diff --git a/.githooks/_/install.sh b/.githooks/_/install.sh
deleted file mode 100755
index a90c9cb65..000000000
--- a/.githooks/_/install.sh
+++ /dev/null
@@ -1,11 +0,0 @@
-#!/bin/sh
-
-DIR="$(dirname "$0")/.."
-
-FLAG_FILE="$DIR/_/.setup"
-
-if [ ! -f "$FLAG_FILE" ]; then
-    echo "Linking Git Hooks 🐶..."
-    git config core.hooksPath "$DIR"
-    touch "$FLAG_FILE"
-fi
diff --git a/.githooks/commit-msg b/.githooks/commit-msg
deleted file mode 100755
index 9745496f9..000000000
--- a/.githooks/commit-msg
+++ /dev/null
@@ -1,25 +0,0 @@
-#!/bin/bash
-
-# Regex for Conventional Commits (Plus Git Vernacular for Merges and Reverts)
-CONVENTIONAL_COMMITS_REGEX="^((Merge[ a-z-]* branch.*)|(Revert*)|((build|chore|ci|docs|feat|fix|perf|refactor|revert|style|test)(\(.*\))?!?: .*))"
-
-# Get the commit message
-COMMIT_MSG=$(cat "$1")
-
-# Check if the commit message matches the Conventional Commits format
-if [[ ! $COMMIT_MSG =~ $CONVENTIONAL_COMMITS_REGEX ]]; then
-  echo "❌ Error: Commit message does not follow the Conventional Commits format."
-  echo ""
-  echo "Expected format: <type>(<scope>): <description>"
-  echo ""
-  echo "✅ Examples:"
-  echo "  feat(parser): add ability to parse arrays"
-  echo "  fix(login): handle edge case with empty passwords"
-  echo "  docs: update README with installation instructions"
-  echo ""
-  echo "Allowed types: build, chore, ci, docs, feat, fix, perf, refactor, revert, style, test"
-  exit 1
-fi
-
-# If the commit message is valid, allow the commit
-exit 0
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
new file mode 100644
index 000000000..8048d3348
--- /dev/null
+++ b/.github/workflows/build.yml
@@ -0,0 +1,36 @@
+name: Build and Publish Docker Image
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+
+jobs:
+  image:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Setup Docker buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to the GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push container image to GitHub Container Registry
+        uses: docker/build-push-action@v5
+        with:
+          labels: |
+            org.opencontainers.image.revision=${{ github.sha }}
+          push: true
+          platforms: linux/amd64
+          tags: |
+            ghcr.io/${{ github.repository_owner }}/hyperbeam:latest
+            ghcr.io/${{ github.repository_owner }}/hyperbeam:${{ github.sha }}
diff --git a/.gitignore b/.gitignore
index f230ac910..3add8e905 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,4 @@
+# config.*
 .rebar3
 _build
 _checkouts
@@ -42,4 +43,6 @@ mkdocs-site/
 mkdocs-site-id.txt
 mkdocs-site-manifest.csv
 
-!test/admissible-report-wallet.json
\ No newline at end of file
+!test/admissible-report-wallet.json
+!test/admissible-report.json
+!test/config.json
diff --git a/.vscode/launch.json b/.vscode/launch.json
index e3631816e..4d956ca88 100644
--- a/.vscode/launch.json
+++ b/.vscode/launch.json
@@ -14,7 +14,7 @@
       "internalConsoleOptions": "openOnSessionStart",
       "module": "hb_debugger",
       "function": "start_and_break",
-      "args": "[${input:moduleName}, ${input:functionName}, [${input:funcArgs}]]"
+      "args": "[${input:moduleName}, ${input:functionName}, [${input:funcArgs}], <<\"${input:debuggerScope}\">>]"
     },
     {
       "name": "Attach to a 'rebar3 debugger' node.",
@@ -65,6 +65,11 @@
       "id": "funcArgs",
       "type": "promptString",
       "description": "(Optional) Pass arguments to the function:"
+    },
+    {
+      "id": "debuggerScope",
+      "type": "promptString",
+      "description": "(Optional) Additional modules/prefixes for debugger scope:"
     }
   ]
 }
\ No newline at end of file
diff --git a/.vscode/tasks.json b/.vscode/tasks.json
index af5da0a2c..4433eda60 100644
--- a/.vscode/tasks.json
+++ b/.vscode/tasks.json
@@ -14,7 +14,37 @@
     {
       "label": "Stop HyperBEAM",
       "type": "shell",
-      "command": "lsof -i tcp:10000 | tail -n 1 | awk '{print $2}' | xargs kill -9"
+      "command": "lsof -i tcp:8734 | tail -n 1 | awk '{print $2}' | xargs kill -9"
+    },
+    {
+      "label": "Generate a flame graph for a function.",
+      "type": "shell",
+      "command": "rebar3 as eflame shell --eval \"hb_debugger:profile_and_stop(fun() -> ${input:moduleName}:${input:functionName}(${input:funcArgs}) end).\"",
+      "group": "test",
+      "problemMatcher": "$erlang",
+      "presentation": {
+        "echo": true,
+        "reveal": "always",
+        "focus": false,
+        "panel": "new"
+      }
+    }
+  ],
+  "inputs": [
+    {
+      "id": "moduleName",
+      "type": "promptString",
+      "description": "Enter module:"
+    },
+    {
+      "id": "functionName", 
+      "type": "promptString",
+      "description": "Enter an exported function name:"
+    },
+    {
+      "id": "funcArgs",
+      "type": "promptString",
+      "description": "(Optional) Pass arguments to the function:"
     }
   ]
 }
\ No newline at end of file
diff --git a/Dockerfile b/Dockerfile
index a78f0137b..26b9ad123 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM --platform=linux/amd64 ubuntu:22.04
+FROM ubuntu:22.04 AS builder
 
 RUN apt-get update && apt-get install -y \
     build-essential \
@@ -7,7 +7,9 @@ RUN apt-get update && apt-get install -y \
     pkg-config \
     ncurses-dev \
     libssl-dev \
-    sudo
+    sudo \
+    curl \
+    ca-certificates
 
 RUN git clone https://github.com/erlang/otp.git && \
     cd otp && \
@@ -21,15 +23,38 @@ RUN git clone https://github.com/erlang/rebar3.git && \
     ./bootstrap && \
     sudo mv rebar3 /usr/local/bin/
 
-RUN git clone https://github.com/rust-lang/rust.git && \
-    cd rust && \
-    ./configure && \
-    make && \
-    sudo make install
+# install node 22 (used by genesis_wasm profile)
+RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - && \
+    apt-get install -y nodejs && \
+    node --version
+
+RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
+ENV PATH="/root/.cargo/bin:${PATH}"
+
+WORKDIR /opt
+
+COPY . .
+
+# compile the project with provided profiles
+RUN rebar3 clean && rebar3 get-deps && rebar3 as genesis_wasm release
+
+FROM ubuntu:22.04 AS runner
+
+WORKDIR /opt
+
+# Install Node 22 dependencies
+RUN apt-get update && apt-get install -y \
+    ca-certificates \
+    curl \
+    gnupg
 
-COPY . /app
+# node 22 is still needed for genesis_wasm profile
+RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - && \
+    apt-get install -y nodejs && \
+    node --version
 
-RUN cd /app && \
-    rebar3 compile
+# copy the build artifacts from the builder stage
+COPY --from=builder /opt/_build/ /opt/_build/
 
-CMD ["/bin/bash"]
\ No newline at end of file
+# bin bash here to start the container
+ENTRYPOINT ["/opt/_build/genesis_wasm/rel/hb/bin/hb"]
diff --git a/Makefile b/Makefile
index 003998809..6d074e578 100644
--- a/Makefile
+++ b/Makefile
@@ -6,9 +6,9 @@ compile:
 WAMR_VERSION = 2.2.0
 WAMR_DIR = _build/wamr
 
-GENESIS_WASM_BRANCH = tillathehun0/cu-experimental
+GENESIS_WASM_BRANCH = feat/http-checkpoint
 GENESIS_WASM_REPO = https://github.com/permaweb/ao.git
-GENESIS_WASM_SERVER_DIR = _build/genesis-wasm-server
+GENESIS_WASM_SERVER_DIR = _build/genesis_wasm/genesis-wasm-server
 
 ifdef HB_DEBUG
 	WAMR_FLAGS = -DWAMR_ENABLE_LOG=1 -DWAMR_BUILD_DUMP_CALL_STACK=1 -DCMAKE_BUILD_TYPE=Debug
@@ -98,7 +98,7 @@ setup-genesis-wasm: $(GENESIS_WASM_SERVER_DIR)
 		echo "Error: Node.js is not installed. Please install Node.js before continuing."; \
 		echo "For Ubuntu/Debian, you can install it with:"; \
 		echo "  curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash - && \\"; \
-		echo "  apt-get install -y nodejs && \\"; \
+		echo "  apt-get install -y nodejs=22.16.0-1nodesource1 --allow-downgrades && \\"; \
 		echo "  node -v && npm -v"; \
 		exit 1; \
 	fi
diff --git a/README.md b/README.md
index fc1b805bd..dc6bf80e1 100644
--- a/README.md
+++ b/README.md
@@ -298,4 +298,3 @@ by [Forward Research](https://fwd.arweave.net). Pull Requests are always welcome
 
 To get started building on HyperBEAM, check out the [hacking on HyperBEAM](./docs/misc/hacking-on-hyperbeam.md)
 guide.
-
diff --git a/config.flat b/config.flat
index cbcd9ebf3..f5ff749fa 100644
--- a/config.flat
+++ b/config.flat
@@ -1 +1 @@
-port: 10000
\ No newline at end of file
+port: 10000
diff --git a/native/dev_snp_nif/src/attestation.rs b/native/dev_snp_nif/src/attestation.rs
index e418949d7..eb5507fcc 100644
--- a/native/dev_snp_nif/src/attestation.rs
+++ b/native/dev_snp_nif/src/attestation.rs
@@ -77,12 +77,12 @@ pub fn generate_attestation_report<'a>(
     };
 
     // Step 5: Log the serialized JSON for debugging purposes.
-    log_message(
-        "INFO",
-        file!(),
-        line!(),
-        &format!("Generated report JSON: {:?}", report_json),
-    );
+    // log_message(
+    //     "INFO",
+    //     file!(),
+    //     line!(),
+    //     &format!("Generated report JSON: {:?}", report_json),
+    // );
 
     // Step 6: Return the result as a tuple with the `ok` atom.
     Ok((ok(), report_json).encode(env))
diff --git a/native/dev_snp_nif/src/digest.rs b/native/dev_snp_nif/src/digest.rs
index 5adb3bcb9..483c026f6 100644
--- a/native/dev_snp_nif/src/digest.rs
+++ b/native/dev_snp_nif/src/digest.rs
@@ -102,14 +102,11 @@ pub fn compute_launch_digest<'a>(env: Env<'a>, input_map: Term<'a>) -> NifResult
         kernel_file: None,
         initrd_file: None,
         append: None,
-        // vcpus: args.vcpus,
-        // vcpu_type: CpuType::try_from(args.vcpu_type).unwrap(),
-        // vmm_type: Some(VMMType::try_from(args.vmm_type).unwrap()),
-        // guest_features: GuestFeatures(args.guest_features),
-		vcpus: 32,
-        vcpu_type: CpuType::EpycV4,
-        vmm_type: Some(VMMType::QEMU),
-        guest_features: GuestFeatures(0x1),
+
+		vcpus: args.vcpus,
+        vcpu_type: CpuType::try_from(args.vcpu_type).unwrap(),
+        vmm_type: Some(VMMType::try_from(args.vmm_type).unwrap()),
+        guest_features: GuestFeatures(args.guest_features),
         ovmf_hash_str: Some(args.ovmf_hash_str.as_str()),
         kernel_hash: Some(hex::decode(args.kernel_hash).unwrap().try_into().unwrap()),
         initrd_hash: Some(hex::decode(args.initrd_hash).unwrap().try_into().unwrap()),
diff --git a/rebar.config b/rebar.config
index 9127ae03f..03ca19b31 100644
--- a/rebar.config
+++ b/rebar.config
@@ -2,10 +2,36 @@
 {plugins, [pc, rebar3_rustler, rebar_edown_plugin]}.
 
 {profiles, [
+    {no_events, [{erl_opts, [{d, 'NO_EVENTS', true}]}]},
+    {store_events, [{erl_opts, [{d, 'STORE_EVENTS', true}]}]},
+    {ao_profiling, [{erl_opts, [{d, 'AO_PROFILING', true}]}]},
+    {eflame,
+        [
+            {deps,
+                [
+                    {eflame,
+                        {git,
+                            "https://github.com/samcamwilliams/eflame.git",
+                            {ref, "d81a6e174956b4b0aca13363d51e4f51a5fabbd2"}
+                        }
+                    }
+                ]
+            },
+            {erl_opts, [{d, 'ENABLE_EFLAME', true}]}
+        ]
+    },
     {genesis_wasm, [
         {erl_opts, [{d, 'ENABLE_GENESIS_WASM', true}]},
         {pre_hooks, [
             {compile, "make -C \"${REBAR_ROOT_DIR}\" setup-genesis-wasm"}
+        ]},
+        {relx, [
+            {overlay, [
+                {copy,
+                    "_build/genesis_wasm/genesis-wasm-server",
+                    "genesis-wasm-server"
+                }
+            ]}
         ]}
     ]},
     {rocksdb, [
@@ -33,10 +59,13 @@
 ]}.
 
 {cargo_opts, [
-    {src_dir, "native/dev_snp_nif"}
+    {src_dir, "native/dev_snp_nif"},
+    {src_dir, "deps/elmdb/native/elmdb_nif"}
 ]}.
 
-{overrides, []}.
+{overrides, [
+    {override, gun, [{deps, [cowlib]}]}
+]}.
 
 {pre_hooks, [
     {compile, "bash -c \"echo '-define(HB_BUILD_SOURCE, <<\\\"$(git rev-parse HEAD)\\\">>).\n' > ${REBAR_ROOT_DIR}/_build/hb_buildinfo.hrl\""},
@@ -58,7 +87,8 @@
     { compile, "rm -f native/hb_beamr/*.o native/hb_beamr/*.d"},
     { compile, "rm -f native/hb_keccak/*.o native/hb_keccak/*.d"},
     { compile, "mkdir -p priv/html"},
-    { compile, "cp -R src/html/* priv/html"}
+    { compile, "cp -R src/html/* priv/html"},
+    { compile, "cp _build/default/lib/elmdb/priv/crates/elmdb_nif/elmdb_nif.so _build/default/lib/elmdb/priv/elmdb_nif.so 2>/dev/null || true" }
 ]}.
 
 {provider_hooks, [
@@ -87,12 +117,16 @@
 ]}.
 
 {deps, [
+    {elmdb, { git, "https://github.com/twilson63/elmdb-rs.git", {branch, "feat/match" }}},
 	{b64fast, {git, "https://github.com/ArweaveTeam/b64fast.git", {ref, "58f0502e49bf73b29d95c6d02460d1fb8d2a5273"}}},
-	{cowboy, {git, "https://github.com/ninenines/cowboy", {ref, "022013b6c4e967957c7e0e7e7cdefa107fc48741"}}},
-	{gun, {git, "https://github.com/ninenines/gun", {ref, "8efcedd3a089e6ab5317e4310fed424a4ee130f8"}}},
-	{prometheus, "4.11.0"},
-	{prometheus_cowboy, "0.1.8"},
-    {gun, "0.10.0"},
+    {cowlib, "2.16.0"},
+	{cowboy, "2.14.0"},
+    {ranch, "2.2.0"},
+    {gun, "2.2.0"},
+    {prometheus_cowboy, "0.2.0"},
+    {prometheus_httpd,  "2.1.15"},
+    {prometheus,        "6.0.3"},
+	{graphql, "0.17.1", {pkg, graphql_erl}},
     {luerl, "1.3.0"}
 ]}.
 
@@ -104,10 +138,11 @@
 	{apps, [hb]}
 ]}.
 
-{eunit_opts, [verbose]}.
+% Increase `scale_timeouts` when running on a slower machine.
+{eunit_opts, [verbose, {scale_timeouts, 10}]}.
 
 {relx, [
-	{release, {'hb', "0.0.1"}, [hb, b64fast, cowboy, gun, luerl, prometheus, prometheus_cowboy]},
+	{release, {'hb', "0.0.1"}, [hb, b64fast, cowboy, gun, luerl, prometheus, prometheus_cowboy, elmdb]},
 	{include_erts, true},
 	{extended_start_script, true},
 	{overlay, [
@@ -133,6 +168,11 @@
         [
             {eunit, "--module dev_lua_test"}
         ]
+    },
+    {'deploy-scripts',
+        [
+            {shell, "--eval hb:deploy_scripts()."}
+        ]
     }
 ]}.
 
