
 /// the provided addresses.
 pub(crate) async fn create_network(
-    addresses: Vec<sui::ObjectID>,
+    addresses: Vec<sui::types::Address>,
     count_leader_caps: u32,
-    sui_gas_coin: Option<sui::ObjectID>,
+    sui_gas_coin: Option<sui::types::Address>,
     sui_gas_budget: u64,
 ) -> AnyResult<(), NexusCliError> {
     command_title!(
@@ -19,97 +19,91 @@ pub(crate) async fn create_network(
         addresses.len()
     );
 
-    // Load CLI configuration.
-    let mut conf = CliConf::load().await.unwrap_or_default();
-
-    // Nexus objects must be present in the configuration.
-    let NexusObjects {
-        workflow_pkg_id, ..
-    } = &get_nexus_objects(&mut conf).await?;
-
-    // Create wallet context, Sui client and find the active address.
-    let mut wallet = create_wallet_context(&conf.sui.wallet_path, conf.sui.net).await?;
-    let sui = build_sui_client(&conf.sui).await?;
-    let address = wallet.active_address().map_err(NexusCliError::Any)?;
-
-    // Fetch gas coin object.
-    let gas_coin = fetch_gas_coin(&sui, address, sui_gas_coin).await?;
-
-    // Fetch reference gas price.
-    let reference_gas_price = fetch_reference_gas_price(&sui).await?;
+    let nexus_client = get_nexus_client(sui_gas_coin, sui_gas_budget).await?;
+    let signer = nexus_client.signer();
+    let gas_config = nexus_client.gas_config();
+    let address = signer.get_active_address();
+    let nexus_objects = &*nexus_client.get_nexus_objects();
 
     // Craft a TX to create a new network.
     let tx_handle = loading!("Crafting transaction...");
 
-    let addresses = match serde_json::to_value(addresses).map(sui::SuiJsonValue::new) {
-        Ok(Ok(addrs)) => addrs,
-        _ => {
-            tx_handle.error();
-
-            return Err(NexusCliError::Any(anyhow!("Failed to serialize addresses")));
-        }
-    };
+    let mut tx = sui::tx::TransactionBuilder::new();
 
-    let count_leader_caps = match sui::SuiJsonValue::new(count_leader_caps.to_string().into()) {
-        Ok(count) => count,
+    let addresses = match addresses
+        .iter()
+        .map(|addr| sui_framework::Address::address_from_type(&mut tx, *addr))
+        .collect::<Result<Vec<_>, _>>()
+    {
+        Ok(addresses) => addresses,
         Err(e) => {
             tx_handle.error();
 
-            return Err(NexusCliError::Any(e));
+            return Err(NexusCliError::Any(anyhow!(
+                "Failed to serialize addresses: {e}"
+            )));
         }
     };
 
-    let tx_data = match sui
-        .transaction_builder()
-        .move_call(
-            address,
-            *workflow_pkg_id,
-            workflow::LeaderCap::CREATE_FOR_SELF_AND_ADDRESSES
-                .module
-                .as_str(),
-            workflow::LeaderCap::CREATE_FOR_SELF_AND_ADDRESSES
-                .name
-                .as_str(),
-            vec![],
-            vec![count_leader_caps, addresses],
-            Some(gas_coin.coin_object_id),
-            sui_gas_budget,
-            Some(reference_gas_price),
-        )
-        .await
-    {
-        Ok(tx_data) => tx_data,
+    let addresses = tx.make_move_vec(Some(sui::types::TypeTag::Address), addresses);
+
+    let count_leader_caps = match idents::pure_arg(&count_leader_caps) {
+        Ok(count_leader_caps) => tx.input(count_leader_caps),
         Err(e) => {
             tx_handle.error();
 
-            return Err(NexusCliError::Any(e));
+            return Err(NexusCliError::Any(anyhow!(
+                "Failed to serialize count_leader_caps: {e}"
+            )));
         }
     };
 
+    tx.move_call(
+        sui::tx::Function::new(
+            nexus_objects.workflow_pkg_id,
+            workflow::LeaderCap::CREATE_FOR_SELF_AND_ADDRESSES.module,
+            workflow::LeaderCap::CREATE_FOR_SELF_AND_ADDRESSES.name,
+            vec![],
+        ),
+        vec![count_leader_caps, addresses],
+    );
+
     tx_handle.success();
 
-    // Sign the transaction and send it to the network.
-    let response = sign_and_execute_transaction(&sui, &wallet, tx_data).await?;
+    let mut gas_coin = gas_config.acquire_gas_coin().await;
 
-    // Parse network ID from the response.
-    let Some(events) = response.events else {
-        return Err(NexusCliError::Any(anyhow!("No events in the response")));
-    };
+    tx.set_sender(address);
+    tx.set_gas_budget(gas_config.get_budget());
+    tx.set_gas_price(nexus_client.get_reference_gas_price());
 
-    let Some(network_id) = events.data.into_iter().find_map(|event| {
-        let nexus_event: NexusEvent = event.try_into().ok()?;
+    tx.add_gas_objects(vec![sui::tx::Input::owned(
+        *gas_coin.object_id(),
+        gas_coin.version(),
+        *gas_coin.digest(),
+    )]);
 
-        match nexus_event.data {
-            NexusEventKind::FoundingLeaderCapCreated(e) => Some(e.network),
-            _ => None,
-        }
+    let tx = tx.finish().map_err(|e| NexusCliError::Any(e.into()))?;
+
+    let signature = signer.sign_tx(&tx).await.map_err(NexusCliError::Nexus)?;
+
+    let response = signer
+        .execute_tx(tx, signature, &mut gas_coin)
+        .await
+        .map_err(NexusCliError::Nexus)?;
+
+    gas_config.release_gas_coin(gas_coin).await;
+
+    let Some(network_id) = response.events.iter().find_map(|event| match &event.data {
+        NexusEventKind::FoundingLeaderCapCreated(e) => Some(e.network),
+        _ => None,
     }) else {
         return Err(NexusCliError::Any(anyhow!("No network ID in the events")));
     };
 
     notify_success!(
-        "New Nexus network created with ID: {id}",
-        id = network_id.to_string().truecolor(100, 100, 100)
+        "New Nexus network created with ID: {id}; digest: {digest}",
+        id = network_id.to_string().truecolor(100, 100, 100),
+        digest = response.digest.to_string().truecolor(100, 100, 100),
     );
 
     json_output(&json!({ "digest": response.digest, "network_id": network_id }))?;
diff --git a/cli/src/prelude.rs b/cli/src/prelude.rs
index ac434662..5c4a84e3 100644
--- a/cli/src/prelude.rs
+++ b/cli/src/prelude.rs
@@ -13,21 +13,35 @@ pub(crate) use {
     serde_json::json,
     std::{
         collections::HashMap,
-        path::{Path, PathBuf},
-        sync::atomic::{AtomicBool, Ordering},
+        path::PathBuf,
+        sync::{
+            atomic::{AtomicBool, Ordering},
+            Arc,
+        },
     },
+    tokio::sync::Mutex,
 };
 
 /// Where to find config files.
 pub(crate) const CLI_CONF_PATH: &str = "~/.nexus/conf.toml";
 pub(crate) const CRYPTO_CONF_PATH: &str = "~/.nexus/crypto.toml";
 
+/// Various Nexus RPC URLs.
+pub(crate) const DEVNET_NEXUS_RPC_URL: &str = "https://rpc.ssfn.devnet.production.taluslabs.dev";
+
 /// objects.toml locations for each network.
-pub(crate) const DEVNET_OBJECTS_TOML: &str =
-    "https://storage.googleapis.com/production-talus-sui-packages/objects.devnet.toml";
+pub(crate) const DEVNET_OBJECTS_TOML: &str = concat!(
+    "https://storage.googleapis.com/production-talus-sui-objects/v",
+    env!("CARGO_PKG_VERSION"),
+    "/objects.devnet.toml"
+);
+
 pub(crate) const _TESTNET_OBJECTS_TOML: &str = "";
 pub(crate) const _MAINNET_OBJECTS_TOML: &str = "";
 
+/// What is the default gas budget to use? (0.1 SUI)
+pub(crate) const DEFAULT_GAS_BUDGET: u64 = sui::MIST_PER_SUI / 10;
+
 #[derive(Clone, Copy, Debug, Default, PartialEq, Eq, ValueEnum, Serialize, Deserialize)]
 pub(crate) enum SuiNet {
     #[default]
@@ -50,8 +64,8 @@ impl std::fmt::Display for SuiNet {
 
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
 pub(crate) struct ToolOwnerCaps {
-    pub(crate) over_tool: sui::ObjectID,
-    pub(crate) over_gas: sui::ObjectID,
+    pub(crate) over_tool: sui::types::Address,
+    pub(crate) over_gas: Option<sui::types::Address>,
 }
 
 /// Reusable Sui gas command args.
@@ -63,13 +77,13 @@ pub(crate) struct GasArgs {
         help = "The gas coin object ID. First coin object is chosen if not present.",
         value_name = "OBJECT_ID"
     )]
-    pub(crate) sui_gas_coin: Option<sui::ObjectID>,
+    pub(crate) sui_gas_coin: Option<sui::types::Address>,
     #[arg(
         long = "sui-gas-budget",
         short = 'b',
         help = "The gas budget for the transaction.",
         value_name = "AMOUNT",
-        default_value_t = sui::MIST_PER_SUI / 10
+        default_value_t = DEFAULT_GAS_BUDGET
     )]
     pub(crate) sui_gas_budget: u64,
 }
@@ -98,14 +112,24 @@ pub(crate) fn parse_json_string(json: &str) -> AnyResult<serde_json::Value> {
 
 #[cfg(test)]
 mod tests {
-    use super::*;
+    use {super::*, serial_test::serial};
 
     #[test]
+    #[serial]
     fn test_expand_tilde() {
-        let path = "~/test";
-        let expanded = expand_tilde(path).unwrap();
+        let original_home = std::env::var_os("HOME");
+        let temp_home = tempfile::tempdir().expect("temp home directory");
+        let temp_home_path = temp_home.path().to_path_buf();
 
-        assert_eq!(expanded, home::home_dir().unwrap().join("test"));
+        std::env::set_var("HOME", &temp_home_path);
+
+        let expanded = expand_tilde("~/test").unwrap();
+        assert_eq!(expanded, temp_home_path.join("test"));
+
+        match original_home {
+            Some(value) => std::env::set_var("HOME", value),
+            None => std::env::remove_var("HOME"),
+        }
     }
 
     #[test]
diff --git a/cli/src/scheduler/helpers.rs b/cli/src/scheduler/helpers.rs
new file mode 100644
index 00000000..660f67a5
--- /dev/null
+++ b/cli/src/scheduler/helpers.rs
@@ -0,0 +1,53 @@
+use {
+    crate::{prelude::*, workflow},
+    nexus_sdk::nexus::crawler::Crawler,
+    std::collections::HashMap,
+};
+
+/// Parse metadata pairs provided as `key=value` strings.
+pub(crate) fn parse_metadata(pairs: &[String]) -> AnyResult<Vec<(String, String)>, NexusCliError> {
+    let mut result = Vec::with_capacity(pairs.len());
+    for pair in pairs {
+        let Some((key, value)) = pair.split_once('=') else {
+            return Err(NexusCliError::Any(anyhow!(
+                "Invalid metadata entry '{pair}'. Expected format key=value"
+            )));
+        };
+        if key.trim().is_empty() {
+            return Err(NexusCliError::Any(anyhow!(
+                "Metadata key in '{pair}' cannot be empty"
+            )));
+        }
+        result.push((key.trim().to_owned(), value.trim().to_owned()));
+    }
+    Ok(result)
+}
+
+/// Fetch the encrypted entry port mapping for the provided DAG entry group.
+pub(crate) async fn fetch_encryption_targets(
+    crawler: &Crawler,
+    dag_id: &sui::types::Address,
+    entry_group: &str,
+) -> AnyResult<HashMap<String, Vec<String>>, NexusCliError> {
+    workflow::fetch_encrypted_entry_ports(crawler, entry_group.to_owned(), dag_id).await
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn parse_metadata_splits_pairs() {
+        let result = parse_metadata(&["a=b".to_string(), "c=d".to_string()]).unwrap();
+        assert_eq!(
+            result,
+            vec![("a".into(), "b".into()), ("c".into(), "d".into())]
+        );
+    }
+
+    #[test]
+    fn parse_metadata_rejects_missing_equals() {
+        let err = parse_metadata(&["invalid".to_string()]).unwrap_err();
+        assert!(err.to_string().contains("Invalid metadata entry"));
+    }
+}
diff --git a/cli/src/scheduler/mod.rs b/cli/src/scheduler/mod.rs
new file mode 100644
index 00000000..7d983cd5
--- /dev/null
+++ b/cli/src/scheduler/mod.rs
@@ -0,0 +1,28 @@
+mod helpers;
+mod occurrence;
+mod periodic;
+mod task;
+
+use crate::prelude::*;
+
+#[derive(Subcommand)]
+pub(crate) enum SchedulerCommand {
+    #[command(subcommand, about = "Manage scheduler tasks")]
+    Task(task::TaskCommand),
+    #[command(subcommand, about = "Manage sporadic occurrences for a task")]
+    Occurrence(occurrence::OccurrenceCommand),
+    #[command(subcommand, about = "Manage periodic scheduling for a task")]
+    Periodic(periodic::PeriodicCommand),
+}
+
+/// Handle scheduler commands dispatched from the CLI root.
+pub(crate) async fn handle(command: SchedulerCommand) -> AnyResult<(), NexusCliError> {
+    match command {
+        // == `$ nexus scheduler task ...` ==
+        SchedulerCommand::Task(cmd) => task::handle(cmd).await,
+        // == `$ nexus scheduler occurrence ...` ==
+        SchedulerCommand::Occurrence(cmd) => occurrence::handle(cmd).await,
+        // == `$ nexus scheduler periodic ...` ==
+        SchedulerCommand::Periodic(cmd) => periodic::handle(cmd).await,
+    }
+}
diff --git a/cli/src/scheduler/occurrence/mod.rs b/cli/src/scheduler/occurrence/mod.rs
new file mode 100644
index 00000000..bd410cc0
--- /dev/null
+++ b/cli/src/scheduler/occurrence/mod.rs
@@ -0,0 +1,73 @@
+mod occurrence_add;
+
+use crate::prelude::*;
+
+#[derive(Args, Debug, Clone)]
+#[group(id = "occurrence-start", multiple = false)]
+pub(crate) struct OccurrenceStartOptions {
+    /// Absolute start time in milliseconds since epoch.
+    #[arg(long = "start-ms", value_name = "MILLIS")]
+    start_ms: Option<u64>,
+    /// Start offset in milliseconds from now.
+    #[arg(long = "start-offset-ms", value_name = "MILLIS")]
+    start_offset_ms: Option<u64>,
+}
+
+#[derive(Args, Debug, Clone)]
+#[group(id = "occurrence-deadline", multiple = false)]
+pub(crate) struct OccurrenceDeadlineOptions {
+    /// Deadline offset in milliseconds after the scheduled start.
+    #[arg(long = "deadline-offset-ms", value_name = "MILLIS")]
+    deadline_offset_ms: Option<u64>,
+}
+
+#[derive(Subcommand)]
+pub(crate) enum OccurrenceCommand {
+    #[command(about = "Add a sporadic occurrence to a task")]
+    Add {
+        /// Task object ID receiving the occurrence.
+        #[arg(long = "task-id", short = 't', value_name = "OBJECT_ID")]
+        task_id: sui::types::Address,
+        #[command(flatten)]
+        start: OccurrenceStartOptions,
+        #[command(flatten)]
+        deadline: OccurrenceDeadlineOptions,
+        /// Priority fee per gas unit applied to the occurrence.
+        #[arg(
+            long = "priority-fee-per-gas-unit",
+            value_name = "AMOUNT",
+            default_value_t = 0u64
+        )]
+        priority_fee_per_gas_unit: u64,
+        #[command(flatten)]
+        gas: GasArgs,
+    },
+}
+
+pub(crate) async fn handle(command: OccurrenceCommand) -> AnyResult<(), NexusCliError> {
+    match command {
+        OccurrenceCommand::Add {
+            task_id,
+            start,
+            deadline,
+            priority_fee_per_gas_unit,
+            gas,
+        } => {
+            let OccurrenceStartOptions {
+                start_ms,
+                start_offset_ms,
+            } = start;
+            let OccurrenceDeadlineOptions { deadline_offset_ms } = deadline;
+
+            occurrence_add::add_occurrence_to_task(
+                task_id,
+                start_ms,
+                start_offset_ms,
+                deadline_offset_ms,
+                priority_fee_per_gas_unit,
+                gas,
+            )
+            .await
+        }
+    }
+}
diff --git a/cli/src/scheduler/occurrence/occurrence_add.rs b/cli/src/scheduler/occurrence/occurrence_add.rs
new file mode 100644
index 00000000..33ba9796
--- /dev/null
+++ b/cli/src/scheduler/occurrence/occurrence_add.rs
@@ -0,0 +1,57 @@
+use {
+    crate::{
+        command_title,
+        display::json_output,
+        notify_success,
+        prelude::*,
+        sui::get_nexus_client,
+    },
+    nexus_sdk::nexus::scheduler::OccurrenceRequest,
+    serde_json::json,
+};
+
+/// Schedule a one-off occurrence for a scheduler task.
+pub(crate) async fn add_occurrence_to_task(
+    task_id: sui::types::Address,
+    start_ms: Option<u64>,
+    start_offset_ms: Option<u64>,
+    deadline_offset_ms: Option<u64>,
+    priority_fee_per_gas_unit: u64,
+    gas: GasArgs,
+) -> AnyResult<(), NexusCliError> {
+    command_title!(
+        "Scheduling occurrence for task '{task_id}'",
+        task_id = task_id
+    );
+
+    let schedule = OccurrenceRequest::new(
+        start_ms,
+        None,
+        start_offset_ms,
+        deadline_offset_ms,
+        priority_fee_per_gas_unit,
+        true,
+    )
+    .map_err(NexusCliError::Nexus)?;
+
+    let nexus_client = get_nexus_client(gas.sui_gas_coin, gas.sui_gas_budget).await?;
+
+    let result = nexus_client
+        .scheduler()
+        .add_occurrence(task_id, schedule)
+        .await
+        .map_err(NexusCliError::Nexus)?;
+
+    notify_success!("Occurrence scheduled");
+
+    json_output(&json!({
+        "digest": result.tx_digest,
+        "task_id": task_id,
+        "start_ms": start_ms,
+        "start_offset_ms": start_offset_ms,
+        "deadline_offset_ms": deadline_offset_ms,
+        "priority_fee_per_gas_unit": priority_fee_per_gas_unit,
+    }))?;
+
+    Ok(())
+}
diff --git a/cli/src/scheduler/periodic/mod.rs b/cli/src/scheduler/periodic/mod.rs
new file mode 100644
index 00000000..802626bd
--- /dev/null
+++ b/cli/src/scheduler/periodic/mod.rs
@@ -0,0 +1,71 @@
+mod periodic_disable;
+mod periodic_set;
+
+use crate::prelude::*;
+
+#[derive(Subcommand)]
+pub(crate) enum PeriodicCommand {
+    #[command(about = "Configure or update periodic scheduling")]
+    Set {
+        /// Task object ID.
+        #[arg(long = "task-id", short = 't', value_name = "OBJECT_ID")]
+        task_id: sui::types::Address,
+        /// Absolute start time in milliseconds since epoch for the next periodic occurrence.
+        #[arg(long = "first-start-ms", value_name = "MILLIS")]
+        first_start_ms: u64,
+        /// Period between occurrences in milliseconds.
+        #[arg(long = "period-ms", value_name = "MILLIS")]
+        period_ms: u64,
+        /// Deadline offset from each start time in milliseconds.
+        #[arg(long = "deadline-offset-ms", value_name = "MILLIS")]
+        deadline_offset_ms: Option<u64>,
+        /// Maximum number of generated occurrences (None for infinite).
+        #[arg(long = "max-iterations", value_name = "COUNT")]
+        max_iterations: Option<u64>,
+        /// Priority fee per gas unit associated with occurrences.
+        #[arg(
+            long = "priority-fee-per-gas-unit",
+            value_name = "AMOUNT",
+            default_value_t = 0u64
+        )]
+        priority_fee_per_gas_unit: u64,
+        #[command(flatten)]
+        gas: GasArgs,
+    },
+    #[command(about = "Disable periodic scheduling")]
+    Disable {
+        /// Task object ID to update.
+        #[arg(long = "task-id", short = 't', value_name = "OBJECT_ID")]
+        task_id: sui::types::Address,
+        #[command(flatten)]
+        gas: GasArgs,
+    },
+}
+
+pub(crate) async fn handle(command: PeriodicCommand) -> AnyResult<(), NexusCliError> {
+    match command {
+        PeriodicCommand::Set {
+            task_id,
+            first_start_ms,
+            period_ms,
+            deadline_offset_ms,
+            max_iterations,
+            priority_fee_per_gas_unit,
+            gas,
+        } => {
+            periodic_set::set_periodic_task(
+                task_id,
+                first_start_ms,
+                period_ms,
+                deadline_offset_ms,
+                max_iterations,
+                priority_fee_per_gas_unit,
+                gas,
+            )
+            .await
+        }
+        PeriodicCommand::Disable { task_id, gas } => {
+            periodic_disable::disable_periodic_task(task_id, gas).await
+        }
+    }
+}
diff --git a/cli/src/scheduler/periodic/periodic_disable.rs b/cli/src/scheduler/periodic/periodic_disable.rs
new file mode 100644
index 00000000..47bd4958
--- /dev/null
+++ b/cli/src/scheduler/periodic/periodic_disable.rs
@@ -0,0 +1,38 @@
+use {
+    crate::{
+        command_title,
+        display::json_output,
+        notify_success,
+        prelude::*,
+        sui::get_nexus_client,
+    },
+    serde_json::json,
+};
+
+/// Disable the periodic schedule for a scheduler task.
+pub(crate) async fn disable_periodic_task(
+    task_id: sui::types::Address,
+    gas: GasArgs,
+) -> AnyResult<(), NexusCliError> {
+    command_title!(
+        "Disabling periodic schedule for task '{task_id}'",
+        task_id = task_id
+    );
+
+    let nexus_client = get_nexus_client(gas.sui_gas_coin, gas.sui_gas_budget).await?;
+
+    let result = nexus_client
+        .scheduler()
+        .disable_periodic(task_id)
+        .await
+        .map_err(NexusCliError::Nexus)?;
+
+    notify_success!("Periodic schedule disabled");
+
+    json_output(&json!({
+        "digest": result.tx_digest,
+        "task_id": task_id,
+    }))?;
+
+    Ok(())
+}
diff --git a/cli/src/scheduler/periodic/periodic_set.rs b/cli/src/scheduler/periodic/periodic_set.rs
new file mode 100644
index 00000000..ff9dbb7b
--- /dev/null
+++ b/cli/src/scheduler/periodic/periodic_set.rs
@@ -0,0 +1,57 @@
+use {
+    crate::{
+        command_title,
+        display::json_output,
+        notify_success,
+        prelude::*,
+        sui::get_nexus_client,
+    },
+    nexus_sdk::nexus::scheduler::PeriodicScheduleConfig,
+    serde_json::json,
+};
+
+/// Configure or update the periodic schedule for a scheduler task.
+pub(crate) async fn set_periodic_task(
+    task_id: sui::types::Address,
+    first_start_ms: u64,
+    period_ms: u64,
+    deadline_offset_ms: Option<u64>,
+    max_iterations: Option<u64>,
+    priority_fee_per_gas_unit: u64,
+    gas: GasArgs,
+) -> AnyResult<(), NexusCliError> {
+    command_title!(
+        "Configuring periodic schedule for task '{task_id}'",
+        task_id = task_id
+    );
+
+    let nexus_client = get_nexus_client(gas.sui_gas_coin, gas.sui_gas_budget).await?;
+
+    let result = nexus_client
+        .scheduler()
+        .configure_periodic(
+            task_id,
+            PeriodicScheduleConfig {
+                first_start_ms,
+                period_ms,
+                deadline_offset_ms,
+                max_iterations,
+                priority_fee_per_gas_unit,
+            },
+        )
+        .await
+        .map_err(NexusCliError::Nexus)?;
+
+    notify_success!("Periodic schedule set");
+
+    json_output(&json!({
+        "digest": result.tx_digest,
+        "task_id": task_id,
+        "period_ms": period_ms,
+        "deadline_offset_ms": deadline_offset_ms,
+        "max_iterations": max_iterations,
+        "priority_fee_per_gas_unit": priority_fee_per_gas_unit,
+    }))?;
+
+    Ok(())
+}
diff --git a/cli/src/scheduler/task/mod.rs b/cli/src/scheduler/task/mod.rs
new file mode 100644
index 00000000..4e015b4e
--- /dev/null
+++ b/cli/src/scheduler/task/mod.rs
@@ -0,0 +1,213 @@
+mod task_create;
+mod task_inspect;
+mod task_metadata;
+mod task_state;
+
+use {
+    self::task_state::TaskStateRequest,
+    crate::prelude::*,
+    nexus_sdk::{nexus::scheduler::GeneratorKind, types::DEFAULT_ENTRY_GROUP},
+};
+
+#[derive(Copy, Clone, Debug, ValueEnum)]
+pub(crate) enum TaskGeneratorArg {
+    Queue,
+    Periodic,
+}
+
+impl From<TaskGeneratorArg> for GeneratorKind {
+    fn from(value: TaskGeneratorArg) -> Self {
+        match value {
+            TaskGeneratorArg::Queue => GeneratorKind::Queue,
+            TaskGeneratorArg::Periodic => GeneratorKind::Periodic,
+        }
+    }
+}
+
+#[derive(Args, Debug, Clone)]
+#[group(id = "schedule-start", multiple = false)]
+pub(crate) struct ScheduleStartOptions {
+    /// Absolute start time in milliseconds since epoch for the first occurrence.
+    #[arg(long = "schedule-start-ms", value_name = "MILLIS")]
+    schedule_start_ms: Option<u64>,
+    /// Start offset in milliseconds from now for the first occurrence.
+    #[arg(long = "schedule-start-offset-ms", value_name = "MILLIS")]
+    schedule_start_offset_ms: Option<u64>,
+}
+
+#[derive(Args, Debug, Clone)]
+#[group(id = "schedule-deadline", multiple = false)]
+pub(crate) struct ScheduleDeadlineOptions {
+    /// Deadline offset in milliseconds after the scheduled start for the first occurrence.
+    #[arg(long = "schedule-deadline-offset-ms", value_name = "MILLIS")]
+    schedule_deadline_offset_ms: Option<u64>,
+}
+
+#[derive(Subcommand)]
+pub(crate) enum TaskCommand {
+    #[command(about = "Create a new scheduler task")]
+    Create {
+        /// DAG object ID providing the execution definition.
+        #[arg(long = "dag-id", short = 'd', value_name = "OBJECT_ID")]
+        dag_id: sui::types::Address,
+        /// Entry group to invoke when executing the DAG.
+        #[arg(
+            long = "entry-group",
+            short = 'e',
+            default_value = DEFAULT_ENTRY_GROUP,
+            value_name = "NAME",
+        )]
+        entry_group: String,
+        /// Initial input JSON for the DAG execution.
+        #[arg(
+            long = "input-json",
+            short = 'i',
+            value_parser = ValueParser::from(parse_json_string),
+            value_name = "JSON",
+        )]
+        input_json: Option<serde_json::Value>,
+        /// Which input json keys should be stored remotely.
+        #[arg(
+            long = "remote",
+            short = 'r',
+            help = "Which input json keys should be stored remotely. Provide a comma-separated list of {vertex}.{port} values. By default, all fields are stored inline.",
+            value_delimiter = ',',
+            value_name = "VERTEX.PORT"
+        )]
+        remote: Vec<String>,
+        /// Metadata entries to attach to the task as key=value pairs.
+        #[arg(long = "metadata", short = 'm', value_name = "KEY=VALUE")]
+        metadata: Vec<String>,
+        /// Priority fee per gas unit for DAG executions launched by the task.
+        #[arg(
+            long = "execution-priority-fee-per-gas-unit",
+            value_name = "AMOUNT",
+            default_value_t = 0u64
+        )]
+        execution_priority_fee_per_gas_unit: u64,
+        #[command(flatten)]
+        schedule_start: ScheduleStartOptions,
+        #[command(flatten)]
+        schedule_deadline: ScheduleDeadlineOptions,
+        /// Priority fee per gas unit for the initial occurrence.
+        #[arg(
+            long = "schedule-priority-fee-per-gas-unit",
+            value_name = "AMOUNT",
+            default_value_t = 0u64
+        )]
+        schedule_priority_fee_per_gas_unit: u64,
+        /// Generator responsible for producing future occurrences for this task.
+        #[arg(
+            long = "generator",
+            value_enum,
+            default_value_t = TaskGeneratorArg::Queue,
+            value_name = "KIND"
+        )]
+        generator: TaskGeneratorArg,
+        #[command(flatten)]
+        gas: GasArgs,
+    },
+    #[command(about = "Inspect a scheduler task")]
+    Inspect {
+        /// Task object ID to inspect.
+        #[arg(long = "task-id", short = 't', value_name = "OBJECT_ID")]
+        task_id: sui::types::Address,
+    },
+    #[command(about = "Update scheduler task metadata")]
+    Metadata {
+        /// Task object ID to update.
+        #[arg(long = "task-id", short = 't', value_name = "OBJECT_ID")]
+        task_id: sui::types::Address,
+        /// Metadata entries to write as key=value pairs.
+        #[arg(
+            long = "metadata",
+            short = 'm',
+            value_name = "KEY=VALUE",
+            required = true
+        )]
+        metadata: Vec<String>,
+        #[command(flatten)]
+        gas: GasArgs,
+    },
+    #[command(about = "Pause task scheduling")]
+    Pause {
+        /// Task object ID to mutate.
+        #[arg(long = "task-id", short = 't', value_name = "OBJECT_ID")]
+        task_id: sui::types::Address,
+        #[command(flatten)]
+        gas: GasArgs,
+    },
+    #[command(about = "Resume task scheduling")]
+    Resume {
+        /// Task object ID to mutate.
+        #[arg(long = "task-id", short = 't', value_name = "OBJECT_ID")]
+        task_id: sui::types::Address,
+        #[command(flatten)]
+        gas: GasArgs,
+    },
+    #[command(about = "Cancel task scheduling")]
+    Cancel {
+        /// Task object ID to mutate.
+        #[arg(long = "task-id", short = 't', value_name = "OBJECT_ID")]
+        task_id: sui::types::Address,
+        #[command(flatten)]
+        gas: GasArgs,
+    },
+}
+
+pub(crate) async fn handle(command: TaskCommand) -> AnyResult<(), NexusCliError> {
+    match command {
+        TaskCommand::Create {
+            dag_id,
+            entry_group,
+            input_json,
+            remote,
+            metadata,
+            execution_priority_fee_per_gas_unit,
+            schedule_start,
+            schedule_deadline,
+            schedule_priority_fee_per_gas_unit,
+            generator,
+            gas,
+        } => {
+            let ScheduleStartOptions {
+                schedule_start_ms,
+                schedule_start_offset_ms,
+            } = schedule_start;
+            let ScheduleDeadlineOptions {
+                schedule_deadline_offset_ms,
+            } = schedule_deadline;
+
+            task_create::create_task(
+                dag_id,
+                entry_group,
+                input_json,
+                remote,
+                metadata,
+                execution_priority_fee_per_gas_unit,
+                schedule_start_ms,
+                schedule_start_offset_ms,
+                schedule_deadline_offset_ms,
+                schedule_priority_fee_per_gas_unit,
+                generator.into(),
+                gas,
+            )
+            .await
+        }
+        TaskCommand::Inspect { task_id } => task_inspect::inspect_task(task_id).await,
+        TaskCommand::Metadata {
+            task_id,
+            metadata,
+            gas,
+        } => task_metadata::update_task_metadata(task_id, metadata, gas).await,
+        TaskCommand::Pause { task_id, gas } => {
+            task_state::set_task_state(task_id, gas, TaskStateRequest::Pause).await
+        }
+        TaskCommand::Resume { task_id, gas } => {
+            task_state::set_task_state(task_id, gas, TaskStateRequest::Resume).await
+        }
+        TaskCommand::Cancel { task_id, gas } => {
+            task_state::set_task_state(task_id, gas, TaskStateRequest::Cancel).await
+        }
+    }
+}
diff --git a/cli/src/scheduler/task/task_create.rs b/cli/src/scheduler/task/task_create.rs
new file mode 100644
index 00000000..bc08f969
--- /dev/null
+++ b/cli/src/scheduler/task/task_create.rs
@@ -0,0 +1,207 @@
+use {
+    crate::{
+        command_title,
+        display::json_output,
+        loading,
+        notify_success,
+        prelude::*,
+        scheduler::helpers,
+        sui::get_nexus_client,
+        workflow,
+    },
+    nexus_sdk::{
+        events::NexusEventKind,
+        nexus::scheduler::{CreateTaskParams, GeneratorKind, OccurrenceRequest},
+        types::{EncryptionMode, PolicySymbol, StorageConf},
+    },
+    std::{collections::HashMap, sync::Arc},
+};
+
+/// Create a scheduler task and optionally enqueue the initial occurrence.
+#[allow(clippy::too_many_arguments)]
+pub(crate) async fn create_task(
+    dag_id: sui::types::Address,
+    entry_group: String,
+    mut input_json: Option<serde_json::Value>,
+    remote: Vec<String>,
+    metadata: Vec<String>,
+    execution_priority_fee_per_gas_unit: u64,
+    schedule_start_ms: Option<u64>,
+    schedule_start_offset_ms: Option<u64>,
+    schedule_deadline_offset_ms: Option<u64>,
+    schedule_priority_fee_per_gas_unit: u64,
+    generator: GeneratorKind,
+    gas: GasArgs,
+) -> AnyResult<(), NexusCliError> {
+    command_title!(
+        "Creating scheduler task for DAG '{dag_id}'",
+        dag_id = dag_id
+    );
+
+    // Load CLI configuration.
+    let conf = CliConf::load().await.unwrap_or_default();
+
+    let nexus_client = get_nexus_client(gas.sui_gas_coin, gas.sui_gas_budget).await?;
+
+    // Parse metadata arguments and prepare the DAG input payload.
+    let metadata_pairs = helpers::parse_metadata(&metadata)?;
+    let input_json = input_json.take().unwrap_or_else(|| serde_json::json!({}));
+
+    // Fetch encrypted entry ports.
+    let encrypt_handles =
+        helpers::fetch_encryption_targets(nexus_client.crawler(), &dag_id, &entry_group).await?;
+
+    // Build the remote storage configuration.
+    let preferred_remote_storage = conf.data_storage.preferred_remote_storage;
+    let storage_conf: StorageConf = conf.data_storage.clone().into();
+
+    // Acquire a session for potential encryption/remote storage commits.
+    let session = CryptoConf::get_active_session(None).await.map_err(|e| {
+        NexusCliError::Any(anyhow!(
+            "Failed to get active session: {}.\nPlease initiate a session first.\n\n{init_key}\n{crypto_auth}",
+            e,
+            init_key = "$ nexus crypto init-key --force",
+            crypto_auth = "$ nexus crypto auth"
+        ))
+    })?;
+
+    let ports_data = workflow::process_entry_ports(
+        &input_json,
+        preferred_remote_storage,
+        &encrypt_handles,
+        &remote,
+        EncryptionMode::LimitedPersistent,
+    )
+    .await?;
+
+    let mut input_data = HashMap::new();
+    for (vertex, data) in ports_data {
+        let committed = data
+            .commit_all(&storage_conf, Arc::clone(&session))
+            .await
+            .map_err(|e| {
+                NexusCliError::Any(anyhow!(
+                    "Failed to store data: {e}.\nEnsure remote storage is configured.\n\n{command}\n{testnet_command}",
+                    e = e,
+                    command = "$ nexus conf set --data-storage.walrus-publisher-url <URL> --data-storage.walrus-save-for-epochs <EPOCHS>",
+                    testnet_command = "Or for testnet simply: $ nexus conf set --data-storage.testnet"
+                ))
+            })?;
+        input_data.insert(vertex, committed);
+    }
+
+    if encrypt_handles.values().any(|ports| !ports.is_empty()) {
+        session.lock().await.commit_sender(None);
+    }
+
+    CryptoConf::release_session(session, None)
+        .await
+        .map_err(|e| NexusCliError::Any(anyhow!("Failed to release session: {e}")))?;
+
+    let schedule_requested = schedule_start_ms.is_some()
+        || schedule_start_offset_ms.is_some()
+        || schedule_deadline_offset_ms.is_some();
+
+    let initial_schedule = if schedule_requested {
+        Some(
+            OccurrenceRequest::new(
+                schedule_start_ms,
+                None,
+                schedule_start_offset_ms,
+                schedule_deadline_offset_ms,
+                schedule_priority_fee_per_gas_unit,
+                true,
+            )
+            .map_err(NexusCliError::Nexus)?,
+        )
+    } else {
+        None
+    };
+
+    if matches!(generator, GeneratorKind::Periodic) && initial_schedule.is_some() {
+        return Err(NexusCliError::Any(anyhow!(
+            "Periodic tasks cannot enqueue an initial occurrence. Configure scheduling with `nexus scheduler periodic set`."
+        )));
+    }
+
+    let tx_handle = loading!("Submitting scheduler task transaction...");
+
+    let result = nexus_client
+        .scheduler()
+        .create_task(CreateTaskParams {
+            dag_id,
+            entry_group: entry_group.clone(),
+            input_data,
+            metadata: metadata_pairs,
+            execution_priority_fee_per_gas_unit,
+            initial_schedule,
+            generator,
+        })
+        .await
+        .map_err(NexusCliError::Nexus)?;
+
+    tx_handle.success();
+
+    let mut result_json = serde_json::json!({
+        "digest": result.tx_digest,
+        "task_id": result.task_id,
+    });
+
+    let mut scheduled_event_display = None;
+
+    if let Some(schedule) = result.initial_schedule.as_ref() {
+        result_json["schedule_digest"] = serde_json::json!(schedule.tx_digest);
+        if let Some(event) = schedule.event.clone() {
+            result_json["scheduled"] = serde_json::to_value(&event).unwrap_or_default();
+            scheduled_event_display = describe_occurrence_event(&event);
+        }
+    }
+
+    notify_success!(
+        "Scheduler task created: {task_id}",
+        task_id = result.task_id.to_string().truecolor(100, 100, 100)
+    );
+
+    if let Some(description) = scheduled_event_display {
+        notify_success!(
+            "Initial occurrence scheduled: {event}",
+            event = description.truecolor(100, 100, 100)
+        );
+    }
+
+    // Always save the updated config.
+    conf.save().await.map_err(NexusCliError::Any)?;
+
+    json_output(&result_json)?;
+
+    Ok(())
+}
+
+fn describe_occurrence_event(event: &NexusEventKind) -> Option<String> {
+    match event {
+        NexusEventKind::RequestScheduledOccurrence(env) => Some(format!(
+            "task={} start_ms={} (generator={}, priority={})",
+            env.request.task,
+            env.start_ms,
+            describe_generator(&env.request.generator),
+            env.priority
+        )),
+        NexusEventKind::RequestScheduledWalk(env) => Some(format!(
+            "walk for dag execution start_ms={} (priority={})",
+            env.start_ms, env.priority
+        )),
+        NexusEventKind::OccurrenceScheduled(e) => Some(format!(
+            "task={} (generator={})",
+            e.task,
+            describe_generator(&e.generator)
+        )),
+        _ => None,
+    }
+}
+
+fn describe_generator(symbol: &PolicySymbol) -> String {
+    match symbol {
+        PolicySymbol::Witness(name) => name.name.clone(),
+        PolicySymbol::Uid(uid) => uid.to_string(),
+    }
+}
diff --git a/cli/src/scheduler/task/task_inspect.rs b/cli/src/scheduler/task/task_inspect.rs
new file mode 100644
index 00000000..905c8d13
--- /dev/null
+++ b/cli/src/scheduler/task/task_inspect.rs
@@ -0,0 +1,66 @@
+use {
+    crate::{
+        command_title,
+        display::json_output,
+        item,
+        loading,
+        notify_success,
+        prelude::*,
+        sui::*,
+    },
+    nexus_sdk::types::Task,
+    serde_json::json,
+};
+
+/// Inspect a scheduler task and display metadata plus raw JSON output.
+pub(crate) async fn inspect_task(task_id: sui::types::Address) -> AnyResult<(), NexusCliError> {
+    command_title!("Inspecting scheduler task '{task_id}'", task_id = task_id);
+
+    let nexus_client = get_nexus_client(None, DEFAULT_GAS_BUDGET).await?;
+    let crawler = nexus_client.crawler();
+
+    let objects_handle = loading!("Fetching task object...");
+
+    // Fetch the task object from chain.
+    let task = crawler
+        .get_object::<Task>(task_id)
+        .await
+        .map_err(|e| NexusCliError::Any(anyhow!(e)))?;
+
+    objects_handle.success();
+
+    let task_ref = task.object_ref();
+    let task_data = task.data;
+
+    notify_success!(
+        "Task owner: {owner}",
+        owner = task_data.owner.to_string().truecolor(100, 100, 100)
+    );
+
+    let metadata = task_data.metadata.values.inner();
+    item!("Metadata entries: {count}", count = metadata.len());
+    for (key, value) in metadata.iter().take(10) {
+        item!(
+            "  {key}: {value}",
+            key = key.truecolor(100, 100, 100),
+            value = value
+        );
+    }
+    if metadata.len() > 10 {
+        item!(
+            "  ... ({remain} more entries)",
+            remain = metadata.len() - 10
+        );
+    }
+
+    json_output(&json!({
+        "task_ref": {
+            "object_id": task_ref.object_id(),
+            "version": task_ref.version(),
+            "digest": task_ref.digest(),
+        },
+        "task": task_data,
+    }))?;
+
+    Ok(())
+}
diff --git a/cli/src/scheduler/task/task_metadata.rs b/cli/src/scheduler/task/task_metadata.rs
new file mode 100644
index 00000000..2be90f48
--- /dev/null
+++ b/cli/src/scheduler/task/task_metadata.rs
@@ -0,0 +1,46 @@
+use {
+    crate::{
+        command_title,
+        display::json_output,
+        notify_success,
+        prelude::*,
+        scheduler::helpers,
+        sui::get_nexus_client,
+    },
+    serde_json::json,
+};
+
+/// Update all metadata entries for a scheduler task.
+pub(crate) async fn update_task_metadata(
+    task_id: sui::types::Address,
+    metadata: Vec<String>,
+    gas: GasArgs,
+) -> AnyResult<(), NexusCliError> {
+    command_title!(
+        "Updating scheduler metadata for task '{task_id}'",
+        task_id = task_id
+    );
+
+    let metadata_pairs = helpers::parse_metadata(&metadata)?;
+
+    let nexus_client = get_nexus_client(gas.sui_gas_coin, gas.sui_gas_budget).await?;
+
+    let result = nexus_client
+        .scheduler()
+        .update_metadata(task_id, metadata_pairs.clone())
+        .await
+        .map_err(NexusCliError::Nexus)?;
+
+    notify_success!(
+        "Metadata updated for task {task_id}",
+        task_id = task_id.to_string().truecolor(100, 100, 100)
+    );
+
+    json_output(&json!({
+        "digest": result.tx_digest,
+        "task_id": task_id,
+        "metadata_entries": metadata_pairs.len(),
+    }))?;
+
+    Ok(())
+}
diff --git a/cli/src/scheduler/task/task_state.rs b/cli/src/scheduler/task/task_state.rs
new file mode 100644
index 00000000..823d5a9c
--- /dev/null
+++ b/cli/src/scheduler/task/task_state.rs
@@ -0,0 +1,70 @@
+use {
+    crate::{
+        command_title,
+        display::json_output,
+        notify_success,
+        prelude::*,
+        sui::get_nexus_client,
+    },
+    nexus_sdk::nexus::scheduler::TaskStateAction,
+    serde_json::json,
+};
+
+#[derive(Clone, Copy, Debug)]
+pub(crate) enum TaskStateRequest {
+    Pause,
+    Resume,
+    Cancel,
+}
+
+impl std::fmt::Display for TaskStateRequest {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        let verb = match self {
+            TaskStateRequest::Pause => "Pausing",
+            TaskStateRequest::Resume => "Resuming",
+            TaskStateRequest::Cancel => "Canceling",
+        };
+        write!(f, "{verb}")
+    }
+}
+
+/// Toggle scheduler task state between paused, resumed, or canceled.
+pub(crate) async fn set_task_state(
+    task_id: sui::types::Address,
+    gas: GasArgs,
+    request: TaskStateRequest,
+) -> AnyResult<(), NexusCliError> {
+    command_title!("{request} scheduler task '{task_id}'");
+
+    let nexus_client = get_nexus_client(gas.sui_gas_coin, gas.sui_gas_budget).await?;
+
+    let action = match request {
+        TaskStateRequest::Pause => TaskStateAction::Pause,
+        TaskStateRequest::Resume => TaskStateAction::Resume,
+        TaskStateRequest::Cancel => TaskStateAction::Cancel,
+    };
+
+    let result = nexus_client
+        .scheduler()
+        .set_task_state(task_id, action)
+        .await
+        .map_err(NexusCliError::Nexus)?;
+
+    match request {
+        TaskStateRequest::Pause => notify_success!("Task paused"),
+        TaskStateRequest::Resume => notify_success!("Task resumed"),
+        TaskStateRequest::Cancel => notify_success!("Task canceled"),
+    }
+
+    json_output(&json!({
+        "digest": result.tx_digest,
+        "task_id": task_id,
+        "state": match request {
+            TaskStateRequest::Pause => "paused",
+            TaskStateRequest::Resume => "resumed",
+            TaskStateRequest::Cancel => "canceled",
+        },
+    }))?;
+
+    Ok(())
+}
diff --git a/cli/src/sui.rs b/cli/src/sui.rs
index a480cbbf..17f54b4e 100644
--- a/cli/src/sui.rs
+++ b/cli/src/sui.rs
@@ -1,225 +1,162 @@
 use {
-    crate::{loading, notify_success, prelude::*},
-    nexus_sdk::{nexus::client::NexusClient, object_crawler::fetch_one, sui},
+    crate::{loading, prelude::*},
+    base64::{prelude::BASE64_STANDARD, Engine},
+    nexus_sdk::{nexus::client::NexusClient, sui},
 };
 
 /// Build Sui client for the provided Sui net.
-pub(crate) async fn build_sui_client(conf: &SuiConf) -> AnyResult<sui::Client, NexusCliError> {
-    let building_handle = loading!("Building Sui client...");
-    let client;
-
-    let builder = sui::ClientBuilder::default();
-
-    if let Ok(sui_rpc_url) = std::env::var("SUI_RPC_URL") {
-        client = builder.build(sui_rpc_url).await
-    } else if let Some(sui_rpc_url) = &conf.rpc_url {
-        client = builder.build(sui_rpc_url).await
-    } else {
-        client = match conf.net {
-            SuiNet::Localnet => builder.build_localnet().await,
-            SuiNet::Devnet => builder.build_devnet().await,
-            SuiNet::Testnet => builder.build_testnet().await,
-            SuiNet::Mainnet => todo!("Mainnet not yet supported"),
-        };
-    }
+pub(crate) async fn build_sui_grpc_client(
+    conf: &CliConf,
+) -> AnyResult<Arc<Mutex<sui::grpc::Client>>, NexusCliError> {
+    let client_handle = loading!("Building Sui client...");
+
+    // Try to get the `SUI_RPC_URL` from the environment, otherwise use
+    // the configuration.
+    let Some(url) = std::env::var("SUI_RPC_URL")
+        .ok()
+        .or_else(|| conf.sui.rpc_url.as_ref().map(|u| u.to_string()))
+    else {
+        client_handle.error();
+
+        return Err(NexusCliError::Any(anyhow!(
+            "{message}\n\n{command}",
+            message = "The Sui RPC URL is not configured. Please set it via the environment variable or the CLI configuration.",
+            command = "$ nexus conf --sui.rpc-url <url>".to_string().bold(),
+        )));
+    };
 
-    match client {
+    match sui::grpc::Client::new(url) {
         Ok(client) => {
-            building_handle.success();
+            client_handle.success();
 
-            Ok(client)
+            Ok(Arc::new(Mutex::new(client)))
         }
         Err(e) => {
-            building_handle.error();
+            client_handle.error();
 
-            Err(NexusCliError::Sui(e))
+            Err(NexusCliError::Rpc(e.into()))
         }
     }
 }
 
-/// Create a wallet context from the provided path.
-pub(crate) async fn create_wallet_context(
-    path: &Path,
-    net: SuiNet,
-) -> AnyResult<sui::WalletContext, NexusCliError> {
-    let wallet_handle = loading!("Initiating SUI wallet...");
-
-    let request_timeout = None;
-    let max_concurrent_requests = None;
-
-    let wallet = match sui::WalletContext::new(path, request_timeout, max_concurrent_requests) {
-        Ok(wallet) => wallet,
-        Err(e) => {
-            wallet_handle.error();
-
-            return Err(NexusCliError::Any(e));
-        }
-    };
-
-    // Check that the Sui net matches.
-    if wallet.config.active_env != get_sui_env(net).map(|env| env.alias) {
-        wallet_handle.error();
-
-        if let Some(active_env) = wallet.config.active_env.as_ref() {
-            return Err(NexusCliError::Any(anyhow!(
-                "{message}\n\n{command}",
-                message = "The Sui net of the wallet does not match the provided Sui net. Either use a different wallet or run:",
-                command = format!("$ nexus conf --sui.net {active_env}").bold(),
-            )));
-        }
-
-        return Err(NexusCliError::Any(anyhow!(
-            "The Sui net of the wallet is not set. Please fix the Sui client configuration."
-        )));
+/// Parses an Ed25519 private key from base64.
+///
+/// Tries formats in order (like Sui's keytool import):
+/// 1. Base64 33 bytes (flag + key) - Sui format, flag must be 0x00 (ed25519)
+/// 2. Base64 32 bytes (raw key) - assumes Ed25519
+fn parse_ed25519_private_key(
+    pk_encoded: &str,
+) -> AnyResult<sui::crypto::Ed25519PrivateKey, String> {
+    let pk_bytes = BASE64_STANDARD
+        .decode(pk_encoded)
+        .map_err(|e| format!("Failed to decode Sui private key from base64: {e}"))?;
+
+    // Try Sui format: 33 bytes (flag + key)
+    if let Ok(bytes) = <[u8; 33]>::try_from(pk_bytes.as_slice()) {
+        const ED25519_FLAG: u8 = 0x00;
+        return match bytes[0] {
+            ED25519_FLAG => Ok(sui::crypto::Ed25519PrivateKey::new(
+                bytes[1..].try_into().unwrap(),
+            )),
+            flag => Err(format!(
+                "unsupported key scheme flag 0x{flag:02x}, only ed25519 (0x00) is supported"
+            )),
+        };
     }
 
-    wallet_handle.success();
+    // Try raw Ed25519: 32 bytes
+    if let Ok(bytes) = <[u8; 32]>::try_from(pk_bytes.as_slice()) {
+        return Ok(sui::crypto::Ed25519PrivateKey::new(bytes));
+    }
 
-    Ok(wallet)
+    Err(format!(
+        "invalid private key length {}, expected 32 (raw ed25519) or 33 (sui format with flag)",
+        pk_bytes.len()
+    ))
 }
 
-/// Fetch all coins owned by the provided address.
-pub(crate) async fn fetch_all_coins_for_address(
-    sui: &sui::Client,
-    addr: sui::Address,
-) -> AnyResult<Vec<sui::Coin>, NexusCliError> {
-    let coins_handle = loading!("Fetching coins...");
-
-    let limit = None;
-    let mut cursor = None;
-    let mut results = Vec::new();
-
-    // Keep fetching gas coins until there are no more pages.
-    loop {
-        let default_to_sui_coin_type = None;
-
-        let response = match sui
-            .coin_read_api()
-            .get_coins(addr, default_to_sui_coin_type, cursor, limit)
-            .await
-        {
-            Ok(response) => response,
-            Err(e) => {
-                coins_handle.error();
-
-                return Err(NexusCliError::Sui(e));
-            }
-        };
+/// Create a wallet context from the provided path.
+pub(crate) async fn get_signing_key(
+    conf: &CliConf,
+) -> AnyResult<sui::crypto::Ed25519PrivateKey, NexusCliError> {
+    let key_handle = loading!("Retrieving Sui signing key...");
+
+    // Try to get the `SUI_PK` from the environment, otherwise use the
+    // configuration. This value is a base64 encoded string of the private key
+    // bytes.
+    let Some(pk_encoded) = std::env::var("SUI_PK")
+        .ok()
+        .or_else(|| conf.sui.pk.clone().map(|pk| pk.peek().to_string()))
+    else {
+        key_handle.error();
 
-        cursor = response.next_cursor;
-        results.extend(response.data);
+        return Err(NexusCliError::Any(anyhow!(
+            "{message}\n\n{command}",
+            message = "The Sui private key is not configured. Please set it via environment or the CLI configuration.",
+            command = "$ nexus conf --sui.pk <base64_encoded_key>".to_string().bold(),
+        )));
+    };
 
-        if !response.has_next_page {
-            break;
+    match parse_ed25519_private_key(&pk_encoded) {
+        Ok(key) => {
+            key_handle.success();
+            Ok(key)
         }
-    }
-
-    coins_handle.success();
-
-    Ok(results)
-}
-
-/// Fetch reference gas price from Sui.
-pub(crate) async fn fetch_reference_gas_price(sui: &sui::Client) -> AnyResult<u64, NexusCliError> {
-    let gas_price_handle = loading!("Fetching reference gas price...");
-
-    let response = match sui.read_api().get_reference_gas_price().await {
-        Ok(response) => response,
         Err(e) => {
-            gas_price_handle.error();
-
-            return Err(NexusCliError::Sui(e));
+            key_handle.error();
+            Err(NexusCliError::Any(anyhow!("{e}")))
         }
-    };
-
-    gas_price_handle.success();
-
-    Ok(response)
+    }
 }
 
-/// Sign a transaction with the provided wallet and execute it.
-///
-/// Returns `Ok` with the transaction block response if successful, or `Err` if
-/// the signing or the execution fails, or if the response contains errors.
-pub(crate) async fn sign_and_execute_transaction(
-    sui: &sui::Client,
-    wallet: &sui::WalletContext,
-    tx_data: sui::TransactionData,
-) -> AnyResult<sui::TransactionBlockResponse, NexusCliError> {
-    let signing_handle = loading!("Signing transaction...");
-
-    let envelope = wallet.sign_transaction(&tx_data);
-
-    let resp_options = sui::TransactionBlockResponseOptions::new()
-        .with_balance_changes()
-        .with_effects()
-        .with_object_changes()
-        .with_events();
-
-    // We want to confirm that the tx was executed (the name of this variant is
-    // misleading).
-    let resp_finality = sui::ExecuteTransactionRequestType::WaitForLocalExecution;
-
-    let response = match sui
-        .quorum_driver_api()
-        .execute_transaction_block(envelope, resp_options, Some(resp_finality))
+/// Fetch all coins owned by the provided address.
+pub(crate) async fn fetch_coins_for_address(
+    client: Arc<Mutex<sui::grpc::Client>>,
+    owner: sui::types::Address,
+) -> AnyResult<Vec<sui::types::ObjectReference>, NexusCliError> {
+    let coins_handle = loading!("Fetching coins...");
+
+    let request = sui::grpc::ListOwnedObjectsRequest::default()
+        .with_owner(owner)
+        .with_page_size(1000)
+        .with_object_type(sui::types::StructTag::gas_coin())
+        .with_read_mask(sui::grpc::FieldMask::from_paths([
+            "object_id",
+            "version",
+            "digest",
+        ]));
+
+    let mut client = client.lock().await;
+
+    let response = match client
+        .state_client()
+        .list_owned_objects(request)
         .await
+        .map(|resp| resp.into_inner())
     {
         Ok(response) => response,
         Err(e) => {
-            signing_handle.error();
+            coins_handle.error();
 
-            return Err(NexusCliError::Sui(e));
+            return Err(NexusCliError::Rpc(e.into()));
         }
     };
 
-    if !response.errors.is_empty() {
-        signing_handle.error();
-
-        return Err(NexusCliError::Any(anyhow!(
-            "Transaction failed with errors: {errors:?}",
-            errors = response.errors
-        )));
-    }
+    drop(client);
 
-    // Check if any effects failed in the TX.
-    if let Some(sui::TransactionBlockEffects::V1(effect)) = &response.effects {
-        if let sui::ExecutionStatus::Failure { error } = effect.clone().into_status() {
-            signing_handle.error();
-
-            return Err(NexusCliError::Any(anyhow!(error)));
-        }
-    };
-
-    signing_handle.success();
-
-    notify_success!(
-        "Transaction digest: {digest}",
-        digest = response.digest.to_string().truecolor(100, 100, 100)
-    );
-
-    Ok(response)
-}
-
-/// Fetch a single object from Sui by its ID.
-pub(crate) async fn fetch_object_by_id(
-    sui: &sui::Client,
-    object_id: sui::ObjectID,
-) -> AnyResult<sui::ObjectRef, NexusCliError> {
-    let object_handle = loading!("Fetching object {object_id}...");
-
-    match fetch_one::<serde_json::Value>(sui, object_id).await {
-        Ok(response) => {
-            object_handle.success();
-
-            Ok(response.object_ref())
-        }
-        Err(e) => {
-            object_handle.error();
+    coins_handle.success();
 
-            Err(NexusCliError::Any(e))
-        }
-    }
+    Ok(response
+        .objects()
+        .iter()
+        .filter_map(|object| {
+            Some(sui::types::ObjectReference::new(
+                object.object_id_opt()?.parse().ok()?,
+                object.version_opt()?,
+                object.digest_opt()?.parse().ok()?,
+            ))
+        })
+        .collect())
 }
 
 /// Wrapping some conf parsing functionality used around the CLI.
@@ -236,8 +173,10 @@ pub(crate) async fn get_nexus_objects(
     }
 
     // For some networks, we attempt to load the objects from public endpoints.
-    let response = match conf.sui.net {
-        SuiNet::Devnet => fetch_objects_from_url(DEVNET_OBJECTS_TOML).await,
+    let response = match conf.sui.rpc_url.as_ref() {
+        Some(url) if url.as_str() == DEVNET_NEXUS_RPC_URL => {
+            fetch_objects_from_url(DEVNET_OBJECTS_TOML).await
+        }
         _ => Err(anyhow!(
             "Nexus objects are not configured for this network."
         )),
@@ -277,15 +216,18 @@ async fn fetch_objects_from_url(url: &str) -> AnyResult<NexusObjects> {
     Ok(objects)
 }
 
-/// Fetch the gas coin from the Sui client. On Localnet, Devnet and Testnet, we
-/// can use the faucet to get the coin. On Mainnet, this fails if the coin is
-/// not present.
-pub(crate) async fn fetch_gas_coin(
-    sui: &sui::Client,
-    addr: sui::Address,
-    sui_gas_coin: Option<sui::ObjectID>,
-) -> AnyResult<sui::Coin, NexusCliError> {
-    let mut coins = fetch_all_coins_for_address(sui, addr).await?;
+/// Fetch a coin from the Sui client.
+///
+/// `by_address`: If specified, fetch the coin with this object ID.
+/// `by_order`: If `by_address` is not specified, fetch the coin by its order in
+/// the list of owned coins (0-based).
+pub(crate) async fn fetch_coin(
+    client: Arc<Mutex<sui::grpc::Client>>,
+    owner: sui::types::Address,
+    by_address: Option<sui::types::Address>,
+    by_order: usize,
+) -> AnyResult<sui::types::ObjectReference, NexusCliError> {
+    let mut coins = fetch_coins_for_address(client, owner).await?;
 
     if coins.is_empty() {
         return Err(NexusCliError::Any(anyhow!(
@@ -295,416 +237,72 @@ pub(crate) async fn fetch_gas_coin(
 
     // If object gas coing object ID was specified, use it. If it was specified
     // and could not be found, return error.
-    match sui_gas_coin {
+    match by_address {
         Some(id) => {
             let coin = coins
                 .into_iter()
-                .find(|coin| coin.coin_object_id == id)
+                .find(|coin| *coin.object_id() == id)
                 .ok_or_else(|| NexusCliError::Any(anyhow!("Coin '{id}' not found in wallet")))?;
 
             Ok(coin)
         }
-        None => Ok(coins.remove(0)),
-    }
-}
+        None => {
+            if by_order >= coins.len() {
+                return Err(NexusCliError::Any(anyhow!(
+                    "The wallet does not have enough coins to select coin #{by_order}"
+                )));
+            }
 
-pub(crate) fn resolve_wallet_path(
-    cli_wallet_path: Option<PathBuf>,
-    conf: &SuiConf,
-) -> Result<PathBuf, NexusCliError> {
-    if let Some(path) = cli_wallet_path {
-        Ok(path)
-    } else if let Ok(mnemonic) = std::env::var("SUI_SECRET_MNEMONIC") {
-        retrieve_wallet_with_mnemonic(conf.net, &mnemonic).map_err(NexusCliError::Any)
-    } else {
-        Ok(conf.wallet_path.clone())
+            Ok(coins.swap_remove(by_order))
+        }
     }
 }
 
 /// Create a Nexus client from CLI parameters.
 pub(crate) async fn get_nexus_client(
-    sui_gas_coin: Option<sui::ObjectID>,
+    sui_gas_coin: Option<sui::types::Address>,
     sui_gas_budget: u64,
-) -> Result<(NexusClient, sui::Client), NexusCliError> {
-    // Load CLI configuration.
+) -> Result<NexusClient, NexusCliError> {
     let mut conf = CliConf::load().await.unwrap_or_default();
 
-    // Nexus objects must be present in the configuration.
-    let objects = &get_nexus_objects(&mut conf).await?;
-
-    // Create wallet context, Sui client and find the active address.
-    let mut wallet = create_wallet_context(&conf.sui.wallet_path, conf.sui.net).await?;
-    let sui_client = build_sui_client(&conf.sui).await?;
-    let address = wallet.active_address().map_err(NexusCliError::Any)?;
-
-    // Fetch gas coin object.
-    let gas_coin = fetch_gas_coin(&sui_client, address, sui_gas_coin).await?;
+    let client = build_sui_grpc_client(&conf).await?;
+    let pk = get_signing_key(&conf).await?;
+    let owner = pk.public_key().derive_address();
+    let gas_coin = fetch_coin(client.clone(), owner, sui_gas_coin, 0).await?;
+    let nexus_objects = get_nexus_objects(&mut conf).await?;
+    let rpc_url = client.lock().await.uri().to_string();
+
+    // Try to get the `SUI_GQL_URL` from the environment, otherwise use
+    // the configuration.
+    let Some(gql_url) = std::env::var("SUI_GQL_URL")
+        .ok()
+        .or_else(|| conf.sui.gql_url.as_ref().map(|u| u.to_string()))
+    else {
+        return Err(NexusCliError::Any(anyhow!(
+            "{message}\n\n{command}",
+            message =
+                "The Sui GraphQL URL is not configured. Please set it via environment or the CLI configuration.",
+            command = "$ nexus conf --sui.gql-url <url>".to_string().bold(),
+        )));
+    };
 
     // Create Nexus client.
     let nexus_client = NexusClient::builder()
-        .with_wallet_context(wallet)
-        .with_nexus_objects(objects.clone())
-        .with_gas(vec![&gas_coin], sui_gas_budget)
-        .map_err(NexusCliError::Nexus)?
+        .with_private_key(pk)
+        .with_nexus_objects(nexus_objects.clone())
+        .with_gas(vec![gas_coin], sui_gas_budget)
+        .with_rpc_url(&rpc_url)
+        .with_gql_url(&gql_url)
         .build()
         .await
         .map_err(NexusCliError::Nexus)?;
 
-    Ok((nexus_client, sui_client))
-}
-
-fn retrieve_wallet_with_mnemonic(net: SuiNet, mnemonic: &str) -> Result<PathBuf, anyhow::Error> {
-    // Determine configuration paths.
-    let config_dir = sui::config_dir()?;
-    let wallet_conf_path = config_dir.join(sui::CLIENT_CONFIG);
-    let keystore_path = config_dir.join(sui::KEYSTORE_FILENAME);
-
-    // Ensure the keystore exists.
-    if !keystore_path.exists() {
-        let keystore = sui::FileBasedKeystore::new(&keystore_path)?;
-        keystore.save()?;
-    }
-
-    // If the wallet config file does not exist, create it.
-    if !wallet_conf_path.exists() {
-        let keystore = sui::FileBasedKeystore::new(&keystore_path)?;
-        let mut client_config = sui::ClientConfig::new(keystore.into());
-        if let Some(env) = get_sui_env(net) {
-            client_config.add_env(env);
-        }
-        if client_config.active_env.is_none() {
-            client_config.active_env = client_config.envs.first().map(|env| env.alias.clone());
-        }
-
-        client_config.save(&wallet_conf_path)?;
-        println!("Client config file is stored in {:?}.", &wallet_conf_path);
-    }
-
-    // Import the mnemonic into the keystore.
-    let mut keystore = sui::FileBasedKeystore::new(&keystore_path)?;
-    let imported_address =
-        keystore.import_from_mnemonic(mnemonic, sui::SignatureScheme::ED25519, None, None)?;
-
-    // Read the existing client configuration.
-    let mut client_config: sui::ClientConfig = sui::PersistedConfig::read(&wallet_conf_path)?;
-
-    client_config.active_address = Some(imported_address);
-    client_config.save(&wallet_conf_path)?;
-
-    Ok(wallet_conf_path)
-}
-
-fn get_sui_env(net: SuiNet) -> Option<sui::Env> {
-    let alias = match net {
-        SuiNet::Localnet => "localnet".to_string(),
-        SuiNet::Devnet => "devnet".to_string(),
-        SuiNet::Testnet => "testnet".to_string(),
-        SuiNet::Mainnet => todo!("Mainnet not yet supported"),
-    };
-
-    if let Ok(sui_rpc_url) = std::env::var("SUI_RPC_URL") {
-        Some(sui::Env {
-            alias,
-            rpc: sui_rpc_url,
-            ws: None,
-            basic_auth: None,
-        })
-    } else {
-        let rpc = match net {
-            SuiNet::Localnet => sui::LOCAL_NETWORK_URL.into(),
-            SuiNet::Devnet => sui::DEVNET_URL.into(),
-            SuiNet::Testnet => sui::TESTNET_URL.into(),
-            SuiNet::Mainnet => todo!("Mainnet not yet supported"),
-        };
-
-        Some(sui::Env {
-            alias,
-            rpc,
-            ws: None,
-            basic_auth: None,
-        })
-    }
+    Ok(nexus_client)
 }
 
 #[cfg(test)]
 mod tests {
-    use {
-        super::*,
-        assert_matches::assert_matches,
-        mockito::Server,
-        nexus_sdk::sui::Address,
-        rstest::rstest,
-        serial_test::serial,
-        tempfile::tempdir,
-    };
-
-    #[rstest(
-        cli_wallet_path,
-        mnemonic_env,
-        expected,
-        case(
-            Some(PathBuf::from("/tmp/sui/config/client.toml")),
-            None,
-            PathBuf::from("/tmp/sui/config/client.toml")
-        ),
-        case(None, None, PathBuf::from("/tmp/sui/config/client.toml")),
-        case(
-            None,
-            Some("include zoo tiger rural ball demand senior asthma tunnel hero ritual domain"),
-            PathBuf::from("/tmp/sui/config/client.yaml")
-        )
-    )]
-    #[serial]
-    fn test_resolve_wallet_path(
-        cli_wallet_path: Option<PathBuf>,
-        mnemonic_env: Option<&str>,
-        expected: PathBuf,
-    ) {
-        let sui_default_config = "/tmp/sui/config";
-        // Set the default sui config folder to /tmp
-        std::env::set_var("SUI_CONFIG_DIR", sui_default_config);
-
-        // Set or remove the mnemonic environment variable as needed.
-        if let Some(mnemonic) = mnemonic_env {
-            std::env::set_var("SUI_SECRET_MNEMONIC", mnemonic);
-        } else {
-            std::env::remove_var("SUI_SECRET_MNEMONIC");
-        }
-
-        // Prepare the SuiConf instance.
-        let conf = SuiConf {
-            net: SuiNet::Localnet,
-            wallet_path: PathBuf::from(format!("{}/client.toml", &sui_default_config)),
-            rpc_url: None,
-        };
-
-        // Call the function under test.
-        let resolved = resolve_wallet_path(cli_wallet_path, &conf).unwrap();
-        assert_eq!(resolved, expected);
-
-        // Clean up the env variable.
-        std::env::remove_var("SUI_SECRET_MNEMONIC");
-        let _ = std::fs::remove_dir_all(sui_default_config);
-    }
-
-    #[rstest(
-        mnemonic,
-        expected_address_str,
-        case(
-            "include zoo tiger rural ball demand senior asthma tunnel hero ritual domain",
-            "0x479c168e5ac1319a78b09eb922a26472fbad9fc9ac904b17453eb71f4d7eb831"
-        ),
-        case(
-            "just place income emotion clutch column pledge same pool twist finish proof",
-            "0xe58c2145af0546e7be946b214e908d7e08e99e907950b428dcfe1dc9d8d8c449"
-        )
-    )]
-    #[serial]
-    fn test_active_address_set_by_mnemonic(mnemonic: &str, expected_address_str: &str) {
-        // Set up a clean temporary config directory.
-        let temp_dir = tempdir().unwrap();
-        let sui_default_config = temp_dir.path().to_str().unwrap();
-        // Set the default sui config folder to /tmp
-        std::env::set_var("SUI_CONFIG_DIR", sui_default_config);
-        let config_dir = sui::config_dir().expect("Failed to get config dir");
-        let wallet_conf_path = config_dir.join(sui::CLIENT_CONFIG);
-        let keystore_path = config_dir.join(sui::KEYSTORE_FILENAME);
-
-        // Clean up any existing files.
-        let _ = std::fs::remove_file(&wallet_conf_path);
-        let _ = std::fs::remove_file(&keystore_path);
-
-        // Call the function under test.
-        let _ = retrieve_wallet_with_mnemonic(SuiNet::Localnet, mnemonic)
-            .expect("retrieve_wallet_with_mnemonic failed");
-
-        let client_config: sui::ClientConfig =
-            sui::PersistedConfig::read(&wallet_conf_path).expect("Failed to read client config");
-        let expected_address: Address = expected_address_str.parse().expect("Invalid address");
-        assert_eq!(client_config.active_address.unwrap(), expected_address);
-
-        let _ = std::fs::remove_dir_all(&config_dir);
-    }
-
-    #[rstest(
-        preexisting_mnemonic,
-        new_mnemonic,
-        expected_active_address_str,
-        case(
-            "include zoo tiger rural ball demand senior asthma tunnel hero ritual domain",
-            "just place income emotion clutch column pledge same pool twist finish proof",
-            "0xe58c2145af0546e7be946b214e908d7e08e99e907950b428dcfe1dc9d8d8c449"
-        )
-    )]
-    #[serial]
-    fn test_active_address_with_preexisting_keystore(
-        preexisting_mnemonic: &str,
-        new_mnemonic: &str,
-        expected_active_address_str: &str,
-    ) {
-        // Create a temporary config directory.
-        let temp_dir = tempdir().unwrap();
-        let config_dir: PathBuf = temp_dir.path().to_path_buf();
-        std::env::set_var("SUI_CONFIG_DIR", config_dir.to_str().unwrap());
-
-        let wallet_conf_path = config_dir.join(sui::CLIENT_CONFIG);
-        let keystore_path = config_dir.join(sui::KEYSTORE_FILENAME);
-
-        // Create a preexisting keystore file with an active address derived from preexisting_mnemonic.
-        {
-            // FileBasedKeystore is assumed to be your real implementation.
-            let mut preexisting_keystore =
-                sui::FileBasedKeystore::new(&keystore_path).expect("Failed to create keystore");
-            preexisting_keystore
-                .import_from_mnemonic(
-                    preexisting_mnemonic,
-                    sui::SignatureScheme::ED25519,
-                    None,
-                    None,
-                )
-                .expect("Failed to import preexisting mnemonic");
-            preexisting_keystore
-                .save()
-                .expect("Failed to save keystore");
-        }
-
-        // Create a default client configuration if it doesn't exist.
-        if !wallet_conf_path.exists() {
-            let keystore =
-                sui::FileBasedKeystore::new(&keystore_path).expect("Failed to create keystore");
-            let client_config = sui::ClientConfig::new(keystore.into());
-            client_config
-                .save(&wallet_conf_path)
-                .expect("Failed to save client config");
-        }
-
-        // Call retrieve_wallet_with_mnemonic with the new mnemonic.
-        // This should import the new mnemonic into the preexisting keystore so that its derived
-        // address becomes the first (active) address.
-        let _ = retrieve_wallet_with_mnemonic(SuiNet::Localnet, new_mnemonic)
-            .expect("retrieve_wallet_with_mnemonic failed");
-
-        // Read the updated client configuration.
-        let updated_config: sui::ClientConfig =
-            sui::PersistedConfig::read(&wallet_conf_path).expect("Failed to read client config");
-
-        // Convert the expected address string into a SuiAddress.
-        let expected_active_address: Address = expected_active_address_str
-            .parse()
-            .expect("Invalid SuiAddress string");
-
-        // The active address in the config should match the one derived from the new mnemonic.
-        assert_eq!(
-            updated_config.active_address.unwrap(),
-            expected_active_address
-        );
-
-        // Clean up temporary files.
-        let _ = std::fs::remove_dir_all(&config_dir);
-    }
-
-    #[rstest]
-    #[tokio::test]
-    #[serial]
-    async fn test_create_wallet_context() {
-        // Set up a clean temporary config directory
-        let temp_dir = tempdir().unwrap();
-        let sui_config_dir = temp_dir.path().to_str().unwrap();
-        std::env::set_var("SUI_CONFIG_DIR", sui_config_dir);
-
-        std::env::set_var(
-            "SUI_SECRET_MNEMONIC",
-            "cost harsh bright regular skin trumpet pave about edit forget isolate monkey",
-        );
-
-        let conf = SuiConf {
-            net: SuiNet::Localnet,
-            wallet_path: PathBuf::from("/invalid"),
-            rpc_url: None,
-        };
-
-        let path = resolve_wallet_path(None, &conf).expect("Failed to resolve wallet path");
-
-        let wallet = create_wallet_context(&path, SuiNet::Localnet).await;
-
-        match wallet {
-            Ok(_) => {} // Test passes
-            Err(e) => panic!("Expected wallet creation to succeed, but got error: {}", e),
-        }
-
-        std::env::remove_var("SUI_SECRET_MNEMONIC");
-        std::env::remove_var("SUI_CONFIG_DIR");
-    }
-
-    #[rstest]
-    #[tokio::test]
-    #[serial]
-    async fn test_create_wallet_context_net_mismatch() {
-        // Set up a clean temporary config directory
-        let temp_dir = tempdir().unwrap();
-        let sui_config_dir = temp_dir.path().to_str().unwrap();
-        std::env::set_var("SUI_CONFIG_DIR", sui_config_dir);
-
-        std::env::set_var(
-            "SUI_SECRET_MNEMONIC",
-            "cost harsh bright regular skin trumpet pave about edit forget isolate monkey",
-        );
-
-        // Create wallet config for devnet
-        let conf = SuiConf {
-            net: SuiNet::Devnet,
-            wallet_path: PathBuf::from("/invalid"),
-            rpc_url: None,
-        };
-
-        let path = resolve_wallet_path(None, &conf).expect("Failed to resolve wallet path");
-
-        // Try to use the devnet wallet with localnet - this should fail
-        let err = create_wallet_context(&path, SuiNet::Localnet)
-            .await
-            .err()
-            .unwrap();
-
-        assert_matches!(err, NexusCliError::Any(e) if e.to_string().contains("The Sui net of the wallet does not match"));
-
-        std::env::remove_var("SUI_SECRET_MNEMONIC");
-        std::env::remove_var("SUI_CONFIG_DIR");
-    }
-
-    #[rstest]
-    #[tokio::test]
-    #[serial]
-    async fn test_create_wallet_context_rpc_url() {
-        // Set up a clean temporary config directory
-        let temp_dir = tempdir().unwrap();
-        let sui_config_dir = temp_dir.path().to_str().unwrap();
-        std::env::set_var("SUI_CONFIG_DIR", sui_config_dir);
-
-        std::env::set_var(
-            "SUI_SECRET_MNEMONIC",
-            "cost harsh bright regular skin trumpet pave about edit forget isolate monkey",
-        );
-        std::env::set_var("SUI_RPC_URL", "http://localhost:9000");
-
-        let conf = SuiConf {
-            net: SuiNet::Devnet,
-            wallet_path: PathBuf::from("/invalid"),
-            rpc_url: None,
-        };
-
-        let path = resolve_wallet_path(None, &conf).expect("Failed to resolve wallet path");
-
-        let wallet = create_wallet_context(&path, SuiNet::Devnet).await;
-
-        match wallet {
-            Ok(_) => {} // Test passes
-            Err(e) => panic!("Expected wallet creation to succeed, but got error: {}", e),
-        }
-
-        std::env::remove_var("SUI_SECRET_MNEMONIC");
-        std::env::remove_var("SUI_RPC_URL");
-        std::env::remove_var("SUI_CONFIG_DIR");
-    }
+    use {super::*, mockito::Server, rstest::rstest};
 
     #[rstest]
     #[tokio::test]
@@ -718,22 +316,22 @@ mod tests {
                 network_id = "0x4"
 
                 [tool_registry]
-                objectId = "0x5"
+                object_id = "0x5"
                 version = 1
                 digest = "3LFAfxPb6Q81U8wXg6qc6UyV9Hoj1VdfFfMwvGTEq5Bv"
 
                 [default_tap]
-                objectId = "0x6"
+                object_id = "0x6"
                 version = 1
                 digest = "3LFAfxPb6Q81U8wXg6qc6UyV9Hoj1VdfFfMwvGTEq5Bv"
 
                 [gas_service]
-                objectId = "0x7"
+                object_id = "0x7"
                 version = 1
                 digest = "3LFAfxPb6Q81U8wXg6qc6UyV9Hoj1VdfFfMwvGTEq5Bv"
 
                 [pre_key_vault]
-                objectId = "0x8"
+                object_id = "0x8"
                 version = 1
                 digest = "3LFAfxPb6Q81U8wXg6qc6UyV9Hoj1VdfFfMwvGTEq5Bv"
             "#
@@ -764,39 +362,113 @@ mod tests {
         assert_eq!(objects.workflow_pkg_id, "0x2".parse().unwrap());
         assert_eq!(objects.interface_pkg_id, "0x3".parse().unwrap());
         assert_eq!(objects.network_id, "0x4".parse().unwrap());
-        assert_eq!(objects.tool_registry.object_id, "0x5".parse().unwrap());
-        assert_eq!(objects.tool_registry.version, 1.into());
         assert_eq!(
-            objects.tool_registry.digest,
-            "3LFAfxPb6Q81U8wXg6qc6UyV9Hoj1VdfFfMwvGTEq5Bv"
-                .parse()
-                .unwrap()
+            *objects.tool_registry.object_id(),
+            sui::types::Address::from_static("0x5")
+        );
+        assert_eq!(objects.tool_registry.version(), 1);
+        assert_eq!(
+            *objects.tool_registry.digest(),
+            sui::types::Digest::from_static("3LFAfxPb6Q81U8wXg6qc6UyV9Hoj1VdfFfMwvGTEq5Bv")
+        );
+        assert_eq!(
+            *objects.default_tap.object_id(),
+            sui::types::Address::from_static("0x6")
+        );
+        assert_eq!(objects.default_tap.version(), 1);
+        assert_eq!(
+            *objects.default_tap.digest(),
+            sui::types::Digest::from_static("3LFAfxPb6Q81U8wXg6qc6UyV9Hoj1VdfFfMwvGTEq5Bv")
         );
-        assert_eq!(objects.default_tap.object_id, "0x6".parse().unwrap());
-        assert_eq!(objects.default_tap.version, 1.into());
         assert_eq!(
-            objects.default_tap.digest,
-            "3LFAfxPb6Q81U8wXg6qc6UyV9Hoj1VdfFfMwvGTEq5Bv"
-                .parse()
-                .unwrap()
+            *objects.gas_service.object_id(),
+            sui::types::Address::from_static("0x7")
         );
-        assert_eq!(objects.gas_service.object_id, "0x7".parse().unwrap());
-        assert_eq!(objects.gas_service.version, 1.into());
+        assert_eq!(objects.gas_service.version(), 1);
         assert_eq!(
-            objects.gas_service.digest,
-            "3LFAfxPb6Q81U8wXg6qc6UyV9Hoj1VdfFfMwvGTEq5Bv"
-                .parse()
-                .unwrap()
+            *objects.gas_service.digest(),
+            sui::types::Digest::from_static("3LFAfxPb6Q81U8wXg6qc6UyV9Hoj1VdfFfMwvGTEq5Bv")
         );
-        assert_eq!(objects.pre_key_vault.object_id, "0x8".parse().unwrap());
-        assert_eq!(objects.pre_key_vault.version, 1.into());
         assert_eq!(
-            objects.pre_key_vault.digest,
-            "3LFAfxPb6Q81U8wXg6qc6UyV9Hoj1VdfFfMwvGTEq5Bv"
-                .parse()
-                .unwrap()
+            *objects.pre_key_vault.object_id(),
+            sui::types::Address::from_static("0x8")
+        );
+        assert_eq!(objects.pre_key_vault.version(), 1);
+        assert_eq!(
+            *objects.pre_key_vault.digest(),
+            sui::types::Digest::from_static("3LFAfxPb6Q81U8wXg6qc6UyV9Hoj1VdfFfMwvGTEq5Bv")
         );
 
         mock.assert_async().await;
     }
+
+    mod parse_ed25519_private_key_tests {
+        use super::*;
+
+        // Test key generated with: sui keytool generate ed25519
+        // mnemonic: "nut garden prefer climb giggle armed snap sibling layer extra obvious fade"
+        const TEST_KEY_BASE64_WITH_FLAG: &str = "ADvFIUMRieVEkqG05MLT8h8QVd1xZuS6xF9KA2EumjLd";
+        const TEST_KEY_BASE64_WITHOUT_FLAG: &str = "O8UhQxGJ5USSobTkwtPyHxBV3XFm5LrEX0oDYS6aMt0=";
+        const TEST_KEY_ADDRESS: &str =
+            "0x79d85606d67f3d046098d93d51b5de4c4606743267713fa0338846ec1729dce1";
+
+        #[test]
+        fn test_33_bytes_sui_format_with_ed25519_flag() {
+            // Sui format: 0x00 (ed25519 flag) + 32 byte key
+            let result = parse_ed25519_private_key(TEST_KEY_BASE64_WITH_FLAG);
+            assert!(result.is_ok(), "Expected Ok, got: {result:?}");
+
+            let pk = result.unwrap();
+            assert_eq!(
+                pk.public_key().derive_address().to_string(),
+                TEST_KEY_ADDRESS
+            );
+        }
+
+        #[test]
+        fn test_32_bytes_raw_ed25519_key() {
+            // Raw 32-byte key without flag (leader format)
+            let result = parse_ed25519_private_key(TEST_KEY_BASE64_WITHOUT_FLAG);
+            assert!(result.is_ok(), "Expected Ok, got: {result:?}");
+
+            let pk = result.unwrap();
+            // Same address as above - same key, just different encoding
+            assert_eq!(
+                pk.public_key().derive_address().to_string(),
+                TEST_KEY_ADDRESS
+            );
+        }
+
+        #[test]
+        fn test_33_bytes_with_unsupported_flag_fails() {
+            // 0x01 is secp256k1 flag - not supported
+            let mut bytes = vec![0x01]; // secp256k1 flag
+            bytes.extend_from_slice(&[0u8; 32]); // dummy key
+            let input = BASE64_STANDARD.encode(&bytes);
+
+            let result = parse_ed25519_private_key(&input);
+            assert!(result.is_err());
+            assert!(
+                result
+                    .unwrap_err()
+                    .contains("unsupported key scheme flag 0x01"),
+                "Expected unsupported flag error"
+            );
+        }
+
+        #[test]
+        fn test_invalid_length_fails() {
+            // 31 bytes - neither 32 nor 33
+            let bytes = [0u8; 31];
+            let input = BASE64_STANDARD.encode(bytes);
+
+            let result = parse_ed25519_private_key(&input);
+            assert!(result.is_err());
+            let err = result.unwrap_err();
+            assert!(
+                err.contains("invalid private key length 31"),
+                "Expected length error, got: {err}"
+            );
+        }
+    }
 }
diff --git a/cli/src/tool/mod.rs b/cli/src/tool/mod.rs
index 53bbffe2..54c8e673 100644
--- a/cli/src/tool/mod.rs
+++ b/cli/src/tool/mod.rs
@@ -1,7 +1,8 @@
 mod tool_claim_collateral;
 mod tool_list;
 mod tool_new;
-mod tool_register;
+mod tool_register_offchain;
+mod tool_register_onchain;
 mod tool_set_invocation_cost;
 mod tool_unregister;
 mod tool_validate;
@@ -11,12 +12,132 @@ use {
     tool_claim_collateral::*,
     tool_list::*,
     tool_new::*,
-    tool_register::*,
+    tool_register_offchain::register_off_chain_tool,
+    tool_register_onchain::register_onchain_tool,
     tool_set_invocation_cost::*,
     tool_unregister::*,
-    tool_validate::*,
+    tool_validate::{validate_off_chain_tool, validate_on_chain_tool},
 };
 
+#[derive(Subcommand)]
+pub(crate) enum RegisterCommand {
+    #[command(about = "Register an offchain tool")]
+    Offchain {
+        #[arg(long = "url", short = 'u', help = "The URL of the offchain tool")]
+        url: reqwest::Url,
+
+        #[arg(
+            long = "collateral-coin",
+            short = 'c',
+            help = "The collateral coin object ID. Second coin object is chosen if not present.",
+            value_name = "OBJECT_ID"
+        )]
+        collateral_coin: Option<sui::types::Address>,
+
+        #[arg(
+            long = "invocation-cost",
+            short = 'i',
+            help = "What is the cost of invoking this tool in MIST.",
+            default_value = "0",
+            value_name = "MIST"
+        )]
+        invocation_cost: u64,
+
+        #[arg(
+            long = "batch",
+            help = "Should all tools on a webserver be registered at once?"
+        )]
+        batch: bool,
+
+        #[arg(
+            long = "no-save",
+            help = "If this flag is set, the tool owner caps will not be saved to the local config file."
+        )]
+        no_save: bool,
+
+        #[command(flatten)]
+        gas: GasArgs,
+    },
+
+    #[command(about = "Register an onchain tool")]
+    Onchain {
+        #[arg(
+            long = "package",
+            short = 'p',
+            help = "The onchain tool package address",
+            value_name = "ADDRESS"
+        )]
+        package: sui::types::Address,
+
+        #[arg(long = "module", short = 'm', help = "The onchain tool module name")]
+        module: sui::types::Identifier,
+
+        #[arg(
+            long = "tool-fqn",
+            short = 't',
+            help = "The fully qualified name (FQN) for this tool.",
+            value_name = "FQN"
+        )]
+        tool_fqn: ToolFqn,
+
+        #[arg(
+            long = "description",
+            short = 'd',
+            help = "Description of what the tool does.",
+            value_name = "DESCRIPTION"
+        )]
+        description: String,
+
+        #[arg(
+            long = "witness-id",
+            short = 'w',
+            help = "The witness object ID that proves the tool's identity.",
+            value_name = "OBJECT_ID"
+        )]
+        witness_id: sui::types::Address,
+
+        #[arg(
+            long = "collateral-coin",
+            short = 'c',
+            help = "The collateral coin object ID. Second coin object is chosen if not present.",
+            value_name = "OBJECT_ID"
+        )]
+        collateral_coin: Option<sui::types::Address>,
+
+        #[arg(
+            long = "no-save",
+            help = "If this flag is set, the tool owner caps will not be saved to the local config file."
+        )]
+        no_save: bool,
+
+        #[command(flatten)]
+        gas: GasArgs,
+    },
+}
+
+#[derive(Subcommand)]
+pub(crate) enum ValidateCommand {
+    #[command(about = "Validate an offchain tool")]
+    Offchain {
+        #[arg(
+            long = "url",
+            short = 'u',
+            help = "The URL of the offchain tool to validate"
+        )]
+        url: reqwest::Url,
+    },
+
+    #[command(about = "Validate an onchain tool")]
+    Onchain {
+        #[arg(
+            long = "ident",
+            short = 'i',
+            help = "The identifier of the onchain tool to validate"
+        )]
+        ident: String,
+    },
+}
+
 #[derive(Subcommand)]
 pub(crate) enum ToolCommand {
     #[command(about = "Create a new tool scaffolding with the specified name and template.")]
@@ -45,47 +166,16 @@ pub(crate) enum ToolCommand {
         target: PathBuf,
     },
 
-    #[command(about = "Validate a tool based on its identifier.")]
+    #[command(about = "Validate a tool based on its type.")]
     Validate {
-        /// The ident of the Tool to validate.
-        #[command(flatten)]
-        ident: ToolIdent,
+        #[command(subcommand)]
+        tool_type: ValidateCommand,
     },
 
-    #[command(about = "Register a tool based on its identifier.")]
+    #[command(about = "Register a tool based on its type.")]
     Register {
-        /// The collateral coin object ID. Second coin object is chosen if not
-        /// present.
-        #[arg(
-            long = "collateral-coin",
-            short = 'c',
-            help = "The collateral coin object ID. Second coin object is chosen if not present.",
-            value_name = "OBJECT_ID"
-        )]
-        collateral_coin: Option<sui::ObjectID>,
-        #[arg(
-            long = "invocation-cost",
-            short = 'i',
-            help = "What is the cost of invoking this tool in MIST.",
-            default_value = "0",
-            value_name = "MIST"
-        )]
-        invocation_cost: u64,
-        #[arg(
-            long = "batch",
-            help = "Should all tools on a webserver be registered at once?"
-        )]
-        batch: bool,
-        #[arg(
-            long = "no-save",
-            help = "If this flag is set, the tool owner caps will not be saved to the local config file."
-        )]
-        no_save: bool,
-        /// The ident of the Tool to register.
-        #[command(flatten)]
-        ident: ToolIdent,
-        #[command(flatten)]
-        gas: GasArgs,
+        #[command(subcommand)]
+        tool_type: RegisterCommand,
     },
 
     #[command(about = "Unregister a tool identified by its FQN.")]
@@ -103,7 +193,7 @@ pub(crate) enum ToolCommand {
             help = "The OwnerCap<OverTool> object ID that must be owned by the sender.",
             value_name = "OBJECT_ID"
         )]
-        owner_cap: Option<sui::ObjectID>,
+        owner_cap: Option<sui::types::Address>,
         /// Whether to skip the confirmation prompt.
         #[arg(long = "yes", short = 'y', help = "Skip the confirmation prompt")]
         skip_confirmation: bool,
@@ -126,7 +216,7 @@ pub(crate) enum ToolCommand {
             help = "The OwnerCap<OverTool> object ID that must be owned by the sender.",
             value_name = "OBJECT_ID"
         )]
-        owner_cap: Option<sui::ObjectID>,
+        owner_cap: Option<sui::types::Address>,
         #[command(flatten)]
         gas: GasArgs,
     },
@@ -146,7 +236,7 @@ pub(crate) enum ToolCommand {
             help = "The OwnerCap<OverGas> object ID that must be owned by the sender.",
             value_name = "OBJECT_ID"
         )]
-        owner_cap: Option<sui::ObjectID>,
+        owner_cap: Option<sui::types::Address>,
         #[arg(
             long = "invocation-cost",
             short = 'i',
@@ -165,28 +255,6 @@ pub(crate) enum ToolCommand {
     },
 }
 
-/// Struct holding an either on-chain or off-chain Tool identifier. Off-chain
-/// tools are identified by their URL, while on-chain tools are identified by
-/// a Move ident.
-#[derive(Args, Clone, Debug)]
-#[group(required = true, multiple = false)]
-pub(crate) struct ToolIdent {
-    #[arg(
-        long = "off-chain",
-        short = 'f',
-        help = "The URL of the off-chain Tool to validate",
-        value_name = "URL"
-    )]
-    pub(crate) off_chain: Option<reqwest::Url>,
-    #[arg(
-        long = "on-chain",
-        short = 'n',
-        help = "The ident of on-chain Tool to validate",
-        value_name = "IDENT"
-    )]
-    pub(crate) on_chain: Option<String>,
-}
-
 /// Handle the provided tool command. The [ToolCommand] instance is passed from
 /// [crate::main].
 pub(crate) async fn handle(command: ToolCommand) -> AnyResult<(), NexusCliError> {
@@ -199,28 +267,56 @@ pub(crate) async fn handle(command: ToolCommand) -> AnyResult<(), NexusCliError>
         } => create_new_tool(name, template, target).await,
 
         // == `$ nexus tool validate` ==
-        ToolCommand::Validate { ident } => validate_tool(ident).await.map(|_| ()),
+        ToolCommand::Validate { tool_type } => match tool_type {
+            ValidateCommand::Offchain { url } => validate_off_chain_tool(url).await.map(|_| ()),
+            ValidateCommand::Onchain { ident } => validate_on_chain_tool(ident).await.map(|_| ()),
+        },
 
         // == `$ nexus tool register` ==
-        ToolCommand::Register {
-            ident,
-            collateral_coin,
-            invocation_cost,
-            batch,
-            no_save,
-            gas,
-        } => {
-            register_tool(
-                ident,
+        ToolCommand::Register { tool_type } => match tool_type {
+            RegisterCommand::Offchain {
+                url,
                 collateral_coin,
                 invocation_cost,
                 batch,
                 no_save,
-                gas.sui_gas_coin,
-                gas.sui_gas_budget,
-            )
-            .await
-        }
+                gas,
+            } => {
+                register_off_chain_tool(
+                    url,
+                    collateral_coin,
+                    invocation_cost,
+                    batch,
+                    no_save,
+                    gas.sui_gas_coin,
+                    gas.sui_gas_budget,
+                )
+                .await
+            }
+            RegisterCommand::Onchain {
+                package,
+                module,
+                tool_fqn,
+                description,
+                witness_id,
+                collateral_coin,
+                no_save,
+                gas,
+            } => {
+                register_onchain_tool(
+                    package,
+                    module,
+                    tool_fqn,
+                    description,
+                    witness_id,
+                    collateral_coin,
+                    no_save,
+                    gas.sui_gas_coin,
+                    gas.sui_gas_budget,
+                )
+                .await
+            }
+        },
 
         // == `$ nexus tool unregister` ==
         ToolCommand::Unregister {
diff --git a/cli/src/tool/templates/move/.gitignore.jinja b/cli/src/tool/templates/move/.gitignore.jinja
new file mode 100644
index 00000000..da639131
--- /dev/null
+++ b/cli/src/tool/templates/move/.gitignore.jinja
@@ -0,0 +1,2 @@
+build/*
+
diff --git a/cli/src/tool/templates/move/Move.toml.jinja b/cli/src/tool/templates/move/Move.toml.jinja
new file mode 100644
index 00000000..33820b4d
--- /dev/null
+++ b/cli/src/tool/templates/move/Move.toml.jinja
@@ -0,0 +1,16 @@
+[package]
+name = "{{ name_snake_case }}"
+edition = "2024.beta"
+
+[dependencies]
+nexus_primitives = { local = "../../primitives"}
+nexus_workflow = { local = "../../workflow"}
+nexus_interface = { local = "../../interface"}
+
+
+[addresses]
+{{ name_snake_case }} = "0x0" 
+nexus_primitives = "0x1"
+nexus_workflow = "0x2"
+nexus_interface = "0x3"
+
diff --git a/cli/src/tool/templates/move/tests.move.jinja b/cli/src/tool/templates/move/tests.move.jinja
new file mode 100644
index 00000000..7192c4a5
--- /dev/null
+++ b/cli/src/tool/templates/move/tests.move.jinja
@@ -0,0 +1,19 @@
+/*
+#[test_only]
+module {{ name_snake_case }}::{{ name_snake_case }}_tests;
+// uncomment this line to import the module
+// use {{ name_snake_case }}::{{ name_snake_case }};
+
+const ENotImplemented: u64 = 0;
+
+#[test]
+fun test_{{ name_snake_case }}() {
+    // pass
+}
+
+#[test, expected_failure(abort_code = ::{{ name_snake_case }}::{{ name_snake_case }}_tests::ENotImplemented)]
+fun test_{{ name_snake_case }}_fail() {
+    abort ENotImplemented
+}
+*/
+
diff --git a/cli/src/tool/templates/move/tool.move.jinja b/cli/src/tool/templates/move/tool.move.jinja
new file mode 100644
index 00000000..a7bf7f61
--- /dev/null
+++ b/cli/src/tool/templates/move/tool.move.jinja
@@ -0,0 +1,121 @@
+module {{ name_snake_case }}::{{ name_snake_case }};
+
+use nexus_primitives::proof_of_uid::ProofOfUID;
+use nexus_workflow::tool_output::{Self, ToolOutput};
+use sui::bag::{Self, Bag};
+use sui::transfer::share_object;
+use std::ascii::String as AsciiString;
+use sui::clock::Clock;
+
+/// One-time witness for package initialization.
+public struct {{ name_uppercase }} has drop {}
+
+/// Witness object used to identify this tool.
+public struct {{ name_pascal_case }}Witness has key, store {
+    id: UID,
+}
+
+/// Your tool's state object (customize as needed).
+public struct {{ name_pascal_case }}State has key {
+    id: UID,
+    /// Store the witness object that identifies this tool.
+    witness: Bag,
+    // Add your application-specific fields here.
+    // Example: value: u64,
+    // ..
+}
+
+/// Tool execution output variants.
+/// This enum is used for automatic schema generation during registration.
+/// It's not used during execution. Only the ToolOutput object is used.
+public enum Output {
+    Ok {
+        result: u64,
+        // Add custom fields here as needed.
+    },
+    Err {
+        reason: AsciiString,
+    },
+    // Add custom variants as needed.
+    CustomResult {
+        data: vector<u8>,
+        timestamp: u64,
+    },
+}
+
+/// Initialize your tool's state.
+fun init(_otw: {{ name_uppercase }}, ctx: &mut TxContext) {
+    let state = {{ name_pascal_case }}State {
+        id: object::new(ctx),
+        witness: {
+            let mut bag = bag::new(ctx);
+            bag.add(b"witness", {{ name_pascal_case }}Witness { id: object::new(ctx) });
+            bag
+        },
+        // Initialize your fields.
+        // value: 0,
+    };
+    share_object(state);
+}
+
+/// Execute function with standardized Nexus signature.
+///
+/// CRITICAL REQUIREMENTS:
+/// 1. First parameter: worksheet: &mut ProofOfUID
+/// 2. Last parameter: ctx: &mut TxContext
+/// 3. Return type: ToolOutput
+/// 4. Must stamp worksheet with witness ID
+public fun execute(
+    worksheet: &mut ProofOfUID,
+    state: &mut {{ name_pascal_case }}State,
+    // Add your custom parameters here.
+    input_value: u64,
+    clock: &Clock,
+    ctx: &mut TxContext,
+): ToolOutput {
+    // Get the witness for stamping.
+    let witness = state.witness();
+
+    // REQUIRED: Stamp the worksheet to prove execution.
+    worksheet.stamp_with_data(&witness.id, b"{{ name_snake_case }}_executed");
+
+    // Implement your tool logic here.
+    if (input_value == 0) {
+        // Return error variant.
+        tool_output::err(b"Input value cannot be zero")
+    } else if (input_value > 1000) {
+        // Return custom variant.
+        tool_output::variant(b"custom_result")
+            .with_field(b"data", tool_output::string_value(b"large_value_processed"))
+            .with_field(b"timestamp", tool_output::string_value(sui::clock::timestamp_ms(clock).to_string().into_bytes()))
+    } else {
+        // Return success variant.
+        let result = input_value * 2;
+        tool_output::ok()
+            .with_field(b"result", tool_output::number_value(result.to_string().into_bytes()))
+    }
+}
+
+// === Getters and Helper Functions ===
+
+/// Helper function to get the witness object.
+fun witness(self: &{{ name_pascal_case }}State): &{{ name_pascal_case }}Witness {
+    self.witness.borrow(b"witness")
+}
+
+/// Get the witness ID for external reference.
+/// Useful for registering the tool onchain.
+public fun witness_id(self: &{{ name_pascal_case }}State): ID {
+    self.witness().id.to_inner()
+}
+
+// Add getters for your custom fields.
+// public fun value(self: &{{ name_pascal_case }}State): u64 {
+//     self.value
+// }
+
+#[test_only]
+public fun init_for_test(otw: {{ name_uppercase }}, ctx: &mut TxContext) {
+    init(otw, ctx);
+}
+
diff --git a/cli/src/tool/templates/rust/Cargo.toml.jinja b/cli/src/tool/templates/rust/Cargo.toml.jinja
index cedd8c7c..c77bc5cf 100644
--- a/cli/src/tool/templates/rust/Cargo.toml.jinja
+++ b/cli/src/tool/templates/rust/Cargo.toml.jinja
@@ -10,10 +10,10 @@ tokio = { version = "1", features = ["full"] }
 
 [dependencies.nexus-sdk]
 git = "https://github.com/Talus-Network/nexus-sdk.git"
-tag = "v0.3.0"
+tag = "v0.5.0"
 package = "nexus-sdk"
 
 [dependencies.nexus-toolkit]
 git = "https://github.com/Talus-Network/nexus-sdk.git"
-tag = "v0.3.0"
+tag = "v0.5.0"
 package = "nexus-toolkit"
diff --git a/cli/src/tool/tool_claim_collateral.rs b/cli/src/tool/tool_claim_collateral.rs
index 4af10d11..a2520ace 100644
--- a/cli/src/tool/tool_claim_collateral.rs
+++ b/cli/src/tool/tool_claim_collateral.rs
@@ -1,33 +1,25 @@
 use {
-    crate::{command_title, display::json_output, loading, prelude::*, sui::*},
+    crate::{command_title, display::json_output, loading, notify_success, prelude::*, sui::*},
     nexus_sdk::transactions::tool,
 };
 
 /// Claim collateral for a Tool based on the provided FQN.
 pub(crate) async fn claim_collateral(
     tool_fqn: ToolFqn,
-    owner_cap: Option<sui::ObjectID>,
-    sui_gas_coin: Option<sui::ObjectID>,
+    owner_cap: Option<sui::types::Address>,
+    sui_gas_coin: Option<sui::types::Address>,
     sui_gas_budget: u64,
 ) -> AnyResult<(), NexusCliError> {
     command_title!("Claiming collateral for Tool '{tool_fqn}'");
 
-    // Load CLI configuration.
-    let mut conf = CliConf::load().await.unwrap_or_default();
+    let nexus_client = get_nexus_client(sui_gas_coin, sui_gas_budget).await?;
+    let signer = nexus_client.signer();
+    let gas_config = nexus_client.gas_config();
+    let address = signer.get_active_address();
+    let nexus_objects = &*nexus_client.get_nexus_objects();
+    let crawler = nexus_client.crawler();
 
-    // Nexus objects must be present in the configuration.
-    let objects = &get_nexus_objects(&mut conf).await?;
-
-    // Create wallet context, Sui client and find the active address.
-    let mut wallet = create_wallet_context(&conf.sui.wallet_path, conf.sui.net).await?;
-    let sui = build_sui_client(&conf.sui).await?;
-    let address = wallet.active_address().map_err(NexusCliError::Any)?;
-
-    // Fetch gas coin object.
-    let gas_coin = fetch_gas_coin(&sui, address, sui_gas_coin).await?;
-
-    // Fetch reference gas price.
-    let reference_gas_price = fetch_reference_gas_price(&sui).await?;
+    let conf = CliConf::load().await.unwrap_or_default();
 
     // Use the provided or saved `owner_cap` object ID and fetch the object.
     let Some(owner_cap) = owner_cap.or(conf.tools.get(&tool_fqn).map(|t| t.over_tool)) else {
@@ -36,14 +28,22 @@ pub(crate) async fn claim_collateral(
         )));
     };
 
-    let owner_cap = fetch_object_by_id(&sui, owner_cap).await?;
-
-    // Craft a TX to claim the collaters for a Tool.
+    let owner_cap = crawler
+        .get_object_metadata(owner_cap)
+        .await
+        .map(|resp| resp.object_ref())
+        .map_err(|e| {
+            NexusCliError::Any(anyhow!(
+                "Failed to fetch OwnerCap object metadata for '{owner_cap}': {e}"
+            ))
+        })?;
+
+    // Craft a TX to claim the collateral for a Tool.
     let tx_handle = loading!("Crafting transaction...");
 
-    let mut tx = sui::ProgrammableTransactionBuilder::new();
+    let mut tx = sui::tx::TransactionBuilder::new();
 
-    if let Err(e) = tool::claim_collateral_for_self(&mut tx, objects, &tool_fqn, &owner_cap) {
+    if let Err(e) = tool::claim_collateral_for_self(&mut tx, nexus_objects, &tool_fqn, &owner_cap) {
         tx_handle.error();
 
         return Err(NexusCliError::Any(e));
@@ -51,16 +51,33 @@ pub(crate) async fn claim_collateral(
 
     tx_handle.success();
 
-    let tx_data = sui::TransactionData::new_programmable(
-        address,
-        vec![gas_coin.object_ref()],
-        tx.finish(),
-        sui_gas_budget,
-        reference_gas_price,
-    );
+    let mut gas_coin = gas_config.acquire_gas_coin().await;
+
+    tx.set_sender(address);
+    tx.set_gas_budget(gas_config.get_budget());
+    tx.set_gas_price(nexus_client.get_reference_gas_price());
 
-    // Sign and submit the TX.
-    let response = sign_and_execute_transaction(&sui, &wallet, tx_data).await?;
+    tx.add_gas_objects(vec![sui::tx::Input::owned(
+        *gas_coin.object_id(),
+        gas_coin.version(),
+        *gas_coin.digest(),
+    )]);
+
+    let tx = tx.finish().map_err(|e| NexusCliError::Any(e.into()))?;
+
+    let signature = signer.sign_tx(&tx).await.map_err(NexusCliError::Nexus)?;
+
+    let response = signer
+        .execute_tx(tx, signature, &mut gas_coin)
+        .await
+        .map_err(NexusCliError::Nexus)?;
+
+    gas_config.release_gas_coin(gas_coin).await;
+
+    notify_success!(
+        "Transaction digest: {digest}",
+        digest = response.digest.to_string().truecolor(100, 100, 100)
+    );
 
     json_output(&json!({ "digest": response.digest }))?;
 
diff --git a/cli/src/tool/tool_list.rs b/cli/src/tool/tool_list.rs
index a5639eb4..16cd7e75 100644
--- a/cli/src/tool/tool_list.rs
+++ b/cli/src/tool/tool_list.rs
@@ -1,41 +1,42 @@
 use {
     crate::{command_title, display::json_output, item, loading, prelude::*, sui::*},
     nexus_sdk::{
-        object_crawler::{fetch_one, ObjectBag, Structure},
+        nexus::crawler::DynamicObjectMap,
         types::{
-            deserialize_bytes_to_lossy_utf8,
+            deserialize_bytes_to_string,
             deserialize_bytes_to_url,
             deserialize_string_to_datetime,
         },
+        ToolRef,
     },
 };
 
 /// List tools available in the tool registry.
 pub(crate) async fn list_tools() -> AnyResult<(), NexusCliError> {
-    command_title!("Listing all available Neuxs tools");
+    command_title!("Listing all available Nexus tools");
 
-    // Load CLI configuration.
-    let mut conf = CliConf::load().await.unwrap_or_default();
-
-    // Nexus objects must be present in the configuration.
-    let NexusObjects { tool_registry, .. } = &get_nexus_objects(&mut conf).await?;
-
-    // Build the Sui client.
-    let sui = build_sui_client(&conf.sui).await?;
+    let nexus_client = get_nexus_client(None, DEFAULT_GAS_BUDGET).await?;
+    let nexus_objects = &*nexus_client.get_nexus_objects();
+    let crawler = nexus_client.crawler();
 
     let tools_handle = loading!("Fetching tools from the tool registry...");
 
-    let tool_registry =
-        match fetch_one::<Structure<ToolRegistry>>(&sui, tool_registry.object_id).await {
-            Ok(tool_registry) => tool_registry.data.into_inner(),
-            Err(e) => {
-                tools_handle.error();
+    let tool_registry = match crawler
+        .get_object::<ToolRegistry>(*nexus_objects.tool_registry.object_id())
+        .await
+    {
+        Ok(tool_registry) => tool_registry.data,
+        Err(e) => {
+            tools_handle.error();
 
-                return Err(NexusCliError::Any(e));
-            }
-        };
+            return Err(NexusCliError::Any(e));
+        }
+    };
 
-    let tools = match tool_registry.tools.fetch_all(&sui).await {
+    let tools = match crawler
+        .get_dynamic_field_objects(&tool_registry.tools)
+        .await
+    {
         Ok(tools) => tools,
         Err(e) => {
             tools_handle.error();
@@ -49,22 +50,65 @@ pub(crate) async fn list_tools() -> AnyResult<(), NexusCliError> {
     let mut tools_json = Vec::new();
 
     for (fqn, tool) in tools {
-        let tool = tool.into_inner();
+        let tool = tool.data;
+
+        let (reference, description, registered_at_ms, input_schema, output_schema) = match &tool {
+            ToolVariant::OffChain(t) => (
+                ToolRef::from(t.url.clone()),
+                t.description.clone(),
+                t.registered_at_ms,
+                t.input_schema.clone(),
+                t.output_schema.clone(),
+            ),
+            ToolVariant::OnChain(t) => (
+                ToolRef::new_sui(&t.package_address, &t.module_name, &t.witness_id).map_err(
+                    |_| {
+                        NexusCliError::Any(anyhow!(
+                            "Invalid package address, module name, or witness ID in onchain tool"
+                        ))
+                    },
+                )?,
+                t.description.clone(),
+                t.registered_at_ms,
+                t.input_schema.clone(),
+                t.output_schema.clone(),
+            ),
+        };
 
-        tools_json.push(json!(
-        {
+        let tool_type = if reference.is_onchain() {
+            "OnChain"
+        } else {
+            "OffChain"
+        };
+
+        // Build JSON output with common fields plus type-specific ones.
+        let mut tool_json = json!({
             "fqn": fqn,
-            "url": tool.url,
-            "registered_at_ms": tool.registered_at_ms,
-            "description": tool.description
-        }));
+            "reference": reference.to_string(),
+            "type": tool_type,
+            "registered_at_ms": registered_at_ms,
+            "description": description,
+        });
+
+        // A bit redundant, but for sake of clarity.
+        if reference.is_onchain() {
+            tool_json["package_address"] = json!(reference.package_address().unwrap().to_string());
+            tool_json["module_name"] = json!(reference.module_name().unwrap().to_string());
+            tool_json["witness_id"] = json!(reference.witness_id().unwrap().to_string());
+        }
+
+        tool_json["input_schema"] = json!(input_schema);
+        tool_json["output_schema"] = json!(output_schema);
+
+        tools_json.push(tool_json);
 
         item!(
-            "Tool '{fqn}' at '{url}' registered '{registered_at}' - {description}",
+            "{tool_type} Tool '{fqn}' at '{reference}' registered '{registered_at}' - {description}",
+            tool_type = tool_type.truecolor(100, 100, 100),
             fqn = fqn.to_string().truecolor(100, 100, 100),
-            url = tool.url.as_str().truecolor(100, 100, 100),
-            registered_at = tool.registered_at_ms.to_string().truecolor(100, 100, 100),
-            description = tool.description.truecolor(100, 100, 100),
+            reference = reference.to_string().truecolor(100, 100, 100),
+            registered_at = registered_at_ms.to_string().truecolor(100, 100, 100),
+            description = description.truecolor(100, 100, 100),
         );
     }
 
@@ -75,15 +119,41 @@ pub(crate) async fn list_tools() -> AnyResult<(), NexusCliError> {
 
 #[derive(Debug, Clone, Deserialize)]
 struct ToolRegistry {
-    tools: ObjectBag<ToolFqn, Structure<Tool>>,
+    tools: DynamicObjectMap<ToolFqn, ToolVariant>,
+}
+
+#[derive(Debug, Clone, Deserialize)]
+#[serde(untagged)]
+enum ToolVariant {
+    OffChain(OffChainTool),
+    OnChain(OnChainTool),
 }
 
 #[derive(Debug, Clone, Deserialize)]
-struct Tool {
+struct OffChainTool {
     #[serde(deserialize_with = "deserialize_bytes_to_url")]
     url: reqwest::Url,
-    #[serde(deserialize_with = "deserialize_bytes_to_lossy_utf8")]
+    #[serde(deserialize_with = "deserialize_bytes_to_string")]
+    description: String,
+    #[serde(deserialize_with = "deserialize_bytes_to_string")]
+    input_schema: String,
+    #[serde(deserialize_with = "deserialize_bytes_to_string")]
+    output_schema: String,
+    #[serde(deserialize_with = "deserialize_string_to_datetime")]
+    registered_at_ms: chrono::DateTime<chrono::Utc>,
+}
+
+#[derive(Debug, Clone, Deserialize)]
+struct OnChainTool {
+    package_address: String,
+    module_name: String,
+    witness_id: String,
+    #[serde(deserialize_with = "deserialize_bytes_to_string")]
     description: String,
+    #[serde(deserialize_with = "deserialize_bytes_to_string")]
+    input_schema: String,
+    #[serde(deserialize_with = "deserialize_bytes_to_string")]
+    output_schema: String,
     #[serde(deserialize_with = "deserialize_string_to_datetime")]
     registered_at_ms: chrono::DateTime<chrono::Utc>,
 }
diff --git a/cli/src/tool/tool_new.rs b/cli/src/tool/tool_new.rs
index 57d9c53c..b5264bdb 100644
--- a/cli/src/tool/tool_new.rs
+++ b/cli/src/tool/tool_new.rs
@@ -12,6 +12,7 @@ use {
 #[derive(Clone, Debug, ValueEnum)]
 pub(crate) enum ToolTemplate {
     Rust,
+    Move,
 }
 
 impl ToolTemplate {
@@ -46,6 +47,49 @@ impl ToolTemplate {
                     ),
                 ])
             }
+            ToolTemplate::Move => {
+                let name_snake_case = name.to_case(Case::Snake);
+                let name_pascal_case = name.to_case(Case::Pascal);
+                let name_uppercase = name.to_case(Case::UpperSnake);
+
+                let mut env = Environment::new();
+
+                env.add_template("move_toml", include_str!("templates/move/Move.toml.jinja"))?;
+                env.add_template("tool_move", include_str!("templates/move/tool.move.jinja"))?;
+                env.add_template(
+                    "tests_move",
+                    include_str!("templates/move/tests.move.jinja"),
+                )?;
+                env.add_template("gitignore", include_str!("templates/move/.gitignore.jinja"))?;
+
+                let move_toml_template = env.get_template("move_toml")?;
+                let tool_move_template = env.get_template("tool_move")?;
+                let tests_move_template = env.get_template("tests_move")?;
+                let gitignore_template = env.get_template("gitignore")?;
+
+                Ok(vec![
+                    ("sources".to_string(), None),
+                    ("tests".to_string(), None),
+                    (
+                        "Move.toml".to_string(),
+                        Some(move_toml_template.render(context! { name_snake_case })?),
+                    ),
+                    (
+                        format!("sources/{name_snake_case}.move"),
+                        Some(tool_move_template.render(
+                            context! { name_snake_case, name_pascal_case, name_uppercase },
+                        )?),
+                    ),
+                    (
+                        format!("tests/{name_snake_case}_tests.move"),
+                        Some(tests_move_template.render(context! { name_snake_case })?),
+                    ),
+                    (
+                        ".gitignore".to_string(),
+                        Some(gitignore_template.render(context! {})?),
+                    ),
+                ])
+            }
         }
     }
 }
@@ -134,7 +178,7 @@ mod tests {
 
     #[tokio::test]
     async fn test_create_new_tool() {
-        let tempdir = tempfile::tempdir().unwrap().into_path();
+        let tempdir = tempfile::tempdir().unwrap().keep();
 
         let result = create_new_tool("test".to_string(), ToolTemplate::Rust, tempdir.clone()).await;
 
@@ -158,4 +202,62 @@ mod tests {
         assert!(contents.contains(r#"name = "test""#));
         assert!(contents.contains("[dependencies.nexus-toolkit]"));
     }
+
+    #[tokio::test]
+    async fn test_create_new_move_tool() {
+        let tempdir = tempfile::tempdir().unwrap().keep();
+
+        let result =
+            create_new_tool("test_tool".to_string(), ToolTemplate::Move, tempdir.clone()).await;
+
+        assert_matches!(result, Ok(()));
+
+        // Check that directories were created.
+        let sources_dir = tempdir.join("test_tool/sources");
+        assert!(sources_dir.exists());
+
+        let tests_dir = tempdir.join("test_tool/tests");
+        assert!(tests_dir.exists());
+
+        // Check that Move.toml was written with correct contents.
+        let move_toml_path = tempdir.join("test_tool/Move.toml");
+        let move_toml_contents = tokio::fs::read_to_string(move_toml_path).await.unwrap();
+
+        assert!(move_toml_contents.contains(r#"name = "test_tool""#));
+        assert!(move_toml_contents.contains("edition = \"2024.beta\""));
+        assert!(move_toml_contents.contains("nexus_primitives"));
+        assert!(move_toml_contents.contains("nexus_workflow"));
+        assert!(move_toml_contents.contains("nexus_interface"));
+
+        // Check that the main Move file was written with correct contents.
+        let move_file_path = tempdir.join("test_tool/sources/test_tool.move");
+        let move_contents = tokio::fs::read_to_string(move_file_path).await.unwrap();
+
+        assert!(move_contents.contains("module test_tool::test_tool;"));
+        assert!(move_contents.contains("public struct TEST_TOOL has drop {}"));
+        assert!(move_contents.contains("public struct TestToolWitness has key, store"));
+        assert!(move_contents.contains("public struct TestToolState has key"));
+        assert!(move_contents.contains("public enum Output"));
+        assert!(move_contents.contains("fun init(_otw: TEST_TOOL, ctx: &mut TxContext)"));
+        assert!(move_contents.contains("public fun execute("));
+        assert!(move_contents.contains("worksheet: &mut ProofOfUID"));
+        assert!(move_contents.contains("): ToolOutput"));
+        assert!(move_contents.contains("public fun witness_id(self: &TestToolState): ID"));
+        assert!(
+            move_contents.contains("public fun init_for_test(otw: TEST_TOOL, ctx: &mut TxContext)")
+        );
+
+        // Check that the test file was written.
+        let test_file_path = tempdir.join("test_tool/tests/test_tool_tests.move");
+        let test_contents = tokio::fs::read_to_string(test_file_path).await.unwrap();
+
+        assert!(test_contents.contains("module test_tool::test_tool_tests;"));
+        assert!(test_contents.contains("fun test_test_tool()"));
+
+        // Check that .gitignore was written.
+        let gitignore_path = tempdir.join("test_tool/.gitignore");
+        let gitignore_contents = tokio::fs::read_to_string(gitignore_path).await.unwrap();
+
+        assert!(gitignore_contents.contains("build/*"));
+    }
 }
diff --git a/cli/src/tool/tool_register.rs b/cli/src/tool/tool_register.rs
deleted file mode 100644
index 986f630c..00000000
--- a/cli/src/tool/tool_register.rs
+++ /dev/null
@@ -1,312 +0,0 @@
-use {
-    crate::{
-        command_title,
-        display::json_output,
-        loading,
-        notify_error,
-        notify_success,
-        prelude::*,
-        sui::*,
-        tool::{tool_validate::*, ToolIdent},
-    },
-    nexus_sdk::{
-        idents::{primitives, workflow},
-        transactions::tool,
-    },
-};
-
-/// Validate and then register a new Tool.
-pub(crate) async fn register_tool(
-    ident: ToolIdent,
-    collateral_coin: Option<sui::ObjectID>,
-    invocation_cost: u64,
-    batch: bool,
-    no_save: bool,
-    sui_gas_coin: Option<sui::ObjectID>,
-    sui_gas_budget: u64,
-) -> AnyResult<(), NexusCliError> {
-    let ident_check = ident.clone();
-
-    // Validate either a single tool or a batch of tools if the `batch` flag is
-    // provided.
-    let idents = if batch {
-        let Some(url) = &ident.off_chain else {
-            todo!("TODO: <https://github.com/Talus-Network/nexus-next/issues/96>");
-        };
-
-        // Fetch all tools on the webserver.
-        let response = reqwest::Client::new()
-            .get(url.join("/tools").expect("Joining URL must be valid"))
-            .send()
-            .await
-            .map_err(NexusCliError::Http)?
-            .json::<Vec<String>>()
-            .await
-            .map_err(NexusCliError::Http)?;
-
-        response
-            .iter()
-            .filter_map(|s| match url.join(s) {
-                Ok(url) => Some(ToolIdent {
-                    off_chain: Some(url),
-                    on_chain: None,
-                }),
-                Err(_) => None,
-            })
-            .collect::<Vec<_>>()
-    } else {
-        vec![ident]
-    };
-
-    let mut registration_results = Vec::with_capacity(idents.len());
-
-    for ident in idents {
-        let meta = validate_tool(ident).await?;
-
-        command_title!(
-            "Registering Tool '{fqn}' at '{url}'",
-            fqn = meta.fqn,
-            url = meta.url
-        );
-
-        // Load CLI configuration.
-        let mut conf = CliConf::load().await.unwrap_or_default();
-
-        // Nexus objects must be present in the configuration.
-        let objects = &get_nexus_objects(&mut conf).await?;
-
-        // Create wallet context, Sui client and find the active address.
-        let mut wallet = create_wallet_context(&conf.sui.wallet_path, conf.sui.net).await?;
-        let sui = build_sui_client(&conf.sui).await?;
-        let address = wallet.active_address().map_err(NexusCliError::Any)?;
-
-        // Fetch gas and collateral coin objects.
-        let (gas_coin, collateral_coin) =
-            fetch_gas_and_collateral_coins(&sui, address, sui_gas_coin, collateral_coin).await?;
-
-        if gas_coin.coin_object_id == collateral_coin.coin_object_id {
-            return Err(NexusCliError::Any(anyhow!(
-                "Gas and collateral coins must be different."
-            )));
-        }
-
-        // Fetch reference gas price.
-        let reference_gas_price = fetch_reference_gas_price(&sui).await?;
-
-        // Craft a TX to register the tool.
-        let tx_handle = loading!("Crafting transaction...");
-
-        // Explicitly check that we're registering an off-chain tool. This is mainly
-        // for when we implement logic for on-chain so that we don't forget to
-        // adjust the transaction.
-        if ident_check.on_chain.is_some() {
-            todo!("TODO: <https://github.com/Talus-Network/nexus-next/issues/96>");
-        }
-
-        let mut tx = sui::ProgrammableTransactionBuilder::new();
-
-        if let Err(e) = tool::register_off_chain_for_self(
-            &mut tx,
-            objects,
-            &meta,
-            address.into(),
-            &collateral_coin,
-            invocation_cost,
-        ) {
-            tx_handle.error();
-
-            return Err(NexusCliError::Any(e));
-        }
-
-        tx_handle.success();
-
-        let tx_data = sui::TransactionData::new_programmable(
-            address,
-            vec![gas_coin.object_ref()],
-            tx.finish(),
-            sui_gas_budget,
-            reference_gas_price,
-        );
-
-        // Sign and submit the TX.
-        let response = match sign_and_execute_transaction(&sui, &wallet, tx_data).await {
-            Ok(response) => response,
-            // If the tool is already registered, we don't want to fail the
-            // command.
-            Err(NexusCliError::Any(e)) if e.to_string().contains("register_off_chain_tool_") => {
-                notify_error!(
-                    "Tool '{fqn}' is already registered.",
-                    fqn = meta.fqn.to_string().truecolor(100, 100, 100)
-                );
-
-                registration_results.push(json!({
-                    "tool_fqn": meta.fqn,
-                    "already_registered": true,
-                }));
-
-                continue;
-            }
-            // Any other error fails the tool registration but continues the
-            // loop.
-            Err(e) => {
-                notify_error!(
-                    "Failed to register tool '{fqn}': {error}",
-                    fqn = meta.fqn.to_string().truecolor(100, 100, 100),
-                    error = e
-                );
-
-                registration_results.push(json!({
-                    "tool_fqn": meta.fqn,
-                    "error": e.to_string(),
-                }));
-
-                continue;
-            }
-        };
-
-        // Parse the owner cap object IDs from the response.
-        let owner_caps = response
-            .object_changes
-            .unwrap_or_default()
-            .into_iter()
-            .filter_map(|change| match change {
-                sui::ObjectChange::Created {
-                    object_type,
-                    object_id,
-                    ..
-                } if object_type.address == *objects.primitives_pkg_id
-                    && object_type.module
-                        == primitives::OwnerCap::CLONEABLE_OWNER_CAP.module.into()
-                    && object_type.name
-                        == primitives::OwnerCap::CLONEABLE_OWNER_CAP.name.into() =>
-                {
-                    Some((object_id, object_type))
-                }
-                _ => None,
-            })
-            .collect::<Vec<_>>();
-
-        // Find `CloneableOwnerCap<OverTool>` object ID.
-        let over_tool = owner_caps.iter().find_map(|(object_id, object_type)| {
-            match object_type.type_params.first() {
-                Some(sui::MoveTypeTag::Struct(what_for))
-                    if what_for.module == workflow::ToolRegistry::OVER_TOOL.module.into()
-                        && what_for.name == workflow::ToolRegistry::OVER_TOOL.name.into() =>
-                {
-                    Some(object_id)
-                }
-                _ => None,
-            }
-        });
-
-        let Some(over_tool_id) = over_tool else {
-            return Err(NexusCliError::Any(anyhow!(
-                "Could not find the OwnerCap<OverTool> object ID in the transaction response."
-            )));
-        };
-
-        // Find `CloneableOwnerCap<OverGas>` object ID.
-        let over_gas = owner_caps.iter().find_map(|(object_id, object_type)| {
-            match object_type.type_params.first() {
-                Some(sui::MoveTypeTag::Struct(what_for))
-                    if what_for.module == workflow::Gas::OVER_GAS.module.into()
-                        && what_for.name == workflow::Gas::OVER_GAS.name.into() =>
-                {
-                    Some(object_id)
-                }
-                _ => None,
-            }
-        });
-
-        let Some(over_gas_id) = over_gas else {
-            return Err(NexusCliError::Any(anyhow!(
-                "Could not find the OwnerCap<OverGas> object ID in the transaction response."
-            )));
-        };
-
-        notify_success!(
-            "OwnerCap<OverTool> object ID: {id}",
-            id = over_tool_id.to_string().truecolor(100, 100, 100)
-        );
-
-        notify_success!(
-            "OwnerCap<OverGas> object ID: {id}",
-            id = over_gas_id.to_string().truecolor(100, 100, 100)
-        );
-
-        // Save the owner caps to the CLI conf.
-        if !no_save {
-            let save_handle = loading!("Saving the owner caps to the CLI configuration...");
-
-            let mut conf = CliConf::load().await.unwrap_or_default();
-
-            conf.tools.insert(
-                meta.fqn.clone(),
-                ToolOwnerCaps {
-                    over_tool: *over_tool_id,
-                    over_gas: *over_gas_id,
-                },
-            );
-
-            if let Err(e) = conf.save().await {
-                save_handle.error();
-
-                return Err(NexusCliError::Any(e));
-            }
-
-            save_handle.success();
-        }
-
-        registration_results.push(json!({
-            "digest": response.digest,
-            "tool_fqn": meta.fqn,
-            "owner_cap_over_tool_id": over_tool_id,
-            "owner_cap_over_gas_id": over_gas_id,
-            "already_registered": false,
-        }))
-    }
-
-    json_output(&registration_results)?;
-
-    Ok(())
-}
-
-/// Fetch the gas and collateral coins from the Sui client. On Localnet, Devnet
-/// and Testnet, we can use the faucet to get the coins. On Mainnet, this fails
-/// if the coins are not present.
-async fn fetch_gas_and_collateral_coins(
-    sui: &sui::Client,
-    addr: sui::Address,
-    sui_gas_coin: Option<sui::ObjectID>,
-    sui_collateral_coin: Option<sui::ObjectID>,
-) -> AnyResult<(sui::Coin, sui::Coin), NexusCliError> {
-    let mut coins = fetch_all_coins_for_address(sui, addr).await?;
-
-    if coins.len() < 2 {
-        return Err(NexusCliError::Any(anyhow!(
-            "The wallet does not have enough coins to register the tool"
-        )));
-    }
-
-    // If object IDs were specified, use them. If any of the specified coins is
-    // not found, return error.
-    let gas_coin = match sui_gas_coin {
-        Some(id) => coins
-            .iter()
-            .find(|coin| coin.coin_object_id == id)
-            .cloned()
-            .ok_or_else(|| NexusCliError::Any(anyhow!("Coin '{id}' not found in wallet")))?,
-        None => coins.remove(0),
-    };
-
-    let collateral_coin = match sui_collateral_coin {
-        Some(id) => coins
-            .iter()
-            .find(|coin| coin.coin_object_id == id)
-            .cloned()
-            .ok_or_else(|| NexusCliError::Any(anyhow!("Coin '{id}' not found in wallet")))?,
-        None => coins.remove(0),
-    };
-
-    Ok((gas_coin, collateral_coin))
-}
diff --git a/cli/src/tool/tool_register_offchain.rs b/cli/src/tool/tool_register_offchain.rs
new file mode 100644
index 00000000..a6421b3d
--- /dev/null
+++ b/cli/src/tool/tool_register_offchain.rs
@@ -0,0 +1,262 @@
+use {
+    crate::{
+        command_title,
+        display::json_output,
+        loading,
+        notify_error,
+        notify_success,
+        prelude::*,
+        sui::*,
+        tool::tool_validate::validate_off_chain_tool,
+    },
+    nexus_sdk::{
+        idents::{primitives, workflow},
+        nexus::error::NexusError,
+        transactions::tool,
+    },
+};
+
+/// Validate and then register a new offchain Tool.
+pub(crate) async fn register_off_chain_tool(
+    url: reqwest::Url,
+    collateral_coin: Option<sui::types::Address>,
+    invocation_cost: u64,
+    batch: bool,
+    no_save: bool,
+    sui_gas_coin: Option<sui::types::Address>,
+    sui_gas_budget: u64,
+) -> AnyResult<(), NexusCliError> {
+    // Validate either a single tool or a batch of tools if the `batch` flag is
+    // provided.
+    let urls = if batch {
+        // Fetch all tools on the webserver.
+        let response = reqwest::Client::new()
+            .get(url.join("/tools").expect("Joining URL must be valid"))
+            .send()
+            .await
+            .map_err(NexusCliError::Http)?
+            .json::<Vec<String>>()
+            .await
+            .map_err(NexusCliError::Http)?;
+
+        response
+            .iter()
+            .filter_map(|s| url.join(s).ok())
+            .collect::<Vec<_>>()
+    } else {
+        vec![url]
+    };
+
+    let mut registration_results = Vec::with_capacity(urls.len());
+
+    if collateral_coin.is_some() && collateral_coin == sui_gas_coin {
+        return Err(NexusCliError::Any(anyhow!(
+            "The coin used for collateral cannot be the same as the gas coin."
+        )));
+    }
+
+    let conf = CliConf::load().await.unwrap_or_default();
+    let client = build_sui_grpc_client(&conf).await?;
+    let pk = get_signing_key(&conf).await?;
+    let owner = pk.public_key().derive_address();
+
+    for tool_url in urls {
+        let meta = validate_off_chain_tool(tool_url).await?;
+
+        command_title!(
+            "Registering Tool '{fqn}' at '{url}'",
+            fqn = meta.fqn,
+            url = meta.url
+        );
+
+        let nexus_client = get_nexus_client(sui_gas_coin, sui_gas_budget).await?;
+        let signer = nexus_client.signer();
+        let gas_config = nexus_client.gas_config();
+        let address = signer.get_active_address();
+        let nexus_objects = &*nexus_client.get_nexus_objects();
+        let collateral_coin = fetch_coin(client.clone(), owner, collateral_coin, 1).await?;
+
+        // Craft a TX to register the tool.
+        let tx_handle = loading!("Crafting transaction...");
+
+        let mut tx = sui::tx::TransactionBuilder::new();
+
+        if let Err(e) = tool::register_off_chain_for_self(
+            &mut tx,
+            nexus_objects,
+            &meta,
+            address,
+            &collateral_coin,
+            invocation_cost,
+        ) {
+            tx_handle.error();
+
+            return Err(NexusCliError::Any(e));
+        }
+
+        tx_handle.success();
+
+        let mut gas_coin = gas_config.acquire_gas_coin().await;
+
+        tx.set_sender(address);
+        tx.set_gas_budget(gas_config.get_budget());
+        tx.set_gas_price(nexus_client.get_reference_gas_price());
+
+        tx.add_gas_objects(vec![sui::tx::Input::owned(
+            *gas_coin.object_id(),
+            gas_coin.version(),
+            *gas_coin.digest(),
+        )]);
+
+        let tx = tx.finish().map_err(|e| NexusCliError::Any(e.into()))?;
+
+        let signature = signer.sign_tx(&tx).await.map_err(NexusCliError::Nexus)?;
+
+        // Sign and submit the TX.
+        let response = match signer.execute_tx(tx, signature, &mut gas_coin).await {
+            Ok(response) => {
+                gas_config.release_gas_coin(gas_coin).await;
+
+                response
+            }
+            // If the tool is already registered, we don't want to fail the
+            // command.
+            Err(NexusError::Wallet(e)) if e.to_string().contains("register_off_chain_tool_") => {
+                gas_config.release_gas_coin(gas_coin).await;
+
+                notify_error!(
+                    "Tool '{fqn}' is already registered.",
+                    fqn = meta.fqn.to_string().truecolor(100, 100, 100)
+                );
+
+                registration_results.push(json!({
+                    "tool_fqn": meta.fqn,
+                    "already_registered": true,
+                }));
+
+                continue;
+            }
+            // Any other error fails the tool registration but continues the
+            // loop.
+            Err(e) => {
+                gas_config.release_gas_coin(gas_coin).await;
+
+                notify_error!(
+                    "Failed to register tool '{fqn}': {error}",
+                    fqn = meta.fqn.to_string().truecolor(100, 100, 100),
+                    error = e
+                );
+
+                registration_results.push(json!({
+                    "tool_fqn": meta.fqn,
+                    "error": e.to_string(),
+                }));
+
+                continue;
+            }
+        };
+
+        // Parse the owner cap object IDs from the response.
+        let owner_caps = response
+            .objects
+            .iter()
+            .filter_map(|obj| {
+                let sui::types::ObjectType::Struct(object_type) = obj.object_type() else {
+                    return None;
+                };
+
+                if *object_type.address() == nexus_objects.primitives_pkg_id
+                    && *object_type.module() == primitives::OwnerCap::CLONEABLE_OWNER_CAP.module
+                    && *object_type.name() == primitives::OwnerCap::CLONEABLE_OWNER_CAP.name
+                {
+                    Some((obj.object_id(), object_type))
+                } else {
+                    None
+                }
+            })
+            .collect::<Vec<_>>();
+
+        // Find `CloneableOwnerCap<OverTool>` object ID.
+        let over_tool = owner_caps.iter().find_map(|(object_id, object_type)| {
+            match object_type.type_params().first() {
+                Some(sui::types::TypeTag::Struct(what_for))
+                    if *what_for.module() == workflow::ToolRegistry::OVER_TOOL.module
+                        && *what_for.name() == workflow::ToolRegistry::OVER_TOOL.name =>
+                {
+                    Some(object_id)
+                }
+                _ => None,
+            }
+        });
+
+        let Some(over_tool_id) = over_tool else {
+            return Err(NexusCliError::Any(anyhow!(
+                "Could not find the OwnerCap<OverTool> object ID in the transaction response."
+            )));
+        };
+
+        // Find `CloneableOwnerCap<OverGas>` object ID.
+        let over_gas = owner_caps.iter().find_map(|(object_id, object_type)| {
+            match object_type.type_params().first() {
+                Some(sui::types::TypeTag::Struct(what_for))
+                    if *what_for.module() == workflow::Gas::OVER_GAS.module
+                        && *what_for.name() == workflow::Gas::OVER_GAS.name =>
+                {
+                    Some(object_id)
+                }
+                _ => None,
+            }
+        });
+
+        let Some(over_gas_id) = over_gas else {
+            return Err(NexusCliError::Any(anyhow!(
+                "Could not find the OwnerCap<OverGas> object ID in the transaction response."
+            )));
+        };
+
+        notify_success!(
+            "OwnerCap<OverTool> object ID: {id}",
+            id = over_tool_id.to_string().truecolor(100, 100, 100)
+        );
+
+        notify_success!(
+            "OwnerCap<OverGas> object ID: {id}",
+            id = over_gas_id.to_string().truecolor(100, 100, 100)
+        );
+
+        // Save the owner caps to the CLI conf.
+        if !no_save {
+            let save_handle = loading!("Saving the owner caps to the CLI configuration...");
+
+            let mut conf = CliConf::load().await.unwrap_or_default();
+
+            conf.tools.insert(
+                meta.fqn.clone(),
+                ToolOwnerCaps {
+                    over_tool: *over_tool_id,
+                    over_gas: Some(*over_gas_id),
+                },
+            );
+
+            if let Err(e) = conf.save().await {
+                save_handle.error();
+
+                return Err(NexusCliError::Any(e));
+            }
+
+            save_handle.success();
+        }
+
+        registration_results.push(json!({
+            "digest": response.digest,
+            "tool_fqn": meta.fqn,
+            "owner_cap_over_tool_id": over_tool_id,
+            "owner_cap_over_gas_id": over_gas_id,
+            "already_registered": false,
+        }))
+    }
+
+    json_output(&registration_results)?;
+
+    Ok(())
+}
diff --git a/cli/src/tool/tool_register_onchain.rs b/cli/src/tool/tool_register_onchain.rs
new file mode 100644
index 00000000..7cba5138
--- /dev/null
+++ b/cli/src/tool/tool_register_onchain.rs
@@ -0,0 +1,1285 @@
+use {
+    crate::{
+        command_title,
+        display::json_output,
+        loading,
+        notify_error,
+        notify_success,
+        prelude::*,
+        sui::*,
+    },
+    nexus_sdk::{idents::primitives, nexus::error::NexusError, sui, transactions::tool},
+    serde::{Deserialize, Serialize},
+    serde_json::{json, Map, Value},
+    std::{
+        collections::HashMap,
+        io::{self, Write},
+    },
+};
+
+/// Register a new onchain tool with automatic schema generation.
+/// The input schema is automatically generated by introspecting the Move module's "execute" function.
+/// todo: merge this function with the existing `tool_register.rs` function.
+#[allow(clippy::too_many_arguments)]
+pub(crate) async fn register_onchain_tool(
+    package: sui::types::Address,
+    module: sui::types::Identifier,
+    fqn: ToolFqn,
+    description: String,
+    witness_id: sui::types::Address,
+    collateral_coin: Option<sui::types::Address>,
+    no_save: bool,
+    sui_gas_coin: Option<sui::types::Address>,
+    sui_gas_budget: u64,
+) -> AnyResult<(), NexusCliError> {
+    command_title!(
+        "Registering Onchain Tool '{fqn}' from package '{package}::{module}'",
+        fqn = fqn,
+        package = package,
+        module = module
+    );
+
+    if collateral_coin.is_some() && collateral_coin == sui_gas_coin {
+        return Err(NexusCliError::Any(anyhow!(
+            "The coin used for collateral cannot be the same as the gas coin."
+        )));
+    }
+
+    let nexus_client = get_nexus_client(sui_gas_coin, sui_gas_budget).await?;
+    let signer = nexus_client.signer();
+    let gas_config = nexus_client.gas_config();
+    let address = signer.get_active_address();
+    let nexus_objects = &*nexus_client.get_nexus_objects();
+    let conf = CliConf::load().await.unwrap_or_default();
+    let client = build_sui_grpc_client(&conf).await?;
+
+    let collateral_coin = fetch_coin(client.clone(), address, collateral_coin, 1).await?;
+
+    // Generate and customize schemas.
+    let (input_schema, output_schema) =
+        generate_and_customize_schemas(client, package, &module).await?;
+
+    let tx_handle = loading!("Crafting transaction...");
+
+    let mut tx = sui::tx::TransactionBuilder::new();
+
+    if let Err(e) = tool::register_on_chain_for_self(
+        &mut tx,
+        nexus_objects,
+        package,
+        module.as_str(),
+        &input_schema,
+        &output_schema,
+        &fqn,
+        &description,
+        witness_id,
+        &collateral_coin,
+        address,
+    ) {
+        tx_handle.error();
+
+        return Err(NexusCliError::Any(e));
+    }
+
+    tx_handle.success();
+
+    let mut gas_coin = gas_config.acquire_gas_coin().await;
+
+    tx.set_sender(address);
+    tx.set_gas_budget(gas_config.get_budget());
+    tx.set_gas_price(nexus_client.get_reference_gas_price());
+
+    tx.add_gas_objects(vec![sui::tx::Input::owned(
+        *gas_coin.object_id(),
+        gas_coin.version(),
+        *gas_coin.digest(),
+    )]);
+
+    let tx = tx.finish().map_err(|e| NexusCliError::Any(e.into()))?;
+
+    let signature = signer.sign_tx(&tx).await.map_err(NexusCliError::Nexus)?;
+
+    // Sign and submit the TX.
+    let response = match signer.execute_tx(tx, signature, &mut gas_coin).await {
+        Ok(response) => {
+            gas_config.release_gas_coin(gas_coin).await;
+
+            response
+        }
+        // If the tool is already registered, we don't want to fail the
+        // command.
+        Err(NexusError::Wallet(e)) if e.to_string().contains("register_on_chain_tool_") => {
+            gas_config.release_gas_coin(gas_coin).await;
+
+            notify_error!(
+                "Tool '{fqn}' is already registered.",
+                fqn = fqn.to_string().truecolor(100, 100, 100)
+            );
+
+            json_output(&json!({
+                "tool_fqn": fqn,
+                "already_registered": true,
+            }))?;
+
+            return Err(NexusCliError::Any(e));
+        }
+        // Any other error fails the tool registration but continues the
+        // loop.
+        Err(e) => {
+            gas_config.release_gas_coin(gas_coin).await;
+
+            notify_error!(
+                "Failed to register tool '{fqn}': {error}",
+                fqn = fqn.to_string().truecolor(100, 100, 100),
+                error = e
+            );
+
+            return Err(NexusCliError::Nexus(e));
+        }
+    };
+
+    // Extract the OwnerCap<OverTool> object ID.
+    let over_tool_id = extract_over_tool_owner_cap(&response.objects, nexus_objects)?;
+
+    // Save the owner caps to the CLI conf.
+    if !no_save {
+        save_tool_owner_caps(fqn.clone(), over_tool_id).await?;
+    }
+
+    json_output(&json!({
+        "digest": response.digest,
+        "tool_fqn": fqn,
+        "package_address": package,
+        "module_name": module,
+        "witness_id": witness_id.to_string(),
+        "description": description,
+        "input_schema": input_schema,
+        "output_schema": output_schema,
+        "owner_cap_over_tool_id": over_tool_id,
+        "owner_cap_over_gas_id": null,
+        "already_registered": false,
+    }))?;
+
+    Ok(())
+}
+
+/// Generate input and output schemas and allow user customization.
+async fn generate_and_customize_schemas(
+    client: Arc<Mutex<sui::grpc::Client>>,
+    package_address: sui::types::Address,
+    module_name: &str,
+) -> AnyResult<(String, String), NexusCliError> {
+    // Generate input schema by introspecting the Move module's "execute" function.
+    let input_handle = loading!("Auto-generating input schema from Move module...");
+    let base_input_schema = match nexus_sdk::onchain_schema_gen::generate_input_schema(
+        client.clone(),
+        package_address,
+        module_name,
+        "execute",
+    )
+    .await
+    {
+        Ok(schema) => {
+            input_handle.success();
+            schema
+        }
+        Err(e) => {
+            input_handle.error();
+            return Err(NexusCliError::Any(e));
+        }
+    };
+
+    // Generate output schema by introspecting the Move module's "Output" enum.
+    let output_handle = loading!("Auto-generating output schema from Move module...");
+    let base_output_schema = match nexus_sdk::onchain_schema_gen::generate_output_schema(
+        client,
+        package_address,
+        module_name,
+        "Output",
+    )
+    .await
+    {
+        Ok(schema) => {
+            output_handle.success();
+            schema
+        }
+        Err(e) => {
+            output_handle.error();
+            return Err(NexusCliError::Any(e));
+        }
+    };
+
+    // Allow user to customize parameter descriptions.
+    let input_schema = customize_parameter_descriptions(base_input_schema)?;
+
+    // Allow user to customize output variant and field descriptions.
+    let output_schema = customize_output_variant_and_field_descriptions(base_output_schema)?;
+
+    Ok((input_schema, output_schema))
+}
+
+/// Extract the OwnerCap<OverTool> object ID from the transaction response.
+fn extract_over_tool_owner_cap(
+    objects: &[sui::types::Object],
+    nexus_objects: &NexusObjects,
+) -> AnyResult<sui::types::Address, NexusCliError> {
+    // Find `CloneableOwnerCap<OverTool>` object ID
+    let over_tool = objects.iter().find_map(|obj| {
+        let sui::types::ObjectType::Struct(object_type) = obj.object_type() else {
+            return None;
+        };
+
+        if *object_type.address() == nexus_objects.primitives_pkg_id
+            && *object_type.module() == primitives::OwnerCap::CLONEABLE_OWNER_CAP.module
+            && *object_type.name() == primitives::OwnerCap::CLONEABLE_OWNER_CAP.name
+        {
+            Some(obj.object_id())
+        } else {
+            None
+        }
+    });
+
+    let Some(over_tool_id) = over_tool else {
+        return Err(NexusCliError::Any(anyhow!(
+            "Could not find the OwnerCap<OverTool> object ID in the transaction response."
+        )));
+    };
+
+    notify_success!(
+        "OwnerCap<OverTool> object ID: {id}",
+        id = over_tool_id.to_string().truecolor(100, 100, 100)
+    );
+
+    notify_success!("Onchain tools use a different gas model. No OverGas cap was created.");
+
+    Ok(over_tool_id)
+}
+
+/// Save the tool owner caps to the CLI configuration.
+async fn save_tool_owner_caps(
+    fqn: ToolFqn,
+    over_tool_id: sui::types::Address,
+) -> AnyResult<(), NexusCliError> {
+    let save_handle = loading!("Saving the owner cap to the CLI configuration...");
+
+    let mut conf = CliConf::load().await.unwrap_or_default();
+
+    // For onchain tools, we only have OverTool cap, no OverGas cap.
+    conf.tools.insert(
+        fqn,
+        ToolOwnerCaps {
+            over_tool: over_tool_id,
+            over_gas: None,
+        },
+    );
+
+    if let Err(e) = conf.save().await {
+        save_handle.error();
+        return Err(NexusCliError::Any(e));
+    }
+
+    save_handle.success();
+
+    Ok(())
+}
+
+/// Represents a single parameter in the input schema.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+struct ParameterSchema {
+    #[serde(rename = "type")]
+    param_type: String,
+    description: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    custom_name: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    mutable: Option<bool>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    parameter_index: Option<String>,
+}
+
+/// Represents an output variant with optional fields.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+struct OutputVariantSchema {
+    #[serde(rename = "type", skip_serializing_if = "Option::is_none")]
+    variant_type: Option<String>,
+    description: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    fields: Option<Map<String, Value>>,
+}
+
+/// Allow the user to customize parameter descriptions interactively.
+fn customize_parameter_descriptions_with_reader(
+    schema_json: String,
+    reader: &mut dyn std::io::BufRead,
+) -> AnyResult<String, NexusCliError> {
+    // Skip interactive prompts in JSON mode.
+    if JSON_MODE.load(Ordering::Relaxed) {
+        return Ok(schema_json);
+    }
+
+    // Deserialize into a typed map.
+    let mut schema: HashMap<String, ParameterSchema> = serde_json::from_str(&schema_json)
+        .map_err(|e| NexusCliError::Any(anyhow::anyhow!("Failed to parse schema JSON: {e}")))?;
+
+    if schema.is_empty() {
+        println!(
+            "\n{info} No parameters to customize.",
+            info = "▶".cyan().bold()
+        );
+        return Ok(schema_json);
+    }
+
+    println!(
+        "\n{title}",
+        title = "Input Schema Customization".bold().cyan()
+    );
+    println!(
+        "Customize names and descriptions for each input parameter (press Enter to keep current)"
+    );
+
+    // Sort parameter keys numerically.
+    let mut param_keys: Vec<String> = schema.keys().cloned().collect();
+    param_keys.sort_by_key(|k| k.parse::<i32>().unwrap_or(i32::MAX));
+
+    // Customize each parameter.
+    for param_key in &param_keys {
+        if let Some(param) = schema.get_mut(param_key) {
+            customize_parameter(param_key, param, reader)
+                .map_err(|e| NexusCliError::Any(anyhow::anyhow!("I/O error: {e}")))?;
+        }
+    }
+
+    println!();
+
+    // Convert schema to use custom names as keys.
+    let final_schema = build_final_schema(schema)?;
+
+    // Serialize back to JSON.
+    serde_json::to_string(&final_schema)
+        .map_err(|e| NexusCliError::Any(anyhow::anyhow!("Failed to serialize schema: {e}")))
+}
+
+/// Build the final schema with custom names as keys.
+fn build_final_schema(
+    schema: HashMap<String, ParameterSchema>,
+) -> AnyResult<Map<String, Value>, NexusCliError> {
+    let mut final_schema = Map::new();
+
+    for (param_index, mut param) in schema {
+        // Use custom name if provided, otherwise use the integer index.
+        let key = param.custom_name.take().unwrap_or(param_index);
+
+        // Clear metadata fields before serialization.
+        param.parameter_index = None;
+
+        // Convert to JSON value (this automatically excludes None fields).
+        let param_value = serde_json::to_value(param).map_err(|e| {
+            NexusCliError::Any(anyhow::anyhow!("Failed to serialize parameter: {e}"))
+        })?;
+
+        final_schema.insert(key, param_value);
+    }
+
+    Ok(final_schema)
+}
+
+/// Wrapper function that calls customize_parameter_descriptions_with_reader using stdin.
+fn customize_parameter_descriptions(schema_json: String) -> AnyResult<String, NexusCliError> {
+    let stdin = io::stdin();
+    let mut reader = stdin.lock();
+    customize_parameter_descriptions_with_reader(schema_json, &mut reader)
+}
+
+/// Allow the user to customize output variant and field descriptions through an interactive prompt.
+fn customize_output_variant_and_field_descriptions_with_reader(
+    base_schema: String,
+    reader: &mut dyn std::io::BufRead,
+) -> AnyResult<String, NexusCliError> {
+    // Skip interactive prompts in JSON mode.
+    if JSON_MODE.load(Ordering::Relaxed) {
+        return Ok(base_schema);
+    }
+
+    // Deserialize into a typed map.
+    let mut schema: HashMap<String, OutputVariantSchema> = serde_json::from_str(&base_schema)
+        .map_err(|e| NexusCliError::Any(anyhow::anyhow!("Failed to parse output schema: {e}")))?;
+
+    // Display header.
+    println!(
+        "\n{title}",
+        title = "Output Schema Descriptions".bold().cyan()
+    );
+    println!(
+        "Customize descriptions for output variants and their fields (press Enter to keep current)"
+    );
+
+    // Customize each variant.
+    for (variant_name, variant) in schema.iter_mut() {
+        customize_output_variant(variant_name, variant, reader)
+            .map_err(|e| NexusCliError::Any(anyhow::anyhow!("I/O error: {e}")))?;
+    }
+
+    println!();
+
+    // Serialize back to JSON.
+    serde_json::to_string(&schema)
+        .map_err(|e| NexusCliError::Any(anyhow::anyhow!("Failed to serialize output schema: {e}")))
+}
+
+/// Wrapper function that calls customize_output_variant_and_field_descriptions_with_reader using stdin.
+fn customize_output_variant_and_field_descriptions(
+    base_schema: String,
+) -> AnyResult<String, NexusCliError> {
+    let stdin = io::stdin();
+    let mut reader = stdin.lock();
+    customize_output_variant_and_field_descriptions_with_reader(base_schema, &mut reader)
+}
+
+/// Get a field's type and description from JSON value.
+fn get_field_info(field_value: &Value) -> (String, String) {
+    let field_type = field_value
+        .get("type")
+        .and_then(|v| v.as_str())
+        .unwrap_or("unknown")
+        .to_string();
+    let description = field_value
+        .get("description")
+        .and_then(|v| v.as_str())
+        .unwrap_or("No description")
+        .to_string();
+    (field_type, description)
+}
+
+/// Update a field's description in the JSON value.
+fn update_field_description(field_value: &mut Value, new_description: String) {
+    if let Some(obj) = field_value.as_object_mut() {
+        obj.insert("description".to_string(), Value::String(new_description));
+    }
+}
+
+/// Prompt the user for optional input with a default fallback.
+fn prompt_optional_input(
+    reader: &mut dyn std::io::BufRead,
+    prompt: &str,
+    current_value: &str,
+) -> io::Result<Option<String>> {
+    println!("Current: {}", current_value.truecolor(150, 150, 150));
+    print!("{prompt}: ");
+    io::stdout().flush()?;
+
+    let mut input = String::new();
+    reader.read_line(&mut input)?;
+    let trimmed = input.trim();
+
+    if trimmed.is_empty() {
+        println!("{} Kept current value", "→".truecolor(150, 150, 150));
+        Ok(None)
+    } else {
+        println!("{} Updated", "✓".green().bold());
+        Ok(Some(trimmed.to_string()))
+    }
+}
+
+/// Customize a single parameter interactively.
+fn customize_parameter(
+    param_key: &str,
+    param: &mut ParameterSchema,
+    reader: &mut dyn std::io::BufRead,
+) -> io::Result<()> {
+    let is_mutable = param.mutable.unwrap_or(false);
+    let type_display = if is_mutable {
+        format!("mut {}", param.param_type)
+    } else {
+        param.param_type.clone()
+    };
+
+    println!();
+    println!(
+        "{} Parameter {}: {} {}",
+        "▶".purple().bold(),
+        param_key.bold(),
+        type_display.blue().bold(),
+        if is_mutable {
+            "(mutable)".yellow()
+        } else {
+            "".normal()
+        }
+    );
+
+    // Customize parameter name.
+    let default_name = param.custom_name.as_deref().unwrap_or(param_key);
+    println!("Current name: {}", default_name.truecolor(150, 150, 150));
+    if param.custom_name.is_some() {
+        println!("Current custom name: {}", default_name.green());
+    }
+
+    if let Some(new_name) = prompt_optional_input(
+        reader,
+        &format!("Custom name (Enter to keep '{default_name}')"),
+        default_name,
+    )? {
+        param.custom_name = Some(new_name);
+    } else if param.custom_name.is_some() {
+        // User pressed Enter but had a custom name.
+        param.custom_name = None;
+    }
+
+    // Customize parameter description.
+    if let Some(new_desc) = prompt_optional_input(
+        reader,
+        "Custom description (Enter to keep)",
+        &param.description,
+    )? {
+        param.description = new_desc;
+    }
+
+    Ok(())
+}
+
+/// Customize a single output field interactively.
+fn customize_output_field(
+    field_name: &str,
+    field_value: &mut Value,
+    reader: &mut dyn std::io::BufRead,
+) -> io::Result<()> {
+    let (field_type, description) = get_field_info(field_value);
+
+    println!();
+    println!(
+        "{} Field {}: {}",
+        "▶".purple().bold(),
+        field_name.bold(),
+        field_type.blue().bold()
+    );
+
+    if let Some(new_desc) =
+        prompt_optional_input(reader, "Custom description (Enter to keep)", &description)?
+    {
+        update_field_description(field_value, new_desc);
+    }
+
+    Ok(())
+}
+
+/// Customize a single output variant interactively.
+fn customize_output_variant(
+    variant_name: &str,
+    variant: &mut OutputVariantSchema,
+    reader: &mut dyn std::io::BufRead,
+) -> io::Result<()> {
+    println!();
+    println!(
+        "{} Variant {}: {}",
+        "▶".purple().bold(),
+        variant_name.bold(),
+        "variant".blue().bold()
+    );
+
+    // Customize variant description.
+    if let Some(new_desc) = prompt_optional_input(
+        reader,
+        "Custom description (Enter to keep)",
+        &variant.description,
+    )? {
+        variant.description = new_desc;
+    }
+
+    // Customize field descriptions if present.
+    if let Some(fields) = &mut variant.fields {
+        for (field_name, field_value) in fields.iter_mut() {
+            customize_output_field(field_name, field_value, reader)?;
+        }
+    }
+
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use {super::*, nexus_sdk::test_utils::sui_mocks, std::sync::atomic::Ordering};
+
+    #[test]
+    fn test_build_final_schema_with_custom_names() {
+        // Create a schema with integer keys and custom names using typed structs.
+        let mut schema = HashMap::new();
+
+        // Parameter 0: u64 with custom name "increment_amount".
+        schema.insert(
+            "0".to_string(),
+            ParameterSchema {
+                param_type: "u64".to_string(),
+                description: "64-bit unsigned integer".to_string(),
+                custom_name: Some("increment_amount".to_string()),
+                mutable: None,
+                parameter_index: Some("0".to_string()),
+            },
+        );
+
+        // Parameter 1: object with custom name "counter".
+        schema.insert(
+            "1".to_string(),
+            ParameterSchema {
+                param_type: "object".to_string(),
+                description: "Counter object reference".to_string(),
+                custom_name: Some("counter".to_string()),
+                mutable: Some(true),
+                parameter_index: Some("1".to_string()),
+            },
+        );
+
+        // Convert schema.
+        let result = build_final_schema(schema).unwrap();
+
+        // Verify custom names are used as keys.
+        assert!(result.contains_key("increment_amount"));
+        assert!(result.contains_key("counter"));
+        assert!(!result.contains_key("0"));
+        assert!(!result.contains_key("1"));
+
+        // Verify metadata fields are removed.
+        let increment_amount_param = result.get("increment_amount").unwrap().as_object().unwrap();
+        assert!(!increment_amount_param.contains_key("custom_name"));
+        assert!(!increment_amount_param.contains_key("parameter_index"));
+
+        // Verify type and description are preserved.
+        assert_eq!(increment_amount_param.get("type").unwrap(), "u64");
+        assert_eq!(
+            increment_amount_param.get("description").unwrap(),
+            "64-bit unsigned integer"
+        );
+
+        // Verify mutable flag is preserved for counter.
+        let counter_param = result.get("counter").unwrap().as_object().unwrap();
+        assert_eq!(counter_param.get("mutable").unwrap(), true);
+        assert!(!counter_param.contains_key("custom_name"));
+        assert!(!counter_param.contains_key("parameter_index"));
+    }
+
+    #[test]
+    fn test_build_final_schema_without_custom_names() {
+        // Create a schema with integer keys but no custom names using typed structs.
+        let mut schema = HashMap::new();
+
+        // Parameter 0: u64 without custom name.
+        schema.insert(
+            "0".to_string(),
+            ParameterSchema {
+                param_type: "u64".to_string(),
+                description: "64-bit unsigned integer".to_string(),
+                custom_name: None,
+                mutable: None,
+                parameter_index: None,
+            },
+        );
+
+        // Parameter 1: object without custom name.
+        schema.insert(
+            "1".to_string(),
+            ParameterSchema {
+                param_type: "object".to_string(),
+                description: "Object reference".to_string(),
+                custom_name: None,
+                mutable: Some(true),
+                parameter_index: None,
+            },
+        );
+
+        // Convert schema.
+        let result = build_final_schema(schema).unwrap();
+
+        // Verify integer keys are preserved.
+        assert!(result.contains_key("0"));
+        assert!(result.contains_key("1"));
+
+        // Verify all properties are preserved.
+        let param0_result = result.get("0").unwrap().as_object().unwrap();
+        assert_eq!(param0_result.get("type").unwrap(), "u64");
+        assert_eq!(
+            param0_result.get("description").unwrap(),
+            "64-bit unsigned integer"
+        );
+
+        let param1_result = result.get("1").unwrap().as_object().unwrap();
+        assert_eq!(param1_result.get("type").unwrap(), "object");
+        assert_eq!(param1_result.get("mutable").unwrap(), true);
+    }
+
+    #[test]
+    fn test_build_final_schema_mixed() {
+        // Create a schema with some custom names and some without using typed structs.
+        let mut schema = HashMap::new();
+
+        // Parameter 0: with custom name.
+        schema.insert(
+            "0".to_string(),
+            ParameterSchema {
+                param_type: "u64".to_string(),
+                description: "Amount parameter".to_string(),
+                custom_name: Some("amount".to_string()),
+                mutable: None,
+                parameter_index: Some("0".to_string()),
+            },
+        );
+
+        // Parameter 1: without custom name.
+        schema.insert(
+            "1".to_string(),
+            ParameterSchema {
+                param_type: "bool".to_string(),
+                description: "Flag parameter".to_string(),
+                custom_name: None,
+                mutable: None,
+                parameter_index: None,
+            },
+        );
+
+        // Parameter 2: with custom name.
+        schema.insert(
+            "2".to_string(),
+            ParameterSchema {
+                param_type: "string".to_string(),
+                description: "Message parameter".to_string(),
+                custom_name: Some("message".to_string()),
+                mutable: None,
+                parameter_index: Some("2".to_string()),
+            },
+        );
+
+        // Convert schema.
+        let result = build_final_schema(schema).unwrap();
+
+        // Verify mixed keys.
+        assert!(result.contains_key("amount")); // Custom name.
+        assert!(result.contains_key("1")); // Integer key preserved.
+        assert!(result.contains_key("message")); // Custom name.
+        assert!(!result.contains_key("0")); // Replaced by custom name.
+        assert!(!result.contains_key("2")); // Replaced by custom name.
+
+        // Verify no metadata in results.
+        for (_, value) in result.iter() {
+            let obj = value.as_object().unwrap();
+            assert!(!obj.contains_key("custom_name"));
+            assert!(!obj.contains_key("parameter_index"));
+        }
+    }
+
+    #[test]
+    fn test_customize_parameter_descriptions_json_mode() {
+        // Set JSON mode to skip interactive prompts.
+        JSON_MODE.store(true, Ordering::Relaxed);
+
+        // Input schema based on onchain tool example.
+        let input_schema = r#"{
+            "0": {
+                "type": "object",
+                "description": "0x123::onchain_tool::RandomCounter",
+                "mutable": true
+            },
+            "1": {
+                "type": "u64",
+                "description": "64-bit unsigned integer"
+            }
+        }"#;
+
+        // Call customize function.
+        let result = customize_parameter_descriptions(input_schema.to_string()).unwrap();
+
+        // In JSON mode, schema should be returned unchanged.
+        let input_value: Value = serde_json::from_str(input_schema).unwrap();
+        let result_value: Value = serde_json::from_str(&result).unwrap();
+
+        assert_eq!(input_value, result_value);
+
+        // Reset JSON mode.
+        JSON_MODE.store(false, Ordering::Relaxed);
+    }
+
+    #[test]
+    fn test_customize_parameter_descriptions_empty_schema() {
+        // Set JSON mode to skip interactive prompts.
+        JSON_MODE.store(true, Ordering::Relaxed);
+
+        // Empty schema.
+        let input_schema = "{}";
+
+        // Call customize function.
+        let result = customize_parameter_descriptions(input_schema.to_string()).unwrap();
+
+        // Should return empty schema unchanged.
+        assert_eq!(result, "{}");
+
+        // Reset JSON mode.
+        JSON_MODE.store(false, Ordering::Relaxed);
+    }
+
+    #[test]
+    fn test_customize_output_variant_and_field_descriptions_json_mode() {
+        // Set JSON mode to skip interactive prompts.
+        JSON_MODE.store(true, Ordering::Relaxed);
+
+        // Output schema based on onchain tool example.
+        let output_schema = r#"{
+            "ok": {
+                "type": "variant",
+                "description": "Ok variant",
+                "fields": {
+                    "old_count": {
+                        "type": "u64",
+                        "description": "64-bit unsigned integer"
+                    },
+                    "new_count": {
+                        "type": "u64",
+                        "description": "64-bit unsigned integer"
+                    },
+                    "increment": {
+                        "type": "u64",
+                        "description": "64-bit unsigned integer"
+                    }
+                }
+            },
+            "err": {
+                "type": "variant",
+                "description": "Err variant",
+                "fields": {
+                    "reason": {
+                        "type": "string",
+                        "description": "0x1::ascii::String"
+                    }
+                }
+            },
+            "largeincrement": {
+                "type": "variant",
+                "description": "LargeIncrement variant",
+                "fields": {
+                    "old_count": {
+                        "type": "u64",
+                        "description": "64-bit unsigned integer"
+                    },
+                    "new_count": {
+                        "type": "u64",
+                        "description": "64-bit unsigned integer"
+                    },
+                    "increment": {
+                        "type": "u64",
+                        "description": "64-bit unsigned integer"
+                    },
+                    "warning": {
+                        "type": "string",
+                        "description": "0x1::ascii::String"
+                    }
+                }
+            }
+        }"#;
+
+        // Call customize function.
+        let result =
+            customize_output_variant_and_field_descriptions(output_schema.to_string()).unwrap();
+
+        // In JSON mode, schema should be returned unchanged.
+        let input_value: Value = serde_json::from_str(output_schema).unwrap();
+        let result_value: Value = serde_json::from_str(&result).unwrap();
+
+        assert_eq!(input_value, result_value);
+
+        // Reset JSON mode.
+        JSON_MODE.store(false, Ordering::Relaxed);
+    }
+
+    #[test]
+    fn test_build_final_schema_preserves_all_fields() {
+        // Test that all field types are properly preserved during conversion using typed structs.
+        let mut schema = HashMap::new();
+
+        // Parameter with various field types.
+        schema.insert(
+            "0".to_string(),
+            ParameterSchema {
+                param_type: "object".to_string(),
+                description: "Test object".to_string(),
+                custom_name: Some("my_param".to_string()),
+                mutable: Some(true),
+                parameter_index: Some("0".to_string()),
+            },
+        );
+
+        // Convert.
+        let result = build_final_schema(schema).unwrap();
+
+        // Verify custom name is used and metadata removed.
+        assert!(result.contains_key("my_param"));
+        let my_param = result.get("my_param").unwrap().as_object().unwrap();
+
+        // Verify all non-metadata fields are preserved.
+        assert_eq!(my_param.get("type").unwrap(), "object");
+        assert_eq!(my_param.get("description").unwrap(), "Test object");
+        assert_eq!(my_param.get("mutable").unwrap(), true);
+
+        // Verify metadata fields are removed.
+        assert!(!my_param.contains_key("custom_name"));
+        assert!(!my_param.contains_key("parameter_index"));
+    }
+
+    #[test]
+    fn test_build_final_schema_with_none_custom_name() {
+        // Test that None custom_name is treated as no custom name using typed structs.
+        let mut schema = HashMap::new();
+
+        schema.insert(
+            "0".to_string(),
+            ParameterSchema {
+                param_type: "u64".to_string(),
+                description: "Test param".to_string(),
+                custom_name: None,
+                mutable: None,
+                parameter_index: None,
+            },
+        );
+
+        // Convert.
+        let result = build_final_schema(schema).unwrap();
+
+        // Verify integer key is preserved when custom_name is None.
+        assert!(result.contains_key("0"));
+        assert_eq!(result.get("0").unwrap()["type"], "u64");
+    }
+
+    #[test]
+    fn test_customize_parameter_descriptions_with_mock_input() {
+        // Ensure JSON_MODE is off for this test.
+        JSON_MODE.store(false, Ordering::Relaxed);
+
+        // Create input schema.
+        let input_schema = r#"{
+            "0": {
+                "type": "u64",
+                "description": "64-bit unsigned integer"
+            }
+        }"#;
+
+        // Mock user input: custom name "amount" + enter, then custom description "The amount to use" + enter.
+        let mock_input = "amount\nThe amount to use\n";
+        let mut reader = std::io::Cursor::new(mock_input.as_bytes());
+
+        // Call the function with mock input.
+        let result =
+            customize_parameter_descriptions_with_reader(input_schema.to_string(), &mut reader)
+                .unwrap();
+
+        // Parse the result.
+        let result_value: Value = serde_json::from_str(&result).unwrap();
+
+        // Verify the custom name was applied.
+        assert!(result_value.get("amount").is_some());
+        assert!(result_value.get("0").is_none());
+
+        // Verify the custom description was applied.
+        let amount_param = result_value.get("amount").unwrap();
+        assert_eq!(
+            amount_param.get("description").unwrap().as_str().unwrap(),
+            "The amount to use"
+        );
+        assert_eq!(amount_param.get("type").unwrap().as_str().unwrap(), "u64");
+
+        // Reset JSON_MODE.
+        JSON_MODE.store(false, Ordering::Relaxed);
+    }
+
+    #[test]
+    fn test_customize_parameter_descriptions_keep_defaults() {
+        // Ensure JSON_MODE is off.
+        JSON_MODE.store(false, Ordering::Relaxed);
+
+        // Create input schema.
+        let input_schema = r#"{
+            "0": {
+                "type": "bool",
+                "description": "Boolean flag"
+            }
+        }"#;
+
+        // Mock user input: empty (press enter) for both name and description to keep defaults.
+        let mock_input = "\n\n";
+        let mut reader = std::io::Cursor::new(mock_input.as_bytes());
+
+        // Call the function.
+        let result =
+            customize_parameter_descriptions_with_reader(input_schema.to_string(), &mut reader)
+                .unwrap();
+
+        // Parse the result.
+        let result_value: Value = serde_json::from_str(&result).unwrap();
+
+        // Verify integer key is preserved (no custom name).
+        assert!(result_value.get("0").is_some());
+
+        // Verify description is unchanged.
+        let param = result_value.get("0").unwrap();
+        assert_eq!(
+            param.get("description").unwrap().as_str().unwrap(),
+            "Boolean flag"
+        );
+
+        // Reset JSON_MODE.
+        JSON_MODE.store(false, Ordering::Relaxed);
+    }
+
+    #[test]
+    fn test_customize_output_with_mock_input() {
+        // Ensure JSON_MODE is off.
+        JSON_MODE.store(false, Ordering::Relaxed);
+
+        // Create output schema with one variant.
+        let output_schema = r#"{
+            "ok": {
+                "type": "variant",
+                "description": "Ok variant",
+                "fields": {
+                    "count": {
+                        "type": "u64",
+                        "description": "64-bit unsigned integer"
+                    }
+                }
+            }
+        }"#;
+
+        // Mock user input:
+        // 1. "Success case\n" for variant description
+        // 2. "The final count\n" for field description.
+        let mock_input = "Success case\nThe final count\n";
+        let mut reader = std::io::Cursor::new(mock_input.as_bytes());
+
+        // Call the function.
+        let result = customize_output_variant_and_field_descriptions_with_reader(
+            output_schema.to_string(),
+            &mut reader,
+        )
+        .unwrap();
+
+        // Parse the result.
+        let result_value: Value = serde_json::from_str(&result).unwrap();
+
+        // Verify variant description was updated.
+        let ok_variant = result_value.get("ok").unwrap();
+        assert_eq!(
+            ok_variant.get("description").unwrap().as_str().unwrap(),
+            "Success case"
+        );
+
+        // Verify field description was updated.
+        let fields = ok_variant.get("fields").unwrap();
+        let count_field = fields.get("count").unwrap();
+        assert_eq!(
+            count_field.get("description").unwrap().as_str().unwrap(),
+            "The final count"
+        );
+
+        // Reset JSON_MODE.
+        JSON_MODE.store(false, Ordering::Relaxed);
+    }
+
+    #[test]
+    fn test_customize_output_keep_defaults() {
+        // Ensure JSON_MODE is off.
+        JSON_MODE.store(false, Ordering::Relaxed);
+
+        // Create output schema.
+        let output_schema = r#"{
+            "err": {
+                "type": "variant",
+                "description": "Error variant",
+                "fields": {
+                    "message": {
+                        "type": "string",
+                        "description": "Error message"
+                    }
+                }
+            }
+        }"#;
+
+        // Mock user input: empty (press enter) for both variant and field to keep defaults.
+        let mock_input = "\n\n";
+        let mut reader = std::io::Cursor::new(mock_input.as_bytes());
+
+        // Call the function.
+        let result = customize_output_variant_and_field_descriptions_with_reader(
+            output_schema.to_string(),
+            &mut reader,
+        )
+        .unwrap();
+
+        // Parse the result.
+        let result_value: Value = serde_json::from_str(&result).unwrap();
+
+        // Verify descriptions are unchanged.
+        let err_variant = result_value.get("err").unwrap();
+        assert_eq!(
+            err_variant.get("description").unwrap().as_str().unwrap(),
+            "Error variant"
+        );
+
+        let fields = err_variant.get("fields").unwrap();
+        let message_field = fields.get("message").unwrap();
+        assert_eq!(
+            message_field.get("description").unwrap().as_str().unwrap(),
+            "Error message"
+        );
+
+        // Reset JSON_MODE.
+        JSON_MODE.store(false, Ordering::Relaxed);
+    }
+
+    #[test]
+    fn test_extract_over_tool_owner_cap_success() {
+        let mut rng = rand::thread_rng();
+        let nexus_objects = sui_mocks::mock_nexus_objects();
+
+        // Create a mock object vector with an OwnerCap<OverTool>.
+        let owner_cap_id = sui::types::Address::generate(&mut rng);
+        let owner_address = sui::types::Address::generate(&mut rng);
+
+        let objects = vec![sui::types::Object::new(
+            sui::types::ObjectData::Struct(
+                sui::types::MoveStruct::new(
+                    sui::types::StructTag::new(
+                        nexus_objects.primitives_pkg_id,
+                        sui::types::Identifier::from_static("owner_cap"),
+                        sui::types::Identifier::from_static("CloneableOwnerCap"),
+                        vec![],
+                    ),
+                    true,
+                    0,
+                    owner_cap_id.to_bcs().unwrap(),
+                )
+                .unwrap(),
+            ),
+            sui::types::Owner::Address(owner_address),
+            sui::types::Digest::generate(&mut rng),
+            1000,
+        )];
+
+        // Extract the owner cap.
+        let result = extract_over_tool_owner_cap(&objects, &nexus_objects);
+        assert!(result.is_ok());
+        assert_eq!(result.unwrap(), owner_cap_id);
+    }
+
+    #[test]
+    fn test_extract_over_tool_owner_cap_not_found() {
+        let nexus_objects = sui_mocks::mock_nexus_objects();
+
+        // Should fail because no owner cap is found.
+        let result = extract_over_tool_owner_cap(&[], &nexus_objects);
+        assert!(result.is_err());
+        assert!(result
+            .unwrap_err()
+            .to_string()
+            .contains("Could not find the OwnerCap<OverTool> object ID"));
+    }
+
+    #[tokio::test]
+    async fn test_generate_and_customize_schemas_integration() {
+        use crate::test_utils;
+
+        // Spin up the Sui instance.
+        let test_utils::containers::SuiInstance {
+            rpc_port,
+            faucet_port,
+            pg: _pg,
+            container: _container,
+            ..
+        } = test_utils::containers::setup_sui_instance().await;
+
+        let rpc_url = format!("http://127.0.0.1:{rpc_port}");
+        let faucet_url = format!("http://127.0.0.1:{faucet_port}/gas");
+
+        let mut rng = rand::thread_rng();
+
+        // Create a wallet and request some gas tokens.
+        let pk = sui::crypto::Ed25519PrivateKey::generate(&mut rng);
+        let addr = pk.public_key().derive_address();
+
+        test_utils::faucet::request_tokens(&faucet_url, addr)
+            .await
+            .expect("Failed to request tokens from faucet.");
+
+        let (gas_coin, _) = test_utils::gas::fetch_gas_coins(&rpc_url, addr)
+            .await
+            .expect("Failed to fetch gas coin.")
+            .into_iter()
+            .next()
+            .unwrap();
+
+        // Publish test onchain_tool package.
+        let response = test_utils::contracts::publish_move_package(
+            &pk,
+            &rpc_url,
+            "../sdk/tests/move/onchain_tool_test",
+            gas_coin,
+        )
+        .await;
+
+        let pkg_id = response
+            .objects
+            .iter()
+            .find_map(|c| match c.data() {
+                sui::types::ObjectData::Package(m) => Some(m.id),
+                _ => None,
+            })
+            .expect("Move package must be published");
+
+        // Enable JSON mode to skip interactive prompts.
+        JSON_MODE.store(true, Ordering::Relaxed);
+
+        let client = Arc::new(Mutex::new(
+            sui::grpc::Client::new(format!("http://127.0.0.1:{rpc_port}"))
+                .expect("Failed to create Sui gRPC client"),
+        ));
+
+        // Generate and customize schemas.
+        let result = generate_and_customize_schemas(
+            client,
+            pkg_id.to_string().parse().unwrap(),
+            "onchain_tool",
+        )
+        .await;
+
+        // Reset JSON mode.
+        JSON_MODE.store(false, Ordering::Relaxed);
+
+        // Should succeed.
+        assert!(result.is_ok());
+        let (input_schema, output_schema) = result.unwrap();
+
+        // Verify input schema is valid JSON.
+        let input_json: serde_json::Value =
+            serde_json::from_str(&input_schema).expect("Input schema should be valid JSON");
+        assert!(input_json.is_object());
+
+        // Verify output schema is valid JSON.
+        let output_json: serde_json::Value =
+            serde_json::from_str(&output_schema).expect("Output schema should be valid JSON");
+        assert!(output_json.is_object());
+
+        // Verify input schema has expected parameters (counter and increase_with).
+        // After skipping ProofOfUID and TxContext, we should have 2 parameters.
+        assert_eq!(input_json.as_object().unwrap().len(), 2);
+
+        // Verify output schema has expected variants.
+        let output_obj = output_json.as_object().unwrap();
+        assert!(output_obj.contains_key("ok") || output_obj.contains_key("err"));
+    }
+
+    #[tokio::test]
+    async fn test_save_tool_owner_caps_success() {
+        let mut rng = rand::thread_rng();
+        // Create a test FQN and object ID.
+        let fqn = "com.example.testtool@1".parse::<ToolFqn>().unwrap();
+        let over_tool_id = sui::types::Address::generate(&mut rng);
+
+        // Call save_tool_owner_caps.
+        let result = save_tool_owner_caps(fqn.clone(), over_tool_id).await;
+
+        // Should succeed.
+        assert!(result.is_ok());
+    }
+}
diff --git a/cli/src/tool/tool_set_invocation_cost.rs b/cli/src/tool/tool_set_invocation_cost.rs
index fa271be0..cd7ce692 100644
--- a/cli/src/tool/tool_set_invocation_cost.rs
+++ b/cli/src/tool/tool_set_invocation_cost.rs
@@ -1,52 +1,56 @@
 use {
-    crate::{command_title, display::json_output, loading, prelude::*, sui::*},
+    crate::{command_title, display::json_output, loading, notify_success, prelude::*, sui::*},
     nexus_sdk::transactions::tool,
 };
 