@@ -143,4 +183,4 @@
 	{preprocess, true},
 	{private, true},
 	{hidden, true}
-]}.
\ No newline at end of file
+]}.
diff --git a/rebar.lock b/rebar.lock
index a6c3e3287..abe0deb60 100644
--- a/rebar.lock
+++ b/rebar.lock
@@ -1,43 +1,46 @@
 {"1.2.0",
-[{<<"accept">>,{pkg,<<"accept">>,<<"0.3.5">>},2},
+[{<<"accept">>,{pkg,<<"accept">>,<<"0.3.7">>},1},
  {<<"b64fast">>,
   {git,"https://github.com/ArweaveTeam/b64fast.git",
        {ref,"58f0502e49bf73b29d95c6d02460d1fb8d2a5273"}},
   0},
- {<<"cowboy">>,
-  {git,"https://github.com/ninenines/cowboy",
-       {ref,"022013b6c4e967957c7e0e7e7cdefa107fc48741"}},
-  0},
- {<<"cowlib">>,
-  {git,"https://github.com/ninenines/cowlib",
-       {ref,"1c3d5defba28e92a88ce45c440d57e178ab1c514"}},
-  1},
- {<<"gun">>,
-  {git,"https://github.com/ninenines/gun",
-       {ref,"8efcedd3a089e6ab5317e4310fed424a4ee130f8"}},
+ {<<"cowboy">>,{pkg,<<"cowboy">>,<<"2.14.0">>},0},
+ {<<"cowlib">>,{pkg,<<"cowlib">>,<<"2.16.0">>},0},
+ {<<"ddskerl">>,{pkg,<<"ddskerl">>,<<"0.4.2">>},1},
+ {<<"elmdb">>,
+  {git,"https://github.com/twilson63/elmdb-rs.git",
+       {ref,"90c8857cd4ccff341fbe415b96bc5703d17ff7f0"}},
   0},
+ {<<"graphql">>,{pkg,<<"graphql_erl">>,<<"0.17.1">>},0},
+ {<<"gun">>,{pkg,<<"gun">>,<<"2.2.0">>},0},
  {<<"luerl">>,{pkg,<<"luerl">>,<<"1.3.0">>},0},
- {<<"prometheus">>,{pkg,<<"prometheus">>,<<"4.11.0">>},0},
- {<<"prometheus_cowboy">>,{pkg,<<"prometheus_cowboy">>,<<"0.1.8">>},0},
- {<<"prometheus_httpd">>,{pkg,<<"prometheus_httpd">>,<<"2.1.11">>},1},
- {<<"quantile_estimator">>,{pkg,<<"quantile_estimator">>,<<"0.2.1">>},1},
- {<<"ranch">>,
-  {git,"https://github.com/ninenines/ranch",
-       {ref,"a692f44567034dacf5efcaa24a24183788594eb7"}},
-  1}]}.
+ {<<"prometheus">>,{pkg,<<"prometheus">>,<<"6.0.3">>},0},
+ {<<"prometheus_cowboy">>,{pkg,<<"prometheus_cowboy">>,<<"0.2.0">>},0},
+ {<<"prometheus_httpd">>,{pkg,<<"prometheus_httpd">>,<<"2.1.15">>},0},
+ {<<"ranch">>,{pkg,<<"ranch">>,<<"2.2.0">>},0}]}.
 [
 {pkg_hash,[
- {<<"accept">>, <<"B33B127ABCA7CC948BBE6CAA4C263369ABF1347CFA9D8E699C6D214660F10CD1">>},
+ {<<"accept">>, <<"CD6E34A2D7E28CA38B2D3CB233734CA0C221EFBC1F171F91FEC5F162CC2D18DA">>},
+ {<<"cowboy">>, <<"565DCF221BA99B1255B0ADCEC24D2D8DBE79E46EC79F30F8373CCEADC6A41E2A">>},
+ {<<"cowlib">>, <<"54592074EBBBB92EE4746C8A8846E5605052F29309D3A873468D76CDF932076F">>},
+ {<<"ddskerl">>, <<"A51A90BE9AC9B36A94017670BED479C623B10CA9D4BDA1EDF3A0E48CAEEADA2A">>},
+ {<<"graphql">>, <<"EB59FCBB39F667DC1C78C950426278015C3423F7A6ED2A121D3DB8B1D2C5F8B4">>},
+ {<<"gun">>, <<"B8F6B7D417E277D4C2B0DC3C07DFDF892447B087F1CC1CAFF9C0F556B884E33D">>},
  {<<"luerl">>, <<"B56423DDB721432AB980B818FEECB84ADBAB115E2E11522CF94BCD0729CAA501">>},
- {<<"prometheus">>, <<"B95F8DE8530F541BD95951E18E355A840003672E5EDA4788C5FA6183406BA29A">>},
- {<<"prometheus_cowboy">>, <<"CFCE0BC7B668C5096639084FCD873826E6220EA714BF60A716F5BD080EF2A99C">>},
- {<<"prometheus_httpd">>, <<"F616ED9B85B536B195D94104063025A91F904A4CFC20255363F49A197D96C896">>},
- {<<"quantile_estimator">>, <<"EF50A361F11B5F26B5F16D0696E46A9E4661756492C981F7B2229EF42FF1CD15">>}]},
+ {<<"prometheus">>, <<"95302236124C0F919163A7762BF7D2B171B919B6FF6148D26EB38A5D2DEF7B81">>},
+ {<<"prometheus_cowboy">>, <<"526F75D9850A9125496F78BCEECCA0F237BC7B403C976D44508543AE5967DAD9">>},
+ {<<"prometheus_httpd">>, <<"8F767D819A5D36275EAB9264AFF40D87279151646776069BF69FBDBBD562BD75">>},
+ {<<"ranch">>, <<"25528F82BC8D7C6152C57666CA99EC716510FE0925CB188172F41CE93117B1B0">>}]},
 {pkg_hash_ext,[
- {<<"accept">>, <<"11B18C220BCC2EAB63B5470C038EF10EB6783BCB1FCDB11AA4137DEFA5AC1BB8">>},
+ {<<"accept">>, <<"CA69388943F5DAD2E7232A5478F16086E3C872F48E32B88B378E1885A59F5649">>},
+ {<<"cowboy">>, <<"EA99769574550FE8A83225C752E8A62780A586770EF408816B82B6FE6D46476B">>},
+ {<<"cowlib">>, <<"7F478D80D66B747344F0EA7708C187645CFCC08B11AA424632F78E25BF05DB51">>},
+ {<<"ddskerl">>, <<"63F907373D7E548151D584D4DA8A38928FD26EC9477B94C0FFAAD87D7CB69FE7">>},
+ {<<"graphql">>, <<"4D0F08EC57EF0983E2596763900872B1AB7E94F8EE3817B9F67EEC911FF7C386">>},
+ {<<"gun">>, <<"76022700C64287FEB4DF93A1795CFF6741B83FB37415C40C34C38D2A4645261A">>},
  {<<"luerl">>, <<"6B3138AA829F0FBC4CD0F083F273B4030A2B6CE99155194A6DB8C67B2C3480A4">>},
- {<<"prometheus">>, <<"719862351AABF4DF7079B05DC085D2BBCBE3AC0AC3009E956671B1D5AB88247D">>},
- {<<"prometheus_cowboy">>, <<"BA286BECA9302618418892D37BCD5DC669A6CC001F4EB6D6AF85FF81F3F4F34C">>},
- {<<"prometheus_httpd">>, <<"0BBE831452CFDF9588538EB2F570B26F30C348ADAE5E95A7D87F35A5910BCF92">>},
- {<<"quantile_estimator">>, <<"282A8A323CA2A845C9E6F787D166348F776C1D4A41EDE63046D72D422E3DA946">>}]}
+ {<<"prometheus">>, <<"53554ECADAC0354066801D514D1A244DD026175E4EE3A9A30192B71D530C8268">>},
+ {<<"prometheus_cowboy">>, <<"2C7EB12F4B970D91E3B47BAAD0F138F6ADC34E53EEB0AE18068FF0AFAB441B24">>},
+ {<<"prometheus_httpd">>, <<"67736D000745184D5013C58A63E947821AB90CB9320BC2E6AE5D3061C6FFE039">>},
+ {<<"ranch">>, <<"FA0B99A1780C80218A4197A59EA8D3BDAE32FBFF7E88527D7D8A4787EFF4F8E7">>}]}
 ].
diff --git a/scripts/dynamic-router.lua b/scripts/dynamic-router.lua
index 4e0ca921b..a3766094b 100644
--- a/scripts/dynamic-router.lua
+++ b/scripts/dynamic-router.lua
@@ -1,7 +1,7 @@
 --- A dynamic route generator in an AO `~process@1.0'.
 --- This generator grants a routing table, found at `/now/routes', that is 
 --- compatible with the `~router@1.0' interface. Subsequently, it can be
---- used for routing by HyperBEAM nodes' via setting the `route-provider'
+--- used for routing by HyperBEAM nodes' via setting the `router@1.0/provider'
 --- node message key.
 --- 
 --- The configuration options are as follows:
@@ -27,7 +27,7 @@ local function ensure_defaults(state)
     state.routes = state.routes or {}
     state["is-admissible"] =
         state["is-admissible"] or {
-			path = "/default",
+			path = "default",
             default = "true"
         }
     state["sampling-rate"] = state["sampling-rate"] or 0.1
@@ -203,11 +203,25 @@ end
 -- Register a new host to a route.
 function register(state, assignment, opts)
     state = ensure_defaults(state)
+    ao.event({"register", { state = state, assignment = assignment, opts = opts }})
     local req = assignment.body
+
+    -- If the message is signed by an explicitly trusted peer, we can skip the
+    -- is-admissible check.
+    if state["trusted-peer"] then
+        local committers = ao.get("committers", req)
+        for _, committer in ipairs(committers) do
+            if committer == state["trusted-peer"] then
+                state = add_node(state, req)
+                return recalculate(state, assignment, opts)
+            end
+        end
+    end
+
     req.path = state["is-admissible"].path or "is-admissible"
     local status, is_admissible = ao.resolve(state["is-admissible"], req)
 
-    ao.event("is-admissible result:", { status, is_admissible })
+    ao.event({"is-admissible result:", { status, is_admissible }})
     if status == "ok" and is_admissible == "true" then
         state = add_node(state, req)
         return recalculate(state, assignment, opts)
@@ -270,11 +284,11 @@ function duration(state, assignment, opts)
 end
 
 function compute(state, assignment, opts)
-    if assignment.body.path == "register" then
+    if assignment.body.action == "register" then
         return register(state, assignment, opts)
-    elseif assignment.body.path == "recalculate" then
+    elseif assignment.body.action == "recalculate" then
         return recalculate(state, assignment, opts)
-    elseif assignment.body.path == "performance" then
+    elseif assignment.body.action == "performance" then
         return duration(state, assignment, opts)
     else
         -- If we have been called without a relevant path, simply ensure that
@@ -377,7 +391,7 @@ function performance_test()
     -- Record the starting scores for the nodes
     local t0_node1_score = state.routes[1].nodes[1].weight
     local t0_node2_score = state.routes[1].nodes[1].weight
-  
+
     if t0_node1_score ~= t0_node2_score then
         error("Initial node scores should be equal. Received: "
             .. tostring(t0_node1_score) .. " and " .. tostring(t0_node2_score))
@@ -403,7 +417,7 @@ function performance_test()
             state = state
         }}
     )
-  
+
     -- now trigger a recalc
     _, state = recalculate(state, { body = { path = "recalculate" } }, {})
 
@@ -429,6 +443,6 @@ function performance_test()
     if t1_node2_score >= t0_node2_score then
         error("Node 2 score should have decreased!")
     end
-    
+
     return "ok"
 end
\ No newline at end of file
diff --git a/scripts/hyper-token-p4-client.lua b/scripts/hyper-token-p4-client.lua
new file mode 100644
index 000000000..d6a14ce9e
--- /dev/null
+++ b/scripts/hyper-token-p4-client.lua
@@ -0,0 +1,41 @@
+--- A simple script that can be used as a `~p4@1.0` ledger device, marshalling
+--- requests to a local process.
+
+-- Find the user's balance in the current ledger state.
+function balance(base, request)
+    local status, res = ao.resolve({
+        path =
+            base["ledger-path"]
+            .. "/now/balance/"
+            .. request["target"]
+    })
+    ao.event({ "client received balance response", 
+        { status = status, res = res, target = request["target"] } }
+    )
+    -- If the balance request fails (most likely because the user has no balance),
+    -- return a balance of 0.
+    if status ~= "ok" then
+        return "ok", 0
+    end
+
+    -- We have successfully retrieved the balance, so return it.
+    return "ok", res
+end
+
+-- Charge the user's balance in the current ledger state.
+function charge(base, request)
+    ao.event("debug_charge", {
+        "client starting charge",
+        { request = request, base = base }
+    })
+    local status, res = ao.resolve({
+        path = "(" .. base["ledger-path"] .. ")/push",
+        method = "POST",
+        body = request
+    })
+    ao.event("debug_charge", {
+        "client received charge response",
+        { status = status, res = res }
+    })
+    return "ok", res
+end
\ No newline at end of file
diff --git a/scripts/hyper-token-p4.lua b/scripts/hyper-token-p4.lua
new file mode 100644
index 000000000..ef7e323f0
--- /dev/null
+++ b/scripts/hyper-token-p4.lua
@@ -0,0 +1,61 @@
+--- An extension to the `hyper-token.lua` script, for execution with the
+--- `lua@5.3a` device. This script adds the ability for an `admin' account to
+--- charge a user's account. This is useful for allowing a node operator to
+--- collect fees from users, if they are running in a trusted execution
+--- environment.
+--- 
+--- This script must be added as after the `hyper-token.lua` script in the
+--- `process-definition`s `script` field.
+
+-- Process an `admin' charge request:
+-- 1. Verify the sender's identity.
+-- 2. Ensure that the quantity and account are present in the request.
+-- 3. Debit the source account.
+-- 4. Increment the balance of the recipient account.
+function charge(base, assignment)
+    ao.event("debug_charge", { "Charge received: ", { assignment = assignment } })
+    local admin = base.admin
+    local status, res, request = validate_request(base, assignment)
+    if status ~= "ok" then
+        return status, res
+    end
+
+    -- Verify that the request is signed by the admin.
+    local committers = ao.get("committers", {"as", "message@1.0", assignment.body})
+    ao.event("debug_charge", { "Validating request: ", {
+        committers = committers,
+        admin = admin
+    } })
+    if count_common(committers, admin) ~= 1 then
+        return "error", base
+    end
+
+    -- Ensure that the quantity and account are present in the request.
+    if not request.quantity or not request.account then
+        ao.event({ "Failure: Quantity or account not found in request.",
+            { request = request } })
+        base.result = {
+            status = "error",
+            error = "Quantity or account not found in request."
+        }
+        return "ok", base
+    end
+
+    -- Debit the source. Note: We do not check the source balance here, because
+    -- the node is capable of debiting the source at-will -- even it puts the
+    -- source into debt. This is important because the node may estimate the
+    -- cost of an execution at lower than its actual cost. Subsequently, the
+    -- ledger should at least debit the source, even if the source may not
+    -- deposit to restore this balance.
+    ao.event({ "Debit request validated: ", { assignment = assignment } })
+    base.balance = base.balance or {}
+    base.balance[request.account] =
+        (base.balance[request.account] or 0) - request.quantity
+
+    -- Increment the balance of the recipient account.
+    base.balance[request.recipient] =
+        (base.balance[request.recipient] or 0) + request.quantity
+
+    ao.event("debug_charge", { "Charge processed: ", { balances = base.balance } })
+    return "ok", base
+end
diff --git a/scripts/hyper-token.lua b/scripts/hyper-token.lua
new file mode 100644
index 000000000..016d9713e
--- /dev/null
+++ b/scripts/hyper-token.lua
@@ -0,0 +1,891 @@
+--- ## HyperTokens: Networks of fungible, parallel ledgers.
+--- # Version: 0.1.
+--- 
+--- An AO token standard implementation, with support for sub-ledger networks,
+--- executed with the `~lua@5.3` device. This script supports both the base token
+--- blueprint's 'active' keys, as well as the mainnet sub-ledger API.
+--- 
+--- Data access actions (e.g. `balance', `info', `total-supply') are not
+--- implemented due to their redundancy. Instead, the full state of the process
+--- is available via the AO-Core HTTP API, including all metadata and individual
+--- account balances.
+--- 
+--- A full description of the hyper-token standard can be found in the
+--- `token.md` file in this directory. The remainder of this module document
+--- provides a breif overview of its design, and focuses on its implementation
+--- details.
+--- 
+--- ## Design and Implementation
+--- 
+--- If running as a `root' token (indicated by the absence of a `token' field),
+--- the `balance' field should be initialized to a table of balances for the
+--- token during spawning. The `ledgers' field holds the state of a sub-ledger's
+--- own balances with other ledgers. This field is always initialized to a message
+--- of zero balances during the evaluation of the first assignment of the process.
+--- When the token receives a `credit-notice' message, it will interpret it as a
+--- deposit from the sending ledger and update its record of its own balance with
+--- the sending ledger.
+--- 
+--- Atop the standard token transfer messages, the sub-ledger API allows for
+--- `transfer' messages to specify a `route' field, which is a list of ledger
+--- IDs that the transfer should be routed through in order to reach a
+--- recipient on a different ledger. At each `hop' in the route, the recipient
+--- ledger validates whether it trusts the sending ledger and whether it knows
+--- how to route to the next hop. If the recipient ledger does not trust the
+--- sending ledger, it will terminate the route with a `route-termination'
+--- message. If the recipient ledger knows how to route to the next hop, it
+--- will create a new `transfer' message to the next hop, with the first
+--- ledger from the route removed and the remainder of the route and recipient
+--- and quantity to transfer forwarded along with the message.
+--- 
+--- There are three security checks performed on incoming messages, above the
+--- standard balance transfer checks:
+--- 
+--- 1. Assignments are evaluated against the `assess/assignment' message, if
+---    present. If not, the assignment is evaluated against the process's own
+---    scheduler address.
+--- 
+--- 2. If the message does not originate from an end-user (indicated by the 
+---    presence of a `from-process' field), the message is evaluated against
+---    the `assess/request' message, if present. If not, the message is 
+---    evaluated against the `authority' field. The `authority' field may 
+---    contain a list of addresses or messages that are considered to be
+---    authorities.
+--- 
+--- 3. `credit-notice' messages that do not originate from a sub-ledger's
+---    `token' are evaluated for parity of source code with the receiving
+---     ledger. This is achieved by comparing the `from-base' field of the
+---     credit-notice message with `process/id&commitments=none' on the receiving
+---     ledger.
+
+--- Utility functions:
+
+-- Add a message to the outbox of the given base.
+local function send(base, message)
+    table.insert(base.results.outbox, message)
+    return base
+end
+
+-- Add a log message to the results of the given base.
+local function log_result(base, status, message)
+    ao.event("token_log", {"Token action log: ", {
+        status = status,
+        message = message
+    }})
+    base.results = base.results or {}
+    base.results.status = status
+    
+    if base.results.log then
+        table.insert(base.results.log, message)
+    else
+        base.results.log = { message }
+    end
+
+    return base
+end
+
+-- Normalize a quantity value to ensure it is a proper integer.
+-- Returns either the normalized integer value or nil and an error message.
+local function normalize_int(value)
+    local num
+    -- Handle string conversion
+    if type(value) == "string" then
+        -- Check for decimal part (not allowed)
+        if string.find(value, "%.") then
+            return nil
+        end
+        -- Convert to number
+        num = tonumber(value)
+        if not num then
+            return nil
+        end
+    elseif type(value) == "number" then
+        num = value
+        -- Check if it's an integer
+        if num ~= math.floor(num) then
+            return nil
+        end
+    else
+        -- Any other type is invalid.
+        return nil
+    end
+    
+    return num
+end
+
+-- Count the number of elements in `a' that are also in `b'.
+function count_common(a, b)
+    -- Normalize both arguments to tables.
+    if type(a) ~= "table" then a = { a } end
+    if type(b) ~= "table" then b = { b } end
+
+    local count = 0
+    for _, v in ipairs(a) do
+        for _, w in ipairs(b) do
+            if v == w then
+                count = count + 1
+            end
+        end
+    end
+
+    return count
+end
+
+-- Normalize an argument to a table if it is not already a table.
+local function normalize_table(value)
+    -- If value is already a table, return it. If it is not a string, return
+    -- a table containing only the value.
+    if type(value) == "table" then
+        ao.event({ "Table already normalized", { table = value } })
+        return value
+    elseif type(value) ~= "string" then
+        return { value }
+    end
+
+    -- If value is a string, remove quotes and split by comma.
+    local t = {}
+    local pos = 1
+    local len = #value
+    while pos <= len do
+        -- find next comma
+        local comma_start, comma_end = value:find(",", pos, true)
+        local chunk
+        if comma_start then
+            chunk = value:sub(pos, comma_start - 1)
+            pos = comma_end + 1
+        else
+            chunk = value:sub(pos)
+            pos = len + 1
+        end
+
+        -- trim whitespace and quotes
+        chunk = chunk:gsub("[\"']", "")
+        local trimmed = chunk:match("^%s*(.-)%s*$")
+        -- convert to number if possible
+        local num = tonumber(trimmed)
+        table.insert(t, num or trimmed)
+    end
+
+    ao.event({ "Normalized table", { table = t } })
+    return t
+end
+
+--- Security verification functions:
+
+-- Enforce that a given list satisfies `hyper-token's grammar constraints.
+-- This function is used to check that the `authority' and `scheduler' fields
+-- satisfy the constraints specified by the `authority[-*]' and `scheduler[-*]'
+-- fields. The supported grammar constraints are:
+-- - `X`: A list of `X`s that are admissible to match in the subject.
+-- - `X-match`: A count of the number of `X`s that must be present in the subject.
+--              Default: Length of `X`.
+-- - `X-required`: A list of `X`s that must be present in the subject.
+--                 Default: `{}`.
+local function satisfies_list_constraints(subject, all, required, match)
+    -- Normalize the fields to tables, aside from the match count.
+    subject = normalize_table(subject)
+    all = normalize_table(all)
+    required = normalize_table(required or {})
+    -- Normalize the match count.
+    match = match or #all
+    match = normalize_int(match)
+
+    ao.event({ "Satisfies list constraints", {
+        subject = subject,
+        all = all,
+        match = match
+    }})
+
+    -- Check that the subject satisfies the grammar's constraints.
+    -- 1. The subject must have at least `match' elements in common with `all'.
+    -- 2. The subject must contain all elements in `required'.
+    local count = count_common(subject, all)
+    local required_count = count_common(required, subject)
+
+    ao.event({ "Counts", {
+        subject = subject,
+        all = all,
+        required = required,
+        match = match,
+        count = count,
+        required_count = required_count
+    }})
+
+    return (count >= match) and (required_count == #required)
+end
+
+-- Ensure that a message satisfies the grammar's constraints, or the assessment
+-- message returns true, if present.
+local function satisfies_constraints(message, assess, all, required, match)
+    -- If the assessment message is present, run it against the message.
+    if assess then
+        ao.event({ "Running assessment message against request." },
+            { assessment = assess, message = message })
+        local status, result = ao.resolve(assess, message)
+        if (status == "ok") and (result == true) then
+            ao.event({ "Assessment of request passed." }, {
+                message = message,
+                status = status,
+                result = result
+            })
+            return true
+        else
+            ao.event({ "Assessment of request failed.", {
+                message = message,
+                status = status,
+                result = result
+            }})
+            return false
+        end
+    end
+
+    -- If the assessment message is not present, check the signatures against
+    -- the requirements list and specifiers.
+    local satisfies_auth = satisfies_list_constraints(
+        ao.get("committers", message),
+        all,
+        required,
+        match
+    )
+
+    ao.event({ "Constraint satisfaction results", {
+        result = satisfies_auth,
+        message = message,
+        all_admissible = all,
+        required = required,
+        required_count = match
+    }})
+
+    return satisfies_auth
+end
+
+-- Ensure that the `authority' field satisfies the `authority[-*]' constraints
+-- (as supported by `satisfies_constraints') or that the assessment message
+-- returns true.
+local function is_trusted_compute(base, assignment)
+    return satisfies_constraints(
+        assignment.body,
+        (base.assess or {})["authority"],
+        base.authority,
+        base["authority-required"],
+        base["authority-match"]
+    )
+end
+
+-- Ensure that the assignment is trusted. Either by running the assessment
+-- process, or by checking the signature against the process's own scheduler
+-- address and those it explicitly trusts.
+local function is_trusted_assignment(base, assignment)
+    return satisfies_constraints(
+        assignment,
+        (base.assess or {})["scheduler"],
+        base.scheduler,
+        base["scheduler-required"],
+        base["scheduler-match"]
+    )
+end
+
+-- Determine if the ledger indicated by `base` is the root ledger.
+local function is_root(base)
+    return base.token == nil
+end
+
+-- Ensure that a credit-notice from another ledger is admissible. It must either
+-- be from our own root ledger, or from a sub-ledger that is precisely the same
+-- as our own.
+local function validate_new_peer_ledger(base, request)
+    ao.event({ "Validating peer ledger: ", { request = request } })
+
+    -- Check if the request is from the root ledger.
+    if is_root(base) or (base.token == request.from) then
+        ao.event({ "Peer is parent token. Accepting." }, {
+            request = request
+        })
+        return true
+    end
+
+    -- Calculate the expected base ID from the process's own `process` message,
+    -- modified to remove the `authority' and `scheduler' fields.
+    -- This ensures that the process we are receiving the `credit-notice` from
+    -- has the same structure as our own process.
+    ao.event({ "Calculating expected `base` from self", { base = base } })
+    local status, proc, expected
+    status, proc = ao.resolve({"as", "message@1.0", base}, "process")
+    -- Reset the `authority' and `scheduler' fields to nil, to ensure that the
+    -- `base` message matches the structure created by `~push@1.0`.
+    proc.authority = nil
+    proc.scheduler = nil
+    status, expected =
+        ao.resolve(
+            proc,
+            { path = "id", commitments = "none" }
+        )
+    ao.event({ "Expected `from-base`", { status = status, expected = expected } })
+    -- Check if the `from-base' field is present in the assignment.
+    if not request["from-base"] then
+        ao.event({ "`from-base` field not found in message", {
+            request = request
+        }})
+        return false
+    end
+
+    -- Check if the `from-base' field matches the expected ID.
+    local base_matches = request["from-base"] == expected
+
+    if not base_matches then
+        ao.event("debug_base", { "Peer registration messages do not match", {
+            expected_base = expected,
+            received_base = request["from-base"],
+            process = proc,
+            request = request
+        }})
+        return false
+    end
+
+    -- Check that the `from-authority' and `from-scheduler' fields match the
+    -- expected values, to the degree specified by the `authority-match' and
+    -- `scheduler-match' fields. Additionally, the `authority-required' and
+    -- `scheduler-required' fields may be present in the base, the members of
+    -- which must be present in the `from-authority' and `from-scheduler' fields
+    -- respectively.
+    local authority_matches = satisfies_list_constraints(
+        request["from-authority"],
+        base.authority,
+        base["authority-required"],
+        base["authority-match"]
+    )
+    local scheduler_matches = satisfies_list_constraints(
+        request["from-scheduler"],
+        base.scheduler,
+        base["scheduler-required"],
+        base["scheduler-match"]
+    )
+    if (not authority_matches) or (not scheduler_matches) then
+        ao.event("debug_base", { "Peer security parameters do not match", {
+            expected_authority = base.authority,
+            received_authority = request["from-authority"],
+            expected_scheduler = base.scheduler,
+            received_scheduler = request["from-scheduler"],
+            scheduler_matches = scheduler_matches,
+            authority_matches = authority_matches,
+            request = request
+        }})
+        return false
+    end
+
+    ao.event("Peer registration messages matches. Accepting.")
+
+    return true
+end
+
+-- Register a new peer ledger, if the `from-base' field matches our own.
+local function register_peer(base, request)
+    -- Validate the registering ledger
+    if not validate_new_peer_ledger(base, request) then
+        base.results = {
+            status = "error",
+            error = "Ledger registration failed."
+        }
+        return "error", base
+    end
+    
+    -- Add to known ledgers
+    base.ledgers[request.from] = base.ledgers[request.from] or 0
+
+    return "ok", base
+end
+
+-- Determine if a request is from a known ledger. Makes no assessment of whether
+-- a request is otherwise trustworthy.
+local function is_from_trusted_ledger(base, request)
+    -- We always trust the root ledger.
+    if request.from == base["token"] then
+        return true, base
+    end
+
+    -- We trust any ledger that is already registered in the `ledgers' map.
+    if base.ledgers and (base.ledgers[request.from] ~= nil) then
+        return true, base
+    end
+
+    -- Validate whether the request is from a new peer ledger.
+    local status
+    status, base = register_peer(base, request)
+    if status ~= "ok" then
+        return false, base
+    end
+
+    return true, base
+end
+
+-- Ensure that the ledger is initialized.
+local function ensure_initialized(base, assignment)
+    -- Ensure that the base has a `result' field before we try to register.
+    base.results = base.results or {}
+    base.results.outbox = {}
+    base.results.status = "OK"
+    -- If the ledger is not being initialized, we can skip the rest of the
+    -- function.
+    if assignment.slot ~= 0 then
+        return "ok", base
+    end
+    base.balance = base.balance or {}
+
+    -- Ensure that the `ledgers' map is initialized: present and empty.
+    base.ledgers = base.ledgers or {}
+    ao.event({ "Ledgers before initialization: ", base.ledgers })
+
+    for _, ledger in ipairs(base.ledgers) do
+        base.ledgers[ledger] = 0
+    end
+    ao.event({ "Ledgers after initialization: ", base.ledgers })
+
+    if not base.token then
+        ao.event({ "Ledger has no source token. Skipping registration." })
+        return "ok", base
+    end
+
+    ao.event({ "Registering self with known token ledgers: ", {
+        ledgers = base.ledgers
+    }})
+
+    for _, ledger in ipairs(base.ledgers) do
+        -- Insert the register result into the base.
+        base.results = send(base, {
+            action = "Register",
+            target = ledger
+        })
+    end
+
+    return "ok", base
+end
+
+-- Verify that an assignment has not been processed and that the request is
+-- valid. If it is, update the `from' field to the address that signed the
+-- request.
+function validate_request(incoming_base, assignment)
+    -- Ensure that the ledger is initialized.
+    local status, base = ensure_initialized(incoming_base, assignment)
+    if status ~= "ok" then
+        return "error", log_result(incoming_base, "error", {
+            message = "Ledger initialization failed.",
+            assignment = assignment,
+            status = status,
+        })
+    end
+
+    -- First, ensure that the message has not already been processed.
+    ao.event("Deduplicating message.", {
+        ["history-length"] = #(base.dedup or {})
+    })
+
+    status, base =
+        ao.resolve(
+            incoming_base,
+            {"as",
+                "dedup@1.0",
+                {
+                    path = "compute",
+                    ["subject-key"] = "body",
+                    body = assignment.body
+                }
+            }
+        )
+
+    -- Set the device back to `process@1.0`.
+    base.device = "process@1.0"
+    if status ~= "ok" then
+        return "error", log_result(base, "error", {
+            message = "Deduplication failure.",
+            assignment = assignment,
+            status = status,
+            incoming_base = incoming_base,
+            resulting_base = base
+        })
+    end
+
+    -- Next, ensure that the assignment is trusted.
+    local trusted, details = is_trusted_assignment(base, assignment)
+    if not trusted then
+        return "error", log_result(base, "error", {
+            message = "Assignment is not trusted.",
+            details = details
+        })
+    end
+
+    if assignment.body["from-process"] then
+        -- If the request is proxied, we need to check that the source
+        -- computation is trusted.
+        trusted, details = is_trusted_compute(base, assignment)
+        if not trusted then
+            return "error", log_result(base, "error", {
+                message = "Message computation is not trusted.",
+                details = details
+            })
+        end
+        assignment.body.from = assignment.body["from-process"]
+        return "ok", base, assignment.body
+    else
+        -- If the request is not proxied, we set the `from' field to the address
+        -- that signed the request.
+        local committers = ao.get("committers", assignment.body)
+        if #committers == 0 then
+            return "error", log_result(base, "error", {
+                message = "No request signers found."
+            })
+        end
+        
+        -- Only accept single-signed requests to avoid ambiguity
+        if #committers > 1 then
+            return "error", log_result(base, "error", {
+                message = "Multiple signers detected, making sender ambiguous. " ..
+                    "Only singly-signed requests are supported for end-user " ..
+                    "requests (those that do not originate from another " ..
+                    "computation)."
+            })
+        end
+        
+        assignment.body.from = committers[1]
+        return "ok", base, assignment.body
+    end
+end
+
+-- Ensure that the source has the required funds, then debit the source. Takes
+-- an origin, which can be used to identify the reason for the debit in logging.
+-- Returns error if the source balance is not viable, or `ok` and the updated
+-- base state if the debit is successful. Does not credit any funds.
+local function debit_balance(base, request)
+    local source = request.from
+
+    ao.event({ "Attempting to deduct balance.", {
+        request = request,
+        balances = base.balance or {}
+    }})
+
+    -- Ensure that the `source' and `quantity' fields are present in the request.
+    if not source or not request.quantity then
+        return "error", log_result(base, "error", {
+            message = "Fund source or quantity not found in request.",
+        })
+    end
+
+    -- Normalize the quantity value.
+    request.quantity = normalize_int(request.quantity)
+    if not request.quantity then
+        ao.event({ "Invalid quantity value: ", { quantity = request.quantity } })
+        base.results = {
+            status = "error",
+            error = "Invalid quantity value.",
+            quantity = request.quantity
+        }
+        return "error", base
+    end
+
+    -- Ensure that the source has the required funds.
+    -- Check 1: The source balance is present in the ledger.
+    local source_balance = base.balance[source]
+
+    if not source_balance then
+        return "error", log_result(base, "error", {
+            message = "Source balance not found.",
+            from = source,
+            quantity = request.quantity,
+            ["is-root"] = is_root(base)
+        })
+    end
+
+    -- Check 2: The source balance is a valid number.
+    if type(source_balance) ~= "number" then
+        return "error", log_result(base, "error", {
+            message = "Source balance is not a number.",
+            balance = source_balance
+        })
+    end
+
+    -- Check 3: Ensure that the quantity to deduct is a non-negative number.
+    if request.quantity < 0 then
+        return "error", log_result(base, "error", {
+            message = "Quantity to deduct is negative.",
+            quantity = request.quantity
+        })
+    end
+
+    -- Check 4: Ensure that the source has enough funds.
+    if source_balance < request.quantity then
+        return "error", log_result(base, "error", {
+            message = "Insufficient funds.",
+            from = source,
+            quantity = request.quantity,
+            balance = source_balance
+        })
+    end
+
+    ao.event({ "Deducting funds:", { request = request } })
+    base.balance[source] = source_balance - request.quantity
+    ao.event({ "Balances after deduction:",
+        { balances = base.balance, ledgers = base.ledgers } }
+    )
+    return "ok", base
+end
+
+-- Transfer the specified amount from the given account to the given account,
+-- optionally routing to a different sub-ledger if necessary.
+-- There are four differing types of transfer requests. They have the following
+-- semantics:
+-- Balance == owed to X. Credit == Owed to subject by X.
+
+-- User on root -> User on sub-ledger:
+-- Xfer in: Root = Dec User balance, Inc Sub-ledger balance
+-- C-N in: Sub-ledger = Inc User balance
+
+-- User on sub-ledgerA -> User on sub-ledgerB:
+-- Xfer in: Sub-ledgerA = Dec User balance
+-- C-N in: Sub-ledgerB = Inc User balance
+
+-- User on sub-ledgerB -> User on sub-ledgerA:
+-- Xfer in: Sub-ledgerB = Dec user balance
+-- C-N in: Sub-ledgerA = Inc user balance
+
+-- User on A->B->C:
+-- Xfer in: A = Dec User balance
+-- C-N in: B = 
+-- C-N in: C = Inc User balance
+
+-- User on sub-ledger -> User on root:
+-- Xfer in: Sub-ledger = Dec User balance
+-- C-N in: Root = Inc User balance, Dec Sub-ledger balance
+function transfer(base, assignment)
+    ao.event({ "Transfer request received", { assignment = assignment } })
+    -- Verify the security of the request.
+    local status, request
+    status, base, request = validate_request(base, assignment)
+    if status ~= "ok" or not request then
+        return "ok", base
+    end
+
+    -- Ensure that the recipient is known.
+    if not request.recipient then
+        return log_result(base, "error", {
+            message = "Transfer request has no recipient."
+        })
+    end
+
+    -- Normalize the quantity value.
+    local quantity = normalize_int(request.quantity)
+    if not quantity then
+        return log_result(base, "error", {
+            message = "Invalid quantity value.",
+            quantity = request.quantity
+        })
+    end
+
+    -- Ensure that the source has the required funds. If they do, debit them.
+    local debit_status
+    debit_status, base = debit_balance(base, request)
+    if debit_status ~= "ok" or base == nil then
+        return "ok", base
+    end
+
+    if is_root(base) or not request.route then
+        -- We are the root ledger, or the user is sending tokens directly to
+        -- another user. We credit the recipient's balance, or the sub-ledger's
+        -- balance if the request has a `route' key.
+        local direct_recipient = request.route or request.recipient
+        base.balance[direct_recipient] =
+            (base.balance[direct_recipient] or 0) + quantity
+        base = send(base, {
+            action = "Credit-Notice",
+            target = direct_recipient,
+            recipient = request.recipient,
+            quantity = quantity,
+            sender = request.from
+        })
+        return log_result(base, "ok", {
+            message = "Direct or root transfer processed successfully.",
+            from_user = request.from,
+            to = direct_recipient,
+            explicit_recipient = request.recipient,
+            quantity = quantity
+        })
+    end
+
+    if request.route == base.token then
+        -- The user is returning tokens to the root ledger, so we send a
+        -- transfer to the root ledger.
+        base = send(base, {
+            action = "Transfer",
+            target = base.token,
+            recipient = request.recipient,
+            quantity = string.format('%d', math.floor(request.quantity))
+        })
+        return log_result(base, "ok", {
+            message = "Ledger-root transfer processed successfully.",
+            from_user = request.from,
+            to_ledger = base.token,
+            to_user = request.recipient,
+            quantity = string.format('%d', math.floor(request.quantity))
+        })
+    end
+
+    -- We are not the root ledger, and the request has a `route` key.
+    -- Subsequently, the target must be another ledger so we dispatch a
+    -- credit-notice to the peer ledger. The peer will increment the balance of