 /// Set the invocation cost in MIST for a tool based on its FQN.
 pub(crate) async fn set_tool_invocation_cost(
     tool_fqn: ToolFqn,
-    owner_cap: Option<sui::ObjectID>,
+    owner_cap: Option<sui::types::Address>,
     invocation_cost: u64,
-    sui_gas_coin: Option<sui::ObjectID>,
+    sui_gas_coin: Option<sui::types::Address>,
     sui_gas_budget: u64,
 ) -> AnyResult<(), NexusCliError> {
     command_title!("Setting '{invocation_cost}' invocation cost for tool '{tool_fqn}'");
 
-    // Load CLI configuration.
-    let mut conf = CliConf::load().await.unwrap_or_default();
+    let nexus_client = get_nexus_client(sui_gas_coin, sui_gas_budget).await?;
+    let signer = nexus_client.signer();
+    let gas_config = nexus_client.gas_config();
+    let address = signer.get_active_address();
+    let nexus_objects = &*nexus_client.get_nexus_objects();
+    let crawler = nexus_client.crawler();
 
-    // Nexus objects must be present in the configuration.
-    let objects = &get_nexus_objects(&mut conf).await?;
-
-    // Create wallet context, Sui client and find the active address.
-    let mut wallet = create_wallet_context(&conf.sui.wallet_path, conf.sui.net).await?;
-    let sui = build_sui_client(&conf.sui).await?;
-    let address = wallet.active_address().map_err(NexusCliError::Any)?;
-
-    // Fetch gas coin object.
-    let gas_coin = fetch_gas_coin(&sui, address, sui_gas_coin).await?;
-
-    // Fetch reference gas price.
-    let reference_gas_price = fetch_reference_gas_price(&sui).await?;
+    let conf = CliConf::load().await.unwrap_or_default();
 
     // Use the provided or saved `owner_cap` object ID and fetch the object.
-    let Some(owner_cap) = owner_cap.or(conf.tools.get(&tool_fqn).map(|t| t.over_gas)) else {
+    let Some(owner_cap) = owner_cap.or(conf.tools.get(&tool_fqn).and_then(|t| t.over_gas)) else {
         return Err(NexusCliError::Any(anyhow!(
             "No OwnerCap object ID found for tool '{tool_fqn}'."
         )));
     };
 
-    let owner_cap = fetch_object_by_id(&sui, owner_cap).await?;
+    let owner_cap = crawler
+        .get_object_metadata(owner_cap)
+        .await
+        .map(|resp| resp.object_ref())
+        .map_err(|e| {
+            NexusCliError::Any(anyhow!(
+                "Failed to fetch OwnerCap object metadata for '{owner_cap}': {e}"
+            ))
+        })?;
 
     // Craft the transaction.
     let tx_handle = loading!("Crafting transaction...");
 
-    let mut tx = sui::ProgrammableTransactionBuilder::new();
+    let mut tx = sui::tx::TransactionBuilder::new();
 
-    if let Err(e) =
-        tool::set_invocation_cost(&mut tx, objects, &tool_fqn, &owner_cap, invocation_cost)
-    {
+    if let Err(e) = tool::set_invocation_cost(
+        &mut tx,
+        nexus_objects,
+        &tool_fqn,
+        &owner_cap,
+        invocation_cost,
+    ) {
         tx_handle.error();
 
         return Err(NexusCliError::Any(e));
@@ -54,16 +58,33 @@ pub(crate) async fn set_tool_invocation_cost(
 
     tx_handle.success();
 
-    let tx_data = sui::TransactionData::new_programmable(
-        address,
-        vec![gas_coin.object_ref()],
-        tx.finish(),
-        sui_gas_budget,
-        reference_gas_price,
-    );
+    let mut gas_coin = gas_config.acquire_gas_coin().await;
+
+    tx.set_sender(address);
+    tx.set_gas_budget(gas_config.get_budget());
+    tx.set_gas_price(nexus_client.get_reference_gas_price());
+
+    tx.add_gas_objects(vec![sui::tx::Input::owned(
+        *gas_coin.object_id(),
+        gas_coin.version(),
+        *gas_coin.digest(),
+    )]);
 
-    // Sign and submit the TX.
-    let response = sign_and_execute_transaction(&sui, &wallet, tx_data).await?;
+    let tx = tx.finish().map_err(|e| NexusCliError::Any(e.into()))?;
+
+    let signature = signer.sign_tx(&tx).await.map_err(NexusCliError::Nexus)?;
+
+    let response = signer
+        .execute_tx(tx, signature, &mut gas_coin)
+        .await
+        .map_err(NexusCliError::Nexus)?;
+
+    gas_config.release_gas_coin(gas_coin).await;
+
+    notify_success!(
+        "Transaction digest: {digest}",
+        digest = response.digest.to_string().truecolor(100, 100, 100)
+    );
 
     json_output(&json!({ "digest": response.digest }))?;
 
diff --git a/cli/src/tool/tool_unregister.rs b/cli/src/tool/tool_unregister.rs
index 0281d8e5..e6a2bccc 100644
--- a/cli/src/tool/tool_unregister.rs
+++ b/cli/src/tool/tool_unregister.rs
@@ -1,13 +1,21 @@
 use {
-    crate::{command_title, confirm, display::json_output, loading, prelude::*, sui::*},
+    crate::{
+        command_title,
+        confirm,
+        display::json_output,
+        loading,
+        notify_success,
+        prelude::*,
+        sui::*,
+    },
     nexus_sdk::transactions::tool,
 };
 
 /// Unregister a Tool based on the provided FQN.
 pub(crate) async fn unregister_tool(
     tool_fqn: ToolFqn,
-    owner_cap: Option<sui::ObjectID>,
-    sui_gas_coin: Option<sui::ObjectID>,
+    owner_cap: Option<sui::types::Address>,
+    sui_gas_coin: Option<sui::types::Address>,
     sui_gas_budget: u64,
     skip_confirmation: bool,
 ) -> AnyResult<(), NexusCliError> {
@@ -19,38 +27,37 @@ pub(crate) async fn unregister_tool(
         );
     }
 
-    // Load CLI configuration.
-    let mut conf = CliConf::load().await.unwrap_or_default();
+    let nexus_client = get_nexus_client(sui_gas_coin, sui_gas_budget).await?;
+    let signer = nexus_client.signer();
+    let gas_config = nexus_client.gas_config();
+    let address = signer.get_active_address();
+    let nexus_objects = &*nexus_client.get_nexus_objects();
+    let crawler = nexus_client.crawler();
 
-    // Nexus objects must be present in the configuration.
-    let objects = &get_nexus_objects(&mut conf).await?;
-
-    // Create wallet context, Sui client and find the active address.
-    let mut wallet = create_wallet_context(&conf.sui.wallet_path, conf.sui.net).await?;
-    let sui = build_sui_client(&conf.sui).await?;
-    let address = wallet.active_address().map_err(NexusCliError::Any)?;
-
-    // Fetch gas coin object.
-    let gas_coin = fetch_gas_coin(&sui, address, sui_gas_coin).await?;
-
-    // Fetch reference gas price.
-    let reference_gas_price = fetch_reference_gas_price(&sui).await?;
+    let conf = CliConf::load().await.unwrap_or_default();
 
     // Use the provided or saved `owner_cap` object ID and fetch the object.
-    let Some(owner_cap) = owner_cap.or(conf.tools.get(&tool_fqn).map(|t| t.over_tool)) else {
+    let Some(owner_cap) = owner_cap.or(conf.tools.get(&tool_fqn).and_then(|t| t.over_gas)) else {
         return Err(NexusCliError::Any(anyhow!(
             "No OwnerCap object ID found for tool '{tool_fqn}'."
         )));
     };
 
-    let owner_cap = fetch_object_by_id(&sui, owner_cap).await?;
-
+    let owner_cap = crawler
+        .get_object_metadata(owner_cap)
+        .await
+        .map(|resp| resp.object_ref())
+        .map_err(|e| {
+            NexusCliError::Any(anyhow!(
+                "Failed to fetch OwnerCap object metadata for '{owner_cap}': {e}"
+            ))
+        })?;
     // Craft a TX to unregister the tool.
     let tx_handle = loading!("Crafting transaction...");
 
-    let mut tx = sui::ProgrammableTransactionBuilder::new();
+    let mut tx = sui::tx::TransactionBuilder::new();
 
-    if let Err(e) = tool::unregister(&mut tx, objects, &tool_fqn, &owner_cap) {
+    if let Err(e) = tool::unregister(&mut tx, nexus_objects, &tool_fqn, &owner_cap) {
         tx_handle.error();
 
         return Err(NexusCliError::Any(e));
@@ -58,16 +65,33 @@ pub(crate) async fn unregister_tool(
 
     tx_handle.success();
 
-    let tx_data = sui::TransactionData::new_programmable(
-        address,
-        vec![gas_coin.object_ref()],
-        tx.finish(),
-        sui_gas_budget,
-        reference_gas_price,
-    );
+    let mut gas_coin = gas_config.acquire_gas_coin().await;
+
+    tx.set_sender(address);
+    tx.set_gas_budget(gas_config.get_budget());
+    tx.set_gas_price(nexus_client.get_reference_gas_price());
 
-    // Sign and submit the TX.
-    let response = sign_and_execute_transaction(&sui, &wallet, tx_data).await?;
+    tx.add_gas_objects(vec![sui::tx::Input::owned(
+        *gas_coin.object_id(),
+        gas_coin.version(),
+        *gas_coin.digest(),
+    )]);
+
+    let tx = tx.finish().map_err(|e| NexusCliError::Any(e.into()))?;
+
+    let signature = signer.sign_tx(&tx).await.map_err(NexusCliError::Nexus)?;
+
+    let response = signer
+        .execute_tx(tx, signature, &mut gas_coin)
+        .await
+        .map_err(NexusCliError::Nexus)?;
+
+    gas_config.release_gas_coin(gas_coin).await;
+
+    notify_success!(
+        "Transaction digest: {digest}",
+        digest = response.digest.to_string().truecolor(100, 100, 100)
+    );
 
     json_output(&json!({ "digest": response.digest }))?;
 
diff --git a/cli/src/tool/tool_validate.rs b/cli/src/tool/tool_validate.rs
index b9d799e2..d4871e10 100644
--- a/cli/src/tool/tool_validate.rs
+++ b/cli/src/tool/tool_validate.rs
@@ -1,20 +1,13 @@
 use {
-    crate::{command_title, loading, prelude::*, tool::ToolIdent},
+    crate::{command_title, loading, prelude::*},
     nexus_sdk::types::ToolMeta,
     reqwest::StatusCode,
 };
 
-/// Validate either an off-chain or an on-chain tool.
-pub(crate) async fn validate_tool(ident: ToolIdent) -> AnyResult<ToolMeta, NexusCliError> {
-    match (ident.off_chain, ident.on_chain) {
-        (Some(url), None) => validate_off_chain_tool(url).await,
-        (None, Some(ident)) => validate_on_chain_tool(ident).await,
-        _ => unreachable!("Checked by clap"),
-    }
-}
-
 /// Validate an off-chain tool based on the provided URL.
-async fn validate_off_chain_tool(url: reqwest::Url) -> AnyResult<ToolMeta, NexusCliError> {
+pub(crate) async fn validate_off_chain_tool(
+    url: reqwest::Url,
+) -> AnyResult<ToolMeta, NexusCliError> {
     command_title!("Validating off-chain Tool at '{url}'");
 
     // Strip the trailing slash from the URL path.
@@ -94,7 +87,7 @@ async fn validate_off_chain_tool(url: reqwest::Url) -> AnyResult<ToolMeta, Nexus
 }
 
 /// Validate an on-chain tool based on the provided ident.
-async fn validate_on_chain_tool(_ident: String) -> AnyResult<ToolMeta, NexusCliError> {
+pub(crate) async fn validate_on_chain_tool(_ident: String) -> AnyResult<ToolMeta, NexusCliError> {
     todo!("TODO: <https://github.com/Talus-Network/nexus-next/issues/96>")
 }
 
@@ -178,41 +171,33 @@ mod tests {
         tokio::time::sleep(std::time::Duration::from_millis(100)).await;
 
         // No path with slash
-        let meta = validate_tool(ToolIdent {
-            off_chain: Some(reqwest::Url::parse("http://localhost:8042/").unwrap()),
-            on_chain: None,
-        })
-        .await;
+        let meta =
+            validate_off_chain_tool(reqwest::Url::parse("http://localhost:8042/").unwrap()).await;
         println!("{:?}", meta);
         assert!(meta.is_ok());
         let meta = meta.unwrap();
         assert_eq!(meta.fqn, fqn!("xyz.dummy.tool@1"));
 
         // No path no slash
-        let meta = validate_tool(ToolIdent {
-            off_chain: Some(reqwest::Url::parse("http://localhost:8042").unwrap()),
-            on_chain: None,
-        })
-        .await;
+        let meta =
+            validate_off_chain_tool(reqwest::Url::parse("http://localhost:8042").unwrap()).await;
         assert!(meta.is_ok());
         let meta = meta.unwrap();
         assert_eq!(meta.fqn, fqn!("xyz.dummy.tool@1"));
 
         // Path with slash
-        let meta = validate_tool(ToolIdent {
-            off_chain: Some(reqwest::Url::parse("http://localhost:8042/dummy/tool/").unwrap()),
-            on_chain: None,
-        })
+        let meta = validate_off_chain_tool(
+            reqwest::Url::parse("http://localhost:8042/dummy/tool/").unwrap(),
+        )
         .await;
         assert!(meta.is_ok());
         let meta = meta.unwrap();
         assert_eq!(meta.fqn, fqn!("xyz.dummy.tool@1"));
 
         // Path no slash
-        let meta = validate_tool(ToolIdent {
-            off_chain: Some(reqwest::Url::parse("http://localhost:8042/dummy/tool").unwrap()),
-            on_chain: None,
-        })
+        let meta = validate_off_chain_tool(
+            reqwest::Url::parse("http://localhost:8042/dummy/tool").unwrap(),
+        )
         .await;
         assert!(meta.is_ok());
         let meta = meta.unwrap();
diff --git a/cli/src/utils/secrets/aes_gcm_encryption.rs b/cli/src/utils/secrets/aes_gcm_encryption.rs
index 280b65ba..caae641e 100644
--- a/cli/src/utils/secrets/aes_gcm_encryption.rs
+++ b/cli/src/utils/secrets/aes_gcm_encryption.rs
@@ -1,7 +1,7 @@
 use {
     super::master_key_provider::MasterKeyProvider,
     aes_gcm::{
-        aead::{Aead, Key, KeyInit},
+        aead::{Aead, KeyInit},
         Aes256Gcm,
     },
     nexus_sdk::secret_core::{
@@ -21,7 +21,8 @@ impl EncryptionAlgo for AesGcmEncryption {
 
     fn encrypt(nonce: &[u8], plaintext: &[u8]) -> Result<Vec<u8>, SecretStoreError> {
         let key: Zeroizing<[u8; KEY_LEN]> = MasterKeyProvider.key()?;
-        let cipher = Aes256Gcm::new(Key::<Aes256Gcm>::from_slice(&*key));
+        let cipher =
+            Aes256Gcm::new_from_slice(&*key).map_err(|e| SecretStoreError::Crypto(Box::new(e)))?;
         let nonce_array: [u8; 12] = nonce
             .try_into()
             .map_err(|_| SecretStoreError::Crypto("Invalid nonce length".into()))?;
@@ -32,7 +33,8 @@ impl EncryptionAlgo for AesGcmEncryption {
 
     fn decrypt(nonce: &[u8], ciphertext: &[u8]) -> Result<Vec<u8>, SecretStoreError> {
         let key: Zeroizing<[u8; KEY_LEN]> = MasterKeyProvider.key()?;
-        let cipher = Aes256Gcm::new(Key::<Aes256Gcm>::from_slice(&*key));
+        let cipher =
+            Aes256Gcm::new_from_slice(&*key).map_err(|e| SecretStoreError::Crypto(Box::new(e)))?;
         let nonce_array: [u8; 12] = nonce
             .try_into()
             .map_err(|_| SecretStoreError::Crypto("Invalid nonce length".into()))?;
diff --git a/cli/src/utils/secrets/master_key.rs b/cli/src/utils/secrets/master_key.rs
index d2d1066b..74be1666 100644
--- a/cli/src/utils/secrets/master_key.rs
+++ b/cli/src/utils/secrets/master_key.rs
@@ -26,9 +26,18 @@ pub const KEY_LEN: usize = 32;
 pub const SALT_LEN: usize = 16;
 
 /// Argon2id default parameters (64 MiB, 4 passes, single thread).
+#[cfg(not(test))]
 const ARGON2_MEMORY_KIB: u32 = 64 * 1024;
+#[cfg(not(test))]
 const ARGON2_ITERATIONS: u32 = 4;
 
+/// Lighter Argon2 parameters used when building/running tests to keep the
+/// suite fast.
+#[cfg(test)]
+const ARGON2_MEMORY_KIB: u32 = 1024; // 1 MiB
+#[cfg(test)]
+const ARGON2_ITERATIONS: u32 = 1;
+
 // === error type ===
 
 #[derive(Debug, Error)]
diff --git a/cli/src/workflow/mod.rs b/cli/src/workflow/mod.rs
new file mode 100644
index 00000000..b8490689
--- /dev/null
+++ b/cli/src/workflow/mod.rs
@@ -0,0 +1,401 @@
+use {
+    crate::{error::NexusCliError, prelude::AnyResult},
+    anyhow::anyhow,
+    nexus_sdk::{
+        nexus::crawler::{Crawler, Map, Set},
+        sui,
+        types::{
+            hint_remote_fields,
+            json_to_nexus_data_map,
+            EncryptionMode,
+            PortsData,
+            StorageKind,
+            TypeName,
+        },
+    },
+    serde::Deserialize,
+    serde_json::Value,
+    std::collections::{HashMap, HashSet},
+};
+
+pub(crate) async fn fetch_encrypted_entry_ports(
+    crawler: &Crawler,
+    entry_group: String,
+    dag_id: &sui::types::Address,
+) -> AnyResult<HashMap<String, Vec<String>>, NexusCliError> {
+    #[derive(Clone, Debug, PartialEq, Eq, Hash, Deserialize)]
+    struct EntryPort {
+        name: String,
+        encrypted: bool,
+    }
+
+    type EntryGroups = Map<TypeName, Map<TypeName, Set<EntryPort>>>;
+
+    #[derive(Clone, Debug, Deserialize)]
+    struct Dag {
+        entry_groups: EntryGroups,
+    }
+
+    let result = crawler
+        .get_object::<Dag>(*dag_id)
+        .await
+        .map_err(|e| NexusCliError::Any(anyhow!(e)))?;
+
+    let key = TypeName {
+        name: entry_group.clone(),
+    };
+
+    let entry_group = result
+        .data
+        .entry_groups
+        .into_inner()
+        .remove(&key)
+        .ok_or_else(|| {
+            NexusCliError::Any(anyhow!("Entry group '{entry_group}' not found in DAG"))
+        })?;
+
+    Ok(entry_group
+        .into_inner()
+        .into_iter()
+        .filter_map(|(vertex, ports)| {
+            let encrypted_ports: Vec<String> = ports
+                .into_inner()
+                .into_iter()
+                .filter_map(|port| port.encrypted.then_some(port.name))
+                .collect();
+
+            (!encrypted_ports.is_empty()).then_some((vertex.name, encrypted_ports))
+        })
+        .collect())
+}
+
+/// Process entry ports: encrypt and/or store remotely as needed. `input` must
+/// be at least a 2-level JSON object (vertex -> port -> value).
+pub(crate) async fn process_entry_ports(
+    input: &Value,
+    preferred_remote_storage: Option<StorageKind>,
+    encrypt: &HashMap<String, Vec<String>>,
+    remote: &[String],
+    encryption_mode: EncryptionMode,
+) -> Result<HashMap<String, PortsData>, NexusCliError> {
+    let Some(vertices) = input.as_object() else {
+        return Err(NexusCliError::Any(anyhow!(
+            "Input JSON must be an object with vertex names as keys."
+        )));
+    };
+
+    let remote_handles: HashSet<String> = remote.iter().cloned().collect();
+    let mut result = HashMap::new();
+
+    for (vertex, data) in vertices {
+        let Some(ports) = data.as_object() else {
+            return Err(NexusCliError::Any(anyhow!(
+                "Input JSON for vertex '{vertex}' must be an object with port names as keys."
+            )));
+        };
+
+        // Figure out which ports need to be encrypted and stored remotely for
+        // this vertex.
+        let encrypt_fields = encrypt.get(vertex);
+        let remote_fields = ports
+            .iter()
+            .filter_map(|(port, _)| {
+                let handle = format!("{vertex}.{port}");
+                remote_handles.contains(&handle).then_some(port.clone())
+            })
+            .collect::<Vec<_>>();
+
+        // Convert this json into a map of port -> NexusData.
+        let nexus_data_map = json_to_nexus_data_map(
+            data,
+            encrypt_fields.unwrap_or(&vec![]),
+            &remote_fields,
+            preferred_remote_storage,
+            encryption_mode,
+        )
+        .map_err(NexusCliError::Any)?;
+
+        result.insert(vertex.clone(), PortsData::from_map(nexus_data_map));
+    }
+
+    // Hint the user if they should use remote storage and for what fields.
+    let mut flattened: serde_json::Map<String, Value> = serde_json::Map::new();
+    for (vertex, ports) in vertices {
+        let ports = ports
+            .as_object()
+            .expect("Input JSON for vertex should already be validated as an object");
+        for (port, data) in ports {
+            let handle = format!("{vertex}.{port}");
+            if remote_handles.contains(&handle) {
+                continue;
+            }
+            flattened.insert(handle, data.clone());
+        }
+    }
+
+    let flattened_json = Value::Object(flattened);
+    let remote_hints = hint_remote_fields(&flattened_json).unwrap_or_default();
+
+    if !remote_hints.is_empty() {
+        return Err(NexusCliError::Any(anyhow!(
+            "Some input fields must be stored remotely to fit within transaction size limits. Please add the following argument to your command:\n\n{command} {fields}",
+            command = "--remote",
+            fields = remote_hints.join(",")
+        )));
+    }
+
+    Ok(result)
+}
+#[cfg(test)]
+mod tests {
+    use {
+        super::*,
+        assert_matches::assert_matches,
+        mockito::{Server, ServerGuard},
+        nexus_sdk::{
+            test_utils::nexus_mocks,
+            types::{DataStorage, Storable, StorageConf},
+            walrus::{BlobObject, BlobStorage, NewlyCreated, StorageInfo},
+        },
+        serde_json::json,
+        std::{collections::HashMap, sync::Arc},
+    };
+
+    async fn setup_mock_server_and_conf() -> anyhow::Result<(ServerGuard, StorageConf)> {
+        let server = Server::new_async().await;
+        let server_url = server.url();
+
+        let storage_conf = StorageConf {
+            walrus_publisher_url: Some(server_url.clone()),
+            walrus_aggregator_url: Some(server_url),
+            walrus_save_for_epochs: Some(2),
+        };
+
+        Ok((server, storage_conf))
+    }
+
+    #[tokio::test]
+    async fn process_entry_ports_success_no_encrypt_no_remote() {
+        let input = json!({
+            "vertex1": {
+                "port1": "value1",
+                "port2": "value2"
+            }
+        });
+        let (_, storage_conf) = setup_mock_server_and_conf()
+            .await
+            .expect("Server must start");
+        let (session, _) = nexus_mocks::mock_session();
+        let encrypt = HashMap::new();
+        let remote = vec![];
+
+        let result = process_entry_ports(&input, None, &encrypt, &remote, EncryptionMode::Standard)
+            .await
+            .expect("Should succeed");
+
+        let vertex = result
+            .get("vertex1")
+            .expect("vertex1 missing")
+            .clone()
+            .commit_all(&storage_conf, Arc::clone(&session))
+            .await
+            .expect("commit_all failed");
+        let port1 = vertex.get("port1").expect("port1 missing");
+        let port2 = vertex.get("port2").expect("port2 missing");
+
+        assert_matches!(port1, DataStorage::Inline(_));
+        assert_eq!(port1.as_json(), &json!("value1"));
+        assert!(!port1.is_encrypted());
+
+        assert_matches!(port2, DataStorage::Inline(_));
+        assert_eq!(port2.as_json(), &json!("value2"));
+        assert!(!port2.is_encrypted());
+    }
+
+    #[tokio::test]
+    async fn process_entry_ports_encrypt_only() {
+        let input = json!({
+            "vertex1": {
+                "port1": "value1",
+                "port2": "value2"
+            }
+        });
+        let (_, storage_conf) = setup_mock_server_and_conf()
+            .await
+            .expect("Server must start");
+        let (session, _) = nexus_mocks::mock_session();
+        let mut encrypt = HashMap::new();
+        encrypt.insert("vertex1".to_string(), vec!["port1".to_string()]);
+        let remote = vec![];
+
+        let result = process_entry_ports(&input, None, &encrypt, &remote, EncryptionMode::Standard)
+            .await
+            .expect("Should succeed");
+
+        let vertex = result
+            .get("vertex1")
+            .expect("vertex1 missing")
+            .clone()
+            .commit_all(&storage_conf, Arc::clone(&session))
+            .await
+            .expect("commit_all failed");
+        let port1 = vertex.get("port1").expect("port1 missing");
+        let port2 = vertex.get("port2").expect("port2 missing");
+
+        assert!(port1.is_encrypted(), "port1 should be encrypted");
+        assert!(!port2.is_encrypted(), "port2 should not be encrypted");
+    }
+
+    #[tokio::test]
+    async fn process_entry_ports_remote_only() {
+        let input = json!({
+            "vertex1": {
+                "port1": "value1",
+                "port2": "value2"
+            }
+        });
+        let (mut server, storage_conf) = setup_mock_server_and_conf()
+            .await
+            .expect("Server must start");
+        let (session, _) = nexus_mocks::mock_session();
+        let encrypt = HashMap::new();
+        let remote = vec!["vertex1.port1".to_string()];
+
+        let mock_put_response = StorageInfo {
+            newly_created: Some(NewlyCreated {
+                blob_object: BlobObject {
+                    blob_id: "json_blob_id".to_string(),
+                    id: "json_object_id".to_string(),
+                    storage: BlobStorage { end_epoch: 200 },
+                },
+            }),
+            already_certified: None,
+        };
+
+        let mock_put = server
+            .mock("PUT", "/v1/blobs?epochs=2")
+            .with_status(200)
+            .with_header("content-type", "application/json")
+            .with_body(serde_json::to_string(&mock_put_response).expect("serialize"))
+            .create_async()
+            .await;
+
+        let result = process_entry_ports(&input, None, &encrypt, &remote, EncryptionMode::Standard)
+            .await
+            .expect("Should succeed");
+
+        let vertex = result
+            .get("vertex1")
+            .expect("vertex1 missing")
+            .clone()
+            .commit_all(&storage_conf, Arc::clone(&session))
+            .await
+            .expect("commit_all failed");
+        let port1 = vertex.get("port1").expect("port1 missing");
+        let port2 = vertex.get("port2").expect("port2 missing");
+
+        assert_matches!(port1, DataStorage::Walrus(_));
+        assert_matches!(port2, DataStorage::Inline(_));
+
+        mock_put.assert_async().await;
+    }
+
+    #[tokio::test]
+    async fn process_entry_ports_encrypt_and_remote() {
+        let input = json!({
+            "vertex1": {
+                "port1": "value1",
+                "port2": "value2"
+            }
+        });
+        let (mut server, storage_conf) = setup_mock_server_and_conf()
+            .await
+            .expect("Server must start");
+        let (session, _) = nexus_mocks::mock_session();
+        let mut encrypt = HashMap::new();
+        encrypt.insert("vertex1".to_string(), vec!["port1".to_string()]);
+        let remote = vec!["vertex1.port1".to_string()];
+
+        let mock_put_response = StorageInfo {
+            newly_created: Some(NewlyCreated {
+                blob_object: BlobObject {
+                    blob_id: "json_blob_id".to_string(),
+                    id: "json_object_id".to_string(),
+                    storage: BlobStorage { end_epoch: 200 },
+                },
+            }),
+            already_certified: None,
+        };
+
+        let mock_put = server
+            .mock("PUT", "/v1/blobs?epochs=2")
+            .with_status(200)
+            .with_header("content-type", "application/json")
+            .with_body(serde_json::to_string(&mock_put_response).expect("serialize"))
+            .create_async()
+            .await;
+
+        let result = process_entry_ports(&input, None, &encrypt, &remote, EncryptionMode::Standard)
+            .await
+            .expect("Should succeed");
+
+        let vertex = result
+            .get("vertex1")
+            .expect("vertex1 missing")
+            .clone()
+            .commit_all(&storage_conf, Arc::clone(&session))
+            .await
+            .expect("commit_all failed");
+        let port1 = vertex.get("port1").expect("port1 missing");
+        let port2 = vertex.get("port2").expect("port2 missing");
+
+        assert!(port1.is_encrypted(), "port1 should be encrypted");
+        assert!(matches!(port1, DataStorage::Walrus(_)), "port1 remote");
+        assert!(!port2.is_encrypted(), "port2 should not be encrypted");
+        assert_matches!(port2, DataStorage::Inline(_));
+
+        mock_put.assert_async().await;
+    }
+
+    #[tokio::test]
+    async fn process_entry_ports_missing_remote_hint() {
+        let input = json!({
+            "vertex1": {
+                "port1": "a".repeat(20_000),
+            }
+        });
+        let encrypt = HashMap::new();
+        let remote = vec![];
+
+        let result =
+            process_entry_ports(&input, None, &encrypt, &remote, EncryptionMode::Standard).await;
+
+        assert_matches!(result, Err(NexusCliError::Any(_)));
+    }
+
+    #[tokio::test]
+    async fn process_entry_ports_invalid_input_not_object() {
+        let input = json!("not an object");
+        let encrypt = HashMap::new();
+        let remote = vec![];
+
+        let result =
+            process_entry_ports(&input, None, &encrypt, &remote, EncryptionMode::Standard).await;
+
+        assert_matches!(result, Err(NexusCliError::Any(_)));
+    }
+
+    #[tokio::test]
+    async fn process_entry_ports_invalid_vertex_not_object() {
+        let input = json!({
+            "vertex1": "not an object"
+        });
+        let encrypt = HashMap::new();
+        let remote = vec![];
+
+        let result =
+            process_entry_ports(&input, None, &encrypt, &remote, EncryptionMode::Standard).await;
+
+        assert_matches!(result, Err(NexusCliError::Any(_)));
+    }
+}
diff --git a/codecov.yml b/codecov.yml
index ff261639..d0f0b570 100644
--- a/codecov.yml
+++ b/codecov.yml
@@ -35,6 +35,7 @@ coverage:
         informational: false
         paths:
           - "!cli/"
+          - "!sdk/src/test_utils/"
 
 component_management:
   individual_components:
diff --git a/docs/cli.md b/docs/cli.md
index 7ffe30d5..426ef5ab 100644
--- a/docs/cli.md
+++ b/docs/cli.md
@@ -20,13 +20,13 @@ Set of commands for managing Tools.
 
 ---
 
-**`nexus tool new <name> --template <template>`**
+**`nexus tool new --name <name> --template <template>`**
 
 Create a new Tool scaffolding in a folder called `<name>`. Which files are generated is determined by the `--template` flag. I propose having `templates/tools/<template>.template` files that contain the Tool skeleton files. For example for `rust` it'd be a `Cargo.toml` with the `nexus-toolkit` dependency, and a `src/main.rs` file that shows a basic use case of the crate.
 
 ---
 
-**`nexus tool validate --off-chain <url>`**
+**`nexus tool validate off-chain --url <url>`**
 
 Validate an off-chain Nexus Tool on the provided URL. This command checks whether the URL hosts a valid Nexus Tool interface:
 
@@ -42,7 +42,7 @@ This command should also check that the URL is accessible by the Leader node. It
 
 ---
 
-**`nexus tool validate --on-chain <ident>`**
+**`nexus tool validate on-chain --ident <ident>`**
 
 {% hint style="warning" %}
 The specific design for onchain tools is still in progress and as a result the implementation is not yet present. When running the command, it will panic.
@@ -50,7 +50,7 @@ The specific design for onchain tools is still in progress and as a result the i
 
 ---
 
-**`nexus tool register --off-chain <url> --invocation-cost [mist] --collateral-coin [object_id] [--batch] [--no-save]`**
+**`nexus tool register offchain --url <url> --invocation-cost [mist] --collateral-coin [object_id] [--batch] [--no-save]`**
 
 Command that makes a request to `GET <url>/meta` to fetch the Tool definition and then submits a TX to our Tool Registry. It also locks the collateral and sets the single invocation cost of the Tool which defaults to 0 MIST.
 
@@ -70,7 +70,7 @@ Tool registration is currently restricted during the beta phase. To register you
 
 ---
 
-**`nexus tool register --on-chain <ident>`**
+**`nexus tool register on-chain --package <ADDRESS> --module <MODULE> --tool-fqn <FQN> --description <DESCRIPTION> --witness-id <OBJECT_ID>`**
 
 {% hint style="warning" %}
 The specific design for onchain tools is still in progress and as a result the implementation is not yet present. When running the command, it will panic.
@@ -162,7 +162,7 @@ This command requires that a wallet is connected to the CLI...
 
 ---
 
-**`nexus dag execute --dag-id <id> --input-json <data> --entry-group [group] --remote [field1,field2,...] [--inspect]`**
+**`nexus dag execute --dag-id <id> --input-json <data> --entry-group [group] --remote [field1,field2,...] [--priority-fee-per-gas-unit <mist>] [--inspect]`**
 
 Execute a DAG with the provided `<id>`. This command also accepts an entry `<group>` of vertices to be invoked. Find out more about entry groups in [[Package: Workflow]]. Entry `<group>` defaults to a starndardized `_default_group` string.
 
@@ -194,6 +194,146 @@ Inspects a DAG execution process based on the provided `DAGExecution` object ID
 
 ---
 
+### `nexus scheduler`
+
+Manage scheduler tasks, occurrences, and periodic schedules.
+
+#### Concepts
+
+- **Task**: owned on-chain object that bundles metadata, policies, and lifecycle state (active/paused/canceled):
+  - an **execution policy** (“what to do”): today this is “begin DAG execution”, but tasks are designed to support additional execution types in the future
+  - a **constraints policy** (“when it may run”): defines when the task is eligible to execute. In the current scheduler this eligibility is time-based and expressed via **occurrences** (start + optional deadline windows) produced by either queue-based scheduling or periodic scheduling
+- In other words: the scheduler is task/schedule/occurrence oriented; DAG execution is just the current default execution policy.
+- **Queue-based scheduling**: you enqueue one-off **occurrences** for a task (as many as you want). This is intentionally generic: by enqueueing occurrences at different times (and with different priorities), you can implement custom strategies such as delayed runs, retries, backoff, and more.
+- **Periodic scheduling**: you configure a repeating schedule (first start + period, plus optional deadline window and max iterations). The scheduler produces occurrences automatically based on that config.
+- **Occurrence**: an eligibility window for a single task run. An occurrence carries a start time (or start offset), optional deadline window, and `priority_fee_per_gas_unit` (ordering/pricing signal). When the window is open and the occurrence is consumed, the task’s execution policy runs once. Ordering is deterministic: earlier start wins; ties break on higher `priority_fee_per_gas_unit`; then FIFO.
+- Each eligible (consumed) occurrence triggers one run of the task’s execution policy: periodic tasks run the same execution periodically, and queue tasks run it once per enqueued occurrence.
+- Each run is independent: the scheduler does not automatically pass outputs/data from one run to the next. If you need stateful behavior across runs, persist and manage that state externally.
+
+---
+
+**`nexus scheduler task create --dag-id <id> [--entry-group <group>] [--input-json <json>] [--remote vertex.port,...] [--metadata key=value ...] [--execution-priority-fee-per-gas-unit <mist>] [--schedule-start-ms <ms> | --schedule-start-offset-ms <ms>] [--schedule-deadline-offset-ms <ms>] [--schedule-priority-fee-per-gas-unit <mist>] [--generator queue|periodic]`**
+
+Creates a new scheduler task tied to the specified DAG. Key options:
+
+- `--entry-group` points to the DAG entry function and defaults to `_default_group`.
+- `--input-json` provides inline input data; `--remote vertex.port,...` forces specific inputs to be uploaded to the configured remote storage instead of inlining them on-chain.
+- `--metadata key=value` attaches arbitrary metadata entries and replaces any existing entries if the command is re-run.
+- `--execution-priority-fee-per-gas-unit` sets the priority fee for future DAG executions launched by the task.
+- `--schedule-start-ms` supplies an absolute first-occurrence timestamp (milliseconds since epoch) while `--schedule-start-offset-ms` uses the current Sui clock as the base; the two switches are mutually exclusive.
+- `--schedule-deadline-offset-ms` sets the completion window relative to whichever start time was selected, and `--schedule-priority-fee-per-gas-unit` sets the priority fee for that initial occurrence.
+- `--generator` chooses the generator responsible for future occurrences (`queue` by default, `periodic` to enable recurring schedules).
+
+Initial schedule arguments (`--schedule-*`) are only valid for queue-based tasks. Selecting `--generator periodic` prepares the task for periodic execution, but you must configure the recurring schedule separately via `nexus scheduler periodic set`.
+
+Data for encrypted entry ports is automatically encrypted when a session is available.
+
+{% hint style="info" %}
+This command requires that a wallet is connected to the CLI and holds sufficient SUI for gas.
+{% endhint %}
+
+---
+
+**`nexus scheduler task inspect --task-id <id>`**
+
+Fetches the on-chain task object, prints high-level metadata (owner, metadata entries, payload sizes), and emits a JSON payload containing the raw task structure for tooling.
+
+---
+
+**`nexus scheduler task metadata --task-id <id> --metadata key=value [...]`**
+
+Replaces all task metadata entries with the provided key/value pairs.
+
+{% hint style="info" %}
+This command requires that a wallet is connected to the CLI and holds sufficient SUI for gas.
+{% endhint %}
+
+---
+
+**`nexus scheduler task pause|resume|cancel --task-id <id>`**
+
+Mutates the scheduling state for a task. `pause` and `resume` toggle consumption of occurrences, while `cancel` clears pending occurrences and permanently disables scheduling.
+
+{% hint style="info" %}
+These commands require that a wallet is connected to the CLI and holds sufficient SUI for gas.
+{% endhint %}
+
+---
+
+**`nexus scheduler occurrence add --task-id <id> [--start-ms <ms> | --start-offset-ms <ms>] [--deadline-offset-ms <ms>] [--priority-fee-per-gas-unit <mist>]`**
+
+Schedules a one-off occurrence for the task. `--start-ms` and `--start-offset-ms` are mutually exclusive and control when the occurrence enters the queue (absolute milliseconds or an offset from the current Sui clock). Deadlines are expressed only as offsets from that start time, and `--priority-fee-per-gas-unit` adjusts the priority fee applied to the queued occurrence.
+
+{% hint style="info" %}
+This command requires that a wallet is connected to the CLI and holds sufficient SUI for gas.
+{% endhint %}
+
+---
+
+**`nexus scheduler periodic set --task-id <id> --first-start-ms <ms> --period-ms <ms> [--deadline-offset-ms <ms>] [--max-iterations <count>] [--priority-fee-per-gas-unit <mist>]`**
+
+Configures or updates a periodic schedule for the task. `--first-start-ms` pins the next execution to an absolute timestamp (milliseconds since epoch), `--period-ms` defines the spacing between subsequent occurrences, `--deadline-offset-ms` applies the same completion window after every generated start, `--max-iterations` limits how many future occurrences may be emitted automatically (omit for infinite), and `--priority-fee-per-gas-unit` sets the priority fee charged for each periodic occurrence.
+
+{% hint style="info" %}
+This command requires that a wallet is connected to the CLI and holds sufficient SUI for gas.
+{% endhint %}
+
+---
+
+**`nexus scheduler periodic disable --task-id <id>`**
+
+Removes the periodic schedule while leaving any existing sporadic occurrences untouched.
+
+{% hint style="info" %}
+This command requires that a wallet is connected to the CLI and holds sufficient SUI for gas.
+{% endhint %}
+
+### `nexus crypto`
+
+Set of commands for managing the CLI’s encrypted secrets (master key, passphrase, identity key) and establishing secure sessions that power DAG data encryption.
+
+---
+
+**`nexus crypto auth [--sui-gas-coin <object_id>] [--sui-gas-budget <mist>]`**
+
+Runs the two-step handshake with the Nexus network to claim a pre-key, perform X3DH with your local identity key, and store a fresh Double Ratchet session on disk. The claimed pre-key bundle is what enables the CLI to complete a Signal-style secure session with the network: X3DH bootstraps shared secrets, and the Double Ratchet derived from that bundle encrypts every DAG payload going forward. The command returns both claim/associate transaction digests and prints the initial message in JSON format, enabling you to audit the handshake.
+
+Before sending the associate transaction, the CLI automatically generates an identity key if one is missing and persists the session in `~/.nexus/crypto.toml`. All subsequent `nexus dag` commands load that session to encrypt entry-port payloads or decrypt remote results, so run `auth` whenever you rotate keys or see “No active sessions found.”
+
+{% hint style="info" %}
+This command requires that a wallet is connected to the CLI and spends gas for **two** programmable transactions. Use `--sui-gas-coin` / `--sui-gas-budget` if you need explicit control.
+{% endhint %}
+
+---
+
+**`nexus crypto generate-identity-key`**
+
+Creates a brand-new long-term identity key and stores it (encrypted) inside `~/.nexus/crypto.toml`. Because peers can no longer trust sessions tied to the previous identity, the CLI makes it clear that all stored sessions become invalid. Run `nexus crypto auth` immediately after to populate a replacement session.
+
+---
+
+**`nexus crypto init-key [--force]`**
+
+Generates a random 32‑byte master key with [`OsRng`](https://docs.rs/rand/latest/rand/rngs/struct.OsRng.html) and writes it to the OS keyring under the `nexus-cli-store/master-key` entry. The master key controls access to every encrypted field (`Secret<T>`) in the CLI configuration. Rotating it without also wiping the encrypted data would leave the ciphertext inaccessible, so this command automatically truncates the cryptographic configuration after a successful write.
+
+Use `--force` to overwrite an existing raw key or stored passphrase; doing so deletes all saved sessions and identity material because it can no longer be decrypted.
+
+---
+
+**`nexus crypto set-passphrase [--stdin] [--force]`**
+
+Stores a user-provided passphrase in the OS keyring (`nexus-cli-store/passphrase`) and derives the same 32‑byte master key via Argon2id whenever secrets need to be decrypted. By default the command prompts interactively; `--stdin` allows piping from scripts or CI.
+
+Like `init-key`, it refuses to overwrite an existing persistent key unless `--force`. Empty or whitespace-only passphrases are rejected to avoid unusable configs.
+
+---
+
+**`nexus crypto key-status`**
+
+Reports where the current master key will be loaded from, following the same priority order as the runtime resolver: `NEXUS_CLI_STORE_PASSPHRASE` environment variable, keyring passphrase entry, or raw key entry. If a raw key is in use the CLI prints the first 8 hex characters so you can distinguish multiple installations; otherwise it notes the source or that no persistent key exists yet.
+
+---
+
 ### `nexus gas`
 
 Set of commands to manage Nexus gas budgets and tickets.
diff --git a/docs/client.md b/docs/client.md
index 52bcd079..461745e2 100644
--- a/docs/client.md
+++ b/docs/client.md
@@ -8,14 +8,17 @@ The [`NexusClient`] provides a high-level interface for interacting with Nexus.
 
 The [`NexusClient`] provides access to:
 
-- [`GasActions`] — manage gas coins and budgets
-- [`CryptoActions`] — perform cryptographic handshakes with Nexus
-- [`WorkflowActions`] — publish and execute workflows (DAGs)
+- [`GasActions`]: manage gas coins and budgets
+- [`CryptoActions`]: perform cryptographic handshakes with Nexus
+- [`WorkflowActions`]: publish and execute workflows (DAGs)
+- [`SchedulerActions`]: create and manage scheduler tasks, occurrences, and periodic schedules
 
-You can initialize a `NexusClient` via [`NexusClient::builder()`] using either:
+You can initialize a `NexusClient` via [`NexusClient::builder()`] with:
 
-- a **Sui wallet context**, or
-- a **Secret mnemonic and Sui client**
+- a Sui **ed25519 private key**
+- an RPC URL (and optional GraphQL URL for event fetching)
+- one or more gas coins + a gas budget
+- the on-chain [`NexusObjects`]
 
 ---
 
@@ -28,29 +31,9 @@ use nexus_sdk::nexus::client::NexusClient;
 async fn main() -> anyhow::Result<()> {
     // Build the Nexus client
     let client = NexusClient::builder()
-        .with_wallet_context(/* your `sui_sdk::wallet_context::WalletContext */)
-        .with_gas(vec![/* your gas coins */], 10_000_000)?
-        .with_nexus_objects(/* your `nexus_sdk::types::NexusObjects` */)
-        .build()
-        .await?;
-
-    println!("✅ Nexus client initialized!");
-
-    Ok(())
-}
-```
-
-Alternatively, you can initialize using a mnemonic:
-
-```rust
-use nexus_sdk::nexus::client::NexusClient;
-
-#[tokio::main]
-async fn main() -> anyhow::Result<()> {
-    // Build the Nexus client
-    let client = NexusClient::builder()
-        .with_mnemonic(/* secret mnemonic */, /* your `sui_sdk::SuiClient` */)?
-        .with_gas(vec![/* your gas coins */], 10_000_000)?
+        .with_rpc_url(/* your Sui RPC URL */)
+        .with_private_key(/* Your wallet private key */)
+        .with_gas(vec![/* your gas coins */], 10_000_000)
         .with_nexus_objects(/* your `nexus_sdk::types::NexusObjects` */)
         .build()
         .await?;
@@ -65,12 +48,9 @@ async fn main() -> anyhow::Result<()> {
 
 ## 🔑 Signer
 
-### Supported Signer Types
+### Signing Mechanism
 
-| Type               | Description                                                       |
-| ------------------ | ----------------------------------------------------------------- |
-| `Signer::Wallet`   | Uses a local [`WalletContext`] for signing transactions           |
-| `Signer::Mnemonic` | Uses a [`SuiClient`] + in-memory keystore derived from a mnemonic |
+The `Signer` struct accepts a [`sui::crypto::Ed25519PrivateKey`] and is responsible for signing and executing transactions on behalf of the active wallet address.
 
 ### Key Public Behaviors
 
@@ -88,9 +68,9 @@ Nexus gas budget is managed through the [`GasActions`] struct.
 ### Add Budget
 
 ```rust
-use nexus_sdk::nexus::client::NexusClient;
+use nexus_sdk::{nexus::client::NexusClient, sui};
 
-let coin_object_id = sui_types::base_types::ObjectID::random();
+let coin_object_id: sui::types::Address = /* your coin object ID */;
 
 let result = nexus_client.gas().add_budget(coin_object_id).await?;
 
@@ -105,7 +85,7 @@ println!("Gas budget added in tx: {:?}", result.tx_digest);
 
 **Returns:**
 
-[`AddBudgetResult`] — includes the transaction digest.
+[`AddBudgetResult`]: includes the transaction digest.
 
 ---
 
@@ -138,7 +118,7 @@ assert!(handshake.session);
 
 **Returns:**
 
-[`HandshakeResult`] — includes session data and transaction digests for claim and association steps.
+[`HandshakeResult`]: includes session data and transaction digests for claim and association steps.
 
 ---
 
@@ -165,7 +145,7 @@ println!("Published DAG ID: {:?}", publish_result.dag_object_id);
 
 **Returns:**
 
-[`PublishResult`] — includes the transaction digest and DAG object ID.
+[`PublishResult`]: includes the transaction digest and DAG object ID.
 
 ---
 
@@ -206,7 +186,7 @@ println!("Execution object ID: {:?}", execute_result.execution_object_id);
 
 **Returns:**
 
-[`ExecuteResult`] — includes the transaction digest and execution object ID.
+[`ExecuteResult`]: includes the transaction digest and execution object ID.
 
 ---
 
@@ -244,18 +224,174 @@ println!("✅ Execution finished successfully!");
 
 **Returns:**
 
-[`InspectExecutionResult`] — includes an event stream and a poller handle.
+[`InspectExecutionResult`]: includes an event stream and a poller handle.
+
+---
+
+## ⏱️ Scheduler Actions
+
+The [`SchedulerActions`] API allows you to create and manage **on-chain scheduler tasks**.
+
+A scheduler task is split into:
+
+- an **execution policy** (“what to run”): today this is “begin DAG execution”, but tasks are designed to support additional execution types in the future
+- a **constraints policy** (“when it may run”): defines when the task is eligible to execute. In the current scheduler this eligibility is time-based and expressed via **occurrences** (start + optional deadline windows) produced by either queue-based scheduling or periodic scheduling
+
+The scheduler APIs are task/schedule/occurrence oriented; starting DAG executions is just the current default execution policy.
+
+Tasks also carry metadata and lifecycle state (active/paused/canceled), which you can update via `update_metadata` and `set_task_state`.
+
+An **occurrence** is an eligibility window for a single task run (start time + optional deadline + `priority_fee_per_gas_unit`). When multiple occurrences are eligible, ordering is deterministic: earlier start wins; ties break on higher `priority_fee_per_gas_unit`; then FIFO.
+
+Each eligible (consumed) occurrence triggers one run of the task’s execution policy. This means the same execution definition can run multiple times:
+
+- **Periodic tasks**: the scheduler generates occurrences automatically from a `(first_start_ms, period_ms, …)` config, so the same execution runs periodically.
+- **Queue tasks**: you can enqueue any number of occurrences; the task’s execution runs once per occurrence.
+
+Each run is independent: the scheduler does not automatically pass outputs/data from one run to the next. If you need stateful behavior across runs (e.g., chaining results, retries with state, counters/backoff), persist and manage that state externally.
+
+Queue-based scheduling is intentionally generic: by enqueueing occurrences at different times (and with different priorities), you can implement delayed runs, retries, backoff, and other custom strategies.
+
+### 1. Create a Queue Task
+
+```rust
+use nexus_sdk::{
+    nexus::scheduler::{CreateTaskParams, GeneratorKind},
+    types::{NexusData, DEFAULT_ENTRY_GROUP},
+};
+use std::collections::HashMap;
+
+let input_data = HashMap::from([(
+    "entry_vertex".to_string(),
+    HashMap::from([(
+        "input_port".to_string(),
+        NexusData::new_inline(serde_json::json!({"hello": "world"})).commit_inline_plain(),
+    )]),
+)]);
+
+let queue_task = nexus_client
+    .scheduler()
+    .create_task(CreateTaskParams {
+        dag_id: publish_result.dag_object_id,
+        entry_group: DEFAULT_ENTRY_GROUP.to_string(),
+        input_data,
+        metadata: vec![("env".into(), "demo".into())],
+        execution_priority_fee_per_gas_unit: 0,
+        initial_schedule: None,
+        generator: GeneratorKind::Queue,
+    })
+    .await?;
+
+println!("Queue task ID: {:?}", queue_task.task_id);
+```
+
+Queue-based tasks can enqueue the first occurrence at creation time by passing `initial_schedule: Some(OccurrenceRequest::new(...))`.
+
+### 2. Enqueue a One-Off Occurrence
+
+```rust
+use nexus_sdk::nexus::scheduler::OccurrenceRequest;
+
+let occurrence = OccurrenceRequest::new(
+    Some(/* start_ms */),
+    None, // deadline_ms
+    None, // start_offset_ms
+    Some(/* deadline_offset_ms */),
+    0,    // priority_fee_per_gas_unit
+    true, // require_start
+)?;
+
+let scheduled = nexus_client
+    .scheduler()
+    .add_occurrence(queue_task.task_id, occurrence)
+    .await?;
+
+println!("Occurrence queued in tx: {:?}", scheduled.tx_digest);
+```
+
+### 3. Create a Periodic Task and Configure Scheduling
+
+```rust
+use nexus_sdk::{
+    nexus::scheduler::{CreateTaskParams, GeneratorKind, PeriodicScheduleConfig},
+    types::{NexusData, DEFAULT_ENTRY_GROUP},
+};
+use std::collections::HashMap;
+
+let input_data = HashMap::from([(
+    "entry_vertex".to_string(),
+    HashMap::from([(
+        "input_port".to_string(),
+        NexusData::new_inline(serde_json::json!({"hello": "world"})).commit_inline_plain(),
+    )]),
+)]);
+
+let periodic_task = nexus_client
+    .scheduler()
+    .create_task(CreateTaskParams {
+        dag_id: publish_result.dag_object_id,
+        entry_group: DEFAULT_ENTRY_GROUP.to_string(),
+        input_data,
+        metadata: vec![("env".into(), "demo".into())],
+        execution_priority_fee_per_gas_unit: 0,
+        initial_schedule: None,
+        generator: GeneratorKind::Periodic,
+    })
+    .await?;
+
+nexus_client
+    .scheduler()
+    .configure_periodic(
+        periodic_task.task_id,
+        PeriodicScheduleConfig {
+            first_start_ms: /* absolute timestamp */,
+            period_ms: /* period in milliseconds */,
+            deadline_offset_ms: None,
+            max_iterations: None,
+            priority_fee_per_gas_unit: 0,
+        },
+    )
+    .await?;
+
+nexus_client
+    .scheduler()
+    .disable_periodic(periodic_task.task_id)
+    .await?;
+```
+
+### 4. Update Task Metadata
+
+```rust
+let updated = nexus_client
+    .scheduler()
+    .update_metadata(queue_task.task_id, vec![("key".into(), "value".into())])
+    .await?;
+
+println!("Metadata updated in tx: {:?}", updated.tx_digest);
+```
+
+### 5. Pause / Resume / Cancel a Task
+
+```rust
+use nexus_sdk::nexus::scheduler::TaskStateAction;
+
+nexus_client
+    .scheduler()
+    .set_task_state(queue_task.task_id, TaskStateAction::Pause)
+    .await?;
+```
 
 ---
 
 ## 🧱 Module Summary
 
-| Module            | Purpose                                                 |
-| ----------------- | ------------------------------------------------------- |
-| `nexus::client`   | Core client, builder, signer, gas management            |
-| `nexus::crypto`   | Cryptographic operations (X3DH, sessions, handshakes)   |
-| `nexus::gas`      | Gas management for Nexus workflows                      |
-| `nexus::workflow` | DAG workflow publishing, execution, and event streaming |
+| Module             | Purpose                                                 |
+| ------------------ | ------------------------------------------------------- |
+| `nexus::client`    | Core client, builder, signer, gas management            |
+| `nexus::crypto`    | Cryptographic operations (X3DH, sessions, handshakes)   |
+| `nexus::gas`       | Gas management for Nexus workflows                      |
+| `nexus::workflow`  | DAG workflow publishing, execution, and event streaming |
+| `nexus::scheduler` | Scheduler tasks, occurrences, and periodic schedules    |
 
 ---
 
diff --git a/docs/guides/dag-construction.md b/docs/guides/dag-construction.md
index 7ae1990c..6deea857 100644
--- a/docs/guides/dag-construction.md
+++ b/docs/guides/dag-construction.md
@@ -246,6 +246,6 @@ For examples of invalid DAGs and common mistakes to avoid (especially regarding
 <!-- List of references -->
 
 [nexus-next-workflow]: ../../nexus-next/packages/workflow.md
-[example-dags]: https://github.com/Talus-Network/nexus-sdk/tree/v0.3.0/sdk/src/dag/_dags
+[example-dags]: https://github.com/Talus-Network/nexus-sdk/tree/v0.5.0/sdk/src/dag/_dags
 [nexus-cli]: ../cli.md
 [looping]: ../../nexus-next/flow-controls/looping.md
diff --git a/docs/guides/onchain-tool-development.md b/docs/guides/onchain-tool-development.md
new file mode 100644
index 00000000..04255c94
--- /dev/null
+++ b/docs/guides/onchain-tool-development.md
@@ -0,0 +1,376 @@
+# Onchain Tool Development Guide
+
+This comprehensive guide walks you through developing and deploying onchain tools for the Nexus framework. Onchain tools are smart contracts (modules) that execute on Sui and integrate seamlessly with Nexus workflows.
+
+## Table of Contents
+
+1. [Prerequisites](#prerequisites)
+1. [Project Setup](#project-setup)
+1. [Step-by-Step Development](#step-by-step-development)
+1. [Testing](#testing)
+1. [Deployment and Tool Registration](#deployment-and-tool-registration)
+1. [Integration with Workflows](#integration-with-workflows)
+
+## Prerequisites
+
+Before starting, ensure you have:
+
+### Required Knowledge
+
+- Familiarity with Sui Move language
+- Basic understanding of Nexus workflows and DAGs
+
+### Setup Guide Completion
+
+- Follow the [setup guide](setup.md) to make sure you've got the [Nexus CLI](../cli.md) and [Sui CLI](https://docs.sui.io/guides/developer/getting-started/sui-install) installed.
+
+## Project Setup
+
+{% hint style="info" %}
+You can choose to skip the manual project setup completely by using
+the following CLI command: `nexus tool new --name my_onchain_tool --template move`
+
+This generates a ready-to-go onchain tool Move module for you to build from.
+{% endhint %}
+
+### 1. Create a New Move Package
+
+```bash
+# Initialize Move package
+sui move new my_onchain_tool
+```
+
+### 2. Configure Dependencies
+
+Edit your `Move.toml` file to include Nexus dependencies:
+
+```toml
+[package]
+name = "my_onchain_tool"
+edition = "2024.beta"
+
+[dependencies]
+nexus_primitives = { local = "path/to/nexus/primitives" }
+nexus_workflow = { local = "path/to/nexus/workflow" }
+nexus_interface = { local = "path/to/nexus/interface" }
+
+[addresses]
+my_onchain_tool = "0x0"
+nexus_primitives = "0xf311c80e60f77ba6008237ed0cd619a05f25894cdac3e2318cf41c74e8e24cea"
+nexus_workflow = "0x5addaf9046d4a16ec3cbbe4fa9f89b5da73e0304ed1fff26fb8301574692cf4b"
+nexus_interface = "0xf66be6face6f35dea9d6aea2b6ce8930a2bf7f55ac9ec7c80ffcb8182cabf5ae"
+```
+
+**Note**: Update the paths and addresses to match your setup and target network.
+
+## Step-by-Step Development
+
+### Step 1: Create the Basic Module Structure
+
+In `sources/my_onchain_tool.move`:
+
+```move
+module my_onchain_tool::my_onchain_tool;
+
+use nexus_primitives::proof_of_uid::ProofOfUID;
+use nexus_workflow::tool_output::{Self, ToolOutput};
+use sui::bag::{Self, Bag};
+use sui::clock::Clock;
+use sui::transfer::share_object;
+use std::ascii::String as AsciiString;
+
+/// One-time witness for package initialization.
+public struct MY_ONCHAIN_TOOL has drop {}
+
+/// Witness object used to identify this tool.
+public struct MyToolWitness has key, store {
+    id: UID,
+}
+
+/// Your tool's state object (customize as needed).
+public struct MyToolState has key {
+    id: UID,
+    /// Store the witness object that identifies this tool.
+    witness: Bag,
+    // Add your application-specific fields here
+    // Example: value: u64,
+    // ..
+}
+```
+
+### Step 2: Define Output Variants
+
+```move
+/// Tool execution output variants.
+/// This enum is used for automatic schema generation during registration.
+/// It's not used during execution. Only the ToolOutput object is used.
+public enum Output {
+    Ok {
+        result: u64,
+        // Add custom fields here as needed
+    },
+    Err {
+        reason: AsciiString,
+    },
+    // Add custom variants as needed
+    CustomResult {
+        data: vector<u8>,
+        timestamp: u64,
+    },
+}
+```
+
+### Step 3: Implement Initialization
+
+```move
+/// Initialize your tool's state.
+fun init(_otw: MY_ONCHAIN_TOOL, ctx: &mut TxContext) {
+    let state = MyToolState {
+        id: object::new(ctx),
+        witness: {
+            let mut bag = bag::new(ctx);
+            bag.add(b"witness", MyToolWitness { id: object::new(ctx) });
+            bag
+        },
+        // Initialize your fields
+        // value: 0,
+    };
+    share_object(state);
+}
+```
+
+### Step 4: Implement the Execute Function
+
+This is the core of your tool, the function that performs the actual execution:
+
+```move
+/// Execute function with standardized Nexus signature.
+///
+/// CRITICAL REQUIREMENTS:
+/// 1. First parameter: worksheet: &mut ProofOfUID
+/// 2. Last parameter: ctx: &mut TxContext
+/// 3. Return type: ToolOutput
+/// 4. Must stamp worksheet with witness ID
+public fun execute(
+    worksheet: &mut ProofOfUID,
+    state: &mut MyToolState,
+    // Add your custom parameters here
+    input_value: u64,
+    clock: &Clock,
+    ctx: &mut TxContext,
+): ToolOutput {
+    // Get the witness for stamping.
+    let witness = state.witness();
+
+    // REQUIRED: Stamp the worksheet to prove execution
+    worksheet.stamp_with_data(&witness.id, b"my_tool_executed");
+
+    // Implement your tool logic here
+    if (input_value == 0) {
+        // Return error variant
+        tool_output::err(b"Input value cannot be zero")
+    } else if (input_value > 1000) {
+        // Return custom variant
+        tool_output::variant(b"custom_result")
+            .with_field(b"data", tool_output::string_value(b"large_value_processed"))
+            .with_field(b"timestamp", tool_output::number_value(sui::clock::timestamp_ms(clock).to_string().into_bytes()))
+    } else {
+        // Return success variant
+        let result = input_value * 2;
+        tool_output::ok()
+            .with_field(b"result", tool_output::number_value(result.to_string().into_bytes()))
+    }
+}
+```
+
+#### Understanding Field Value Types
+
+When adding fields to `ToolOutput`, you must use typed constructor functions to ensure proper JSON formatting:
+
+```move
+// Numeric values (u8, u16, u32, u64, u128, u256)
+.with_field(b"count", tool_output::number_value(value.to_string().into_bytes()))
+
+// String values (will be wrapped in quotes in JSON)
+.with_field(b"message", tool_output::string_value(b"Hello world"))
+
+// Boolean values (true/false without quotes in JSON)
+.with_field(b"success", tool_output::bool_value(b"true"))
+
+// Address values (prefixed with "0x" and wrapped in quotes in JSON)
+.with_field(b"sender", tool_output::address_value(address.to_string().into_bytes()))
+```
+
+This typing ensures that the Nexus framework correctly parses and processes your tool's outputs.
+
+### Step 5: Add Helper Functions
+
+```move
+// === Getters and Helper Functions ===
+
+/// Helper function to get the witness object.
+fun witness(self: &MyToolState): &MyToolWitness {
+    self.witness.borrow(b"witness")
+}
+
+/// Get the witness ID for external reference.
+/// Useful for registering the tool onchain.
+public fun witness_id(self: &MyToolState): ID {
+    self.witness().id.to_inner()
+}
+
+// Add getters for your custom fields
+// public fun value(self: &MyToolState): u64 {
+//     self.value
+// }
+
+#[test_only]
+public fun init_for_test(otw: MY_ONCHAIN_TOOL, ctx: &mut TxContext) {
+    init(otw, ctx);
+}
+```
+
+## Testing
+
+Make sure to add tests in the `/tests` folder to test the correct functionality of your onchain tool module.
+
+## Deployment and Tool Registration
+
+### Step 1: Publish to Sui
+
+```bash
+# Publish to testnet (or your target network)
+sui client publish
+
+# Save the package ID from the output
+export PACKAGE_ID="0x..."
+# export <..> Other required IDs as described in step 2...
+```
+
+### Step 2: Get Required Information
+
+After publishing, you'll need:
+
+1. **Module Path**: Combination of package address and module name (e.g., "0xPACKAGE_ID::my_tool")
+1. **Witness ID**: Object ID of your witness object
+1. **\*ToolState**: The shared object necessary as argument for the execute function. _This ID is not required for tool registration._
+
+You can find the witness ID in the explorer by looking up the Witness object in the dynamic field ID that is given
+to you in the publish output. This object has type: `0x2::dynamic_field::Field<vector<u8>, PACKAGE_ID::my_onchain_tool::MyToolWitness>`
+
+Alternatively, you can find the witness ID by using the CLI:
+
+```bash
+sui client object <DYNAMIC_FIELD_ID>
+```
+
+### Step 3: Register with Nexus
+
+Use the Nexus CLI to register your tool with automatic schema generation:
+
+```bash
+nexus tool register onchain \
+  --module-path "$PACKAGE_ID::my_onchain_tool" \
+  --tool-fqn "xyz.mydomain.my_onchain_tool@1" \
+  --description "My custom onchain tool that processes values" \
+  --witness-id "0x..."
+```
+
+The CLI will:
+
+1. **Analyze your `execute` function** to generate input schema
+1. **Generate output schema** from your `Output` enum
+1. **Prompt for parameter descriptions** (interactive customization)
+1. **Register the tool** in the Nexus tool registry
+
+### Step 4: Verify Registration
+
+```bash
+# List all registered tools
+nexus tool list
+```
+
+## Integration with Workflows
+
+### Using in DAG Definitions
+
+Once registered, your onchain tool can be used in Nexus workflows the same way offchain tools are used.
+
+An example JSON DAG using the onchain tool is as follows:
+
+```json
+{
+  "default_values": [
+    {
+      "vertex": "just_execute_first",
+      "input_port": "2",
+      "value": {
+        "storage": "inline",
+        "data": "0x6"
+      }
+    },
+    {
+      "vertex": "just_execute_second",
+      "input_port": "2",
+      "value": {
+        "storage": "inline",
+        "data": "0x6"
+      }
+    }
+  ],
+  "vertices": [
+    {
+      "kind": {
+        "variant": "on_chain",
+        "tool_fqn": "xyz.mydomain.my_tool@1"
+      },
+      "name": "just_execute_first",
+      "entry_ports": [
+        {
+          "name": "0",
+          "encrypted": false
+        },
+        {
+          "name": "1",
+          "encrypted": false
+        }
+      ]
+    },
+    {
+      "kind": {
+        "variant": "on_chain",
+        "tool_fqn": "xyz.mydomain.my_tool@1"
+      },
+      "name": "just_execute_second",
+      "entry_ports": [
+        {
+          "name": "0",
+          "encrypted": false
+        }
+      ]
+    }
+  ],
+  "edges": [
+    {
+      "from": {
+        "vertex": "just_execute_first",
+        "output_variant": "ok",
+        "output_port": "result"
+      },
+      "to": {
+        "vertex": "just_execute_second",
+        "input_port": "1"
+      }
+    }
+  ]
+}
+```
+
+This workflow only executes the onchain tool twice if the output variant is Success. Else it only executes it once.
+
+### Useful Sources
+
+- **Nexus Documentation**: Check the main [tool documentation](../../nexus-next/docs/tool.md)
+- **Examples**: Study the [onchain tool example modules](../../nexus-next/sui/examples/) and [corresponding json dag workflows](../../sdk/src/dag/_dags/)
+
+Remember that onchain tools are powerful building blocks in the Nexus ecosystem. Well-designed tools can be composed with others to create sophisticated autonomous agents and workflows.
diff --git a/docs/guides/setup.md b/docs/guides/setup.md
index 866bd4c3..abc5c3d2 100644
--- a/docs/guides/setup.md
+++ b/docs/guides/setup.md
@@ -38,7 +38,7 @@ To install directly from the source using `cargo`, run:
 ```bash
 cargo install nexus-cli \
   --git https://github.com/talus-network/nexus-sdk \
-  --tag v0.3.0 \
+  --tag v0.5.0 \
   --locked
 ```
 
@@ -51,7 +51,7 @@ nexus --version
 ## Download the Nexus objects
 
 ```bash
-wget https://storage.googleapis.com/production-talus-sui-objects/v0.3.0/objects.devnet.toml
+wget -O ~/.nexus/objects.devnet.toml https://storage.googleapis.com/production-talus-sui-objects/v0.5.0/objects.devnet.toml
 ```
 
 ## Configure the Talus devnet
@@ -59,9 +59,10 @@ wget https://storage.googleapis.com/production-talus-sui-objects/v0.3.0/objects.
 Configure your Nexus CLI to connect to the Talus `devnet` by running:
 
 ```bash
-nexus conf set --sui.net devnet \
-  --sui.rpc-url https://rpc.ssfn.devnet.production.taluslabs.dev \
-  --nexus.objects objects.devnet.toml
+nexus conf set \
+  --sui.rpc-url https://grpc.ssfn.devnet.production.taluslabs.dev \
+  --sui.gql-url https://graphql.devnet.production.taluslabs.dev/graphql \
+  --nexus.objects ~/.nexus/objects.devnet.toml
 ```
 
 ### Configure the Sui client
@@ -95,6 +96,14 @@ sui client switch --address tally
 This command will output your wallet details, including your address and recovery phrase. Ensure you store this information securely.
 {% endhint %}
 
+Import the newly created wallet to `nexus`:
+
+```bash
+PK=$(sui keytool export --key-identity tally --json | jq -er '.exportedPrivateKey')
+BASE64_PK=$(sui keytool convert "$PK" --json | jq -er '.base64WithFlag')
+nexus conf set --sui.pk "$BASE64_PK"
+```
+
 To request funds from the faucet, run the following command twice to get 2 gas coins:
 
 ```bash
@@ -134,23 +143,82 @@ Note that this coin can only be used to pay for Nexus and tool invocation fees o
 
 ## Configure Encryption for Nexus workflows
 
-To ensure end-to-end encryption of data flowing through workflows, Nexus employs a customized implementation of the [Signal Protocol](https://signal.org/docs/). To establish a secure communication channel, you must claim a pre-key from the on-chain Nexus module `pre_key_vault`, perform an X3DH (Extended Triple Diffie-Hellman) key exchange, and derive a session key used to send an initial encrypted message.
+Nexus encrypts every sensitive value in your CLI config and every DAG payload using a [Signal-inspired](https://signal.org/docs/) stack: a persistent master key protects secrets at rest, an [X3DH](https://signal.org/docs/specifications/x3dh/) identity key authenticates you to the network, and a [Double-Ratchet](https://signal.org/docs/specifications/doubleratchet/) session derived from an on-chain pre-key encrypts runtime traffic. Follow the steps below in order; each one builds on the previous.
+
+### 1. Initialize the CLI master key
+
+The CLI stores encrypted blobs (identity key, sessions, Walrus credentials, etc.) in `~/.nexus/*.toml`. Those blobs are decrypted using a 32-byte master key that lives either in your OS keyring or is derived from a passphrase via [Argon2id](https://en.wikipedia.org/wiki/Argon2).
 
-The Nexus CLI abstracts away these cryptographic operations. You can initialize this process by simply running:
+```bash
+# Option A: generate a raw master key inside the OS keyring
+nexus crypto init-key
+
+# Option B: store a passphrase (useful for headless or CI)
+printf "my-strong-passphrase" | nexus crypto set-passphrase --stdin
+```
+
+Both commands refuse to overwrite existing credentials unless you add `--force`, because rotating the master key invalidates every encrypted entry. You can confirm which source will be used by running:
+
+```bash
+nexus crypto key-status
+```
+
+### 2. Generate an identity key
+
+Your long-term identity key represents the "public face" of the CLI in the Signal/X3DH handshake. It only needs to be generated once per installation or when you intentionally rotate it, which also invalidates stored sessions.
 
 ```bash
-nexus crypto init-key --force
 nexus crypto generate-identity-key
-nexus crypto auth
 ```
 
-This command generates two programmable transactions:
+This writes a freshly generated X25519 key pair into `~/.nexus/crypto.toml`, encrypted with the master key from Step 1.
+
+### 3. Establish a Signal-style session
+
+With persistence in place, run the auth flow to claim a pre-key bundle on-chain and derive a per-session Double Ratchet. The CLI handles the entire exchange for you:
 
-- The first claims a pre-key from the `pre_key_vault` module.
-- The second, after performing the X3DH handshake, sends the initial message to finalize the secure channel setup.
+```bash
+nexus crypto auth
+```
+
+Behind the scenes the command:
+
+1. Submits a programmable transaction that calls `pre_key_vault::claim_pre_key_for_self`, emitting the pre-key bundle bytes for your Sui address.
+1. Runs the X3DH sender flow locally using your identity key and that bundle, deriving shared secrets and the first Double-Ratchet message.
+1. Persists the resulting session (encrypted) to `~/.nexus/crypto.toml`.
+1. Sends a second programmable transaction that associates the claimed pre-key object with your address and delivers the initial encrypted message to the network.
+
+Every `nexus dag execute` / `inspect-execution` call now loads this session to encrypt entry ports and decrypt remote-hosted outputs. If you delete the session or rotate keys, simply rerun `nexus crypto auth` to mint a replacement.
+
+#### What `nexus crypto auth` does under the hood
+
+At a high level the CLI glues an on-chain pre-key vault (for rendezvous) with an offline Signal stack (X3DH + Double Ratchet):
+
+```mermaid
+sequenceDiagram
+    participant CLI as Nexus CLI
+    participant Conf as CryptoConf
+    participant Sui as Sui chain
+    participant Vault as PreKeyVault contract
+    participant Network as Nexus network
+
+    CLI->>Conf: Load config + decrypt identity key
+    CLI->>Sui: Submit claim_pre_key_for_self PTB (request)
+    Sui->>Vault: execute pre_key_vault::claim_pre_key_for_self
+    Vault-->>Sui: Emit PreKeyRequestedEvent (no bundle yet)
+    Leader->>Sui: Submit fulfill_pre_key_for_user PTB
+    Sui->>Vault: execute pre_key_vault::fulfill_pre_key_for_user
+    Vault-->>Sui: Emit PreKeyFulfilledEvent (carries pre_key bytes)
+    CLI->>Sui: poll events, read pre_key bytes from PreKeyFulfilledEvent
+    CLI->>CLI: Deserialize bytes -> PreKeyBundle
+    CLI->>CLI: Initialize double-ratche Session
+    CLI->>Conf: Save Double-Ratchet Session
+    CLI->>Sui: Submit associate_pre_key PTB + initial_message
+    Sui->>Network: Route initial message so nexus completes X3DH receiver flow
+```
 
 {% hint style="info" %}
-Keep in mind that the `claim_pre_key` operation is subject to rate limiting. Additionally, it requires a small gas budget to be deposited into Nexus. See `nexus gas add-budget` command.
+`claim_pre_key_for_self` is rate limited and each transaction requires gas. Make sure you have uploaded budget via `nexus gas add-budget` and keep an eye on `--sui-gas-coin` / `--sui-gas-budget` if you need precise control.
 {% endhint %}
 
 ## (Optional) Access Devnet Sui Explorer
diff --git a/docs/index.md b/docs/index.md
index f948eace..f4b742cb 100644
--- a/docs/index.md
+++ b/docs/index.md
@@ -1,6 +1,6 @@
 # 🧰 Nexus SDK
 
-This documentation aims to document the Nexus SDK, a combination of a CLI tool and Toolkit to facilitate developers building with Nexus. For more information about Nexus itself, please refer to [the Nexus Core documentation](../nexus-next/index.md).
+This documentation aims to document the Nexus SDK, including the CLI, the Rust client (`NexusClient`), and the Toolkit to facilitate developers building with Nexus. For more information about Nexus itself, please refer to [the Nexus Core documentation](../nexus-next/index.md).
 
 ## Actors
 
@@ -29,6 +29,7 @@ Docs:
 
 - [Nexus CLI](cli.md)
 - [DAG Construction Guide](guides/dag-construction.md)
+- [Nexus Client (Rust)](client.md)
 
 ## Toolkit
 
diff --git a/docs/toolkit-rust.md b/docs/toolkit-rust.md
index 87b9db70..f43e52cd 100644
--- a/docs/toolkit-rust.md
+++ b/docs/toolkit-rust.md
@@ -15,7 +15,7 @@ Alternatively, you can add the following to your `Cargo.toml` file:
 ```toml
 [dependencies.nexus-toolkit]
 git = "https://github.com/Talus-Network/nexus-sdk"
-tag = "v0.3.0"
+tag = "v0.5.0"
 package = "nexus-toolkit"
 ```
 
diff --git a/rust-toolchain.toml b/rust-toolchain.toml
index 3e42f6ed..e62665ca 100644
--- a/rust-toolchain.toml
+++ b/rust-toolchain.toml
@@ -1,5 +1,5 @@
 [toolchain]
-channel = "1.86"
+channel = "stable"
 components = [
     "rustc",
     "cargo",
diff --git a/sdk/Cargo.toml b/sdk/Cargo.toml
index 96a2cf77..4fd99881 100644
--- a/sdk/Cargo.toml
+++ b/sdk/Cargo.toml
@@ -19,6 +19,10 @@ default = ["tool_fqn"]
 # This feature is enabled by default.
 tool_fqn = ["regex", "lazy-regex"]
 
+# Tool Ref feature enables the use of the `ToolRef` enum for unified
+# tool reference representation (HTTP URL or Sui module ID and witness).
+tool_ref = ["sui_types", "reqwest"]
+
 # Crypto feature enables cryptographic primitives
 crypto = [
     "aead", "serde-big-array", "chacha20poly1305", "hkdf", "rand", "rand_core",
@@ -31,19 +35,15 @@ secret_core = ["bincode", "base64", "rand", "thiserror", "chacha20poly1305", "ze
 
 # Sui Types feature gives access to the re-exported Sui types.
 sui_types = [
-    "sui_sdk",
-    "move_core_types",
-    "sui_keys",
-    "shared_crypto",
-    "sui_config",
+    "sui-rpc",
+    "sui-sdk-types",
+    "sui-crypto",
+    "sui-transaction-builder",
 ]
 
 # Sui idents feature enables the use of the `idents` module and adds sui-sdk
 # and move-core-types as dependencies.
-sui_idents = ["tool_fqn", "sui_types", "serde_json"]
-
-# Object crawler feature enables the use of the `object_crawler` module.
-object_crawler = ["sui_types", "serde_json"]
+sui_idents = ["tool_fqn", "sui_types", "serde_json", "base64"]
 
 # Walrus client feature enables the use of the `walrus` module, providing
 # integration with the Walrus decentralized blob storage system.
@@ -57,7 +57,7 @@ types = ["sui_types", "crypto", "enum_dispatch", "walrus", "futures", "serde_jso
 wasm_types = ["tool_fqn", "serde_json"]
 
 # Events feature enables the use of the `events` module.
-events = ["sui_idents", "types"]
+events = ["sui_idents", "types", "graphql_client"]
 
 # Transactions feature enables the use of the `transactions` module. These are
 # used in the CLI and tests and hide away PTBs for various Nexus operations.
@@ -66,8 +66,12 @@ transactions = ["sui_idents", "bincode", "types"]
 # Provides DAG-related utilities.
 dag = ["petgraph"]
 
+# Schema generation feature enables automatic schema generation from Move modules.
+# Used for onchain tool registration.
+schema_gen = ["sui_types", "serde_json"]
+
 # Provides various Nexus utilities like deployment and execution of workflows.
-nexus = ["transactions", "dag", "object_crawler"]
+nexus = ["transactions", "events", "dag", "bcs", "prost-types"]
 
 # Test utils feature enables the use of the `test_utils` module. Also adds
 # tempfile, tokio-retry, sui_move_build, sui_package_management and
@@ -78,23 +82,28 @@ test_utils = [
     "tokio-retry",
     "sui_move_build",
     "sui_package_management",
+    "move_package",
+    "portpicker",
     "testcontainers-modules",
+    "mockall",
     "mockito",
+    "tonic",
 ]
 
 # Enable all features apart from `test_utils`.
 full = [
     "tool_fqn",
+    "tool_ref",
     "crypto",
     "secret_core",
     "sui_types",
     "sui_idents",
     "types",
     "events",
-    "object_crawler",
     "transactions",
     "walrus",
     "dag",
+    "schema_gen",
     "nexus",
 ]
 
@@ -104,6 +113,7 @@ anyhow.workspace = true
 chrono.workspace = true
 dirs = "6.0.0"
 serde.workspace = true
+serde_repr = "0.1"
 
 # === Optional deps for features ===
 [dependencies.base64]
@@ -144,6 +154,10 @@ optional = true
 workspace = true
 optional = true
 
+[dependencies.bcs]
+workspace = true
+optional = true
+
 [dependencies.chacha20poly1305]
 version = "0.10"
 features = ["rand_core", "std"]
@@ -165,6 +179,10 @@ optional = true
 workspace = true
 optional = true
 
+[dependencies.portpicker]
+workspace = true
+optional = true
+
 [dependencies.rand]
 workspace = true
 optional = true
@@ -206,10 +224,18 @@ optional = true
 version = "0.3"
 optional = true
 
+[dependencies.graphql_client]
+workspace = true
+optional = true
+
 [dependencies.lazy-regex]
 workspace = true
 optional = true
 
+[dependencies.mockall]
+workspace = true
+optional = true
+
 [dependencies.mockito]
 workspace = true
 optional = true
@@ -221,12 +247,15 @@ optional = true
 [dependencies.reqwest]
 workspace = true
 optional = true
-features = ["json", "stream"]
 
 [dependencies.serde_json]
 workspace = true
 optional = true
 
+[dependencies.prost-types]
+workspace = true
+optional = true
+
 [dependencies.tempfile]
 workspace = true
 optional = true
@@ -244,54 +273,51 @@ optional = true
 workspace = true
 optional = true
 
-# === Sui deps ===
-[dependencies.sui_sdk]
-git = "https://github.com/MystenLabs/sui"
-tag = "mainnet-v1.45.3"
-package = "sui-sdk"
+[dependencies.tonic]
+workspace = true
 optional = true
 
-[dependencies.move_core_types]
-git = "https://github.com/MystenLabs/sui"
-tag = "mainnet-v1.45.3"
-package = "move-core-types"
+# === Sui deps ===
+[dependencies.sui-rpc]
+version = "0.1.0"
 optional = true
 
-[dependencies.sui_keys]
-git = "https://github.com/MystenLabs/sui"
-tag = "mainnet-v1.45.3"
-package = "sui-keys"
+[dependencies.sui-sdk-types]
+version = "0.1.0"
+features = ["rand", "serde"]
 optional = true
 
-[dependencies.sui_config]
-git = "https://github.com/MystenLabs/sui"
-tag = "mainnet-v1.45.3"
-package = "sui-config"
+[dependencies.sui-crypto]
+version = "0.1.0"
+features = ["ed25519", "pem"]
 optional = true
 
-[dependencies.shared_crypto]
-git = "https://github.com/mystenlabs/sui"
-tag = "mainnet-v1.45.3"
-package = "shared-crypto"
+[dependencies.sui-transaction-builder]
+version = "0.1.0"
 optional = true
 
 [dependencies.sui_move_build]
 git = "https://github.com/MystenLabs/sui"
-tag = "mainnet-v1.45.3"
+tag = "mainnet-v1.61.2"
 package = "sui-move-build"
 optional = true
 
 [dependencies.sui_package_management]
 git = "https://github.com/MystenLabs/sui"
-tag = "mainnet-v1.45.3"
+tag = "mainnet-v1.61.2"
 package = "sui-package-management"
 optional = true
 
+[dependencies.move_package]
+git = "https://github.com/MystenLabs/sui"
+tag = "mainnet-v1.61.2"
+package = "move-package"
+optional = true
+
 [dependencies.testcontainers-modules]
 git = "https://github.com/Talus-Network/testcontainers-rs-modules-community"
-# TODO: change this once merged.
 branch = "feat/add-sui-support"
-features = ["sui", "redis"]
+features = ["sui", "redis", "postgres"]
 optional = true
 
 # === Dev deps ===
@@ -299,8 +325,11 @@ optional = true
 assert_matches = "1.5.0"
 tokio = { workspace = true, features = ["full", "macros"] }
 serde_json.workspace = true
+mockall.workspace = true
 mockito.workspace = true
+portpicker.workspace = true
 tempfile.workspace = true
+tonic.workspace = true
 
 # === Build deps ===
 [build-dependencies]
diff --git a/sdk/README.md b/sdk/README.md
index 69f663a5..090e4e7b 100644
--- a/sdk/README.md
+++ b/sdk/README.md
@@ -17,7 +17,7 @@ you can include this crate in your project's `Cargo.toml` file:
 ```toml
 [dependencies.nexus-sdk]
 git = "https://github.com/Talus-Network/nexus-sdk"
-tag = "v0.3.0"
+tag = "v0.5.0"
 package = "nexus-sdk"
 ```
 
diff --git a/sdk/build.rs b/sdk/build.rs
index 4a850659..eeb53ce4 100644
--- a/sdk/build.rs
+++ b/sdk/build.rs
@@ -4,9 +4,9 @@ fn main() {
     let cargo_toml = fs::read_to_string("Cargo.toml").expect("Should find Cargo.toml");
     let parsed: toml::Value = cargo_toml.parse().expect("Cargo.toml should valid");
 
-    let sui_sdk_tag = &parsed["dependencies"]["sui_sdk"]["tag"]
+    let sui_sdk_tag = &parsed["dependencies"]["sui_package_management"]["tag"]
         .as_str()
-        .expect("Should read dependencies.sui_sdk tag");
+        .expect("Should read dependencies.sui_package_management tag");
 
     println!("cargo:rustc-env=SUI_SDK_TAG={sui_sdk_tag}");
 }
diff --git a/sdk/src/crypto/double_ratchet.rs b/sdk/src/crypto/double_ratchet.rs
index 16157595..14d83425 100644
--- a/sdk/src/crypto/double_ratchet.rs
+++ b/sdk/src/crypto/double_ratchet.rs
@@ -62,6 +62,8 @@ use {
     zeroize::{Zeroize, Zeroizing},
 };
 
+type SkippedDecrypt = Option<(Vec<u8>, [u8; 32], u32, [u8; 32])>;
+
 /// Maximum number of skipped message keys to derive per chain before rejecting incoming traffic,
 ///  as mentioned in section 4 of the spec.
 const MAX_SKIP_PER_CHAIN: usize = 1_000;
@@ -70,8 +72,6 @@ const MAX_SKIP_PER_CHAIN: usize = 1_000;
 const MAX_SKIP_GLOBAL: usize = 2 * MAX_SKIP_PER_CHAIN;
 /// Maximum cached outgoing drafts (bounded LRU).
 const MAX_OUTGOING: usize = 1024;
-/// Deterministic SIV nonce (16-byte all-zero).
-const ZERO_NONCE: [u8; 16] = [0u8; 16];
 /// Each AES‑SIV nonce is 128‑bit.  We concatenate an 8‑byte random prefix with
 /// an 8‑byte big‑endian counter to get a unique value for every encryption.
 /// Note: We use AES‑128‑SIV with 32‑byte (256‑bit) keys for 128‑bit security.
@@ -469,7 +469,7 @@ impl RatchetStateHE {
     /// Reject the identity point and other small‑order curve points.
     /// This is a defence‑in‑depth measure.
     #[inline]
-    /// Reject identity *and* any of the eight small‑order points.
+    /// Reject identity and any of the eight small‑order points.
     fn validate_pk(pk: &PublicKey) -> Result<(), RatchetError> {
         for bad in SMALL_ORDER {
             if pk.as_bytes().ct_eq(&bad).unwrap_u8() == 1 {
@@ -537,18 +537,17 @@ impl RatchetStateHE {
     // hencrypt/hdecrypt unchanged
     fn hencrypt(&self, hk: &[u8; 32], pt: &[u8]) -> Result<Vec<u8>, RatchetError> {
         let cipher = Aes128SivAead::new_from_slice(hk)?;
+        let zero_nonce = Nonce::default();
         cipher
-            .encrypt(
-                Nonce::from_slice(&ZERO_NONCE),
-                Payload { msg: pt, aad: &[] },
-            )
+            .encrypt(&zero_nonce, Payload { msg: pt, aad: &[] })
             .map_err(Into::into)
     }
 
     fn hdecrypt(hk: &[u8; 32], data: &[u8]) -> Result<Header, RatchetError> {
         let cipher = Aes128SivAead::new_from_slice(hk)?;
+        let zero_nonce = Nonce::default();
         let pt = cipher.decrypt(
-            Nonce::from_slice(&ZERO_NONCE),
+            &zero_nonce,
             Payload {
                 msg: data,
                 aad: &[],
@@ -698,8 +697,10 @@ impl RatchetStateHE {
         full_ad.extend_from_slice(&enc_header);
         let cipher = Aes128SivAead::new_from_slice(&mk).unwrap();
         let nonce_bytes = self.nonce_seq_msg.next();
+        let mut nonce = Nonce::default();
+        nonce.copy_from_slice(&nonce_bytes);
         let mut ct = cipher.encrypt(
-            Nonce::from_slice(&nonce_bytes),
+            &nonce,
             Payload {
                 msg: plaintext,
                 aad: &full_ad,
@@ -726,17 +727,37 @@ impl RatchetStateHE {
         ciphertext: &[u8],
         ad: &[u8],
     ) -> Result<Vec<u8>, RatchetError> {
-        // 0. try skipped keys first
-        if let Some(pt) = self.try_skipped_keys(enc_header, ciphertext, ad)? {
+        self.ratchet_decrypt_he_impl(enc_header, ciphertext, ad, false)
+    }
+
+    /// Decrypts a message while keeping its key cached for limited reuse.
+    pub fn ratchet_decrypt_he_persistent(
+        &mut self,
+        enc_header: &[u8],
+        ciphertext: &[u8],
+        ad: &[u8],
+    ) -> Result<Vec<u8>, RatchetError> {
+        self.ratchet_decrypt_he_impl(enc_header, ciphertext, ad, true)
+    }
+
+    fn ratchet_decrypt_he_impl(
+        &mut self,
+        enc_header: &[u8],
+        ciphertext: &[u8],
+        ad: &[u8],
+        retain_mk: bool,
+    ) -> Result<Vec<u8>, RatchetError> {
+        if let Some((pt, hk, n, mk)) = self.try_skipped_keys(enc_header, ciphertext, ad)? {
+            if retain_mk {
+                self.mkskipped.insert((hk, n), mk);
+            }
             return Ok(pt);
         }
 
-        // 1. decrypt header using HK_r or NHK_r
         let (header, used_nhk, hk_used) = self.decrypt_header(enc_header)?;
+        let hk_for_cache = if used_nhk { Some(self.nhkr) } else { hk_used };
 
-        // If we used NHK_r, we need to do a DH ratchet and then handle skipped messages
         if used_nhk {
-            // 1. deal with the previous chain (PN)
             self.skip_message_keys_he(header.pn, None)?;
             self.dh_ratchet_he(&header)?;
 
@@ -754,7 +775,6 @@ impl RatchetStateHE {
                 return Err(RatchetError::MissingHeaderKey);
             }
         } else if self.ckr.is_none() {
-            // We have never derived a receiving chain: perform a DH-ratchet now.
             self.skip_message_keys_he(header.pn, None)?;
             self.dh_ratchet_he(&header)?;
             self.skip_message_keys_he(header.n, self.hkr)?;
@@ -772,13 +792,12 @@ impl RatchetStateHE {
             }
         }
 
-        // 2. normal message‑key ratchet
         let ckr = self.ckr.ok_or(RatchetError::MissingReceivingChain)?;
         let (new_ckr, mk) = Self::kdf_ck(&ckr);
+        let mk_copy = mk;
         self.ckr = Some(new_ckr);
         self.nr = self.nr.wrapping_add(1);
 
-        // 3. decrypt payload
         if ciphertext.len() < NONCE_LEN {
             return Err(RatchetError::CryptoError);
         }
@@ -786,9 +805,11 @@ impl RatchetStateHE {
         let mut full_ad = ad.to_vec();
         full_ad.extend_from_slice(enc_header);
         let cipher = Aes128SivAead::new_from_slice(&mk).unwrap();
+        let mut nonce = Nonce::default();
+        nonce.copy_from_slice(nonce_bytes);
         let result = cipher
             .decrypt(
-                Nonce::from_slice(nonce_bytes),
+                &nonce,
                 Payload {
                     msg: ct,
                     aad: &full_ad,
@@ -796,10 +817,13 @@ impl RatchetStateHE {
             )
             .map_err(Into::into);
 
-        // 4. Remove any matching key from skipped messages to prevent replay
         if result.is_ok() {
-            if let Some(hk_used) = hk_used {
-                self.mkskipped.remove(&(hk_used, header.n));
+            if let Some(hk_cache) = hk_for_cache {
+                if retain_mk {
+                    self.mkskipped.insert((hk_cache, header.n), mk_copy);
+                } else {
+                    self.mkskipped.remove(&(hk_cache, header.n));
+                }
             }
         }
 
@@ -814,18 +838,17 @@ impl RatchetStateHE {
         enc_header: &[u8],
         ciphertext: &[u8],
         ad: &[u8],
-    ) -> Result<Option<Vec<u8>>, RatchetError> {
-        // Try all stored skipped message keys
+    ) -> Result<SkippedDecrypt, RatchetError> {
         let keys: Vec<_> = self.mkskipped.keys().cloned().collect();
         for (hk, n) in keys {
             if let Ok(hdr) = Self::hdecrypt(&hk, enc_header) {
                 if hdr.n == n {
                     if let Some(mk) = self.mkskipped.get(&(hk, n)) {
-                        // Try decrypting with the skipped key, ignore errors and only succeed on valid decryption.
+                        let mk_copy = *mk;
                         if let Ok(Some(pt)) = Self::decrypt_with_mk(ciphertext, ad, enc_header, mk)
                         {
                             self.mkskipped.remove(&(hk, n));
-                            return Ok(Some(pt));
+                            return Ok(Some((pt, hk, n, mk_copy)));
                         }
                     }
                 }
@@ -1055,12 +1078,13 @@ impl RatchetStateHE {
         }
         let (nonce_bytes, ct) = ciphertext.split_at(NONCE_LEN);
         let cipher = Aes128SivAead::new_from_slice(mk).map_err(|_| RatchetError::CryptoError)?;
-        let nonce = Nonce::from_slice(nonce_bytes);
+        let mut nonce = Nonce::default();
+        nonce.copy_from_slice(nonce_bytes);
         let mut full_ad = ad.to_vec();
         full_ad.extend_from_slice(enc_header);
         cipher
             .decrypt(
-                nonce,
+                &nonce,
                 Payload {
                     msg: ct,
                     aad: &full_ad,
diff --git a/sdk/src/crypto/session.rs b/sdk/src/crypto/session.rs
index 85dc58e6..1596dd9e 100644
--- a/sdk/src/crypto/session.rs
+++ b/sdk/src/crypto/session.rs
@@ -118,12 +118,14 @@ pub struct StandardMessage {
 
 /// Union covering all messages that can traverse the transport.
 #[derive(Debug, Clone, Serialize, Deserialize)]
-#[serde(tag = "kind", rename_all = "lowercase")]
+#[serde(tag = "kind", rename_all = "snake_case")]
 pub enum Message {
     /// First packet in the X3DH handshake (sent by Sender).
     Initial(InitialMessage),
     /// Ordinary Double-Ratchet message exchanged after the handshake.
     Standard(StandardMessage),
+    /// Double-Ratchet message whose key should remain cached for limited reuse.
+    LimitedPersistent(StandardMessage),
 }
 
 /// A live end-to-end encrypted session.
@@ -346,6 +348,25 @@ impl Session {
             .map_err(|_| SessionError::InvalidState("Encryption failed".into()))
     }
 
+    /// Encrypts a plaintext while marking the result as limited persistent.
+    ///
+    /// The receiver keeps the derived message key cached so the ciphertext can
+    /// be replayed a bounded number of times without rewinding the ratchet.
+    pub fn encrypt_limited_persistent(
+        &mut self,
+        plaintext: &[u8],
+    ) -> Result<Message, SessionError> {
+        match self.encrypt(plaintext)? {
+            Message::Standard(msg) => Ok(Message::LimitedPersistent(msg)),
+            Message::Initial(_) => Err(SessionError::InvalidState(
+                "Cannot emit an Initial message in persistent mode".into(),
+            )),
+            Message::LimitedPersistent(_) => Err(SessionError::InvalidState(
+                "Message already tagged as persistent".into(),
+            )),
+        }
+    }
+
     /// Decrypts an incoming `message`, performing DH/PN ratchets as required.
     ///
     /// *Errors*:
@@ -369,6 +390,19 @@ impl Session {
                     .ratchet_decrypt_he(header, ciphertext, &ad)
                     .map_err(|_| SessionError::DecryptionFailed)
             }
+            Message::LimitedPersistent(StandardMessage {
+                version,
+                header,
+                ciphertext,
+            }) => {
+                if *version != PROTOCOL_VERSION {
+                    return Err(SessionError::Version(*version));
+                }
+                let ad = self.make_associated_data();
+                self.ratchet
+                    .ratchet_decrypt_he_persistent(header, ciphertext, &ad)
+                    .map_err(|_| SessionError::DecryptionFailed)
+            }
         }
     }
 
@@ -380,7 +414,7 @@ impl Session {
     ///   already forgotten or the header does not belong to this session.
     pub fn read_own_msg(&mut self, msg: &Message) -> Option<Vec<u8>> {
         match msg {
-            Message::Standard(sm) => {
+            Message::Standard(sm) | Message::LimitedPersistent(sm) => {
                 let ad = self.make_associated_data();
                 self.ratchet
                     .decrypt_outgoing(&sm.header, &sm.ciphertext, &ad)
@@ -471,6 +505,30 @@ impl Session {
         Ok(())
     }
 
+    /// Encrypts the provided JSON using the limited persistent variant.
+    pub fn encrypt_limited_persistent_nexus_data_json(
+        &mut self,
+        data: &mut serde_json::Value,
+    ) -> anyhow::Result<()> {
+        if let serde_json::Value::Array(values) = data {
+            let mut encrypted_values = Vec::with_capacity(values.len());
+
+            for value in values {
+                let bytes = serde_json::to_vec(value)?;
+                let message = self.encrypt_limited_persistent(&bytes)?;
+                encrypted_values.push(serde_json::to_value(&message)?);
+            }
+
+            *data = serde_json::Value::Array(encrypted_values);
+            return Ok(());
+        }
+
+        let bytes = serde_json::to_vec(data)?;
+        let message = self.encrypt_limited_persistent(&bytes)?;
+        *data = serde_json::to_value(&message)?;
+        Ok(())
+    }
+
     /// Opposite of [`Self::encrypt_nexus_data_json`], decrypts the provided
     /// `serde_json::Value` and returns the decrypted JSON data. If the value
     /// is an array, it decrypts each object individually.
@@ -483,34 +541,34 @@ impl Session {
 
             // Decrypt each element.
             for value in values {
-                let msg: StandardMessage = serde_json::from_value(value.clone())?;
-                let msg = Message::Standard(msg);
+                let msg = if value.get("kind").is_some() {
+                    serde_json::from_value::<Message>(value.clone())?
+                } else {
+                    Message::Standard(serde_json::from_value::<StandardMessage>(value.clone())?)
+                };
 
-                // Was this message sent by us?
                 if let Some(bytes) = self.read_own_msg(&msg) {
                     decrypted_values.push(serde_json::from_slice(&bytes)?);
-
                     continue;
                 }
 
-                // If not, just decrypt it normally.
                 let bytes = self.decrypt(&msg)?;
-
                 decrypted_values.push(serde_json::from_slice(&bytes)?);
             }
 
             return Ok(serde_json::Value::Array(decrypted_values));
         }
 
-        let msg: StandardMessage = serde_json::from_value(data.clone())?;
-        let msg = Message::Standard(msg);
+        let msg = if data.get("kind").is_some() {
+            serde_json::from_value::<Message>(data.clone())?
+        } else {
+            Message::Standard(serde_json::from_value::<StandardMessage>(data.clone())?)
+        };
 
-        // Was this message sent by us?
         if let Some(bytes) = self.read_own_msg(&msg) {
             return Ok(serde_json::from_slice(&bytes)?);
         }
 
-        // If not, just decrypt it normally.
         let bytes = self.decrypt(&msg)?;
 
         Ok(serde_json::from_slice(&bytes)?)
@@ -1263,6 +1321,52 @@ mod tests {
         receiver_sess.commit_receiver(None, Some(100)); // This should be a no-op for current state
     }
 
+    #[test]
+    fn test_limited_persistent_replay() {
+        use serde_json::json;
+
+        let sender_id = IdentityKey::generate();
+        let receiver_id = IdentityKey::generate();
+        let spk_secret = StaticSecret::random_from_rng(OsRng);
+        let bundle = PreKeyBundle::new(&receiver_id, 7, &spk_secret, None, None);
+
+        let (init_msg, mut sender_sess) =
+            Session::initiate(&sender_id, &bundle, b"handshake").unwrap();
+
+        let initial_message = match &init_msg {
+            Message::Initial(m) => m,
+            _ => unreachable!("initiate must return Initial message"),
+        };
+
+        let (mut receiver_sess, _) =
+            Session::recv(&receiver_id, &spk_secret, &bundle, initial_message, None).unwrap();
+
+        let original = json!({
+            "foo": "bar",
+            "count": 42
+        });
+        let mut payload = original.clone();
+
+        sender_sess
+            .encrypt_limited_persistent_nexus_data_json(&mut payload)
+            .expect("encrypt limited persistent");
+
+        assert!(
+            payload.get("kind").is_some(),
+            "kind tag should exist for persistent payloads"
+        );
+
+        let first = receiver_sess
+            .decrypt_nexus_data_json(&payload)
+            .expect("first decrypt should succeed");
+        assert_eq!(first, original, "first decrypt must round-trip");
+
+        let second = receiver_sess
+            .decrypt_nexus_data_json(&payload)
+            .expect("second decrypt should reuse message key");
+        assert_eq!(second, original, "replayed decrypt must match");
+    }
+
     #[test]
     fn test_nexus_data_json_encrypt_decrypt_roundtrip() {
         use serde_json::json;
diff --git a/sdk/src/crypto/x3dh.rs b/sdk/src/crypto/x3dh.rs
index e62d96dd..4c2e82e0 100644
--- a/sdk/src/crypto/x3dh.rs
+++ b/sdk/src/crypto/x3dh.rs
@@ -1,4 +1,5 @@
 #![forbid(unsafe_code)]
+#![allow(unused_assignments)]
 //! # X3DH: Extended Triple Diffie‑Hellman key agreement
 //!
 //! This module implements the X3DH protocol as described in Signal's public
@@ -189,6 +190,7 @@ fn kdf(dhs: &[&[u8]], info: &[u8]) -> Result<SharedSecret, X3dhError> {
 ///
 /// A single 32‑byte secret scalar serves double purpose – it is interpreted in
 /// Montgomery form for X25519 and in Edwards form for XEdDSA.
+#[allow(unused_assignments)]
 #[derive(Zeroize, ZeroizeOnDrop)]
 pub struct IdentityKey {
     /// 32‑byte X25519 secret.
@@ -534,9 +536,11 @@ pub fn sender_init(
     let cipher = XChaCha20Poly1305::new((&*sk).into());
     let mut nonce = [0u8; 24];
     OsRng.fill_bytes(&mut nonce);
+    let mut xnonce = XNonce::default();
+    xnonce.copy_from_slice(&nonce);
     let ciphertext = cipher
         .encrypt(
-            XNonce::from_slice(&nonce),
+            &xnonce,
             Payload {
                 msg: plaintext,
                 aad: &ad,
@@ -636,9 +640,11 @@ pub fn receiver_receive(
 
     // 5. Decrypt
     let cipher = XChaCha20Poly1305::new((&*sk).into());
+    let mut xnonce = XNonce::default();
+    xnonce.copy_from_slice(&msg.nonce);
     let plaintext = cipher
         .decrypt(
-            XNonce::from_slice(&msg.nonce),
+            &xnonce,
             Payload {
                 msg: &msg.ciphertext,
                 aad: &ad,
@@ -653,6 +659,7 @@ pub fn receiver_receive(
 
 /// Container that pairs a publicly published [`PreKeyBundle`] with the
 /// secrets that Receiver keeps in local storage.
+#[allow(unused_assignments)]
 #[derive(Zeroize, ZeroizeOnDrop)]
 pub struct PreKeyBundleWithSecrets {
     /// The bundle that must be posted to the key server.
diff --git a/sdk/src/dag/_dags/conditional_onchain_tool.json b/sdk/src/dag/_dags/conditional_onchain_tool.json
new file mode 100644
index 00000000..55f61b61
--- /dev/null
+++ b/sdk/src/dag/_dags/conditional_onchain_tool.json
@@ -0,0 +1,79 @@
+{
+  "default_values": [
+    {
+      "vertex": "add_input_and_default",
+      "input_port": "b",
+      "value": {
+        "storage": "inline",
+        "data": -3
+      }
+    },
+    {
+      "vertex": "is_positive",
+      "input_port": "b",
+      "value": {
+        "storage": "inline",
+        "data": 0
+      }
+    }
+  ],
+  "vertices": [
+    {
+      "kind": {
+        "variant": "off_chain",
+        "tool_fqn": "xyz.taluslabs.math.i64.add@1"
+      },
+      "name": "add_input_and_default",
+      "entry_ports": [
+        {
+          "name": "a",
+          "encrypted": false
+        }
+      ]
+    },
+    {
+      "kind": {
+        "variant": "off_chain",
+        "tool_fqn": "xyz.taluslabs.math.i64.cmp@1"
+      },
+      "name": "is_positive"
+    },
+    {
+      "kind": {
+        "variant": "on_chain",
+        "tool_fqn": "xyz.taluslabs.example@1"
+      },
+      "name": "counter_increment",
+      "entry_ports": [
+        {
+          "name": "0",
+          "encrypted": false
+        }
+      ]
+    }
+  ],
+  "edges": [
+    {
+      "from": {
+        "vertex": "add_input_and_default",
+        "output_variant": "ok",
+        "output_port": "result"
+      },
+      "to": {
+        "vertex": "is_positive",
+        "input_port": "a"
+      }
+    },
+    {
+      "from": {
+        "vertex": "is_positive",
+        "output_variant": "gt",
+        "output_port": "a"
+      },
+      "to": {
+        "vertex": "counter_increment",
+        "input_port": "1"
+      }
+    }
+  ]
+}
diff --git a/sdk/src/dag/_dags/double_onchain_tool.json b/sdk/src/dag/_dags/double_onchain_tool.json
new file mode 100644
index 00000000..a619cb9f
--- /dev/null
+++ b/sdk/src/dag/_dags/double_onchain_tool.json
@@ -0,0 +1,56 @@
+{
+  "vertices": [
+    {
+      "kind": {
+        "variant": "on_chain",
+        "tool_fqn": "xyz.taluslabs.example@1"
+      },
+      "name": "counter_increment_first",
+      "entry_ports": [
+        {
+          "name": "0",
+          "encrypted": false
+        },
+        {
+          "name": "1",
+          "encrypted": false
+        },
+        {
+          "name": "2",
+          "encrypted": false
+        }
+      ]
+    },
+    {
+      "kind": {
+        "variant": "on_chain",
+        "tool_fqn": "xyz.taluslabs.example@1"
+      },
+      "name": "counter_increment_second",
+      "entry_ports": [
+        {
+          "name": "0",
+          "encrypted": false
+        },
+        {
+          "name": "2",
+          "encrypted": false
+        }
+      ]
+    }
+  ],
+  "edges": [
+    {
+      "from": {
+        "vertex": "counter_increment_first",
+        "output_variant": "ok",
+        "output_port": "increment"
+      },
+      "to": {
+        "vertex": "counter_increment_second",
+        "input_port": "1"
+      }
+    }
+  ]
+}
+  
\ No newline at end of file
diff --git a/sdk/src/dag/_dags/guide_onchain_tool.json b/sdk/src/dag/_dags/guide_onchain_tool.json
new file mode 100644
index 00000000..7252935e
--- /dev/null
+++ b/sdk/src/dag/_dags/guide_onchain_tool.json
@@ -0,0 +1,66 @@
+{
+    "default_values": [
+    {
+      "vertex": "execute_first",
+      "input_port": "2",
+      "value": {
+        "storage": "inline",
+        "data": "0x6"
+      }
+    },
+    {
+        "vertex": "execute_second",
+        "input_port": "2",
+        "value": {
+          "storage": "inline",
+          "data": "0x6"
+        }
+      }
+  ],
+    "vertices": [
+      {
+        "kind": {
+          "variant": "on_chain",
+          "tool_fqn": "xyz.mydomain.my_tool@1"
+        },
+        "name": "execute_first",
+        "entry_ports": [
+          {
+            "name": "0",
+            "encrypted": false
+          },
+          {
+            "name": "1",
+            "encrypted": false
+          }
+        ]
+      },
+      {
+        "kind": {
+          "variant": "on_chain",
+          "tool_fqn": "xyz.mydomain.my_tool@1"
+        },
+        "name": "execute_second",
+        "entry_ports": [
+          {
+            "name": "0",
+            "encrypted": false
+          }
+        ]
+      }
+    ],
+    "edges": [
+      {
+        "from": {
+          "vertex": "execute_first",
+          "output_variant": "ok",
+          "output_port": "result"
+        },
+        "to": {
+          "vertex": "execute_second",
+          "input_port": "1"
+        }
+      }
+    ]
+  }
+    
\ No newline at end of file
diff --git a/sdk/src/dag/_dags/single_onchain_tool.json b/sdk/src/dag/_dags/single_onchain_tool.json
new file mode 100644
index 00000000..24949446
--- /dev/null
+++ b/sdk/src/dag/_dags/single_onchain_tool.json
@@ -0,0 +1,22 @@
+{
+  "vertices": [
+    {
+      "kind": {
+        "variant": "on_chain",
+        "tool_fqn": "xyz.taluslabs.example@1"
+      },
+      "name": "counter_increment",
+      "entry_ports": [
+        {
+          "name": "0",
+          "encrypted": false
+        },
+        {
+          "name": "1",
+          "encrypted": false
+        }
+      ]
+    }
+  ],
+  "edges": []
+}
diff --git a/sdk/src/dag/validator.rs b/sdk/src/dag/validator.rs
index 727f9b0f..3505da07 100644
--- a/sdk/src/dag/validator.rs
+++ b/sdk/src/dag/validator.rs
@@ -141,9 +141,8 @@ fn follows_concurrency_rules(
             // If there is no path to this input port then it is unreachable.
             if all_nodes_in_paths.is_empty() {
                 bail!(
-                    "'{}' is unreachable when invoking group '{}'",
-                    graph[input_port],
-                    group
+                    "'{}' is unreachable when invoking group '{group}'",
+                    graph[input_port]
                 );
             }
 
@@ -151,17 +150,15 @@ fn follows_concurrency_rules(
 
             if concurrency < 0 {
                 bail!(
-                    "'{}' is unreachable when invoking group '{}'",
-                    graph[input_port],
-                    group
+                    "'{}' is unreachable when invoking group '{group}'",
+                    graph[input_port]
                 )
             }
 
             if concurrency > 0 {
                 bail!(
-                    "'{}' has a race condition on it when invoking group '{}'",
-                    graph[input_port],
-                    group
+                    "'{}' has a race condition on it when invoking group '{group}'",
+                    graph[input_port]
                 )
             }
         }
@@ -235,10 +232,7 @@ fn validate_for_each_pairs(
     while let Some((node, vertex, state)) = stack.pop() {
         if graph.edges(node).count() == 0 {
             if state == InForEach {
-                bail!(
-                    "'{}' has a for-each edge without a corresponding collect",
-                    vertex
-                );
+                bail!("'{vertex}' has a for-each edge without a corresponding collect");
             }
 
             continue;
@@ -393,9 +387,8 @@ fn try_into_graph(dag: Dag) -> AnyResult<GraphAndVertexEntryGroups> {
                 // Check that the group references a vertex that exists.
                 if !dag.vertices.iter().any(|v| &v.name == vertex) {
                     bail!(
-                        "Entry group '{}' references a non-existing vertex '{}'.",
-                        entry_group.name,
-                        vertex
+                        "Entry group '{}' references a non-existing vertex '{vertex}'.",
+                        entry_group.name
                     );
                 }
 