+    -- the recipient.
+    base = send(base, {
+        action = "Credit-Notice",
+        target = request.route,
+        recipient = request.recipient,
+        quantity = quantity,
+        sender = request.from
+    })
+
+    return log_result(base, "ok", {
+        message = "Ledger-ledger transfer processed successfully.",
+        from_user = request.from,
+        to_ledger = request.route,
+        to_user = request.recipient,
+        quantity = quantity
+    })
+end
+
+-- Process credit notices from other ledgers.
+_G["credit-notice"] = function (base, assignment)
+    ao.event({ "Credit-Notice received", { assignment = assignment } })
+
+    -- Verify the security of the request.
+    local status, request
+    status, base, request = validate_request(base, assignment)
+    if status ~= "ok" or not request then
+        return "ok", base
+    end
+
+    if is_root(base) then
+        -- The root ledger will not process credit notices.
+        return log_result(base, "error", {
+            message = "Credit-Notice to root ledger ignored."
+        })
+    end
+
+    -- Ensure that the recipient is known.
+    if not request.recipient then
+        return log_result(base, "error", {
+            message = "Credit-Notice request has no recipient."
+        })
+    end
+
+    -- Normalize the quantity value.
+    local quantity = normalize_int(request.quantity)
+    if not quantity then
+        return log_result(base, "error", {
+            message = "Invalid quantity value.",
+            quantity = request.quantity
+        })
+    end
+
+    -- Ensure that the sender is a trusted ledger peer.
+    local trusted
+    trusted, base = is_from_trusted_ledger(base, request)
+    if not trusted then
+        return log_result(base, "error", {
+            message = "Credit-Notice not from a trusted peer ledger."
+        })
+    end
+
+    -- Credit the recipient's balance.
+    base.balance[request.recipient] =
+        (base.balance[request.recipient] or 0) + quantity
+    
+    return "ok", log_result(base, "ok", {
+        message = "Credit-Notice processed successfully.",
+        from_ledger = request.from,
+        to_ledger = request.sender,
+        to_user = request.recipient,
+        quantity = quantity,
+        balance = base.balance[request.recipient]
+    })
+end
+
+-- Process registration requests from other ledgers.
+function register(raw_base, assignment)
+    ao.event({ "Register request received", { assignment = assignment } })
+    
+    local status, base, request = validate_request(raw_base, assignment)
+    if (status ~= "ok") or (type(request) ~= "table") then
+        return "ok", base
+    end
+
+    if base.ledgers[request.from] then
+        ao.event({ "Ledger already registered. Ignoring registration request." })
+        base.results = {
+            message = "Ledger already registered."
+        }
+        return "ok", base
+    end
+
+    -- Validate the registering ledger
+    status, base = register_peer(base, request)
+    if status ~= "ok" then
+        return status, base
+    end
+    
+    -- Send a reciprocal registration request to the remote ledger.
+    base = send(base, {
+        target = request.from,
+        action = "register"
+    })
+    
+    return "ok", base
+end
+
+-- Register ourselves with a remote ledger, at the request of a user or another
+-- ledger.
+_G["register-remote"] = function (raw_base, assignment)
+    -- Validate the request.
+    local status, base, request = validate_request(raw_base, assignment)
+    if (status ~= "ok") or (type(request) ~= "table") then
+        return "ok", base
+    end
+
+    base = log_result(base, "ok", {
+        message = "Register-Remote request received.",
+        peer = request.peer
+    })
+
+    -- Send a registration request to the remote ledger. Our request is simply
+    -- a `Register' message, as the recipient will be assessing our unsigned
+    -- process ID in order to validate that we are an appropriate peer. This is
+    -- added by our `push-device`, so no further action is required on our part.
+    base = send(base, {
+        target = request.peer,
+        action = "register"
+    })
+
+    return "ok", base
+end
+
+--- Index function, called by the `~process@1.0` device for scheduled messages.
+--- We route any `action' to the appropriate function based on the request path.
+function compute(base, assignment)
+    ao.event({ "compute called",
+        { balance = base.balance, ledgers = base.ledgers } })
+
+    assignment.body.action = string.lower(assignment.body.action or "")
+    
+    if assignment.body.action == "credit-notice" then
+        return _G["credit-notice"](base, assignment)
+    elseif assignment.body.action == "transfer" then
+        return transfer(base, assignment)
+    elseif assignment.body.action == "register" then
+        return register(base, assignment)
+    elseif assignment.body.action == "register-remote" then
+        return _G["register-remote"](base, assignment)
+    else
+        -- Handle unknown `action' values.
+        _, base = ensure_initialized(base, assignment)
+        base.results = {
+            status = "ok"
+        }
+        ao.event({ "Process initialized.", { slot = assignment.slot } })
+        return "ok", base
+    end
+end
\ No newline at end of file
diff --git a/scripts/hyper-token.md b/scripts/hyper-token.md
new file mode 100644
index 000000000..770bf4bb4
--- /dev/null
+++ b/scripts/hyper-token.md
@@ -0,0 +1,217 @@
+# HyperTokens: Networks of fungible, parallel ledgers.
+## Status: Draft-1
+
+This document describes the implementation details of the token ledger found in
+`scripts/token.lua`. The script is built for operation with the HyperBEAM
+`~lua@5.3a` and `~process@1.0` devices.
+
+In addition to implementing the core AO token ledger API, `hyper-ledger.lua` also
+implements a `sub-ledger` standard, which allows for the creation of networks
+of ledgers that are may each hold fragments of the total supply of a given token.
+Each ledger may execute in paralell fully asynchronously, while ownership in their
+tokens can be viewed as fungible. The fungibility of tokens across these ledgers
+is created as a result of their transitively enforced security properties -- each
+ledger must be a precise copy of every other ledger in the network -- as well as
+the transferrability of balances from one ledger to another. Ledgers that have
+`register`ed with one another are able to transfer tokens directly. A multi-hop
+routing option is also available for situations in which it may be desirable to
+utilize pre-existing peer relationships instead.
+
+This document provides a terse overview of the mechanics of this standard, and
+the specifics of its implementation in `scripts/token.lua`.
+
+## 1. Entities and State
+
+### 1.1 Entities
+- **User Account**: Identified by wallet address, may own tokens in `ledgers`.
+- **Ledger Process**: An AO process implementing this token script.
+- **Root Ledger**: The base token ledger process, from which supply scarcity is
+  derived. Root ledgers are differentiated from `sub-ledger`s by the absence of
+  a `token` field.
+- **Sub-Ledger**: An independent ledger that that may own tokens in the root
+  ledger, holding them on behalf of users and other ledgers in the network.
+  All sub-ledgers must have a `token' field in their process definition, which
+  contains the signed process ID of the root ledger.
+
+### 1.2 State
+
+Each ledger maintain the following fields:
+
+- `balance`: A message containing a map of user addresses to token balances.
+- `ledgers`: A message containing a map of peer-ledgers and the local ledger's
+  balance in each.
+- `token`: (Optional) The signed process ID of the root ledger.
+
+Additionally, ledgers (root or sub-ledger) may maintain any other metadata fields
+as needed in their process definition messages. Both metadata and necessary 
+fields are available via the AO-Core HTTP API.
+
+## 2. Message Paths and Actions
+
+All instances of this script support calling the following functions, as either
+the `path` or `action` of scheduled messages upon them:
+
+- **Register**: Attempt to establish a trust relationship between ledger peers.
+- **Register-Remote**: User-initiated request for the recipient ledger to
+  register with a specific remote peer. After registration, the user may transfer
+  tokens from their own account on the registrant ledger, to the remote ledger
+  that they specified.
+- **Transfer**: Move tokens between accounts (with optional routing).
+- **Credit-Notice**: Notification sent by a ledger to a recipient of credit upon
+  a successful transfer.
+- **Debit-Notice**: A notification granted by a ledger to a sender of tokens,
+  upon successful transfer.
+- **Credit-Notice-Rejection**: A notice sent by a ledger to the sender of tokens,
+  if the ledger is unable to accept the transfer (crediting its own account).
+  This action occurs when the recipient ledger is unable to validate the sender
+  as a valid peer, or when the recipient ledger is unable to validate the
+  quantity of tokens being transferred. Upon receipt, a process will likely
+  wish to reverse the transfer locally.
+- **Route-Termination**: Notice, dispatched to a sender of tokens, if the
+  ledger is unable to forward the transfer to the next hop in the stated route.
+  Upon receipt, senders will typically wish to send a new transfer request to 
+  the ledger with a different route to reach their recipient. If all other
+  routes are exhausted, the sender may transfer the tokens to the root ledger.
+
+## 3. Core Process Flows
+
+### 3.1 Ledger Registration and Trust Negotiation.
+
+1. Ledger A sends `Register` to Ledger B. The `push-device` that delivers this
+   message to the recipient (for example, `push@1.0`) must add the
+   `from-process-uncommitted` field to the message, containing the hash of the
+   sending process.
+2. Ledger B validates:
+   - The admissibility of the assignment (its `scheduler` commitment),
+   - Whether it trusts the computation commitments upon the message, and
+   - Whether the message is from a process that is executing precisely the same
+     code as the recipient, as signified by the `from-process-uncommitted` field.
+3. Ledger B adds Ledger A to its list of trusted peers, if it is not already
+   present, and sends a reciprocal `Register` message to the sending ledger.
+4. Ledger A validates and adds Ledger B using the same mechanism, then adds it
+   to its list of trusted peers.
+5. **Result**: Bidirectional trust relationship, and the ability to transfer
+   tokens directly between the two ledgers.
+
+### 3.2 Direct Cross-Process Transfer
+
+**Objective**: `Alice` wants to send tokens to `Bob`, who is on Ledger B. There
+is an established peer relationship between Ledger A and Ledger B.
+
+1. `Alice`, with tokens resident on Ledger A, initiates transfer to `Bob`, who 
+   would like to receive tokens on Ledger B. Ledger B already has an established
+   trust relationship and sufficient balance for `Alice` to send tokens to `Bob`.
+2. Ledger A validates request, checks their balance for `Alice`, and debits the
+   sender's account.
+3. Ledger A sends a `Transfer` message to Ledger B.
+4. Ledger B validates sender ledger, decrements sender's balance, and credits the
+   recipient's balance.
+
+### 3.3 Multi-Hop Transfer
+
+**Objective**: `Alice` wants to send tokens to `Bob`, who is on Ledger N, but
+there is no peer relationship between Ledger A and Ledger N.
+
+1. `Alice` initiates a transfer on Ledger A, with a multi-hop route
+   (`route=[L₁, L₂, ..., Lₙ]`) to reach `Bob` on Ledger N.
+2. As with S`3.2`, Ledger A validates request, checks their balance for `Alice`,
+   and debits the sender's account.
+3. Each intermediate ledger in the route validates the balance of the sending 
+   ledger, and debits their account. Each ledger also removes themselves from the
+   list of hops remaining in the `route` parameter of the request, and forwards
+   it onwards to the next hop.
+4. Final ledger in the route validates the balance of the sending ledger, and
+   credits the `Bob`'s account.
+
+### 3.4 Transfer with Peer Registration
+
+**Objective**: `Alice` wants to send tokens to `Bob`, who is on Ledger B. There
+is no peer relationship between Ledger A and Ledger B, but `Alice` would rather
+establish one than route the transfer through a potentially longer multi-hop
+route.
+
+1. `Alice` sends a `Register-Remote` message to Ledger B, with a `peer` parameter
+   of Ledger A's signed process ID.
+2. Ledger B validates the request, and adds Ledger A to its list of trusted peers.
+3. `Alice` sends a `Transfer` message to Ledger B.
+4. Ledger A and B validate the transfer request, as in `3.2`.
+
+## 4. Intended Security Properties
+
+1. **Code Integrity**: Each new peer relationship validates that each other 
+   peer is executing precisely the same code as it is. Subsequently, the
+   security properties of the original ledger are transitively applied to all
+   new ledgers in the network.
+2. **Conservation of Tokens**: As each peer may trust each other peer to monitor
+   balances as they would, the network as a whole maintains the conservation
+   of the total supply of tokens.
+3. **Trustless Registration**: A subledger may register with any AO token process
+   without that process needing to be aware of the subledger protocol, nor the
+   security properties that it enforces. Instead, users that wish to participate
+   in a subledger process network with security properties that they deem 
+   acceptable may do so at-will. Processes that do choose to participate may
+   maintain an index of known ledgers, allowing tokens within them to be shown
+   as fungible with the root ledger's tokens in user interfaces, etc.
+
+## 5. API Reference
+
+### 5.1 External API Functions
+
+#### `transfer(state, assignment)`
+
+Transfers tokens from one account to another.
+
+Parameters:
+
+- `base`: The current state of the ledger process.
+- `assignment`: An assignment of the transfer message from the process's
+  `sheduler`.
+- `assignment/body`: The transfer message.
+- `assignment/body/from`: Source account (determined from signature or 
+  `from-process`).
+- `assignment/body/recipient`: The destination account.
+- `assignment/body/quantity`: Amount to transfer (integer).
+- `assignment/body/route`: (Optional) A list of ledger IDs that should be 
+  traversed to reach the destination ledger.
+
+Returns: The updated process ledger state, and:
+
+- `result/status`: The status of the transfer.
+- `result/outbox/1`: A message containing the `Action: Credit-Notice` field, sent
+  to the recipient (either an end-user or another ledger).
+- `result/outbox/2`: (Optional) A message containing the `Action: Debit-Notice`
+  field, dispatched to the sender _if_ the transfer is not a multi-hop route.
+  In the case of multi-hop routes, debit notices are not sent to any intermediate
+  ledgers, but are sent to the initial sender upon completion of the final hop.
+
+In event of error, the following messages are dispatched:
+
+- `result/outbox/1`: (Optional) A message containing the
+  `Action: Credit-Notice-Rejection` field, along with a `notice` field with the
+  ID of the credit notice that was rejected.
+- `result/outbox/1`: (Optional) A message containing `Action: Route-Termination`,
+  sent to the initiator of an inter-ledger transfer, if the transfer is unable to
+  reach the destination ledger. In this case, the sender will hold a balance on
+  the intermediate ledger, and may attempt to route the transfer again with a
+  different route.
+
+#### `register-remote(base, assignment)`
+
+Initiates a registration from the target ledger to the `peer` ledger.
+
+Parameters:
+- `base`: The current state of the ledger
+- `assignment`: The message containing:
+- `assignment/body/peer`: The signed process ID of the remote ledger to
+  register with.
+
+#### `register(base, assignment)`
+
+Attempts to register the sending ledger with the target ledger.
+
+Parameters:
+- `base`: The current state of the ledger
+- `assignment`: The message containing:
+- `assignment/body/from`: The ledger requesting registration.
+- `assignment/body/from-process-uncommitted`: A hash, added by the `push-device`,
+  of the sending process.
\ No newline at end of file
diff --git a/scripts/p4-payment-client.lua b/scripts/p4-payment-client.lua
deleted file mode 100644
index 20a1921ae..000000000
--- a/scripts/p4-payment-client.lua
+++ /dev/null
@@ -1,84 +0,0 @@
---- A simple script that can be used as a `~p4@1.0` ledger device, marshalling
---- requests to a local process.
-
--- Find the user's balance in the current ledger state.
-function balance(base, request)
-    local status, res = ao.resolve({
-        path =
-            base["ledger-path"]
-            .. "/now/balance/"
-            .. request["target"]
-    })
-    ao.event({ "client received balance response", 
-        { status = status, res = res, target = request["target"] } }
-    )
-    -- If the balance request fails (most likely because the user has no balance),
-    -- return a balance of 0.
-    if status ~= "ok" then
-        return "ok", 0
-    end
-
-    -- We have successfully retrieved the balance, so return it.
-    return "ok", res
-end
-
--- Debit the user's balance in the current ledger state.
-function debit(base, request)
-    ao.event({ "client starting debit", { request = request, base = base } })
-    local status, res = ao.resolve({
-        path = "(" .. base["ledger-path"] .. ")/schedule",
-        method = "POST",
-        body = request
-    })
-    ao.event({ "client received schedule response", { status = status, res = res } })
-    status, res = ao.resolve({
-        path = base["ledger-path"] .. "/compute/balance/" .. request["account"],
-        slot = res.slot
-    })
-    ao.event({ "confirmed balance", { status = status, res = res } })
-    return "ok"
-end
-
---- Poll an external ledger for credit events. If new credit noticess have been
---- sent by the external ledger, push them to the local ledger.
-function poll(base, req)
-    local status, local_last_credit = ao.resolve({
-        path = base["ledger-path"] .. "/now/last-credit"
-    })
-    if status ~= "ok" then
-        ao.event(
-            { "error getting local last credit",
-                { status = status, res = local_last_credit } }
-        )
-        return "error", base
-    end
-
-    local status, external_last_credit = ao.resolve({
-        path = base["external-ledger"] .. "/now/last-credit"
-    })
-    if status ~= "ok" then
-        ao.event({ "error getting external last credit",
-            { status = status, res = external_last_credit } })
-        return "error", base
-    end
-
-    ao.event({ "Retreived sync data. Last credit info:",
-        {
-            local_last_credit = local_last_credit,
-            external_last_credit = external_last_credit }
-        }
-    )
-    while local_last_credit < external_last_credit do
-        status, res = ao.resolve({
-            path = base["external-ledger"] .. "/push",
-            slot = local_last_credit + 1
-        })
-        if status ~= "ok" then
-            ao.event({ "error pushing slot", { status = status, res = res } })
-            return "error", base
-        end
-        local_last_credit = local_last_credit + 1
-    end
-
-    return "ok", base
-end
\ No newline at end of file
diff --git a/scripts/p4-payment-process.lua b/scripts/p4-payment-process.lua
deleted file mode 100644
index 7bb60c2a2..000000000
--- a/scripts/p4-payment-process.lua
+++ /dev/null
@@ -1,97 +0,0 @@
---- A ledger that allows account balances to be debited and credited by a
---- specified address.
-
--- Check if the request is a valid debit/credit request by checking if one of
--- the committers is the operator.
-local function is_valid_request(base, assignment)
-    -- First, validate that the assignment is signed by the scheduler.
-    local scheduler = base.scheduler
-    local status, res = ao.resolve(assignment, "committers")
-    ao.event({
-        "assignment committers resp:",
-        { status = status, res = res, scheduler = scheduler }
-    })
-    
-    if status ~= "ok" then
-        return false
-    end
-
-    local valid = false
-    for _, committer in ipairs(res) do
-        if committer == scheduler then
-            valid = true
-        end
-    end
-
-    if not valid then
-        return false
-    end
-
-    -- Next, validate that the request is signed by the operator.
-    local operator = base.operator
-    status, res = ao.resolve(assignment.body, "committers")
-    ao.event({
-        "request committers resp:",
-        { status = status, res = res, operator = operator }
-    })
-
-    if status ~= "ok" then
-        return false
-    end
-
-    for _, committer in ipairs(res) do
-        if committer == operator then
-            return true
-        end
-    end
-
-    return false
-end
-
--- Debit the specified account by the given amount.
-function debit(base, assignment)
-    ao.event({ "process debit starting", { assignment = assignment } })
-    if not is_valid_request(base, assignment) then
-        base.result = { status = "error", error = "Operator signature required." }
-        ao.event({ "debit error", base.result })
-        return "ok", base
-    end
-    ao.event({ "process debit valid", { assignment = assignment } })
-    base.balance = base.balance or {}
-    base.balance[assignment.body.account] =
-        (base.balance[assignment.body.account] or 0) - assignment.body.quantity
-    
-    ao.event({ "process debit success", { balances = base.balance } })
-    return "ok", base
-end
-
--- Credit the specified account by the given amount.
-_G["credit-notice"] = function (base, assignment)
-    ao.event({ "credit-notice", { assignment = assignment }, { balances = base.balance } })
-    if not is_valid_request(base, assignment) then
-        base.result = { status = "error", error = "Operator signature required." }
-        return "ok", base
-    end
-    ao.event({ "is valid", { req = assignment.body } })
-    base.balance = base.balance or {}
-    base.balance[assignment.body.recipient] =
-        (base.balance[assignment.body.recipient] or 0) + assignment.body.quantity
-    ao.event({ "credit", { ["new balances"] = base.balance } })
-    return "ok", base
-end
-
---- Index function, called by the `~process@1.0` device for scheduled messages.
---- We route each to the appropriate function based on the request path.
-function compute(base, assignment, opts)
-    ao.event({ "compute", { assignment = assignment }, { balances = base.balance } })
-    if assignment.body.path == "debit" then
-        return debit(base, assignment.body)
-    elseif assignment.body.path == "credit-notice" then
-        return _G["credit-notice"](base, assignment.body)
-    elseif assignment.body.path == "balance" then
-        return balance(base, assignment.body)
-    elseif assignment.slot == 0 then
-        base.balance = base.balance or {}
-        return "ok", base
-    end
-end
diff --git a/scripts/schema.gql b/scripts/schema.gql
new file mode 100644
index 000000000..85e083b46
--- /dev/null
+++ b/scripts/schema.gql
@@ -0,0 +1,301 @@
+### Supported GraphQL Queries. ###
+
+type Query {
+
+  # Get a message by its id or a subset of its keys.
+  message(id: ID, keys: [KeyInput]): Message
+
+  # Get a transaction by its id
+  transaction(id: ID!): Transaction
+
+  # Get a paginated set of matching transactions using filters.
+  transactions(
+    # Find transactions from a list of ids.
+    ids: [ID!]
+
+    # Find transactions from a list of owner wallet addresses, or wallet owner public keys.
+    owners: [String!]
+
+    # Find transactions from a list of recipient wallet addresses.
+    recipients: [String!]
+
+    # Find transactions using tags.
+    tags: [TagFilter!]
+
+    # Find data items from the given data bundles.
+    # See: https://github.com/ArweaveTeam/arweave-standards/blob/master/ans/ANS-104.md
+    bundledIn: [ID!]
+
+    # Find transactions within a given Search Indexing Service ingestion time range.
+    ingested_at: RangeFilter
+
+    # Find transactions within a given block height range.
+    block: RangeFilter
+
+    # Result page size (max: 100)
+    first: Int = 10
+
+    # A pagination cursor value, for fetching subsequent pages from a result set.
+    after: String
+
+    # Optionally specify the result sort order.
+    #sort: SortOrder = HEIGHT_DESC
+  ): TransactionConnection!
+  block(id: String): Block
+  blocks(
+    # Find blocks from a list of ids.
+    ids: [ID!]
+
+    # Find blocks within a given block height range.
+    height: RangeFilter
+
+    # Result page size (max: 100)
+    first: Int = 10
+
+    # A pagination cursor value, for fetching subsequent pages from a result set.
+    after: String
+
+    # Optionally specify the result sort order.
+    #sort: SortOrder = HEIGHT_DESC
+  ): BlockConnection!
+}
+
+### HyperBEAM Message Schema. ###
+
+input KeyInput {
+    name: String!
+    value: String!
+}
+
+type Message {
+    id: ID!
+    keys: [Key]
+}
+
+type Key {
+    name: String
+    value: String
+}
+
+### Arweave GraphQL Schema. ###
+
+# Indicates exactly one field must be supplied and this field must not be `null`.
+directive @oneOf on INPUT_OBJECT
+
+directive @cacheControl(
+  maxAge: Int
+  scope: CacheControlScope
+  inheritMaxAge: Boolean
+) on FIELD_DEFINITION | OBJECT | INTERFACE | UNION
+
+# Representation of a transaction owner.
+type Owner {
+  # The owner's wallet address.
+  address: String!
+
+  # The owner's public key as a base64url encoded string.
+  key: String!
+}
+
+# Representation of a value transfer between wallets, in both winson and ar.
+type Amount {
+  # Amount as a winston string e.g. \`"1000000000000"\`.
+  winston: String!
+
+  # Amount as an AR string e.g. \`"0.000000000001"\`.
+  ar: String!
+}
+
+# Basic metadata about the transaction data payload.
+type MetaData {
+  # Size of the associated data in bytes.
+  size: String!
+
+  # Type is derived from the \`content-type\` tag on a transaction.
+  type: String
+}
+
+# Tag Schema
+type Tag {
+  # UTF-8 tag name
+  name: String!
+
+  # UTF-8 tag value
+  value: String!
+}
+
+# Block Schema
+type Block {
+  # The block ID.
+  id: ID
+
+  # The block timestamp (UTC).
+  timestamp: Int
+
+  # The block height.
+  height: Int!
+
+  # The previous block ID.
+  previous: ID
+}
+
+# The parent transaction for bundled transactions,
+# see: https://github.com/ArweaveTeam/arweave-standards/blob/master/ans/ANS-102.md.
+type Parent {
+  id: ID!
+}
+
+# The data bundle containing the current data item.
+# See: https://github.com/ArweaveTeam/arweave-standards/blob/master/ans/ANS-104.md.
+type Bundle {
+  # ID of the containing data bundle.
+  id: ID!
+}
+
+# Transaction Structure
+type Transaction {
+  id: ID!
+  anchor: String!
+  signature: String!
+  recipient: String!
+  owner: Owner!
+  fee: Amount!
+  quantity: Amount!
+  data: MetaData!
+  tags: [Tag!]!
+
+  # When this transaction was made available for querying
+  ingested_at: Int
+
+  # Transactions with a null block are recent and unconfirmed, if they aren't mined into a block within 60 minutes they will be removed from results.
+  block: Block
+
+  # @deprecated Don't use, kept for backwards compatability only!
+  parent: Parent @deprecated(reason: "Use `bundledIn`")
+
+  # For bundled data items this references the containing bundle ID.
+  # See: https://github.com/ArweaveTeam/arweave-standards/blob/master/ans/ANS-104.md
+  bundledIn: Bundle
+}
+
+# Paginated page info using the GraphQL cursor spec.
+type PageInfo {
+  hasNextPage: Boolean!
+}
+
+# Paginated result set using the GraphQL cursor spec.
+type TransactionEdge {
+  # The cursor value for fetching the next page.
+  #
+  # Pass this to the `after` parameter in ` transactions(after: $cursor)`, the next page will start from the next item after this.
+  cursor: String!
+
+  # A transaction object.
+  node: Transaction!
+}
+
+# Paginated result set using the GraphQL cursor spec,
+# see: https://relay.dev/graphql/connections.htm.
+type TransactionConnection {
+  pageInfo: PageInfo!
+
+  # The number of transactions that match this query.
+  count: String
+  edges: [TransactionEdge!]!
+}
+
+# Paginated result set using the GraphQL cursor spec.
+type BlockEdge {
+  # The cursor value for fetching the next page.
+  #
+  # Pass this to the after parameter in blocks(after: $cursor), the next page will start from the next item after this.
+  cursor: String!
+
+  # A block object.
+  node: Block!
+}
+
+# Paginated result set using the GraphQL cursor spec,
+# see: https://relay.dev/graphql/connections.htm.
+type BlockConnection {
+  pageInfo: PageInfo!
+  edges: [BlockEdge!]!
+}
+
+# Find transactions with the following tag name and value
+input TagFilter {
+  # The tag name
+  name: String
+
+  # An array of values to match against. If multiple values are passed then transactions with _any_ matching tag value from the set will be returned.
+  #
+  # e.g.
+  #
+  # `{name: "app-name", values: ["app-1"]}`
+  #
+  # Returns all transactions where the `app-name` tag has a value of `app-1`.
+  #
+  # `{name: "app-name", values: ["app-1", "app-2", "app-3"]}`
+  #
+  # Returns all transactions where the `app-name` tag has a value of either `app-1` _or_ `app-2` _or_ `app-3`.
+  values: [String!]
+
+  # The operator to apply to to the tag filter. Defaults to EQ (equal).
+  #op: TagOperator! = EQ
+
+  # How tag names and values are matched. Defaults to EXACT.
+  #match: TagMatch! = EXACT
+}
+
+# The operator to apply to a tag value.
+enum TagOperator {
+  # Equal
+  EQ
+
+  # Not equal
+  NEQ
+}
+
+# The method used to determine if tags match.
+enum TagMatch {
+  # An exact match
+  EXACT
+
+  # A wildcard match
+  WILDCARD
+
+  # Fuzzy match containing all search terms
+  FUZZY_AND
+
+  # Fuzzy match containing at least one search term
+  FUZZY_OR
+}
+
+# Filter with a min and max
+input RangeFilter {
+  # Minimum integer to filter from
+  min: Int
+
+  # Maximum integer to filter to
+  max: Int
+}
+
+# Optionally reverse the result sort order from `HEIGHT_DESC` (default) to `HEIGHT_ASC`.
+enum SortOrder {
+  # Results are sorted by the transaction block height in ascending order, with the oldest transactions appearing first, and the most recent and pending/unconfirmed appearing last.
+  HEIGHT_ASC
+
+  # Results are sorted by the transaction block height in descending order, with the most recent and unconfirmed/pending transactions appearing first.
+  HEIGHT_DESC
+
+  # Results are sorted by the transaction ingestion time in descending order, with the most recently ingested transactions appearing first.
+  INGESTED_AT_DESC
+
+  # Results are sorted by the transaction ingestion time in ascending order, with the oldest ingested transactions appearing first.
+  INGESTED_AT_ASC
+}
+
+enum CacheControlScope {
+  PUBLIC
+  PRIVATE
+}
\ No newline at end of file
diff --git a/src/ar_bundles.erl b/src/ar_bundles.erl
index dc2435d25..50257208f 100644
--- a/src/ar_bundles.erl
+++ b/src/ar_bundles.erl
@@ -7,7 +7,7 @@
 -export([serialize/1, serialize/2, deserialize/1, deserialize/2]).
 -export([data_item_signature_data/1]).
 -export([normalize/1]).
--export([print/1, format/1, format/2]).
+-export([print/1, format/1, format/2, format/3]).
 -include("include/hb.hrl").
 -include_lib("eunit/include/eunit.hrl").
 
@@ -34,31 +34,49 @@ print(Item) ->
     io:format(standard_error, "~s", [lists:flatten(format(Item))]).
 
 format(Item) -> format(Item, 0).
-format(Item, Indent) when is_list(Item); is_map(Item) ->
-    format(normalize(Item), Indent);
-format(Item, Indent) when is_record(Item, tx) ->
-    Valid = verify_item(Item),
+format(Item, Indent) -> format(Item, Indent, #{}).
+format(Item, Indent, Opts) when is_list(Item); is_map(Item) ->
+    format(normalize(Item), Indent, Opts);
+format(Item, Indent, Opts) when is_record(Item, tx) ->
+    MustVerify = hb_opts:get(debug_ids, true, Opts),
+    Valid =
+        if MustVerify -> verify_item(Item);
+        true -> true
+        end,
+    UnsignedID =
+        if MustVerify -> hb_util:encode(id(Item, unsigned));
+        true -> <<"[SKIPPED ID]">>
+        end,
+    SignedID =
+        if MustVerify ->
+            case id(Item, signed) of
+                not_signed -> <<"[NOT SIGNED]">>;
+                ID -> hb_util:encode(ID)
+            end;
+        true -> <<"[SKIPPED ID]">>
+        end,
     format_line(
         "TX ( ~s: ~s ) {",
         [
             if
-                Item#tx.signature =/= ?DEFAULT_SIG ->
+                MustVerify andalso Item#tx.signature =/= ?DEFAULT_SIG ->
                     lists:flatten(
                         io_lib:format(
                             "~s (signed) ~s (unsigned)",
-                            [hb_util:encode(id(Item, signed)), hb_util:encode(id(Item, unsigned))]
+                            [SignedID, UnsignedID]
                         )
                     );
-                true -> hb_util:encode(id(Item, unsigned))
+                true -> UnsignedID
             end,
             if
+                not MustVerify -> "[SKIPPED VERIFICATION]";
                 Valid == true -> "[SIGNED+VALID]";
                 true -> "[UNSIGNED/INVALID]"
             end
         ],
         Indent
     ) ++
-    case (not Valid) andalso Item#tx.signature =/= ?DEFAULT_SIG of
+    case MustVerify andalso (not Valid) andalso Item#tx.signature =/= ?DEFAULT_SIG of
         true ->
             format_line("!!! CAUTION: ITEM IS SIGNED BUT INVALID !!!", Indent + 1);
         false -> []
@@ -74,6 +92,12 @@ format(Item, Indent) when is_record(Item, tx) ->
                 Target -> hb_util:id(Target)
             end
         ], Indent + 1) ++
+    format_line("Last TX: ~s", [
+            case Item#tx.anchor of
+                ?DEFAULT_LAST_TX -> "[NONE]";
+                LastTX -> hb_util:encode(LastTX)
+            end
+        ], Indent + 1) ++
     format_line("Tags:", Indent + 1) ++
     lists:map(
         fun({Key, Val}) -> format_line("~s -> ~s", [Key, Val], Indent + 2) end,
@@ -81,7 +105,7 @@ format(Item, Indent) when is_record(Item, tx) ->
     ) ++
     format_line("Data:", Indent + 1) ++ format_data(Item, Indent + 2) ++
     format_line("}", Indent);
-format(Item, Indent) ->
+format(Item, Indent, _Opts) ->
     % Whatever we have, its not a tx...
     format_line("INCORRECT ITEM: ~p", [Item], Indent).
 
@@ -224,7 +248,7 @@ new_item(Target, Anchor, Tags, Data) ->
         #tx{
             format = ans104,
             target = Target,
-            last_tx = Anchor,
+            anchor = Anchor,
             tags = Tags,
             data = Data,
             data_size = byte_size(Data)
@@ -247,7 +271,6 @@ verify_item(DataItem) ->
     ValidID andalso ValidSignature andalso ValidTags.
 
 type(Item) when is_record(Item, tx) ->
-    lists:keyfind(<<"bundle-map">>, 1, Item#tx.tags),
     case lists:keyfind(<<"bundle-map">>, 1, Item#tx.tags) of
         {<<"bundle-map">>, _} ->
             case lists:keyfind(<<"map-format">>, 1, Item#tx.tags) of
@@ -283,7 +306,7 @@ data_item_signature_data(RawItem, signed) ->
         utf8_encoded("1"),
         <<(NormItem#tx.owner)/binary>>,
         <<(NormItem#tx.target)/binary>>,
-        <<(NormItem#tx.last_tx)/binary>>,
+        <<(NormItem#tx.anchor)/binary>>,
         encode_tags(NormItem#tx.tags),
         <<(NormItem#tx.data)/binary>>
     ]).
@@ -314,8 +337,12 @@ verify_data_item_tags(DataItem) ->
 
 normalize(Item) -> reset_ids(normalize_data(Item)).
 
-%% @doc Ensure that a data item (potentially containing a map or list) has a standard, serialized form.
+%% @doc Ensure that a data item (potentially containing a map or list) has a
+%% standard, serialized form.
 normalize_data(not_found) -> throw(not_found);
+normalize_data(Item = #tx{data = Bin}) when is_binary(Bin) ->
+    ?event({normalize_data, binary, Item}),
+    normalize_data_size(Item);
 normalize_data(Bundle) when is_list(Bundle); is_map(Bundle) ->
     ?event({normalize_data, bundle, Bundle}),
     normalize_data(#tx{ data = Bundle });
@@ -339,9 +366,6 @@ normalize_data(Item = #tx { data = Data }) when is_list(Data) ->
                 )
         }
     );
-normalize_data(Item = #tx{data = Bin}) when is_binary(Bin) ->
-    ?event({normalize_data, binary, Item}),
-    normalize_data_size(Item);
 normalize_data(Item = #tx{data = Data}) ->
     ?event({normalize_data, map, Item}),
     normalize_data_size(
@@ -350,10 +374,11 @@ normalize_data(Item = #tx{data = Data}) ->
                 Item#tx{
                     data = Bin,
                     manifest = Manifest,
-                    tags = add_manifest_tags(
-                        add_bundle_tags(Item#tx.tags),
-                        id(Manifest, unsigned)
-                    )
+                    tags =
+                        add_manifest_tags(
+                            add_bundle_tags(Item#tx.tags),
+                            id(Manifest, unsigned)
+                        )
                 };
             DirectBin ->
                 Item#tx{
@@ -381,7 +406,7 @@ serialize(RawTX, binary) ->
         (TX#tx.signature)/binary,
         (TX#tx.owner)/binary,
         (encode_optional_field(TX#tx.target))/binary,
-        (encode_optional_field(TX#tx.last_tx))/binary,
+        (encode_optional_field(TX#tx.anchor))/binary,
         (encode_tags_size(TX#tx.tags, EncodedTags))/binary,
         EncodedTags/binary,
         (TX#tx.data)/binary
@@ -412,8 +437,8 @@ enforce_valid_tx(TX) ->
         {invalid_field, unsigned_id, TX#tx.unsigned_id}
     ),
     ok_or_throw(TX,
-        check_size(TX#tx.last_tx, [0, 32]),
-        {invalid_field, last_tx, TX#tx.last_tx}
+        check_size(TX#tx.anchor, [0, 32]),
+        {invalid_field, last_tx, TX#tx.anchor}
     ),
     ok_or_throw(TX,
         check_size(TX#tx.owner, [0, byte_size(?DEFAULT_OWNER)]),
@@ -427,6 +452,10 @@ enforce_valid_tx(TX) ->
         check_size(TX#tx.signature, [0, 65, byte_size(?DEFAULT_SIG)]),
         {invalid_field, signature, TX#tx.signature}
     ),
+    ok_or_throw(TX,
+        check_type(TX#tx.tags, list),
+        {invalid_field, tags, TX#tx.tags}
+    ),
     lists:foreach(
         fun({Name, Value}) ->
             ok_or_throw(TX,
@@ -439,11 +468,11 @@ enforce_valid_tx(TX) ->
             ),
             ok_or_throw(TX,
                 check_type(Value, binary),
-                {invalid_field, tag_value, Value}
+                {invalid_field, tag_value, {Name, Value}}
             ),
             ok_or_throw(TX,
                 check_size(Value, {range, 0, ?MAX_TAG_VALUE_SIZE}),
-                {invalid_field, tag_value, Value}
+                {invalid_field, tag_value, {Name, Value}}
             );
             (InvalidTagForm) ->
                 throw({invalid_field, tag, InvalidTagForm})
@@ -538,6 +567,10 @@ finalize_bundle_data(Processed) ->
     Items = <<<<Data/binary>> || {_, Data} <- Processed>>,
     <<Length/binary, Index/binary, Items/binary>>.
 
+to_serialized_pair(Item) when is_binary(Item) ->
+    % Support bundling of bare binary payloads by wrapping them in a TX that
+    % is explicitly marked as a binary data item.
+    to_serialized_pair(#tx{ tags = [{<<"ao-type">>, <<"binary">>}], data = Item });
 to_serialized_pair(Item) ->
     % TODO: This is a hack to get the ID of the item. We need to do this because we may not
     % have the ID in 'item' if it is just a map/list. We need to make this more efficient.
@@ -609,7 +642,7 @@ encode_tags([]) ->
 encode_tags(Tags) ->
     EncodedBlocks = lists:flatmap(
         fun({Name, Value}) ->
-            Res = [encode_avro_string(Name), encode_avro_string(Value)],
+            Res = [encode_avro_name(Name), encode_avro_value(Value)],
             case lists:member(error, Res) of
                 true ->
                     throw({cannot_encode_empty_string, Name, Value});
@@ -624,14 +657,22 @@ encode_tags(Tags) ->
     <<ZigZagCount/binary, (list_to_binary(EncodedBlocks))/binary, 0>>.
 
 %% @doc Encode a string for Avro using ZigZag and VInt encoding.
-encode_avro_string(<<>>) ->
-    % Zero length strings are treated as a special case, due to the Avro encoder.
+encode_avro_name(<<>>) ->
+    % Zero length names are treated as a special case, due to the Avro encoder.
     << 0 >>;
-encode_avro_string(String) ->
-    StringBytes = unicode:characters_to_binary(String, utf8),
+encode_avro_name(String) ->
+    StringBytes = utf8_encoded(String),
     Length = byte_size(StringBytes),
     <<(encode_zigzag(Length))/binary, StringBytes/binary>>.
 
+encode_avro_value(<<>>) ->
+    % Zero length values are treated as a special case, due to the Avro encoder.
+    << 0 >>;
+encode_avro_value(Value) when is_binary(Value) ->
+    % Tag values can be raw binaries
+    Length = byte_size(Value),
+    <<(encode_zigzag(Length))/binary, Value/binary>>.
+
 %% @doc Encode an integer using ZigZag encoding.
 encode_zigzag(Int) when Int >= 0 ->
     encode_vint(Int bsl 1);
@@ -670,7 +711,7 @@ deserialize(Binary, binary) ->
             signature = Signature,
             owner = Owner,
             target = Target,
-            last_tx = Anchor,
+            anchor = Anchor,
             tags = Tags,
             data = Data,
             data_size = byte_size(Data)
@@ -867,9 +908,45 @@ ar_bundles_test_() ->
         {timeout, 30, fun test_basic_member_id/0},
         {timeout, 30, fun test_deep_member/0},
         {timeout, 30, fun test_extremely_large_bundle/0},
-        {timeout, 30, fun test_serialize_deserialize_deep_signed_bundle/0}
+        {timeout, 30, fun test_serialize_deserialize_deep_signed_bundle/0},
+        {timeout, 30, fun test_encode_tags/0}
     ].
 
+test_encode_tags() ->
+    BinValue = <<1, 2, 3, 255, 254>>,
+    TestCases = [
+        {simple_string_tags, [{<<"tag1">>, <<"value1">>}]},
+        {binary_value_tag, [{<<"binary-tag">>, BinValue}]},
+        {mixed_tags,
+            [
+                {<<"string-tag">>, <<"string-value">>},
+                {<<"binary-tag">>, BinValue}
+            ]
+        },
+        {empty_value_tag, [{<<"empty-value-tag">>, <<>>}]},
+        {unicode_tag, [{<<"unicode-tag">>, <<"你好世界">>}]}
+    ],
+    lists:foreach(
+        fun({Label, InputTags}) ->
+            Encoded = encode_tags(InputTags),
+            Wrapped =
+                <<
+                    (length(InputTags)):64/little,
+                    (byte_size(Encoded)):64/little,
+                    Encoded/binary
+                >>,
+            {DecodedTags, <<>>} = decode_tags(Wrapped),
+            ?assertEqual(InputTags, DecodedTags, Label)
+        end,
+        TestCases
+    ),
+    % Test case: Empty tags list
+    EmptyTags = [],
+    EncodedEmpty = encode_tags(EmptyTags),
+    ?assertEqual(<<>>, EncodedEmpty),
+    WrappedEmpty = <<0:64/little, 0:64/little>>,
+    {[], <<>>} = decode_tags(WrappedEmpty).
+
 run_test() ->
     test_with_zero_length_tag().
 
@@ -880,12 +957,9 @@ test_no_tags() ->
     Anchor = crypto:strong_rand_bytes(32),
     DataItem = new_item(Target, Anchor, [], <<"data">>),
     SignedDataItem = sign_item(DataItem, {Priv, Pub}),
-
     ?assertEqual(true, verify_item(SignedDataItem)),
     assert_data_item(KeyType, Owner, Target, Anchor, [], <<"data">>, SignedDataItem),
-
     SignedDataItem2 = deserialize(serialize(SignedDataItem)),
-
     ?assertEqual(SignedDataItem, SignedDataItem2),
     ?assertEqual(true, verify_item(SignedDataItem2)),
     assert_data_item(KeyType, Owner, Target, Anchor, [], <<"data">>, SignedDataItem2).
@@ -898,12 +972,9 @@ test_with_tags() ->
     Tags = [{<<"tag1">>, <<"value1">>}, {<<"tag2">>, <<"value2">>}],
     DataItem = new_item(Target, Anchor, Tags, <<"taggeddata">>),
     SignedDataItem = sign_item(DataItem, {Priv, Pub}),
-
     ?assertEqual(true, verify_item(SignedDataItem)),
     assert_data_item(KeyType, Owner, Target, Anchor, Tags, <<"taggeddata">>, SignedDataItem),
-
     SignedDataItem2 = deserialize(serialize(SignedDataItem)),
-
     ?assertEqual(SignedDataItem, SignedDataItem2),
     ?assertEqual(true, verify_item(SignedDataItem2)),
     assert_data_item(KeyType, Owner, Target, Anchor, Tags, <<"taggeddata">>, SignedDataItem2).
@@ -939,7 +1010,7 @@ assert_data_item(KeyType, Owner, Target, Anchor, Tags, Data, DataItem) ->
     ?assertEqual(KeyType, DataItem#tx.signature_type),
     ?assertEqual(Owner, DataItem#tx.owner),
     ?assertEqual(Target, DataItem#tx.target),
-    ?assertEqual(Anchor, DataItem#tx.last_tx),
+    ?assertEqual(Anchor, DataItem#tx.anchor),
     ?assertEqual(Tags, DataItem#tx.tags),
     ?assertEqual(Data, DataItem#tx.data),
     ?assertEqual(byte_size(Data), DataItem#tx.data_size).
@@ -985,17 +1056,17 @@ test_recursive_bundle() ->
     W = ar_wallet:new(),
     Item1 = sign_item(#tx{
         id = crypto:strong_rand_bytes(32),
-        last_tx = crypto:strong_rand_bytes(32),
+        anchor = crypto:strong_rand_bytes(32),
         data = <<1:256/integer>>
     }, W),
     Item2 = sign_item(#tx{
         id = crypto:strong_rand_bytes(32),
-        last_tx = crypto:strong_rand_bytes(32),
+        anchor = crypto:strong_rand_bytes(32),
         data = [Item1]
     }, W),
     Item3 = sign_item(#tx{
         id = crypto:strong_rand_bytes(32),
-        last_tx = crypto:strong_rand_bytes(32),
+        anchor = crypto:strong_rand_bytes(32),
         data = [Item2]
     }, W),
     Bundle = serialize([Item3]),
@@ -1015,7 +1086,7 @@ test_bundle_map() ->
     }, W),
     Item2 = sign_item(#tx{
         format = ans104,
-        last_tx = crypto:strong_rand_bytes(32),
+        anchor = crypto:strong_rand_bytes(32),
         data = #{<<"key1">> => Item1}
     }, W),
     Bundle = serialize(Item2),
diff --git a/src/ar_rate_limiter.erl b/src/ar_rate_limiter.erl
index 2fc501912..81781e81c 100644
--- a/src/ar_rate_limiter.erl
+++ b/src/ar_rate_limiter.erl
@@ -74,10 +74,10 @@ handle_cast({throttle, Peer, Path, From}, State) ->
 	#state{ traces = Traces, opts = Opts } = State,
 	{Type, Limit} = hb_opts:get(throttle_rpm_by_path, Path, Opts),
 	Now = os:system_time(millisecond),
-	case maps:get({Peer, Type}, Traces, not_found) of
+	case hb_maps:get({Peer, Type}, Traces, not_found, Opts) of
 		not_found ->
 			gen_server:reply(From, ok),
-			Traces2 = maps:put({Peer, Type}, {1, queue:from_list([Now])}, Traces),
+			Traces2 = hb_maps:put({Peer, Type}, {1, queue:from_list([Now])}, Traces, Opts),
 			{noreply, State#state{ traces = Traces2 }};
 		{N, Trace} ->
 			{N2, Trace2} = cut_trace(N, queue:in(Now, Trace), Now, Opts),
@@ -103,7 +103,7 @@ handle_cast({throttle, Peer, Path, From}, State) ->
 					{noreply, State};
 				false ->
 					gen_server:reply(From, ok),
-					Traces2 = maps:put({Peer, Type}, {N2 + 1, Trace2}, Traces),
+					Traces2 = hb_maps:put({Peer, Type}, {N2 + 1, Trace2}, Traces, Opts),
 					{noreply, State#state{ traces = Traces2 }}
 			end
 	end;
diff --git a/src/ar_timestamp.erl b/src/ar_timestamp.erl
index 1776c23b9..fcf3f8d11 100644
--- a/src/ar_timestamp.erl
+++ b/src/ar_timestamp.erl
@@ -57,10 +57,6 @@ cache(Current) ->
 %% @doc Refresh the timestamp cache periodically.
 refresher(TSServer) ->
     timer:sleep(?TIMEOUT),
-    TS =
-        case hb_opts:get(mode) of
-            debug -> { 0, 0, << 0:256 >> };
-            prod -> hb_client:arweave_timestamp()
-        end,
+    TS = hb_client:arweave_timestamp(),
     TSServer ! {refresh, TS},
     refresher(TSServer).
\ No newline at end of file
diff --git a/src/ar_tx.erl b/src/ar_tx.erl
index befb58060..7269c0107 100644
--- a/src/ar_tx.erl
+++ b/src/ar_tx.erl
@@ -14,7 +14,7 @@
 new(Dest, Reward, Qty, Last) ->
     #tx{
         id = crypto:strong_rand_bytes(32),
-        last_tx = Last,
+        anchor = Last,
         quantity = Qty,
         target = Dest,
         data = <<>>,
@@ -25,7 +25,7 @@ new(Dest, Reward, Qty, Last) ->
 new(Dest, Reward, Qty, Last, SigType) ->
     #tx{
         id = crypto:strong_rand_bytes(32),
-        last_tx = Last,
+        anchor = Last,
         quantity = Qty,
         target = Dest,
         data = <<>>,
@@ -61,7 +61,7 @@ signature_data_segment(TX) ->
         << (TX#tx.target)/binary >>,
         << (list_to_binary(integer_to_list(TX#tx.quantity)))/binary >>,
         << (list_to_binary(integer_to_list(TX#tx.reward)))/binary >>,
-        << (TX#tx.last_tx)/binary >>,
+        << (TX#tx.anchor)/binary >>,
         << (integer_to_binary(TX#tx.data_size))/binary >>,
         << (TX#tx.data_root)/binary >>
     ],
@@ -131,7 +131,7 @@ json_struct_to_tx(TXStruct) ->
     #tx{
         format = Format,
         id = TXID,
-        last_tx = hb_util:decode(hb_util:find_value(<<"last_tx">>, TXStruct)),
+        anchor = hb_util:decode(hb_util:find_value(<<"anchor">>, TXStruct)),
         owner = hb_util:decode(hb_util:find_value(<<"owner">>, TXStruct)),
         tags = [{hb_util:decode(Name), hb_util:decode(Value)}
                 %% Only the elements matching this pattern are included in the list.
@@ -154,7 +154,7 @@ tx_to_json_struct(
     #tx{
         id = ID,
         format = Format,
-        last_tx = Last,
+        anchor = Anchor,
         owner = Owner,
         tags = Tags,
         target = Target,
@@ -175,7 +175,7 @@ tx_to_json_struct(
                     Format
             end},
         {id, hb_util:encode(ID)},
-        {last_tx, hb_util:encode(Last)},
+        {anchor, hb_util:encode(Anchor)},
         {owner, hb_util:encode(Owner)},
         {tags,
             lists:map(
@@ -206,4 +206,4 @@ tx_to_json_struct(
             false ->
                 Fields
         end,
-    maps:from_list(Fields2).
\ No newline at end of file
+    hb_maps:from_list(Fields2).
\ No newline at end of file
diff --git a/src/ar_wallet.erl b/src/ar_wallet.erl
index bf4304bec..4bff3d6f7 100644
--- a/src/ar_wallet.erl
+++ b/src/ar_wallet.erl
@@ -1,6 +1,8 @@
 -module(ar_wallet).
--export([sign/2, sign/3, hmac/1, hmac/2, verify/3, verify/4, to_address/1, to_address/2, new/0, new/1]).
--export([new_keyfile/2, load_keyfile/1, load_key/1]).
+-export([sign/2, sign/3, hmac/1, hmac/2, verify/3, verify/4]).
+-export([to_pubkey/1, to_pubkey/2, to_address/1, to_address/2, new/0, new/1]).
+-export([new_keyfile/2, load_keyfile/1, load_keyfile/2, load_key/1, load_key/2]).
+-export([to_json/1, from_json/1, from_json/2]).
 -include("include/ar.hrl").
 -include_lib("public_key/include/public_key.hrl").
 