diff --git a/sdk/src/events.rs b/sdk/src/events.rs
deleted file mode 100644
index 00779674..00000000
--- a/sdk/src/events.rs
+++ /dev/null
@@ -1,450 +0,0 @@
-use {
-    crate::{idents::primitives, sui, types::*, ToolFqn},
-    serde::{Deserialize, Serialize},
-};
-
-/// Struct holding the Sui event ID, the event generic arguments and the data
-/// as one of [NexusEventKind].
-#[derive(Clone, Debug, Serialize, Deserialize)]
-pub struct NexusEvent {
-    /// The event transaction digest and event sequence. Useful to filter down
-    /// events.
-    pub id: sui::EventID,
-    /// If the `T in NexusEvent<T>` is also a generic, this field holds the
-    /// generic type. Note that this can be nested indefinitely.
-    pub generics: Vec<sui::MoveTypeTag>,
-    /// The event data.
-    pub data: NexusEventKind,
-}
-
-/// This allows us to deserialize SuiEvent into [NexusEvent] and match the
-/// corresponding event kind to one of [NexusEventKind].
-const NEXUS_EVENT_TYPE_TAG: &str = "_nexus_event_type";
-
-/// Enumeration with all available events coming from the on-chain part of
-/// Nexus.
-#[derive(Clone, Debug, Deserialize, Serialize)]
-#[serde(tag = "_nexus_event_type", content = "event")]
-pub enum NexusEventKind {
-    #[serde(rename = "RequestWalkExecutionEvent")]
-    RequestWalkExecution(RequestWalkExecutionEvent),
-    #[serde(rename = "AnnounceInterfacePackageEvent")]
-    AnnounceInterfacePackage(AnnounceInterfacePackageEvent),
-    #[serde(rename = "OffChainToolRegisteredEvent")]
-    OffChainToolRegistered(OffChainToolRegisteredEvent),
-    #[serde(rename = "OnChainToolRegisteredEvent")]
-    OnChainToolRegistered(OnChainToolRegisteredEvent),
-    #[serde(rename = "ToolUnregisteredEvent")]
-    ToolUnregistered(ToolUnregisteredEvent),
-    #[serde(rename = "WalkAdvancedEvent")]
-    WalkAdvanced(WalkAdvancedEvent),
-    #[serde(rename = "WalkFailedEvent")]
-    WalkFailed(WalkFailedEvent),
-    #[serde(rename = "EndStateReachedEvent")]
-    EndStateReached(EndStateReachedEvent),
-    #[serde(rename = "ExecutionFinishedEvent")]
-    ExecutionFinished(ExecutionFinishedEvent),
-    #[serde(rename = "FoundingLeaderCapCreatedEvent")]
-    FoundingLeaderCapCreated(FoundingLeaderCapCreatedEvent),
-    #[serde(rename = "GasSettlementUpdateEvent")]
-    GasSettlementUpdate(GasSettlementUpdateEvent),
-    #[serde(rename = "PreKeyVaultCreatedEvent")]
-    PreKeyVaultCreated(PreKeyVaultCreatedEvent),
-    #[serde(rename = "PreKeyClaimedEvent")]
-    PreKeyClaimed(PreKeyClaimedEvent),
-    #[serde(rename = "PreKeyAssociatedEvent")]
-    PreKeyAssociated(PreKeyAssociatedEvent),
-    // These events are unused for now.
-    #[serde(rename = "ToolRegistryCreatedEvent")]
-    ToolRegistryCreated(serde_json::Value),
-    #[serde(rename = "DAGCreatedEvent")]
-    DAGCreated(serde_json::Value),
-    #[serde(rename = "DAGVertexAddedEvent")]
-    DAGVertexAdded(serde_json::Value),
-    #[serde(rename = "DAGEdgeAddedEvent")]
-    DAGEdgeAdded(serde_json::Value),
-    #[serde(rename = "DAGOutputAddedEvent")]
-    DAGOutputAdded(serde_json::Value),
-    #[serde(rename = "DAGEntryVertexInputPortAddedEvent")]
-    DAGEntryVertexInputPortAdded(serde_json::Value),
-    #[serde(rename = "DAGDefaultValueAddedEvent")]
-    DAGDefaultValueAdded(serde_json::Value),
-    #[serde(rename = "LeaderClaimedGasEvent")]
-    LeaderClaimedGas(serde_json::Value),
-    #[serde(rename = "AllowedOwnerAddedEvent")]
-    AllowedOwnerAdded(serde_json::Value),
-    #[serde(rename = "AllowedOwnerRemovedEvent")]
-    AllowedOwnerRemoved(serde_json::Value),
-}
-
-impl NexusEventKind {
-    /// Returns the name of the event kind as a string.
-    pub fn name(&self) -> String {
-        if let Ok(json) = serde_json::to_value(self) {
-            if let Some(name) = json.get(NEXUS_EVENT_TYPE_TAG).and_then(|v| v.as_str()) {
-                return name.to_string();
-            }
-        }
-
-        "UnknownEvent".to_string()
-    }
-}
-
-// == Event definitions ==
-
-/// Fired by the on-chain part of Nexus when a DAG vertex execution is
-/// requested.
-#[derive(Clone, Debug, Deserialize, Serialize)]
-pub struct RequestWalkExecutionEvent {
-    pub dag: sui::ObjectID,
-    pub execution: sui::ObjectID,
-    #[serde(
-        deserialize_with = "deserialize_sui_u64",
-        serialize_with = "serialize_sui_u64"
-    )]
-    pub walk_index: u64,
-    pub next_vertex: RuntimeVertex,
-    pub evaluations: sui::ObjectID,
-    /// This field defines the package ID, module and name of the Agent that
-    /// holds the DAG. Used to confirm the tool evaluation with the Agent.
-    pub worksheet_from_type: TypeName,
-}
-
-/// Fired via the Nexus `interface` package when a new Agent is registered.
-/// Provides the agent's interface so that we can invoke
-/// `confirm_tool_eval_for_walk` on it.
-#[derive(Clone, Debug, Deserialize, Serialize)]
-pub struct AnnounceInterfacePackageEvent {
-    pub shared_objects: Vec<sui::ObjectID>,
-}
-
-/// Fired by the Nexus Workflow when a new off-chain tool is registered so that
-/// the Leader can also register it in Redis. This way the Leader knows how and
-/// where to evaluate the tool.
-#[derive(Clone, Debug, Deserialize, Serialize)]
-pub struct OffChainToolRegisteredEvent {
-    pub registry: sui::ObjectID,
-    pub tool: sui::ObjectID,
-    /// The tool domain, name and version. See [ToolFqn] for more information.
-    pub fqn: ToolFqn,
-    #[serde(
-        deserialize_with = "deserialize_bytes_to_url",
-        serialize_with = "serialize_url_to_bytes"
-    )]
-    pub url: reqwest::Url,
-    #[serde(
-        deserialize_with = "deserialize_bytes_to_json_value",
-        serialize_with = "serialize_json_value_to_bytes"
-    )]
-    pub input_schema: serde_json::Value,
-    #[serde(
-        deserialize_with = "deserialize_bytes_to_json_value",
-        serialize_with = "serialize_json_value_to_bytes"
-    )]
-    pub output_schema: serde_json::Value,
-}
-
-/// Fired by the Nexus Workflow when a new on-chain tool is registered so that
-/// the Leader can also register it in Redis. This way the Leader knows how and
-/// where to evaluate the tool.
-// TODO: <https://github.com/Talus-Network/nexus-next/issues/96>
-#[derive(Clone, Debug, Deserialize, Serialize)]
-pub struct OnChainToolRegisteredEvent {
-    /// The tool domain, name and version. See [ToolFqn] for more information.
-    pub fqn: ToolFqn,
-}
-
-/// Fired by the Nexus Workflow when a tool is unregistered. The Leader should
-/// remove the tool definition from its Redis registry.
-#[derive(Clone, Debug, Deserialize, Serialize)]
-pub struct ToolUnregisteredEvent {
-    pub tool: sui::ObjectID,
-    /// The tool domain, name and version. See [ToolFqn] for more information.
-    pub fqn: ToolFqn,
-}
-
-/// Fired by the Nexus Workflow when a walk has advanced. This event is used to
-/// inspect DAG execution process.
-#[derive(Clone, Debug, Deserialize, Serialize)]
-pub struct WalkAdvancedEvent {
-    pub dag: sui::ObjectID,
-    pub execution: sui::ObjectID,
-    #[serde(
-        deserialize_with = "deserialize_sui_u64",
-        serialize_with = "serialize_sui_u64"
-    )]
-    pub walk_index: u64,
-    /// Which vertex was just executed.
-    pub vertex: RuntimeVertex,
-    /// Which output variant was evaluated.
-    pub variant: TypeName,
-    /// What data is associated with the variant.
-    pub variant_ports_to_data: PortsData,
-}
-
-/// Fired by the Nexus Workflow when a walk has failed.
-#[derive(Clone, Debug, Deserialize, Serialize)]
-pub struct WalkFailedEvent {
-    pub dag: sui::ObjectID,
-    pub execution: sui::ObjectID,
-    #[serde(
-        deserialize_with = "deserialize_sui_u64",
-        serialize_with = "serialize_sui_u64"
-    )]
-    pub walk_index: u64,
-    /// Which vertex was being executed when the failure happened.
-    pub vertex: RuntimeVertex,
-    /// The error message associated with the failure.
-    pub reason: String,
-}
-
-/// Fired by the Nexus Workflow when a walk has halted in an end state. This
-/// event is used to inspect DAG execution process.
-#[derive(Clone, Debug, Deserialize, Serialize)]
-pub struct EndStateReachedEvent {
-    pub dag: sui::ObjectID,
-    pub execution: sui::ObjectID,
-    #[serde(
-        deserialize_with = "deserialize_sui_u64",
-        serialize_with = "serialize_sui_u64"
-    )]
-    pub walk_index: u64,
-    /// Which vertex was just executed.
-    pub vertex: RuntimeVertex,
-    /// Which output variant was evaluated.
-    pub variant: TypeName,
-    /// What data is associated with the variant.
-    pub variant_ports_to_data: PortsData,
-}
-
-/// Fired by the Nexus Workflow when all walks have halted in their end states
-/// and there is no more work to be done. This event is used to inspect DAG
-/// execution process.
-#[derive(Clone, Debug, Deserialize, Serialize)]
-pub struct ExecutionFinishedEvent {
-    pub dag: sui::ObjectID,
-    pub execution: sui::ObjectID,
-    pub has_any_walk_failed: bool,
-    pub has_any_walk_succeeded: bool,
-}
-
-/// Fired by the Nexus Workflow when a new founding LeaderCap is created.
-#[derive(Clone, Debug, Deserialize, Serialize)]
-pub struct FoundingLeaderCapCreatedEvent {
-    pub leader_cap: sui::ObjectID,
-    pub network: sui::ObjectID,
-}
-
-/// Fired by the Gas service when the gas settlement is updated. This event is
-/// used to determine whether a tool invocation was paid for by the caller.
-/// Combination of `execution` and `vertex` uniquely identifies the tool
-/// invocation.
-#[derive(Clone, Debug, Deserialize, Serialize)]
-pub struct GasSettlementUpdateEvent {
-    pub execution: sui::ObjectID,
-    pub tool_fqn: ToolFqn,
-    pub vertex: RuntimeVertex,
-    pub was_settled: bool,
-}
-
-/// Fired by the Nexus Workflow when a new pre key vault is created. This happens
-/// on initial network setup.
-#[derive(Clone, Debug, Deserialize, Serialize)]
-pub struct PreKeyVaultCreatedEvent {
-    pub vault: sui::ObjectID,
-    pub crypto_cap: sui::ObjectID,
-}
-
-/// Fired by the Nexus Workflow when a pre key is claimed. Notifies about the
-/// remaining pre keys in the vault after the claim.
-#[derive(Clone, Debug, Deserialize, Serialize)]
-pub struct PreKeyClaimedEvent {
-    /// How many pre keys are left in the vault after this claim.
-    #[serde(
-        deserialize_with = "deserialize_sui_u64",
-        serialize_with = "serialize_sui_u64"
-    )]
-    pub remaining: u64,
-}
-
-/// Fired by the Nexus Workflow when a pre key is associated with a user.
-#[derive(Clone, Debug, Deserialize, Serialize)]
-pub struct PreKeyAssociatedEvent {
-    /// The address of the user the pre key is associated with.
-    pub claimed_by: sui::ObjectID,
-    /// Bytes of the pre key.
-    pub pre_key: Vec<u8>,
-    /// Bytes of the initial message.
-    pub initial_message: Vec<u8>,
-}
-
-// == Parsing ==
-
-/// Parse [`sui::Event`] into [`NexusEvent`]. We check that the module and name
-/// of the event wrapper are what we expect. Then we add the event name as a
-/// field in the json object with the [`NEXUS_EVENT_TYPE_TAG`] key. This way we
-/// can automatically deserialize into the correct [`NexusEventKind`].
-impl TryInto<NexusEvent> for sui::Event {
-    type Error = anyhow::Error;
-
-    fn try_into(self) -> anyhow::Result<NexusEvent> {
-        let id = self.id;
-
-        let sui::MoveStructTag {
-            name,
-            module,
-            type_params,
-            ..
-        } = self.type_;
-
-        if name != primitives::Event::EVENT_WRAPPER.name.into()
-            || module != primitives::Event::EVENT_WRAPPER.module.into()
-        {
-            anyhow::bail!("Event is not a Nexus event");
-        };
-
-        // Extract the event name from its type parameters. This is used to
-        // match the corresponding [NexusEventKind].
-        let Some(sui::MoveTypeTag::Struct(type_param)) = type_params.into_iter().next() else {
-            anyhow::bail!("Event is not a struct");
-        };
-
-        let sui::MoveStructTag {
-            name, type_params, ..
-        } = *type_param;
-
-        // This allows us to insert the event name to the json object. This way
-        // we can then automatically deserialize into the correct
-        // [NexusEventKind].
-        let mut payload = self.parsed_json;
-
-        payload
-            .as_object_mut()
-            .ok_or_else(|| anyhow::anyhow!("Event payload could not be accessed"))?
-            .insert(NEXUS_EVENT_TYPE_TAG.to_string(), name.to_string().into());
-
-        let data = match serde_json::from_value(payload) {
-            Ok(data) => data,
-            Err(e) => {
-                anyhow::bail!("Could not deserialize event data for event '{name}': {e}");
-            }
-        };
-
-        Ok(NexusEvent {
-            id,
-            generics: type_params,
-            data,
-        })
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use {super::*, assert_matches::assert_matches};
-
-    fn dummy_event(
-        name: sui::Identifier,
-        data: serde_json::Value,
-        generics: Vec<sui::MoveTypeTag>,
-    ) -> sui::Event {
-        sui::Event {
-            id: sui::EventID {
-                tx_digest: sui::TransactionDigest::random(),
-                event_seq: 42,
-            },
-            package_id: sui::ObjectID::random(),
-            transaction_module: sui::move_ident_str!("primitives").into(),
-            sender: sui::ObjectID::random().into(),
-            bcs: sui::BcsEvent::new(vec![]),
-            timestamp_ms: None,
-            type_: sui::MoveStructTag {
-                address: *sui::ObjectID::random(),
-                name: primitives::Event::EVENT_WRAPPER.name.into(),
-                module: primitives::Event::EVENT_WRAPPER.module.into(),
-                type_params: vec![sui::MoveTypeTag::Struct(Box::new(sui::MoveStructTag {
-                    address: *sui::ObjectID::random(),
-                    name,
-                    module: sui::move_ident_str!("dag").into(),
-                    type_params: generics,
-                }))],
-            },
-            parsed_json: data,
-        }
-    }
-
-    #[test]
-    fn test_sui_event_desers_into_nexus_event() {
-        let dag = sui::ObjectID::random();
-        let execution = sui::ObjectID::random();
-        let evaluations = sui::ObjectID::random();
-
-        let generic = sui::MoveTypeTag::Struct(Box::new(sui::MoveStructTag {
-            address: *sui::ObjectID::random(),
-            name: sui::move_ident_str!("Foo").into(),
-            module: sui::move_ident_str!("bar").into(),
-            type_params: vec![],
-        }));
-
-        let event = dummy_event(
-            sui::move_ident_str!("RequestWalkExecutionEvent").into(),
-            serde_json::json!({
-                "event":{
-                    "dag": dag.to_string(),
-                    "execution": execution.to_string(),
-                    "walk_index": "42",
-                    "next_vertex": {
-                        "variant": "Plain",
-                        "fields": {
-                            "vertex": { "name": "foo" },
-                        }
-                    },
-                    "evaluations": evaluations.to_string(),
-                    "worksheet_from_type": {
-                        "name": "bar",
-                    },
-                }
-            }),
-            vec![generic.clone()],
-        );
-
-        let event: NexusEvent = event.try_into().unwrap();
-
-        assert_eq!(event.generics, vec![generic]);
-        assert_matches!(event.data, NexusEventKind::RequestWalkExecution(e)
-            if e.dag == dag &&
-                e.execution == execution &&
-                e.evaluations == evaluations &&
-                e.walk_index == 42 &&
-                matches!(&e.next_vertex, RuntimeVertex::Plain { vertex } if vertex.name == "foo") &&
-                e.worksheet_from_type.name == *"bar"
-        );
-    }
-
-    #[test]
-    fn test_nexus_event_kind_name_returns_correct_name() {
-        let dummy_event = NexusEventKind::RequestWalkExecution(RequestWalkExecutionEvent {
-            dag: sui::ObjectID::random(),
-            execution: sui::ObjectID::random(),
-            walk_index: 1,
-            next_vertex: RuntimeVertex::Plain {
-                vertex: TypeName::new("vertex"),
-            },
-            evaluations: sui::ObjectID::random(),
-            worksheet_from_type: TypeName {
-                name: "worksheet".into(),
-            },
-        });
-        assert_eq!(dummy_event.name(), "RequestWalkExecutionEvent");
-
-        let dummy_event = NexusEventKind::AnnounceInterfacePackage(AnnounceInterfacePackageEvent {
-            shared_objects: vec![sui::ObjectID::random()],
-        });
-        assert_eq!(dummy_event.name(), "AnnounceInterfacePackageEvent");
-
-        let dummy_event = NexusEventKind::ToolRegistryCreated(serde_json::json!({}));
-        assert_eq!(dummy_event.name(), "ToolRegistryCreatedEvent");
-
-        let dummy_event = NexusEventKind::LeaderClaimedGas(serde_json::json!({}));
-        assert_eq!(dummy_event.name(), "LeaderClaimedGasEvent");
-    }
-}
diff --git a/sdk/src/events/fetching.rs b/sdk/src/events/fetching.rs
new file mode 100644
index 00000000..e78544e2
--- /dev/null
+++ b/sdk/src/events/fetching.rs
@@ -0,0 +1,316 @@
+//! This module wraps a Sui GQL endpoint to provide the functionality to fetch
+//! events. These are sent over a channel to the consumer. All events are parsed
+//! to [`NexusEvent`]. Those that cannot be parsed are ignored.
+//!
+//! Note that the polling will stop whenever the receiver side of the channel is
+//! dropped.
+
+use {
+    crate::{
+        events::{
+            graphql::events_query::{events_query, EventsQuery},
+            FromSuiGqlEvent,
+            NexusEvent,
+        },
+        idents::primitives,
+        sui,
+        types::NexusObjects,
+    },
+    graphql_client::{GraphQLQuery, Response},
+    reqwest::Client,
+    std::sync::Arc,
+};
+
+/// This struct defines the structure of the message sent over the channel.
+pub struct EventPage {
+    pub events: Vec<NexusEvent>,
+    pub next_cursor: String,
+}
+
+/// The fetcher struct itself. Responsible for creating a poller thread,
+/// fetching and parsing events and sending them over a channel.
+#[derive(Clone)]
+pub struct EventFetcher {
+    url: String,
+    channel_capacity: usize,
+    max_poll_interval: tokio::time::Duration,
+    nexus_objects: Arc<NexusObjects>,
+}
+
+impl EventFetcher {
+    /// Create a new EventFetcher instance pointing to the given graphql URL.
+    pub fn new(url: &str, nexus_objects: Arc<NexusObjects>) -> Self {
+        Self {
+            url: url.to_string(),
+            channel_capacity: 100,
+            max_poll_interval: tokio::time::Duration::from_secs(2),
+            nexus_objects,
+        }
+    }
+
+    /// Set the desired channel capacity.
+    pub fn with_channel_capacity(mut self, capacity: usize) -> Self {
+        self.channel_capacity = capacity;
+        self
+    }
+
+    /// Set the maximum polling interval.
+    pub fn with_max_poll_interval(mut self, interval: tokio::time::Duration) -> Self {
+        self.max_poll_interval = interval;
+        self
+    }
+
+    /// Start polling for events and sending them over the given channel. Return
+    /// the JoinHandle of the polling task as well as the channel receiver.
+    pub fn poll_nexus_events(
+        &self,
+        from_cursor: Option<String>,
+        from_checkpoint: Option<u64>,
+    ) -> (
+        tokio::task::JoinHandle<()>,
+        tokio::sync::mpsc::Receiver<anyhow::Result<EventPage>>,
+    ) {
+        let (notify_about_events, next_page) =
+            tokio::sync::mpsc::channel::<anyhow::Result<EventPage>>(self.channel_capacity);
+
+        let poller = {
+            let nexus_objects = self.nexus_objects.clone();
+            let url = self.url.clone();
+            let mut cursor = from_cursor;
+            let after_checkpoint = from_checkpoint;
+
+            // Polling intervals.
+            let mut poll_interval = tokio::time::Duration::from_millis(100);
+            let max_poll_interval = self.max_poll_interval;
+
+            // NOTE: that the poller process is infallible. RPC errors result
+            // in backoff and retry. Events that cannot be parsed are ignored.
+            tokio::spawn(async move {
+                let event_wrapper = sui::types::StructTag::new(
+                    nexus_objects.primitives_pkg_id,
+                    primitives::Event::EVENT_WRAPPER.module,
+                    primitives::Event::EVENT_WRAPPER.name,
+                    vec![],
+                );
+
+                loop {
+                    let request = events_query::Variables {
+                        after: cursor.clone(),
+                        filter: events_query::EventFilter {
+                            type_: Some(event_wrapper.to_string()),
+                            sender: None,
+                            after_checkpoint,
+                            at_checkpoint: None,
+                            before_checkpoint: None,
+                            module: None,
+                        },
+                    };
+
+                    let query = EventsQuery::build_query(request);
+                    let client = Client::new();
+
+                    // Send the GQL request.
+                    let response = match client.post(&url).json(&query).send().await {
+                        Ok(resp) => resp,
+                        Err(e) => {
+                            if let Err(_) = notify_about_events
+                                .send(Err(anyhow::anyhow!("Failed to send GQL request: {e}")))
+                                .await
+                            {
+                                // Receiver dropped, exit the poller process.
+                                break;
+                            }
+
+                            Self::sleep_and_backoff(&mut poll_interval, max_poll_interval).await;
+
+                            continue;
+                        }
+                    };
+
+                    // Parse the GQL response.
+                    let response: Response<events_query::ResponseData> = match response.json().await
+                    {
+                        Ok(data) => data,
+                        Err(e) => {
+                            if let Err(_) = notify_about_events
+                                .send(Err(anyhow::anyhow!("Failed to send GQL request: {e}")))
+                                .await
+                            {
+                                // Receiver dropped, exit the poller process.
+                                break;
+                            }
+
+                            Self::sleep_and_backoff(&mut poll_interval, max_poll_interval).await;
+
+                            continue;
+                        }
+                    };
+
+                    // Parse the response data.
+                    let (events, page_info) = match response
+                        .data
+                        .and_then(|d| d.events)
+                        .map(|e| (e.nodes, e.page_info))
+                    {
+                        Some((events, page_info)) => (events, page_info),
+                        None => {
+                            Self::sleep_and_backoff(&mut poll_interval, max_poll_interval).await;
+
+                            continue;
+                        }
+                    };
+
+                    // If there are no events, backoff.
+                    if events.is_empty() {
+                        Self::sleep_and_backoff(&mut poll_interval, max_poll_interval).await;
+
+                        continue;
+                    }
+
+                    // Cursor is only empty when there are no events. Meaning
+                    // this should never be reached.
+                    let Some(next_cursor) = page_info.end_cursor.clone() else {
+                        continue;
+                    };
+
+                    let nexus_events = events.into_iter().filter_map(|event| {
+                        let index = event.sequence_number;
+                        let digest = event.transaction.and_then(|t| t.digest.parse().ok())?;
+                        let package_id = event.transaction_module?.package?.address;
+                        let contents = event.contents?;
+
+                        NexusEvent::from_sui_gql_event(
+                            index,
+                            digest,
+                            package_id,
+                            &contents,
+                            &nexus_objects,
+                        )
+                        .ok()
+                    });
+
+                    cursor = Some(next_cursor.clone());
+
+                    match notify_about_events
+                        .send(Ok(EventPage {
+                            events: nexus_events.collect(),
+                            next_cursor,
+                        }))
+                        .await
+                    {
+                        Ok(()) => {
+                            poll_interval = tokio::time::Duration::from_millis(100);
+
+                            tokio::time::sleep(poll_interval).await;
+                        }
+                        Err(_) => {
+                            // Receiver dropped, exit the poller process.
+                            break;
+                        }
+                    }
+                }
+            })
+        };
+
+        (poller, next_page)
+    }
+
+    async fn sleep_and_backoff(
+        current_interval: &mut tokio::time::Duration,
+        max_interval: tokio::time::Duration,
+    ) {
+        tokio::time::sleep(*current_interval).await;
+
+        *current_interval = std::cmp::min(*current_interval * 2, max_interval);
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use {
+        super::*,
+        crate::{
+            events::{DAGCreatedEvent, NexusEventKind},
+            sui,
+            test_utils::sui_mocks,
+        },
+        mockito::Server,
+    };
+
+    #[tokio::test]
+    async fn test_event_fetcher_polling() {
+        let mut rng = rand::thread_rng();
+        let mut server = Server::new_async().await;
+        let objects = sui_mocks::mock_nexus_objects();
+        let primitives_pkg_id = objects.primitives_pkg_id;
+
+        let dag_id_1 = sui::types::Address::generate(&mut rng);
+        let dag_id_2 = sui::types::Address::generate(&mut rng);
+        let dag_id_3 = sui::types::Address::generate(&mut rng);
+        let events = vec![
+            NexusEventKind::DAGCreated(DAGCreatedEvent { dag: dag_id_1 }),
+            NexusEventKind::DAGCreated(DAGCreatedEvent { dag: dag_id_2 }),
+            NexusEventKind::DAGCreated(DAGCreatedEvent { dag: dag_id_3 }),
+        ];
+        let digest = sui::types::Digest::generate(&mut rng);
+
+        let mock = sui_mocks::gql::mock_event_query(
+            &mut server,
+            primitives_pkg_id,
+            events.clone(),
+            Some(digest),
+            Some("12345"),
+        );
+
+        let fetcher = EventFetcher::new(&format!("{}/graphql", &server.url()), Arc::new(objects));
+
+        let (_poller, mut receiver) = fetcher.poll_nexus_events(None, None);
+
+        if let Some(Ok(page)) = receiver.recv().await {
+            assert_eq!(page.next_cursor, "12345".to_string());
+            assert_eq!(page.events.len(), 3);
+
+            let first_event = &page.events[0];
+            assert_eq!(first_event.id, (digest, 0));
+            assert!(matches!(
+                first_event.data,
+                NexusEventKind::DAGCreated(DAGCreatedEvent { dag }) if dag == dag_id_1
+            ));
+
+            let second_event = &page.events[1];
+            assert_eq!(second_event.id, (digest, 1));
+            assert!(matches!(
+                second_event.data,
+                NexusEventKind::DAGCreated(DAGCreatedEvent { dag }) if dag == dag_id_2
+            ));
+
+            let third_event = &page.events[2];
+            assert_eq!(third_event.id, (digest, 2));
+            assert!(matches!(
+                third_event.data,
+                NexusEventKind::DAGCreated(DAGCreatedEvent { dag }) if dag == dag_id_3
+            ));
+        } else {
+            panic!("Did not receive any events from the fetcher.");
+        }
+
+        mock.assert_async().await;
+    }
+
+    #[tokio::test]
+    async fn test_event_fetcher_wrong_url() {
+        let objects = sui_mocks::mock_nexus_objects();
+        let fetcher = EventFetcher::new("http://invalid.url", Arc::new(objects));
+
+        let (_poller, mut receiver) = fetcher.poll_nexus_events(None, None);
+
+        if let Some(result) = receiver.recv().await {
+            assert!(result.is_err());
+            assert!(
+                matches!(result, Err(e) if e.to_string().contains("Failed to send GQL request"))
+            );
+        } else {
+            panic!("Did not receive any events from the fetcher.");
+        }
+    }
+}
diff --git a/sdk/src/events/graphql/events_query.graphql b/sdk/src/events/graphql/events_query.graphql
new file mode 100644
index 00000000..8ba9e567
--- /dev/null
+++ b/sdk/src/events/graphql/events_query.graphql
@@ -0,0 +1,24 @@
+query EventsQuery($after: String, $filter: EventFilter!) {
+  events(first: 50, after: $after, filter: $filter) {
+    nodes {
+      sequenceNumber
+      transaction {
+        digest
+      }
+      transactionModule {
+        package {
+          address
+        }
+      }
+      contents {
+        json
+        type {
+          repr
+        }
+      }
+    }
+    pageInfo {
+      endCursor
+    }
+  }
+}
diff --git a/sdk/src/events/graphql/events_query.rs b/sdk/src/events/graphql/events_query.rs
new file mode 100644
index 00000000..41860e1e
--- /dev/null
+++ b/sdk/src/events/graphql/events_query.rs
@@ -0,0 +1,14 @@
+use graphql_client::GraphQLQuery;
+
+type SuiAddress = sui_sdk_types::Address;
+type UInt53 = u64;
+#[allow(clippy::upper_case_acronyms)]
+type JSON = serde_json::Value;
+
+#[derive(GraphQLQuery)]
+#[graphql(
+    schema_path = "src/events/graphql/schema-1.61.2.graphql",
+    query_path = "src/events/graphql/events_query.graphql",
+    response_derives = "Debug"
+)]
+pub struct EventsQuery;
diff --git a/sdk/src/events/graphql/mod.rs b/sdk/src/events/graphql/mod.rs
new file mode 100644
index 00000000..3a4a8de7
--- /dev/null
+++ b/sdk/src/events/graphql/mod.rs
@@ -0,0 +1 @@
+pub mod events_query;
diff --git a/sdk/src/events/graphql/schema-1.61.2.graphql b/sdk/src/events/graphql/schema-1.61.2.graphql
new file mode 100644
index 00000000..3b5cf63b
--- /dev/null
+++ b/sdk/src/events/graphql/schema-1.61.2.graphql
@@ -0,0 +1,5370 @@
+"""
+System transaction for creating the accumulator root.
+"""
+type AccumulatorRootCreateTransaction {
+  """
+  A workaround to define an empty variant of a GraphQL union.
+  """
+  _: Boolean
+}
+
+type ActiveJwk {
+  """
+  The string (Issuing Authority) that identifies the OIDC provider.
+  """
+  iss: String
+
+  """
+  The string (Key ID) that identifies the JWK among a set of JWKs, (RFC 7517, Section 4.5).
+  """
+  kid: String
+
+  """
+  The JWK key type parameter, (RFC 7517, Section 4.1).
+  """
+  kty: String
+
+  """
+  The JWK RSA public exponent, (RFC 7517, Section 9.3).
+  """
+  e: String
+
+  """
+  The JWK RSA modulus, (RFC 7517, Section 9.3).
+  """
+  n: String
+
+  """
+  The JWK algorithm parameter, (RFC 7517, Section 4.4).
+  """
+  alg: String
+
+  """
+  The most recent epoch in which the JWK was validated.
+  """
+  epoch: Epoch
+}
+
+type ActiveJwkConnection {
+  """
+  Information to aid in pagination.
+  """
+  pageInfo: PageInfo!
+
+  """
+  A list of edges.
+  """
+  edges: [ActiveJwkEdge!]!
+
+  """
+  A list of nodes.
+  """
+  nodes: [ActiveJwk!]!
+}
+
+"""
+An edge in a connection.
+"""
+type ActiveJwkEdge {
+  """
+  The item at the end of the edge
+  """
+  node: ActiveJwk!
+
+  """
+  A cursor for use in pagination
+  """
+  cursor: String!
+}
+
+type Address implements IAddressable {
+  """
+  The Address' identifier, a 32-byte number represented as a 64-character hex string, with a lead "0x".
+  """
+  address: SuiAddress!
+
+  """
+  Attempts to fetch the object at this address.
+  """
+  asObject: Object
+
+  """
+  Fetch the total balance for coins with marker type `coinType` (e.g. `0x2::sui::SUI`), owned by this address.
+
+  Returns `None` when no checkpoint is set in scope (e.g. execution scope).
+  If the address does not own any coins of that type, a balance of zero is returned.
+  """
+  balance(coinType: String!): Balance
+
+  """
+  Total balance across coins owned by this address, grouped by coin type.
+  """
+  balances(
+    first: Int
+    after: String
+    last: Int
+    before: String
+  ): BalanceConnection
+
+  """
+  The domain explicitly configured as the default SuiNS name for this address.
+  """
+  defaultSuinsName: String
+
+  """
+  Access a dynamic field on an object using its type and BCS-encoded name.
+
+  Returns `null` if a dynamic field with that name could not be found attached to the object with this address.
+  """
+  dynamicField(name: DynamicFieldName!): DynamicField
+
+  """
+  Dynamic fields owned by this address.
+
+  The address must correspond to an object (account addresses cannot own dynamic fields), but that object may be wrapped.
+  """
+  dynamicFields(
+    first: Int
+    after: String
+    last: Int
+    before: String
+  ): DynamicFieldConnection
+
+  """
+  Access a dynamic object field on an object using its type and BCS-encoded name.
+
+  Returns `null` if a dynamic object field with that name could not be found attached to the object with this address.
+  """
+  dynamicObjectField(name: DynamicFieldName!): DynamicField
+
+  """
+  Access dynamic fields on an object using their types and BCS-encoded names.
+
+  Returns a list of dynamic fields that is guaranteed to be the same length as `keys`. If a dynamic field in `keys` could not be found in the store, its corresponding entry in the result will be `null`.
+  """
+  multiGetDynamicFields(keys: [DynamicFieldName!]!): [DynamicField]!
+
+  """
+  Access dynamic object fields on an object using their types and BCS-encoded names.
+
+  Returns a list of dynamic object fields that is guaranteed to be the same length as `keys`. If a dynamic object field in `keys` could not be found in the store, its corresponding entry in the result will be `null`.
+  """
+  multiGetDynamicObjectFields(keys: [DynamicFieldName!]!): [DynamicField]!
+
+  """
+  Fetch the total balances keyed by coin types (e.g. `0x2::sui::SUI`) owned by this address.
+
+  Returns `None` when no checkpoint is set in scope (e.g. execution scope).
+  If the address does not own any coins of a given type, a balance of zero is returned for that type.
+  """
+  multiGetBalances(keys: [String!]!): [Balance!]
+
+  """
+  Objects owned by this address, optionally filtered by type.
+  """
+  objects(
+    first: Int
+    after: String
+    last: Int
+    before: String
+    filter: ObjectFilter
+  ): MoveObjectConnection
+
+  """
+  Transactions associated with this address.
+
+  Similar behavior to the `transactions` in Query but supporting the additional `AddressTransactionRelationship` filter, which defaults to `SENT`.
+  """
+  transactions(
+    first: Int
+    after: String
+    last: Int
+    before: String
+    relation: AddressTransactionRelationship
+    filter: TransactionFilter
+  ): TransactionConnection
+}
+
+"""
+Object is exclusively owned by a single address, and is mutable.
+"""
+type AddressOwner {
+  """
+  The owner's address.
+  """
+  address: Address
+}
+
+"""
+The possible relationship types for a transaction: sent or affected.
+"""
+enum AddressTransactionRelationship {
+  """
+  Transactions this address has sent.
+  """
+  SENT
+
+  """
+  Transactions that this address was involved in, either as the sender, sponsor, or as the owner of some object that was created, modified or transferred.
+  """
+  AFFECTED
+}
+
+"""
+System transaction for creating the on-chain state used by zkLogin.
+"""
+type AuthenticatorStateCreateTransaction {
+  """
+  A workaround to define an empty variant of a GraphQL union.
+  """
+  _: Boolean
+}
+
+"""
+System transaction that is executed at the end of an epoch to expire JSON Web Keys (JWKs) that are no longer valid, based on their associated epoch. This is part of the on-chain state management for zkLogin and authentication.
+"""
+type AuthenticatorStateExpireTransaction {
+  """
+  Expire JWKs that have a lower epoch than this.
+  """
+  minEpoch: Epoch
+
+  """
+  The initial version that the AuthenticatorStateUpdate was shared at.
+  """
+  authenticatorObjInitialSharedVersion: UInt53
+}
+
+type AuthenticatorStateUpdateTransaction {
+  """
+  Epoch of the authenticator state update transaction.
+  """
+  epoch: Epoch
+
+  """
+  Consensus round of the authenticator state update.
+  """
+  round: UInt53
+
+  """
+  Newly active JWKs (JSON Web Keys).
+  """
+  newActiveJwks(
+    first: Int
+    after: String
+    last: Int
+    before: String
+  ): ActiveJwkConnection
+
+  """
+  The initial version of the authenticator object that it was shared at.
+  """
+  authenticatorObjInitialSharedVersion: UInt53
+}
+
+"""
+Checkpoint range for which data is available.
+"""
+type AvailableRange {
+  """
+  Inclusive lower checkpoint for which data is available.
+  """
+  first: Checkpoint
+
+  """
+  Inclusive upper checkpoint for which data is available.
+  """
+  last: Checkpoint
+}
+
+"""
+The total balance for a particular coin type.
+"""
+type Balance {
+  """
+  Coin type for the balance, such as `0x2::sui::SUI`.
+  """
+  coinType: MoveType
+
+  """
+  The total balance across all coin objects of this coin type.
+  """
+  totalBalance: BigInt
+}
+
+"""
+Effects to the balance (sum of coin values per coin type) of addresses and objects.
+"""
+type BalanceChange {
+  """
+  The address or object whose balance has changed.
+  """
+  owner: Address
+
+  """
+  The inner type of the coin whose balance has changed (e.g. `0x2::sui::SUI`).
+  """
+  coinType: MoveType
+
+  """
+  The signed balance change.
+  """
+  amount: BigInt
+}
+
+type BalanceChangeConnection {
+  """
+  Information to aid in pagination.
+  """
+  pageInfo: PageInfo!
+
+  """
+  A list of edges.
+  """
+  edges: [BalanceChangeEdge!]!
+
+  """
+  A list of nodes.
+  """
+  nodes: [BalanceChange!]!
+}
+
+"""
+An edge in a connection.
+"""
+type BalanceChangeEdge {
+  """
+  The item at the end of the edge
+  """
+  node: BalanceChange!
+
+  """
+  A cursor for use in pagination
+  """
+  cursor: String!
+}
+
+type BalanceConnection {
+  """
+  Information to aid in pagination.
+  """
+  pageInfo: PageInfo!
+
+  """
+  A list of edges.
+  """
+  edges: [BalanceEdge!]!
+
+  """
+  A list of nodes.
+  """
+  nodes: [Balance!]!
+}
+
+"""
+An edge in a connection.
+"""
+type BalanceEdge {
+  """
+  The item at the end of the edge
+  """
+  node: Balance!
+
+  """
+  A cursor for use in pagination
+  """
+  cursor: String!
+}
+
+"""
+String containing Base64-encoded binary data.
+"""
+scalar Base64
+
+"""
+String representation of an arbitrary width, possibly signed integer
+"""
+scalar BigInt
+
+"""
+System transaction for initializing bridge committee.
+"""
+type BridgeCommitteeInitTransaction {
+  """
+  The initial shared version of the bridge object.
+  """
+  bridgeObjectVersion: UInt53
+}
+
+"""
+System transaction for creating bridge state for cross-chain operations.
+"""
+type BridgeStateCreateTransaction {
+  """
+  The chain identifier for which this bridge state is being created.
+  """
+  chainIdentifier: String
+}
+
+"""
+A system transaction that updates epoch information on-chain (increments the current epoch). Executed by the system once per epoch, without using gas. Epoch change transactions cannot be submitted by users, because validators will refuse to sign them.
+
+This transaction kind is deprecated in favour of `EndOfEpochTransaction`.
+"""
+type ChangeEpochTransaction {
+  """
+  The next (to become) epoch.
+  """
+  epoch: Epoch
+
+  """
+  The epoch's corresponding protocol configuration.
+  """
+  protocolConfigs: ProtocolConfigs
+
+  """
+  The total amount of gas charged for storage during the epoch.
+  """
+  storageCharge: UInt53
+
+  """
+  The total amount of gas charged for computation during the epoch.
+  """
+  computationCharge: UInt53
+
+  """
+  The amount of storage rebate refunded to the transaction senders.
+  """
+  storageRebate: UInt53
+
+  """
+  The non-refundable storage fee.
+  """
+  nonRefundableStorageFee: UInt53
+
+  """
+  Unix timestamp when epoch started.
+  """
+  epochStartTimestamp: DateTime
+
+  """
+  System packages that will be written by validators before the new epoch starts, to upgrade them on-chain. These objects do not have a "previous transaction" because they are not written on-chain yet. Consult `effects.objectChanges` for this transaction to see the actual objects written.
+  """
+  systemPackages(
+    first: Int
+    after: String
+    last: Int
+    before: String
+  ): MovePackageConnection
+}
+
+"""
+Checkpoints contain finalized transactions and are used for node synchronization and global transaction ordering.
+"""
+type Checkpoint {
+  """
+  The checkpoint's position in the total order of finalized checkpoints, agreed upon by consensus.
+  """
+  sequenceNumber: UInt53!
+
+  """
+  Query the RPC as if this checkpoint were the latest checkpoint.
+  """
+  query: Query
+
+  """
+  A commitment by the committee at each checkpoint on the artifacts of the checkpoint.
+  e.g., object checkpoint states
+  """
+  artifactsDigest: String
+
+  """
+  A 32-byte hash that uniquely identifies the checkpoint, encoded in Base58. This is a hash of the checkpoint's summary.
+  """
+  digest: String
+
+  """
+  A 32-byte hash that uniquely identifies the checkpoint's content, encoded in Base58.
+  """
+  contentDigest: String
+
+  """
+  The epoch that this checkpoint is part of.
+  """
+  epoch: Epoch
+
+  """
+  The total number of transactions in the network by the end of this checkpoint.
+  """
+  networkTotalTransactions: UInt53
+
+  """
+  The digest of the previous checkpoint's summary.
+  """
+  previousCheckpointDigest: String
+
+  """
+  The computation cost, storage cost, storage rebate, and non-refundable storage fee accumulated during this epoch, up to and including this checkpoint. These values increase monotonically across checkpoints in the same epoch, and reset on epoch boundaries.
+  """
+  rollingGasSummary: GasCostSummary
+
+  """
+  The Base64 serialized BCS bytes of this checkpoint's summary.
+  """
+  summaryBcs: Base64
+
+  """
+  The Base64 serialized BCS bytes of this checkpoint's contents.
+  """
+  contentBcs: Base64
+
+  """
+  The timestamp at which the checkpoint is agreed to have happened according to consensus. Transactions that access time in this checkpoint will observe this timestamp.
+  """
+  timestamp: DateTime
+
+  """
+  The aggregation of signatures from a quorum of validators for the checkpoint proposal.
+  """
+  validatorSignatures: ValidatorAggregatedSignature
+  transactions(
+    first: Int
+    after: String
+    last: Int
+    before: String
+    filter: TransactionFilter
+  ): TransactionConnection
+}
+
+type CheckpointConnection {
+  """
+  Information to aid in pagination.
+  """
+  pageInfo: PageInfo!
+
+  """
+  A list of edges.
+  """
+  edges: [CheckpointEdge!]!
+
+  """
+  A list of nodes.
+  """
+  nodes: [Checkpoint!]!
+}
+
+"""
+An edge in a connection.
+"""
+type CheckpointEdge {
+  """
+  The item at the end of the edge
+  """
+  node: Checkpoint!
+
+  """
+  A cursor for use in pagination
+  """
+  cursor: String!
+}
+
+input CheckpointFilter {
+  """
+  Limit query results to checkpoints at this epoch.
+  """
+  atEpoch: UInt53
+
+  """
+  Limit query results to checkpoints that occurred strictly after the given checkpoint.
+  """
+  afterCheckpoint: UInt53
+
+  """
+  Limit query results to checkpoints that occurred at the given checkpoint.
+  """
+  atCheckpoint: UInt53
+
+  """
+  Limit query results to checkpoints that occurred strictly before the given checkpoint.
+  """
+  beforeCheckpoint: UInt53
+}
+
+"""
+System transaction for creating the coin deny list state.
+"""
+type CoinDenyListStateCreateTransaction {
+  """
+  A workaround to define an empty variant of a GraphQL union.
+  """
+  _: Boolean
+}
+
+"""
+An object representing metadata about a coin type.
+"""
+type CoinMetadata implements IAddressable & IMoveObject & IObject {
+  """
+  The CoinMetadata's ID.
+  """
+  address: SuiAddress!
+
+  """
+  The version of this object that this content comes from.
+  """
+  version: UInt53
+
+  """
+  32-byte hash that identifies the object's contents, encoded in Base58.
+  """
+  digest: String
+
+  """
+  Fetch the total balance for coins with marker type `coinType` (e.g. `0x2::sui::SUI`), owned by this address.
+
+  If the address does not own any coins of that type, a balance of zero is returned.
+  """
+  balance(coinType: String!): Balance
+
+  """
+  Total balance across coins owned by this address, grouped by coin type.
+  """
+  balances(
+    first: Int
+    after: String
+    last: Int
+    before: String
+  ): BalanceConnection
+
+  """
+  The structured representation of the object's contents.
+  """
+  contents: MoveValue
+
+  """
+  Number of decimal places the coin uses.
+  """
+  decimals: Int
+
+  """
+  The domain explicitly configured as the default SuiNS name for this address.
+  """
+  defaultSuinsName: String
+
+  """
+  Description of the coin.
+  """
+  description: String
+
+  """
+  Access a dynamic field on an object using its type and BCS-encoded name.
+
+  Returns `null` if a dynamic field with that name could not be found attached to this object.
+  """
+  dynamicField(name: DynamicFieldName!): DynamicField
+
+  """
+  Dynamic fields owned by this object.
+
+  Dynamic fields on wrapped objects can be accessed using `Address.dynamicFields`.
+  """
+  dynamicFields(
+    first: Int
+    after: String
+    last: Int
+    before: String
+  ): DynamicFieldConnection
+
+  """
+  Access a dynamic object field on an object using its type and BCS-encoded name.
+
+  Returns `null` if a dynamic object field with that name could not be found attached to this object.
+  """
+  dynamicObjectField(name: DynamicFieldName!): DynamicField
+
+  """
+  Whether this object can be transferred using the `TransferObjects` Programmable Transaction Command or `sui::transfer::public_transfer`.
+
+  Both these operations require the object to have both the `key` and `store` abilities.
+  """
+  hasPublicTransfer: Boolean
+
+  """
+  URL for the coin logo.
+  """
+  iconUrl: String
+
+  """
+  Access dynamic fields on an object using their types and BCS-encoded names.
+
+  Returns a list of dynamic fields that is guaranteed to be the same length as `keys`. If a dynamic field in `keys` could not be found in the store, its corresponding entry in the result will be `null`.
+  """
+  multiGetDynamicFields(keys: [DynamicFieldName!]!): [DynamicField]!
+
+  """
+  Access dynamic object fields on an object using their types and BCS-encoded names.
+
+  Returns a list of dynamic object fields that is guaranteed to be the same length as `keys`. If a dynamic object field in `keys` could not be found in the store, its corresponding entry in the result will be `null`.
+  """
+  multiGetDynamicObjectFields(keys: [DynamicFieldName!]!): [DynamicField]!
+
+  """
+  The Base64-encoded BCS serialize of this object, as a `MoveObject`.
+  """
+  moveObjectBcs: Base64
+
+  """
+  Fetch the total balances keyed by coin types (e.g. `0x2::sui::SUI`) owned by this address.
+
+  If the address does not own any coins of a given type, a balance of zero is returned for that type.
+  """
+  multiGetBalances(keys: [String!]!): [Balance!]
+
+  """
+  Name for the coin.
+  """
+  name: String
+
+  """
+  Fetch the object with the same ID, at a different version, root version bound, or checkpoint.
+  """
+  objectAt(version: UInt53, rootVersion: UInt53, checkpoint: UInt53): Object
+
+  """
+  The Base64-encoded BCS serialization of this object, as an `Object`.
+  """
+  objectBcs: Base64
+
+  """
+  Paginate all versions of this object after this one.
+  """
+  objectVersionsAfter(
+    first: Int
+    after: String
+    last: Int
+    before: String
+    filter: VersionFilter
+  ): ObjectConnection
+
+  """
+  Paginate all versions of this object before this one.
+  """
+  objectVersionsBefore(
+    first: Int
+    after: String
+    last: Int
+    before: String
+    filter: VersionFilter
+  ): ObjectConnection
+
+  """
+  Objects owned by this object, optionally filtered by type.
+  """
+  objects(
+    first: Int
+    after: String
+    last: Int
+    before: String
+    filter: ObjectFilter
+  ): MoveObjectConnection
+
+  """
+  The object's owner kind.
+  """
+  owner: Owner
+
+  """
+  The transaction that created this version of the object.
+  """
+  previousTransaction: Transaction
+
+  """
+  The SUI returned to the sponsor or sender of the transaction that modifies or deletes this object.
+  """
+  storageRebate: BigInt
+
+  """
+  The transactions that sent objects to this object.
+  """
+  receivedTransactions(
+    first: Int
+    after: String
+    last: Int
+    before: String
+    filter: TransactionFilter
+  ): TransactionConnection
+
+  """
+  Whether the currency is regulated or not. `null` indicates that the regulatory status is unknown.
+  """
+  regulatedState: RegulatedState
+
+  """
+  Whether the `DenyCap` can be used to enable a global pause that behaves as if all addresses were added to the deny list. `null` indicates that it is not known whether the currency can be paused or not. This field is only populated on currencies held in the Coin Registry. To determine whether a legacy currency can be paused, check the contents of its `DenyCap`, if it can be found.
+  """
+  allowGlobalPause: Boolean
+
+  """
+  If the currency is regulated, this object represents the capability to modify the deny list. If a capability is known but wrapped, its address can be fetched but other fields will not be accessible.
+  """
+  denyCap: MoveObject
+
+  """
+  Future behavior of the supply. `null` indicates that the future behavior of the supply is not known because the currency's treasury still exists.
+  """
+  supplyState: SupplyState
+
+  """
+  The overall balance of coins issued.
+  """
+  supply: BigInt
+
+  """
+  Symbol for the coin.
+  """
+  symbol: String
+}
+
+"""
+System transaction for creating the coin registry.
+"""
+type CoinRegistryCreateTransaction {
+  """
+  A workaround to define an empty variant of a GraphQL union.
+  """
+  _: Boolean
+}
+
+"""
+A single command in the programmable transaction.
+"""
+union Command =
+    MakeMoveVecCommand
+  | MergeCoinsCommand
+  | MoveCallCommand
+  | PublishCommand
+  | SplitCoinsCommand
+  | TransferObjectsCommand
+  | UpgradeCommand
+  | OtherCommand
+
+type CommandConnection {
+  """
+  Information to aid in pagination.
+  """
+  pageInfo: PageInfo!
+
+  """
+  A list of edges.
+  """
+  edges: [CommandEdge!]!
+
+  """
+  A list of nodes.
+  """
+  nodes: [Command!]!
+}
+
+"""
+An edge in a connection.
+"""
+type CommandEdge {
+  """
+  The item at the end of the edge
+  """
+  node: Command!
+
+  """
+  A cursor for use in pagination
+  """
+  cursor: String!
+}
+
+"""
+A value produced or modified during command execution.
+
+This can represent either a return value from a command or an argument that was mutated by reference.
+"""
+type CommandOutput {
+  """
+  The transaction argument that this value corresponds to (if any).
+  """
+  argument: TransactionArgument
+
+  """
+  The structured Move value, if available.
+  """
+  value: MoveValue
+}
+
+"""
+The intermediate results for each command of a transaction simulation.
+"""
+type CommandResult {
+  """
+  Return results of each command in this transaction.
+  """
+  returnValues: [CommandOutput!]
+
+  """
+  Changes made to arguments that were mutably borrowed by each command in this transaction.
+  """
+  mutatedReferences: [CommandOutput!]
+}
+
+"""
+Object is exclusively owned by a single address and sequenced via consensus.
+"""
+type ConsensusAddressOwner {
+  """
+  The version at which the object most recently bcame a consensus object. This serves the same function as `Shared.initialSharedVersion`, except it may change if the object's `owner` type changes.
+  """
+  startVersion: UInt53
+
+  """
+  The owner's address.
+  """
+  address: Address
+}
+
+"""
+System transaction that runs at the beginning of a checkpoint, and is responsible for setting the current value of the clock, based on the timestamp from consensus.
+"""
+type ConsensusCommitPrologueTransaction {
+  """
+  Epoch of the commit prologue transaction.
+
+  Present in V1, V2, V3, V4.
+  """
+  epoch: Epoch
+
+  """
+  Consensus round of the commit.
+
+  Present in V1, V2, V3, V4.
+  """
+  round: UInt53
+
+  """
+  Unix timestamp from consensus.
+
+  Present in V1, V2, V3, V4.
+  """
+  commitTimestamp: DateTime
+
+  """
+  Digest of consensus output, encoded as a Base58 string.
+
+  Present in V2, V3, V4.
+  """
+  consensusCommitDigest: String
+
+  """
+  The sub DAG index of the consensus commit. This field is populated if there
+  are multiple consensus commits per round.
+
+  Present in V3, V4.
+  """
+  subDagIndex: UInt53
+
+  """
+  Digest of any additional state computed by the consensus handler.
+  Used to detect forking bugs as early as possible.
+
+  Present in V4.
+  """
+  additionalStateDigest: String
+}
+
+"""
+Reason why a transaction that attempted to access a consensus-managed object was cancelled.
+"""
+enum ConsensusObjectCancellationReason {
+  """
+  Read operation was cancelled.
+  """
+  CANCELLED_READ
+
+  """
+  Object congestion prevented execution.
+  """
+  CONGESTED
+
+  """
+  Randomness service was unavailable.
+  """
+  RANDOMNESS_UNAVAILABLE
+
+  """
+  Internal use only.
+  """
+  UNKNOWN
+}
+
+"""
+A transaction that was cancelled before it could access the consensus-managed object, so the object was an input but remained unchanged.
+"""
+type ConsensusObjectCancelled {
+  """
+  The ID of the consensus-managed object that the transaction intended to access.
+  """
+  address: SuiAddress
+
+  """
+  Reason why the transaction was cancelled.
+  """
+  cancellationReason: ConsensusObjectCancellationReason
+}
+
+type ConsensusObjectRead {
+  """
+  The version of the consensus-managed object that was read by this transaction.
+  """
+  object: Object
+}
+
+"""
+ISO-8601 Date and Time: RFC3339 in UTC with format: YYYY-MM-DDTHH:MM:SS.mmmZ. Note that the milliseconds part is optional, and it may be omitted if its value is 0.
+"""
+scalar DateTime
+
+"""
+A rendered JSON blob based on an on-chain template.
+"""
+type Display {
+  """
+  Output for all successfully substituted display fields. Unsuccessful fields will be `null`, and will be accompanied by a field in `errors`, explaining the error.
+  """
+  output: JSON
+
+  """
+  If any fields failed to render, this will contain a mapping from failed field names to error messages. If all fields succeed, this will be `null`.
+  """
+  errors: JSON
+}
+
+"""
+System transaction for creating the display registry.
+"""
+type DisplayRegistryCreateTransaction {
+  """
+  A workaround to define an empty variant of a GraphQL union.
+  """
+  _: Boolean
+}
+
+"""
+Dynamic fields are heterogenous fields that can be added or removed from an object at runtime. Their names are arbitrary Move values that have `copy`, `drop`, and `store`.
+
+There are two sub-types of dynamic fields:
+
+- Dynamic fields can store any value that has `store`. Objects stored in this kind of field will be considered wrapped (not accessible via its ID by external tools like explorers, wallets, etc. accessing storage).
+- Dynamic object fields can only store objects (values that have the `key` ability, and an `id: UID` as its first field) that have `store`, but they will still be directly accessible off-chain via their ID after being attached as a field.
+"""
+type DynamicField implements IAddressable & IMoveObject & IObject {
+  """
+  The DynamicField's ID.
+  """
+  address: SuiAddress!
+
+  """
+  The version of this object that this content comes from.
+  """
+  version: UInt53
+
+  """
+  32-byte hash that identifies the object's contents, encoded in Base58.
+  """
+  digest: String
+
+  """
+  Fetch the total balance for coins with marker type `coinType` (e.g. `0x2::sui::SUI`), owned by this address.
+
+  If the address does not own any coins of that type, a balance of zero is returned.
+  """
+  balance(coinType: String!): Balance
+
+  """
+  Total balance across coins owned by this address, grouped by coin type.
+  """
+  balances(
+    first: Int
+    after: String
+    last: Int
+    before: String
+  ): BalanceConnection
+
+  """
+  The structured representation of the object's contents.
+  """
+  contents: MoveValue
+
+  """
+  The domain explicitly configured as the default SuiNS name for this address.
+  """
+  defaultSuinsName: String
+
+  """
+  Access a dynamic field on an object using its type and BCS-encoded name.
+
+  Returns `null` if a dynamic field with that name could not be found attached to this object.
+  """
+  dynamicField(name: DynamicFieldName!): DynamicField
+
+  """
+  Dynamic fields owned by this object.
+
+  Dynamic fields on wrapped objects can be accessed using `Address.dynamicFields`.
+  """
+  dynamicFields(
+    first: Int
+    after: String
+    last: Int
+    before: String
+  ): DynamicFieldConnection
+
+  """
+  Access a dynamic object field on an object using its type and BCS-encoded name.
+
+  Returns `null` if a dynamic object field with that name could not be found attached to this object.
+  """
+  dynamicObjectField(name: DynamicFieldName!): DynamicField
+
+  """
+  Whether this object can be transferred using the `TransferObjects` Programmable Transaction Command or `sui::transfer::public_transfer`.
+
+  Both these operations require the object to have both the `key` and `store` abilities.
+  """
+  hasPublicTransfer: Boolean
+
+  """
+  Access dynamic fields on an object using their types and BCS-encoded names.
+
+  Returns a list of dynamic fields that is guaranteed to be the same length as `keys`. If a dynamic field in `keys` could not be found in the store, its corresponding entry in the result will be `null`.
+  """
+  multiGetDynamicFields(keys: [DynamicFieldName!]!): [DynamicField]!
+
+  """
+  Access dynamic object fields on an object using their types and BCS-encoded names.
+
+  Returns a list of dynamic object fields that is guaranteed to be the same length as `keys`. If a dynamic object field in `keys` could not be found in the store, its corresponding entry in the result will be `null`.
+  """
+  multiGetDynamicObjectFields(keys: [DynamicFieldName!]!): [DynamicField]!
+
+  """
+  The Base64-encoded BCS serialize of this object, as a `MoveObject`.
+  """
+  moveObjectBcs: Base64
+
+  """
+  Fetch the total balances keyed by coin types (e.g. `0x2::sui::SUI`) owned by this address.
+
+  If the address does not own any coins of a given type, a balance of zero is returned for that type.
+  """
+  multiGetBalances(keys: [String!]!): [Balance!]
+
+  """
+  The dynamic field's name, as a Move value.
+  """
+  name: MoveValue
+
+  """
+  Fetch the object with the same ID, at a different version, root version bound, or checkpoint.
+  """
+  objectAt(version: UInt53, rootVersion: UInt53, checkpoint: UInt53): Object
+
+  """
+  The Base64-encoded BCS serialization of this object, as an `Object`.
+  """
+  objectBcs: Base64
+
+  """
+  Paginate all versions of this object after this one.
+  """
+  objectVersionsAfter(
+    first: Int
+    after: String
+    last: Int
+    before: String
+    filter: VersionFilter
+  ): ObjectConnection
+
+  """
+  Paginate all versions of this object before this one.
+  """
+  objectVersionsBefore(
+    first: Int
+    after: String
+    last: Int
+    before: String
+    filter: VersionFilter
+  ): ObjectConnection
+
+  """
+  Objects owned by this object, optionally filtered by type.
+  """
+  objects(
+    first: Int
+    after: String
+    last: Int
+    before: String
+    filter: ObjectFilter
+  ): MoveObjectConnection
+
+  """
+  The object's owner kind.
+  """
+  owner: Owner
+
+  """
+  The transaction that created this version of the object.
+  """
+  previousTransaction: Transaction
+
+  """
+  The SUI returned to the sponsor or sender of the transaction that modifies or deletes this object.
+  """
+  storageRebate: BigInt
+
+  """
+  The transactions that sent objects to this object.
+  """
+  receivedTransactions(
+    first: Int
+    after: String
+    last: Int
+    before: String
+    filter: TransactionFilter
+  ): TransactionConnection
+
+  """
+  The dynamic field's value, as a Move value for dynamic fields and as a MoveObject for dynamic object fields.
+  """
+  value: DynamicFieldValue
+}
+
+type DynamicFieldConnection {
+  """
+  Information to aid in pagination.
+  """
+  pageInfo: PageInfo!
+
+  """
+  A list of edges.
+  """
+  edges: [DynamicFieldEdge!]!
+
+  """
+  A list of nodes.
+  """
+  nodes: [DynamicField!]!
+}
+
+"""
+An edge in a connection.
+"""
+type DynamicFieldEdge {
+  """
+  The item at the end of the edge
+  """
+  node: DynamicField!
+
+  """
+  A cursor for use in pagination
+  """
+  cursor: String!
+}
+
+"""
+A description of a dynamic field's name.
+"""
+input DynamicFieldName {
+  """
+  The type of the dynamic field's name, like 'u64' or '0x2::kiosk::Listing'.
+  """
+  type: String!
+
+  """
+  The Base64-encoded BCS serialization of the dynamic field's 'name'.
+  """
+  bcs: Base64!
+}
+
+"""
+The value of a dynamic field (`MoveValue`) or dynamic object field (`MoveObject`).
+"""
+union DynamicFieldValue = MoveObject | MoveValue
+
+"""
+System transaction that supersedes `ChangeEpochTransaction` as the new way to run transactions at the end of an epoch. Behaves similarly to `ChangeEpochTransaction` but can accommodate other optional transactions to run at the end of the epoch.
+"""
+type EndOfEpochTransaction {
+  """
+  The list of system transactions that are allowed to run at the end of the epoch.
+  """
+  transactions(
+    first: Int
+    after: String
+    last: Int
+    before: String
+  ): EndOfEpochTransactionKindConnection
+}
+
+union EndOfEpochTransactionKind =
+    ChangeEpochTransaction
+  | AuthenticatorStateCreateTransaction
+  | AuthenticatorStateExpireTransaction
+  | RandomnessStateCreateTransaction
+  | CoinDenyListStateCreateTransaction
+  | StoreExecutionTimeObservationsTransaction
+  | BridgeStateCreateTransaction
+  | BridgeCommitteeInitTransaction
+  | AccumulatorRootCreateTransaction
+  | CoinRegistryCreateTransaction
+  | DisplayRegistryCreateTransaction
+
+type EndOfEpochTransactionKindConnection {
+  """
+  Information to aid in pagination.
+  """
+  pageInfo: PageInfo!
+
+  """
+  A list of edges.
+  """
+  edges: [EndOfEpochTransactionKindEdge!]!
+
+  """
+  A list of nodes.
+  """
+  nodes: [EndOfEpochTransactionKind!]!
+}
+
+"""
+An edge in a connection.
+"""
+type EndOfEpochTransactionKindEdge {
+  """
+  The item at the end of the edge
+  """
+  node: EndOfEpochTransactionKind!
+
+  """
+  A cursor for use in pagination
+  """
+  cursor: String!
+}
+
+"""
+Activity on Sui is partitioned in time, into epochs.
+
+Epoch changes are opportunities for the network to reconfigure itself (perform protocol or system package upgrades, or change the committee) and distribute staking rewards. The network aims to keep epochs roughly the same duration as each other.
+
+During a particular epoch the following data is fixed:
+
+- protocol version,
+- reference gas price,
+- system package versions,
+- validators in the committee.
+"""
+type Epoch {
+  """
+  The epoch's id as a sequence number that starts at 0 and is incremented by one at every epoch change.
+  """
+  epochId: UInt53!
+
+  """
+  The epoch's corresponding checkpoints.
+  """
+  checkpoints(
+    first: Int
+    after: String
+    last: Int
+    before: String
+    filter: CheckpointFilter
+  ): CheckpointConnection
+
+  """
+  State of the Coin DenyList object (0x403) at the start of this epoch.
+
+  The DenyList controls access to Regulated Coins. Writes to the DenyList are accumulated and only take effect on the next epoch boundary. Consequently, it's possible to determine the state of the DenyList for a transaction by reading it at the start of the epoch the transaction is in.
+  """
+  coinDenyList: Object
+
+  """
+  The epoch's corresponding protocol configuration, including the feature flags and the configuration options.
+  """
+  protocolConfigs: ProtocolConfigs
+
+  """
+  The minimum gas price that a quorum of validators are guaranteed to sign a transaction for in this epoch.
+  """
+  referenceGasPrice: BigInt
+
+  """
+  The timestamp associated with the first checkpoint in the epoch.
+  """
+  startTimestamp: DateTime
+
+  """
+  The transactions in this epoch, optionally filtered by transaction filters.
+
+  Returns `None` when no checkpoint is set in scope (e.g. execution scope).
+  """
+  transactions(
+    first: Int
+    after: String
+    last: Int
+    before: String
+    filter: TransactionFilter
+  ): TransactionConnection
+
+  """
+  The system packages used by all transactions in this epoch.
+  """
+  systemPackages(
+    first: Int
+    after: String
+    last: Int
+    before: String
+  ): MovePackageConnection
+
+  """
+  The timestamp associated with the last checkpoint in the epoch (or `null` if the epoch has not finished yet).
+  """
+  endTimestamp: DateTime
+
+  """
+  Validator-related properties, including the active validators.
+  """
+  validatorSet: ValidatorSet
+
+  """
+  The total number of checkpoints in this epoch.
+
+  Returns `None` when no checkpoint is set in scope (e.g. execution scope).
+  """
+  totalCheckpoints: UInt53
+
+  """
+  The total number of transaction blocks in this epoch (or `null` if the epoch has not finished yet).
+  """
+  totalTransactions: UInt53
+
+  """
+  The total amount of gas fees (in MIST) that were paid in this epoch (or `null` if the epoch has not finished yet).
+  """
+  totalGasFees: BigInt
+
+  """
+  The total MIST rewarded as stake (or `null` if the epoch has not finished yet).
+  """
+  totalStakeRewards: BigInt
+
+  """
+  The amount added to total gas fees to make up the total stake rewards (or `null` if the epoch has not finished yet).
+  """
+  totalStakeSubsidies: BigInt
+
+  """
+  The storage fund available in this epoch (or `null` if the epoch has not finished yet).
+  This fund is used to redistribute storage fees from past transactions to future validators.
+  """
+  fundSize: BigInt
+
+  """
+  The difference between the fund inflow and outflow, representing the net amount of storage fees accumulated in this epoch (or `null` if the epoch has not finished yet).
+  """
+  netInflow: BigInt
+
+  """
+  The storage fees paid for transactions executed during the epoch (or `null` if the epoch has not finished yet).
+  """
+  fundInflow: BigInt
+
+  """
+  The storage fee rebates paid to users who deleted the data associated with past transactions (or `null` if the epoch has not finished yet).
+  """
+  fundOutflow: BigInt
+
+  """
+  SUI set aside to account for objects stored on-chain, at the start of the epoch.
+  This is also used for storage rebates.
+  """
+  storageFund: StorageFund
+
+  """
+  Information about whether this epoch was started in safe mode, which happens if the full epoch change logic fails.
+  """
+  safeMode: SafeMode
+
+  """
+  The value of the `version` field of `0x5`, the `0x3::sui::SuiSystemState` object.
+  This version changes whenever the fields contained in the system state object (held in a dynamic field attached to `0x5`) change.
+  """
+  systemStateVersion: UInt53
+
+  """
+  Details of the system that are decided during genesis.
+  """
+  systemParameters: SystemParameters
+
+  """
+  Parameters related to the subsidy that supplements staking rewards
+  """
+  systemStakeSubsidy: StakeSubsidy
+
+  """
+  A commitment by the committee at the end of epoch on the contents of the live object set at that time.
+  This can be used to verify state snapshots.
+  """
+  liveObjectSetDigest: String
+}
+
+type EpochConnection {
+  """
+  Information to aid in pagination.
+  """
+  pageInfo: PageInfo!
+
+  """
+  A list of edges.
+  """
+  edges: [EpochEdge!]!
+
+  """
+  A list of nodes.
+  """
+  nodes: [Epoch!]!
+}
+
+"""
+An edge in a connection.
+"""
+type EpochEdge {
+  """
+  The item at the end of the edge
+  """
+  node: Epoch!
+
+  """
+  A cursor for use in pagination
+  """
+  cursor: String!
+}
+
+type Event {
+  """
+  The Move value emitted for this event.
+  """
+  contents: MoveValue
+
+  """
+  The Base64 encoded BCS serialized bytes of the entire Event structure from sui-types.
+  This includes: package_id, transaction_module, sender, type, and contents (which itself contains the BCS-serialized Move struct data).
+  """
+  eventBcs: Base64
+
+  """
+  Address of the sender of the transaction that emitted this event.
+  """
+  sender: Address
+
+  """
+  The position of the event among the events from the same transaction.
+  """
+  sequenceNumber: UInt53!
+
+  """
+  Timestamp corresponding to the checkpoint this event's transaction was finalized in.
+  All events from the same transaction share the same timestamp.
+  """
+  timestamp: DateTime
+
+  """
+  The transaction that emitted this event. This information is only available for events from indexed transactions, and not from transactions that have just been executed or dry-run.
+  """
+  transaction: Transaction
+
+  """
+  The module containing the function that was called in the programmable transaction, that resulted in this event being emitted.
+  """
+  transactionModule: MoveModule
+}
+
+type EventConnection {
+  """
+  Information to aid in pagination.
+  """
+  pageInfo: PageInfo!
+
+  """
+  A list of edges.
+  """
+  edges: [EventEdge!]!
+
+  """
+  A list of nodes.
+  """
+  nodes: [Event!]!
+}
+
+"""
+An edge in a connection.
+"""
+type EventEdge {
+  """
+  The item at the end of the edge
+  """
+  node: Event!
+
+  """
+  A cursor for use in pagination
+  """
+  cursor: String!
+}
+
+input EventFilter {
+  """
+  Limit to events that occurred strictly after the given checkpoint.
+  """
+  afterCheckpoint: UInt53
+
+  """
+  Limit to events in the given checkpoint.
+  """
+  atCheckpoint: UInt53
+
+  """
+  Limit to event that occurred strictly before the given checkpoint.
+  """
+  beforeCheckpoint: UInt53
+
+  """
+  Filter on events by transaction sender address.
+  """
+  sender: SuiAddress
+
+  """
+  Events emitted by a particular module. An event is emitted by a particular module if some function in the module is called by a PTB and emits an event.
+
+  Modules can be filtered by their package, or package::module. We currently do not support filtering by emitting module and event type at the same time so if both are provided in one filter, the query will error.
+  """
+  module: String
+
+  """
+  This field is used to specify the type of event emitted.
+
+  Events can be filtered by their type's package, package::module, or their fully qualified type name.
+
+  Generic types can be queried by either the generic type name, e.g. `0x2::coin::Coin`, or by the full type name, such as `0x2::coin::Coin<0x2::sui::SUI>`.
+  """
+  type: String
+}
+
+"""
+Represents execution error information for failed transactions.
+"""
+type ExecutionError {
+  """
+  The error code of the Move abort, populated if this transaction failed with a Move abort.
+
+  Returns the explicit code if the abort used `code` annotation (e.g., `abort(ERR, code = 5)` returns 5), otherwise returns the raw abort code containing encoded error information.
+  """
+  abortCode: BigInt
+
+  """
+  The source line number for the abort. Only populated for clever errors.
+  """
+  sourceLineNumber: Int
+
+  """
+  The instruction offset in the Move bytecode where the error occurred. Populated for Move aborts and primitive runtime errors.
+  """
+  instructionOffset: Int
+
+  """
+  The error's name. Only populated for clever errors.
+  """
+  identifier: String
+
+  """
+  An associated constant for the error. Only populated for clever errors.
+
+  Constants are returned as human-readable strings when possible. Complex types are returned as Base64-encoded bytes.
+  """
+  constant: String
+
+  """
+  The module that the abort originated from. Only populated for Move aborts and primitive runtime errors.
+  """
+  module: MoveModule
+
+  """
+  The function that the abort originated from. Only populated for Move aborts and primitive runtime errors that have function name information.
+  """
+  function: MoveFunction
+
+  """
+  Human readable explanation of why the transaction failed.
+
+  For Move aborts, the error message will be resolved to a human-readable form if possible, otherwise it will fall back to displaying the abort code and location.
+  """
+  message: String!
+}
+
+"""
+The execution result of a transaction, including the transaction effects and any potential errors due to signing or quorum-driving.
+"""
+type ExecutionResult {
+  """
+  The effects of the transaction execution, if successful.
+  """
+  effects: TransactionEffects
+
+  """
+  Errors that occurred during execution (e.g., network errors, validation failures).
+  These are distinct from execution failures within the transaction itself.
+  """
+  errors: [String!]
+}
+
+"""
+The execution status of this transaction: success or failure.
+"""
+enum ExecutionStatus {
+  """
+  The transaction was successfully executed.
+  """
+  SUCCESS
+
+  """
+  The transaction could not be executed.
+  """
+  FAILURE
+}
+
+"""
+A boolean protocol configuration.
+"""
+type FeatureFlag {
+  """
+  Feature flag name.
+  """
+  key: String!
+
+  """
+  Feature flag value.
+  """
+  value: Boolean!
+}
+
+"""
+Access to the gas inputs, after they have been smashed into one coin. The gas coin can only be used by reference, except for with `TransferObjectsTransaction` that can accept it by value.
+"""
+type GasCoin {
+  """
+  Placeholder field (gas coin has no additional data)
+  """
+  _: Boolean
+}
+
+"""
+Summary of charges from transactions.
+
+Storage is charged in three parts -- `storage_cost`, `-storage_rebate`, and `non_refundable_storage_fee` -- independently of `computation_cost`.
+
+The overall cost of a transaction, deducted from its gas coins, is its `computation_cost + storage_cost - storage_rebate`. `non_refundable_storage_fee` is collected from objects being mutated or deleted and accumulated by the system in storage funds, the remaining storage costs of previous object versions are what become the `storage_rebate`. The ratio between `non_refundable_storage_fee` and `storage_rebate` is set by the protocol.
+"""
+type GasCostSummary {
+  """
+  The sum cost of computation/execution
+  """
+  computationCost: UInt53
+
+  """
+  Cost for storage at the time the transaction is executed, calculated as the size of the objects being mutated in bytes multiplied by a storage cost per byte (part of the protocol).
+  """
+  storageCost: UInt53
+
+  """
+  Amount the user gets back from the storage cost of the previous versions of objects being mutated or deleted.
+  """
+  storageRebate: UInt53
+
+  """
+  Amount that is retained by the system in the storage fund from the cost of the previous versions of objects being mutated or deleted.
+  """
+  nonRefundableStorageFee: UInt53
+}
+
+"""
+Effects related to gas (costs incurred and the identity of the smashed gas object returned).
+"""
+type GasEffects {
+  """
+  The gas object used to pay for this transaction. If multiple gas coins were provided, this represents the combined coin after smashing.
+  """
+  gasObject: Object
+
+  """
+  Breakdown of the gas costs for this transaction.
+  """
+  gasSummary: GasCostSummary
+}
+
+type GasInput {
+  """
+  Address of the owner of the gas object(s) used.
+  """
+  gasSponsor: Address
+
+  """
+  An unsigned integer specifying the number of native tokens per gas unit this transaction will pay (in MIST).
+  """
+  gasPrice: BigInt
+
+  """
+  The maximum SUI that can be expended by executing this transaction
+  """
+  gasBudget: BigInt
+
+  """
+  Objects used to pay for a transaction's execution and storage
+  """
+  gasPayment(
+    first: Int
+    after: String
+    last: Int
+    before: String
+  ): ObjectConnection
+}
+
+"""
+System transaction that initializes the network and writes the initial set of objects on-chain.
+"""
+type GenesisTransaction {
+  """
+  Objects to be created during genesis.
+  """
+  objects(
+    first: Int
+    after: String
+    last: Int
+    before: String
+  ): ObjectConnection
+}
+
+"""
+Interface implemented by GraphQL types representing entities that are identified by an address.
+
+An address uniquely represents either the public key of an account, or an object's ID, but never both. It is not possible to determine which type an address represents up-front. If an object is wrapped, its contents will not be accessible via its address, but it will still be possible to access other objects it owns.
+"""
+interface IAddressable {
+  address: SuiAddress!
+
+  """
+  Fetch the total balance for coins with marker type `coinType` (e.g. `0x2::sui::SUI`), owned by this address.
+
+  If the address does not own any coins of that type, a balance of zero is returned.
+  """
+  balance(coinType: String!): Balance
+
+  """
+  Total balance across coins owned by this address, grouped by coin type.
+  """
+  balances(
+    first: Int
+    after: String
+    last: Int
+    before: String
+  ): BalanceConnection
+
+  """
+  The domain explicitly configured as the default SuiNS name for this address.
+  """
+  defaultSuinsName: String
+
+  """
+  Fetch the total balances keyed by coin types (e.g. `0x2::sui::SUI`) owned by this address.
+
+  Returns `null` when no checkpoint is set in scope (e.g. execution scope). If the address does not own any coins of a given type, a balance of zero is returned for that type.
+  """
+  multiGetBalances(keys: [String!]!): [Balance!]
+
+  """
+  Objects owned by this address, optionally filtered by type.
+  """
+  objects(
+    first: Int
+    after: String
+    last: Int
+    before: String
+    filter: ObjectFilter
+  ): MoveObjectConnection
+}
+
+"""
+Interface implemented by all GraphQL types that represent a Move datatype definition (either a struct or an enum definition).
+
+This interface is used to provide a way to access fields that are shared by both structs and enums, e.g., the module that the datatype belongs to, the name of the datatype, type parameters etc.
+"""
+interface IMoveDatatype {
+  """
+  The module that this datatype is defined in
+  """
+  module: MoveModule!
+
+  """
+  The datatype's unqualified name
+  """
+  name: String!
+
+  """
+  Abilities on this datatype definition.
+  """
+  abilities: [MoveAbility!]
+
+  """
+  Constraints on the datatype's formal type parameters
+
+  Move bytecode does not name type parameters, so when they are referenced (e.g. in field types), they are identified by their index in this list.
+  """
+  typeParameters: [MoveDatatypeTypeParameter!]
+}
+
+"""
+Interface implemented by types that represent a Move object on-chain (A Move value whose type has `key`).
+"""
+interface IMoveObject {
+  """
+  The structured representation of the object's contents.
+  """
+  contents: MoveValue
+
+  """
+  Access a dynamic field on an object using its type and BCS-encoded name.
+
+  Returns `null` if a dynamic field with that name could not be found attached to this object.
+  """
+  dynamicField(name: DynamicFieldName!): DynamicField
+
+  """
+  Access a dynamic object field on an object using its type and BCS-encoded name.
+
+  Returns `null` if a dynamic object field with that name could not be found attached to this object.
+  """
+  dynamicObjectField(name: DynamicFieldName!): DynamicField
+
+  """
+  Whether this object can be transferred using the `TransferObjects` Programmable Transaction Command or `sui::transfer::public_transfer`.
+
+  Both these operations require the object to have both the `key` and `store` abilities.
+  """
+  hasPublicTransfer: Boolean
+
+  """
+  Access dynamic fields on an object using their types and BCS-encoded names.
+
+  Returns a list of dynamic fields that is guaranteed to be the same length as `keys`. If a dynamic field in `keys` could not be found in the store, its corresponding entry in the result will be `null`.
+  """
+  multiGetDynamicFields(keys: [DynamicFieldName!]!): [DynamicField]!
+
+  """
+  Access dynamic object fields on an object using their types and BCS-encoded names.
+
+  Returns a list of dynamic object fields that is guaranteed to be the same length as `keys`. If a dynamic object field in `keys` could not be found in the store, its corresponding entry in the result will be `null`.
+  """
+  multiGetDynamicObjectFields(keys: [DynamicFieldName!]!): [DynamicField]!
+
+  """
+  Dynamic fields and dynamic object fields owned by this object.
+
+  Dynamic fields on wrapped objects can be accessed using `Address.dynamicFields`.
+  """
+  dynamicFields(
+    first: Int
+    after: String
+    last: Int
+    before: String
+  ): DynamicFieldConnection
+
+  """
+  The Base64-encoded BCS serialize of this object, as a `MoveObject`.
+  """
+  moveObjectBcs: Base64
+}
+
+"""
+Interface implemented by versioned on-chain values that are addressable by an ID (also referred to as its address). This includes Move objects and packages.
+"""
+interface IObject {
+  """
+  The version of this object that this content comes from.
+  """
+  version: UInt53
+
+  """
+  32-byte hash that identifies the object's contents, encoded in Base58.
+  """
+  digest: String
+
+  """
+  Fetch the object with the same ID, at a different version, root version bound, or checkpoint.
+  """
+  objectAt(version: UInt53, rootVersion: UInt53, checkpoint: UInt53): Object
+
+  """
+  The Base64-encoded BCS serialization of this object, as an `Object`.
+  """
+  objectBcs: Base64
+
+  """
+  Paginate all versions of this object after this one.
+  """
+  objectVersionsAfter(
+    first: Int
+    after: String
+    last: Int
+    before: String
+    filter: VersionFilter
+  ): ObjectConnection
+
+  """
+  Paginate all versions of this object before this one.
+  """
+  objectVersionsBefore(
+    first: Int
+    after: String
+    last: Int
+    before: String
+    filter: VersionFilter
+  ): ObjectConnection
+
+  """
+  The object's owner kind.
+  """
+  owner: Owner
+
+  """
+  The transaction that created this version of the object
+  """
+  previousTransaction: Transaction
+
+  """
+  The SUI returned to the sponsor or sender of the transaction that modifies or deletes this object.
+  """
+  storageRebate: BigInt
+
+  """
+  The transactions that sent objects to this object.
+  """
+  receivedTransactions(
+    first: Int
+    after: String
+    last: Int
+    before: String
+    filter: TransactionFilter
+  ): TransactionConnection
+}
+
+"""
+Object is accessible to all addresses, and is immutable.
+"""
+type Immutable {
+  _: Boolean
+}
+
+type Input {
+  """
+  The index of the input.
+  """
+  ix: Int
+}
+
+"""
+Arbitrary JSON data.
+"""
+scalar JSON
+
+"""
+Information used by a package to link to a specific version of its dependency.
+"""
+type Linkage {
+  """
+  The ID on-chain of the first version of the dependency.
+  """
+  originalId: SuiAddress
+
+  """
+  The ID on-chain of the version of the dependency that this package depends on.
+  """
+  upgradedId: SuiAddress
+
+  """
+  The version of the dependency that this package depends on.
+  """
+  version: UInt53
+}
+
+"""
+Create a vector (can be empty).
+"""
+type MakeMoveVecCommand {
+  """
+  If the elements are not objects, or the vector is empty, a type must be supplied.
+  """
+  type: MoveType
+
+  """
+  The values to pack into the vector, all of the same type.
+  """
+  elements: [TransactionArgument!]
+}
+
+"""
+Merges `coins` into the first `coin` (produces no results).
+"""
+type MergeCoinsCommand {
+  """
+  The coin to merge into.
+  """
+  coin: TransactionArgument
+
+  """
+  The coins to be merged.
+  """
+  coins: [TransactionArgument!]!
+}
+
+"""
+Abilities are keywords in Sui Move that define how types behave at the compiler level.
+"""
+enum MoveAbility {
+  """
+  Enables values to be copied.
+  """
+  COPY
+
+  """
+  Enables values to be popped/dropped.
+  """
+  DROP
+
+  """
+  Enables values to be held directly in global storage.
+  """
+  KEY
+
+  """
+  Enables values to be held inside a struct in global storage.
+  """
+  STORE
+}
+
+type MoveCallCommand {
+  """
+  The function being called.
+  """
+  function: MoveFunction!
+
+  """
+  The actual function parameters passed in for this move call.
+  """
+  arguments: [TransactionArgument!]!
+}
+
+"""
+Description of a datatype, defined in a Move module.
+"""
+type MoveDatatype implements IMoveDatatype {
+  """
+  The module that this datatype is defined in.
+  """
+  module: MoveModule!
+
+  """
+  The datatype's unqualified name.
+  """
+  name: String!
+
+  """
+  Abilities on this datatype definition.
+  """
+  abilities: [MoveAbility!]
+
+  """
+  Attempts to convert the `MoveDatatype` to a `MoveStruct`.
+  """
+  asMoveStruct: MoveStruct
+
+  """
+  Attempts to convert the `MoveDatatype` to a `MoveEnum`.
+  """
+  asMoveEnum: MoveEnum
+
+  """
+  Constraints on the datatype's formal type parameters.
+
+  Move bytecode does not name type parameters, so when they are referenced (e.g. in field types), they are identified by their index in this list.
+  """
+  typeParameters: [MoveDatatypeTypeParameter!]
+}
+
+type MoveDatatypeConnection {
+  """
+  Information to aid in pagination.
+  """
+  pageInfo: PageInfo!
+
+  """
+  A list of edges.
+  """
+  edges: [MoveDatatypeEdge!]!
+
+  """
+  A list of nodes.
+  """
+  nodes: [MoveDatatype!]!
+}
+
+"""
+An edge in a connection.
+"""
+type MoveDatatypeEdge {
+  """
+  The item at the end of the edge
+  """
+  node: MoveDatatype!
+
+  """
+  A cursor for use in pagination
+  """
+  cursor: String!
+}
+
+"""
+Declaration of a type parameter on a Move struct.
+"""
+type MoveDatatypeTypeParameter {
+  """
+  Ability constraints on this type parameter.
+  """
+  constraints: [MoveAbility!]!
+
+  """
+  Whether this type parameter is marked `phantom` or not.
+
+  Phantom type parameters are not referenced in the struct's fields.
+  """
+  isPhantom: Boolean!
+}
+
+"""
+Description of an enum type, defined in a Move module.
+"""
+type MoveEnum implements IMoveDatatype {
+  """
+  The module that this enum is defined in.
+  """
+  module: MoveModule!
+
+  """
+  The enum's unqualified name.
+  """
+  name: String!
+
+  """
+  Abilities on this enum definition.
+  """
+  abilities: [MoveAbility!]
+
+  """
+  The names and fields of the enum's variants
+
+  Field types reference type parameters by their index in the defining enum's `typeParameters` list.
+  """
+  variants: [MoveEnumVariant!]
+
+  """
+  Constraints on the enum's formal type parameters.
+
+  Move bytecode does not name type parameters, so when they are referenced (e.g. in field types), they are identified by their index in this list.
+  """
+  typeParameters: [MoveDatatypeTypeParameter!]
+}
+
+type MoveEnumConnection {
+  """
+  Information to aid in pagination.
+  """
+  pageInfo: PageInfo!
+
+  """
+  A list of edges.
+  """
+  edges: [MoveEnumEdge!]!
+
+  """
+  A list of nodes.
+  """
+  nodes: [MoveEnum!]!
+}
+
+"""
+An edge in a connection.
+"""
+type MoveEnumEdge {
+  """
+  The item at the end of the edge
+  """
+  node: MoveEnum!
+
+  """
+  A cursor for use in pagination
+  """
+  cursor: String!
+}
+
+type MoveEnumVariant {
+  """
+  The variant's name.
+  """
+  name: String
+
+  """
+  The names and types of the variant's fields.
+
+  Field types reference type parameters by their index in the defining struct's `typeParameters` list.
+  """
+  fields: [MoveField!]
+}
+
+type MoveField {
+  """
+  The field's name.
+  """
+  name: String
+
+  """
+  The field's type.
+
+  This type can reference type parameters introduced by the defining struct (see `typeParameters`).
+  """
+  type: OpenMoveType
+}
+
+"""
+A function defined in a Move module.
+"""
+type MoveFunction {
+  """
+  The module that this function is defined in.
+  """
+  module: MoveModule!
+
+  """
+  The function's unqualified name.
+  """
+  name: String!
+
+  """
+  Whether the function is marked `entry` or not.
+  """
+  isEntry: Boolean
+
+  """
+  The function's parameter types. These types can reference type parameters introduced by this function (see `typeParameters`).
+  """
+  parameters: [OpenMoveType!]
+
+  """
+  The function's return types. There can be multiple because functions in Move can return multiple values. These types can reference type parameters introduced by this function (see `typeParameters`).
+  """
+  return: [OpenMoveType!]
+
+  """
+  Constraints on the function's formal type parameters.
+
+  Move bytecode does not name type parameters, so when they are referenced (e.g. in parameter and return types), they are identified by their index in this list.
+  """
+  typeParameters: [MoveFunctionTypeParameter!]
+
+  """
+  The function's visibility: `public`, `public(friend)`, or `private`.
+  """
+  visibility: MoveVisibility
+}
+
+type MoveFunctionConnection {
+  """
+  Information to aid in pagination.
+  """
+  pageInfo: PageInfo!
+
+  """
+  A list of edges.
+  """
+  edges: [MoveFunctionEdge!]!
+
+  """
+  A list of nodes.
+  """
+  nodes: [MoveFunction!]!
+}
+
+"""
+An edge in a connection.
+"""
+type MoveFunctionEdge {
+  """
+  The item at the end of the edge
+  """
+  node: MoveFunction!
+
+  """
+  A cursor for use in pagination
+  """
+  cursor: String!
+}
+
+"""
+Declaration of a type parameter on a Move function.
+"""
+type MoveFunctionTypeParameter {
+  """
+  Ability constraints on this type parameter.
+  """
+  constraints: [MoveAbility!]!
+}
+
+"""
+Modules are a unit of code organization in Move.
+
+Modules belong to packages, and contain type and function definitions.
+"""
+type MoveModule {
+  """
+  The package that this module was defined in.
+  """
+  package: MovePackage
+
+  """
+  The module's unqualified name.
+  """
+  name: String!
+
+  """
+  Base64 encoded bytes of the serialized CompiledModule.
+  """
+  bytes: Base64
+
+  """
+  The datatype (struct or enum) named `name` in this module.
+  """
+  datatype(name: String!): MoveDatatype
+
+  """
+  Paginate through this module's datatype definitions.
+  """
+  datatypes(
+    first: Int
+    after: String
+    last: Int
+    before: String
+  ): MoveDatatypeConnection
+
+  """
+  Textual representation of the module's bytecode.
+  """
+  disassembly: String
+
+  """
+  The enum named `name` in this module.
+  """
+  enum(name: String!): MoveEnum
+
+  """
+  Paginate through this module's enum definitions.
+  """
+  enums(
+    first: Int
+    after: String
+    last: Int
+    before: String
+  ): MoveEnumConnection
+
+  """
+  Bytecode format version.
+  """
+  fileFormatVersion: Int
+
+  """
+  Modules that this module considers friends. These modules can call `public(package)` functions in this module.
+  """
+  friends(
+    first: Int
+    after: String
+    last: Int
+    before: String
+  ): MoveModuleConnection
+
+  """
+  The function named `name` in this module.
+  """
+  function(name: String!): MoveFunction
+
+  """
+  Paginate through this module's function definitions.
+  """
+  functions(
+    first: Int
+    after: String
+    last: Int
+    before: String
+  ): MoveFunctionConnection
+
+  """
+  The struct named `name` in this module.
+  """
+  struct(name: String!): MoveStruct
+
+  """
+  Paginate through this module's struct definitions.
+  """
+  structs(
+    first: Int
+    after: String
+    last: Int
+    before: String
+  ): MoveStructConnection
+}
+
+type MoveModuleConnection {
+  """
+  Information to aid in pagination.
+  """
+  pageInfo: PageInfo!
+
+  """
+  A list of edges.
+  """
+  edges: [MoveModuleEdge!]!
+
+  """
+  A list of nodes.
+  """
+  nodes: [MoveModule!]!
+}
+
+"""
+An edge in a connection.
+"""
+type MoveModuleEdge {
+  """
+  The item at the end of the edge
+  """
+  node: MoveModule!
+
+  """
+  A cursor for use in pagination
+  """
+  cursor: String!
+}
+
+"""
+A MoveObject is a kind of Object that represents data stored on-chain.
+"""
+type MoveObject implements IAddressable & IMoveObject & IObject {
+  """
+  The MoveObject's ID.
+  """
+  address: SuiAddress!
+
+  """
+  The version of this object that this content comes from.
+  """
+  version: UInt53
+
+  """
+  32-byte hash that identifies the object's contents, encoded in Base58.
+  """
+  digest: String
+
+  """
+  Attempts to convert the object into a CoinMetadata.
+  """
+  asCoinMetadata: CoinMetadata
+
+  """
+  Attempts to convert the object into a DynamicField.
+  """
+  asDynamicField: DynamicField
+
+  """
+  Fetch the total balance for coins with marker type `coinType` (e.g. `0x2::sui::SUI`), owned by this address.
+
+  If the address does not own any coins of that type, a balance of zero is returned.
+  """
+  balance(coinType: String!): Balance
+
+  """
+  Total balance across coins owned by this address, grouped by coin type.
+  """
+  balances(
+    first: Int
+    after: String
+    last: Int
+    before: String
+  ): BalanceConnection
+
+  """
+  The structured representation of the object's contents.
+  """
+  contents: MoveValue
+
+  """
+  The domain explicitly configured as the default SuiNS name for this address.
+  """
+  defaultSuinsName: String
+
+  """
+  Access a dynamic field on an object using its type and BCS-encoded name.
+
+  Returns `null` if a dynamic field with that name could not be found attached to this object.
+  """
+  dynamicField(name: DynamicFieldName!): DynamicField
+
+  """
+  Dynamic fields owned by this object.
+
+  Dynamic fields on wrapped objects can be accessed using `Address.dynamicFields`.
+  """
+  dynamicFields(
+    first: Int
+    after: String
+    last: Int
+    before: String
+  ): DynamicFieldConnection
+
+  """
+  Access a dynamic object field on an object using its type and BCS-encoded name.
+
+  Returns `null` if a dynamic object field with that name could not be found attached to this object.
+  """
+  dynamicObjectField(name: DynamicFieldName!): DynamicField
+
+  """
+  Whether this object can be transferred using the `TransferObjects` Programmable Transaction Command or `sui::transfer::public_transfer`.
+
+  Both these operations require the object to have both the `key` and `store` abilities.
+  """
+  hasPublicTransfer: Boolean
+
+  """
+  Access dynamic fields on an object using their types and BCS-encoded names.
+
+  Returns a list of dynamic fields that is guaranteed to be the same length as `keys`. If a dynamic field in `keys` could not be found in the store, its corresponding entry in the result will be `null`.
+  """
+  multiGetDynamicFields(keys: [DynamicFieldName!]!): [DynamicField]!
+
+  """
+  Fetch the total balances keyed by coin types (e.g. `0x2::sui::SUI`) owned by this address.
+
+  If the address does not own any coins of a given type, a balance of zero is returned for that type.
+  """
+  multiGetBalances(keys: [String!]!): [Balance!]
+
+  """
+  Access dynamic object fields on an object using their types and BCS-encoded names.
+
+  Returns a list of dynamic object fields that is guaranteed to be the same length as `keys`. If a dynamic object field in `keys` could not be found in the store, its corresponding entry in the result will be `null`.
+  """
+  multiGetDynamicObjectFields(keys: [DynamicFieldName!]!): [DynamicField]!
+
+  """
+  The Base64-encoded BCS serialize of this object, as a `MoveObject`.
+  """
+  moveObjectBcs: Base64
+
+  """
+  Fetch the object with the same ID, at a different version, root version bound, or checkpoint.
+
+  If no additional bound is provided, the latest version of this object is fetched at the latest checkpoint.
+  """
+  objectAt(version: UInt53, rootVersion: UInt53, checkpoint: UInt53): Object
+
+  """
+  The Base64-encoded BCS serialization of this object, as an `Object`.
+  """
+  objectBcs: Base64
+
+  """
+  Paginate all versions of this object after this one.
+  """
+  objectVersionsAfter(
+    first: Int
+    after: String
+    last: Int
+    before: String
+    filter: VersionFilter
+  ): ObjectConnection
+
+  """
+  Paginate all versions of this object before this one.
+  """
+  objectVersionsBefore(
+    first: Int
+    after: String
+    last: Int
+    before: String
+    filter: VersionFilter
+  ): ObjectConnection
+
+  """
+  Objects owned by this object, optionally filtered by type.
+  """
+  objects(
+    first: Int
+    after: String
+    last: Int
+    before: String
+    filter: ObjectFilter
+  ): MoveObjectConnection
+
+  """
+  The object's owner kind.
+  """
+  owner: Owner
+
+  """
+  The transaction that created this version of the object.
+  """
+  previousTransaction: Transaction
+
+  """
+  The SUI returned to the sponsor or sender of the transaction that modifies or deletes this object.
+  """
+  storageRebate: BigInt
+
+  """
+  The transactions that sent objects to this object.
+  """
+  receivedTransactions(
+    first: Int
+    after: String
+    last: Int
+    before: String
+    filter: TransactionFilter
+  ): TransactionConnection
+}
+
+type MoveObjectConnection {
+  """
+  Information to aid in pagination.
+  """
+  pageInfo: PageInfo!
+
+  """
+  A list of edges.
+  """
+  edges: [MoveObjectEdge!]!
+
+  """
+  A list of nodes.
+  """
+  nodes: [MoveObject!]!
+}
+
+"""
+An edge in a connection.
+"""
+type MoveObjectEdge {
+  """
+  The item at the end of the edge
+  """
+  node: MoveObject!
+
+  """
+  A cursor for use in pagination
+  """
+  cursor: String!
+}
+
+"""
+A MovePackage is a kind of Object that represents code that has been published on-chain. It exposes information about its modules, type definitions, functions, and dependencies.
+"""
+type MovePackage implements IAddressable & IObject {
+  """
+  The MovePackage's ID.
+  """
+  address: SuiAddress!
+
+  """
+  The version of this package that this content comes from.
+  """
+  version: UInt53
+
+  """
+  32-byte hash that identifies the package's contents, encoded in Base58.
+  """
+  digest: String
+
+  """
+  Fetch the total balance for coins with marker type `coinType` (e.g. `0x2::sui::SUI`), owned by this address.
+
+  If the address does not own any coins of that type, a balance of zero is returned.
+  """
+  balance(coinType: String!): Balance
+
+  """
+  Total balance across coins owned by this address, grouped by coin type.
+  """
+  balances(
+    first: Int
+    after: String
+    last: Int
+    before: String
+  ): BalanceConnection
+
+  """
+  The domain explicitly configured as the default SuiNS name for this address.
+  """
+  defaultSuinsName: String
+
+  """
+  The module named `name` in this package.
+  """
+  module(name: String!): MoveModule
+
+  """
+  Paginate through this package's modules.
+  """
+  modules(
+    first: Int
+    after: String
+    last: Int
+    before: String
+  ): MoveModuleConnection
+
+  """
+  BCS representation of the package's modules.  Modules appear as a sequence of pairs (module name, followed by module bytes), in alphabetic order by module name.
+  """
+  moduleBcs: Base64
+
+  """
+  Fetch the total balances keyed by coin types (e.g. `0x2::sui::SUI`) owned by this address.
+
+  If the address does not own any coins of a given type, a balance of zero is returned for that type.
+  """
+  multiGetBalances(keys: [String!]!): [Balance!]
+
+  """
+  Objects owned by this package, optionally filtered by type.
+  """
+  objects(
+    first: Int
+    after: String
+    last: Int
+    before: String
+    filter: ObjectFilter
+  ): MoveObjectConnection
+
+  """
+  Fetch the package as an object with the same ID, at a different version, root version bound, or checkpoint.
+
+  If no additional bound is provided, the latest version of this object is fetched at the latest checkpoint.
+  """
+  objectAt(version: UInt53, rootVersion: UInt53, checkpoint: UInt53): Object
+
+  """
+  The Base64-encoded BCS serialization of this package, as an `Object`.
+  """
+  objectBcs: Base64
+
+  """
+  Paginate all versions of this package treated as an object, after this one.
+  """
+  objectVersionsAfter(
+    first: Int
+    after: String
+    last: Int
+    before: String
+    filter: VersionFilter
+  ): ObjectConnection
+
+  """
+  Paginate all versions of this package treated as an object, before this one.
+  """
+  objectVersionsBefore(
+    first: Int
+    after: String
+    last: Int
+    before: String
+    filter: VersionFilter
+  ): ObjectConnection
+
+  """
+  The object's owner kind.
+  """
+  owner: Owner
+
+  """
+  Fetch the package with the same original ID, at a different version, root version bound, or checkpoint.
+
+  If no additional bound is provided, the latest version of this package is fetched at the latest checkpoint.
+  """
+  packageAt(version: UInt53, checkpoint: UInt53): MovePackage
+
+  """
+  The Base64-encoded BCS serialization of this package, as a `MovePackage`.
+  """
+  packageBcs: Base64
+
+  """
+  Paginate all versions of this package after this one.
+  """
+  packageVersionsAfter(
+    first: Int
+    after: String
+    last: Int
+    before: String
+    filter: VersionFilter
+  ): MovePackageConnection
+
+  """
+  Paginate all versions of this package before this one.
+  """
+  packageVersionsBefore(
+    first: Int
+    after: String
+    last: Int
+    before: String
+    filter: VersionFilter
+  ): MovePackageConnection
+
+  """
+  The transaction that created this version of the object.
+  """
+  previousTransaction: Transaction
+
+  """
+  The transitive dependencies of this package.
+  """
+  linkage: [Linkage!]
+
+  """
+  The SUI returned to the sponsor or sender of the transaction that modifies or deletes this object.
+  """
+  storageRebate: BigInt
+
+  """
+  The transactions that sent objects to this object.
+  """
+  receivedTransactions(
+    first: Int
+    after: String
+    last: Int
+    before: String
+    filter: TransactionFilter
+  ): TransactionConnection
+
+  """
+  A table identifying which versions of a package introduced each of its types.
+  """
+  typeOrigins: [TypeOrigin!]
+}
+
+type MovePackageConnection {
+  """
+  Information to aid in pagination.
+  """
+  pageInfo: PageInfo!
+
+  """
+  A list of edges.
+  """
+  edges: [MovePackageEdge!]!
+
+  """
+  A list of nodes.
+  """
+  nodes: [MovePackage!]!
+}
+
+"""
+An edge in a connection.
+"""
+type MovePackageEdge {
+  """
+  The item at the end of the edge
+  """
+  node: MovePackage!
+
+  """
+  A cursor for use in pagination
+  """
+  cursor: String!
+}
+
+"""
+Description of a struct type, defined in a Move module.
+"""
+type MoveStruct implements IMoveDatatype {
+  """
+  The module that this struct is defined in.
+  """
+  module: MoveModule!
+
+  """
+  The struct's unqualified name.
+  """
+  name: String!
+
+  """
+  Abilities on this struct definition.
+  """
+  abilities: [MoveAbility!]
+
+  """
+  The names and types of the struct's fields.
+
+  Field types reference type parameters by their index in the defining struct's `typeParameters` list.
+  """
+  fields: [MoveField!]
+
+  """
+  Constraints on the struct's formal type parameters.
+
+  Move bytecode does not name type parameters, so when they are referenced (e.g. in field types), they are identified by their index in this list.
+  """
+  typeParameters: [MoveDatatypeTypeParameter!]
+}
+
+type MoveStructConnection {
+  """
+  Information to aid in pagination.
+  """
+  pageInfo: PageInfo!
+
+  """
+  A list of edges.
+  """
+  edges: [MoveStructEdge!]!
+
+  """
+  A list of nodes.
+  """
+  nodes: [MoveStruct!]!
+}
+
+"""
+An edge in a connection.
+"""
+type MoveStructEdge {
+  """
+  The item at the end of the edge
+  """
+  node: MoveStruct!
+
+  """
+  A cursor for use in pagination
+  """
+  cursor: String!
+}
+
+"""
+Represents instances of concrete types (no type parameters, no references).
+"""
+type MoveType {
+  """
+  Flat representation of the type signature, as a displayable string.
+  """
+  repr: String!
+
+  """
+  Structured representation of the type signature.
+  """
+  signature: MoveTypeSignature!
+
+  """
+  Structured representation of the "shape" of values that match this type. May return no
+  layout if the type is invalid.
+  """
+  layout: MoveTypeLayout
+
+  """
+  The abilities this concrete type has. Returns no abilities if the type is invalid.
+  """
+  abilities: [MoveAbility!]
+}
+
+"""
+The shape of a concrete Move Type (a type with all its type parameters instantiated with concrete types), corresponding to the following recursive type:
+
+type MoveTypeLayout =
+    "address"
+  | "bool"
+  | "u8" | "u16" | ... | "u256"
+  | { vector: MoveTypeLayout }
+  | {
+      struct: {
+        type: string,
+        fields: [{ name: string, layout: MoveTypeLayout }],
+      }
+    }
+  | { enum: [{
+          type: string,
+          variants: [{
+              name: string,
+              fields: [{ name: string, layout: MoveTypeLayout }],
+          }]
+      }]
+  }
+"""
+scalar MoveTypeLayout
+
+"""
+The signature of a concrete Move Type (a type with all its type parameters instantiated with concrete types, that contains no references), corresponding to the following recursive type:
+
+type MoveTypeSignature =
+    "address"
+  | "bool"
+  | "u8" | "u16" | ... | "u256"
+  | { vector: MoveTypeSignature }
+  | {
+      datatype: {
+        package: string,
+        module: string,
+        type: string,
+        typeParameters: [MoveTypeSignature],
+      }
+    }
+"""
+scalar MoveTypeSignature
+
+type MoveValue {
+  """
+  The BCS representation of this value, Base64-encoded.
+  """
+  bcs: Base64
+
+  """
+  A rendered JSON blob based on an on-chain template, substituted with data from this value.
+
+  Returns `null` if the value's type does not have an associated `Display` template.
+  """
+  display: Display
+
+  """
+  Representation of a Move value in JSON, where:
+
+  - Addresses, IDs, and UIDs are represented in canonical form, as JSON strings.
+  - Bools are represented by JSON boolean literals.
+  - u8, u16, and u32 are represented as JSON numbers.
+  - u64, u128, and u256 are represented as JSON strings.
+  - Balances, Strings, and Urls are represented as JSON strings.
+  - Vectors of bytes are represented as Base64 blobs, and other vectors are represented by JSON arrays.
+  - Structs are represented by JSON objects.
+  - Enums are represented by JSON objects, with a field named `@variant` containing the variant name.
+  - Empty optional values are represented by `null`.
+  """
+  json: JSON
+
+  """
+  The value's type.
+  """
+  type: MoveType
+}
+
+"""
+The visibility modifier describes which modules can access this module member.
+
+By default, a module member can be called only within the same module.
+"""
+enum MoveVisibility {
+  """
+  A public member can be accessed by any module.
+  """
+  PUBLIC
+
+  """
+  A private member can be accessed in the module it is defined in.
+  """
+  PRIVATE
+
+  """
+  A friend member can be accessed in the module it is defined in and any other module in its package that is explicitly specified in its friend list.
+  """
+  FRIEND
+}
+
+"""
+A transaction that wanted to mutate a consensus-managed object but couldn't because it became not-consensus-managed before the transaction executed (for example, it was deleted, turned into an owned object, or wrapped).
+"""
+type MutateConsensusStreamEnded {
+  """
+  The ID of the consensus-managed object.
+  """
+  address: SuiAddress
+
+  """
+  The sequence number associated with the consensus stream ending.
+  """
+  sequenceNumber: UInt53
+}
+
+"""
+Mutations are used to write to the Sui network.
+"""
+type Mutation {
+  """
+  Execute a transaction, committing its effects on chain.
+
+  - `transactionDataBcs` contains the BCS-encoded transaction data (Base64-encoded).
+  - `signatures` are a list of `flag || signature || pubkey` bytes, Base64-encoded.
+
+  Waits until the transaction has reached finality on chain to return its transaction digest, or returns the error that prevented finality if that was not possible. A transaction is final when its effects are guaranteed on chain (it cannot be revoked).
+
+  There may be a delay between transaction finality and when GraphQL requests (including the request that issued the transaction) reflect its effects. As a result, queries that depend on indexing the state of the chain (e.g. contents of output objects, address-level balance information at the time of the transaction), must wait for indexing to catch up by polling for the transaction digest using `Query.transaction`.
+  """
+  executeTransaction(
+    transactionDataBcs: Base64!
+    signatures: [Base64!]!
+  ): ExecutionResult!
+}
+
+"""
+An Object on Sui is either a typed value (a Move Object) or a Package (modules containing functions and types).
+
+Every object on Sui is identified by a unique address, and has a version number that increases with every modification. Objects also hold metadata detailing their current owner (who can sign for access to the object and whether that access can modify and/or delete the object), and the digest of the last transaction that modified the object.
+"""
+type Object implements IAddressable & IObject {
+  """
+  The Object's ID.
+  """
+  address: SuiAddress!
+
+  """
+  The version of this object that this content comes from.
+  """
+  version: UInt53
+
+  """
+  32-byte hash that identifies the object's contents, encoded in Base58.
+  """
+  digest: String
+
+  """
+  Attempts to convert the object into a MoveObject.
+  """
+  asMoveObject: MoveObject
+
+  """
+  Attempts to convert the object into a MovePackage.
+  """
+  asMovePackage: MovePackage
+
+  """
+  Fetch the total balance for coins with marker type `coinType` (e.g. `0x2::sui::SUI`), owned by this address.
+
+  If the address does not own any coins of that type, a balance of zero is returned.
+  """
+  balance(coinType: String!): Balance
+
+  """
+  Total balance across coins owned by this address, grouped by coin type.
+  """
+  balances(
+    first: Int
+    after: String
+    last: Int
+    before: String
+  ): BalanceConnection
+
+  """
+  The domain explicitly configured as the default SuiNS name for this address.
+  """
+  defaultSuinsName: String
+
+  """
+  Access a dynamic field on an object using its type and BCS-encoded name.
+
+  Returns `null` if a dynamic field with that name could not be found attached to this object.
+  """
+  dynamicField(name: DynamicFieldName!): DynamicField
+
+  """
+  Dynamic fields owned by this object.
+  """
+  dynamicFields(
+    first: Int
+    after: String
+    last: Int
+    before: String
+  ): DynamicFieldConnection
+
+  """
+  Access a dynamic object field on an object using its type and BCS-encoded name.
+
+  Returns `null` if a dynamic object field with that name could not be found attached to this object.
+  """
+  dynamicObjectField(name: DynamicFieldName!): DynamicField
+
+  """
+  Access dynamic fields on an object using their types and BCS-encoded names.
+
+  Returns a list of dynamic fields that is guaranteed to be the same length as `keys`. If a dynamic field in `keys` could not be found in the store, its corresponding entry in the result will be `null`.
+  """
+  multiGetDynamicFields(keys: [DynamicFieldName!]!): [DynamicField]!
+
+  """
+  Access dynamic object fields on an object using their types and BCS-encoded names.
+
+  Returns a list of dynamic object fields that is guaranteed to be the same length as `keys`. If a dynamic object field in `keys` could not be found in the store, its corresponding entry in the result will be `null`.
+  """
+  multiGetDynamicObjectFields(keys: [DynamicFieldName!]!): [DynamicField]!
+
+  """
+  Fetch the total balances keyed by coin types (e.g. `0x2::sui::SUI`) owned by this address.
+
+  Returns `None` when no checkpoint is set in scope (e.g. execution scope).
+  If the address does not own any coins of a given type, a balance of zero is returned for that type.
+  """
+  multiGetBalances(keys: [String!]!): [Balance!]
+
+  """
+  Fetch the object with the same ID, at a different version, root version bound, or checkpoint.
+
+  If no additional bound is provided, the latest version of this object is fetched at the latest checkpoint.
+  """
+  objectAt(version: UInt53, rootVersion: UInt53, checkpoint: UInt53): Object
+
+  """
+  The Base64-encoded BCS serialization of this object, as an `Object`.
+  """
+  objectBcs: Base64
+
+  """
+  Paginate all versions of this object after this one.
+  """
+  objectVersionsAfter(
+    first: Int
+    after: String
+    last: Int
+    before: String
+    filter: VersionFilter
+  ): ObjectConnection
+
+  """
+  Paginate all versions of this object before this one.
+  """
+  objectVersionsBefore(
+    first: Int
+    after: String
+    last: Int
+    before: String
+    filter: VersionFilter
+  ): ObjectConnection
+
+  """
+  Objects owned by this object, optionally filtered by type.
+  """
+  objects(
+    first: Int
+    after: String
+    last: Int
+    before: String
+    filter: ObjectFilter
+  ): MoveObjectConnection
+
+  """
+  The object's owner kind.
+  """
+  owner: Owner
+
+  """
+  The transaction that created this version of the object.
+  """
+  previousTransaction: Transaction
+
+  """
+  The SUI returned to the sponsor or sender of the transaction that modifies or deletes this object.
+  """
+  storageRebate: BigInt
+
+  """
+  The transactions that sent objects to this object
+  """
+  receivedTransactions(
+    first: Int
+    after: String
+    last: Int
+    before: String
+    filter: TransactionFilter
+  ): TransactionConnection
+}
+
+type ObjectChange {
+  """
+  The address of the object that has changed.
+  """
+  address: SuiAddress!
+
+  """
+  The contents of the object immediately before the transaction.
+  """
+  inputState: Object
+
+  """
+  The contents of the object immediately after the transaction.
+  """
+  outputState: Object
+
+  """
+  Whether the ID was created in this transaction.
+  """
+  idCreated: Boolean
+
+  """
+  Whether the ID was deleted in this transaction.
+  """
+  idDeleted: Boolean
+}
+
+type ObjectChangeConnection {
+  """
+  Information to aid in pagination.
+  """
+  pageInfo: PageInfo!
+
+  """
+  A list of edges.
+  """
+  edges: [ObjectChangeEdge!]!
+
+  """
+  A list of nodes.
+  """
+  nodes: [ObjectChange!]!
+}
+
+"""
+An edge in a connection.
+"""
+type ObjectChangeEdge {
+  """
+  The item at the end of the edge
+  """
+  node: ObjectChange!
+
+  """
+  A cursor for use in pagination
+  """
+  cursor: String!
+}
+
+type ObjectConnection {
+  """
+  Information to aid in pagination.
+  """
+  pageInfo: PageInfo!
+
+  """
+  A list of edges.
+  """
+  edges: [ObjectEdge!]!
+
+  """
+  A list of nodes.
+  """
+  nodes: [Object!]!
+}
+
+"""
+An edge in a connection.
+"""
+type ObjectEdge {
+  """
+  The item at the end of the edge
+  """
+  node: Object!
+
+  """
+  A cursor for use in pagination
+  """
+  cursor: String!
+}
+
+"""
+A filter over the live object set, the filter can be one of:
+
+- A filter on type (all live objects whose type matches that filter).
+- Fetching all objects owned by an address or object, optionally filtered by type.
+- Fetching all shared or immutable objects, filtered by type.
+"""
+input ObjectFilter {
+  """
+  Filter on whether the object is address-owned, object-owned, shared, or immutable.
+
+  - If this field is set to "ADDRESS" or "OBJECT", then an owner filter must also be provided.
+  - If this field is set to "SHARED" or "IMMUTABLE", then a type filter must also be provided.
+  """
+  ownerKind: OwnerKind
+
+  """
+  Specifies the address of the owning address or object.
+
+  This field is required if `ownerKind` is "ADDRESS" or "OBJECT". If provided without `ownerKind`, `ownerKind` defaults to "ADDRESS".
+  """
+  owner: SuiAddress
+
+  """
+  Filter on the object's type.
+
+  The filter can be one of:
+
+  - A package address: `0x2`,
+  - A module: `0x2::coin`,
+  - A fully-qualified name: `0x2::coin::Coin`,
+  - A type instantiation: `0x2::coin::Coin<0x2::sui::SUI>`.
+  """
+  type: String
+}
+
+"""
+Identifies a specific version of an object.
+
+The `address` field must be specified, as well as at most one of `version`, `rootVersion`, or `atCheckpoint`. If none are provided, the object is fetched at the current checkpoint.
+
+Specifying a `version` or a `rootVersion` disables nested queries for paginating owned objects or dynamic fields (these queries are only supported at checkpoint boundaries).
+
+See `Query.object` for more details.
+"""
+input ObjectKey {
+  """
+  The object's ID.
+  """
+  address: SuiAddress!
+
+  """
+  If specified, tries to fetch the object at this exact version.
+  """
+  version: UInt53
+
+  """
+  If specified, tries to fetch the latest version of the object at or before this version. Nested dynamic field accesses will also be subject to this bound.
+
+  This can be used to fetch a child or ancestor object bounded by its root object's version. For any wrapped or child (object-owned) object, its root object can be defined recursively as:
+
+  - The root object of the object it is wrapped in, if it is wrapped.
+  - The root object of its owner, if it is owned by another object.
+  - The object itself, if it is not object-owned or wrapped.
+  """
+  rootVersion: UInt53
+
+  """
+  If specified, tries to fetch the latest version as of this checkpoint. Fails if the checkpoint is later than the RPC's latest checkpoint.
+  """
+  atCheckpoint: UInt53
+}
+
+"""
+Object is exclusively owned by a single object, and is mutable. Note that the owning object may be inaccessible because it is wrapped.
+"""
+type ObjectOwner {
+  """
+  The owner's address.
+  """
+  address: Address
+}
+
+"""
+Represents types that could contain references or free type parameters.  Such types can appear
+as function parameters, in fields of structs, or as actual type parameter.
+"""
+type OpenMoveType {
+  """
+  Structured representation of the type signature.
+  """
+  signature: OpenMoveTypeSignature!
+
+  """
+  Flat representation of the type signature, as a displayable string.
+  """
+  repr: String!
+}
+
+"""
+The shape of an abstract Move Type (a type that can contain free type parameters, and can optionally be taken by reference), corresponding to the following recursive type:
+
+type OpenMoveTypeSignature = {
+  ref: ("&" | "&mut")?,
+  body: OpenMoveTypeSignatureBody,
+}
+
+type OpenMoveTypeSignatureBody =
+    "address"
+  | "bool"
+  | "u8" | "u16" | ... | "u256"
+  | { vector: OpenMoveTypeSignatureBody }
+  | {
+      datatype {
+        package: string,
+        module: string,
+        type: string,
+        typeParameters: [OpenMoveTypeSignatureBody]
+      }
+    }
+  | { typeParameter: number }
+"""
+scalar OpenMoveTypeSignature
+
+"""
+Placeholder for unimplemented command types
+"""
+type OtherCommand {
+  """
+  Placeholder field for unimplemented commands
+  """
+  _: Boolean
+}
+
+"""
+A Move object, either immutable, or owned mutable.
+"""
+type OwnedOrImmutable {
+  object: Object
+}
+
+"""
+The object's owner kind.
+"""
+union Owner =
+    AddressOwner
+  | ObjectOwner
+  | Shared
+  | Immutable
+  | ConsensusAddressOwner
+
+"""
+Filter on who owns an object.
+"""
+enum OwnerKind {
+  """
+  Object is owned by an address.
+  """
+  ADDRESS
+
+  """
+  Object is a child of another object (e.g. a dynamic field or dynamic object field).
+  """
+  OBJECT
+
+  """
+  Object is shared among multiple owners.
+  """
+  SHARED
+
+  """
+  Object is frozen.
+  """
+  IMMUTABLE
+}
+
+"""
+Filter for paginating packages published within a range of checkpoints.
+"""
+input PackageCheckpointFilter {
+  """
+  Filter to packages that were published strictly after this checkpoint, defaults to fetching from the earliest checkpoint known to this RPC (this could be the genesis checkpoint, or some later checkpoint if data has been pruned).
+  """
+  afterCheckpoint: UInt53
+
+  """
+  Filter to packages published strictly before this checkpoint, defaults to fetching up to the latest checkpoint (inclusive).
+  """
+  beforeCheckpoint: UInt53
+}
+
+"""
+Identifies a specific version of a package.
+
+The `address` field must be specified, as well as at most one of `version`, or `atCheckpoint`. If neither is provided, the package is fetched at the current checkpoint.
+
+See `Query.package` for more details.
+"""
+input PackageKey {
+  """
+  The object's ID.
+  """
+  address: SuiAddress!
+
+  """
+  If specified, tries to fetch the package at this exact version.
+  """
+  version: UInt53
+
+  """
+  If specified, tries to fetch the latest version as of this checkpoint.
+  """
+  atCheckpoint: UInt53
+}
+
+"""
+Information about pagination in a connection
+"""
+type PageInfo {
+  """
+  When paginating backwards, are there more items?
+  """
+  hasPreviousPage: Boolean!
+
+  """
+  When paginating forwards, are there more items?
+  """
+  hasNextPage: Boolean!
+
+  """
+  When paginating backwards, the cursor to continue.
+  """
+  startCursor: String
+
+  """
+  When paginating forwards, the cursor to continue.
+  """
+  endCursor: String
+}
+
+type PerEpochConfig {
+  """
+  The per-epoch configuration object as of when the transaction was executed.
+  """
+  object: Object
+}
+
+"""
+ProgrammableSystemTransaction is identical to ProgrammableTransaction, but GraphQL does not allow multiple variants with the same type.
+"""
+type ProgrammableSystemTransaction {
+  """
+  Input objects or primitive values.
+  """
+  inputs(
+    first: Int
+    after: String
+    last: Int
+    before: String
+  ): TransactionInputConnection
+
+  """
+  The transaction commands, executed sequentially.
+  """
+  commands(
+    first: Int
+    after: String
+    last: Int
+    before: String
+  ): CommandConnection
+}
+
+type ProgrammableTransaction {
+  """
+  Input objects or primitive values.
+  """
+  inputs(
+    first: Int
+    after: String
+    last: Int
+    before: String
+  ): TransactionInputConnection
+
+  """
+  The transaction commands, executed sequentially.
+  """
+  commands(
+    first: Int
+    after: String
+    last: Int
+    before: String
+  ): CommandConnection
+}
+
+"""
+A protocol configuration that can hold an arbitrary value (or no value at all).
+"""
+type ProtocolConfig {
+  """
+  Configuration name.
+  """
+  key: String!
+
+  """
+  Configuration value.
+  """
+  value: String
+}
+
+"""
+Constants that control how the chain operates.
+
+These can only change during protocol upgrades which happen on epoch boundaries. Configuration is split into feature flags (which are just booleans), and configs which can take any value (including no value at all), and will be represented by a string.
+"""
+type ProtocolConfigs {
+  protocolVersion: UInt53!
+
+  """
+  Query for the value of the configuration with name `key`.
+  """
+  config(key: String!): ProtocolConfig
+
+  """
+  List all available configurations and their values.
+  """
+  configs: [ProtocolConfig!]!
+
+  """
+  Query for the state of the feature flag with name `key`.
+  """
+  featureFlag(key: String!): FeatureFlag
+
+  """
+  List all available feature flags and their values.
+  """
+  featureFlags: [FeatureFlag!]!
+}
+
+"""
+Publishes a Move Package.
+"""
+type PublishCommand {
+  """
+  Bytecode for the modules to be published, BCS serialized and Base64 encoded.
+  """
+  modules: [Base64!]
+
+  """
+  IDs of the transitive dependencies of the package to be published.
+  """
+  dependencies: [SuiAddress!]
+}
+
+"""
+BCS encoded primitive value (not an object or Move struct).
+"""
+type Pure {
+  """
+  BCS serialized and Base64 encoded primitive value.
+  """
+  bytes: Base64
+}
+
+type Query {
+  """
+  Look-up an account by its SuiAddress.
+
+  If `rootVersion` is specified, nested dynamic field accesses will be fetched at or before this version. This can be used to fetch a child or ancestor object bounded by its root object's version, when its immediate parent is wrapped, or a value in a dynamic object field. For any wrapped or child (object-owned) object, its root object can be defined recursively as:
+
+  - The root object of the object it is wrapped in, if it is wrapped.
+  - The root object of its owner, if it is owned by another object.
+  - The object itself, if it is not object-owned or wrapped.
+
+  Specifying a `rootVersion` disables nested queries for paginating owned objects or dynamic fields (these queries are only supported at checkpoint boundaries).
+  """
+  address(address: SuiAddress!, rootVersion: UInt53): Address!
+
+  """
+  First four bytes of the network's genesis checkpoint digest (uniquely identifies the network), hex-encoded.
+  """
+  chainIdentifier: String!
+
+  """
+  Fetch a checkpoint by its sequence number, or the latest checkpoint if no sequence number is provided.
+
+  Returns `null` if the checkpoint does not exist in the store, either because it never existed or because it was pruned.
+  """
+  checkpoint(sequenceNumber: UInt53): Checkpoint
+
+  """
+  Paginate checkpoints in the network, optionally bounded to checkpoints in the given epoch.
+  """
+  checkpoints(
+    first: Int
+    after: String
+    last: Int
+    before: String
+    filter: CheckpointFilter
+  ): CheckpointConnection
+
+  """
+  Fetch the CoinMetadata for a given coin type.
+
+  Returns `null` if no CoinMetadata object exists for the given coin type.
+  """
+  coinMetadata(coinType: String!): CoinMetadata
+
+  """
+  Fetch an epoch by its ID, or fetch the latest epoch if no ID is provided.
+
+  Returns `null` if the epoch does not exist yet, or was pruned.
+  """
+  epoch(epochId: UInt53): Epoch
+
+  """
+  Paginate epochs that are in the network.
+  """
+  epochs(first: Int, after: String, last: Int, before: String): EpochConnection
+
+  """
+  Paginate events that are emitted in the network, optionally filtered by event filters.
+  """
+  events(
+    first: Int
+    after: String
+    last: Int
+    before: String
+    filter: EventFilter
+  ): EventConnection
+
+  """
+  Fetch checkpoints by their sequence numbers.
+
+  Returns a list of checkpoints that is guaranteed to be the same length as `keys`. If a checkpoint in `keys` could not be found in the store, its corresponding entry in the result will be `null`. This could be because the checkpoint does not exist yet, or because it was pruned.
+  """
+  multiGetCheckpoints(keys: [UInt53!]!): [Checkpoint]!
+
+  """
+  Fetch epochs by their IDs.
+
+  Returns a list of epochs that is guaranteed to be the same length as `keys`. If an epoch in `keys` could not be found in the store, its corresponding entry in the result will be `null`. This could be because the epoch does not exist yet, or because it was pruned.
+  """
+  multiGetEpochs(keys: [UInt53!]!): [Epoch]!
+
+  """
+  Fetch objects by their keys.
+
+  Returns a list of objects that is guaranteed to be the same length as `keys`. If an object in `keys` could not be found in the store, its corresponding entry in the result will be `null`. This could be because the object never existed, or because it was pruned.
+  """
+  multiGetObjects(keys: [ObjectKey!]!): [Object]!
+
+  """
+  Fetch packages by their keys.
+
+  Returns a list of packages that is guaranteed to be the same length as `keys`. If a package in `keys` could not be found in the store, its corresponding entry in the result will be `null`. This could be because that address never pointed to a package, or because the package was pruned.
+  """
+  multiGetPackages(keys: [PackageKey!]!): [MovePackage]!
+
+  """
+  Fetch transactions by their digests.
+
+  Returns a list of transactions that is guaranteed to be the same length as `keys`. If a digest in `keys` could not be found in the store, its corresponding entry in the result will be `null`. This could be because the transaction never existed, or because it was pruned.
+  """
+  multiGetTransactions(keys: [String!]!): [Transaction]!
+
+  """
+  Fetch transaction effects by their transactions' digests.
+
+  Returns a list of transaction effects that is guaranteed to be the same length as `keys`. If a digest in `keys` could not be found in the store, its corresponding entry in the result will be `null`. This could be because the transaction effects never existed, or because it was pruned.
+  """
+  multiGetTransactionEffects(keys: [String!]!): [TransactionEffects]!
+
+  """
+  Fetch types by their string representations.
+
+  Types are canonicalized: In the input they can be at any package address at or after the package that first defines them, and in the output they will be relocated to the package that first defines them.
+
+  Returns a list of types that is guaranteed to be the same length as `keys`. If a type in `keys` could not be found, its corresponding entry in the result will be `null`.
+  """
+  multiGetTypes(keys: [String!]!): [MoveType]!
+
+  """
+  Fetch an object by its address.
+
+  If `version` is specified, the object will be fetched at that exact version.
+
+  If `rootVersion` is specified, the object will be fetched at the latest version at or before this version. Nested dynamic field accesses will also be subject to this bound. This can be used to fetch a child or ancestor object bounded by its root object's version. For any wrapped or child (object-owned) object, its root object can be defined recursively as:
+
+  - The root object of the object it is wrapped in, if it is wrapped.
+  - The root object of its owner, if it is owned by another object.
+  - The object itself, if it is not object-owned or wrapped.
+
+  Specifying a `version` or a `rootVersion` disables nested queries for paginating owned objects or dynamic fields (these queries are only supported at checkpoint boundaries).
+
+  If `atCheckpoint` is specified, the object will be fetched at the latest version as of this checkpoint. This will fail if the provided checkpoint is after the RPC's latest checkpoint.
+
+  If none of the above are specified, the object is fetched at the latest checkpoint.
+
+  It is an error to specify more than one of `version`, `rootVersion`, or `atCheckpoint`.
+
+  Returns `null` if an object cannot be found that meets this criteria.
+  """
+  object(
+    address: SuiAddress!
+    version: UInt53
+    rootVersion: UInt53
+    atCheckpoint: UInt53
+  ): Object
+
+  """
+  Paginate objects in the live object set, optionally filtered by owner and/or type. `filter` can be one of:
+
+  - A filter on type (all live objects whose type matches that filter).
+  - Fetching all objects owned by an address or object, optionally filtered by type.
+  - Fetching all shared or immutable objects, filtered by type.
+  """
+  objects(
+    first: Int
+    after: String
+    last: Int
+    before: String
+    filter: ObjectFilter!
+  ): ObjectConnection
+
+  """
+  Paginate all versions of an object at `address`, optionally bounding the versions exclusively from below with `filter.afterVersion` or from above with `filter.beforeVersion`.
+  """
+  objectVersions(
+    first: Int
+    after: String
+    last: Int
+    before: String
+    address: SuiAddress!
+    filter: VersionFilter
+  ): ObjectConnection
+
+  """
+  Fetch a package by its address.
+
+  If `version` is specified, the package loaded is the one that shares its original ID with the package at `address`, but whose version is `version`.
+
+  If `atCheckpoint` is specified, the package loaded is the one with the largest version among all packages sharing an original ID with the package at `address` and was published at or before `atCheckpoint`.
+
+  If neither are specified, the package is fetched at the latest checkpoint.
+
+  It is an error to specify both `version` and `atCheckpoint`, and `null` will be returned if the package cannot be found as of the latest checkpoint, or the address points to an object that is not a package.
+
+  Note that this interpretation of `version` and "latest" differs from the one used by `Query.object`, because non-system package upgrades generate objects with different IDs. To fetch a package using the versioning semantics of objects, use `Object.asMovePackage` nested under `Query.object`.
+  """
+  package(
+    address: SuiAddress!
+    version: UInt53
+    atCheckpoint: UInt53
+  ): MovePackage
+
+  """
+  Paginate all packages published on-chain, optionally bounded to packages published strictly after `filter.afterCheckpoint` and/or strictly before `filter.beforeCheckpoint`.
+  """
+  packages(
+    first: Int
+    after: String
+    last: Int
+    before: String
+    filter: PackageCheckpointFilter
+  ): MovePackageConnection
+
+  """
+  Paginate all versions of a package at `address`, optionally bounding the versions exclusively from below with `filter.afterVersion` or from above with `filter.beforeVersion`.
+
+  Different versions of a package will have different object IDs, unless they are system packages, but will share the same original ID.
+  """
+  packageVersions(
+    first: Int
+    after: String
+    last: Int
+    before: String
+    address: SuiAddress!
+    filter: VersionFilter
+  ): MovePackageConnection
+
+  """
+  Fetch the protocol config by protocol version, or the latest protocol config used on chain if no version is provided.
+  """
+  protocolConfigs(version: UInt53): ProtocolConfigs
+
+  """
+  Configuration for this RPC service.
+  """
+  serviceConfig: ServiceConfig!
+
+  """
+  Look-up an account by its SuiNS name, assuming it has a valid, unexpired name registration.
+  """
+  suinsName(address: String!, rootVersion: UInt53): Address
+
+  """
+  Fetch a transaction by its digest.
+
+  Returns `null` if the transaction does not exist in the store, either because it never existed or because it was pruned.
+  """
+  transaction(digest: String!): Transaction
+
+  """
+  Fetch transaction effects by its transaction's digest.
+
+  Returns `null` if the transaction effects do not exist in the store, either because that transaction was not executed, or it was pruned.
+  """
+  transactionEffects(digest: String!): TransactionEffects
+
+  """
+  The transactions that exist in the network, optionally filtered by transaction filters.
+  """
+  transactions(
+    first: Int
+    after: String
+    last: Int
+    before: String
+    filter: TransactionFilter
+  ): TransactionConnection
+
+  """
+  Fetch a structured representation of a concrete type, including its layout information.
+
+  Types are canonicalized: In the input they can be at any package address at or after the package that first defines them, and in the output they will be relocated to the package that first defines them.
+
+  Fails if the type is malformed, returns `null` if a type mentioned does not exist.
+  """
+  type(type: String!): MoveType
+
+  """
+  Simulate a transaction to preview its effects without executing it on chain.
+
+  Accepts a JSON transaction matching the [Sui gRPC API schema](https://docs.sui.io/references/fullnode-protocol#sui-rpc-v2-Transaction).
+  The JSON format allows for partial transaction specification where certain fields can be automatically resolved by the server.
+
+  Alternatively, for already serialized transactions, you can pass BCS-encoded data:
+  `{"bcs": {"value": "<base64>"}}`
+
+  Unlike `executeTransaction`, this does not require signatures since the transaction is not committed to the blockchain. This allows for previewing transaction effects, estimating gas costs, and testing transaction logic without spending gas or requiring valid signatures.
+  """
+  simulateTransaction(transaction: JSON!): SimulationResult!
+
+  """
+  Verify a zkLogin signature os from the given `author`.
+
+  Returns a `ZkLoginVerifyResult` where `success` is `true` and `error` is empty if the signature is valid. If the signature is invalid, `success` is `false` and `error` contains the relevant error message.
+
+  - `bytes` are either the bytes of a serialized personal message, or `TransactionData`, Base64-encoded.
+  - `signature` is a serialized zkLogin signature, also Base64-encoded.
+  - `intentScope` indicates whether `bytes` are to be parsed as a personal message or `TransactionData`.
+  - `author` is the signer's address.
+  """
+  verifyZkLoginSignature(
+    bytes: Base64!
+    signature: Base64!
+    intentScope: ZkLoginIntentScope!
+    author: SuiAddress!
+  ): ZkLoginVerifyResult!
+}
+
+"""
+System transaction for creating the on-chain randomness state.
+"""
+type RandomnessStateCreateTransaction {
+  """
+  A workaround to define an empty variant of a GraphQL union.
+  """
+  _: Boolean
+}
+
+"""
+System transaction to update the source of on-chain randomness.
+"""
+type RandomnessStateUpdateTransaction {
+  """
+  Epoch of the randomness state update transaction.
+  """
+  epoch: Int
+
+  """
+  Randomness round of the update.
+  """
+  randomnessRound: Int
+
+  """
+  Updated random bytes, Base64 encoded.
+  """
+  randomBytes: Base64
+
+  """
+  The initial version of the randomness object that it was shared at.
+  """
+  randomnessObjInitialSharedVersion: Int
+}
+
+"""
+A transaction that wanted to read a consensus-managed object but couldn't because it became not-consensus-managed before the transaction executed (for example, it was deleted, turned into an owned object, or wrapped).
+"""
+type ReadConsensusStreamEnded {
+  """
+  The ID of the consensus-managed object.
+  """
+  address: SuiAddress
+
+  """
+  The sequence number associated with the consensus stream ending.
+  """
+  sequenceNumber: UInt53
+}
+
+"""
+A Move object that can be received in this transaction.
+"""
+type Receiving {
+  object: Object
+}
+
+"""
+Whether the currency is regulated or not.
+"""
+enum RegulatedState {
+  """
+  A `DenyCap` or a `RegulatedCoinMetadata` exists for this currency.
+  """
+  REGULATED
+
+  """
+  The currency was created without a deny list.
+  """
+  UNREGULATED
+}
+
+type SafeMode {
+  """
+  Whether safe mode was used for the last epoch change.
+  The system will retry a full epoch change on every epoch boundary and automatically reset this flag if so.
+  """
+  enabled: Boolean
+
+  """
+  Accumulated fees for computation and cost that have not been added to the various reward pools, because the full epoch change did not happen.
+  """
+  gasSummary: GasCostSummary
+}
+
+type ServiceConfig {
+  """
+  Maximum time in milliseconds spent waiting for a response from fullnode after issuing a transaction to execute. Note that the transaction may still succeed even in the case of a timeout. Transactions are idempotent, so a transaction that times out should be re-submitted until the network returns a definite response (success or failure, not timeout).
+  """
+  mutationTimeoutMs: Int
+
+  """
+  Maximum time in milliseconds that will be spent to serve one query request.
+  """
+  queryTimeoutMs: Int
+
+  """
+  Maximum depth of a GraphQL query that can be accepted by this service.
+  """
+  maxQueryDepth: Int
+
+  """
+  The maximum number of nodes (field names) the service will accept in a single query.
+  """
+  maxQueryNodes: Int
+
+  """
+  Maximum number of estimated output nodes in a GraphQL response.
+
+  The estimate is an upperbound of how many nodes there would be in the output assuming every requested field is present, paginated requests return full page sizes, and multi-get queries find all requested keys. Below is a worked example query:
+
+  ```graphql
+  |  0: query {                            # 514 = total
+  |  1:   checkpoint {                     # 1
+  |  2:     sequenceNumber                 # 1
+  |  3:   }
+  |  4:
+  |  5:   multiGetObjects([$a, $b, $c]) {  # 1 (* 3)
+  |  6:     address                        # 3
+  |  7:     digest                         # 3
+  |  8:   }
+  |  9:
+  | 10:   # default page size is 20
+  | 11:   transactions {                   # 1 (* 20)
+  | 12:     pageInfo {                     # 1
+  | 13:       hasNextPage                  # 1
+  | 14:       endCursor                    # 1
+  | 15:     }
+  | 16:
+  | 17:     nodes                          # 1
+  | 18:     {                              # 20
+  | 19:       digest                       # 20
+  | 20:       effects {                    # 20
+  | 21:         objectChanges(first: 10) { # 20 (* 10)
+  | 22:           nodes                    # 20
+  | 23:           {                        # 200
+  | 24:             address                # 200
+  | 25:           }
+  | 26:         }
+  | 27:       }
+  | 28:     }
+  | 29:   }
+  | 30: }
+  ```
+  """
+  maxOutputNodes: Int
+
+  """
+  Maximum size in bytes allowed for the `txBytes` and `signatures` parameters of an `executeTransaction` or `simulateTransaction` field, or the `bytes` and `signature` parameters of a `verifyZkLoginSignature` field.
+
+  This is cumulative across all matching fields in a single GraphQL request.
+  """
+  maxTransactionPayloadSize: Int
+
+  """
+  Maximum size in bytes of a single GraphQL request, excluding the elements covered by `maxTransactionPayloadSize`.
+  """
+  maxQueryPayloadSize: Int
+
+  """
+  Number of elements a paginated connection will return if a page size is not supplied.
+
+  Accepts `type` and `field` arguments which identify the connection that is being queried. If the field in question is paginated, its default page size is returned. If it does not exist or is not paginated, `null` is returned.
+  """
+  defaultPageSize(type: String!, field: String!): Int
+
+  """
+  Maximum number of elements that can be requested from a paginated connection. A request to fetch more elements will result in an error.
+
+  Accepts `type` and `field` arguments which identify the connection that is being queried. If the field in question is paginated, its max page size is returned. If it does not exist or is not paginated, `null` is returned.
+  """
+  maxPageSize(type: String!, field: String!): Int
+
+  """
+  Maximum number of elements that can be requested from a multi-get query. A request to fetch more keys will result in an error.
+  """
+  maxMultiGetSize: Int
+
+  """
+  Maximum amount of nesting among type arguments (type arguments nest when a type argument is itself generic and has arguments).
+  """
+  maxTypeArgumentDepth: Int
+
+  """
+  Maximum number of type parameters a type can have.
+  """
+  maxTypeArgumentWidth: Int
+
+  """
+  Maximum number of datatypes that need to be processed when calculating the layout of a single type.
+  """
+  maxTypeNodes: Int
+
+  """
+  Maximum nesting allowed in datatype fields when calculating the layout of a single type.
+  """
+  maxMoveValueDepth: Int
+
+  """
+  Maximum budget in bytes to spend when outputting a structured `MoveValue`.
+  """
+  maxMoveValueBound: Int
+
+  """
+  Maximum depth of nested field access supported in display outputs.
+  """
+  maxDisplayFieldDepth: Int
+
+  """
+  Maximum output size of a display output.
+  """
+  maxDisplayOutputSize: Int
+
+  """
+  Maximum output size of a disassembled MoveModule, in bytes.
+  """
+  maxDisassembledModuleSize: Int
+
+  """
+  Range of checkpoints for which data is available for a query type, field and optional filter. If filter is not provided, the strictest retention range for the query and type is returned.
+  """
+  availableRange(
+    type: String!
+    field: String
+    filters: [String!]
+  ): AvailableRange!
+}
+
+"""
+Object is shared, can be used by any address, and is mutable.
+"""
+type Shared {
+  """
+  The version at which the object became shared.
+  """
+  initialSharedVersion: UInt53
+}
+
+"""
+A Move object that's shared.
+"""
+type SharedInput {
+  """
+  The address of the shared object.
+  """
+  address: SuiAddress
+
+  """
+  The version that this object was shared at.
+  """
+  initialSharedVersion: UInt53
+
+  """
+  Controls whether the transaction block can reference the shared object as a mutable reference or by value.
+
+  This has implications for scheduling: Transactions that just read shared objects at a certain version (mutable = false) can be executed concurrently, while transactions that write shared objects (mutable = true) must be executed serially with respect to each other.
+  """
+  mutable: Boolean
+}
+
+"""
+The result of simulating a transaction, including the predicted effects, events, and any errors.
+"""
+type SimulationResult {
+  """
+  The predicted effects of the transaction if it were executed.
+
+  `None` if the simulation failed due to an error.
+  """
+  effects: TransactionEffects
+
+  """
+  The events that would be emitted if the transaction were executed.
+
+  `None` if the simulation failed or no events would be emitted.
+  """
+  events: [Event!]
+
+  """
+  The intermediate outputs for each command of the transaction simulation, including contents of mutated references and return values.
+  """
+  outputs: [CommandResult!]
+
+  """
+  Error message if the simulation failed.
+
+  `None` if the simulation was successful.
+  """
+  error: String
+}
+
+"""
+Splits off coins with denominations in `amounts` from `coin`, returning multiple results (as many as there are amounts.)
+"""
+type SplitCoinsCommand {
+  """
+  The coin to split.
+  """
+  coin: TransactionArgument
+
+  """
+  The denominations to split off from the coin.
+  """
+  amounts: [TransactionArgument!]!
+}
+
+"""
+Parameters that control the distribution of the stake subsidy.
+"""
+type StakeSubsidy {
+  """
+  SUI set aside for stake subsidies -- reduces over time as stake subsidies are paid out over time.
+  """
+  balance: BigInt
+
+  """
+  Number of times stake subsidies have been distributed.
+  Subsidies are distributed with other staking rewards, at the end of the epoch.
+  """
+  distributionCounter: Int
+
+  """
+  Amount of stake subsidy deducted from the balance per distribution -- decays over time.
+  """
+  currentDistributionAmount: BigInt
+
+  """
+  Maximum number of stake subsidy distributions that occur with the same distribution amount (before the amount is reduced).
+  """
+  periodLength: Int
+
+  """
+  Percentage of the current distribution amount to deduct at the end of the current subsidy period, expressed in basis points.
+  """
+  decreaseRate: Int
+}
+
+"""
+SUI set aside to account for objects stored on-chain.
+"""
+type StorageFund {
+  """
+  Sum of storage rebates of live objects on chain.
+  """
+  totalObjectStorageRebates: BigInt
+
+  """
+  The portion of the storage fund that will never be refunded through storage rebates.
+  The system maintains an invariant that the sum of all storage fees into the storage fund is equal to the sum of all storage rebates out, the total storage rebates remaining, and the non-refundable balance.
+  """
+  nonRefundableBalance: BigInt
+}
+
+"""
+System transaction for storing execution time observations.
+"""
+type StoreExecutionTimeObservationsTransaction {
+  """
+  A workaround to define an empty variant of a GraphQL union.
+  """
+  _: Boolean
+}
+
+"""
+String containing 32 byte hex-encoded address, with a leading '0x'. Leading zeroes can be omitted on input but will always appear in outputs (SuiAddress in output is guaranteed to be 66 characters long).
+"""
+scalar SuiAddress
+
+"""
+Future behavior of a currency's supply.
+"""
+enum SupplyState {
+  """
+  The supply can only decrease.
+  """
+  BURN_ONLY
+
+  """
+  The supply can neither increase nor decrease.
+  """
+  FIXED
+}
+
+"""
+Details of the system that are decided during genesis.
+"""
+type SystemParameters {
+  """
+  Target duration of an epoch, in milliseconds.
+  """
+  durationMs: BigInt
+
+  """
+  The epoch at which stake subsidies start being paid out.
+  """
+  stakeSubsidyStartEpoch: UInt53
+
+  """
+  The minimum number of active validators that the system supports.
+  """
+  minValidatorCount: Int
+
+  """
+  The maximum number of active validators that the system supports.
+  """
+  maxValidatorCount: Int
+
+  """
+  Minimum stake needed to become a new validator.
+  """
+  minValidatorJoiningStake: BigInt
+
+  """
+  Validators with stake below this threshold will enter the grace period (see `validatorLowStakeGracePeriod`), after which they are removed from the active validator set.
+  """
+  validatorLowStakeThreshold: BigInt
+
+  """
+  Validators with stake below this threshold will be removed from the active validator set at the next epoch boundary, without a grace period.
+  """
+  validatorVeryLowStakeThreshold: BigInt
+
+  """
+  The number of epochs that a validator has to recover from having less than `validatorLowStakeThreshold` stake.
+  """
+  validatorLowStakeGracePeriod: BigInt
+}
+
+"""
+Description of a transaction, the unit of activity on Sui.
+"""
+type Transaction {
+  """
+  A 32-byte hash that uniquely identifies the transaction contents, encoded in Base58.
+  """
+  digest: String!
+
+  """
+  The results to the chain of executing this transaction.
+  """
+  effects: TransactionEffects
+
+  """
+  The type of this transaction as well as the commands and/or parameters comprising the transaction of this kind.
+  """
+  kind: TransactionKind
+
+  """
+  This field is set by senders of a transaction block. It is an epoch reference that sets a deadline after which validators will no longer consider the transaction valid. By default, there is no deadline for when a transaction must execute.
+  """
+  expiration: Epoch
+
+  """
+  The gas input field provides information on what objects were used as gas as well as the owner of the gas object(s) and information on the gas price and budget.
+  """
+  gasInput: GasInput
+
+  """
+  The address corresponding to the public key that signed this transaction. System transactions do not have senders.
+  """
+  sender: Address
+
+  """
+  The Base64-encoded BCS serialization of this transaction, as a `TransactionData`.
+  """
+  transactionBcs: Base64
+
+  """
+  User signatures for this transaction.
+  """
+  signatures: [UserSignature!]!
+}
+
+"""
+An argument to a programmable transaction command.
+"""
+union TransactionArgument = GasCoin | Input | TxResult
+
+type TransactionConnection {
+  """
+  Information to aid in pagination.
+  """
+  pageInfo: PageInfo!
+
+  """
+  A list of edges.
+  """
+  edges: [TransactionEdge!]!
+
+  """
+  A list of nodes.
+  """
+  nodes: [Transaction!]!
+}
+
+"""
+An edge in a connection.
+"""
+type TransactionEdge {
+  """
+  The item at the end of the edge
+  """
+  node: Transaction!
+
+  """
+  A cursor for use in pagination
+  """
+  cursor: String!
+}
+
+"""
+The results of executing a transaction.
+"""
+type TransactionEffects {
+  """
+  A 32-byte hash that uniquely identifies the transaction contents, encoded in Base58.
+
+  Note that this is different from the execution digest, which is the unique hash of the transaction effects.
+  """
+  digest: String!
+
+  """
+  The transaction that ran to produce these effects.
+  """
+  transaction: Transaction
+
+  """
+  The checkpoint this transaction was finalized in.
+  """
+  checkpoint: Checkpoint
+
+  """
+  Whether the transaction executed successfully or not.
+  """
+  status: ExecutionStatus
+
+  """
+  The latest version of all objects (apart from packages) that have been created or modified by this transaction, immediately following this transaction.
+  """
+  lamportVersion: UInt53
+
+  """
+  Rich execution error information for failed transactions.
+  """
+  executionError: ExecutionError
+
+  """
+  Timestamp corresponding to the checkpoint this transaction was finalized in.
+  """
+  timestamp: DateTime
+
+  """
+  The epoch this transaction was finalized in.
+  """
+  epoch: Epoch
+
+  """
+  Events emitted by this transaction.
+  """
+  events(first: Int, after: String, last: Int, before: String): EventConnection
+
+  """
+  The effect this transaction had on the balances (sum of coin values per coin type) of addresses and objects.
+  """
+  balanceChanges(
+    first: Int
+    after: String
+    last: Int
+    before: String
+  ): BalanceChangeConnection
+
+  """
+  The Base64-encoded BCS serialization of these effects, as `TransactionEffects`.
+  """
+  effectsBcs: Base64
+
+  """
+  A 32-byte hash that uniquely identifies the effects contents, encoded in Base58.
+  """
+  effectsDigest: String
+
+  """
+  The before and after state of objects that were modified by this transaction.
+  """
+  objectChanges(
+    first: Int
+    after: String
+    last: Int
+    before: String
+  ): ObjectChangeConnection
+
+  """
+  Effects related to the gas object used for the transaction (costs incurred and the identity of the smashed gas object returned).
+  """
+  gasEffects: GasEffects
+
+  """
+  The unchanged consensus-managed objects that were referenced by this transaction.
+  """
+  unchangedConsensusObjects(
+    first: Int
+    after: String
+    last: Int
+    before: String
+  ): UnchangedConsensusObjectConnection
+
+  """
+  Transactions whose outputs this transaction depends upon.
+  """
+  dependencies(
+    first: Int
+    after: String
+    last: Int
+    before: String
+  ): TransactionConnection
+}
+
+input TransactionFilter {
+  """
+  Filter to transactions that occurred strictly after the given checkpoint.
+  """
+  afterCheckpoint: UInt53
+
+  """
+  Filter to transactions in the given checkpoint.
+  """
+  atCheckpoint: UInt53
+
+  """
+  Filter to transaction that occurred strictly before the given checkpoint.
+  """
+  beforeCheckpoint: UInt53
+
+  """
+  Filter transactions by move function called. Calls can be filtered by the `package`, `package::module`, or the `package::module::name` of their function.
+  """
+  function: String
+
+  """
+  An input filter selecting for either system or programmable transactions.
+  """
+  kind: TransactionKindInput
+
+  """
+  Limit to transactions that interacted with the given address.
+  The address could be a sender, sponsor, or recipient of the transaction.
+  """
+  affectedAddress: SuiAddress
+
+  """
+  Limit to transactions that interacted with the given object.
+  The object could have been created, read, modified, deleted, wrapped, or unwrapped by the transaction.
+  Objects that were passed as a `Receiving` input are not considered to have been affected by a transaction unless they were actually received.
+  """
+  affectedObject: SuiAddress
+
+  """
+  Limit to transactions that were sent by the given address.
+  """
+  sentAddress: SuiAddress
+}
+
+"""
+Input argument to a Programmable Transaction Block (PTB) command.
+"""
+union TransactionInput = Pure | OwnedOrImmutable | SharedInput | Receiving
+
+type TransactionInputConnection {
+  """
+  Information to aid in pagination.
+  """
+  pageInfo: PageInfo!
+
+  """
+  A list of edges.
+  """
+  edges: [TransactionInputEdge!]!
+
+  """
+  A list of nodes.
+  """
+  nodes: [TransactionInput!]!
+}
+
+"""
+An edge in a connection.
+"""
+type TransactionInputEdge {
+  """
+  The item at the end of the edge
+  """
+  node: TransactionInput!
+
+  """
+  A cursor for use in pagination
+  """
+  cursor: String!
+}
+
+"""
+Different types of transactions that can be executed on the Sui network.
+"""
+union TransactionKind =
+    GenesisTransaction
+  | ConsensusCommitPrologueTransaction
+  | ChangeEpochTransaction
+  | RandomnessStateUpdateTransaction
+  | AuthenticatorStateUpdateTransaction
+  | EndOfEpochTransaction
+  | ProgrammableTransaction
+  | ProgrammableSystemTransaction
+
+"""
+An input filter selecting for either system or programmable transactions.
+"""
+enum TransactionKindInput {
+  """
+  A system transaction can be one of several types of transactions.
+  See [unions/transaction-block-kind] for more details.
+  """
+  SYSTEM_TX
+
+  """
+  A user submitted transaction block.
+  """
+  PROGRAMMABLE_TX
+}
+
+"""
+Transfers `inputs` to `address`. All inputs must have the `store` ability (allows public transfer) and must not be previously immutable or shared.
+"""
+type TransferObjectsCommand {
+  """
+  The objects to transfer.
+  """
+  inputs: [TransactionArgument!]!
+
+  """
+  The address to transfer to.
+  """
+  address: TransactionArgument
+}
+
+"""
+The result of another command.
+"""
+type TxResult {
+  """
+  The index of the command that produced this result.
+  """
+  cmd: Int
+
+  """
+  For nested results, the index within the result.
+  """
+  ix: Int
+}
+
+"""
+Information about which previous versions of a package introduced its types.
+"""
+type TypeOrigin {
+  """
+  Module defining the type.
+  """
+  module: String
+
+  """
+  Name of the struct.
+  """
+  struct: String
+
+  """
+  The storage ID of the package that first defined this type.
+  """
+  definingId: SuiAddress
+}
+
+"""
+An unsigned integer that can hold values up to 2^53 - 1. This can be treated similarly to `Int`, but it is guaranteed to be non-negative, and it may be larger than 2^32 - 1.
+"""
+scalar UInt53
+
+"""
+Details pertaining to consensus-managed objects that are referenced by but not changed by a transaction.
+"""
+union UnchangedConsensusObject =
+    ConsensusObjectRead
+  | MutateConsensusStreamEnded
+  | ReadConsensusStreamEnded
+  | ConsensusObjectCancelled
+  | PerEpochConfig
+
+type UnchangedConsensusObjectConnection {
+  """
+  Information to aid in pagination.
+  """
+  pageInfo: PageInfo!
+
+  """
+  A list of edges.
+  """
+  edges: [UnchangedConsensusObjectEdge!]!
+
+  """
+  A list of nodes.
+  """
+  nodes: [UnchangedConsensusObject!]!
+}
+
+"""
+An edge in a connection.
+"""
+type UnchangedConsensusObjectEdge {
+  """
+  The item at the end of the edge
+  """
+  node: UnchangedConsensusObject!
+
+  """
+  A cursor for use in pagination
+  """
+  cursor: String!
+}
+
+"""
+Upgrades a Move Package.
+"""
+type UpgradeCommand {
+  """
+  Bytecode for the modules to be published, BCS serialized and Base64 encoded.
+  """
+  modules: [Base64!]
+
+  """
+  IDs of the transitive dependencies of the package to be published.
+  """
+  dependencies: [SuiAddress!]
+
+  """
+  ID of the package being upgraded.
+  """
+  currentPackage: SuiAddress
+
+  """
+  The `UpgradeTicket` authorizing the upgrade.
+  """
+  upgradeTicket: TransactionArgument
+}
+
+type UserSignature {
+  """
+  The signature bytes, Base64-encoded.
+  For simple signatures: flag || signature || pubkey
+  For complex signatures: flag || bcs_serialized_struct
+  """
+  signatureBytes: Base64
+}
+
+type Validator implements IAddressable {
+  """
+  The validator's address.
+  """
+  address: SuiAddress!
+
+  """
+  Fetch the total balance for coins with marker type `coinType` (e.g. `0x2::sui::SUI`), owned by this address.
+
+  If the address does not own any coins of that type, a balance of zero is returned.
+  """
+  balance(coinType: String!): Balance
+
+  """
+  Total balance across coins owned by this address, grouped by coin type.
+  """
+  balances(
+    first: Int
+    after: String
+    last: Int
+    before: String
+  ): BalanceConnection
+
+  """
+  The domain explicitly configured as the default SuiNS name for this address.
+  """
+  defaultSuinsName: String
+
+  """
+  Fetch the total balances keyed by coin types (e.g. `0x2::sui::SUI`) owned by this address.
+
+  Returns `None` when no checkpoint is set in scope (e.g. execution scope).
+  If the address does not own any coins of a given type, a balance of zero is returned for that type.
+  """
+  multiGetBalances(keys: [String!]!): [Balance!]
+
+  """
+  Objects owned by this object, optionally filtered by type.
+  """
+  objects(
+    first: Int
+    after: String
+    last: Int
+    before: String
+    filter: ObjectFilter
+  ): MoveObjectConnection
+
+  """
+  Validator's set of credentials such as public keys, network addresses and others.
+  """
+  credentials: ValidatorCredentials
+
+  """
+  Validator's set of credentials for the next epoch.
+  """
+  nextEpochCredentials: ValidatorCredentials
+
+  """
+  Validator's name.
+  """
+  name: String
+
+  """
+  Validator's description.
+  """
+  description: String
+
+  """
+  Validator's url containing their custom image.
+  """
+  imageUrl: String
+
+  """
+  Validator's homepage URL.
+  """
+  projectUrl: String
+
+  """
+  The validator's current valid `Cap` object. Validators can delegate the operation ability to another address.
+  The address holding this `Cap` object can then update the reference gas price and tallying rule on behalf of the validator.
+  """
+  operationCap: MoveObject
+
+  """
+  The ID of this validator's `0x3::staking_pool::StakingPool`.
+  """
+  stakingPoolId: SuiAddress!
+
+  """
+  A wrapped object containing the validator's exchange rates. This is a table from epoch number to `PoolTokenExchangeRate` value.
+  The exchange rate is used to determine the amount of SUI tokens that each past SUI staker can withdraw in the future.
+  """
+  exchangeRatesTable: Address
+
+  """
+  Number of exchange rates in the table.
+  """
+  exchangeRatesSize: UInt53
+
+  """
+  The epoch at which this pool became active.
+  """
+  stakingPoolActivationEpoch: UInt53
+
+  """
+  The total number of SUI tokens in this pool.
+  """
+  stakingPoolSuiBalance: BigInt
+
+  """
+  The epoch stake rewards will be added here at the end of each epoch.
+  """
+  rewardsPool: BigInt
+
+  """
+  Total number of pool tokens issued by the pool.
+  """
+  poolTokenBalance: BigInt
+
+  """
+  Pending stake amount for this epoch.
+  """
+  pendingStake: BigInt
+
+  """
+  Pending stake withdrawn during the current epoch, emptied at epoch boundaries.
+  """
+  pendingTotalSuiWithdraw: BigInt
+
+  """
+  Pending pool token withdrawn during the current epoch, emptied at epoch boundaries.
+  """
+  pendingPoolTokenWithdraw: BigInt
+
+  """
+  The voting power of this validator in basis points (e.g., 100 = 1% voting power).
+  """
+  votingPower: Int
+
+  """
+  The reference gas price for this epoch.
+  """
+  gasPrice: BigInt
+
+  """
+  The fee charged by the validator for staking services.
+  """
+  commissionRate: Int
+
+  """
+  The total number of SUI tokens in this pool plus the pending stake amount for this epoch.
+  """
+  nextEpochStake: BigInt
+
+  """
+  The validator's gas price quote for the next epoch.
+  """
+  nextEpochGasPrice: BigInt
+
+  """
+  The proposed next epoch fee for the validator's staking services.
+  """
+  nextEpochCommissionRate: Int
+
+  """
+  The number of epochs for which this validator has been below the low stake threshold.
+  """
+  atRisk: UInt53
+
+  """
+  Other validators this validator has reported.
+  """
+  reportRecords(
+    first: Int
+    before: String
+    last: Int
+    after: String
+  ): ValidatorConnection
+}
+
+type ValidatorAggregatedSignature {
+  """
+  The epoch when this aggregate signature was produced.
+  """
+  epoch: Epoch
+
+  """
+  The Base64 encoded BLS12381 aggregated signature.
+  """
+  signature: Base64
+
+  """
+  The indexes of validators that contributed to this signature.
+  """
+  signersMap: [Int!]!
+}
+
+type ValidatorConnection {
+  """
+  Information to aid in pagination.
+  """
+  pageInfo: PageInfo!
+
+  """
+  A list of edges.
+  """
+  edges: [ValidatorEdge!]!
+
+  """
+  A list of nodes.
+  """
+  nodes: [Validator!]!
+}
+
+"""
+The credentials related fields associated with a validator.
+"""
+type ValidatorCredentials {
+  protocolPubKey: Base64
+  networkPubKey: Base64
+  workerPubKey: Base64
+  proofOfPossession: Base64
+  netAddress: String
+  p2PAddress: String
+  primaryAddress: String
+  workerAddress: String
+}
+
+"""
+An edge in a connection.
+"""
+type ValidatorEdge {
+  """
+  The item at the end of the edge
+  """
+  node: Validator!
+
+  """
+  A cursor for use in pagination
+  """
+  cursor: String!
+}
+
+"""
+Representation of `0x3::validator_set::ValidatorSet`.
+"""
+type ValidatorSet {
+  """
+  The current list of active validators.
+  """
+  activeValidators(
+    first: Int
+    after: String
+    last: Int
+    before: String
+  ): ValidatorConnection
+
+  """
+  Object ID of the `Table` storing the inactive staking pools.
+  """
+  inactivePoolsId: SuiAddress
+
+  """
+  Size of the inactive pools `Table`.
+  """
+  inactivePoolsSize: Int
+
+  """
+  Object ID of the wrapped object `TableVec` storing the pending active validators.
+  """
+  pendingActiveValidatorsId: SuiAddress
+
+  """
+  Size of the pending active validators table.
+  """
+  pendingActiveValidatorsSize: Int
+
+  """
+  Validators that are pending removal from the active validator set, expressed as indices in to `activeValidators`.
+  """
+  pendingRemovals: [Int!]
+
+  """
+  Object ID of the `Table` storing the mapping from staking pool ids to the addresses of the corresponding validators.
+  This is needed because a validator's address can potentially change but the object ID of its pool will not.
+  """
+  stakingPoolMappingsId: SuiAddress
+
+  """
+  Size of the stake pool mappings `Table`.
+  """
+  stakingPoolMappingsSize: Int
+
+  """
+  Total amount of stake for all active validators at the beginning of the epoch.
+  """
+  totalStake: BigInt
+
+  """
+  Object ID of the `Table` storing the validator candidates.
+  """
+  validatorCandidatesId: SuiAddress
+
+  """
+  Size of the validator candidates `Table`.
+  """
+  validatorCandidatesSize: Int
+}
+
+"""
+Filter for paginating the history of an Object or MovePackage.
+"""
+input VersionFilter {
+  """
+  Filter to versions that are strictly newer than this one, defaults to fetching from the earliest version known to this RPC (this could be the initial version, or some later version if the initial version has been pruned).
+  """
+  afterVersion: UInt53
+
+  """
+  Filter to versions that are strictly older than this one, defaults to fetching up to the latest version (inclusive).
+  """
+  beforeVersion: UInt53
+}
+
+"""
+An enum that specifies the intent scope to be used to parse the bytes for signature verification.
+"""
+enum ZkLoginIntentScope {
+  """
+  Indicates that the bytes are to be parsed as transaction data bytes.
+  """
+  TRANSACTION_DATA
+
+  """
+  Indicates that the bytes are to be parsed as a personal message.
+  """
+  PERSONAL_MESSAGE
+}
+
+"""
+The result of the zkLogin signature verification.
+"""
+type ZkLoginVerifyResult {
+  """
+  The boolean result of the verification. If true, errors should be empty.
+  """
+  success: Boolean
+
+  """
+  The error field capture reasons why the signature could not be verified, assuming the inputs are valid and there are no internal errors.
+  """
+  error: String
+}
diff --git a/sdk/src/events/mod.rs b/sdk/src/events/mod.rs
new file mode 100644
index 00000000..0f086641
--- /dev/null
+++ b/sdk/src/events/mod.rs
@@ -0,0 +1,650 @@
+use {
+    crate::{sui, types::*, ToolFqn},
+    anyhow::{bail, Result},
+    serde::{Deserialize, Serialize},
+};
+
+mod fetching;
+mod graphql;
+mod parsing;
+
+pub use {fetching::*, graphql::*, parsing::*};
+
+/// Struct holding the Sui event ID, the event generic arguments and the data
+/// as one of [NexusEventKind].
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct NexusEvent {
+    /// The event transaction digest and event sequence.
+    pub id: (sui::types::Digest, u64),
+    /// If the `T in NexusEvent<T>` is also a generic, this field holds the
+    /// generic type. Note that this can be nested indefinitely.
+    pub generics: Vec<sui::types::TypeTag>,
+    /// The event data.
+    pub data: NexusEventKind,
+}
+
+macro_rules! events {
+    (
+        $(
+            $struct_name:ident => $variant:ident, $name:expr
+        ),* $(,)?
+    ) => {
+
+        // == enum NexusEventKind ==
+
+        #[derive(Clone, Debug, Serialize, Deserialize)]
+        #[serde(tag = "_nexus_event_type", content = "event")]
+        pub enum NexusEventKind {
+            $(
+                #[serde(rename = $name)]
+                $variant($struct_name),
+            )*
+        }
+
+        impl NexusEventKind {
+            /// Returns the name of the event kind as a string.
+            pub fn name(&self) -> String {
+                match self {
+                    $(
+                        NexusEventKind::$variant(_) => stringify!($struct_name).to_string(),
+                    )*
+                }
+            }
+        }
+
+        // == Parsing from BCS ==
+
+        pub(super) fn parse_bcs(name: &str, bytes: &[u8]) -> Result<NexusEventKind> {
+            #[derive(Deserialize)]
+            struct Wrapper<T> {
+                event: T,
+            }
+
+            match name {
+                $(
+                    stringify!($struct_name) => {
+                        let obj: Wrapper<$struct_name> = bcs::from_bytes(bytes)?;
+                        Ok(NexusEventKind::$variant(obj.event))
+                    }
+                )*
+                _ => bail!("Unknown event: {}", name),
+            }
+        }
+    };
+}
+
+// Enumeration with all available events coming from the on-chain part of
+// Nexus. Also includes BCS parsing implementations.
+events! {
+    RequestScheduledOccurrenceEvent => RequestScheduledOccurrence, "RequestScheduledOccurrenceEvent",
+    RequestScheduledWalkEvent => RequestScheduledWalk, "RequestScheduledWalkEvent",
+    OccurrenceScheduledEvent => OccurrenceScheduled, "OccurrenceScheduledEvent",
+    RequestWalkExecutionEvent => RequestWalkExecution, "RequestWalkExecutionEvent",
+    AnnounceInterfacePackageEvent => AnnounceInterfacePackage, "AnnounceInterfacePackageEvent",
+    OffChainToolRegisteredEvent => OffChainToolRegistered, "OffChainToolRegisteredEvent",
+    OnChainToolRegisteredEvent => OnChainToolRegistered, "OnChainToolRegisteredEvent",
+    ToolUnregisteredEvent => ToolUnregistered, "ToolUnregisteredEvent",
+    WalkAdvancedEvent => WalkAdvanced, "WalkAdvancedEvent",
+    WalkFailedEvent => WalkFailed, "WalkFailedEvent",
+    EndStateReachedEvent => EndStateReached, "EndStateReachedEvent",
+    ExecutionFinishedEvent => ExecutionFinished, "ExecutionFinishedEvent",
+    MissedOccurrenceEvent => MissedOccurrence, "MissedOccurrenceEvent",
+    TaskCreatedEvent => TaskCreated, "TaskCreatedEvent",
+    TaskPausedEvent => TaskPaused, "TaskPausedEvent",
+    TaskResumedEvent => TaskResumed, "TaskResumedEvent",
+    TaskCanceledEvent => TaskCanceled, "TaskCanceledEvent",
+    OccurrenceConsumedEvent => OccurrenceConsumed, "OccurrenceConsumedEvent",
+    PeriodicScheduleConfiguredEvent => PeriodicScheduleConfigured, "PeriodicScheduleConfiguredEvent",
+    FoundingLeaderCapCreatedEvent => FoundingLeaderCapCreated, "FoundingLeaderCapCreatedEvent",
+    GasSettlementUpdateEvent => GasSettlementUpdate, "GasSettlementUpdateEvent",
+    PreKeyVaultCreatedEvent => PreKeyVaultCreated, "PreKeyVaultCreatedEvent",
+    PreKeyRequestedEvent => PreKeyRequested, "PreKeyRequestedEvent",
+    PreKeyFulfilledEvent => PreKeyFulfilled, "PreKeyFulfilledEvent",
+    PreKeyAssociatedEvent => PreKeyAssociated, "PreKeyAssociatedEvent",
+    DAGCreatedEvent => DAGCreated, "DAGCreatedEvent",
+    ToolRegistryCreatedEvent => ToolRegistryCreated, "ToolRegistryCreatedEvent",
+
+    // These events are unused for now.
+    // "ToolRegistryCreated" => ToolRegistryCreated(serde_json::Value),
+    // "DAGVertexAdded" => DAGVertexAdded(serde_json::Value),
+    // "DAGEdgeAdded" => DAGEdgeAdded(serde_json::Value),
+    // "DAGOutputAdded" => DAGOutputAdded(serde_json::Value),
+    // "DAGEntryVertexInputPortAdded" => DAGEntryVertexInputPortAdded(serde_json::Value),
+    // "DAGDefaultValueAdded" => DAGDefaultValueAdded(serde_json::Value),
+    // "LeaderClaimedGas" => LeaderClaimedGas(serde_json::Value),
+    // "AllowedOwnerAdded" => AllowedOwnerAdded(serde_json::Value),
+    // "AllowedOwnerRemoved" => AllowedOwnerRemoved(serde_json::Value),
+}
+
+// == Event definitions ==
+
+/// Fired by the on-chain part of Nexus when a DAG vertex execution is
+/// requested.
+#[derive(Clone, Debug, Deserialize, Serialize)]
+pub struct RequestWalkExecutionEvent {
+    pub dag: sui::types::Address,
+    pub execution: sui::types::Address,
+    #[serde(
+        deserialize_with = "deserialize_sui_u64",
+        serialize_with = "serialize_sui_u64"
+    )]
+    pub walk_index: u64,
+    pub next_vertex: RuntimeVertex,
+    pub evaluations: sui::types::Address,
+    /// This field defines the package ID, module and name of the Agent that
+    /// holds the DAG. Used to confirm the tool evaluation with the Agent.
+    pub worksheet_from_type: TypeName,
+}
+
+/// Fired via the Nexus `interface` package when a new Agent is registered.
+/// Provides the agent's interface so that we can invoke
+/// `confirm_tool_eval_for_walk` on it.
+#[derive(Clone, Debug, Deserialize, Serialize)]
+pub struct AnnounceInterfacePackageEvent {
+    pub shared_objects: Vec<sui::types::Address>,
+}
+
+/// Fired by the Nexus Workflow when a new off-chain tool is registered so that
+/// the Leader can also register it in Redis. This way the Leader knows how and
+/// where to evaluate the tool.
+#[derive(Clone, Debug, Deserialize, Serialize)]
+pub struct OffChainToolRegisteredEvent {
+    pub registry: sui::types::Address,
+    pub tool: sui::types::Address,
+    /// The tool domain, name and version. See [ToolFqn] for more information.
+    pub fqn: ToolFqn,
+    #[serde(
+        deserialize_with = "deserialize_bytes_to_url",
+        serialize_with = "serialize_url_to_bytes"
+    )]
+    pub url: reqwest::Url,
+    #[serde(
+        deserialize_with = "deserialize_bytes_to_json_value",
+        serialize_with = "serialize_json_value_to_bytes"
+    )]
+    pub input_schema: serde_json::Value,
+    #[serde(
+        deserialize_with = "deserialize_bytes_to_json_value",
+        serialize_with = "serialize_json_value_to_bytes"
+    )]
+    pub output_schema: serde_json::Value,
+}
+
+/// Fired by the Nexus Workflow when a new on-chain tool is registered so that
+/// the Leader can also register it in Redis. This way the Leader knows how and
+/// where to evaluate the tool.
+#[derive(Clone, Debug, Deserialize, Serialize)]
+pub struct OnChainToolRegisteredEvent {
+    /// [ID] of [ToolRegistry].
+    pub registry: sui::types::Address,
+    /// New [ID] of the [OnChainTool].
+    pub tool: sui::types::Address,
+    /// When the tool was registered.
+    #[serde(
+        deserialize_with = "deserialize_sui_u64",
+        serialize_with = "serialize_sui_u64"
+    )]
+    pub registered_at_ms: u64,
+    /// The tool domain, name and version. See [ToolFqn] for more information.
+    pub fqn: ToolFqn,
+    /// The address of the published package.
+    pub package_address: sui::types::Address,
+    /// Module name.
+    pub module_name: String,
+    /// The witness object ID that proves the tool's identity.
+    pub witness_id: sui::types::Address,
+    /// Arguments to the execute function.
+    #[serde(
+        deserialize_with = "deserialize_bytes_to_json_value",
+        serialize_with = "serialize_json_value_to_bytes"
+    )]
+    pub input_schema: serde_json::Value,
+    /// Output schema of the execute function.
+    #[serde(
+        deserialize_with = "deserialize_bytes_to_json_value",
+        serialize_with = "serialize_json_value_to_bytes"
+    )]
+    pub output_schema: serde_json::Value,
+    /// Description of the tool.
+    #[serde(
+        deserialize_with = "deserialize_bytes_to_string",
+        serialize_with = "serialize_string_to_bytes"
+    )]
+    pub description: String,
+}
+
+/// Fired by the Nexus Workflow when a tool is unregistered. The Leader should
+/// remove the tool definition from its Redis registry.
+#[derive(Clone, Debug, Deserialize, Serialize)]
+pub struct ToolUnregisteredEvent {
+    pub tool: sui::types::Address,
+    /// The tool domain, name and version. See [ToolFqn] for more information.
+    pub fqn: ToolFqn,
+}
+
+/// Fired by the Nexus Workflow when a walk has advanced. This event is used to
+/// inspect DAG execution process.
+#[derive(Clone, Debug, Deserialize, Serialize)]
+pub struct WalkAdvancedEvent {
+    pub dag: sui::types::Address,
+    pub execution: sui::types::Address,
+    #[serde(
+        deserialize_with = "deserialize_sui_u64",
+        serialize_with = "serialize_sui_u64"
+    )]
+    pub walk_index: u64,
+    /// Which vertex was just executed.
+    pub vertex: RuntimeVertex,
+    /// Which output variant was evaluated.
+    pub variant: TypeName,
+    /// What data is associated with the variant.
+    pub variant_ports_to_data: PortsData,
+}
+
+/// Fired by the Nexus Workflow when a walk has failed.
+#[derive(Clone, Debug, Deserialize, Serialize)]
+pub struct WalkFailedEvent {
+    pub dag: sui::types::Address,
+    pub execution: sui::types::Address,
+    #[serde(
+        deserialize_with = "deserialize_sui_u64",
+        serialize_with = "serialize_sui_u64"
+    )]
+    pub walk_index: u64,
+    /// Which vertex was being executed when the failure happened.
+    pub vertex: RuntimeVertex,
+    /// The error message associated with the failure.
+    pub reason: String,
+}
+
+/// Fired by the Nexus Workflow when a walk has halted in an end state. This
+/// event is used to inspect DAG execution process.
+#[derive(Clone, Debug, Deserialize, Serialize)]
+pub struct EndStateReachedEvent {
+    pub dag: sui::types::Address,
+    pub execution: sui::types::Address,
+    #[serde(
+        deserialize_with = "deserialize_sui_u64",
+        serialize_with = "serialize_sui_u64"
+    )]
+    pub walk_index: u64,
+    /// Which vertex was just executed.
+    pub vertex: RuntimeVertex,
+    /// Which output variant was evaluated.
+    pub variant: TypeName,
+    /// What data is associated with the variant.
+    pub variant_ports_to_data: PortsData,
+}
+
+/// Fired by the Nexus Workflow when all walks have halted in their end states
+/// and there is no more work to be done. This event is used to inspect DAG
+/// execution process.
+#[derive(Clone, Debug, Deserialize, Serialize)]
+pub struct ExecutionFinishedEvent {
+    pub dag: sui::types::Address,
+    pub execution: sui::types::Address,
+    pub has_any_walk_failed: bool,
+    pub has_any_walk_succeeded: bool,
+}
+
+/// Request wrapper emitted when scheduling an occurrence.
+#[derive(Clone, Debug, Deserialize, Serialize)]
+pub struct RequestScheduledOccurrenceEvent {
+    pub request: OccurrenceScheduledEvent,
+    #[serde(
+        deserialize_with = "deserialize_sui_u64",
+        serialize_with = "serialize_sui_u64"
+    )]
+    pub priority: u64,
+    #[serde(
+        deserialize_with = "deserialize_sui_u64",
+        serialize_with = "serialize_sui_u64"
+    )]
+    pub request_ms: u64,
+    #[serde(
+        deserialize_with = "deserialize_sui_u64",
+        serialize_with = "serialize_sui_u64"
+    )]
+    pub start_ms: u64,
+    #[serde(
+        deserialize_with = "deserialize_sui_u64",
+        serialize_with = "serialize_sui_u64"
+    )]
+    pub deadline_ms: u64,
+}
+
+/// Request wrapper emitted when scheduling a walk execution.
+#[derive(Clone, Debug, Deserialize, Serialize)]
+pub struct RequestScheduledWalkEvent {
+    pub request: RequestWalkExecutionEvent,
+    #[serde(
+        deserialize_with = "deserialize_sui_u64",
+        serialize_with = "serialize_sui_u64"
+    )]
+    pub priority: u64,
+    #[serde(
+        deserialize_with = "deserialize_sui_u64",
+        serialize_with = "serialize_sui_u64"
+    )]
+    pub request_ms: u64,
+    #[serde(
+        deserialize_with = "deserialize_sui_u64",
+        serialize_with = "serialize_sui_u64"
+    )]
+    pub start_ms: u64,
+    #[serde(
+        deserialize_with = "deserialize_sui_u64",
+        serialize_with = "serialize_sui_u64"
+    )]
+    pub deadline_ms: u64,
+}
+
+/// Fired when a scheduler occurrence is enqueued; used as the payload of
+/// `RequestScheduledOccurrenceEvent`.
+#[derive(Clone, Debug, Deserialize, Serialize)]
+pub struct OccurrenceScheduledEvent {
+    pub task: sui::types::Address,
+    pub generator: PolicySymbol,
+}
+
+/// Emitted when a scheduled occurrence misses its deadline and is pruned.
+#[derive(Clone, Debug, Deserialize, Serialize)]
+pub struct MissedOccurrenceEvent {
+    pub task: sui::types::Address,
+    #[serde(
+        deserialize_with = "deserialize_sui_u64",
+        serialize_with = "serialize_sui_u64"
+    )]
+    pub start_time_ms: u64,
+    #[serde(
+        deserialize_with = "deserialize_sui_option_u64",
+        serialize_with = "serialize_sui_option_u64"
+    )]
+    pub deadline_ms: Option<u64>,
+    #[serde(
+        deserialize_with = "deserialize_sui_u64",
+        serialize_with = "serialize_sui_u64"
+    )]
+    pub pruned_at: u64,
+    #[serde(
+        deserialize_with = "deserialize_sui_u64",
+        serialize_with = "serialize_sui_u64"
+    )]
+    pub priority_fee_per_gas_unit: u64,
+    pub generator: PolicySymbol,
+}
+
+/// Emitted after a scheduler task object is created.
+#[derive(Clone, Debug, Deserialize, Serialize)]
+pub struct TaskCreatedEvent {
+    pub task: sui::types::Address,
+    pub owner: sui::types::Address,
+}
+
+/// Emitted when scheduling for a task is paused.
+#[derive(Clone, Debug, Deserialize, Serialize)]
+pub struct TaskPausedEvent {
+    pub task: sui::types::Address,
+}
+
+/// Emitted when scheduling for a task is resumed.
+#[derive(Clone, Debug, Deserialize, Serialize)]
+pub struct TaskResumedEvent {
+    pub task: sui::types::Address,
+}
+
+/// Emitted when scheduling for a task is canceled.
+#[derive(Clone, Debug, Deserialize, Serialize)]
+pub struct TaskCanceledEvent {
+    pub task: sui::types::Address,
+    #[serde(
+        deserialize_with = "deserialize_sui_u64",
+        serialize_with = "serialize_sui_u64"
+    )]
+    pub cleared_occurrences: u64,
+    pub had_periodic: bool,
+}
+
+/// Emitted whenever a pending occurrence is consumed for execution.
+#[derive(Clone, Debug, Deserialize, Serialize)]
+pub struct OccurrenceConsumedEvent {
+    pub task: sui::types::Address,
+    #[serde(
+        deserialize_with = "deserialize_sui_u64",
+        serialize_with = "serialize_sui_u64"
+    )]
+    pub start_time_ms: u64,
+    #[serde(
+        deserialize_with = "deserialize_sui_option_u64",
+        serialize_with = "serialize_sui_option_u64"
+    )]
+    pub deadline_ms: Option<u64>,
+    #[serde(
+        deserialize_with = "deserialize_sui_u64",
+        serialize_with = "serialize_sui_u64"
+    )]
+    pub priority_fee_per_gas_unit: u64,
+    pub generator: PolicySymbol,
+    #[serde(
+        deserialize_with = "deserialize_sui_u64",
+        serialize_with = "serialize_sui_u64"
+    )]
+    pub executed_at: u64,
+}
+
+/// Emitted whenever the periodic schedule is configured or cleared.
+#[derive(Clone, Debug, Deserialize, Serialize)]
+pub struct PeriodicScheduleConfiguredEvent {
+    pub task: sui::types::Address,
+    #[serde(
+        deserialize_with = "deserialize_sui_option_u64",
+        serialize_with = "serialize_sui_option_u64"
+    )]
+    pub period_ms: Option<u64>,
+    #[serde(
+        deserialize_with = "deserialize_sui_option_u64",
+        serialize_with = "serialize_sui_option_u64"
+    )]
+    pub deadline_offset_ms: Option<u64>,
+    #[serde(
+        deserialize_with = "deserialize_sui_option_u64",
+        serialize_with = "serialize_sui_option_u64"
+    )]
+    pub max_iterations: Option<u64>,
+    #[serde(
+        deserialize_with = "deserialize_sui_option_u64",
+        serialize_with = "serialize_sui_option_u64"
+    )]
+    pub generated: Option<u64>,
+    #[serde(
+        deserialize_with = "deserialize_sui_option_u64",
+        serialize_with = "serialize_sui_option_u64"
+    )]
+    pub priority_fee_per_gas_unit: Option<u64>,
+    #[serde(
+        deserialize_with = "deserialize_sui_option_u64",
+        serialize_with = "serialize_sui_option_u64"
+    )]
+    pub last_generated_start_ms: Option<u64>,
+}
+
+/// Fired by the Nexus Workflow when a new founding LeaderCap is created.
+#[derive(Clone, Debug, Deserialize, Serialize)]
+pub struct FoundingLeaderCapCreatedEvent {
+    pub leader_cap: sui::types::Address,
+    pub network: sui::types::Address,
+}
+
+/// Fired by the Gas service when the gas settlement is updated. This event is
+/// used to determine whether a tool invocation was paid for by the caller.
+/// Combination of `execution` and `vertex` uniquely identifies the tool
+/// invocation.
+#[derive(Clone, Debug, Deserialize, Serialize)]
+pub struct GasSettlementUpdateEvent {
+    pub execution: sui::types::Address,
+    pub tool_fqn: ToolFqn,
+    pub vertex: RuntimeVertex,
+    pub was_settled: bool,
+}
+
+/// Fired when the leader claims gas from a user's budget.
+#[derive(Clone, Debug, Deserialize, Serialize)]
+pub struct LeaderClaimedGasEvent {
+    pub network: sui::types::Address,
+    pub amount: u64,
+    /// Optional reason for auditing purposes.
+    #[serde(default)]
+    pub purpose: String,
+}
+
+/// Fired by the Nexus Workflow when a new pre key vault is created. This happens
+/// on initial network setup.
+#[derive(Clone, Debug, Deserialize, Serialize)]
+pub struct PreKeyVaultCreatedEvent {
+    pub vault: sui::types::Address,
+    pub crypto_cap: sui::types::Address,
+}
+
+/// Fired by the Nexus Workflow when a pre key is requested. The pre key bytes
+/// are still empty at this point and will be fulfilled by the leader.
+#[derive(Clone, Debug, Deserialize, Serialize)]
+pub struct PreKeyRequestedEvent {
+    /// The address of the user that requested the pre key.
+    pub requested_by: sui::types::Address,
+}
+
+/// Fired by the Nexus Workflow when a pre key request is fulfilled by the
+/// leader. Carries the pending pre key bytes that the user can then associate.
+#[derive(Clone, Debug, Deserialize, Serialize)]
+pub struct PreKeyFulfilledEvent {
+    /// The address of the user that requested the pre key.
+    pub requested_by: sui::types::Address,
+    /// Bytes of the fulfilled pre key.
+    #[serde(
+        deserialize_with = "deserialize_encoded_bytes",
+        serialize_with = "serialize_encoded_bytes"
+    )]
+    pub pre_key_bytes: Vec<u8>,
+}
+
+/// Fired by the Nexus Workflow when a pre key is associated with a user.
+#[derive(Clone, Debug, Deserialize, Serialize)]
+pub struct PreKeyAssociatedEvent {
+    /// The address of the user the pre key is associated with.
+    pub claimed_by: sui::types::Address,
+    /// Bytes of the pre key.
+    #[serde(
+        deserialize_with = "deserialize_encoded_bytes",
+        serialize_with = "serialize_encoded_bytes"
+    )]
+    pub pre_key: Vec<u8>,
+    /// Bytes of the initial message.
+    #[serde(
+        deserialize_with = "deserialize_encoded_bytes",
+        serialize_with = "serialize_encoded_bytes"
+    )]
+    pub initial_message: Vec<u8>,
+}
+
+/// Fired by the Nexus Workflow when a new DAG is created.
+#[derive(Clone, Debug, Deserialize, Serialize)]
+pub struct DAGCreatedEvent {
+    /// Address of the created DAG.
+    pub dag: sui::types::Address,
+}
+
+/// Fired by the Nexus Workflow when a new ToolRegistry is created.
+#[derive(Clone, Debug, Deserialize, Serialize)]
+pub struct ToolRegistryCreatedEvent {
+    /// Address of the created ToolRegistry.
+    pub registry: sui::types::Address,
+    /// Address of the relevant slashing cap.
+    pub slashing_cap: sui::types::Address,
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    events!(
+        DummyEvent => Dummy, "DummyEvent",
+        AnotherEvent => Another, "AnotherEvent",
+    );
+
+    #[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
+    pub struct DummyEvent {
+        pub value: u32,
+    }
+
+    #[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
+    pub struct AnotherEvent {
+        pub text: String,
+    }
+
+    #[test]
+    fn test_nexus_event_kind_name_helper() {
+        let dummy = DummyEvent { value: 42 };
+        let another = AnotherEvent {
+            text: "hello".to_string(),
+        };
+
+        let kind_dummy = NexusEventKind::Dummy(dummy.clone());
+        let kind_another = NexusEventKind::Another(another.clone());
+
+        assert_eq!(kind_dummy.name(), "DummyEvent");
+        assert_eq!(kind_another.name(), "AnotherEvent");
+    }
+
+    #[test]
+    fn test_nexus_event_kind_enum_generation() {
+        let dummy = DummyEvent { value: 1 };
+        let another = AnotherEvent {
+            text: "abc".to_string(),
+        };
+
+        let kind_dummy = NexusEventKind::Dummy(dummy.clone());
+        let kind_another = NexusEventKind::Another(another.clone());
+
+        match kind_dummy {
+            NexusEventKind::Dummy(ev) => assert_eq!(ev, dummy),
+            _ => panic!("Expected Dummy variant"),
+        }
+
+        match kind_another {
+            NexusEventKind::Another(ev) => assert_eq!(ev, another),
+            _ => panic!("Expected Another variant"),
+        }
+    }
+
+    #[test]
+    fn test_nexus_event_kind_bcs_deser() {
+        let dummy = DummyEvent { value: 99 };
+        let another = AnotherEvent {
+            text: "xyz".to_string(),
+        };
+
+        let dummy_bytes = bcs::to_bytes(&dummy).unwrap();
+        let another_bytes = bcs::to_bytes(&another).unwrap();
+
+        let parsed_dummy = parse_bcs("DummyEvent", &dummy_bytes).unwrap();
+        let parsed_another = parse_bcs("AnotherEvent", &another_bytes).unwrap();
+
+        match parsed_dummy {
+            NexusEventKind::Dummy(ev) => assert_eq!(ev, dummy),
+            _ => panic!("Expected Dummy variant"),
+        }
+
+        match parsed_another {
+            NexusEventKind::Another(ev) => assert_eq!(ev, another),
+            _ => panic!("Expected Another variant"),
+        }
+    }
+
+    #[test]
+    fn test_parse_bcs_unknown_event() {
+        let dummy = DummyEvent { value: 123 };
+        let bytes = bcs::to_bytes(&dummy).unwrap();
+        let result = parse_bcs("UnknownEvent", &bytes);
+        assert!(result.is_err());
+    }
+}
diff --git a/sdk/src/events/parsing.rs b/sdk/src/events/parsing.rs
new file mode 100644
index 00000000..03d15d98
--- /dev/null
+++ b/sdk/src/events/parsing.rs
@@ -0,0 +1,956 @@
+//! This module defines transformers from various Sui types to Nexus event types.
+//! Namely we support:
+//! - Parsing GRPC [`sui_sdk_types::Event`]
+//! - Parsing GQL response type
+
+use {
+    crate::{
+        events::{
+            events_query::events_query::EventsQueryEventsNodesContents,
+            parse_bcs,
+            NexusEvent,
+        },
+        idents::primitives,
+        sui,
+        types::NexusObjects,
+    },
+    anyhow::bail,
+    serde_json::json,
+};
+
+/// [`sui_sdk_types::Event`] -> [`NexusEvent`]
+pub trait FromSuiGrpcEvent {
+    /// Parse a Sui GRPC event into a Nexus event.
+    fn from_sui_grpc_event(
+        index: u64,
+        digest: sui::types::Digest,
+        event: &sui::types::Event,
+        objects: &NexusObjects,
+    ) -> anyhow::Result<NexusEvent>;
+}
+
+/// [`EventsQueryEventsNodes`] -> [`NexusEvent`]
+pub trait FromSuiGqlEvent {
+    /// Parse a Sui GQL event into a Nexus event.
+    fn from_sui_gql_event(
+        index: u64,
+        digest: sui::types::Digest,
+        package_id: sui::types::Address,
+        event: &EventsQueryEventsNodesContents,
+        objects: &NexusObjects,
+    ) -> anyhow::Result<NexusEvent>;
+}
+
+impl FromSuiGrpcEvent for NexusEvent {
+    fn from_sui_grpc_event(
+        index: u64,
+        digest: sui::types::Digest,
+        event: &sui::types::Event,
+        objects: &NexusObjects,
+    ) -> anyhow::Result<NexusEvent> {
+        // Only accept events that come from the Nexus packages.
+        if !is_nexus_package(event.package_id, objects) {
+            bail!(
+                "Event does not come from a Nexus package, it comes from '{}' instead",
+                event.package_id
+            );
+        }
+
+        // Only accept events that are wrapped in `nexus_primitives::event::EventWrapper`.
+        if !is_event_wrapper(&event.type_, objects) {
+            bail!(
+                "Event is not wrapped in '{}::event::EventWrapper', found type: '{:?}'",
+                objects.primitives_pkg_id,
+                event.type_
+            );
+        }
+
+        // Extract the name of the event we want to parse into.
+        let Some(event_type) = event.type_.type_params().first().and_then(|tag| match tag {
+            sui::types::TypeTag::Struct(struct_tag) => Some(struct_tag),
+            _ => None,
+        }) else {
+            bail!("EventWrapper does not have a valid event type parameter");
+        };
+
+        let event_name = normalize_event_name(event_type)?;
+
+        Ok(NexusEvent {
+            id: (digest, index),
+            generics: event_type.type_params().to_vec(),
+            data: parse_bcs(&event_name, &event.contents)?,
+        })
+    }
+}
+
+impl FromSuiGqlEvent for NexusEvent {
+    fn from_sui_gql_event(
+        index: u64,
+        digest: sui::types::Digest,
+        package_id: sui::types::Address,
+        event: &EventsQueryEventsNodesContents,
+        objects: &NexusObjects,
+    ) -> anyhow::Result<NexusEvent> {
+        // Only accept events that come from the Nexus packages.
+        if !is_nexus_package(package_id, objects) {
+            bail!("Event does not come from a Nexus package, it comes from '{package_id}' instead");
+        }
+
+        let struct_tag: sui::types::StructTag = event
+            .type_
+            .as_ref()
+            .and_then(|t| t.repr.parse().ok())
+            .ok_or_else(|| {
+                anyhow::anyhow!(
+                    "Failed to parse event type '{:?}' into StructTag",
+                    event.type_
+                )
+            })?;
+
+        // Only accept events that are wrapped in `nexus_primitives::event::EventWrapper`.
+        if !is_event_wrapper(&struct_tag, objects) {
+            bail!(
+                "Event is not wrapped in '{}::event::EventWrapper', found type: '{:?}'",
+                objects.primitives_pkg_id,
+                event.type_
+            );
+        }
+
+        // Extract the name of the event we want to parse into.
+        let Some(event_type) = struct_tag.type_params().first().and_then(|tag| match tag {
+            sui::types::TypeTag::Struct(struct_tag) => Some(struct_tag),
+            _ => None,
+        }) else {
+            bail!("EventWrapper does not have a valid event type parameter");
+        };
+
+        let event_name = normalize_event_name(event_type)?;
+
+        let Some(json) = event
+            .json
+            .as_ref()
+            .and_then(|j| j.as_object())
+            .and_then(|obj| obj.get("event"))
+        else {
+            bail!("Event contents missing JSON data");
+        };
+
+        let data = json!({
+            "_nexus_event_type": event_name,
+            "event": json
+        });
+
+        Ok(NexusEvent {
+            id: (digest, index),
+            generics: event_type.type_params().to_vec(),
+            data: serde_json::from_value(data)?,
+        })
+    }
+}
+
+fn normalize_event_name(event_type: &sui::types::StructTag) -> anyhow::Result<String> {
+    let name = event_type.name().as_str();
+
+    if name != "RequestScheduledExecution" {
+        return Ok(name.to_string());
+    }
+
+    let Some(type_tag) = event_type.type_params().first() else {
+        bail!("RequestScheduledExecution is missing a type parameter");
+    };
+
+    let sui::types::TypeTag::Struct(struct_tag) = type_tag else {
+        bail!("RequestScheduledExecution expects a struct type parameter");
+    };
+
+    let normalized = match struct_tag.name().as_str() {
+        "OccurrenceScheduledEvent" => "RequestScheduledOccurrenceEvent",
+        "RequestWalkExecutionEvent" => "RequestScheduledWalkEvent",
+        other => bail!("Unsupported RequestScheduledExecution payload: {other}"),
+    };
+
+    Ok(normalized.to_string())
+}
+
+/// Helper function to determine whether the given address is one of the Nexus
+/// package addresses.
+fn is_nexus_package(address: sui::types::Address, objects: &NexusObjects) -> bool {
+    address == objects.primitives_pkg_id
+        || address == objects.interface_pkg_id
+        || address == objects.workflow_pkg_id
+}
+
+/// Helper function to determine whether the provided struct tag corresponds to
+/// `nexus_primitives::event::EventWrapper`.
+fn is_event_wrapper(tag: &sui::types::StructTag, objects: &NexusObjects) -> bool {
+    *tag.address() == objects.primitives_pkg_id
+        && *tag.module() == primitives::Event::EVENT_WRAPPER.module
+        && *tag.name() == primitives::Event::EVENT_WRAPPER.name
+}
+
+#[cfg(all(test, feature = "test_utils"))]
+mod tests {
+    use {
+        super::*,
+        crate::{
+            events::{
+                events_query::events_query::EventsQueryEventsNodesContentsType,
+                AnnounceInterfacePackageEvent,
+                DAGCreatedEvent,
+                EndStateReachedEvent,
+                ExecutionFinishedEvent,
+                FoundingLeaderCapCreatedEvent,
+                GasSettlementUpdateEvent,
+                MissedOccurrenceEvent,
+                NexusEventKind,
+                OccurrenceConsumedEvent,
+                OccurrenceScheduledEvent,
+                OffChainToolRegisteredEvent,
+                OnChainToolRegisteredEvent,
+                PeriodicScheduleConfiguredEvent,
+                PreKeyAssociatedEvent,
+                PreKeyFulfilledEvent,
+                PreKeyRequestedEvent,
+                PreKeyVaultCreatedEvent,
+                RequestScheduledOccurrenceEvent,
+                RequestScheduledWalkEvent,
+                RequestWalkExecutionEvent,
+                RuntimeVertex,
+                TaskCanceledEvent,
+                TaskCreatedEvent,
+                TaskPausedEvent,
+                TaskResumedEvent,
+                ToolUnregisteredEvent,
+                TypeName,
+                WalkAdvancedEvent,
+                WalkFailedEvent,
+            },
+            fqn,
+            idents::primitives,
+            test_utils::sui_mocks,
+            types::{NexusData, PolicySymbol, PortsData},
+            ToolFqn,
+        },
+        serde::{Deserialize, Serialize},
+        std::sync::Arc,
+    };
+
+    #[derive(Clone, Debug, Serialize, Deserialize)]
+    struct Wrapper<T> {
+        event: T,
+    }
+
+    #[test]
+    fn test_parse_from_grpc_valid_nexus_event() {
+        let mut rng = rand::thread_rng();
+        let index = 0u64;
+        let digest = sui::types::Digest::generate(&mut rng);
+        let objects = sui_mocks::mock_nexus_objects();
+        let event_type = sui::types::StructTag::new(
+            objects.workflow_pkg_id,
+            sui::types::Identifier::new("dag").unwrap(),
+            sui::types::Identifier::new("DAGCreatedEvent").unwrap(),
+            vec![],
+        );
+
+        let wrapper_type = sui::types::TypeTag::Struct(Box::new(event_type.clone()));
+        // Manually craft a valid event kind and serialize as BCS
+        let dag_addr = sui::types::Address::generate(&mut rng);
+        let data = Wrapper {
+            event: DAGCreatedEvent { dag: dag_addr },
+        };
+        let bcs = bcs::to_bytes(&data).expect("BCS serialization should succeed");
+
+        let event = sui_mocks::mock_sui_event(
+            objects.primitives_pkg_id,
+            sui::types::StructTag::new(
+                objects.primitives_pkg_id,
+                primitives::Event::EVENT_WRAPPER.module,
+                primitives::Event::EVENT_WRAPPER.name,
+                vec![wrapper_type.clone()],
+            ),
+            bcs,
+        );
+
+        let result = NexusEvent::from_sui_grpc_event(index, digest, &event, &objects);
+        assert!(result.is_ok(), "Should parse valid Nexus event");
+        let nexus_event = result.unwrap();
+        assert_eq!(nexus_event.generics, vec![]);
+        assert_eq!(nexus_event.id, (digest, index));
+        assert!(matches!(
+            nexus_event.data,
+            crate::events::NexusEventKind::DAGCreated(DAGCreatedEvent { dag }) if dag == dag_addr
+        ));
+    }
+
+    #[test]
+    fn test_parse_from_grpc_non_nexus_package_event() {
+        let mut rng = rand::thread_rng();
+        let index = 0u64;
+        let digest = sui::types::Digest::generate(&mut rng);
+        let objects = sui_mocks::mock_nexus_objects();
+        let event_type = sui::types::StructTag::new(
+            sui::types::Address::generate(&mut rng),
+            sui::types::Identifier::new("module").unwrap(),
+            sui::types::Identifier::new("EventName").unwrap(),
+            vec![],
+        );
+        let wrapper_type = sui::types::TypeTag::Struct(Box::new(event_type.clone()));
+
+        let event = sui_mocks::mock_sui_event(
+            sui::types::Address::generate(&mut rng),
+            sui::types::StructTag::new(
+                sui::types::Address::generate(&mut rng),
+                primitives::Event::EVENT_WRAPPER.module,
+                primitives::Event::EVENT_WRAPPER.name,
+                vec![wrapper_type],
+            ),
+            vec![1, 2, 3],
+        );
+
+        let result = NexusEvent::from_sui_grpc_event(index, digest, &event, &objects);
+        assert!(result.is_err(), "Should fail for non-Nexus package event");
+    }
+
+    #[test]
+    fn test_parse_from_grpc_non_event_wrapper_type() {
+        let mut rng = rand::thread_rng();
+        let index = 0u64;
+        let digest = sui::types::Digest::generate(&mut rng);
+        let objects = sui_mocks::mock_nexus_objects();
+        let wrong_tag = sui::types::StructTag::new(
+            objects.primitives_pkg_id,
+            sui::types::Identifier::new("wrong_module").unwrap(),
+            sui::types::Identifier::new("wrong_name").unwrap(),
+            vec![],
+        );
+        let event = sui_mocks::mock_sui_event(objects.primitives_pkg_id, wrong_tag, vec![1, 2, 3]);
+        let result = NexusEvent::from_sui_grpc_event(index, digest, &event, &objects);
+        assert!(result.is_err(), "Should fail for non-EventWrapper type");
+    }
+
+    #[test]
+    fn test_parse_from_grpc_event_wrapper_missing_type_param() {
+        let mut rng = rand::thread_rng();
+        let index = 0u64;
+        let digest = sui::types::Digest::generate(&mut rng);
+        let objects = sui_mocks::mock_nexus_objects();
+        let wrapper_tag = sui::types::StructTag::new(
+            objects.primitives_pkg_id,
+            sui::types::Identifier::new(primitives::Event::EVENT_WRAPPER.module.as_str()).unwrap(),
+            sui::types::Identifier::new(primitives::Event::EVENT_WRAPPER.name.as_str()).unwrap(),
+            vec![],
+        );
+        let event =
+            sui_mocks::mock_sui_event(objects.primitives_pkg_id, wrapper_tag, vec![1, 2, 3]);
+        let result = NexusEvent::from_sui_grpc_event(index, digest, &event, &objects);
+        assert!(result.is_err(), "Should fail for missing type param");
+    }
+
+    #[test]
+    fn test_parse_from_grpc_valid_nexus_event_with_generics() {
+        let mut rng = rand::thread_rng();
+        let index = 0u64;
+        let digest = sui::types::Digest::generate(&mut rng);
+        let objects = sui_mocks::mock_nexus_objects();
+        let event_type = sui::types::StructTag::new(
+            objects.workflow_pkg_id,
+            sui::types::Identifier::new("dag").unwrap(),
+            sui::types::Identifier::new("DAGCreatedEvent").unwrap(),
+            vec![sui::types::TypeTag::U64],
+        );
+
+        let wrapper_type = sui::types::TypeTag::Struct(Box::new(event_type.clone()));
+        // Manually craft a valid event kind and serialize as BCS
+        let dag_addr = sui::types::Address::generate(&mut rng);
+        let data = Wrapper {
+            event: DAGCreatedEvent { dag: dag_addr },
+        };
+        let bcs = bcs::to_bytes(&data).expect("BCS serialization should succeed");
+
+        let event = sui_mocks::mock_sui_event(
+            objects.primitives_pkg_id,
+            sui::types::StructTag::new(
+                objects.primitives_pkg_id,
+                primitives::Event::EVENT_WRAPPER.module,
+                primitives::Event::EVENT_WRAPPER.name,
+                vec![wrapper_type.clone()],
+            ),
+            bcs,
+        );
+
+        let result = NexusEvent::from_sui_grpc_event(index, digest, &event, &objects);
+        assert!(result.is_ok(), "Should parse valid Nexus event");
+        let nexus_event = result.unwrap();
+        assert_eq!(nexus_event.id, (digest, index));
+        assert_eq!(nexus_event.generics, vec![sui::types::TypeTag::U64]);
+        assert!(matches!(
+            nexus_event.data,
+            crate::events::NexusEventKind::DAGCreated(DAGCreatedEvent { dag }) if dag == dag_addr
+        ));
+    }
+
+    #[test]
+    fn test_parse_from_gql_request_scheduled_occurrence_event() {
+        let mut rng = rand::thread_rng();
+        let index = 0u64;
+        let digest = sui::types::Digest::generate(&mut rng);
+        let objects = sui_mocks::mock_nexus_objects();
+
+        let inner_type = sui::types::StructTag::new(
+            objects.workflow_pkg_id,
+            sui::types::Identifier::new("scheduler").unwrap(),
+            sui::types::Identifier::new("OccurrenceScheduledEvent").unwrap(),
+            vec![],
+        );
+
+        let scheduled_type = sui::types::StructTag::new(
+            objects.workflow_pkg_id,
+            sui::types::Identifier::new("scheduler").unwrap(),
+            sui::types::Identifier::new("RequestScheduledExecution").unwrap(),
+            vec![sui::types::TypeTag::Struct(Box::new(inner_type))],
+        );
+
+        let wrapper_type = sui::types::StructTag::new(
+            objects.primitives_pkg_id,
+            primitives::Event::EVENT_WRAPPER.module,
+            primitives::Event::EVENT_WRAPPER.name,
+            vec![sui::types::TypeTag::Struct(Box::new(scheduled_type))],
+        );
+
+        let generator_uid = sui::types::Address::generate(&mut rng);
+        let occurrence = OccurrenceScheduledEvent {
+            task: sui::types::Address::generate(&mut rng),
+            generator: crate::types::PolicySymbol::Uid(generator_uid),
+        };
+
+        let scheduled = RequestScheduledOccurrenceEvent {
+            request: occurrence.clone(),
+            priority: 5,
+            request_ms: 10,
+            start_ms: 20,
+            deadline_ms: 30,
+        };
+
+        let gql_event = EventsQueryEventsNodesContents {
+            json: Some(serde_json::json!({
+                "event": {
+                    "request": {
+                        "task": scheduled.request.task,
+                        "generator": {
+                            "variant": "Uid",
+                            "fields": { "pos0": generator_uid }
+                        }
+                    },
+                    "priority": scheduled.priority.to_string(),
+                    "request_ms": scheduled.request_ms.to_string(),
+                    "start_ms": scheduled.start_ms.to_string(),
+                    "deadline_ms": scheduled.deadline_ms.to_string(),
+                }
+            })),
+            type_: Some(EventsQueryEventsNodesContentsType {
+                repr: wrapper_type.to_string(),
+            }),
+        };
+
+        let result = NexusEvent::from_sui_gql_event(
+            index,
+            digest,
+            objects.primitives_pkg_id,
+            &gql_event,
+            &objects,
+        )
+        .expect("Should parse scheduled occurrence event");
+
+        assert!(matches!(
+            result.data,
+            NexusEventKind::RequestScheduledOccurrence(env)
+                if env.request.task == scheduled.request.task
+                    && env.priority == scheduled.priority
+                    && env.start_ms == scheduled.start_ms
+        ));
+    }
+
+    #[test]
+    fn test_parse_from_gql_request_scheduled_walk_event() {
+        let mut rng = rand::thread_rng();
+        let index = 0u64;
+        let digest = sui::types::Digest::generate(&mut rng);
+        let objects = sui_mocks::mock_nexus_objects();
+
+        let inner_type = sui::types::StructTag::new(
+            objects.workflow_pkg_id,
+            sui::types::Identifier::new("scheduler").unwrap(),
+            sui::types::Identifier::new("RequestWalkExecutionEvent").unwrap(),
+            vec![],
+        );
+
+        let scheduled_type = sui::types::StructTag::new(
+            objects.workflow_pkg_id,
+            sui::types::Identifier::new("scheduler").unwrap(),
+            sui::types::Identifier::new("RequestScheduledExecution").unwrap(),
+            vec![sui::types::TypeTag::Struct(Box::new(inner_type))],
+        );
+
+        let wrapper_type = sui::types::StructTag::new(
+            objects.primitives_pkg_id,
+            primitives::Event::EVENT_WRAPPER.module,
+            primitives::Event::EVENT_WRAPPER.name,
+            vec![sui::types::TypeTag::Struct(Box::new(scheduled_type))],
+        );
+
+        let walk = RequestWalkExecutionEvent {
+            dag: sui::types::Address::generate(&mut rng),
+            execution: sui::types::Address::generate(&mut rng),
+            walk_index: 1,
+            next_vertex: RuntimeVertex::plain("v"),
+            evaluations: sui::types::Address::generate(&mut rng),
+            worksheet_from_type: TypeName::new("worksheet"),
+        };
+
+        let scheduled = RequestScheduledWalkEvent {
+            request: walk.clone(),
+            priority: 1,
+            request_ms: 2,
+            start_ms: 3,
+            deadline_ms: 4,
+        };
+
+        let gql_event = EventsQueryEventsNodesContents {
+            json: Some(
+                serde_json::to_value(&Wrapper {
+                    event: scheduled.clone(),
+                })
+                .unwrap(),
+            ),
+            type_: Some(EventsQueryEventsNodesContentsType {
+                repr: wrapper_type.to_string(),
+            }),
+        };
+
+        let result = NexusEvent::from_sui_gql_event(
+            index,
+            digest,
+            objects.primitives_pkg_id,
+            &gql_event,
+            &objects,
+        )
+        .expect("Should parse scheduled walk event");
+
+        assert!(matches!(
+            result.data,
+            NexusEventKind::RequestScheduledWalk(env)
+                if env.request.dag == scheduled.request.dag
+                    && env.start_ms == scheduled.start_ms
+                    && env.deadline_ms == scheduled.deadline_ms
+        ));
+    }
+
+    #[test]
+    fn test_parse_from_gql_valid_nexus_event() {
+        let mut rng = rand::thread_rng();
+        let index = 0u64;
+        let digest = sui::types::Digest::generate(&mut rng);
+        let objects = sui_mocks::mock_nexus_objects();
+        let primitives_pkg_id = objects.primitives_pkg_id;
+        let event_type = sui::types::StructTag::new(
+            objects.primitives_pkg_id,
+            sui::types::Identifier::new("dag").unwrap(),
+            sui::types::Identifier::new("DAGCreatedEvent").unwrap(),
+            vec![],
+        );
+        let wrapper_type = sui::types::TypeTag::Struct(Box::new(event_type.clone()));
+        let dag_addr = sui::types::Address::generate(&mut rng);
+        let data = Wrapper {
+            event: DAGCreatedEvent { dag: dag_addr },
+        };
+        let gql_event = EventsQueryEventsNodesContents {
+            json: Some(serde_json::to_value(&data).unwrap()),
+            type_: Some(EventsQueryEventsNodesContentsType {
+                repr: sui::types::StructTag::new(
+                    primitives_pkg_id,
+                    primitives::Event::EVENT_WRAPPER.module,
+                    primitives::Event::EVENT_WRAPPER.name,
+                    vec![wrapper_type.clone()],
+                )
+                .to_string(),
+            }),
+        };
+
+        let result =
+            NexusEvent::from_sui_gql_event(index, digest, primitives_pkg_id, &gql_event, &objects);
+        assert!(result.is_ok(), "Should parse valid Nexus GQL event");
+        let nexus_event = result.unwrap();
+        assert_eq!(nexus_event.generics, vec![]);
+        assert_eq!(nexus_event.id, (digest, index));
+        assert!(matches!(
+            nexus_event.data,
+            crate::events::NexusEventKind::DAGCreated(DAGCreatedEvent { dag }) if dag == dag_addr
+        ));
+    }
+
+    #[test]
+    fn test_parse_from_gql_non_nexus_package_event() {
+        let mut rng = rand::thread_rng();
+        let index = 0u64;
+        let digest = sui::types::Digest::generate(&mut rng);
+        let objects = sui_mocks::mock_nexus_objects();
+        let non_nexus_pkg_id = sui::types::Address::generate(&mut rng);
+        let event_type = sui::types::StructTag::new(
+            non_nexus_pkg_id,
+            sui::types::Identifier::new("dag").unwrap(),
+            sui::types::Identifier::new("DAGCreatedEvent").unwrap(),
+            vec![],
+        );
+        let wrapper_type = sui::types::TypeTag::Struct(Box::new(event_type.clone()));
+        let dag_addr = sui::types::Address::generate(&mut rng);
+        let data = Wrapper {
+            event: DAGCreatedEvent { dag: dag_addr },
+        };
+        let gql_event = EventsQueryEventsNodesContents {
+            json: Some(serde_json::to_value(&data).unwrap()),
+            type_: Some(EventsQueryEventsNodesContentsType {
+                repr: sui::types::StructTag::new(
+                    non_nexus_pkg_id,
+                    primitives::Event::EVENT_WRAPPER.module,
+                    primitives::Event::EVENT_WRAPPER.name,
+                    vec![wrapper_type.clone()],
+                )
+                .to_string(),
+            }),
+        };
+        let result =
+            NexusEvent::from_sui_gql_event(index, digest, non_nexus_pkg_id, &gql_event, &objects);
+        assert!(
+            result.is_err(),
+            "Should fail for non-Nexus package GQL event"
+        );
+    }
+
+    #[test]
+    fn test_parse_from_gql_non_event_wrapper_gql_type() {
+        let mut rng = rand::thread_rng();
+        let index = 0u64;
+        let digest = sui::types::Digest::generate(&mut rng);
+        let objects = sui_mocks::mock_nexus_objects();
+        let primitives_pkg_id = objects.primitives_pkg_id;
+        let event_type = sui::types::StructTag::new(
+            primitives_pkg_id,
+            sui::types::Identifier::new("dag").unwrap(),
+            sui::types::Identifier::new("DAGCreatedEvent").unwrap(),
+            vec![],
+        );
+        let wrapper_type = sui::types::TypeTag::Struct(Box::new(event_type.clone()));
+        let dag_addr = sui::types::Address::generate(&mut rng);
+        let data = Wrapper {
+            event: DAGCreatedEvent { dag: dag_addr },
+        };
+        // Use a non-wrapper struct tag
+        let non_wrapper_tag = sui::types::StructTag::new(
+            primitives_pkg_id,
+            sui::types::Identifier::new("not_wrapper").unwrap(),
+            sui::types::Identifier::new("not_wrapper").unwrap(),
+            vec![wrapper_type.clone()],
+        );
+        let gql_event = EventsQueryEventsNodesContents {
+            json: Some(serde_json::to_value(&data).unwrap()),
+            type_: Some(EventsQueryEventsNodesContentsType {
+                repr: non_wrapper_tag.to_string(),
+            }),
+        };
+        let result =
+            NexusEvent::from_sui_gql_event(index, digest, primitives_pkg_id, &gql_event, &objects);
+        assert!(result.is_err(), "Should fail for non-EventWrapper GQL type");
+    }
+
+    #[test]
+    fn test_parse_from_gql_event_wrapper_missing_type_param() {
+        let mut rng = rand::thread_rng();
+        let index = 0u64;
+        let digest = sui::types::Digest::generate(&mut rng);
+        let objects = sui_mocks::mock_nexus_objects();
+        let primitives_pkg_id = objects.primitives_pkg_id;
+        // Wrapper tag with no type params
+        let wrapper_tag = sui::types::StructTag::new(
+            primitives_pkg_id,
+            primitives::Event::EVENT_WRAPPER.module,
+            primitives::Event::EVENT_WRAPPER.name,
+            vec![],
+        );
+        let dag_addr = sui::types::Address::generate(&mut rng);
+        let data = Wrapper {
+            event: DAGCreatedEvent { dag: dag_addr },
+        };
+        let gql_event = EventsQueryEventsNodesContents {
+            json: Some(serde_json::to_value(&data).unwrap()),
+            type_: Some(EventsQueryEventsNodesContentsType {
+                repr: wrapper_tag.to_string(),
+            }),
+        };
+        let result =
+            NexusEvent::from_sui_gql_event(index, digest, primitives_pkg_id, &gql_event, &objects);
+        assert!(
+            result.is_err(),
+            "Should fail for missing type param in GQL event"
+        );
+    }
+
+    #[test]
+    fn test_parse_from_gql_valid_nexus_event_with_generics() {
+        let mut rng = rand::thread_rng();
+        let index = 0u64;
+        let digest = sui::types::Digest::generate(&mut rng);
+        let objects = sui_mocks::mock_nexus_objects();
+        let primitives_pkg_id = objects.primitives_pkg_id;
+        let event_type = sui::types::StructTag::new(
+            primitives_pkg_id,
+            sui::types::Identifier::new("dag").unwrap(),
+            sui::types::Identifier::new("DAGCreatedEvent").unwrap(),
+            vec![sui::types::TypeTag::U64],
+        );
+        let wrapper_type = sui::types::TypeTag::Struct(Box::new(event_type.clone()));
+        let dag_addr = sui::types::Address::generate(&mut rng);
+        let data = Wrapper {
+            event: DAGCreatedEvent { dag: dag_addr },
+        };
+        let gql_event = EventsQueryEventsNodesContents {
+            json: Some(serde_json::to_value(&data).unwrap()),
+            type_: Some(EventsQueryEventsNodesContentsType {
+                repr: sui::types::StructTag::new(
+                    primitives_pkg_id,
+                    primitives::Event::EVENT_WRAPPER.module,
+                    primitives::Event::EVENT_WRAPPER.name,
+                    vec![wrapper_type.clone()],
+                )
+                .to_string(),
+            }),
+        };
+
+        let result =
+            NexusEvent::from_sui_gql_event(index, digest, primitives_pkg_id, &gql_event, &objects);
+        assert!(
+            result.is_ok(),
+            "Should parse valid Nexus GQL event with generics"
+        );
+        let nexus_event = result.unwrap();
+        assert_eq!(nexus_event.generics, vec![sui::types::TypeTag::U64]);
+        assert_eq!(nexus_event.id, (digest, index));
+        assert!(matches!(
+            nexus_event.data,
+            crate::events::NexusEventKind::DAGCreated(DAGCreatedEvent { dag }) if dag == dag_addr
+        ));
+    }
+
+    #[tokio::test]
+    async fn test_parse_from_gql_all_events_roundtrip() {
+        let mut server = mockito::Server::new_async().await;
+        let objects = Arc::new(sui_mocks::mock_nexus_objects());
+        let primitives_pkg_id = objects.primitives_pkg_id;
+
+        let events = sample_events();
+
+        let mock = sui_mocks::gql::mock_event_query(
+            &mut server,
+            primitives_pkg_id,
+            events.clone(),
+            None,
+            Some("cursor"),
+        );
+
+        let fetcher = crate::events::EventFetcher::new(
+            &format!("{}/graphql", &server.url()),
+            objects.clone(),
+        );
+
+        let (_poller, mut receiver) = fetcher.poll_nexus_events(None, None);
+        let page = receiver
+            .recv()
+            .await
+            .expect("fetcher should yield a page of events")
+            .expect("result should be Ok");
+
+        assert_eq!(page.events.len(), events.len());
+
+        for (expected, parsed) in events.iter().zip(page.events.iter()) {
+            assert_eq!(expected.name(), parsed.data.name());
+        }
+
+        mock.assert_async().await;
+    }
+
+    fn sample_events() -> Vec<NexusEventKind> {
+        let mut idx: u8 = 1;
+        let mut addr = || {
+            let hex = format!("0x{:02x}", idx);
+            idx = idx.wrapping_add(1);
+            hex.parse::<sui::types::Address>().unwrap()
+        };
+        let fqn: ToolFqn = fqn!("xyz.taluslabs.example@1");
+        let vertex = RuntimeVertex::plain("v");
+        let ports = PortsData::from_map(
+            std::iter::once((
+                "p".to_string(),
+                NexusData::new_inline(serde_json::json!({ "k": 1 })),
+            ))
+            .collect(),
+        );
+
+        vec![
+            NexusEventKind::RequestScheduledOccurrence(RequestScheduledOccurrenceEvent {
+                request: OccurrenceScheduledEvent {
+                    task: addr(),
+                    generator: PolicySymbol::Uid(addr()),
+                },
+                priority: 1,
+                request_ms: 2,
+                start_ms: 3,
+                deadline_ms: 4,
+            }),
+            NexusEventKind::RequestScheduledWalk(RequestScheduledWalkEvent {
+                request: RequestWalkExecutionEvent {
+                    dag: addr(),
+                    execution: addr(),
+                    walk_index: 1,
+                    next_vertex: vertex.clone(),
+                    evaluations: addr(),
+                    worksheet_from_type: TypeName::new("worksheet"),
+                },
+                priority: 1,
+                request_ms: 2,
+                start_ms: 3,
+                deadline_ms: 4,
+            }),
+            NexusEventKind::OccurrenceScheduled(OccurrenceScheduledEvent {
+                task: addr(),
+                generator: PolicySymbol::Uid(addr()),
+            }),
+            NexusEventKind::RequestWalkExecution(RequestWalkExecutionEvent {
+                dag: addr(),
+                execution: addr(),
+                walk_index: 7,
+                next_vertex: vertex.clone(),
+                evaluations: addr(),
+                worksheet_from_type: TypeName::new("worksheet"),
+            }),
+            NexusEventKind::AnnounceInterfacePackage(AnnounceInterfacePackageEvent {
+                shared_objects: vec![addr()],
+            }),
+            NexusEventKind::OffChainToolRegistered(OffChainToolRegisteredEvent {
+                registry: addr(),
+                tool: addr(),
+                fqn: fqn.clone(),
+                url: reqwest::Url::parse("https://example.com").unwrap(),
+                input_schema: serde_json::json!({"in": 1}),
+                output_schema: serde_json::json!({"out": 1}),
+            }),
+            NexusEventKind::OnChainToolRegistered(OnChainToolRegisteredEvent {
+                registry: addr(),
+                tool: addr(),
+                registered_at_ms: 10,
+                fqn: fqn.clone(),
+                package_address: addr(),
+                module_name: "module".to_string(),
+                witness_id: addr(),
+                input_schema: serde_json::json!({"in": 1}),
+                output_schema: serde_json::json!({"out": 1}),
+                description: "desc".to_string(),
+            }),
+            NexusEventKind::ToolUnregistered(ToolUnregisteredEvent {
+                tool: addr(),
+                fqn: fqn.clone(),
+            }),
+            NexusEventKind::WalkAdvanced(WalkAdvancedEvent {
+                dag: addr(),
+                execution: addr(),
+                walk_index: 1,
+                vertex: vertex.clone(),
+                variant: TypeName::new("var"),
+                variant_ports_to_data: ports.clone(),
+            }),
+            NexusEventKind::WalkFailed(WalkFailedEvent {
+                dag: addr(),
+                execution: addr(),
+                walk_index: 2,
+                vertex: vertex.clone(),
+                reason: "fail".to_string(),
+            }),
+            NexusEventKind::EndStateReached(EndStateReachedEvent {
+                dag: addr(),
+                execution: addr(),
+                walk_index: 3,
+                vertex: vertex.clone(),
+                variant: TypeName::new("end"),
+                variant_ports_to_data: ports.clone(),
+            }),
+            NexusEventKind::ExecutionFinished(ExecutionFinishedEvent {
+                dag: addr(),
+                execution: addr(),
+                has_any_walk_failed: true,
+                has_any_walk_succeeded: true,
+            }),
+            NexusEventKind::MissedOccurrence(MissedOccurrenceEvent {
+                task: addr(),
+                start_time_ms: 1,
+                deadline_ms: Some(2),
+                pruned_at: 3,
+                priority_fee_per_gas_unit: 4,
+                generator: PolicySymbol::Uid(addr()),
+            }),
+            NexusEventKind::TaskCreated(TaskCreatedEvent {
+                task: addr(),
+                owner: addr(),
+            }),
+            NexusEventKind::TaskPaused(TaskPausedEvent { task: addr() }),
+            NexusEventKind::TaskResumed(TaskResumedEvent { task: addr() }),
+            NexusEventKind::TaskCanceled(TaskCanceledEvent {
+                task: addr(),
+                cleared_occurrences: 1,
+                had_periodic: true,
+            }),
+            NexusEventKind::OccurrenceConsumed(OccurrenceConsumedEvent {
+                task: addr(),
+                start_time_ms: 1,
+                deadline_ms: Some(2),
+                priority_fee_per_gas_unit: 3,
+                generator: PolicySymbol::Uid(addr()),
+                executed_at: 4,
+            }),
+            NexusEventKind::PeriodicScheduleConfigured(PeriodicScheduleConfiguredEvent {
+                task: addr(),
+                period_ms: Some(1),
+                deadline_offset_ms: Some(2),
+                max_iterations: Some(3),
+                generated: Some(4),
+                priority_fee_per_gas_unit: Some(5),
+                last_generated_start_ms: Some(6),
+            }),
+            NexusEventKind::FoundingLeaderCapCreated(FoundingLeaderCapCreatedEvent {
+                leader_cap: addr(),
+                network: addr(),
+            }),
+            NexusEventKind::GasSettlementUpdate(GasSettlementUpdateEvent {
+                execution: addr(),
+                tool_fqn: fqn.clone(),
+                vertex: vertex.clone(),
+                was_settled: true,
+            }),
+            NexusEventKind::PreKeyVaultCreated(PreKeyVaultCreatedEvent {
+                vault: addr(),
+                crypto_cap: addr(),
+            }),
+            NexusEventKind::PreKeyRequested(PreKeyRequestedEvent {
+                requested_by: addr(),
+            }),
+            NexusEventKind::PreKeyFulfilled(PreKeyFulfilledEvent {
+                requested_by: addr(),
+                pre_key_bytes: vec![1, 2, 3],
+            }),
+            NexusEventKind::PreKeyAssociated(PreKeyAssociatedEvent {
+                claimed_by: addr(),
+                pre_key: vec![4, 5],
+                initial_message: vec![6, 7],
+            }),
+            NexusEventKind::DAGCreated(DAGCreatedEvent { dag: addr() }),
+        ]
+    }
+}
diff --git a/sdk/src/idents/mod.rs b/sdk/src/idents/mod.rs
index 52e33aeb..ff4f6083 100644
--- a/sdk/src/idents/mod.rs
+++ b/sdk/src/idents/mod.rs
@@ -8,11 +8,11 @@
 //! use nexus_sdk::sui;
 //! use nexus_sdk::idents::workflow;
 //!
-//! let mut tx = sui::ProgrammableTransactionBuilder::new();
-//! let workflow_pkg_id = sui::ObjectID::random();
+//! let mut tx = sui::tx::TransactionBuilder::new();
+//! let workflow_pkg_id = sui::types::Address::generate(&mut rand::thread_rng());
 //! let vertex = workflow::Dag::vertex_from_str(&mut tx, workflow_pkg_id, "my_vertex");
 //!
-//! assert!(matches!(vertex, Ok(sui::Argument::Result(_))));
+//! assert!(matches!(vertex, Ok(sui::types::Argument::Result(_))));
 //! ```
 