@@ -17,6 +19,7 @@ new(KeyType = {KeyAlg, PublicExpnt}) when KeyType =:= {rsa, 65537} ->
         = crypto:generate_key(KeyAlg, {4096, PublicExpnt}),
     {{KeyType, Priv, Pub}, {KeyType, Pub}}.
 
+
 %% @doc Sign some data with a private key.
 sign(Key, Data) ->
     sign(Key, Data, sha256).
@@ -32,7 +35,9 @@ sign({{rsa, PublicExpnt}, Priv, Pub}, Data, DigestType) when PublicExpnt =:= 655
             modulus = binary:decode_unsigned(Pub),
             privateExponent = binary:decode_unsigned(Priv)
         }
-    ).
+    );
+sign({{KeyType, Priv, Pub}, {KeyType, Pub}}, Data, DigestType) ->
+    sign({KeyType, Priv, Pub}, Data, DigestType).
 
 hmac(Data) ->
     hmac(Data, sha256).
@@ -54,12 +59,22 @@ verify({{rsa, PublicExpnt}, Pub}, Data, Sig, DigestType) when PublicExpnt =:= 65
         }
     ).
 
+%% @doc Find a public key from a wallet.
+to_pubkey(Pubkey) ->
+    to_pubkey(Pubkey, ?DEFAULT_KEY_TYPE).
+to_pubkey(PubKey, {rsa, 65537}) when bit_size(PubKey) == 256 ->
+    % Small keys are not secure, nobody is using them, the clause
+    % is for backwards-compatibility.
+    PubKey;
+to_pubkey({{_, _, PubKey}, {_, PubKey}}, {rsa, 65537}) ->
+    PubKey;
+to_pubkey(PubKey, {rsa, 65537}) ->
+    PubKey.
+
 %% @doc Generate an address from a public key.
 to_address(Pubkey) ->
     to_address(Pubkey, ?DEFAULT_KEY_TYPE).
-to_address(PubKey, _) when bit_size(PubKey) == 256 ->
-    %% Small keys are not secure, nobody is using them, the clause
-    %% is for backwards-compatibility.
+to_address(PubKey, {rsa, 65537}) when bit_size(PubKey) == 256 ->
     PubKey;
 to_address({{_, _, PubKey}, {_, PubKey}}, _) ->
     to_address(PubKey);
@@ -78,50 +93,19 @@ new_keyfile(KeyType, WalletName) ->
             {?RSA_SIGN_ALG, PublicExpnt} ->
                 {[Expnt, Pb], [Expnt, Pb, Prv, P1, P2, E1, E2, C]} =
                     crypto:generate_key(rsa, {?RSA_PRIV_KEY_SZ, PublicExpnt}),
-                Ky =
-                    hb_json:encode(
-                        #{
-                            kty => <<"RSA">>,
-                            ext => true,
-                            e => hb_util:encode(Expnt),
-                            n => hb_util:encode(Pb),
-                            d => hb_util:encode(Prv),
-                            p => hb_util:encode(P1),
-                            q => hb_util:encode(P2),
-                            dp => hb_util:encode(E1),
-                            dq => hb_util:encode(E2),
-                            qi => hb_util:encode(C)
-                        }
-                    ),
+                PrivKey = {KeyType, Prv, Pb},
+                Ky = to_json(PrivKey),
                 {Pb, Prv, Ky};
             {?ECDSA_SIGN_ALG, secp256k1} ->
                 {OrigPub, Prv} = crypto:generate_key(ecdh, secp256k1),
-                <<4:8, PubPoint/binary>> = OrigPub,
-                PubPointMid = byte_size(PubPoint) div 2,
-                <<X:PubPointMid/binary, Y:PubPointMid/binary>> = PubPoint,
-                Ky =
-                    hb_json:encode(
-                        #{
-                            kty => <<"EC">>,
-                            crv => <<"secp256k1">>,
-                            x => hb_util:encode(X),
-                            y => hb_util:encode(Y),
-                            d => hb_util:encode(Prv)
-                        }
-                    ),
-                {compress_ecdsa_pubkey(OrigPub), Prv, Ky};
+                CompressedPub = compress_ecdsa_pubkey(OrigPub),
+                PrivKey = {KeyType, Prv, CompressedPub},
+                Ky = to_json(PrivKey),
+                {CompressedPub, Prv, Ky};
             {?EDDSA_SIGN_ALG, ed25519} ->
                 {{_, Prv, Pb}, _} = new(KeyType),
-                Ky =
-                    hb_json:encode(
-                        #{
-                            kty => <<"OKP">>,
-                            alg => <<"EdDSA">>,
-                            crv => <<"Ed25519">>,
-                            x => hb_util:encode(Pb),
-                            d => hb_util:encode(Prv)
-                        }
-                    ),
+                PrivKey = {KeyType, Prv, Pb},
+                Ky = to_json(PrivKey),
                 {Pb, Prv, Ky}
         end,
     Filename = wallet_filepath(WalletName, Pub, KeyType),
@@ -139,6 +123,12 @@ wallet_filepath2(Wallet) ->
 %% Return not_found if arweave_keyfile_[addr].json or [addr].json is not found
 %% in [data_dir]/?WALLET_DIR.
 load_key(Addr) ->
+    load_key(Addr, #{}).
+
+%% @doc Read the keyfile for the key with the given address from disk.
+%% Return not_found if arweave_keyfile_[addr].json or [addr].json is not found
+%% in [data_dir]/?WALLET_DIR.
+load_key(Addr, Opts) ->
     Path = hb_util:encode(Addr),
     case filelib:is_file(Path) of
         false ->
@@ -147,22 +137,63 @@ load_key(Addr) ->
                 false ->
                     not_found;
                 true ->
-                    load_keyfile(Path2)
+                    load_keyfile(Path2, Opts)
             end;
         true ->
-            load_keyfile(Path)
+            load_keyfile(Path, Opts)
     end.
 
 %% @doc Extract the public and private key from a keyfile.
 load_keyfile(File) ->
+    load_keyfile(File, #{}).
+
+%% @doc Extract the public and private key from a keyfile.
+load_keyfile(File, Opts) ->
     {ok, Body} = file:read_file(File),
-    Key = hb_json:decode(Body),
+    from_json(Body, Opts).
+
+%% @doc Convert a wallet private key to JSON (JWK) format
+to_json({PrivKey, _PubKey}) ->
+    to_json(PrivKey);
+to_json({{?RSA_SIGN_ALG, PublicExpnt}, Priv, Pub}) when PublicExpnt =:= 65537 ->
+    hb_json:encode(#{
+        kty => <<"RSA">>,
+        ext => true,
+        e => hb_util:encode(<<PublicExpnt:32>>),
+        n => hb_util:encode(Pub),
+        d => hb_util:encode(Priv)
+    });
+to_json({{?ECDSA_SIGN_ALG, secp256k1}, Priv, CompressedPub}) ->
+    % For ECDSA, we need to expand the compressed pubkey to get X,Y coordinates
+    % This is a simplified version - ideally we'd implement pubkey expansion
+    hb_json:encode(#{
+        kty => <<"EC">>,
+        crv => <<"secp256k1">>,
+        d => hb_util:encode(Priv)
+        % TODO: Add x and y coordinates from expanded pubkey
+    });
+to_json({{?EDDSA_SIGN_ALG, ed25519}, Priv, Pub}) ->
+    hb_json:encode(#{
+        kty => <<"OKP">>,
+        alg => <<"EdDSA">>,
+        crv => <<"Ed25519">>,
+        x => hb_util:encode(Pub),
+        d => hb_util:encode(Priv)
+    }).
+
+%% @doc Parse a wallet from JSON (JWK) format
+from_json(JsonBinary) ->
+    from_json(JsonBinary, #{}).
+
+%% @doc Parse a wallet from JSON (JWK) format with options
+from_json(JsonBinary, Opts) ->
+    Key = hb_json:decode(JsonBinary),
     {Pub, Priv, KeyType} =
-        case maps:get(<<"kty">>, Key) of
+        case hb_maps:get(<<"kty">>, Key, undefined, Opts) of
             <<"EC">> ->
-                XEncoded = maps:get(<<"x">>, Key),
-                YEncoded = maps:get(<<"y">>, Key),
-                PrivEncoded = maps:get(<<"d">>, Key),
+                XEncoded = hb_maps:get(<<"x">>, Key, undefined, Opts),
+                YEncoded = hb_maps:get(<<"y">>, Key, undefined, Opts),
+                PrivEncoded = hb_maps:get(<<"d">>, Key, undefined, Opts),
                 OrigPub = iolist_to_binary([<<4:8>>, hb_util:decode(XEncoded),
                         hb_util:decode(YEncoded)]),
                 Pb = compress_ecdsa_pubkey(OrigPub),
@@ -170,15 +201,15 @@ load_keyfile(File) ->
                 KyType = {?ECDSA_SIGN_ALG, secp256k1},
                 {Pb, Prv, KyType};
             <<"OKP">> ->
-                PubEncoded = maps:get(<<"x">>, Key),
-                PrivEncoded = maps:get(<<"d">>, Key),
+                PubEncoded = hb_maps:get(<<"x">>, Key, undefined, Opts),
+                PrivEncoded = hb_maps:get(<<"d">>, Key, undefined, Opts),
                 Pb = hb_util:decode(PubEncoded),
                 Prv = hb_util:decode(PrivEncoded),
                 KyType = {?EDDSA_SIGN_ALG, ed25519},
                 {Pb, Prv, KyType};
             _ ->
-                PubEncoded = maps:get(<<"n">>, Key),
-                PrivEncoded = maps:get(<<"d">>, Key),
+                PubEncoded = hb_maps:get(<<"n">>, Key, undefined, Opts),
+                PrivEncoded = hb_maps:get(<<"d">>, Key, undefined, Opts),
                 Pb = hb_util:decode(PubEncoded),
                 Prv = hb_util:decode(PrivEncoded),
                 KyType = {?RSA_SIGN_ALG, 65537},
diff --git a/src/dev_apply.erl b/src/dev_apply.erl
new file mode 100644
index 000000000..d3fd3d8dd
--- /dev/null
+++ b/src/dev_apply.erl
@@ -0,0 +1,287 @@
+%%% @doc A device that executes AO resolutions. It can be passed a key that
+%%% refers to a path stored in the base message to execute upon the base or
+%%% message referenced by the `source' key.
+%%%
+%%% Alternatively, a `base' and `request' pair can be passed to execute
+%%% together via invoking the `pair' key.
+%%%
+%%% When given a message with a `base' and `request' key, the default handler
+%%% will invoke `pair' upon it, setting the `path' in the resulting request to
+%%% the key that `apply' was invoked with.
+%%% 
+%%% Paths found in keys interpreted by this device can contain a `base:' or
+%%% `request:' prefix to indicate the message from which the path should be
+%%% retrieved. If no such prefix is present, the `Request' message is checked
+%%% first, and the `Base' message is checked second.
+-module(dev_apply).
+-export([info/1, pair/3, default/4]).
+-include_lib("eunit/include/eunit.hrl").
+-include("include/hb.hrl").
+
+%% @doc The device info. Forwards all keys aside `pair', `keys' and `set' are
+%% resolved with the `apply/4' function.
+info(_) ->
+    #{
+        excludes => [<<"keys">>, <<"set">>, <<"set_path">>, <<"remove">>],
+        default => fun default/4
+    }.
+
+%% @doc The default handler. If the `base' and `request' keys are present in
+%% the given request, then the `pair' function is called. Otherwise, the `eval'
+%% key is used to resolve the request.
+default(Key, Base, Request, Opts) ->
+    ?event(debug_apply, {req, {key, Key}, {base, Base}, {request, Request}}),
+    FoundBase = hb_maps:get(<<"base">>, Request, not_found, Opts),
+    FoundRequest = hb_maps:get(<<"request">>, Request, not_found, Opts),
+    case {FoundBase, FoundRequest} of
+        {B, R} when B =/= not_found andalso R =/= not_found ->
+            pair(Key, Base, Request, Opts);
+        _ ->
+            eval(Base, Request#{ <<"apply-path">> => Key }, Opts)
+    end.
+
+%% @doc Apply a request. We source the `base' message for the request either
+%% from the `source' key if it is present, or we assume that the entire base
+%% should be used. After sourcing the base, we resolve the `apply-path' on top
+%% of it as a singleton message, if it is present in the request.
+eval(Base, Request, Opts) ->
+    maybe
+        ?event({eval, {base, Base}, {request, Request}}),
+        {ok, ApplyBase} ?=
+            case find_path(<<"source">>, Base, Request, Opts) of
+                {ok, SourcePath} ->
+                    find_key(SourcePath, Base, Request, Opts);
+                {error, path_not_found, _} ->
+                    % If the base is not found, we return the base for this 
+                    % request, minus the device (which will, inherently, be
+                    % `apply@1.0' and cause recursion).
+                    {ok, hb_maps:without([<<"device">>], Base, Opts)}
+            end,
+        ?event({eval, {apply_base, ApplyBase}}),
+        case find_path(<<"apply-path">>, Base, Request, Opts) of
+            {error, path_not_found, _} ->
+                ?event({eval, no_path_to_execute}),
+                {ok, ApplyBase};
+            {ok, ApplyPathKey} ->
+                ?event({eval, {key_containing_path_to_execute, ApplyPathKey}}),
+                case find_key(ApplyPathKey, ApplyBase, Request, Opts) of
+                    {error, _, _} ->
+                        ?event({eval, path_to_execute_not_found}),
+                        {error,
+                            <<
+                                "Path `",
+                                (normalize_path(ApplyPathKey))/binary,
+                                "` to execute not found."
+                            >>
+                        };
+                    {ok, ApplyPath} ->
+                        ApplyMsg = ApplyBase#{ <<"path">> => ApplyPath },
+                        ?event({executing, ApplyMsg}),
+                        hb_ao:resolve(ApplyMsg, Opts)
+                end
+        end
+    else
+        Error -> error_to_message(Error)
+    end.
+
+%% @doc Apply the message found at `request' to the message found at `base'.
+pair(Base, Request, Opts) ->
+    pair(<<"undefined">>, Base, Request, Opts).
+pair(PathToSet, Base, Request, Opts) ->
+    maybe
+        {ok, RequestPath} ?= find_path(<<"request">>, Base, Request, Opts),
+        {ok, BasePath} ?= find_path(<<"base">>, Base, Request, Opts),
+        ?event({eval_pair, {base_source, BasePath}, {request_source, RequestPath}}),
+        {ok, RequestSource} ?= find_key(RequestPath, Base, Request, Opts),
+        {ok, BaseSource} ?= find_key(BasePath, Base, Request, Opts),
+        PreparedRequest =
+            case PathToSet of
+                <<"undefined">> -> RequestSource;
+                _ -> RequestSource#{ <<"path">> => PathToSet }
+            end,
+        ?event({eval_pair, {base, BaseSource}, {request, PreparedRequest}}),
+        hb_ao:resolve(BaseSource, PreparedRequest, Opts)
+    else
+        Error -> error_to_message(Error)
+    end.
+
+%% @doc Resolve the given path on the message as `message@1.0'.
+find_path(Path, Base, Request, Opts) ->
+    Res =
+        hb_ao:get_first(
+            [
+                {{as, <<"message@1.0">>, Request}, Path},
+                {{as, <<"message@1.0">>, Base}, Path}
+            ],
+            path_not_found,
+            Opts
+        ),
+    case Res of
+        path_not_found -> {error, path_not_found, Path};
+        Value -> {ok, Value}
+    end.
+
+%% @doc Find the value of the source key, supporting `base:' and `request:'
+%% prefixes.
+find_key(Path, Base, Request, Opts) ->
+    BaseAs = {as, <<"message@1.0">>, Base},
+    RequestAs = {as, <<"message@1.0">>, Request},
+    MaybeResolve =
+        case hb_path:term_to_path_parts(Path) of
+            [BinKey|RestKeys] ->
+                case binary:split(BinKey, <<":">>) of
+                    [<<"base">>, <<"">>] ->
+                        {message, Base};
+                    [<<"request">>, <<"">>] ->
+                        {message, Request};
+                    [<<"base">>, Key] ->
+                        {resolve, [{BaseAs, normalize_path([Key|RestKeys])}]};
+                    [Req, Key] when Req == <<"request">> orelse Req == <<"req">> ->
+                        {resolve, [{RequestAs, normalize_path([Key|RestKeys])}]};
+                    [_] ->
+                        {resolve, [
+                            {RequestAs, normalize_path(Path)},
+                            {BaseAs, normalize_path(Path)}
+                        ]}
+                end;
+            _ -> {error, invalid_path, Path}
+        end,
+    case MaybeResolve of
+        Err = {error, _, _} -> Err;
+        {message, Message} -> {ok, Message};
+        {resolve, Sources} ->
+            ?event(
+                {resolving_from_sources,
+                    {path, Path},
+                    {sources, Sources}
+                }
+            ),
+            case hb_ao:get_first(Sources, source_not_found, Opts) of
+                source_not_found -> {error, source_not_found, Path};
+                Source -> {ok, Source}
+            end
+    end.
+
+%% @doc Normalize the path.
+normalize_path(Path) ->
+    case hb_path:to_binary(Path) of
+        <<"">> -> <<"/">>;
+        P -> P
+    end.
+
+%% @doc Convert an error to a message.
+error_to_message({error, invalid_path, ErrPath}) ->
+    {error, #{
+        <<"body">> =>
+            <<"Path `", (normalize_path(ErrPath))/binary, "` is invalid.">>
+    }};
+error_to_message({error, source_not_found, ErrPath}) ->
+    {error, #{
+        <<"body">> =>
+            <<
+                "Source path `",
+                (normalize_path(ErrPath))/binary,
+                "` to apply not found."
+            >>
+    }};
+error_to_message({error, path_not_found, ErrPath}) ->
+    {error, #{
+        <<"body">> =>
+            <<
+                "Path `",
+                (normalize_path(ErrPath))/binary,
+                "` to apply not found."
+            >>
+    }};
+error_to_message(Error) ->
+    Error.
+
+%%% Tests
+
+resolve_key_test() ->
+    hb:init(),
+    Base = #{
+        <<"device">> => <<"apply@1.0">>,
+        <<"body">> => <<"/~meta@1.0/build/node">>,
+        <<"irrelevant">> => <<"irrelevant">>
+    },
+    Request = #{
+        <<"irrelevant2">> => <<"irrelevant2">>,
+        <<"path">> => <<"body">>
+    },
+    ?assertEqual({ok, <<"HyperBEAM">>}, hb_ao:resolve(Base, Request, #{})).
+
+resolve_pair_test() ->
+    Base = #{
+        <<"device">> => <<"apply@1.0">>,
+        <<"data-container">> => #{ <<"relevant">> => <<"DATA">> },
+        <<"base">> => <<"data-container">>,
+        <<"irrelevant">> => <<"irrelevant">>
+    },
+    Request = #{
+        <<"irrelevant2">> => <<"irrelevant2">>,
+        <<"data-path">> => <<"relevant">>,
+        <<"request">> => <<"data-path">>,
+        <<"path">> => <<"pair">>
+    },
+    ?assertEqual({ok, <<"DATA">>}, hb_ao:resolve(Base, Request, #{})).
+
+reverse_resolve_pair_test() ->
+    ?assertEqual(
+        {ok, <<"TEST">>},
+        hb_ao:resolve(
+            <<
+                "/~meta@1.0/build",
+                "/node~apply@1.0&node=TEST&base=request:&request=base:"
+            >>,
+            #{}
+        )
+    ).
+
+resolve_with_prefix_test() ->
+    ShortTraceLen = hb_opts:get(short_trace_len),
+    Node = hb_http_server:start_node(),
+    ?assertEqual(
+        {ok, ShortTraceLen},
+        hb_http:request(
+            <<"GET">>,
+            Node,
+            <<"/~meta@1.0/info/request:debug-info~apply@1.0">>,
+            #{
+                <<"debug-info">> => <<"short_trace_len">>
+            },
+            #{}
+        )
+    ).
+
+apply_over_http_test() ->
+    Node = hb_http_server:start_node(),
+    Signed =
+        hb_message:commit(
+            #{
+                <<"device">> => <<"apply@1.0">>,
+                <<"user-path">> => <<"/user-request/test-key">>,
+                <<"user-request">> =>
+                    #{
+                        <<"test-key">> => <<"DATA">>
+                    }
+            },
+            #{ priv_wallet => hb:wallet() }
+        ),
+    ?assertEqual(
+        {ok, <<"DATA">>},
+        hb_ao:resolve(
+            Signed#{ <<"path">> => <<"/user-path">> },
+            #{ priv_wallet => hb:wallet() }
+        )
+    ),
+    ?assertEqual(
+        {ok, <<"DATA">>},
+        hb_http:request(
+            <<"GET">>,
+            Node,
+            <<"/user-path">>,
+            Signed,
+            #{ priv_wallet => hb:wallet() }
+        )
+    ).
diff --git a/src/dev_arweave.erl b/src/dev_arweave.erl
new file mode 100644
index 000000000..704937f1e
--- /dev/null
+++ b/src/dev_arweave.erl
@@ -0,0 +1,289 @@
+%%% @doc A device that provides access to Arweave network information, relayed
+%%% from a designated node.
+%%%
+%%% The node(s) that are used to query data may be configured by altering the
+%%% `/arweave` route in the node's configuration message.
+-module(dev_arweave).
+-export([tx/3, block/3, current/3, status/3]).
+-include("include/hb.hrl").
+-include_lib("eunit/include/eunit.hrl").
+
+%% @doc Proxy the `/info' endpoint from the Arweave node.
+status(_Base, _Request, Opts) ->
+    request(<<"GET">>, <<"/info">>, Opts).
+
+%% @doc Returns the given transaction, if known to the client node(s), as an
+%% AO-Core message.
+tx(Base, Request, Opts) ->
+    case hb_maps:get(<<"method">>, Request, <<"GET">>, Opts) of
+        <<"POST">> -> post_tx(Base, Request, Opts);
+        <<"GET">> -> get_tx(Base, Request, Opts)
+    end.
+
+%% @doc Upload a transaction to Arweave, using the node's default bundler (see
+%% `hb_client:upload/2' for more details). Ensures that uploaded transactions are
+%% stored in the local cache after a successful response has been received.
+post_tx(_Base, Request, Opts) ->
+    case hb_client:upload(Request, Opts) of
+        Res = {ok, _} ->
+            ?event(arweave, {uploaded, Request}),
+            CacheRes = hb_cache:write(Request, Opts),
+            ?event(arweave,
+                {cache_uploaded_message,
+                    {msg, Request},
+                    {status,
+                        case CacheRes of {ok, _} -> ok;
+                        _ -> failed
+                        end
+                    }
+                }
+            ),
+            Res;
+        Res ->
+            Res
+    end.
+
+%% @doc Get a transaction ID from the Arweave node, as indicated by the `tx` key
+%% in the request or base message. If the `data' key is present and set to
+%% `false', the data is not retrieved and added to the response. If the `data'
+%% key is set to `always', transactions for which the header is available but
+%% the data is not will lead to an error. Otherwise, just the header will be
+%% returned.
+get_tx(Base, Request, Opts) ->
+    case find_txid(Base, Request, Opts) of
+        not_found -> {error, not_found};
+        TXID ->
+            case request(<<"GET">>, <<"/tx/", TXID/binary>>, Opts) of
+                {ok, TXHeader} ->
+                    ?event(arweave, {retrieved_tx_header, {tx, TXID}}),
+                    maybe_add_data(TXID, TXHeader, Base, Request, Opts);
+                Other -> Other
+            end
+    end.
+
+%% @doc Handle the optional adding of data to the transaction header, depending
+%% on the request. Semantics of the `data' key are described in the `get_tx/3'
+%% documentation.
+maybe_add_data(TXID, Header, Base, Request, Opts) ->
+    GetData =
+        hb_util:atom(hb_ao:get_first(
+            [
+                {Request, <<"data">>},
+                {Base, <<"data">>}
+            ],
+            true,
+            Opts
+        )),
+    case hb_util:atom(GetData) of
+        false ->
+            {ok, Header};
+        _ ->
+            case data(Base, Request, Opts) of
+                {ok, Data} ->
+                    FullMessage = Header#{ <<"data">> => Data },
+                    ?event(
+                        arweave,
+                        {retrieved_tx_with_data,
+                            {id, TXID},
+                            {data_size, byte_size(Data)},
+                            {message, FullMessage}
+                        }
+                    ),
+                    {ok, FullMessage};
+                {error, Reason} ->
+                    ?event(arweave,
+                        {data_retrieval_failed_after_header,
+                            {id, TXID},
+                            {error, Reason}
+                        }
+                    ),
+                    if GetData =/= always -> {ok, Header};
+                    true -> {error, Reason}
+                    end
+            end
+    end.
+
+%% @doc Retrieve the data of a transaction from Arweave.
+data(Base, Request, Opts) ->
+    case find_txid(Base, Request, Opts) of
+        not_found -> {error, not_found};
+        TXID ->
+            ?event(arweave, {retrieving_tx_data, {tx, TXID}}),
+            request(<<"GET">>, <<"/raw/", TXID/binary>>, Opts)
+    end.
+
+%% @doc Retrieve (and cache) block information from Arweave. If the `block' key
+%% is present, it is used to look up the associated block. If it is of Arweave
+%% block hash length (43 characters), it is used as an ID. If it is parsable as
+%% an integer, it is used as a block height. If it is not present, the current
+%% block is used.
+block(Base, Request, Opts) ->
+    Block =
+        hb_ao:get_first(
+            [
+                {Request, <<"block">>},
+                {Base, <<"block">>}
+            ],
+            not_found,
+            Opts
+        ),
+    case Block of
+        <<"current">> -> current(Base, Request, Opts);
+        not_found -> current(Base, Request, Opts);
+        ID when ?IS_ID(ID) -> block({id, ID}, Opts);
+        MaybeHeight ->
+            try hb_util:int(MaybeHeight) of
+              Int -> block({height, Int}, Opts)
+            catch
+                _:_ ->
+                    {
+                        error,
+                        <<"Invalid block reference `", MaybeHeight/binary, "`">>
+                    }
+            end
+    end.
+block({id, ID}, Opts) ->
+    case hb_cache:read(ID, Opts) of
+        {ok, Block} ->
+            ?event(arweave, {retrieved_block_from_cache, {id, ID}}),
+            {ok, Block};
+        not_found ->
+            request(<<"GET">>, <<"/block/hash/", ID/binary>>, Opts)
+    end;
+block({height, Height}, Opts) ->
+    case dev_arweave_block_cache:read(Height, Opts) of
+        {ok, Block} ->
+            ?event(arweave, {retrieved_block_from_cache, {height, Height}}),
+            {ok, Block};
+        not_found ->
+            request(
+                <<"GET">>,
+                <<"/block/height/", (hb_util:bin(Height))/binary>>,
+                Opts
+            )
+    end.
+
+%% @doc Retrieve the current block information from Arweave.
+current(_Base, _Request, Opts) ->
+    request(<<"GET">>, <<"/block/current">>, Opts).
+
+%%% Internal Functions
+
+%% @doc Find the transaction ID to retrieve from Arweave based on the request or
+%% base message.
+find_txid(Base, Request, Opts) ->
+    hb_ao:get_first(
+        [
+            {Request, <<"tx">>},
+            {Base, <<"tx">>}
+        ],
+        not_found,
+        Opts
+    ).
+
+%% @doc Make a request to the Arweave node and parse the response into an
+%% AO-Core message. Most Arweave API responses are in JSON format, but without
+%% a `content-type' header. Subsequently, we parse the response manually and
+%% pass it back as a message.
+request(Method, Path, Opts) ->
+    ?event(arweave, {arweave_request, {method, Method}, {path, Path}}),
+    Res =
+        hb_http:request(
+            #{
+                <<"path">> => <<"/arweave", Path/binary>>,
+                <<"method">> => Method
+            },
+            Opts
+        ),
+    to_message(Path, Res, Opts).
+
+%% @doc Transform a response from the Arweave node into an AO-Core message.
+to_message(Path = <<"/raw/", _/binary>>, {ok, #{ <<"body">> := Body }}, _Opts) ->
+    ?event(arweave,
+        {arweave_raw_response,
+            {path, Path},
+            {data_size, byte_size(Body)}
+        }
+    ),
+    {ok, Body};
+to_message(Path = <<"/block/", _/binary>>, {ok, #{ <<"body">> := Body }}, Opts) ->
+    Block = hb_message:convert(Body, <<"structured@1.0">>, <<"json@1.0">>, Opts),
+    ?event(arweave,
+        {arweave_block_response,
+            {path, Path},
+            {block, Block}
+        }
+    ),
+    CacheRes = dev_arweave_block_cache:write(Block, Opts),
+    ?event(arweave,
+        {cached_arweave_block,
+            {path, Path},
+            {result, CacheRes}
+        }
+    ),
+    {ok, Block};
+to_message(Path, {ok, #{ <<"body">> := Body }}, Opts) ->
+    % All other responses that are `OK' status are converted from JSON to an
+    % AO-Core message.
+    ?event(arweave,
+        {arweave_json_response,
+            {path, Path},
+            {body_size, byte_size(Body)}
+        }
+    ),
+    {
+        ok,
+        hb_message:convert(
+            Body,
+            <<"structured@1.0">>,
+            <<"json@1.0">>,
+            Opts
+        )
+    }.
+
+%%% Tests
+
+post_ans104_tx_test() ->
+    ServerOpts = #{ store => [hb_test_utils:test_store()] },
+    Server = hb_http_server:start_node(ServerOpts),
+    ClientOpts =
+        #{
+            store => [hb_test_utils:test_store()],
+            priv_wallet => hb:wallet()
+        },
+    Msg =
+        hb_message:commit(
+            #{
+                <<"variant">> => <<"ao.N.1">>,
+                <<"type">> => <<"Process">>,
+                <<"data">> => <<"test-data">>
+            },
+            ClientOpts,
+            #{ <<"commitment-device">> => <<"ans104@1.0">> }
+        ),
+    {ok, PostRes} =
+        hb_http:post(
+            Server,
+            Msg#{
+                <<"path">> => <<"/~arweave@2.9-pre/tx">>,
+                <<"codec-device">> => <<"ans104@1.0">>
+            },
+            ClientOpts
+        ),
+    ?assertMatch(#{ <<"status">> := 200 }, PostRes),
+    SignedID = hb_message:id(Msg, signed, ClientOpts),
+    {ok, GetRes} =
+        hb_http:get(
+            Server, <<"/", SignedID/binary>>,
+            ClientOpts
+        ),
+    ?assertMatch(
+        #{
+            <<"status">> := 200,
+            <<"variant">> := <<"ao.N.1">>,
+            <<"type">> := <<"Process">>,
+            <<"data">> := <<"test-data">>
+        },
+        GetRes
+    ),
+    ok.
\ No newline at end of file
diff --git a/src/dev_arweave_block_cache.erl b/src/dev_arweave_block_cache.erl
new file mode 100644
index 000000000..4d20cb764
--- /dev/null
+++ b/src/dev_arweave_block_cache.erl
@@ -0,0 +1,66 @@
+%%% @doc A module that performs caching operations for the Arweave device, 
+%%% focused on ensuring that block metadata is queriable via pseudo-paths.
+-module(dev_arweave_block_cache).
+-export([latest/1, heights/1, read/2, write/2]).
+-export([path/2]).
+-include("include/hb.hrl").
+-include_lib("eunit/include/eunit.hrl").
+
+%% @doc The pseudo-path prefix which the Arweave block cache should use.
+-define(ARWEAVE_BLOCK_CACHE_PREFIX, <<"~arweave@2.9">>).
+
+%% @doc Get the latest block from the cache.
+latest(Opts) ->
+    case heights(Opts) of
+        {ok, []} ->
+            ?event(arweave_cache, no_blocks_in_cache),
+            not_found;
+        {ok, Blocks} ->
+            Latest = lists:max(Blocks),
+            ?event(arweave_cache, {latest_block_from_cache, {latest, Latest}}),
+            {ok, Latest}
+    end.
+
+%% @doc Get the list of blocks from the cache.
+heights(Opts) ->
+    AllBlocks =
+        hb_cache:list_numbered(
+            hb_store:path(hb_opts:get(store, no_viable_store, Opts), [
+                ?ARWEAVE_BLOCK_CACHE_PREFIX,
+                <<"block">>,
+                <<"height">>
+            ]),
+            Opts
+        ),
+    ?event(arweave_cache, {listed_blocks, length(AllBlocks)}),
+    {ok, AllBlocks}.
+
+%% @doc Read a block from the cache.
+read(Block, Opts) ->
+    Res = hb_cache:read(path(Block, Opts), Opts),
+    ?event(arweave_cache, {read_block, {reference, Block}, {result, Res}}),
+    Res.
+
+%% @doc Return the path of a block that will be used in the cache.
+path(Block, Opts) when is_integer(Block) ->
+    hb_store:path(hb_opts:get(store, no_viable_store, Opts), [
+        ?ARWEAVE_BLOCK_CACHE_PREFIX,
+        <<"block">>,
+        <<"height">>,
+        hb_util:bin(Block)
+    ]).
+
+%% @doc Write a block to the cache and create pseudo-paths for it.
+write(Block, Opts) ->
+    {ok, Height} = hb_maps:find(<<"height">>, Block, Opts),
+    {ok, BlockID} = hb_maps:find(<<"indep_hash">>, Block, Opts),
+    {ok, BlockHash} = hb_maps:find(<<"hash">>, Block, Opts),
+    {ok, MsgID} = hb_cache:write(Block, Opts),
+    % Link the independent hash and the dependent hash to the written AO-Core
+    % message ID.
+    hb_cache:link(MsgID, BlockID, Opts),
+    hb_cache:link(MsgID, BlockHash, Opts),
+    % Link the block height pseudo-path to the message.
+    hb_cache:link(MsgID, path(Height, Opts), Opts),
+    ?event(arweave_cache, {wrote_block, {height, Height}, {message_id, MsgID}}),
+    {ok, MsgID}.
\ No newline at end of file
diff --git a/src/dev_auth_hook.erl b/src/dev_auth_hook.erl
new file mode 100644
index 000000000..9436aa734
--- /dev/null
+++ b/src/dev_auth_hook.erl
@@ -0,0 +1,703 @@
+%%% @doc A device offering an on-request hook that signs incoming messages with
+%%% node-hosted wallets, in accordance with the node operator's configuration.
+%%% It is intended for deployment in environments where a node's users have
+%%% intrinsic reasons for trusting the node outside of the scope of this device.
+%%% For example, if executed on a node running in a Trusted Execution Environment
+%%% with `~snp@1.0', or a node they operate or is operated by a trusted