 pub mod move_std;
@@ -21,10 +21,30 @@ pub mod sui_framework;
 pub mod tap;
 pub mod workflow;
 
-use crate::sui;
+use {
+    crate::sui,
+    base64::{prelude::BASE64_STANDARD as BASE64, Engine},
+    serde::Serialize,
+};
 
 /// This struct is used to define Nexus Move resources as `const`s.
 pub struct ModuleAndNameIdent {
-    pub module: &'static sui::MoveIdentStr,
-    pub name: &'static sui::MoveIdentStr,
+    pub module: sui::types::Identifier,
+    pub name: sui::types::Identifier,
+}
+
+impl ModuleAndNameIdent {
+    /// Returns the fully-qualified string for this identifier under the given package ID.
+    pub fn qualified_name(&self, package: sui::types::Address) -> String {
+        format!("{package}::{}::{}", self.module, self.name)
+    }
+}
+
+/// Helper to create a pure [`sui::tx::Input`].
+pub fn pure_arg<T: Serialize>(value: &T) -> anyhow::Result<sui::tx::Input> {
+    Ok(sui::tx::Input {
+        value: Some(sui::tx::Value::String(BASE64.encode(bcs::to_bytes(value)?))),
+        kind: Some(sui::tx::InputKind::Pure),
+        ..Default::default()
+    })
 }
diff --git a/sdk/src/idents/move_std.rs b/sdk/src/idents/move_std.rs
index 8d66acb4..3117bbc8 100644
--- a/sdk/src/idents/move_std.rs
+++ b/sdk/src/idents/move_std.rs
@@ -1,30 +1,37 @@
-use crate::{idents::ModuleAndNameIdent, sui};
+use crate::{
+    idents::{move_std, pure_arg, ModuleAndNameIdent},
+    sui,
+};
+
+pub const PACKAGE_ID: sui::types::Address = sui::types::Address::from_static("0x1");
 
 // == `std::ascii` ==
 
 pub struct Ascii;
 
-const ASCII_MODULE: &sui::MoveIdentStr = sui::move_ident_str!("ascii");
+const ASCII_MODULE: sui::types::Identifier = sui::types::Identifier::from_static("ascii");
 
 impl Ascii {
     /// `std::ascii::string`
     pub const STRING: ModuleAndNameIdent = ModuleAndNameIdent {
         module: ASCII_MODULE,
-        name: sui::move_ident_str!("string"),
+        name: sui::types::Identifier::from_static("string"),
     };
 
     /// Convert a string to a Move ASCII string.
     pub fn ascii_string_from_str<T: AsRef<str>>(
-        tx: &mut sui::ProgrammableTransactionBuilder,
+        tx: &mut sui::tx::TransactionBuilder,
         str: T,
-    ) -> anyhow::Result<sui::Argument> {
-        let str = tx.pure(str.as_ref().as_bytes())?;
+    ) -> anyhow::Result<sui::types::Argument> {
+        let str = tx.input(pure_arg(&str.as_ref().to_string())?);
 
-        Ok(tx.programmable_move_call(
-            sui::MOVE_STDLIB_PACKAGE_ID,
-            Self::STRING.module.into(),
-            Self::STRING.name.into(),
-            vec![],
+        Ok(tx.move_call(
+            sui::tx::Function::new(
+                move_std::PACKAGE_ID,
+                Self::STRING.module,
+                Self::STRING.name,
+                vec![],
+            ),
             vec![str],
         ))
     }
@@ -34,17 +41,46 @@ impl Ascii {
 
 pub struct Vector;
 
-const VECTOR_MODULE: &sui::MoveIdentStr = sui::move_ident_str!("vector");
+const VECTOR_MODULE: sui::types::Identifier = sui::types::Identifier::from_static("vector");
 
 impl Vector {
     /// `std::vector::empty`
     pub const EMPTY: ModuleAndNameIdent = ModuleAndNameIdent {
         module: VECTOR_MODULE,
-        name: sui::move_ident_str!("empty"),
+        name: sui::types::Identifier::from_static("empty"),
     };
     /// `std::vector::push_back`
     pub const PUSH_BACK: ModuleAndNameIdent = ModuleAndNameIdent {
         module: VECTOR_MODULE,
-        name: sui::move_ident_str!("push_back"),
+        name: sui::types::Identifier::from_static("push_back"),
+    };
+    /// `std::vector::singleton`
+    pub const SINGLETON: ModuleAndNameIdent = ModuleAndNameIdent {
+        module: VECTOR_MODULE,
+        name: sui::types::Identifier::from_static("singleton"),
+    };
+}
+
+// == `std::string` ==
+
+pub struct StdString;
+
+const STRING_MODULE: sui::types::Identifier = sui::types::Identifier::from_static("string");
+
+impl StdString {
+    /// `std::string::String`
+    pub const STRING: ModuleAndNameIdent = ModuleAndNameIdent {
+        module: STRING_MODULE,
+        name: sui::types::Identifier::from_static("String"),
     };
+
+    /// Convenience helper to build the `std::string::String` type tag.
+    pub fn type_tag() -> sui::types::TypeTag {
+        sui::types::TypeTag::Struct(Box::new(sui::types::StructTag::new(
+            move_std::PACKAGE_ID,
+            Self::STRING.module,
+            Self::STRING.name,
+            vec![],
+        )))
+    }
 }
diff --git a/sdk/src/idents/primitives.rs b/sdk/src/idents/primitives.rs
index af1e9fb7..610c5045 100644
--- a/sdk/src/idents/primitives.rs
+++ b/sdk/src/idents/primitives.rs
@@ -1,5 +1,5 @@
 use crate::{
-    idents::{move_std, ModuleAndNameIdent},
+    idents::{move_std, pure_arg, ModuleAndNameIdent},
     sui,
 };
 
@@ -7,7 +7,7 @@ use crate::{
 
 pub struct Data;
 
-const DATA_MODULE: &sui::MoveIdentStr = sui::move_ident_str!("data");
+const DATA_MODULE: sui::types::Identifier = sui::types::Identifier::from_static("data");
 
 impl Data {
     /// Create NexusData from a vector of vectors of bytes.
@@ -15,7 +15,7 @@ impl Data {
     /// `nexus_primitives::data::inline_many`
     pub const INLINE_MANY: ModuleAndNameIdent = ModuleAndNameIdent {
         module: DATA_MODULE,
-        name: sui::move_ident_str!("inline_many"),
+        name: sui::types::Identifier::from_static("inline_many"),
     };
     /// Create NexusData from a vector of vectors of bytes and mark it as
     /// encrypted.
@@ -23,28 +23,28 @@ impl Data {
     /// `nexus_primitives::data::inline_many_encrypted`
     pub const INLINE_MANY_ENCRYPTED: ModuleAndNameIdent = ModuleAndNameIdent {
         module: DATA_MODULE,
-        name: sui::move_ident_str!("inline_many_encrypted"),
+        name: sui::types::Identifier::from_static("inline_many_encrypted"),
     };
     /// Create NexusData from a vector of bytes.
     ///
     /// `nexus_primitives::data::inline_one`
     pub const INLINE_ONE: ModuleAndNameIdent = ModuleAndNameIdent {
         module: DATA_MODULE,
-        name: sui::move_ident_str!("inline_one"),
+        name: sui::types::Identifier::from_static("inline_one"),
     };
     /// Create NexusData from a vector of bytes and mark it as encrypted.
     ///
     /// `nexus_primitives::data::inline_one_encrypted`
     pub const INLINE_ONE_ENCRYPTED: ModuleAndNameIdent = ModuleAndNameIdent {
         module: DATA_MODULE,
-        name: sui::move_ident_str!("inline_one_encrypted"),
+        name: sui::types::Identifier::from_static("inline_one_encrypted"),
     };
     /// NexusData struct. Mostly used for creating generic types.
     ///
     /// `nexus_primitives::data::NexusData`
     pub const NEXUS_DATA: ModuleAndNameIdent = ModuleAndNameIdent {
         module: DATA_MODULE,
-        name: sui::move_ident_str!("NexusData"),
+        name: sui::types::Identifier::from_static("NexusData"),
     };
     /// Create NexusData from a vector of vectors of bytes that are stored on
     /// Walrus.
@@ -52,7 +52,7 @@ impl Data {
     /// `nexus_primitives::data::walrus_many`
     pub const WALRUS_MANY: ModuleAndNameIdent = ModuleAndNameIdent {
         module: DATA_MODULE,
-        name: sui::move_ident_str!("walrus_many"),
+        name: sui::types::Identifier::from_static("walrus_many"),
     };
     /// Create NexusData from a vector of vectors of bytes that are stored on
     /// Walrus and mark it as encrypted.
@@ -60,14 +60,14 @@ impl Data {
     /// `nexus_primitives::data::walrus_many_encrypted`
     pub const WALRUS_MANY_ENCRYPTED: ModuleAndNameIdent = ModuleAndNameIdent {
         module: DATA_MODULE,
-        name: sui::move_ident_str!("walrus_many_encrypted"),
+        name: sui::types::Identifier::from_static("walrus_many_encrypted"),
     };
     /// Create NexusData from a vector of bytes that are stored on Walrus.
     ///
     /// `nexus_primitives::data::walrus_one`
     pub const WALRUS_ONE: ModuleAndNameIdent = ModuleAndNameIdent {
         module: DATA_MODULE,
-        name: sui::move_ident_str!("walrus_one"),
+        name: sui::types::Identifier::from_static("walrus_one"),
     };
     /// Create NexusData from a vector of bytes that are stored on Walrus and
     /// mark it as encrypted.
@@ -75,16 +75,16 @@ impl Data {
     /// `nexus_primitives::data::walrus_one_encrypted`
     pub const WALRUS_ONE_ENCRYPTED: ModuleAndNameIdent = ModuleAndNameIdent {
         module: DATA_MODULE,
-        name: sui::move_ident_str!("walrus_one_encrypted"),
+        name: sui::types::Identifier::from_static("walrus_one_encrypted"),
     };
 
     /// Create NexusData with inline storage from a [serde_json::Value].
     pub fn nexus_data_inline_from_json<T: serde::Serialize>(
-        tx: &mut sui::ProgrammableTransactionBuilder,
-        primitives_pkg_id: sui::ObjectID,
+        tx: &mut sui::tx::TransactionBuilder,
+        primitives_pkg_id: sui::types::Address,
         json: &T,
         encrypted: bool,
-    ) -> anyhow::Result<sui::Argument> {
+    ) -> anyhow::Result<sui::types::Argument> {
         let (one, many) = match encrypted {
             true => (&Self::INLINE_ONE_ENCRYPTED, &Self::INLINE_MANY_ENCRYPTED),
             false => (&Self::INLINE_ONE, &Self::INLINE_MANY),
@@ -95,11 +95,11 @@ impl Data {
 
     /// Create NexusData with Walrus storage from a [serde_json::Value].
     pub fn nexus_data_walrus_from_json<T: serde::Serialize>(
-        tx: &mut sui::ProgrammableTransactionBuilder,
-        primitives_pkg_id: sui::ObjectID,
+        tx: &mut sui::tx::TransactionBuilder,
+        primitives_pkg_id: sui::types::Address,
         json: &T,
         encrypted: bool,
-    ) -> anyhow::Result<sui::Argument> {
+    ) -> anyhow::Result<sui::types::Argument> {
         let (one, many) = match encrypted {
             true => (&Self::WALRUS_ONE_ENCRYPTED, &Self::WALRUS_MANY_ENCRYPTED),
             false => (&Self::WALRUS_ONE, &Self::WALRUS_MANY),
@@ -110,53 +110,63 @@ impl Data {
 
     /// Internal helper to create NexusData from a [serde_json::Value].
     fn nexus_data_from_json<T: serde::Serialize>(
-        tx: &mut sui::ProgrammableTransactionBuilder,
-        primitives_pkg_id: sui::ObjectID,
+        tx: &mut sui::tx::TransactionBuilder,
+        primitives_pkg_id: sui::types::Address,
         json: &T,
         one: &ModuleAndNameIdent,
         many: &ModuleAndNameIdent,
-    ) -> anyhow::Result<sui::Argument> {
+    ) -> anyhow::Result<sui::types::Argument> {
         if let serde_json::Value::Array(arr) = serde_json::to_value(json)? {
-            let type_params = vec![sui::MoveTypeTag::Vector(Box::new(sui::MoveTypeTag::U8))];
+            let type_params = vec![sui::types::TypeTag::Vector(Box::new(
+                sui::types::TypeTag::U8,
+            ))];
 
-            let vec = tx.programmable_move_call(
-                sui::MOVE_STDLIB_PACKAGE_ID,
-                move_std::Vector::EMPTY.module.into(),
-                move_std::Vector::EMPTY.name.into(),
-                type_params.clone(),
+            let vec = tx.move_call(
+                sui::tx::Function::new(
+                    move_std::PACKAGE_ID,
+                    move_std::Vector::EMPTY.module,
+                    move_std::Vector::EMPTY.name,
+                    type_params.clone(),
+                ),
                 vec![],
             );
 
             for data in arr {
                 // `bytes: vector<u8>`
-                let data_bytes = tx.pure(serde_json::to_string(&data)?.into_bytes())?;
+                let data_bytes = tx.input(pure_arg(&serde_json::to_vec(&data)?)?);
 
                 // `vector<vector<u8>>::push_back`
-                tx.programmable_move_call(
-                    sui::MOVE_STDLIB_PACKAGE_ID,
-                    move_std::Vector::PUSH_BACK.module.into(),
-                    move_std::Vector::PUSH_BACK.name.into(),
-                    type_params.clone(),
+                tx.move_call(
+                    sui::tx::Function::new(
+                        move_std::PACKAGE_ID,
+                        move_std::Vector::PUSH_BACK.module,
+                        move_std::Vector::PUSH_BACK.name,
+                        type_params.clone(),
+                    ),
                     vec![vec, data_bytes],
                 );
             }
 
-            return Ok(tx.programmable_move_call(
-                primitives_pkg_id,
-                many.module.into(),
-                many.name.into(),
-                vec![],
+            return Ok(tx.move_call(
+                sui::tx::Function::new(
+                    primitives_pkg_id,
+                    many.module.clone(),
+                    many.name.clone(),
+                    vec![],
+                ),
                 vec![vec],
             ));
         }
 
-        let json = tx.pure(serde_json::to_string(json)?.into_bytes())?;
+        let json = tx.input(pure_arg(&serde_json::to_vec(json)?)?);
 
-        Ok(tx.programmable_move_call(
-            primitives_pkg_id,
-            one.module.into(),
-            one.name.into(),
-            vec![],
+        Ok(tx.move_call(
+            sui::tx::Function::new(
+                primitives_pkg_id,
+                one.module.clone(),
+                one.name.clone(),
+                vec![],
+            ),
             vec![json],
         ))
     }
@@ -166,7 +176,7 @@ impl Data {
 
 pub struct Event;
 
-const EVENT_MODULE: &sui::MoveIdentStr = sui::move_ident_str!("event");
+const EVENT_MODULE: sui::types::Identifier = sui::types::Identifier::from_static("event");
 
 impl Event {
     /// All events fired by the on-chain part of Nexus are wrapped in the
@@ -175,7 +185,7 @@ impl Event {
     /// `nexus_primitives::event::EventWrapper`
     pub const EVENT_WRAPPER: ModuleAndNameIdent = ModuleAndNameIdent {
         module: EVENT_MODULE,
-        name: sui::move_ident_str!("EventWrapper"),
+        name: sui::types::Identifier::from_static("EventWrapper"),
     };
 }
 
@@ -183,7 +193,7 @@ impl Event {
 
 pub struct OwnerCap;
 
-const OWNER_CAP_MODULE: &sui::MoveIdentStr = sui::move_ident_str!("owner_cap");
+const OWNER_CAP_MODULE: sui::types::Identifier = sui::types::Identifier::from_static("owner_cap");
 
 impl OwnerCap {
     /// This is used to fetch owner caps for the configured addresses. Each
@@ -193,22 +203,41 @@ impl OwnerCap {
     /// `nexus_primitives::owner_cap::CloneableOwnerCap`
     pub const CLONEABLE_OWNER_CAP: ModuleAndNameIdent = ModuleAndNameIdent {
         module: OWNER_CAP_MODULE,
-        name: sui::move_ident_str!("CloneableOwnerCap"),
+        name: sui::types::Identifier::from_static("CloneableOwnerCap"),
     };
 }
 
-/// Helper to turn a `ModuleAndNameIdent` into a `sui::MoveTypeTag`. Useful for
+// == `nexus_primitives::policy` ==
+
+pub struct Policy;
+
+const POLICY_MODULE: sui::types::Identifier = sui::types::Identifier::from_static("policy");
+
+impl Policy {
+    /// `nexus_primitives::policy::Symbol`
+    pub const SYMBOL: ModuleAndNameIdent = ModuleAndNameIdent {
+        module: POLICY_MODULE,
+        name: sui::types::Identifier::from_static("Symbol"),
+    };
+    /// `nexus_primitives::policy::witness_symbol`
+    pub const WITNESS_SYMBOL: ModuleAndNameIdent = ModuleAndNameIdent {
+        module: POLICY_MODULE,
+        name: sui::types::Identifier::from_static("witness_symbol"),
+    };
+}
+
+/// Helper to turn a `ModuleAndNameIdent` into a `sui::types::TypeTag`. Useful for
 /// creating generic types.
 pub fn into_type_tag(
-    workflow_pkg_id: sui::ObjectID,
+    workflow_pkg_id: sui::types::Address,
     ident: ModuleAndNameIdent,
-) -> sui::MoveTypeTag {
-    sui::MoveTypeTag::Struct(Box::new(sui::MoveStructTag {
-        address: *workflow_pkg_id,
-        module: ident.module.into(),
-        name: ident.name.into(),
-        type_params: vec![],
-    }))
+) -> sui::types::TypeTag {
+    sui::types::TypeTag::Struct(Box::new(sui::types::StructTag::new(
+        workflow_pkg_id,
+        ident.module,
+        ident.name,
+        vec![],
+    )))
 }
 
 #[cfg(test)]
@@ -217,21 +246,22 @@ mod tests {
 
     #[test]
     fn test_into_type_tag() {
-        let primitives_pkg_id = sui::ObjectID::random();
+        let rng = &mut rand::thread_rng();
+        let primitives_pkg_id = sui::types::Address::generate(rng);
         let ident = ModuleAndNameIdent {
-            module: sui::move_ident_str!("foo"),
-            name: sui::move_ident_str!("bar"),
+            module: sui::types::Identifier::from_static("foo"),
+            name: sui::types::Identifier::from_static("bar"),
         };
 
         let tag = into_type_tag(primitives_pkg_id, ident);
         assert_eq!(
             tag,
-            sui::MoveTypeTag::Struct(Box::new(sui::MoveStructTag {
-                address: *primitives_pkg_id,
-                module: sui::move_ident_str!("foo").into(),
-                name: sui::move_ident_str!("bar").into(),
-                type_params: vec![],
-            }))
+            sui::types::TypeTag::Struct(Box::new(sui::types::StructTag::new(
+                primitives_pkg_id,
+                sui::types::Identifier::from_static("foo"),
+                sui::types::Identifier::from_static("bar"),
+                vec![],
+            )))
         );
     }
 }
diff --git a/sdk/src/idents/sui_framework.rs b/sdk/src/idents/sui_framework.rs
index c09bb52e..fa20bfd6 100644
--- a/sdk/src/idents/sui_framework.rs
+++ b/sdk/src/idents/sui_framework.rs
@@ -1,32 +1,30 @@
-use crate::{idents::ModuleAndNameIdent, sui};
+use crate::{
+    idents::{pure_arg, ModuleAndNameIdent},
+    sui,
+};
 
-// == `sui::address` ==
+pub const PACKAGE_ID: sui::types::Address = sui::types::Address::from_static("0x2");
+pub const CLOCK_OBJECT_ID: sui::types::Address = sui::types::Address::from_static("0x6");
+
+// == `sui::types::Address` ==
 
 pub struct Address;
 
-const ADDRESS_MODULE: &sui::MoveIdentStr = sui::move_ident_str!("address");
+const ADDRESS_MODULE: sui::types::Identifier = sui::types::Identifier::from_static("address");
 
 impl Address {
-    /// `sui::address::from_ascii_bytes`
+    /// `sui::types::Address::from_ascii_bytes`
     pub const FROM_ASCII_BYTES: ModuleAndNameIdent = ModuleAndNameIdent {
         module: ADDRESS_MODULE,
-        name: sui::move_ident_str!("from_ascii_bytes"),
-    };
-
-    /// Convert a string to a Move ASCII string.
-    pub fn address_from_str<T: AsRef<str>>(
-        tx: &mut sui::ProgrammableTransactionBuilder,
-        str: T,
-    ) -> anyhow::Result<sui::Argument> {
-        let str = tx.pure(str.as_ref().as_bytes())?;
-
-        Ok(tx.programmable_move_call(
-            sui::FRAMEWORK_PACKAGE_ID,
-            Self::FROM_ASCII_BYTES.module.into(),
-            Self::FROM_ASCII_BYTES.name.into(),
-            vec![],
-            vec![str],
-        ))
+        name: sui::types::Identifier::from_static("from_ascii_bytes"),
+    };
+
+    /// Covert [`sui::types::Address`] into a [`sui::types::Argument`].
+    pub fn address_from_type(
+        tx: &mut sui::tx::TransactionBuilder,
+        address: sui::types::Address,
+    ) -> anyhow::Result<sui::types::Argument> {
+        Ok(tx.input(pure_arg(&address)?))
     }
 }
 
@@ -34,28 +32,29 @@ impl Address {
 
 pub struct Object;
 
-const OBJECT_MODULE: &sui::MoveIdentStr = sui::move_ident_str!("object");
+const OBJECT_MODULE: sui::types::Identifier = sui::types::Identifier::from_static("object");
 
 impl Object {
     /// `sui::object::id_from_address`
     pub const ID_FROM_ADDRESS: ModuleAndNameIdent = ModuleAndNameIdent {
         module: OBJECT_MODULE,
-        name: sui::move_ident_str!("id_from_address"),
+        name: sui::types::Identifier::from_static("id_from_address"),
     };
 
     /// Convert an object ID to a Move ID.
     pub fn id_from_object_id(
-        tx: &mut sui::ProgrammableTransactionBuilder,
-        object_id: sui::ObjectID,
-    ) -> anyhow::Result<sui::Argument> {
-        let with_prefix = false;
-        let address = Address::address_from_str(tx, object_id.to_canonical_string(with_prefix))?;
-
-        Ok(tx.programmable_move_call(
-            sui::FRAMEWORK_PACKAGE_ID,
-            Self::ID_FROM_ADDRESS.module.into(),
-            Self::ID_FROM_ADDRESS.name.into(),
-            vec![],
+        tx: &mut sui::tx::TransactionBuilder,
+        object_id: sui::types::Address,
+    ) -> anyhow::Result<sui::types::Argument> {
+        let address = Address::address_from_type(tx, object_id)?;
+
+        Ok(tx.move_call(
+            sui::tx::Function::new(
+                PACKAGE_ID,
+                Self::ID_FROM_ADDRESS.module,
+                Self::ID_FROM_ADDRESS.name,
+                vec![],
+            ),
             vec![address],
         ))
     }
@@ -65,18 +64,18 @@ impl Object {
 
 pub struct VecSet;
 
-const VEC_SET_MODULE: &sui::MoveIdentStr = sui::move_ident_str!("vec_set");
+const VEC_SET_MODULE: sui::types::Identifier = sui::types::Identifier::from_static("vec_set");
 
 impl VecSet {
     /// `sui::vec_set::empty`
     pub const EMPTY: ModuleAndNameIdent = ModuleAndNameIdent {
         module: VEC_SET_MODULE,
-        name: sui::move_ident_str!("empty"),
+        name: sui::types::Identifier::from_static("empty"),
     };
     /// `sui::vec_set::insert`
     pub const INSERT: ModuleAndNameIdent = ModuleAndNameIdent {
         module: VEC_SET_MODULE,
-        name: sui::move_ident_str!("insert"),
+        name: sui::types::Identifier::from_static("insert"),
     };
 }
 
@@ -84,23 +83,47 @@ impl VecSet {
 
 pub struct VecMap;
 
-const VEC_MAP_MODULE: &sui::MoveIdentStr = sui::move_ident_str!("vec_map");
+const VEC_MAP_MODULE: sui::types::Identifier = sui::types::Identifier::from_static("vec_map");
 
 impl VecMap {
     /// `sui::vec_map::empty`
     pub const EMPTY: ModuleAndNameIdent = ModuleAndNameIdent {
         module: VEC_MAP_MODULE,
-        name: sui::move_ident_str!("empty"),
+        name: sui::types::Identifier::from_static("empty"),
     };
     /// `sui::vec_map::insert`
     pub const INSERT: ModuleAndNameIdent = ModuleAndNameIdent {
         module: VEC_MAP_MODULE,
-        name: sui::move_ident_str!("insert"),
+        name: sui::types::Identifier::from_static("insert"),
     };
     /// `sui::vec_map::VecMap`
     pub const VEC_MAP: ModuleAndNameIdent = ModuleAndNameIdent {
         module: VEC_MAP_MODULE,
-        name: sui::move_ident_str!("VecMap"),
+        name: sui::types::Identifier::from_static("VecMap"),
+    };
+}
+
+// == `sui::table_vec` ==
+
+pub struct TableVec;
+
+const TABLE_VEC_MODULE: sui::types::Identifier = sui::types::Identifier::from_static("table_vec");
+
+impl TableVec {
+    /// `sui::table_vec::drop`
+    pub const DROP: ModuleAndNameIdent = ModuleAndNameIdent {
+        module: TABLE_VEC_MODULE,
+        name: sui::types::Identifier::from_static("drop"),
+    };
+    /// `sui::table_vec::empty`
+    pub const EMPTY: ModuleAndNameIdent = ModuleAndNameIdent {
+        module: TABLE_VEC_MODULE,
+        name: sui::types::Identifier::from_static("empty"),
+    };
+    /// `sui::table_vec::push_back`
+    pub const PUSH_BACK: ModuleAndNameIdent = ModuleAndNameIdent {
+        module: TABLE_VEC_MODULE,
+        name: sui::types::Identifier::from_static("push_back"),
     };
 }
 
@@ -108,18 +131,18 @@ impl VecMap {
 
 pub struct Transfer;
 
-const TRANSFER_MODULE: &sui::MoveIdentStr = sui::move_ident_str!("transfer");
+const TRANSFER_MODULE: sui::types::Identifier = sui::types::Identifier::from_static("transfer");
 
 impl Transfer {
     /// `sui::transfer::public_share_object`
     pub const PUBLIC_SHARE_OBJECT: ModuleAndNameIdent = ModuleAndNameIdent {
         module: TRANSFER_MODULE,
-        name: sui::move_ident_str!("public_share_object"),
+        name: sui::types::Identifier::from_static("public_share_object"),
     };
     /// `sui::transfer::public_transfer`
     pub const PUBLIC_TRANSFER: ModuleAndNameIdent = ModuleAndNameIdent {
         module: TRANSFER_MODULE,
-        name: sui::move_ident_str!("public_transfer"),
+        name: sui::types::Identifier::from_static("public_transfer"),
     };
 }
 
@@ -127,28 +150,28 @@ impl Transfer {
 
 pub struct Coin;
 
-const COIN_MODULE: &sui::MoveIdentStr = sui::move_ident_str!("coin");
+const COIN_MODULE: sui::types::Identifier = sui::types::Identifier::from_static("coin");
 
 impl Coin {
     /// `sui::coin::Coin`
     pub const COIN: ModuleAndNameIdent = ModuleAndNameIdent {
         module: COIN_MODULE,
-        name: sui::move_ident_str!("Coin"),
+        name: sui::types::Identifier::from_static("Coin"),
     };
     /// `sui::coin::from_balance`
     pub const FROM_BALANCE: ModuleAndNameIdent = ModuleAndNameIdent {
         module: COIN_MODULE,
-        name: sui::move_ident_str!("from_balance"),
+        name: sui::types::Identifier::from_static("from_balance"),
     };
     /// `sui::coin::into_balance`
     pub const INTO_BALANCE: ModuleAndNameIdent = ModuleAndNameIdent {
         module: COIN_MODULE,
-        name: sui::move_ident_str!("into_balance"),
+        name: sui::types::Identifier::from_static("into_balance"),
     };
     /// `sui::coin::join`
     pub const JOIN: ModuleAndNameIdent = ModuleAndNameIdent {
         module: COIN_MODULE,
-        name: sui::move_ident_str!("join"),
+        name: sui::types::Identifier::from_static("join"),
     };
 }
 
@@ -156,23 +179,23 @@ impl Coin {
 
 pub struct Sui;
 
-const SUI_MODULE: &sui::MoveIdentStr = sui::move_ident_str!("sui");
+const SUI_MODULE: sui::types::Identifier = sui::types::Identifier::from_static("sui");
 
 impl Sui {
     /// `sui::sui::SUI`
     pub const SUI: ModuleAndNameIdent = ModuleAndNameIdent {
         module: SUI_MODULE,
-        name: sui::move_ident_str!("SUI"),
+        name: sui::types::Identifier::from_static("SUI"),
     };
 }
 
-/// Helper to turn a `ModuleAndNameIdent` into a `sui::MoveTypeTag`. Useful for
+/// Helper to turn a `ModuleAndNameIdent` into a `sui::types::TypeTag`. Useful for
 /// creating generic types.
-pub fn into_type_tag(ident: ModuleAndNameIdent) -> sui::MoveTypeTag {
-    sui::MoveTypeTag::Struct(Box::new(sui::MoveStructTag {
-        address: *sui::FRAMEWORK_PACKAGE_ID,
-        module: ident.module.into(),
-        name: ident.name.into(),
-        type_params: vec![],
-    }))
+pub fn into_type_tag(ident: ModuleAndNameIdent) -> sui::types::TypeTag {
+    sui::types::TypeTag::Struct(Box::new(sui::types::StructTag::new(
+        PACKAGE_ID,
+        ident.module,
+        ident.name,
+        vec![],
+    )))
 }
diff --git a/sdk/src/idents/tap.rs b/sdk/src/idents/tap.rs
index b52d46a7..518ead0d 100644
--- a/sdk/src/idents/tap.rs
+++ b/sdk/src/idents/tap.rs
@@ -10,8 +10,8 @@ pub struct TapV1;
 
 impl TapV1 {
     /// Confirm walk eval with the TAP.
-    pub const CONFIRM_TOOL_EVAL_FOR_WALK: &sui::MoveIdentStr =
-        sui::move_ident_str!("confirm_tool_eval_for_walk");
+    pub const CONFIRM_TOOL_EVAL_FOR_WALK: sui::types::Identifier =
+        sui::types::Identifier::from_static("confirm_tool_eval_for_walk");
     /// Get the TAP worksheet so that we can stamp it.
-    pub const WORKSHEET: &sui::MoveIdentStr = sui::move_ident_str!("worksheet");
+    pub const WORKSHEET: sui::types::Identifier = sui::types::Identifier::from_static("worksheet");
 }
diff --git a/sdk/src/idents/workflow.rs b/sdk/src/idents/workflow.rs
index 834891e8..c0db0df9 100644
--- a/sdk/src/idents/workflow.rs
+++ b/sdk/src/idents/workflow.rs
@@ -1,5 +1,5 @@
 use crate::{
-    idents::{sui_framework::Address, ModuleAndNameIdent},
+    idents::{pure_arg, sui_framework::Address, ModuleAndNameIdent},
     sui,
     types::{EdgeKind, RuntimeVertex},
     ToolFqn,
@@ -9,7 +9,8 @@ use crate::{
 
 pub struct DefaultTap;
 
-const DEFAULT_TAP_MODULE: &sui::MoveIdentStr = sui::move_ident_str!("default_tap");
+const DEFAULT_TAP_MODULE: sui::types::Identifier =
+    sui::types::Identifier::from_static("default_tap");
 
 impl DefaultTap {
     /// This function is called when a DAG is to be executed using the default
@@ -18,22 +19,219 @@ impl DefaultTap {
     /// `nexus_workflow::default_tap::begin_dag_execution`
     pub const BEGIN_DAG_EXECUTION: ModuleAndNameIdent = ModuleAndNameIdent {
         module: DEFAULT_TAP_MODULE,
-        name: sui::move_ident_str!("begin_dag_execution"),
+        name: sui::types::Identifier::from_static("begin_dag_execution"),
     };
-    /// The DefaultTap struct type.
+    /// The witness type needed to register DAG execution.
+    ///
+    /// `nexus_workflow::default_tap::BeginDagExecutionWitness`
+    pub const BEGIN_DAG_EXECUTION_WITNESS: ModuleAndNameIdent = ModuleAndNameIdent {
+        module: DEFAULT_TAP_MODULE,
+        name: sui::types::Identifier::from_static("BeginDagExecutionWitness"),
+    };
+    /// Scheduler entry point to invoke DAG execution via the default TAP.
+    ///
+    /// `nexus_workflow::default_tap::dag_begin_execution_from_scheduler`
+    pub const DAG_BEGIN_EXECUTION_FROM_SCHEDULER: ModuleAndNameIdent = ModuleAndNameIdent {
+        module: DEFAULT_TAP_MODULE,
+        name: sui::types::Identifier::from_static("dag_begin_execution_from_scheduler"),
+    };
+    /// The DefaultTAP struct type.
     ///
     /// `nexus_workflow::default_tap::DefaultTAP`
     pub const DEFAULT_TAP: ModuleAndNameIdent = ModuleAndNameIdent {
         module: DEFAULT_TAP_MODULE,
-        name: sui::move_ident_str!("DefaultTAP"),
+        name: sui::types::Identifier::from_static("DefaultTAP"),
+    };
+    /// Register DAG execution configuration on the execution policy.
+    ///
+    /// `nexus_workflow::default_tap::register_begin_execution`
+    pub const REGISTER_BEGIN_EXECUTION: ModuleAndNameIdent = ModuleAndNameIdent {
+        module: DEFAULT_TAP_MODULE,
+        name: sui::types::Identifier::from_static("register_begin_execution"),
     };
 }
 
+// == `nexus_workflow::scheduler` ==
+
+pub struct Scheduler;
+
+const SCHEDULER_MODULE: sui::types::Identifier = sui::types::Identifier::from_static("scheduler");
+
+impl Scheduler {
+    /// Enqueue a new occurrence for a task with explicit deadline.
+    ///
+    /// `nexus_workflow::scheduler::add_occurrence_absolute_for_task`
+    pub const ADD_OCCURRENCE_ABSOLUTE_FOR_TASK: ModuleAndNameIdent = ModuleAndNameIdent {
+        module: SCHEDULER_MODULE,
+        name: sui::types::Identifier::from_static("add_occurrence_absolute_for_task"),
+    };
+    /// Enqueue a new occurrence relative to the current time.
+    ///
+    /// `nexus_workflow::scheduler::add_occurrence_relative_for_task`
+    pub const ADD_OCCURRENCE_RELATIVE_FOR_TASK: ModuleAndNameIdent = ModuleAndNameIdent {
+        module: SCHEDULER_MODULE,
+        name: sui::types::Identifier::from_static("add_occurrence_relative_for_task"),
+    };
+    /// Cancel scheduling for a task.
+    ///
+    /// `nexus_workflow::scheduler::cancel_time_constraint_for_task`
+    pub const CANCEL_TIME_CONSTRAINT_FOR_TASK: ModuleAndNameIdent = ModuleAndNameIdent {
+        module: SCHEDULER_MODULE,
+        name: sui::types::Identifier::from_static("cancel_time_constraint_for_task"),
+    };
+    /// Run scheduler checks to consume the next periodic occurrence.
+    ///
+    /// `nexus_workflow::scheduler::check_periodic_occurrence`
+    pub const CHECK_PERIODIC_OCCURRENCE: ModuleAndNameIdent = ModuleAndNameIdent {
+        module: SCHEDULER_MODULE,
+        name: sui::types::Identifier::from_static("check_periodic_occurrence"),
+    };
+    /// Run scheduler checks to consume the next queue occurrence.
+    ///
+    /// `nexus_workflow::scheduler::check_queue_occurrence`
+    pub const CHECK_QUEUE_OCCURRENCE: ModuleAndNameIdent = ModuleAndNameIdent {
+        module: SCHEDULER_MODULE,
+        name: sui::types::Identifier::from_static("check_queue_occurrence"),
+    };
+    /// Disable periodic scheduling for a task.
+    ///
+    /// `nexus_workflow::scheduler::disable_periodic_for_task`
+    pub const DISABLE_PERIODIC_FOR_TASK: ModuleAndNameIdent = ModuleAndNameIdent {
+        module: SCHEDULER_MODULE,
+        name: sui::types::Identifier::from_static("disable_periodic_for_task"),
+    };
+    /// Execute the DAG witness advancing logic.
+    ///
+    /// `nexus_workflow::scheduler::execute`
+    pub const EXECUTE: ModuleAndNameIdent = ModuleAndNameIdent {
+        module: SCHEDULER_MODULE,
+        name: sui::types::Identifier::from_static("execute"),
+    };
+    /// Finalize a task run ensuring policies reached accepting states.
+    ///
+    /// `nexus_workflow::scheduler::finish`
+    pub const FINISH: ModuleAndNameIdent = ModuleAndNameIdent {
+        module: SCHEDULER_MODULE,
+        name: sui::types::Identifier::from_static("finish"),
+    };
+    /// Creates a new task with metadata and policies.
+    ///
+    /// `nexus_workflow::scheduler::new`
+    pub const NEW: ModuleAndNameIdent = ModuleAndNameIdent {
+        module: SCHEDULER_MODULE,
+        name: sui::types::Identifier::from_static("new"),
+    };
+    /// Creates the default constraints policy.
+    ///
+    /// `nexus_workflow::scheduler::new_constraints_policy`
+    pub const NEW_CONSTRAINTS_POLICY: ModuleAndNameIdent = ModuleAndNameIdent {
+        module: SCHEDULER_MODULE,
+        name: sui::types::Identifier::from_static("new_constraints_policy"),
+    };
+    /// Creates the default execution policy.
+    ///
+    /// `nexus_workflow::scheduler::new_execution_policy`
+    pub const NEW_EXECUTION_POLICY: ModuleAndNameIdent = ModuleAndNameIdent {
+        module: SCHEDULER_MODULE,
+        name: sui::types::Identifier::from_static("new_execution_policy"),
+    };
+    /// Creates a metadata container from key/value pairs.
+    ///
+    /// `nexus_workflow::scheduler::new_metadata`
+    pub const NEW_METADATA: ModuleAndNameIdent = ModuleAndNameIdent {
+        module: SCHEDULER_MODULE,
+        name: sui::types::Identifier::from_static("new_metadata"),
+    };
+    /// Configure or update periodic scheduling for a task.
+    ///
+    /// `nexus_workflow::scheduler::new_or_modify_periodic_for_task`
+    pub const NEW_OR_MODIFY_PERIODIC_FOR_TASK: ModuleAndNameIdent = ModuleAndNameIdent {
+        module: SCHEDULER_MODULE,
+        name: sui::types::Identifier::from_static("new_or_modify_periodic_for_task"),
+    };
+    /// Create a periodic generator state.
+    ///
+    /// `nexus_workflow::scheduler::new_periodic_generator_state`
+    pub const NEW_PERIODIC_GENERATOR_STATE: ModuleAndNameIdent = ModuleAndNameIdent {
+        module: SCHEDULER_MODULE,
+        name: sui::types::Identifier::from_static("new_periodic_generator_state"),
+    };
+    /// Create a queue generator state.
+    ///
+    /// `nexus_workflow::scheduler::new_queue_generator_state`
+    pub const NEW_QUEUE_GENERATOR_STATE: ModuleAndNameIdent = ModuleAndNameIdent {
+        module: SCHEDULER_MODULE,
+        name: sui::types::Identifier::from_static("new_queue_generator_state"),
+    };
+    /// Pause the scheduler for a task.
+    ///
+    /// `nexus_workflow::scheduler::pause_time_constraint_for_task`
+    pub const PAUSE_TIME_CONSTRAINT_FOR_TASK: ModuleAndNameIdent = ModuleAndNameIdent {
+        module: SCHEDULER_MODULE,
+        name: sui::types::Identifier::from_static("pause_time_constraint_for_task"),
+    };
+    /// Witness type registered for periodic generators.
+    ///
+    /// `nexus_workflow::scheduler::PeriodicGeneratorWitness`
+    pub const PERIODIC_GENERATOR_WITNESS: ModuleAndNameIdent = ModuleAndNameIdent {
+        module: SCHEDULER_MODULE,
+        name: sui::types::Identifier::from_static("PeriodicGeneratorWitness"),
+    };
+    /// Witness type registered for queue-based generators.
+    ///
+    /// `nexus_workflow::scheduler::QueueGeneratorWitness`
+    pub const QUEUE_GENERATOR_WITNESS: ModuleAndNameIdent = ModuleAndNameIdent {
+        module: SCHEDULER_MODULE,
+        name: sui::types::Identifier::from_static("QueueGeneratorWitness"),
+    };
+    /// Register the periodic generator state on the constraints policy.
+    ///
+    /// `nexus_workflow::scheduler::register_periodic_generator`
+    pub const REGISTER_PERIODIC_GENERATOR: ModuleAndNameIdent = ModuleAndNameIdent {
+        module: SCHEDULER_MODULE,
+        name: sui::types::Identifier::from_static("register_periodic_generator"),
+    };
+    /// Register the queue generator state on the constraints policy.
+    ///
+    /// `nexus_workflow::scheduler::register_queue_generator`
+    pub const REGISTER_QUEUE_GENERATOR: ModuleAndNameIdent = ModuleAndNameIdent {
+        module: SCHEDULER_MODULE,
+        name: sui::types::Identifier::from_static("register_queue_generator"),
+    };
+    /// Resume the scheduler for a task.
+    ///
+    /// `nexus_workflow::scheduler::resume_time_constraint_for_task`
+    pub const RESUME_TIME_CONSTRAINT_FOR_TASK: ModuleAndNameIdent = ModuleAndNameIdent {
+        module: SCHEDULER_MODULE,
+        name: sui::types::Identifier::from_static("resume_time_constraint_for_task"),
+    };
+    /// The Task struct type. Mostly used for creating generic types.
+    ///
+    /// `nexus_workflow::scheduler::Task`
+    pub const TASK: ModuleAndNameIdent = ModuleAndNameIdent {
+        module: SCHEDULER_MODULE,
+        name: sui::types::Identifier::from_static("Task"),
+    };
+    /// The TimeConstraint struct type.
+    ///
+    /// `nexus_workflow::scheduler::TimeConstraint`
+    pub const TIME_CONSTRAINT: ModuleAndNameIdent = ModuleAndNameIdent {
+        module: SCHEDULER_MODULE,
+        name: sui::types::Identifier::from_static("TimeConstraint"),
+    };
+    /// Updates task metadata with the provided values.
+    ///
+    /// `nexus_workflow::scheduler::update_metadata`
+    pub const UPDATE_METADATA: ModuleAndNameIdent = ModuleAndNameIdent {
+        module: SCHEDULER_MODULE,
+        name: sui::types::Identifier::from_static("update_metadata"),
+    };
+}
 // == `nexus_workflow::dag` ==
 
 pub struct Dag;
 
-const DAG_MODULE: &sui::MoveIdentStr = sui::move_ident_str!("dag");
+const DAG_MODULE: sui::types::Identifier = sui::types::Identifier::from_static("dag");
 
 impl Dag {
     /// The DAG struct. Mostly used for creating generic types.
@@ -41,147 +239,154 @@ impl Dag {
     /// `nexus_workflow::dag::DAG`
     pub const DAG: ModuleAndNameIdent = ModuleAndNameIdent {
         module: DAG_MODULE,
-        name: sui::move_ident_str!("DAG"),
+        name: sui::types::Identifier::from_static("DAG"),
     };
     /// The DAGExecution struct. Mostly used for creating generic types.
     ///
     /// `nexus_workflow::dag::DAGExecution`
     pub const DAG_EXECUTION: ModuleAndNameIdent = ModuleAndNameIdent {
         module: DAG_MODULE,
-        name: sui::move_ident_str!("DAGExecution"),
+        name: sui::types::Identifier::from_static("DAGExecution"),
     };
     /// Create a break edge kind.
     ///
     /// `nexus_workflow::dag::edge_kind_break`
     pub const EDGE_KIND_BREAK: ModuleAndNameIdent = ModuleAndNameIdent {
         module: DAG_MODULE,
-        name: sui::move_ident_str!("edge_kind_break"),
+        name: sui::types::Identifier::from_static("edge_kind_break"),
     };
     /// Create a collect edge kind.
     ///
     /// `nexus_workflow::dag::edge_kind_collect`
     pub const EDGE_KIND_COLLECT: ModuleAndNameIdent = ModuleAndNameIdent {
         module: DAG_MODULE,
-        name: sui::move_ident_str!("edge_kind_collect"),
+        name: sui::types::Identifier::from_static("edge_kind_collect"),
     };
     /// Create a do-while edge kind.
     ///
     /// `nexus_workflow::dag::edge_kind_do_while`
     pub const EDGE_KIND_DO_WHILE: ModuleAndNameIdent = ModuleAndNameIdent {
         module: DAG_MODULE,
-        name: sui::move_ident_str!("edge_kind_do_while"),
+        name: sui::types::Identifier::from_static("edge_kind_do_while"),
     };
     /// Create a for-each edge kind.
     ///
     /// `nexus_workflow::dag::edge_kind_for_each`
     pub const EDGE_KIND_FOR_EACH: ModuleAndNameIdent = ModuleAndNameIdent {
         module: DAG_MODULE,
-        name: sui::move_ident_str!("edge_kind_for_each"),
+        name: sui::types::Identifier::from_static("edge_kind_for_each"),
     };
     /// Create a normal edge kind.
     ///
     /// `nexus_workflow::dag::edge_kind_normal`
     pub const EDGE_KIND_NORMAL: ModuleAndNameIdent = ModuleAndNameIdent {
         module: DAG_MODULE,
-        name: sui::move_ident_str!("edge_kind_normal"),
+        name: sui::types::Identifier::from_static("edge_kind_normal"),
     };
     /// Create an encrypted InputPort from an ASCII string.
     ///
     /// `nexus_workflow::dag::encrypted_input_port_from_string`
     pub const ENCRYPTED_INPUT_PORT_FROM_STRING: ModuleAndNameIdent = ModuleAndNameIdent {
         module: DAG_MODULE,
-        name: sui::move_ident_str!("encrypted_input_port_from_string"),
+        name: sui::types::Identifier::from_static("encrypted_input_port_from_string"),
     };
     /// The EntryGroup struct. Mostly used for creating generic types.
     ///
     /// `nexus_workflow::dag::EntryGroup`
     pub const ENTRY_GROUP: ModuleAndNameIdent = ModuleAndNameIdent {
         module: DAG_MODULE,
-        name: sui::move_ident_str!("EntryGroup"),
+        name: sui::types::Identifier::from_static("EntryGroup"),
     };
     /// Create an EntryGroup from an ASCII string.
     ///
     /// `nexus_workflow::dag::entry_group_from_string`
     pub const ENTRY_GROUP_FROM_STRING: ModuleAndNameIdent = ModuleAndNameIdent {
         module: DAG_MODULE,
-        name: sui::move_ident_str!("entry_group_from_string"),
+        name: sui::types::Identifier::from_static("entry_group_from_string"),
     };
     /// The InputPort struct. Mostly used for creating generic types.
     ///
     /// `nexus_workflow::dag::InputPort`
     pub const INPUT_PORT: ModuleAndNameIdent = ModuleAndNameIdent {
         module: DAG_MODULE,
-        name: sui::move_ident_str!("InputPort"),
+        name: sui::types::Identifier::from_static("InputPort"),
     };
     /// Create an InputPort from an ASCII string.
     ///
     /// `nexus_workflow::dag::input_port_from_string`
     pub const INPUT_PORT_FROM_STRING: ModuleAndNameIdent = ModuleAndNameIdent {
         module: DAG_MODULE,
-        name: sui::move_ident_str!("input_port_from_string"),
+        name: sui::types::Identifier::from_static("input_port_from_string"),
     };
     /// Create a new DAG object.
     ///
     /// `nexus_workflow::dag::new`
     pub const NEW: ModuleAndNameIdent = ModuleAndNameIdent {
         module: DAG_MODULE,
-        name: sui::move_ident_str!("new"),
+        name: sui::types::Identifier::from_static("new"),
+    };
+    /// Create a new DAG execution config value.
+    ///
+    /// `nexus_workflow::dag::new_dag_execution_config`
+    pub const NEW_DAG_EXECUTION_CONFIG: ModuleAndNameIdent = ModuleAndNameIdent {
+        module: DAG_MODULE,
+        name: sui::types::Identifier::from_static("new_dag_execution_config"),
     };
     /// The OutputPort struct. Mostly used for creating generic types.
     ///
     /// `nexus_workflow::dag::OutputPort`
     pub const OUTPUT_PORT: ModuleAndNameIdent = ModuleAndNameIdent {
         module: DAG_MODULE,
-        name: sui::move_ident_str!("OutputPort"),
+        name: sui::types::Identifier::from_static("OutputPort"),
     };
     /// Create an OutputPort from an ASCII string.
     ///
     /// `nexus_workflow::dag::output_port_from_string`
     pub const OUTPUT_PORT_FROM_STRING: ModuleAndNameIdent = ModuleAndNameIdent {
         module: DAG_MODULE,
-        name: sui::move_ident_str!("output_port_from_string"),
+        name: sui::types::Identifier::from_static("output_port_from_string"),
     };
     /// The OutputVariant struct. Mostly used for creating generic types.
     ///
     /// `nexus_workflow::dag::OutputVariant`
     pub const OUTPUT_VARIANT: ModuleAndNameIdent = ModuleAndNameIdent {
         module: DAG_MODULE,
-        name: sui::move_ident_str!("OutputVariant"),
+        name: sui::types::Identifier::from_static("OutputVariant"),
     };
     /// Create an OutputVariant from an ASCII string.
     ///
     /// `nexus_workflow::dag::output_variant_from_string`
     pub const OUTPUT_VARIANT_FROM_STRING: ModuleAndNameIdent = ModuleAndNameIdent {
         module: DAG_MODULE,
-        name: sui::move_ident_str!("output_variant_from_string"),
+        name: sui::types::Identifier::from_static("output_variant_from_string"),
     };
     /// Function to call to continue to the next vertex in the given walk.
     ///
     /// `nexus_workflow::dag::request_network_to_execute_walks`
     pub const REQUEST_NETWORK_TO_EXECUTE_WALKS: ModuleAndNameIdent = ModuleAndNameIdent {
         module: DAG_MODULE,
-        name: sui::move_ident_str!("request_network_to_execute_walks"),
+        name: sui::types::Identifier::from_static("request_network_to_execute_walks"),
     };
     /// Returns a new hot potato object RequestWalkExecution.
     ///
     /// `nexus_workflow::dag::request_walk_execution`
     pub const REQUEST_WALK_EXECUTION: ModuleAndNameIdent = ModuleAndNameIdent {
         module: DAG_MODULE,
-        name: sui::move_ident_str!("request_walk_execution"),
+        name: sui::types::Identifier::from_static("request_walk_execution"),
     };
     /// Create a `RuntimeVertex::Plain` from a string.
     ///
     /// `nexus_workflow::dag::runtime_vertex_plain_from_string`
     pub const RUNTIME_VERTEX_PLAIN_FROM_STRING: ModuleAndNameIdent = ModuleAndNameIdent {
         module: DAG_MODULE,
-        name: sui::move_ident_str!("runtime_vertex_plain_from_string"),
+        name: sui::types::Identifier::from_static("runtime_vertex_plain_from_string"),
     };
     /// Create a `RuntimeVertex::WithIterator` from a string.
     ///
     /// `nexus_workflow::dag::runtime_vertex_with_iterator_from_string`
     pub const RUNTIME_VERTEX_WITH_ITERATOR_FROM_STRING: ModuleAndNameIdent = ModuleAndNameIdent {
         module: DAG_MODULE,
-        name: sui::move_ident_str!("runtime_vertex_with_iterator_from_string"),
+        name: sui::types::Identifier::from_static("runtime_vertex_with_iterator_from_string"),
     };
     /// One of the functions to call when an off-chain tool is evaluated to submit
     /// its result to the workflow.
@@ -189,7 +394,7 @@ impl Dag {
     /// `nexus_workflow::dag::submit_off_chain_tool_eval_for_walk`
     pub const SUBMIT_OFF_CHAIN_TOOL_EVAL_FOR_WALK: ModuleAndNameIdent = ModuleAndNameIdent {
         module: DAG_MODULE,
-        name: sui::move_ident_str!("submit_off_chain_tool_eval_for_walk"),
+        name: sui::types::Identifier::from_static("submit_off_chain_tool_eval_for_walk"),
     };
     /// One of the functions to call when an on-chain tool is evaluated to submit
     /// its result to the workflow.
@@ -198,28 +403,35 @@ impl Dag {
     // TODO: <https://github.com/Talus-Network/nexus-next/issues/30>
     pub const SUBMIT_ON_CHAIN_TOOL_EVAL_FOR_WALK: ModuleAndNameIdent = ModuleAndNameIdent {
         module: DAG_MODULE,
-        name: sui::move_ident_str!("submit_on_chain_tool_eval_for_walk"),
+        name: sui::types::Identifier::from_static("submit_on_chain_tool_eval_for_walk"),
     };
     /// The Vertex struct. Mostly used for creating generic types.
     ///
     /// `nexus_workflow::dag::Vertex`
     pub const VERTEX: ModuleAndNameIdent = ModuleAndNameIdent {
         module: DAG_MODULE,
-        name: sui::move_ident_str!("Vertex"),
+        name: sui::types::Identifier::from_static("Vertex"),
     };
     /// Create a Vertex from an ASCII string.
     ///
     /// `nexus_workflow::dag::vertex_from_string`
     pub const VERTEX_FROM_STRING: ModuleAndNameIdent = ModuleAndNameIdent {
         module: DAG_MODULE,
-        name: sui::move_ident_str!("vertex_from_string"),
+        name: sui::types::Identifier::from_static("vertex_from_string"),
     };
     /// Create a new off-chain NodeIdent from an ASCII string.
     ///
     /// `nexus_workflow::dag::vertex_off_chain`
     pub const VERTEX_OFF_CHAIN: ModuleAndNameIdent = ModuleAndNameIdent {
         module: DAG_MODULE,
-        name: sui::move_ident_str!("vertex_off_chain"),
+        name: sui::types::Identifier::from_static("vertex_off_chain"),
+    };
+    /// Create a new onchain NodeIdent from an ASCII string.
+    ///
+    /// `nexus_workflow::dag::vertex_on_chain`
+    pub const VERTEX_ON_CHAIN: ModuleAndNameIdent = ModuleAndNameIdent {
+        module: DAG_MODULE,
+        name: sui::types::Identifier::from_static("vertex_on_chain"),
     };
     /// Add a default value to a DAG. Default value is a Vertex + InputPort pair
     /// with NexusData as the value.
@@ -227,42 +439,42 @@ impl Dag {
     /// `nexus_workflow::dag::with_default_value`
     pub const WITH_DEFAULT_VALUE: ModuleAndNameIdent = ModuleAndNameIdent {
         module: DAG_MODULE,
-        name: sui::move_ident_str!("with_default_value"),
+        name: sui::types::Identifier::from_static("with_default_value"),
     };
     /// Add an Edge to a DAG.
     ///
     /// `nexus_workflow::dag::with_edge`
     pub const WITH_EDGE: ModuleAndNameIdent = ModuleAndNameIdent {
         module: DAG_MODULE,
-        name: sui::move_ident_str!("with_edge"),
+        name: sui::types::Identifier::from_static("with_edge"),
     };
     /// Add an encrypted Edge to a DAG.
     ///
     /// `nexus_workflow::dag::with_encrypted_edge`
     pub const WITH_ENCRYPTED_EDGE: ModuleAndNameIdent = ModuleAndNameIdent {
         module: DAG_MODULE,
-        name: sui::move_ident_str!("with_encrypted_edge"),
+        name: sui::types::Identifier::from_static("with_encrypted_edge"),
     };
     /// Add an encrypted output to a DAG.
     ///
     /// `nexus_workflow::dag::with_encrypted_output`
     pub const WITH_ENCRYPTED_OUTPUT: ModuleAndNameIdent = ModuleAndNameIdent {
         module: DAG_MODULE,
-        name: sui::move_ident_str!("with_encrypted_output"),
+        name: sui::types::Identifier::from_static("with_encrypted_output"),
     };
     /// Mark a vertex as an entry vertex and assign it to a group.
     ///
     /// `nexus_workflow::dag::with_entry_in_group`
     pub const WITH_ENTRY_IN_GROUP: ModuleAndNameIdent = ModuleAndNameIdent {
         module: DAG_MODULE,
-        name: sui::move_ident_str!("with_entry_in_group"),
+        name: sui::types::Identifier::from_static("with_entry_in_group"),
     };
     /// Add an input port as an entry input port and assign it to a group.
     ///
     /// `nexus_workflow::dag::with_entry_port_in_group`
     pub const WITH_ENTRY_PORT_IN_GROUP: ModuleAndNameIdent = ModuleAndNameIdent {
         module: DAG_MODULE,
-        name: sui::move_ident_str!("with_entry_port_in_group"),
+        name: sui::types::Identifier::from_static("with_entry_port_in_group"),
     };
     /// Add an entry vertex to a DAG. Entry vertex is just a Vertex with its
     /// required InputPorts specified.
@@ -270,148 +482,196 @@ impl Dag {
     /// `nexus_workflow::dag::with_entry_vertex`
     pub const WITH_ENTRY_VERTEX: ModuleAndNameIdent = ModuleAndNameIdent {
         module: DAG_MODULE,
-        name: sui::move_ident_str!("with_entry_vertex"),
+        name: sui::types::Identifier::from_static("with_entry_vertex"),
     };
     /// Add an output to a DAG.
     ///
     /// `nexus_workflow::dag::with_output`
     pub const WITH_OUTPUT: ModuleAndNameIdent = ModuleAndNameIdent {
         module: DAG_MODULE,
-        name: sui::move_ident_str!("with_output"),
+        name: sui::types::Identifier::from_static("with_output"),
     };
     /// Add a Vertex to a DAG.
     ///
     /// `nexus_workflow::dag::with_vertex`
     pub const WITH_VERTEX: ModuleAndNameIdent = ModuleAndNameIdent {
         module: DAG_MODULE,
-        name: sui::move_ident_str!("with_vertex"),
+        name: sui::types::Identifier::from_static("with_vertex"),
     };
 
     /// Create an EntryGroup from a string.
     pub fn entry_group_from_str<T: AsRef<str>>(
-        tx: &mut sui::ProgrammableTransactionBuilder,
-        workflow_pkg_id: sui::ObjectID,
+        tx: &mut sui::tx::TransactionBuilder,
+        workflow_pkg_id: sui::types::Address,
         str: T,
-    ) -> anyhow::Result<sui::Argument> {
+    ) -> anyhow::Result<sui::types::Argument> {
         let str = super::move_std::Ascii::ascii_string_from_str(tx, str)?;
 
-        Ok(tx.programmable_move_call(
-            workflow_pkg_id,
-            Self::ENTRY_GROUP_FROM_STRING.module.into(),
-            Self::ENTRY_GROUP_FROM_STRING.name.into(),
-            vec![],
+        Ok(tx.move_call(
+            sui::tx::Function::new(
+                workflow_pkg_id,
+                Self::ENTRY_GROUP_FROM_STRING.module,
+                Self::ENTRY_GROUP_FROM_STRING.name,
+                vec![],
+            ),
             vec![str],
         ))
     }
 
     /// Create an InputPort from a string.
     pub fn input_port_from_str<T: AsRef<str>>(
-        tx: &mut sui::ProgrammableTransactionBuilder,
-        workflow_pkg_id: sui::ObjectID,
+        tx: &mut sui::tx::TransactionBuilder,
+        workflow_pkg_id: sui::types::Address,
         str: T,
-    ) -> anyhow::Result<sui::Argument> {
+    ) -> anyhow::Result<sui::types::Argument> {
         let str = super::move_std::Ascii::ascii_string_from_str(tx, str)?;
 
-        Ok(tx.programmable_move_call(
-            workflow_pkg_id,
-            Self::INPUT_PORT_FROM_STRING.module.into(),
-            Self::INPUT_PORT_FROM_STRING.name.into(),
-            vec![],
+        Ok(tx.move_call(
+            sui::tx::Function::new(
+                workflow_pkg_id,
+                Self::INPUT_PORT_FROM_STRING.module,
+                Self::INPUT_PORT_FROM_STRING.name,
+                vec![],
+            ),
             vec![str],
         ))
     }
 
     /// Create an encrypted InputPort from a string.
     pub fn encrypted_input_port_from_str<T: AsRef<str>>(
-        tx: &mut sui::ProgrammableTransactionBuilder,
-        workflow_pkg_id: sui::ObjectID,
+        tx: &mut sui::tx::TransactionBuilder,
+        workflow_pkg_id: sui::types::Address,
         str: T,
-    ) -> anyhow::Result<sui::Argument> {
+    ) -> anyhow::Result<sui::types::Argument> {
         let str = super::move_std::Ascii::ascii_string_from_str(tx, str)?;
 
-        Ok(tx.programmable_move_call(
-            workflow_pkg_id,
-            Self::ENCRYPTED_INPUT_PORT_FROM_STRING.module.into(),
-            Self::ENCRYPTED_INPUT_PORT_FROM_STRING.name.into(),
-            vec![],
+        Ok(tx.move_call(
+            sui::tx::Function::new(
+                workflow_pkg_id,
+                Self::ENCRYPTED_INPUT_PORT_FROM_STRING.module,
+                Self::ENCRYPTED_INPUT_PORT_FROM_STRING.name,
+                vec![],
+            ),
             vec![str],
         ))
     }
 
     /// Create an OutputPort from a string.
     pub fn output_port_from_str<T: AsRef<str>>(
-        tx: &mut sui::ProgrammableTransactionBuilder,
-        workflow_pkg_id: sui::ObjectID,
+        tx: &mut sui::tx::TransactionBuilder,
+        workflow_pkg_id: sui::types::Address,
         str: T,
-    ) -> anyhow::Result<sui::Argument> {
+    ) -> anyhow::Result<sui::types::Argument> {
         let str = super::move_std::Ascii::ascii_string_from_str(tx, str)?;
 
-        Ok(tx.programmable_move_call(
-            workflow_pkg_id,
-            Self::OUTPUT_PORT_FROM_STRING.module.into(),
-            Self::OUTPUT_PORT_FROM_STRING.name.into(),
-            vec![],
+        Ok(tx.move_call(
+            sui::tx::Function::new(
+                workflow_pkg_id,
+                Self::OUTPUT_PORT_FROM_STRING.module,
+                Self::OUTPUT_PORT_FROM_STRING.name,
+                vec![],
+            ),
             vec![str],
         ))
     }
 
     /// Create an OutputVariant from a string.
     pub fn output_variant_from_str<T: AsRef<str>>(
-        tx: &mut sui::ProgrammableTransactionBuilder,
-        workflow_pkg_id: sui::ObjectID,
+        tx: &mut sui::tx::TransactionBuilder,
+        workflow_pkg_id: sui::types::Address,
         str: T,
-    ) -> anyhow::Result<sui::Argument> {
+    ) -> anyhow::Result<sui::types::Argument> {
         let str = super::move_std::Ascii::ascii_string_from_str(tx, str)?;
 
-        Ok(tx.programmable_move_call(
-            workflow_pkg_id,
-            Self::OUTPUT_VARIANT_FROM_STRING.module.into(),
-            Self::OUTPUT_VARIANT_FROM_STRING.name.into(),
-            vec![],
+        Ok(tx.move_call(
+            sui::tx::Function::new(
+                workflow_pkg_id,
+                Self::OUTPUT_VARIANT_FROM_STRING.module,
+                Self::OUTPUT_VARIANT_FROM_STRING.name,
+                vec![],
+            ),
             vec![str],
         ))
     }
 
     /// Create a Vertex from a string.
     pub fn vertex_from_str<T: AsRef<str>>(
-        tx: &mut sui::ProgrammableTransactionBuilder,
-        workflow_pkg_id: sui::ObjectID,
+        tx: &mut sui::tx::TransactionBuilder,
+        workflow_pkg_id: sui::types::Address,
         str: T,
-    ) -> anyhow::Result<sui::Argument> {
+    ) -> anyhow::Result<sui::types::Argument> {
         let str = super::move_std::Ascii::ascii_string_from_str(tx, str)?;
 
-        Ok(tx.programmable_move_call(
-            workflow_pkg_id,
-            Self::VERTEX_FROM_STRING.module.into(),
-            Self::VERTEX_FROM_STRING.name.into(),
-            vec![],
+        Ok(tx.move_call(
+            sui::tx::Function::new(
+                workflow_pkg_id,
+                Self::VERTEX_FROM_STRING.module,
+                Self::VERTEX_FROM_STRING.name,
+                vec![],
+            ),
             vec![str],
         ))
     }
 
     /// Create a new off-chain NodeIdent from a string.
     pub fn off_chain_vertex_kind_from_fqn(
-        tx: &mut sui::ProgrammableTransactionBuilder,
-        workflow_pkg_id: sui::ObjectID,
+        tx: &mut sui::tx::TransactionBuilder,
+        workflow_pkg_id: sui::types::Address,
         fqn: &ToolFqn,
-    ) -> anyhow::Result<sui::Argument> {
+    ) -> anyhow::Result<sui::types::Argument> {
         let str = super::move_std::Ascii::ascii_string_from_str(tx, fqn.to_string())?;
 
-        Ok(tx.programmable_move_call(
-            workflow_pkg_id,
-            Self::VERTEX_OFF_CHAIN.module.into(),
-            Self::VERTEX_OFF_CHAIN.name.into(),
-            vec![],
+        Ok(tx.move_call(
+            sui::tx::Function::new(
+                workflow_pkg_id,
+                Self::VERTEX_OFF_CHAIN.module,
+                Self::VERTEX_OFF_CHAIN.name,
+                vec![],
+            ),
             vec![str],
         ))
     }
 
+    pub fn on_chain_vertex_kind_from_fqn(
+        tx: &mut sui::tx::TransactionBuilder,
+        workflow_pkg_id: sui::types::Address,
+        tool_registry_id: &sui::types::ObjectReference,
+        fqn: &ToolFqn,
+    ) -> anyhow::Result<sui::types::Argument> {
+        let str = super::move_std::Ascii::ascii_string_from_str(tx, fqn.to_string())?;
+        let tool_registry_id = tx.input(sui::tx::Input::shared(
+            *tool_registry_id.object_id(),
+            tool_registry_id.version(),
+            false,
+        ));
+
+        let witness_id = tx.move_call(
+            sui::tx::Function::new(
+                workflow_pkg_id,
+                ToolRegistry::ONCHAIN_TOOL_WITNESS_ID.module,
+                ToolRegistry::ONCHAIN_TOOL_WITNESS_ID.name,
+                vec![],
+            ),
+            vec![tool_registry_id, str],
+        );
+
+        Ok(tx.move_call(
+            sui::tx::Function::new(
+                workflow_pkg_id,
+                Self::VERTEX_ON_CHAIN.module,
+                Self::VERTEX_ON_CHAIN.name,
+                vec![],
+            ),
+            vec![str, witness_id],
+        ))
+    }
+
     /// Create an edge kind from an enum variant.
     pub fn edge_kind_from_enum(
-        tx: &mut sui::ProgrammableTransactionBuilder,
-        workflow_pkg_id: sui::ObjectID,
+        tx: &mut sui::tx::TransactionBuilder,
+        workflow_pkg_id: sui::types::Address,
         edge_kind: &EdgeKind,
-    ) -> sui::Argument {
+    ) -> sui::types::Argument {
         let ident = match edge_kind {
             EdgeKind::Normal => Self::EDGE_KIND_NORMAL,
             EdgeKind::ForEach => Self::EDGE_KIND_FOR_EACH,
@@ -420,30 +680,29 @@ impl Dag {
             EdgeKind::Break => Self::EDGE_KIND_BREAK,
         };
 
-        tx.programmable_move_call(
-            workflow_pkg_id,
-            ident.module.into(),
-            ident.name.into(),
-            vec![],
+        tx.move_call(
+            sui::tx::Function::new(workflow_pkg_id, ident.module, ident.name, vec![]),
             vec![],
         )
     }
 
     /// Create a runtime vertex from an enum variant
     pub fn runtime_vertex_from_enum(
-        tx: &mut sui::ProgrammableTransactionBuilder,
-        workflow_pkg_id: sui::ObjectID,
+        tx: &mut sui::tx::TransactionBuilder,
+        workflow_pkg_id: sui::types::Address,
         runtime_vertex: &RuntimeVertex,
-    ) -> anyhow::Result<sui::Argument> {
+    ) -> anyhow::Result<sui::types::Argument> {
         match runtime_vertex {
             RuntimeVertex::Plain { vertex } => {
                 let name = super::move_std::Ascii::ascii_string_from_str(tx, &vertex.name)?;
 
-                Ok(tx.programmable_move_call(
-                    workflow_pkg_id,
-                    Self::RUNTIME_VERTEX_PLAIN_FROM_STRING.module.into(),
-                    Self::RUNTIME_VERTEX_PLAIN_FROM_STRING.name.into(),
-                    vec![],
+                Ok(tx.move_call(
+                    sui::tx::Function::new(
+                        workflow_pkg_id,
+                        Self::RUNTIME_VERTEX_PLAIN_FROM_STRING.module,
+                        Self::RUNTIME_VERTEX_PLAIN_FROM_STRING.name,
+                        vec![],
+                    ),
                     vec![name],
                 ))
             }
@@ -453,14 +712,17 @@ impl Dag {
                 out_of,
             } => {
                 let name = super::move_std::Ascii::ascii_string_from_str(tx, &vertex.name)?;
-                let iteration = tx.pure(*iteration)?;
-                let out_of = tx.pure(*out_of)?;
-
-                Ok(tx.programmable_move_call(
-                    workflow_pkg_id,
-                    Self::RUNTIME_VERTEX_WITH_ITERATOR_FROM_STRING.module.into(),
-                    Self::RUNTIME_VERTEX_WITH_ITERATOR_FROM_STRING.name.into(),
-                    vec![],
+
+                let iteration = tx.input(pure_arg(iteration)?);
+                let out_of = tx.input(pure_arg(out_of)?);
+
+                Ok(tx.move_call(
+                    sui::tx::Function::new(
+                        workflow_pkg_id,
+                        Self::RUNTIME_VERTEX_WITH_ITERATOR_FROM_STRING.module,
+                        Self::RUNTIME_VERTEX_WITH_ITERATOR_FROM_STRING.name,
+                        vec![],
+                    ),
                     vec![name, iteration, out_of],
                 ))
             }
@@ -468,11 +730,29 @@ impl Dag {
     }
 }
 
+// == `nexus_workflow::tool_output` ==
+
+pub struct ToolOutput;
+
+const TOOL_OUTPUT_MODULE: sui::types::Identifier =
+    sui::types::Identifier::from_static("tool_output");
+
+impl ToolOutput {
+    /// Convert ToolOutput to DAG types.
+    ///
+    /// `nexus_workflow::tool_output::to_dag_types`
+    pub const TO_DAG_TYPES: ModuleAndNameIdent = ModuleAndNameIdent {
+        module: TOOL_OUTPUT_MODULE,
+        name: sui::types::Identifier::from_static("to_dag_types"),
+    };
+}
+
 // == `nexus_workflow::tool_registry` ==
 
 pub struct ToolRegistry;
 
-const TOOL_REGISTRY_MODULE: &sui::MoveIdentStr = sui::move_ident_str!("tool_registry");
+const TOOL_REGISTRY_MODULE: sui::types::Identifier =
+    sui::types::Identifier::from_static("tool_registry");
 
 impl ToolRegistry {
     /// Add an address to the allowlist for tool registration.
@@ -481,43 +761,49 @@ impl ToolRegistry {
     /// `nexus_workflow::tool_registry::add_allowed_owner`
     pub const ADD_ALLOWED_OWNER: ModuleAndNameIdent = ModuleAndNameIdent {
         module: TOOL_REGISTRY_MODULE,
-        name: sui::move_ident_str!("add_allowed_owner"),
+        name: sui::types::Identifier::from_static("add_allowed_owner"),
     };
     /// Claim collateral for a tool and transfer the balance to the tx sender.
     ///
     /// `nexus_workflow::tool_registry::claim_collateral_for_self`
     pub const CLAIM_COLLATERAL_FOR_SELF: ModuleAndNameIdent = ModuleAndNameIdent {
         module: TOOL_REGISTRY_MODULE,
-        name: sui::move_ident_str!("claim_collateral_for_self"),
+        name: sui::types::Identifier::from_static("claim_collateral_for_self"),
     };
     /// Claim collateral for a tool. The function call returns Balance<SUI>.
     ///
     /// `nexus_workflow::tool_registry::claim_collateral_for_tool`
     pub const CLAIM_COLLATERAL_FOR_TOOL: ModuleAndNameIdent = ModuleAndNameIdent {
         module: TOOL_REGISTRY_MODULE,
-        // TODO: This will likely be renamed to `claim_collateral_for_tool`.
-        name: sui::move_ident_str!("claim_collateral_for_off_chain_tool"),
+        name: sui::types::Identifier::from_static("claim_collateral_for_tool"),
+    };
+    /// Get the witness ID for an onchain tool.
+    ///
+    /// `nexus_workflow::tool_registry::onchain_tool_witness_id`
+    pub const ONCHAIN_TOOL_WITNESS_ID: ModuleAndNameIdent = ModuleAndNameIdent {
+        module: TOOL_REGISTRY_MODULE,
+        name: sui::types::Identifier::from_static("onchain_tool_witness_id"),
     };
     /// OverSlashing struct type. Used to fetch caps for slashing tools.
     ///
     /// `nexus_workflow::tool_registry::OverSlashing`
     pub const OVER_SLASHING: ModuleAndNameIdent = ModuleAndNameIdent {
         module: TOOL_REGISTRY_MODULE,
-        name: sui::move_ident_str!("OverSlashing"),
+        name: sui::types::Identifier::from_static("OverSlashing"),
     };
     /// OverTool struct type. Used for fetching tool owner caps.
     ///
     /// `nexus_workflow::tool_registry::OverTool`
     pub const OVER_TOOL: ModuleAndNameIdent = ModuleAndNameIdent {
         module: TOOL_REGISTRY_MODULE,
-        name: sui::move_ident_str!("OverTool"),
+        name: sui::types::Identifier::from_static("OverTool"),
     };
     /// Register an off-chain tool. This returns the tool's owner cap.
     ///
     /// `nexus_workflow::tool_registry::register_off_chain_tool`
     pub const REGISTER_OFF_CHAIN_TOOL: ModuleAndNameIdent = ModuleAndNameIdent {
         module: TOOL_REGISTRY_MODULE,
-        name: sui::move_ident_str!("register_off_chain_tool"),
+        name: sui::types::Identifier::from_static("register_off_chain_tool"),
     };
     /// Register an off-chain tool and transfer the tool's owner cap to the ctx
     /// sender.
@@ -525,7 +811,22 @@ impl ToolRegistry {
     /// `nexus_workflow::tool_registry::register_off_chain_tool_for_self`
     pub const REGISTER_OFF_CHAIN_TOOL_FOR_SELF: ModuleAndNameIdent = ModuleAndNameIdent {
         module: TOOL_REGISTRY_MODULE,
-        name: sui::move_ident_str!("register_off_chain_tool_for_self"),
+        name: sui::types::Identifier::from_static("register_off_chain_tool_for_self"),
+    };
+    /// Register an on-chain tool. This returns the tool's owner cap.
+    ///
+    /// `nexus_workflow::tool_registry::register_on_chain_tool`
+    pub const REGISTER_ON_CHAIN_TOOL: ModuleAndNameIdent = ModuleAndNameIdent {
+        module: TOOL_REGISTRY_MODULE,
+        name: sui::types::Identifier::from_static("register_on_chain_tool"),
+    };
+    /// Register an on-chain tool and transfer the tool's owner cap to the ctx
+    /// sender.
+    ///
+    /// `nexus_workflow::tool_registry::register_on_chain_tool_for_self`
+    pub const REGISTER_ON_CHAIN_TOOL_FOR_SELF: ModuleAndNameIdent = ModuleAndNameIdent {
+        module: TOOL_REGISTRY_MODULE,
+        name: sui::types::Identifier::from_static("register_on_chain_tool_for_self"),
     };
     /// Remove an address from the allowlist for tool registration.
     /// Only callable by the holder of OverSlashing cap.
@@ -533,22 +834,21 @@ impl ToolRegistry {
     /// `nexus_workflow::tool_registry::remove_allowed_owner`
     pub const REMOVE_ALLOWED_OWNER: ModuleAndNameIdent = ModuleAndNameIdent {
         module: TOOL_REGISTRY_MODULE,
-        name: sui::move_ident_str!("remove_allowed_owner"),
+        name: sui::types::Identifier::from_static("remove_allowed_owner"),
     };
     /// The ToolRegistry struct type.
     ///
     /// `nexus_workflow::tool_registry::ToolRegistry`
     pub const TOOL_REGISTRY: ModuleAndNameIdent = ModuleAndNameIdent {
         module: TOOL_REGISTRY_MODULE,
-        name: sui::move_ident_str!("ToolRegistry"),
+        name: sui::types::Identifier::from_static("ToolRegistry"),
     };
-    /// Unregister an tool.
+    /// Unregister a tool.
     ///
     /// `nexus_workflow::tool_registry::unregister_tool`
     pub const UNREGISTER_TOOL: ModuleAndNameIdent = ModuleAndNameIdent {
         module: TOOL_REGISTRY_MODULE,
-        // TODO: This will likely be renamed to `unregister_tool`.
-        name: sui::move_ident_str!("unregister_off_chain_tool"),
+        name: sui::types::Identifier::from_static("unregister_tool"),
     };
 }
 
@@ -556,7 +856,7 @@ impl ToolRegistry {
 
 pub struct LeaderCap;
 
-const LEADER_CAP_MODULE: &sui::MoveIdentStr = sui::move_ident_str!("leader_cap");
+const LEADER_CAP_MODULE: sui::types::Identifier = sui::types::Identifier::from_static("leader_cap");
 
 impl LeaderCap {
     /// Create N leader caps for self and the provided addresses.
@@ -564,7 +864,7 @@ impl LeaderCap {
     /// `nexus_workflow::leader_cap::create_for_self_and_addresses`
     pub const CREATE_FOR_SELF_AND_ADDRESSES: ModuleAndNameIdent = ModuleAndNameIdent {
         module: LEADER_CAP_MODULE,
-        name: sui::move_ident_str!("create_for_self_and_addresses"),
+        name: sui::types::Identifier::from_static("create_for_self_and_addresses"),
     };
     /// This is used as a generic argument for
     /// [crate::idents::primitives::OwnerCap::CLONEABLE_OWNER_CAP].
@@ -572,7 +872,7 @@ impl LeaderCap {
     /// `nexus_workflow::leader_cap::OverNetwork`
     pub const OVER_NETWORK: ModuleAndNameIdent = ModuleAndNameIdent {
         module: LEADER_CAP_MODULE,
-        name: sui::move_ident_str!("OverNetwork"),
+        name: sui::types::Identifier::from_static("OverNetwork"),
     };
 }
 
@@ -580,7 +880,7 @@ impl LeaderCap {
 
 pub struct Gas;
 
-const GAS_MODULE: &sui::MoveIdentStr = sui::move_ident_str!("gas");
+const GAS_MODULE: sui::types::Identifier = sui::types::Identifier::from_static("gas");
 
 impl Gas {
     /// Add Balance<SUI> to the tx sender's gas budget.
@@ -588,86 +888,101 @@ impl Gas {
     /// `nexus_workflow::gas::add_gas_budget`
     pub const ADD_GAS_BUDGET: ModuleAndNameIdent = ModuleAndNameIdent {
         module: GAS_MODULE,
-        name: sui::move_ident_str!("add_gas_budget"),
+        name: sui::types::Identifier::from_static("add_gas_budget"),
     };
     /// Claim leader gas for this evaluation.
     ///
     /// `nexus_workflow::gas::claim_leader_gas`
     pub const CLAIM_LEADER_GAS: ModuleAndNameIdent = ModuleAndNameIdent {
         module: GAS_MODULE,
-        name: sui::move_ident_str!("claim_leader_gas"),
+        name: sui::types::Identifier::from_static("claim_leader_gas"),
+    };
+    /// Claim leader gas against an invoker scope (no DAG execution object).
+    ///
+    /// `nexus_workflow::gas::claim_leader_gas_for_invoker`
+    pub const CLAIM_LEADER_GAS_FOR_INVOKER: ModuleAndNameIdent = ModuleAndNameIdent {
+        module: GAS_MODULE,
+        name: sui::types::Identifier::from_static("claim_leader_gas_for_invoker"),
+    };
+    /// Claim leader gas specifically for pre-key handshakes.
+    ///
+    /// `nexus_workflow::gas::claim_leader_gas_for_pre_key`
+    pub const CLAIM_LEADER_GAS_FOR_PRE_KEY: ModuleAndNameIdent = ModuleAndNameIdent {
+        module: GAS_MODULE,
+        name: sui::types::Identifier::from_static("claim_leader_gas_for_pre_key"),
     };
     /// De-escalate an OverTool owner cap into OverGas.
     ///
     /// `nexus_workflow::gas::deescalate`
     pub const DEESCALATE: ModuleAndNameIdent = ModuleAndNameIdent {
         module: GAS_MODULE,
-        name: sui::move_ident_str!("deescalate"),
+        name: sui::types::Identifier::from_static("deescalate"),
     };
     /// GasService type for lookups.
     ///
     /// `nexus_workflow::gas::GasService`
     pub const GAS_SERVICE: ModuleAndNameIdent = ModuleAndNameIdent {
         module: GAS_MODULE,
-        name: sui::move_ident_str!("GasService"),
+        name: sui::types::Identifier::from_static("GasService"),
     };
     /// OverGas owner cap generic.
     ///
     /// `nexus_workflow::gas::OverGas`
     pub const OVER_GAS: ModuleAndNameIdent = ModuleAndNameIdent {
         module: GAS_MODULE,
-        name: sui::move_ident_str!("OverGas"),
+        name: sui::types::Identifier::from_static("OverGas"),
     };
     /// Create an Execution scope.
     ///
     /// `nexus_workflow::gas::scope_execution`
     pub const SCOPE_EXECUTION: ModuleAndNameIdent = ModuleAndNameIdent {
         module: GAS_MODULE,
-        name: sui::move_ident_str!("scope_execution"),
+        name: sui::types::Identifier::from_static("scope_execution"),
     };
     /// Create an InvokerAddress scope.
     ///
     /// `nexus_workflow::gas::scope_invoker_address`
     pub const SCOPE_INVOKER_ADDRESS: ModuleAndNameIdent = ModuleAndNameIdent {
         module: GAS_MODULE,
-        name: sui::move_ident_str!("scope_invoker_address"),
+        name: sui::types::Identifier::from_static("scope_invoker_address"),
     };
     /// Create a WorksheetType scope.
     ///
     /// `nexus_workflow::gas::scope_worksheet_type`
     pub const SCOPE_WORKSHEET_TYPE: ModuleAndNameIdent = ModuleAndNameIdent {
         module: GAS_MODULE,
-        name: sui::move_ident_str!("scope_worksheet_type"),
+        name: sui::types::Identifier::from_static("scope_worksheet_type"),
     };
     /// Set a tool invocation cost in MIST.
     ///
     /// `nexus_workflow::gas::set_single_invocation_cost_mist`
     pub const SET_SINGLE_INVOCATION_COST_MIST: ModuleAndNameIdent = ModuleAndNameIdent {
         module: GAS_MODULE,
-        name: sui::move_ident_str!("set_single_invocation_cost_mist"),
+        name: sui::types::Identifier::from_static("set_single_invocation_cost_mist"),
     };
     /// Sync gas for the vertices in the current execution object.
     ///
     /// `nexus_workflow::gas::sync_gas_state`
     pub const SYNC_GAS_STATE: ModuleAndNameIdent = ModuleAndNameIdent {
         module: GAS_MODULE,
-        name: sui::move_ident_str!("sync_gas_state"),
+        name: sui::types::Identifier::from_static("sync_gas_state"),
     };
 
     /// Convert an object ID to an InvokerAddress scope.
     pub fn scope_invoker_address_from_object_id(
-        tx: &mut sui::ProgrammableTransactionBuilder,
-        workflow_pkg_id: sui::ObjectID,
-        object_id: sui::ObjectID,
-    ) -> anyhow::Result<sui::Argument> {
-        let with_prefix = false;
-        let address = Address::address_from_str(tx, object_id.to_canonical_string(with_prefix))?;
-
-        Ok(tx.programmable_move_call(
-            workflow_pkg_id,
-            Self::SCOPE_INVOKER_ADDRESS.module.into(),
-            Self::SCOPE_INVOKER_ADDRESS.name.into(),
-            vec![],
+        tx: &mut sui::tx::TransactionBuilder,
+        workflow_pkg_id: sui::types::Address,
+        object_id: sui::types::Address,
+    ) -> anyhow::Result<sui::types::Argument> {
+        let address = Address::address_from_type(tx, object_id)?;
+
+        Ok(tx.move_call(
+            sui::tx::Function::new(
+                workflow_pkg_id,
+                Self::SCOPE_INVOKER_ADDRESS.module,
+                Self::SCOPE_INVOKER_ADDRESS.name,
+                vec![],
+            ),
             vec![address],
         ))
     }
@@ -677,7 +992,8 @@ impl Gas {
 
 pub struct GasExtension;
 
-const GAS_EXTENSION_MODULE: &sui::MoveIdentStr = sui::move_ident_str!("gas_extension");
+const GAS_EXTENSION_MODULE: sui::types::Identifier =
+    sui::types::Identifier::from_static("gas_extension");
 
 impl GasExtension {
     /// Buy an expiry gas extension ticket.
@@ -685,42 +1001,42 @@ impl GasExtension {
     /// `nexus_workflow::gas_extension::buy_expiry_gas_ticket`
     pub const BUY_EXPIRY_GAS_TICKET: ModuleAndNameIdent = ModuleAndNameIdent {
         module: GAS_EXTENSION_MODULE,
-        name: sui::move_ident_str!("buy_expiry_gas_ticket"),
+        name: sui::types::Identifier::from_static("buy_expiry_gas_ticket"),
     };
     /// Buy a limited invocations gas extension ticket.
     ///
     /// `nexus_workflow::gas_extension::buy_limited_invocations_gas_ticket`
     pub const BUY_LIMITED_INVOCATIONS_GAS_TICKET: ModuleAndNameIdent = ModuleAndNameIdent {
         module: GAS_EXTENSION_MODULE,
-        name: sui::move_ident_str!("buy_limited_invocations_gas_ticket"),
+        name: sui::types::Identifier::from_static("buy_limited_invocations_gas_ticket"),
     };
     /// Disable expiry gas extension for a tool.
     ///
     /// `nexus_workflow::gas_extension::disable_expiry`
     pub const DISABLE_EXPIRY: ModuleAndNameIdent = ModuleAndNameIdent {
         module: GAS_EXTENSION_MODULE,
-        name: sui::move_ident_str!("disable_expiry"),
+        name: sui::types::Identifier::from_static("disable_expiry"),
     };
     /// Disable limited invocations gas extension for a tool.
     ///
     /// `nexus_workflow::gas_extension::disable_limited_invocations`
     pub const DISABLE_LIMITED_INVOCATIONS: ModuleAndNameIdent = ModuleAndNameIdent {
         module: GAS_EXTENSION_MODULE,
-        name: sui::move_ident_str!("disable_limited_invocations"),
+        name: sui::types::Identifier::from_static("disable_limited_invocations"),
     };
     /// Enable expiry gas extension for a tool.
     ///
     /// `nexus_workflow::gas_extension::enable_expiry`
     pub const ENABLE_EXPIRY: ModuleAndNameIdent = ModuleAndNameIdent {
         module: GAS_EXTENSION_MODULE,
-        name: sui::move_ident_str!("enable_expiry"),
+        name: sui::types::Identifier::from_static("enable_expiry"),
     };
     /// Enable limited invocations gas extension for a tool.
     ///
     /// `nexus_workflow::gas_extension::enable_limited_invocations`
     pub const ENABLE_LIMITED_INVOCATIONS: ModuleAndNameIdent = ModuleAndNameIdent {
         module: GAS_EXTENSION_MODULE,
-        name: sui::move_ident_str!("enable_limited_invocations"),
+        name: sui::types::Identifier::from_static("enable_limited_invocations"),
     };
 }
 
@@ -728,7 +1044,8 @@ impl GasExtension {
 
 pub struct PreKeyVault;
 
-const PRE_KEY_VAULT_MODULE: &sui::MoveIdentStr = sui::move_ident_str!("pre_key_vault");
+const PRE_KEY_VAULT_MODULE: sui::types::Identifier =
+    sui::types::Identifier::from_static("pre_key_vault");
 
 impl PreKeyVault {
     /// Associate a pre key with the sender and fire an initial message.
@@ -736,57 +1053,50 @@ impl PreKeyVault {
     /// `nexus_workflow::pre_key_vault::associate_pre_key`
     pub const ASSOCIATE_PRE_KEY: ModuleAndNameIdent = ModuleAndNameIdent {
         module: PRE_KEY_VAULT_MODULE,
-        name: sui::move_ident_str!("associate_pre_key"),
+        name: sui::types::Identifier::from_static("associate_pre_key"),
     };
     /// Claim a pre key for the tx sender.
     ///
     /// `nexus_workflow::pre_key_vault::claim_pre_key_for_self`
     pub const CLAIM_PRE_KEY_FOR_SELF: ModuleAndNameIdent = ModuleAndNameIdent {
         module: PRE_KEY_VAULT_MODULE,
-        name: sui::move_ident_str!("claim_pre_key_for_self"),
+        name: sui::types::Identifier::from_static("claim_pre_key_for_self"),
     };
-    /// PreKey struct type. Mostly used for creating generic types.
+    /// Fulfill a requested pre key for a user.
     ///
-    /// `nexus_workflow::pre_key_vault::PreKey`
-    pub const PRE_KEY: ModuleAndNameIdent = ModuleAndNameIdent {
+    /// `nexus_workflow::pre_key_vault::fulfill_pre_key_for_user`
+    pub const FULFILL_PRE_KEY_FOR_USER: ModuleAndNameIdent = ModuleAndNameIdent {
         module: PRE_KEY_VAULT_MODULE,
-        name: sui::move_ident_str!("PreKey"),
+        name: sui::types::Identifier::from_static("fulfill_pre_key_for_user"),
     };
-    /// Create a new pre key from bytes.
+    /// OverCrypto owner cap generic.
     ///
-    /// `nexus_workflow::pre_key_vault::pre_key_from_bytes`
-    pub const PRE_KEY_FROM_BYTES: ModuleAndNameIdent = ModuleAndNameIdent {
+    /// `nexus_workflow::pre_key_vault::OverCrypto`
+    pub const OVER_CRYPTO: ModuleAndNameIdent = ModuleAndNameIdent {
         module: PRE_KEY_VAULT_MODULE,
-        name: sui::move_ident_str!("pre_key_from_bytes"),
+        name: sui::types::Identifier::from_static("OverCrypto"),
     };
     /// PreKeyVault type for lookups.
     ///
     /// `nexus_workflow::pre_key_vault::PreKeyVault`
     pub const PRE_KEY_VAULT: ModuleAndNameIdent = ModuleAndNameIdent {
         module: PRE_KEY_VAULT_MODULE,
-        name: sui::move_ident_str!("PreKeyVault"),
-    };
-    /// Replenish the pre key vault with public pre_keys.
-    ///
-    /// `nexus_workflow::pre_key_vault::replenish_pre_keys`
-    pub const REPLENISH_PRE_KEYS: ModuleAndNameIdent = ModuleAndNameIdent {
-        module: PRE_KEY_VAULT_MODULE,
-        name: sui::move_ident_str!("replenish_pre_keys"),
+        name: sui::types::Identifier::from_static("PreKeyVault"),
     };
 }
 
-/// Helper to turn a `ModuleAndNameIdent` into a `sui::MoveTypeTag`. Useful for
+/// Helper to turn a `ModuleAndNameIdent` into a `sui::types::TypeTag`. Useful for
 /// creating generic types.
 pub fn into_type_tag(
-    workflow_pkg_id: sui::ObjectID,
+    workflow_pkg_id: sui::types::Address,
     ident: ModuleAndNameIdent,
-) -> sui::MoveTypeTag {
-    sui::MoveTypeTag::Struct(Box::new(sui::MoveStructTag {
-        address: *workflow_pkg_id,
-        module: ident.module.into(),
-        name: ident.name.into(),
-        type_params: vec![],
-    }))
+) -> sui::types::TypeTag {
+    sui::types::TypeTag::Struct(Box::new(sui::types::StructTag::new(
+        workflow_pkg_id,
+        ident.module,
+        ident.name,
+        vec![],
+    )))
 }
 
 #[cfg(test)]
@@ -795,22 +1105,23 @@ mod tests {
 
     #[test]
     fn test_into_type_tag() {
-        let workflow_pkg_id = sui::ObjectID::random();
+        let rng = &mut rand::thread_rng();
+        let workflow_pkg_id = sui::types::Address::generate(rng);
         let ident = ModuleAndNameIdent {
-            module: sui::move_ident_str!("foo"),
-            name: sui::move_ident_str!("bar"),
+            module: sui::types::Identifier::from_static("foo"),
+            name: sui::types::Identifier::from_static("bar"),
         };
 
         let tag = into_type_tag(workflow_pkg_id, ident);
 
         assert_eq!(
             tag,
-            sui::MoveTypeTag::Struct(Box::new(sui::MoveStructTag {
-                address: *workflow_pkg_id,
-                module: sui::move_ident_str!("foo").into(),
-                name: sui::move_ident_str!("bar").into(),
-                type_params: vec![],
-            }))
+            sui::types::TypeTag::Struct(Box::new(sui::types::StructTag::new(
+                workflow_pkg_id,
+                sui::types::Identifier::from_static("foo"),
+                sui::types::Identifier::from_static("bar"),
+                vec![],
+            )))
         )
     }
 }
diff --git a/sdk/src/lib.rs b/sdk/src/lib.rs
index 3bb7c88a..d51b610f 100644
--- a/sdk/src/lib.rs
+++ b/sdk/src/lib.rs
@@ -8,6 +8,13 @@ mod tool_fqn;
 #[cfg(feature = "tool_fqn")]
 pub use tool_fqn::*;
 
+/// The ToolRef type represents the reference of a tool, either as an HTTP
+/// URL for offchain tools or as a Sui module identifier for onchain tools.
+#[cfg(feature = "tool_ref")]
+mod tool_ref;
+#[cfg(feature = "tool_ref")]
+pub use tool_ref::*;
+
 /// Ubiquitously used resource identifiers for on-chain types and functions.
 /// This includes workflow, primitives and interface Nexus modules but also
 /// some Sui framework and Sui move std modules that we use.
@@ -29,11 +36,6 @@ pub mod types;
 #[cfg(feature = "events")]
 pub mod events;
 
-/// Object crawler attempts to improve the Sui SDK object fetching by allowing
-/// direct parsing into structs.
-#[cfg(feature = "object_crawler")]
-pub mod object_crawler;
-
 /// Transactions module contains builders for PTBs that are submitted to Sui
 /// and perform various operations on the Nexus ecosystem.
 #[cfg(feature = "transactions")]
@@ -61,6 +63,10 @@ pub mod secret_core;
 #[cfg(feature = "dag")]
 pub mod dag;
 
+/// Schema generation utilities for Move onchain tools.
+#[cfg(feature = "schema_gen")]
+pub mod onchain_schema_gen;
+
 /// Provides various Nexus utilities like deployment and execution of workflows.
 #[cfg(feature = "nexus")]
 pub mod nexus;
diff --git a/sdk/src/nexus/client.rs b/sdk/src/nexus/client.rs
index e8dbf22a..9353c303 100644
--- a/sdk/src/nexus/client.rs
+++ b/sdk/src/nexus/client.rs
@@ -3,161 +3,37 @@
 
 use {
     crate::{
+        events::EventFetcher,
         nexus::{
+            crawler::Crawler,
             crypto::CryptoActions,
             error::NexusError,
             gas::GasActions,
+            scheduler::SchedulerActions,
+            signer::Signer,
             workflow::WorkflowActions,
         },
-        sui::{self, traits::*},
+        sui,
         types::NexusObjects,
     },
     std::sync::Arc,
-    sui_keys::keystore::AccountKeystore,
-    tokio::sync::{Mutex, Notify},
+    tokio::{
+        sync::{Mutex, Notify},
+        time::Duration,
+    },
 };
 
-/// We want to provide flexibility when it comes to signing transactions. We
-/// accept both - a [`sui::WalletContext`] and a tuple of a [`sui::Client`] and
-/// a secret mnemonic string.
-#[derive(Clone)]
-pub enum Signer {
-    Wallet(Arc<Mutex<sui::WalletContext>>),
-    Mnemonic(Arc<sui::Client>, Arc<Mutex<sui::Keystore>>),
-}
-
-impl Signer {
-    /// Get a reference to the Sui client.
-    pub(super) async fn get_client(&self) -> Result<Arc<sui::Client>, NexusError> {
-        match self {
-            Signer::Wallet(ctx) => {
-                let wallet = ctx.lock().await;
-                let client = wallet.get_client().await.map_err(NexusError::Wallet)?;
-
-                Ok(Arc::new(client))
-            }
-            Signer::Mnemonic(client, _) => Ok(Arc::clone(client)),
-        }
-    }
-
-    /// Get the active address from the signer.
-    pub(super) async fn get_active_address(&self) -> Result<sui::Address, NexusError> {
-        match self {
-            Signer::Wallet(ctx) => {
-                let mut wallet = ctx.lock().await;
-                let address = wallet
-                    .active_address()
-                    .map_err(|e| NexusError::Wallet(anyhow::anyhow!(e)))?;
-
-                Ok(address)
-            }
-            Signer::Mnemonic(_, keystore) => {
-                let keystore = keystore.lock().await;
-                let addresses = keystore.addresses();
-                let address = addresses.first().ok_or_else(|| {
-                    NexusError::Wallet(anyhow::anyhow!("No address found in keystore"))
-                })?;
-
-                Ok(*address)
-            }
-        }
-    }
-
-    /// Sign a transaction block using the signer.
-    pub(super) async fn sign_tx(
-        &self,
-        tx: sui::TransactionData,
-    ) -> Result<sui::Transaction, NexusError> {
-        match self {
-            Signer::Wallet(ctx) => {
-                let wallet = ctx.lock().await;
-
-                Ok(wallet.sign_transaction(&tx))
-            }
-            Signer::Mnemonic(_, keystore) => {
-                let keystore = keystore.lock().await;
-
-                let addresses = keystore.addresses();
-                let addr = addresses.first().ok_or_else(|| {
-                    NexusError::Wallet(anyhow::anyhow!("No address found in keystore"))
-                })?;
-
-                let signature = keystore
-                    .sign_secure(addr, &tx, sui::Intent::sui_transaction())
-                    .map_err(|e| NexusError::Wallet(anyhow::anyhow!(e)))?;
-
-                Ok(sui::Transaction::from_data(tx, vec![signature]))
-            }
-        }
-    }
-
-    /// Execute a transaction block and return the response.
-    pub(super) async fn execute_tx(
-        &self,
-        tx: sui::Transaction,
-        gas_coin: &mut sui::ObjectRef,
-    ) -> Result<sui::TransactionBlockResponse, NexusError> {
-        let client = self.get_client().await?;
-
-        let resp_options = sui::TransactionBlockResponseOptions::new()
-            .with_events()
-            .with_effects()
-            .with_object_changes()
-            .with_balance_changes();
-
-        let resp_finality = sui::ExecuteTransactionRequestType::WaitForLocalExecution;
-
-        let response = client
-            .quorum_driver_api()
-            .execute_transaction_block(tx, resp_options, Some(resp_finality))
-            .await
-            .map_err(|e| NexusError::Wallet(anyhow::anyhow!(e)))?;
-
-        if !response.errors.is_empty() {
-            return Err(NexusError::Wallet(anyhow::anyhow!(
-                "Transaction execution failed: {:?}",
-                response.errors
-            )));
-        }
-
-        let Some(sui::TransactionBlockEffects::V1(effects)) = response.effects.clone() else {
-            return Err(NexusError::Wallet(anyhow::anyhow!(
-                "Transactions has no effects."
-            )));
-        };
-
-        // Check if any effects failed in the TX.
-        if effects.clone().into_status().is_err() {
-            return Err(NexusError::Wallet(anyhow::anyhow!(
-                "Transaction has erroneous effects: {effects:?}"
-            )));
-        }
-
-        // Update the gas coin reference after execution.
-        for o in effects.mutated {
-            match o.reference.object_id {
-                id if id == gas_coin.object_id => {
-                    *gas_coin = o.reference;
-                }
-                _ => {}
-            }
-        }
-
-        Ok(response)
-    }
-}
-
 /// [`Gas`] struct handles distributing gas coins for Nexus operations.
 #[derive(Clone)]
 pub struct Gas {
-    coins: Arc<Mutex<Vec<sui::ObjectRef>>>,
+    coins: Arc<Mutex<Vec<sui::types::ObjectReference>>>,
     notify: Arc<Notify>,
     budget: u64,
 }
 
 impl Gas {
     /// Acquire a gas coin from the pool.
-    pub(super) async fn acquire_gas_coin(&self) -> sui::ObjectRef {
+    pub async fn acquire_gas_coin(&self) -> sui::types::ObjectReference {
         loop {
             // Try to grab one
             if let Some(coin) = self.coins.lock().await.pop() {
@@ -170,88 +46,58 @@ impl Gas {
     }
 
     /// Release a gas coin back to the pool.
-    pub(super) async fn release_gas_coin(&self, coin: sui::ObjectRef) {
+    pub async fn release_gas_coin(&self, coin: sui::types::ObjectReference) {
         self.coins.lock().await.push(coin);
         self.notify.notify_one();
     }
 
     /// Get the gas budget.
-    pub(super) fn get_budget(&self) -> u64 {
+    pub fn get_budget(&self) -> u64 {
         self.budget
     }
 }
 
 /// Builder for [`NexusClient`].
+#[derive(Default)]
 pub struct NexusClientBuilder {
-    signer: Option<Signer>,
-    gas: Option<Gas>,
+    pk: Option<sui::crypto::Ed25519PrivateKey>,
+    rpc_url: Option<String>,
+    gql_url: Option<String>,
+    gas_coins: Vec<sui::types::ObjectReference>,
+    gas_budget: Option<u64>,
     nexus_objects: Option<NexusObjects>,
-}
-
-impl Default for NexusClientBuilder {
-    fn default() -> Self {
-        Self::new()
-    }
+    transaction_timeout: Option<Duration>,
 }
 
 impl NexusClientBuilder {
     /// Create a new builder instance.
     pub fn new() -> Self {
-        Self {
-            signer: None,
-            gas: None,
-            nexus_objects: None,
-        }
+        Self::default()
     }
 
-    /// Create a new Nexus instance with a wallet context.
-    pub fn with_wallet_context(mut self, wallet_context: sui::WalletContext) -> Self {
-        let signer = Signer::Wallet(Arc::new(Mutex::new(wallet_context)));
-
-        self.signer = Some(signer);
+    /// Add a private key to the builder.
+    pub fn with_private_key(mut self, pk: sui::crypto::Ed25519PrivateKey) -> Self {
+        self.pk = Some(pk);
         self
     }
 
-    /// Create a new Nexus instance with a Sui client and a keystore from a
-    /// mnemonic.
-    pub fn with_mnemonic(
-        mut self,
-        client: sui::Client,
-        mnemonic: &str,
-        sig_scheme: sui::SignatureScheme,
-    ) -> Result<Self, NexusError> {
-        let mut keystore = sui::Keystore::InMem(Default::default());
-
-        let derivation_path = None;
-        let alias = None;
-
-        keystore
-            .import_from_mnemonic(mnemonic, sig_scheme, derivation_path, alias)
-            .map_err(|e| NexusError::Wallet(anyhow::anyhow!(e)))?;
-
-        let signer = Signer::Mnemonic(Arc::new(client), Arc::new(Mutex::new(keystore)));
+    /// Which RPC to connect to.
+    pub fn with_rpc_url(mut self, rpc_url: &str) -> Self {
+        self.rpc_url = Some(rpc_url.to_string());
+        self
+    }
 
-        self.signer = Some(signer);
-        Ok(self)
+    /// Which GraphQL to connect to.
+    pub fn with_gql_url(mut self, gql_url: &str) -> Self {
+        self.gql_url = Some(gql_url.to_string());
+        self
     }
 
     /// Add gas coins and budget to the builder.
-    pub fn with_gas(mut self, coins: Vec<&sui::Coin>, budget: u64) -> Result<Self, NexusError> {
-        // Need at least one gas coin.
-        if coins.is_empty() {
-            return Err(NexusError::Configuration(
-                "At least one gas coin is required".into(),
-            ));
-        }
-
-        let coins = coins.into_iter().map(|c| c.object_ref().into()).collect();
-
-        self.gas = Some(Gas {
-            coins: Arc::new(Mutex::new(coins)),
-            notify: Arc::new(Notify::new()),
-            budget,
-        });
-        Ok(self)
+    pub fn with_gas(mut self, coins: Vec<sui::types::ObjectReference>, budget: u64) -> Self {
+        self.gas_coins = coins;
+        self.gas_budget = Some(budget);
+        self
     }
 
     /// Set Nexus objects to use.
@@ -260,33 +106,74 @@ impl NexusClientBuilder {
         self
     }
 
+    /// Set transaction timeout duration.
+    pub fn with_transaction_timeout(mut self, timeout: Duration) -> Self {
+        self.transaction_timeout = Some(timeout);
+        self
+    }
+
     /// Build the [`NexusClient`].
     pub async fn build(self) -> Result<NexusClient, NexusError> {
-        let signer = self
-            .signer
-            .ok_or_else(|| NexusError::Configuration("Signer is required".into()))?;
+        let pk = self
+            .pk
+            .ok_or_else(|| NexusError::Configuration("User's private key is required".into()))?;
+
+        let rpc_url = self
+            .rpc_url
+            .ok_or_else(|| NexusError::Configuration("RPC URL is required".into()))?;
+
+        // Need at least one gas coin.
+        if self.gas_coins.is_empty() {
+            return Err(NexusError::Configuration(
+                "At least one gas coin is required".into(),
+            ));
+        }
 
-        let gas = self
-            .gas
-            .ok_or_else(|| NexusError::Configuration("Gas configuration is required".into()))?;
+        let gas_budget = self
+            .gas_budget
+            .ok_or_else(|| NexusError::Configuration("Gas budget is required".into()))?;
 
-        let nexus_objects = self
-            .nexus_objects
-            .ok_or_else(|| NexusError::Configuration("Nexus objects are required".into()))?;
+        let nexus_objects = Arc::new(
+            self.nexus_objects
+                .ok_or_else(|| NexusError::Configuration("Nexus objects are required".into()))?,
+        );
 
-        let client = signer.get_client().await?;
+        let client = Arc::new(Mutex::new(
+            sui_rpc::Client::new(&rpc_url).map_err(|e| NexusError::Rpc(e.into()))?,
+        ));
 
         let reference_gas_price = client
-            .read_api()
+            .lock()
+            .await
             .get_reference_gas_price()
             .await
             .map_err(|e| NexusError::Rpc(e.into()))?;
 
+        let signer = Signer::new(
+            client.clone(),
+            pk,
+            self.transaction_timeout.unwrap_or(Duration::from_secs(5)),
+            Arc::clone(&nexus_objects),
+        );
+
+        let gas = Gas {
+            coins: Arc::new(Mutex::new(self.gas_coins)),
+            notify: Arc::new(Notify::new()),
+            budget: gas_budget,
+        };
+
         Ok(NexusClient {
             signer,
             gas,
-            nexus_objects: Arc::new(nexus_objects),
+            nexus_objects: Arc::clone(&nexus_objects),
             reference_gas_price,
+            crawler: Crawler::new(client),
+            event_fetcher: EventFetcher::new(
+                &self
+                    .gql_url
+                    .unwrap_or_else(|| format!("{}/graphql", &rpc_url)),
+                Arc::clone(&nexus_objects),
+            ),
         })
     }
 }
@@ -302,6 +189,10 @@ pub struct NexusClient {
     pub(super) nexus_objects: Arc<NexusObjects>,
     /// Save reference gas price to avoid fetching it multiple times.
     pub(super) reference_gas_price: u64,
+    /// Provide access to an instantiated object crawler.
+    pub(super) crawler: Crawler,
+    /// Provide access to an instantiated event fetcher.
+    pub(super) event_fetcher: EventFetcher,
 }
 
 impl NexusClient {
@@ -310,11 +201,6 @@ impl NexusClient {
         NexusClientBuilder::new()
     }
 
-    /// Return a [`sui::Client`] instance for interacting with the Sui network.
-    pub async fn get_sui_client(&self) -> Result<Arc<sui::Client>, NexusError> {
-        self.signer.get_client().await
-    }
-
     /// Return a [`GasActions`] instance for performing gas-related operations.
     pub fn gas(&self) -> GasActions {
         GasActions {
@@ -335,6 +221,43 @@ impl NexusClient {
             client: self.clone(),
         }
     }
+
+    /// Return a [`SchedulerActions`] instance for scheduler operations.
+    pub fn scheduler(&self) -> SchedulerActions {
+        SchedulerActions {
+            client: self.clone(),
+        }
+    }
+
+    /// Return a [`Crawler`] instance for object crawling operations.
+    pub fn crawler(&self) -> &Crawler {
+        &self.crawler
+    }
+
+    /// Return a [`Signer`] instance for signing transactions.
+    pub fn signer(&self) -> &Signer {
+        &self.signer
+    }
+
+    /// Return an [`EventFetcher`] instance for fetching Nexus events.
+    pub fn event_fetcher(&self) -> &EventFetcher {
+        &self.event_fetcher
+    }
+
+    /// Return a reference to the [`Gas`] instance.
+    pub fn gas_config(&self) -> Gas {
+        self.gas.clone()
+    }
+
+    /// Get the reference gas price.
+    pub fn get_reference_gas_price(&self) -> u64 {
+        self.reference_gas_price
+    }
+
+    /// Get the Nexus objects.
+    pub fn get_nexus_objects(&self) -> Arc<NexusObjects> {
+        Arc::clone(&self.nexus_objects)
+    }
 }
 
 #[cfg(test)]
@@ -343,21 +266,14 @@ mod tests {
         super::*,
         crate::test_utils::{
             nexus_mocks,
-            sui_mocks::{
-                self,
-                mock_nexus_objects,
-                mock_sui_coin,
-                mock_sui_mnemonic,
-                mock_sui_object_ref,
-            },
-            wallet::create_ephemeral_wallet_context_testnet,
+            sui_mocks::{self},
         },
     };
 
     #[tokio::test]
     async fn test_acquire_and_release_gas_coin() {
-        let coin1 = mock_sui_object_ref();
-        let coin2 = mock_sui_object_ref();
+        let coin1 = sui_mocks::mock_sui_object_ref();
+        let coin2 = sui_mocks::mock_sui_object_ref();
 
         let gas = Gas {
             coins: Arc::new(Mutex::new(vec![coin1.clone(), coin2.clone()])),
@@ -393,7 +309,7 @@ mod tests {
 
     #[tokio::test]
     async fn test_acquire_gas_coin_waits_for_release() {
-        let coin = mock_sui_object_ref();
+        let coin = sui_mocks::mock_sui_object_ref();
         let gas = Gas {
             coins: Arc::new(Mutex::new(vec![])),
             notify: Arc::new(Notify::new()),
@@ -415,58 +331,54 @@ mod tests {
     }
 
     #[tokio::test]
-    async fn test_builder_with_wallet_context() {
-        let (wallet_context, _) =
-            create_ephemeral_wallet_context_testnet().expect("Failed to create wallet context.");
-        let coin = mock_sui_coin(100);
-        let objects = mock_nexus_objects();
-        let coins = vec![&coin];
+    async fn test_builder_with_private_key() {
+        let mut rng = rand::thread_rng();
+        let pk = sui::crypto::Ed25519PrivateKey::generate(&mut rng);
+        let coin = sui_mocks::mock_sui_object_ref();
+        let objects = sui_mocks::mock_nexus_objects();
+        let coins = vec![coin];
         let budget = 1000;
 
         let builder = NexusClientBuilder::new()
-            .with_wallet_context(wallet_context)
+            .with_private_key(pk)
+            .with_rpc_url("https://fullnode.testnet.sui.io:443")
             .with_nexus_objects(objects)
-            .with_gas(coins, budget)
-            .unwrap();
+            .with_gas(coins, budget);
 
         let client = builder.build().await.unwrap();
         assert_eq!(client.gas.get_budget(), budget);
+        assert_eq!(client.signer.transaction_timeout, Duration::from_secs(5));
     }
 
     #[tokio::test]
-    async fn test_builder_with_mnemonic() {
-        let (_, mnemonic) = mock_sui_mnemonic();
-        let client = sui::ClientBuilder::default()
-            .build_testnet()
-            .await
-            .expect("Failed to build sui client");
-        let coin = mock_sui_coin(100);
-        let objects = mock_nexus_objects();
-        let coins = vec![&coin];
+    async fn test_builder_missing_pk() {
+        let coin = sui_mocks::mock_sui_object_ref();
+        let coins = vec![coin];
+        let objects = sui_mocks::mock_nexus_objects();
         let budget = 1000;
 
         let builder = NexusClientBuilder::new()
+            .with_rpc_url("https://fullnode.testnet.sui.io:443")
             .with_nexus_objects(objects)
-            .with_mnemonic(client, &mnemonic, sui::SignatureScheme::ED25519)
-            .unwrap()
-            .with_gas(coins, budget)
-            .unwrap();
+            .with_gas(coins, budget);
 
-        let nexus_client = builder.build().await.unwrap();
-        assert_eq!(nexus_client.gas.get_budget(), budget);
+        let result = builder.build().await;
+        assert!(matches!(result, Err(NexusError::Configuration(_))));
     }
 
     #[tokio::test]
-    async fn test_builder_missing_signer() {
-        let coin = mock_sui_coin(100);
-        let coins = vec![&coin];
-        let objects = mock_nexus_objects();
+    async fn test_builder_missing_rpc_url() {
+        let mut rng = rand::thread_rng();
+        let pk = sui::crypto::Ed25519PrivateKey::generate(&mut rng);
+        let coin = sui_mocks::mock_sui_object_ref();
+        let coins = vec![coin];
+        let objects = sui_mocks::mock_nexus_objects();
         let budget = 1000;
 
         let builder = NexusClientBuilder::new()
+            .with_private_key(pk)
             .with_nexus_objects(objects)
-            .with_gas(coins, budget)
-            .unwrap();
+            .with_gas(coins, budget);
 
         let result = builder.build().await;
         assert!(matches!(result, Err(NexusError::Configuration(_))));
@@ -474,12 +386,28 @@ mod tests {
 
     #[tokio::test]
     async fn test_builder_missing_gas() {
-        let objects = mock_nexus_objects();
-        let (wallet_context, _) =
-            create_ephemeral_wallet_context_testnet().expect("Failed to create wallet context.");
+        let mut rng = rand::thread_rng();
+        let pk = sui::crypto::Ed25519PrivateKey::generate(&mut rng);
+        let objects = sui_mocks::mock_nexus_objects();
+
+        let builder = NexusClientBuilder::new()
+            .with_private_key(pk)
+            .with_rpc_url("https://fullnode.testnet.sui.io:443")
+            .with_nexus_objects(objects);
+
+        let result = builder.build().await;
+        assert!(matches!(result, Err(NexusError::Configuration(_))));
+    }
+
+    #[tokio::test]
+    async fn test_builder_with_missing_budget() {
+        let mut rng = rand::thread_rng();
+        let pk = sui::crypto::Ed25519PrivateKey::generate(&mut rng);
+        let objects = sui_mocks::mock_nexus_objects();
 
         let builder = NexusClientBuilder::new()
-            .with_wallet_context(wallet_context)
+            .with_private_key(pk)
+            .with_rpc_url("https://fullnode.testnet.sui.io:443")
             .with_nexus_objects(objects);
 
         let result = builder.build().await;
@@ -488,88 +416,118 @@ mod tests {
 
     #[tokio::test]
     async fn test_builder_with_gas_empty_coins() {
-        let builder = NexusClientBuilder::new();
-        let result = builder.with_gas(vec![], 1000);
+        let mut rng = rand::thread_rng();
+        let pk = sui::crypto::Ed25519PrivateKey::generate(&mut rng);
+        let coins = vec![];
+        let objects = sui_mocks::mock_nexus_objects();
+        let budget = 1000;
+
+        let builder = NexusClientBuilder::new()
+            .with_private_key(pk)
+            .with_rpc_url("https://fullnode.testnet.sui.io:443")
+            .with_nexus_objects(objects)
+            .with_gas(coins, budget);
+
+        let result = builder.build().await;
         assert!(matches!(result, Err(NexusError::Configuration(_))));
     }
 
     #[tokio::test]
     async fn test_builder_missing_nexus_objects() {
-        let (wallet_context, _) =
-            create_ephemeral_wallet_context_testnet().expect("Failed to create wallet context.");
-        let coin = mock_sui_coin(100);
-        let coins = vec![&coin];
+        let mut rng = rand::thread_rng();
+        let pk = sui::crypto::Ed25519PrivateKey::generate(&mut rng);
+        let coin = sui_mocks::mock_sui_object_ref();
+        let coins = vec![coin];
         let budget = 1000;
 
         let builder = NexusClientBuilder::new()
-            .with_wallet_context(wallet_context)
-            .with_gas(coins, budget)
-            .unwrap();
+            .with_private_key(pk)
+            .with_rpc_url("https://fullnode.testnet.sui.io:443")
+            .with_gas(coins, budget);
 
         let result = builder.build().await;
         assert!(matches!(result, Err(NexusError::Configuration(_))));
     }
 
     #[tokio::test]
-    async fn test_execute_tx_mutates_gas_coin() {
-        let (mut server, nexus_client) = nexus_mocks::mock_nexus_client().await;
+    async fn test_builder_tx_timeout() {
+        let mut rng = rand::thread_rng();
+        let pk = sui::crypto::Ed25519PrivateKey::generate(&mut rng);
+        let coin = sui_mocks::mock_sui_object_ref();
+        let objects = sui_mocks::mock_nexus_objects();
+        let coins = vec![coin];
+        let budget = 1000;
 
-        let tx = sui::ProgrammableTransactionBuilder::new();
+        let builder = NexusClientBuilder::new()
+            .with_private_key(pk)
+            .with_rpc_url("https://fullnode.testnet.sui.io:443")
+            .with_nexus_objects(objects)
+            .with_gas(coins, budget)
+            .with_transaction_timeout(Duration::from_secs(10));
 
-        let mut gas_coin = nexus_client.gas.acquire_gas_coin().await;
-        let gas_coin_initial = gas_coin.clone();
-        let gas_coin_mutated = sui::ObjectRef {
-            object_id: gas_coin.object_id,
-            version: sui::SequenceNumber::from_u64(gas_coin.version.value() + 1),
-            digest: sui::ObjectDigest::random(),
-        };
+        let client = builder.build().await.unwrap();
+        assert_eq!(client.gas.get_budget(), budget);
+        assert_eq!(client.signer.transaction_timeout, Duration::from_secs(10));
+    }
 
-        let tx_data = sui::TransactionData::new_programmable(
-            nexus_client
-                .signer
-                .get_active_address()
-                .await
-                .expect("Failed to get address"),
-            vec![gas_coin.to_object_ref()],
-            tx.finish(),
-            nexus_client.gas.get_budget(),
-            nexus_client.reference_gas_price,
+    #[tokio::test]
+    async fn test_execute_tx_mutates_gas_coin() {
+        let mut rng = rand::thread_rng();
+        let digest = sui::types::Digest::generate(&mut rng);
+        let gas_coin_ref = sui_mocks::mock_sui_object_ref();
+        let nexus_objects = sui_mocks::mock_nexus_objects();
+
+        let mut ledger_service_mock = sui_mocks::grpc::MockLedgerService::new();
+        let mut tx_service_mock = sui_mocks::grpc::MockTransactionExecutionService::new();
+        let mut sub_service_mock = sui_mocks::grpc::MockSubscriptionService::new();
+
+        sui_mocks::grpc::mock_reference_gas_price(&mut ledger_service_mock, 1000);
+
+        sui_mocks::grpc::mock_execute_transaction_and_wait_for_checkpoint(
+            &mut tx_service_mock,
+            &mut sub_service_mock,
+            &mut ledger_service_mock,
+            digest,
+            gas_coin_ref.clone(),
+            vec![],
+            vec![],
+            vec![],
         );
 
-        let envelope = nexus_client
-            .signer
-            .sign_tx(tx_data)
-            .await
-            .expect("Failed to sign tx");
-
-        let (execute_mock, confirm_mock) =
-            sui_mocks::rpc::mock_governance_api_execute_execute_transaction_block(
-                &mut server,
-                sui::TransactionDigest::random(),
-                Some(sui_mocks::mock_sui_transaction_block_effects(
-                    None,
-                    Some(vec![sui::OwnedObjectRef {
-                        owner: sui::Owner::AddressOwner(sui::ObjectID::random().into()),
-                        reference: gas_coin_mutated.clone(),
-                    }]),
-                    None,
-                    None,
-                )),
-                None,
-                None,
-                None,
-            );
-
-        let _response = nexus_client
+        let rpc_url = sui_mocks::grpc::mock_server(sui_mocks::grpc::ServerMocks {
+            ledger_service_mock: Some(ledger_service_mock),
+            execution_service_mock: Some(tx_service_mock),
+            subscription_service_mock: Some(sub_service_mock),
+        });
+
+        let client = nexus_mocks::mock_nexus_client(&nexus_objects, &rpc_url, None).await;
+
+        assert_eq!(client.reference_gas_price, 1000);
+
+        let mut gas_coin = client.gas.acquire_gas_coin().await;
+        let mut tx = sui::tx::TransactionBuilder::new();
+
+        tx.set_sender(client.signer.get_active_address());
+        tx.set_gas_budget(1000);
+        tx.set_gas_price(1000);
+        tx.add_gas_objects(vec![sui::tx::Input::owned(
+            *gas_coin.object_id(),
+            gas_coin.version(),
+            *gas_coin.digest(),
+        )]);
+
+        let tx = tx.finish().unwrap();
+        let signature = client.signer.sign_tx(&tx).await.unwrap();
+
+        let response = client
             .signer
-            .execute_tx(envelope, &mut gas_coin)
+            .execute_tx(tx, signature, &mut gas_coin)
             .await
-            .expect("Failed to execute tx");
+            .unwrap();
 
-        assert_ne!(gas_coin, gas_coin_initial);
-        assert_eq!(gas_coin, gas_coin_mutated);
+        assert_eq!(response.digest, digest);
 
-        execute_mock.assert_async().await;
-        confirm_mock.assert_async().await;
+        assert_eq!(gas_coin.version(), gas_coin_ref.version());
+        assert_eq!(gas_coin.digest(), gas_coin_ref.digest());
     }
 }
diff --git a/sdk/src/nexus/crawler.rs b/sdk/src/nexus/crawler.rs
new file mode 100644
index 00000000..fc7470cb
--- /dev/null
+++ b/sdk/src/nexus/crawler.rs
@@ -0,0 +1,917 @@
+//! Module defining a Sui object crawler - this struct is able to fetch object
+//! and dynamic field data from Sui GRPC and deserialize them into Rust structs.
+
+use {
+    crate::sui::{self, traits::FieldMaskUtil},
+    anyhow::{anyhow, bail},
+    serde::{de::DeserializeOwned, Deserialize, Deserializer, Serialize},
+    std::{
+        collections::{HashMap, HashSet},
+        hash::Hash,
+        marker::PhantomData,
+        sync::Arc,
+    },
+    tokio::sync::Mutex,
+};
+
+/// The main crawler struct.
+#[derive(Clone)]
+pub struct Crawler {
+    client: Arc<Mutex<sui::grpc::Client>>,
+}
+
+impl Crawler {
+    pub fn new(client: Arc<Mutex<sui::grpc::Client>>) -> Self {
+        Self { client }
+    }
+
+    /// Fetch an object by its ID and deserialize it into the specified type.
+    pub async fn get_object<T>(&self, object_id: sui::types::Address) -> anyhow::Result<Response<T>>
+    where
+        T: DeserializeOwned,
+    {
+        let field_mask = sui::grpc::FieldMask::from_paths([
+            "object_id",
+            "owner",
+            "version",
+            "digest",
+            "balance",
+            "json",
+        ]);
+
+        let object = self.fetch_object(object_id, field_mask).await?;
+        let (owner, digest, version, balance) = self.parse_object_metadata(object_id, &object)?;
+        let data = self.parse_object_content(&object)?;
+
+        Ok(Response {
+            object_id,
+            owner,
+            version,
+            data,
+            digest,
+            balance,
+        })
+    }
+
+    /// Fetch many objects by their IDs in batch and deserialize them into the
+    /// specified type.
+    pub async fn get_objects<T>(
+        &self,
+        object_ids: &[sui::types::Address],
+    ) -> anyhow::Result<Vec<Response<T>>>
+    where
+        T: DeserializeOwned,
+    {
+        let field_mask = sui::grpc::FieldMask::from_paths([
+            "object_id",
+            "owner",
+            "version",
+            "digest",
+            "balance",
+            "json",
+        ]);
+
+        let objects = self.fetch_objects(object_ids, field_mask).await?;
+
+        objects
+            .into_iter()
+            .map(|object| {
+                let object_id = object
+                    .object_id_opt()
+                    .ok_or_else(|| anyhow!("Object ID missing"))?
+                    .parse()
+                    .map_err(|_| anyhow!("Could not parse object ID"))?;
+
+                let (owner, digest, version, balance) =
+                    self.parse_object_metadata(object_id, &object)?;
+                let data = self.parse_object_content(&object)?;
+
+                Ok(Response {
+                    object_id,
+                    owner,
+                    version,
+                    data,
+                    digest,
+                    balance,
+                })
+            })
+            .collect()
+    }
+
+    /// Fetch an object's metadata only, omitting its content.
+    pub async fn get_object_metadata(
+        &self,
+        object_id: sui::types::Address,
+    ) -> anyhow::Result<Response<()>> {
+        let field_mask = sui::grpc::FieldMask::from_paths([
+            "object_id",
+            "owner",
+            "version",
+            "digest",
+            "balance",
+        ]);
+
+        let object = self.fetch_object(object_id, field_mask).await?;
+        let (owner, digest, version, balance) = self.parse_object_metadata(object_id, &object)?;
+
+        Ok(Response {
+            object_id,
+            owner,
+            version,
+            data: (),
+            digest,
+            balance,
+        })
+    }
+
+    /// Fetch many objects' metadata only in batch, omitting their content.
+    pub async fn get_objects_metadata(
+        &self,
+        object_ids: &[sui::types::Address],
+    ) -> anyhow::Result<Vec<Response<()>>> {
+        let field_mask = sui::grpc::FieldMask::from_paths([
+            "object_id",
+            "owner",
+            "version",
+            "digest",
+            "balance",
+        ]);
+
+        let objects = self.fetch_objects(object_ids, field_mask).await?;
+
+        objects
+            .into_iter()
+            .map(|object| {
+                let object_id = object
+                    .object_id_opt()
+                    .ok_or_else(|| anyhow!("Object ID missing"))?
+                    .parse()
+                    .map_err(|_| anyhow!("Could not parse object ID"))?;
+
+                let (owner, digest, version, balance) =
+                    self.parse_object_metadata(object_id, &object)?;
+
+                Ok(Response {
+                    object_id,
+                    owner,
+                    version,
+                    data: (),
+                    digest,
+                    balance,
+                })
+            })
+            .collect()
+    }
+
+    /// Fetch all dynamic object fields for a given parent and parse them into a
+    /// HashMap<K, V>.
+    pub async fn get_dynamic_fields<K, V>(
+        &self,
+        parent: &DynamicMap<K, V>,
+    ) -> anyhow::Result<HashMap<K, V>>
+    where
+        K: Eq + Hash + DeserializeOwned,
+        V: DeserializeOwned,
+    {
+        let names_and_ids = self
+            .fetch_dynamic_fields::<K>(parent.id(), parent.size())
+            .await?;
+
+        // Now fetch all dynamic field objects in batch.
+        let child_ids = names_and_ids
+            .iter()
+            .filter_map(|(_, _, id)| *id)
+            .collect::<Vec<_>>();
+
+        let child_objects = self.get_objects::<DynamicPair<K, V>>(&child_ids).await?;
+
+        Ok(child_objects
+            .into_iter()
+            .map(|obj| (obj.data.name, obj.data.value.into_inner()))
+            .collect())
+    }
+
+    /// Fetch all dynamic object fields for a given parent and parse them into a
+    /// HashMap<K, V>. Since the values are objects, they need to be fetched
+    /// first.
+    pub async fn get_dynamic_field_objects<K, V>(
+        &self,
+        parent: &DynamicObjectMap<K, V>,
+    ) -> anyhow::Result<HashMap<K, Response<V>>>
+    where
+        K: Eq + Hash + DeserializeOwned,
+        V: DeserializeOwned,
+    {
+        let names_and_ids = self
+            .fetch_dynamic_fields::<K>(parent.id(), parent.size())
+            .await?;
+
+        // Now fetch all dynamic field objects in batch.
+        let child_ids = names_and_ids
+            .iter()
+            .filter_map(|(_, id, _)| *id)
+            .collect::<Vec<_>>();
+
+        let child_objects = self.get_objects::<V>(&child_ids).await?;
+
+        Ok(names_and_ids
+            .into_iter()
+            .map(|(name, _, _)| name)
+            .zip(child_objects.into_iter())
+            .collect())
+    }
+
+    /// Fetch all items in a `TableVec<T>` and return them as a `Vec<T>`.
+    pub async fn get_table_vec<T>(&self, parent: &TableVec<T>) -> anyhow::Result<Vec<T>>
+    where
+        T: DeserializeOwned,
+    {
+        let expected_size = parent.size();
+        if expected_size == 0 {
+            return Ok(vec![]);
+        }
+
+        let names_and_ids = self
+            .fetch_dynamic_fields::<u64>(parent.id(), expected_size)
+            .await?;
+
+        let mut index_by_field_id = HashMap::with_capacity(names_and_ids.len());
+        let mut field_ids = Vec::with_capacity(names_and_ids.len());
+
+        for (name, _child_id, field_id) in names_and_ids {
+            let Some(field_id) = field_id else {
+                bail!("Dynamic field ID missing for TableVec");
+            };
+
+            let index = usize::try_from(name).unwrap_or(usize::MAX);
+            if index >= expected_size {
+                bail!("TableVec index out of bounds: {index} >= {expected_size}");
+            }
+
+            if index_by_field_id.insert(field_id, index).is_some() {
+                bail!("Duplicate dynamic field ID '{field_id}' for TableVec");
+            }
+
+            field_ids.push(field_id);
+        }
+
+        let field_objects = self.get_objects::<DynamicValue<T>>(&field_ids).await?;
+
+        let mut values_by_index: Vec<Option<T>> = std::iter::repeat_with(|| None)
+            .take(expected_size)
+            .collect();
+        for obj in field_objects {
+            let index = index_by_field_id
+                .get(&obj.object_id)
+                .copied()
+                .ok_or_else(|| {
+                    anyhow!(
+                        "Unexpected dynamic field ID '{}' for TableVec",
+                        obj.object_id
+                    )
+                })?;
+
+            if values_by_index[index].is_some() {
+                bail!("Duplicate TableVec element at index {index}");
+            }
+
+            values_by_index[index] = Some(obj.data.value.into_inner());
+        }
+
+        values_by_index
+            .into_iter()
+            .enumerate()
+            .map(|(index, value)| value.ok_or_else(|| anyhow!("Missing TableVec element {index}")))
+            .collect()
+    }
+
+    /// Helper function to fetch an object based on its ID and field mask.
+    async fn fetch_object(
+        &self,
+        object_id: sui::types::Address,
+        field_mask: sui::grpc::FieldMask,
+    ) -> anyhow::Result<sui::grpc::Object> {
+        let mut client = self.client.lock().await;
+
+        let request = sui::grpc::GetObjectRequest::default()
+            .with_object_id(object_id)
+            .with_read_mask(field_mask);
+
+        let response = client
+            .ledger_client()
+            .get_object(request)
+            .await
+            .map(|r| r.into_inner())
+            .map_err(|e| anyhow!("Could not fetch object: {e}"))?;
+
+        let Some(object) = response.object else {
+            bail!("Object '{object_id}' not found");
+        };
+
+        Ok(object)
+    }
+
+    /// Helper function to fetch many objects based on their IDs and field mask.
+    async fn fetch_objects(
+        &self,
+        object_ids: &[sui::types::Address],
+        field_mask: sui::grpc::FieldMask,
+    ) -> anyhow::Result<Vec<sui::grpc::Object>> {
+        let request = {
+            let mut req = sui::grpc::BatchGetObjectsRequest::default();
+
+            req.set_requests(
+                object_ids
+                    .iter()
+                    .map(|&id| {
+                        sui::grpc::GetObjectRequest::default()
+                            .with_object_id(id)
+                            .with_read_mask(field_mask.clone())
+                    })
+                    .collect(),
+            );
+
+            req.set_read_mask(field_mask);
+
+            req
+        };
+
+        let mut client = self.client.lock().await;
+
+        let response = client
+            .ledger_client()
+            .batch_get_objects(request)
+            .await
+            .map(|r| r.into_inner())
+            .map_err(|e| anyhow!("Could not fetch objects: {e}"))?;
+
+        let mut objects = Vec::with_capacity(object_ids.len());
+
+        for result in response.objects {
+            let object = result
+                .object_opt()
+                .ok_or_else(|| anyhow!("Object not found"))?;
+
+            objects.push(object.clone());
+        }
+
+        Ok(objects)
+    }
+
+    /// Helper function to fetch all dynamic fields for a given parent object.
+    /// Optionally stopping at `stop_at` if we're only interested in a singular
+    /// item.
+    async fn fetch_dynamic_fields<K>(
+        &self,
+        parent_id: sui::types::Address,
+        expected_size: usize,
+    ) -> anyhow::Result<Vec<(K, Option<sui::types::Address>, Option<sui::types::Address>)>>
+    where
+        K: Eq + Hash + DeserializeOwned,
+    {
+        let mut results = Vec::with_capacity(expected_size);
+        let mut page_token = None;
+        let field_mask = sui::grpc::FieldMask::from_paths(["name", "child_id", "field_id"]);
+
+        loop {
+            let mut request = sui::grpc::ListDynamicFieldsRequest::default()
+                .with_parent(parent_id)
+                .with_page_size(1000)
+                .with_read_mask(field_mask.clone());
+
+            if let Some(token) = page_token.clone() {
+                request = request.with_page_token(token);
+            }
+
+            let mut client = self.client.lock().await;
+            let response = client
+                .state_client()
+                .list_dynamic_fields(request)
+                .await
+                .map(|r| r.into_inner())
+                .map_err(|e| {
+                    anyhow!("Could not fetch dynamic fields for parent '{parent_id}': {e}")
+                })?;
+
+            drop(client);
+
+            page_token = response.next_page_token;
+
+            for field in response.dynamic_fields {
+                // Parse the dynamic field name as K.
+                let name = bcs::from_bytes::<K>(
+                    field
+                        .name_opt()
+                        .ok_or_else(|| {
+                            anyhow!("Dynamic field name missing for parent '{parent_id}'")
+                        })?
+                        .value(),
+                )
+                .map_err(|e| {
+                    anyhow!("Could not parse dynamic field name for parent '{parent_id}': {e}")
+                })?;
+
+                let field_id = field
+                    .field_id_opt()
+                    .map(|id| id.parse())
+                    .transpose()
+                    .map_err(|_| anyhow!("Could not parse field ID for dynamic field"))?;
+
+                let child_id = field
+                    .child_id_opt()
+                    .map(|id| id.parse())
+                    .transpose()
+                    .map_err(|_| anyhow!("Could not parse child ID for dynamic field"))?;
+
+                results.push((name, child_id, field_id));
+            }
+
+            if page_token.is_none() {
+                break;
+            }
+        }
+
+        Ok(results)
+    }
+
+    /// Helper function to parse metadata from an object.
+    fn parse_object_metadata(
+        &self,
+        object_id: sui::types::Address,
+        object: &sui::grpc::Object,
+    ) -> anyhow::Result<(
+        sui::types::Owner,
+        sui::types::Digest,
+        sui::types::Version,
+        Option<u64>,
+    )> {
+        let owner = object
+            .owner_opt()
+            .ok_or_else(|| anyhow!("Owner missing for object '{object_id}'"))?
+            .try_into()
+            .map_err(|_| anyhow!("Could not parse owner for object '{object_id}'"))?;
+
+        let digest = object
+            .digest_opt()
+            .ok_or_else(|| anyhow!("Digest missing for object '{object_id}'"))?
+            .parse()
+            .map_err(|_| anyhow!("Could not parse digest for object '{object_id}'"))?;
+
+        let version = object
+            .version_opt()
+            .ok_or_else(|| anyhow!("Version missing for object '{object_id}'"))?;
+
+        let balance = object.balance_opt();
+
+        Ok((owner, digest, version, balance))
+    }
+
+    /// Helper function to turn returned object data in prost format into T.
+    fn parse_object_content<T>(&self, object: &sui::grpc::Object) -> anyhow::Result<T>
+    where
+        T: DeserializeOwned,
+    {
+        let Some(json) = object.json_opt() else {
+            bail!("Object content missing");
+        };
+
+        prost_value_to_json_value(json)
+            .and_then(|v| serde_json::from_value::<T>(v).map_err(anyhow::Error::new))
+    }
+}
+
+/// Wrapper for `sui::bag::Bag` projection.
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq, Eq)]
+pub struct Bag {
+    #[serde(flatten)]
+    inner: IdSize,
+}
+
+impl Bag {
+    pub fn new(id: sui::types::Address, size: u64) -> Self {
+        Self {
+            inner: IdSize { id, size },
+        }
+    }
+
+    pub fn id(&self) -> sui::types::Address {
+        self.inner.id
+    }
+
+    pub fn size_u64(&self) -> u64 {
+        self.inner.size
+    }
+
+    pub fn size(&self) -> usize {
+        self.inner.size()
+    }
+}
+
+/// Wrapper for `sui::object_bag::ObjectBag` projection.
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq, Eq)]
+pub struct ObjectBag {
+    #[serde(flatten)]
+    inner: IdSize,
+}
+
+impl ObjectBag {
+    pub fn new(id: sui::types::Address, size: u64) -> Self {
+        Self {
+            inner: IdSize { id, size },
+        }
+    }
+
+    pub fn id(&self) -> sui::types::Address {
+        self.inner.id
+    }
+
+    pub fn size_u64(&self) -> u64 {
+        self.inner.size
+    }
+
+    pub fn size(&self) -> usize {
+        self.inner.size()
+    }
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq, Eq)]
+pub struct IdSize {
+    pub id: sui::types::Address,
+    #[serde(
+        deserialize_with = "crate::types::deserialize_sui_u64",
+        serialize_with = "crate::types::serialize_sui_u64"
+    )]
+    pub size: u64,
+}
+
+impl IdSize {
+    pub fn size(&self) -> usize {
+        usize::try_from(self.size).unwrap_or(0)
+    }
+}
+
+/// A generic response wrapper for fetched objects. Contains metadata such as
+/// the object ID version and owner.
+#[derive(Clone, Debug)]
+pub struct Response<T> {
+    pub object_id: sui::types::Address,
+    pub owner: sui::types::Owner,
+    pub version: sui::types::Version,
+    pub data: T,
+    pub digest: sui::types::Digest,
+    /// If the object is `0x2::coin::Coin`, contains the balance.
+    pub balance: Option<u64>,
+}
+
+impl<T> Response<T> {
+    /// Check if the object is shared.
+    pub fn is_shared(&self) -> bool {
+        matches!(self.owner, sui::types::Owner::Shared(_))
+    }
+
+    /// Check if the object is immutable.
+    pub fn is_immutable(&self) -> bool {
+        matches!(self.owner, sui::types::Owner::Immutable)
+    }
+
+    /// Get initial version of the object if it's shared or current version
+    /// otherwise.
+    pub fn get_initial_version(&self) -> sui::types::Version {
+        match self.owner {
+            sui::types::Owner::Shared(v) => v,
+            _ => self.version,
+        }
+    }
+
+    // Get a Sui object ref.
+    pub fn object_ref(&self) -> sui::types::ObjectReference {
+        sui::types::ObjectReference::new(self.object_id, self.get_initial_version(), self.digest)
+    }
+}
+
+// == Wrappers ==
+
+/// Wrapper around any vec-like structure within parsed Sui object data. These
+/// are always wrapped in a struct with a single `contents` field.
+#[derive(Clone, Debug, Deserialize)]
+pub struct Set<T>
+where
+    T: Eq + Hash,
+{
+    contents: HashSet<T>,
+}
+
+impl<T> Set<T>
+where
+    T: Eq + Hash,
+{
+    pub fn into_inner(self) -> HashSet<T> {
+        self.contents
+    }
+
+    pub fn inner(&self) -> &HashSet<T> {
+        &self.contents
+    }
+
+    pub fn inner_mut(&mut self) -> &mut HashSet<T> {
+        &mut self.contents
+    }
+}
+
+/// Wrapper around any map-like structure within parsed Sui object data. These
+/// are always wrapped in a struct with a single `contents` field. The contents
+/// is a vec of key-value pairs.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct Map<K, V>
+where
+    K: Eq + Hash,
+{
+    contents: HashMap<K, V>,
+}
+
+impl<K, V> Map<K, V>
+where
+    K: Eq + Hash,
+{
+    pub fn new() -> Self {
+        Self {
+            contents: HashMap::new(),
+        }
+    }
+
+    pub fn from_map(contents: HashMap<K, V>) -> Self {
+        Self { contents }
+    }
+
+    pub fn into_inner(self) -> HashMap<K, V> {
+        self.contents
+    }
+
+    pub fn into_map(self) -> HashMap<K, V> {
+        self.into_inner()
+    }
+
+    pub fn inner(&self) -> &HashMap<K, V> {
+        &self.contents
+    }
+
+    pub fn inner_mut(&mut self) -> &mut HashMap<K, V> {
+        &mut self.contents
+    }
+}
+
+impl<K, V> Default for Map<K, V>
+where
+    K: Eq + Hash,
+{
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl<K, V> From<HashMap<K, V>> for Map<K, V>
+where
+    K: Eq + Hash,
+{
+    fn from(contents: HashMap<K, V>) -> Self {
+        Self { contents }
+    }
+}
+
+impl<K, V> FromIterator<(K, V)> for Map<K, V>
+where
+    K: Eq + Hash,
+{
+    fn from_iter<T: IntoIterator<Item = (K, V)>>(iter: T) -> Self {
+        Self {
+            contents: HashMap::from_iter(iter),
+        }
+    }
+}
+
+impl<K, V> Serialize for Map<K, V>
+where
+    K: Eq + Hash + Serialize,
+    V: Serialize,
+{
+    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
+    where
+        S: serde::Serializer,
+    {
+        #[derive(Serialize)]
+        struct PairRef<'a, K, V> {
+            key: &'a K,
+            value: &'a V,
+        }
+
+        #[derive(Serialize)]
+        struct Wrapper<'a, K, V> {
+            contents: Vec<PairRef<'a, K, V>>,
+        }
+
+        let contents = self
+            .contents
+            .iter()
+            .map(|(key, value)| PairRef { key, value })
+            .collect();
+
+        Wrapper { contents }.serialize(serializer)
+    }
+}
+
+impl<'de, K, V> Deserialize<'de> for Map<K, V>
+where
+    K: Eq + Hash + DeserializeOwned,
+    V: DeserializeOwned,
+{
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: Deserializer<'de>,
+    {
+        #[derive(Deserialize)]
+        #[serde(untagged)]
+        enum Wrapper<K, V>
+        where
+            K: Eq + Hash,
+        {
+            Pairs { contents: Vec<Pair<K, V>> },
+            Map { contents: HashMap<K, V> },
+        }
+
+        match Wrapper::<K, V>::deserialize(deserializer)? {
+            Wrapper::Pairs { contents } => Ok(Self {
+                contents: contents
+                    .into_iter()
+                    .map(|Pair { key, value }| (key, value))
+                    .collect(),
+            }),
+            Wrapper::Map { contents } => Ok(Self { contents }),
+        }
+    }
+}
+
+/// Wrapper around `sui::table_vec::TableVec<T>`.
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq, Eq)]
+pub struct TableVec<T> {
+    contents: IdSize,
+    #[serde(skip)]
+    _marker: PhantomData<T>,
+}
+
+impl<T> TableVec<T> {
+    pub fn new(id: sui::types::Address, size: u64) -> Self {
+        Self {
+            contents: IdSize { id, size },
+            _marker: PhantomData,
+        }
+    }
+
+    pub fn id(&self) -> sui::types::Address {
+        self.contents.id
+    }
+
+    pub fn size_u64(&self) -> u64 {
+        self.contents.size
+    }
+
+    pub fn size(&self) -> usize {
+        self.contents.size()
+    }
+}
+
+/// Wrapper around a dynamic map-like structure within parsed Sui object data.
+/// These need to be fetched dynamically from Sui based on the parent object ID.
+#[derive(Clone, Debug, Deserialize)]
+pub struct DynamicMap<K, V> {
+    id: sui::types::Address,
+    size: String,
+    #[serde(default)]
+    _marker: PhantomData<(K, V)>,
+}
+
+impl<K, V> DynamicMap<K, V> {
+    pub fn new(id: sui::types::Address, size: u64) -> Self {
+        Self {
+            id,
+            size: size.to_string(),
+            _marker: PhantomData,
+        }
+    }
+
+    pub fn id(&self) -> sui::types::Address {
+        self.id
+    }
+
+    pub fn size(&self) -> usize {
+        self.size.parse().unwrap_or(0)
+    }
+}
+
+/// Wrapper around a dynamic object map-like structure within parsed Sui object
+/// data. These need to be fetched dynamically from Sui based on the parent
+/// object ID. And then each object needs to be fetched separately (or batched).
+#[derive(Clone, Debug, Deserialize)]
+pub struct DynamicObjectMap<K, V> {
+    id: sui::types::Address,
+    size: String,
+    #[serde(default)]
+    _marker: PhantomData<(K, V)>,
+}
+
+impl<K, V> DynamicObjectMap<K, V> {
+    pub fn id(&self) -> sui::types::Address {
+        self.id
+    }
+
+    pub fn size(&self) -> usize {
+        self.size.parse().unwrap_or(0)
+    }
+}
+
+/// Internal wrapper around a key-value pair within a map-like structure.
+#[derive(Clone, Debug, Deserialize)]
+struct Pair<K, V> {
+    #[serde(alias = "key", alias = "name")]
+    key: K,
+    value: V,
+}
+
+/// Internal wrapper around dynamic map fields.
+#[derive(Clone, Debug, Deserialize)]
+#[serde(untagged)]
+enum ValueOrWrapper<V> {
+    Value(V),
+    Wrapper { value: V },
+}
+
+impl<V> ValueOrWrapper<V> {
+    fn into_inner(self) -> V {
+        match self {
+            ValueOrWrapper::Value(v) => v,
+            ValueOrWrapper::Wrapper { value } => value,
+        }
+    }
+}
+
+#[derive(Clone, Debug, Deserialize)]
+struct DynamicValue<V> {
+    value: ValueOrWrapper<V>,
+}
+
+#[derive(Clone, Debug, Deserialize)]
+struct DynamicPair<K, V> {
+    name: K,
+    value: ValueOrWrapper<V>,
+}
+
+// == Helper functions ==
+
+/// Helper function to transform [`prost_types::Value`] which is returned by the
+/// GRPC into a [`serde_json::Value`]. This can then be easily deserialized into
+/// any Rust struct.
+pub fn prost_value_to_json_value(value: &prost_types::Value) -> anyhow::Result<serde_json::Value> {
+    use {
+        prost_types::value::Kind,
+        serde_json::{Map, Number, Value},
+    };
+
+    let kind = value
+        .kind
+        .as_ref()
+        .ok_or_else(|| anyhow!("Missing kind in prost_types::Value"))?;
+
+    match kind {
+        Kind::NullValue(_) => Ok(Value::Null),
+        Kind::NumberValue(n) => match (n.fract() == 0.0, *n < 0.0) {
+            (true, false) => Ok(Value::Number(Number::from_u128(*n as u128).ok_or_else(
+                || anyhow!("Could not convert number value '{n}' to JSON number"),
+            )?)),
+            (true, true) => Ok(Value::Number(Number::from_i128(*n as i128).ok_or_else(
+                || anyhow!("Could not convert number value '{n}' to JSON number"),
+            )?)),
+            (false, _) => Ok(Value::Number(Number::from_f64(*n).ok_or_else(|| {
+                anyhow!("Could not convert number value '{n}' to JSON number")
+            })?)),
+        },
+        Kind::StringValue(s) => Ok(Value::String(s.clone())),
+        Kind::BoolValue(b) => Ok(Value::Bool(*b)),
+        Kind::StructValue(sv) => {
+            let mut map = Map::with_capacity(sv.fields.len());
+
+            for (k, v) in &sv.fields {
+                map.insert(k.clone(), prost_value_to_json_value(v)?);
+            }
+
+            Ok(Value::Object(map))
+        }
+        Kind::ListValue(lv) => {
+            let mut vec = Vec::with_capacity(lv.values.len());
+
+            for v in &lv.values {
+                vec.push(prost_value_to_json_value(v)?);
+            }
+
+            Ok(Value::Array(vec))
+        }
+    }
+}
diff --git a/sdk/src/nexus/crypto.rs b/sdk/src/nexus/crypto.rs
index 61a2ce44..e6c546d0 100644
--- a/sdk/src/nexus/crypto.rs
+++ b/sdk/src/nexus/crypto.rs
@@ -9,19 +9,19 @@ use {
             session::{Message, Session},
             x3dh::{IdentityKey, PreKeyBundle},
         },
+        events::{NexusEventKind, PreKeyFulfilledEvent},
         nexus::{client::NexusClient, error::NexusError},
-        object_crawler::{fetch_one, Structure},
         sui,
         transactions::crypto,
     },
     anyhow::anyhow,
-    sui_sdk::rpc_types::SuiTransactionBlockEffectsAPI,
+    std::time::Duration,
 };
 
 pub struct HandshakeResult {
     pub session: Session,
-    pub claim_tx_digest: sui::TransactionDigest,
-    pub associate_tx_digest: sui::TransactionDigest,
+    pub claim_tx_digest: sui::types::Digest,
+    pub associate_tx_digest: sui::types::Digest,
 }
 
 pub struct CryptoActions {
@@ -32,13 +32,12 @@ impl CryptoActions {
     /// Perform crypto handshake with Nexus and return the [`Session`] and
     /// the [`IdentityKey`] generated.
     pub async fn handshake(&self, ik: &IdentityKey) -> Result<HandshakeResult, NexusError> {
-        let address = self.client.signer.get_active_address().await?;
+        let address = self.client.signer.get_active_address();
         let nexus_objects = &self.client.nexus_objects;
-        let sui_client = &self.client.signer.get_client().await?;
 
         // == Claim PreKey transaction ==
 
-        let mut tx = sui::ProgrammableTransactionBuilder::new();
+        let mut tx = sui::tx::TransactionBuilder::new();
 
         if let Err(e) = crypto::claim_pre_key_for_self(&mut tx, nexus_objects) {
             return Err(NexusError::TransactionBuilding(e));
@@ -46,52 +45,39 @@ impl CryptoActions {
 
         let mut gas_coin = self.client.gas.acquire_gas_coin().await;
 
-        let tx_data = sui::TransactionData::new_programmable(
-            address,
-            vec![gas_coin.to_object_ref()],
-            tx.finish(),
-            self.client.gas.get_budget(),
-            self.client.reference_gas_price,
-        );
+        tx.set_sender(address);
+        tx.set_gas_budget(self.client.gas.get_budget());
+        tx.set_gas_price(self.client.reference_gas_price);
+
+        tx.add_gas_objects(vec![sui::tx::Input::owned(
+            *gas_coin.object_id(),
+            gas_coin.version(),
+            *gas_coin.digest(),
+        )]);
 
-        let envelope = self.client.signer.sign_tx(tx_data).await?;
+        let tx = tx
+            .finish()
+            .map_err(|e| NexusError::TransactionBuilding(e.into()))?;
+
+        let signature = self.client.signer.sign_tx(&tx).await?;
 
         let claim_response = self
             .client
             .signer
-            .execute_tx(envelope, &mut gas_coin)
+            .execute_tx(tx, signature, &mut gas_coin)
             .await?;
 
         self.client.gas.release_gas_coin(gas_coin).await;
 
-        // == Find the claimed PreKey object ID ==
-
-        let effects = claim_response.effects.expect("Effects must be present");
-
-        let pre_key_object_id = effects
-            .unwrapped()
-            .iter()
-            .find_map(|object| {
-                if object.owner.get_owner_address() == Ok(address) {
-                    return Some(object.object_id());
-                }
-
-                None
-            })
-            .ok_or_else(|| NexusError::Parsing(anyhow!("No PreKey object found")))?;
-
-        // == Parse into PreKeyBundle and initiate the session ==
+        // == Wait for pre key fulfillment ==
 
-        #[derive(serde::Deserialize, Debug)]
-        struct RawPreKey {
-            bytes: Vec<u8>,
-        }
+        let fulfilled_event = self
+            .wait_for_pre_key_fulfilled_event(address, claim_response.checkpoint)
+            .await?;
 
-        let raw_pre_key = fetch_one::<Structure<RawPreKey>>(sui_client, pre_key_object_id)
-            .await
-            .map_err(NexusError::Rpc)?;
+        let pre_key_bytes = fulfilled_event.pre_key_bytes;
 
-        let bundle = bincode::deserialize::<PreKeyBundle>(&raw_pre_key.data.inner().bytes)
+        let bundle = bincode::deserialize::<PreKeyBundle>(&pre_key_bytes)
             .map_err(|e| NexusError::Parsing(e.into()))?;
 
         let (Message::Initial(message), session) =
@@ -102,33 +88,34 @@ impl CryptoActions {
 
         // == Associate PreKey transaction ==
 
-        let mut tx = sui::ProgrammableTransactionBuilder::new();
+        let mut tx = sui::tx::TransactionBuilder::new();
 
-        if let Err(e) = crypto::associate_pre_key_with_sender(
-            &mut tx,
-            nexus_objects,
-            &raw_pre_key.object_ref(),
-            message,
-        ) {
+        if let Err(e) = crypto::associate_pre_key_with_sender(&mut tx, nexus_objects, message) {
             return Err(NexusError::TransactionBuilding(e));
         }
 
         let mut gas_coin = self.client.gas.acquire_gas_coin().await;
 
-        let tx_data = sui::TransactionData::new_programmable(
-            address,
-            vec![gas_coin.to_object_ref()],
-            tx.finish(),
-            self.client.gas.get_budget(),
-            self.client.reference_gas_price,
-        );
+        tx.set_sender(address);
+        tx.set_gas_budget(self.client.gas.get_budget());
+        tx.set_gas_price(self.client.reference_gas_price);
 
-        let envelope = self.client.signer.sign_tx(tx_data).await?;
+        tx.add_gas_objects(vec![sui::tx::Input::owned(
+            *gas_coin.object_id(),
+            gas_coin.version(),
+            *gas_coin.digest(),
+        )]);
+
+        let tx = tx
+            .finish()
+            .map_err(|e| NexusError::TransactionBuilding(e.into()))?;
+
+        let signature = self.client.signer.sign_tx(&tx).await?;
 
         let associate_response = self
             .client
             .signer
-            .execute_tx(envelope, &mut gas_coin)
+            .execute_tx(tx, signature, &mut gas_coin)
             .await?;
 
         self.client.gas.release_gas_coin(gas_coin).await;
@@ -139,6 +126,47 @@ impl CryptoActions {
             associate_tx_digest: associate_response.digest,
         })
     }
+
+    async fn wait_for_pre_key_fulfilled_event(
+        &self,
+        requested_by: sui::types::Address,
+        checkpoint: u64,
+    ) -> Result<PreKeyFulfilledEvent, NexusError> {
+        let fetcher = self.client.event_fetcher();
+        let timeout = tokio::time::sleep(Duration::from_secs(20));
+
+        let (_poller, mut next_page) = fetcher.poll_nexus_events(None, Some(checkpoint));
+
+        tokio::pin!(timeout);
+
+        loop {
+            tokio::select! {
+                result = next_page.recv() => {
+                    let page = match result {
+                        Some(Ok(page)) => page,
+                        Some(Err(e)) => {
+                            return Err(NexusError::Channel(anyhow!("Error fetching events: {}", e)));
+                        }
+                        None => {
+                            return Err(NexusError::Channel(anyhow!("Event fetcher stopped unexpectedly")));
+                        }
+                    };
+
+                    for event in page.events {
+                        if let NexusEventKind::PreKeyFulfilled(e) = event.data {
+                            if e.requested_by == requested_by {
+                                return Ok(e);
+                            }
+                        }
+                    }
+                }
+
+                _ = &mut timeout => {
+                    return Err(NexusError::Timeout(anyhow!("Timeout reached while waiting for PreKeyFulfilledEvent")));
+                }
+            }
+        }
+    }
 }
 
 #[cfg(test)]
@@ -146,102 +174,88 @@ mod tests {
     use {
         crate::{
             crypto::x3dh::{IdentityKey, PreKeyBundle},
-            idents::workflow,
+            events::{NexusEventKind, PreKeyFulfilledEvent},
             sui,
             test_utils::{nexus_mocks, sui_mocks},
         },
-        std::collections::BTreeMap,
+        mockito::Server,
     };
 
     #[tokio::test]
     async fn test_crypto_actions_handshake() {
-        let (mut server, nexus_client) = nexus_mocks::mock_nexus_client().await;
-        let ik = IdentityKey::generate();
-        let address = nexus_client
-            .signer
-            .get_active_address()
-            .await
-            .expect("Failed to get active address");
+        let mut rng = rand::thread_rng();
+        let claim_tx_digest = sui::types::Digest::generate(&mut rng);
+        let associate_tx_digest = sui::types::Digest::generate(&mut rng);
+        let gas_coin_ref = sui_mocks::mock_sui_object_ref();
+        let nexus_objects = sui_mocks::mock_nexus_objects();
 
+        let ik = IdentityKey::generate();
         let receiver_id = IdentityKey::generate();
         let spk_secret = IdentityKey::generate().secret().clone();
         let bundle = PreKeyBundle::new(&receiver_id, 1, &spk_secret, None, None);
 
-        let pre_key_object_ref = sui::ObjectRef {
-            object_id: sui::ObjectID::random(),
-            version: sui::SequenceNumber::from_u64(1),
-            digest: sui::ObjectDigest::random(),
-        };
+        let mut server = Server::new_async().await;
+        let mut ledger_service_mock = sui_mocks::grpc::MockLedgerService::new();
+        let mut tx_service_mock = sui_mocks::grpc::MockTransactionExecutionService::new();
+        let mut sub_service_mock = sui_mocks::grpc::MockSubscriptionService::new();
+
+        sui_mocks::grpc::mock_reference_gas_price(&mut ledger_service_mock, 1000);
+
+        sui_mocks::grpc::mock_execute_transaction_and_wait_for_checkpoint(
+            &mut tx_service_mock,
+            &mut sub_service_mock,
+            &mut ledger_service_mock,
+            claim_tx_digest,
+            gas_coin_ref.clone(),
+            vec![],
+            vec![],
+            vec![],
+        );
 
-        let claim_tx_digest = sui::TransactionDigest::random();
-        let (claim_execute_call, claim_confirm_call) =
-            sui_mocks::rpc::mock_governance_api_execute_execute_transaction_block(
-                &mut server,
-                claim_tx_digest,
-                Some(sui_mocks::mock_sui_transaction_block_effects(
-                    None,
-                    None,
-                    Some(vec![sui::OwnedObjectRef {
-                        owner: sui::Owner::AddressOwner(address),
-                        reference: pre_key_object_ref.clone(),
-                    }]),
-                    None,
-                )),
-                None,
-                None,
-                None,
-            );
-
-        let pre_key_object = sui::ParsedMoveObject {
-            type_: sui::MoveStructTag {
-                address: *nexus_client.nexus_objects.workflow_pkg_id,
-                module: workflow::PreKeyVault::PRE_KEY.module.into(),
-                name: workflow::PreKeyVault::PRE_KEY.name.into(),
-                type_params: vec![],
-            },
-            has_public_transfer: false,
-            fields: sui::MoveStruct::WithFields(BTreeMap::from([(
-                "bytes".into(),
-                sui::MoveValue::Vector(
-                    bincode::serialize(&bundle)
-                        .expect("Failed to serialize PreKeyBundle")
-                        .into_iter()
-                        .map(|b| sui::MoveValue::Number(b.into()))
-                        .collect(),
-                ),
-            )])),
-        };
+        sui_mocks::grpc::mock_execute_transaction_and_wait_for_checkpoint(
+            &mut tx_service_mock,
+            &mut sub_service_mock,
+            &mut ledger_service_mock,
+            associate_tx_digest,
+            gas_coin_ref.clone(),
+            vec![],
+            vec![],
+            vec![],
+        );
 
-        let get_object_call = sui_mocks::rpc::mock_read_api_get_object(
+        let rpc_url = sui_mocks::grpc::mock_server(sui_mocks::grpc::ServerMocks {
+            ledger_service_mock: Some(ledger_service_mock),
+            execution_service_mock: Some(tx_service_mock),
+            subscription_service_mock: Some(sub_service_mock),
+        });
+
+        let client = nexus_mocks::mock_nexus_client(
+            &nexus_objects,
+            &rpc_url,
+            Some(&format!("{}/graphql", server.url())),
+        )
+        .await;
+
+        let pre_key_fulfilled_event = NexusEventKind::PreKeyFulfilled(PreKeyFulfilledEvent {
+            requested_by: client.signer.get_active_address(),
+            pre_key_bytes: bincode::serialize(&bundle).unwrap(),
+        });
+
+        let event_mock = sui_mocks::gql::mock_event_query(
             &mut server,
-            pre_key_object_ref.object_id,
-            pre_key_object,
+            nexus_objects.primitives_pkg_id,
+            vec![pre_key_fulfilled_event],
+            None,
+            None,
         );
 
-        let associate_tx_digest = sui::TransactionDigest::random();
-        let (associate_execute_call, associate_confirm_call) =
-            sui_mocks::rpc::mock_governance_api_execute_execute_transaction_block(
-                &mut server,
-                associate_tx_digest,
-                None,
-                None,
-                None,
-                None,
-            );
-
-        let result = nexus_client
+        let result = client
             .crypto()
             .handshake(&ik)
             .await
             .expect("Failed to perform handshake");
 
-        claim_execute_call.assert_async().await;
-        claim_confirm_call.assert_async().await;
-
-        get_object_call.assert_async().await;
-
-        associate_execute_call.assert_async().await;
-        associate_confirm_call.assert_async().await;
+        event_mock.assert_async().await;
 
         assert_eq!(result.claim_tx_digest, claim_tx_digest);
         assert_eq!(result.associate_tx_digest, associate_tx_digest);
diff --git a/sdk/src/nexus/gas.rs b/sdk/src/nexus/gas.rs
index 58ff1773..c3a717f4 100644
--- a/sdk/src/nexus/gas.rs
+++ b/sdk/src/nexus/gas.rs
@@ -4,13 +4,12 @@
 
 use crate::{
     nexus::{client::NexusClient, error::NexusError},
-    object_crawler::fetch_one,
     sui,
     transactions::gas,
 };
 
 pub struct AddBudgetResult {
-    pub tx_digest: sui::TransactionDigest,
+    pub tx_digest: sui::types::Digest,
 }
 
 pub struct GasActions {
@@ -18,41 +17,49 @@ pub struct GasActions {
 }
 
 impl GasActions {
-    /// Add a Coin [`sui::ObjectRef`] as gas budget for Nexus workflows.
+    /// Add a Coin [`sui::types::ObjectReference`] as gas budget for Nexus workflows.
     pub async fn add_budget(
         &self,
-        coin_object_id: sui::ObjectID,
+        coin_object_id: sui::types::Address,
     ) -> Result<AddBudgetResult, NexusError> {
-        let address = self.client.signer.get_active_address().await?;
+        let address = self.client.signer.get_active_address();
         let nexus_objects = &self.client.nexus_objects;
-        let sui_client = &self.client.signer.get_client().await?;
-        let coin = fetch_one::<serde_json::Value>(sui_client, coin_object_id)
+
+        let coin = self
+            .client
+            .crawler()
+            .get_object_metadata(coin_object_id)
             .await
             .map_err(NexusError::Rpc)?;
 
-        let mut tx = sui::ProgrammableTransactionBuilder::new();
+        let mut tx = sui::tx::TransactionBuilder::new();
 
-        if let Err(e) = gas::add_budget(&mut tx, nexus_objects, address.into(), &coin.object_ref())
-        {
+        if let Err(e) = gas::add_budget(&mut tx, nexus_objects, address, &coin.object_ref()) {
             return Err(NexusError::TransactionBuilding(e));
         }
 
         let mut gas_coin = self.client.gas.acquire_gas_coin().await;
 
-        let tx_data = sui::TransactionData::new_programmable(
-            address,
-            vec![gas_coin.to_object_ref()],
-            tx.finish(),
-            self.client.gas.get_budget(),
-            self.client.reference_gas_price,
-        );
+        tx.set_sender(address);
+        tx.set_gas_budget(self.client.gas.get_budget());
+        tx.set_gas_price(self.client.reference_gas_price);
+
+        tx.add_gas_objects(vec![sui::tx::Input::owned(
+            *gas_coin.object_id(),
+            gas_coin.version(),
+            *gas_coin.digest(),
+        )]);
 
-        let envelope = self.client.signer.sign_tx(tx_data).await?;
+        let tx = tx
+            .finish()
+            .map_err(|e| NexusError::TransactionBuilding(e.into()))?;
+
+        let signature = self.client.signer.sign_tx(&tx).await?;
 
         let response = self
             .client
             .signer
-            .execute_tx(envelope, &mut gas_coin)
+            .execute_tx(tx, signature, &mut gas_coin)
             .await?;
 
         self.client.gas.release_gas_coin(gas_coin).await;
@@ -65,58 +72,57 @@ impl GasActions {
 
 #[cfg(test)]
 mod tests {
-    use {
-        crate::{
-            sui,
-            test_utils::{nexus_mocks, sui_mocks},
-        },
-        std::collections::BTreeMap,
+    use crate::{
+        sui,
+        test_utils::{nexus_mocks, sui_mocks},
     };
 
     #[tokio::test]
     async fn test_gas_actions_add_budget() {
-        let (mut server, nexus_client) = nexus_mocks::mock_nexus_client().await;
-
-        let coin_object_id = sui::ObjectID::random();
-        let coin_object = sui::ParsedMoveObject {
-            type_: sui::MoveStructTag {
-                address: *nexus_client.nexus_objects.workflow_pkg_id,
-                module: sui::move_ident_str!("coin").into(),
-                name: sui::move_ident_str!("Coin").into(),
-                type_params: vec![],
-            },
-            has_public_transfer: false,
-            fields: sui::MoveStruct::WithFields(BTreeMap::from([(
-                "test".into(),
-                sui::MoveValue::Number(1),
-            )])),
-        };
-
-        let get_object_call =
-            sui_mocks::rpc::mock_read_api_get_object(&mut server, coin_object_id, coin_object);
-
-        let tx_digest = sui::TransactionDigest::random();
-        let (execute_call, confirm_call) =
-            sui_mocks::rpc::mock_governance_api_execute_execute_transaction_block(
-                &mut server,
-                tx_digest,
-                None,
-                None,
-                None,
-                None,
-            );
-
-        let result = nexus_client
+        let mut rng = rand::thread_rng();
+        let tx_digest = sui::types::Digest::generate(&mut rng);
+        let gas_coin_ref = sui_mocks::mock_sui_object_ref();
+        let nexus_objects = sui_mocks::mock_nexus_objects();
+        let coin_object_id = sui::types::Address::generate(&mut rng);
+
+        let mut ledger_service_mock = sui_mocks::grpc::MockLedgerService::new();
+        let mut tx_service_mock = sui_mocks::grpc::MockTransactionExecutionService::new();
+        let mut sub_service_mock = sui_mocks::grpc::MockSubscriptionService::new();
+
+        sui_mocks::grpc::mock_reference_gas_price(&mut ledger_service_mock, 1000);
+
+        sui_mocks::grpc::mock_get_object_metadata(
+            &mut ledger_service_mock,
+            sui::types::ObjectReference::new(coin_object_id, 0, tx_digest),
+            sui::types::Owner::Address(sui::types::Address::from_static("0x1")),
+            None,
+        );
+
+        sui_mocks::grpc::mock_execute_transaction_and_wait_for_checkpoint(
+            &mut tx_service_mock,
+            &mut sub_service_mock,
+            &mut ledger_service_mock,
+            tx_digest,
+            gas_coin_ref.clone(),
+            vec![],
+            vec![],
+            vec![],
+        );
+
+        let rpc_url = sui_mocks::grpc::mock_server(sui_mocks::grpc::ServerMocks {
+            ledger_service_mock: Some(ledger_service_mock),
+            execution_service_mock: Some(tx_service_mock),
+            subscription_service_mock: Some(sub_service_mock),
+        });
+
+        let client = nexus_mocks::mock_nexus_client(&nexus_objects, &rpc_url, None).await;
+
+        let result = client
             .gas()
             .add_budget(coin_object_id)
             .await
             .expect("Failed to add budget");
 
-        get_object_call.assert_async().await;
-
-        execute_call.assert_async().await;
-        confirm_call.assert_async().await;
-
         assert_eq!(result.tx_digest, tx_digest);
     }
 }
diff --git a/sdk/src/nexus/mod.rs b/sdk/src/nexus/mod.rs
index bf70b9ff..428224ac 100644
--- a/sdk/src/nexus/mod.rs
+++ b/sdk/src/nexus/mod.rs
@@ -5,7 +5,10 @@
 //! All CLI functionality should be exported to this module in the future.
 
 pub mod client;
+pub mod crawler;
 pub mod crypto;
 pub mod error;
 pub mod gas;
+pub mod scheduler;
+pub mod signer;
 pub mod workflow;
diff --git a/sdk/src/nexus/scheduler.rs b/sdk/src/nexus/scheduler.rs
new file mode 100644
index 00000000..d99aab9f
--- /dev/null
+++ b/sdk/src/nexus/scheduler.rs
@@ -0,0 +1,1464 @@
+//! Scheduler-oriented actions exposed through [`NexusClient`].
+
+use {
+    crate::{
+        events::NexusEventKind,
+        idents::sui_framework,
+        nexus::{
+            client::NexusClient,
+            crawler::Response,
+            error::NexusError,
+            signer::ExecutedTransaction,
+        },
+        sui,
+        transactions::scheduler as scheduler_tx,
+        types::{DataStorage, Task},
+    },
+    anyhow::anyhow,
+    std::collections::HashMap,
+};
+
+/// High-level interface for scheduler operations.
+#[derive(Clone)]
+pub struct SchedulerActions {
+    pub(super) client: NexusClient,
+}
+
+/// Supported generator types for a scheduler task.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum GeneratorKind {
+    Queue,
+    Periodic,
+}
+
+impl From<GeneratorKind> for scheduler_tx::OccurrenceGenerator {
+    fn from(value: GeneratorKind) -> Self {
+        match value {
+            GeneratorKind::Queue => scheduler_tx::OccurrenceGenerator::Queue,
+            GeneratorKind::Periodic => scheduler_tx::OccurrenceGenerator::Periodic,
+        }
+    }
+}
+
+/// Parameters required to create a scheduler task.
+pub struct CreateTaskParams {
+    pub dag_id: sui::types::Address,
+    pub entry_group: String,
+    pub input_data: HashMap<String, HashMap<String, DataStorage>>,
+    pub metadata: Vec<(String, String)>,
+    pub execution_priority_fee_per_gas_unit: u64,
+    pub initial_schedule: Option<OccurrenceRequest>,
+    pub generator: GeneratorKind,
+}
+
+/// Result returned after creating a scheduler task.
+pub struct CreateTaskResult {
+    pub tx_digest: sui::types::Digest,
+    pub task_id: sui::types::Address,
+    pub initial_schedule: Option<ScheduleExecutionResult>,
+}
+
+/// Result returned after enqueuing an occurrence.
+pub struct ScheduleExecutionResult {
+    pub tx_digest: sui::types::Digest,
+    pub event: Option<NexusEventKind>,
+}
+
+/// Parameters for a sporadic occurrence (start/deadline offsets).
+#[derive(Clone, Debug)]
+pub struct OccurrenceRequest {
+    pub start_ms: Option<u64>,
+    pub deadline_ms: Option<u64>,
+    pub start_offset_ms: Option<u64>,
+    pub deadline_offset_ms: Option<u64>,
+    pub priority_fee_per_gas_unit: u64,
+}
+
+impl OccurrenceRequest {
+    pub fn new(
+        start_ms: Option<u64>,
+        deadline_ms: Option<u64>,
+        start_offset_ms: Option<u64>,
+        deadline_offset_ms: Option<u64>,
+        priority_fee_per_gas_unit: u64,
+        require_start: bool,
+    ) -> Result<Self, NexusError> {
+        validate_schedule_options(
+            start_ms,
+            deadline_ms,
+            start_offset_ms,
+            deadline_offset_ms,
+            require_start,
+        )?;
+
+        Ok(Self {
+            start_ms,
+            deadline_ms,
+            start_offset_ms,
+            deadline_offset_ms,
+            priority_fee_per_gas_unit,
+        })
+    }
+}
+
+/// Actions supported when mutating task state.
+#[derive(Clone, Copy, Debug)]
+pub enum TaskStateAction {
+    Pause,
+    Resume,
+    Cancel,
+}
+
+/// Configuration for periodic scheduling.
+pub struct PeriodicScheduleConfig {
+    pub first_start_ms: u64,
+    pub period_ms: u64,
+    pub deadline_offset_ms: Option<u64>,
+    pub max_iterations: Option<u64>,
+    pub priority_fee_per_gas_unit: u64,
+}
+
+pub struct PeriodicScheduleResult {
+    pub tx_digest: sui::types::Digest,
+}
+
+pub struct DisablePeriodicResult {
+    pub tx_digest: sui::types::Digest,
+}
+
+pub struct UpdateMetadataResult {
+    pub tx_digest: sui::types::Digest,
+    pub entries: usize,
+}
+
+pub struct TaskStateResult {
+    pub tx_digest: sui::types::Digest,
+    pub state: TaskStateAction,
+}
+
+impl SchedulerActions {
+    /// Create a scheduler task and optionally enqueue its first occurrence.
+    pub async fn create_task(
+        &self,
+        params: CreateTaskParams,
+    ) -> Result<CreateTaskResult, NexusError> {
+        let CreateTaskParams {
+            dag_id,
+            entry_group,
+            input_data,
+            metadata,
+            execution_priority_fee_per_gas_unit,
+            initial_schedule: initial_schedule_request,
+            generator,
+        } = params;
+        let address = self.client.signer.get_active_address();
+        let objects = &self.client.nexus_objects;
+
+        let mut tx = sui::tx::TransactionBuilder::new();
+
+        let metadata_arg = scheduler_tx::new_metadata(&mut tx, objects, metadata.iter().cloned())
+            .map_err(NexusError::TransactionBuilding)?;
+
+        let constraints_arg =
+            scheduler_tx::new_constraints_policy(&mut tx, objects, generator.into())
+                .map_err(NexusError::TransactionBuilding)?;
+
+        let execution_arg = scheduler_tx::new_execution_policy(
+            &mut tx,
+            objects,
+            dag_id,
+            execution_priority_fee_per_gas_unit,
+            entry_group.as_str(),
+            &input_data,
+        )
+        .map_err(NexusError::TransactionBuilding)?;
+
+        let task = scheduler_tx::new_task(
+            &mut tx,
+            objects,
+            metadata_arg,
+            constraints_arg,
+            execution_arg,
+        )
+        .map_err(NexusError::TransactionBuilding)?;
+
+        let task_type = crate::idents::workflow::into_type_tag(
+            objects.workflow_pkg_id,
+            crate::idents::workflow::Scheduler::TASK,
+        );
+
+        tx.move_call(
+            sui::tx::Function::new(
+                sui_framework::PACKAGE_ID,
+                sui_framework::Transfer::PUBLIC_SHARE_OBJECT.module,
+                sui_framework::Transfer::PUBLIC_SHARE_OBJECT.name,
+                vec![task_type],
+            ),
+            vec![task],
+        );
+
+        let mut gas_coin = self.client.gas.acquire_gas_coin().await;
+
+        tx.set_sender(address);
+        tx.set_gas_budget(self.client.gas.get_budget());
+        tx.set_gas_price(self.client.reference_gas_price);
+
+        tx.add_gas_objects(vec![sui::tx::Input::owned(
+            *gas_coin.object_id(),
+            gas_coin.version(),
+            *gas_coin.digest(),
+        )]);
+
+        let tx = tx
+            .finish()
+            .map_err(|e| NexusError::TransactionBuilding(e.into()))?;
+
+        let signature = self.client.signer.sign_tx(&tx).await?;
+
+        let response = self
+            .client
+            .signer
+            .execute_tx(tx, signature, &mut gas_coin)
+            .await?;
+
+        self.client.gas.release_gas_coin(gas_coin).await;
+
+        let task_id = extract_task_id(&response)?;
+
+        let mut initial_schedule_result = None;
+        if initial_schedule_request.is_some() && generator != GeneratorKind::Queue {
+            return Err(NexusError::Configuration(
+                "Initial queue schedule can only be used with the queue generator".into(),
+            ));
+        }
+
+        if let Some(schedule) = initial_schedule_request {
+            let task_object = self.fetch_task(task_id).await?;
+            initial_schedule_result = Some(
+                self.enqueue_occurrence(&task_object, schedule, address)
+                    .await?,
+            );
+        }
+
+        Ok(CreateTaskResult {
+            tx_digest: response.digest,
+            task_id,
+            initial_schedule: initial_schedule_result,
+        })
+    }
+
+    /// Update metadata entries associated with a task.
+    pub async fn update_metadata(
+        &self,
+        task_id: sui::types::Address,
+        metadata: Vec<(String, String)>,
+    ) -> Result<UpdateMetadataResult, NexusError> {
+        let address = self.client.signer.get_active_address();
+        let mut tx = sui::tx::TransactionBuilder::new();
+        let objects = &self.client.nexus_objects;
+
+        let task = self.fetch_task(task_id).await?;
+        let task_ref = task.object_ref();
+
+        let metadata_arg =
+            scheduler_tx::new_metadata(&mut tx, objects, metadata.clone().into_iter())
+                .map_err(NexusError::TransactionBuilding)?;
+
+        scheduler_tx::update_metadata(&mut tx, objects, &task_ref, metadata_arg)
+            .map_err(NexusError::TransactionBuilding)?;
+
+        let mut gas_coin = self.client.gas.acquire_gas_coin().await;
+
+        tx.set_sender(address);
+        tx.set_gas_budget(self.client.gas.get_budget());
+        tx.set_gas_price(self.client.reference_gas_price);
+
+        tx.add_gas_objects(vec![sui::tx::Input::owned(
+            *gas_coin.object_id(),
+            gas_coin.version(),
+            *gas_coin.digest(),
+        )]);
+
+        let tx = tx
+            .finish()
+            .map_err(|e| NexusError::TransactionBuilding(e.into()))?;
+
+        let signature = self.client.signer.sign_tx(&tx).await?;
+
+        let response = self
+            .client
+            .signer
+            .execute_tx(tx, signature, &mut gas_coin)
+            .await?;
+
+        self.client.gas.release_gas_coin(gas_coin).await;
+
+        Ok(UpdateMetadataResult {
+            tx_digest: response.digest,
+            entries: metadata.len(),
+        })
+    }
+
+    /// Set the scheduler state for a task (pause/resume/cancel).
+    pub async fn set_task_state(
+        &self,
+        task_id: sui::types::Address,
+        request: TaskStateAction,
+    ) -> Result<TaskStateResult, NexusError> {
+        let address = self.client.signer.get_active_address();
+        let mut tx = sui::tx::TransactionBuilder::new();
+        let objects = &self.client.nexus_objects;
+
+        let task = self.fetch_task(task_id).await?;
+        let task_ref = task.object_ref();
+
+        match request {
+            TaskStateAction::Pause => {
+                scheduler_tx::pause_time_constraint_for_task(&mut tx, objects, &task_ref)
+            }
+            TaskStateAction::Resume => {
+                scheduler_tx::resume_time_constraint_for_task(&mut tx, objects, &task_ref)
+            }
+            TaskStateAction::Cancel => {
+                scheduler_tx::cancel_time_constraint_for_task(&mut tx, objects, &task_ref)
+            }
+        }
+        .map_err(NexusError::TransactionBuilding)?;
+
+        let mut gas_coin = self.client.gas.acquire_gas_coin().await;
+
+        tx.set_sender(address);
+        tx.set_gas_budget(self.client.gas.get_budget());
+        tx.set_gas_price(self.client.reference_gas_price);
+
+        tx.add_gas_objects(vec![sui::tx::Input::owned(
+            *gas_coin.object_id(),
+            gas_coin.version(),
+            *gas_coin.digest(),
+        )]);
+
+        let tx = tx
+            .finish()
+            .map_err(|e| NexusError::TransactionBuilding(e.into()))?;
+
+        let signature = self.client.signer.sign_tx(&tx).await?;
+
+        let response = self
+            .client
+            .signer
+            .execute_tx(tx, signature, &mut gas_coin)
+            .await?;
+
+        self.client.gas.release_gas_coin(gas_coin).await;
+
+        Ok(TaskStateResult {
+            tx_digest: response.digest,
+            state: request,
+        })
+    }
+
+    /// Add a sporadic occurrence for an existing task.
+    pub async fn add_occurrence(
+        &self,
+        task_id: sui::types::Address,
+        request: OccurrenceRequest,
+    ) -> Result<ScheduleExecutionResult, NexusError> {
+        let address = self.client.signer.get_active_address();
+        let task = self.fetch_task(task_id).await?;
+
+        self.enqueue_occurrence(&task, request, address).await
+    }
+
+    /// Configure or update periodic scheduling for a task.
+    pub async fn configure_periodic(
+        &self,
+        task_id: sui::types::Address,
+        config: PeriodicScheduleConfig,
+    ) -> Result<PeriodicScheduleResult, NexusError> {
+        let address = self.client.signer.get_active_address();
+        let mut tx = sui::tx::TransactionBuilder::new();
+        let objects = &self.client.nexus_objects;
+        let task = self.fetch_task(task_id).await?;
+        let task_ref = task.object_ref();
+
+        scheduler_tx::new_or_modify_periodic_for_task(
+            &mut tx,
+            objects,
+            &task_ref,
+            scheduler_tx::PeriodicScheduleInputs {
+                first_start_ms: config.first_start_ms,
+                period_ms: config.period_ms,
+                deadline_offset_ms: config.deadline_offset_ms,
+                max_iterations: config.max_iterations,
+                priority_fee_per_gas_unit: config.priority_fee_per_gas_unit,
+            },
+        )
+        .map_err(NexusError::TransactionBuilding)?;
+
+        let mut gas_coin = self.client.gas.acquire_gas_coin().await;
+
+        tx.set_sender(address);
+        tx.set_gas_budget(self.client.gas.get_budget());
+        tx.set_gas_price(self.client.reference_gas_price);
+
+        tx.add_gas_objects(vec![sui::tx::Input::owned(
+            *gas_coin.object_id(),
+            gas_coin.version(),
+            *gas_coin.digest(),
+        )]);
+
+        let tx = tx
+            .finish()
+            .map_err(|e| NexusError::TransactionBuilding(e.into()))?;
+
+        let signature = self.client.signer.sign_tx(&tx).await?;
+
+        let response = self
+            .client
+            .signer
+            .execute_tx(tx, signature, &mut gas_coin)
+            .await?;
+
+        self.client.gas.release_gas_coin(gas_coin).await;
+
+        Ok(PeriodicScheduleResult {
+            tx_digest: response.digest,
+        })
+    }
+
+    /// Disable periodic scheduling for a task.
+    pub async fn disable_periodic(
+        &self,
+        task_id: sui::types::Address,
+    ) -> Result<DisablePeriodicResult, NexusError> {
+        let address = self.client.signer.get_active_address();
+        let mut tx = sui::tx::TransactionBuilder::new();
+        let objects = &self.client.nexus_objects;
+        let task = self.fetch_task(task_id).await?;
+        let task_ref = task.object_ref();
+
+        scheduler_tx::disable_periodic_for_task(&mut tx, objects, &task_ref)
+            .map_err(NexusError::TransactionBuilding)?;
+
+        let mut gas_coin = self.client.gas.acquire_gas_coin().await;
+
+        tx.set_sender(address);
+        tx.set_gas_budget(self.client.gas.get_budget());
+        tx.set_gas_price(self.client.reference_gas_price);
+
+        tx.add_gas_objects(vec![sui::tx::Input::owned(
+            *gas_coin.object_id(),
+            gas_coin.version(),
+            *gas_coin.digest(),
+        )]);
+
+        let tx = tx
+            .finish()
+            .map_err(|e| NexusError::TransactionBuilding(e.into()))?;
+
+        let signature = self.client.signer.sign_tx(&tx).await?;
+
+        let response = self
+            .client
+            .signer
+            .execute_tx(tx, signature, &mut gas_coin)
+            .await?;
+
+        self.client.gas.release_gas_coin(gas_coin).await;
+
+        Ok(DisablePeriodicResult {
+            tx_digest: response.digest,
+        })
+    }
+
+    async fn enqueue_occurrence(
+        &self,
+        task: &Response<Task>,
+        request: OccurrenceRequest,
+        address: sui::types::Address,
+    ) -> Result<ScheduleExecutionResult, NexusError> {
+        let mut tx = sui::tx::TransactionBuilder::new();
+        let objects = &self.client.nexus_objects;
+        let task_ref = task.object_ref();
+
+        if let Some(start_ms) = request.start_ms {
+            let deadline_offset = request
+                .deadline_offset_ms
+                .or_else(|| request.deadline_ms.map(|deadline| deadline - start_ms));
+
+            scheduler_tx::add_occurrence_absolute_for_task(
+                &mut tx,
+                objects,
+                &task_ref,
+                start_ms,
+                deadline_offset,
+                request.priority_fee_per_gas_unit,
+            )
+        } else {
+            scheduler_tx::add_occurrence_relative_for_task(
+                &mut tx,
+                objects,
+                &task_ref,
+                request.start_offset_ms.expect("validated start offset"),
+                request.deadline_offset_ms,
+                request.priority_fee_per_gas_unit,
+            )
+        }
+        .map_err(NexusError::TransactionBuilding)?;
+
+        let mut gas_coin = self.client.gas.acquire_gas_coin().await;
+
+        tx.set_sender(address);
+        tx.set_gas_budget(self.client.gas.get_budget());
+        tx.set_gas_price(self.client.reference_gas_price);
+
+        tx.add_gas_objects(vec![sui::tx::Input::owned(
+            *gas_coin.object_id(),
+            gas_coin.version(),
+            *gas_coin.digest(),
+        )]);
+
+        let tx = tx
+            .finish()
+            .map_err(|e| NexusError::TransactionBuilding(e.into()))?;
+
+        let signature = self.client.signer.sign_tx(&tx).await?;
+
+        let response = self
+            .client
+            .signer
+            .execute_tx(tx, signature, &mut gas_coin)
+            .await?;
+
+        self.client.gas.release_gas_coin(gas_coin).await;
+
+        Ok(ScheduleExecutionResult {
+            tx_digest: response.digest,
+            event: extract_occurrence_event(&response),
+        })
+    }
+
+    async fn fetch_task(&self, task_id: sui::types::Address) -> Result<Response<Task>, NexusError> {
+        self.client
+            .crawler()
+            .get_object::<Task>(task_id)
+            .await
+            .map_err(NexusError::Rpc)
+    }
+}
+
+fn extract_task_id(response: &ExecutedTransaction) -> Result<sui::types::Address, NexusError> {
+    response
+        .events
+        .iter()
+        .find_map(|event| match &event.data {
+            NexusEventKind::TaskCreated(e) => Some(e.task),
+            _ => None,
+        })
+        .ok_or_else(|| NexusError::Parsing(anyhow!("TaskCreatedEvent not found in response")))
+}
+
+fn extract_occurrence_event(response: &ExecutedTransaction) -> Option<NexusEventKind> {
+    response.events.iter().find_map(|event| match &event.data {
+        NexusEventKind::RequestScheduledOccurrence(_) => Some(event.data.clone()),
+        NexusEventKind::OccurrenceScheduled(_) => Some(event.data.clone()),
+        _ => None,
+    })
+}
+
+fn validate_schedule_options(
+    start_ms: Option<u64>,
+    deadline_ms: Option<u64>,
+    start_offset_ms: Option<u64>,
+    deadline_offset_ms: Option<u64>,
+    require_start: bool,
+) -> Result<(), NexusError> {
+    if require_start && start_ms.is_none() && start_offset_ms.is_none() {
+        return Err(NexusError::Configuration(
+            "Provide either an absolute start or a start offset".into(),
+        ));
+    }
+
+    if deadline_ms.is_some() && start_ms.is_none() {
+        return Err(NexusError::Configuration(
+            "Absolute deadlines require an absolute start time".into(),
+        ));
+    }
+
+    if start_ms.is_none()
+        && start_offset_ms.is_none()
+        && (deadline_ms.is_some() || deadline_offset_ms.is_some())
+    {
+        return Err(NexusError::Configuration(
+            "Deadline flags require a corresponding start flag".into(),
+        ));
+    }
+
+    if let Some(start) = start_ms {
+        ensure_start_before_deadline(Some(start), deadline_ms)?;
+    }
+
+    ensure_offset_deadline_valid(start_ms, start_offset_ms, deadline_offset_ms)?;
+
+    Ok(())
+}
+
+fn ensure_start_before_deadline(
+    start_ms: Option<u64>,
+    deadline_ms: Option<u64>,
+) -> Result<(), NexusError> {
+    if let (Some(start), Some(deadline)) = (start_ms, deadline_ms) {
+        if deadline < start {
+            return Err(NexusError::Configuration(format!(
+                "Deadline ({deadline}) cannot be earlier than start ({start})"
+            )));
+        }
+    }
+    Ok(())
+}
+
+fn ensure_offset_deadline_valid(
+    start_ms: Option<u64>,
+    start_offset_ms: Option<u64>,
+    deadline_offset_ms: Option<u64>,
+) -> Result<(), NexusError> {
+    if deadline_offset_ms.is_some() && start_offset_ms.is_none() && start_ms.is_none() {
+        return Err(NexusError::Configuration(
+            "Deadline offset requires either an absolute start or a start offset".into(),
+        ));
+    }
+
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use {
+        super::*,
+        crate::{
+            events::{
+                NexusEvent,
+                NexusEventKind,
+                OccurrenceScheduledEvent,
+                RequestScheduledOccurrenceEvent,
+                TaskCreatedEvent,
+            },
+            nexus::{
+                client::NexusClient,
+                crawler::{Bag, Map, ObjectBag, TableVec},
+                error::NexusError,
+                signer::ExecutedTransaction,
+            },
+            sui,
+            test_utils::{nexus_mocks, sui_mocks},
+            types::{
+                ConfiguredAutomaton,
+                ConstraintsData,
+                DataStorage,
+                DeterministicAutomaton,
+                ExecutionData,
+                Metadata,
+                NexusData,
+                NexusObjects,
+                Policy,
+                PolicySymbol,
+                TaskState,
+                TypeName,
+            },
+        },
+        rand::thread_rng,
+        serde::Serialize,
+        serde_json::json,
+    };
+
+    fn dummy_executed_transaction(events: Vec<NexusEvent>) -> ExecutedTransaction {
+        let mut rng = thread_rng();
+
+        ExecutedTransaction {
+            effects: sui::types::TransactionEffectsV2 {
+                status: sui::types::ExecutionStatus::Success,
+                epoch: 0,
+                gas_used: sui::types::GasCostSummary::new(0, 0, 0, 0),
+                transaction_digest: sui::types::Digest::generate(&mut rng),
+                gas_object_index: None,
+                events_digest: None,
+                dependencies: vec![],
+                lamport_version: 0,
+                changed_objects: vec![],
+                unchanged_consensus_objects: vec![],
+                auxiliary_data_digest: None,
+            },
+            events,
+            objects: vec![],
+            digest: sui::types::Digest::generate(&mut rng),
+            checkpoint: 0,
+        }
+    }
+    fn sample_input_data() -> HashMap<String, HashMap<String, DataStorage>> {
+        HashMap::from([(
+            "entry_vertex".to_string(),
+            HashMap::from([(
+                "entry_port".to_string(),
+                NexusData::new_inline(json!("payload")).commit_inline_plain(),
+            )]),
+        )])
+    }
+
+    fn mock_task_object(
+        task_id: sui::types::Address,
+        owner: sui::types::Address,
+    ) -> serde_json::Value {
+        let metadata = Metadata {
+            values: Map::from_iter([("initial".to_string(), "value".to_string())]),
+        };
+
+        let dfa = DeterministicAutomaton {
+            states: TableVec::new(sui::types::Address::from_static("0x100"), 1),
+            alphabet: TableVec::new(sui::types::Address::from_static("0x101"), 0),
+            transition: TableVec::new(sui::types::Address::from_static("0x102"), 1),
+            accepting: TableVec::new(sui::types::Address::from_static("0x103"), 1),
+            start: 0,
+        };
+
+        let constraints = Policy {
+            id: sui::types::Address::from_static("0x400"),
+            dfa: ConfiguredAutomaton {
+                id: sui::types::Address::from_static("0x401"),
+                dfa: dfa.clone(),
+            },
+            state_index: 0,
+            data: ConstraintsData::default(),
+        };
+
+        let execution = Policy {
+            id: sui::types::Address::from_static("0x500"),
+            dfa: ConfiguredAutomaton {
+                id: sui::types::Address::from_static("0x600"),
+                dfa,
+            },
+            state_index: 0,
+            data: ExecutionData::default(),
+        };
+
+        let task = Task {
+            id: task_id,
+            owner,
+            metadata,
+            constraints,
+            execution,
+            state: TaskState::Active,
+            data: Bag::new(sui::types::Address::from_static("0x700"), 0),
+            objects: ObjectBag::new(sui::types::Address::from_static("0x701"), 0),
+        };
+
+        serde_json::to_value(task).expect("serialize task")
+    }
+
+    fn generator_symbol(workflow_pkg_id: sui::types::Address, name: &str) -> PolicySymbol {
+        PolicySymbol::Witness(TypeName::new(&format!(
+            "{workflow_pkg_id}::scheduler::{name}"
+        )))
+    }
+
+    fn queue_generator_symbol(workflow_pkg_id: sui::types::Address) -> PolicySymbol {
+        generator_symbol(workflow_pkg_id, "QueueGeneratorWitness")
+    }
+
+    fn event_bcs(
+        primitives_pkg: sui::types::Address,
+        workflow_pkg: sui::types::Address,
+        kind: NexusEventKind,
+    ) -> sui::types::Event {
+        #[derive(Serialize)]
+        struct Wrapper<'a, T: Serialize + ?Sized> {
+            event: &'a T,
+        }
+
+        let event_type = sui::types::StructTag::new(
+            workflow_pkg,
+            sui::types::Identifier::from_static("scheduler"),
+            sui::types::Identifier::new(kind.name()).unwrap(),
+            vec![],
+        );
+
+        let wrapper_tag = sui::types::StructTag::new(
+            primitives_pkg,
+            crate::idents::primitives::Event::EVENT_WRAPPER.module,
+            crate::idents::primitives::Event::EVENT_WRAPPER.name,
+            vec![sui::types::TypeTag::Struct(Box::new(event_type))],
+        );
+
+        let bcs = match &kind {
+            NexusEventKind::RequestScheduledOccurrence(ev) => {
+                bcs::to_bytes(&Wrapper { event: ev }).unwrap()
+            }
+            NexusEventKind::RequestScheduledWalk(ev) => {
+                bcs::to_bytes(&Wrapper { event: ev }).unwrap()
+            }
+            NexusEventKind::OccurrenceScheduled(ev) => {
+                bcs::to_bytes(&Wrapper { event: ev }).unwrap()
+            }
+            NexusEventKind::TaskCreated(ev) => bcs::to_bytes(&Wrapper { event: ev }).unwrap(),
+            NexusEventKind::TaskPaused(ev) => bcs::to_bytes(&Wrapper { event: ev }).unwrap(),
+            NexusEventKind::TaskResumed(ev) => bcs::to_bytes(&Wrapper { event: ev }).unwrap(),
+            NexusEventKind::TaskCanceled(ev) => bcs::to_bytes(&Wrapper { event: ev }).unwrap(),
+            _ => bcs::to_bytes(&Wrapper { event: &kind }).unwrap(),
+        };
+
+        sui_mocks::mock_sui_event(primitives_pkg, wrapper_tag, bcs)
+    }
+
+    async fn mock_nexus_client_with_server(
+        ledger_service_mock: sui_mocks::grpc::MockLedgerService,
+        execution_service_mock: sui_mocks::grpc::MockTransactionExecutionService,
+        subscription_service_mock: sui_mocks::grpc::MockSubscriptionService,
+        nexus_objects: NexusObjects,
+    ) -> (String, NexusClient) {
+        let rpc_url = sui_mocks::grpc::mock_server(sui_mocks::grpc::ServerMocks {
+            ledger_service_mock: Some(ledger_service_mock),
+            execution_service_mock: Some(execution_service_mock),
+            subscription_service_mock: Some(subscription_service_mock),
+        });
+
+        let nexus_client = nexus_mocks::mock_nexus_client(&nexus_objects, &rpc_url, None).await;
+
+        (rpc_url, nexus_client)
+    }
+
+    #[tokio::test]
+    async fn test_scheduler_create_task_without_initial_schedule() {
+        let mut rng = rand::thread_rng();
+        let mut ledger_service_mock = sui_mocks::grpc::MockLedgerService::new();
+        let mut execution_service_mock = sui_mocks::grpc::MockTransactionExecutionService::new();
+        let mut subscription_service_mock = sui_mocks::grpc::MockSubscriptionService::new();
+
+        sui_mocks::grpc::mock_reference_gas_price(&mut ledger_service_mock, 1_000);
+
+        let digest = sui::types::Digest::generate(&mut rng);
+        let gas_coin_ref = sui_mocks::mock_sui_object_ref();
+
+        let nexus_objects = sui_mocks::mock_nexus_objects();
+        let owner = sui::types::Address::generate(&mut rng);
+        let task_id = sui::types::Address::generate(&mut rng);
+        let dag_id = sui::types::Address::generate(&mut rng);
+
+        let events = vec![event_bcs(
+            nexus_objects.primitives_pkg_id,
+            nexus_objects.workflow_pkg_id,
+            NexusEventKind::TaskCreated(TaskCreatedEvent {
+                task: task_id,
+                owner,
+            }),
+        )];
+
+        sui_mocks::grpc::mock_execute_transaction_and_wait_for_checkpoint(
+            &mut execution_service_mock,
+            &mut subscription_service_mock,
+            &mut ledger_service_mock,
+            digest,
+            gas_coin_ref.clone(),
+            vec![],
+            vec![],
+            events,
+        );
+
+        let (_url, nexus_client) = mock_nexus_client_with_server(
+            ledger_service_mock,
+            execution_service_mock,
+            subscription_service_mock,
+            nexus_objects.clone(),
+        )
+        .await;
+
+        let params = CreateTaskParams {
+            dag_id,
+            entry_group: "entry".into(),
+            input_data: sample_input_data(),
+            metadata: vec![("team".into(), "sdk".into())],
+            execution_priority_fee_per_gas_unit: 1,
+            initial_schedule: None,
+            generator: GeneratorKind::Queue,
+        };
+
+        let result = nexus_client
+            .scheduler()
+            .create_task(params)
+            .await
+            .expect("task created");
+
+        assert_eq!(result.task_id, task_id);
+        assert_eq!(result.tx_digest, digest);
+        assert!(result.initial_schedule.is_none());
+    }
+
+    #[tokio::test]
+    async fn test_scheduler_create_task_with_initial_schedule() {
+        let mut rng = rand::thread_rng();
+        let mut ledger_service_mock = sui_mocks::grpc::MockLedgerService::new();
+        let mut execution_service_mock = sui_mocks::grpc::MockTransactionExecutionService::new();
+        let mut subscription_service_mock = sui_mocks::grpc::MockSubscriptionService::new();
+
+        sui_mocks::grpc::mock_reference_gas_price(&mut ledger_service_mock, 1_000);
+
+        let creation_digest = sui::types::Digest::generate(&mut rng);
+        let schedule_digest = sui::types::Digest::generate(&mut rng);
+        let gas_coin_ref = sui_mocks::mock_sui_object_ref();
+
+        let nexus_objects = sui_mocks::mock_nexus_objects();
+        let owner = sui::types::Address::generate(&mut rng);
+        let task_id = sui::types::Address::generate(&mut rng);
+        let dag_id = sui::types::Address::generate(&mut rng);
+
+        let creation_events = vec![event_bcs(
+            nexus_objects.primitives_pkg_id,
+            nexus_objects.workflow_pkg_id,
+            NexusEventKind::TaskCreated(TaskCreatedEvent {
+                task: task_id,
+                owner,
+            }),
+        )];
+
+        // Creation TX
+        sui_mocks::grpc::mock_execute_transaction_and_wait_for_checkpoint(
+            &mut execution_service_mock,
+            &mut subscription_service_mock,
+            &mut ledger_service_mock,
+            creation_digest,
+            gas_coin_ref.clone(),
+            vec![],
+            vec![],
+            creation_events,
+        );
+
+        // Task fetch
+        let task_object_json = mock_task_object(task_id, owner);
+        let task_ref =
+            sui::types::ObjectReference::new(task_id, 1, sui::types::Digest::generate(&mut rng));
+        sui_mocks::grpc::mock_get_object_json(
+            &mut ledger_service_mock,
+            task_ref,
+            sui::types::Owner::Address(owner),
+            task_object_json,
+        );
+
+        // Scheduled occurrence event
+        let queue_generator = queue_generator_symbol(nexus_objects.workflow_pkg_id);
+        let scheduled_event =
+            NexusEventKind::RequestScheduledOccurrence(RequestScheduledOccurrenceEvent {
+                request: OccurrenceScheduledEvent {
+                    task: task_id,
+                    generator: queue_generator.clone(),
+                },
+                priority: 10,
+                request_ms: 100,
+                start_ms: 200,
+                deadline_ms: 300,
+            });
+
+        sui_mocks::grpc::mock_execute_transaction_and_wait_for_checkpoint(
+            &mut execution_service_mock,
+            &mut subscription_service_mock,
+            &mut ledger_service_mock,
+            schedule_digest,
+            gas_coin_ref.clone(),
+            vec![],
+            vec![],
+            vec![event_bcs(
+                nexus_objects.primitives_pkg_id,
+                nexus_objects.workflow_pkg_id,
+                scheduled_event.clone(),
+            )],
+        );
+
+        let (_url, nexus_client) = mock_nexus_client_with_server(
+            ledger_service_mock,
+            execution_service_mock,
+            subscription_service_mock,
+            nexus_objects.clone(),
+        )
+        .await;
+
+        let initial_schedule =
+            OccurrenceRequest::new(Some(1_000), Some(2_000), None, None, 5, true)
+                .expect("valid request");
+
+        let params = CreateTaskParams {
+            dag_id,
+            entry_group: "entry".into(),
+            input_data: sample_input_data(),
+            metadata: vec![],
+            execution_priority_fee_per_gas_unit: 5,
+            initial_schedule: Some(initial_schedule),
+            generator: GeneratorKind::Queue,
+        };
+
+        let result = nexus_client
+            .scheduler()
+            .create_task(params)
+            .await
+            .expect("task created");
+
+        assert_eq!(result.task_id, task_id);
+        let schedule = result.initial_schedule.expect("schedule created");
+        assert_eq!(schedule.tx_digest, schedule_digest);
+        assert!(matches!(
+            schedule.event,
+            Some(NexusEventKind::RequestScheduledOccurrence(env))
+                if env.request.task == task_id && env.priority == 10 && env.start_ms == 200
+        ));
+    }
+
+    #[tokio::test]
+    async fn test_scheduler_update_metadata() {
+        let mut rng = rand::thread_rng();
+        let mut ledger_service_mock = sui_mocks::grpc::MockLedgerService::new();
+        let mut execution_service_mock = sui_mocks::grpc::MockTransactionExecutionService::new();
+        let mut subscription_service_mock = sui_mocks::grpc::MockSubscriptionService::new();
+
+        sui_mocks::grpc::mock_reference_gas_price(&mut ledger_service_mock, 1_000);
+
+        let digest = sui::types::Digest::generate(&mut rng);
+        let gas_coin_ref = sui_mocks::mock_sui_object_ref();
+
+        let nexus_objects = sui_mocks::mock_nexus_objects();
+        let task_id = sui::types::Address::generate(&mut rng);
+        let owner = sui::types::Address::generate(&mut rng);
+
+        // Task fetch
+        let task_object_json = mock_task_object(task_id, owner);
+        let task_ref =
+            sui::types::ObjectReference::new(task_id, 1, sui::types::Digest::generate(&mut rng));
+        sui_mocks::grpc::mock_get_object_json(
+            &mut ledger_service_mock,
+            task_ref,
+            sui::types::Owner::Address(owner),
+            task_object_json,
+        );
+
+        sui_mocks::grpc::mock_execute_transaction_and_wait_for_checkpoint(
+            &mut execution_service_mock,
+            &mut subscription_service_mock,
+            &mut ledger_service_mock,
+            digest,
+            gas_coin_ref.clone(),
+            vec![],
+            vec![],
+            vec![],
+        );
+
+        let (_url, nexus_client) = mock_nexus_client_with_server(
+            ledger_service_mock,
+            execution_service_mock,
+            subscription_service_mock,
+            nexus_objects.clone(),
+        )
+        .await;
+
+        let metadata = vec![
+            ("region".into(), "us".into()),
+            ("tier".into(), "gold".into()),
+        ];
+        let result = nexus_client
+            .scheduler()
+            .update_metadata(task_id, metadata.clone())
+            .await
+            .expect("metadata updated");
+
+        assert_eq!(result.tx_digest, digest);
+        assert_eq!(result.entries, metadata.len());
+    }
+
+    #[tokio::test]
+    async fn test_scheduler_set_task_state_pause() {
+        let mut rng = rand::thread_rng();
+        let mut ledger_service_mock = sui_mocks::grpc::MockLedgerService::new();
+        let mut execution_service_mock = sui_mocks::grpc::MockTransactionExecutionService::new();
+        let mut subscription_service_mock = sui_mocks::grpc::MockSubscriptionService::new();
+
+        sui_mocks::grpc::mock_reference_gas_price(&mut ledger_service_mock, 1_000);
+
+        let digest = sui::types::Digest::generate(&mut rng);
+        let gas_coin_ref = sui_mocks::mock_sui_object_ref();
+
+        let nexus_objects = sui_mocks::mock_nexus_objects();
+        let task_id = sui::types::Address::generate(&mut rng);
+        let owner = sui::types::Address::generate(&mut rng);
+
+        // Task fetch
+        let task_object_json = mock_task_object(task_id, owner);
+        let task_ref =
+            sui::types::ObjectReference::new(task_id, 1, sui::types::Digest::generate(&mut rng));
+        sui_mocks::grpc::mock_get_object_json(
+            &mut ledger_service_mock,
+            task_ref,
+            sui::types::Owner::Address(owner),
+            task_object_json,
+        );
+
+        sui_mocks::grpc::mock_execute_transaction_and_wait_for_checkpoint(
+            &mut execution_service_mock,
+            &mut subscription_service_mock,
+            &mut ledger_service_mock,
+            digest,
+            gas_coin_ref.clone(),
+            vec![],
+            vec![],
+            vec![],
+        );
+
+        let (_url, nexus_client) = mock_nexus_client_with_server(
+            ledger_service_mock,
+            execution_service_mock,
+            subscription_service_mock,
+            nexus_objects.clone(),
+        )
+        .await;
+
+        let result = nexus_client
+            .scheduler()
+            .set_task_state(task_id, TaskStateAction::Pause)
+            .await
+            .expect("state updated");
+
+        assert_eq!(result.tx_digest, digest);
+        assert!(matches!(result.state, TaskStateAction::Pause));
+    }
+
+    #[tokio::test]
+    async fn test_scheduler_add_occurrence_absolute() {
+        let mut rng = rand::thread_rng();
+        let mut ledger_service_mock = sui_mocks::grpc::MockLedgerService::new();
+        let mut execution_service_mock = sui_mocks::grpc::MockTransactionExecutionService::new();
+        let mut subscription_service_mock = sui_mocks::grpc::MockSubscriptionService::new();
+
+        sui_mocks::grpc::mock_reference_gas_price(&mut ledger_service_mock, 1_000);
+
+        let digest = sui::types::Digest::generate(&mut rng);
+        let gas_coin_ref = sui_mocks::mock_sui_object_ref();
+
+        let nexus_objects = sui_mocks::mock_nexus_objects();
+        let task_id = sui::types::Address::generate(&mut rng);
+        let owner = sui::types::Address::generate(&mut rng);
+
+        // Task fetch
+        let task_object_json = mock_task_object(task_id, owner);
+        let task_ref =
+            sui::types::ObjectReference::new(task_id, 1, sui::types::Digest::generate(&mut rng));
+        sui_mocks::grpc::mock_get_object_json(
+            &mut ledger_service_mock,
+            task_ref,
+            sui::types::Owner::Address(owner),
+            task_object_json,
+        );
+
+        let generator = queue_generator_symbol(nexus_objects.workflow_pkg_id);
+        let scheduled_event = NexusEventKind::OccurrenceScheduled(OccurrenceScheduledEvent {
+            task: task_id,
+            generator: generator.clone(),
+        });
+
+        sui_mocks::grpc::mock_execute_transaction_and_wait_for_checkpoint(
+            &mut execution_service_mock,
+            &mut subscription_service_mock,
+            &mut ledger_service_mock,
+            digest,
+            gas_coin_ref.clone(),
+            vec![],
+            vec![],
+            vec![event_bcs(
+                nexus_objects.primitives_pkg_id,
+                nexus_objects.workflow_pkg_id,
+                scheduled_event.clone(),
+            )],
+        );
+
+        let (_url, nexus_client) = mock_nexus_client_with_server(
+            ledger_service_mock,
+            execution_service_mock,
+            subscription_service_mock,
+            nexus_objects.clone(),
+        )
+        .await;
+
+        let request =
+            OccurrenceRequest::new(Some(2_000), Some(2_500), None, None, 7, true).unwrap();
+
+        let result = nexus_client
+            .scheduler()
+            .add_occurrence(task_id, request)
+            .await
+            .expect("occurrence enqueued");
+
+        assert_eq!(result.tx_digest, digest);
+        assert!(matches!(
+            result.event,
+            Some(NexusEventKind::OccurrenceScheduled(_))
+        ));
+    }
+
+    #[tokio::test]
+    async fn test_scheduler_add_occurrence_with_offsets() {
+        let mut rng = rand::thread_rng();
+        let mut ledger_service_mock = sui_mocks::grpc::MockLedgerService::new();
+        let mut execution_service_mock = sui_mocks::grpc::MockTransactionExecutionService::new();
+        let mut subscription_service_mock = sui_mocks::grpc::MockSubscriptionService::new();
+
+        sui_mocks::grpc::mock_reference_gas_price(&mut ledger_service_mock, 1_000);
+
+        let digest = sui::types::Digest::generate(&mut rng);
+        let gas_coin_ref = sui_mocks::mock_sui_object_ref();
+
+        let nexus_objects = sui_mocks::mock_nexus_objects();
+        let task_id = sui::types::Address::generate(&mut rng);
+        let owner = sui::types::Address::generate(&mut rng);
+
+        // Task fetch
+        let task_object_json = mock_task_object(task_id, owner);
+        let task_ref =
+            sui::types::ObjectReference::new(task_id, 1, sui::types::Digest::generate(&mut rng));
+        sui_mocks::grpc::mock_get_object_json(
+            &mut ledger_service_mock,
+            task_ref,
+            sui::types::Owner::Address(owner),
+            task_object_json,
+        );
+
+        let generator = queue_generator_symbol(nexus_objects.workflow_pkg_id);
+        let scheduled_event = NexusEventKind::OccurrenceScheduled(OccurrenceScheduledEvent {
+            task: task_id,
+            generator: generator.clone(),
+        });
+
+        sui_mocks::grpc::mock_execute_transaction_and_wait_for_checkpoint(
+            &mut execution_service_mock,
+            &mut subscription_service_mock,
+            &mut ledger_service_mock,
+            digest,
+            gas_coin_ref.clone(),
+            vec![],
+            vec![],
+            vec![event_bcs(
+                nexus_objects.primitives_pkg_id,
+                nexus_objects.workflow_pkg_id,
+                scheduled_event.clone(),
+            )],
+        );
+
+        let (_url, nexus_client) = mock_nexus_client_with_server(
+            ledger_service_mock,
+            execution_service_mock,
+            subscription_service_mock,
+            nexus_objects.clone(),
+        )
+        .await;
+
+        let request =
+            OccurrenceRequest::new(None, None, Some(500), Some(900), 4, true).expect("valid");
+
+        let result = nexus_client
+            .scheduler()
+            .add_occurrence(task_id, request)
+            .await
+            .expect("occurrence enqueued");
+
+        assert!(matches!(
+            result.event,
+            Some(NexusEventKind::OccurrenceScheduled(_))
+        ));
+    }
+
+    #[tokio::test]
+    async fn test_scheduler_configure_periodic() {
+        let mut rng = rand::thread_rng();
+        let mut ledger_service_mock = sui_mocks::grpc::MockLedgerService::new();
+        let mut execution_service_mock = sui_mocks::grpc::MockTransactionExecutionService::new();
+        let mut subscription_service_mock = sui_mocks::grpc::MockSubscriptionService::new();
+
+        sui_mocks::grpc::mock_reference_gas_price(&mut ledger_service_mock, 1_000);
+
+        let digest = sui::types::Digest::generate(&mut rng);
+        let gas_coin_ref = sui_mocks::mock_sui_object_ref();
+
+        let nexus_objects = sui_mocks::mock_nexus_objects();
+        let task_id = sui::types::Address::generate(&mut rng);
+        let owner = sui::types::Address::generate(&mut rng);
+
+        // Task fetch
+        let task_object_json = mock_task_object(task_id, owner);
+        let task_ref =
+            sui::types::ObjectReference::new(task_id, 1, sui::types::Digest::generate(&mut rng));
+        sui_mocks::grpc::mock_get_object_json(
+            &mut ledger_service_mock,
+            task_ref,
+            sui::types::Owner::Address(owner),
+            task_object_json,
+        );
+
+        sui_mocks::grpc::mock_execute_transaction_and_wait_for_checkpoint(
+            &mut execution_service_mock,
+            &mut subscription_service_mock,
+            &mut ledger_service_mock,
+            digest,
+            gas_coin_ref.clone(),
+            vec![],
+            vec![],
+            vec![],
+        );
+
+        let (_url, nexus_client) = mock_nexus_client_with_server(
+            ledger_service_mock,
+            execution_service_mock,
+            subscription_service_mock,
+            nexus_objects.clone(),
+        )
+        .await;
+
+        let config = PeriodicScheduleConfig {
+            first_start_ms: 10_000,
+            period_ms: 5_000,
+            deadline_offset_ms: Some(1_000),
+            max_iterations: Some(5),
+            priority_fee_per_gas_unit: 20,
+        };
+
+        let result = nexus_client
+            .scheduler()
+            .configure_periodic(task_id, config)
+            .await
+            .expect("periodic configured");
+
+        assert_eq!(result.tx_digest, digest);
+    }
+
+    #[tokio::test]
+    async fn test_scheduler_disable_periodic() {
+        let mut rng = rand::thread_rng();
+        let mut ledger_service_mock = sui_mocks::grpc::MockLedgerService::new();
+        let mut execution_service_mock = sui_mocks::grpc::MockTransactionExecutionService::new();
+        let mut subscription_service_mock = sui_mocks::grpc::MockSubscriptionService::new();
+
+        sui_mocks::grpc::mock_reference_gas_price(&mut ledger_service_mock, 1_000);
+
+        let digest = sui::types::Digest::generate(&mut rng);
+        let gas_coin_ref = sui_mocks::mock_sui_object_ref();
+
+        let nexus_objects = sui_mocks::mock_nexus_objects();
+        let task_id = sui::types::Address::generate(&mut rng);
+        let owner = sui::types::Address::generate(&mut rng);
+
+        // Task fetch
+        let task_object_json = mock_task_object(task_id, owner);
+        let task_ref =
+            sui::types::ObjectReference::new(task_id, 1, sui::types::Digest::generate(&mut rng));
+        sui_mocks::grpc::mock_get_object_json(
+            &mut ledger_service_mock,
+            task_ref,
+            sui::types::Owner::Address(owner),
+            task_object_json,
+        );
+
+        sui_mocks::grpc::mock_execute_transaction_and_wait_for_checkpoint(
+            &mut execution_service_mock,
+            &mut subscription_service_mock,
+            &mut ledger_service_mock,
+            digest,
+            gas_coin_ref.clone(),
+            vec![],
+            vec![],
+            vec![],
+        );
+
+        let (_url, nexus_client) = mock_nexus_client_with_server(
+            ledger_service_mock,
+            execution_service_mock,
+            subscription_service_mock,
+            nexus_objects.clone(),
+        )
+        .await;
+
+        let result = nexus_client
+            .scheduler()
+            .disable_periodic(task_id)
+            .await
+            .expect("periodic disabled");
+
+        assert_eq!(result.tx_digest, digest);
+    }
+
+    #[test]
+    fn test_occurrence_request_validation_rules() {
+        assert!(OccurrenceRequest::new(Some(10), Some(20), None, None, 1, true).is_ok());
+        assert!(OccurrenceRequest::new(None, None, Some(5), Some(15), 1, true).is_ok());
+
+        let err = OccurrenceRequest::new(None, None, None, None, 1, true).unwrap_err();
+        assert!(matches!(err, NexusError::Configuration(msg) if msg.contains("Provide either")));
+
+        let err = OccurrenceRequest::new(Some(50), Some(40), None, None, 1, true).unwrap_err();
+        assert!(matches!(err, NexusError::Configuration(msg) if msg.contains("Deadline")));
+
+        let err = OccurrenceRequest::new(None, None, None, Some(10), 1, false).unwrap_err();
+        assert!(matches!(err, NexusError::Configuration(msg) if msg.contains("Deadline flags")));
+    }
+
+    #[test]
+    fn test_extract_task_id_errors_without_event() {
+        let mut rng = thread_rng();
+        let workflow_pkg = sui::types::Address::generate(&mut rng);
+        let response = dummy_executed_transaction(vec![NexusEvent {
+            id: (sui::types::Digest::generate(&mut rng), 0),
+            generics: vec![],
+            data: NexusEventKind::OccurrenceScheduled(OccurrenceScheduledEvent {
+                task: sui::types::Address::generate(&mut rng),
+                generator: PolicySymbol::Uid(workflow_pkg),
+            }),
+        }]);
+
+        let err = extract_task_id(&response).expect_err("missing event");
+        assert!(matches!(err, NexusError::Parsing(_)));
+    }
+
+    #[test]
+    fn test_extract_occurrence_event_variants() {
+        let mut rng = thread_rng();
+        let workflow_pkg = sui::types::Address::generate(&mut rng);
+        let task_id = sui::types::Address::generate(&mut rng);
+
+        let scheduled =
+            NexusEventKind::RequestScheduledOccurrence(RequestScheduledOccurrenceEvent {
+                request: OccurrenceScheduledEvent {
+                    task: task_id,
+                    generator: PolicySymbol::Uid(workflow_pkg),
+                },
+                priority: 1,
+                request_ms: 10,
+                start_ms: 11,
+                deadline_ms: 12,
+            });
+
+        let response = dummy_executed_transaction(vec![NexusEvent {
+            id: (sui::types::Digest::generate(&mut rng), 0),
+            generics: vec![],
+            data: scheduled.clone(),
+        }]);
+        assert!(matches!(
+            extract_occurrence_event(&response),
+            Some(NexusEventKind::RequestScheduledOccurrence(_))
+        ));
+
+        let direct = dummy_executed_transaction(vec![NexusEvent {
+            id: (sui::types::Digest::generate(&mut rng), 0),
+            generics: vec![],
+            data: NexusEventKind::OccurrenceScheduled(OccurrenceScheduledEvent {
+                task: task_id,
+                generator: PolicySymbol::Uid(workflow_pkg),
+            }),
+        }]);
+        assert!(matches!(
+            extract_occurrence_event(&direct),
+            Some(NexusEventKind::OccurrenceScheduled(_))
+        ));
+
+        let empty = dummy_executed_transaction(vec![]);
+        assert!(extract_occurrence_event(&empty).is_none());
+    }
+}
diff --git a/sdk/src/nexus/signer.rs b/sdk/src/nexus/signer.rs
new file mode 100644
index 00000000..f04c1712
--- /dev/null
+++ b/sdk/src/nexus/signer.rs
@@ -0,0 +1,215 @@
+//! Module defining a [`Signer`] struct that can sign and execute transactions
+//! on Sui in Nexus context.
+use {
+    crate::{
+        events::{FromSuiGrpcEvent, NexusEvent},
+        nexus::{crawler::Crawler, error::NexusError},
+        sui::{self, traits::*},
+        types::NexusObjects,
+    },
+    futures::TryStreamExt,
+    std::sync::Arc,
+    tokio::{sync::Mutex, time::Duration},
+};
+
+/// Resulting struct from executing a transaction.
+pub struct ExecutedTransaction {
+    pub effects: sui::types::TransactionEffectsV2,
+    pub events: Vec<NexusEvent>,
+    pub objects: Vec<sui::types::Object>,
+    pub digest: sui::types::Digest,
+    pub checkpoint: u64,
+}
+
+/// The Signer struct capable of signing and executing transactions based on the
+/// provided [`sui::crypto::Ed25519PrivateKey`].
+#[derive(Clone)]
+pub struct Signer {
+    pub(super) client: Arc<Mutex<sui::grpc::Client>>,
+    pub(super) pk: sui::crypto::Ed25519PrivateKey,
+    pub(super) transaction_timeout: Duration,
+    pub(super) nexus_objects: Arc<NexusObjects>,
+}
+
+impl Signer {
+    pub fn new(
+        client: Arc<Mutex<sui::grpc::Client>>,
+        pk: sui::crypto::Ed25519PrivateKey,
+        transaction_timeout: Duration,
+        nexus_objects: Arc<NexusObjects>,
+    ) -> Self {
+        Self {
+            client,
+            pk,
+            transaction_timeout,
+            nexus_objects,
+        }
+    }
+
+    /// Get the active address from the signer.
+    pub fn get_active_address(&self) -> sui::types::Address {
+        self.pk.public_key().derive_address()
+    }
+
+    /// Sign a transaction block using the signer.
+    pub async fn sign_tx(
+        &self,
+        tx: &sui::types::Transaction,
+    ) -> Result<sui::types::UserSignature, NexusError> {
+        self.pk
+            .sign_transaction(tx)
+            .map_err(|e| NexusError::Wallet(anyhow::anyhow!(e)))
+    }
+
+    /// Execute a transaction block and return the response.
+    pub async fn execute_tx(
+        &self,
+        tx: sui::types::Transaction,
+        signature: sui::types::UserSignature,
+        gas_coin: &mut sui::types::ObjectReference,
+    ) -> Result<ExecutedTransaction, NexusError> {
+        let (response, digest, checkpoint) = self
+            .execute_tx_and_wait_for_checkpoint(tx, signature)
+            .await?;
+
+        // Deserialize effects.
+        let Ok(sui::types::TransactionEffects::V2(effects)) =
+            sui::types::TransactionEffects::try_from(response.effects())
+        else {
+            return Err(NexusError::Wallet(anyhow::anyhow!(
+                "Failed to read transaction effects."
+            )));
+        };
+
+        if let sui::types::ExecutionStatus::Failure { error, command } = effects.status() {
+            return Err(NexusError::Wallet(anyhow::anyhow!(
+                "Transaction execution failed: {error:?} in command: {command:?}"
+            )));
+        }
+
+        // Deserialize events.
+        let Ok(events) = sui::types::TransactionEvents::try_from(response.events()) else {
+            return Err(NexusError::Wallet(anyhow::anyhow!(
+                "Failed to read transaction events."
+            )));
+        };
+
+        let nexus_events = events.0.iter().enumerate().filter_map(|(index, event)| {
+            NexusEvent::from_sui_grpc_event(index as u64, digest, event, &self.nexus_objects).ok()
+        });
+
+        // Deserialize objects.
+        let Ok(objects) = response
+            .objects()
+            .objects()
+            .iter()
+            .map(sui::types::Object::try_from)
+            .collect::<Result<Vec<_>, _>>()
+        else {
+            return Err(NexusError::Wallet(anyhow::anyhow!(
+                "Failed to read transaction objects."
+            )));
+        };
+
+        // Re-fetch the gas coin's new reference.
+        let crawler = Crawler::new(self.client.clone());
+
+        let gas_coin_ref = crawler
+            .get_object_metadata(*gas_coin.object_id())
+            .await
+            .map_err(|e| NexusError::Rpc(e.into()))?
+            .object_ref();
+
+        *gas_coin = gas_coin_ref;
+
+        Ok(ExecutedTransaction {
+            effects: *effects,
+            events: nexus_events.collect(),
+            objects,
+            digest,
+            checkpoint,
+        })
+    }
+
+    /// Execute a transaction while subscribing to a checkpoint stream to confirm
+    /// its inclusion in a checkpoint.
+    async fn execute_tx_and_wait_for_checkpoint(
+        &self,
+        tx: sui::types::Transaction,
+        signature: sui::types::UserSignature,
+    ) -> Result<(sui::grpc::ExecutedTransaction, sui::types::Digest, u64), NexusError> {
+        let mut client = self.client.lock().await;
+
+        let checkpoints_request = sui::grpc::SubscribeCheckpointsRequest::default().with_read_mask(
+            sui::grpc::FieldMask::from_paths(["transactions.digest", "sequence_number"]),
+        );
+
+        let tx_request = sui::grpc::ExecuteTransactionRequest::default()
+            .with_transaction(tx)
+            .with_signatures(vec![signature.into()])
+            .with_read_mask(sui::grpc::FieldMask::from_paths([
+                "effects.bcs",
+                "events.events",
+                "objects.objects",
+                "digest",
+            ]));
+
+        // Subscribe to checkpoint stream before execution.
+        let mut checkpoint_stream = match client
+            .subscription_client()
+            .subscribe_checkpoints(checkpoints_request)
+            .await
+        {
+            Ok(stream) => stream.into_inner(),
+            Err(e) => return Err(NexusError::Rpc(e.into())),
+        };
+
+        let response = match client
+            .execution_client()
+            .execute_transaction(tx_request)
+            .await
+        {
+            Ok(resp) => resp.into_inner().transaction.ok_or_else(|| {
+                NexusError::Wallet(anyhow::anyhow!("No transaction in execution response"))
+            })?,
+            Err(e) => return Err(NexusError::Rpc(e.into())),
+        };
+
+        // Get the executed transaction digest to find it in the checkpoint
+        // stream.
+        let digest: sui::types::Digest = response
+            .digest()
+            .parse()
+            .map_err(|e: sui::types::DigestParseError| NexusError::Parsing(e.into()))?;
+
+        // Wait for the transaction to appear in a checkpoint.
+        let timeout_future = tokio::time::sleep(self.transaction_timeout);
+        let checkpoint_future = async {
+            while let Some(response) = checkpoint_stream.try_next().await? {
+                let checkpoint = response.checkpoint();
+
+                for tx in checkpoint.transactions() {
+                    if tx.digest() == digest.to_string() {
+                        return Ok(checkpoint.sequence_number());
+                    }
+                }
+            }
+
+            Err(anyhow::anyhow!(
+                "Checkpoint stream closed before transaction was confirmed."
+            ))
+        };
+
+        tokio::select! {
+            result = checkpoint_future => {
+                match result {
+                    Ok(sequence_number) => Ok((response, digest, sequence_number)),
+                    Err(e) => Err(NexusError::Rpc(e))
+                }
+            },
+            _ = timeout_future => {
+                Err(NexusError::Timeout(anyhow::anyhow!("Transaction confirmation timed out")))
+            }
+        }
+    }
+}
diff --git a/sdk/src/nexus/workflow.rs b/sdk/src/nexus/workflow.rs
index deca77d2..08dd948b 100644
--- a/sdk/src/nexus/workflow.rs
+++ b/sdk/src/nexus/workflow.rs
@@ -1,14 +1,15 @@
 //! Commands related to workflow management in Nexus.
 //!
 //! - [`WorkflowActions::publish`] to publish a [`Dag`] instance to Nexus.
+//! - [`WorkflowActions::execute`] to execute a published DAG.
+//! - [`WorkflowActions::inspect_execution`] to monitor the execution of a DAG.
 
 use {
     crate::{
         crypto::session::Session,
-        events::{NexusEvent, NexusEventKind},
-        idents::{primitives, workflow},
+        events::{EventPage, NexusEvent, NexusEventKind},
+        idents::workflow,
         nexus::{client::NexusClient, error::NexusError},
-        object_crawler::fetch_one,
         sui,
         transactions::dag,
         types::{Dag, PortsData, StorageConf, DEFAULT_ENTRY_GROUP},
@@ -21,18 +22,19 @@ use {
             Mutex,
         },
         task::JoinHandle,
-        time::{Duration, Instant},
+        time::Duration,
     },
 };
 
 pub struct PublishResult {
-    pub tx_digest: sui::TransactionDigest,
-    pub dag_object_id: sui::ObjectID,
+    pub tx_digest: sui::types::Digest,
+    pub dag_object_id: sui::types::Address,
 }
 
 pub struct ExecuteResult {
-    pub tx_digest: sui::TransactionDigest,
-    pub execution_object_id: sui::ObjectID,
+    pub tx_digest: sui::types::Digest,
+    pub execution_object_id: sui::types::Address,
+    pub tx_checkpoint: u64,
 }
 
 pub struct InspectExecutionResult {
@@ -47,12 +49,12 @@ pub struct WorkflowActions {
 impl WorkflowActions {
     /// Publish the provided JSON [`Dag`].
     pub async fn publish(&self, json_dag: Dag) -> Result<PublishResult, NexusError> {
-        let address = self.client.signer.get_active_address().await?;
+        let address = self.client.signer.get_active_address();
         let nexus_objects = &self.client.nexus_objects;
 
         // == Craft and submit the publish DAG transaction ==
 
-        let mut tx = sui::ProgrammableTransactionBuilder::new();
+        let mut tx = sui::tx::TransactionBuilder::new();
 
         let mut dag_arg = dag::empty(&mut tx, nexus_objects);
 
@@ -67,20 +69,26 @@ impl WorkflowActions {
 
         let mut gas_coin = self.client.gas.acquire_gas_coin().await;
 
-        let tx_data = sui::TransactionData::new_programmable(
-            address,
-            vec![gas_coin.to_object_ref()],
-            tx.finish(),
-            self.client.gas.get_budget(),
-            self.client.reference_gas_price,
-        );
+        tx.set_sender(address);
+        tx.set_gas_budget(self.client.gas.get_budget());
+        tx.set_gas_price(self.client.reference_gas_price);
+
+        tx.add_gas_objects(vec![sui::tx::Input::owned(
+            *gas_coin.object_id(),
+            gas_coin.version(),
+            *gas_coin.digest(),
+        )]);
 
-        let envelope = self.client.signer.sign_tx(tx_data).await?;
+        let tx = tx
+            .finish()
+            .map_err(|e| NexusError::TransactionBuilding(e.into()))?;
+
+        let signature = self.client.signer.sign_tx(&tx).await?;
 
         let response = self
             .client
             .signer
-            .execute_tx(envelope, &mut gas_coin)
+            .execute_tx(tx, signature, &mut gas_coin)
             .await?;
 
         self.client.gas.release_gas_coin(gas_coin).await;
@@ -88,21 +96,21 @@ impl WorkflowActions {
         // == Find the published DAG object ID ==
 
         let dag_object_id = response
-            .object_changes
-            .unwrap_or_default()
+            .objects
             .into_iter()
-            .find_map(|change| match change {
-                sui::ObjectChange::Created {
-                    object_type,
-                    object_id,
-                    ..
-                } if object_type.address == *nexus_objects.workflow_pkg_id
-                    && object_type.module == workflow::Dag::DAG.module.into()
-                    && object_type.name == workflow::Dag::DAG.name.into() =>
+            .find_map(|obj| {
+                let sui::types::ObjectType::Struct(object_type) = obj.object_type() else {
+                    return None;
+                };
+
+                if *object_type.address() == nexus_objects.workflow_pkg_id
+                    && *object_type.module() == workflow::Dag::DAG.module
+                    && *object_type.name() == workflow::Dag::DAG.name
                 {
-                    Some(object_id)
+                    Some(obj.object_id())
+                } else {
+                    None
                 }
-                _ => None,
             })
             .ok_or_else(|| {
                 NexusError::Parsing(anyhow!("DAG object ID not found in TX response"))
@@ -124,11 +132,15 @@ impl WorkflowActions {
     /// `storage_conf` can accept [`StorageConf::default`] if no remote storage
     /// is expected.
     ///
+    /// `priority_fee_per_gas_unit` is the per-transaction priority fee to pass
+    /// down to the DAG execution.
+    ///
     /// Use [`WorkflowActions::inspect_execution`] to monitor the execution.
     pub async fn execute(
         &self,
-        dag_object_id: sui::ObjectID,
+        dag_object_id: sui::types::Address,
         entry_data: HashMap<String, PortsData>,
+        priority_fee_per_gas_unit: u64,
         entry_group: Option<&str>,
         storage_conf: &StorageConf,
         session: Arc<Mutex<Session>>,
@@ -150,19 +162,22 @@ impl WorkflowActions {
 
         // == Craft and submit the execute DAG transaction ==
 
-        let address = self.client.signer.get_active_address().await?;
-        let sui_client = &self.client.signer.get_client().await?;
+        let address = self.client.signer.get_active_address();
         let nexus_objects = &self.client.nexus_objects;
-        let dag = fetch_one::<serde_json::Value>(sui_client, dag_object_id)
+        let dag = self
+            .client
+            .crawler()
+            .get_object_metadata(dag_object_id)
             .await
             .map_err(NexusError::Rpc)?;
 
-        let mut tx = sui::ProgrammableTransactionBuilder::new();
+        let mut tx = sui::tx::TransactionBuilder::new();
 
         if let Err(e) = dag::execute(
             &mut tx,
             nexus_objects,
             &dag.object_ref(),
+            priority_fee_per_gas_unit,
             entry_group.unwrap_or(DEFAULT_ENTRY_GROUP),
             &input_data,
         ) {
@@ -171,20 +186,26 @@ impl WorkflowActions {
 
         let mut gas_coin = self.client.gas.acquire_gas_coin().await;
 
-        let tx_data = sui::TransactionData::new_programmable(
-            address,
-            vec![gas_coin.to_object_ref()],
-            tx.finish(),
-            self.client.gas.get_budget(),
-            self.client.reference_gas_price,
-        );
+        tx.set_sender(address);
+        tx.set_gas_budget(self.client.gas.get_budget());
+        tx.set_gas_price(self.client.reference_gas_price);
+
+        tx.add_gas_objects(vec![sui::tx::Input::owned(
+            *gas_coin.object_id(),
+            gas_coin.version(),
+            *gas_coin.digest(),
+        )]);
 
-        let envelope = self.client.signer.sign_tx(tx_data).await?;
+        let tx = tx
+            .finish()
+            .map_err(|e| NexusError::TransactionBuilding(e.into()))?;
+
+        let signature = self.client.signer.sign_tx(&tx).await?;
 
         let response = self
             .client
             .signer
-            .execute_tx(envelope, &mut gas_coin)
+            .execute_tx(tx, signature, &mut gas_coin)
             .await?;
 
         self.client.gas.release_gas_coin(gas_coin).await;
@@ -192,21 +213,21 @@ impl WorkflowActions {
         // == Find the created DAG execution object ID ==
 
         let execution_object_id = response
-            .object_changes
-            .unwrap_or_default()
+            .objects
             .into_iter()
-            .find_map(|change| match change {
-                sui::ObjectChange::Created {
-                    object_type,
-                    object_id,
-                    ..
-                } if object_type.address == *nexus_objects.workflow_pkg_id
-                    && object_type.module == workflow::Dag::DAG_EXECUTION.module.into()
-                    && object_type.name == workflow::Dag::DAG_EXECUTION.name.into() =>
+            .find_map(|obj| {
+                let sui::types::ObjectType::Struct(object_type) = obj.object_type() else {
+                    return None;
+                };
+
+                if *object_type.address() == nexus_objects.workflow_pkg_id
+                    && *object_type.module() == workflow::Dag::DAG_EXECUTION.module
+                    && *object_type.name() == workflow::Dag::DAG_EXECUTION.name
                 {
-                    Some(object_id)
+                    Some(obj.object_id())
+                } else {
+                    None
                 }
-                _ => None,
             })
             .ok_or_else(|| {
                 NexusError::Parsing(anyhow!("DAG execution object ID not found in TX response"))
@@ -215,6 +236,7 @@ impl WorkflowActions {
         Ok(ExecuteResult {
             tx_digest: response.digest,
             execution_object_id,
+            tx_checkpoint: response.checkpoint,
         })
     }
 
@@ -228,94 +250,67 @@ impl WorkflowActions {
     /// completion.
     pub async fn inspect_execution(
         &self,
-        dag_execution_id: sui::ObjectID,
-        execution_tx_digest: sui::TransactionDigest,
+        dag_execution_id: sui::types::Address,
+        execution_checkpoint: u64,
         timeout: Option<Duration>,
     ) -> Result<InspectExecutionResult, NexusError> {
         // Setup MSPC channel.
         let (tx, rx) = unbounded_channel::<NexusEvent>();
 
-        let mut cursor = Some(sui::EventID {
-            tx_digest: execution_tx_digest,
-            event_seq: 0,
-        });
-
-        let sui_client = self.client.signer.get_client().await?;
-
         // Create some initial timings and restrictions.
         let timeout = timeout.unwrap_or(Duration::from_secs(300));
-        let mut poll_interval = Duration::from_millis(100);
-        let max_poll_interval = Duration::from_secs(2);
-        let started = Instant::now();
-
-        let primitives_pkg_id = self.client.nexus_objects.primitives_pkg_id;
-
-        let poller = tokio::spawn(async move {
-            // Loop until we find an [`NexusEventKind::ExecutionFinished`] event.
-            loop {
-                if started.elapsed() > timeout {
-                    return Err(NexusError::Timeout(anyhow!("Timeout {timeout:?} reached while inspecting DAG execution '{dag_execution_id}'")));
-                }
-
-                let query = sui::EventFilter::MoveEventModule {
-                    package: primitives_pkg_id,
-                    module: primitives::Event::EVENT_WRAPPER.module.into(),
-                };
-                let limit = None;
-                let descending_order = false;
-
-                let page = sui_client
-                    .event_api()
-                    .query_events(query, cursor, limit, descending_order)
-                    .await
-                    .map_err(|e| NexusError::Rpc(e.into()))?;
-
-                cursor = page.next_cursor;
-
-                let mut found_event = false;
-
-                for event in page.data {
-                    let Ok(event): anyhow::Result<NexusEvent> = event.try_into() else {
-                        continue;
-                    };
-
-                    let execution_id = match &event.data {
-                        NexusEventKind::WalkAdvanced(e) => e.execution,
-                        NexusEventKind::WalkFailed(e) => e.execution,
-                        NexusEventKind::EndStateReached(e) => e.execution,
-                        NexusEventKind::ExecutionFinished(e) => e.execution,
-                        _ => continue,
-                    };
-
-                    // Only process events for the given execution ID.
-                    if execution_id != dag_execution_id {
-                        continue;
-                    }
-
-                    // We did find relevant events, do not increase the polling
-                    // interval.
-                    found_event = true;
-
-                    if matches!(&event.data, NexusEventKind::ExecutionFinished(_)) {
-                        tx.send(event).map_err(|e| NexusError::Channel(e.into()))?;
 
-                        return Ok(());
+        let poller = {
+            let fetcher = self.client.event_fetcher().clone();
+
+            tokio::spawn(async move {
+                let (_poller, mut next_page) =
+                    fetcher.poll_nexus_events(None, Some(execution_checkpoint));
+
+                let timeout = tokio::time::sleep(timeout);
+
+                tokio::pin!(timeout);
+
+                loop {
+                    tokio::select! {
+                        maybe_page = next_page.recv() => {
+                            let events = match maybe_page {
+                                Some(Ok(EventPage { events, .. })) => events,
+                                Some(Err(e)) => return Err(NexusError::Channel(anyhow!("Error fetching events: {}", e))),
+                                None => return Err(NexusError::Channel(anyhow!("Event stream closed unexpectedly while inspecting DAG execution '{dag_execution_id}'"))),
+                            };
+
+                            for event in events {
+                                let execution_id = match &event.data {
+                                    NexusEventKind::WalkAdvanced(e) => e.execution,
+                                    NexusEventKind::WalkFailed(e) => e.execution,
+                                    NexusEventKind::EndStateReached(e) => e.execution,
+                                    NexusEventKind::ExecutionFinished(e) => e.execution,
+                                    _ => continue,
+                                };
+
+                                // Only process events for the given execution ID.
+                                if execution_id != dag_execution_id {
+                                    continue;
+                                }
+
+                                if matches!(&event.data, NexusEventKind::ExecutionFinished(_)) {
+                                    tx.send(event).map_err(|e| NexusError::Channel(e.into()))?;
+
+                                    return Ok(());
+                                }
+
+                                tx.send(event).map_err(|e| NexusError::Channel(e.into()))?;
+                            }
+                        }
+
+                        _ = &mut timeout => {
+                            return Err(NexusError::Timeout(anyhow!("Timeout {timeout:?} reached while inspecting DAG execution '{dag_execution_id}'")));
+                        }
                     }
-
-                    tx.send(event).map_err(|e| NexusError::Channel(e.into()))?;
-                }
-
-                // If no new events were found, increase the polling interval.
-                // Otherwise, reset it to the initial value.
-                if found_event {
-                    poll_interval = Duration::from_millis(100);
-                } else {
-                    poll_interval = (poll_interval * 2).min(max_poll_interval);
                 }
-
-                tokio::time::sleep(poll_interval).await;
-            }
-        });
+            })
+        };
 
         Ok(InspectExecutionResult {
             next_event: rx,
@@ -327,6 +322,7 @@ impl WorkflowActions {
 #[cfg(test)]
 mod tests {
     use {
+        super::*,
         crate::{
             events::{
                 EndStateReachedEvent,
@@ -334,47 +330,66 @@ mod tests {
                 NexusEventKind,
                 WalkAdvancedEvent,
             },
-            idents::workflow,
-            nexus::error::NexusError,
-            sui,
+            sui::traits::*,
             test_utils::{nexus_mocks, sui_mocks},
-            types::{Dag, NexusData, PortsData, RuntimeVertex, StorageConf, TypeName},
+            types::{NexusData, RuntimeVertex, TypeName},
         },
+        mockito::Server,
         serde_json::json,
-        std::collections::{BTreeMap, HashMap},
     };
 
     #[tokio::test]
     async fn test_workflow_actions_publish() {
-        let (mut server, nexus_client) = nexus_mocks::mock_nexus_client().await;
+        let mut rng = rand::thread_rng();
+        let digest = sui::types::Digest::generate(&mut rng);
+        let gas_coin_ref = sui_mocks::mock_sui_object_ref();
+        let nexus_objects = sui_mocks::mock_nexus_objects();
+        let dag_object_id = sui::types::Address::generate(&mut rng);
+
+        let mut ledger_service_mock = sui_mocks::grpc::MockLedgerService::new();
+        let mut tx_service_mock = sui_mocks::grpc::MockTransactionExecutionService::new();
+        let mut sub_service_mock = sui_mocks::grpc::MockSubscriptionService::new();
+
+        sui_mocks::grpc::mock_reference_gas_price(&mut ledger_service_mock, 1000);
+
+        let dag_created = sui::types::Object::new(
+            sui::types::ObjectData::Struct(
+                sui::types::MoveStruct::new(
+                    sui::types::StructTag::new(
+                        nexus_objects.workflow_pkg_id,
+                        sui::types::Identifier::from_static("dag"),
+                        sui::types::Identifier::from_static("DAG"),
+                        vec![],
+                    ),
+                    true,
+                    0,
+                    dag_object_id.to_bcs().unwrap(),
+                )
+                .unwrap(),
+            ),
+            sui::types::Owner::Shared(0),
+            digest,
+            1000,
+        );
 
-        let dag_object_id = sui::ObjectID::random();
-        let dag_created = sui::ObjectChange::Created {
-            sender: sui::ObjectID::random().into(),
-            owner: sui::Owner::Shared {
-                initial_shared_version: sui::SequenceNumber::from_u64(1),
-            },
-            object_type: sui::MoveStructTag {
-                address: *nexus_client.nexus_objects.workflow_pkg_id,
-                module: workflow::Dag::DAG.module.into(),
-                name: workflow::Dag::DAG.name.into(),
-                type_params: vec![],
-            },
-            object_id: dag_object_id,
-            version: sui::SequenceNumber::from_u64(1),
-            digest: sui::ObjectDigest::random(),
-        };
+        sui_mocks::grpc::mock_execute_transaction_and_wait_for_checkpoint(
+            &mut tx_service_mock,
+            &mut sub_service_mock,
+            &mut ledger_service_mock,
+            digest,
+            gas_coin_ref.clone(),
+            vec![dag_created],
+            vec![],
+            vec![],
+        );
 
-        let tx_digest = sui::TransactionDigest::random();
-        let (execute_call, confirm_call) =
-            sui_mocks::rpc::mock_governance_api_execute_execute_transaction_block(
-                &mut server,
-                tx_digest,
-                None,
-                None,
-                None,
-                Some(vec![dag_created]),
-            );
+        let rpc_url = sui_mocks::grpc::mock_server(sui_mocks::grpc::ServerMocks {
+            ledger_service_mock: Some(ledger_service_mock),
+            execution_service_mock: Some(tx_service_mock),
+            subscription_service_mock: Some(sub_service_mock),
+        });
+
+        let client = nexus_mocks::mock_nexus_client(&nexus_objects, &rpc_url, None).await;
 
         let dag = Dag {
             vertices: vec![],
@@ -384,69 +399,84 @@ mod tests {
             outputs: None,
         };
 
-        let result = nexus_client
+        let result = client
             .workflow()
             .publish(dag)
             .await
             .expect("Failed to publish DAG");
 
-        execute_call.assert_async().await;
-        confirm_call.assert_async().await;
-
         assert_eq!(result.dag_object_id, dag_object_id);
-        assert_eq!(result.tx_digest, tx_digest);
+        assert_eq!(result.tx_digest, digest);
     }
 
     #[tokio::test]
     async fn test_workflow_actions_execute() {
-        let (mut server, nexus_client) = nexus_mocks::mock_nexus_client().await;
+        let mut rng = rand::thread_rng();
+        let tx_digest = sui::types::Digest::generate(&mut rng);
+        let gas_coin_ref = sui_mocks::mock_sui_object_ref();
+        let nexus_objects = sui_mocks::mock_nexus_objects();
+        let dag_object_id = sui::types::Address::generate(&mut rng);
+        let execution_object_id = sui::types::Address::generate(&mut rng);
         let (sender, _) = nexus_mocks::mock_session();
 
-        let dag_object_id = sui::ObjectID::random();
-        let execution_object_id = sui::ObjectID::random();
-        let execution_created = sui::ObjectChange::Created {
-            sender: sui::ObjectID::random().into(),
-            owner: sui::Owner::Shared {
-                initial_shared_version: sui::SequenceNumber::from_u64(1),
-            },
-            object_type: sui::MoveStructTag {
-                address: *nexus_client.nexus_objects.workflow_pkg_id,
-                module: workflow::Dag::DAG_EXECUTION.module.into(),
-                name: workflow::Dag::DAG_EXECUTION.name.into(),
-                type_params: vec![],
-            },
-            object_id: execution_object_id,
-            version: sui::SequenceNumber::from_u64(1),
-            digest: sui::ObjectDigest::random(),
-        };
+        let mut ledger_service_mock = sui_mocks::grpc::MockLedgerService::new();
+        let mut tx_service_mock = sui_mocks::grpc::MockTransactionExecutionService::new();
+        let mut sub_service_mock = sui_mocks::grpc::MockSubscriptionService::new();
+
+        sui_mocks::grpc::mock_reference_gas_price(&mut ledger_service_mock, 1000);
+
+        let execution_created = sui::types::Object::new(
+            sui::types::ObjectData::Struct(
+                sui::types::MoveStruct::new(
+                    sui::types::StructTag::new(
+                        nexus_objects.workflow_pkg_id,
+                        sui::types::Identifier::from_static("dag"),
+                        sui::types::Identifier::from_static("DAGExecution"),
+                        vec![],
+                    ),
+                    true,
+                    0,
+                    execution_object_id.to_bcs().unwrap(),
+                )
+                .unwrap(),
+            ),
+            sui::types::Owner::Shared(0),
+            tx_digest,
+            1000,
+        );
 
-        let dag_object = sui::ParsedMoveObject {
-            type_: sui::MoveStructTag {
-                address: *nexus_client.nexus_objects.workflow_pkg_id,
-                module: workflow::Dag::DAG.module.into(),
-                name: workflow::Dag::DAG.name.into(),
-                type_params: vec![],
-            },
-            has_public_transfer: false,
-            fields: sui::MoveStruct::WithFields(BTreeMap::from([(
-                "test".into(),
-                sui::MoveValue::Number(1),
-            )])),
-        };
+        sui_mocks::grpc::mock_get_object_metadata(
+            &mut ledger_service_mock,
+            sui::types::ObjectReference::new(dag_object_id, 0, tx_digest),
+            sui::types::Owner::Shared(0),
+            None,
+        );
 
-        let get_object_call =
-            sui_mocks::rpc::mock_read_api_get_object(&mut server, dag_object_id, dag_object);
+        sui_mocks::grpc::mock_execute_transaction_and_wait_for_checkpoint(
+            &mut tx_service_mock,
+            &mut sub_service_mock,
+            &mut ledger_service_mock,
+            tx_digest,
+            gas_coin_ref.clone(),
+            vec![execution_created],
+            vec![],
+            vec![],
+        );
 
-        let tx_digest = sui::TransactionDigest::random();
-        let (execute_call, confirm_call) =
-            sui_mocks::rpc::mock_governance_api_execute_execute_transaction_block(
-                &mut server,
-                tx_digest,
-                None,
-                None,
-                None,
-                Some(vec![execution_created]),
-            );
+        sui_mocks::grpc::mock_get_object_metadata(
+            &mut ledger_service_mock,
+            gas_coin_ref.clone(),
+            sui::types::Owner::Immutable,
+            Some(1000),
+        );
+
+        let rpc_url = sui_mocks::grpc::mock_server(sui_mocks::grpc::ServerMocks {
+            ledger_service_mock: Some(ledger_service_mock),
+            execution_service_mock: Some(tx_service_mock),
+            subscription_service_mock: Some(sub_service_mock),
+        });
+
+        let client = nexus_mocks::mock_nexus_client(&nexus_objects, &rpc_url, None).await;
 
         let entry_data = HashMap::from([(
             "entry_vertex".to_string(),
@@ -462,11 +492,14 @@ mod tests {
             ])),
         )]);
 
-        let result = nexus_client
+        let price_priority_fee = 0_u64;
+
+        let result = client
             .workflow()
             .execute(
                 dag_object_id,
                 entry_data,
+                price_priority_fee,
                 None,
                 &StorageConf::default(),
                 sender,
@@ -474,22 +507,26 @@ mod tests {
             .await
             .expect("Failed to execute DAG");
 
-        get_object_call.assert_async().await;
-
-        execute_call.assert_async().await;
-        confirm_call.assert_async().await;
-
         assert_eq!(result.execution_object_id, execution_object_id);
         assert_eq!(result.tx_digest, tx_digest);
     }
 
     #[tokio::test]
     async fn test_workflow_actions_inspect_execution() {
-        let (mut server, nexus_client) = nexus_mocks::mock_nexus_client().await;
+        let mut rng = rand::thread_rng();
+        let nexus_objects = sui_mocks::mock_nexus_objects();
+        let dag_object_id = sui::types::Address::generate(&mut rng);
+        let execution_object_id = sui::types::Address::generate(&mut rng);
 
-        let dag_object_id = sui::ObjectID::random();
-        let execution_object_id = sui::ObjectID::random();
-        let execution_tx_digest = sui::TransactionDigest::random();
+        let mut server = Server::new_async().await;
+        let mut ledger_service_mock = sui_mocks::grpc::MockLedgerService::new();
+
+        sui_mocks::grpc::mock_reference_gas_price(&mut ledger_service_mock, 1000);
+
+        let rpc_url = sui_mocks::grpc::mock_server(sui_mocks::grpc::ServerMocks {
+            ledger_service_mock: Some(ledger_service_mock),
+            ..Default::default()
+        });
 
         let walk_advanced_event = NexusEventKind::WalkAdvanced(WalkAdvancedEvent {
             dag: dag_object_id,
@@ -520,32 +557,42 @@ mod tests {
             has_any_walk_succeeded: true,
         });
 
-        let first_call = sui_mocks::rpc::mock_event_api_query_events(
+        let first_call = sui_mocks::gql::mock_event_query(
             &mut server,
-            vec![("WalkAdvancedEvent".to_string(), walk_advanced_event.clone())],
+            nexus_objects.primitives_pkg_id,
+            vec![walk_advanced_event],
+            None,
+            None,
         );
 
-        let second_call = sui_mocks::rpc::mock_event_api_query_events(
+        let second_call = sui_mocks::gql::mock_event_query(
             &mut server,
-            vec![(
-                "EndStateReachedEvent".to_string(),
-                end_state_reached_event.clone(),
-            )],
+            nexus_objects.primitives_pkg_id,
+            vec![end_state_reached_event],
+            None,
+            None,
         );
 
-        let third_call = sui_mocks::rpc::mock_event_api_query_events(
+        let third_call = sui_mocks::gql::mock_event_query(
             &mut server,
-            vec![(
-                "ExecutionFinishedEvent".to_string(),
-                execution_finished_event.clone(),
-            )],
+            nexus_objects.primitives_pkg_id,
+            vec![execution_finished_event],
+            None,
+            None,
         );
 
-        let mut result = nexus_client
+        let client = nexus_mocks::mock_nexus_client(
+            &nexus_objects,
+            &rpc_url,
+            Some(&format!("{}/graphql", server.url())),
+        )
+        .await;
+
+        let mut result = client
             .workflow()
             .inspect_execution(
                 execution_object_id,
-                execution_tx_digest,
+                1,
                 Some(std::time::Duration::from_secs(5)),
             )
             .await
@@ -573,19 +620,43 @@ mod tests {
 
     #[tokio::test]
     async fn test_workflow_actions_inspect_execution_timeout() {
-        let (mut server, nexus_client) = nexus_mocks::mock_nexus_client().await;
+        let mut rng = rand::thread_rng();
+        let nexus_objects = sui_mocks::mock_nexus_objects();
+        let execution_object_id = sui::types::Address::generate(&mut rng);
+
+        let mut server = Server::new_async().await;
+        let mut ledger_service_mock = sui_mocks::grpc::MockLedgerService::new();
 
-        let execution_object_id = sui::ObjectID::random();
-        let execution_tx_digest = sui::TransactionDigest::random();
+        sui_mocks::grpc::mock_reference_gas_price(&mut ledger_service_mock, 1000);
 
-        let first_call = sui_mocks::rpc::mock_event_api_query_events(&mut server, vec![]);
+        let rpc_url = sui_mocks::grpc::mock_server(sui_mocks::grpc::ServerMocks {
+            ledger_service_mock: Some(ledger_service_mock),
+            ..Default::default()
+        });
 
-        let mut result = nexus_client
+        let first_call = sui_mocks::gql::mock_event_query(
+            &mut server,
+            nexus_objects.primitives_pkg_id,
+            vec![],
+            None,
+            None,
+        )
+        .expect_at_least(1)
+        .expect_at_most(10);
+
+        let client = nexus_mocks::mock_nexus_client(
+            &nexus_objects,
+            &rpc_url,
+            Some(&format!("{}/graphql", server.url())),
+        )
+        .await;
+
+        let mut result = client
             .workflow()
             .inspect_execution(
                 execution_object_id,
-                execution_tx_digest,
-                Some(std::time::Duration::from_millis(100)),
+                1,
+                Some(std::time::Duration::from_secs(3)),
             )
             .await
             .expect("Failed to setup channel");
@@ -604,34 +675,4 @@ mod tests {
             Err(NexusError::Timeout(_))
         ));
     }
-
-    #[tokio::test]
-    async fn test_workflow_actions_inspect_execution_rpc_fail() {
-        let (_, nexus_client) = nexus_mocks::mock_nexus_client().await;
-
-        let execution_object_id = sui::ObjectID::random();
-        let execution_tx_digest = sui::TransactionDigest::random();
-
-        let mut result = nexus_client
-            .workflow()
-            .inspect_execution(
-                execution_object_id,
-                execution_tx_digest,
-                Some(std::time::Duration::from_millis(100)),
-            )
-            .await
-            .expect("Failed to setup channel");
-
-        let mut events = vec![];
-
-        while let Some(event) = result.next_event.recv().await {
-            events.push(event);
-        }
-
-        assert_eq!(events.len(), 0);
-        assert!(matches!(
-            result.poller.await.unwrap(),
-            Err(NexusError::Rpc(_))
-        ));
-    }
 }
diff --git a/sdk/src/object_crawler/fetching.rs b/sdk/src/object_crawler/fetching.rs
deleted file mode 100644
index cd07b305..00000000
--- a/sdk/src/object_crawler/fetching.rs
+++ /dev/null
@@ -1,233 +0,0 @@
-use {
-    crate::sui,
-    anyhow::bail,
-    serde::{de::DeserializeOwned, Deserialize, Serialize},
-    std::hash::Hash,
-};
-
-/// Fetch a single object from Sui based on the provided object ID.
-pub async fn fetch_one<T>(
-    sui: &sui::Client,
-    object_id: sui::ObjectID,
-) -> anyhow::Result<Response<T>>
-where
-    T: DeserializeOwned,
-{
-    let options = sui::ObjectDataOptions::new().with_content().with_owner();
-
-    let response = match sui
-        .read_api()
-        .get_object_with_options(object_id, options)
-        .await
-    {
-        Ok(response) => response,
-        Err(e) => bail!("Could not fetch object {object_id}: {e}"),
-    };
-
-    parse_object_response(response)
-}
-
-/// Fetch a dynamic field object from Sui based on the provided key.
-pub(crate) async fn dynamic_fetch_one<V>(
-    sui: &sui::Client,
-    object_id: sui::ObjectID,
-    field_name: sui::DynamicFieldName,
-) -> anyhow::Result<V>
-where
-    V: DeserializeOwned,
-{
-    let response = match sui
-        .read_api()
-        .get_dynamic_field_object(object_id, field_name)
-        .await
-    {
-        Ok(response) => response,
-        Err(e) => bail!("Could not fetch dynamic object {object_id} field: {e}"),
-    };
-
-    Ok(parse_object_response(response)?.data)
-}
-
-/// Batch fetch multiple objects from Sui based on the provided object IDs.
-pub async fn fetch_many<T>(
-    sui: &sui::Client,
-    object_ids: Vec<sui::ObjectID>,
-) -> anyhow::Result<Vec<Response<T>>>
-where
-    T: DeserializeOwned,
-{
-    let options = sui::ObjectDataOptions::new().with_content().with_owner();
-
-    let response = match sui
-        .read_api()
-        .multi_get_object_with_options(object_ids, options)
-        .await
-    {
-        Ok(response) => response,
-        Err(e) => bail!("Could not batch fetch objects: {e}"),
-    };
-
-    response.into_iter().map(parse_object_response).collect()
-}
-
-/// Fetch all dynamic field objects for this resource.
-pub(crate) async fn dynamic_fetch_many<K, V>(
-    sui: &sui::Client,
-    object_id: sui::ObjectID,
-) -> anyhow::Result<Vec<(K, V)>>
-where
-    K: Eq + Hash + DeserializeOwned + Serialize,
-    V: DeserializeOwned,
-{
-    let mut cursor = None;
-    let limit = None;
-    let mut objects = Vec::new();
-
-    // Fetch all dynamic fields and their names.
-    loop {
-        let response = match sui
-            .read_api()
-            .get_dynamic_fields(object_id, cursor, limit)
-            .await
-        {
-            Ok(response) => response,
-            Err(e) => bail!("Could not fetch dynamic object {object_id} fields: {e}"),
-        };
-
-        cursor = response.next_cursor;
-
-        objects.extend(response.data);
-
-        if !response.has_next_page {
-            break;
-        }
-    }
-
-    let keys = objects
-        .iter()
-        .filter_map(|f| serde_json::from_value::<K>(f.name.value.clone()).ok())
-        .collect::<Vec<_>>();
-
-    let values = fetch_many::<V>(sui, objects.iter().map(|f| f.object_id).collect())
-        .await?
-        .into_iter()
-        .map(|r| r.data)
-        .collect::<Vec<_>>();
-
-    if keys.len() != values.len() {
-        bail!("Could not fetch all dynamic object {object_id} fields");
-    }
-
-    Ok(keys.into_iter().zip(values).collect())
-}
-
-/// Helper function to parse the response from Sui into a [Response] struct.
-fn parse_object_response<T>(response: sui::ObjectResponse) -> anyhow::Result<Response<T>>
-where
-    T: DeserializeOwned,
-{
-    let object_id = match response.object_id() {
-        Ok(object_id) => object_id,
-        Err(e) => bail!("Could not get object ID from response: {e}"),
-    };
-
-    if let Some(e) = response.error {
-        bail!("Could not fetch object {object_id}: {e}");
-    }
-
-    let data = match response.data {
-        Some(data) => data,
-        None => bail!("Could not fetch object {object_id}"),
-    };
-
-    // We expect a move object.
-    let Some(sui::ParsedData::MoveObject(object)) = data.content else {
-        bail!("Could not parse move object from object {object_id}")
-    };
-
-    // We expect the object owner data as we requested it.
-    let Some(owner) = data.owner else {
-        bail!("Could not parse owner data from object {object_id}")
-    };
-
-    // Using [serde_json::Value] as an intermediary format.
-    match serde_json::to_value(&object).and_then(serde_json::from_value::<T>) {
-        Ok(parsed) => Ok(Response {
-            id: object_id,
-            owner,
-            data: parsed,
-            version: data.version,
-            digest: data.digest,
-        }),
-        Err(e) => bail!("Could not parse object {object_id}: {e}"),
-    }
-}
-
-// == Response wrapper ==
-
-/// We want to provide metadata from the response along with the object itself.
-/// This struct holds this data. As we develop the Leader, more required
-/// metadata can be added here.
-#[derive(Clone, Debug)]
-pub struct Response<T> {
-    pub id: sui::ObjectID,
-    pub owner: sui::Owner,
-    pub version: sui::SequenceNumber,
-    pub data: T,
-    pub digest: sui::ObjectDigest,
-}
-
-impl<T> Response<T> {
-    /// Check if the object is shared.
-    pub fn is_shared(&self) -> bool {
-        self.owner.is_shared()
-    }
-
-    /// Get initial shard version of the object.
-    pub fn get_initial_version(&self) -> sui::SequenceNumber {
-        match self.owner {
-            sui::Owner::Shared {
-                initial_shared_version,
-            } => initial_shared_version,
-            _ => self.version,
-        }
-    }
-
-    // Get a Sui object ref.
-    pub fn object_ref(&self) -> sui::ObjectRef {
-        sui::ObjectRef {
-            object_id: self.id,
-            version: self.get_initial_version(),
-            digest: self.digest,
-        }
-    }
-}
-
-// == Wrappers around various Sui SDK structures ==
-
-#[derive(Clone, Debug, Deserialize)]
-pub(crate) struct ObjectFields<T> {
-    pub(crate) fields: T,
-}
-
-#[derive(Clone, Debug, Deserialize)]
-pub(crate) struct ObjectContents<T> {
-    pub(crate) contents: T,
-}
-
-#[derive(Clone, Debug, Deserialize)]
-pub(crate) struct ObjectId {
-    pub(crate) id: sui::UID,
-}
-
-#[derive(Clone, Debug, Deserialize)]
-pub(crate) struct ObjectKV<K, V> {
-    #[serde(alias = "key", alias = "name")]
-    pub(crate) key: K,
-    pub(crate) value: V,
-}
-
-#[derive(Clone, Debug, Deserialize)]
-pub(crate) struct ObjectValue<T> {
-    pub(crate) value: T,
-}
diff --git a/sdk/src/object_crawler/mod.rs b/sdk/src/object_crawler/mod.rs
deleted file mode 100644
index 0c1fe07d..00000000
--- a/sdk/src/object_crawler/mod.rs
+++ /dev/null
@@ -1,3 +0,0 @@
-pub(crate) mod fetching;
-mod wrappers;
-pub use {fetching::*, wrappers::*};
diff --git a/sdk/src/object_crawler/wrappers.rs b/sdk/src/object_crawler/wrappers.rs
deleted file mode 100644
index 4de0cda6..00000000
--- a/sdk/src/object_crawler/wrappers.rs
+++ /dev/null
@@ -1,504 +0,0 @@
-//! This module defines wrapper around Move structures so that they can be
-//! correctly deserialized into these structures.
-
-use {
-    crate::{object_crawler::fetching::*, sui},
-    serde::{de::DeserializeOwned, Deserialize, Deserializer, Serialize},
-    std::{
-        collections::{HashMap, HashSet},
-        hash::Hash,
-        marker::PhantomData,
-        str::FromStr,
-    },
-};
-
-/// Move's `ObjectTable` wrapper. This wraps objects that are not stored
-/// directly on the fetched object - one must fetch them separately.
-///
-/// If one value is fetched based on its name then the result is `Response<V>`
-/// where `V` is the generic of `ObjectTable`.
-///
-/// If multiple values are fetched, then the result is `HashMap<K, V>`.
-#[derive(Clone, Debug)]
-pub struct ObjectTable<K, V> {
-    /// The ID of the dynamic object.
-    id: sui::UID,
-    /// Fetching an ObjectTable automatically gives us the key type.
-    tag: sui::MoveTypeTag,
-    _marker: PhantomData<(K, V)>,
-}
-
-impl<K, V> ObjectTable<K, V>
-where
-    K: Eq + Hash + DeserializeOwned + Serialize,
-    V: DeserializeOwned,
-{
-    /// Fetch a single object from the table by its key.
-    pub async fn fetch_one(&self, sui: &sui::Client, key: K) -> anyhow::Result<V> {
-        let field_name = sui::DynamicFieldName {
-            type_: self.tag.clone(),
-            value: serde_json::to_value(key).map_err(anyhow::Error::new)?,
-        };
-
-        dynamic_fetch_one::<V>(sui, *self.id.object_id(), field_name).await
-    }
-
-    /// Fetch all objects from the table.
-    pub async fn fetch_all(&self, sui: &sui::Client) -> anyhow::Result<HashMap<K, V>> {
-        let response = dynamic_fetch_many::<K, V>(sui, *self.id.object_id()).await?;
-
-        Ok(response.into_iter().collect())
-    }
-}
-
-fn new_from_tag_and_fields_id<'de, D, T>(
-    deserializer: D,
-    constructor: impl FnOnce(sui::MoveTypeTag, sui::UID) -> T,
-) -> Result<T, D::Error>
-where
-    D: Deserializer<'de>,
-{
-    #[derive(Deserialize)]
-    struct Wrapper {
-        #[serde(rename = "type")]
-        type_: String,
-        fields: ObjectId,
-    }
-
-    let Wrapper { type_, fields } = Wrapper::deserialize(deserializer)?;
-
-    let struct_tag = sui::MoveStructTag::from_str(type_.as_str()).map_err(|e| {
-        serde::de::Error::custom(format!(
-            "Could not parse sui::MoveStructTag from String: {e}"
-        ))
-    })?;
-
-    let Some(tag) = struct_tag.type_params.into_iter().next() else {
-        return Err(serde::de::Error::custom(
-            "Could not get type parameter from `type_`",
-        ));
-    };
-
-    Ok(constructor(tag, fields.id))
-}
-
-fn new_from_fields_id<'de, D, T>(
-    deserializer: D,
-    constructor: impl FnOnce(sui::UID) -> T,
-) -> Result<T, D::Error>
-where
-    D: Deserializer<'de>,
-{
-    #[derive(Deserialize)]
-    struct Wrapper {
-        fields: ObjectId,
-    }
-
-    let Wrapper { fields } = Wrapper::deserialize(deserializer)?;
-
-    Ok(constructor(fields.id))
-}
-
-impl<'de, K, V> Deserialize<'de> for ObjectTable<K, V> {
-    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
-    where
-        D: Deserializer<'de>,
-    {
-        new_from_tag_and_fields_id(deserializer, |tag, id| Self {
-            tag,
-            id,
-            _marker: PhantomData,
-        })
-    }
-}
-
-/// Move's `LinkedTable` wrapper. This wraps objects that are not stored
-/// directly on the fetched object - one must fetch them separately.
-///
-/// If one value is fetched based on its name then the result is `Response<V>`
-/// where `V` is the generic of `LinkedTable`.
-///
-/// If multiple values are fetched, then the result is `HashMap<K, V>`.
-#[derive(Clone, Debug)]
-pub struct LinkedTable<K, V> {
-    /// The ID of the dynamic object.
-    id: sui::UID,
-    /// Fetching an LinkedTable automatically gives us the key type.
-    tag: sui::MoveTypeTag,
-    _marker: PhantomData<(K, V)>,
-}
-
-impl<K, V> LinkedTable<K, V>
-where
-    K: Eq + Hash + DeserializeOwned + Serialize,
-    V: DeserializeOwned,
-{
-    /// Fetch a single object from the linked table by its key.
-    pub async fn fetch_one(&self, sui: &sui::Client, key: K) -> anyhow::Result<V> {
-        let field_name = sui::DynamicFieldName {
-            type_: self.tag.clone(),
-            value: serde_json::to_value(key).map_err(anyhow::Error::new)?,
-        };
-
-        Ok(
-            dynamic_fetch_one::<ObjectFields<ObjectValue<ObjectFields<ObjectValue<V>>>>>(
-                sui,
-                *self.id.object_id(),
-                field_name,
-            )
-            .await?
-            .fields
-            .value
-            .fields
-            .value,
-        )
-    }
-
-    /// Fetch all objects from the linked table.
-    pub async fn fetch_all(&self, sui: &sui::Client) -> anyhow::Result<HashMap<K, V>> {
-        let response = dynamic_fetch_many::<
-            K,
-            ObjectFields<ObjectValue<ObjectFields<ObjectValue<V>>>>,
-        >(sui, *self.id.object_id())
-        .await?;
-
-        Ok(response
-            .into_iter()
-            .map(|(key, ObjectFields { fields })| (key, fields.value.fields.value))
-            .collect())
-    }
-}
-
-impl<'de, K, V> Deserialize<'de> for LinkedTable<K, V> {
-    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
-    where
-        D: Deserializer<'de>,
-    {
-        new_from_tag_and_fields_id(deserializer, |tag, id| Self {
-            tag,
-            id,
-            _marker: PhantomData,
-        })
-    }
-}
-
-/// Move's `Table` wrapper. This wraps objects that are not stored directly on
-/// the fetched object - one must fetch them separately.
-///
-/// The structure of the dynamically fetched object is different from the
-/// `ObjectTable` structure. `Table` has the key on the response, while
-/// `ObjectTable` does not.
-///
-/// If one value is fetched based on its name then the result is `Response<V>`
-/// where `V` is the generic of `Table`.
-///
-/// If multiple values are fetched, then the result is `HashMap<K, V>`.
-#[derive(Clone, Debug)]
-pub struct Table<K, V> {
-    /// The ID of the dynamic object.
-    id: sui::UID,
-    /// Fetching an Table automatically gives us the key type.
-    tag: sui::MoveTypeTag,
-    _marker: PhantomData<(K, V)>,
-}
-
-impl<K, V> Table<K, V>
-where
-    K: Eq + Hash + DeserializeOwned + Serialize,
-    V: DeserializeOwned,
-{
-    /// Fetch a single object from the table by its key.
-    pub async fn fetch_one(&self, sui: &sui::Client, key: K) -> anyhow::Result<V> {
-        let field_name = sui::DynamicFieldName {
-            type_: self.tag.clone(),
-            value: serde_json::to_value(key).map_err(anyhow::Error::new)?,
-        };
-
-        Ok(
-            dynamic_fetch_one::<ObjectFields<ObjectValue<V>>>(
-                sui,
-                *self.id.object_id(),
-                field_name,
-            )
-            .await?
-            .fields
-            .value,
-        )
-    }
-
-    /// Fetch all objects from the table.
-    pub async fn fetch_all(&self, sui: &sui::Client) -> anyhow::Result<HashMap<K, V>> {
-        let response =
-            dynamic_fetch_many::<K, ObjectFields<ObjectValue<V>>>(sui, *self.id.object_id())
-                .await?;
-
-        Ok(response
-            .into_iter()
-            .map(|(key, ObjectFields { fields })| (key, fields.value))
-            .collect())
-    }
-}
-
-impl<'de, K, V> Deserialize<'de> for Table<K, V> {
-    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
-    where
-        D: Deserializer<'de>,
-    {
-        new_from_tag_and_fields_id(deserializer, |tag, id| Self {
-            tag,
-            id,
-            _marker: PhantomData,
-        })
-    }
-}
-
-/// Move's `ObjectBag` wrapper. This wraps objects that are not stored directly
-/// on the fetched object - one must fetch them separately.
-///
-/// If one value is fetched based on its name then the result is `Response<V>`
-/// where `V` is the generic of `ObjectBag`.
-///
-/// `ObjectBag` doesn't provide the key type because in Move, `ObjectBag`s are
-/// heterogeneous. This means that when fetching one, one must provide the key
-/// type. When fetching multiple, one must provide an enumeration of all
-/// possible key types.
-///
-/// If multiple values are fetched, then the result is `HashMap<K, V>`.
-#[derive(Clone, Debug)]
-pub struct ObjectBag<K, V> {
-    /// The ID of the dynamic object.
-    id: sui::UID,
-    _marker: PhantomData<(K, V)>,
-}
-
-impl<K, V> ObjectBag<K, V>
-where
-    K: Eq + Hash + DeserializeOwned + Serialize,
-    V: DeserializeOwned,
-{
-    /// Fetch a single object from the bag by its key.
-    pub async fn fetch_one(
-        &self,
-        sui: &sui::Client,
-        key: K,
-        tag: sui::MoveTypeTag,
-    ) -> anyhow::Result<V> {
-        let field_name = sui::DynamicFieldName {
-            type_: tag,
-            value: serde_json::to_value(key).map_err(anyhow::Error::new)?,
-        };
-
-        dynamic_fetch_one::<V>(sui, *self.id.object_id(), field_name).await
-    }
-
-    /// Fetch all objects from the bag.
-    pub async fn fetch_all(&self, sui: &sui::Client) -> anyhow::Result<HashMap<K, V>> {
-        let response = dynamic_fetch_many::<K, V>(sui, *self.id.object_id()).await?;
-
-        Ok(response.into_iter().collect())
-    }
-}
-
-impl<'de, K, V> Deserialize<'de> for ObjectBag<K, V> {
-    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
-    where
-        D: Deserializer<'de>,
-    {
-        new_from_fields_id(deserializer, |id| Self {
-            id,
-            _marker: PhantomData,
-        })
-    }
-}
-
-/// Move's `Bag` wrapper. This wraps objects that are not stored directly on the
-/// fetched object - one must fetch them separately.
-///
-/// The structure of the dynamically fetched object is different from the
-/// `ObjectBag` structure. `Bag` has the key on the response, while `ObjectBag`
-/// does not.
-///
-/// If one value is fetched based on its name then the result is `Response<V>`
-/// where `V` is the generic of `Bag`.
-///
-/// `Bag` doesn't provide the key type because in Move, `Bag`s are heterogeneous.
-/// This means that when fetching one, one must provide the key type. When
-/// fetching multiple, one must provide an enumeration of all possible key types.
-///
-/// If multiple values are fetched, then the result is `HashMap<K, V>`.
-#[derive(Clone, Debug)]
-pub struct Bag<K, V> {
-    /// The ID of the dynamic object.
-    id: sui::UID,
-    _marker: PhantomData<(K, V)>,
-}
-
-impl<K, V> Bag<K, V>
-where
-    K: Eq + Hash + DeserializeOwned + Serialize,
-    V: DeserializeOwned,
-{
-    /// Fetch a single object from the bag by its key.
-    pub async fn fetch_one(
-        &self,
-        sui: &sui::Client,
-        key: K,
-        tag: sui::MoveTypeTag,
-    ) -> anyhow::Result<V> {
-        let field_name = sui::DynamicFieldName {
-            type_: tag,
-            value: serde_json::to_value(key).map_err(anyhow::Error::new)?,
-        };
-
-        Ok(
-            dynamic_fetch_one::<ObjectFields<ObjectValue<V>>>(
-                sui,
-                *self.id.object_id(),
-                field_name,
-            )
-            .await?
-            .fields
-            .value,
-        )
-    }
-
-    /// Fetch all objects from the bag.
-    pub async fn fetch_all(&self, sui: &sui::Client) -> anyhow::Result<HashMap<K, V>> {
-        let response =
-            dynamic_fetch_many::<K, ObjectFields<ObjectValue<V>>>(sui, *self.id.object_id())
-                .await?;
-
-        Ok(response
-            .into_iter()
-            .map(|(key, ObjectFields { fields })| (key, fields.value))
-            .collect())
-    }
-}
-
-impl<'de, K, V> Deserialize<'de> for Bag<K, V> {
-    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
-    where
-        D: Deserializer<'de>,
-    {
-        new_from_fields_id(deserializer, |id| Self {
-            id,
-            _marker: PhantomData,
-        })
-    }
-}
-
-/// Move's `VecMap` wrapper. This type is stored directly on the fetched object.
-#[derive(Clone, Debug)]
-pub struct VecMap<K, V> {
-    values: HashMap<K, V>,
-}
-
-impl<K, V> VecMap<K, V> {
-    pub fn into_inner(self) -> HashMap<K, V> {
-        self.values
-    }
-
-    pub fn inner(&self) -> &HashMap<K, V> {
-        &self.values
-    }
-
-    pub fn inner_mut(&mut self) -> &mut HashMap<K, V> {
-        &mut self.values
-    }
-}
-
-impl<'de, K, V> Deserialize<'de> for VecMap<K, V>
-where
-    K: Eq + Hash + DeserializeOwned,
-    V: DeserializeOwned,
-{
-    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
-    where
-        D: Deserializer<'de>,
-    {
-        #[derive(Deserialize)]
-        struct Wrapper<K, V> {
-            fields: ObjectContents<Vec<ObjectFields<ObjectKV<K, V>>>>,
-        }
-
-        let Wrapper { fields } = Wrapper::<K, V>::deserialize(deserializer)?;
-
-        Ok(Self {
-            values: fields
-                .contents
-                .into_iter()
-                .map(|ObjectFields { fields }| (fields.key, fields.value))
-                .collect(),
-        })
-    }
-}
-
-/// Move's `VecSet` wrapper. This type is stored directly on the fetched object.
-#[derive(Clone, Debug)]
-pub struct VecSet<T> {
-    values: HashSet<T>,
-}
-
-impl<T> VecSet<T> {
-    pub fn into_inner(self) -> HashSet<T> {
-        self.values
-    }
-
-    pub fn inner(&self) -> &HashSet<T> {
-        &self.values
-    }
-
-    pub fn inner_mut(&mut self) -> &mut HashSet<T> {
-        &mut self.values
-    }
-}
-
-impl<'de, T> Deserialize<'de> for VecSet<T>
-where
-    T: Eq + Hash + DeserializeOwned,
-{
-    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
-    where
-        D: Deserializer<'de>,
-    {
-        #[derive(Deserialize)]
-        struct Wrapper<T>
-        where
-            T: Eq + Hash,
-        {
-            fields: ObjectContents<HashSet<T>>,
-        }
-
-        let Wrapper { fields } = Wrapper::<T>::deserialize(deserializer)?;
-
-        Ok(Self {
-            values: fields.contents,
-        })
-    }
-}
-
-/// Move's `struct` type wrapper.
-#[derive(Clone, Debug, PartialEq, Eq, Hash, Deserialize, Serialize)]
-pub struct Structure<T> {
-    fields: T,
-}
-
-impl<T> Structure<T> {
-    pub fn into_inner(self) -> T {
-        self.fields
-    }
-
-    pub fn inner(&self) -> &T {
-        &self.fields
-    }
-
-    pub fn inner_mut(&mut self) -> &mut T {
-        &mut self.fields
-    }
-}
-
-impl<T> From<T> for Structure<T> {
-    fn from(fields: T) -> Self {
-        Self { fields }
-    }
-}
diff --git a/sdk/src/onchain_schema_gen/input.rs b/sdk/src/onchain_schema_gen/input.rs
new file mode 100644
index 00000000..113ed80a
--- /dev/null
+++ b/sdk/src/onchain_schema_gen/input.rs
@@ -0,0 +1,201 @@
+//! Input schema generation for Move onchain tools.
+
+use {
+    super::types::{convert_move_signature_to_schema, is_tx_context_param},
+    crate::sui,
+    anyhow::{anyhow, bail, Result as AnyResult},
+    serde_json::{Map, Value},
+    std::sync::Arc,
+    tokio::sync::Mutex,
+};
+
+/// Generate input schema by introspecting the execute function's parameters.
+///
+/// This function fetches the Move module from the chain and analyzes the
+/// execute function's parameters to generate a JSON schema. It automatically
+/// skips the first parameter (ProofOfUID) and the last parameter (TxContext).
+pub async fn generate_input_schema(
+    client: Arc<Mutex<sui::grpc::Client>>,
+    package_address: sui::types::Address,
+    module_name: &str,
+    execute_function: &str,
+) -> AnyResult<String> {
+    let request = sui::grpc::GetPackageRequest::default().with_package_id(package_address);
+
+    let mut client = client.lock().await;
+
+    // Fetch all normalized Move modules for the package.
+    let Some(package) = client
+        .package_client()
+        .get_package(request)
+        .await
+        .map(|resp| resp.into_inner().package)?
+    else {
+        bail!("Package '{package_address}' not found")
+    };
+
+    drop(client);
+
+    let all_modules = package.modules();
+
+    // Find the specific module.
+    let normalized_module = all_modules
+        .iter()
+        .find(|m| m.name() == module_name)
+        .ok_or_else(|| {
+            anyhow!("Module '{module_name}' not found in package '{package_address}'")
+        })?;
+
+    // Find the execute function.
+    let execute_func = normalized_module
+        .functions()
+        .iter()
+        .find(|f| f.name() == execute_function)
+        .ok_or_else(|| {
+            anyhow!("Function '{execute_function}' not found in module '{module_name}'")
+        })?;
+
+    // Parse function parameters.
+    let mut schema_map = Map::new();
+    let mut param_index = 0;
+
+    for (i, param_type) in execute_func.parameters().iter().enumerate() {
+        let body = param_type.body_opt().ok_or_else(|| {
+            anyhow!("Parameter type missing body in function '{execute_function}' of module '{module_name}'")
+        })?;
+
+        let is_tx_context = is_tx_context_param(body);
+
+        // Skip the first parameter (ProofOfUID) and the last parameter (TxContext).
+        if i == 0 || is_tx_context {
+            continue;
+        }
+
+        // Convert the full signature (includes reference/mutability info).
+        let param_schema = convert_move_signature_to_schema(param_type)?;
+
+        // Store parameter information with index as the default name.
+        let param_obj = match param_schema {
+            Value::Object(obj) => obj,
+            other => {
+                let mut new_obj = Map::new();
+                new_obj.insert("type".to_string(), other);
+                new_obj
+            }
+        };
+
+        schema_map.insert(param_index.to_string(), Value::Object(param_obj));
+        param_index += 1;
+    }
+
+    let schema_json = Value::Object(schema_map);
+    let schema_string = serde_json::to_string(&schema_json)?;
+
+    Ok(schema_string)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[tokio::test]
+    #[cfg(feature = "test_utils")]
+    async fn test_generate_input_schema_from_published_package() {
+        use crate::test_utils;
+
+        // Spin up the Sui instance.
+        let test_utils::containers::SuiInstance {
+            rpc_port,
+            faucet_port,
+            pg: _pg,
+            container: _container,
+            ..
+        } = test_utils::containers::setup_sui_instance().await;
+
+        let rpc_url = format!("http://127.0.0.1:{rpc_port}");
+        let faucet_url = format!("http://127.0.0.1:{faucet_port}/gas");
+
+        let mut rng = rand::thread_rng();
+
+        // Create a wallet and request some gas tokens.
+        let pk = sui::crypto::Ed25519PrivateKey::generate(&mut rng);
+        let addr = pk.public_key().derive_address();
+
+        test_utils::faucet::request_tokens(&faucet_url, addr)
+            .await
+            .expect("Failed to request tokens from faucet.");
+
+        let (gas_coin, _) = test_utils::gas::fetch_gas_coins(&rpc_url, addr)
+            .await
+            .expect("Failed to fetch gas coin.")
+            .into_iter()
+            .next()
+            .unwrap();
+
+        // Publish test onchain_tool package.
+        let response = test_utils::contracts::publish_move_package(
+            &pk,
+            &rpc_url,
+            "tests/move/onchain_tool_test",
+            gas_coin,
+        )
+        .await;
+
+        let pkg_id = response
+            .objects
+            .iter()
+            .find_map(|c| match c.data() {
+                sui::types::ObjectData::Package(m) => Some(m.id),
+                _ => None,
+            })
+            .expect("Move package must be published");
+
+        let client = Arc::new(Mutex::new(
+            sui::grpc::Client::new(format!("http://127.0.0.1:{rpc_port}"))
+                .expect("Could not create gRPC client"),
+        ));
+
+        // Generate input schema for the onchain_tool::execute function.
+        let schema_str = generate_input_schema(
+            client,
+            pkg_id.to_string().parse().unwrap(),
+            "onchain_tool",
+            "execute",
+        )
+        .await
+        .expect("Failed to generate input schema");
+
+        // Parse the schema.
+        let schema: serde_json::Value =
+            serde_json::from_str(&schema_str).expect("Failed to parse schema JSON");
+
+        // Verify schema structure.
+        // The execute function has signature:
+        // execute(worksheet: &mut ProofOfUID, counter: &mut RandomCounter, increase_with: u64, _ctx: &mut TxContext)
+        // After skipping ProofOfUID (first) and TxContext (last), we should have:
+        // - Parameter 0: counter (&mut RandomCounter) - object type, mutable
+        // - Parameter 1: increase_with (u64).
+
+        // Check parameter 0 (counter).
+        let param0 = schema
+            .get("0")
+            .expect("Schema should have parameter 0 (counter)");
+        assert_eq!(param0["type"], "object");
+        assert!(param0["description"]
+            .as_str()
+            .unwrap()
+            .contains("RandomCounter"));
+        assert_eq!(param0["mutable"], true);
+
+        // Check parameter 1 (increase_with).
+        let param1 = schema
+            .get("1")
+            .expect("Schema should have parameter 1 (increase_with)");
+        assert_eq!(param1["type"], "u64");
+        assert_eq!(param1["description"], "64-bit unsigned integer");
+        assert!(param1.get("mutable").is_none());
+
+        // Verify only 2 parameters (ProofOfUID and TxContext were skipped).
+        assert_eq!(schema.as_object().unwrap().len(), 2);
+    }
+}
diff --git a/sdk/src/onchain_schema_gen/mod.rs b/sdk/src/onchain_schema_gen/mod.rs
new file mode 100644
index 00000000..d13a1b6e
--- /dev/null
+++ b/sdk/src/onchain_schema_gen/mod.rs
@@ -0,0 +1,14 @@
+//! Schema generation utilities for Move onchain tools.
+//!
+//! Provides introspection of Move modules to automatically generate
+//! input/output schemas for tool registration.
+
+mod input;
+mod output;
+mod types;
+
+pub use {
+    input::generate_input_schema,
+    output::generate_output_schema,
+    types::{convert_move_signature_to_schema, convert_move_type_to_schema, is_tx_context_param},
+};
diff --git a/sdk/src/onchain_schema_gen/output.rs b/sdk/src/onchain_schema_gen/output.rs
new file mode 100644
index 00000000..6ec9d651
--- /dev/null
+++ b/sdk/src/onchain_schema_gen/output.rs
@@ -0,0 +1,216 @@
+//! Output schema generation for Move onchain tools.
+
+use {
+    super::types::convert_move_type_to_schema,
+    crate::sui,
+    anyhow::{anyhow, bail, Result as AnyResult},
+    serde_json::{json, Map, Value},
+    std::sync::Arc,
+    tokio::sync::Mutex,
+};
+
+/// Generate output schema by introspecting the Move module's Output enum.
+///
+/// This function fetches the Move module from the chain and analyzes the
+/// Output enum to generate a JSON schema. Each variant becomes a key in the
+/// schema with its fields represented as nested schema objects.
+pub async fn generate_output_schema(
+    client: Arc<Mutex<sui::grpc::Client>>,
+    package_address: sui::types::Address,
+    module_name: &str,
+    output_enum_name: &str,
+) -> AnyResult<String> {
+    let request = sui::grpc::GetPackageRequest::default().with_package_id(package_address);
+
+    let mut client = client.lock().await;
+
+    // Fetch all normalized Move modules for the package.
+    let Some(package) = client
+        .package_client()
+        .get_package(request)
+        .await
+        .map(|resp| resp.into_inner().package)?
+    else {
+        bail!("Package '{package_address}' not found")
+    };
+
+    drop(client);
+
+    let all_modules = package.modules();
+
+    // Find the specific module.
+    let normalized_module = all_modules
+        .iter()
+        .find(|m| m.name() == module_name)
+        .ok_or_else(|| {
+            anyhow!("Module '{module_name}' not found in package '{package_address}'")
+        })?;
+
+    // Find the Output enum.
+    let output_enum = normalized_module
+        .datatypes()
+        .iter()
+        .find(|kind| kind.name() == output_enum_name)
+        .ok_or_else(|| anyhow!("Enum '{output_enum_name}' not found in module '{module_name}'"))?;
+
+    // Parse the enum variants from the normalized enum.
+    let mut schema_map = Map::new();
+
+    // Iterate through each variant in the enum.
+    for variant in &output_enum.variants {
+        let Some(variant_name) = variant.name_opt() else {
+            bail!("Variant name missing in enum '{output_enum_name}'")
+        };
+
+        let variant_fields = &variant.fields;
+
+        let mut fields_schema = Map::new();
+
+        // Convert each field in the variant to schema.
+        for field in variant_fields {
+            let Some(field_type) = &field.r#type else {
+                bail!(
+                    "Field type missing body in variant '{variant_name}' of enum '{output_enum_name}'"
+                )
+            };
+
+            let Some(field_name) = field.name_opt() else {
+                bail!("Field name missing in variant '{variant_name}' of enum '{output_enum_name}'")
+            };
+
+            let field_schema = convert_move_type_to_schema(field_type)?;
+            fields_schema.insert(field_name.to_string(), field_schema);
+        }
+
+        // Create the variant schema.
+        let variant_schema = json!({
+            "type": "variant",
+            "description": format!("{} variant", variant_name),
+            "fields": fields_schema
+        });
+
+        schema_map.insert(variant_name.to_lowercase(), variant_schema);
+    }
+
+    let schema_json = Value::Object(schema_map);
+    let schema_string = serde_json::to_string(&schema_json)?;
+
+    Ok(schema_string)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[tokio::test]
+    #[cfg(feature = "test_utils")]
+    async fn test_generate_output_schema_from_published_package() {
+        use crate::test_utils;
+
+        // Spin up the Sui instance.
+        let test_utils::containers::SuiInstance {
+            rpc_port,
+            faucet_port,
+            pg: _pg,
+            container: _container,
+            ..
+        } = test_utils::containers::setup_sui_instance().await;
+
+        let rpc_url = format!("http://127.0.0.1:{rpc_port}");
+        let faucet_url = format!("http://127.0.0.1:{faucet_port}/gas");
+
+        let mut rng = rand::thread_rng();
+
+        // Create a wallet and request some gas tokens.
+        let pk = sui::crypto::Ed25519PrivateKey::generate(&mut rng);
+        let addr = pk.public_key().derive_address();
+
+        test_utils::faucet::request_tokens(&faucet_url, addr)
+            .await
+            .expect("Failed to request tokens from faucet.");
+
+        let (gas_coin, _) = test_utils::gas::fetch_gas_coins(&rpc_url, addr)
+            .await
+            .expect("Failed to fetch gas coin.")
+            .into_iter()
+            .next()
+            .unwrap();
+
+        // Publish test onchain_tool package.
+        let response = test_utils::contracts::publish_move_package(
+            &pk,
+            &rpc_url,
+            "tests/move/onchain_tool_test",
+            gas_coin,
+        )
+        .await;
+
+        let pkg_id = response
+            .objects
+            .iter()
+            .find_map(|c| match c.data() {
+                sui::types::ObjectData::Package(m) => Some(m.id),
+                _ => None,
+            })
+            .expect("Move package must be published");
+
+        let client = Arc::new(Mutex::new(
+            sui::grpc::Client::new(format!("http://127.0.0.1:{rpc_port}"))
+                .expect("Could not create gRPC client"),
+        ));
+
+        // Generate output schema for the onchain_tool::Output enum.
+        let schema_str = generate_output_schema(
+            client,
+            pkg_id.to_string().parse().unwrap(),
+            "onchain_tool",
+            "Output",
+        )
+        .await
+        .expect("Failed to generate output schema");
+
+        // Parse the schema.
+        let schema: serde_json::Value =
+            serde_json::from_str(&schema_str).expect("Failed to parse schema JSON");
+
+        // Verify schema structure.
+        // The Output enum has three variants: Ok, Err, LargeIncrement.
+
+        // Check "ok" variant.
+        let ok_variant = schema.get("ok").expect("Schema should have 'ok' variant");
+        assert_eq!(ok_variant["type"], "variant");
+        assert!(ok_variant["description"].as_str().unwrap().contains("Ok"));
+
+        let ok_fields = ok_variant["fields"].as_object().unwrap();
+        assert_eq!(ok_fields["old_count"]["type"], "u64");
+        assert_eq!(ok_fields["new_count"]["type"], "u64");
+        assert_eq!(ok_fields["increment"]["type"], "u64");
+
+        // Check "err" variant.
+        let err_variant = schema.get("err").expect("Schema should have 'err' variant");
+        assert_eq!(err_variant["type"], "variant");
+        assert!(err_variant["description"].as_str().unwrap().contains("Err"));
+
+        let err_fields = err_variant["fields"].as_object().unwrap();
+        assert_eq!(err_fields["reason"]["type"], "string");
+
+        // Check "largeincrement" variant (lowercase).
+        let large_variant = schema
+            .get("largeincrement")
+            .expect("Schema should have 'largeincrement' variant");
+        assert_eq!(large_variant["type"], "variant");
+        assert!(large_variant["description"]
+            .as_str()
+            .unwrap()
+            .contains("LargeIncrement"));
+
+        let large_fields = large_variant["fields"].as_object().unwrap();
+        assert_eq!(large_fields["old_count"]["type"], "u64");
+        assert_eq!(large_fields["new_count"]["type"], "u64");
+        assert_eq!(large_fields["increment"]["type"], "u64");
+        assert_eq!(large_fields["warning"]["type"], "string");
+
+        // Verify all three variants are present.
+        assert_eq!(schema.as_object().unwrap().len(), 3);
+    }
+}
diff --git a/sdk/src/onchain_schema_gen/types.rs b/sdk/src/onchain_schema_gen/types.rs
new file mode 100644
index 00000000..d7dcb078
--- /dev/null
+++ b/sdk/src/onchain_schema_gen/types.rs
@@ -0,0 +1,450 @@
+//! Type conversion utilities for Move types to JSON schema.
+
+use {
+    crate::{
+        idents::{move_std, sui_framework},
+        sui,
+    },
+    anyhow::{anyhow, bail, Result as AnyResult},
+    serde_json::{json, Value},
+};
+
+/// Convert a Sui Move signature (which includes reference info) to a JSON schema representation.
+///
+/// This function handles the full `OpenSignature` type which includes both the type body
+/// and reference information (mutable vs immutable). Use this for function parameters.
+pub fn convert_move_signature_to_schema(signature: &sui::grpc::OpenSignature) -> AnyResult<Value> {
+    let body = signature
+        .body
+        .as_ref()
+        .ok_or_else(|| anyhow!("OpenSignature missing body"))?;
+
+    let mut schema = convert_move_type_to_schema(body)?;
+
+    // Add mutable field if this is a mutable reference.
+    // This works since we default to "false" for mutability in the leader when
+    // creating the tx objects.
+    //
+    // Reference enum: Unknown = 0, Immutable = 1, Mutable = 2.
+    if signature.reference == Some(sui::grpc::open_signature::Reference::Mutable as i32) {
+        if let Value::Object(ref mut obj) = schema {
+            obj.insert("mutable".to_string(), Value::Bool(true));
+        }
+    }
+
+    Ok(schema)
+}
+
+/// This function introspects Move types and generates corresponding JSON schema
+/// representations that can be used for tool registration and validation.
+pub fn convert_move_type_to_schema(move_type: &sui::grpc::OpenSignatureBody) -> AnyResult<Value> {
+    use sui::grpc::open_signature_body::Type;
+
+    let Some(kind) = move_type.r#type else {
+        bail!("Move type missing kind");
+    };
+
+    match kind.try_into() {
+        Ok(Type::Address) => Ok(json!({
+            "type": "address",
+            "description": "Sui address"
+        })),
+        Ok(Type::Bool) => Ok(json!({
+            "type": "bool",
+            "description": "Boolean value"
+        })),
+        Ok(Type::U8) => Ok(json!({
+            "type": "u8",
+            "description": "8-bit unsigned integer"
+        })),
+        Ok(Type::U16) => Ok(json!({
+            "type": "u16",
+            "description": "16-bit unsigned integer"
+        })),
+        Ok(Type::U32) => Ok(json!({
+            "type": "u32",
+            "description": "32-bit unsigned integer"
+        })),
+        Ok(Type::U64) => Ok(json!({
+            "type": "u64",
+            "description": "64-bit unsigned integer"
+        })),
+        Ok(Type::U128) => Ok(json!({
+            "type": "u128",
+            "description": "128-bit unsigned integer"
+        })),
+        Ok(Type::U256) => Ok(json!({
+            "type": "u256",
+            "description": "256-bit unsigned integer"
+        })),
+        Ok(Type::Vector) => {
+            let inner_type = move_type
+                .type_parameter_instantiation
+                .first()
+                .ok_or_else(|| anyhow!("Vector type missing inner type"))?;
+
+            let inner_schema = convert_move_type_to_schema(inner_type)?;
+
+            Ok(json!({
+                "type": "vector",
+                "description": "Vector of values",
+                "element_type": inner_schema
+            }))
+        }
+        Ok(Type::Datatype) => {
+            let struct_tag: sui::types::StructTag = move_type
+                .type_name_opt()
+                .and_then(|n| n.parse().ok())
+                .ok_or_else(|| anyhow!("Datatype type missing or invalid StructTag"))?;
+
+            if *struct_tag.address() == move_std::PACKAGE_ID {
+                match (struct_tag.module().as_str(), struct_tag.name().as_str()) {
+                    ("string", "String") => Ok(json!({
+                        "type": "string",
+                        "description": "0x1::string::String"
+                    })),
+                    ("ascii", "String") => Ok(json!({
+                        "type": "string",
+                        "description": "0x1::ascii::String"
+                    })),
+                    _ => Ok(json!({
+                        "type": "object",
+                        "description": format!("0x1::{}::{}", struct_tag.module(), struct_tag.name())
+                    })),
+                }
+            } else if *struct_tag.address() == sui_framework::PACKAGE_ID {
+                match (struct_tag.module().as_str(), struct_tag.name().as_str()) {
+                    ("object", "ID") => Ok(json!({
+                        "type": "object_id",
+                        "description": "Sui object ID"
+                    })),
+                    ("tx_context", "TxContext") => Ok(json!({
+                        "type": "tx_context",
+                        "description": "Transaction context (automatically provided)"
+                    })),
+                    _ => Ok(json!({
+                        "type": "object",
+                        "description": format!("0x2::{}::{}", struct_tag.module(), struct_tag.name())
+                    })),
+                }
+            } else {
+                Ok(json!({
+                    "type": "object",
+                    "description": format!("{}::{}::{}", struct_tag.address(), struct_tag.module(), struct_tag.name())
+                }))
+            }
+        }
+        Ok(Type::Parameter) => Ok(json!({
+            "type": "generic",
+            "description": "Generic type parameter"
+        })),
+        _ => {
+            bail!("Unsupported Move type for schema conversion: {kind:?}");
+        }
+    }
+}
+
+/// Check if a parameter is TxContext (should be excluded from the inputschema).
+pub fn is_tx_context_param(move_type: &sui::grpc::OpenSignatureBody) -> bool {
+    let Some(type_name) = move_type.type_name_opt() else {
+        return false;
+    };
+
+    let maybe_struct_tag: Option<sui::types::StructTag> = type_name.parse().ok();
+
+    if let Some(struct_tag) = maybe_struct_tag {
+        *struct_tag.address() == sui_framework::PACKAGE_ID
+            && struct_tag.module().as_str() == "tx_context"
+            && struct_tag.name().as_str() == "TxContext"
+    } else {
+        false
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use {super::*, sui::grpc::open_signature_body::Type};
+
+    // Helper function to create a struct type.
+    fn make_struct(address: &str, module: &str, name: &str) -> sui::grpc::OpenSignatureBody {
+        sui::grpc::OpenSignatureBody::default()
+            .with_type(Type::Datatype)
+            .with_type_name(format!("{}::{}::{}", address, module, name))
+    }
+
+    fn make_prim(kind: Type) -> sui::grpc::OpenSignatureBody {
+        sui::grpc::OpenSignatureBody::default().with_type(kind)
+    }
+
+    fn make_vec(inner: sui::grpc::OpenSignatureBody) -> sui::grpc::OpenSignatureBody {
+        sui::grpc::OpenSignatureBody::default()
+            .with_type(Type::Vector)
+            .with_type_parameter_instantiation(vec![inner])
+    }
+
+    fn make_signature(
+        body: sui::grpc::OpenSignatureBody,
+        reference: Option<sui::grpc::open_signature::Reference>,
+    ) -> sui::grpc::OpenSignature {
+        let sig = sui::grpc::OpenSignature::default().with_body(body);
+        match reference {
+            Some(r) => sig.with_reference(r),
+            None => sig,
+        }
+    }
+
+    #[test]
+    fn test_primitive_types() {
+        // Bool.
+        let schema = convert_move_type_to_schema(&make_prim(Type::Bool)).unwrap();
+        assert_eq!(schema["type"], "bool");
+
+        // U8.
+        let schema = convert_move_type_to_schema(&make_prim(Type::U8)).unwrap();
+        assert_eq!(schema["type"], "u8");
+
+        // U16.
+        let schema = convert_move_type_to_schema(&make_prim(Type::U16)).unwrap();
+        assert_eq!(schema["type"], "u16");
+
+        // U32.
+        let schema = convert_move_type_to_schema(&make_prim(Type::U32)).unwrap();
+        assert_eq!(schema["type"], "u32");
+
+        // U64.
+        let schema = convert_move_type_to_schema(&make_prim(Type::U64)).unwrap();
+        assert_eq!(schema["type"], "u64");
+
+        // U128.
+        let schema = convert_move_type_to_schema(&make_prim(Type::U128)).unwrap();
+        assert_eq!(schema["type"], "u128");
+
+        // U256.
+        let schema = convert_move_type_to_schema(&make_prim(Type::U256)).unwrap();
+        assert_eq!(schema["type"], "u256");
+
+        // Address.
+        let schema = convert_move_type_to_schema(&make_prim(Type::Address)).unwrap();
+        assert_eq!(schema["type"], "address");
+    }
+
+    #[test]
+    fn test_vector_types() {
+        // Vector<u8>.
+        let vec_u8 = make_vec(make_prim(Type::U8));
+        let schema = convert_move_type_to_schema(&vec_u8).unwrap();
+        assert_eq!(schema["type"], "vector");
+        assert_eq!(schema["element_type"]["type"], "u8");
+
+        // Vector<bool>.
+        let vec_bool = make_vec(make_prim(Type::Bool));
+        let schema = convert_move_type_to_schema(&vec_bool).unwrap();
+        assert_eq!(schema["type"], "vector");
+        assert_eq!(schema["element_type"]["type"], "bool");
+
+        // Nested vector Vector<Vector<u64>>.
+        let vec_vec_u64 = make_vec(make_vec(make_prim(Type::U64)));
+        let schema = convert_move_type_to_schema(&vec_vec_u64).unwrap();
+        assert_eq!(schema["type"], "vector");
+        assert_eq!(schema["element_type"]["type"], "vector");
+        assert_eq!(schema["element_type"]["element_type"]["type"], "u64");
+    }
+
+    #[test]
+    fn test_standard_library_string_types() {
+        // 0x1::string::String.
+        let utf8_string = make_struct("0x1", "string", "String");
+        let schema = convert_move_type_to_schema(&utf8_string).unwrap();
+        assert_eq!(schema["type"], "string");
+        assert_eq!(schema["description"], "0x1::string::String");
+
+        // 0x1::ascii::String.
+        let ascii_string = make_struct("0x1", "ascii", "String");
+        let schema = convert_move_type_to_schema(&ascii_string).unwrap();
+        assert_eq!(schema["type"], "string");
+        assert_eq!(schema["description"], "0x1::ascii::String");
+    }
+
+    #[test]
+    fn test_standard_library_other_types() {
+        // 0x1::option::Option.
+        let option_type = make_struct("0x1", "option", "Option");
+        let schema = convert_move_type_to_schema(&option_type).unwrap();
+        assert_eq!(schema["type"], "object");
+        assert_eq!(schema["description"], "0x1::option::Option");
+    }
+
+    #[test]
+    fn test_sui_framework_object_id() {
+        // 0x2::object::ID.
+        let object_id = make_struct("0x2", "object", "ID");
+        let schema = convert_move_type_to_schema(&object_id).unwrap();
+        assert_eq!(schema["type"], "object_id");
+        assert_eq!(schema["description"], "Sui object ID");
+    }
+
+    #[test]
+    fn test_sui_framework_tx_context() {
+        // 0x2::tx_context::TxContext.
+        let tx_context = make_struct("0x2", "tx_context", "TxContext");
+        let schema = convert_move_type_to_schema(&tx_context).unwrap();
+        assert_eq!(schema["type"], "tx_context");
+        assert_eq!(
+            schema["description"],
+            "Transaction context (automatically provided)"
+        );
+    }
+
+    #[test]
+    fn test_sui_framework_coin() {
+        // 0x2::coin::Coin .
+        let coin = make_struct("0x2", "coin", "Coin");
+        let schema = convert_move_type_to_schema(&coin).unwrap();
+        assert_eq!(schema["type"], "object");
+        assert_eq!(schema["description"], "0x2::coin::Coin");
+    }
+
+    #[test]
+    fn test_sui_framework_uid() {
+        // 0x2::object::UID.
+        let uid = make_struct("0x2", "object", "UID");
+        let schema = convert_move_type_to_schema(&uid).unwrap();
+        assert_eq!(schema["type"], "object");
+        assert_eq!(schema["description"], "0x2::object::UID");
+    }
+
+    #[test]
+    fn test_sui_framework_other_types() {
+        // 0x2::balance::Balance.
+        let balance = make_struct("0x2", "balance", "Balance");
+        let schema = convert_move_type_to_schema(&balance).unwrap();
+        assert_eq!(schema["type"], "object");
+        assert_eq!(schema["description"], "0x2::balance::Balance");
+
+        // 0x2::transfer::Transfer.
+        let transfer = make_struct("0x2", "transfer", "Transfer");
+        let schema = convert_move_type_to_schema(&transfer).unwrap();
+        assert_eq!(schema["type"], "object");
+        assert_eq!(schema["description"], "0x2::transfer::Transfer");
+    }
+
+    #[test]
+    fn test_custom_package_types() {
+        // Custom package type.
+        let custom = make_struct("0x123456789abcdef", "my_module", "MyStruct");
+        let schema = convert_move_type_to_schema(&custom).unwrap();
+        assert_eq!(schema["type"], "object");
+        assert_eq!(
+            schema["description"],
+            format!(
+                "{}::my_module::MyStruct",
+                sui::types::Address::from_static("0x123456789abcdef")
+            )
+        );
+    }
+
+    #[test]
+    fn test_type_parameter() {
+        // Generic type parameter.
+        let generic = make_prim(Type::Parameter);
+        let schema = convert_move_type_to_schema(&generic).unwrap();
+        assert_eq!(schema["type"], "generic");
+    }
+
+    #[test]
+    fn test_is_tx_context_param_struct() {
+        // Direct TxContext struct.
+        let tx_context = make_struct("0x2", "tx_context", "TxContext");
+        assert!(is_tx_context_param(&tx_context));
+
+        // Non-TxContext struct.
+        let coin = make_struct("0x2", "coin", "Coin");
+        assert!(!is_tx_context_param(&coin));
+    }
+
+    #[test]
+    fn test_is_tx_context_param_primitive() {
+        // Primitives are not TxContext.
+        assert!(!is_tx_context_param(&make_prim(Type::U64)));
+        assert!(!is_tx_context_param(&make_prim(Type::Bool)));
+        assert!(!is_tx_context_param(&make_prim(Type::Address)));
+    }
+
+    #[test]
+    fn test_complex_nested_types() {
+        // Vector  to objects.
+        let vector = make_vec(make_struct("0x2", "coin", "Coin"));
+        let schema = convert_move_type_to_schema(&vector).unwrap();
+        assert_eq!(schema["type"], "vector");
+        assert_eq!(schema["element_type"]["type"], "object");
+    }
+
+    #[test]
+    fn test_schema_structure_completeness() {
+        // Verify that all schemas have both type and description fields.
+        let test_types = vec![
+            make_prim(Type::Bool),
+            make_prim(Type::U8),
+            make_prim(Type::U256),
+            make_prim(Type::Address),
+            make_struct("0x1", "string", "String"),
+            make_struct("0x2", "object", "ID"),
+            make_struct("0x2", "coin", "Coin"),
+        ];
+
+        for move_type in test_types {
+            let schema = convert_move_type_to_schema(&move_type).unwrap();
+            assert!(schema.get("type").is_some(), "Schema missing 'type' field");
+            assert!(
+                schema.get("description").is_some(),
+                "Schema missing 'description' field"
+            );
+        }
+    }
+
+    #[test]
+    fn test_signature_mutable_reference() {
+        // Mutable reference to an object.
+        let body = make_struct("0x2", "coin", "Coin");
+        let sig = make_signature(body, Some(sui::grpc::open_signature::Reference::Mutable));
+        let schema = convert_move_signature_to_schema(&sig).unwrap();
+
+        assert_eq!(schema["type"], "object");
+        assert_eq!(schema["mutable"], true);
+    }
+
+    #[test]
+    fn test_signature_immutable_reference() {
+        // Immutable reference to an object.
+        let body = make_struct("0x2", "coin", "Coin");
+        let sig = make_signature(body, Some(sui::grpc::open_signature::Reference::Immutable));
+        let schema = convert_move_signature_to_schema(&sig).unwrap();
+
+        assert_eq!(schema["type"], "object");
+        // No mutable field for immutable references.
+        assert!(schema.get("mutable").is_none());
+    }
+
+    #[test]
+    fn test_signature_no_reference() {
+        // Value type (no reference).
+        let body = make_prim(Type::U64);
+        let sig = make_signature(body, None);
+        let schema = convert_move_signature_to_schema(&sig).unwrap();
+
+        assert_eq!(schema["type"], "u64");
+        // No mutable field for value types.
+        assert!(schema.get("mutable").is_none());
+    }
+
+    #[test]
+    fn test_signature_mutable_primitive() {
+        // Mutable reference to a primitive (edge case).
+        let body = make_prim(Type::Bool);
+        let sig = make_signature(body, Some(sui::grpc::open_signature::Reference::Mutable));
+        let schema = convert_move_signature_to_schema(&sig).unwrap();
+
+        assert_eq!(schema["type"], "bool");
+        assert_eq!(schema["mutable"], true);
+    }
+}
diff --git a/sdk/src/sui.rs b/sdk/src/sui.rs
index 8e2f01fe..d7c1517f 100644
--- a/sdk/src/sui.rs
+++ b/sdk/src/sui.rs
@@ -1,110 +1,40 @@
 //! This module attempts to make a little bit of sense when dealing with Sui
 //! types.
 //!
-//! Some are prefixed with `Sui`, some are not. This re-export will nest all
-//! Sui types under `predule::sui` and remove all `Sui` prefixes.
-//!
-//! This way we can use, for example `sui::ObjectID` in our code.
-//!
-//! All move types are now also prefixed with `Move` to avoid confusion.
+//! This way we can use, for example `sui::types::Address` in our code.
 
-pub use {
-    move_core_types::{
-        ident_str as move_ident_str,
-        identifier::IdentStr as MoveIdentStr,
-        language_storage::{StructTag as MoveStructTag, TypeTag as MoveTypeTag},
-    },
-    shared_crypto::intent::Intent,
-    sui_config::{
-        sui_config_dir as config_dir,
-        Config,
-        PersistedConfig,
-        SUI_CLIENT_CONFIG as CLIENT_CONFIG,
-        SUI_KEYSTORE_FILENAME as KEYSTORE_FILENAME,
-    },
-    sui_keys::{
-        key_derive::generate_new_key,
-        keystore::{FileBasedKeystore, Keystore},
-    },
-    sui_sdk::{
-        error::Error,
-        json::SuiJsonValue,
-        rpc_types::{
-            BalanceChange,
-            BcsEvent,
-            Coin,
-            EventFilter,
-            EventPage,
-            ObjectChange,
-            OwnedObjectRef,
-            SuiEvent as Event,
-            SuiExecutionStatus as ExecutionStatus,
-            SuiMoveStruct as MoveStruct,
-            SuiMoveValue as MoveValue,
-            SuiObjectData as ObjectData,
-            SuiObjectDataFilter as ObjectDataFilter,
-            SuiObjectDataOptions as ObjectDataOptions,
-            SuiObjectRef as ObjectRef,
-            SuiObjectResponse as ObjectResponse,
-            SuiObjectResponseQuery as ObjectResponseQuery,
-            SuiParsedData as ParsedData,
-            SuiParsedMoveObject as ParsedMoveObject,
-            SuiTransactionBlockEffects as TransactionBlockEffects,
-            SuiTransactionBlockEffectsV1 as TransactionBlockEffectsV1,
-            SuiTransactionBlockEvents as TransactionBlockEvents,
-            SuiTransactionBlockResponse as TransactionBlockResponse,
-            SuiTransactionBlockResponseOptions as TransactionBlockResponseOptions,
-        },
-        sui_client_config::{SuiClientConfig as ClientConfig, SuiEnv as Env},
-        types::{
-            base_types::{ObjectID, SequenceNumber, SuiAddress as Address},
-            crypto::SignatureScheme,
-            digests::{ObjectDigest, TransactionDigest},
-            dynamic_field::{DynamicFieldInfo, DynamicFieldName},
-            event::EventID,
-            gas::GasCostSummary,
-            gas_coin::MIST_PER_SUI,
-            id::UID,
-            object::Owner,
-            programmable_transaction_builder::ProgrammableTransactionBuilder,
-            quorum_driver_types::ExecuteTransactionRequestType,
-            transaction::{
-                Argument,
-                CallArg,
-                Command,
-                ObjectArg,
-                ProgrammableTransaction,
-                Transaction,
-                TransactionData,
-            },
-            Identifier,
-            MOVE_STDLIB_PACKAGE_ID,
-            SUI_CLOCK_OBJECT_ID as CLOCK_OBJECT_ID,
-            SUI_CLOCK_OBJECT_SHARED_VERSION as CLOCK_OBJECT_SHARED_VERSION,
-            SUI_FRAMEWORK_PACKAGE_ID as FRAMEWORK_PACKAGE_ID,
-        },
-        wallet_context::WalletContext,
-        SuiClient as Client,
-        SuiClientBuilder as ClientBuilder,
-        SUI_DEVNET_URL as DEVNET_URL,
-        SUI_LOCAL_NETWORK_URL as LOCAL_NETWORK_URL,
-        SUI_MAINNET_URL as MAINNET_URL,
-        SUI_TESTNET_URL as TESTNET_URL,
-    },
-};
+pub mod tx {
+    pub use sui_transaction_builder::{unresolved::*, *};
+}
+
+pub mod types {
+    pub use sui_sdk_types::*;
+}
+
+pub mod crypto {
+    pub use sui_crypto::{ed25519::Ed25519PrivateKey, *};
+}
+
+pub mod grpc {
+    pub use sui_rpc::{field::FieldMask, proto::sui::rpc::v2::*, Client};
+}
 
 /// Sui traits re-exported so that we can `use sui::traits::*` in our code.
 pub mod traits {
+    pub use {sui_crypto::SuiSigner, sui_rpc::field::FieldMaskUtil, sui_sdk_types::bcs::ToBcs};
+}
+
+pub const MIST_PER_SUI: u64 = 1_000_000_000;
+
+/// Move build and package management re-exported for testing.
+#[cfg(feature = "test_utils")]
+pub mod build {
     pub use {
-        sui_config::Config,
-        sui_keys::keystore::AccountKeystore,
-        sui_sdk::rpc_types::SuiTransactionBlockEffectsAPI as TransactionBlockEffectsAPI,
+        move_package::lock_file::{
+            schema::{update_managed_address, ManagedAddressUpdate},
+            LockFile,
+        },
+        sui_move_build::{implicit_deps, BuildConfig},
+        sui_package_management::system_package_versions::latest_system_packages,
     };
 }
-
-/// Use this whenever you need da Clock (=`0x06`) as Tx argument.
-pub const CLOCK_OBJ_ARG: ObjectArg = ObjectArg::SharedObject {
-    id: CLOCK_OBJECT_ID,
-    initial_shared_version: CLOCK_OBJECT_SHARED_VERSION,
-    mutable: false,
-};
diff --git a/sdk/src/test_utils/containers.rs b/sdk/src/test_utils/containers.rs
index 3c5817a3..0dea3e6c 100644
--- a/sdk/src/test_utils/containers.rs
+++ b/sdk/src/test_utils/containers.rs
@@ -4,43 +4,124 @@
 //! - Sui
 //! - Redis
 
-use testcontainers_modules::{
-    redis::Redis,
-    sui::Sui,
-    testcontainers::{core::ports::ContainerPort, runners::AsyncRunner, ContainerAsync, ImageExt},
+use {
+    portpicker::pick_unused_port,
+    testcontainers_modules::{
+        postgres::Postgres,
+        redis::Redis,
+        sui::Sui,
+        testcontainers::{
+            bollard::network::CreateNetworkOptions,
+            core::{client, ports::ContainerPort, Mount},
+            runners::AsyncRunner,
+            ContainerAsync,
+            ImageExt,
+        },
+    },
 };
 
 pub type SuiContainer = ContainerAsync<Sui>;
+pub type PgContainer = ContainerAsync<Postgres>;
 pub type RedisContainer = ContainerAsync<Redis>;
 pub type ExecCommand = testcontainers_modules::testcontainers::core::ExecCommand;
 
+const SUI_TOOLS_TAG_AMD64: &str = "mainnet-v1.61.2";
+const SUI_TOOLS_TAG_ARM64: &str = "mainnet-v1.61.2-arm64";
+
+pub struct SuiInstance {
+    pub container: SuiContainer,
+    pub pg: PgContainer,
+    pub rpc_port: u16,
+    pub faucet_port: u16,
+    pub graphql_port: u16,
+}
+
 /// Spins up a Sui container and returns its handle and mapped RPC and faucet
 /// ports.
-pub async fn setup_sui_instance() -> (SuiContainer, u16, u16) {
+pub async fn setup_sui_instance() -> SuiInstance {
+    let rpc_host_port = pick_unused_port().expect("No free port for Sui RPC.");
+    let faucet_host_port = loop {
+        let port = pick_unused_port().expect("No free port for Sui faucet.");
+        if port != rpc_host_port {
+            break port;
+        }
+    };
+    let graphql_host_port = loop {
+        let port = pick_unused_port().expect("No free port for Sui GraphQL.");
+        if port != rpc_host_port && port != faucet_host_port {
+            break port;
+        }
+    };
+
+    // Create a `sui-net` Docker network for Sui and Postgres to communicate.
+    // If it already exists, it will be reused.
+    let docker = client::docker_client_instance()
+        .await
+        .expect("Failed to get Docker client.");
+    let mut request = CreateNetworkOptions::default();
+    request.name = "sui-net";
+    let _ = docker.create_network(request).await.ok();
+
+    let sui_tools_tag = docker
+        .version()
+        .await
+        .ok()
+        .and_then(|version| version.arch)
+        .map(|arch| arch.to_ascii_lowercase())
+        .as_deref()
+        .map(|arch| match arch {
+            "arm64" | "aarch64" => SUI_TOOLS_TAG_ARM64,
+            _ => SUI_TOOLS_TAG_AMD64,
+        })
+        .unwrap_or_else(|| {
+            if cfg!(target_arch = "aarch64") {
+                SUI_TOOLS_TAG_ARM64
+            } else {
+                SUI_TOOLS_TAG_AMD64
+            }
+        });
+
+    let container_name = format!("sui-postgres-{}", rpc_host_port);
+
+    let pg_request = Postgres::default()
+        .with_tag("latest")
+        .with_mount(Mount::tmpfs_mount("/postgres_data"))
+        .with_network("sui-net")
+        .with_container_name(&container_name);
+
+    let pg_container = pg_request
+        .start()
+        .await
+        .expect("Failed to start Postgres container for Sui.");
+
     let sui_request = Sui::default()
         .with_force_regenesis(true)
         .with_faucet(true)
-        .with_name("taluslabs/sui-tools")
-        .with_tag(env!("SUI_SDK_TAG"))
-        .with_mapped_port(0, ContainerPort::Tcp(9000))
-        .with_mapped_port(0, ContainerPort::Tcp(9123));
+        .with_indexer(true)
+        .with_indexer_pg_url(format!(
+            "postgres://postgres:postgres@{}:5432/postgres",
+            container_name
+        ))
+        .with_graphql(true)
+        .with_name("mysten/sui-tools")
+        .with_tag(sui_tools_tag)
+        .with_mapped_port(rpc_host_port, ContainerPort::Tcp(9000))
+        .with_mapped_port(faucet_host_port, ContainerPort::Tcp(9123))
+        .with_mapped_port(graphql_host_port, ContainerPort::Tcp(9125))
+        .with_network("sui-net");
 
     let container = sui_request
         .start()
         .await
         .expect("Failed to start Sui container.");
 
-    let rpc_port = container
-        .get_host_port_ipv4(9000)
-        .await
-        .expect("Failed to get RPC port.");
-
-    let faucet_port = container
-        .get_host_port_ipv4(9123)
-        .await
-        .expect("Failed to get faucet port.");
-
-    (container, rpc_port, faucet_port)
+    SuiInstance {
+        container,
+        pg: pg_container,
+        rpc_port: rpc_host_port,
+        faucet_port: faucet_host_port,
+        graphql_port: graphql_host_port,
+    }
 }
 
 /// Spins up a Redis container and returns its handle and mapped Redis port.
diff --git a/sdk/src/test_utils/contracts.rs b/sdk/src/test_utils/contracts.rs
index 4d611c00..8ce76128 100644
--- a/sdk/src/test_utils/contracts.rs
+++ b/sdk/src/test_utils/contracts.rs
@@ -1,96 +1,126 @@
 use {
-    crate::sui::{self, traits::*},
-    std::{fs::OpenOptions, path::PathBuf},
-    sui_move_build::implicit_deps,
-    sui_package_management::system_package_versions::latest_system_packages,
+    crate::{
+        idents::sui_framework,
+        nexus::signer::{ExecutedTransaction, Signer},
+        sui,
+        test_utils::sui_mocks,
+    },
+    std::{fs::OpenOptions, path::PathBuf, sync::Arc},
+    tokio::sync::Mutex,
 };
 
-/// Publishes a Move package to Sui.
+/// Publishes a Move package to Sui with no package ID overrides.
+pub async fn publish_move_package(
+    pk: &sui::crypto::Ed25519PrivateKey,
+    rpc_url: &str,
+    path_str: &str,
+    gas_coin: sui::types::ObjectReference,
+) -> ExecutedTransaction {
+    publish_move_package_with_overrides(pk, rpc_url, path_str, gas_coin, &[]).await
+}
+
+/// Publishes a Move package to Sui. Optionally providing overrides for package
+/// IDs.
 ///
 /// `path_str` is the path relative to the project `Cargo.toml` directory.
-pub async fn publish_move_package(
-    wallet: &mut sui::WalletContext,
+pub async fn publish_move_package_with_overrides(
+    pk: &sui::crypto::Ed25519PrivateKey,
+    rpc_url: &str,
     path_str: &str,
-    gas_coin: sui::Coin,
-) -> sui::TransactionBlockResponse {
+    gas_coin: sui::types::ObjectReference,
+    overrides: &[(&str, sui::types::Address)],
+) -> ExecutedTransaction {
     let install_dir = PathBuf::from(path_str);
     let lock_file = PathBuf::from(format!("{path_str}/Move.lock"));
 
-    let sui = wallet
-        .get_client()
+    let mut client = sui::grpc::Client::new(rpc_url).expect("Could not create gRPC client");
+    let addr = pk.public_key().derive_address();
+    let signer = Signer::new(
+        Arc::new(Mutex::new(client.clone())),
+        pk.clone(),
+        std::time::Duration::from_secs(30),
+        Arc::new(sui_mocks::mock_nexus_objects()),
+    );
+
+    let reference_gas_price = client
+        .get_reference_gas_price()
         .await
-        .expect("Failed to get Sui client.");
+        .expect("Failed to get reference gas price.");
 
-    let addr = wallet
-        .active_address()
-        .expect("Failed to get active address.");
+    let chain_id = {
+        let response = client
+            .ledger_client()
+            .get_service_info(sui::grpc::GetServiceInfoRequest::default())
+            .await
+            .expect("Failed to get service info.");
 
-    let chain_id = sui
-        .read_api()
-        .get_chain_identifier()
-        .await
-        .expect("Failed to get chain identifier.");
+        response
+            .into_inner()
+            .chain_id
+            .expect("Chain ID missing in service info.")
+    };
 
     // Compile the package.
-    let mut build_config = sui_move_build::BuildConfig::new_for_testing();
-    build_config.chain_id = Some(chain_id);
-    build_config.config.implicit_dependencies = implicit_deps(latest_system_packages());
+    let mut build_config = sui_move_build::BuildConfig::new_for_testing_replace_addresses(
+        overrides
+            .into_iter()
+            .map(|(k, v)| (k.to_string(), v.to_string().parse().unwrap()))
+            .collect::<Vec<_>>(),
+    );
+
+    build_config.chain_id = Some(chain_id.clone());
+    build_config.config.implicit_dependencies =
+        sui::build::implicit_deps(sui::build::latest_system_packages());
     let package = build_config
         .build(&install_dir)
         .expect("Failed to build package.");
 
-    let reference_gas_price = sui
-        .read_api()
-        .get_reference_gas_price()
-        .await
-        .expect("Failed to fetch reference gas price.");
-
     let with_unpublished_deps = false;
 
-    let tx = sui
-        .transaction_builder()
-        .publish_tx_kind(
-            addr,
-            package.get_package_bytes(with_unpublished_deps),
-            package.get_dependency_storage_package_ids(),
-        )
-        .await
-        .expect("Failed to build transaction.");
-
-    let tx_data = sui
-        .transaction_builder()
-        .tx_data(
-            addr,
-            tx,
-            sui::MIST_PER_SUI,
-            reference_gas_price,
-            vec![gas_coin.coin_object_id],
-            None,
-        )
+    let mut tx = sui::tx::TransactionBuilder::new();
+
+    let upgrade_cap = tx.publish(
+        package.get_package_bytes(with_unpublished_deps),
+        package
+            .get_dependency_storage_package_ids()
+            .iter()
+            .map(|id| id.to_string().parse().unwrap())
+            .collect(),
+    );
+    let address =
+        sui_framework::Address::address_from_type(&mut tx, addr).expect("Failed to get address.");
+
+    tx.transfer_objects(vec![upgrade_cap], address);
+
+    tx.set_sender(addr);
+    tx.set_gas_budget(1_000_000_000);
+    tx.set_gas_price(reference_gas_price);
+    tx.add_gas_objects(vec![sui::tx::Input::owned(
+        *gas_coin.object_id(),
+        gas_coin.version(),
+        *gas_coin.digest(),
+    )]);
+
+    let tx = tx.finish().expect("Failed to finish transaction.");
+
+    let signature = signer
+        .sign_tx(&tx)
         .await
-        .expect("Failed to build transaction data.");
-
-    // Prepare some options for the transaction. Object changes and events are
-    // used to parse useful IDs from.
-    let envelope = wallet.sign_transaction(&tx_data);
-    let resp_options = sui::TransactionBlockResponseOptions::new()
-        .with_events()
-        .with_effects()
-        .with_object_changes();
-    let resp_finality = sui::ExecuteTransactionRequestType::WaitForLocalExecution;
-
-    // Execute the transaction.
-    let response = sui
-        .quorum_driver_api()
-        .execute_transaction_block(envelope, resp_options, Some(resp_finality))
+        .expect("Failed to sign transaction.");
+
+    let response = signer
+        .execute_tx(tx, signature, &mut gas_coin.clone())
         .await
         .expect("Failed to execute transaction.");
 
-    if let Some(effects) = response.effects.clone() {
-        if effects.clone().into_status().is_err() {
-            panic!("Transaction has erroneous effects: {path_str} {effects}");
-        }
-    }
+    let pkg_id = response
+        .objects
+        .iter()
+        .find_map(|c| match c.data() {
+            sui::types::ObjectData::Package(m) => Some(m.id),
+            _ => None,
+        })
+        .expect("Move package must be published");
 
     // Create the lock file if not exists.
     OpenOptions::new()
@@ -100,15 +130,20 @@ pub async fn publish_move_package(
         .open(&lock_file)
         .expect("Failed to create lock file.");
 
-    sui_package_management::update_lock_file(
-        wallet,
-        sui_package_management::LockCommand::Publish,
-        Some(install_dir),
-        Some(lock_file),
-        &response,
+    let mut lock = sui::build::LockFile::from(install_dir.clone(), &lock_file)
+        .expect("Failed to read lock file.");
+
+    sui::build::update_managed_address(
+        &mut lock,
+        "localnet",
+        sui::build::ManagedAddressUpdate::Published {
+            chain_id,
+            original_id: pkg_id.to_string(),
+        },
     )
-    .await
     .expect("Failed to update lock file.");
 
+    lock.commit(lock_file).expect("Failed to update lock file.");
+
     response
 }
diff --git a/sdk/src/test_utils/faucet.rs b/sdk/src/test_utils/faucet.rs
index a8058ca2..ffca370d 100644
--- a/sdk/src/test_utils/faucet.rs
+++ b/sdk/src/test_utils/faucet.rs
@@ -8,7 +8,7 @@ use {
 };
 
 /// Request tokens from the Sui faucet for the given address.
-pub async fn request_tokens(url: &str, addr: sui::Address) -> anyhow::Result<()> {
+pub async fn request_tokens(url: &str, addr: sui::types::Address) -> anyhow::Result<()> {
     #[derive(Debug, Deserialize)]
     struct FaucetResponse {
         error: Option<String>,
diff --git a/sdk/src/test_utils/gas.rs b/sdk/src/test_utils/gas.rs
index 2fb5d574..ef75189c 100644
--- a/sdk/src/test_utils/gas.rs
+++ b/sdk/src/test_utils/gas.rs
@@ -1,18 +1,41 @@
-use crate::sui;
+use crate::{sui, sui::traits::*};
 
 /// Fetch gas coin for the provided address.
 pub async fn fetch_gas_coins(
-    sui: &sui::Client,
-    addr: sui::Address,
-) -> anyhow::Result<Vec<sui::Coin>> {
-    let limit = None;
-    let cursor = None;
-    let default_to_sui_coin_type = None;
+    rpc_url: &str,
+    owner: sui::types::Address,
+) -> anyhow::Result<Vec<(sui::types::ObjectReference, u64)>> {
+    let mut client = sui::grpc::Client::new(rpc_url)?;
 
-    let response = sui
-        .coin_read_api()
-        .get_coins(addr, default_to_sui_coin_type, cursor, limit)
-        .await?;
+    let request = sui::grpc::ListOwnedObjectsRequest::default()
+        .with_owner(owner)
+        .with_page_size(1000)
+        .with_object_type(sui::types::StructTag::gas_coin())
+        .with_read_mask(sui::grpc::FieldMask::from_paths([
+            "object_id",
+            "version",
+            "digest",
+            "balance",
+        ]));
 
-    Ok(response.data)
+    let response = client
+        .state_client()
+        .list_owned_objects(request)
+        .await
+        .map(|resp| resp.into_inner())?;
+
+    Ok(response
+        .objects()
+        .iter()
+        .filter_map(|object| {
+            Some((
+                sui::types::ObjectReference::new(
+                    object.object_id_opt()?.parse().ok()?,
+                    object.version_opt()?,
+                    object.digest_opt()?.parse().ok()?,
+                ),
+                object.balance(),
+            ))
+        })
+        .collect())
 }
diff --git a/sdk/src/test_utils/mod.rs b/sdk/src/test_utils/mod.rs
index fcc4ab96..75c9e4b8 100644
--- a/sdk/src/test_utils/mod.rs
+++ b/sdk/src/test_utils/mod.rs
@@ -4,4 +4,3 @@ pub mod faucet;
 pub mod gas;
 pub mod nexus_mocks;
 pub mod sui_mocks;
-pub mod wallet;
diff --git a/sdk/src/test_utils/nexus_mocks.rs b/sdk/src/test_utils/nexus_mocks.rs
index 4a1062db..08cee1e3 100644
--- a/sdk/src/test_utils/nexus_mocks.rs
+++ b/sdk/src/test_utils/nexus_mocks.rs
@@ -7,45 +7,37 @@ use {
         nexus::client::NexusClient,
         sui,
         test_utils::sui_mocks,
+        types::NexusObjects,
     },
-    mockito::{Server, ServerGuard},
     std::sync::Arc,
     tokio::sync::Mutex,
 };
 
 /// Create a mock [`NexusClient`] that is connected to a mock RPC using [`mockito`].
-pub async fn mock_nexus_client() -> (ServerGuard, NexusClient) {
-    let mut server = Server::new_async().await;
-    let server_url = server.url();
+pub async fn mock_nexus_client(
+    nexus_objects: &NexusObjects,
+    rpc_url: &str,
+    gql_url: Option<&str>,
+) -> NexusClient {
+    let mut rng = rand::thread_rng();
+    let pk = sui::crypto::Ed25519PrivateKey::generate(&mut rng);
 
-    let (_, mnemonic) = sui_mocks::mock_sui_mnemonic();
-    let nexus_objects = sui_mocks::mock_nexus_objects();
-    let coin = sui_mocks::mock_sui_coin(1000);
+    let coin = sui_mocks::mock_sui_object_ref();
 
-    let mock = sui_mocks::rpc::mock_rpc_discover(&mut server);
-
-    let sui_client = sui::ClientBuilder::default()
-        .build(server_url)
-        .await
-        .expect("Failed to build Sui client");
-
-    mock.assert_async().await;
-
-    let mock = sui_mocks::rpc::mock_reference_gas_price(&mut server, "1000".to_string());
+    let builder = if let Some(gql_url) = gql_url {
+        NexusClient::builder().with_gql_url(gql_url)
+    } else {
+        NexusClient::builder()
+    };
 
-    let client = NexusClient::builder()
-        .with_nexus_objects(nexus_objects)
-        .with_gas(vec![&coin], 1000)
-        .expect("Failed to setup gas")
-        .with_mnemonic(sui_client, &mnemonic, sui::SignatureScheme::ED25519)
-        .expect("Failed to import mnemonic")
+    builder
+        .with_private_key(pk)
+        .with_rpc_url(rpc_url)
+        .with_nexus_objects(nexus_objects.clone())
+        .with_gas(vec![coin], 1000)
         .build()
         .await
-        .expect("Failed to build NexusClient");
-
-    mock.assert_async().await;
-
-    (server, client)
+        .expect("Failed to build NexusClient")
 }
 
 /// Create a mock [`Session`] for testing encryption.
diff --git a/sdk/src/test_utils/sui_mocks.rs b/sdk/src/test_utils/sui_mocks.rs
index 7e35053e..7b190bcf 100644
--- a/sdk/src/test_utils/sui_mocks.rs
+++ b/sdk/src/test_utils/sui_mocks.rs
@@ -1,41 +1,39 @@
 use crate::{sui, types::NexusObjects};
 
-/// Create a new [`sui::Coin`] with random values.
-pub fn mock_sui_coin(balance: u64) -> sui::Coin {
-    sui::Coin {
-        coin_type: "Sui".to_string(),
-        coin_object_id: sui::ObjectID::random(),
-        version: sui::SequenceNumber::new(),
-        digest: sui::ObjectDigest::random(),
-        balance,
-        previous_transaction: sui::TransactionDigest::random(),
-    }
+/// Create a new [`sui::types::ObjectReference`] with random values.
+pub fn mock_sui_object_ref() -> sui::types::ObjectReference {
+    let mut rng = rand::thread_rng();
+
+    sui::types::ObjectReference::new(
+        sui::types::Address::generate(&mut rng),
+        1,
+        sui::types::Digest::generate(&mut rng),
+    )
 }
 
-/// Create a new [`sui::ObjectRef`] with random values.
-pub fn mock_sui_object_ref() -> sui::ObjectRef {
-    sui::ObjectRef {
-        object_id: sui::ObjectID::random(),
-        version: sui::SequenceNumber::new(),
-        digest: sui::ObjectDigest::random(),
-    }
+/// Create a new [`sui::EventID`] with random values.
+pub fn mock_sui_event_id() -> (sui::types::Digest, u64) {
+    let mut rng = rand::thread_rng();
+
+    (sui::types::Digest::generate(&mut rng), 0)
 }
 
 /// Create a new [`sui::EventID`] with random values.
-pub fn mock_sui_event_id() -> sui::EventID {
-    sui::EventID {
-        tx_digest: sui::TransactionDigest::random(),
-        event_seq: 0,
-    }
+pub fn mock_sui_address() -> sui::types::Address {
+    let mut rng = rand::thread_rng();
+
+    sui::types::Address::generate(&mut rng)
 }
 
 /// Create a new [`sui::EventID`] with random values.
 pub fn mock_nexus_objects() -> NexusObjects {
+    let mut rng = rand::thread_rng();
+
     NexusObjects {
-        workflow_pkg_id: sui::ObjectID::random(),
-        primitives_pkg_id: sui::ObjectID::random(),
-        interface_pkg_id: sui::ObjectID::random(),
-        network_id: sui::ObjectID::random(),
+        workflow_pkg_id: sui::types::Address::generate(&mut rng),
+        primitives_pkg_id: sui::types::Address::generate(&mut rng),
+        interface_pkg_id: sui::types::Address::generate(&mut rng),
+        network_id: sui::types::Address::generate(&mut rng),
         tool_registry: mock_sui_object_ref(),
         default_tap: mock_sui_object_ref(),
         gas_service: mock_sui_object_ref(),
@@ -43,313 +41,496 @@ pub fn mock_nexus_objects() -> NexusObjects {
     }
 }
 
-/// Generate a new Sui address and its corresponding mnemonic.
-pub fn mock_sui_mnemonic() -> (sui::Address, String) {
-    let derivation_path = None;
-    let word_length = None;
+/// Generate a mock [`sui::types::Event`]
+pub fn mock_sui_event(
+    package_id: sui::types::Address,
+    type_: sui::types::StructTag,
+    contents: Vec<u8>,
+) -> sui::types::Event {
+    let mut rng = rand::thread_rng();
 
-    let (addr, _, _, secret_mnemonic) =
-        sui::generate_new_key(sui::SignatureScheme::ED25519, derivation_path, word_length)
-            .expect("Failed to generate key.");
-
-    (addr, secret_mnemonic)
+    sui::types::Event {
+        package_id,
+        type_,
+        contents,
+        sender: sui::types::Address::generate(&mut rng),
+        module: sui::types::Identifier::new("test_module").unwrap(),
+    }
 }
 
-/// Create a new [`sui::TransactionBlockEffects`] with random values. Note that
-/// this function can be changed in the future to allow more customization.
-pub fn mock_sui_transaction_block_effects(
-    created: Option<Vec<sui::OwnedObjectRef>>,
-    mutated: Option<Vec<sui::OwnedObjectRef>>,
-    unwrapped: Option<Vec<sui::OwnedObjectRef>>,
-    deleted: Option<Vec<sui::ObjectRef>>,
-) -> sui::TransactionBlockEffects {
-    sui::TransactionBlockEffects::V1(sui::TransactionBlockEffectsV1 {
-        status: sui::ExecutionStatus::Success,
-        executed_epoch: 1,
-        gas_used: sui::GasCostSummary {
-            computation_cost: 0,
-            storage_cost: 0,
-            storage_rebate: 0,
-            non_refundable_storage_fee: 0,
-        },
-        modified_at_versions: vec![],
-        shared_objects: vec![],
-        transaction_digest: sui::TransactionDigest::random(),
-        created: created.unwrap_or_default(),
-        mutated: mutated.unwrap_or_default(),
-        unwrapped: unwrapped.unwrap_or_default(),
-        deleted: deleted.unwrap_or_default(),
-        unwrapped_then_deleted: vec![],
-        wrapped: vec![],
-        gas_object: sui::OwnedObjectRef {
-            owner: sui::Owner::AddressOwner(sui::ObjectID::random().into()),
-            reference: mock_sui_object_ref(),
-        },
-        events_digest: None,
-        dependencies: vec![],
-    })
+/// Finish the given [`sui::tx::TransactionBuilder`] with mock data.
+pub fn mock_finish_transaction(mut tx: sui::tx::TransactionBuilder) -> sui::types::Transaction {
+    let mut rng = rand::thread_rng();
+    let gas = mock_sui_object_ref();
+
+    tx.set_sender(sui::types::Address::generate(&mut rng));
+    tx.set_gas_budget(1000);
+    tx.set_gas_price(1000);
+    tx.add_gas_objects(vec![sui::tx::Input::owned(
+        *gas.object_id(),
+        gas.version(),
+        *gas.digest(),
+    )]);
+
+    tx.finish().expect("Transaction should build")
 }
 
-/// Mocking RPC endpoints for deeper testing.
-pub mod rpc {
+pub mod grpc {
     use {
-        crate::{events::NexusEventKind, idents::primitives, sui, test_utils::sui_mocks},
-        mockito::{Matcher, Mock, ServerGuard},
-        serde_json::json,
+        super::*,
+        mockall::mock,
+        std::time::SystemTime,
+        sui_rpc::proto::sui::rpc::v2::{
+            ledger_service_server::{LedgerService, LedgerServiceServer},
+            subscription_service_server::{SubscriptionService, SubscriptionServiceServer},
+            transaction_execution_service_server::{
+                TransactionExecutionService,
+                TransactionExecutionServiceServer,
+            },
+            *,
+        },
+        tonic::{Request, Response, Status},
     };
 
-    #[derive(serde::Deserialize)]
-    struct PartialRequest {
-        jsonrpc: String,
-        id: u64,
+    // Mocking LedgerService RPC endpoints for deeper testing.
+    mock! {
+        pub LedgerService {}
+
+        #[tonic::async_trait]
+        impl LedgerService for LedgerService {
+            async fn get_service_info(
+                &self,
+                request: Request<GetServiceInfoRequest>,
+            ) -> Result<Response<GetServiceInfoResponse>, Status>;
+
+            async fn get_object(
+                &self,
+                request: Request<GetObjectRequest>,
+            ) -> Result<Response<GetObjectResponse>, Status>;
+
+            async fn batch_get_objects(
+                &self,
+                request: Request<BatchGetObjectsRequest>,
+            ) -> Result<Response<BatchGetObjectsResponse>, Status>;
+
+            async fn get_transaction(
+                &self,
+                request: Request<GetTransactionRequest>,
+            ) -> Result<Response<GetTransactionResponse>, Status>;
+
+            async fn batch_get_transactions(
+                &self,
+                request: Request<BatchGetTransactionsRequest>,
+            ) -> Result<Response<BatchGetTransactionsResponse>, Status>;
+
+            async fn get_checkpoint(
+                &self,
+                request: Request<GetCheckpointRequest>,
+            ) -> Result<Response<GetCheckpointResponse>, Status>;
+
+            async fn get_epoch(
+                &self,
+                request: Request<GetEpochRequest>,
+            ) -> Result<Response<GetEpochResponse>, Status>;
+        }
     }
 
-    pub fn mock_rpc_discover(server: &mut ServerGuard) -> Mock {
-        server
-            .mock("POST", "/")
-            .match_header("content-type", "application/json")
-            .match_body(Matcher::PartialJson(json!({
-                "method": "rpc.discover"
-            })))
-            .with_status(200)
-            .with_body_from_request(move |req| {
-                let req: PartialRequest = serde_json::from_str(
-                    &req.utf8_lossy_body().expect("Failed to parse request body"),
-                )
-                .expect("Failed to parse PartialRequest");
+    // Mocking TransactionExecutionService RPC endpoints for deeper testing.
+    mock! {
+        pub TransactionExecutionService {}
 
-                json!({
-                    "result": {
-                        "openrpc": "1.2.6",
-                        "info": { "version": "1.58.3" },
-                        "methods": []
-                    },
-                    "jsonrpc": req.jsonrpc,
-                    "id": req.id
-                })
-                .to_string()
-                .into()
-            })
-            .expect(1)
-            .create()
+        #[tonic::async_trait]
+        impl TransactionExecutionService for TransactionExecutionService {
+            async fn execute_transaction(
+                &self,
+                request: tonic::Request<ExecuteTransactionRequest>,
+            ) -> Result<tonic::Response<ExecuteTransactionResponse>, tonic::Status>;
+
+            async fn simulate_transaction(
+                &self,
+                request: tonic::Request<SimulateTransactionRequest>,
+            ) -> Result<tonic::Response<SimulateTransactionResponse>, tonic::Status>;
+        }
     }
 
-    pub fn mock_reference_gas_price(server: &mut ServerGuard, price: String) -> Mock {
-        server
-            .mock("POST", "/")
-            .match_header("content-type", "application/json")
-            .match_body(Matcher::PartialJson(json!({
-                "method": "suix_getReferenceGasPrice"
-            })))
-            .with_status(200)
-            .with_body_from_request(move |req| {
-                let req: PartialRequest = serde_json::from_str(
-                    &req.utf8_lossy_body().expect("Failed to parse request body"),
-                )
-                .expect("Failed to parse PartialRequest");
+    // Mocking SubscriptionService RPC endpoints for deeper testing.
 
-                json!({
-                    "result": price,
-                    "jsonrpc": req.jsonrpc,
-                    "id": req.id
-                })
-                .to_string()
-                .into()
-            })
-            .expect(1)
-            .create()
+    pub type BoxCheckpointStream = std::pin::Pin<
+        Box<
+            dyn futures::Stream<Item = Result<SubscribeCheckpointsResponse, Status>>
+                + Send
+                + 'static,
+        >,
+    >;
+
+    #[tonic::async_trait]
+
+    pub trait SubscriptionServiceWrapper: Send + Sync + 'static {
+        async fn subscribe_checkpoints(
+            &self,
+
+            request: Request<SubscribeCheckpointsRequest>,
+        ) -> Result<Response<BoxCheckpointStream>, Status>;
     }
 
-    pub fn mock_event_api_query_events(
-        server: &mut ServerGuard,
-        events: Vec<(String, NexusEventKind)>,
-    ) -> Mock {
-        server
-            .mock("POST", "/")
-            .match_header("content-type", "application/json")
-            .match_body(Matcher::PartialJson(json!({
-                "method": "suix_queryEvents"
-            })))
-            .with_status(200)
-            .with_body_from_request(move |req| {
-                let req: PartialRequest = serde_json::from_str(
-                    &req.utf8_lossy_body().expect("Failed to parse request body"),
-                )
-                .expect("Failed to parse PartialRequest");
+    pub struct SubscriptionServiceAdapter<W: SubscriptionServiceWrapper> {
+        pub inner: std::sync::Arc<W>,
+    }
 
-                json!({
-                    "result": {
-                        "data": events
-                            .iter()
-                            .map(|(event_name, event)|
-                                sui::Event {
-                                    id: sui_mocks::mock_sui_event_id(),
-                                    package_id: sui::ObjectID::random(),
-                                    parsed_json: serde_json::to_value(event).expect("Failed to serialize event"),
-                                    transaction_module: sui::move_ident_str!("test").into(),
-                                    sender: sui::ObjectID::random().into(),
-                                    type_: sui::MoveStructTag {
-                                        address: sui::ObjectID::random().into(),
-                                        module: primitives::Event::EVENT_WRAPPER.module.into(),
-                                        name: primitives::Event::EVENT_WRAPPER.name.into(),
-                                        type_params: vec![
-                                            sui::MoveTypeTag::Struct(Box::new(sui::MoveStructTag {
-                                                address: sui::ObjectID::random().into(),
-                                                module: sui::move_ident_str!("test").into(),
-                                                name: sui::Identifier::new(event_name.clone()).expect("Failed to parse event name"),
-                                                type_params: vec![],
-                                            })),
-                                        ],
-                                    },
-                                    bcs: sui::BcsEvent::Base64 { bcs: vec![] },
-                                    timestamp_ms: None,
-                                }
-                            )
-                            .collect::<Vec<sui::Event>>(),
-                        "nextCursor": null,
-                        "hasNextPage": false,
+    impl<W: SubscriptionServiceWrapper> SubscriptionServiceAdapter<W> {
+        pub fn new(inner: std::sync::Arc<W>) -> Self {
+            Self { inner }
+        }
+    }
+
+    #[tonic::async_trait]
+    impl<W: SubscriptionServiceWrapper> SubscriptionService for SubscriptionServiceAdapter<W> {
+        type SubscribeCheckpointsStream = BoxCheckpointStream;
+
+        async fn subscribe_checkpoints(
+            &self,
+            request: Request<SubscribeCheckpointsRequest>,
+        ) -> Result<Response<Self::SubscribeCheckpointsStream>, Status> {
+            self.inner.subscribe_checkpoints(request).await
+        }
+    }
+
+    mock! {
+        pub SubscriptionService {}
+
+        #[tonic::async_trait]
+        impl SubscriptionServiceWrapper for SubscriptionService {
+            async fn subscribe_checkpoints(
+                &self,
+                request: tonic::Request<SubscribeCheckpointsRequest>,
+            ) -> Result<tonic::Response<BoxCheckpointStream>, tonic::Status>;
+        }
+    }
+
+    #[derive(Default)]
+    pub struct ServerMocks {
+        pub ledger_service_mock: Option<MockLedgerService>,
+        pub execution_service_mock: Option<MockTransactionExecutionService>,
+        pub subscription_service_mock: Option<MockSubscriptionService>,
+    }
+
+    pub fn mock_server(mocks: ServerMocks) -> String {
+        let port = portpicker::pick_unused_port().expect("No ports free");
+        let addr = format!("127.0.0.1:{}", port);
+        let thread_addr = addr.clone();
+
+        let ledger_service = mocks.ledger_service_mock.map(LedgerServiceServer::new);
+        let execution_service = mocks
+            .execution_service_mock
+            .map(TransactionExecutionServiceServer::new);
+        let subscription_service = mocks.subscription_service_mock.map(|m| {
+            SubscriptionServiceServer::new(SubscriptionServiceAdapter::new(std::sync::Arc::new(m)))
+        });
+
+        tokio::spawn(async move {
+            tonic::transport::Server::builder()
+                .add_optional_service(ledger_service)
+                .add_optional_service(execution_service)
+                .add_optional_service(subscription_service)
+                .serve(thread_addr.parse().unwrap())
+                .await
+                .unwrap();
+        });
+
+        format!("http://{}", addr)
+    }
+
+    pub fn mock_execute_transaction_and_wait_for_checkpoint(
+        tx_service: &mut MockTransactionExecutionService,
+        sub_service: &mut MockSubscriptionService,
+        ledger_service: &mut MockLedgerService,
+        digest: sui::types::Digest,
+        gas_coin_ref: sui::types::ObjectReference,
+        objects: Vec<sui::types::Object>,
+        changed_objects: Vec<sui::types::ChangedObject>,
+        events: Vec<sui::types::Event>,
+    ) {
+        let mut changed_objects_with_coin = vec![sui::types::ChangedObject {
+            object_id: sui::types::Address::from_static("0x1"),
+            input_state: sui::types::ObjectIn::NotExist,
+            output_state: sui::types::ObjectOut::ObjectWrite {
+                digest: *gas_coin_ref.digest(),
+                owner: sui::types::Owner::Address(sui::types::Address::from_static("0x1")),
+            },
+            id_operation: sui::types::IdOperation::None,
+        }];
+
+        changed_objects_with_coin.extend(changed_objects.clone());
+
+        sub_service
+            .expect_subscribe_checkpoints()
+            .times(1)
+            .returning(move |_request| {
+                let mut response = sui::grpc::SubscribeCheckpointsResponse::default();
+                let mut checkpoint = sui::grpc::Checkpoint::default();
+                let mut tx = sui::grpc::ExecutedTransaction::default();
+
+                tx.set_digest(digest);
+                checkpoint.set_transactions(vec![tx]);
+                checkpoint.set_sequence_number(1);
+                response.set_checkpoint(checkpoint);
+
+                let output = vec![Ok(response)];
+                let stream = futures::stream::iter(output);
+
+                Ok(tonic::Response::new(Box::pin(stream) as BoxCheckpointStream))
+            });
+
+        tx_service
+            .expect_execute_transaction()
+            .times(1)
+            .returning(move |_request| {
+                let mut response = sui::grpc::ExecuteTransactionResponse::default();
+                let mut tx = sui::grpc::ExecutedTransaction::default();
+
+                let mut tx_objects = sui::grpc::ObjectSet::default();
+                tx_objects.set_objects(objects.clone().into_iter().map(Into::into).collect());
+                tx.set_objects(tx_objects);
+
+                let mut effects = sui::grpc::TransactionEffects::default();
+                let effect = sui::types::TransactionEffectsV2 {
+                    status: sui::types::ExecutionStatus::Success,
+                    epoch: 1,
+                    gas_used: sui::types::GasCostSummary {
+                        computation_cost: 0,
+                        storage_cost: 0,
+                        storage_rebate: 0,
+                        non_refundable_storage_fee: 0,
                     },
-                    "jsonrpc": req.jsonrpc,
-                    "id": req.id
-                })
-                .to_string()
-                .into()
-            })
-            .create()
+                    transaction_digest: digest,
+                    gas_object_index: Some(0),
+                    events_digest: None,
+                    dependencies: vec![],
+                    lamport_version: 1,
+                    changed_objects: changed_objects_with_coin.clone(),
+                    unchanged_consensus_objects: vec![],
+                    auxiliary_data_digest: None,
+                };
+                effects.set_bcs(
+                    bcs::to_bytes(&sui::types::TransactionEffects::V2(Box::new(effect))).unwrap(),
+                );
+                tx.set_effects(effects);
+
+                let mut tx_events = sui::grpc::TransactionEvents::default();
+                tx_events.set_events(events.clone().into_iter().map(Into::into).collect());
+                tx.set_events(tx_events);
+                tx.set_digest(digest);
+                tx.set_checkpoint(1);
+
+                response.set_transaction(tx);
+
+                Ok(tonic::Response::new(response))
+            });
+
+        mock_get_object_metadata(
+            ledger_service,
+            gas_coin_ref,
+            sui::types::Owner::Immutable,
+            Some(1000),
+        );
     }
 
-    pub fn mock_read_api_get_object(
-        server: &mut ServerGuard,
-        object_id: sui::ObjectID,
-        object: sui::ParsedMoveObject,
-    ) -> Mock {
-        server
-            .mock("POST", "/")
-            .match_header("content-type", "application/json")
-            .match_body(Matcher::PartialJson(json!({
-                "method": "sui_getObject"
-            })))
-            .with_status(200)
-            .with_body_from_request(move |req| {
-                let req: PartialRequest = serde_json::from_str(
-                    &req.utf8_lossy_body().expect("Failed to parse request body"),
-                )
-                .expect("Failed to parse PartialRequest");
+    pub fn mock_reference_gas_price(
+        ledger_service: &mut MockLedgerService,
+        reference_gas_price: u64,
+    ) {
+        ledger_service
+            .expect_get_epoch()
+            .times(1)
+            .returning(move |_request| {
+                let mut response = sui::grpc::GetEpochResponse::default();
+                let mut epoch = sui::grpc::Epoch::default();
+                epoch.set_reference_gas_price(reference_gas_price);
+                response.set_epoch(epoch);
+                Ok(tonic::Response::new(response))
+            });
+    }
 
-                json!({
-                    "result": sui::ObjectResponse::new_with_data(
-                        sui::ObjectData {
-                            object_id,
-                            version: sui::SequenceNumber::from_u64(1),
-                            digest: sui::ObjectDigest::random(),
-                            type_: None,
-                            owner: Some(sui::Owner::AddressOwner(sui::ObjectID::random().into())),
-                            previous_transaction: None,
-                            storage_rebate: None,
-                            display: None,
-                            content: Some(sui::ParsedData::MoveObject(object.clone())),
-                            bcs: None,
-                        }
-                    ),
-                    "jsonrpc": req.jsonrpc,
-                    "id": req.id
-                })
-                .to_string()
-                .into()
-            })
-            .create()
+    pub fn mock_get_object_metadata(
+        ledger_service: &mut MockLedgerService,
+        object_ref: sui::types::ObjectReference,
+        owner: sui::types::Owner,
+        balance: Option<u64>,
+    ) {
+        ledger_service
+            .expect_get_object()
+            .times(1)
+            .returning(move |_request| {
+                let mut response = sui::grpc::GetObjectResponse::default();
+                let mut grpc_object = sui::grpc::Object::default();
+                grpc_object.set_owner(sui::grpc::Owner::from(owner));
+                grpc_object.set_digest(*object_ref.digest());
+                grpc_object.set_version(object_ref.version());
+                grpc_object.set_balance(balance.unwrap_or(0));
+                response.set_object(grpc_object);
+                Ok(tonic::Response::new(response))
+            });
+    }
+
+    pub fn mock_get_objects_metadata(
+        ledger_service: &mut MockLedgerService,
+        objects: Vec<(sui::types::ObjectReference, sui::types::Owner, Option<u64>)>,
+    ) {
+        ledger_service
+            .expect_batch_get_objects()
+            .times(1)
+            .returning(move |_request| {
+                let mut response = sui::grpc::BatchGetObjectsResponse::default();
+                let mut objs = Vec::with_capacity(objects.len());
+                for (object_ref, owner, balance) in objects.clone() {
+                    let mut parent_object = sui::grpc::GetObjectResult::default();
+                    let mut grpc_object = sui::grpc::Object::default();
+                    grpc_object.set_owner(sui::grpc::Owner::from(owner));
+                    grpc_object.set_digest(*object_ref.digest());
+                    grpc_object.set_object_id(*object_ref.object_id());
+                    grpc_object.set_version(object_ref.version());
+                    grpc_object.set_balance(balance.unwrap_or(0));
+                    parent_object.set_object(grpc_object);
+                    objs.push(parent_object);
+                }
+                response.set_objects(objs);
+                Ok(tonic::Response::new(response))
+            });
+    }
+
+    /// Expect a `get_object` call and return an object populated with metadata
+    /// and a JSON payload (converted into `prost_types::Value`).
+    pub fn mock_get_object_json(
+        ledger_service: &mut MockLedgerService,
+        object_ref: sui::types::ObjectReference,
+        owner: sui::types::Owner,
+        json_value: serde_json::Value,
+    ) {
+        ledger_service
+            .expect_get_object()
+            .times(1)
+            .returning(move |_request| {
+                let mut response = sui::grpc::GetObjectResponse::default();
+                let mut grpc_object = sui::grpc::Object::default();
+                grpc_object.set_owner(sui::grpc::Owner::from(owner.clone()));
+                grpc_object.set_digest(*object_ref.digest());
+                grpc_object.set_version(object_ref.version());
+                grpc_object.set_object_id(object_ref.object_id().to_string());
+                grpc_object.json = Some(Box::new(json_to_prost_value(&json_value)));
+                response.set_object(grpc_object);
+                Ok(tonic::Response::new(response))
+            });
+    }
+
+    /// Expect a `get_epoch` call and return the end timestamp.
+    pub fn mock_get_epoch_end(ledger_service: &mut MockLedgerService, epoch_end: SystemTime) {
+        ledger_service
+            .expect_get_epoch()
+            .times(1)
+            .returning(move |_request| {
+                let mut response = sui::grpc::GetEpochResponse::default();
+                let mut epoch = sui::grpc::Epoch::default();
+                epoch.set_end(epoch_end);
+                response.set_epoch(epoch);
+                Ok(tonic::Response::new(response))
+            });
     }
 
-    pub fn mock_governance_api_execute_execute_transaction_block(
+    fn json_to_prost_value(value: &serde_json::Value) -> prost_types::Value {
+        use prost_types::value::Kind;
+
+        let kind = match value {
+            serde_json::Value::Null => Kind::NullValue(0),
+            serde_json::Value::Bool(b) => Kind::BoolValue(*b),
+            serde_json::Value::Number(n) => Kind::NumberValue(n.as_f64().unwrap_or_default()),
+            serde_json::Value::String(s) => Kind::StringValue(s.clone()),
+            serde_json::Value::Array(arr) => Kind::ListValue(prost_types::ListValue {
+                values: arr.iter().map(json_to_prost_value).collect(),
+            }),
+            serde_json::Value::Object(map) => Kind::StructValue(prost_types::Struct {
+                fields: map
+                    .iter()
+                    .map(|(k, v)| (k.clone(), json_to_prost_value(v)))
+                    .collect(),
+            }),
+        };
+
+        prost_types::Value { kind: Some(kind) }
+    }
+}
+
+/// Mocking GQL endpoints for deeper testing.
+pub mod gql {
+    use {
+        crate::{events::NexusEventKind, sui},
+        mockito::{Mock, ServerGuard},
+        serde_json::json,
+    };
+
+    pub fn mock_event_query(
         server: &mut ServerGuard,
-        digest: sui::TransactionDigest,
-        effects: Option<sui::TransactionBlockEffects>,
-        events: Option<sui::TransactionBlockEvents>,
-        balance_changes: Option<Vec<sui::BalanceChange>>,
-        object_changes: Option<Vec<sui::ObjectChange>>,
-    ) -> (Mock, Mock) {
-        let effects_execute = effects.or(Some(sui_mocks::mock_sui_transaction_block_effects(
-            None, None, None, None,
-        )));
-        let effects_confirm = effects_execute.clone();
-        let events_confirm = events.clone();
-        let object_changes_confirm = object_changes.clone();
-        let balance_changes_confirm = balance_changes.clone();
-
-        let execute_mock = server
-            .mock("POST", "/")
-            .match_header("content-type", "application/json")
-            .match_body(Matcher::PartialJson(json!({
-                "method": "sui_executeTransactionBlock"
-            })))
-            .with_status(200)
-            .with_body_from_request(move |req| {
-                let req: PartialRequest = serde_json::from_str(
-                    &req.utf8_lossy_body().expect("Failed to parse request body"),
-                )
-                .expect("Failed to parse PartialRequest");
+        primitives_pkg_id: sui::types::Address,
+        events: Vec<NexusEventKind>,
+        digest: Option<sui::types::Digest>,
+        end_cursor: Option<&str>,
+    ) -> Mock {
+        let mut rng = rand::thread_rng();
 
+        let mock_events = events
+            .iter()
+            .enumerate()
+            .map(|(id, event)| {
                 json!({
-                    "result": sui::TransactionBlockResponse {
-                        digest,
-                        transaction: None,
-                        raw_transaction: vec![],
-                        effects: effects_execute.clone(),
-                        events: events.clone(),
-                        object_changes: object_changes.clone(),
-                        balance_changes: balance_changes.clone(),
-                        timestamp_ms: None,
-                        confirmed_local_execution: Some(true),
-                        checkpoint: None,
-                        errors: vec![],
-                        raw_effects: vec![],
+                    "sequenceNumber": id,
+                    "transaction": {
+                        "digest": digest.unwrap_or_else(|| sui::types::Digest::generate(&mut rng)),
                     },
-                    "jsonrpc": req.jsonrpc,
-                    "id": req.id
+                    "transactionModule": {
+                        "package": {
+                            "address": primitives_pkg_id,
+                        }
+                    },
+                    "contents": {
+                        "json": serde_json::to_value(event).unwrap(),
+                        "type": {
+                            "repr": sui::types::StructTag::new(
+                                primitives_pkg_id,
+                                sui::types::Identifier::from_static("event"),
+                                sui::types::Identifier::from_static("EventWrapper"),
+                                vec![
+                                    sui::types::TypeTag::Struct(
+                                        Box::new(sui::types::StructTag::new(
+                                            primitives_pkg_id,
+                                            sui::types::Identifier::from_static("test"),
+                                            event.name().parse().unwrap(),
+                                            vec![],
+                                        )),
+                                    ),
+                                ],
+                            )
+                        }
+                    }
                 })
-                .to_string()
-                .into()
             })
-            .expect(1)
-            .create();
-
-        let confirm_mock = server
-            .mock("POST", "/")
-            .match_header("content-type", "application/json")
-            .match_body(Matcher::PartialJson(json!({
-                "method": "sui_getTransactionBlock"
-            })))
-            .with_status(200)
-            .with_body_from_request(move |req| {
-                let req: PartialRequest = serde_json::from_str(
-                    &req.utf8_lossy_body().expect("Failed to parse request body"),
-                )
-                .expect("Failed to parse PartialRequest");
+            .collect::<Vec<serde_json::Value>>();
 
+        server
+            .mock("POST", "/graphql")
+            .with_status(200)
+            .with_body(
                 json!({
-                    "result": sui::TransactionBlockResponse {
-                        digest,
-                        transaction: None,
-                        raw_transaction: vec![],
-                        effects: effects_confirm.clone(),
-                        events: events_confirm.clone(),
-                        object_changes: object_changes_confirm.clone(),
-                        balance_changes: balance_changes_confirm.clone(),
-                        timestamp_ms: None,
-                        confirmed_local_execution: Some(true),
-                        checkpoint: None,
-                        errors: vec![],
-                        raw_effects: vec![],
+                    "data": {
+                        "events": {
+                            "nodes": mock_events,
+                            "pageInfo": {
+                                "endCursor": end_cursor.unwrap_or("12345"),
+                            }
+                        },
                     },
-                    "jsonrpc": req.jsonrpc,
-                    "id": req.id
                 })
-                .to_string()
-                .into()
-            })
+                .to_string(),
+            )
             .expect(1)
-            .create();
-
-        (execute_mock, confirm_mock)
+            .create()
     }
 }
diff --git a/sdk/src/test_utils/wallet.rs b/sdk/src/test_utils/wallet.rs
deleted file mode 100644
index 276dee1c..00000000
--- a/sdk/src/test_utils/wallet.rs
+++ /dev/null
@@ -1,103 +0,0 @@
-//! Test utils for wallet management. Create and import mnemonics.
-
-use crate::{sui, sui::traits::AccountKeystore};
-
-/// Create an ephemeral wallet context that can be loaded.
-pub fn create_ephemeral_wallet_context(
-    sui_port: u16,
-) -> anyhow::Result<(sui::WalletContext, String)> {
-    let derivation_path = None;
-    let word_length = None;
-
-    let (addr, _, _, sui_secret_mnemonic) =
-        sui::generate_new_key(sui::SignatureScheme::ED25519, derivation_path, word_length)
-            .expect("Failed to generate key.");
-
-    let config = format!(
-        "\
-keystore:
-  InMem:
-    aliases: {}
-    keys: {}
-envs:
-  - alias: test
-    rpc: http://127.0.0.1:{sui_port}
-    ws: ~
-    basic_auth: ~
-active_env: test
-active_address: \"{addr}\"",
-        "{}", "{}"
-    );
-
-    // Create sui config in tmp and load it.
-    let dir = tempfile::tempdir().map_err(|e| anyhow::anyhow!(e))?;
-    let path = dir.path().join("config.yaml");
-
-    std::fs::write(&path, config).map_err(|e| anyhow::anyhow!(e))?;
-
-    let request_timeout = None;
-    let max_concurrent_requests = None;
-
-    let mut context = sui::WalletContext::new(&path, request_timeout, max_concurrent_requests)?;
-
-    let derivation_path = None;
-    let alias = None;
-
-    context.config.keystore.import_from_mnemonic(
-        sui_secret_mnemonic.as_str(),
-        sui::SignatureScheme::ED25519,
-        derivation_path,
-        alias,
-    )?;
-
-    Ok((context, sui_secret_mnemonic))
-}
-
-/// Create an ephemeral wallet context that can be loaded.
-pub fn create_ephemeral_wallet_context_testnet() -> anyhow::Result<(sui::WalletContext, String)> {
-    let derivation_path = None;
-    let word_length = None;
-
-    let (addr, _, _, sui_secret_mnemonic) =
-        sui::generate_new_key(sui::SignatureScheme::ED25519, derivation_path, word_length)
-            .expect("Failed to generate key.");
-
-    let config = format!(
-        "\
-keystore:
-  InMem:
-    aliases: {}
-    keys: {}
-envs:
-  - alias: test
-    rpc: https://fullnode.testnet.sui.io:443
-    ws: ~
-    basic_auth: ~
-active_env: test
-active_address: \"{addr}\"",
-        "{}", "{}"
-    );
-
-    // Create sui config in tmp and load it.
-    let dir = tempfile::tempdir().map_err(|e| anyhow::anyhow!(e))?;
-    let path = dir.path().join("config.yaml");
-
-    std::fs::write(&path, config).map_err(|e| anyhow::anyhow!(e))?;
-
-    let request_timeout = None;
-    let max_concurrent_requests = None;
-
-    let mut context = sui::WalletContext::new(&path, request_timeout, max_concurrent_requests)?;
-
-    let derivation_path = None;
-    let alias = None;
-
-    context.config.keystore.import_from_mnemonic(
-        sui_secret_mnemonic.as_str(),
-        sui::SignatureScheme::ED25519,
-        derivation_path,
-        alias,
-    )?;
-
-    Ok((context, sui_secret_mnemonic))
-}
diff --git a/sdk/src/tool_fqn.rs b/sdk/src/tool_fqn.rs
index 2f981f3a..f4e9691a 100644
--- a/sdk/src/tool_fqn.rs
+++ b/sdk/src/tool_fqn.rs
@@ -233,7 +233,7 @@ mod tests {
         let version_too_large: u64 = u32::MAX as u64 + 1;
 
         let version_too_large =
-            format!("xyz.taluslabs.example@{}", version_too_large).parse::<ToolFqn>();
+            format!("xyz.taluslabs.example@{version_too_large}").parse::<ToolFqn>();
 
         assert_matches!(version_too_large, Err(e) if e.to_string().contains("Tool version too large"));
     }
diff --git a/sdk/src/tool_ref.rs b/sdk/src/tool_ref.rs
new file mode 100644
index 00000000..4460d0ca
--- /dev/null
+++ b/sdk/src/tool_ref.rs
@@ -0,0 +1,415 @@
+//! This module provides a reference abstraction for both onchain and
+//! offchain tools.
+
+use {
+    crate::sui,
+    serde::{Deserialize, Serialize},
+    std::str::FromStr,
+};
+
+/// Represents the reference of a tool, either as an HTTP URL for offchain tools
+/// or as a Sui module identifier for onchain tools.
+///
+/// # String Representations
+///
+/// - Offchain: `https://example.com/my-tool`
+/// - Onchain: `0xabc123::my_module@0xwitness` (address::module@witness format)
+///
+/// # Examples
+///
+/// ```
+/// // Parse an offchain tool reference.
+/// let offchain: ToolRef = "https://example.com/my-tool".parse().unwrap();
+/// assert!(offchain.is_offchain());
+///
+/// // Parse an onchain tool reference.
+/// let onchain: ToolRef = "0x1234::my_module@0x5678".parse().unwrap();
+/// assert!(onchain.is_onchain());
+/// ```
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum ToolRef {
+    /// HTTP(S) endpoint for offchain tools.
+    Http(reqwest::Url),
+    /// Sui module for onchain tools (package::module@witness format).
+    Sui {
+        /// The package address containing the tool module.
+        package: sui::types::Address,
+        /// The module name within the package.
+        module: sui::types::Identifier,
+        /// The witness ID for the onchain tool.
+        witness_id: sui::types::Address,
+    },
+}
+
+impl ToolRef {
+    /// Creates a new offchain tool reference from a URL.
+    pub fn new_http(url: reqwest::Url) -> Self {
+        Self::Http(url)
+    }
+
+    /// Creates a new onchain tool reference from package address, module name, and witness ID.
+    pub fn new_sui(package: &str, module: &str, witness_id: &str) -> Result<Self, anyhow::Error> {
+        let package = package.parse()?;
+        let module = sui::types::Identifier::new(module)?;
+        let witness_id = witness_id.parse()?;
+        Ok(Self::Sui {
+            package,
+            module,
+            witness_id,
+        })
+    }
+
+    /// Returns true if this is an offchain (HTTP) tool reference.
+    pub fn is_offchain(&self) -> bool {
+        matches!(self, Self::Http(_))
+    }
+
+    /// Returns true if this is an onchain (Sui) tool reference.
+    pub fn is_onchain(&self) -> bool {
+        matches!(self, Self::Sui { .. })
+    }
+
+    /// Returns the URL if this is an offchain tool reference.
+    pub fn url(&self) -> Result<&reqwest::Url, anyhow::Error> {
+        match self {
+            Self::Http(url) => Ok(url),
+            Self::Sui { .. } => anyhow::bail!("URL is not available for onchain tools"),
+        }
+    }
+
+    /// Returns the package address if this is an onchain tool reference.
+    pub fn package_address(&self) -> Result<sui::types::Address, anyhow::Error> {
+        match self {
+            Self::Http(_) => anyhow::bail!("Package address is not available for offchain tools"),
+            Self::Sui { package, .. } => Ok(*package),
+        }
+    }
+
+    /// Returns the module name if this is an onchain tool reference.
+    pub fn module_name(&self) -> Result<&sui::types::Identifier, anyhow::Error> {
+        match self {
+            Self::Http(_) => anyhow::bail!("Module name is not available for offchain tools"),
+            Self::Sui { module, .. } => Ok(module),
+        }
+    }
+
+    /// Returns the witness ID if this is an onchain tool reference.
+    pub fn witness_id(&self) -> Result<sui::types::Address, anyhow::Error> {
+        match self {
+            Self::Http(_) => anyhow::bail!("Witness ID is not available for offchain tools"),
+            Self::Sui { witness_id, .. } => Ok(*witness_id),
+        }
+    }
+}
+
+impl FromStr for ToolRef {
+    type Err = anyhow::Error;
+
+    /// Parses a string into a ToolRef.
+    ///
+    /// The format is auto-detected:
+    /// - If it starts with `http://` or `https://`, it's parsed as an HTTP URL.
+    /// - Otherwise, it's parsed as a Sui module ID (`package_address::module_name@witness_id`).
+    fn from_str(s: &str) -> Result<Self, Self::Err> {
+        // Check if it looks like an HTTP URL.
+        if s.starts_with("http://") || s.starts_with("https://") {
+            let url = reqwest::Url::parse(s)?;
+            return Ok(Self::Http(url));
+        }
+
+        // Otherwise, try to parse as a Sui module ID (address::module@witness).
+        let parts: Vec<&str> = s.splitn(2, "::").collect();
+        if parts.len() != 2 {
+            anyhow::bail!(
+                "Invalid tool reference format: expected 'address::module@witness', got '{s}'"
+            );
+        }
+
+        let package = sui::types::Address::from_str(parts[0])
+            .map_err(|e| anyhow::anyhow!("Invalid package address: {e}"))?;
+
+        // Split the module part to extract module name and witness ID.
+        let module_witness: Vec<&str> = parts[1].splitn(2, '@').collect();
+        if module_witness.len() != 2 {
+            anyhow::bail!(
+                "Invalid tool reference format: expected 'address::module@witness', got '{s}'"
+            );
+        }
+
+        let module = sui::types::Identifier::from_str(module_witness[0])
+            .map_err(|e| anyhow::anyhow!("Invalid module identifier: {e}"))?;
+        let witness_id = sui::types::Address::from_str(module_witness[1])
+            .map_err(|e| anyhow::anyhow!("Invalid witness ID: {e}"))?;
+
+        Ok(Self::Sui {
+            package,
+            module,
+            witness_id,
+        })
+    }
+}
+
+impl std::fmt::Display for ToolRef {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Self::Http(url) => write!(f, "{}", url),
+            Self::Sui {
+                package,
+                module,
+                witness_id,
+            } => write!(f, "{}::{}@{}", package, module, witness_id),
+        }
+    }
+}
+
+impl Serialize for ToolRef {
+    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
+    where
+        S: serde::Serializer,
+    {
+        self.to_string().serialize(serializer)
+    }
+}
+
+impl<'de> Deserialize<'de> for ToolRef {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: serde::Deserializer<'de>,
+    {
+        let value = String::deserialize(deserializer)?;
+        let reference = value.parse::<ToolRef>().map_err(serde::de::Error::custom)?;
+
+        Ok(reference)
+    }
+}
+
+/// Conversion from reqwest::Url to ToolRef.
+impl From<reqwest::Url> for ToolRef {
+    fn from(url: reqwest::Url) -> Self {
+        Self::Http(url)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use {super::*, assert_matches::assert_matches};
+
+    #[test]
+    fn test_parse_http_url() {
+        let reference: ToolRef = "https://example.com/my-tool".parse().unwrap();
+
+        assert!(reference.is_offchain());
+        assert!(!reference.is_onchain());
+        assert_eq!(
+            reference.url().unwrap().as_str(),
+            "https://example.com/my-tool"
+        );
+        assert!(reference.package_address().is_err());
+        assert!(reference.module_name().is_err());
+        assert!(reference.witness_id().is_err());
+    }
+
+    #[test]
+    fn test_parse_http_url_with_port() {
+        let reference: ToolRef = "http://localhost:8080/tool".parse().unwrap();
+
+        assert!(reference.is_offchain());
+        assert_eq!(
+            reference.url().unwrap().as_str(),
+            "http://localhost:8080/tool"
+        );
+    }
+
+    #[test]
+    fn test_parse_sui_module_id() {
+        let reference: ToolRef =
+            "0x0000000000000000000000000000000000000000000000000000000000001234::my_module@0x0000000000000000000000000000000000000000000000000000000000005678"
+                .parse()
+                .unwrap();
+
+        assert!(reference.is_onchain());
+        assert!(!reference.is_offchain());
+        assert!(reference.url().is_err());
+        assert!(reference.package_address().is_ok());
+        assert_eq!(
+            reference.module_name().unwrap(),
+            &sui::types::Identifier::from_static("my_module")
+        );
+        assert_eq!(
+            reference.witness_id().unwrap().to_string(),
+            "0x0000000000000000000000000000000000000000000000000000000000005678"
+        );
+    }
+
+    #[test]
+    fn test_parse_short_sui_address() {
+        // Short addresses are expanded by the Sui SDK.
+        let reference: ToolRef = "0x1::module@0x2".parse().unwrap();
+
+        assert!(reference.is_onchain());
+        assert_eq!(
+            reference.module_name().unwrap(),
+            &sui::types::Identifier::from_static("module")
+        );
+        assert!(reference.witness_id().is_ok());
+    }
+
+    #[test]
+    fn test_display_http() {
+        let reference = ToolRef::Http("https://example.com/tool".parse().unwrap());
+
+        assert_eq!(reference.to_string(), "https://example.com/tool");
+    }
+
+    #[test]
+    fn test_display_sui() {
+        let package = sui::types::Address::from_str(
+            "0x0000000000000000000000000000000000000000000000000000000000001234",
+        )
+        .unwrap();
+        let witness_id = sui::types::Address::from_str(
+            "0x0000000000000000000000000000000000000000000000000000000000005678",
+        )
+        .unwrap();
+        let reference = ToolRef::Sui {
+            package,
+            module: sui::types::Identifier::from_static("my_module"),
+            witness_id,
+        };
+
+        assert_eq!(
+            reference.to_string(),
+            "0x0000000000000000000000000000000000000000000000000000000000001234::my_module@0x0000000000000000000000000000000000000000000000000000000000005678"
+        );
+    }
+
+    #[test]
+    fn test_serialize_deserialize_http() {
+        let reference = ToolRef::Http("https://example.com/tool".parse().unwrap());
+
+        let serialized = serde_json::to_string(&reference).unwrap();
+        assert_eq!(serialized, "\"https://example.com/tool\"");
+
+        let deserialized: ToolRef = serde_json::from_str(&serialized).unwrap();
+        assert_eq!(reference, deserialized);
+    }
+
+    #[test]
+    fn test_serialize_deserialize_sui() {
+        let package = sui::types::Address::from_str(
+            "0x0000000000000000000000000000000000000000000000000000000000001234",
+        )
+        .unwrap();
+        let witness_id = sui::types::Address::from_str(
+            "0x0000000000000000000000000000000000000000000000000000000000005678",
+        )
+        .unwrap();
+        let reference = ToolRef::Sui {
+            package,
+            module: sui::types::Identifier::from_static("my_module"),
+            witness_id,
+        };
+
+        let serialized = serde_json::to_string(&reference).unwrap();
+        let deserialized: ToolRef = serde_json::from_str(&serialized).unwrap();
+        assert_eq!(reference, deserialized);
+    }
+
+    #[test]
+    fn test_invalid_reference() {
+        let result = "not_a_valid_reference".parse::<ToolRef>();
+
+        assert_matches!(result, Err(e) if e.to_string().contains("Invalid tool reference format"));
+    }
+
+    #[test]
+    fn test_from_url() {
+        let url: reqwest::Url = "https://example.com/tool".parse().unwrap();
+        let reference = ToolRef::from(url.clone());
+
+        assert!(reference.is_offchain());
+        assert_eq!(reference.url().unwrap(), &url);
+    }
+
+    #[test]
+    fn test_new_constructors() {
+        let http_reference = ToolRef::new_http("https://example.com/tool".parse().unwrap());
+        assert!(http_reference.is_offchain());
+
+        let sui_reference = ToolRef::new_sui(
+            "0x0000000000000000000000000000000000000000000000000000000000001234",
+            "my_module",
+            "0x0000000000000000000000000000000000000000000000000000000000005678",
+        )
+        .unwrap();
+        assert!(sui_reference.is_onchain());
+        assert_eq!(
+            sui_reference.module_name().unwrap(),
+            &sui::types::Identifier::from_static("my_module")
+        );
+        assert!(sui_reference.witness_id().is_ok());
+    }
+
+    #[test]
+    fn test_new_sui_success() {
+        let reference = ToolRef::new_sui(
+            "0x0000000000000000000000000000000000000000000000000000000000001234",
+            "my_module",
+            "0x0000000000000000000000000000000000000000000000000000000000005678",
+        )
+        .unwrap();
+
+        assert!(reference.is_onchain());
+        assert_eq!(
+            reference.package_address().unwrap().to_string(),
+            "0x0000000000000000000000000000000000000000000000000000000000001234"
+        );
+        assert_eq!(
+            reference.module_name().unwrap(),
+            &sui::types::Identifier::from_static("my_module")
+        );
+        assert_eq!(
+            reference.witness_id().unwrap().to_string(),
+            "0x0000000000000000000000000000000000000000000000000000000000005678"
+        );
+    }
+
+    #[test]
+    fn test_new_sui_invalid_address() {
+        let result = ToolRef::new_sui(
+            "invalid_address",
+            "my_module",
+            "0x0000000000000000000000000000000000000000000000000000000000005678",
+        );
+        assert!(result.is_err());
+    }
+
+    #[test]
+    fn test_new_sui_invalid_module() {
+        let result = ToolRef::new_sui(
+            "0x0000000000000000000000000000000000000000000000000000000000001234",
+            "invalid-module-name",
+            "0x0000000000000000000000000000000000000000000000000000000000005678",
+        );
+        assert!(result.is_err());
+    }
+
+    #[test]
+    fn test_new_sui_invalid_witness() {
+        let result = ToolRef::new_sui(
+            "0x0000000000000000000000000000000000000000000000000000000000001234",
+            "my_module",
+            "invalid_witness",
+        );
+        assert!(result.is_err());
+    }
+
+    #[test]
+    fn test_parse_sui_missing_witness() {
+        // Should fail because witness_id is missing.
+        let result =
+            "0x0000000000000000000000000000000000000000000000000000000000001234::my_module"
+                .parse::<ToolRef>();
+        assert_matches!(result, Err(e) if e.to_string().contains("Invalid tool reference format"));
+    }
+}
diff --git a/sdk/src/transactions/crypto.rs b/sdk/src/transactions/crypto.rs
index 3e9af5ea..a7fab3e1 100644
--- a/sdk/src/transactions/crypto.rs
+++ b/sdk/src/transactions/crypto.rs
@@ -1,128 +1,194 @@
 use crate::{
     crypto::x3dh::{InitialMessage, PreKeyBundle},
-    idents::{move_std, workflow},
+    idents::{pure_arg, sui_framework, workflow},
     sui,
     types::NexusObjects,
 };
 
-/// PTB template to replenish public pre_keys in the pre_key vault.
-pub fn replenish_pre_keys(
-    tx: &mut sui::ProgrammableTransactionBuilder,
+/// PTB to claim a pre_key for the tx sender. Note that one must have uploaded
+/// gas budget before calling this function for rate limiting purposes. Also
+/// rate limited per address.
+pub fn claim_pre_key_for_self(
+    tx: &mut sui::tx::TransactionBuilder,
     objects: &NexusObjects,
-    owner_cap: &sui::ObjectRef,
-    pre_keys: &Vec<PreKeyBundle>,
-) -> anyhow::Result<sui::Argument> {
+) -> anyhow::Result<sui::types::Argument> {
     // `self: &mut PreKeyVault`
-    let pre_key_vault = tx.obj(sui::ObjectArg::SharedObject {
-        id: objects.pre_key_vault.object_id,
-        initial_shared_version: objects.pre_key_vault.version,
-        mutable: true,
-    })?;
+    let pre_key_vault = tx.input(sui::tx::Input::shared(
+        *objects.pre_key_vault.object_id(),
+        objects.pre_key_vault.version(),
+        true,
+    ));
 
-    // `owner_cap: &CloneableOwnerCap<OverCrypto>`
-    let owner_cap = tx.obj(sui::ObjectArg::ImmOrOwnedObject(owner_cap.to_object_ref()))?;
-
-    // `PreKey`
-    let pre_key_type =
-        workflow::into_type_tag(objects.workflow_pkg_id, workflow::PreKeyVault::PRE_KEY);
-
-    // `vector::<PreKey>::empty`
-    let pre_key_vector = tx.programmable_move_call(
-        sui::MOVE_STDLIB_PACKAGE_ID,
-        move_std::Vector::EMPTY.module.into(),
-        move_std::Vector::EMPTY.name.into(),
-        vec![pre_key_type.clone()],
-        vec![],
-    );
+    // `gas_service: &GasService`
+    let gas_service = tx.input(sui::tx::Input::shared(
+        *objects.gas_service.object_id(),
+        objects.gas_service.version(),
+        false,
+    ));
 
-    for pre_key in pre_keys {
-        // `bytes: vector<u8>`
-        let pre_key_bytes = tx.pure(bincode::serialize(pre_key)?)?;
+    // `clock: &Clock`
+    let clock = tx.input(sui::tx::Input::shared(
+        sui_framework::CLOCK_OBJECT_ID,
+        1,
+        false,
+    ));
 
-        // `pre_key: PreKey`
-        let new_pre_key = tx.programmable_move_call(
+    // `nexus_workflow::pre_key_vault::claim_pre_key_for_self`
+    Ok(tx.move_call(
+        sui::tx::Function::new(
             objects.workflow_pkg_id,
-            workflow::PreKeyVault::PRE_KEY_FROM_BYTES.module.into(),
-            workflow::PreKeyVault::PRE_KEY_FROM_BYTES.name.into(),
+            workflow::PreKeyVault::CLAIM_PRE_KEY_FOR_SELF.module,
+            workflow::PreKeyVault::CLAIM_PRE_KEY_FOR_SELF.name,
             vec![],
-            vec![pre_key_bytes],
-        );
-
-        // `vector::<PreKey>::push_back`
-        tx.programmable_move_call(
-            sui::MOVE_STDLIB_PACKAGE_ID,
-            move_std::Vector::PUSH_BACK.module.into(),
-            move_std::Vector::PUSH_BACK.name.into(),
-            vec![pre_key_type.clone()],
-            vec![pre_key_vector, new_pre_key],
-        );
-    }
-
-    // `nexus_workflow::pre_key_vault::replenish_pre_keys`
-    Ok(tx.programmable_move_call(
-        objects.workflow_pkg_id,
-        workflow::PreKeyVault::REPLENISH_PRE_KEYS.module.into(),
-        workflow::PreKeyVault::REPLENISH_PRE_KEYS.name.into(),
-        vec![],
-        vec![pre_key_vault, owner_cap, pre_key_vector],
+        ),
+        vec![pre_key_vault, gas_service, clock],
     ))
 }
 
-/// PTB to claim a pre_key for the tx sender. Note that one must have uploaded
-/// gas budget before calling this function for rate limiting purposes. Also
-/// rate limited per address.
-pub fn claim_pre_key_for_self(
-    tx: &mut sui::ProgrammableTransactionBuilder,
+/// PTB to fulfill a user's pending pre_key request with the provided bundle.
+pub fn fulfill_pre_key_for_user(
+    tx: &mut sui::tx::TransactionBuilder,
     objects: &NexusObjects,
-) -> anyhow::Result<sui::Argument> {
+    crypto_cap: &sui::types::ObjectReference,
+    requested_by: sui::types::Address,
+    pre_key: &PreKeyBundle,
+) -> anyhow::Result<sui::types::Argument> {
     // `self: &mut PreKeyVault`
-    let pre_key_vault = tx.obj(sui::ObjectArg::SharedObject {
-        id: objects.pre_key_vault.object_id,
-        initial_shared_version: objects.pre_key_vault.version,
-        mutable: true,
-    })?;
+    let pre_key_vault = tx.input(sui::tx::Input::shared(
+        *objects.pre_key_vault.object_id(),
+        objects.pre_key_vault.version(),
+        true,
+    ));
 
-    // `gas_service: &GasService`
-    let gas_service = tx.obj(sui::ObjectArg::SharedObject {
-        id: objects.gas_service.object_id,
-        initial_shared_version: objects.gas_service.version,
-        mutable: false,
-    })?;
+    // `owner_cap: &CloneableOwnerCap<OverCrypto>`
+    let crypto_cap = tx.input(sui::tx::Input::shared(
+        *crypto_cap.object_id(),
+        crypto_cap.version(),
+        false,
+    ));
 
-    // `clock: &Clock`
-    let clock = tx.obj(sui::CLOCK_OBJ_ARG)?;
+    // `requested_by: address`
+    let requested_by = sui_framework::Address::address_from_type(tx, requested_by)?;
 
-    // `nexus_workflow::pre_key_vault::claim_pre_key_for_self`
-    Ok(tx.programmable_move_call(
-        objects.workflow_pkg_id,
-        workflow::PreKeyVault::CLAIM_PRE_KEY_FOR_SELF.module.into(),
-        workflow::PreKeyVault::CLAIM_PRE_KEY_FOR_SELF.name.into(),
-        vec![],
-        vec![pre_key_vault, gas_service, clock],
+    // `pre_key_bytes: vector<u8>`
+    let pre_key_bytes = tx.input(pure_arg(&bincode::serialize(pre_key)?)?);
+
+    // `nexus_workflow::pre_key_vault::fulfill_pre_key_for_user`
+    Ok(tx.move_call(
+        sui::tx::Function::new(
+            objects.workflow_pkg_id,
+            workflow::PreKeyVault::FULFILL_PRE_KEY_FOR_USER.module,
+            workflow::PreKeyVault::FULFILL_PRE_KEY_FOR_USER.name,
+            vec![],
+        ),
+        vec![pre_key_vault, crypto_cap, requested_by, pre_key_bytes],
     ))
 }
 
+/// PTB template to claim gas from the requester and fulfill a requested pre key.
+// This PTB template maps directly to the underlying Move call parameters, so keep
+// the argument list and silence the clippy lint.
+#[allow(clippy::too_many_arguments)]
+pub fn claim_and_fulfill_pre_key_for_user(
+    tx: &mut sui::tx::TransactionBuilder,
+    objects: &NexusObjects,
+    crypto_cap: &sui::types::ObjectReference,
+    leader_cap: &sui::types::ObjectReference,
+    leader_address: sui::types::Address,
+    requested_by: sui::types::Address,
+    pre_key: &PreKeyBundle,
+    mist_gas_budget_to_claim: u64,
+) -> anyhow::Result<sui::types::Argument> {
+    // `gas_service: &mut GasService`
+    let gas_service = tx.input(sui::tx::Input::shared(
+        *objects.gas_service.object_id(),
+        objects.gas_service.version(),
+        true,
+    ));
+
+    // `amount: u64`
+    let amount = tx.input(pure_arg(&mist_gas_budget_to_claim)?);
+
+    // `requested_by: address`
+    let requested_by_arg = sui_framework::Address::address_from_type(tx, requested_by)?;
+
+    // `leader_cap: &CloneableOwnerCap<OverNetwork>`
+    let leader_cap_obj = tx.input(sui::tx::Input::shared(
+        *leader_cap.object_id(),
+        leader_cap.version(),
+        false,
+    ));
+
+    // Claim gas from the requester into a temporary balance.
+    let balance = tx.move_call(
+        sui::tx::Function::new(
+            objects.workflow_pkg_id,
+            workflow::Gas::CLAIM_LEADER_GAS_FOR_PRE_KEY.module,
+            workflow::Gas::CLAIM_LEADER_GAS_FOR_PRE_KEY.name,
+            vec![],
+        ),
+        vec![gas_service, requested_by_arg, leader_cap_obj, amount],
+    );
+
+    // Convert the balance into a Coin<SUI>.
+    let sui = sui_framework::into_type_tag(sui_framework::Sui::SUI);
+    let coin = tx.move_call(
+        sui::tx::Function::new(
+            sui_framework::PACKAGE_ID,
+            sui_framework::Coin::FROM_BALANCE.module,
+            sui_framework::Coin::FROM_BALANCE.name,
+            vec![sui],
+        ),
+        vec![balance],
+    );
+
+    // `address`
+    let address = sui_framework::Address::address_from_type(tx, leader_address)?;
+
+    // `Coin<SUI>`
+    let coin_sui = sui::types::TypeTag::Struct(Box::new(sui::types::StructTag::gas_coin()));
+
+    // Transfer the claimed gas back to the leader's wallet.
+    // `sui::transfer::public_transfer()`
+    tx.move_call(
+        sui::tx::Function::new(
+            sui_framework::PACKAGE_ID,
+            sui_framework::Transfer::PUBLIC_TRANSFER.module,
+            sui_framework::Transfer::PUBLIC_TRANSFER.name,
+            vec![coin_sui],
+        ),
+        vec![coin, address],
+    );
+
+    fulfill_pre_key_for_user(tx, objects, crypto_cap, requested_by, pre_key)
+}
+
 /// PTB template to associate a claimed pre key with the sender address while
 /// sending an initial message.
 pub fn associate_pre_key_with_sender(
-    tx: &mut sui::ProgrammableTransactionBuilder,
+    tx: &mut sui::tx::TransactionBuilder,
     objects: &NexusObjects,
-    pre_key: &sui::ObjectRef,
     initial_message: InitialMessage,
-) -> anyhow::Result<sui::Argument> {
-    // `pre_key: PreKey`
-    let pre_key = tx.obj(sui::ObjectArg::ImmOrOwnedObject(pre_key.to_object_ref()))?;
+) -> anyhow::Result<sui::types::Argument> {
+    // `self: &mut PreKeyVault`
+    let pre_key_vault = tx.input(sui::tx::Input::shared(
+        *objects.pre_key_vault.object_id(),
+        objects.pre_key_vault.version(),
+        true,
+    ));
 
     // `initial_message: vector<u8>`
-    let initial_message = tx.pure(bincode::serialize(&initial_message)?)?;
+    let initial_message = tx.input(pure_arg(&bincode::serialize(&initial_message)?)?);
 
     // `nexus_workflow::pre_key_vault::associate_pre_key`
-    Ok(tx.programmable_move_call(
-        objects.workflow_pkg_id,
-        workflow::PreKeyVault::ASSOCIATE_PRE_KEY.module.into(),
-        workflow::PreKeyVault::ASSOCIATE_PRE_KEY.name.into(),
-        vec![],
-        vec![pre_key, initial_message],
+    Ok(tx.move_call(
+        sui::tx::Function::new(
+            objects.workflow_pkg_id,
+            workflow::PreKeyVault::ASSOCIATE_PRE_KEY.module,
+            workflow::PreKeyVault::ASSOCIATE_PRE_KEY.name,
+            vec![],
+        ),
+        vec![pre_key_vault, initial_message],
     ))
 }
 
@@ -131,60 +197,168 @@ mod tests {
     use {super::*, crate::test_utils::sui_mocks, x25519_dalek::PublicKey};
 
     #[test]
-    fn test_replenish_pre_keys() {
+    fn test_claim_pre_key_for_self() {
         let objects = sui_mocks::mock_nexus_objects();
-        let owner_cap = sui_mocks::mock_sui_object_ref();
 
-        let mut tx = sui::ProgrammableTransactionBuilder::new();
-        replenish_pre_keys(&mut tx, &objects, &owner_cap, &vec![]).unwrap();
-        let tx = tx.finish();
+        let mut tx = sui::tx::TransactionBuilder::new();
+        tx.set_sender(sui::types::Address::from_static("0x1"));
+        tx.set_gas_budget(1000);
+        tx.set_gas_price(1000);
+        let gas = sui_mocks::mock_sui_object_ref();
+        tx.add_gas_objects(vec![sui::tx::Input::owned(
+            *gas.object_id(),
+            gas.version(),
+            *gas.digest(),
+        )]);
+        claim_pre_key_for_self(&mut tx, &objects).unwrap();
+        let tx = tx.finish().expect("Transaction should build");
+        let sui::types::TransactionKind::ProgrammableTransaction(
+            sui::types::ProgrammableTransaction { commands, .. },
+        ) = tx.kind
+        else {
+            panic!("Expected a ProgrammableTransaction");
+        };
 
-        let sui::Command::MoveCall(call) = &tx.commands.last().unwrap() else {
-            panic!("Expected last command to be a MoveCall to replenish pre_keys");
+        let sui::types::Command::MoveCall(call) = &commands.last().unwrap() else {
+            panic!("Expected last command to be a MoveCall to claim pre_key for self");
         };
 
         assert_eq!(call.package, objects.workflow_pkg_id);
         assert_eq!(
             call.module,
-            workflow::PreKeyVault::REPLENISH_PRE_KEYS.module.to_string(),
+            workflow::PreKeyVault::CLAIM_PRE_KEY_FOR_SELF.module
         );
         assert_eq!(
             call.function,
-            workflow::PreKeyVault::REPLENISH_PRE_KEYS.name.to_string()
+            workflow::PreKeyVault::CLAIM_PRE_KEY_FOR_SELF.name
         );
     }
 
     #[test]
-    fn test_claim_pre_key_for_self() {
+    fn test_fulfill_pre_key_for_user() {
+        let rng = &mut rand::thread_rng();
         let objects = sui_mocks::mock_nexus_objects();
+        let owner_cap = sui_mocks::mock_sui_object_ref();
+        let identity = crate::crypto::x3dh::IdentityKey::generate();
+        let spk_secret = x25519_dalek::StaticSecret::from([1; 32]);
+        let pre_key = PreKeyBundle::new(&identity, 1, &spk_secret, None, None);
 
-        let mut tx = sui::ProgrammableTransactionBuilder::new();
-        claim_pre_key_for_self(&mut tx, &objects).unwrap();
-        let tx = tx.finish();
+        let mut tx = sui::tx::TransactionBuilder::new();
+        fulfill_pre_key_for_user(
+            &mut tx,
+            &objects,
+            &owner_cap,
+            sui::types::Address::generate(rng),
+            &pre_key,
+        )
+        .unwrap();
+        tx.set_sender(sui::types::Address::from_static("0x1"));
+        tx.set_gas_budget(1000);
+        tx.set_gas_price(1000);
+        let gas = sui_mocks::mock_sui_object_ref();
+        tx.add_gas_objects(vec![sui::tx::Input::owned(
+            *gas.object_id(),
+            gas.version(),
+            *gas.digest(),
+        )]);
+        let tx = tx.finish().expect("Transaction should build");
+        let sui::types::TransactionKind::ProgrammableTransaction(
+            sui::types::ProgrammableTransaction { commands, .. },
+        ) = tx.kind
+        else {
+            panic!("Expected a ProgrammableTransaction");
+        };
 
-        let sui::Command::MoveCall(call) = &tx.commands.last().unwrap() else {
-            panic!("Expected last command to be a MoveCall to claim pre_key for self");
+        let sui::types::Command::MoveCall(call) = &commands.last().unwrap() else {
+            panic!("Expected last command to be a MoveCall to fulfill pre_key for user");
         };
 
         assert_eq!(call.package, objects.workflow_pkg_id);
         assert_eq!(
             call.module,
-            workflow::PreKeyVault::CLAIM_PRE_KEY_FOR_SELF
-                .module
-                .to_string(),
+            workflow::PreKeyVault::FULFILL_PRE_KEY_FOR_USER.module
         );
         assert_eq!(
             call.function,
-            workflow::PreKeyVault::CLAIM_PRE_KEY_FOR_SELF
-                .name
-                .to_string()
+            workflow::PreKeyVault::FULFILL_PRE_KEY_FOR_USER.name
+        );
+    }
+
+    #[test]
+    fn test_claim_and_fulfill_pre_key_for_user() {
+        let rng = &mut rand::thread_rng();
+        let objects = sui_mocks::mock_nexus_objects();
+        let crypto_cap = sui_mocks::mock_sui_object_ref();
+        let leader_cap = sui_mocks::mock_sui_object_ref();
+        let leader_address = sui_mocks::mock_sui_address();
+        let identity = crate::crypto::x3dh::IdentityKey::generate();
+        let spk_secret = x25519_dalek::StaticSecret::from([1; 32]);
+        let pre_key = PreKeyBundle::new(&identity, 1, &spk_secret, None, None);
+        let requested_by = sui::types::Address::generate(rng);
+
+        let mut tx = sui::tx::TransactionBuilder::new();
+        claim_and_fulfill_pre_key_for_user(
+            &mut tx,
+            &objects,
+            &crypto_cap,
+            &leader_cap,
+            leader_address,
+            requested_by,
+            &pre_key,
+            1,
+        )
+        .unwrap();
+        tx.set_sender(sui::types::Address::from_static("0x1"));
+        tx.set_gas_budget(1000);
+        tx.set_gas_price(1000);
+        let gas = sui_mocks::mock_sui_object_ref();
+        tx.add_gas_objects(vec![sui::tx::Input::owned(
+            *gas.object_id(),
+            gas.version(),
+            *gas.digest(),
+        )]);
+        let tx = tx.finish().expect("Transaction should build");
+        let sui::types::TransactionKind::ProgrammableTransaction(
+            sui::types::ProgrammableTransaction { commands, .. },
+        ) = tx.kind
+        else {
+            panic!("Expected a ProgrammableTransaction");
+        };
+
+        let move_calls: Vec<_> = commands
+            .iter()
+            .filter_map(|cmd| {
+                if let sui::types::Command::MoveCall(call) = cmd {
+                    Some(call)
+                } else {
+                    None
+                }
+            })
+            .collect();
+
+        assert_eq!(move_calls.len(), 4);
+
+        assert_eq!(
+            move_calls[0].function,
+            workflow::Gas::CLAIM_LEADER_GAS_FOR_PRE_KEY.name
+        );
+        assert_eq!(
+            move_calls[1].function,
+            sui_framework::Coin::FROM_BALANCE.name
+        );
+        assert_eq!(
+            move_calls[2].function,
+            sui_framework::Transfer::PUBLIC_TRANSFER.name
+        );
+        assert_eq!(
+            move_calls[3].function,
+            workflow::PreKeyVault::FULFILL_PRE_KEY_FOR_USER.name
         );
     }
 
     #[test]
     fn test_associate_pre_key_with_sender() {
         let objects = sui_mocks::mock_nexus_objects();
-        let pre_key = sui_mocks::mock_sui_object_ref();
         let initial_message = InitialMessage {
             ika_pub: PublicKey::from([0; 32]),
             ek_pub: PublicKey::from([0; 32]),
@@ -194,22 +368,31 @@ mod tests {
             ciphertext: vec![0; 32],
         };
 
-        let mut tx = sui::ProgrammableTransactionBuilder::new();
-        associate_pre_key_with_sender(&mut tx, &objects, &pre_key, initial_message).unwrap();
-        let tx = tx.finish();
+        let mut tx = sui::tx::TransactionBuilder::new();
+        associate_pre_key_with_sender(&mut tx, &objects, initial_message).unwrap();
+        tx.set_sender(sui::types::Address::from_static("0x1"));
+        tx.set_gas_budget(1000);
+        tx.set_gas_price(1000);
+        let gas = sui_mocks::mock_sui_object_ref();
+        tx.add_gas_objects(vec![sui::tx::Input::owned(
+            *gas.object_id(),
+            gas.version(),
+            *gas.digest(),
+        )]);
+        let tx = tx.finish().expect("Transaction should build");
+        let sui::types::TransactionKind::ProgrammableTransaction(
+            sui::types::ProgrammableTransaction { commands, .. },
+        ) = tx.kind
+        else {
+            panic!("Expected a ProgrammableTransaction");
+        };
 
-        let sui::Command::MoveCall(call) = &tx.commands.last().unwrap() else {
+        let sui::types::Command::MoveCall(call) = &commands.last().unwrap() else {
             panic!("Expected last command to be a MoveCall to associate pre_key with sender");
         };
 
         assert_eq!(call.package, objects.workflow_pkg_id);
-        assert_eq!(
-            call.module,
-            workflow::PreKeyVault::ASSOCIATE_PRE_KEY.module.to_string(),
-        );
-        assert_eq!(
-            call.function,
-            workflow::PreKeyVault::ASSOCIATE_PRE_KEY.name.to_string()
-        );
+        assert_eq!(call.module, workflow::PreKeyVault::ASSOCIATE_PRE_KEY.module);
+        assert_eq!(call.function, workflow::PreKeyVault::ASSOCIATE_PRE_KEY.name);
     }
 }
diff --git a/sdk/src/transactions/dag.rs b/sdk/src/transactions/dag.rs
index a360acd6..5c589ae8 100644
--- a/sdk/src/transactions/dag.rs
+++ b/sdk/src/transactions/dag.rs
@@ -1,6 +1,6 @@
 use {
     crate::{
-        idents::{primitives, sui_framework, workflow},
+        idents::{primitives, pure_arg, sui_framework, workflow},
         sui,
         types::{
             Dag,
@@ -21,43 +21,44 @@ use {
 };
 
 /// PTB template for creating a new empty DAG.
-pub fn empty(
-    tx: &mut sui::ProgrammableTransactionBuilder,
-    objects: &NexusObjects,
-) -> sui::Argument {
-    tx.programmable_move_call(
-        objects.workflow_pkg_id,
-        workflow::Dag::NEW.module.into(),
-        workflow::Dag::NEW.name.into(),
-        vec![],
+pub fn empty(tx: &mut sui::tx::TransactionBuilder, objects: &NexusObjects) -> sui::types::Argument {
+    tx.move_call(
+        sui::tx::Function::new(
+            objects.workflow_pkg_id,
+            workflow::Dag::NEW.module,
+            workflow::Dag::NEW.name,
+            vec![],
+        ),
         vec![],
     )
 }
 
 /// PTB template to publish a DAG.
 pub fn publish(
-    tx: &mut sui::ProgrammableTransactionBuilder,
+    tx: &mut sui::tx::TransactionBuilder,
     objects: &NexusObjects,
-    dag: sui::Argument,
-) -> sui::Argument {
+    dag: sui::types::Argument,
+) -> sui::types::Argument {
     let dag_type = workflow::into_type_tag(objects.workflow_pkg_id, workflow::Dag::DAG);
 
-    tx.programmable_move_call(
-        sui::FRAMEWORK_PACKAGE_ID,
-        sui_framework::Transfer::PUBLIC_SHARE_OBJECT.module.into(),
-        sui_framework::Transfer::PUBLIC_SHARE_OBJECT.name.into(),
-        vec![dag_type],
+    tx.move_call(
+        sui::tx::Function::new(
+            sui_framework::PACKAGE_ID,
+            sui_framework::Transfer::PUBLIC_SHARE_OBJECT.module,
+            sui_framework::Transfer::PUBLIC_SHARE_OBJECT.name,
+            vec![dag_type],
+        ),
         vec![dag],
     )
 }
 
 /// PTB template to publish a full [`crate::types::Dag`].
 pub fn create(
-    tx: &mut sui::ProgrammableTransactionBuilder,
+    tx: &mut sui::tx::TransactionBuilder,
     objects: &NexusObjects,
-    mut dag_arg: sui::Argument,
+    mut dag_arg: sui::types::Argument,
     dag: Dag,
-) -> anyhow::Result<sui::Argument> {
+) -> anyhow::Result<sui::types::Argument> {
     // Create all vertices.
     for vertex in &dag.vertices {
         dag_arg = create_vertex(tx, objects, dag_arg, vertex)?;
@@ -133,11 +134,11 @@ pub fn create(
 
 /// PTB template for creating a new DAG vertex.
 pub fn create_vertex(
-    tx: &mut sui::ProgrammableTransactionBuilder,
+    tx: &mut sui::tx::TransactionBuilder,
     objects: &NexusObjects,
-    dag: sui::Argument,
+    dag: sui::types::Argument,
     vertex: &Vertex,
-) -> anyhow::Result<sui::Argument> {
+) -> anyhow::Result<sui::types::Argument> {
     // `name: Vertex`
     let name = workflow::Dag::vertex_from_str(tx, objects.workflow_pkg_id, &vertex.name)?;
 
@@ -147,28 +148,33 @@ pub fn create_vertex(
             // `tool_fqn: AsciiString`
             workflow::Dag::off_chain_vertex_kind_from_fqn(tx, objects.workflow_pkg_id, tool_fqn)?
         }
-        VertexKind::OnChain { .. } => {
-            todo!("TODO: <https://github.com/Talus-Network/nexus-next/issues/96>")
-        }
+        VertexKind::OnChain { tool_fqn } => workflow::Dag::on_chain_vertex_kind_from_fqn(
+            tx,
+            objects.workflow_pkg_id,
+            &objects.tool_registry,
+            tool_fqn,
+        )?,
     };
 
     // `dag.with_vertex(name, kind)`
-    Ok(tx.programmable_move_call(
-        objects.workflow_pkg_id,
-        workflow::Dag::WITH_VERTEX.module.into(),
-        workflow::Dag::WITH_VERTEX.name.into(),
-        vec![],
+    Ok(tx.move_call(
+        sui::tx::Function::new(
+            objects.workflow_pkg_id,
+            workflow::Dag::WITH_VERTEX.module,
+            workflow::Dag::WITH_VERTEX.name,
+            vec![],
+        ),
         vec![dag, name, kind],
     ))
 }
 
 /// PTB template for creating a new DAG default value.
 pub fn create_default_value(
-    tx: &mut sui::ProgrammableTransactionBuilder,
+    tx: &mut sui::tx::TransactionBuilder,
     objects: &NexusObjects,
-    dag: sui::Argument,
+    dag: sui::types::Argument,
     default_value: &DefaultValue,
-) -> anyhow::Result<sui::Argument> {
+) -> anyhow::Result<sui::types::Argument> {
     // `vertex: Vertex`
     let vertex =
         workflow::Dag::vertex_from_str(tx, objects.workflow_pkg_id, &default_value.vertex)?;
@@ -198,22 +204,24 @@ pub fn create_default_value(
     };
 
     // `dag.with_default_value(vertex, port, value)`
-    Ok(tx.programmable_move_call(
-        objects.workflow_pkg_id,
-        workflow::Dag::WITH_DEFAULT_VALUE.module.into(),
-        workflow::Dag::WITH_DEFAULT_VALUE.name.into(),
-        vec![],
+    Ok(tx.move_call(
+        sui::tx::Function::new(
+            objects.workflow_pkg_id,
+            workflow::Dag::WITH_DEFAULT_VALUE.module,
+            workflow::Dag::WITH_DEFAULT_VALUE.name,
+            vec![],
+        ),
         vec![dag, vertex, port, value],
     ))
 }
 
 /// PTB template for creating a new DAG edge.
 pub fn create_edge(
-    tx: &mut sui::ProgrammableTransactionBuilder,
+    tx: &mut sui::tx::TransactionBuilder,
     objects: &NexusObjects,
-    dag: sui::Argument,
+    dag: sui::types::Argument,
     edge: &Edge,
-) -> anyhow::Result<sui::Argument> {
+) -> anyhow::Result<sui::types::Argument> {
     // `from_vertex: Vertex`
     let from_vertex =
         workflow::Dag::vertex_from_str(tx, objects.workflow_pkg_id, &edge.from.vertex)?;
@@ -241,11 +249,13 @@ pub fn create_edge(
 
     if edge.from.encrypted {
         // `dag.with_encrypted_edge(from_vertex, from_variant, from_port, to_vertex, to_port)`
-        return Ok(tx.programmable_move_call(
-            objects.workflow_pkg_id,
-            workflow::Dag::WITH_ENCRYPTED_EDGE.module.into(),
-            workflow::Dag::WITH_ENCRYPTED_EDGE.name.into(),
-            vec![],
+        return Ok(tx.move_call(
+            sui::tx::Function::new(
+                objects.workflow_pkg_id,
+                workflow::Dag::WITH_ENCRYPTED_EDGE.module,
+                workflow::Dag::WITH_ENCRYPTED_EDGE.name,
+                vec![],
+            ),
             vec![
                 dag,
                 from_vertex,
@@ -259,11 +269,13 @@ pub fn create_edge(
     }
 
     // `dag.with_edge(from_vertex, from_variant, from_port, encrypted, to_vertex, to_port)`
-    Ok(tx.programmable_move_call(
-        objects.workflow_pkg_id,
-        workflow::Dag::WITH_EDGE.module.into(),
-        workflow::Dag::WITH_EDGE.name.into(),
-        vec![],
+    Ok(tx.move_call(
+        sui::tx::Function::new(
+            objects.workflow_pkg_id,
+            workflow::Dag::WITH_EDGE.module,
+            workflow::Dag::WITH_EDGE.name,
+            vec![],
+        ),
         vec![
             dag,
             from_vertex,
@@ -278,11 +290,11 @@ pub fn create_edge(
 
 /// PTB template for creating a new DAG edge.
 pub fn create_output(
-    tx: &mut sui::ProgrammableTransactionBuilder,
+    tx: &mut sui::tx::TransactionBuilder,
     objects: &NexusObjects,
-    dag: sui::Argument,
+    dag: sui::types::Argument,
     output: &FromPort,
-) -> anyhow::Result<sui::Argument> {
+) -> anyhow::Result<sui::types::Argument> {
     // `vertex: Vertex`
     let vertex = workflow::Dag::vertex_from_str(tx, objects.workflow_pkg_id, &output.vertex)?;
 
@@ -299,33 +311,37 @@ pub fn create_output(
 
     if output.encrypted {
         // `dag.with_encrypted_output(vertex, variant, port)`
-        return Ok(tx.programmable_move_call(
-            objects.workflow_pkg_id,
-            workflow::Dag::WITH_ENCRYPTED_OUTPUT.module.into(),
-            workflow::Dag::WITH_ENCRYPTED_OUTPUT.name.into(),
-            vec![],
+        return Ok(tx.move_call(
+            sui::tx::Function::new(
+                objects.workflow_pkg_id,
+                workflow::Dag::WITH_ENCRYPTED_OUTPUT.module,
+                workflow::Dag::WITH_ENCRYPTED_OUTPUT.name,
+                vec![],
+            ),
             vec![dag, vertex, variant, port],
         ));
     }
 
     // `dag.with_output(vertex, variant, port)`
-    Ok(tx.programmable_move_call(
-        objects.workflow_pkg_id,
-        workflow::Dag::WITH_OUTPUT.module.into(),
-        workflow::Dag::WITH_OUTPUT.name.into(),
-        vec![],
+    Ok(tx.move_call(
+        sui::tx::Function::new(
+            objects.workflow_pkg_id,
+            workflow::Dag::WITH_OUTPUT.module,
+            workflow::Dag::WITH_OUTPUT.name,
+            vec![],
+        ),
         vec![dag, vertex, variant, port],
     ))
 }
 
 /// PTB template for marking a vertex as an entry vertex.
 pub fn mark_entry_vertex(
-    tx: &mut sui::ProgrammableTransactionBuilder,
+    tx: &mut sui::tx::TransactionBuilder,
     objects: &NexusObjects,
-    dag: sui::Argument,
+    dag: sui::types::Argument,
     vertex: &str,
     entry_group: &str,
-) -> anyhow::Result<sui::Argument> {
+) -> anyhow::Result<sui::types::Argument> {
     // `vertex: Vertex`
     let vertex = workflow::Dag::vertex_from_str(tx, objects.workflow_pkg_id, vertex)?;
 
@@ -334,24 +350,26 @@ pub fn mark_entry_vertex(
         workflow::Dag::entry_group_from_str(tx, objects.workflow_pkg_id, entry_group)?;
 
     // `dag.with_entry_in_group(vertex, entry_group)`
-    Ok(tx.programmable_move_call(
-        objects.workflow_pkg_id,
-        workflow::Dag::WITH_ENTRY_IN_GROUP.module.into(),
-        workflow::Dag::WITH_ENTRY_IN_GROUP.name.into(),
-        vec![],
+    Ok(tx.move_call(
+        sui::tx::Function::new(
+            objects.workflow_pkg_id,
+            workflow::Dag::WITH_ENTRY_IN_GROUP.module,
+            workflow::Dag::WITH_ENTRY_IN_GROUP.name,
+            vec![],
+        ),
         vec![dag, vertex, entry_group],
     ))
 }
 
 /// PTB template for marking an input port as an input port.
 pub fn mark_entry_input_port(
-    tx: &mut sui::ProgrammableTransactionBuilder,
+    tx: &mut sui::tx::TransactionBuilder,
     objects: &NexusObjects,
-    dag: sui::Argument,
+    dag: sui::types::Argument,
     vertex: &str,
     entry_port: &EntryPort,
     entry_group: &str,
-) -> anyhow::Result<sui::Argument> {
+) -> anyhow::Result<sui::types::Argument> {
     // `vertex: Vertex`
     let vertex = workflow::Dag::vertex_from_str(tx, objects.workflow_pkg_id, vertex)?;
 
@@ -367,43 +385,46 @@ pub fn mark_entry_input_port(
         workflow::Dag::entry_group_from_str(tx, objects.workflow_pkg_id, entry_group)?;
 
     // `dag.with_entry_port_in_group(vertex, entry_port, entry_group)`
-    Ok(tx.programmable_move_call(
-        objects.workflow_pkg_id,
-        workflow::Dag::WITH_ENTRY_PORT_IN_GROUP.module.into(),
-        workflow::Dag::WITH_ENTRY_PORT_IN_GROUP.name.into(),
-        vec![],
+    Ok(tx.move_call(
+        sui::tx::Function::new(
+            objects.workflow_pkg_id,
+            workflow::Dag::WITH_ENTRY_PORT_IN_GROUP.module,
+            workflow::Dag::WITH_ENTRY_PORT_IN_GROUP.name,
+            vec![],
+        ),
         vec![dag, vertex, entry_port, entry_group],
     ))
 }
 
 /// PTB template to execute a DAG.
 pub fn execute(
-    tx: &mut sui::ProgrammableTransactionBuilder,
+    tx: &mut sui::tx::TransactionBuilder,
     objects: &NexusObjects,
-    dag: &sui::ObjectRef,
+    dag: &sui::types::ObjectReference,
+    priority_fee_per_gas_unit: u64,
     entry_group: &str,
     input_data: &HashMap<String, HashMap<String, DataStorage>>,
-) -> anyhow::Result<sui::Argument> {
+) -> anyhow::Result<sui::types::Argument> {
     // `self: &mut DefaultTAP`
-    let default_tap = tx.obj(sui::ObjectArg::SharedObject {
-        id: objects.default_tap.object_id,
-        initial_shared_version: objects.default_tap.version,
-        mutable: true,
-    })?;
+    let default_tap = tx.input(sui::tx::Input::shared(
+        *objects.default_tap.object_id(),
+        objects.default_tap.version(),
+        true,
+    ));
 
     // `dag: &DAG`
-    let dag = tx.obj(sui::ObjectArg::SharedObject {
-        id: dag.object_id,
-        initial_shared_version: dag.version,
-        mutable: false,
-    })?;
+    let dag = tx.input(sui::tx::Input::shared(
+        *dag.object_id(),
+        dag.version(),
+        false,
+    ));
 
     // `gas_service: &mut GasService`
-    let gas_service = tx.obj(sui::ObjectArg::SharedObject {
-        id: objects.gas_service.object_id,
-        initial_shared_version: objects.gas_service.version,
-        mutable: true,
-    })?;
+    let gas_service = tx.input(sui::tx::Input::shared(
+        *objects.gas_service.object_id(),
+        objects.gas_service.version(),
+        true,
+    ));
 
     // `network: ID`
     let network = sui_framework::Object::id_from_object_id(tx, objects.network_id)?;
@@ -420,19 +441,21 @@ pub fn execute(
 
     let outer_vec_map_type = vec![
         workflow::into_type_tag(objects.workflow_pkg_id, workflow::Dag::VERTEX),
-        sui::MoveTypeTag::Struct(Box::new(sui::MoveStructTag {
-            address: *sui::FRAMEWORK_PACKAGE_ID,
-            module: sui_framework::VecMap::VEC_MAP.module.into(),
-            name: sui_framework::VecMap::VEC_MAP.name.into(),
-            type_params: inner_vec_map_type.clone(),
-        })),
+        sui::types::TypeTag::Struct(Box::new(sui::types::StructTag::new(
+            sui_framework::PACKAGE_ID,
+            sui_framework::VecMap::VEC_MAP.module,
+            sui_framework::VecMap::VEC_MAP.name,
+            inner_vec_map_type.clone(),
+        ))),
     ];
 
-    let with_vertex_inputs = tx.programmable_move_call(
-        sui::FRAMEWORK_PACKAGE_ID,
-        sui_framework::VecMap::EMPTY.module.into(),
-        sui_framework::VecMap::EMPTY.name.into(),
-        outer_vec_map_type.clone(),
+    let with_vertex_inputs = tx.move_call(
+        sui::tx::Function::new(
+            sui_framework::PACKAGE_ID,
+            sui_framework::VecMap::EMPTY.module,
+            sui_framework::VecMap::EMPTY.name,
+            outer_vec_map_type.clone(),
+        ),
         vec![],
     );
 
@@ -441,23 +464,29 @@ pub fn execute(
         let vertex = workflow::Dag::vertex_from_str(tx, objects.workflow_pkg_id, vertex_name)?;
 
         // `with_vertex_input: VecMap<InputPort, NexusData>`
-        let with_vertex_input = tx.programmable_move_call(
-            sui::FRAMEWORK_PACKAGE_ID,
-            sui_framework::VecMap::EMPTY.module.into(),
-            sui_framework::VecMap::EMPTY.name.into(),
-            inner_vec_map_type.clone(),
+        let with_vertex_input = tx.move_call(
+            sui::tx::Function::new(
+                sui_framework::PACKAGE_ID,
+                sui_framework::VecMap::EMPTY.module,
+                sui_framework::VecMap::EMPTY.name,
+                inner_vec_map_type.clone(),
+            ),
             vec![],
         );
 
-        for (port, value) in data {
+        for (port_name, value) in data {
             // `port: InputPort`
             let port = match value.is_encrypted() {
                 true => workflow::Dag::encrypted_input_port_from_str(
                     tx,
                     objects.workflow_pkg_id,
-                    &port,
+                    port_name.as_str(),
+                )?,
+                false => workflow::Dag::input_port_from_str(
+                    tx,
+                    objects.workflow_pkg_id,
+                    port_name.as_str(),
                 )?,
-                false => workflow::Dag::input_port_from_str(tx, objects.workflow_pkg_id, &port)?,
             };
 
             // `value: NexusData`
@@ -477,34 +506,47 @@ pub fn execute(
             };
 
             // `with_vertex_input.insert(port, value)`
-            tx.programmable_move_call(
-                sui::FRAMEWORK_PACKAGE_ID,
-                sui_framework::VecMap::INSERT.module.into(),
-                sui_framework::VecMap::INSERT.name.into(),
-                inner_vec_map_type.clone(),
+            tx.move_call(
+                sui::tx::Function::new(
+                    sui_framework::PACKAGE_ID,
+                    sui_framework::VecMap::INSERT.module,
+                    sui_framework::VecMap::INSERT.name,
+                    inner_vec_map_type.clone(),
+                ),
                 vec![with_vertex_input, port, value],
             );
         }
 
         // `with_vertex_inputs.insert(vertex, with_vertex_input)`
-        tx.programmable_move_call(
-            sui::FRAMEWORK_PACKAGE_ID,
-            sui_framework::VecMap::INSERT.module.into(),
-            sui_framework::VecMap::INSERT.name.into(),
-            outer_vec_map_type.clone(),
+        tx.move_call(
+            sui::tx::Function::new(
+                sui_framework::PACKAGE_ID,
+                sui_framework::VecMap::INSERT.module,
+                sui_framework::VecMap::INSERT.name,
+                outer_vec_map_type.clone(),
+            ),
             vec![with_vertex_inputs, vertex, with_vertex_input],
         );
     }
 
     // `clock: &Clock`
-    let clock = tx.obj(sui::CLOCK_OBJ_ARG)?;
+    let clock = tx.input(sui::tx::Input::shared(
+        sui_framework::CLOCK_OBJECT_ID,
+        1,
+        false,
+    ));
+
+    // `priority_fee_per_gas_unit: u64`
+    let priority_fee_per_gas_unit = tx.input(pure_arg(&priority_fee_per_gas_unit)?);
 
     // `workflow::default_tap::begin_dag_execution()`
-    Ok(tx.programmable_move_call(
-        objects.workflow_pkg_id,
-        workflow::DefaultTap::BEGIN_DAG_EXECUTION.module.into(),
-        workflow::DefaultTap::BEGIN_DAG_EXECUTION.name.into(),
-        vec![],
+    Ok(tx.move_call(
+        sui::tx::Function::new(
+            objects.workflow_pkg_id,
+            workflow::DefaultTap::BEGIN_DAG_EXECUTION.module,
+            workflow::DefaultTap::BEGIN_DAG_EXECUTION.name,
+            vec![],
+        ),
         vec![
             default_tap,
             dag,
@@ -512,6 +554,7 @@ pub fn execute(
             network,
             entry_group,
             with_vertex_inputs,
+            priority_fee_per_gas_unit,
             clock,
         ],
     ))
@@ -526,23 +569,30 @@ mod tests {
             test_utils::sui_mocks,
             types::{Data, EdgeKind, FromPort, ToPort},
         },
+        std::collections::HashMap,
     };
 
     #[test]
     fn test_empty() {
         let objects = sui_mocks::mock_nexus_objects();
 
-        let mut tx = sui::ProgrammableTransactionBuilder::new();
+        let mut tx = sui::tx::TransactionBuilder::new();
         empty(&mut tx, &objects);
-        let tx = tx.finish();
+        let tx = sui_mocks::mock_finish_transaction(tx);
+        let sui::types::TransactionKind::ProgrammableTransaction(
+            sui::types::ProgrammableTransaction { commands, .. },
+        ) = tx.kind
+        else {
+            panic!("Expected a ProgrammableTransaction");
+        };
 
-        let sui::Command::MoveCall(call) = &tx.commands.last().unwrap() else {
+        let sui::types::Command::MoveCall(call) = &commands.last().unwrap() else {
             panic!("Expected last command to be a MoveCall to create an empty DAG");
         };
 
         assert_eq!(call.package, objects.workflow_pkg_id);
-        assert_eq!(call.module, workflow::Dag::NEW.module.to_string(),);
-        assert_eq!(call.function, workflow::Dag::NEW.name.to_string());
+        assert_eq!(call.module, workflow::Dag::NEW.module);
+        assert_eq!(call.function, workflow::Dag::NEW.name);
         assert_eq!(call.type_arguments.len(), 0);
         assert_eq!(call.arguments.len(), 0);
     }
@@ -550,28 +600,30 @@ mod tests {
     #[test]
     fn test_publish() {
         let objects = sui_mocks::mock_nexus_objects();
-        let dag = sui::Argument::Result(0);
+        let dag = sui::types::Argument::Result(0);
 
-        let mut tx = sui::ProgrammableTransactionBuilder::new();
+        let mut tx = sui::tx::TransactionBuilder::new();
         publish(&mut tx, &objects, dag);
-        let tx = tx.finish();
+        let tx = sui_mocks::mock_finish_transaction(tx);
+        let sui::types::TransactionKind::ProgrammableTransaction(
+            sui::types::ProgrammableTransaction { commands, .. },
+        ) = tx.kind
+        else {
+            panic!("Expected a ProgrammableTransaction");
+        };
 
-        let sui::Command::MoveCall(call) = &tx.commands.last().unwrap() else {
+        let sui::types::Command::MoveCall(call) = &commands.last().unwrap() else {
             panic!("Expected last command to be a MoveCall to publish a DAG");
         };
 
-        assert_eq!(call.package, sui::FRAMEWORK_PACKAGE_ID);
+        assert_eq!(call.package, sui_framework::PACKAGE_ID);
         assert_eq!(
             call.module,
-            sui_framework::Transfer::PUBLIC_SHARE_OBJECT
-                .module
-                .to_string(),
+            sui_framework::Transfer::PUBLIC_SHARE_OBJECT.module
         );
         assert_eq!(
             call.function,
-            sui_framework::Transfer::PUBLIC_SHARE_OBJECT
-                .name
-                .to_string()
+            sui_framework::Transfer::PUBLIC_SHARE_OBJECT.name
         );
         assert_eq!(call.type_arguments.len(), 1);
         assert_eq!(call.arguments.len(), 1);
@@ -580,7 +632,7 @@ mod tests {
     #[test]
     fn test_create_vertex() {
         let objects = sui_mocks::mock_nexus_objects();
-        let dag = sui::Argument::Result(0);
+        let dag = sui::types::Argument::Result(0);
         let vertex = Vertex {
             name: "vertex1".to_string(),
             kind: VertexKind::OffChain {
@@ -589,23 +641,29 @@ mod tests {
             entry_ports: None,
         };
 
-        let mut tx = sui::ProgrammableTransactionBuilder::new();
+        let mut tx = sui::tx::TransactionBuilder::new();
         create_vertex(&mut tx, &objects, dag, &vertex).unwrap();
-        let tx = tx.finish();
+        let tx = sui_mocks::mock_finish_transaction(tx);
+        let sui::types::TransactionKind::ProgrammableTransaction(
+            sui::types::ProgrammableTransaction { commands, .. },
+        ) = tx.kind
+        else {
+            panic!("Expected a ProgrammableTransaction");
+        };
 
-        let sui::Command::MoveCall(call) = &tx.commands.last().unwrap() else {
+        let sui::types::Command::MoveCall(call) = &commands.last().unwrap() else {
             panic!("Expected last command to be a MoveCall to create a vertex");
         };
 
         assert_eq!(call.package, objects.workflow_pkg_id);
-        assert_eq!(call.module, workflow::Dag::WITH_VERTEX.module.to_string(),);
-        assert_eq!(call.function, workflow::Dag::WITH_VERTEX.name.to_string());
+        assert_eq!(call.module, workflow::Dag::WITH_VERTEX.module);
+        assert_eq!(call.function, workflow::Dag::WITH_VERTEX.name);
     }
 
     #[test]
     fn test_create_default_value() {
         let objects = sui_mocks::mock_nexus_objects();
-        let dag = sui::Argument::Result(0);
+        let dag = sui::types::Argument::Result(0);
         let default_value = DefaultValue {
             vertex: "vertex1".to_string(),
             input_port: "port1".to_string(),
@@ -615,29 +673,29 @@ mod tests {
             },
         };
 
-        let mut tx = sui::ProgrammableTransactionBuilder::new();
+        let mut tx = sui::tx::TransactionBuilder::new();
         create_default_value(&mut tx, &objects, dag, &default_value).unwrap();
-        let tx = tx.finish();
+        let tx = sui_mocks::mock_finish_transaction(tx);
+        let sui::types::TransactionKind::ProgrammableTransaction(
+            sui::types::ProgrammableTransaction { commands, .. },
+        ) = tx.kind
+        else {
+            panic!("Expected a ProgrammableTransaction");
+        };
 
-        let sui::Command::MoveCall(call) = &tx.commands.last().unwrap() else {
+        let sui::types::Command::MoveCall(call) = &commands.last().unwrap() else {
             panic!("Expected last command to be a MoveCall to create a default value");
         };
 
         assert_eq!(call.package, objects.workflow_pkg_id);
-        assert_eq!(
-            call.module,
-            workflow::Dag::WITH_DEFAULT_VALUE.module.to_string(),
-        );
-        assert_eq!(
-            call.function,
-            workflow::Dag::WITH_DEFAULT_VALUE.name.to_string()
-        );
+        assert_eq!(call.module, workflow::Dag::WITH_DEFAULT_VALUE.module);
+        assert_eq!(call.function, workflow::Dag::WITH_DEFAULT_VALUE.name);
     }
 
     #[test]
     fn test_create_edge() {
         let objects = sui_mocks::mock_nexus_objects();
-        let dag = sui::Argument::Result(0);
+        let dag = sui::types::Argument::Result(0);
         let edge = Edge {
             from: FromPort {
                 vertex: "vertex1".to_string(),
@@ -652,49 +710,55 @@ mod tests {
             kind: EdgeKind::Normal,
         };
 
-        let mut tx = sui::ProgrammableTransactionBuilder::new();
+        let mut tx = sui::tx::TransactionBuilder::new();
         create_edge(&mut tx, &objects, dag, &edge).unwrap();
-        let tx = tx.finish();
+        let tx = sui_mocks::mock_finish_transaction(tx);
+        let sui::types::TransactionKind::ProgrammableTransaction(
+            sui::types::ProgrammableTransaction { commands, .. },
+        ) = tx.kind
+        else {
+            panic!("Expected a ProgrammableTransaction");
+        };
 
-        let sui::Command::MoveCall(call) = &tx.commands.last().unwrap() else {
+        let sui::types::Command::MoveCall(call) = &commands.last().unwrap() else {
             panic!("Expected last command to be a MoveCall to create an edge");
         };
 
         assert_eq!(call.package, objects.workflow_pkg_id);
-        assert_eq!(call.module, workflow::Dag::WITH_EDGE.module.to_string(),);
-        assert_eq!(call.function, workflow::Dag::WITH_EDGE.name.to_string());
+        assert_eq!(call.module, workflow::Dag::WITH_EDGE.module);
+        assert_eq!(call.function, workflow::Dag::WITH_EDGE.name);
     }
 
     #[test]
     fn test_mark_entry_vertex() {
         let objects = sui_mocks::mock_nexus_objects();
-        let dag = sui::Argument::Result(0);
+        let dag = sui::types::Argument::Result(0);
         let vertex = "vertex1";
         let entry_group = "group1";
 
-        let mut tx = sui::ProgrammableTransactionBuilder::new();
+        let mut tx = sui::tx::TransactionBuilder::new();
         mark_entry_vertex(&mut tx, &objects, dag, vertex, entry_group).unwrap();
-        let tx = tx.finish();
+        let tx = sui_mocks::mock_finish_transaction(tx);
+        let sui::types::TransactionKind::ProgrammableTransaction(
+            sui::types::ProgrammableTransaction { commands, .. },
+        ) = tx.kind
+        else {
+            panic!("Expected a ProgrammableTransaction");
+        };
 
-        let sui::Command::MoveCall(call) = &tx.commands.last().unwrap() else {
+        let sui::types::Command::MoveCall(call) = &commands.last().unwrap() else {
             panic!("Expected last command to be a MoveCall to mark an entry vertex");
         };
 
         assert_eq!(call.package, objects.workflow_pkg_id);
-        assert_eq!(
-            call.module,
-            workflow::Dag::WITH_ENTRY_IN_GROUP.module.to_string(),
-        );
-        assert_eq!(
-            call.function,
-            workflow::Dag::WITH_ENTRY_IN_GROUP.name.to_string()
-        );
+        assert_eq!(call.module, workflow::Dag::WITH_ENTRY_IN_GROUP.module);
+        assert_eq!(call.function, workflow::Dag::WITH_ENTRY_IN_GROUP.name);
     }
 
     #[test]
     fn test_mark_entry_input_port() {
         let nexus_objects = sui_mocks::mock_nexus_objects();
-        let dag = sui::Argument::Result(0);
+        let dag = sui::types::Argument::Result(0);
         let vertex = "vertex1";
         let entry_port = &EntryPort {
             name: "test".to_string(),
@@ -702,7 +766,7 @@ mod tests {
         };
         let entry_group = "group1";
 
-        let mut tx = sui::ProgrammableTransactionBuilder::new();
+        let mut tx = sui::tx::TransactionBuilder::new();
         mark_entry_input_port(
             &mut tx,
             &nexus_objects,
@@ -712,21 +776,21 @@ mod tests {
             entry_group,
         )
         .unwrap();
-        let tx = tx.finish();
+        let tx = sui_mocks::mock_finish_transaction(tx);
+        let sui::types::TransactionKind::ProgrammableTransaction(
+            sui::types::ProgrammableTransaction { commands, .. },
+        ) = tx.kind
+        else {
+            panic!("Expected a ProgrammableTransaction");
+        };
 
-        let sui::Command::MoveCall(call) = &tx.commands.last().unwrap() else {
+        let sui::types::Command::MoveCall(call) = &commands.last().unwrap() else {
             panic!("Expected last command to be a MoveCall to mark an entry input port");
         };
 
         assert_eq!(call.package, nexus_objects.workflow_pkg_id);
-        assert_eq!(
-            call.module,
-            workflow::Dag::WITH_ENTRY_PORT_IN_GROUP.module.to_string(),
-        );
-        assert_eq!(
-            call.function,
-            workflow::Dag::WITH_ENTRY_PORT_IN_GROUP.name.to_string()
-        );
+        assert_eq!(call.module, workflow::Dag::WITH_ENTRY_PORT_IN_GROUP.module);
+        assert_eq!(call.function, workflow::Dag::WITH_ENTRY_PORT_IN_GROUP.name);
     }
 
     #[test]
@@ -740,35 +804,50 @@ mod tests {
             "vertex1".to_string(),
             HashMap::from([(
                 "port1".to_string(),
-                serde_json::json!({"kind": "inline", "encrypted": false, "data": { "key": "value" } })
+                serde_json::json!({"kind": "inline", "encryption_mode": 0, "data": { "key": "value"} })
                     .try_into()
                     .expect("Failed to convert JSON to DataStorage"),
             )]),
         );
 
-        let mut tx = sui::ProgrammableTransactionBuilder::new();
-        execute(&mut tx, &nexus_objects, &dag, entry_group, &input_data).unwrap();
-        let tx = tx.finish();
+        let mut tx = sui::tx::TransactionBuilder::new();
+        let priority_fee_per_gas_unit = 0;
+        execute(
+            &mut tx,
+            &nexus_objects,
+            &dag,
+            priority_fee_per_gas_unit,
+            entry_group,
+            &input_data,
+        )
+        .unwrap();
+        let tx = sui_mocks::mock_finish_transaction(tx);
+        let sui::types::TransactionKind::ProgrammableTransaction(
+            sui::types::ProgrammableTransaction { commands, .. },
+        ) = tx.kind
+        else {
+            panic!("Expected a ProgrammableTransaction");
+        };
 
-        let sui::Command::MoveCall(call) = &tx.commands.last().unwrap() else {
+        let sui::types::Command::MoveCall(call) = &commands.last().unwrap() else {
             panic!("Expected last command to be a MoveCall to execute a DAG");
         };
 
         assert_eq!(call.package, nexus_objects.workflow_pkg_id);
         assert_eq!(
             call.module,
-            workflow::DefaultTap::BEGIN_DAG_EXECUTION.module.to_string(),
+            workflow::DefaultTap::BEGIN_DAG_EXECUTION.module
         );
         assert_eq!(
             call.function,
-            workflow::DefaultTap::BEGIN_DAG_EXECUTION.name.to_string()
+            workflow::DefaultTap::BEGIN_DAG_EXECUTION.name
         );
     }
 
     #[test]
     fn test_create_output_unencrypted() {
         let objects = sui_mocks::mock_nexus_objects();
-        let dag = sui::Argument::Result(0);
+        let dag = sui::types::Argument::Result(0);
         let output = FromPort {
             vertex: "vertex1".to_string(),
             output_variant: "variant1".to_string(),
@@ -776,23 +855,29 @@ mod tests {
             encrypted: false,
         };
 
-        let mut tx = sui::ProgrammableTransactionBuilder::new();
+        let mut tx = sui::tx::TransactionBuilder::new();
         create_output(&mut tx, &objects, dag, &output).unwrap();
-        let tx = tx.finish();
+        let tx = sui_mocks::mock_finish_transaction(tx);
+        let sui::types::TransactionKind::ProgrammableTransaction(
+            sui::types::ProgrammableTransaction { commands, .. },
+        ) = tx.kind
+        else {
+            panic!("Expected a ProgrammableTransaction");
+        };
 
-        let sui::Command::MoveCall(call) = &tx.commands.last().unwrap() else {
+        let sui::types::Command::MoveCall(call) = &commands.last().unwrap() else {
             panic!("Expected last command to be a MoveCall to create an output");
         };
 
         assert_eq!(call.package, objects.workflow_pkg_id);
-        assert_eq!(call.module, workflow::Dag::WITH_OUTPUT.module.to_string());
-        assert_eq!(call.function, workflow::Dag::WITH_OUTPUT.name.to_string());
+        assert_eq!(call.module, workflow::Dag::WITH_OUTPUT.module);
+        assert_eq!(call.function, workflow::Dag::WITH_OUTPUT.name);
     }
 
     #[test]
     fn test_create_output_encrypted() {
         let objects = sui_mocks::mock_nexus_objects();
-        let dag = sui::Argument::Result(0);
+        let dag = sui::types::Argument::Result(0);
         let output = FromPort {
             vertex: "vertex1".to_string(),
             output_variant: "variant1".to_string(),
@@ -800,22 +885,22 @@ mod tests {
             encrypted: true,
         };
 
-        let mut tx = sui::ProgrammableTransactionBuilder::new();
+        let mut tx = sui::tx::TransactionBuilder::new();
         create_output(&mut tx, &objects, dag, &output).unwrap();
-        let tx = tx.finish();
+        let tx = sui_mocks::mock_finish_transaction(tx);
+        let sui::types::TransactionKind::ProgrammableTransaction(
+            sui::types::ProgrammableTransaction { commands, .. },
+        ) = tx.kind
+        else {
+            panic!("Expected a ProgrammableTransaction");
+        };
 
-        let sui::Command::MoveCall(call) = &tx.commands.last().unwrap() else {
+        let sui::types::Command::MoveCall(call) = &commands.last().unwrap() else {
             panic!("Expected last command to be a MoveCall to create an encrypted output");
         };
 
         assert_eq!(call.package, objects.workflow_pkg_id);
-        assert_eq!(
-            call.module,
-            workflow::Dag::WITH_ENCRYPTED_OUTPUT.module.to_string()
-        );
-        assert_eq!(
-            call.function,
-            workflow::Dag::WITH_ENCRYPTED_OUTPUT.name.to_string()
-        );
+        assert_eq!(call.module, workflow::Dag::WITH_ENCRYPTED_OUTPUT.module);
+        assert_eq!(call.function, workflow::Dag::WITH_ENCRYPTED_OUTPUT.name);
     }
 }
diff --git a/sdk/src/transactions/gas.rs b/sdk/src/transactions/gas.rs
index c6c47c7c..3aec0aad 100644
--- a/sdk/src/transactions/gas.rs
+++ b/sdk/src/transactions/gas.rs
@@ -1,5 +1,5 @@
 use crate::{
-    idents::{move_std, sui_framework, workflow},
+    idents::{move_std, pure_arg, sui_framework, workflow},
     sui,
     types::NexusObjects,
     ToolFqn,
@@ -7,17 +7,17 @@ use crate::{
 
 /// PTB template to add gas budget to a transaction.
 pub fn add_budget(
-    tx: &mut sui::ProgrammableTransactionBuilder,
+    tx: &mut sui::tx::TransactionBuilder,
     objects: &NexusObjects,
-    invoker_address: sui::ObjectID,
-    coin: &sui::ObjectRef,
-) -> anyhow::Result<sui::Argument> {
+    invoker_address: sui::types::Address,
+    coin: &sui::types::ObjectReference,
+) -> anyhow::Result<sui::types::Argument> {
     // `self: &mut GasService`
-    let gas_service = tx.obj(sui::ObjectArg::SharedObject {
-        id: objects.gas_service.object_id,
-        initial_shared_version: objects.gas_service.version,
-        mutable: true,
-    })?;
+    let gas_service = tx.input(sui::tx::Input::shared(
+        *objects.gas_service.object_id(),
+        objects.gas_service.version(),
+        true,
+    ));
 
     // `scope: Scope`
     let scope = workflow::Gas::scope_invoker_address_from_object_id(
@@ -27,198 +27,231 @@ pub fn add_budget(
     )?;
 
     // `balance: Balance<SUI>`
-    let coin = tx.obj(sui::ObjectArg::ImmOrOwnedObject(coin.to_object_ref()))?;
+    let coin = tx.input(sui::tx::Input::owned(
+        *coin.object_id(),
+        coin.version(),
+        *coin.digest(),
+    ));
+
     let sui = sui_framework::into_type_tag(sui_framework::Sui::SUI);
 
-    let balance = tx.programmable_move_call(
-        sui::FRAMEWORK_PACKAGE_ID,
-        sui_framework::Coin::INTO_BALANCE.module.into(),
-        sui_framework::Coin::INTO_BALANCE.name.into(),
-        vec![sui],
+    let balance = tx.move_call(
+        sui::tx::Function::new(
+            sui_framework::PACKAGE_ID,
+            sui_framework::Coin::INTO_BALANCE.module,
+            sui_framework::Coin::INTO_BALANCE.name,
+            vec![sui],
+        ),
         vec![coin],
     );
 
     // `nexus_workflow::gas::add_gas_budget`
-    Ok(tx.programmable_move_call(
-        objects.workflow_pkg_id,
-        workflow::Gas::ADD_GAS_BUDGET.module.into(),
-        workflow::Gas::ADD_GAS_BUDGET.name.into(),
-        vec![],
+    Ok(tx.move_call(
+        sui::tx::Function::new(
+            objects.workflow_pkg_id,
+            workflow::Gas::ADD_GAS_BUDGET.module,
+            workflow::Gas::ADD_GAS_BUDGET.name,
+            vec![],
+        ),
         vec![gas_service, scope, balance],
     ))
 }
 
 /// PTB template to enable the expiry gas extension for a tool.
 pub fn enable_expiry(
-    tx: &mut sui::ProgrammableTransactionBuilder,
+    tx: &mut sui::tx::TransactionBuilder,
     objects: &NexusObjects,
     tool_fqn: &ToolFqn,
-    owner_cap: &sui::ObjectRef,
+    owner_cap: &sui::types::ObjectReference,
     cost_per_minute: u64,
-) -> anyhow::Result<sui::Argument> {
+) -> anyhow::Result<sui::types::Argument> {
     // `self: &mut GasService`
-    let gas_service = tx.obj(sui::ObjectArg::SharedObject {
-        id: objects.gas_service.object_id,
-        initial_shared_version: objects.gas_service.version,
-        mutable: true,
-    })?;
+    let gas_service = tx.input(sui::tx::Input::shared(
+        *objects.gas_service.object_id(),
+        objects.gas_service.version(),
+        true,
+    ));
 
     // `tool_registry: &ToolRegistry`
-    let tool_registry = tx.obj(sui::ObjectArg::SharedObject {
-        id: objects.tool_registry.object_id,
-        initial_shared_version: objects.tool_registry.version,
-        mutable: false,
-    })?;
+    let tool_registry = tx.input(sui::tx::Input::shared(
+        *objects.tool_registry.object_id(),
+        objects.tool_registry.version(),
+        false,
+    ));
 
     // `owner_cap: OwnerCap<OverGas>`
-    let owner_cap = tx.obj(sui::ObjectArg::ImmOrOwnedObject(owner_cap.to_object_ref()))?;
+    let owner_cap = tx.input(sui::tx::Input::owned(
+        *owner_cap.object_id(),
+        owner_cap.version(),
+        *owner_cap.digest(),
+    ));
 
     // `cost_per_minute: u64`
-    let cost_per_minute = tx.pure(cost_per_minute)?;
+    let cost_per_minute = tx.input(pure_arg(&cost_per_minute)?);
 
     // `fqn: ToolFqn`
     let fqn = move_std::Ascii::ascii_string_from_str(tx, tool_fqn.to_string())?;
 
     // `nexus_workflow::gas_extension::enable_expiry`
-    Ok(tx.programmable_move_call(
-        objects.workflow_pkg_id,
-        workflow::GasExtension::ENABLE_EXPIRY.module.into(),
-        workflow::GasExtension::ENABLE_EXPIRY.name.into(),
-        vec![],
+    Ok(tx.move_call(
+        sui::tx::Function::new(
+            objects.workflow_pkg_id,
+            workflow::GasExtension::ENABLE_EXPIRY.module,
+            workflow::GasExtension::ENABLE_EXPIRY.name,
+            vec![],
+        ),
         vec![gas_service, tool_registry, owner_cap, cost_per_minute, fqn],
     ))
 }
 
 /// PTB template to disable the expiry gas extension for a tool.
 pub fn disable_expiry(
-    tx: &mut sui::ProgrammableTransactionBuilder,
+    tx: &mut sui::tx::TransactionBuilder,
     objects: &NexusObjects,
     tool_fqn: &ToolFqn,
-    owner_cap: &sui::ObjectRef,
-) -> anyhow::Result<sui::Argument> {
+    owner_cap: &sui::types::ObjectReference,
+) -> anyhow::Result<sui::types::Argument> {
     // `self: &mut GasService`
-    let gas_service = tx.obj(sui::ObjectArg::SharedObject {
-        id: objects.gas_service.object_id,
-        initial_shared_version: objects.gas_service.version,
-        mutable: true,
-    })?;
+    let gas_service = tx.input(sui::tx::Input::shared(
+        *objects.gas_service.object_id(),
+        objects.gas_service.version(),
+        true,
+    ));
 
     // `tool_registry: &ToolRegistry`
-    let tool_registry = tx.obj(sui::ObjectArg::SharedObject {
-        id: objects.tool_registry.object_id,
-        initial_shared_version: objects.tool_registry.version,
-        mutable: false,
-    })?;
+    let tool_registry = tx.input(sui::tx::Input::shared(
+        *objects.tool_registry.object_id(),
+        objects.tool_registry.version(),
+        false,
+    ));
 
     // `owner_cap: OwnerCap<OverGas>`
-    let owner_cap = tx.obj(sui::ObjectArg::ImmOrOwnedObject(owner_cap.to_object_ref()))?;
+    let owner_cap = tx.input(sui::tx::Input::owned(
+        *owner_cap.object_id(),
+        owner_cap.version(),
+        *owner_cap.digest(),
+    ));
 
     // `fqn: ToolFqn`
     let fqn = move_std::Ascii::ascii_string_from_str(tx, tool_fqn.to_string())?;
 
     // `nexus_workflow::gas_extension::disable_expiry`
-    Ok(tx.programmable_move_call(
-        objects.workflow_pkg_id,
-        workflow::GasExtension::DISABLE_EXPIRY.module.into(),
-        workflow::GasExtension::DISABLE_EXPIRY.name.into(),
-        vec![],
+    Ok(tx.move_call(
+        sui::tx::Function::new(
+            objects.workflow_pkg_id,
+            workflow::GasExtension::DISABLE_EXPIRY.module,
+            workflow::GasExtension::DISABLE_EXPIRY.name,
+            vec![],
+        ),
         vec![gas_service, tool_registry, owner_cap, fqn],
     ))
 }
 
 /// PTB template to buy an expiry gas ticket.
 pub fn buy_expiry_gas_ticket(
-    tx: &mut sui::ProgrammableTransactionBuilder,
+    tx: &mut sui::tx::TransactionBuilder,
     objects: &NexusObjects,
     tool_fqn: &ToolFqn,
-    pay_with: &sui::ObjectRef,
+    pay_with: &sui::types::ObjectReference,
     minutes: u64,
-) -> anyhow::Result<sui::Argument> {
+) -> anyhow::Result<sui::types::Argument> {
     // `self: &mut GasService`
-    let gas_service = tx.obj(sui::ObjectArg::SharedObject {
-        id: objects.gas_service.object_id,
-        initial_shared_version: objects.gas_service.version,
-        mutable: true,
-    })?;
+    let gas_service = tx.input(sui::tx::Input::shared(
+        *objects.gas_service.object_id(),
+        objects.gas_service.version(),
+        true,
+    ));
 
     // `tool_registry: &ToolRegistry`
-    let tool_registry = tx.obj(sui::ObjectArg::SharedObject {
-        id: objects.tool_registry.object_id,
-        initial_shared_version: objects.tool_registry.version,
-        mutable: false,
-    })?;
+    let tool_registry = tx.input(sui::tx::Input::shared(
+        *objects.tool_registry.object_id(),
+        objects.tool_registry.version(),
+        false,
+    ));
 
     // `fqn: ToolFqn`
     let fqn = move_std::Ascii::ascii_string_from_str(tx, tool_fqn.to_string())?;
 
     // `minutes: u64`
-    let minutes = tx.pure(minutes)?;
+    let minutes = tx.input(pure_arg(&minutes)?);
 
     // `pay_with: Coin<SUI>`
-    let pay_with = tx.obj(sui::ObjectArg::ImmOrOwnedObject(pay_with.to_object_ref()))?;
+    let pay_with = tx.input(sui::tx::Input::owned(
+        *pay_with.object_id(),
+        pay_with.version(),
+        *pay_with.digest(),
+    ));
 
     // `clock: &Clock`
-    let clock = tx.obj(sui::CLOCK_OBJ_ARG)?;
+    let clock = tx.input(sui::tx::Input::shared(
+        sui_framework::CLOCK_OBJECT_ID,
+        1,
+        false,
+    ));
 
     // `nexus_workflow::gas_extension::buy_expiry_gas_ticket`
-    Ok(tx.programmable_move_call(
-        objects.workflow_pkg_id,
-        workflow::GasExtension::BUY_EXPIRY_GAS_TICKET.module.into(),
-        workflow::GasExtension::BUY_EXPIRY_GAS_TICKET.name.into(),
-        vec![],
+    Ok(tx.move_call(
+        sui::tx::Function::new(
+            objects.workflow_pkg_id,
+            workflow::GasExtension::BUY_EXPIRY_GAS_TICKET.module,
+            workflow::GasExtension::BUY_EXPIRY_GAS_TICKET.name,
+            vec![],
+        ),
         vec![gas_service, tool_registry, fqn, minutes, pay_with, clock],
     ))
 }
 
 /// PTB template to enable the limited invocations gas extension for a tool.
 pub fn enable_limited_invocations(
-    tx: &mut sui::ProgrammableTransactionBuilder,
+    tx: &mut sui::tx::TransactionBuilder,
     objects: &NexusObjects,
     tool_fqn: &ToolFqn,
-    owner_cap: &sui::ObjectRef,
+    owner_cap: &sui::types::ObjectReference,
     cost_per_invocation: u64,
     min_invocations: u64,
     max_invocations: u64,
-) -> anyhow::Result<sui::Argument> {
+) -> anyhow::Result<sui::types::Argument> {
     // `self: &mut GasService`
-    let gas_service = tx.obj(sui::ObjectArg::SharedObject {
-        id: objects.gas_service.object_id,
-        initial_shared_version: objects.gas_service.version,
-        mutable: true,
-    })?;
+    let gas_service = tx.input(sui::tx::Input::shared(
+        *objects.gas_service.object_id(),
+        objects.gas_service.version(),
+        true,
+    ));
 
     // `tool_registry: &ToolRegistry`
-    let tool_registry = tx.obj(sui::ObjectArg::SharedObject {
-        id: objects.tool_registry.object_id,
-        initial_shared_version: objects.tool_registry.version,
-        mutable: false,
-    })?;
+    let tool_registry = tx.input(sui::tx::Input::shared(
+        *objects.tool_registry.object_id(),
+        objects.tool_registry.version(),
+        false,
+    ));
 
     // `owner_cap: OwnerCap<OverGas>`
-    let owner_cap = tx.obj(sui::ObjectArg::ImmOrOwnedObject(owner_cap.to_object_ref()))?;
+    let owner_cap = tx.input(sui::tx::Input::owned(
+        *owner_cap.object_id(),
+        owner_cap.version(),
+        *owner_cap.digest(),
+    ));
 
     // `cost_per_invocation: u64`
-    let cost_per_invocation = tx.pure(cost_per_invocation)?;
+    let cost_per_invocation = tx.input(pure_arg(&cost_per_invocation)?);
 
     // `min_invocations: u64`
-    let min_invocations = tx.pure(min_invocations)?;
+    let min_invocations = tx.input(pure_arg(&min_invocations)?);
 
     // `max_invocations: u64`
-    let max_invocations = tx.pure(max_invocations)?;
+    let max_invocations = tx.input(pure_arg(&max_invocations)?);
 
     // `fqn: ToolFqn`
     let fqn = move_std::Ascii::ascii_string_from_str(tx, tool_fqn.to_string())?;
 
     // `nexus_workflow::gas_extension::enable_limited_invocations`
-    Ok(tx.programmable_move_call(
-        objects.workflow_pkg_id,
-        workflow::GasExtension::ENABLE_LIMITED_INVOCATIONS
-            .module
-            .into(),
-        workflow::GasExtension::ENABLE_LIMITED_INVOCATIONS
-            .name
-            .into(),
-        vec![],
+    Ok(tx.move_call(
+        sui::tx::Function::new(
+            objects.workflow_pkg_id,
+            workflow::GasExtension::ENABLE_LIMITED_INVOCATIONS.module,
+            workflow::GasExtension::ENABLE_LIMITED_INVOCATIONS.name,
+            vec![],
+        ),
         vec![
             gas_service,
             tool_registry,
@@ -233,89 +266,97 @@ pub fn enable_limited_invocations(
 
 /// PTB template to disable the limited invocations gas extension for a tool.
 pub fn disable_limited_invocations(
-    tx: &mut sui::ProgrammableTransactionBuilder,
+    tx: &mut sui::tx::TransactionBuilder,
     objects: &NexusObjects,
     tool_fqn: &ToolFqn,
-    owner_cap: &sui::ObjectRef,
-) -> anyhow::Result<sui::Argument> {
+    owner_cap: &sui::types::ObjectReference,
+) -> anyhow::Result<sui::types::Argument> {
     // `self: &mut GasService`
-    let gas_service = tx.obj(sui::ObjectArg::SharedObject {
-        id: objects.gas_service.object_id,
-        initial_shared_version: objects.gas_service.version,
-        mutable: true,
-    })?;
+    let gas_service = tx.input(sui::tx::Input::shared(
+        *objects.gas_service.object_id(),
+        objects.gas_service.version(),
+        true,
+    ));
 
     // `tool_registry: &ToolRegistry`
-    let tool_registry = tx.obj(sui::ObjectArg::SharedObject {
-        id: objects.tool_registry.object_id,
-        initial_shared_version: objects.tool_registry.version,
-        mutable: false,
-    })?;
+    let tool_registry = tx.input(sui::tx::Input::shared(
+        *objects.tool_registry.object_id(),
+        objects.tool_registry.version(),
+        false,
+    ));
 
     // `owner_cap: OwnerCap<OverGas>`
-    let owner_cap = tx.obj(sui::ObjectArg::ImmOrOwnedObject(owner_cap.to_object_ref()))?;
+    let owner_cap = tx.input(sui::tx::Input::owned(
+        *owner_cap.object_id(),
+        owner_cap.version(),
+        *owner_cap.digest(),
+    ));
 
     // `fqn: ToolFqn`
     let fqn = move_std::Ascii::ascii_string_from_str(tx, tool_fqn.to_string())?;
 
     // `nexus_workflow::gas_extension::disable_limited_invocations`
-    Ok(tx.programmable_move_call(
-        objects.workflow_pkg_id,
-        workflow::GasExtension::DISABLE_LIMITED_INVOCATIONS
-            .module
-            .into(),
-        workflow::GasExtension::DISABLE_LIMITED_INVOCATIONS
-            .name
-            .into(),
-        vec![],
+    Ok(tx.move_call(
+        sui::tx::Function::new(
+            objects.workflow_pkg_id,
+            workflow::GasExtension::DISABLE_LIMITED_INVOCATIONS.module,
+            workflow::GasExtension::DISABLE_LIMITED_INVOCATIONS.name,
+            vec![],
+        ),
         vec![gas_service, tool_registry, owner_cap, fqn],
     ))
 }
 
 /// PTB template to buy a limited invocations gas ticket.
 pub fn buy_limited_invocations_gas_ticket(
-    tx: &mut sui::ProgrammableTransactionBuilder,
+    tx: &mut sui::tx::TransactionBuilder,
     objects: &NexusObjects,
     tool_fqn: &ToolFqn,
-    pay_with: &sui::ObjectRef,
+    pay_with: &sui::types::ObjectReference,
     invocations: u64,
-) -> anyhow::Result<sui::Argument> {
+) -> anyhow::Result<sui::types::Argument> {
     // `self: &mut GasService`
-    let gas_service = tx.obj(sui::ObjectArg::SharedObject {
-        id: objects.gas_service.object_id,
-        initial_shared_version: objects.gas_service.version,
-        mutable: true,
-    })?;
+    let gas_service = tx.input(sui::tx::Input::shared(
+        *objects.gas_service.object_id(),
+        objects.gas_service.version(),
+        true,
+    ));
 
     // `tool_registry: &ToolRegistry`
-    let tool_registry = tx.obj(sui::ObjectArg::SharedObject {
-        id: objects.tool_registry.object_id,
-        initial_shared_version: objects.tool_registry.version,
-        mutable: false,
-    })?;
+    let tool_registry = tx.input(sui::tx::Input::shared(
+        *objects.tool_registry.object_id(),
+        objects.tool_registry.version(),
+        false,
+    ));
 
     // `fqn: ToolFqn`
     let fqn = move_std::Ascii::ascii_string_from_str(tx, tool_fqn.to_string())?;
 
     // `invocations: u64`
-    let invocations = tx.pure(invocations)?;
+    let invocations = tx.input(pure_arg(&invocations)?);
 
     // `pay_with: Coin<SUI>`
-    let pay_with = tx.obj(sui::ObjectArg::ImmOrOwnedObject(pay_with.to_object_ref()))?;
+    let pay_with = tx.input(sui::tx::Input::owned(
+        *pay_with.object_id(),
+        pay_with.version(),
+        *pay_with.digest(),
+    ));
 
     // `clock: &Clock`
-    let clock = tx.obj(sui::CLOCK_OBJ_ARG)?;
+    let clock = tx.input(sui::tx::Input::shared(
+        sui_framework::CLOCK_OBJECT_ID,
+        1,
+        false,
+    ));
 
     // `nexus_workflow::gas_extension::buy_limited_invocations_gas_ticket`
-    Ok(tx.programmable_move_call(
-        objects.workflow_pkg_id,
-        workflow::GasExtension::BUY_LIMITED_INVOCATIONS_GAS_TICKET
-            .module
-            .into(),
-        workflow::GasExtension::BUY_LIMITED_INVOCATIONS_GAS_TICKET
-            .name
-            .into(),
-        vec![],
+    Ok(tx.move_call(
+        sui::tx::Function::new(
+            objects.workflow_pkg_id,
+            workflow::GasExtension::BUY_LIMITED_INVOCATIONS_GAS_TICKET.module,
+            workflow::GasExtension::BUY_LIMITED_INVOCATIONS_GAS_TICKET.name,
+            vec![],
+        ),
         vec![
             gas_service,
             tool_registry,
@@ -339,27 +380,28 @@ mod tests {
 
     #[test]
     fn test_add_budget() {
+        let rng = &mut rand::thread_rng();
         let objects = sui_mocks::mock_nexus_objects();
-        let invoker_address = sui::ObjectID::random();
+        let invoker_address = sui::types::Address::generate(rng);
         let coin = sui_mocks::mock_sui_object_ref();
 
-        let mut tx = sui::ProgrammableTransactionBuilder::new();
+        let mut tx = sui::tx::TransactionBuilder::new();
         add_budget(&mut tx, &objects, invoker_address, &coin).unwrap();
-        let tx = tx.finish();
+        let tx = sui_mocks::mock_finish_transaction(tx);
+        let sui::types::TransactionKind::ProgrammableTransaction(
+            sui::types::ProgrammableTransaction { commands, .. },
+        ) = tx.kind
+        else {
+            panic!("Expected a ProgrammableTransaction");
+        };
 
-        let sui::Command::MoveCall(call) = &tx.commands.last().unwrap() else {
+        let sui::types::Command::MoveCall(call) = &commands.last().unwrap() else {
             panic!("Expected last command to be a MoveCall to add gas budget");
         };
 
         assert_eq!(call.package, objects.workflow_pkg_id);
-        assert_eq!(
-            call.module,
-            workflow::Gas::ADD_GAS_BUDGET.module.to_string(),
-        );
-        assert_eq!(
-            call.function,
-            workflow::Gas::ADD_GAS_BUDGET.name.to_string()
-        );
+        assert_eq!(call.module, workflow::Gas::ADD_GAS_BUDGET.module);
+        assert_eq!(call.function, workflow::Gas::ADD_GAS_BUDGET.name);
     }
 
     #[test]
@@ -369,23 +411,23 @@ mod tests {
         let owner_cap = sui_mocks::mock_sui_object_ref();
         let cost_per_minute = DEFAULT_COST_PER_MINUTE;
 
-        let mut tx = sui::ProgrammableTransactionBuilder::new();
+        let mut tx = sui::tx::TransactionBuilder::new();
         enable_expiry(&mut tx, &objects, &tool_fqn, &owner_cap, cost_per_minute).unwrap();
-        let tx = tx.finish();
+        let tx = sui_mocks::mock_finish_transaction(tx);
+        let sui::types::TransactionKind::ProgrammableTransaction(
+            sui::types::ProgrammableTransaction { commands, .. },
+        ) = tx.kind
+        else {
+            panic!("Expected a ProgrammableTransaction");
+        };
 
-        let sui::Command::MoveCall(call) = &tx.commands.last().unwrap() else {
+        let sui::types::Command::MoveCall(call) = &commands.last().unwrap() else {
             panic!("Expected last command to be a MoveCall to enable expiry");
         };
 
         assert_eq!(call.package, objects.workflow_pkg_id);
-        assert_eq!(
-            call.module,
-            workflow::GasExtension::ENABLE_EXPIRY.module.to_string(),
-        );
-        assert_eq!(
-            call.function,
-            workflow::GasExtension::ENABLE_EXPIRY.name.to_string()
-        );
+        assert_eq!(call.module, workflow::GasExtension::ENABLE_EXPIRY.module);
+        assert_eq!(call.function, workflow::GasExtension::ENABLE_EXPIRY.name);
     }
 
     #[test]
@@ -394,23 +436,23 @@ mod tests {
         let tool_fqn = fqn!("xyz.test.tool@1");
         let owner_cap = sui_mocks::mock_sui_object_ref();
 
-        let mut tx = sui::ProgrammableTransactionBuilder::new();
+        let mut tx = sui::tx::TransactionBuilder::new();
         disable_expiry(&mut tx, &objects, &tool_fqn, &owner_cap).unwrap();
-        let tx = tx.finish();
+        let tx = sui_mocks::mock_finish_transaction(tx);
+        let sui::types::TransactionKind::ProgrammableTransaction(
+            sui::types::ProgrammableTransaction { commands, .. },
+        ) = tx.kind
+        else {
+            panic!("Expected a ProgrammableTransaction");
+        };
 
-        let sui::Command::MoveCall(call) = &tx.commands.last().unwrap() else {
+        let sui::types::Command::MoveCall(call) = &commands.last().unwrap() else {
             panic!("Expected last command to be a MoveCall to disable expiry");
         };
 
         assert_eq!(call.package, objects.workflow_pkg_id);
-        assert_eq!(
-            call.module,
-            workflow::GasExtension::DISABLE_EXPIRY.module.to_string(),
-        );
-        assert_eq!(
-            call.function,
-            workflow::GasExtension::DISABLE_EXPIRY.name.to_string()
-        );
+        assert_eq!(call.module, workflow::GasExtension::DISABLE_EXPIRY.module);
+        assert_eq!(call.function, workflow::GasExtension::DISABLE_EXPIRY.name);
     }
 
     #[test]
@@ -420,26 +462,28 @@ mod tests {
         let pay_with = sui_mocks::mock_sui_object_ref();
         let minutes = 60;
 
-        let mut tx = sui::ProgrammableTransactionBuilder::new();
+        let mut tx = sui::tx::TransactionBuilder::new();
         buy_expiry_gas_ticket(&mut tx, &objects, &tool_fqn, &pay_with, minutes).unwrap();
-        let tx = tx.finish();
+        let tx = sui_mocks::mock_finish_transaction(tx);
+        let sui::types::TransactionKind::ProgrammableTransaction(
+            sui::types::ProgrammableTransaction { commands, .. },
+        ) = tx.kind
+        else {
+            panic!("Expected a ProgrammableTransaction");
+        };
 
-        let sui::Command::MoveCall(call) = &tx.commands.last().unwrap() else {
+        let sui::types::Command::MoveCall(call) = &commands.last().unwrap() else {
             panic!("Expected last command to be a MoveCall to buy expiry gas ticket");
         };
 
         assert_eq!(call.package, objects.workflow_pkg_id);
         assert_eq!(
             call.module,
-            workflow::GasExtension::BUY_EXPIRY_GAS_TICKET
-                .module
-                .to_string(),
+            workflow::GasExtension::BUY_EXPIRY_GAS_TICKET.module
         );
         assert_eq!(
             call.function,
-            workflow::GasExtension::BUY_EXPIRY_GAS_TICKET
-                .name
-                .to_string()
+            workflow::GasExtension::BUY_EXPIRY_GAS_TICKET.name
         );
     }
 
@@ -452,7 +496,7 @@ mod tests {
         let min_invocations = 10;
         let max_invocations = 100;
 
-        let mut tx = sui::ProgrammableTransactionBuilder::new();
+        let mut tx = sui::tx::TransactionBuilder::new();
         enable_limited_invocations(
             &mut tx,
             &objects,
@@ -463,24 +507,26 @@ mod tests {
             max_invocations,
         )
         .unwrap();
-        let tx = tx.finish();
+        let tx = sui_mocks::mock_finish_transaction(tx);
+        let sui::types::TransactionKind::ProgrammableTransaction(
+            sui::types::ProgrammableTransaction { commands, .. },
+        ) = tx.kind
+        else {
+            panic!("Expected a ProgrammableTransaction");
+        };
 
-        let sui::Command::MoveCall(call) = &tx.commands.last().unwrap() else {
+        let sui::types::Command::MoveCall(call) = &commands.last().unwrap() else {
             panic!("Expected last command to be a MoveCall to enable limited invocations");
         };
 
         assert_eq!(call.package, objects.workflow_pkg_id);
         assert_eq!(
             call.module,
-            workflow::GasExtension::ENABLE_LIMITED_INVOCATIONS
-                .module
-                .to_string(),
+            workflow::GasExtension::ENABLE_LIMITED_INVOCATIONS.module
         );
         assert_eq!(
             call.function,
-            workflow::GasExtension::ENABLE_LIMITED_INVOCATIONS
-                .name
-                .to_string()
+            workflow::GasExtension::ENABLE_LIMITED_INVOCATIONS.name
         );
     }
 
@@ -490,26 +536,28 @@ mod tests {
         let tool_fqn = fqn!("xyz.test.tool@1");
         let owner_cap = sui_mocks::mock_sui_object_ref();
 
-        let mut tx = sui::ProgrammableTransactionBuilder::new();
+        let mut tx = sui::tx::TransactionBuilder::new();
         disable_limited_invocations(&mut tx, &objects, &tool_fqn, &owner_cap).unwrap();
-        let tx = tx.finish();
+        let tx = sui_mocks::mock_finish_transaction(tx);
+        let sui::types::TransactionKind::ProgrammableTransaction(
+            sui::types::ProgrammableTransaction { commands, .. },
+        ) = tx.kind
+        else {
+            panic!("Expected a ProgrammableTransaction");
+        };
 
-        let sui::Command::MoveCall(call) = &tx.commands.last().unwrap() else {
+        let sui::types::Command::MoveCall(call) = &commands.last().unwrap() else {
             panic!("Expected last command to be a MoveCall to disable limited invocations");
         };
 
         assert_eq!(call.package, objects.workflow_pkg_id);
         assert_eq!(
             call.module,
-            workflow::GasExtension::DISABLE_LIMITED_INVOCATIONS
-                .module
-                .to_string(),
+            workflow::GasExtension::DISABLE_LIMITED_INVOCATIONS.module
         );
         assert_eq!(
             call.function,
-            workflow::GasExtension::DISABLE_LIMITED_INVOCATIONS
-                .name
-                .to_string()
+            workflow::GasExtension::DISABLE_LIMITED_INVOCATIONS.name
         );
     }
 
@@ -520,27 +568,29 @@ mod tests {
         let pay_with = sui_mocks::mock_sui_object_ref();
         let invocations = 100;
 
-        let mut tx = sui::ProgrammableTransactionBuilder::new();
+        let mut tx = sui::tx::TransactionBuilder::new();
         buy_limited_invocations_gas_ticket(&mut tx, &objects, &tool_fqn, &pay_with, invocations)
             .unwrap();
-        let tx = tx.finish();
+        let tx = sui_mocks::mock_finish_transaction(tx);
+        let sui::types::TransactionKind::ProgrammableTransaction(
+            sui::types::ProgrammableTransaction { commands, .. },
+        ) = tx.kind
+        else {
+            panic!("Expected a ProgrammableTransaction");
+        };
 
-        let sui::Command::MoveCall(call) = &tx.commands.last().unwrap() else {
+        let sui::types::Command::MoveCall(call) = &commands.last().unwrap() else {
             panic!("Expected last command to be a MoveCall to buy limited invocations gas ticket");
         };
 
         assert_eq!(call.package, objects.workflow_pkg_id);
         assert_eq!(
             call.module,
-            workflow::GasExtension::BUY_LIMITED_INVOCATIONS_GAS_TICKET
-                .module
-                .to_string(),
+            workflow::GasExtension::BUY_LIMITED_INVOCATIONS_GAS_TICKET.module
         );
         assert_eq!(
             call.function,
-            workflow::GasExtension::BUY_LIMITED_INVOCATIONS_GAS_TICKET
-                .name
-                .to_string()
+            workflow::GasExtension::BUY_LIMITED_INVOCATIONS_GAS_TICKET.name
         );
     }
 }
diff --git a/sdk/src/transactions/mod.rs b/sdk/src/transactions/mod.rs
index b73d0180..7087a04e 100644
--- a/sdk/src/transactions/mod.rs
+++ b/sdk/src/transactions/mod.rs
@@ -9,3 +9,6 @@ pub mod gas;
 
 /// Transactions concerning operations around Nexus cryptography.
 pub mod crypto;
+
+/// Transactions concerning operations around the scheduler.
+pub mod scheduler;
diff --git a/sdk/src/transactions/scheduler.rs b/sdk/src/transactions/scheduler.rs
new file mode 100644
index 00000000..2d42a461
--- /dev/null
+++ b/sdk/src/transactions/scheduler.rs
@@ -0,0 +1,1733 @@
+use {
+    crate::{
+        idents::{move_std, primitives, pure_arg, sui_framework, workflow},
+        sui,
+        types::{DataStorage, NexusObjects, Storable, StorageKind},
+    },
+    serde::{Deserialize, Serialize},
+    std::collections::HashMap,
+};
+
+/// Generator variants supported by the scheduler when executing occurrences.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub enum OccurrenceGenerator {
+    Queue,
+    Periodic,
+}
+
+/// Arguments required to configure periodic scheduling in the PTB.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct PeriodicScheduleInputs {
+    pub first_start_ms: u64,
+    pub period_ms: u64,
+    pub deadline_offset_ms: Option<u64>,
+    pub max_iterations: Option<u64>,
+    pub priority_fee_per_gas_unit: u64,
+}
+
+// Shared helper for turning a scheduler task object ref into a mutable shared argument.
+fn shared_task_arg(
+    tx: &mut sui::tx::TransactionBuilder,
+    task: &sui::types::ObjectReference,
+) -> anyhow::Result<sui::types::Argument> {
+    Ok(tx.input(sui::tx::Input::shared(
+        *task.object_id(),
+        task.version(),
+        true,
+    )))
+}
+
+// == Metadata ==
+
+/// PTB template to build task metadata from key/value pairs.
+pub fn new_metadata<K, V>(
+    tx: &mut sui::tx::TransactionBuilder,
+    objects: &NexusObjects,
+    key_values: impl IntoIterator<Item = (K, V)>,
+) -> anyhow::Result<sui::types::Argument>
+where
+    K: AsRef<str>,
+    V: AsRef<str>,
+{
+    let string_type = move_std::StdString::type_tag();
+
+    let metadata = tx.move_call(
+        sui::tx::Function::new(
+            sui_framework::PACKAGE_ID,
+            sui_framework::VecMap::EMPTY.module,
+            sui_framework::VecMap::EMPTY.name,
+            vec![string_type.clone(), string_type.clone()],
+        ),
+        vec![],
+    );
+
+    for (key, value) in key_values.into_iter() {
+        let key = tx.input(pure_arg(&key.as_ref().to_string())?);
+
+        let value = tx.input(pure_arg(&value.as_ref().to_string())?);
+
+        tx.move_call(
+            sui::tx::Function::new(
+                sui_framework::PACKAGE_ID,
+                sui_framework::VecMap::INSERT.module,
+                sui_framework::VecMap::INSERT.name,
+                vec![string_type.clone(), string_type.clone()],
+            ),
+            vec![metadata, key, value],
+        );
+    }
+
+    Ok(tx.move_call(
+        sui::tx::Function::new(
+            objects.workflow_pkg_id,
+            workflow::Scheduler::NEW_METADATA.module,
+            workflow::Scheduler::NEW_METADATA.name,
+            vec![],
+        ),
+        vec![metadata],
+    ))
+}
+
+// == Task lifecycle ==
+
+/// PTB template to create a new scheduler task.
+pub fn new_task(
+    tx: &mut sui::tx::TransactionBuilder,
+    objects: &NexusObjects,
+    metadata: sui::types::Argument,
+    constraints: sui::types::Argument,
+    execution: sui::types::Argument,
+) -> anyhow::Result<sui::types::Argument> {
+    Ok(tx.move_call(
+        sui::tx::Function::new(
+            objects.workflow_pkg_id,
+            workflow::Scheduler::NEW.module,
+            workflow::Scheduler::NEW.name,
+            vec![],
+        ),
+        vec![metadata, constraints, execution],
+    ))
+}
+
+/// PTB template to update an existing task metadata bag.
+pub fn update_metadata(
+    tx: &mut sui::tx::TransactionBuilder,
+    objects: &NexusObjects,
+    task: &sui::types::ObjectReference,
+    metadata: sui::types::Argument,
+) -> anyhow::Result<sui::types::Argument> {
+    let task = shared_task_arg(tx, task)?;
+
+    Ok(tx.move_call(
+        sui::tx::Function::new(
+            objects.workflow_pkg_id,
+            workflow::Scheduler::UPDATE_METADATA.module,
+            workflow::Scheduler::UPDATE_METADATA.name,
+            vec![],
+        ),
+        vec![task, metadata],
+    ))
+}
+
+/// PTB template to construct and register the default constraints policy.
+pub fn new_constraints_policy(
+    tx: &mut sui::tx::TransactionBuilder,
+    objects: &NexusObjects,
+    generator: OccurrenceGenerator,
+) -> anyhow::Result<sui::types::Argument> {
+    let symbol_type =
+        primitives::into_type_tag(objects.primitives_pkg_id, primitives::Policy::SYMBOL);
+    let constraint_symbol = match generator {
+        OccurrenceGenerator::Queue => {
+            let witness_tag = workflow::into_type_tag(
+                objects.workflow_pkg_id,
+                workflow::Scheduler::QUEUE_GENERATOR_WITNESS,
+            );
+            tx.move_call(
+                sui::tx::Function::new(
+                    objects.primitives_pkg_id,
+                    primitives::Policy::WITNESS_SYMBOL.module,
+                    primitives::Policy::WITNESS_SYMBOL.name,
+                    vec![witness_tag],
+                ),
+                vec![],
+            )
+        }
+        OccurrenceGenerator::Periodic => {
+            let witness_tag = workflow::into_type_tag(
+                objects.workflow_pkg_id,
+                workflow::Scheduler::PERIODIC_GENERATOR_WITNESS,
+            );
+            tx.move_call(
+                sui::tx::Function::new(
+                    objects.primitives_pkg_id,
+                    primitives::Policy::WITNESS_SYMBOL.module,
+                    primitives::Policy::WITNESS_SYMBOL.name,
+                    vec![witness_tag],
+                ),
+                vec![],
+            )
+        }
+    };
+
+    let constraint_sequence = tx.move_call(
+        sui::tx::Function::new(
+            sui_framework::PACKAGE_ID,
+            sui_framework::TableVec::EMPTY.module,
+            sui_framework::TableVec::EMPTY.name,
+            vec![symbol_type.clone()],
+        ),
+        vec![],
+    );
+
+    tx.move_call(
+        sui::tx::Function::new(
+            sui_framework::PACKAGE_ID,
+            sui_framework::TableVec::PUSH_BACK.module,
+            sui_framework::TableVec::PUSH_BACK.name,
+            vec![symbol_type.clone()],
+        ),
+        vec![constraint_sequence, constraint_symbol],
+    );
+
+    let constraints = tx.move_call(
+        sui::tx::Function::new(
+            objects.workflow_pkg_id,
+            workflow::Scheduler::NEW_CONSTRAINTS_POLICY.module,
+            workflow::Scheduler::NEW_CONSTRAINTS_POLICY.name,
+            vec![],
+        ),
+        vec![constraint_sequence],
+    );
+
+    tx.move_call(
+        sui::tx::Function::new(
+            sui_framework::PACKAGE_ID,
+            sui_framework::TableVec::DROP.module,
+            sui_framework::TableVec::DROP.name,
+            vec![symbol_type.clone()],
+        ),
+        vec![constraint_sequence],
+    );
+
+    match generator {
+        OccurrenceGenerator::Queue => {
+            let queue_state = new_queue_generator_state(tx, objects)?;
+            register_queue_generator(tx, objects, constraints, queue_state)?;
+        }
+        OccurrenceGenerator::Periodic => {
+            let periodic_state = new_periodic_generator_state(tx, objects)?;
+            register_periodic_generator(tx, objects, constraints, periodic_state)?;
+        }
+    };
+
+    Ok(constraints)
+}
+
+/// PTB template to construct a queue generator state.
+pub fn new_queue_generator_state(
+    tx: &mut sui::tx::TransactionBuilder,
+    objects: &NexusObjects,
+) -> anyhow::Result<sui::types::Argument> {
+    Ok(tx.move_call(
+        sui::tx::Function::new(
+            objects.workflow_pkg_id,
+            workflow::Scheduler::NEW_QUEUE_GENERATOR_STATE.module,
+            workflow::Scheduler::NEW_QUEUE_GENERATOR_STATE.name,
+            vec![],
+        ),
+        vec![],
+    ))
+}
+
+/// PTB template to register the queue generator state.
+pub fn register_queue_generator(
+    tx: &mut sui::tx::TransactionBuilder,
+    objects: &NexusObjects,
+    constraints: sui::types::Argument,
+    queue_state: sui::types::Argument,
+) -> anyhow::Result<()> {
+    tx.move_call(
+        sui::tx::Function::new(
+            objects.workflow_pkg_id,
+            workflow::Scheduler::REGISTER_QUEUE_GENERATOR.module,
+            workflow::Scheduler::REGISTER_QUEUE_GENERATOR.name,
+            vec![],
+        ),
+        vec![constraints, queue_state],
+    );
+
+    Ok(())
+}
+
+/// PTB template to construct a periodic generator state.
+pub fn new_periodic_generator_state(
+    tx: &mut sui::tx::TransactionBuilder,
+    objects: &NexusObjects,
+) -> anyhow::Result<sui::types::Argument> {
+    Ok(tx.move_call(
+        sui::tx::Function::new(
+            objects.workflow_pkg_id,
+            workflow::Scheduler::NEW_PERIODIC_GENERATOR_STATE.module,
+            workflow::Scheduler::NEW_PERIODIC_GENERATOR_STATE.name,
+            vec![],
+        ),
+        vec![],
+    ))
+}
+
+/// PTB template to register the periodic generator state.
+pub fn register_periodic_generator(
+    tx: &mut sui::tx::TransactionBuilder,
+    objects: &NexusObjects,
+    constraints: sui::types::Argument,
+    periodic_state: sui::types::Argument,
+) -> anyhow::Result<()> {
+    tx.move_call(
+        sui::tx::Function::new(
+            objects.workflow_pkg_id,
+            workflow::Scheduler::REGISTER_PERIODIC_GENERATOR.module,
+            workflow::Scheduler::REGISTER_PERIODIC_GENERATOR.name,
+            vec![],
+        ),
+        vec![constraints, periodic_state],
+    );
+
+    Ok(())
+}
+
+/// PTB template to construct and register the default execution policy.
+#[allow(clippy::too_many_arguments)]
+pub fn new_execution_policy(
+    tx: &mut sui::tx::TransactionBuilder,
+    objects: &NexusObjects,
+    dag_id: sui::types::Address,
+    priority_fee_per_gas_unit: u64,
+    entry_group: &str,
+    input_data: &HashMap<String, HashMap<String, DataStorage>>,
+) -> anyhow::Result<sui::types::Argument> {
+    let symbol_type =
+        primitives::into_type_tag(objects.primitives_pkg_id, primitives::Policy::SYMBOL);
+    let witness_tag = workflow::into_type_tag(
+        objects.workflow_pkg_id,
+        workflow::DefaultTap::BEGIN_DAG_EXECUTION_WITNESS,
+    );
+
+    let execution_symbol = tx.move_call(
+        sui::tx::Function::new(
+            objects.primitives_pkg_id,
+            primitives::Policy::WITNESS_SYMBOL.module,
+            primitives::Policy::WITNESS_SYMBOL.name,
+            vec![witness_tag],
+        ),
+        vec![],
+    );
+
+    let execution_sequence = tx.move_call(
+        sui::tx::Function::new(
+            sui_framework::PACKAGE_ID,
+            sui_framework::TableVec::EMPTY.module,
+            sui_framework::TableVec::EMPTY.name,
+            vec![symbol_type.clone()],
+        ),
+        vec![],
+    );
+
+    tx.move_call(
+        sui::tx::Function::new(
+            sui_framework::PACKAGE_ID,
+            sui_framework::TableVec::PUSH_BACK.module,
+            sui_framework::TableVec::PUSH_BACK.name,
+            vec![symbol_type.clone()],
+        ),
+        vec![execution_sequence, execution_symbol],
+    );
+
+    let execution = tx.move_call(
+        sui::tx::Function::new(
+            objects.workflow_pkg_id,
+            workflow::Scheduler::NEW_EXECUTION_POLICY.module,
+            workflow::Scheduler::NEW_EXECUTION_POLICY.name,
+            vec![],
+        ),
+        vec![execution_sequence],
+    );
+
+    tx.move_call(
+        sui::tx::Function::new(
+            sui_framework::PACKAGE_ID,
+            sui_framework::TableVec::DROP.module,
+            sui_framework::TableVec::DROP.name,
+            vec![symbol_type.clone()],
+        ),
+        vec![execution_sequence],
+    );
+
+    let dag_id_arg = sui_framework::Object::id_from_object_id(tx, dag_id)?;
+    let network_id_arg = sui_framework::Object::id_from_object_id(tx, objects.network_id)?;
+    let priority_fee_per_gas_unit = tx.input(pure_arg(&priority_fee_per_gas_unit)?);
+
+    let entry_group =
+        workflow::Dag::entry_group_from_str(tx, objects.workflow_pkg_id, entry_group)?;
+
+    let with_vertex_inputs = build_inputs_vec_map(tx, objects, input_data)?;
+
+    let config = tx.move_call(
+        sui::tx::Function::new(
+            objects.workflow_pkg_id,
+            workflow::Dag::NEW_DAG_EXECUTION_CONFIG.module,
+            workflow::Dag::NEW_DAG_EXECUTION_CONFIG.name,
+            vec![],
+        ),
+        vec![
+            dag_id_arg,
+            network_id_arg,
+            entry_group,
+            with_vertex_inputs,
+            priority_fee_per_gas_unit,
+        ],
+    );
+
+    register_begin_execution(tx, objects, execution, config)?;
+
+    Ok(execution)
+}
+
+fn build_inputs_vec_map(
+    tx: &mut sui::tx::TransactionBuilder,
+    objects: &NexusObjects,
+    input_data: &HashMap<String, HashMap<String, DataStorage>>,
+) -> anyhow::Result<sui::types::Argument> {
+    let inner_vec_map_type = vec![
+        workflow::into_type_tag(objects.workflow_pkg_id, workflow::Dag::INPUT_PORT),
+        primitives::into_type_tag(objects.primitives_pkg_id, primitives::Data::NEXUS_DATA),
+    ];
+
+    let outer_vec_map_type = vec![
+        workflow::into_type_tag(objects.workflow_pkg_id, workflow::Dag::VERTEX),
+        sui::types::TypeTag::Struct(Box::new(sui::types::StructTag::new(
+            sui_framework::PACKAGE_ID,
+            sui_framework::VecMap::VEC_MAP.module,
+            sui_framework::VecMap::VEC_MAP.name,
+            inner_vec_map_type.clone(),
+        ))),
+    ];
+
+    let with_vertex_inputs = tx.move_call(
+        sui::tx::Function::new(
+            sui_framework::PACKAGE_ID,
+            sui_framework::VecMap::EMPTY.module,
+            sui_framework::VecMap::EMPTY.name,
+            outer_vec_map_type.clone(),
+        ),
+        vec![],
+    );
+
+    for (vertex_name, data) in input_data {
+        // `vertex: Vertex`
+        let vertex = workflow::Dag::vertex_from_str(tx, objects.workflow_pkg_id, vertex_name)?;
+
+        // `with_vertex_input: VecMap<InputPort, NexusData>`
+        let with_vertex_input = tx.move_call(
+            sui::tx::Function::new(
+                sui_framework::PACKAGE_ID,
+                sui_framework::VecMap::EMPTY.module,
+                sui_framework::VecMap::EMPTY.name,
+                inner_vec_map_type.clone(),
+            ),
+            vec![],
+        );
+
+        for (port_name, value) in data {
+            // `port: InputPort`
+            let port = match value.is_encrypted() {
+                true => workflow::Dag::encrypted_input_port_from_str(
+                    tx,
+                    objects.workflow_pkg_id,
+                    port_name.as_str(),
+                )?,
+                false => workflow::Dag::input_port_from_str(
+                    tx,
+                    objects.workflow_pkg_id,
+                    port_name.as_str(),
+                )?,
+            };
+
+            // `value: NexusData`
+            let value = match value.storage_kind() {
+                StorageKind::Inline => primitives::Data::nexus_data_inline_from_json(
+                    tx,
+                    objects.primitives_pkg_id,
+                    value.as_json(),
+                    value.is_encrypted(),
+                )?,
+                StorageKind::Walrus => primitives::Data::nexus_data_walrus_from_json(
+                    tx,
+                    objects.primitives_pkg_id,
+                    value.as_json(),
+                    value.is_encrypted(),
+                )?,
+            };
+
+            // `with_vertex_input.insert(port, value)`
+            tx.move_call(
+                sui::tx::Function::new(
+                    sui_framework::PACKAGE_ID,
+                    sui_framework::VecMap::INSERT.module,
+                    sui_framework::VecMap::INSERT.name,
+                    inner_vec_map_type.clone(),
+                ),
+                vec![with_vertex_input, port, value],
+            );
+        }
+
+        // `with_vertex_inputs.insert(vertex, with_vertex_input)`
+        tx.move_call(
+            sui::tx::Function::new(
+                sui_framework::PACKAGE_ID,
+                sui_framework::VecMap::INSERT.module,
+                sui_framework::VecMap::INSERT.name,
+                outer_vec_map_type.clone(),
+            ),
+            vec![with_vertex_inputs, vertex, with_vertex_input],
+        );
+    }
+
+    Ok(with_vertex_inputs)
+}
+
+/// PTB template to obtain the execution witness for a task.
+pub fn execute(
+    tx: &mut sui::tx::TransactionBuilder,
+    objects: &NexusObjects,
+    task: &sui::types::ObjectReference,
+) -> anyhow::Result<sui::types::Argument> {
+    let task = shared_task_arg(tx, task)?;
+
+    Ok(tx.move_call(
+        sui::tx::Function::new(
+            objects.workflow_pkg_id,
+            workflow::Scheduler::EXECUTE.module,
+            workflow::Scheduler::EXECUTE.name,
+            vec![],
+        ),
+        vec![task],
+    ))
+}
+
+/// PTB template to finalize a task execution.
+pub fn finish(
+    tx: &mut sui::tx::TransactionBuilder,
+    objects: &NexusObjects,
+    task: &sui::types::ObjectReference,
+    proof: sui::types::Argument,
+) -> anyhow::Result<sui::types::Argument> {
+    let task = shared_task_arg(tx, task)?;
+
+    Ok(tx.move_call(
+        sui::tx::Function::new(
+            objects.workflow_pkg_id,
+            workflow::Scheduler::FINISH.module,
+            workflow::Scheduler::FINISH.name,
+            vec![],
+        ),
+        vec![task, proof],
+    ))
+}
+
+// == Occurrence scheduling ==
+
+/// PTB template to enqueue a new occurrence with absolute start time.
+pub fn add_occurrence_absolute_for_task(
+    tx: &mut sui::tx::TransactionBuilder,
+    objects: &NexusObjects,
+    task: &sui::types::ObjectReference,
+    start_time_ms: u64,
+    deadline_offset_ms: Option<u64>,
+    priority_fee_per_gas_unit: u64,
+) -> anyhow::Result<sui::types::Argument> {
+    // `task: &mut Task`
+    let task = shared_task_arg(tx, task)?;
+
+    // `start_time_ms: u64`
+    let start_time_ms = tx.input(pure_arg(&start_time_ms)?);
+
+    // `deadline_offset_ms: option::Option<u64>`
+    let deadline_offset_ms = tx.input(pure_arg(&deadline_offset_ms)?);
+
+    // `priority_fee_per_gas_unit: u64`
+    let priority_fee_per_gas_unit = tx.input(pure_arg(&priority_fee_per_gas_unit)?);
+
+    // `clock: &Clock`
+    let clock = tx.input(sui::tx::Input::shared(
+        sui_framework::CLOCK_OBJECT_ID,
+        1,
+        false,
+    ));
+
+    Ok(tx.move_call(
+        sui::tx::Function::new(
+            objects.workflow_pkg_id,
+            workflow::Scheduler::ADD_OCCURRENCE_ABSOLUTE_FOR_TASK.module,
+            workflow::Scheduler::ADD_OCCURRENCE_ABSOLUTE_FOR_TASK.name,
+            vec![],
+        ),
+        vec![
+            task,
+            start_time_ms,
+            deadline_offset_ms,
+            priority_fee_per_gas_unit,
+            clock,
+        ],
+    ))
+}
+
+/// PTB template to enqueue a new occurrence relative to the current clock time.
+pub fn add_occurrence_relative_for_task(
+    tx: &mut sui::tx::TransactionBuilder,
+    objects: &NexusObjects,
+    task: &sui::types::ObjectReference,
+    start_offset_ms: u64,
+    deadline_offset_ms: Option<u64>,
+    priority_fee_per_gas_unit: u64,
+) -> anyhow::Result<sui::types::Argument> {
+    // `task: &mut Task`
+    let task = shared_task_arg(tx, task)?;
+
+    // `start_offset_ms: u64`
+    let start_offset_ms = tx.input(pure_arg(&start_offset_ms)?);
+
+    // `deadline_offset_ms: option::Option<u64>`
+    let deadline_offset_ms = tx.input(pure_arg(&deadline_offset_ms)?);
+
+    // `priority_fee_per_gas_unit: u64`
+    let priority_fee_per_gas_unit = tx.input(pure_arg(&priority_fee_per_gas_unit)?);
+
+    // `clock: &Clock`
+    let clock = tx.input(sui::tx::Input::shared(
+        sui_framework::CLOCK_OBJECT_ID,
+        1,
+        false,
+    ));
+
+    Ok(tx.move_call(
+        sui::tx::Function::new(
+            objects.workflow_pkg_id,
+            workflow::Scheduler::ADD_OCCURRENCE_RELATIVE_FOR_TASK.module,
+            workflow::Scheduler::ADD_OCCURRENCE_RELATIVE_FOR_TASK.name,
+            vec![],
+        ),
+        vec![
+            task,
+            start_offset_ms,
+            deadline_offset_ms,
+            priority_fee_per_gas_unit,
+            clock,
+        ],
+    ))
+}
+
+// == Periodic scheduling ==
+
+/// PTB template to configure or update periodic scheduling.
+#[warn(clippy::too_many_arguments)]
+pub fn new_or_modify_periodic_for_task(
+    tx: &mut sui::tx::TransactionBuilder,
+    objects: &NexusObjects,
+    task: &sui::types::ObjectReference,
+    schedule: PeriodicScheduleInputs,
+) -> anyhow::Result<sui::types::Argument> {
+    let PeriodicScheduleInputs {
+        first_start_ms,
+        period_ms,
+        deadline_offset_ms,
+        max_iterations,
+        priority_fee_per_gas_unit,
+    } = schedule;
+
+    // `task: &mut Task`
+    let task = shared_task_arg(tx, task)?;
+
+    // `first_start_ms: u64`
+    let first_start_ms = tx.input(pure_arg(&first_start_ms)?);
+
+    // `period_ms: u64`
+    let period_ms = tx.input(pure_arg(&period_ms)?);
+
+    // `deadline_offset_ms: option::Option<u64>`
+    let deadline_offset_ms = tx.input(pure_arg(&deadline_offset_ms)?);
+
+    // `max_iterations: option::Option<u64>`
+    let max_iterations = tx.input(pure_arg(&max_iterations)?);
+
+    // `priority_fee_per_gas_unit: u64`
+    let priority_fee_per_gas_unit = tx.input(pure_arg(&priority_fee_per_gas_unit)?);
+
+    Ok(tx.move_call(
+        sui::tx::Function::new(
+            objects.workflow_pkg_id,
+            workflow::Scheduler::NEW_OR_MODIFY_PERIODIC_FOR_TASK.module,
+            workflow::Scheduler::NEW_OR_MODIFY_PERIODIC_FOR_TASK.name,
+            vec![],
+        ),
+        vec![
+            task,
+            first_start_ms,
+            period_ms,
+            deadline_offset_ms,
+            max_iterations,
+            priority_fee_per_gas_unit,
+        ],
+    ))
+}
+
+/// PTB template to disable periodic scheduling for a task.
+pub fn disable_periodic_for_task(
+    tx: &mut sui::tx::TransactionBuilder,
+    objects: &NexusObjects,
+    task: &sui::types::ObjectReference,
+) -> anyhow::Result<sui::types::Argument> {
+    let task = shared_task_arg(tx, task)?;
+
+    Ok(tx.move_call(
+        sui::tx::Function::new(
+            objects.workflow_pkg_id,
+            workflow::Scheduler::DISABLE_PERIODIC_FOR_TASK.module,
+            workflow::Scheduler::DISABLE_PERIODIC_FOR_TASK.name,
+            vec![],
+        ),
+        vec![task],
+    ))
+}
+
+// == Constraint state management ==
+
+/// PTB template to pause scheduling for a task.
+pub fn pause_time_constraint_for_task(
+    tx: &mut sui::tx::TransactionBuilder,
+    objects: &NexusObjects,
+    task: &sui::types::ObjectReference,
+) -> anyhow::Result<sui::types::Argument> {
+    let task = shared_task_arg(tx, task)?;
+
+    Ok(tx.move_call(
+        sui::tx::Function::new(
+            objects.workflow_pkg_id,
+            workflow::Scheduler::PAUSE_TIME_CONSTRAINT_FOR_TASK.module,
+            workflow::Scheduler::PAUSE_TIME_CONSTRAINT_FOR_TASK.name,
+            vec![],
+        ),
+        vec![task],
+    ))
+}
+
+/// PTB template to resume scheduling for a task.
+pub fn resume_time_constraint_for_task(
+    tx: &mut sui::tx::TransactionBuilder,
+    objects: &NexusObjects,
+    task: &sui::types::ObjectReference,
+) -> anyhow::Result<sui::types::Argument> {
+    let task = shared_task_arg(tx, task)?;
+
+    Ok(tx.move_call(
+        sui::tx::Function::new(
+            objects.workflow_pkg_id,
+            workflow::Scheduler::RESUME_TIME_CONSTRAINT_FOR_TASK.module,
+            workflow::Scheduler::RESUME_TIME_CONSTRAINT_FOR_TASK.name,
+            vec![],
+        ),
+        vec![task],
+    ))
+}
+
+/// PTB template to cancel scheduling for a task.
+pub fn cancel_time_constraint_for_task(
+    tx: &mut sui::tx::TransactionBuilder,
+    objects: &NexusObjects,
+    task: &sui::types::ObjectReference,
+) -> anyhow::Result<sui::types::Argument> {
+    let task = shared_task_arg(tx, task)?;
+
+    Ok(tx.move_call(
+        sui::tx::Function::new(
+            objects.workflow_pkg_id,
+            workflow::Scheduler::CANCEL_TIME_CONSTRAINT_FOR_TASK.module,
+            workflow::Scheduler::CANCEL_TIME_CONSTRAINT_FOR_TASK.name,
+            vec![],
+        ),
+        vec![task],
+    ))
+}
+
+// == Execution flow ==
+
+/// PTB template to consume the next queued occurrence.
+pub fn check_queue_occurrence(
+    tx: &mut sui::tx::TransactionBuilder,
+    objects: &NexusObjects,
+    task: &sui::types::ObjectReference,
+) -> anyhow::Result<sui::types::Argument> {
+    let task = shared_task_arg(tx, task)?;
+    let clock = tx.input(sui::tx::Input::shared(
+        sui_framework::CLOCK_OBJECT_ID,
+        1,
+        false,
+    ));
+
+    Ok(tx.move_call(
+        sui::tx::Function::new(
+            objects.workflow_pkg_id,
+            workflow::Scheduler::CHECK_QUEUE_OCCURRENCE.module,
+            workflow::Scheduler::CHECK_QUEUE_OCCURRENCE.name,
+            vec![],
+        ),
+        vec![task, clock],
+    ))
+}
+
+/// PTB template to consume the next periodic occurrence.
+pub fn check_periodic_occurrence(
+    tx: &mut sui::tx::TransactionBuilder,
+    objects: &NexusObjects,
+    task: &sui::types::ObjectReference,
+) -> anyhow::Result<sui::types::Argument> {
+    let task = shared_task_arg(tx, task)?;
+    let clock = tx.input(sui::tx::Input::shared(
+        sui_framework::CLOCK_OBJECT_ID,
+        1,
+        false,
+    ));
+
+    Ok(tx.move_call(
+        sui::tx::Function::new(
+            objects.workflow_pkg_id,
+            workflow::Scheduler::CHECK_PERIODIC_OCCURRENCE.module,
+            workflow::Scheduler::CHECK_PERIODIC_OCCURRENCE.name,
+            vec![],
+        ),
+        vec![task, clock],
+    ))
+}
+
+/// PTB template to register DAG execution config on the execution policy.
+pub fn register_begin_execution(
+    tx: &mut sui::tx::TransactionBuilder,
+    objects: &NexusObjects,
+    policy: sui::types::Argument,
+    config: sui::types::Argument,
+) -> anyhow::Result<sui::types::Argument> {
+    Ok(tx.move_call(
+        sui::tx::Function::new(
+            objects.workflow_pkg_id,
+            workflow::DefaultTap::REGISTER_BEGIN_EXECUTION.module,
+            workflow::DefaultTap::REGISTER_BEGIN_EXECUTION.name,
+            vec![],
+        ),
+        vec![policy, config],
+    ))
+}
+
+/// PTB template to invoke DAG execution from the scheduler via the Default TAP.
+#[allow(clippy::too_many_arguments)]
+pub fn dag_begin_execution_from_scheduler(
+    tx: &mut sui::tx::TransactionBuilder,
+    objects: &NexusObjects,
+    task: &sui::types::ObjectReference,
+    dag: &sui::types::ObjectReference,
+    leader_cap: &sui::types::ObjectReference,
+    amount_execution: u64,
+    amount_priority: u64,
+) -> anyhow::Result<sui::types::Argument> {
+    // `self: &mut DefaultTAP`
+    let tap = tx.input(sui::tx::Input::shared(
+        *objects.default_tap.object_id(),
+        objects.default_tap.version(),
+        true,
+    ));
+
+    // `task: &mut Task`
+    let task = shared_task_arg(tx, task)?;
+
+    // `dag: &DAG`
+    let dag = tx.input(sui::tx::Input::shared(
+        *dag.object_id(),
+        dag.version(),
+        false,
+    ));
+
+    // `gas_service: &mut GasService`
+    let gas_service = tx.input(sui::tx::Input::shared(
+        *objects.gas_service.object_id(),
+        objects.gas_service.version(),
+        true,
+    ));
+
+    // `amount_execution: u64`
+    let amount_execution_arg = tx.input(pure_arg(&amount_execution)?);
+
+    // `amount_priority: u64`
+    let amount_priority_arg = tx.input(pure_arg(&amount_priority)?);
+
+    // `clock: &Clock`
+    let clock = tx.input(sui::tx::Input::shared(
+        sui_framework::CLOCK_OBJECT_ID,
+        1,
+        false,
+    ));
+
+    // `leader_cap: &CloneableOwnerCap<OverNetwork>`
+    let leader_cap = tx.input(sui::tx::Input::shared(
+        *leader_cap.object_id(),
+        leader_cap.version(),
+        false,
+    ));
+
+    Ok(tx.move_call(
+        sui::tx::Function::new(
+            objects.workflow_pkg_id,
+            workflow::DefaultTap::DAG_BEGIN_EXECUTION_FROM_SCHEDULER.module,
+            workflow::DefaultTap::DAG_BEGIN_EXECUTION_FROM_SCHEDULER.name,
+            vec![],
+        ),
+        vec![
+            tap,
+            task,
+            dag,
+            gas_service,
+            leader_cap,
+            amount_execution_arg,
+            amount_priority_arg,
+            clock,
+        ],
+    ))
+}
+
+/// PTB helper that consumes the next scheduled occurrence and invokes the TAP.
+#[allow(clippy::too_many_arguments)]
+pub fn execute_scheduled_occurrence(
+    tx: &mut sui::tx::TransactionBuilder,
+    objects: &NexusObjects,
+    task: &sui::types::ObjectReference,
+    dag: &sui::types::ObjectReference,
+    leader_cap: &sui::types::ObjectReference,
+    amount_execution: u64,
+    amount_priority: u64,
+    generator: OccurrenceGenerator,
+) -> anyhow::Result<()> {
+    // Create shared inputs once so subsequent commands reuse the same arguments.
+    let task_arg = shared_task_arg(tx, task)?;
+    let clock = tx.input(sui::tx::Input::shared(
+        sui_framework::CLOCK_OBJECT_ID,
+        1,
+        false,
+    ));
+
+    // Consume the occurrence and obtain the proof-of-UID hot potato.
+    let proof = match generator {
+        OccurrenceGenerator::Queue => tx.move_call(
+            sui::tx::Function::new(
+                objects.workflow_pkg_id,
+                workflow::Scheduler::CHECK_QUEUE_OCCURRENCE.module,
+                workflow::Scheduler::CHECK_QUEUE_OCCURRENCE.name,
+                vec![],
+            ),
+            vec![task_arg, clock],
+        ),
+        OccurrenceGenerator::Periodic => tx.move_call(
+            sui::tx::Function::new(
+                objects.workflow_pkg_id,
+                workflow::Scheduler::CHECK_PERIODIC_OCCURRENCE.module,
+                workflow::Scheduler::CHECK_PERIODIC_OCCURRENCE.name,
+                vec![],
+            ),
+            vec![task_arg, clock],
+        ),
+    };
+
+    // Begin DAG execution through the TAP.
+    let tap = tx.input(sui::tx::Input::shared(
+        *objects.default_tap.object_id(),
+        objects.default_tap.version(),
+        true,
+    ));
+    let dag = tx.input(sui::tx::Input::shared(
+        *dag.object_id(),
+        dag.version(),
+        false,
+    ));
+    let gas_service = tx.input(sui::tx::Input::shared(
+        *objects.gas_service.object_id(),
+        objects.gas_service.version(),
+        true,
+    ));
+    let leader_cap = tx.input(sui::tx::Input::shared(
+        *leader_cap.object_id(),
+        leader_cap.version(),
+        false,
+    ));
+    let amount_execution_arg = tx.input(pure_arg(&amount_execution)?);
+    let amount_priority_arg = tx.input(pure_arg(&amount_priority)?);
+
+    tx.move_call(
+        sui::tx::Function::new(
+            objects.workflow_pkg_id,
+            workflow::DefaultTap::DAG_BEGIN_EXECUTION_FROM_SCHEDULER.module,
+            workflow::DefaultTap::DAG_BEGIN_EXECUTION_FROM_SCHEDULER.name,
+            vec![],
+        ),
+        vec![
+            tap,
+            task_arg,
+            dag,
+            gas_service,
+            leader_cap,
+            amount_execution_arg,
+            amount_priority_arg,
+            clock,
+        ],
+    );
+
+    // Consume the proof to satisfy Move's non-drop requirement and reset task policies.
+    tx.move_call(
+        sui::tx::Function::new(
+            objects.workflow_pkg_id,
+            workflow::Scheduler::FINISH.module,
+            workflow::Scheduler::FINISH.name,
+            vec![],
+        ),
+        vec![task_arg, proof],
+    );
+
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use {
+        super::*,
+        crate::{sui, test_utils::sui_mocks},
+        assert_matches::assert_matches,
+    };
+
+    struct TxInspector {
+        tx: sui::types::Transaction,
+    }
+
+    impl TxInspector {
+        fn new(tx: sui::types::Transaction) -> Self {
+            Self { tx }
+        }
+
+        fn commands(&self) -> &Vec<sui::types::Command> {
+            let sui::types::TransactionKind::ProgrammableTransaction(
+                sui::types::ProgrammableTransaction { commands, .. },
+            ) = &self.tx.kind
+            else {
+                panic!("expected PTB transaction kind, got {:?}", self.tx.kind);
+            };
+
+            commands
+        }
+
+        fn inputs(&self) -> &Vec<sui::types::Input> {
+            let sui::types::TransactionKind::ProgrammableTransaction(
+                sui::types::ProgrammableTransaction { inputs, .. },
+            ) = &self.tx.kind
+            else {
+                panic!("expected PTB transaction kind, got {:?}", self.tx.kind);
+            };
+
+            inputs
+        }
+
+        fn move_call(&self, index: usize) -> &sui::types::MoveCall {
+            match self.commands().get(index) {
+                Some(sui::types::Command::MoveCall(call)) => call,
+                Some(other) => panic!("expected MoveCall at index {index}, got {other:?}"),
+                None => panic!("missing command at index {index}"),
+            }
+        }
+
+        fn input(&self, argument: &sui::types::Argument) -> &sui::types::Input {
+            let sui::types::Argument::Input(index) = argument else {
+                panic!("expected Argument::Input, got {argument:?}");
+            };
+
+            self.inputs()
+                .get(*index as usize)
+                .unwrap_or_else(|| panic!("missing input for index {index}"))
+        }
+
+        fn expect_shared_object(
+            &self,
+            argument: &sui::types::Argument,
+            expected: &sui::types::ObjectReference,
+            mutable: bool,
+        ) {
+            let sui::types::Input::Shared {
+                object_id,
+                initial_shared_version,
+                mutable: actual_mutable,
+            } = self.input(argument)
+            else {
+                panic!(
+                    "expected shared object argument, got {:?}",
+                    self.input(argument)
+                );
+            };
+
+            assert_eq!(object_id, expected.object_id());
+            assert_eq!(*initial_shared_version, expected.version());
+            assert_eq!(*actual_mutable, mutable);
+        }
+
+        fn expect_clock(&self, argument: &sui::types::Argument) {
+            let sui::types::Input::Shared {
+                object_id,
+                initial_shared_version,
+                mutable,
+            } = self.input(argument)
+            else {
+                panic!(
+                    "expected clock shared object argument, got {:?}",
+                    self.input(argument)
+                );
+            };
+
+            assert_eq!(*object_id, sui_framework::CLOCK_OBJECT_ID);
+            assert_eq!(*initial_shared_version, 1);
+            assert!(!*mutable, "clock object must be immutable");
+        }
+
+        fn expect_pure_bytes(&self, argument: &sui::types::Argument, expected: &[u8]) {
+            let sui::types::Input::Pure { value } = self.input(argument) else {
+                panic!("expected pure argument, got {:?}", self.input(argument));
+            };
+
+            assert_eq!(value.as_slice(), expected);
+        }
+
+        fn expect_u64(&self, argument: &sui::types::Argument, value: u64) {
+            self.expect_pure_bytes(argument, &value.to_le_bytes());
+        }
+
+        fn expect_option_u64(&self, argument: &sui::types::Argument, value: Option<u64>) {
+            match value {
+                Some(inner) => {
+                    let mut bytes = vec![1];
+                    bytes.extend_from_slice(&inner.to_le_bytes());
+                    self.expect_pure_bytes(argument, &bytes);
+                }
+                None => self.expect_pure_bytes(argument, &[0]),
+            }
+        }
+    }
+
+    #[test]
+    fn new_metadata_builds_vecmap_and_scheduler_calls() {
+        let objects = sui_mocks::mock_nexus_objects();
+        let mut tx = sui::tx::TransactionBuilder::new();
+
+        let scheduler_arg =
+            new_metadata(&mut tx, &objects, [("foo", "bar")]).expect("ptb construction succeeds");
+
+        assert_matches!(scheduler_arg, sui::types::Argument::Result(2));
+
+        let inspector = TxInspector::new(sui_mocks::mock_finish_transaction(tx));
+        assert_eq!(inspector.commands().len(), 3);
+
+        let empty_call = inspector.move_call(0);
+        assert_eq!(empty_call.package, sui_framework::PACKAGE_ID);
+        assert_eq!(empty_call.module, sui_framework::VecMap::EMPTY.module);
+        assert_eq!(empty_call.function, sui_framework::VecMap::EMPTY.name);
+        assert_eq!(empty_call.type_arguments.len(), 2);
+        assert!(empty_call.arguments.is_empty());
+
+        let insert_call = inspector.move_call(1);
+        assert_eq!(insert_call.package, sui_framework::PACKAGE_ID);
+        assert_eq!(insert_call.module, sui_framework::VecMap::INSERT.module);
+        assert_eq!(insert_call.function, sui_framework::VecMap::INSERT.name);
+        assert_eq!(insert_call.type_arguments.len(), 2);
+        assert_eq!(insert_call.arguments.len(), 3);
+
+        let final_call = inspector.move_call(2);
+        assert_eq!(final_call.package, objects.workflow_pkg_id);
+        assert_eq!(final_call.module, workflow::Scheduler::NEW_METADATA.module);
+        assert_eq!(final_call.function, workflow::Scheduler::NEW_METADATA.name);
+        assert!(final_call.type_arguments.is_empty());
+        assert_eq!(final_call.arguments.len(), 1);
+        assert_matches!(final_call.arguments[0], sui::types::Argument::Result(0));
+    }
+
+    #[test]
+    fn new_metadata_handles_empty_iterators() {
+        let objects = sui_mocks::mock_nexus_objects();
+        let mut tx = sui::tx::TransactionBuilder::new();
+
+        let result = new_metadata(
+            &mut tx,
+            &objects,
+            std::iter::empty::<(&'static str, &'static str)>(),
+        )
+        .expect("ptb construction succeeds");
+
+        assert_matches!(result, sui::types::Argument::Result(1));
+
+        let inspector = TxInspector::new(sui_mocks::mock_finish_transaction(tx));
+        assert_eq!(inspector.commands().len(), 2);
+    }
+
+    #[test]
+    fn new_task_builds_call() {
+        let objects = sui_mocks::mock_nexus_objects();
+        let mut tx = sui::tx::TransactionBuilder::new();
+        let metadata = tx.input(pure_arg(&1_u64).unwrap());
+        let constraints = tx.input(pure_arg(&2_u64).unwrap());
+        let execution = tx.input(pure_arg(&3_u64).unwrap());
+
+        let result = new_task(&mut tx, &objects, metadata, constraints, execution)
+            .expect("ptb construction succeeds");
+
+        assert_matches!(result, sui::types::Argument::Result(0));
+
+        let inspector = TxInspector::new(sui_mocks::mock_finish_transaction(tx));
+        assert_eq!(inspector.commands().len(), 1);
+
+        let call = inspector.move_call(0);
+        assert_eq!(call.package, objects.workflow_pkg_id);
+        assert_eq!(call.module, workflow::Scheduler::NEW.module);
+        assert_eq!(call.function, workflow::Scheduler::NEW.name);
+        assert_eq!(call.arguments.len(), 3);
+        inspector.expect_u64(&call.arguments[0], 1);
+        inspector.expect_u64(&call.arguments[1], 2);
+        inspector.expect_u64(&call.arguments[2], 3);
+    }
+
+    #[test]
+    fn update_metadata_uses_shared_task() {
+        let objects = sui_mocks::mock_nexus_objects();
+        let task = sui_mocks::mock_sui_object_ref();
+
+        let mut tx = sui::tx::TransactionBuilder::new();
+        let metadata = tx.input(pure_arg(&9_u64).unwrap());
+
+        update_metadata(&mut tx, &objects, &task, metadata).expect("ptb construction succeeds");
+
+        let inspector = TxInspector::new(sui_mocks::mock_finish_transaction(tx));
+        assert_eq!(inspector.commands().len(), 1);
+        let call = inspector.move_call(0);
+        assert_eq!(call.module, workflow::Scheduler::UPDATE_METADATA.module);
+        assert_eq!(call.function, workflow::Scheduler::UPDATE_METADATA.name);
+        assert_eq!(call.arguments.len(), 2);
+        inspector.expect_shared_object(&call.arguments[0], &task, true);
+        inspector.expect_u64(&call.arguments[1], 9);
+    }
+
+    #[test]
+    fn new_queue_generator_state_has_no_arguments() {
+        let objects = sui_mocks::mock_nexus_objects();
+        let mut tx = sui::tx::TransactionBuilder::new();
+
+        let arg = new_queue_generator_state(&mut tx, &objects).expect("ptb construction succeeds");
+        assert_matches!(arg, sui::types::Argument::Result(0));
+
+        let inspector = TxInspector::new(sui_mocks::mock_finish_transaction(tx));
+        assert_eq!(inspector.commands().len(), 1);
+        let call = inspector.move_call(0);
+        assert!(call.arguments.is_empty());
+        assert_eq!(
+            call.module,
+            workflow::Scheduler::NEW_QUEUE_GENERATOR_STATE.module
+        );
+        assert_eq!(
+            call.function,
+            workflow::Scheduler::NEW_QUEUE_GENERATOR_STATE.name
+        );
+    }
+
+    #[test]
+    fn register_queue_generator_invokes_scheduler() {
+        let objects = sui_mocks::mock_nexus_objects();
+        let mut tx = sui::tx::TransactionBuilder::new();
+        let constraints = tx.input(pure_arg(&11_u64).unwrap());
+        let queue_state = tx.input(pure_arg(&12_u64).unwrap());
+
+        register_queue_generator(&mut tx, &objects, constraints, queue_state)
+            .expect("ptb construction succeeds");
+
+        let inspector = TxInspector::new(sui_mocks::mock_finish_transaction(tx));
+        assert_eq!(inspector.commands().len(), 1);
+        let call = inspector.move_call(0);
+        assert_eq!(
+            call.module,
+            workflow::Scheduler::REGISTER_QUEUE_GENERATOR.module
+        );
+        assert_eq!(
+            call.function,
+            workflow::Scheduler::REGISTER_QUEUE_GENERATOR.name
+        );
+        assert_eq!(call.arguments.len(), 2);
+        inspector.expect_u64(&call.arguments[0], 11);
+        inspector.expect_u64(&call.arguments[1], 12);
+    }
+
+    #[test]
+    fn new_periodic_generator_state_has_no_arguments() {
+        let objects = sui_mocks::mock_nexus_objects();
+        let mut tx = sui::tx::TransactionBuilder::new();
+
+        let arg =
+            new_periodic_generator_state(&mut tx, &objects).expect("ptb construction succeeds");
+        assert_matches!(arg, sui::types::Argument::Result(0));
+
+        let inspector = TxInspector::new(sui_mocks::mock_finish_transaction(tx));
+        assert_eq!(inspector.commands().len(), 1);
+        let call = inspector.move_call(0);
+        assert!(call.arguments.is_empty());
+        assert_eq!(
+            call.module,
+            workflow::Scheduler::NEW_PERIODIC_GENERATOR_STATE.module
+        );
+        assert_eq!(
+            call.function,
+            workflow::Scheduler::NEW_PERIODIC_GENERATOR_STATE.name
+        );
+    }
+
+    #[test]
+    fn register_periodic_generator_invokes_scheduler() {
+        let objects = sui_mocks::mock_nexus_objects();
+        let mut tx = sui::tx::TransactionBuilder::new();
+        let constraints = tx.input(pure_arg(&21_u64).unwrap());
+        let periodic_state = tx.input(pure_arg(&22_u64).unwrap());
+
+        register_periodic_generator(&mut tx, &objects, constraints, periodic_state)
+            .expect("ptb construction succeeds");
+
+        let inspector = TxInspector::new(sui_mocks::mock_finish_transaction(tx));
+        assert_eq!(inspector.commands().len(), 1);
+        let call = inspector.move_call(0);
+        assert_eq!(
+            call.module,
+            workflow::Scheduler::REGISTER_PERIODIC_GENERATOR.module
+        );
+        assert_eq!(
+            call.function,
+            workflow::Scheduler::REGISTER_PERIODIC_GENERATOR.name
+        );
+        assert_eq!(call.arguments.len(), 2);
+        inspector.expect_u64(&call.arguments[0], 21);
+        inspector.expect_u64(&call.arguments[1], 22);
+    }
+
+    #[test]
+    fn execute_fetches_execution_witness() {
+        let objects = sui_mocks::mock_nexus_objects();
+        let task = sui_mocks::mock_sui_object_ref();
+        let mut tx = sui::tx::TransactionBuilder::new();
+
+        let witness = execute(&mut tx, &objects, &task).expect("ptb construction succeeds");
+        assert_matches!(witness, sui::types::Argument::Result(0));
+
+        let inspector = TxInspector::new(sui_mocks::mock_finish_transaction(tx));
+        assert_eq!(inspector.commands().len(), 1);
+        let call = inspector.move_call(0);
+        assert_eq!(call.arguments.len(), 1);
+        inspector.expect_shared_object(&call.arguments[0], &task, true);
+        assert_eq!(call.module, workflow::Scheduler::EXECUTE.module);
+        assert_eq!(call.function, workflow::Scheduler::EXECUTE.name);
+    }
+
+    #[test]
+    fn finish_finalizes_execution_with_proof() {
+        let objects = sui_mocks::mock_nexus_objects();
+        let task = sui_mocks::mock_sui_object_ref();
+        let mut tx = sui::tx::TransactionBuilder::new();
+        let proof = tx.input(pure_arg(&5_u64).unwrap());
+        finish(&mut tx, &objects, &task, proof).expect("ptb construction succeeds");
+
+        let inspector = TxInspector::new(sui_mocks::mock_finish_transaction(tx));
+        assert_eq!(inspector.commands().len(), 1);
+        let call = inspector.move_call(0);
+        assert_eq!(call.module, workflow::Scheduler::FINISH.module);
+        assert_eq!(call.function, workflow::Scheduler::FINISH.name);
+        assert_eq!(call.arguments.len(), 2);
+        inspector.expect_shared_object(&call.arguments[0], &task, true);
+        inspector.expect_u64(&call.arguments[1], 5);
+    }
+
+    #[test]
+    fn add_occurrence_absolute_for_task_encodes_arguments() {
+        let objects = sui_mocks::mock_nexus_objects();
+        let task = sui_mocks::mock_sui_object_ref();
+        let mut tx = sui::tx::TransactionBuilder::new();
+
+        let start_time = 10;
+        let deadline = Some(20);
+        let priority_fee_per_gas_unit = 30;
+
+        add_occurrence_absolute_for_task(
+            &mut tx,
+            &objects,
+            &task,
+            start_time,
+            deadline,
+            priority_fee_per_gas_unit,
+        )
+        .expect("ptb construction succeeds");
+
+        let inspector = TxInspector::new(sui_mocks::mock_finish_transaction(tx));
+        assert_eq!(inspector.commands().len(), 1);
+        let call = inspector.move_call(0);
+        assert_eq!(call.arguments.len(), 5);
+        inspector.expect_shared_object(&call.arguments[0], &task, true);
+        inspector.expect_u64(&call.arguments[1], start_time);
+        inspector.expect_option_u64(&call.arguments[2], deadline);
+        inspector.expect_u64(&call.arguments[3], priority_fee_per_gas_unit);
+        inspector.expect_clock(&call.arguments[4]);
+    }
+
+    #[test]
+    fn add_occurrence_relative_for_task_encodes_offsets() {
+        let objects = sui_mocks::mock_nexus_objects();
+        let task = sui_mocks::mock_sui_object_ref();
+        let mut tx = sui::tx::TransactionBuilder::new();
+
+        let start_offset = 5;
+        let deadline_offset = Some(15);
+        let priority_fee_per_gas_unit = 25;
+
+        add_occurrence_relative_for_task(
+            &mut tx,
+            &objects,
+            &task,
+            start_offset,
+            deadline_offset,
+            priority_fee_per_gas_unit,
+        )
+        .expect("ptb construction succeeds");
+
+        let inspector = TxInspector::new(sui_mocks::mock_finish_transaction(tx));
+        let call = inspector.move_call(0);
+        assert_eq!(call.arguments.len(), 5);
+        inspector.expect_shared_object(&call.arguments[0], &task, true);
+        inspector.expect_u64(&call.arguments[1], start_offset);
+        inspector.expect_option_u64(&call.arguments[2], deadline_offset);
+        inspector.expect_u64(&call.arguments[3], priority_fee_per_gas_unit);
+        inspector.expect_clock(&call.arguments[4]);
+    }
+
+    #[test]
+    fn new_or_modify_periodic_for_task_sets_all_arguments() {
+        let objects = sui_mocks::mock_nexus_objects();
+        let task = sui_mocks::mock_sui_object_ref();
+        let mut tx = sui::tx::TransactionBuilder::new();
+
+        let first_start = 10_000;
+        let period = 1_000;
+        let deadline_offset = Some(500);
+        let max_iterations = Some(3);
+        let priority_fee_per_gas_unit = 75;
+
+        new_or_modify_periodic_for_task(
+            &mut tx,
+            &objects,
+            &task,
+            PeriodicScheduleInputs {
+                first_start_ms: first_start,
+                period_ms: period,
+                deadline_offset_ms: deadline_offset,
+                max_iterations,
+                priority_fee_per_gas_unit,
+            },
+        )
+        .expect("ptb construction succeeds");
+
+        let inspector = TxInspector::new(sui_mocks::mock_finish_transaction(tx));
+        let call = inspector.move_call(0);
+        assert_eq!(call.arguments.len(), 6);
+        inspector.expect_shared_object(&call.arguments[0], &task, true);
+        inspector.expect_u64(&call.arguments[1], first_start);
+        inspector.expect_u64(&call.arguments[2], period);
+        inspector.expect_option_u64(&call.arguments[3], deadline_offset);
+        inspector.expect_option_u64(&call.arguments[4], max_iterations);
+        inspector.expect_u64(&call.arguments[5], priority_fee_per_gas_unit);
+    }
+
+    #[test]
+    fn disable_periodic_for_task_uses_shared_argument() {
+        let objects = sui_mocks::mock_nexus_objects();
+        let task = sui_mocks::mock_sui_object_ref();
+        let mut tx = sui::tx::TransactionBuilder::new();
+
+        disable_periodic_for_task(&mut tx, &objects, &task).expect("ptb construction succeeds");
+
+        let inspector = TxInspector::new(sui_mocks::mock_finish_transaction(tx));
+        let call = inspector.move_call(0);
+        assert_eq!(call.arguments.len(), 1);
+        inspector.expect_shared_object(&call.arguments[0], &task, true);
+    }
+
+    #[test]
+    fn pause_time_constraint_for_task_uses_shared_argument() {
+        let objects = sui_mocks::mock_nexus_objects();
+        let task = sui_mocks::mock_sui_object_ref();
+        let mut tx = sui::tx::TransactionBuilder::new();
+
+        pause_time_constraint_for_task(&mut tx, &objects, &task)
+            .expect("ptb construction succeeds");
+
+        let inspector = TxInspector::new(sui_mocks::mock_finish_transaction(tx));
+        let call = inspector.move_call(0);
+        assert_eq!(call.arguments.len(), 1);
+        inspector.expect_shared_object(&call.arguments[0], &task, true);
+    }
+
+    #[test]
+    fn resume_time_constraint_for_task_uses_shared_argument() {
+        let objects = sui_mocks::mock_nexus_objects();
+        let task = sui_mocks::mock_sui_object_ref();
+        let mut tx = sui::tx::TransactionBuilder::new();
+
+        resume_time_constraint_for_task(&mut tx, &objects, &task)
+            .expect("ptb construction succeeds");
+
+        let inspector = TxInspector::new(sui_mocks::mock_finish_transaction(tx));
+        let call = inspector.move_call(0);
+        assert_eq!(call.arguments.len(), 1);
+        inspector.expect_shared_object(&call.arguments[0], &task, true);
+    }
+
+    #[test]
+    fn cancel_time_constraint_for_task_uses_shared_argument() {
+        let objects = sui_mocks::mock_nexus_objects();
+        let task = sui_mocks::mock_sui_object_ref();
+        let mut tx = sui::tx::TransactionBuilder::new();
+
+        cancel_time_constraint_for_task(&mut tx, &objects, &task)
+            .expect("ptb construction succeeds");
+
+        let inspector = TxInspector::new(sui_mocks::mock_finish_transaction(tx));
+        let call = inspector.move_call(0);
+        assert_eq!(call.arguments.len(), 1);
+        inspector.expect_shared_object(&call.arguments[0], &task, true);
+    }
+
+    #[test]
+    fn check_queue_occurrence_uses_clock_and_shared_task() {
+        let objects = sui_mocks::mock_nexus_objects();
+        let task = sui_mocks::mock_sui_object_ref();
+        let mut tx = sui::tx::TransactionBuilder::new();
+
+        check_queue_occurrence(&mut tx, &objects, &task).expect("ptb construction succeeds");
+
+        let inspector = TxInspector::new(sui_mocks::mock_finish_transaction(tx));
+        let call = inspector.move_call(0);
+        assert_eq!(
+            call.function,
+            workflow::Scheduler::CHECK_QUEUE_OCCURRENCE.name
+        );
+        assert_eq!(call.arguments.len(), 2);
+        inspector.expect_shared_object(&call.arguments[0], &task, true);
+        inspector.expect_clock(&call.arguments[1]);
+    }
+
+    #[test]
+    fn check_periodic_occurrence_uses_clock_and_shared_task() {
+        let objects = sui_mocks::mock_nexus_objects();
+        let task = sui_mocks::mock_sui_object_ref();
+        let mut tx = sui::tx::TransactionBuilder::new();
+
+        check_periodic_occurrence(&mut tx, &objects, &task).expect("ptb construction succeeds");
+
+        let inspector = TxInspector::new(sui_mocks::mock_finish_transaction(tx));
+        let call = inspector.move_call(0);
+        assert_eq!(
+            call.function,
+            workflow::Scheduler::CHECK_PERIODIC_OCCURRENCE.name
+        );
+        assert_eq!(call.arguments.len(), 2);
+        inspector.expect_shared_object(&call.arguments[0], &task, true);
+        inspector.expect_clock(&call.arguments[1]);
+    }
+
+    #[test]
+    fn register_begin_execution_routes_through_default_tap() {
+        let objects = sui_mocks::mock_nexus_objects();
+        let mut tx = sui::tx::TransactionBuilder::new();
+        let policy = tx.input(pure_arg(&13_u64).unwrap());
+        let config = tx.input(pure_arg(&14_u64).unwrap());
+        register_begin_execution(&mut tx, &objects, policy, config)
+            .expect("ptb construction succeeds");
+
+        let inspector = TxInspector::new(sui_mocks::mock_finish_transaction(tx));
+        let call = inspector.move_call(0);
+        assert_eq!(call.package, objects.workflow_pkg_id);
+        assert_eq!(
+            call.module,
+            workflow::DefaultTap::REGISTER_BEGIN_EXECUTION.module
+        );
+        assert_eq!(
+            call.function,
+            workflow::DefaultTap::REGISTER_BEGIN_EXECUTION.name
+        );
+        assert_eq!(call.arguments.len(), 2);
+        inspector.expect_u64(&call.arguments[0], 13);
+        inspector.expect_u64(&call.arguments[1], 14);
+    }
+
+    #[test]
+    fn dag_begin_execution_from_scheduler_builds_full_call() {
+        let objects = sui_mocks::mock_nexus_objects();
+        let task = sui_mocks::mock_sui_object_ref();
+        let dag = sui_mocks::mock_sui_object_ref();
+        let leader_cap = sui_mocks::mock_sui_object_ref();
+        let mut tx = sui::tx::TransactionBuilder::new();
+
+        let amount_execution = 44;
+        let amount_priority = 55;
+
+        dag_begin_execution_from_scheduler(
+            &mut tx,
+            &objects,
+            &task,
+            &dag,
+            &leader_cap,
+            amount_execution,
+            amount_priority,
+        )
+        .expect("ptb construction succeeds");
+
+        let inspector = TxInspector::new(sui_mocks::mock_finish_transaction(tx));
+        assert_eq!(inspector.commands().len(), 1);
+        let call = inspector.move_call(0);
+        assert_eq!(call.arguments.len(), 8);
+
+        inspector.expect_shared_object(&call.arguments[0], &objects.default_tap, true);
+        inspector.expect_shared_object(&call.arguments[1], &task, true);
+        let sui::types::Input::Shared {
+            object_id,
+            initial_shared_version,
+            mutable,
+        } = inspector.input(&call.arguments[2])
+        else {
+            panic!(
+                "expected shared object argument for DAG, got {:?}",
+                inspector.input(&call.arguments[2])
+            );
+        };
+        assert_eq!(object_id, dag.object_id());
+        assert_eq!(*initial_shared_version, dag.version());
+        assert!(!*mutable);
+
+        inspector.expect_shared_object(&call.arguments[3], &objects.gas_service, true);
+        inspector.expect_shared_object(&call.arguments[4], &leader_cap, false);
+        inspector.expect_u64(&call.arguments[5], amount_execution);
+        inspector.expect_u64(&call.arguments[6], amount_priority);
+        inspector.expect_clock(&call.arguments[7]);
+    }
+
+    #[test]
+    fn execute_scheduled_occurrence_chains_scheduler_and_tap_calls() {
+        let objects = sui_mocks::mock_nexus_objects();
+        let task = sui_mocks::mock_sui_object_ref();
+        let dag = sui_mocks::mock_sui_object_ref();
+        let leader_cap = sui_mocks::mock_sui_object_ref();
+        let mut tx = sui::tx::TransactionBuilder::new();
+
+        execute_scheduled_occurrence(
+            &mut tx,
+            &objects,
+            &task,
+            &dag,
+            &leader_cap,
+            100,
+            200,
+            OccurrenceGenerator::Queue,
+        )
+        .expect("ptb construction succeeds");
+
+        let inspector = TxInspector::new(sui_mocks::mock_finish_transaction(tx));
+        assert_eq!(inspector.commands().len(), 3);
+
+        let scheduler_call = inspector.move_call(0);
+        assert_eq!(
+            scheduler_call.module,
+            workflow::Scheduler::CHECK_QUEUE_OCCURRENCE.module
+        );
+        assert_eq!(
+            scheduler_call.function,
+            workflow::Scheduler::CHECK_QUEUE_OCCURRENCE.name
+        );
+        assert_eq!(scheduler_call.arguments.len(), 2);
+        inspector.expect_shared_object(&scheduler_call.arguments[0], &task, true);
+        inspector.expect_clock(&scheduler_call.arguments[1]);
+
+        let tap_call = inspector.move_call(1);
+        assert_eq!(
+            tap_call.module,
+            workflow::DefaultTap::DAG_BEGIN_EXECUTION_FROM_SCHEDULER.module
+        );
+        assert_eq!(
+            tap_call.function,
+            workflow::DefaultTap::DAG_BEGIN_EXECUTION_FROM_SCHEDULER.name
+        );
+        assert_eq!(tap_call.arguments.len(), 8);
+        inspector.expect_shared_object(&tap_call.arguments[0], &objects.default_tap, true);
+        inspector.expect_shared_object(&tap_call.arguments[1], &task, true);
+        let sui::types::Input::Shared {
+            object_id,
+            initial_shared_version,
+            mutable,
+        } = inspector.input(&tap_call.arguments[2])
+        else {
+            panic!(
+                "expected shared DAG object, got {:?}",
+                inspector.input(&tap_call.arguments[2])
+            );
+        };
+        assert_eq!(object_id, dag.object_id());
+        assert_eq!(*initial_shared_version, dag.version());
+        assert!(!*mutable);
+        inspector.expect_shared_object(&tap_call.arguments[3], &objects.gas_service, true);
+        inspector.expect_shared_object(&tap_call.arguments[4], &leader_cap, false);
+        inspector.expect_u64(&tap_call.arguments[5], 100);
+        inspector.expect_u64(&tap_call.arguments[6], 200);
+        inspector.expect_clock(&tap_call.arguments[7]);
+
+        let finish_call = inspector.move_call(2);
+        assert_eq!(finish_call.module, workflow::Scheduler::FINISH.module);
+        assert_eq!(finish_call.function, workflow::Scheduler::FINISH.name);
+        assert_eq!(finish_call.arguments.len(), 2);
+        inspector.expect_shared_object(&finish_call.arguments[0], &task, true);
+        assert_matches!(&finish_call.arguments[1], sui::types::Argument::Result(0));
+    }
+
+    #[test]
+    fn execute_scheduled_occurrence_supports_periodic_generators() {
+        let objects = sui_mocks::mock_nexus_objects();
+        let task = sui_mocks::mock_sui_object_ref();
+        let dag = sui_mocks::mock_sui_object_ref();
+        let leader_cap = sui_mocks::mock_sui_object_ref();
+        let mut tx = sui::tx::TransactionBuilder::new();
+
+        execute_scheduled_occurrence(
+            &mut tx,
+            &objects,
+            &task,
+            &dag,
+            &leader_cap,
+            10,
+            20,
+            OccurrenceGenerator::Periodic,
+        )
+        .expect("ptb construction succeeds");
+
+        let inspector = TxInspector::new(sui_mocks::mock_finish_transaction(tx));
+        let scheduler_call = inspector.move_call(0);
+        assert_eq!(
+            scheduler_call.function,
+            workflow::Scheduler::CHECK_PERIODIC_OCCURRENCE.name
+        );
+    }
+}
diff --git a/sdk/src/transactions/tool.rs b/sdk/src/transactions/tool.rs
index c0ec38df..9242a268 100644
--- a/sdk/src/transactions/tool.rs
+++ b/sdk/src/transactions/tool.rs
@@ -1,5 +1,5 @@
 use crate::{
-    idents::{move_std, primitives, sui_framework, workflow},
+    idents::{move_std, primitives, pure_arg, sui_framework, workflow},
     sui,
     types::{NexusObjects, ToolMeta},
     ToolFqn,
@@ -7,51 +7,57 @@ use crate::{
 
 /// PTB template for registering a new Nexus Tool.
 pub fn register_off_chain_for_self(
-    tx: &mut sui::ProgrammableTransactionBuilder,
+    tx: &mut sui::tx::TransactionBuilder,
     objects: &NexusObjects,
     meta: &ToolMeta,
-    address: sui::ObjectID,
-    collateral_coin: &sui::Coin,
+    address: sui::types::Address,
+    collateral_coin: &sui::types::ObjectReference,
     invocation_cost: u64,
-) -> anyhow::Result<sui::Argument> {
+) -> anyhow::Result<sui::types::Argument> {
     // `self: &mut ToolRegistry`
-    let tool_registry = tx.obj(sui::ObjectArg::SharedObject {
-        id: objects.tool_registry.object_id,
-        initial_shared_version: objects.tool_registry.version,
-        mutable: true,
-    })?;
+    let tool_registry = tx.input(sui::tx::Input::shared(
+        *objects.tool_registry.object_id(),
+        objects.tool_registry.version(),
+        true,
+    ));
 
     // `fqn: AsciiString`
     let fqn = move_std::Ascii::ascii_string_from_str(tx, meta.fqn.to_string())?;
 
     // `url: vector<u8>`
-    let url = tx.pure(meta.url.to_string().as_bytes())?;
+    let url = tx.input(pure_arg(&meta.url.to_string())?);
 
     // `description: vector<u8>`
-    let description = tx.pure(meta.description.as_bytes())?;
+    let description = tx.input(pure_arg(&meta.description.as_bytes())?);
 
     // `input_schema: vector<u8>`
-    let input_schema = tx.pure(meta.input_schema.to_string().as_bytes())?;
+    let input_schema = tx.input(pure_arg(&serde_json::to_vec(&meta.input_schema)?)?);
 
     // `output_schema: vector<u8>`
-    let output_schema = tx.pure(meta.output_schema.to_string().as_bytes())?;
+    let output_schema = tx.input(pure_arg(&serde_json::to_vec(&meta.output_schema)?)?);
 
     // `pay_with: Coin<SUI>`
-    let pay_with = tx.obj(sui::ObjectArg::ImmOrOwnedObject(
-        collateral_coin.object_ref(),
-    ))?;
+    let pay_with = tx.input(sui::tx::Input::owned(
+        *collateral_coin.object_id(),
+        collateral_coin.version(),
+        *collateral_coin.digest(),
+    ));
 
     // `clock: &Clock`
-    let clock = tx.obj(sui::CLOCK_OBJ_ARG)?;
+    let clock = tx.input(sui::tx::Input::shared(
+        sui_framework::CLOCK_OBJECT_ID,
+        1,
+        false,
+    ));
 
     // `nexus_workflow::tool_registry::register_off_chain_tool()`
-    let owner_cap_over_tool = tx.programmable_move_call(
-        objects.workflow_pkg_id,
-        workflow::ToolRegistry::REGISTER_OFF_CHAIN_TOOL
-            .module
-            .into(),
-        workflow::ToolRegistry::REGISTER_OFF_CHAIN_TOOL.name.into(),
-        vec![],
+    let owner_cap_over_tool = tx.move_call(
+        sui::tx::Function::new(
+            objects.workflow_pkg_id,
+            workflow::ToolRegistry::REGISTER_OFF_CHAIN_TOOL.module,
+            workflow::ToolRegistry::REGISTER_OFF_CHAIN_TOOL.name,
+            vec![],
+        ),
         vec![
             tool_registry,
             fqn,
@@ -65,30 +71,33 @@ pub fn register_off_chain_for_self(
     );
 
     // `nexus_workflow::gas::deescalate()`
-    let owner_cap_over_gas = tx.programmable_move_call(
-        objects.workflow_pkg_id,
-        workflow::Gas::DEESCALATE.module.into(),
-        workflow::Gas::DEESCALATE.name.into(),
-        vec![],
+    let owner_cap_over_gas = tx.move_call(
+        sui::tx::Function::new(
+            objects.workflow_pkg_id,
+            workflow::Gas::DEESCALATE.module,
+            workflow::Gas::DEESCALATE.name,
+            vec![],
+        ),
         vec![tool_registry, owner_cap_over_tool, fqn],
     );
 
     // `gas_service: &mut GasService`
-    let gas_service = tx.obj(sui::ObjectArg::SharedObject {
-        id: objects.gas_service.object_id,
-        initial_shared_version: objects.gas_service.version,
-        mutable: true,
-    })?;
+    let gas_service = tx.input(sui::tx::Input::shared(
+        *objects.gas_service.object_id(),
+        objects.gas_service.version(),
+        true,
+    ));
 
     // `single_invocation_cost_mist: u64`
-    let single_invocation_cost_mist = tx.pure(invocation_cost)?;
-
+    let single_invocation_cost_mist = tx.input(pure_arg(&invocation_cost)?);
     // `nexus_workflow::gas::set_single_invocation_cost_mist`
-    tx.programmable_move_call(
-        objects.workflow_pkg_id,
-        workflow::Gas::SET_SINGLE_INVOCATION_COST_MIST.module.into(),
-        workflow::Gas::SET_SINGLE_INVOCATION_COST_MIST.name.into(),
-        vec![],
+    tx.move_call(
+        sui::tx::Function::new(
+            objects.workflow_pkg_id,
+            workflow::Gas::SET_SINGLE_INVOCATION_COST_MIST.module,
+            workflow::Gas::SET_SINGLE_INVOCATION_COST_MIST.name,
+            vec![],
+        ),
         vec![
             gas_service,
             tool_registry,
@@ -99,92 +108,213 @@ pub fn register_off_chain_for_self(
     );
 
     // `CloneableOwnerCap<OverGas>`
-    let over_gas_type = sui::MoveTypeTag::Struct(Box::new(sui::MoveStructTag {
-        address: *objects.primitives_pkg_id,
-        module: primitives::OwnerCap::CLONEABLE_OWNER_CAP.module.into(),
-        name: primitives::OwnerCap::CLONEABLE_OWNER_CAP.name.into(),
-        type_params: vec![sui::MoveTypeTag::Struct(Box::new(sui::MoveStructTag {
-            address: *objects.workflow_pkg_id,
-            module: workflow::Gas::OVER_GAS.module.into(),
-            name: workflow::Gas::OVER_GAS.name.into(),
-            type_params: vec![],
-        }))],
-    }));
+    let over_gas_type = sui::types::TypeTag::Struct(Box::new(sui::types::StructTag::new(
+        objects.primitives_pkg_id,
+        primitives::OwnerCap::CLONEABLE_OWNER_CAP.module,
+        primitives::OwnerCap::CLONEABLE_OWNER_CAP.name,
+        vec![sui::types::TypeTag::Struct(Box::new(
+            sui::types::StructTag::new(
+                objects.workflow_pkg_id,
+                workflow::Gas::OVER_GAS.module,
+                workflow::Gas::OVER_GAS.name,
+                vec![],
+            ),
+        ))],
+    )));
 
     // `CloneableOwnerCap<OverTool>`
-    let over_tool_type = sui::MoveTypeTag::Struct(Box::new(sui::MoveStructTag {
-        address: *objects.primitives_pkg_id,
-        module: primitives::OwnerCap::CLONEABLE_OWNER_CAP.module.into(),
-        name: primitives::OwnerCap::CLONEABLE_OWNER_CAP.name.into(),
-        type_params: vec![sui::MoveTypeTag::Struct(Box::new(sui::MoveStructTag {
-            address: *objects.workflow_pkg_id,
-            module: workflow::ToolRegistry::OVER_TOOL.module.into(),
-            name: workflow::ToolRegistry::OVER_TOOL.name.into(),
-            type_params: vec![],
-        }))],
-    }));
+    let over_tool_type = sui::types::TypeTag::Struct(Box::new(sui::types::StructTag::new(
+        objects.primitives_pkg_id,
+        primitives::OwnerCap::CLONEABLE_OWNER_CAP.module,
+        primitives::OwnerCap::CLONEABLE_OWNER_CAP.name,
+        vec![sui::types::TypeTag::Struct(Box::new(
+            sui::types::StructTag::new(
+                objects.workflow_pkg_id,
+                workflow::ToolRegistry::OVER_TOOL.module,
+                workflow::ToolRegistry::OVER_TOOL.name,
+                vec![],
+            ),
+        ))],
+    )));
 
     // `recipient: address`
-    let with_prefix = false;
-    let recipient =
-        sui_framework::Address::address_from_str(tx, address.to_canonical_string(with_prefix))?;
+    let recipient = sui_framework::Address::address_from_type(tx, address)?;
 
     // `sui::transfer::public_transfer`
-    tx.programmable_move_call(
-        sui::FRAMEWORK_PACKAGE_ID,
-        sui_framework::Transfer::PUBLIC_TRANSFER.module.into(),
-        sui_framework::Transfer::PUBLIC_TRANSFER.name.into(),
-        vec![over_tool_type],
+    tx.move_call(
+        sui::tx::Function::new(
+            sui_framework::PACKAGE_ID,
+            sui_framework::Transfer::PUBLIC_TRANSFER.module,
+            sui_framework::Transfer::PUBLIC_TRANSFER.name,
+            vec![over_tool_type],
+        ),
         vec![owner_cap_over_tool, recipient],
     );
 
     // `sui::transfer::public_transfer`
-    Ok(tx.programmable_move_call(
-        sui::FRAMEWORK_PACKAGE_ID,
-        sui_framework::Transfer::PUBLIC_TRANSFER.module.into(),
-        sui_framework::Transfer::PUBLIC_TRANSFER.name.into(),
-        vec![over_gas_type],
+    Ok(tx.move_call(
+        sui::tx::Function::new(
+            sui_framework::PACKAGE_ID,
+            sui_framework::Transfer::PUBLIC_TRANSFER.module,
+            sui_framework::Transfer::PUBLIC_TRANSFER.name,
+            vec![over_gas_type],
+        ),
         vec![owner_cap_over_gas, recipient],
     ))
 }
 
+/// PTB template for registering a new onchain Nexus Tool.
+#[allow(clippy::too_many_arguments)]
+pub fn register_on_chain_for_self(
+    tx: &mut sui::tx::TransactionBuilder,
+    objects: &NexusObjects,
+    package_address: sui::types::Address,
+    module_name: &str,
+    input_schema: &str,
+    output_schema: &str,
+    fqn: &ToolFqn,
+    description: &str,
+    witness_id: sui::types::Address,
+    collateral_coin: &sui::types::ObjectReference,
+    address: sui::types::Address,
+) -> anyhow::Result<sui::types::Argument> {
+    // `self: &mut ToolRegistry`
+    let tool_registry = tx.input(sui::tx::Input::shared(
+        *objects.tool_registry.object_id(),
+        objects.tool_registry.version(),
+        true,
+    ));
+
+    // `package_address: address`
+    let package_addr = sui_framework::Address::address_from_type(tx, package_address)?;
+
+    // `module_name: AsciiString`
+    let module_name = move_std::Ascii::ascii_string_from_str(tx, module_name)?;
+
+    // `input_schema: vector<u8>`
+    let input_schema = tx.input(pure_arg(&input_schema.as_bytes().to_vec())?);
+
+    // `output_schema: vector<u8>`
+    let output_schema = tx.input(pure_arg(&output_schema.as_bytes().to_vec())?);
+
+    // `fqn: AsciiString`
+    let fqn = move_std::Ascii::ascii_string_from_str(tx, fqn.to_string())?;
+
+    // `description: vector<u8>`
+    let description = tx.input(pure_arg(&description.as_bytes().to_vec())?);
+
+    // `witness_id: ID`
+    let witness_id = sui_framework::Address::address_from_type(tx, witness_id)?;
+
+    // `pay_with: Coin<SUI>`
+    let pay_with = tx.input(sui::tx::Input::owned(
+        *collateral_coin.object_id(),
+        collateral_coin.version(),
+        *collateral_coin.digest(),
+    ));
+
+    // `clock: &Clock`
+    let clock = tx.input(sui::tx::Input::shared(
+        sui_framework::CLOCK_OBJECT_ID,
+        1,
+        false,
+    ));
+
+    // `nexus_workflow::tool_registry::register_on_chain_tool()`
+    let owner_cap_over_tool = tx.move_call(
+        sui::tx::Function::new(
+            objects.workflow_pkg_id,
+            workflow::ToolRegistry::REGISTER_ON_CHAIN_TOOL.module,
+            workflow::ToolRegistry::REGISTER_ON_CHAIN_TOOL.name,
+            vec![],
+        ),
+        vec![
+            tool_registry,
+            package_addr,
+            module_name,
+            input_schema,
+            output_schema,
+            fqn,
+            description,
+            witness_id,
+            pay_with,
+            clock,
+        ],
+    );
+
+    // `CloneableOwnerCap<OverTool>`
+    let over_tool_type = sui::types::TypeTag::Struct(Box::new(sui::types::StructTag::new(
+        objects.primitives_pkg_id,
+        primitives::OwnerCap::CLONEABLE_OWNER_CAP.module,
+        primitives::OwnerCap::CLONEABLE_OWNER_CAP.name,
+        vec![sui::types::TypeTag::Struct(Box::new(
+            sui::types::StructTag::new(
+                objects.workflow_pkg_id,
+                workflow::ToolRegistry::OVER_TOOL.module,
+                workflow::ToolRegistry::OVER_TOOL.name,
+                vec![],
+            ),
+        ))],
+    )));
+
+    // `recipient: address`
+    let recipient = sui_framework::Address::address_from_type(tx, address)?;
+
+    // `sui::transfer::public_transfer`
+    Ok(tx.move_call(
+        sui::tx::Function::new(
+            sui_framework::PACKAGE_ID,
+            sui_framework::Transfer::PUBLIC_TRANSFER.module,
+            sui_framework::Transfer::PUBLIC_TRANSFER.name,
+            vec![over_tool_type],
+        ),
+        vec![owner_cap_over_tool, recipient],
+    ))
+}
+
 /// PTB template for setting the invocation cost of a Nexus Tool.
 pub fn set_invocation_cost(
-    tx: &mut sui::ProgrammableTransactionBuilder,
+    tx: &mut sui::tx::TransactionBuilder,
     objects: &NexusObjects,
     tool_fqn: &ToolFqn,
-    owner_cap: &sui::ObjectRef,
+    owner_cap: &sui::types::ObjectReference,
     invocation_cost: u64,
-) -> anyhow::Result<sui::Argument> {
+) -> anyhow::Result<sui::types::Argument> {
     // `self: &mut GasService`
-    let gas_service = tx.obj(sui::ObjectArg::SharedObject {
-        id: objects.gas_service.object_id,
-        initial_shared_version: objects.gas_service.version,
-        mutable: true,
-    })?;
+    let gas_service = tx.input(sui::tx::Input::shared(
+        *objects.gas_service.object_id(),
+        objects.gas_service.version(),
+        true,
+    ));
 
     // `tool_registry: &mut ToolRegistry`
-    let tool_registry = tx.obj(sui::ObjectArg::SharedObject {
-        id: objects.tool_registry.object_id,
-        initial_shared_version: objects.tool_registry.version,
-        mutable: true,
-    })?;
+    let tool_registry = tx.input(sui::tx::Input::shared(
+        *objects.tool_registry.object_id(),
+        objects.tool_registry.version(),
+        true,
+    ));
 
     // `owner_cap: &CloneableOwnerCap<OverGas>`
-    let owner_cap = tx.obj(sui::ObjectArg::ImmOrOwnedObject(owner_cap.to_object_ref()))?;
+    let owner_cap = tx.input(sui::tx::Input::owned(
+        *owner_cap.object_id(),
+        owner_cap.version(),
+        *owner_cap.digest(),
+    ));
 
     // `fqn: AsciiString`
     let fqn = move_std::Ascii::ascii_string_from_str(tx, tool_fqn.to_string())?;
 
     // `single_invocation_cost_mist: u64`
-    let single_invocation_cost_mist = tx.pure(invocation_cost)?;
+    let single_invocation_cost_mist = tx.input(pure_arg(&invocation_cost)?);
 
     // `nexus_workflow::gas::set_single_invocation_cost_mist`
-    Ok(tx.programmable_move_call(
-        objects.workflow_pkg_id,
-        workflow::Gas::SET_SINGLE_INVOCATION_COST_MIST.module.into(),
-        workflow::Gas::SET_SINGLE_INVOCATION_COST_MIST.name.into(),
-        vec![],
+    Ok(tx.move_call(
+        sui::tx::Function::new(
+            objects.workflow_pkg_id,
+            workflow::Gas::SET_SINGLE_INVOCATION_COST_MIST.module,
+            workflow::Gas::SET_SINGLE_INVOCATION_COST_MIST.name,
+            vec![],
+        ),
         vec![
             gas_service,
             tool_registry,
@@ -197,33 +327,43 @@ pub fn set_invocation_cost(
 
 /// PTB template for unregistering a Nexus Tool.
 pub fn unregister(
-    tx: &mut sui::ProgrammableTransactionBuilder,
+    tx: &mut sui::tx::TransactionBuilder,
     objects: &NexusObjects,
     tool_fqn: &ToolFqn,
-    owner_cap: &sui::ObjectRef,
-) -> anyhow::Result<sui::Argument> {
+    owner_cap: &sui::types::ObjectReference,
+) -> anyhow::Result<sui::types::Argument> {
     // `self: &mut ToolRegistry`
-    let tool_registry = tx.obj(sui::ObjectArg::SharedObject {
-        id: objects.tool_registry.object_id,
-        initial_shared_version: objects.tool_registry.version,
-        mutable: true,
-    })?;
+    let tool_registry = tx.input(sui::tx::Input::shared(
+        *objects.tool_registry.object_id(),
+        objects.tool_registry.version(),
+        true,
+    ));
 
     // `fqn: AsciiString`
     let fqn = move_std::Ascii::ascii_string_from_str(tx, tool_fqn.to_string())?;
 
     // `owner_cap: &CloneableOwnerCap<OverTool>`
-    let owner_cap = tx.obj(sui::ObjectArg::ImmOrOwnedObject(owner_cap.to_object_ref()))?;
+    let owner_cap = tx.input(sui::tx::Input::owned(
+        *owner_cap.object_id(),
+        owner_cap.version(),
+        *owner_cap.digest(),
+    ));
 
     // `clock: &Clock`
-    let clock = tx.obj(sui::CLOCK_OBJ_ARG)?;
+    let clock = tx.input(sui::tx::Input::shared(
+        sui_framework::CLOCK_OBJECT_ID,
+        1,
+        false,
+    ));
 
     // `nexus::tool_registry::unregister_tool()`
-    Ok(tx.programmable_move_call(
-        objects.workflow_pkg_id,
-        workflow::ToolRegistry::UNREGISTER_TOOL.module.into(),
-        workflow::ToolRegistry::UNREGISTER_TOOL.name.into(),
-        vec![],
+    Ok(tx.move_call(
+        sui::tx::Function::new(
+            objects.workflow_pkg_id,
+            workflow::ToolRegistry::UNREGISTER_TOOL.module,
+            workflow::ToolRegistry::UNREGISTER_TOOL.name,
+            vec![],
+        ),
         vec![tool_registry, owner_cap, fqn, clock],
     ))
 }
@@ -231,37 +371,43 @@ pub fn unregister(
 /// PTB template for claiming collateral for a Nexus Tool. The funds are
 /// transferred to the tx sender.
 pub fn claim_collateral_for_self(
-    tx: &mut sui::ProgrammableTransactionBuilder,
+    tx: &mut sui::tx::TransactionBuilder,
     objects: &NexusObjects,
     tool_fqn: &ToolFqn,
-    owner_cap: &sui::ObjectRef,
-) -> anyhow::Result<sui::Argument> {
+    owner_cap: &sui::types::ObjectReference,
+) -> anyhow::Result<sui::types::Argument> {
     // `self: &mut ToolRegistry`
-    let tool_registry = tx.obj(sui::ObjectArg::SharedObject {
-        id: objects.tool_registry.object_id,
-        initial_shared_version: objects.tool_registry.version,
-        mutable: true,
-    })?;
+    let tool_registry = tx.input(sui::tx::Input::shared(
+        *objects.tool_registry.object_id(),
+        objects.tool_registry.version(),
+        true,
+    ));
 
     // `owner_cap: &CloneableOwnerCap<OverTool>`
-    let owner_cap = tx.obj(sui::ObjectArg::ImmOrOwnedObject(owner_cap.to_object_ref()))?;
+    let owner_cap = tx.input(sui::tx::Input::owned(
+        *owner_cap.object_id(),
+        owner_cap.version(),
+        *owner_cap.digest(),
+    ));
 
     // `fqn: AsciiString`
     let fqn = move_std::Ascii::ascii_string_from_str(tx, tool_fqn.to_string())?;
 
     // `clock: &Clock`
-    let clock = tx.obj(sui::CLOCK_OBJ_ARG)?;
-
-    // `nexus::tool_registry::claim_collateral_for_tool()`
-    Ok(tx.programmable_move_call(
-        objects.workflow_pkg_id,
-        workflow::ToolRegistry::CLAIM_COLLATERAL_FOR_SELF
-            .module
-            .into(),
-        workflow::ToolRegistry::CLAIM_COLLATERAL_FOR_SELF
-            .name
-            .into(),
-        vec![],
+    let clock = tx.input(sui::tx::Input::shared(
+        sui_framework::CLOCK_OBJECT_ID,
+        1,
+        false,
+    ));
+
+    // `nexus::tool_registry::claim_collateral_for_self()`
+    Ok(tx.move_call(
+        sui::tx::Function::new(
+            objects.workflow_pkg_id,
+            workflow::ToolRegistry::CLAIM_COLLATERAL_FOR_SELF.module,
+            workflow::ToolRegistry::CLAIM_COLLATERAL_FOR_SELF.name,
+            vec![],
+        ),
         vec![tool_registry, owner_cap, fqn, clock],
     ))
 }
@@ -276,6 +422,7 @@ mod tests {
 
     #[test]
     fn test_register_off_chain_for_self() {
+        let rng = &mut rand::thread_rng();
         let meta = ToolMeta {
             fqn: fqn!("xyz.dummy.tool@1"),
             url: "https://example.com".parse().unwrap(),
@@ -285,11 +432,11 @@ mod tests {
         };
 
         let objects = sui_mocks::mock_nexus_objects();
-        let collateral_coin = sui_mocks::mock_sui_coin(100);
-        let address = sui::ObjectID::random();
+        let collateral_coin = sui_mocks::mock_sui_object_ref();
+        let address = sui::types::Address::generate(rng);
         let invocation_cost = 1000;
 
-        let mut tx = sui::ProgrammableTransactionBuilder::new();
+        let mut tx = sui::tx::TransactionBuilder::new();
         register_off_chain_for_self(
             &mut tx,
             &objects,
@@ -299,58 +446,107 @@ mod tests {
             invocation_cost,
         )
         .expect("Failed to build PTB for registering a tool.");
-        let tx = tx.finish();
+        let tx = sui_mocks::mock_finish_transaction(tx);
+        let sui::types::TransactionKind::ProgrammableTransaction(
+            sui::types::ProgrammableTransaction { commands, .. },
+        ) = tx.kind
+        else {
+            panic!("Expected a ProgrammableTransaction");
+        };
 
-        let sui::Command::MoveCall(call) = &tx.commands.get(1).unwrap() else {
+        let sui::types::Command::MoveCall(call) = &commands.get(1).unwrap() else {
             panic!("Expected a command to be a MoveCall to register a tool");
         };
 
         assert_eq!(call.package, objects.workflow_pkg_id);
-
         assert_eq!(
             call.module,
-            workflow::ToolRegistry::REGISTER_OFF_CHAIN_TOOL
-                .module
-                .to_string(),
+            workflow::ToolRegistry::REGISTER_OFF_CHAIN_TOOL.module,
         );
-
         assert_eq!(
             call.function,
-            workflow::ToolRegistry::REGISTER_OFF_CHAIN_TOOL
-                .name
-                .to_string()
+            workflow::ToolRegistry::REGISTER_OFF_CHAIN_TOOL.name,
         );
-
         assert_eq!(call.arguments.len(), 8);
     }
 
     #[test]
-    fn test_unregister_tool() {
+    fn test_register_on_chain_for_self() {
+        let mut rng = rand::thread_rng();
         let objects = sui_mocks::mock_nexus_objects();
-        let tool_fqn = fqn!("xyz.dummy.tool@1");
-        let owner_cap = sui_mocks::mock_sui_object_ref();
-
-        let mut tx = sui::ProgrammableTransactionBuilder::new();
-        unregister(&mut tx, &objects, &tool_fqn, &owner_cap)
-            .expect("Failed to build PTB for unregistering a tool.");
-        let tx = tx.finish();
+        let package_address = sui::types::Address::generate(&mut rng);
+        let module_name = "onchain_tool";
+        let input_schema = &json!({}).to_string();
+        let output_schema = &json!({}).to_string();
+        let fqn = fqn!("xyz.dummy.tool@1");
+        let description = "a dummy onchain tool";
+        let witness_id = sui::types::Address::generate(&mut rng);
+        let collateral_coin = sui_mocks::mock_sui_object_ref();
+        let address = sui::types::Address::generate(&mut rng);
+
+        let mut tx = sui::tx::TransactionBuilder::new();
+        register_on_chain_for_self(
+            &mut tx,
+            &objects,
+            package_address,
+            module_name,
+            input_schema,
+            output_schema,
+            &fqn,
+            description,
+            witness_id,
+            &collateral_coin,
+            address,
+        )
+        .expect("Failed to build PTB for registering an onchain tool.");
+        let tx = sui_mocks::mock_finish_transaction(tx);
+        let sui::types::TransactionKind::ProgrammableTransaction(
+            sui::types::ProgrammableTransaction { commands, .. },
+        ) = tx.kind
+        else {
+            panic!("Expected a ProgrammableTransaction");
+        };
 
-        let sui::Command::MoveCall(call) = &tx.commands.last().unwrap() else {
-            panic!("Expected last command to be a MoveCall to unregister a tool");
+        let sui::types::Command::MoveCall(call) = &commands.get(2).unwrap() else {
+            panic!("Expected a command to be a MoveCall to register an onchain tool");
         };
 
         assert_eq!(call.package, objects.workflow_pkg_id);
-
         assert_eq!(
             call.module,
-            workflow::ToolRegistry::UNREGISTER_TOOL.module.to_string(),
+            workflow::ToolRegistry::REGISTER_ON_CHAIN_TOOL.module
         );
-
         assert_eq!(
             call.function,
-            workflow::ToolRegistry::UNREGISTER_TOOL.name.to_string()
+            workflow::ToolRegistry::REGISTER_ON_CHAIN_TOOL.name
         );
+        assert_eq!(call.arguments.len(), 10);
+    }
 
+    #[test]
+    fn test_unregister_tool() {
+        let objects = sui_mocks::mock_nexus_objects();
+        let tool_fqn = fqn!("xyz.dummy.tool@1");
+        let owner_cap = sui_mocks::mock_sui_object_ref();
+
+        let mut tx = sui::tx::TransactionBuilder::new();
+        unregister(&mut tx, &objects, &tool_fqn, &owner_cap)
+            .expect("Failed to build PTB for unregistering a tool.");
+        let tx = sui_mocks::mock_finish_transaction(tx);
+        let sui::types::TransactionKind::ProgrammableTransaction(
+            sui::types::ProgrammableTransaction { commands, .. },
+        ) = tx.kind
+        else {
+            panic!("Expected a ProgrammableTransaction");
+        };
+
+        let sui::types::Command::MoveCall(call) = &commands.last().unwrap() else {
+            panic!("Expected last command to be a MoveCall to unregister a tool");
+        };
+
+        assert_eq!(call.package, objects.workflow_pkg_id);
+        assert_eq!(call.module, workflow::ToolRegistry::UNREGISTER_TOOL.module);
+        assert_eq!(call.function, workflow::ToolRegistry::UNREGISTER_TOOL.name);
         assert_eq!(call.arguments.len(), 4);
     }
 
@@ -360,31 +556,30 @@ mod tests {
         let tool_fqn = fqn!("xyz.dummy.tool@1");
         let owner_cap = sui_mocks::mock_sui_object_ref();
 
-        let mut tx = sui::ProgrammableTransactionBuilder::new();
+        let mut tx = sui::tx::TransactionBuilder::new();
         claim_collateral_for_self(&mut tx, &objects, &tool_fqn, &owner_cap)
             .expect("Failed to build PTB for claiming collateral for a tool.");
-        let tx = tx.finish();
+        let tx = sui_mocks::mock_finish_transaction(tx);
+        let sui::types::TransactionKind::ProgrammableTransaction(
+            sui::types::ProgrammableTransaction { commands, .. },
+        ) = tx.kind
+        else {
+            panic!("Expected a ProgrammableTransaction");
+        };
 
-        let sui::Command::MoveCall(call) = &tx.commands.last().unwrap() else {
+        let sui::types::Command::MoveCall(call) = &commands.last().unwrap() else {
             panic!("Expected last command to be a MoveCall to claim collateral for a tool");
         };
 
         assert_eq!(call.package, objects.workflow_pkg_id);
-
         assert_eq!(
             call.module,
-            workflow::ToolRegistry::CLAIM_COLLATERAL_FOR_SELF
-                .module
-                .to_string(),
+            workflow::ToolRegistry::CLAIM_COLLATERAL_FOR_SELF.module
         );
-
         assert_eq!(
             call.function,
-            workflow::ToolRegistry::CLAIM_COLLATERAL_FOR_SELF
-                .name
-                .to_string()
+            workflow::ToolRegistry::CLAIM_COLLATERAL_FOR_SELF.name
         );
-
         assert_eq!(call.arguments.len(), 4);
     }
 
@@ -395,31 +590,30 @@ mod tests {
         let objects = sui_mocks::mock_nexus_objects();
         let invocation_cost = 500;
 
-        let mut tx = sui::ProgrammableTransactionBuilder::new();
+        let mut tx = sui::tx::TransactionBuilder::new();
         set_invocation_cost(&mut tx, &objects, &tool_fqn, &owner_cap, invocation_cost)
             .expect("Failed to build PTB for setting invocation cost.");
-        let tx = tx.finish();
+        let tx = sui_mocks::mock_finish_transaction(tx);
+        let sui::types::TransactionKind::ProgrammableTransaction(
+            sui::types::ProgrammableTransaction { commands, .. },
+        ) = tx.kind
+        else {
+            panic!("Expected a ProgrammableTransaction");
+        };
 
-        let sui::Command::MoveCall(call) = &tx.commands.last().unwrap() else {
+        let sui::types::Command::MoveCall(call) = &commands.last().unwrap() else {
             panic!("Expected last command to be a MoveCall to set invocation cost");
         };
 
         assert_eq!(call.package, objects.workflow_pkg_id);
-
         assert_eq!(
             call.module,
-            workflow::Gas::SET_SINGLE_INVOCATION_COST_MIST
-                .module
-                .to_string(),
+            workflow::Gas::SET_SINGLE_INVOCATION_COST_MIST.module
         );
-
         assert_eq!(
             call.function,
-            workflow::Gas::SET_SINGLE_INVOCATION_COST_MIST
-                .name
-                .to_string()
+            workflow::Gas::SET_SINGLE_INVOCATION_COST_MIST.name
         );
-
         assert_eq!(call.arguments.len(), 5);
     }
 }
diff --git a/sdk/src/types/json_dag.rs b/sdk/src/types/json_dag.rs
index cad49dbf..0f342d9f 100644
--- a/sdk/src/types/json_dag.rs
+++ b/sdk/src/types/json_dag.rs
@@ -28,12 +28,8 @@ pub struct Dag {
 #[derive(Clone, Debug, Deserialize)]
 #[serde(tag = "variant", rename_all = "snake_case")]
 pub enum VertexKind {
-    OffChain {
-        tool_fqn: ToolFqn,
-    },
-    OnChain {
-        //
-    },
+    OffChain { tool_fqn: ToolFqn },
+    OnChain { tool_fqn: ToolFqn },
 }
 
 #[derive(Clone, Debug, Deserialize)]
diff --git a/sdk/src/types/mod.rs b/sdk/src/types/mod.rs
index 33b4997c..e16deb2c 100644
--- a/sdk/src/types/mod.rs
+++ b/sdk/src/types/mod.rs
@@ -11,6 +11,10 @@ mod ports_data;
 #[cfg(feature = "types")]
 mod runtime_vertex;
 
+#[cfg(feature = "types")]
+mod scheduler;
+#[cfg(feature = "types")]
+mod secret_value;
 #[cfg(feature = "types")]
 mod serde_parsers;
 #[cfg(any(feature = "types", feature = "wasm_types"))]
@@ -32,6 +36,8 @@ pub use {
     nexus_objects::NexusObjects,
     ports_data::PortsData,
     runtime_vertex::RuntimeVertex,
+    scheduler::*,
+    secret_value::SecretValue,
     serde_parsers::*,
     tool_meta::ToolMeta,
     type_name::TypeName,
diff --git a/sdk/src/types/nexus_data.rs b/sdk/src/types/nexus_data.rs
index 39ce1ca6..9823e2be 100644
--- a/sdk/src/types/nexus_data.rs
+++ b/sdk/src/types/nexus_data.rs
@@ -18,6 +18,7 @@ use {
     },
     enum_dispatch::enum_dispatch,
     serde::{Deserialize, Serialize},
+    serde_repr::{Deserialize_repr, Serialize_repr},
     std::{collections::HashMap, sync::Arc},
     tokio::sync::Mutex,
 };
@@ -26,6 +27,9 @@ use {
 pub const NEXUS_BASE_TRANSACTION_SIZE: usize = 8 * 1024;
 /// Max transaction size supported by Sui.
 pub const MAX_TRANSACTION_SIZE: usize = 128 * 1024;
+/// Extra bytes we reserve for workflow metadata (DAG, proofs, etc.) when
+/// estimating how much room entry data can take inside a transaction.
+const ENTRY_PORTS_RESERVED_BYTES: usize = 64 * 1024;
 /// The length of a Walrus blob ID.
 pub const WALRUS_BLOB_ID_LENGTH: usize = 44;
 /// How much extra space per encrypted item is needed?
@@ -33,6 +37,29 @@ pub const ENCRYPTION_BASE_SIZE: usize = 440;
 /// What is the inflation factor for encrypted data size?
 pub const ENCRYPTION_INFLATION_FACTOR: usize = 4;
 
+/// Represents how a [`NexusData`] payload should be (or was) encrypted.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize_repr, Deserialize_repr)]
+#[repr(u8)]
+pub enum EncryptionMode {
+    /// Data is kept in plaintext.
+    #[default]
+    Plain             = 0,
+    /// Data is encrypted using the standard double-ratchet message mode.
+    Standard          = 1,
+    /// Data is encrypted using the limited persistent mode, allowing the
+    /// ciphertext to be decrypted multiple times.
+    LimitedPersistent = 2,
+}
+
+impl EncryptionMode {
+    pub fn is_encrypted(self) -> bool {
+        matches!(
+            self,
+            EncryptionMode::Standard | EncryptionMode::LimitedPersistent
+        )
+    }
+}
+
 // == NexusData ==
 
 /// Note that the sole reason the top-level [`NexusData`] struct exists is to
@@ -99,40 +126,48 @@ impl NexusData {
 
     /// Create inline data that is not encrypted.
     pub fn new_inline(data: serde_json::Value) -> Self {
-        Self {
-            data: DataStorage::Inline(InlineStorage {
-                data,
-                encrypted: false,
-            }),
-        }
+        Self::new_inline_with_mode(data, EncryptionMode::Plain)
     }
 
-    /// Create inline data that is encrypted.
+    /// Create inline data that is encrypted with the standard mode.
     pub fn new_inline_encrypted(data: serde_json::Value) -> Self {
+        Self::new_inline_with_mode(data, EncryptionMode::Standard)
+    }
+
+    /// Create inline data encrypted using the limited persistent mode.
+    pub fn new_inline_limited_persistent(data: serde_json::Value) -> Self {
+        Self::new_inline_with_mode(data, EncryptionMode::LimitedPersistent)
+    }
+
+    fn new_inline_with_mode(data: serde_json::Value, encryption_mode: EncryptionMode) -> Self {
         Self {
             data: DataStorage::Inline(InlineStorage {
                 data,
-                encrypted: true,
+                encryption_mode,
             }),
         }
     }
 
     /// Create walrus data that is not encrypted.
     pub fn new_walrus(data: serde_json::Value) -> Self {
-        Self {
-            data: DataStorage::Walrus(WalrusStorage {
-                data,
-                encrypted: false,
-            }),
-        }
+        Self::new_walrus_with_mode(data, EncryptionMode::Plain)
     }
 
-    /// Create walrus data that is encrypted.
+    /// Create walrus data that is encrypted with the standard mode.
     pub fn new_walrus_encrypted(data: serde_json::Value) -> Self {
+        Self::new_walrus_with_mode(data, EncryptionMode::Standard)
+    }
+
+    /// Create walrus data encrypted using the limited persistent mode.
+    pub fn new_walrus_limited_persistent(data: serde_json::Value) -> Self {
+        Self::new_walrus_with_mode(data, EncryptionMode::LimitedPersistent)
+    }
+
+    fn new_walrus_with_mode(data: serde_json::Value, encryption_mode: EncryptionMode) -> Self {
         Self {
             data: DataStorage::Walrus(WalrusStorage {
                 data,
-                encrypted: true,
+                encryption_mode,
             }),
         }
     }
@@ -154,6 +189,15 @@ pub enum DataStorage {
     Walrus(WalrusStorage),
 }
 
+impl DataStorage {
+    pub fn encryption_mode(&self) -> EncryptionMode {
+        match self {
+            DataStorage::Inline(storage) => storage.encryption_mode,
+            DataStorage::Walrus(storage) => storage.encryption_mode,
+        }
+    }
+}
+
 #[cfg(test)]
 impl TryFrom<serde_json::Value> for DataStorage {
     type Error = anyhow::Error;
@@ -168,36 +212,47 @@ impl TryFrom<serde_json::Value> for DataStorage {
             .get("data")
             .ok_or_else(|| anyhow::anyhow!("Missing 'data' field"))?;
 
-        let encrypted = value
-            .get("encrypted")
-            .and_then(|v| v.as_bool())
-            .ok_or_else(|| anyhow::anyhow!("Missing or invalid 'encrypted' field"))?;
+        let encryption_mode = parse_encryption_mode(&value)?;
 
         match kind {
             "inline" => Ok(Self::Inline(InlineStorage {
                 data: data.clone(),
-                encrypted,
+                encryption_mode,
             })),
             "walrus" => Ok(Self::Walrus(WalrusStorage {
                 data: data.clone(),
-                encrypted,
+                encryption_mode,
             })),
             _ => Err(anyhow::anyhow!("Invalid 'kind' value")),
         }
     }
 }
 
+#[cfg(test)]
+fn parse_encryption_mode(value: &serde_json::Value) -> anyhow::Result<EncryptionMode> {
+    let raw = value
+        .get("encryption_mode")
+        .and_then(|v| v.as_u64())
+        .ok_or_else(|| anyhow::anyhow!("Missing or invalid 'encryption_mode' field"))?;
+
+    match raw {
+        0 => Ok(EncryptionMode::Plain),
+        1 => Ok(EncryptionMode::Standard),
+        2 => Ok(EncryptionMode::LimitedPersistent),
+        other => anyhow::bail!("Invalid 'encryption_mode' value: {other}"),
+    }
+}
+
 #[derive(Clone, Debug, PartialEq, Eq, Deserialize, Serialize)]
 pub struct InlineStorage {
     pub(super) data: serde_json::Value,
-    /// Whether the data is encrypted and should be decrypted before use or
-    /// encrypted before committing.
-    pub(super) encrypted: bool,
+    /// Controls how the data is encrypted when committing to storage.
+    pub(super) encryption_mode: EncryptionMode,
 }
 
 impl Storable for InlineStorage {
     async fn fetch(&mut self, _: &StorageConf, session: Arc<Mutex<Session>>) -> anyhow::Result<()> {
-        if self.encrypted {
+        if self.encryption_mode.is_encrypted() {
             self.data = session.lock().await.decrypt_nexus_data_json(&self.data)?;
         }
 
@@ -209,12 +264,21 @@ impl Storable for InlineStorage {
         _: &StorageConf,
         session: Arc<Mutex<Session>>,
     ) -> anyhow::Result<()> {
-        if self.encrypted {
-            session
-                .lock()
-                .await
-                .encrypt_nexus_data_json(&mut self.data)?;
-        }
+        match self.encryption_mode {
+            EncryptionMode::Plain => {}
+            EncryptionMode::Standard => {
+                session
+                    .lock()
+                    .await
+                    .encrypt_nexus_data_json(&mut self.data)?;
+            }
+            EncryptionMode::LimitedPersistent => {
+                session
+                    .lock()
+                    .await
+                    .encrypt_limited_persistent_nexus_data_json(&mut self.data)?;
+            }
+        };
 
         Ok(())
     }
@@ -232,16 +296,15 @@ impl Storable for InlineStorage {
     }
 
     fn is_encrypted(&self) -> bool {
-        self.encrypted
+        self.encryption_mode.is_encrypted()
     }
 }
 
 #[derive(Clone, Debug, PartialEq, Eq, Deserialize, Serialize)]
 pub struct WalrusStorage {
     pub(super) data: serde_json::Value,
-    /// Whether the data is encrypted and should be decrypted before use or
-    /// encrypted before committing.
-    pub(super) encrypted: bool,
+    /// Controls how the data is encrypted when committing to storage.
+    pub(super) encryption_mode: EncryptionMode,
 }
 
 impl Storable for WalrusStorage {
@@ -288,7 +351,7 @@ impl Storable for WalrusStorage {
         let mut data = client.read_json::<serde_json::Value>(&blob_id).await?;
 
         // Decrypt the data if needed.
-        if self.encrypted {
+        if self.encryption_mode.is_encrypted() {
             data = session.lock().await.decrypt_nexus_data_json(&data)?;
         }
 
@@ -313,8 +376,7 @@ impl Storable for WalrusStorage {
 
         if store_for_epochs > WALRUS_MAX_EPOCHS {
             return Err(anyhow::anyhow!(
-                "Walrus save for epochs exceeds maximum allowed ({})",
-                WALRUS_MAX_EPOCHS
+                "Walrus save for epochs exceeds maximum allowed ({WALRUS_MAX_EPOCHS})"
             ));
         }
 
@@ -323,12 +385,21 @@ impl Storable for WalrusStorage {
             .build();
 
         // Encrypt the data if needed.
-        if self.encrypted {
-            session
-                .lock()
-                .await
-                .encrypt_nexus_data_json(&mut self.data)?;
-        }
+        match self.encryption_mode {
+            EncryptionMode::Plain => {}
+            EncryptionMode::Standard => {
+                session
+                    .lock()
+                    .await
+                    .encrypt_nexus_data_json(&mut self.data)?;
+            }
+            EncryptionMode::LimitedPersistent => {
+                session
+                    .lock()
+                    .await
+                    .encrypt_limited_persistent_nexus_data_json(&mut self.data)?;
+            }
+        };
 
         // Store data on Walrus using the client. If it's an array, we store
         // the entire array as a single blob and repeat the key N times where
@@ -397,7 +468,7 @@ impl Storable for WalrusStorage {
     }
 
     fn is_encrypted(&self) -> bool {
-        self.encrypted
+        self.encryption_mode.is_encrypted()
     }
 }
 
@@ -442,11 +513,13 @@ pub trait Storable {
 /// - [`Vec<String>`] that indicates which fields should be encrypted
 /// - [`Vec<String>`] that indicates which fields should be stored remotely
 /// - [`Option<StorageKind>`] that indicates the preferred remote storage kind
+/// - [`EncryptionMode`] that indicates how encrypted fields should be processed
 pub fn json_to_nexus_data_map(
     json: &serde_json::Value,
     encrypt_fields: &[String],
     remote_fields: &[String],
     preferred_remote_storage: Option<StorageKind>,
+    encryption_mode: EncryptionMode,
 ) -> anyhow::Result<HashMap<String, NexusData>> {
     let preferred_remote_storage = preferred_remote_storage.unwrap_or(StorageKind::Walrus);
 
@@ -465,7 +538,15 @@ pub fn json_to_nexus_data_map(
 
         match (encrypt, remote) {
             (false, false) => map.insert(key, NexusData::new_inline(value)),
-            (true, false) => map.insert(key, NexusData::new_inline_encrypted(value)),
+            (true, false) => match encryption_mode {
+                EncryptionMode::Plain => {
+                    anyhow::bail!("Field '{key}' cannot request encryption with a plain mode")
+                }
+                EncryptionMode::Standard => map.insert(key, NexusData::new_inline_encrypted(value)),
+                EncryptionMode::LimitedPersistent => {
+                    map.insert(key, NexusData::new_inline_limited_persistent(value))
+                }
+            },
             (false, true) => match preferred_remote_storage {
                 StorageKind::Walrus => map.insert(key, NexusData::new_walrus(value)),
                 StorageKind::Inline => {
@@ -473,7 +554,17 @@ pub fn json_to_nexus_data_map(
                 }
             },
             (true, true) => match preferred_remote_storage {
-                StorageKind::Walrus => map.insert(key, NexusData::new_walrus_encrypted(value)),
+                StorageKind::Walrus => match encryption_mode {
+                    EncryptionMode::Plain => {
+                        anyhow::bail!("Field '{key}' cannot request encryption with a plain mode")
+                    }
+                    EncryptionMode::Standard => {
+                        map.insert(key, NexusData::new_walrus_encrypted(value))
+                    }
+                    EncryptionMode::LimitedPersistent => {
+                        map.insert(key, NexusData::new_walrus_limited_persistent(value))
+                    }
+                },
                 StorageKind::Inline => {
                     anyhow::bail!("Cannot store data remotely using inline storage")
                 }
@@ -513,7 +604,8 @@ pub fn hint_remote_fields(json: &serde_json::Value) -> anyhow::Result<Vec<String
     // Sort them largest to smallest.
     fields.sort_by(|a, b| b.1.cmp(&a.1));
 
-    let available_size = MAX_TRANSACTION_SIZE - NEXUS_BASE_TRANSACTION_SIZE;
+    let available_size = (MAX_TRANSACTION_SIZE - NEXUS_BASE_TRANSACTION_SIZE)
+        .saturating_sub(ENTRY_PORTS_RESERVED_BYTES);
     let mut required_size = fields.iter().map(|(_, size)| size).sum::<usize>();
 
     if required_size <= available_size {
@@ -1083,7 +1175,14 @@ mod tests {
         ];
         let remote_fields = vec!["plain_walrus".to_string(), "encrypted_walrus".to_string()];
 
-        let map = json_to_nexus_data_map(&json, &encrypt_fields, &remote_fields, None).unwrap();
+        let map = json_to_nexus_data_map(
+            &json,
+            &encrypt_fields,
+            &remote_fields,
+            None,
+            EncryptionMode::Standard,
+        )
+        .unwrap();
 
         assert_eq!(
             map.get("plain_inline").unwrap(),
@@ -1109,7 +1208,14 @@ mod tests {
         let encrypt_fields = vec![];
         let remote_fields = vec![];
 
-        let map = json_to_nexus_data_map(&json, &encrypt_fields, &remote_fields, None).unwrap();
+        let map = json_to_nexus_data_map(
+            &json,
+            &encrypt_fields,
+            &remote_fields,
+            None,
+            EncryptionMode::Standard,
+        )
+        .unwrap();
         assert!(map.is_empty());
     }
 
@@ -1119,7 +1225,13 @@ mod tests {
         let encrypt_fields = vec![];
         let remote_fields = vec![];
 
-        let result = json_to_nexus_data_map(&json, &encrypt_fields, &remote_fields, None);
+        let result = json_to_nexus_data_map(
+            &json,
+            &encrypt_fields,
+            &remote_fields,
+            None,
+            EncryptionMode::Standard,
+        );
         assert!(result.is_err());
         assert_matches!(
             result,
@@ -1141,6 +1253,7 @@ mod tests {
             &encrypt_fields,
             &remote_fields,
             Some(StorageKind::Inline),
+            EncryptionMode::Standard,
         );
         assert!(result.is_err());
         assert_matches!(
@@ -1162,6 +1275,7 @@ mod tests {
             &encrypt_fields,
             &remote_fields,
             Some(StorageKind::Inline),
+            EncryptionMode::Standard,
         );
         assert!(result.is_err());
         assert_matches!(
@@ -1170,6 +1284,79 @@ mod tests {
         );
     }
 
+    #[test]
+    fn test_json_to_nexus_data_map_limited_persistent_encryption() {
+        let json = json!({ "enc_field": 42 });
+        let encrypt_fields = vec!["enc_field".to_string()];
+        let remote_fields = vec![];
+
+        let map = json_to_nexus_data_map(
+            &json,
+            &encrypt_fields,
+            &remote_fields,
+            None,
+            EncryptionMode::LimitedPersistent,
+        )
+        .expect("map");
+
+        assert_eq!(
+            map.get("enc_field").unwrap(),
+            &NexusData::new_inline_limited_persistent(json.get("enc_field").unwrap().clone())
+        );
+    }
+
+    #[test]
+    fn test_json_to_nexus_data_map_plain_mode_rejects_encrypted_fields() {
+        let json = json!({ "secret": 1 });
+        let encrypt_fields = vec!["secret".to_string()];
+        let remote_fields = vec![];
+
+        let result = json_to_nexus_data_map(
+            &json,
+            &encrypt_fields,
+            &remote_fields,
+            None,
+            EncryptionMode::Plain,
+        );
+
+        assert!(result.is_err());
+        assert_matches!(
+            result,
+            Err(e) if e.to_string().contains("cannot request encryption with a plain mode")
+        );
+    }
+
+    #[tokio::test]
+    async fn test_inline_limited_persistent_commit_encrypts() {
+        use {crate::test_utils::nexus_mocks, std::sync::Arc};
+
+        let storage_conf = StorageConf::default();
+        let (session, _) = nexus_mocks::mock_session();
+
+        let committed = NexusData::new_inline_limited_persistent(json!({"msg": "hi"}))
+            .commit(&storage_conf, Arc::clone(&session))
+            .await
+            .expect("commit");
+
+        let inline = match committed {
+            DataStorage::Inline(storage) => storage,
+            other => panic!("Expected inline storage, got {other:?}"),
+        };
+
+        assert!(
+            inline.is_encrypted(),
+            "limited persistent data must be encrypted"
+        );
+
+        let kind = inline
+            .as_json()
+            .get("kind")
+            .and_then(|v| v.as_str())
+            .expect("encrypted payload must contain kind");
+
+        assert_eq!(kind, "limited_persistent");
+    }
+
     #[test]
     fn test_hint_remote_fields_all_fit() {
         // All fields fit within the transaction size.
@@ -1222,8 +1409,10 @@ mod tests {
     #[test]
     fn test_hint_remote_fields_array_storage_cost() {
         // Create a large array to overflow the transaction size.
-        let arr_len =
-            ((MAX_TRANSACTION_SIZE - NEXUS_BASE_TRANSACTION_SIZE) / WALRUS_BLOB_ID_LENGTH) - 10;
+        let effective_budget = MAX_TRANSACTION_SIZE
+            .saturating_sub(NEXUS_BASE_TRANSACTION_SIZE)
+            .saturating_sub(ENTRY_PORTS_RESERVED_BYTES);
+        let arr_len = (effective_budget / WALRUS_BLOB_ID_LENGTH).saturating_sub(10);
         let arr: Vec<serde_json::Value> = (0..arr_len)
             // Make the data longer than the walrus key storage cost to ensure
             // storing remotely is beneficial.
diff --git a/sdk/src/types/nexus_data_parser.rs b/sdk/src/types/nexus_data_parser.rs
index 7057c79b..2ebe7595 100644
--- a/sdk/src/types/nexus_data_parser.rs
+++ b/sdk/src/types/nexus_data_parser.rs
@@ -1,16 +1,16 @@
 //! Module that defines serde serialization and deserialization for [`NexusData`]
 //!
 //! We represent nexus data onchain as a struct of
-//! `{ storage: u8[], one: u8[], many: u8[][], encrypted: bool }`.
+//! `{ storage: u8[], one: u8[], many: u8[][], encryption_mode: u8 }`.
 //!
 //! However, storage has a special value [NEXUS_DATA_INLINE_STORAGE_TAG].
 //! Therefore we represent [NexusData] as an enum within the codebase.
 //!
 //! `one` and `many` are mutually exclusive, meaning that if one is
 //! present, the other cannot be. The `one` field is used for single values,
-//! while the `many` field is used for arrays of values. The `encrypted` field
-//! indicates whether the data is encrypted and should be decrypted before
-//! use.
+//! while the `many` field is used for arrays of values. The `encryption_mode`
+//! field indicates whether (and how) the data is encrypted and should be
+//! decrypted before use.
 
 /// This is a hard-coded identifier for inline data in nexus.
 /// Inline means you can parse it as is, without any additional processing.
@@ -24,7 +24,17 @@ const NEXUS_DATA_INLINE_STORAGE_TAG: &[u8] = b"inline";
 const NEXUS_DATA_WALRUS_STORAGE_TAG: &[u8] = b"walrus";
 
 use {
-    crate::types::{DataStorage, InlineStorage, NexusData, Storable, WalrusStorage},
+    crate::types::{
+        deserialize_encoded_bytes,
+        deserialize_encoded_bytes_vec,
+        serialize_encoded_bytes,
+        serialize_encoded_bytes_vec,
+        DataStorage,
+        EncryptionMode,
+        InlineStorage,
+        NexusData,
+        WalrusStorage,
+    },
     serde::{Deserialize, Deserializer, Serialize, Serializer},
 };
 
@@ -32,10 +42,56 @@ use {
 struct NexusDataAsStruct {
     /// Either identifies some remote storage or is equal to [NEXUS_DATA_INLINE_STORAGE_TAG]
     /// if the data can be parsed as is.
+    #[serde(
+        deserialize_with = "deserialize_encoded_bytes",
+        serialize_with = "serialize_encoded_bytes"
+    )]
     storage: Vec<u8>,
+    #[serde(
+        deserialize_with = "deserialize_encoded_bytes",
+        serialize_with = "serialize_encoded_bytes"
+    )]
     one: Vec<u8>,
+    #[serde(
+        deserialize_with = "deserialize_encoded_bytes_vec",
+        serialize_with = "serialize_encoded_bytes_vec"
+    )]
     many: Vec<Vec<u8>>,
-    encrypted: bool,
+    encryption_mode: u8,
+}
+
+impl NexusDataAsStruct {
+    fn mode(&self) -> Result<EncryptionMode, serde::de::value::Error> {
+        match self.encryption_mode {
+            0 => Ok(EncryptionMode::Plain),
+            1 => Ok(EncryptionMode::Standard),
+            2 => Ok(EncryptionMode::LimitedPersistent),
+            other => Err(serde::de::Error::custom(format!(
+                "Invalid encryption_mode value: {other}"
+            ))),
+        }
+    }
+}
+
+/// Check if a string represents a large number (u128/u256 range).
+/// Handles both positive and negative integers.
+fn is_large_number(s: &str) -> bool {
+    if let Some(stripped) = s.strip_prefix('-') {
+        stripped.chars().all(|c| c.is_ascii_digit()) && s.len() > 21
+    } else {
+        s.chars().all(|c| c.is_ascii_digit()) && s.len() > 20
+    }
+}
+
+/// Wrap large numbers as JSON strings to preserve precision for u128/u256.
+fn wrap_large_numbers_as_string(value: &str) -> String {
+    let trimmed = value.trim();
+
+    if is_large_number(trimmed) {
+        format!(r#""{trimmed}""#)
+    } else {
+        trimmed.to_string()
+    }
 }
 
 impl<'de> Deserialize<'de> for NexusData {
@@ -44,38 +100,51 @@ impl<'de> Deserialize<'de> for NexusData {
         D: Deserializer<'de>,
     {
         let data: NexusDataAsStruct = Deserialize::deserialize(deserializer)?;
+        let encryption_mode = data.mode().map_err(serde::de::Error::custom)?;
+        let NexusDataAsStruct {
+            storage, one, many, ..
+        } = data;
 
-        let value = if !data.one.is_empty() {
+        let value = if !one.is_empty() {
             // If we're dealing with a single value, we assume that
             // the data is a JSON string that can be parsed directly.
-            let str = String::from_utf8(data.one).map_err(serde::de::Error::custom)?;
+            let str = String::from_utf8(one).map_err(serde::de::Error::custom)?;
+
+            // Wrap large numbers as strings to preserve precision.
+            // We also trim the value to remove any leading or trailing whitespace.
+            let adjusted_value = wrap_large_numbers_as_string(&str);
 
-            serde_json::from_str(&str).map_err(serde::de::Error::custom)?
+            serde_json::from_str(&adjusted_value).map_err(serde::de::Error::custom)?
         } else {
             // If we're dealing with multiple values, we assume that
             // the data is an array of JSON strings that can be parsed.
-            let mut values = Vec::with_capacity(data.many.len());
+            let mut values = Vec::with_capacity(many.len());
 
-            for value in data.many {
+            for value in many {
                 let str = String::from_utf8(value).map_err(serde::de::Error::custom)?;
 
-                values.push(serde_json::from_str(&str).map_err(serde::de::Error::custom)?);
+                // Wrap large numbers as strings to preserve precision.
+                // We also trim the value to remove any leading or trailing whitespace.
+                let adjusted_value = wrap_large_numbers_as_string(&str);
+
+                values
+                    .push(serde_json::from_str(&adjusted_value).map_err(serde::de::Error::custom)?);
             }
 
             serde_json::Value::Array(values)
         };
 
-        match data.storage.as_ref() {
+        match storage.as_ref() {
             NEXUS_DATA_INLINE_STORAGE_TAG => Ok(NexusData {
                 data: DataStorage::Inline(InlineStorage {
                     data: value,
-                    encrypted: data.encrypted,
+                    encryption_mode,
                 }),
             }),
             NEXUS_DATA_WALRUS_STORAGE_TAG => Ok(NexusData {
                 data: DataStorage::Walrus(WalrusStorage {
                     data: value,
-                    encrypted: data.encrypted,
+                    encryption_mode,
                 }),
             }),
             // Add more...
@@ -95,7 +164,7 @@ impl Serialize for NexusData {
             // Add more...
         };
 
-        let encrypted = self.data.is_encrypted();
+        let encryption_mode = self.data.encryption_mode() as u8;
 
         let storage = match &self.data {
             DataStorage::Inline { .. } => NEXUS_DATA_INLINE_STORAGE_TAG.to_vec(),
@@ -132,7 +201,7 @@ impl Serialize for NexusData {
             storage,
             one,
             many,
-            encrypted,
+            encryption_mode,
         }
         .serialize(serializer)
     }
@@ -151,7 +220,7 @@ mod tests {
                 data: serde_json::json!({
                     "key": "value"
                 }),
-                encrypted: false,
+                encryption_mode: EncryptionMode::Plain,
             }),
         };
 
@@ -169,10 +238,10 @@ mod tests {
         );
 
         // The byte representation of the JSON object
-        // {"key":"value"} is [123,34,107,101,121,34,58,34,118,97,108,117,101,34,125]
+        // {"key":"value"} is "eyJrZXkiOiJ2YWx1ZSJ9"
         assert_eq!(
             serialized,
-            r#"{"storage":[105,110,108,105,110,101],"one":[123,34,107,101,121,34,58,34,118,97,108,117,101,34,125],"many":[],"encrypted":false}"#
+            r#"{"storage":"aW5saW5l","one":"eyJrZXkiOiJ2YWx1ZSJ9","many":[],"encryption_mode":0}"#
         );
 
         let deserialized = serde_json::from_str(&serialized).unwrap();
@@ -186,7 +255,7 @@ mod tests {
                     { "key": "value" },
                     { "key": "value" }
                 ]),
-                encrypted: true,
+                encryption_mode: EncryptionMode::Standard,
             }),
         };
 
@@ -202,7 +271,7 @@ mod tests {
 
         assert_eq!(
             serialized,
-            r#"{"storage":[105,110,108,105,110,101],"one":[],"many":[[123,34,107,101,121,34,58,34,118,97,108,117,101,34,125],[123,34,107,101,121,34,58,34,118,97,108,117,101,34,125]],"encrypted":true}"#
+            r#"{"storage":"aW5saW5l","one":"","many":["eyJrZXkiOiJ2YWx1ZSJ9","eyJrZXkiOiJ2YWx1ZSJ9"],"encryption_mode":1}"#
         );
 
         let deserialized = serde_json::from_str(&serialized).unwrap();
@@ -218,7 +287,7 @@ mod tests {
                 data: serde_json::json!({
                     "key": "value"
                 }),
-                encrypted: false,
+                encryption_mode: EncryptionMode::Plain,
             }),
         };
 
@@ -236,7 +305,7 @@ mod tests {
         // {"key":"value"} is [123,34,107,101,121,34,58,34,118,97,108,117,101,34,125]
         assert_eq!(
             serialized,
-            r#"{"storage":[119,97,108,114,117,115],"one":[123,34,107,101,121,34,58,34,118,97,108,117,101,34,125],"many":[],"encrypted":false}"#
+            r#"{"storage":"d2FscnVz","one":"eyJrZXkiOiJ2YWx1ZSJ9","many":[],"encryption_mode":0}"#
         );
 
         let deserialized = serde_json::from_str(&serialized).unwrap();
@@ -250,7 +319,7 @@ mod tests {
                     { "key": "value" },
                     { "key": "value" }
                 ]),
-                encrypted: true,
+                encryption_mode: EncryptionMode::Standard,
             }),
         };
 
@@ -266,11 +335,36 @@ mod tests {
 
         assert_eq!(
             serialized,
-            r#"{"storage":[119,97,108,114,117,115],"one":[],"many":[[123,34,107,101,121,34,58,34,118,97,108,117,101,34,125],[123,34,107,101,121,34,58,34,118,97,108,117,101,34,125]],"encrypted":true}"#
+            r#"{"storage":"d2FscnVz","one":"","many":["eyJrZXkiOiJ2YWx1ZSJ9","eyJrZXkiOiJ2YWx1ZSJ9"],"encryption_mode":1}"#
         );
 
         let deserialized = serde_json::from_str(&serialized).unwrap();
 
         assert_eq!(dag_data, deserialized);
     }
+
+    #[test]
+    fn test_large_number_precision_preserved() {
+        // Test that large numbers (like u256) are converted to strings to preserve precision.
+        let large_u256 =
+            "105792089237316195563853351929625371316844592863025172891227567439681422591090";
+
+        // Create NexusData with a large number as a string value.
+        let nexus_data = NexusData::new_inline(serde_json::Value::String(large_u256.to_string()));
+
+        // Serialize and deserialize to verify precision is preserved.
+        let serialized = serde_json::to_string(&nexus_data).unwrap();
+        let deserialized: NexusData = serde_json::from_str(&serialized).unwrap();
+
+        // The large number should be stored as a string to avoid precision loss.
+        match &deserialized.data {
+            DataStorage::Inline(storage) => {
+                assert_eq!(
+                    storage.data,
+                    serde_json::Value::String(large_u256.to_string())
+                );
+            }
+            _ => panic!("Expected inline storage"),
+        }
+    }
 }
diff --git a/sdk/src/types/nexus_objects.rs b/sdk/src/types/nexus_objects.rs
index c129e840..cb60dfc3 100644
--- a/sdk/src/types/nexus_objects.rs
+++ b/sdk/src/types/nexus_objects.rs
@@ -1,5 +1,11 @@
 //! [`NexusObjects`] struct is holding the Nexus object IDs and refs that are
 //! generated during Nexus package deployment.
+#[cfg(feature = "sui_idents")]
+use super::{scheduler::PolicySymbol, TypeName};
+#[cfg(all(test, feature = "sui_idents"))]
+use crate::idents::primitives;
+#[cfg(feature = "sui_idents")]
+use crate::idents::{workflow, ModuleAndNameIdent};
 use {
     crate::sui,
     serde::{Deserialize, Serialize},
@@ -7,12 +13,183 @@ use {
 
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
 pub struct NexusObjects {
-    pub workflow_pkg_id: sui::ObjectID,
-    pub primitives_pkg_id: sui::ObjectID,
-    pub interface_pkg_id: sui::ObjectID,
-    pub network_id: sui::ObjectID,
-    pub tool_registry: sui::ObjectRef,
-    pub default_tap: sui::ObjectRef,
-    pub gas_service: sui::ObjectRef,
-    pub pre_key_vault: sui::ObjectRef,
+    pub workflow_pkg_id: sui::types::Address,
+    pub primitives_pkg_id: sui::types::Address,
+    pub interface_pkg_id: sui::types::Address,
+    pub network_id: sui::types::Address,
+    pub tool_registry: sui::types::ObjectReference,
+    pub default_tap: sui::types::ObjectReference,
+    pub gas_service: sui::types::ObjectReference,
+    pub pre_key_vault: sui::types::ObjectReference,
+}
+
+#[cfg(feature = "sui_idents")]
+impl NexusObjects {
+    /// Returns true when the event payload originates from the configured workflow or interface package.
+    pub fn is_event_from_nexus(&self, event: &sui::types::Event) -> bool {
+        let Some(sui::types::TypeTag::Struct(inner_tag)) = event.type_.type_params().first() else {
+            return false;
+        };
+
+        if *inner_tag.address() == self.workflow_pkg_id {
+            return true;
+        }
+
+        if *inner_tag.address() == self.interface_pkg_id
+            && inner_tag.module().as_str() == "v1"
+            && inner_tag.name().as_str() == "AnnounceInterfacePackageEvent"
+        {
+            let Some(sui::types::TypeTag::Struct(witness)) = inner_tag.type_params().first() else {
+                return false;
+            };
+
+            return *witness.address() == self.workflow_pkg_id;
+        }
+
+        false
+    }
+
+    /// Fully-qualified Move type name for the queue generator witness.
+    pub fn scheduler_queue_generator_symbol(&self) -> PolicySymbol {
+        self.sched_generator_symbol(&workflow::Scheduler::QUEUE_GENERATOR_WITNESS)
+    }
+
+    /// Fully-qualified Move type name for the periodic generator witness.
+    pub fn scheduler_periodic_generator_symbol(&self) -> PolicySymbol {
+        self.sched_generator_symbol(&workflow::Scheduler::PERIODIC_GENERATOR_WITNESS)
+    }
+
+    /// Returns true when the provided policy symbol references the queue generator witness.
+    pub fn scheduler_matches_queue_generator(&self, symbol: &PolicySymbol) -> bool {
+        self.generator_matches(symbol, &workflow::Scheduler::QUEUE_GENERATOR_WITNESS)
+    }
+
+    /// Returns true when the provided policy symbol references the periodic generator witness.
+    pub fn scheduler_matches_periodic_generator(&self, symbol: &PolicySymbol) -> bool {
+        self.generator_matches(symbol, &workflow::Scheduler::PERIODIC_GENERATOR_WITNESS)
+    }
+
+    fn sched_generator_symbol(&self, ident: &ModuleAndNameIdent) -> PolicySymbol {
+        PolicySymbol::Witness(TypeName::new(&ident.qualified_name(self.workflow_pkg_id)))
+    }
+
+    fn generator_matches(&self, symbol: &PolicySymbol, ident: &ModuleAndNameIdent) -> bool {
+        let expected = ident.qualified_name(self.workflow_pkg_id);
+        symbol.matches_qualified_name(&expected)
+    }
+}
+
+#[cfg(all(test, feature = "sui_idents"))]
+mod tests {
+    use super::*;
+
+    fn sample_objects() -> NexusObjects {
+        let mut rng = rand::thread_rng();
+
+        NexusObjects {
+            workflow_pkg_id: sui::types::Address::generate(&mut rng),
+            primitives_pkg_id: sui::types::Address::generate(&mut rng),
+            interface_pkg_id: sui::types::Address::generate(&mut rng),
+            network_id: sui::types::Address::generate(&mut rng),
+            tool_registry: sui::types::ObjectReference::new(
+                sui::types::Address::generate(&mut rng),
+                1,
+                sui::types::Digest::generate(&mut rng),
+            ),
+            default_tap: sui::types::ObjectReference::new(
+                sui::types::Address::generate(&mut rng),
+                1,
+                sui::types::Digest::generate(&mut rng),
+            ),
+            gas_service: sui::types::ObjectReference::new(
+                sui::types::Address::generate(&mut rng),
+                1,
+                sui::types::Digest::generate(&mut rng),
+            ),
+            pre_key_vault: sui::types::ObjectReference::new(
+                sui::types::Address::generate(&mut rng),
+                1,
+                sui::types::Digest::generate(&mut rng),
+            ),
+        }
+    }
+
+    fn wrap_event(objects: &NexusObjects, inner: sui::types::StructTag) -> sui::types::Event {
+        let rng = &mut rand::thread_rng();
+
+        sui::types::Event {
+            package_id: objects.primitives_pkg_id,
+            module: primitives::Event::EVENT_WRAPPER.module,
+            sender: sui::types::Address::generate(rng),
+            type_: sui::types::StructTag::new(
+                objects.primitives_pkg_id,
+                primitives::Event::EVENT_WRAPPER.module,
+                primitives::Event::EVENT_WRAPPER.name,
+                vec![sui::types::TypeTag::Struct(Box::new(inner))],
+            ),
+            contents: vec![],
+        }
+    }
+
+    #[test]
+    fn matches_workflow_and_interface_events() {
+        let objects = sample_objects();
+        let rng = &mut rand::thread_rng();
+
+        let workflow_event = wrap_event(
+            &objects,
+            sui::types::StructTag::new(
+                objects.workflow_pkg_id,
+                workflow::Scheduler::TASK.module,
+                workflow::Scheduler::TASK.name,
+                vec![],
+            ),
+        );
+
+        assert!(objects.is_event_from_nexus(&workflow_event));
+
+        let interface_event = wrap_event(
+            &objects,
+            sui::types::StructTag::new(
+                objects.interface_pkg_id,
+                sui::types::Identifier::from_static("v1"),
+                sui::types::Identifier::from_static("AnnounceInterfacePackageEvent"),
+                vec![sui::types::TypeTag::Struct(Box::new(
+                    sui::types::StructTag::new(
+                        objects.workflow_pkg_id,
+                        workflow::Scheduler::TASK.module,
+                        workflow::Scheduler::TASK.name,
+                        vec![],
+                    ),
+                ))],
+            ),
+        );
+
+        assert!(objects.is_event_from_nexus(&interface_event));
+
+        let unrelated_event = wrap_event(
+            &objects,
+            sui::types::StructTag::new(
+                sui::types::Address::generate(rng),
+                sui::types::Identifier::from_static("foo"),
+                sui::types::Identifier::from_static("bar"),
+                vec![],
+            ),
+        );
+
+        assert!(!objects.is_event_from_nexus(&unrelated_event));
+    }
+
+    #[test]
+    fn generator_helpers_match_symbols() {
+        let objects = sample_objects();
+
+        let queue = objects.scheduler_queue_generator_symbol();
+        assert!(objects.scheduler_matches_queue_generator(&queue));
+        assert!(!objects.scheduler_matches_periodic_generator(&queue));
+
+        let periodic = objects.scheduler_periodic_generator_symbol();
+        assert!(objects.scheduler_matches_periodic_generator(&periodic));
+        assert!(!objects.scheduler_matches_queue_generator(&periodic));
+    }
 }
diff --git a/sdk/src/types/ports_data.rs b/sdk/src/types/ports_data.rs
index 67c01c41..40b982c7 100644
--- a/sdk/src/types/ports_data.rs
+++ b/sdk/src/types/ports_data.rs
@@ -172,7 +172,7 @@ mod tests {
 
         assert_eq!(
             json,
-            r#"{"contents":[{"key":{"name":"port1"},"value":{"storage":[105,110,108,105,110,101],"one":[123,34,107,101,121,34,58,34,118,97,108,117,101,34,125],"many":[],"encrypted":false}}]}"#
+            r#"{"contents":[{"key":{"name":"port1"},"value":{"storage":"aW5saW5l","one":"eyJrZXkiOiJ2YWx1ZSJ9","many":[],"encryption_mode":0}}]}"#
         );
 
         let deserialized: PortsData = serde_json::from_str(&json).unwrap();
diff --git a/sdk/src/types/runtime_vertex.rs b/sdk/src/types/runtime_vertex.rs
index 67f02b4b..389f4c3e 100644
--- a/sdk/src/types/runtime_vertex.rs
+++ b/sdk/src/types/runtime_vertex.rs
@@ -13,7 +13,7 @@ use {
 };
 
 #[derive(Clone, Debug, PartialEq, Eq, Deserialize, Serialize)]
-#[serde(tag = "variant", content = "fields")]
+#[serde(tag = "@variant")]
 pub enum RuntimeVertex {
     Plain {
         vertex: TypeName,
@@ -80,19 +80,14 @@ mod tests {
 
         let json = serde_json::to_string(&vertex).unwrap();
 
-        assert_eq!(
-            json,
-            r#"{"variant":"Plain","fields":{"vertex":{"name":"vertex_a"}}}"#,
-        );
+        assert_eq!(json, r#"{"@variant":"Plain","vertex":{"name":"vertex_a"}}"#,);
     }
 
     #[test]
     fn test_deserialize_plain() {
         let json = r#"{
-            "variant": "Plain",
-            "fields": {
-                "vertex": { "name": "vertex_b" }
-            }
+            "@variant": "Plain",
+            "vertex": { "name": "vertex_b" }
         }"#;
 
         let vertex: RuntimeVertex = serde_json::from_str(json).unwrap();
@@ -123,19 +118,17 @@ mod tests {
 
         assert_eq!(
             json,
-            r#"{"variant":"WithIterator","fields":{"vertex":{"name":"vertex_c"},"iteration":"5","out_of":"10"}}"#
+            r#"{"@variant":"WithIterator","vertex":{"name":"vertex_c"},"iteration":"5","out_of":"10"}"#
         );
     }
 
     #[test]
     fn test_deserialize_with_iterator() {
         let json = r#"{
-            "variant": "WithIterator",
-            "fields": {
-                "vertex": { "name": "vertex_d" },
-                "iteration": "7",
-                "out_of": "15"
-            }
+            "@variant": "WithIterator",
+            "vertex": { "name": "vertex_d" },
+            "iteration": "7",
+            "out_of": "15"
         }"#;
 
         let vertex: RuntimeVertex = serde_json::from_str(json).unwrap();
diff --git a/sdk/src/types/scheduler.rs b/sdk/src/types/scheduler.rs
new file mode 100644
index 00000000..8b0fefaf
--- /dev/null
+++ b/sdk/src/types/scheduler.rs
@@ -0,0 +1,463 @@
+//! This module contains a struct representation of the task used by the scheduler.
+//! It provides a way to serialize and deserialize the task and any helper structures.
+use {
+    super::{
+        serde_parsers::{deserialize_sui_u64, serialize_sui_u64},
+        TypeName,
+    },
+    crate::{
+        nexus::crawler::{Bag, Map, ObjectBag, TableVec},
+        sui,
+        types::NexusData,
+    },
+    serde::{Deserialize, Deserializer, Serialize, Serializer},
+};
+
+/// Representation of `nexus_workflow::dag::DagExecutionConfig`.
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
+pub struct DagExecutionConfig {
+    pub dag: sui::types::Address,
+    pub network: sui::types::Address,
+    pub entry_group: SchedulerEntryGroup,
+    pub inputs: Map<TypeName, Map<InputPort, NexusData>>,
+    pub invoker: sui::types::Address,
+    #[serde(
+        deserialize_with = "deserialize_sui_u64",
+        serialize_with = "serialize_sui_u64"
+    )]
+    pub priority_fee_per_gas_unit: u64,
+}
+
+/// Representation of `nexus_workflow::dag::InputPort`.
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq, Eq, Hash)]
+pub struct InputPort {
+    pub name: String,
+    pub encrypted: bool,
+}
+
+/// Representation of `nexus_workflow::scheduler::Task`.
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq)]
+pub struct Task {
+    pub id: sui::types::Address,
+    pub owner: sui::types::Address,
+    pub metadata: Metadata,
+    pub constraints: Policy<ConstraintsData>,
+    pub execution: Policy<ExecutionData>,
+    pub state: TaskState,
+    pub data: Bag,
+    pub objects: ObjectBag,
+}
+
+/// Minimal representation of `nexus_primitives::policy::Policy`.
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
+pub struct Policy<T> {
+    pub id: sui::types::Address,
+    pub dfa: ConfiguredAutomaton,
+    #[serde(
+        deserialize_with = "deserialize_sui_u64",
+        serialize_with = "serialize_sui_u64"
+    )]
+    pub state_index: u64,
+    pub data: T,
+}
+
+/// Minimal representation of `nexus_primitives::automaton::ConfiguredAutomaton`.
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
+pub struct ConfiguredAutomaton {
+    pub id: sui::types::Address,
+    pub dfa: DeterministicAutomaton,
+}
+
+/// Deterministic automaton backing a policy.
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
+pub struct DeterministicAutomaton {
+    pub states: TableVec<u64>,
+    pub alphabet: TableVec<PolicySymbol>,
+    pub transition: TableVec<TableVec<u64>>,
+    pub accepting: TableVec<bool>,
+    #[serde(
+        deserialize_with = "deserialize_sui_u64",
+        serialize_with = "serialize_sui_u64"
+    )]
+    pub start: u64,
+}
+
+/// Representation of `nexus_primitives::policy::Symbol`.
+#[derive(Clone, Debug, PartialEq, Eq, Hash)]
+pub enum PolicySymbol {
+    Witness(TypeName),
+    Uid(sui::types::Address),
+}
+
+// TODO: BCS and JSON standardization
+// TODO: https://github.com/Talus-Network/nexus-sdk/issues/364
+impl<'de> Deserialize<'de> for PolicySymbol {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: Deserializer<'de>,
+    {
+        // Non-human readable formats (BCS) use the standard enum layout.
+        if !deserializer.is_human_readable() {
+            #[derive(Deserialize)]
+            enum Standard {
+                Witness(TypeName),
+                Uid(sui::types::Address),
+            }
+
+            return match Standard::deserialize(deserializer)? {
+                Standard::Witness(name) => Ok(PolicySymbol::Witness(name)),
+                Standard::Uid(uid) => Ok(PolicySymbol::Uid(uid)),
+            };
+        }
+
+        // Human readable formats (GraphQL/JSON) use the { variant, fields: { pos0 } } shape.
+        #[derive(Deserialize)]
+        struct Fields<T> {
+            #[serde(rename = "pos0")]
+            pos0: T,
+        }
+
+        let value: serde_json::Value = Deserialize::deserialize(deserializer)?;
+        let object = value
+            .as_object()
+            .ok_or_else(|| serde::de::Error::custom("PolicySymbol must be an object"))?;
+
+        let variant = object
+            .get("variant")
+            .or_else(|| object.get("@variant"))
+            .and_then(|value| value.as_str())
+            .ok_or_else(|| serde::de::Error::custom("PolicySymbol missing variant tag"))?;
+
+        let fields = object
+            .get("fields")
+            .or_else(|| object.get("@fields"))
+            .cloned()
+            .or_else(|| {
+                object.get("pos0").cloned().map(|pos0| {
+                    let mut map = serde_json::Map::new();
+                    map.insert("pos0".to_string(), pos0);
+                    serde_json::Value::Object(map)
+                })
+            })
+            .ok_or_else(|| serde::de::Error::custom("PolicySymbol missing fields payload"))?;
+
+        match variant {
+            "Witness" => {
+                let fields: Fields<TypeName> =
+                    serde_json::from_value(fields).map_err(serde::de::Error::custom)?;
+                Ok(PolicySymbol::Witness(fields.pos0))
+            }
+            "Uid" => {
+                let fields: Fields<sui::types::Address> =
+                    serde_json::from_value(fields).map_err(serde::de::Error::custom)?;
+                Ok(PolicySymbol::Uid(fields.pos0))
+            }
+            other => Err(serde::de::Error::custom(format!(
+                "Unknown policy symbol variant: {other}"
+            ))),
+        }
+    }
+}
+
+impl Serialize for PolicySymbol {
+    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
+    where
+        S: serde::Serializer,
+    {
+        // Non-human readable formats (BCS) use the standard enum layout.
+        if !serializer.is_human_readable() {
+            #[derive(Serialize)]
+            enum Standard<'a> {
+                Witness(&'a TypeName),
+                Uid(sui::types::Address),
+            }
+
+            return match self {
+                PolicySymbol::Witness(name) => Standard::Witness(name).serialize(serializer),
+                PolicySymbol::Uid(uid) => Standard::Uid(*uid).serialize(serializer),
+            };
+        }
+
+        // Human readable formats (GraphQL/JSON) use the { variant, fields: { pos0 } } shape.
+        #[derive(Serialize)]
+        struct Fields<'a, T> {
+            #[serde(rename = "pos0")]
+            pos0: &'a T,
+        }
+
+        #[derive(Serialize)]
+        struct Tagged<'a, T> {
+            variant: &'a str,
+            fields: Fields<'a, T>,
+        }
+
+        match self {
+            PolicySymbol::Witness(name) => Tagged {
+                variant: "Witness",
+                fields: Fields { pos0: name },
+            }
+            .serialize(serializer),
+            PolicySymbol::Uid(uid) => Tagged {
+                variant: "Uid",
+                fields: Fields { pos0: uid },
+            }
+            .serialize(serializer),
+        }
+    }
+}
+
+impl PolicySymbol {
+    pub fn as_witness(&self) -> Option<&TypeName> {
+        match self {
+            PolicySymbol::Witness(name) => Some(name),
+            PolicySymbol::Uid(_) => None,
+        }
+    }
+
+    pub fn as_uid(&self) -> Option<&sui::types::Address> {
+        match self {
+            PolicySymbol::Uid(uid) => Some(uid),
+            PolicySymbol::Witness(_) => None,
+        }
+    }
+
+    /// Returns true when the witness matches the fully-qualified name.
+    pub fn matches_qualified_name(&self, expected: &str) -> bool {
+        self.as_witness()
+            .map(|name| name.matches_qualified_name(expected))
+            .unwrap_or(false)
+    }
+}
+
+/// Scheduler task state.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum TaskState {
+    Active,
+    Paused,
+    Canceled,
+}
+
+impl<'de> Deserialize<'de> for TaskState {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: Deserializer<'de>,
+    {
+        #[derive(Deserialize)]
+        enum Standard {
+            Active,
+            Paused,
+            Canceled,
+        }
+
+        if !deserializer.is_human_readable() {
+            return match Standard::deserialize(deserializer)? {
+                Standard::Active => Ok(TaskState::Active),
+                Standard::Paused => Ok(TaskState::Paused),
+                Standard::Canceled => Ok(TaskState::Canceled),
+            };
+        }
+
+        let value: serde_json::Value = Deserialize::deserialize(deserializer)?;
+
+        let variant = match value {
+            serde_json::Value::String(variant) => variant,
+            serde_json::Value::Object(object) => object
+                .get("variant")
+                .or_else(|| object.get("@variant"))
+                .and_then(|value| value.as_str())
+                .ok_or_else(|| serde::de::Error::custom("TaskState missing variant tag"))?
+                .to_string(),
+            other => {
+                return Err(serde::de::Error::custom(format!(
+                    "unexpected value for TaskState: {other}"
+                )))
+            }
+        };
+
+        match variant.as_str() {
+            "Active" => Ok(TaskState::Active),
+            "Paused" => Ok(TaskState::Paused),
+            "Canceled" => Ok(TaskState::Canceled),
+            other => Err(serde::de::Error::unknown_variant(
+                other,
+                &["Active", "Paused", "Canceled"],
+            )),
+        }
+    }
+}
+
+impl Serialize for TaskState {
+    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
+    where
+        S: Serializer,
+    {
+        #[derive(Serialize)]
+        enum Standard<'a> {
+            Active,
+            Paused,
+            Canceled,
+            #[allow(dead_code)]
+            #[serde(skip)]
+            _Marker(&'a ()),
+        }
+
+        if !serializer.is_human_readable() {
+            return match self {
+                TaskState::Active => Standard::Active.serialize(serializer),
+                TaskState::Paused => Standard::Paused.serialize(serializer),
+                TaskState::Canceled => Standard::Canceled.serialize(serializer),
+            };
+        }
+
+        match self {
+            TaskState::Active => "Active".serialize(serializer),
+            TaskState::Paused => "Paused".serialize(serializer),
+            TaskState::Canceled => "Canceled".serialize(serializer),
+        }
+    }
+}
+
+/// Marker data stored in the constraints policy.
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq, Eq, Default)]
+pub struct ConstraintsData {}
+
+/// Marker data stored in the execution policy.
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq, Eq, Default)]
+pub struct ExecutionData {}
+
+/// Task metadata wrapper (Map<String, String>).
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
+pub struct Metadata {
+    pub values: Map<String, String>,
+}
+
+/// Representation of `nexus_workflow::dag::EntryGroup`.
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq, Eq)]
+pub struct SchedulerEntryGroup {
+    pub name: String,
+}
+
+/// Representation of `nexus_primitives::automaton::TransitionKey`.
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq, Hash)]
+pub struct TransitionKey<State, Symbol> {
+    pub state: Option<State>,
+    pub symbol: Symbol,
+}
+
+/// Representation of `nexus_primitives::automaton::TransitionConfigKey`.
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq, Hash)]
+pub struct TransitionConfigKey<State, Symbol> {
+    pub transition: TransitionKey<State, Symbol>,
+    pub config: TypeName,
+}
+
+#[cfg(test)]
+mod tests {
+    use {super::*, rand::thread_rng, serde_json::json};
+
+    #[test]
+    fn policy_deserializes_from_json() {
+        let policy_id = sui::types::Address::from_static("0x2");
+        let dfa_id = sui::types::Address::from_static("0x3");
+
+        let expected = Policy {
+            id: policy_id,
+            dfa: ConfiguredAutomaton {
+                id: dfa_id,
+                dfa: DeterministicAutomaton {
+                    states: TableVec::new(sui::types::Address::from_static("0x10"), 1),
+                    alphabet: TableVec::new(sui::types::Address::from_static("0x11"), 1),
+                    transition: TableVec::new(sui::types::Address::from_static("0x12"), 1),
+                    accepting: TableVec::new(sui::types::Address::from_static("0x13"), 1),
+                    start: 0,
+                },
+            },
+            state_index: 5,
+            data: ConstraintsData::default(),
+        };
+
+        let parsed: Policy<ConstraintsData> =
+            serde_json::from_value(serde_json::to_value(&expected).unwrap()).unwrap();
+
+        assert_eq!(parsed.id, expected.id);
+        assert_eq!(parsed.dfa.id, expected.dfa.id);
+        assert_eq!(parsed.dfa.dfa, expected.dfa.dfa);
+        assert_eq!(parsed.state_index, expected.state_index);
+        assert_eq!(parsed.data, expected.data);
+    }
+
+    #[test]
+    fn dag_execution_config_deserializes_from_json() {
+        let mut rng = rand::thread_rng();
+        let dag_id = sui::types::Address::generate(&mut rng);
+        let network_id = sui::types::Address::generate(&mut rng);
+        let invoker = sui::types::Address::generate(&mut rng);
+
+        let expected = DagExecutionConfig {
+            dag: dag_id,
+            network: network_id,
+            priority_fee_per_gas_unit: 1000,
+            entry_group: SchedulerEntryGroup {
+                name: "default".to_string(),
+            },
+            inputs: Map::default(),
+            invoker,
+        };
+
+        let parsed: DagExecutionConfig =
+            serde_json::from_value(serde_json::to_value(&expected).unwrap()).unwrap();
+
+        assert_eq!(parsed.dag, expected.dag);
+        assert_eq!(parsed.network, expected.network);
+        assert_eq!(
+            parsed.priority_fee_per_gas_unit,
+            expected.priority_fee_per_gas_unit
+        );
+        assert_eq!(parsed.entry_group, expected.entry_group);
+        assert_eq!(parsed.inputs, expected.inputs);
+        assert_eq!(parsed.invoker, expected.invoker);
+    }
+
+    #[test]
+    fn policy_symbol_deserializes_enum_witness() {
+        let json = json!({
+            "variant": "Witness",
+            "fields": { "pos0": { "name": "0x1::module::Type" } }
+        });
+
+        let sym: PolicySymbol = serde_json::from_value(json).unwrap();
+        assert!(matches!(sym, PolicySymbol::Witness(name) if name.name == "0x1::module::Type"));
+    }
+
+    #[test]
+    fn policy_symbol_deserializes_enum_uid() {
+        let mut rng = thread_rng();
+        let addr = sui::types::Address::generate(&mut rng);
+        let json = json!({
+            "variant": "Uid",
+            "fields": { "pos0": addr }
+        });
+
+        let sym: PolicySymbol = serde_json::from_value(json).unwrap();
+        assert!(matches!(sym, PolicySymbol::Uid(uid) if uid == addr));
+    }
+
+    #[test]
+    fn policy_symbol_deserializes_bcs_witness() {
+        let witness = TypeName::new("0x1::module::Type");
+        let bytes = bcs::to_bytes(&PolicySymbol::Witness(witness.clone())).unwrap();
+
+        let parsed: PolicySymbol = bcs::from_bytes(&bytes).unwrap();
+        assert!(matches!(parsed, PolicySymbol::Witness(name) if name == witness));
+    }
+
+    #[test]
+    fn policy_symbol_deserializes_bcs_uid() {
+        let mut rng = thread_rng();
+        let addr = sui::types::Address::generate(&mut rng);
+        let bytes = bcs::to_bytes(&PolicySymbol::Uid(addr)).unwrap();
+
+        let parsed: PolicySymbol = bcs::from_bytes(&bytes).unwrap();
+        assert!(matches!(parsed, PolicySymbol::Uid(uid) if uid == addr));
+    }
+}
diff --git a/sdk/src/types/secret_value.rs b/sdk/src/types/secret_value.rs
new file mode 100644
index 00000000..9769763f
--- /dev/null
+++ b/sdk/src/types/secret_value.rs
@@ -0,0 +1,75 @@
+//! String wrapper for type safety around our secret strings. Also implements
+//! custom display that avoids leaking the secret in logs.
+
+use serde::{Deserialize, Serialize};
+
+#[derive(Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct SecretValue(String);
+
+impl From<String> for SecretValue {
+    fn from(s: String) -> Self {
+        SecretValue(s)
+    }
+}
+
+impl From<&str> for SecretValue {
+    fn from(s: &str) -> Self {
+        SecretValue(s.to_string())
+    }
+}
+
+impl SecretValue {
+    pub fn peek(&self) -> &str {
+        &self.0
+    }
+}
+
+impl std::fmt::Debug for SecretValue {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(f, "SecretValue([Redacted: *****])",)
+    }
+}
+
+impl std::fmt::Display for SecretValue {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(f, "[Redacted: *****]")
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::SecretValue;
+
+    #[test]
+    fn test_secret_value_from_string_and_str() {
+        let s = "supersecret";
+        let sv1 = SecretValue::from(s.to_string());
+        let sv2 = SecretValue::from(s);
+
+        assert_eq!(sv1.peek(), s);
+        assert_eq!(sv2.peek(), s);
+        assert_eq!(sv1, sv2);
+    }
+
+    #[test]
+    fn test_secret_value_debug_and_display_redacted() {
+        let secret = "averylongsupersecretvalue";
+        let sv = SecretValue::from(secret);
+        let debug_str = format!("{sv:?}");
+        let display_str = format!("{sv}");
+
+        assert_eq!(debug_str, "SecretValue([Redacted: *****])");
+        assert_eq!(display_str, "[Redacted: *****]");
+    }
+
+    #[test]
+    fn test_secret_value_debug_and_display_short_secret() {
+        let secret = "tiny";
+        let sv = SecretValue::from(secret);
+        let debug_str = format!("{sv:?}");
+        let display_str = format!("{sv}");
+
+        assert_eq!(debug_str, "SecretValue([Redacted: *****])");
+        assert_eq!(display_str, "[Redacted: *****]");
+    }
+}
diff --git a/sdk/src/types/serde_parsers.rs b/sdk/src/types/serde_parsers.rs
index e0696bb1..deda33fd 100644
--- a/sdk/src/types/serde_parsers.rs
+++ b/sdk/src/types/serde_parsers.rs
@@ -1,11 +1,15 @@
-use serde::{de::Deserializer, ser::Serializer, Deserialize, Serialize};
+use {
+    base64::{prelude::BASE64_STANDARD, Engine},
+    serde::{de::Deserializer, ser::Serializer, Deserialize, Serialize},
+    serde_json::Value,
+};
 
-/// Deserialize a `Vec<u8>` into a [reqwest::Url].
+/// Deserialize base 64 encoded bytes into a [reqwest::Url].
 pub fn deserialize_bytes_to_url<'de, D>(deserializer: D) -> Result<reqwest::Url, D::Error>
 where
     D: Deserializer<'de>,
 {
-    let bytes: Vec<u8> = Deserialize::deserialize(deserializer)?;
+    let bytes: Vec<u8> = deserialize_encoded_bytes(deserializer)?;
     let url = String::from_utf8(bytes).map_err(serde::de::Error::custom)?;
 
     reqwest::Url::parse(&url).map_err(serde::de::Error::custom)
@@ -17,19 +21,19 @@ where
     S: Serializer,
 {
     let url = value.to_string();
-    let bytes = url.into_bytes();
+    let bytes = url.as_bytes();
 
-    bytes.serialize(serializer)
+    serialize_encoded_bytes(bytes, serializer)
 }
 
-/// Deserialize a `Vec<u8>` into a [serde_json::Value].
+/// Deserialize base 64 encoded bytes into a [serde_json::Value].
 pub fn deserialize_bytes_to_json_value<'de, D>(
     deserializer: D,
 ) -> Result<serde_json::Value, D::Error>
 where
     D: Deserializer<'de>,
 {
-    let bytes: Vec<u8> = Deserialize::deserialize(deserializer)?;
+    let bytes: Vec<u8> = deserialize_encoded_bytes(deserializer)?;
     let value = String::from_utf8(bytes).map_err(serde::de::Error::custom)?;
 
     serde_json::from_str(&value).map_err(serde::de::Error::custom)
@@ -44,9 +48,9 @@ where
     S: Serializer,
 {
     let value = serde_json::to_string(value).map_err(serde::ser::Error::custom)?;
-    let bytes = value.into_bytes();
+    let bytes = value.as_bytes();
 
-    bytes.serialize(serializer)
+    serialize_encoded_bytes(bytes, serializer)
 }
 
 /// Custom parser for deserializing to a [u64] from Sui Events. They wrap this
@@ -57,8 +61,22 @@ pub fn deserialize_sui_u64<'de, D>(deserializer: D) -> Result<u64, D::Error>
 where
     D: Deserializer<'de>,
 {
-    let value: String = Deserialize::deserialize(deserializer)?;
-    let value = value.parse::<u64>().map_err(serde::de::Error::custom)?;
+    if !deserializer.is_human_readable() {
+        return u64::deserialize(deserializer);
+    }
+
+    let value: Value = Deserialize::deserialize(deserializer)?;
+    let value = match value {
+        Value::String(value) => value.parse::<u64>().map_err(serde::de::Error::custom)?,
+        Value::Number(num) => num
+            .as_u64()
+            .ok_or_else(|| serde::de::Error::custom("expected unsigned number"))?,
+        other => {
+            return Err(serde::de::Error::custom(format!(
+                "unexpected value for u64: {other}"
+            )))
+        }
+    };
 
     Ok(value)
 }
@@ -68,16 +86,84 @@ pub fn serialize_sui_u64<S>(value: &u64, serializer: S) -> Result<S::Ok, S::Erro
 where
     S: Serializer,
 {
-    value.to_string().serialize(serializer)
+    if serializer.is_human_readable() {
+        value.to_string().serialize(serializer)
+    } else {
+        value.serialize(serializer)
+    }
 }
 
-/// Deserialize a `Vec<u8>` into a `String` using lossy UTF-8 conversion.
-pub fn deserialize_bytes_to_lossy_utf8<'de, D>(deserializer: D) -> Result<String, D::Error>
+/// Deserialize an optional Sui `u64` value.
+pub fn deserialize_sui_option_u64<'de, D>(deserializer: D) -> Result<Option<u64>, D::Error>
 where
     D: Deserializer<'de>,
 {
-    let bytes: Vec<u8> = Deserialize::deserialize(deserializer)?;
-    Ok(String::from_utf8_lossy(&bytes).into_owned())
+    if !deserializer.is_human_readable() {
+        return Option::<u64>::deserialize(deserializer);
+    }
+
+    fn parse_value(value: Value) -> Result<Option<u64>, String> {
+        match value {
+            Value::Null => Ok(None),
+            Value::String(str) => {
+                if str.is_empty() {
+                    Ok(None)
+                } else {
+                    str.parse::<u64>()
+                        .map(Some)
+                        .map_err(|e| format!("invalid number: {e}"))
+                }
+            }
+            Value::Number(num) => num
+                .as_u64()
+                .map(Some)
+                .ok_or_else(|| "expected unsigned number".to_string()),
+            Value::Object(mut object) => {
+                if let Some(inner) = object.remove("some").or_else(|| object.remove("Some")) {
+                    parse_value(inner)
+                } else if object.contains_key("none") || object.contains_key("None") {
+                    Ok(None)
+                } else {
+                    Err("expected Option with `some` or `none` field".to_string())
+                }
+            }
+            other => Err(format!("unexpected value for Option<u64>: {other}")),
+        }
+    }
+
+    match parse_value(Deserialize::deserialize(deserializer)?) {
+        Ok(value) => Ok(value),
+        Err(err) => Err(serde::de::Error::custom(err)),
+    }
+}
+
+/// Serialize an optional Sui `u64` value.
+pub fn serialize_sui_option_u64<S>(value: &Option<u64>, serializer: S) -> Result<S::Ok, S::Error>
+where
+    S: Serializer,
+{
+    match value {
+        Some(inner) => Value::String(inner.to_string()).serialize(serializer),
+        None => serializer.serialize_none(),
+    }
+}
+
+/// Deserialize base 64 encoded bytes into a [String].
+pub fn deserialize_bytes_to_string<'de, D>(deserializer: D) -> Result<String, D::Error>
+where
+    D: Deserializer<'de>,
+{
+    let bytes = deserialize_encoded_bytes(deserializer)?;
+    String::from_utf8(bytes).map_err(serde::de::Error::custom)
+}
+
+/// Inverse of [deserialize_bytes_to_string].
+pub fn serialize_string_to_bytes<S>(value: &String, serializer: S) -> Result<S::Ok, S::Error>
+where
+    S: Serializer,
+{
+    let bytes = value.as_bytes();
+    serialize_encoded_bytes(bytes, serializer)
 }
 
 pub fn deserialize_string_to_datetime<'de, D>(
@@ -93,6 +179,58 @@ where
     datetime.ok_or(serde::de::Error::custom("datetime out of range"))
 }
 
+/// Deserialize a base64 encoded vector of bytest to a [`Vec<u8>`].
+pub fn deserialize_encoded_bytes<'de, D>(deserializer: D) -> Result<Vec<u8>, D::Error>
+where
+    D: Deserializer<'de>,
+{
+    let encoded: String = Deserialize::deserialize(deserializer)?;
+
+    BASE64_STANDARD
+        .decode(&encoded)
+        .map_err(serde::de::Error::custom)
+}
+
+/// Inverse of [deserialize_encoded_bytes].
+pub fn serialize_encoded_bytes<S>(value: &[u8], serializer: S) -> Result<S::Ok, S::Error>
+where
+    S: Serializer,
+{
+    let encoded = BASE64_STANDARD.encode(value);
+
+    encoded.serialize(serializer)
+}
+
+/// Same as [deserialize_encoded_bytes] but for a `Vec<Vec<u8>>`.
+pub fn deserialize_encoded_bytes_vec<'de, D>(deserializer: D) -> Result<Vec<Vec<u8>>, D::Error>
+where
+    D: Deserializer<'de>,
+{
+    let encoded_vec: Vec<String> = Deserialize::deserialize(deserializer)?;
+
+    encoded_vec
+        .into_iter()
+        .map(|encoded| {
+            BASE64_STANDARD
+                .decode(&encoded)
+                .map_err(serde::de::Error::custom)
+        })
+        .collect()
+}
+
+/// Inverse of [deserialize_encoded_bytes_vec].
+pub fn serialize_encoded_bytes_vec<S>(value: &[Vec<u8>], serializer: S) -> Result<S::Ok, S::Error>
+where
+    S: Serializer,
+{
+    let encoded_vec: Vec<String> = value
+        .iter()
+        .map(|bytes| BASE64_STANDARD.encode(bytes))
+        .collect();
+
+    encoded_vec.serialize(serializer)
+}
+
 #[cfg(test)]
 mod tests {
     use {super::*, serde::Deserialize};
@@ -115,33 +253,9 @@ mod tests {
         value: u64,
     }
 
-    #[derive(Deserialize, Serialize, Debug)]
-    struct TestDescriptionStruct {
-        #[serde(deserialize_with = "deserialize_bytes_to_lossy_utf8")]
-        value: String,
-    }
-
-    #[test]
-    fn test_lossy_utf8_deserialization_exact() {
-        // The array [49, 50, 51] corresponds to a valid UTF-8 byte sequence,
-        // which is the string "123".
-        let input = r#"{"value":[49,50,51]}"#;
-        let result: TestDescriptionStruct = serde_json::from_str(input).unwrap();
-        assert_eq!(result.value, "123");
-    }
-
-    #[test]
-    fn test_lossy_utf8_deserialization_lossy() {
-        // The array [49, 50, 255, 48] does not correspond to a valid UTF-8 byte sequence.
-        // "12\u{FFFD}0" is its lossy UTF-8 representation.
-        let input = r#"{"value":[49,50,255,48]}"#;
-        let result = serde_json::from_str::<TestDescriptionStruct>(input).unwrap();
-        assert_eq!(result.value, "12\u{FFFD}0");
-    }
-
     #[test]
     fn test_url_deser_ser() {
-        let bytes = b"https://example.com/";
+        let bytes = "aHR0cHM6Ly9leGFtcGxlLmNvbS8=";
         let input = format!(r#"{{"url":{}}}"#, serde_json::to_string(&bytes).unwrap());
 
         let result: TestUrlStruct = serde_json::from_str(&input).unwrap();
diff --git a/sdk/src/types/storage_kind.rs b/sdk/src/types/storage_kind.rs
index 2b5cafe7..a808e0f6 100644
--- a/sdk/src/types/storage_kind.rs
+++ b/sdk/src/types/storage_kind.rs
@@ -20,7 +20,7 @@ impl FromStr for StorageKind {
         match s.to_lowercase().as_str() {
             "inline" => Ok(StorageKind::Inline),
             "walrus" => Ok(StorageKind::Walrus),
-            _ => Err(format!("Invalid storage kind: {}", s)),
+            _ => Err(format!("Invalid storage kind: {s}")),
         }
     }
 }
diff --git a/sdk/src/types/tool_meta.rs b/sdk/src/types/tool_meta.rs
index 09973d0b..5e07e460 100644
--- a/sdk/src/types/tool_meta.rs
+++ b/sdk/src/types/tool_meta.rs
@@ -7,7 +7,7 @@ use {
 #[derive(Clone, Debug, Serialize, Deserialize)]
 pub struct ToolMeta {
     pub fqn: ToolFqn,
-    pub url: reqwest::Url,
+    pub url: String,
     pub description: String,
     pub input_schema: serde_json::Value,
     pub output_schema: serde_json::Value,
diff --git a/sdk/src/types/type_name.rs b/sdk/src/types/type_name.rs
index 753c9af4..54d11e39 100644
--- a/sdk/src/types/type_name.rs
+++ b/sdk/src/types/type_name.rs
@@ -14,6 +14,20 @@ impl TypeName {
             name: name.to_string(),
         }
     }
+
+    fn normalize(name: &str) -> std::borrow::Cow<'_, str> {
+        let trimmed = name.trim_start_matches("0x");
+        if trimmed.len() == name.len() {
+            std::borrow::Cow::Borrowed(name)
+        } else {
+            std::borrow::Cow::Owned(trimmed.to_string())
+        }
+    }
+
+    /// Returns true when two fully-qualified Move type names represent the same symbol.
+    pub fn matches_qualified_name(&self, expected: &str) -> bool {
+        Self::normalize(&self.name).eq_ignore_ascii_case(&Self::normalize(expected))
+    }
 }
 
 impl From<&str> for TypeName {
diff --git a/sdk/src/walrus/client.rs b/sdk/src/walrus/client.rs
index eb734db1..2dca432c 100644
--- a/sdk/src/walrus/client.rs
+++ b/sdk/src/walrus/client.rs
@@ -172,9 +172,9 @@ impl WalrusClient {
                 })?;
 
         // Construct API URL with query parameters
-        let mut url = format!("{}/v1/blobs?epochs={}", self.publisher_url, epochs);
+        let mut url = format!("{}/v1/blobs?epochs={epochs}", self.publisher_url);
         if let Some(address) = send_to {
-            url.push_str(&format!("&send_object_to={}", address));
+            url.push_str(&format!("&send_object_to={address}"));
         }
 
         // Send PUT request
@@ -231,7 +231,7 @@ impl WalrusClient {
         // Construct API URL with query parameters
         let mut url = format!("{}/v1/blobs?epochs={}", self.publisher_url, epochs);
         if let Some(address) = send_to {
-            url.push_str(&format!("&send_object_to={}", address));
+            url.push_str(&format!("&send_object_to={address}"));
         }
 
         // Send PUT request with JSON content
diff --git a/sdk/tests/move/object_crawler_test/Move.toml b/sdk/tests/move/object_crawler_test/Move.toml
index 693e5e9d..f226d2d9 100644
--- a/sdk/tests/move/object_crawler_test/Move.toml
+++ b/sdk/tests/move/object_crawler_test/Move.toml
@@ -1,7 +1,7 @@
 [package]
 name = "object_crawler_test"
 version = "0.0.0"
-edition = "2024.beta"
+edition = "2024"
 
 [addresses]
 object_crawler_test = "0x0"
diff --git a/sdk/tests/move/object_crawler_test/sources/main.move b/sdk/tests/move/object_crawler_test/sources/main.move
index 6f1d414e..ca17e52e 100644
--- a/sdk/tests/move/object_crawler_test/sources/main.move
+++ b/sdk/tests/move/object_crawler_test/sources/main.move
@@ -7,7 +7,7 @@ use std::ascii::String as AsciiString;
 
 use sui::object_bag::{Self, ObjectBag};
 use sui::object_table::{Self, ObjectTable};
-use sui::table::{Self, Table};
+use sui::table_vec::{Self, TableVec};
 use sui::linked_table::{Self, LinkedTable};
 use sui::vec_map::{Self, VecMap};
 use sui::vec_set::{Self, VecSet};
@@ -23,11 +23,11 @@ public struct Guy has key, store {
     hobbies: VecSet<AsciiString>,
     groups: VecMap<Name, vector<Name>>,
 
-    chair: Table<Name, Name>,
     timetable: ObjectTable<Name, Value>,
     friends: ObjectBag,
     bag: Bag,
     heterogeneous: Bag,
+    sequence: TableVec<Name>,
     linked_table: LinkedTable<Name, Name>,
 }
 
@@ -35,10 +35,6 @@ public struct Name has copy, drop, store {
     name: AsciiString,
 }
 
-public struct AnotherName has copy, drop, store {
-    another_name: AsciiString,
-}
-
 public struct Value has key, store {
     id: UID,
     value: Name,
@@ -80,10 +76,6 @@ fun init(ctx: &mut TxContext) {
     groups.insert(group_1_name, group_1_members);
     groups.insert(group_2_name, group_2_members);
 
-    let mut chair = table::new(ctx);
-    chair.add(Name { name: b"Chairman".to_ascii_string() }, Name { name: b"John Doe".to_ascii_string() });
-    chair.add(Name { name: b"Vice Chairman".to_ascii_string() }, Name { name: b"Alice".to_ascii_string() });
-
     let mut timetable = object_table::new(ctx);
 
     let mut pouch = object_bag::new(ctx);
@@ -140,11 +132,16 @@ fun init(ctx: &mut TxContext) {
         id: object::new(ctx),
         value: b"Bag Data",
     });
-    heterogeneous.add(AnotherName { another_name: b"Another Bag Item".to_ascii_string() }, AnotherPlainValue {
+    heterogeneous.add(Name { name: b"Another Bag Item".to_ascii_string() }, AnotherPlainValue {
         id: object::new(ctx),
         another_value: b"Another Bag Data",
     });
 
+    let mut sequence = table_vec::empty(ctx);
+    table_vec::push_back(&mut sequence, Name { name: b"First".to_ascii_string() });
+    table_vec::push_back(&mut sequence, Name { name: b"Second".to_ascii_string() });
+    table_vec::push_back(&mut sequence, Name { name: b"Third".to_ascii_string() });
+
     let mut linked_table = linked_table::new(ctx);
     linked_table.push_back(Name { name: b"Key 1".to_ascii_string() }, Name { name: b"Value 1".to_ascii_string() });
 
@@ -154,11 +151,11 @@ fun init(ctx: &mut TxContext) {
         age,
         hobbies,
         groups,
-        chair,
         timetable,
         friends,
         bag,
         heterogeneous,
+        sequence,
         linked_table,
     };
 
diff --git a/sdk/tests/move/onchain_tool_test/Move.toml b/sdk/tests/move/onchain_tool_test/Move.toml
new file mode 100644
index 00000000..ed3af2b2
--- /dev/null
+++ b/sdk/tests/move/onchain_tool_test/Move.toml
@@ -0,0 +1,10 @@
+[package]
+name = "onchain_tool_test"
+edition = "2024.beta"
+
+[dependencies]
+
+[addresses]
+onchain_tool = "0x0"
+
+
diff --git a/sdk/tests/move/onchain_tool_test/sources/onchain_tool.move b/sdk/tests/move/onchain_tool_test/sources/onchain_tool.move
new file mode 100644
index 00000000..a4346fab
--- /dev/null
+++ b/sdk/tests/move/onchain_tool_test/sources/onchain_tool.move
@@ -0,0 +1,104 @@
+module onchain_tool::onchain_tool;
+
+use std::ascii::String as AsciiString;
+use sui::bag::{Self, Bag};
+use sui::transfer::share_object;
+
+/// One-time witness for package initialization.
+public struct ONCHAIN_TOOL has drop {}
+
+/// Witness object used to identify this tool.
+public struct OnchainToolWitness has key, store {
+    id: UID,
+}
+
+/// Random counter used for demonstration purposes. This is up to the tool dev.
+public struct RandomCounter has key {
+    id: UID,
+    count: u64,
+    /// Store the witness object that identifies this tool.
+    witness: Bag,
+}
+
+/// Placeholder for ProofOfUID.
+public struct ProofOfUID {
+    id: UID,
+}
+
+/// Tool execution output variants.
+/// update: We only use this for when we register the tool. The SDK automatically fetches
+/// the output schema from this enum. It is not used in the tool execution. Instead, we use
+/// the new `ToolOutput` object.
+public enum Output {
+    Ok {
+        old_count: u64,
+        new_count: u64,
+        increment: u64,
+    },
+    Err {
+        reason: AsciiString,
+    },
+    LargeIncrement {
+        old_count: u64,
+        new_count: u64,
+        increment: u64,
+        warning: AsciiString,
+    },
+}
+
+/// Initialize the counter for testing purposes.
+fun init(_otw: ONCHAIN_TOOL, ctx: &mut TxContext) {
+    let counter = RandomCounter {
+        id: object::new(ctx),
+        count: 0,
+        witness: {
+            let mut bag = bag::new(ctx);
+            bag.add(b"witness", OnchainToolWitness { id: object::new(ctx) });
+            bag
+        },
+    };
+    share_object(counter);
+}
+
+/// Execute function that takes a ProofOfUID worksheet as its first argument.
+/// The tool must stamp the worksheet with the witness ID to prove it was executed.
+/// This allows the Nexus framework to verify that the tool was actually invoked.
+///
+/// This execute function implements conditional logic:
+/// - If increase_with > 0, the counter is increased and execution succeeds.
+/// - If increase_with = 0, the execution should return an error output variant.
+/// - If increase_with > 100, the counter is increased and returns the LargeIncrement variant.
+///
+/// We also need to return output data from the onchain tool execution.
+/// We can do this in various ways, one being by simply returning the data directly
+/// from the execute function call. When we do this, we need to consume this output
+/// data for the next call, so we make it a hot potato that is being consumed in submit_on_chain_tool_eval_for_walk.
+public fun execute(
+    worksheet: &mut ProofOfUID,
+    counter: &mut RandomCounter,
+    increase_with: u64,
+    _ctx: &mut TxContext,
+) {
+    let old_count = counter.count;
+}
+
+// === Getters ===
+
+/// Get the count value.
+public fun count(self: &RandomCounter): u64 {
+    self.count
+}
+
+/// Helper function to get the witness object.
+fun witness(self: &RandomCounter): &OnchainToolWitness {
+    self.witness.borrow(b"witness")
+}
+
+public fun witness_id(self: &RandomCounter): ID {
+    self.witness().id.to_inner()
+}
+
+#[test_only]
+public fun init_for_test(otw: ONCHAIN_TOOL, ctx: &mut TxContext) {
+    init(otw, ctx);
+}
diff --git a/sdk/tests/object_crawler_test.rs b/sdk/tests/object_crawler_test.rs
index a4db6112..0a51107e 100644
--- a/sdk/tests/object_crawler_test.rs
+++ b/sdk/tests/object_crawler_test.rs
@@ -1,26 +1,42 @@
 #![cfg(feature = "test_utils")]
 
 use {
-    assert_matches::assert_matches,
-    nexus_sdk::{object_crawler::*, sui, test_utils},
+    nexus_sdk::{
+        nexus::crawler::{
+            Bag,
+            Crawler,
+            DynamicMap,
+            DynamicObjectMap,
+            Map,
+            ObjectBag,
+            Set,
+            TableVec,
+        },
+        sui,
+        test_utils,
+        types::deserialize_encoded_bytes,
+    },
     serde::{Deserialize, Serialize},
+    serde_json::json,
+    std::{collections::HashMap, str::FromStr, sync::Arc},
+    tokio::sync::Mutex,
 };
 
 #[derive(Clone, Debug, Deserialize)]
 struct Guy {
     // Test UID deser.
     #[allow(dead_code)]
-    id: sui::UID,
+    id: sui::types::Address,
     name: String,
     age: u8,
-    hobbies: VecSet<String>,
-    groups: VecMap<Structure<Name>, Vec<Structure<Name>>>,
-    chair: Table<Name, Structure<Name>>,
-    timetable: ObjectTable<Name, Structure<Value>>,
-    friends: ObjectBag<Name, Structure<PlainValue>>,
-    bag: Bag<Name, Structure<PlainValue>>,
-    heterogeneous: Bag<HeterogeneousKey, Structure<HeterogeneousValue>>,
-    linked_table: LinkedTable<Name, Structure<Name>>,
+    hobbies: Set<String>,
+    groups: Map<Name, Vec<Name>>,
+    timetable: DynamicObjectMap<Name, Value>,
+    friends: DynamicObjectMap<Name, PlainValue>,
+    bag: DynamicMap<Name, PlainValue>,
+    heterogeneous: DynamicMap<Name, HeterogeneousValue>,
+    linked_table: DynamicMap<Name, Name>,
+    sequence: TableVec<Name>,
 }
 
 #[derive(Clone, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
@@ -28,25 +44,21 @@ struct Name {
     name: String,
 }
 
-#[derive(Clone, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
-struct AnotherName {
-    another_name: String,
-}
-
 #[derive(Clone, Debug, Deserialize)]
 struct Value {
     // Test UID deser.
     #[allow(dead_code)]
-    id: sui::UID,
-    value: Structure<Name>,
-    pouch: ObjectBag<Name, Structure<PlainValue>>,
+    id: sui::types::Address,
+    value: Name,
+    pouch: DynamicObjectMap<Name, PlainValue>,
 }
 
 #[derive(Clone, Debug, Deserialize)]
 struct PlainValue {
     // Test UID deser.
     #[allow(dead_code)]
-    id: sui::UID,
+    id: sui::types::Address,
+    #[serde(deserialize_with = "deserialize_encoded_bytes")]
     value: Vec<u8>,
 }
 
@@ -54,17 +66,14 @@ struct PlainValue {
 struct AnotherPlainValue {
     // Test UID deser.
     #[allow(dead_code)]
-    id: sui::UID,
+    id: sui::types::Address,
+    #[serde(
+        deserialize_with = "deserialize_encoded_bytes",
+        serialize_with = "serialize_encoded_bytes"
+    )]
     another_value: Vec<u8>,
 }
 
-#[derive(Clone, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
-#[serde(untagged)]
-enum HeterogeneousKey {
-    Name(Name),
-    AnotherName(AnotherName),
-}
-
 #[derive(Clone, Debug, Deserialize)]
 #[serde(untagged)]
 enum HeterogeneousValue {
@@ -76,74 +85,73 @@ enum HeterogeneousValue {
 #[tokio::test]
 async fn test_object_crawler() {
     // Spin up the Sui instance.
-    let (_container, rpc_port, faucet_port) = test_utils::containers::setup_sui_instance().await;
+    let test_utils::containers::SuiInstance {
+        rpc_port,
+        faucet_port,
+        pg: _pg,
+        container: _container,
+        ..
+    } = test_utils::containers::setup_sui_instance().await;
 
-    // Create a wallet and request some gas tokens.
-    let (mut wallet, _) = test_utils::wallet::create_ephemeral_wallet_context(rpc_port)
-        .expect("Failed to create a wallet.");
-    let sui = wallet.get_client().await.expect("Could not get Sui client");
+    let rpc_url = format!("http://127.0.0.1:{rpc_port}");
+    let faucet_url = format!("http://127.0.0.1:{faucet_port}/gas");
 
-    let addr = wallet
-        .active_address()
-        .expect("Failed to get active address.");
+    let mut rng = rand::thread_rng();
+
+    // Create a wallet and request some gas tokens.
+    let pk = sui::crypto::Ed25519PrivateKey::generate(&mut rng);
+    let addr = pk.public_key().derive_address();
 
-    test_utils::faucet::request_tokens(&format!("http://127.0.0.1:{faucet_port}/gas"), addr)
+    test_utils::faucet::request_tokens(&faucet_url, addr)
         .await
         .expect("Failed to request tokens from faucet.");
 
-    let gas_coin = test_utils::gas::fetch_gas_coins(&sui, addr)
+    let gas_coins = test_utils::gas::fetch_gas_coins(&rpc_url, addr)
         .await
-        .expect("Failed to fetch gas coin.")
-        .into_iter()
-        .next()
-        .unwrap();
+        .expect("Failed to fetch gas coins.");
 
     // Publish test contract and fetch some IDs.
     let response = test_utils::contracts::publish_move_package(
-        &mut wallet,
+        &pk,
+        &rpc_url,
         "tests/move/object_crawler_test",
-        gas_coin,
+        gas_coins.first().cloned().unwrap().0,
     )
     .await;
 
-    let changes = response
-        .object_changes
-        .expect("TX response must have object changes");
+    tokio::time::sleep(std::time::Duration::from_secs(2)).await;
 
-    let pkg_id = *changes
+    let guy = response
+        .objects
         .iter()
-        .find_map(|c| match c {
-            sui::ObjectChange::Published { package_id, .. } => Some(package_id),
-            _ => None,
-        })
-        .expect("Move package must be published");
-
-    let guy = *changes
-        .iter()
-        .find_map(|c| match c {
-            sui::ObjectChange::Created {
-                object_id,
-                object_type,
-                ..
-            } if object_type.name == sui::move_ident_str!("Guy").into() => Some(object_id),
-            _ => None,
+        .find_map(|obj| {
+            let sui::types::ObjectType::Struct(object_type) = obj.object_type() else {
+                return None;
+            };
+
+            if *object_type.name() == sui::types::Identifier::from_static("Guy") {
+                Some(obj.object_id())
+            } else {
+                None
+            }
         })
         .expect("Guy object must be created");
 
-    // Name type tag.
-    let name_tag = sui::MoveTypeTag::Struct(Box::new(sui::MoveStructTag {
-        address: *pkg_id,
-        module: sui::move_ident_str!("main").into(),
-        name: sui::move_ident_str!("Name").into(),
-        type_params: vec![],
-    }));
+    let guy = sui::types::Address::from_str(&guy.to_string()).unwrap();
 
-    // Fetch the base object.
-    let guy = fetch_one::<Structure<Guy>>(&sui, guy)
+    let grpc = sui::grpc::Client::new(format!("http://127.0.0.1:{rpc_port}"))
+        .expect("Could not create gRPC client");
+
+    let crawler = Crawler::new(Arc::new(Mutex::new(grpc)));
+
+    let guy = crawler
+        .get_object::<Guy>(guy)
         .await
-        .unwrap()
-        .data
-        .into_inner();
+        .expect("Could not fetch Guy object.");
+
+    assert!(guy.is_shared());
+
+    let guy = guy.data;
 
     assert_eq!(guy.name, "John Doe");
     assert_eq!(guy.age, 30);
@@ -154,204 +162,205 @@ async fn test_object_crawler() {
             .collect()
     );
 
-    // Check VecMap and nested vector fetched correctly.
+    // Check map and nested vector fetched correctly.
     let groups = guy.groups.into_inner();
     assert_eq!(groups.len(), 2);
 
     // Contains book club with the correct people.
     let group = groups.clone().into_iter().find(|(group, people)| {
-        group.clone().into_inner().name == "Book Club"
-            && people.iter().any(|p| p.inner().name == "Alice")
-            && people.iter().any(|p| p.inner().name == "Bob")
+        group.clone().name == "Book Club"
+            && people.iter().any(|p| p.name == "Alice")
+            && people.iter().any(|p| p.name == "Bob")
     });
 
     assert!(group.is_some());
 
     // Contains swimming club with the correct people.
     let group = groups.clone().into_iter().find(|(group, people)| {
-        group.clone().into_inner().name == "Swimming Club"
-            && people.iter().any(|p| p.inner().name == "Charlie")
-            && people.iter().any(|p| p.inner().name == "David")
+        group.clone().name == "Swimming Club"
+            && people.iter().any(|p| p.name == "Charlie")
+            && people.iter().any(|p| p.name == "David")
     });
 
     assert!(group.is_some());
 
     // Fetch timetable that is an ObjectTable and has a nested ObjectBag.
-    let timetable = guy.timetable.fetch_all(&sui).await.unwrap();
+    assert_eq!(guy.timetable.size(), 2);
+    let timetable = crawler
+        .get_dynamic_field_objects(&guy.timetable)
+        .await
+        .unwrap();
     assert_eq!(timetable.len(), 2);
 
     // Fetch monday.
-    let monday = guy
-        .timetable
-        .fetch_one(
-            &sui,
-            Name {
-                name: "Monday".to_string(),
-            },
-        )
+    let monday = timetable
+        .get(&Name {
+            name: "Monday".to_string(),
+        })
+        .unwrap();
+
+    assert_eq!(monday.data.value.name, "Meeting");
+
+    assert_eq!(monday.data.pouch.size(), 1);
+    let pouch = crawler
+        .get_dynamic_field_objects(&monday.data.pouch)
         .await
-        .unwrap()
-        .into_inner();
-    assert_eq!(monday.value.into_inner().name, "Meeting");
+        .unwrap();
 
-    let pouch = monday.pouch.fetch_all(&sui).await.unwrap();
     assert_eq!(pouch.len(), 1);
     let (key, value) = pouch.into_iter().next().unwrap();
     assert_eq!(key.name, "Pouch Item");
-    assert_eq!(value.into_inner().value, b"Pouch Data");
+    assert_eq!(value.data.value, b"Pouch Data");
 
     // Fetch tuesday
-    let monday = guy
-        .timetable
-        .fetch_one(
-            &sui,
-            Name {
-                name: "Tuesday".to_string(),
-            },
-        )
-        .await
-        .unwrap()
-        .into_inner();
-    assert_eq!(monday.value.into_inner().name, "Code Review");
+    let tuesday = timetable
+        .get(&Name {
+            name: "Tuesday".to_string(),
+        })
+        .unwrap();
+
+    assert_eq!(tuesday.data.value.name, "Code Review");
 
-    let pouch = monday.pouch.fetch_all(&sui).await.unwrap();
+    assert_eq!(tuesday.data.pouch.size(), 1);
+    let pouch = crawler
+        .get_dynamic_field_objects(&tuesday.data.pouch)
+        .await
+        .unwrap();
     assert_eq!(pouch.len(), 1);
     let (key, value) = pouch.into_iter().next().unwrap();
     assert_eq!(key.name, "Pouch Code");
-    assert_eq!(value.into_inner().value, b"MOREDATA15");
-
-    // Fetch chair which is a Table. Weirdly.
-    let chair = guy.chair.fetch_all(&sui).await.unwrap();
-    assert_eq!(chair.len(), 2);
-
-    // Fetch chairman.
-    let chairman = guy
-        .chair
-        .fetch_one(
-            &sui,
-            Name {
-                name: "Chairman".to_string(),
-            },
-        )
-        .await
-        .unwrap()
-        .into_inner();
-    assert_eq!(chairman.name, "John Doe");
-
-    // Fetch vice chairman.
-    let vice_chairman = guy
-        .chair
-        .fetch_one(
-            &sui,
-            Name {
-                name: "Vice Chairman".to_string(),
-            },
-        )
-        .await
-        .unwrap()
-        .into_inner();
-    assert_eq!(vice_chairman.name, "Alice");
+    assert_eq!(value.data.value, b"MOREDATA15");
 
     // Fetch friends which is an ObjectBag.
-    let friends = guy.friends.fetch_all(&sui).await.unwrap();
+    assert_eq!(guy.friends.size(), 2);
+    let friends = crawler
+        .get_dynamic_field_objects(&guy.friends)
+        .await
+        .unwrap();
     assert_eq!(friends.len(), 2);
 
     // Fetch first friend.
-    let charlie = guy
-        .friends
-        .fetch_one(
-            &sui,
-            Name {
-                name: "Charlie".to_string(),
-            },
-            name_tag.clone(),
-        )
-        .await
-        .unwrap()
-        .into_inner();
-    assert_eq!(charlie.value, b"Never Seen");
+    let charlie = friends
+        .get(&Name {
+            name: "Charlie".to_string(),
+        })
+        .unwrap();
+
+    assert_eq!(charlie.data.value.clone(), b"Never Seen");
 
     // Fetch second friend.
-    let david = guy
-        .friends
-        .fetch_one(
-            &sui,
-            Name {
-                name: "David".to_string(),
-            },
-            name_tag.clone(),
-        )
-        .await
-        .unwrap()
-        .into_inner();
-    assert_eq!(david.value, b"Definitely Imagination");
+    let david = friends
+        .get(&Name {
+            name: "David".to_string(),
+        })
+        .unwrap();
+
+    assert_eq!(david.data.value.clone(), b"Definitely Imagination");
 
     // Now fetch bag which is a Bag. Finally.
-    let bag = guy.bag.fetch_all(&sui).await.unwrap();
+    assert_eq!(guy.bag.size(), 2);
+    let bag = crawler.get_dynamic_fields(&guy.bag).await.unwrap();
     assert_eq!(bag.len(), 2);
 
     // Fetch first item from bag.
-    let item1 = guy
-        .bag
-        .fetch_one(
-            &sui,
-            Name {
-                name: "Bag Item".to_string(),
-            },
-            name_tag.clone(),
-        )
-        .await
-        .unwrap()
-        .into_inner();
-    assert_eq!(item1.value, b"Bag Data");
+    let item1 = bag
+        .get(&Name {
+            name: "Bag Item".to_string(),
+        })
+        .unwrap();
+
+    assert_eq!(item1.value.clone(), b"Bag Data");
 
     // Fetch second item from bag.
-    let item2 = guy
-        .bag
-        .fetch_one(
-            &sui,
-            Name {
-                name: "Bag Item 2".to_string(),
-            },
-            name_tag.clone(),
-        )
-        .await
-        .unwrap()
-        .into_inner();
-    assert_eq!(item2.value, b"Bag Data 2");
+    let item2 = bag
+        .get(&Name {
+            name: "Bag Item 2".to_string(),
+        })
+        .unwrap();
+
+    assert_eq!(item2.value.clone(), b"Bag Data 2");
 
     // Fetch heterogeneous Bag.
-    let heterogeneous = guy.heterogeneous.fetch_all(&sui).await.unwrap();
+    assert_eq!(guy.heterogeneous.size(), 2);
+    let heterogeneous = crawler
+        .get_dynamic_fields(&guy.heterogeneous)
+        .await
+        .unwrap();
     assert!(heterogeneous.len() == 2);
 
     for (key, value) in heterogeneous {
-        match key {
-            HeterogeneousKey::Name(name) => {
-                assert_eq!(name.name, "Bag Item");
-                assert_matches!(value.into_inner(), HeterogeneousValue::Value(v) if v.value == b"Bag Data");
-            }
-            HeterogeneousKey::AnotherName(name) => {
-                assert_eq!(name.another_name, "Another Bag Item");
-                assert_matches!(value.into_inner(), HeterogeneousValue::AnotherValue(v) if v.another_value == b"Another Bag Data");
-            }
+        if key.name == "Bag Item" {
+            assert!(
+                matches!(value, HeterogeneousValue::Value(v) if v.value.clone() == b"Bag Data")
+            );
+        } else if key.name == "Another Bag Item" {
+            assert!(
+                matches!(value, HeterogeneousValue::AnotherValue(v) if v.another_value.clone() == b"Another Bag Data")
+            );
+        } else {
+            panic!("Unexpected key in heterogeneous bag: {:?}", key);
         }
     }
 
     // Fetch linked table.
-    let linked_table = guy.linked_table.fetch_all(&sui).await.unwrap();
+    assert_eq!(guy.linked_table.size(), 1);
+    let linked_table = crawler.get_dynamic_fields(&guy.linked_table).await.unwrap();
     assert_eq!(linked_table.len(), 1);
 
     // Fetch first value from linked table.
-    let linked_item = guy
-        .linked_table
-        .fetch_one(
-            &sui,
-            Name {
-                name: "Key 1".to_string(),
-            },
-        )
-        .await
-        .unwrap()
-        .into_inner();
+    let linked_item = linked_table
+        .get(&Name {
+            name: "Key 1".to_string(),
+        })
+        .unwrap();
+
     assert_eq!(linked_item.name, "Value 1");
+
+    // Fetch TableVec.
+    assert_eq!(guy.sequence.size(), 3);
+    assert_eq!(guy.sequence.size_u64(), 3);
+    let sequence_id = guy.sequence.id();
+    assert_ne!(sequence_id, sui::types::Address::from_static("0x0"));
+
+    let sequence = crawler.get_table_vec(&guy.sequence).await.unwrap();
+    assert_eq!(sequence.len(), 3);
+    assert_eq!(sequence[0].name, "First");
+    assert_eq!(sequence[1].name, "Second");
+    assert_eq!(sequence[2].name, "Third");
+}
+
+#[test]
+fn crawler_wrapper_accessors_cover_id_and_size_helpers() {
+    let id = nexus_sdk::sui::types::Address::from_static("0x123");
+
+    let bag = Bag::new(id, 2);
+    assert_eq!(bag.id(), id);
+    assert_eq!(bag.size_u64(), 2);
+    assert_eq!(bag.size(), 2);
+
+    let object_bag = ObjectBag::new(id, 3);
+    assert_eq!(object_bag.id(), id);
+    assert_eq!(object_bag.size_u64(), 3);
+    assert_eq!(object_bag.size(), 3);
+
+    let table_vec: TableVec<u64> = TableVec::new(id, 5);
+    assert_eq!(table_vec.id(), id);
+    assert_eq!(table_vec.size_u64(), 5);
+    assert_eq!(table_vec.size(), 5);
+}
+
+#[test]
+fn map_deserializes_from_object_contents_variant() {
+    let value = json!({
+        "contents": {
+            "a": 1,
+            "b": 2,
+        }
+    });
+
+    let parsed: Map<String, u64> = serde_json::from_value(value).expect("deserialize Map");
+    assert_eq!(
+        parsed.into_map(),
+        HashMap::from([("a".to_string(), 1), ("b".to_string(), 2)])
+    );
 }
diff --git a/sdk/tests/scheduler_test.rs b/sdk/tests/scheduler_test.rs
new file mode 100644
index 00000000..08c7a330
--- /dev/null
+++ b/sdk/tests/scheduler_test.rs
@@ -0,0 +1,115 @@
+#![cfg(feature = "test_utils")]
+
+use {
+    nexus_sdk::{
+        sui,
+        types::{
+            deserialize_sui_option_u64,
+            deserialize_sui_u64,
+            PolicySymbol,
+            TaskState,
+            TypeName,
+        },
+    },
+    serde::Deserialize,
+    serde_json::json,
+};
+
+#[test]
+fn policy_symbol_supports_pos0_fallback_shape() {
+    let value = json!({
+        "variant": "Witness",
+        "pos0": { "name": "0x1::module::Type" },
+    });
+
+    let symbol: PolicySymbol = serde_json::from_value(value).expect("deserialize policy symbol");
+    assert_eq!(
+        symbol,
+        PolicySymbol::Witness(TypeName::new("0x1::module::Type"))
+    );
+}
+
+#[test]
+fn task_state_supports_variant_object_and_errors_on_unknown_variant() {
+    let paused: TaskState = serde_json::from_value(json!({ "variant": "Paused" }))
+        .expect("deserialize TaskState from object");
+    assert_eq!(paused, TaskState::Paused);
+
+    let err = serde_json::from_value::<TaskState>(json!({ "variant": "Bogus" }))
+        .expect_err("unknown TaskState should error");
+    let msg = err.to_string();
+    assert!(
+        msg.contains("unknown variant") || msg.contains("Bogus"),
+        "unexpected error: {msg}"
+    );
+}
+
+#[test]
+fn task_state_roundtrips_through_bcs() {
+    for state in [TaskState::Active, TaskState::Paused, TaskState::Canceled] {
+        let bytes = bcs::to_bytes(&state).expect("bcs serialize TaskState");
+        let decoded: TaskState = bcs::from_bytes(&bytes).expect("bcs deserialize TaskState");
+        assert_eq!(decoded, state);
+    }
+}
+
+#[test]
+fn task_state_serializes_as_strings_in_json() {
+    assert_eq!(
+        serde_json::to_value(TaskState::Active).expect("serialize"),
+        json!("Active")
+    );
+    assert_eq!(
+        serde_json::to_value(TaskState::Paused).expect("serialize"),
+        json!("Paused")
+    );
+    assert_eq!(
+        serde_json::to_value(TaskState::Canceled).expect("serialize"),
+        json!("Canceled")
+    );
+}
+
+#[test]
+fn deserialize_sui_u64_accepts_numbers_and_rejects_other_json_types() {
+    #[derive(Deserialize)]
+    struct Wrapper {
+        #[serde(deserialize_with = "deserialize_sui_u64")]
+        value: u64,
+    }
+
+    let parsed: Wrapper =
+        serde_json::from_value(json!({ "value": 42 })).expect("number value should parse");
+    assert_eq!(parsed.value, 42);
+
+    assert!(serde_json::from_value::<Wrapper>(json!({ "value": true })).is_err());
+}
+
+#[test]
+fn deserialize_sui_option_u64_uses_standard_layout_for_bcs() {
+    #[derive(serde::Serialize)]
+    struct Raw {
+        value: Option<u64>,
+    }
+
+    #[derive(Deserialize)]
+    struct Wrapper {
+        #[serde(deserialize_with = "deserialize_sui_option_u64")]
+        value: Option<u64>,
+    }
+
+    let bytes = bcs::to_bytes(&Raw { value: Some(7) }).expect("bcs serialize");
+    let parsed: Wrapper = bcs::from_bytes(&bytes).expect("bcs deserialize");
+    assert_eq!(parsed.value, Some(7));
+}
+
+#[test]
+fn policy_symbol_uid_pos0_fallback_parses_addresses() {
+    let addr = sui::types::Address::from_static("0x123");
+    let value = json!({
+        "variant": "Uid",
+        "pos0": addr,
+    });
+
+    let parsed: PolicySymbol = serde_json::from_value(value).expect("deserialize PolicySymbol");
+    assert_eq!(parsed, PolicySymbol::Uid(addr));
+}
diff --git a/toolkit-rust/README.md b/toolkit-rust/README.md
index 97e8fe0c..e357cf9a 100644
--- a/toolkit-rust/README.md
+++ b/toolkit-rust/README.md
@@ -27,7 +27,7 @@ Add the following lines to your project's `Cargo.toml`:
 ```toml
 [dependencies.nexus-toolkit]
 git = "https://github.com/Talus-Network/nexus-sdk"
-tag = "v0.3.0"
+tag = "v0.5.0"
 package = "nexus-toolkit"
 ```
 
diff --git a/toolkit-rust/src/runtime.rs b/toolkit-rust/src/runtime.rs
index 5fc5906f..f172034a 100644
--- a/toolkit-rust/src/runtime.rs
+++ b/toolkit-rust/src/runtime.rs
@@ -223,6 +223,20 @@ async fn meta_handler<T: NexusTool>(
     //
     // Ref: https://github.com/Talus-Network/nexus-sdk/issues/77
     let scheme = x_forwarded_proto.unwrap_or_else(|| "http".to_string());
+
+    // Validate scheme to prevent URL injection attacks
+    if scheme != "http" && scheme != "https" {
+        let reply = json!({
+            "error": "invalid_scheme",
+            "details": "Scheme must be either 'http' or 'https'.",
+        });
+
+        return Ok(warp::reply::with_status(
+            warp::reply::json(&reply),
+            StatusCode::BAD_REQUEST,
+        ));
+    }
+
     let url = match Url::parse(&format!("{scheme}://{host}{base_path}")) {
         Ok(url) => url,
         Err(e) => {
diff --git a/toolkit-rust/tests/integration.rs b/toolkit-rust/tests/integration.rs
index 2f2c9df2..26913e09 100644
--- a/toolkit-rust/tests/integration.rs
+++ b/toolkit-rust/tests/integration.rs
@@ -232,4 +232,29 @@ mod tests {
 
         assert_eq!(invoke_json["error"], "input_deserialization_error");
     }
+
+    #[tokio::test]
+    async fn test_meta_invalid_schema() {
+        tokio::spawn(async move { bootstrap!(([127, 0, 0, 1], 8047), DummyTool) });
+
+        // Give the webserver some time to start.
+        tokio::time::sleep(std::time::Duration::from_millis(100)).await;
+
+        let meta = Client::new()
+            .get("http://localhost:8047/meta")
+            .header("X-Forwarded-Proto", "ftp")
+            .send()
+            .await
+            .unwrap();
+
+        assert_eq!(meta.status(), 400);
+
+        let meta_json = meta.json::<serde_json::Value>().await.unwrap();
+
+        assert_eq!(meta_json["error"], "invalid_scheme");
+        assert_eq!(
+            meta_json["details"],
+            "Scheme must be either 'http' or 'https'."
+        );
+    }
 }
diff --git a/tools/exchanges-coinbase/src/main.rs b/tools/exchanges-coinbase/src/main.rs
index 43c7e30a..1e3e0b52 100644
--- a/tools/exchanges-coinbase/src/main.rs
+++ b/tools/exchanges-coinbase/src/main.rs
@@ -1,4 +1,5 @@
 #![doc = include_str!("../README.md")]
+#![allow(clippy::large_enum_variant)]
 
 use nexus_toolkit::bootstrap;
 
diff --git a/tools/exchanges-coinbase/src/tools/get_product_stats.rs b/tools/exchanges-coinbase/src/tools/get_product_stats.rs
index ce9bd423..903cfcf9 100644
--- a/tools/exchanges-coinbase/src/tools/get_product_stats.rs
+++ b/tools/exchanges-coinbase/src/tools/get_product_stats.rs
@@ -27,6 +27,7 @@ pub(crate) struct Input {
 
 #[derive(Serialize, JsonSchema)]
 #[serde(rename_all = "snake_case")]
+#[allow(clippy::large_enum_variant)]
 pub(crate) enum Output {
     Ok {
         /// Opening price (in quote currency)
diff --git a/tools/http/src/errors.rs b/tools/http/src/errors.rs
index 2e97698c..c0c58286 100644
--- a/tools/http/src/errors.rs
+++ b/tools/http/src/errors.rs
@@ -96,8 +96,32 @@ pub enum HttpToolError {
 }
 
 impl HttpToolError {
+    /// Convert a validation error into an HttpToolError
+    pub fn from_validation_error(error: ValidationError) -> Self {
+        HttpToolError::ErrInput(error.to_string())
+    }
+
+    /// Convert a network error into an HttpToolError with timeout detection
+    pub fn from_network_error(error: ReqwestError) -> Self {
+        if error.is_timeout() {
+            HttpToolError::ErrTimeout(error.to_string())
+        } else {
+            HttpToolError::ErrNetwork(error.to_string())
+        }
+    }
+
+    /// Convert a JSON parsing error into an HttpToolError
+    pub fn from_json_error(error: JsonError) -> Self {
+        HttpToolError::ErrJsonParse(error.to_string())
+    }
+
+    /// Convert a URL parsing error into an HttpToolError
+    pub fn from_url_parse_error(error: UrlParseError) -> Self {
+        HttpToolError::ErrUrlParse(error.to_string())
+    }
+
     /// Convert HttpToolError to Output enum for API compatibility
-    pub fn to_output(self) -> crate::http::Output {
+    pub fn into_output(self) -> crate::http::Output {
         match self {
             HttpToolError::ErrHttp {
                 status,
@@ -145,41 +169,4 @@ impl HttpToolError {
             },
         }
     }
-
-    /// Create HttpToolError from external error types
-    pub fn from_json_error(e: JsonError) -> Self {
-        Self::ErrJsonParse(e.to_string())
-    }
-
-    pub fn from_network_error(e: ReqwestError) -> Self {
-        let error_msg = e.to_string();
-        if e.is_timeout() {
-            Self::ErrTimeout(error_msg)
-        } else {
-            // Check if it's a timeout by looking at the error message
-            if error_msg.contains("timeout") || error_msg.contains("timed out") {
-                Self::ErrTimeout(error_msg)
-            } else {
-                Self::ErrNetwork(error_msg)
-            }
-        }
-    }
-
-    pub fn from_url_parse_error(e: UrlParseError) -> Self {
-        Self::ErrUrlParse(e.to_string())
-    }
-
-    pub fn from_validation_error(e: ValidationError) -> Self {
-        Self::ErrInput(e.to_string())
-    }
-
-    pub fn from_schema_validation_error(e: crate::models::SchemaValidationDetails) -> Self {
-        Self::ErrSchemaValidation { errors: e.errors }
-    }
-}
-
-impl From<crate::models::SchemaValidationDetails> for HttpToolError {
-    fn from(e: crate::models::SchemaValidationDetails) -> Self {
-        Self::from_schema_validation_error(e)
-    }
 }
diff --git a/tools/http/src/http.rs b/tools/http/src/http.rs
index a4996b01..a7037a91 100644
--- a/tools/http/src/http.rs
+++ b/tools/http/src/http.rs
@@ -156,6 +156,7 @@ impl Input {
 }
 
 /// Output model for the HTTP Generic tool
+#[allow(clippy::large_enum_variant)]
 #[derive(Debug, Serialize, JsonSchema)]
 #[serde(tag = "type", rename_all = "snake_case")]
 pub(crate) enum Output {
@@ -219,13 +220,13 @@ impl NexusTool for Http {
     async fn invoke(&self, input: Self::Input) -> Self::Output {
         // Validate input parameters
         if let Err(validation_error) = input.validate() {
-            return HttpToolError::from_validation_error(validation_error).to_output();
+            return HttpToolError::from_validation_error(validation_error).into_output();
         }
 
         // Prepare request (client, URL, method, headers, body)
         let (http_client, request) = match self.prepare_request(&input) {
             Ok((client, req)) => (client, req),
-            Err(e) => return e.to_output(),
+            Err(e) => return e.into_output(),
         };
 
         // Execute request with or without retry logic
@@ -238,7 +239,7 @@ impl NexusTool for Http {
 
         match response {
             Ok(response) => self.process_response(response, &input).await,
-            Err(e) => e.to_output(),
+            Err(e) => e.into_output(),
         }
     }
 }
@@ -308,7 +309,7 @@ impl Http {
                 },
                 snippet,
             }
-            .to_output();
+            .into_output();
         }
 
         // Get response headers
@@ -322,7 +323,7 @@ impl Http {
         let body_bytes = match response.bytes().await {
             Ok(bytes) => bytes,
             Err(e) => {
-                return HttpToolError::from_network_error(e).to_output();
+                return HttpToolError::from_network_error(e).into_output();
             }
         };
 
@@ -335,13 +336,13 @@ impl Http {
         // Parse JSON response
         let json = match self.parse_json_response(&text, &headers, input, &status_code) {
             Ok(json) => json,
-            Err(e) => return e.to_output(),
+            Err(e) => return e.into_output(),
         };
 
         // Validate schema if provided
         let schema_validation = match self.validate_schema_response(&json, input) {
             Ok(validation) => validation,
-            Err(e) => return e.to_output(),
+            Err(e) => return e.into_output(),
         };
 
         Output::Ok {
@@ -380,13 +381,13 @@ impl Http {
 
         if let Some(ref text_content) = text {
             if text_content.trim().is_empty() {
-                // If expect_json=true but status indicates no content (204, 202, 205)
                 if input.expect_json.unwrap_or(false) && !Self::is_no_content_status(status) {
-                    return Err(HttpToolError::ErrInput(
+                    Err(HttpToolError::ErrInput(
                         "Empty response body but JSON expected".to_string(),
-                    ));
+                    ))
+                } else {
+                    Ok(None)
                 }
-                Ok(None)
             } else {
                 match serde_json::from_str(text_content) {
                     Ok(json_data) => Ok(Some(json_data)),
@@ -399,14 +400,12 @@ impl Http {
                     }
                 }
             }
+        } else if input.expect_json.unwrap_or(false) && !Self::is_no_content_status(status) {
+            Err(HttpToolError::ErrInput(
+                "Non-text response body but JSON expected".to_string(),
+            ))
         } else {
-            if input.expect_json.unwrap_or(false) && !Self::is_no_content_status(status) {
-                Err(HttpToolError::ErrInput(
-                    "Non-text response body but JSON expected".to_string(),
-                ))
-            } else {
-                Ok(None)
-            }
+            Ok(None)
         }
     }
 
@@ -418,7 +417,11 @@ impl Http {
     ) -> Result<Option<SchemaValidationDetails>, HttpToolError> {
         let schema_validation = if let Some(schema_def) = &input.json_schema {
             if let Some(ref json_data) = json {
-                Some(validate_schema_detailed(schema_def, json_data)?)
+                // Capture validation details whether validation succeeds or fails
+                Some(
+                    validate_schema_detailed(schema_def, json_data)
+                        .unwrap_or_else(|details| details),
+                )
             } else {
                 // JSON could not be parsed, schema validation failed
                 Some(SchemaValidationDetails {
diff --git a/tools/http/src/http_client.rs b/tools/http/src/http_client.rs
index 48991bf3..6e8dd0d4 100644
--- a/tools/http/src/http_client.rs
+++ b/tools/http/src/http_client.rs
@@ -138,10 +138,10 @@ impl HttpClient {
 
     /// Check if HTTP method supports request body
     fn method_supports_body(method: &reqwest::Method) -> bool {
-        match *method {
-            reqwest::Method::GET | reqwest::Method::HEAD | reqwest::Method::OPTIONS => false,
-            _ => true,
-        }
+        !matches!(
+            *method,
+            reqwest::Method::GET | reqwest::Method::HEAD | reqwest::Method::OPTIONS
+        )
     }
 
     /// Builds request body
diff --git a/tools/http/src/models.rs b/tools/http/src/models.rs
index 2fecae20..eb47e551 100644
--- a/tools/http/src/models.rs
+++ b/tools/http/src/models.rs
@@ -40,9 +40,10 @@ pub(crate) struct SchemaValidationDetails {
 }
 
 /// HTTP Method enum for type-safe method handling
-#[derive(Clone, Debug, Deserialize, Serialize, JsonSchema)]
+#[derive(Clone, Debug, Deserialize, Serialize, JsonSchema, Default)]
 #[serde(rename_all = "UPPERCASE")]
 pub enum HttpMethod {
+    #[default]
     Get,
     Post,
     Put,
@@ -52,12 +53,6 @@ pub enum HttpMethod {
     Options,
 }
 
-impl Default for HttpMethod {
-    fn default() -> Self {
-        HttpMethod::Get
-    }
-}
-
 /// Convert HttpMethod to reqwest::Method
 impl From<HttpMethod> for reqwest::Method {
     fn from(method: HttpMethod) -> Self {
diff --git a/tools/social-twitter/src/direct_message/get_conversation_messages.rs b/tools/social-twitter/src/direct_message/get_conversation_messages.rs
index 14cf627f..962a30b4 100644
--- a/tools/social-twitter/src/direct_message/get_conversation_messages.rs
+++ b/tools/social-twitter/src/direct_message/get_conversation_messages.rs
@@ -23,7 +23,6 @@ use {
     nexus_toolkit::*,
     schemars::JsonSchema,
     serde::{Deserialize, Serialize},
-    serde_json,
 };
 
 #[derive(Debug, Deserialize, JsonSchema)]
@@ -85,6 +84,7 @@ impl Input {
     }
 }
 
+#[allow(clippy::large_enum_variant)]
 #[derive(Serialize, JsonSchema)]
 #[serde(rename_all = "snake_case")]
 pub(crate) enum Output {
diff --git a/tools/social-twitter/src/direct_message/get_conversation_messages_by_id.rs b/tools/social-twitter/src/direct_message/get_conversation_messages_by_id.rs
index 1c8f2c1d..899b09ff 100644
--- a/tools/social-twitter/src/direct_message/get_conversation_messages_by_id.rs
+++ b/tools/social-twitter/src/direct_message/get_conversation_messages_by_id.rs
@@ -22,7 +22,6 @@ use {
     nexus_toolkit::*,
     schemars::JsonSchema,
     serde::{Deserialize, Serialize},
-    serde_json,
 };
 
 #[derive(Debug, Deserialize, JsonSchema)]
@@ -91,6 +90,7 @@ impl Input {
     }
 }
 
+#[allow(clippy::large_enum_variant)]
 #[derive(Serialize, JsonSchema)]
 #[serde(rename_all = "snake_case")]
 pub(crate) enum Output {
diff --git a/tools/social-twitter/src/list/get_list.rs b/tools/social-twitter/src/list/get_list.rs
index 72962984..fe36a2be 100644
--- a/tools/social-twitter/src/list/get_list.rs
+++ b/tools/social-twitter/src/list/get_list.rs
@@ -13,7 +13,6 @@ use {
     reqwest::Client,
     schemars::JsonSchema,
     serde::{Deserialize, Serialize},
-    serde_json,
 };
 #[derive(Debug, Deserialize, JsonSchema)]
 pub(crate) struct Input {
@@ -35,6 +34,7 @@ pub(crate) struct Input {
     pub user_fields: Option<Vec<UserField>>,
 }
 
+#[allow(clippy::large_enum_variant)]
 #[derive(Serialize, JsonSchema)]
 #[serde(rename_all = "snake_case")]
 pub(crate) enum Output {
diff --git a/tools/social-twitter/src/list/get_list_members.rs b/tools/social-twitter/src/list/get_list_members.rs
index d8d4ccea..6511085d 100644
--- a/tools/social-twitter/src/list/get_list_members.rs
+++ b/tools/social-twitter/src/list/get_list_members.rs
@@ -17,7 +17,6 @@ use {
     reqwest::Client,
     schemars::JsonSchema,
     serde::{Deserialize, Serialize},
-    serde_json,
 };
 
 #[derive(Debug, Deserialize, JsonSchema)]
diff --git a/tools/social-twitter/src/list/get_list_tweets.rs b/tools/social-twitter/src/list/get_list_tweets.rs
index 27f41c31..4c400519 100644
--- a/tools/social-twitter/src/list/get_list_tweets.rs
+++ b/tools/social-twitter/src/list/get_list_tweets.rs
@@ -16,7 +16,6 @@ use {
     reqwest::Client,
     schemars::JsonSchema,
     serde::{Deserialize, Serialize},
-    serde_json,
 };
 
 #[derive(Debug, Deserialize, JsonSchema)]
@@ -59,6 +58,7 @@ pub(crate) struct Input {
     place_fields: Option<Vec<PlaceField>>,
 }
 
+#[allow(clippy::large_enum_variant)]
 #[derive(Serialize, JsonSchema)]
 #[serde(rename_all = "snake_case")]
 pub(crate) enum Output {
diff --git a/tools/social-twitter/src/list/get_user_lists.rs b/tools/social-twitter/src/list/get_user_lists.rs
index 28b1d6a7..6fdeeb23 100644
--- a/tools/social-twitter/src/list/get_user_lists.rs
+++ b/tools/social-twitter/src/list/get_user_lists.rs
@@ -12,7 +12,6 @@ use {
     nexus_toolkit::*,
     schemars::JsonSchema,
     serde::{Deserialize, Serialize},
-    serde_json,
 };
 
 #[derive(Debug, Deserialize, JsonSchema)]
@@ -45,6 +44,7 @@ pub(crate) struct Input {
     user_fields: Option<Vec<UserField>>,
 }
 
+#[allow(clippy::large_enum_variant)]
 #[derive(Serialize, JsonSchema)]
 #[serde(rename_all = "snake_case")]
 pub(crate) enum Output {
diff --git a/tools/social-twitter/src/list/remove_member.rs b/tools/social-twitter/src/list/remove_member.rs
index ac7f4f88..4c834d6b 100644
--- a/tools/social-twitter/src/list/remove_member.rs
+++ b/tools/social-twitter/src/list/remove_member.rs
@@ -10,7 +10,6 @@ use {
     reqwest::Client,
     schemars::JsonSchema,
     serde::{Deserialize, Serialize},
-    serde_json,
 };
 
 #[derive(Debug, Serialize, Deserialize, JsonSchema)]
diff --git a/tools/social-twitter/src/list/update_list.rs b/tools/social-twitter/src/list/update_list.rs
index 527f2d5d..0482775b 100644
--- a/tools/social-twitter/src/list/update_list.rs
+++ b/tools/social-twitter/src/list/update_list.rs
@@ -10,7 +10,6 @@ use {
     reqwest::Client,
     schemars::JsonSchema,
     serde::{Deserialize, Serialize},
-    serde_json,
 };
 
 #[derive(Debug, Serialize, Deserialize, JsonSchema)]
diff --git a/tools/social-twitter/src/main.rs b/tools/social-twitter/src/main.rs
index 6b8becef..389aea09 100644
--- a/tools/social-twitter/src/main.rs
+++ b/tools/social-twitter/src/main.rs
@@ -3,6 +3,16 @@
 //! This module contains tools for Twitter operations.
 #![doc = include_str!("../README.md")]
 #![recursion_limit = "256"]
+#![allow(
+    clippy::single_component_path_imports,
+    clippy::large_enum_variant,
+    clippy::upper_case_acronyms,
+    clippy::too_many_arguments,
+    clippy::manual_clamp,
+    clippy::derivable_impls,
+    clippy::to_string_trait_impl,
+    clippy::assertions_on_constants
+)]
 
 use nexus_toolkit::bootstrap;
 mod auth;
diff --git a/tools/social-twitter/src/media/models.rs b/tools/social-twitter/src/media/models.rs
index 184fa0c9..48488fbf 100644
--- a/tools/social-twitter/src/media/models.rs
+++ b/tools/social-twitter/src/media/models.rs
@@ -64,10 +64,11 @@ pub enum MediaType {
 
 /// Available options for media upload command
 #[derive(Debug, Deserialize, Serialize, JsonSchema)]
+#[serde(rename_all = "SCREAMING_SNAKE_CASE")]
 pub enum MediaCommand {
-    INIT,
-    APPEND,
-    FINALIZE,
+    Init,
+    Append,
+    Finalize,
 }
 
 /// Media upload response
diff --git a/tools/social-twitter/src/media/upload_media.rs b/tools/social-twitter/src/media/upload_media.rs
index 58626dca..f499fd1c 100644
--- a/tools/social-twitter/src/media/upload_media.rs
+++ b/tools/social-twitter/src/media/upload_media.rs
@@ -16,7 +16,6 @@ use {
         },
         twitter_client::{TwitterClient, TWITTER_X_API_BASE},
     },
-    base64,
     nexus_sdk::{fqn, ToolFqn},
     nexus_toolkit::*,
     reqwest::multipart::{Form, Part},
@@ -184,6 +183,7 @@ impl NexusTool for UploadMedia {
 }
 
 /// Upload media to Twitter in chunks
+#[allow(clippy::too_many_arguments)]
 async fn upload_media(
     client: &TwitterClient,
     auth: &TwitterAuth,
@@ -341,10 +341,7 @@ fn calculate_optimal_chunk_size(
     let calculated_size = media_size / ideal_chunk_count;
 
     // Ensure the calculated size is within bounds and round to nearest 128KB
-    let chunk_size = std::cmp::min(
-        MAX_CHUNK_SIZE,
-        std::cmp::max(MIN_CHUNK_SIZE, calculated_size),
-    );
+    let chunk_size = calculated_size.clamp(MIN_CHUNK_SIZE, MAX_CHUNK_SIZE);
 
     // Round to nearest 128KB for efficiency
     (chunk_size / CHUNK_SIZE_ALIGNMENT) * CHUNK_SIZE_ALIGNMENT
diff --git a/tools/social-twitter/src/tweet/get_mentioned_tweets.rs b/tools/social-twitter/src/tweet/get_mentioned_tweets.rs
index c4f14820..2f4a8edf 100644
--- a/tools/social-twitter/src/tweet/get_mentioned_tweets.rs
+++ b/tools/social-twitter/src/tweet/get_mentioned_tweets.rs
@@ -100,6 +100,7 @@ pub(crate) struct Input {
     place_fields: Option<Vec<PlaceField>>,
 }
 
+#[allow(clippy::large_enum_variant)]
 #[derive(Serialize, JsonSchema)]
 #[serde(rename_all = "snake_case")]
 pub(crate) enum Output {
diff --git a/tools/social-twitter/src/tweet/get_recent_search_tweets.rs b/tools/social-twitter/src/tweet/get_recent_search_tweets.rs
index b2312ac0..96e74949 100644
--- a/tools/social-twitter/src/tweet/get_recent_search_tweets.rs
+++ b/tools/social-twitter/src/tweet/get_recent_search_tweets.rs
@@ -25,7 +25,6 @@ use {
     nexus_toolkit::*,
     schemars::JsonSchema,
     serde::{Deserialize, Serialize},
-    serde_json,
 };
 
 #[derive(Debug, Deserialize, JsonSchema)]
@@ -135,6 +134,7 @@ fn is_valid_timestamp_format(timestamp: &str) -> bool {
     DateTime::parse_from_rfc3339(timestamp).is_ok()
 }
 
+#[allow(clippy::large_enum_variant)]
 #[derive(Serialize, JsonSchema)]
 #[serde(rename_all = "snake_case")]
 pub(crate) enum Output {
diff --git a/tools/social-twitter/src/tweet/get_recent_tweet_count.rs b/tools/social-twitter/src/tweet/get_recent_tweet_count.rs
index 7bb5fa98..ba24a287 100644
--- a/tools/social-twitter/src/tweet/get_recent_tweet_count.rs
+++ b/tools/social-twitter/src/tweet/get_recent_tweet_count.rs
@@ -15,12 +15,6 @@ use {
     serde::{Deserialize, Serialize},
 };
 
-impl Default for Granularity {
-    fn default() -> Self {
-        Granularity::Hour
-    }
-}
-
 #[derive(Debug, Deserialize, JsonSchema)]
 #[serde(deny_unknown_fields)]
 pub(crate) struct Input {
diff --git a/tools/social-twitter/src/tweet/get_tweet.rs b/tools/social-twitter/src/tweet/get_tweet.rs
index 174454b1..d4a494e2 100644
--- a/tools/social-twitter/src/tweet/get_tweet.rs
+++ b/tools/social-twitter/src/tweet/get_tweet.rs
@@ -43,6 +43,7 @@ pub(crate) struct Input {
     tweet_id: String,
 }
 
+#[allow(clippy::large_enum_variant)]
 #[derive(Serialize, JsonSchema)]
 #[serde(rename_all = "snake_case")]
 pub(crate) enum Output {
diff --git a/tools/social-twitter/src/tweet/get_tweets.rs b/tools/social-twitter/src/tweet/get_tweets.rs
index 3e28b7f4..c6101cab 100644
--- a/tools/social-twitter/src/tweet/get_tweets.rs
+++ b/tools/social-twitter/src/tweet/get_tweets.rs
@@ -52,6 +52,7 @@ pub(crate) struct Input {
     place_fields: Option<Vec<PlaceField>>,
 }
 
+#[allow(clippy::large_enum_variant)]
 #[derive(Serialize, JsonSchema)]
 #[serde(rename_all = "snake_case")]
 pub(crate) enum Output {
diff --git a/tools/social-twitter/src/tweet/get_user_tweets.rs b/tools/social-twitter/src/tweet/get_user_tweets.rs
index 68d66d16..78be0403 100644
--- a/tools/social-twitter/src/tweet/get_user_tweets.rs
+++ b/tools/social-twitter/src/tweet/get_user_tweets.rs
@@ -107,6 +107,7 @@ pub(crate) struct Input {
     place_fields: Option<Vec<PlaceField>>,
 }
 
+#[allow(clippy::large_enum_variant)]
 #[derive(Serialize, JsonSchema)]
 #[serde(rename_all = "snake_case")]
 pub(crate) enum Output {
diff --git a/tools/social-twitter/src/tweet/models.rs b/tools/social-twitter/src/tweet/models.rs
index 3639f54d..ef90e500 100644
--- a/tools/social-twitter/src/tweet/models.rs
+++ b/tools/social-twitter/src/tweet/models.rs
@@ -7,6 +7,7 @@ use {
     schemars::JsonSchema,
     serde::{Deserialize, Serialize},
     serde_json::Value,
+    std::fmt,
 };
 
 #[derive(Debug, Serialize, Deserialize, JsonSchema)]
@@ -581,12 +582,13 @@ pub enum SortOrder {
     Relevancy,
 }
 
-impl ToString for SortOrder {
-    fn to_string(&self) -> String {
-        match self {
-            SortOrder::Recency => "recency".to_string(),
-            SortOrder::Relevancy => "relevancy".to_string(),
-        }
+impl fmt::Display for SortOrder {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        let value = match self {
+            SortOrder::Recency => "recency",
+            SortOrder::Relevancy => "relevancy",
+        };
+        f.write_str(value)
     }
 }
 
@@ -697,12 +699,13 @@ pub struct TweetCountMeta {
 }
 
 /// Granularity options for tweet counts
-#[derive(Debug, Deserialize, Serialize, JsonSchema)]
+#[derive(Debug, Deserialize, Serialize, JsonSchema, Default)]
 #[serde(rename_all = "lowercase")]
 pub enum Granularity {
     /// Minute-by-minute counts
     Minute,
     /// Hourly counts (default)
+    #[default]
     Hour,
     /// Daily counts
     Day,
diff --git a/tools/social-twitter/src/tweet/post_tweet.rs b/tools/social-twitter/src/tweet/post_tweet.rs
index f13c521b..f3cc30bf 100644
--- a/tools/social-twitter/src/tweet/post_tweet.rs
+++ b/tools/social-twitter/src/tweet/post_tweet.rs
@@ -365,9 +365,8 @@ mod tests {
             Output::Ok { .. } => panic!("Expected error, got success"),
             Output::Err { reason } => {
                 println!("Actual error message: {}", reason);
-                // We just check that we got an error, since the exact error message
-                // depends on how the code handles 401 responses
-                assert!(true, "Got error response as expected");
+                // Ensure we actually received an error payload.
+                assert!(!reason.is_empty(), "Got error response as expected");
             }
         }
 
diff --git a/tools/social-twitter/src/user/get_user_by_id.rs b/tools/social-twitter/src/user/get_user_by_id.rs
index 1734a2af..e722f308 100644
--- a/tools/social-twitter/src/user/get_user_by_id.rs
+++ b/tools/social-twitter/src/user/get_user_by_id.rs
@@ -52,6 +52,7 @@ pub(crate) struct Input {
     tweet_fields: Option<Vec<TweetField>>,
 }
 
+#[allow(clippy::large_enum_variant)]
 #[derive(Serialize, JsonSchema)]
 #[serde(rename_all = "snake_case")]
 pub(crate) enum Output {
diff --git a/tools/social-twitter/src/user/get_user_by_username.rs b/tools/social-twitter/src/user/get_user_by_username.rs
index 04f5091a..5d967398 100644
--- a/tools/social-twitter/src/user/get_user_by_username.rs
+++ b/tools/social-twitter/src/user/get_user_by_username.rs
@@ -48,6 +48,7 @@ pub(crate) struct Input {
     tweet_fields: Option<Vec<TweetField>>,
 }
 
+#[allow(clippy::large_enum_variant)]
 #[derive(Serialize, JsonSchema)]
 #[serde(rename_all = "snake_case")]
 pub(crate) enum Output {

From 37ed21d581d8b8148c185c3d22e9642a18112ae9 Mon Sep 17 00:00:00 2001
From: afarukcali <afarukcali@gmail.com>
Date: Tue, 20 Jan 2026 14:13:44 +0300
Subject: [PATCH 2/5] fix : cargo.lock updated.

---
 Cargo.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index b29ed9be..49a673e9 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -5831,7 +5831,7 @@ dependencies = [
 
 [[package]]
 name = "nexus-sdk-wasm"
-version = "0.3.0"
+version = "0.5.0"
 dependencies = [
  "aes-gcm",
  "anyhow",
@@ -5839,7 +5839,7 @@ dependencies = [
  "base64 0.21.7",
  "bincode",
  "console_error_panic_hook",
- "getrandom 0.2.15",
+ "getrandom 0.2.16",
  "hex",
  "js-sys",
  "nexus-sdk",
@@ -5847,7 +5847,7 @@ dependencies = [
  "serde",
  "serde-wasm-bindgen",
  "serde_json",
- "thiserror 2.0.12",
+ "thiserror 2.0.17",
  "wasm-bindgen",
  "wasm-bindgen-futures",
  "web-sys",

From 8313d802e2c120ddb7b97931860c40525a8f567c Mon Sep 17 00:00:00 2001
From: afarukcali <afarukcali@gmail.com>
Date: Fri, 23 Jan 2026 15:33:30 +0300
Subject: [PATCH 3/5] feat : nexus v0.5.0 wasm.

---
 sdk-wasm/package.json       |   2 +-
 sdk-wasm/src/crypto.rs      | 229 ++++++++++-
 sdk-wasm/src/dag_execute.rs |  13 +-
 sdk-wasm/src/dag_publish.rs |  98 +++--
 sdk-wasm/src/lib.rs         |  21 +-
 sdk-wasm/src/scheduler.rs   | 794 ++++++++++++++++++++++++++++++++++++
 6 files changed, 1109 insertions(+), 48 deletions(-)
 create mode 100644 sdk-wasm/src/scheduler.rs

diff --git a/sdk-wasm/package.json b/sdk-wasm/package.json
index a8127ce5..5c8ab686 100644
--- a/sdk-wasm/package.json
+++ b/sdk-wasm/package.json
@@ -1,6 +1,6 @@
 {
   "name": "nexus-cli-wasm",
-  "version": "0.2.0-rc.7",
+  "version": "0.5.0",
   "description": "Nexus CLI WASM bindings for browser/web usage",
   "main": "pkg/nexus_cli_wasm.js",
   "types": "pkg/nexus_cli_wasm.d.ts",
diff --git a/sdk-wasm/src/crypto.rs b/sdk-wasm/src/crypto.rs
index bc1c8213..a0310232 100644
--- a/sdk-wasm/src/crypto.rs
+++ b/sdk-wasm/src/crypto.rs
@@ -1,5 +1,6 @@
-// CLI v0.3.0 Crypto Implementation for WASM
+// CLI v0.5.0 Crypto Implementation for WASM
 // Direct port of CLI crypto with localStorage instead of OS keyring
+// Updated for v0.5.0: Added EncryptionMode support for scheduler
 
 use {
     aes_gcm::{
@@ -20,6 +21,25 @@ use {
     zeroize::Zeroizing,
 };
 
+// =============================================================================
+// EncryptionMode (v0.5.0 - CLI Parity)
+// =============================================================================
+
+/// Encryption mode for entry port data
+/// - Plain: No encryption
+/// - Standard: Normal encryption (for dag execute)
+/// - LimitedPersistent: Reusable key encryption (for scheduler tasks)
+#[wasm_bindgen]
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum EncryptionMode {
+    /// No encryption
+    Plain             = 0,
+    /// Standard encryption - keys are consumed after use
+    Standard          = 1,
+    /// Limited persistent - keys can be reused for scheduler tasks
+    LimitedPersistent = 2,
+}
+
 // === Constants (matching CLI) ===
 
 const SERVICE: &str = "nexus-cli-store";
@@ -473,8 +493,21 @@ pub fn get_session_count() -> usize {
 }
 
 /// Encrypt input ports with active session (CLI parity)
+/// Uses Standard encryption mode (for dag execute)
 #[wasm_bindgen]
 pub fn encrypt_entry_ports(input_json: &str, encrypted_ports_json: &str) -> String {
+    encrypt_entry_ports_with_mode(input_json, encrypted_ports_json, EncryptionMode::Standard)
+}
+
+/// Encrypt input ports with specified encryption mode (v0.5.0)
+/// - Standard: for dag execute (one-time use)
+/// - LimitedPersistent: for scheduler tasks (reusable keys)
+#[wasm_bindgen]
+pub fn encrypt_entry_ports_with_mode(
+    input_json: &str,
+    encrypted_ports_json: &str,
+    mode: EncryptionMode,
+) -> String {
     let result = (|| -> Result<String, String> {
         // Load sessions if not already loaded
         let _ = load_sessions();
@@ -484,11 +517,16 @@ pub fn encrypt_entry_ports(input_json: &str, encrypted_ports_json: &str) -> Stri
         let encrypted_ports: HashMap<String, Vec<String>> =
             serde_json::from_str(encrypted_ports_json).map_err(|e| e.to_string())?;
 
-        if encrypted_ports.is_empty() {
+        if encrypted_ports.is_empty() || mode == EncryptionMode::Plain {
             return Ok(serde_json::json!({
                 "success": true,
                 "input_data": input_data,
-                "encrypted_count": 0
+                "encrypted_count": 0,
+                "encryption_mode": match mode {
+                    EncryptionMode::Plain => "plain",
+                    EncryptionMode::Standard => "standard",
+                    EncryptionMode::LimitedPersistent => "limited_persistent",
+                }
             })
             .to_string());
         }
@@ -510,22 +548,48 @@ pub fn encrypt_entry_ports(input_json: &str, encrypted_ports_json: &str) -> Stri
                         let plaintext = slot.take();
                         let bytes = serde_json::to_vec(&plaintext).map_err(|e| e.to_string())?;
 
-                        let msg = session
-                            .encrypt(&bytes)
-                            .map_err(|e| format!("Encrypt: {}", e))?;
+                        // Use appropriate encryption based on mode (v0.5.0)
+                        let msg = match mode {
+                            EncryptionMode::Standard => session
+                                .encrypt(&bytes)
+                                .map_err(|e| format!("Encrypt: {}", e))?,
+                            EncryptionMode::LimitedPersistent => session
+                                .encrypt_limited_persistent(&bytes)
+                                .map_err(|e| format!("Encrypt limited persistent: {}", e))?,
+                            EncryptionMode::Plain => {
+                                // Should not reach here due to early return
+                                return Err("Plain mode should not encrypt".into());
+                            }
+                        };
 
-                        let Message::Standard(pkt) = msg else {
-                            return Err("Expected StandardMessage".into());
+                        // Extract the StandardMessage from the Message enum
+                        let pkt = match msg {
+                            Message::Standard(pkt) => pkt,
+                            Message::LimitedPersistent(pkt) => pkt,
+                            _ => return Err("Expected StandardMessage".into()),
                         };
 
                         // CLI parity: serialize StandardMessage directly as JSON object
-                        *slot = serde_json::to_value(&pkt).map_err(|e| e.to_string())?;
+                        // For LimitedPersistent, we include the "kind" tag
+                        if mode == EncryptionMode::LimitedPersistent {
+                            *slot = serde_json::json!({
+                                "kind": "limited_persistent",
+                                "version": pkt.version,
+                                "header": pkt.header,
+                                "ciphertext": pkt.ciphertext
+                            });
+                        } else {
+                            *slot = serde_json::to_value(&pkt).map_err(|e| e.to_string())?;
+                        }
                         encrypted_count += 1;
                     }
                 }
             }
 
-            session.commit_sender(None);
+            // Only commit for Standard mode; LimitedPersistent keeps keys cached
+            if mode == EncryptionMode::Standard {
+                session.commit_sender(None);
+            }
             Ok(())
         })?;
 
@@ -535,7 +599,12 @@ pub fn encrypt_entry_ports(input_json: &str, encrypted_ports_json: &str) -> Stri
         Ok(serde_json::json!({
             "success": true,
             "input_data": input_data,
-            "encrypted_count": encrypted_count
+            "encrypted_count": encrypted_count,
+            "encryption_mode": match mode {
+                EncryptionMode::Plain => "plain",
+                EncryptionMode::Standard => "standard",
+                EncryptionMode::LimitedPersistent => "limited_persistent",
+            }
         })
         .to_string())
     })();
@@ -551,16 +620,16 @@ pub fn encrypt_entry_ports(input_json: &str, encrypted_ports_json: &str) -> Stri
 }
 
 /// Decrypt output data with active session (CLI parity)
+/// Supports both Standard and LimitedPersistent messages (v0.5.0)
 #[wasm_bindgen]
 pub fn decrypt_output_data(encrypted_json: &str) -> String {
     let result = (|| -> Result<String, String> {
         // Load sessions if not already loaded
         let _ = load_sessions();
 
-        // CLI parity: StandardMessage is serialized as JSON object, not bincode
-        let standard_msg: nexus_sdk::crypto::session::StandardMessage =
-            serde_json::from_str(encrypted_json)
-                .map_err(|e| format!("Parse StandardMessage: {}", e))?;
+        // Parse the encrypted JSON - could be Standard or LimitedPersistent (v0.5.0)
+        let encrypted_value: serde_json::Value =
+            serde_json::from_str(encrypted_json).map_err(|e| format!("Parse JSON: {}", e))?;
 
         let decrypted_data = SESSIONS.with(|sessions| {
             let mut sessions = sessions.borrow_mut();
@@ -571,14 +640,55 @@ pub fn decrypt_output_data(encrypted_json: &str) -> String {
 
             let (_session_id, session) = sessions.iter_mut().next().ok_or("No sessions")?;
 
+            // Determine message type from "kind" field (v0.5.0)
+            let msg = if let Some(kind) = encrypted_value.get("kind").and_then(|k| k.as_str()) {
+                // Has "kind" tag - parse as full Message enum
+                match kind {
+                    "limited_persistent" => {
+                        let standard_msg: nexus_sdk::crypto::session::StandardMessage =
+                            serde_json::from_value(encrypted_value.clone())
+                                .map_err(|e| format!("Parse LimitedPersistent: {}", e))?;
+                        Message::LimitedPersistent(standard_msg)
+                    }
+                    "standard" => {
+                        let standard_msg: nexus_sdk::crypto::session::StandardMessage =
+                            serde_json::from_value(encrypted_value.clone())
+                                .map_err(|e| format!("Parse Standard: {}", e))?;
+                        Message::Standard(standard_msg)
+                    }
+                    _ => {
+                        // Try to parse as full Message enum
+                        serde_json::from_value(encrypted_value.clone())
+                            .map_err(|e| format!("Parse Message: {}", e))?
+                    }
+                }
+            } else {
+                // No "kind" tag - assume StandardMessage directly (backward compatible)
+                let standard_msg: nexus_sdk::crypto::session::StandardMessage =
+                    serde_json::from_value(encrypted_value.clone())
+                        .map_err(|e| format!("Parse StandardMessage: {}", e))?;
+                Message::Standard(standard_msg)
+            };
+
+            // Try to read own message first (for sender reading their own encrypted data)
+            if let Some(bytes) = session.read_own_msg(&msg) {
+                let data: serde_json::Value = serde_json::from_slice(&bytes)
+                    .map_err(|e| format!("Parse JSON from own message: {}", e))?;
+                return Ok(data);
+            }
+
+            // Otherwise decrypt normally
             let decrypted_bytes = session
-                .decrypt(&Message::Standard(standard_msg))
+                .decrypt(&msg)
                 .map_err(|e| format!("Decrypt: {}", e))?;
 
             let data: serde_json::Value = serde_json::from_slice(&decrypted_bytes)
                 .map_err(|e| format!("Parse JSON: {}", e))?;
 
-            session.commit_receiver(None, None);
+            // Only commit for Standard messages; LimitedPersistent keeps keys cached
+            if matches!(msg, Message::Standard(_)) {
+                session.commit_receiver(None, None);
+            }
             Ok(data)
         })?;
 
@@ -602,6 +712,91 @@ pub fn decrypt_output_data(encrypted_json: &str) -> String {
     }
 }
 
+/// Decrypt an array of encrypted values (v0.5.0)
+/// Useful for decrypting multiple outputs from a DAG execution
+#[wasm_bindgen]
+pub fn decrypt_output_array(encrypted_array_json: &str) -> String {
+    let result = (|| -> Result<String, String> {
+        // Load sessions if not already loaded
+        let _ = load_sessions();
+
+        let encrypted_values: Vec<serde_json::Value> =
+            serde_json::from_str(encrypted_array_json)
+                .map_err(|e| format!("Parse array: {}", e))?;
+
+        let mut decrypted_values = Vec::with_capacity(encrypted_values.len());
+
+        SESSIONS.with(|sessions| {
+            let mut sessions = sessions.borrow_mut();
+
+            if sessions.is_empty() {
+                return Err("No active sessions".to_string());
+            }
+
+            let (_session_id, session) = sessions.iter_mut().next().ok_or("No sessions")?;
+
+            for encrypted_value in encrypted_values {
+                // Determine message type
+                let msg = if let Some(kind) = encrypted_value.get("kind").and_then(|k| k.as_str()) {
+                    match kind {
+                        "limited_persistent" => {
+                            let standard_msg: nexus_sdk::crypto::session::StandardMessage =
+                                serde_json::from_value(encrypted_value.clone())
+                                    .map_err(|e| format!("Parse LimitedPersistent: {}", e))?;
+                            Message::LimitedPersistent(standard_msg)
+                        }
+                        _ => {
+                            let standard_msg: nexus_sdk::crypto::session::StandardMessage =
+                                serde_json::from_value(encrypted_value.clone())
+                                    .map_err(|e| format!("Parse Standard: {}", e))?;
+                            Message::Standard(standard_msg)
+                        }
+                    }
+                } else {
+                    let standard_msg: nexus_sdk::crypto::session::StandardMessage =
+                        serde_json::from_value(encrypted_value.clone())
+                            .map_err(|e| format!("Parse StandardMessage: {}", e))?;
+                    Message::Standard(standard_msg)
+                };
+
+                // Try read_own_msg first
+                let decrypted: serde_json::Value = if let Some(bytes) = session.read_own_msg(&msg) {
+                    serde_json::from_slice(&bytes)
+                        .map_err(|e| format!("Parse JSON from own message: {}", e))?
+                } else {
+                    let bytes = session
+                        .decrypt(&msg)
+                        .map_err(|e| format!("Decrypt: {}", e))?;
+                    serde_json::from_slice(&bytes).map_err(|e| format!("Parse JSON: {}", e))?
+                };
+
+                decrypted_values.push(decrypted);
+            }
+
+            Ok(())
+        })?;
+
+        // Persist updated sessions
+        persist_sessions()?;
+
+        Ok(serde_json::json!({
+            "success": true,
+            "data": decrypted_values,
+            "count": decrypted_values.len()
+        })
+        .to_string())
+    })();
+
+    match result {
+        Ok(json) => json,
+        Err(e) => serde_json::json!({
+            "success": false,
+            "error": e
+        })
+        .to_string(),
+    }
+}
+
 /// Clear all crypto data (for testing)
 #[wasm_bindgen]
 pub fn crypto_clear_all() -> String {
diff --git a/sdk-wasm/src/dag_execute.rs b/sdk-wasm/src/dag_execute.rs
index 2b539f99..f1914aa4 100644
--- a/sdk-wasm/src/dag_execute.rs
+++ b/sdk-wasm/src/dag_execute.rs
@@ -67,6 +67,7 @@ impl ExecutionResult {
 }
 
 /// ✅ Build DAG execution transaction using SDK (CLI-compatible with auto-encryption)
+/// Updated for v0.5.0: Added priority_fee_per_gas_unit support
 #[wasm_bindgen]
 pub fn build_dag_execution_transaction(
     dag_id: &str,
@@ -74,6 +75,7 @@ pub fn build_dag_execution_transaction(
     input_json: &str,
     encrypted_ports_json: &str,
     gas_budget: &str,
+    priority_fee_per_gas_unit: Option<String>,
 ) -> ExecutionResult {
     use web_sys::console;
 
@@ -280,7 +282,14 @@ pub fn build_dag_execution_transaction(
         let entry_group_result_index = command_index;
         command_index += 1;
 
-        // Step 4: Final DAG execution call (exactly like CLI)
+        // Parse priority fee (v0.5.0 feature)
+        let priority_fee: u64 = priority_fee_per_gas_unit
+            .as_ref()
+            .and_then(|s| s.parse().ok())
+            .unwrap_or(0);
+
+        // Step 4: Final DAG execution call (exactly like CLI/SDK)
+        // Arguments order matches SDK: default_tap, dag, gas_service, network, entry_group, inputs, priority_fee, clock
         commands.push(serde_json::json!({
             "type": "moveCall",
             "target": "{{workflow_pkg_id}}::default_tap::begin_dag_execution",
@@ -291,6 +300,7 @@ pub fn build_dag_execution_transaction(
                 {"type": "pure", "pure_type": "id", "value": "{{network_id}}"},
                 {"type": "result", "index": entry_group_result_index},
                 {"type": "result", "index": 0},
+                {"type": "pure", "pure_type": "u64", "value": priority_fee},
                 {"type": "clock_object"}
             ],
             "result_index": command_index
@@ -299,6 +309,7 @@ pub fn build_dag_execution_transaction(
         let transaction_data = serde_json::json!({
             "commands": commands,
             "gas_budget": gas_budget_u64,
+            "priority_fee_per_gas_unit": priority_fee,
             "encrypted_ports_count": encrypted_ports.len(),
             "vertices_count": input_data.as_object().map_or(0, |obj| obj.len()),
             "auto_encrypted": !encrypted_ports.is_empty()
diff --git a/sdk-wasm/src/dag_publish.rs b/sdk-wasm/src/dag_publish.rs
index 713240d6..940821b4 100644
--- a/sdk-wasm/src/dag_publish.rs
+++ b/sdk-wasm/src/dag_publish.rs
@@ -1,7 +1,7 @@
 use {
     nexus_sdk::{
         dag::validator,
-        types::{Dag, EdgeKind, VertexKind},
+        types::{Dag, EdgeKind, StorageKind, VertexKind},
     },
     serde::{Deserialize, Serialize},
     std::collections::HashMap,
@@ -174,30 +174,59 @@ pub fn build_dag_publish_transaction(dag_json: &str, nexus_objects_json: &str) -
         let vertex_name_index = result_index;
         result_index += 1;
 
-        // Create vertex kind (off-chain) - Use pattern matching for VertexKind
-        let tool_fqn = match &vertex.kind {
-            VertexKind::OffChain { tool_fqn } => tool_fqn.to_string(),
-            VertexKind::OnChain { .. } => "on_chain_tool".to_string(),
+        // Create vertex kind - supports both OffChain and OnChain (v0.5.0)
+        let vertex_kind_index = match &vertex.kind {
+            VertexKind::OffChain { tool_fqn } => {
+                commands.push(TransactionCommand {
+                    command_type: "moveCall".to_string(),
+                    target: format!(
+                        "{}::dag::vertex_off_chain",
+                        nexus_objects
+                            .get("workflow_pkg_id")
+                            .unwrap_or(&"{{workflow_pkg_id}}".to_string())
+                    ),
+                    arguments: vec![CommandArgument::Pure {
+                        pure_type: "string".to_string(),
+                        value: serde_json::Value::String(tool_fqn.to_string()),
+                    }],
+                    type_arguments: vec![],
+                    result_index,
+                });
+                let idx = result_index;
+                result_index += 1;
+                idx
+            }
+            VertexKind::OnChain { tool_fqn } => {
+                // OnChain vertex requires tool_registry lookup
+                commands.push(TransactionCommand {
+                    command_type: "moveCall".to_string(),
+                    target: format!(
+                        "{}::dag::vertex_on_chain",
+                        nexus_objects
+                            .get("workflow_pkg_id")
+                            .unwrap_or(&"{{workflow_pkg_id}}".to_string())
+                    ),
+                    arguments: vec![
+                        CommandArgument::Object {
+                            value: nexus_objects
+                                .get("tool_registry_id")
+                                .cloned()
+                                .unwrap_or_else(|| "{{tool_registry_id}}".to_string()),
+                        },
+                        CommandArgument::Pure {
+                            pure_type: "string".to_string(),
+                            value: serde_json::Value::String(tool_fqn.to_string()),
+                        },
+                    ],
+                    type_arguments: vec![],
+                    result_index,
+                });
+                let idx = result_index;
+                result_index += 1;
+                idx
+            }
         };
 
-        commands.push(TransactionCommand {
-            command_type: "moveCall".to_string(),
-            target: format!(
-                "{}::dag::vertex_off_chain",
-                nexus_objects
-                    .get("workflow_pkg_id")
-                    .unwrap_or(&"{{workflow_pkg_id}}".to_string())
-            ),
-            arguments: vec![CommandArgument::Pure {
-                pure_type: "string".to_string(),
-                value: serde_json::Value::String(tool_fqn),
-            }],
-            type_arguments: vec![],
-            result_index,
-        });
-        let vertex_kind_index = result_index;
-        result_index += 1;
-
         // Add vertex to DAG
         commands.push(TransactionCommand {
             command_type: "moveCall".to_string(),
@@ -267,18 +296,31 @@ pub fn build_dag_publish_transaction(dag_json: &str, nexus_objects_json: &str) -
             let input_port_index = result_index;
             result_index += 1;
 
-            // Create nexus data - Access data field from Data struct
+            // Create nexus data - supports both Inline and Walrus storage (v0.5.0)
             let json_string = serde_json::to_string(&default_value.value.data).unwrap_or_default();
             let json_bytes: Vec<u8> = json_string.into_bytes();
 
-            commands.push(TransactionCommand {
-                command_type: "moveCall".to_string(),
-                target: format!(
+            // Determine storage type from the Data struct
+            let is_walrus = matches!(default_value.value.storage, StorageKind::Walrus);
+            let data_target = if is_walrus {
+                format!(
+                    "{}::data::walrus_one",
+                    nexus_objects
+                        .get("primitives_pkg_id")
+                        .unwrap_or(&"{{primitives_pkg_id}}".to_string())
+                )
+            } else {
+                format!(
                     "{}::data::inline_one",
                     nexus_objects
                         .get("primitives_pkg_id")
                         .unwrap_or(&"{{primitives_pkg_id}}".to_string())
-                ),
+                )
+            };
+
+            commands.push(TransactionCommand {
+                command_type: "moveCall".to_string(),
+                target: data_target,
                 arguments: vec![CommandArgument::Pure {
                     pure_type: "vector_u8".to_string(),
                     value: serde_json::Value::Array(
diff --git a/sdk-wasm/src/lib.rs b/sdk-wasm/src/lib.rs
index 177f2338..610c64b0 100644
--- a/sdk-wasm/src/lib.rs
+++ b/sdk-wasm/src/lib.rs
@@ -4,8 +4,9 @@ mod crypto;
 mod dag_execute;
 mod dag_publish;
 mod dag_validate;
+mod scheduler;
 
-pub use {crypto::*, dag_execute::*, dag_publish::*, dag_validate::*};
+pub use {crypto::*, dag_execute::*, dag_publish::*, dag_validate::*, scheduler::*};
 
 // Called when the wasm module is instantiated
 #[wasm_bindgen(start)]
@@ -13,6 +14,24 @@ pub fn main() {
     console_error_panic_hook::set_once();
 }
 
+/// Get the SDK-WASM version information
+/// Updated to v0.5.0 with scheduler and tool registration support
+#[wasm_bindgen]
+pub fn get_sdk_version() -> String {
+    serde_json::json!({
+        "version": env!("CARGO_PKG_VERSION"),
+        "features": [
+            "dag_validation",
+            "dag_publish",
+            "dag_execute",
+            "crypto",
+            "scheduler"
+        ],
+        "cli_compatible_version": "0.5.0"
+    })
+    .to_string()
+}
+
 // A macro to provide `println!(..)`-style syntax for `console.log` logging.
 #[allow(unused_macros)]
 macro_rules! console_log {
diff --git a/sdk-wasm/src/scheduler.rs b/sdk-wasm/src/scheduler.rs
new file mode 100644
index 00000000..afa04994
--- /dev/null
+++ b/sdk-wasm/src/scheduler.rs
@@ -0,0 +1,794 @@
+// Scheduler transaction builders for WASM
+// Added in v0.5.0 to support on-chain task management
+//
+// Note: SDK's native transaction builders (nexus_sdk::transactions::scheduler)
+// cannot be used in WASM due to sui-crypto and sui-transaction-builder dependencies.
+// This module produces JSON command structures that JavaScript can convert to Sui transactions.
+//
+// IMPORTANT: This implementation mirrors sdk/src/transactions/scheduler.rs exactly.
+
+use {
+    serde::{Deserialize, Serialize},
+    std::collections::HashMap,
+    wasm_bindgen::prelude::*,
+};
+
+// =============================================================================
+// Constants
+// =============================================================================
+
+const SUI_FRAMEWORK: &str = "0x2";
+const MOVE_STDLIB: &str = "0x1";
+
+// =============================================================================
+// Public Types (WASM-exported)
+// =============================================================================
+
+/// Generator type for scheduler tasks
+#[wasm_bindgen]
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum GeneratorKind {
+    Queue    = 0,
+    Periodic = 1,
+}
+
+/// Task state actions
+#[wasm_bindgen]
+#[derive(Clone, Copy, Debug)]
+pub enum TaskStateAction {
+    Pause  = 0,
+    Resume = 1,
+    Cancel = 2,
+}
+
+// =============================================================================
+// Input Parameter Types
+// =============================================================================
+
+/// Scheduler task creation parameters
+#[derive(Serialize, Deserialize)]
+pub struct CreateTaskParams {
+    pub dag_id: String,
+    pub entry_group: String,
+    pub input_data: serde_json::Value,
+    pub metadata: Vec<(String, String)>,
+    pub execution_priority_fee_per_gas_unit: u64,
+    pub generator: String, // "queue" or "periodic"
+    pub network_id: String, // Required for execution policy
+}
+
+/// Occurrence request parameters
+#[derive(Serialize, Deserialize)]
+pub struct OccurrenceParams {
+    pub start_ms: Option<u64>,
+    pub deadline_ms: Option<u64>,
+    pub start_offset_ms: Option<u64>,
+    pub deadline_offset_ms: Option<u64>,
+    pub priority_fee_per_gas_unit: u64,
+}
+
+/// Periodic schedule configuration
+#[derive(Serialize, Deserialize)]
+pub struct PeriodicConfig {
+    pub first_start_ms: u64,
+    pub period_ms: u64,
+    pub deadline_offset_ms: Option<u64>,
+    pub max_iterations: Option<u64>,
+    pub priority_fee_per_gas_unit: u64,
+}
+
+// =============================================================================
+// Result Types (WASM-exported)
+// =============================================================================
+
+#[wasm_bindgen]
+pub struct SchedulerResult {
+    is_success: bool,
+    error_message: Option<String>,
+    transaction_data: Option<String>,
+}
+
+#[wasm_bindgen]
+impl SchedulerResult {
+    #[wasm_bindgen(getter)]
+    pub fn is_success(&self) -> bool {
+        self.is_success
+    }
+
+    #[wasm_bindgen(getter)]
+    pub fn error_message(&self) -> Option<String> {
+        self.error_message.clone()
+    }
+
+    #[wasm_bindgen(getter)]
+    pub fn transaction_data(&self) -> Option<String> {
+        self.transaction_data.clone()
+    }
+}
+
+impl SchedulerResult {
+    fn ok(data: String) -> Self {
+        Self {
+            is_success: true,
+            error_message: None,
+            transaction_data: Some(data),
+        }
+    }
+
+    fn err(msg: impl Into<String>) -> Self {
+        Self {
+            is_success: false,
+            error_message: Some(msg.into()),
+            transaction_data: None,
+        }
+    }
+}
+
+// =============================================================================
+// Internal: Command Builder
+// =============================================================================
+
+/// Helper for building PTB commands in JSON format
+struct CommandBuilder {
+    commands: Vec<serde_json::Value>,
+    result_index: usize,
+    workflow_pkg: String,
+    primitives_pkg: String,
+}
+
+impl CommandBuilder {
+    fn new(nexus_objects: &HashMap<String, String>) -> Self {
+        Self {
+            commands: Vec::new(),
+            result_index: 0,
+            workflow_pkg: nexus_objects
+                .get("workflow_pkg_id")
+                .cloned()
+                .unwrap_or_else(|| "{{workflow_pkg_id}}".into()),
+            primitives_pkg: nexus_objects
+                .get("primitives_pkg_id")
+                .cloned()
+                .unwrap_or_else(|| "{{primitives_pkg_id}}".into()),
+        }
+    }
+
+    /// Add a move call command and return its result index
+    fn move_call(
+        &mut self,
+        target: impl Into<String>,
+        type_args: Vec<String>,
+        arguments: Vec<serde_json::Value>,
+    ) -> usize {
+        let idx = self.result_index;
+        self.commands.push(serde_json::json!({
+            "type": "moveCall",
+            "target": target.into(),
+            "typeArguments": type_args,
+            "arguments": arguments,
+            "result_index": idx
+        }));
+        self.result_index += 1;
+        idx
+    }
+
+    /// Reference a previous result
+    fn result(index: usize) -> serde_json::Value {
+        serde_json::json!({"type": "result", "index": index})
+    }
+
+    /// Pure value argument
+    fn pure(pure_type: &str, value: impl Serialize) -> serde_json::Value {
+        serde_json::json!({"type": "pure", "pure_type": pure_type, "value": value})
+    }
+
+    /// Shared object argument
+    fn shared_object(id: &str, mutable: bool) -> serde_json::Value {
+        serde_json::json!({"type": "shared_object_by_id", "id": id, "mutable": mutable})
+    }
+
+    /// Clock object argument
+    fn clock() -> serde_json::Value {
+        serde_json::json!({"type": "clock_object"})
+    }
+
+    // =========================================================================
+    // Sui Framework Helpers
+    // =========================================================================
+
+    /// Create empty VecMap<K, V>
+    fn vec_map_empty(&mut self, key_type: &str, value_type: &str) -> usize {
+        self.move_call(
+            format!("{SUI_FRAMEWORK}::vec_map::empty"),
+            vec![key_type.into(), value_type.into()],
+            vec![],
+        )
+    }
+
+    /// Insert into VecMap
+    fn vec_map_insert(
+        &mut self,
+        key_type: &str,
+        value_type: &str,
+        map_idx: usize,
+        key_idx: usize,
+        value_idx: usize,
+    ) {
+        self.move_call(
+            format!("{SUI_FRAMEWORK}::vec_map::insert"),
+            vec![key_type.into(), value_type.into()],
+            vec![
+                Self::result(map_idx),
+                Self::result(key_idx),
+                Self::result(value_idx),
+            ],
+        );
+    }
+
+    /// Create empty TableVec<T>
+    fn table_vec_empty(&mut self, elem_type: &str) -> usize {
+        self.move_call(
+            format!("{SUI_FRAMEWORK}::table_vec::empty"),
+            vec![elem_type.into()],
+            vec![],
+        )
+    }
+
+    /// Push back to TableVec
+    fn table_vec_push_back(&mut self, elem_type: &str, vec_idx: usize, elem_idx: usize) {
+        self.move_call(
+            format!("{SUI_FRAMEWORK}::table_vec::push_back"),
+            vec![elem_type.into()],
+            vec![Self::result(vec_idx), Self::result(elem_idx)],
+        );
+    }
+
+    /// Drop TableVec
+    fn table_vec_drop(&mut self, elem_type: &str, vec_idx: usize) {
+        self.move_call(
+            format!("{SUI_FRAMEWORK}::table_vec::drop"),
+            vec![elem_type.into()],
+            vec![Self::result(vec_idx)],
+        );
+    }
+
+    /// Create string from bytes
+    fn string_utf8(&mut self, value: &str) -> usize {
+        self.move_call(
+            format!("{MOVE_STDLIB}::string::utf8"),
+            vec![],
+            vec![Self::pure("vector_u8", value.as_bytes().to_vec())],
+        )
+    }
+
+    /// Share object publicly
+    fn public_share_object(&mut self, type_tag: &str, obj_idx: usize) {
+        self.move_call(
+            format!("{SUI_FRAMEWORK}::transfer::public_share_object"),
+            vec![type_tag.into()],
+            vec![Self::result(obj_idx)],
+        );
+    }
+
+    // =========================================================================
+    // Workflow Package Helpers
+    // =========================================================================
+
+    fn workflow_target(&self, module: &str, function: &str) -> String {
+        format!("{}::{}::{}", self.workflow_pkg, module, function)
+    }
+
+    fn primitives_target(&self, module: &str, function: &str) -> String {
+        format!("{}::{}::{}", self.primitives_pkg, module, function)
+    }
+
+    /// Create witness symbol from type
+    fn witness_symbol(&mut self, witness_type: &str) -> usize {
+        self.move_call(
+            self.primitives_target("policy", "witness_symbol"),
+            vec![witness_type.into()],
+            vec![],
+        )
+    }
+
+    /// dag::vertex_from_string
+    fn vertex_from_string(&mut self, name: &str) -> usize {
+        self.move_call(
+            self.workflow_target("dag", "vertex_from_string"),
+            vec![],
+            vec![Self::pure("string", name)],
+        )
+    }
+
+    /// dag::input_port_from_string
+    fn input_port_from_string(&mut self, name: &str) -> usize {
+        self.move_call(
+            self.workflow_target("dag", "input_port_from_string"),
+            vec![],
+            vec![Self::pure("string", name)],
+        )
+    }
+
+    /// dag::entry_group_from_string
+    fn entry_group_from_string(&mut self, name: &str) -> usize {
+        self.move_call(
+            self.workflow_target("dag", "entry_group_from_string"),
+            vec![],
+            vec![Self::pure("string", name)],
+        )
+    }
+
+    /// data::inline_one (create NexusData)
+    fn nexus_data_inline(&mut self, json_value: &serde_json::Value) -> anyhow::Result<usize> {
+        let json_bytes = serde_json::to_string(json_value)?.into_bytes();
+        Ok(self.move_call(
+            self.primitives_target("data", "inline_one"),
+            vec![],
+            vec![Self::pure("vector_u8", json_bytes)],
+        ))
+    }
+
+    // =========================================================================
+    // Build Final Output
+    // =========================================================================
+
+    fn build(self) -> Vec<serde_json::Value> {
+        self.commands
+    }
+}
+
+// =============================================================================
+// Input Data Processing
+// =============================================================================
+
+/// Build the nested VecMap structure for input data
+/// VecMap<Vertex, VecMap<InputPort, NexusData>>
+fn build_input_data_commands(
+    cb: &mut CommandBuilder,
+    input_data: &serde_json::Value,
+) -> anyhow::Result<usize> {
+    let vertex_type = format!("{}::dag::Vertex", cb.workflow_pkg);
+    let port_type = format!("{}::dag::InputPort", cb.workflow_pkg);
+    let data_type = format!("{}::data::NexusData", cb.primitives_pkg);
+    let inner_map_type = format!("{SUI_FRAMEWORK}::vec_map::VecMap<{port_type}, {data_type}>");
+
+    // Outer VecMap<Vertex, VecMap<InputPort, NexusData>>
+    let outer_map = cb.vec_map_empty(&vertex_type, &inner_map_type);
+
+    if let Some(vertices) = input_data.as_object() {
+        for (vertex_name, ports) in vertices {
+            let vertex_idx = cb.vertex_from_string(vertex_name);
+            let inner_map = cb.vec_map_empty(&port_type, &data_type);
+
+            if let Some(port_obj) = ports.as_object() {
+                for (port_name, port_value) in port_obj {
+                    let port_idx = cb.input_port_from_string(port_name);
+                    let data_idx = cb.nexus_data_inline(port_value)?;
+                    cb.vec_map_insert(&port_type, &data_type, inner_map, port_idx, data_idx);
+                }
+            }
+
+            cb.vec_map_insert(
+                &vertex_type,
+                &inner_map_type,
+                outer_map,
+                vertex_idx,
+                inner_map,
+            );
+        }
+    }
+
+    Ok(outer_map)
+}
+
+/// Build metadata VecMap<String, String>
+fn build_metadata_commands(cb: &mut CommandBuilder, metadata: &[(String, String)]) -> usize {
+    let string_type = format!("{MOVE_STDLIB}::string::String");
+    let metadata_map = cb.vec_map_empty(&string_type, &string_type);
+
+    for (key, value) in metadata {
+        let key_idx = cb.string_utf8(key);
+        let value_idx = cb.string_utf8(value);
+        cb.vec_map_insert(&string_type, &string_type, metadata_map, key_idx, value_idx);
+    }
+
+    metadata_map
+}
+
+/// Build constraints policy with proper witness/TableVec pattern
+/// Mirrors SDK: new_constraints_policy()
+fn build_constraints_policy(
+    cb: &mut CommandBuilder,
+    generator: &str,
+) -> usize {
+    let symbol_type = format!("{}::policy::Symbol", cb.primitives_pkg);
+    
+    // 1. Create witness symbol based on generator type
+    let witness_type = if generator == "periodic" {
+        format!("{}::scheduler::PeriodicGeneratorWitness", cb.workflow_pkg)
+    } else {
+        format!("{}::scheduler::QueueGeneratorWitness", cb.workflow_pkg)
+    };
+    let constraint_symbol = cb.witness_symbol(&witness_type);
+
+    // 2. Create TableVec<Symbol> and push the symbol
+    let constraint_sequence = cb.table_vec_empty(&symbol_type);
+    cb.table_vec_push_back(&symbol_type, constraint_sequence, constraint_symbol);
+
+    // 3. Create constraints policy from sequence
+    let constraints = cb.move_call(
+        cb.workflow_target("scheduler", "new_constraints_policy"),
+        vec![],
+        vec![CommandBuilder::result(constraint_sequence)],
+    );
+
+    // 4. Drop the TableVec (it's consumed)
+    cb.table_vec_drop(&symbol_type, constraint_sequence);
+
+    // 5. Create and register generator state
+    if generator == "periodic" {
+        // Create periodic generator state
+        let periodic_state = cb.move_call(
+            cb.workflow_target("scheduler", "new_periodic_generator_state"),
+            vec![],
+            vec![],
+        );
+        // Register it
+        cb.move_call(
+            cb.workflow_target("scheduler", "register_periodic_generator"),
+            vec![],
+            vec![CommandBuilder::result(constraints), CommandBuilder::result(periodic_state)],
+        );
+    } else {
+        // Create queue generator state
+        let queue_state = cb.move_call(
+            cb.workflow_target("scheduler", "new_queue_generator_state"),
+            vec![],
+            vec![],
+        );
+        // Register it
+        cb.move_call(
+            cb.workflow_target("scheduler", "register_queue_generator"),
+            vec![],
+            vec![CommandBuilder::result(constraints), CommandBuilder::result(queue_state)],
+        );
+    }
+
+    constraints
+}
+
+/// Build execution policy with proper witness/TableVec pattern
+/// Mirrors SDK: new_execution_policy()
+fn build_execution_policy(
+    cb: &mut CommandBuilder,
+    dag_id: &str,
+    network_id: &str,
+    entry_group: &str,
+    input_data: &serde_json::Value,
+    priority_fee_per_gas_unit: u64,
+) -> anyhow::Result<usize> {
+    let symbol_type = format!("{}::policy::Symbol", cb.primitives_pkg);
+
+    // 1. Create witness symbol for BeginDagExecutionWitness
+    let witness_type = format!("{}::default_tap::BeginDagExecutionWitness", cb.workflow_pkg);
+    let execution_symbol = cb.witness_symbol(&witness_type);
+
+    // 2. Create TableVec<Symbol> and push the symbol
+    let execution_sequence = cb.table_vec_empty(&symbol_type);
+    cb.table_vec_push_back(&symbol_type, execution_sequence, execution_symbol);
+
+    // 3. Create execution policy from sequence
+    let execution = cb.move_call(
+        cb.workflow_target("scheduler", "new_execution_policy"),
+        vec![],
+        vec![CommandBuilder::result(execution_sequence)],
+    );
+
+    // 4. Drop the TableVec (it's consumed)
+    cb.table_vec_drop(&symbol_type, execution_sequence);
+
+    // 5. Create dag_id argument (ID from object_id)
+    let dag_id_arg = cb.move_call(
+        format!("{SUI_FRAMEWORK}::object::id_from_address"),
+        vec![],
+        vec![CommandBuilder::pure("address", dag_id)],
+    );
+
+    // 6. Create network_id argument (ID from object_id)
+    let network_id_arg = cb.move_call(
+        format!("{SUI_FRAMEWORK}::object::id_from_address"),
+        vec![],
+        vec![CommandBuilder::pure("address", network_id)],
+    );
+
+    // 7. Create entry_group argument
+    let entry_group_arg = cb.entry_group_from_string(entry_group);
+
+    // 8. Build input data VecMap
+    let with_vertex_inputs = build_input_data_commands(cb, input_data)?;
+
+    // 9. Create DAG execution config
+    let config = cb.move_call(
+        cb.workflow_target("dag", "new_dag_execution_config"),
+        vec![],
+        vec![
+            CommandBuilder::result(dag_id_arg),
+            CommandBuilder::result(network_id_arg),
+            CommandBuilder::result(entry_group_arg),
+            CommandBuilder::result(with_vertex_inputs),
+            CommandBuilder::pure("u64", priority_fee_per_gas_unit),
+        ],
+    );
+
+    // 10. Register the config on execution policy
+    cb.move_call(
+        cb.workflow_target("default_tap", "register_begin_execution"),
+        vec![],
+        vec![CommandBuilder::result(execution), CommandBuilder::result(config)],
+    );
+
+    Ok(execution)
+}
+
+// =============================================================================
+// WASM-Exported Functions
+// =============================================================================
+
+/// Build transaction for creating a scheduler task
+/// CLI: `nexus scheduler task create`
+#[wasm_bindgen]
+pub fn build_scheduler_task_create_transaction(
+    params_json: &str,
+    nexus_objects_json: &str,
+) -> SchedulerResult {
+    match build_task_create_impl(params_json, nexus_objects_json) {
+        Ok(data) => SchedulerResult::ok(data),
+        Err(e) => SchedulerResult::err(format!("Failed to build task create transaction: {e}")),
+    }
+}
+
+fn build_task_create_impl(params_json: &str, nexus_objects_json: &str) -> anyhow::Result<String> {
+    let params: CreateTaskParams = serde_json::from_str(params_json)?;
+    let nexus_objects: HashMap<String, String> = serde_json::from_str(nexus_objects_json)?;
+
+    let mut cb = CommandBuilder::new(&nexus_objects);
+
+    // 1. Build metadata
+    let metadata_map = build_metadata_commands(&mut cb, &params.metadata);
+    let metadata_arg = cb.move_call(
+        cb.workflow_target("scheduler", "new_metadata"),
+        vec![],
+        vec![CommandBuilder::result(metadata_map)],
+    );
+
+    // 2. Build constraints policy (with witness/TableVec pattern)
+    let constraints_arg = build_constraints_policy(&mut cb, &params.generator);
+
+    // 3. Build execution policy (with witness/TableVec pattern + config + register)
+    let execution_arg = build_execution_policy(
+        &mut cb,
+        &params.dag_id,
+        &params.network_id,
+        &params.entry_group,
+        &params.input_data,
+        params.execution_priority_fee_per_gas_unit,
+    )?;
+
+    // 4. Create task
+    let task_idx = cb.move_call(
+        cb.workflow_target("scheduler", "new"),
+        vec![],
+        vec![
+            CommandBuilder::result(metadata_arg),
+            CommandBuilder::result(constraints_arg),
+            CommandBuilder::result(execution_arg),
+        ],
+    );
+
+    // 5. Share task object
+    let task_type = format!("{}::scheduler::Task", cb.workflow_pkg);
+    cb.public_share_object(&task_type, task_idx);
+
+    Ok(serde_json::to_string(&serde_json::json!({
+        "operation": "scheduler_task_create",
+        "commands": cb.build(),
+        "dag_id": params.dag_id,
+        "network_id": params.network_id,
+        "entry_group": params.entry_group,
+        "generator": params.generator,
+        "priority_fee_per_gas_unit": params.execution_priority_fee_per_gas_unit
+    }))?)
+}
+
+/// Build transaction for adding an occurrence to a task
+/// CLI: `nexus scheduler occurrence add`
+#[wasm_bindgen]
+pub fn build_scheduler_occurrence_add_transaction(
+    task_id: &str,
+    params_json: &str,
+    nexus_objects_json: &str,
+) -> SchedulerResult {
+    match build_occurrence_add_impl(task_id, params_json, nexus_objects_json) {
+        Ok(data) => SchedulerResult::ok(data),
+        Err(e) => SchedulerResult::err(format!("Failed to build occurrence add transaction: {e}")),
+    }
+}
+
+fn build_occurrence_add_impl(
+    task_id: &str,
+    params_json: &str,
+    nexus_objects_json: &str,
+) -> anyhow::Result<String> {
+    let params: OccurrenceParams = serde_json::from_str(params_json)?;
+    let nexus_objects: HashMap<String, String> = serde_json::from_str(nexus_objects_json)?;
+
+    let mut cb = CommandBuilder::new(&nexus_objects);
+    let is_absolute = params.start_ms.is_some();
+
+    if is_absolute {
+        // Absolute time occurrence
+        let start_ms = params.start_ms.unwrap();
+        let deadline_offset = params
+            .deadline_offset_ms
+            .or_else(|| params.deadline_ms.map(|d| d.saturating_sub(start_ms)));
+
+        cb.move_call(
+            cb.workflow_target("scheduler", "add_occurrence_absolute_for_task"),
+            vec![],
+            vec![
+                CommandBuilder::shared_object(task_id, true),
+                CommandBuilder::pure("u64", start_ms),
+                CommandBuilder::pure("option_u64", deadline_offset),
+                CommandBuilder::pure("u64", params.priority_fee_per_gas_unit),
+                CommandBuilder::clock(),
+            ],
+        );
+    } else {
+        // Relative time occurrence
+        let start_offset = params.start_offset_ms.unwrap_or(0);
+
+        cb.move_call(
+            cb.workflow_target("scheduler", "add_occurrence_relative_for_task"),
+            vec![],
+            vec![
+                CommandBuilder::shared_object(task_id, true),
+                CommandBuilder::pure("u64", start_offset),
+                CommandBuilder::pure("option_u64", params.deadline_offset_ms),
+                CommandBuilder::pure("u64", params.priority_fee_per_gas_unit),
+                CommandBuilder::clock(),
+            ],
+        );
+    }
+
+    Ok(serde_json::to_string(&serde_json::json!({
+        "operation": "scheduler_occurrence_add",
+        "commands": cb.build(),
+        "task_id": task_id,
+        "is_absolute": is_absolute,
+        "priority_fee_per_gas_unit": params.priority_fee_per_gas_unit
+    }))?)
+}
+
+/// Build transaction for configuring periodic scheduling
+/// CLI: `nexus scheduler periodic set`
+#[wasm_bindgen]
+pub fn build_scheduler_periodic_set_transaction(
+    task_id: &str,
+    config_json: &str,
+    nexus_objects_json: &str,
+) -> SchedulerResult {
+    match build_periodic_set_impl(task_id, config_json, nexus_objects_json) {
+        Ok(data) => SchedulerResult::ok(data),
+        Err(e) => SchedulerResult::err(format!("Failed to build periodic set transaction: {e}")),
+    }
+}
+
+fn build_periodic_set_impl(
+    task_id: &str,
+    config_json: &str,
+    nexus_objects_json: &str,
+) -> anyhow::Result<String> {
+    let config: PeriodicConfig = serde_json::from_str(config_json)?;
+    let nexus_objects: HashMap<String, String> = serde_json::from_str(nexus_objects_json)?;
+
+    let mut cb = CommandBuilder::new(&nexus_objects);
+
+    // SDK does NOT use clock for this function
+    // Arguments: task, first_start_ms, period_ms, deadline_offset_ms, max_iterations, priority_fee
+    cb.move_call(
+        cb.workflow_target("scheduler", "new_or_modify_periodic_for_task"),
+        vec![],
+        vec![
+            CommandBuilder::shared_object(task_id, true),
+            CommandBuilder::pure("u64", config.first_start_ms),
+            CommandBuilder::pure("u64", config.period_ms),
+            CommandBuilder::pure("option_u64", config.deadline_offset_ms),
+            CommandBuilder::pure("option_u64", config.max_iterations),
+            CommandBuilder::pure("u64", config.priority_fee_per_gas_unit),
+        ],
+    );
+
+    Ok(serde_json::to_string(&serde_json::json!({
+        "operation": "scheduler_periodic_set",
+        "commands": cb.build(),
+        "task_id": task_id,
+        "first_start_ms": config.first_start_ms,
+        "period_ms": config.period_ms
+    }))?)
+}
+
+/// Build transaction for disabling periodic scheduling
+/// CLI: `nexus scheduler periodic disable`
+#[wasm_bindgen]
+pub fn build_scheduler_periodic_disable_transaction(
+    task_id: &str,
+    nexus_objects_json: &str,
+) -> SchedulerResult {
+    match build_periodic_disable_impl(task_id, nexus_objects_json) {
+        Ok(data) => SchedulerResult::ok(data),
+        Err(e) => {
+            SchedulerResult::err(format!("Failed to build periodic disable transaction: {e}"))
+        }
+    }
+}
+
+fn build_periodic_disable_impl(task_id: &str, nexus_objects_json: &str) -> anyhow::Result<String> {
+    let nexus_objects: HashMap<String, String> = serde_json::from_str(nexus_objects_json)?;
+    let mut cb = CommandBuilder::new(&nexus_objects);
+
+    cb.move_call(
+        cb.workflow_target("scheduler", "disable_periodic_for_task"),
+        vec![],
+        vec![CommandBuilder::shared_object(task_id, true)],
+    );
+
+    Ok(serde_json::to_string(&serde_json::json!({
+        "operation": "scheduler_periodic_disable",
+        "commands": cb.build(),
+        "task_id": task_id
+    }))?)
+}
+
+/// Build transaction for changing task state (pause/resume/cancel)
+/// CLI: `nexus scheduler task pause/resume/cancel`
+#[wasm_bindgen]
+pub fn build_scheduler_task_state_transaction(
+    task_id: &str,
+    action: TaskStateAction,
+    nexus_objects_json: &str,
+) -> SchedulerResult {
+    match build_task_state_impl(task_id, action, nexus_objects_json) {
+        Ok(data) => SchedulerResult::ok(data),
+        Err(e) => SchedulerResult::err(format!("Failed to build task state transaction: {e}")),
+    }
+}
+
+fn build_task_state_impl(
+    task_id: &str,
+    action: TaskStateAction,
+    nexus_objects_json: &str,
+) -> anyhow::Result<String> {
+    let nexus_objects: HashMap<String, String> = serde_json::from_str(nexus_objects_json)?;
+    let mut cb = CommandBuilder::new(&nexus_objects);
+
+    let action_name = match action {
+        TaskStateAction::Pause => "pause",
+        TaskStateAction::Resume => "resume",
+        TaskStateAction::Cancel => "cancel",
+    };
+
+    cb.move_call(
+        cb.workflow_target(
+            "scheduler",
+            &format!("{action_name}_time_constraint_for_task"),
+        ),
+        vec![],
+        vec![CommandBuilder::shared_object(task_id, true)],
+    );
+
+    Ok(serde_json::to_string(&serde_json::json!({
+        "operation": format!("scheduler_task_{action_name}"),
+        "commands": cb.build(),
+        "task_id": task_id,
+        "action": action_name
+    }))?)
+}

From 95a3fe34c7aabd4965b34878b5186ebd3af68d2a Mon Sep 17 00:00:00 2001
From: afarukcali <afarukcali@gmail.com>
Date: Tue, 27 Jan 2026 14:42:33 +0300
Subject: [PATCH 4/5] fix : wrong contract method name changed.

---
 sdk-wasm/src/scheduler.rs | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/sdk-wasm/src/scheduler.rs b/sdk-wasm/src/scheduler.rs
index afa04994..c18fa19b 100644
--- a/sdk-wasm/src/scheduler.rs
+++ b/sdk-wasm/src/scheduler.rs
@@ -777,10 +777,7 @@ fn build_task_state_impl(
     };
 
     cb.move_call(
-        cb.workflow_target(
-            "scheduler",
-            &format!("{action_name}_time_constraint_for_task"),
-        ),
+        cb.workflow_target("scheduler", action_name),
         vec![],
         vec![CommandBuilder::shared_object(task_id, true)],
     );

From 011c020fc5560ca2eee9012a92e4299e256ba44f Mon Sep 17 00:00:00 2001
From: afarukcali <afarukcali@gmail.com>
Date: Thu, 12 Feb 2026 16:56:05 +0300
Subject: [PATCH 5/5] feat : walrus remote data storage for sdk-wasm

---
 sdk-wasm/Cargo.toml         |   3 +-
 sdk-wasm/README.md          |  38 ++++++++++++
 sdk-wasm/src/dag_execute.rs |  80 ++++++++++++++++++++++----
 sdk-wasm/src/lib.rs         |  26 +++++----
 sdk-wasm/src/walrus.rs      | 112 ++++++++++++++++++++++++++++++++++++
 5 files changed, 236 insertions(+), 23 deletions(-)
 create mode 100644 sdk-wasm/src/walrus.rs

diff --git a/sdk-wasm/Cargo.toml b/sdk-wasm/Cargo.toml
index 7c43273c..17488c7e 100644
--- a/sdk-wasm/Cargo.toml
+++ b/sdk-wasm/Cargo.toml
@@ -40,7 +40,7 @@ argon2.workspace = true
 aes-gcm.workspace = true
 zeroize.workspace = true
 
-# Web API bindings
+# Web API bindings (includes fetch for Walrus upload)
 [dependencies.web-sys]
 version = "0.3"
 features = [
@@ -51,6 +51,7 @@ features = [
   "Storage",
   "Request",
   "RequestInit",
+  "RequestMode",
   "Response",
   "Headers",
   "Crypto",
diff --git a/sdk-wasm/README.md b/sdk-wasm/README.md
index c40f0daa..2305e21f 100644
--- a/sdk-wasm/README.md
+++ b/sdk-wasm/README.md
@@ -5,6 +5,8 @@ WebAssembly bindings for Nexus CLI functionality, enabling DAG validation and ot
 ## Features
 
 - **DAG Validation**: Validate Nexus DAG structures from JSON in the browser
+- **DAG Execute**: Build DAG execution transactions (CLI-compatible)
+- **Walrus Storage**: Upload data to Walrus for remote port storage (CLI `--remote` parity)
 - **Zero Dependencies**: All functionality bundled in WASM for web usage
 - **Multiple Targets**: Supports web, Node.js, and bundler environments
 
@@ -87,6 +89,42 @@ Validates a DAG from a JSON string.
   - `is_valid`: boolean indicating if the DAG is valid
   - `error_message`: optional string with error details if validation fails
 
+### Walrus (Remote Storage)
+
+To store port data in Walrus instead of inline (CLI `--remote` parity):
+
+1. **Upload data** for each remote port:
+
+```javascript
+const blobId = await upload_json_to_walrus(
+  "https://publisher.walrus-testnet.walrus.space",
+  JSON.stringify(portValue),
+  2  // save_for_epochs (1-53)
+);
+```
+
+2. **Build the transaction** with remote ports:
+
+```javascript
+const result = build_dag_execution_transaction(
+  dagId,
+  "default",
+  inputJson,
+  "{}",
+  "10000000",
+  "0",
+  '["vertex.port"]',           // remote_ports_json
+  `{"vertex.port": "${blobId}"}`,  // remote_ports_blob_ids_json
+  "2"                         // walrus_save_for_epochs
+);
+```
+
+**Parameters** (Walrus, optional):
+
+- `remote_ports_json`: JSON array of `"vertex.port"` strings
+- `remote_ports_blob_ids_json`: JSON object mapping `"vertex.port"` → blob ID
+- `walrus_save_for_epochs`: Number of epochs (1-53). Required when using remote ports.
+
 ## Development
 
 The WASM bindings are built from Rust source code using `wasm-bindgen`. The main validator logic is adapted from the Nexus CLI to work in WASM environments.
diff --git a/sdk-wasm/src/dag_execute.rs b/sdk-wasm/src/dag_execute.rs
index f1914aa4..469b0d3b 100644
--- a/sdk-wasm/src/dag_execute.rs
+++ b/sdk-wasm/src/dag_execute.rs
@@ -67,7 +67,14 @@ impl ExecutionResult {
 }
 
 /// ✅ Build DAG execution transaction using SDK (CLI-compatible with auto-encryption)
-/// Updated for v0.5.0: Added priority_fee_per_gas_unit support
+///
+/// # Walrus (remote storage) parameters
+/// When using remote storage, call `upload_json_to_walrus` for each remote port first,
+/// then pass the blob IDs here.
+///
+/// * `remote_ports_json` - JSON array of "vertex.port" strings, e.g. `["add-vertex.a"]`
+/// * `remote_ports_blob_ids_json` - JSON object mapping "vertex.port" to blob IDs
+/// * `walrus_save_for_epochs` - Number of epochs (1-53) when using Walrus. Required when remote_ports are provided.
 #[wasm_bindgen]
 pub fn build_dag_execution_transaction(
     dag_id: &str,
@@ -76,6 +83,9 @@ pub fn build_dag_execution_transaction(
     encrypted_ports_json: &str,
     gas_budget: &str,
     priority_fee_per_gas_unit: Option<String>,
+    remote_ports_json: Option<String>,
+    remote_ports_blob_ids_json: Option<String>,
+    walrus_save_for_epochs: Option<String>,
 ) -> ExecutionResult {
     use web_sys::console;
 
@@ -143,6 +153,36 @@ pub fn build_dag_execution_transaction(
             console::log_1(&"No encrypted ports, using plaintext input (CLI-parity)".into());
         }
 
+        // Parse Walrus remote ports (CLI --remote parity)
+        let remote_ports: std::collections::HashSet<String> = remote_ports_json
+            .as_ref()
+            .and_then(|s| serde_json::from_str(s).ok())
+            .unwrap_or_default();
+        let remote_ports_blob_ids: std::collections::HashMap<String, String> =
+            remote_ports_blob_ids_json
+                .as_ref()
+                .and_then(|s| serde_json::from_str(s).ok())
+                .unwrap_or_default();
+        let walrus_epochs: u8 = walrus_save_for_epochs
+            .as_ref()
+            .and_then(|s| s.parse().ok())
+            .unwrap_or(0);
+
+        if !remote_ports.is_empty() {
+            if walrus_epochs == 0 {
+                return Err("walrus_save_for_epochs is required when using remote ports".into());
+            }
+            for rp in &remote_ports {
+                if !remote_ports_blob_ids.contains_key(rp) {
+                    return Err(format!(
+                        "Missing blob ID for remote port '{}'. Call upload_json_to_walrus first.",
+                        rp
+                    )
+                    .into());
+                }
+            }
+        }
+
         // Build transaction commands that mirror CLI's dag::execute function
         let mut commands = Vec::new();
 
@@ -215,21 +255,39 @@ pub fn build_dag_execution_transaction(
                 let port_result_index = command_index;
                 command_index += 1;
 
-                let json_string = serde_json::to_string(port_value)?;
-                let json_bytes = json_string.as_bytes().to_vec();
-
-                // Use appropriate NexusData function based on encryption status (like CLI)
-                let data_target = if is_encrypted {
-                    "{{primitives_pkg_id}}::data::inline_one_encrypted" // Use inline_one_encrypted for encrypted data
+                let remote_handle = format!("{}.{}", vertex_name, port_name);
+                let is_remote = remote_ports.contains(&remote_handle);
+
+                let (data_target, data_bytes) = if is_remote {
+                    // Walrus: use blob_id bytes (JSON serialization of the string)
+                    let blob_id = remote_ports_blob_ids.get(&remote_handle).ok_or_else(|| {
+                        format!("Missing blob ID for remote port '{}'", remote_handle)
+                    })?;
+                    let blob_id_bytes =
+                        serde_json::to_vec(&serde_json::Value::String(blob_id.clone()))?;
+                    let target = if is_encrypted {
+                        "{{primitives_pkg_id}}::data::walrus_one_encrypted"
+                    } else {
+                        "{{primitives_pkg_id}}::data::walrus_one"
+                    };
+                    (target, blob_id_bytes)
                 } else {
-                    "{{primitives_pkg_id}}::data::inline_one" // Use inline_one for regular data
+                    // Inline: use port value bytes
+                    let json_string = serde_json::to_string(port_value)?;
+                    let bytes = json_string.as_bytes().to_vec();
+                    let target = if is_encrypted {
+                        "{{primitives_pkg_id}}::data::inline_one_encrypted"
+                    } else {
+                        "{{primitives_pkg_id}}::data::inline_one"
+                    };
+                    (target, bytes)
                 };
 
                 commands.push(serde_json::json!({
                     "type": "moveCall",
                     "target": data_target,
                     "arguments": [
-                        {"type": "pure", "pure_type": "vector_u8", "value": json_bytes}
+                        {"type": "pure", "pure_type": "vector_u8", "value": data_bytes}
                     ],
                     "result_index": command_index
                 }));
@@ -312,7 +370,9 @@ pub fn build_dag_execution_transaction(
             "priority_fee_per_gas_unit": priority_fee,
             "encrypted_ports_count": encrypted_ports.len(),
             "vertices_count": input_data.as_object().map_or(0, |obj| obj.len()),
-            "auto_encrypted": !encrypted_ports.is_empty()
+            "auto_encrypted": !encrypted_ports.is_empty(),
+            "remote_ports_count": remote_ports.len(),
+            "walrus_save_for_epochs": if remote_ports.is_empty() { None::<u8> } else { Some(walrus_epochs) }
         });
 
         Ok(serde_json::json!({
diff --git a/sdk-wasm/src/lib.rs b/sdk-wasm/src/lib.rs
index 610c64b0..6e461224 100644
--- a/sdk-wasm/src/lib.rs
+++ b/sdk-wasm/src/lib.rs
@@ -5,8 +5,9 @@ mod dag_execute;
 mod dag_publish;
 mod dag_validate;
 mod scheduler;
+mod walrus;
 
-pub use {crypto::*, dag_execute::*, dag_publish::*, dag_validate::*, scheduler::*};
+pub use {crypto::*, dag_execute::*, dag_publish::*, dag_validate::*, scheduler::*, walrus::*};
 
 // Called when the wasm module is instantiated
 #[wasm_bindgen(start)]
@@ -18,17 +19,18 @@ pub fn main() {
 /// Updated to v0.5.0 with scheduler and tool registration support
 #[wasm_bindgen]
 pub fn get_sdk_version() -> String {
-    serde_json::json!({
-        "version": env!("CARGO_PKG_VERSION"),
-        "features": [
-            "dag_validation",
-            "dag_publish",
-            "dag_execute",
-            "crypto",
-            "scheduler"
-        ],
-        "cli_compatible_version": "0.5.0"
-    })
+        serde_json::json!({
+            "version": env!("CARGO_PKG_VERSION"),
+            "features": [
+                "dag_validation",
+                "dag_publish",
+                "dag_execute",
+                "crypto",
+                "scheduler",
+                "walrus"
+            ],
+            "cli_compatible_version": "0.5.0"
+        })
     .to_string()
 }
 
diff --git a/sdk-wasm/src/walrus.rs b/sdk-wasm/src/walrus.rs
new file mode 100644
index 00000000..2803143e
--- /dev/null
+++ b/sdk-wasm/src/walrus.rs
@@ -0,0 +1,112 @@
+//! Walrus blob storage integration for WASM.
+//!
+//! Provides HTTP-based upload to Walrus publisher for remote port data storage.
+
+use {
+    js_sys::Promise,
+    serde::Deserialize,
+    wasm_bindgen::prelude::*,
+    wasm_bindgen_futures::JsFuture,
+};
+
+/// Response from Walrus publisher PUT /v1/blobs
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct StorageInfo {
+    newly_created: Option<NewlyCreated>,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct NewlyCreated {
+    blob_object: BlobObject,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct BlobObject {
+    blob_id: String,
+}
+
+/// Upload JSON data to Walrus and return the blob ID.
+///
+/// Uses the Walrus publisher API: PUT {publisher_url}/v1/blobs?epochs={epochs}
+/// with the JSON content as body.
+///
+/// # Arguments
+/// * `publisher_url` - Walrus publisher URL (e.g. https://publisher.walrus-testnet.walrus.space)
+/// * `data_json` - JSON string of the data to upload
+/// * `save_for_epochs` - Number of epochs to store the data (1-53)
+///
+/// # Returns
+/// A Promise that resolves to the blob ID string, or rejects with an error message.
+#[wasm_bindgen]
+pub fn upload_json_to_walrus(publisher_url: &str, data_json: &str, save_for_epochs: u8) -> Promise {
+    let url = format!("{}/v1/blobs?epochs={}", publisher_url, save_for_epochs);
+
+    let init = web_sys::RequestInit::new();
+    init.set_method("PUT");
+    init.set_mode(web_sys::RequestMode::Cors);
+    let body = JsValue::from_str(data_json);
+    init.set_body(&body);
+
+    let request =
+        web_sys::Request::new_with_str_and_init(&url, &init).expect("Failed to create request");
+
+    request
+        .headers()
+        .set("Content-Type", "application/json")
+        .expect("Failed to set Content-Type header");
+
+    let window = web_sys::window().expect("No window");
+    let fetch_promise = window.fetch_with_request(&request);
+
+    wasm_bindgen_futures::future_to_promise(async move {
+        let resp_value = JsFuture::from(fetch_promise).await.map_err(|e| {
+            JsValue::from(format!(
+                "Walrus upload request failed: {}",
+                js_sys::Reflect::get(&e, &JsValue::from_str("message"))
+                    .ok()
+                    .and_then(|v| v.as_string())
+                    .unwrap_or_else(|| "Unknown error".to_string())
+            ))
+        })?;
+
+        let resp: web_sys::Response = resp_value
+            .dyn_into()
+            .map_err(|_| JsValue::from("Fetch returned non-Response"))?;
+
+        if !resp.ok() {
+            let status = resp.status();
+            let text = JsFuture::from(
+                resp.text()
+                    .map_err(|_| JsValue::from("Failed to get response text"))?,
+            )
+            .await
+            .map_err(|_| JsValue::from("Failed to read response body"))?;
+            let text_str = text.as_string().unwrap_or_default();
+            return Err(JsValue::from(format!(
+                "Walrus API error {}: {}",
+                status, text_str
+            )));
+        }
+
+        let json = JsFuture::from(
+            resp.json()
+                .map_err(|_| JsValue::from("Failed to get JSON"))?,
+        )
+        .await
+        .map_err(|_| JsValue::from("Failed to parse JSON response"))?;
+
+        let info: StorageInfo = serde_wasm_bindgen::from_value(json)
+            .map_err(|e| JsValue::from(format!("Failed to parse Walrus response: {}", e)))?;
+
+        let blob_id = info
+            .newly_created
+            .ok_or_else(|| JsValue::from("Walrus response missing newlyCreated"))?
+            .blob_object
+            .blob_id;
+
+        Ok(JsValue::from(blob_id))
+    })
+}