+%%% third-party.
+%%% 
+%%% This device utilizes the `generator' interface type which other devices may
+%%% implement. The generator is used to find/create a secret based on a user's
+%%% request, which is then passed to the `~proxy-wallet@1.0' device and matched
+%%% with a wallet which is used to sign the request. The `generator' interface
+%%% may implement the following keys:
+%%% 
+%%% <pre>
+%%%     `generate' (optional): A key that generates a secret based on a
+%%%                            user's request. May return either the secret
+%%%                            directly, or a message with a `secret' key. If 
+%%%                            a message is returned, it is assumed to be a
+%%%                            modified version of the user's request and is
+%%%                            used for further processing.
+%%%     `finalize' (optional): A key that takes the message sequence after this
+%%%                            device has processed it and returns it in a
+%%%                            modified form.
+%%% </pre>
+%%% 
+%%% At present, the `~cookie-secret@1.0' and `~http-auth@1.0' devices implement
+%%% the `generator' interface. For example, the following hook definition will
+%%% use the `~cookie-secret@1.0' device to generate and manage wallets for
+%%% users, with authentication details stored in cookies:
+%%% 
+%%% <pre>
+%%%   "on": {
+%%%     "request": {
+%%%       "device": "auth-hook@1.0",
+%%%       "secret-provider": {
+%%%         "device": "cookie-secret@1.0"
+%%%       }
+%%%     }
+%%%   }
+%%% </pre>
+%%% 
+%%% `~auth-hook@1.0' expects to receive a `secret-provider' key in the hook
+%%% base message. It may optionally also take a `generate-path' and
+%%% `finalize-path', which are used to generate the secret and post-process the
+%%% response. If either `X-path' keys are not present, the `generate' and
+%%% `finalize' paths are used upon the `secret-provider' message. If the secret
+%%% provider's device does not implement these keys, the operations are skipped.
+%%% 
+%%% Node operators may also specify a `when' message inside their hook definition
+%%% which is used to determine when messages should be signed. The supported keys
+%%% are:
+%%% 
+%%% <pre>
+%%%     `committers': always | uncommitted | [committer1, or committer2, or ...]
+%%%     `keys': always | [key1, or key2, or ...]
+%%% </pre>
+%%% 
+%%% Both keys are optional and can be combined to form 'and' conditions. For
+%%% example, the following hook definition will sign all uncommitted requests
+%%% that have the `Authorization' header:
+%%% 
+%%% <pre>
+%%%   "on": {
+%%%     "request": {
+%%%       "device": "auth-hook@1.0",
+%%%       "when": {
+%%%             "keys": ["authorization"],
+%%%             "committers": "uncommitted"
+%%%         }
+%%%       }
+%%%     }
+%%% </pre>
+%%% 
+-module(dev_auth_hook).
+-export([request/3]).
+-include("include/hb.hrl").
+-include_lib("eunit/include/eunit.hrl").
+
+%%% Default key used to indicate that an individual message in the path should
+%%% be signed.
+-define(DEFAULT_COMMIT_KEY, <<"!">>).
+
+%%% Default keys to ignore when signing
+-define(DEFAULT_IGNORED_KEYS,
+    [
+        <<"secret">>,
+        <<"cookie">>,
+        <<"set-cookie">>,
+        <<"path">>,
+        <<"method">>,
+        <<"authorization">>,
+        ?DEFAULT_COMMIT_KEY
+    ]
+).
+
+%% @doc Process an incoming request through a key provider. The key provider
+%% should be a message optionally implementing the following keys:
+%% <pre>
+%%     `generate-path': The path to call the `generate' function.
+%%     `finalize-path': The path to call the `finalize' function.
+%%     `skip-commit': Whether to skip committing the request.
+%%     `ignored-keys': A list of keys to ignore when signing (can be overridden
+%%     by the user request).
+%% </pre>
+%% 
+request(Base, HookReq, Opts) ->
+    ?event({auth_hook_request, {base, Base}, {hook_req, HookReq}}),
+    maybe
+        % Get the key provider from options and short-circuit if none is
+        % provided.
+        {ok, Provider} ?= find_provider(Base, Opts),
+        % Check if the request already has signatures, or the hook base enforces
+        % that we should always attempt to sign the request.
+        {ok, Request} ?= hb_maps:find(<<"request">>, HookReq, Opts),
+        {ok, OrigMessages} ?= hb_maps:find(<<"body">>, HookReq, Opts),
+        true ?= is_relevant(Base, Request, OrigMessages, Opts),
+        ?event(auth_hook_is_relevant),
+        % Call the key provider to normalize authentication (generate if needed)
+        {ok, IntermediateProvider, NormReq} ?=
+            generate_secret(Provider, Request, Opts),
+        % Call `~secret@1.0' to generate a wallet if needed. Returns refreshed
+        % options.
+        {ok, NormProvider, NewOpts} ?=
+            generate_wallet(IntermediateProvider, NormReq, Opts),
+        ?event(
+            {auth_hook_normalized,
+                {intermediate_provider, IntermediateProvider},
+                {norm_provider, NormProvider},
+                {norm_req, NormReq}
+            }
+        ),
+        % Sign the full request  
+        {ok, SignedReq} ?= sign_request(NormProvider, NormReq, NewOpts),
+        ?event(auth_hook_signed),
+        % Process individual messages if needed
+        {ok, MessageSequence} ?=
+            maybe_sign_messages(
+                NormProvider,
+                SignedReq,
+                NewOpts
+            ),
+        ?event(auth_hook_processed_messages),
+        % Call the key provider to finalize the response
+        {ok, FinalSequence} ?=
+            finalize(
+                NormProvider,
+                SignedReq,
+                MessageSequence,
+                NewOpts
+            ),
+        ?event({auth_hook_returning, FinalSequence}),
+        {ok, #{ <<"body">> => FinalSequence, <<"request">> => SignedReq }}
+    else
+        {error, AuthError} ->
+            ?event({auth_hook_auth_error, AuthError}),
+            {error, AuthError};
+        {skip, {committers, Committers}, {keys, Keys}} ->
+            ?event({auth_hook_skipping, {committers, Committers}, {keys, Keys}}),
+            {ok, HookReq};
+        error ->
+            ?event({auth_hook_error, no_request}),
+            {ok, HookReq};
+        Other ->
+            ?event({auth_hook_unexpected_result, Other}),
+            Other
+    end.
+
+%% @doc Check if the request is relevant to the hook base. Node operators may
+%% specify criteria for activation of the hook based on the committers of the
+%% request (`always', `uncommitted', or a list of committers), or the presence
+%% of certain keys (`always', or a list of keys) on any of the messages in the
+%% sequence.
+is_relevant(Base, Request, MessageSequence, Opts) ->
+    Committers = is_relevant_from_committers(Base, Request, Opts),
+    Keys =
+        lists:any(
+            fun(Msg) -> is_relevant_from_keys(Base, Msg, Opts) end,
+            [Request | MessageSequence]
+        ),
+    ?event({auth_hook_is_relevant, {committers, Committers}, {keys, Keys}}),
+    if Committers andalso Keys -> true;
+        true -> {skip, {committers, Committers}, {keys, Keys}}
+    end.
+
+%% @doc Check if the request is relevant to the hook base based on the committers
+%% of the request.
+is_relevant_from_committers(Base, Request, Opts) ->
+    Config =
+        hb_util:deep_get(
+            [<<"when">>, <<"committers">>],
+            Base,
+            <<"uncommitted">>,
+            Opts
+        ),
+    ?event({auth_hook_is_relevant_from_committers, {config, Config}, {base, Base}}),
+    case Config of
+        <<"always">> -> true;
+        <<"uncommitted">> -> hb_message:signers(Request, Opts) == [];
+        RelevantCommitters ->
+            lists:any(
+                fun(Signer) ->
+                    lists:member(Signer, RelevantCommitters)
+                end,
+                hb_message:signers(Request, Opts)
+            )
+    end.
+
+%% @doc Check if the request is relevant to the hook base based on the presence
+%% of keys specified in the hook base.
+is_relevant_from_keys(_Base, ID, _Opts) when is_binary(ID) ->
+    false;
+is_relevant_from_keys(Base, {as, _, Msg}, Opts) ->
+    is_relevant_from_keys(Base, Msg, Opts);
+is_relevant_from_keys(Base, {resolve, Msg}, Opts) ->
+    is_relevant_from_keys(Base, Msg, Opts);
+is_relevant_from_keys(Base, Request, Opts) ->
+    Config = hb_util:deep_get([<<"when">>, <<"keys">>], Base, <<"always">>, Opts),
+    ?event(
+        {
+            auth_hook_is_relevant_from_keys,
+            {config, Config},
+            {base, Base},
+            {request, Request}
+        }
+    ),
+    case Config of
+        <<"always">> -> true;
+        RelevantKeys ->
+            lists:any(
+                fun(Key) ->
+                    case hb_maps:find(Key, Request, Opts) of
+                        {ok, _} -> true;
+                        error -> false
+                    end
+                end,
+                RelevantKeys
+            )
+    end.
+
+%% @doc Normalize authentication credentials, generating new ones if needed.
+generate_secret(Provider, Request, Opts) ->
+    case call_provider(<<"generate">>, Provider, Request, Opts) of
+        {error, not_found} ->
+            ?event({no_generate_handler, Provider}),
+            {ok, Provider, strip_sensitive(Request, Opts)};
+        {error, Err} ->
+            % Forward the error. The main handler will fail to match this and
+            % return the error to the user.
+            ?event({generate_error, Err}),
+            {error, Err};
+        {ok, Secret} when is_binary(Secret) ->
+            % The provider returned a direct key, calculate the committer and
+            % generate a wallet for it, if needed.
+            ?event({secret_from_provider, Secret}),
+            {ok, Provider#{ <<"secret">> => Secret }, strip_sensitive(Request, Opts)};
+        {ok, NormalizedReq} when is_map(NormalizedReq) ->
+            % If there is a `wallet' field in the request, we move it to the
+            % provider, else continue with the existing provider.
+            ?event({normalized_req, NormalizedReq}),
+            case hb_maps:find(<<"secret">>, NormalizedReq, Opts) of
+                {ok, Key} ->
+                    ?event({key_found_in_normalized_req, Key}),
+                    {
+                        ok,
+                        Provider#{ <<"secret">> => Key },
+                        strip_sensitive(NormalizedReq, Opts)
+                    };
+                error ->
+                    ?event({no_key_in_normalized_req, NormalizedReq}),
+                    {ok, Provider, strip_sensitive(NormalizedReq, Opts)}
+            end
+    end.
+
+%% @doc Strip the `secret' field from a request.
+strip_sensitive(Request, Opts) ->
+    hb_maps:without([<<"secret">>], Request, Opts).
+
+%% @doc Generate a wallet with the key if the `wallet' field is not present in
+%% the provider after normalization.
+generate_wallet(Provider, Request, Opts) ->
+    {ok, #{ <<"body">> := WalletID }} =
+        dev_secret:generate(Provider, Request, Opts),
+    ?event({generated_wallet, WalletID}),
+    {ok, Provider, refresh_opts(Opts)}.
+
+%% @doc Sign a request using the configured key provider
+sign_request(Provider, Msg, Opts) ->
+    case hb_maps:get(<<"skip-commit">>, Provider, true, Opts) of
+        false ->
+            % Skip signing and return the normalized message.
+            ?event({provider_requested_signing_skip, Provider}),
+            {ok, Msg};
+        true ->
+            % Wallet signs without ignored keys
+            IgnoredKeys = ignored_keys(Msg, Opts),
+            WithoutIgnored = hb_maps:without(IgnoredKeys, Msg, Opts),
+            % Call the wallet to sign the request.
+            case dev_secret:commit(WithoutIgnored, Provider, Opts) of
+                {ok, Signed} ->
+                    ?event({auth_hook_signed, Signed}),
+                    SignedWithIgnored = 
+                        hb_maps:merge(
+                            Signed,
+                            hb_maps:with(IgnoredKeys, Msg, Opts),
+                            Opts
+                        ),
+                    {ok, SignedWithIgnored};
+                {error, Err} ->
+                    ?event({auth_hook_sign_error, Err}),
+                    {error, Err}
+            end
+    end.
+
+%% @doc Process a sequence of messages, signing those marked for signing
+maybe_sign_messages(Provider, SignedReq, Opts) ->
+    Parsed = hb_singleton:from(SignedReq, Opts),
+    ?event({auth_hook_parsed_messages, {sequence_length, length(Parsed)}}),
+    SignKey = hb_opts:get(auth_hook_commit_key, ?DEFAULT_COMMIT_KEY, Opts),
+    Processed = maybe_sign_messages(Provider, SignKey, Parsed, Opts),
+    {ok, Processed}.
+maybe_sign_messages(_Provider, _Key, [], _Opts) -> [];
+maybe_sign_messages(Provider, Key, [Msg | Rest], Opts) when is_map(Msg) ->
+    case hb_util:atom(hb_maps:get(Key, Msg, false, Opts)) of
+        true ->
+            Uncommitted = hb_message:uncommitted(Msg, Opts),
+            ?event({auth_hook_signing_message, {uncommitted, Msg}}),
+            case sign_request(Provider, Uncommitted, Opts) of
+                {ok, Signed} ->
+                    [
+                        Signed
+                    |
+                        maybe_sign_messages(Provider, Key, Rest, Opts)
+                    ];
+                {error, Err} ->
+                    ?event({auth_hook_sign_error, Err}),
+                    [{error, Err}]
+            end;
+        _ ->
+            [Msg | maybe_sign_messages(Provider, Key, Rest, Opts)]
+    end;
+maybe_sign_messages(Provider, Key, [Msg | Rest], Opts) ->
+    [Msg | maybe_sign_messages(Provider, Key, Rest, Opts)].
+
+%% @doc Finalize the response by adding authentication state
+finalize(KeyProvider, SignedReq, MessageSequence, Opts) ->
+    % Add the signed request and message sequence to the response, mirroring the
+    % structure of a normal `~hook@1.0' on-request hook.
+    Req =
+        #{
+            <<"request">> => SignedReq,
+            <<"body">> => MessageSequence
+        },
+    case call_provider(<<"finalize">>, KeyProvider, Req, Opts) of
+        {ok, Finalized} ->
+            ?event({auth_hook_finalized, Finalized}),
+            {ok, Finalized};
+        {error, not_found} ->
+            ?event(auth_hook_no_finalize_handler),
+            {ok, MessageSequence}
+    end.
+
+%%% Utility functions
+
+%% @doc Refresh the options and log an event if they have changed.
+refresh_opts(Opts) ->
+    NewOpts = hb_http_server:get_opts(Opts),
+    case NewOpts of
+        Opts -> ?event(auth_hook_no_opts_change);
+        _ ->
+            ?event(
+                {auth_hook_opts_changed,
+                    {size_diff,
+                        erlang:external_size(NewOpts) -
+                            erlang:external_size(Opts)
+                    }
+                }
+            )
+    end,
+    NewOpts.
+
+%% @doc Get the key provider from the base message or the defaults.
+find_provider(Base, Opts) ->
+    case hb_maps:get(<<"secret-provider">>, Base, no_key_provider, Opts) of
+        no_key_provider ->
+            case hb_opts:get(hook_secret_provider, no_key_provider, Opts) of
+                no_key_provider -> {error, no_key_provider};
+                SecretProvider -> SecretProvider
+            end;
+        SecretProvider when is_binary(SecretProvider) ->
+            {ok, #{ <<"device">> => SecretProvider }};
+        SecretProvider when is_map(SecretProvider) ->
+            {ok, SecretProvider};
+        _ ->
+            {error, invalid_auth_provider}
+    end.
+
+%% @doc Find the appropriate handler for a key in the key provider.
+call_provider(Key, Provider, Request, Opts) ->
+    ?event({call_provider, {key, Key}, {provider, Provider}, {req, Request}}),
+    ExecKey = hb_maps:get(<< Key/binary, "-path">>, Provider, Key, Opts),
+    ?event({call_provider, {exec_key, ExecKey}}),
+    case hb_ao:resolve(Provider, Request#{ <<"path">> => ExecKey }, Opts) of
+        {ok, Msg} when is_map(Msg) ->
+            % The result is a message. We revert the path to its original value.
+            case hb_maps:find(<<"path">>, Request, Opts) of
+                {ok, Path} -> {ok, Msg#{ <<"path">> => Path }};
+                _ -> {ok, Msg}
+            end;
+        {ok, _} = Res ->
+            % The result is a non-message. We return it as-is.
+            Res;
+        {error, Err} ->
+            ?event({call_provider_error, Err}),
+            {error, Err}
+    end.
+
+%% @doc Default keys to ignore when signing
+ignored_keys(Msg, Opts) ->
+    hb_maps:get(
+        <<"ignored-keys">>,
+        Msg,
+        hb_opts:get(
+            hook_auth_ignored_keys,
+            ?DEFAULT_IGNORED_KEYS,
+            Opts
+        )
+    ).
+
+%%% Tests
+
+cookie_test() ->
+    % Start a node with a secret-provider that uses the cookie device.
+    Node =
+        hb_http_server:start_node(
+            #{
+                priv_wallet => ServerWallet = ar_wallet:new(),
+                on => #{
+                    <<"request">> => #{
+                        <<"device">> => <<"auth-hook@1.0">>,
+                        <<"path">> => <<"request">>,
+                        <<"secret-provider">> =>
+                            #{
+                                <<"device">> => <<"cookie@1.0">>
+                            }
+                    }
+                }
+            }
+        ),
+    % Run a request and check that the response is signed. The cookie device
+    % will generate a new cookie for the client.
+    {ok, Response} =
+        hb_http:get(
+            Node,
+            #{
+                <<"path">> => <<"commitments">>,
+                <<"body">> => <<"Test data">>
+            },
+            #{}
+        ),
+    % Filter the response to only include signed commitments.
+    Signers = signers_from_commitments_response(Response, ServerWallet),
+    ?event(
+        {response, {found_signers, Signers}}
+    ),    
+    ?assertEqual(1, length(Signers)),
+    % Generate a further request and check that the same address is used. Extract
+    % the cookie given in the first request and use it to sign the second.
+    [CookieAddress] = Signers,
+    #{ <<"priv">> := CookiePriv } = Response,
+    ?event(
+        {cookie_from_response,
+            {cookie_priv, CookiePriv},
+            {cookie_address, CookieAddress}
+        }
+    ),
+    {ok, Response2} =
+        hb_http:get(
+            Node,
+            #{
+                <<"path">> => <<"/commitments">>,
+                <<"body">> => <<"Test data2">>,
+                <<"priv">> => CookiePriv
+            },
+            #{}
+        ),
+    % Check that the second request is signed with the same address as the first.
+    ?assertEqual(
+        [CookieAddress],
+        signers_from_commitments_response(Response2, ServerWallet)
+    ).
+
+http_auth_test() ->
+    % Start a node with the `~http-auth@1.0' device as the secret-provider.
+    Node =
+        hb_http_server:start_node(
+            #{
+                priv_wallet => ServerWallet = ar_wallet:new(),
+                on => #{
+                    <<"request">> => #{
+                        <<"device">> => <<"auth-hook@1.0">>,
+                        <<"path">> => <<"request">>,
+                        <<"secret-provider">> =>
+                            #{
+                                <<"device">> => <<"http-auth@1.0">>,
+                                <<"access-control">> =>
+                                    #{ <<"device">> => <<"http-auth@1.0">> }
+                            }
+                    }
+                }
+            }
+        ),
+    % Run a request and check that the response is a 401 with the
+    % `www-authenticate' header.
+    Resp1 =
+        hb_http:get(
+            Node,
+            #{
+                <<"path">> => <<"commitments">>,
+                <<"body">> => <<"Test data">>
+            },
+            #{}
+        ),
+    ?assertMatch(
+        {error, #{ <<"status">> := 401, <<"www-authenticate">> := _ }},
+        Resp1
+    ),
+    % Run a request with the `Authorization' header and check that the response
+    % is signed.
+    AuthStr = << "Basic ", (base64:encode(<<"user:pass">>))/binary >>,
+    Resp2 =
+        hb_http:get(
+            Node,
+            #{
+                <<"path">> => <<"commitments">>,
+                <<"body">> => <<"Test data">>,
+                <<"authorization">> => AuthStr
+            },
+            #{}
+        ),
+    ?assertMatch(
+        {ok, #{ <<"status">> := 200 }},
+        Resp2
+    ),
+    % Filter the response to only include signed commitments.
+    Signers = signers_from_commitments_response(hb_util:ok(Resp2), ServerWallet),
+    ?event(
+        {response, {found_signers, Signers}}
+    ),
+    ?assertEqual(1, length(Signers)),
+    % Generate a further request and check that the same address is used.
+    [Signer] = Signers,
+    {ok, Resp3} =
+        hb_http:get(
+            Node,
+            #{
+                <<"path">> => <<"commitments">>,
+                <<"body">> => <<"Test data2">>,
+                <<"authorization">> => AuthStr
+            },
+            #{}
+        ),
+    ?assertEqual(
+        [Signer],
+        signers_from_commitments_response(Resp3, ServerWallet)
+    ).
+
+chained_preprocess_test() ->
+    % Start a node with the `~http-auth@1.0' device as the secret-provider, with
+    % a router chained afterwards in the request hook.
+    RelayWallet = ar_wallet:new(),
+    RelayAddress = hb_util:human_id(RelayWallet),
+    RelayURL = hb_http_server:start_node(#{ priv_wallet => RelayWallet }),
+    Node =
+        hb_http_server:start_node(
+            #{
+                priv_wallet => ar_wallet:new(),
+                relay_allow_commit_request => true,
+                on => #{
+                    <<"request">> =>
+                        [
+                            #{
+                                <<"device">> => <<"auth-hook@1.0">>,
+                                <<"path">> => <<"request">>,
+                                <<"secret-provider">> =>
+                                    #{
+                                        <<"device">> => <<"http-auth@1.0">>,
+                                        <<"access-control">> =>
+                                            #{
+                                                <<"device">> => <<"http-auth@1.0">>
+                                            }
+                                    }
+                            },
+                            #{
+                                <<"device">> => <<"router@1.0">>,
+                                <<"path">> => <<"preprocess">>,
+                                <<"commit-request">> => true
+                            }
+                        ]
+                },
+                routes => [
+                    #{
+                        <<"template">> => <<"/~meta@1.0/info/address">>,
+                        <<"node">> => #{ <<"prefix">> => RelayURL }
+                    }
+                ]
+            }
+        ),
+    % Run a request with the `Authorization' header and check that the response
+    % is signed.
+    AuthStr = << "Basic ", (base64:encode(<<"user:pass">>))/binary >>,
+    Resp1 =
+        hb_http:get(
+            Node,
+            #{
+                <<"path">> => <<"/~meta@1.0/info/address">>,
+                <<"authorization">> => AuthStr
+            },
+            #{}
+        ),
+    ?assertMatch({ok, RelayAddress}, Resp1).
+
+when_test() ->
+    % Start a node with the `~http-auth@1.0' device as the secret-provider. Only
+    % request commitment with the hook if the `Authorization' header is present.
+    Node =
+        hb_http_server:start_node(
+            #{
+                priv_wallet => ServerWallet = ar_wallet:new(),
+                on => #{
+                    <<"request">> => #{
+                        <<"device">> => <<"auth-hook@1.0">>,
+                        <<"path">> => <<"request">>,
+                        <<"when">> => #{
+                            <<"keys">> => [<<"authorization">>]
+                        },
+                        <<"secret-provider">> =>
+                            #{
+                                <<"device">> => <<"http-auth@1.0">>,
+                                <<"access-control">> =>
+                                    #{ <<"device">> => <<"http-auth@1.0">> }
+                            }
+                    }
+                }
+            }
+        ),
+    % Run a request and check that the response is not signed, but is `status: 200'.
+    {ok, Resp1} =
+        hb_http:get(
+            Node,
+            #{
+                <<"path">> => <<"~meta@1.0/info">>,
+                <<"body">> => <<"Test data">>
+            },
+            #{}
+        ),
+    ?assertEqual(200, hb_maps:get(<<"status">>, Resp1, 0)),
+    % Run a request with the `Authorization' header and check that the response
+    % is signed.
+    AuthStr = << "Basic ", (base64:encode(<<"user:pass">>))/binary >>,
+    Resp2 =
+        hb_http:get(
+            Node,
+            #{
+                <<"path">> => <<"commitments">>,
+                <<"body">> => <<"Test data">>,
+                <<"authorization">> => AuthStr
+            },
+            #{}
+        ),
+    ?assertMatch(
+        {ok, #{ <<"status">> := 200 }},
+        Resp2
+    ),
+    ?assertMatch(
+        [_],
+        signers_from_commitments_response(
+            hb_util:ok(Resp2),
+            ServerWallet
+        )
+    ).
+
+%% @doc The cookie hook test(s) call `GET /commitments', which returns the 
+%% commitments found on the client request during execution on the server.
+%% This function filters the response to return only the signers of that message,
+%% excluding the server's own signature.
+signers_from_commitments_response(Response, ServerWallet) ->
+    ServerAddress = ar_wallet:to_address(ServerWallet),
+    hb_maps:values(hb_maps:filtermap(
+        fun(Key, Value) when ?IS_ID(Key) ->
+            Type = hb_maps:get(<<"type">>, Value, not_found, #{}),
+            Committer = hb_maps:get(<<"committer">>, Value, not_found, #{}),
+            case {Type, Committer} of
+                {<<"rsa-pss-sha512">>, ServerAddress} -> false;
+                {<<"rsa-pss-sha512">>, _} -> {true, Committer};
+                _ -> false
+            end;
+           (_Key, _Value) ->
+            false
+        end,
+        Response,
+        #{}
+    )).
\ No newline at end of file
diff --git a/src/dev_cache.erl b/src/dev_cache.erl
index 6bae07eff..461965695 100644
--- a/src/dev_cache.erl
+++ b/src/dev_cache.erl
@@ -35,7 +35,7 @@ read(_M1, M2, Opts) ->
 							{accept_header, <<"application/aos-2">>}
 						}
 					),
-                    JSONMsg = dev_json_iface:message_to_json_struct(Res),
+                    JSONMsg = dev_json_iface:message_to_json_struct(Res, Opts),
                     ?event(dev_cache, {read, {json_message, JSONMsg}}),
                     {ok,
                         #{
@@ -79,12 +79,13 @@ write(_M1, M2, Opts) ->
                     write_single(M2, Opts);
                 <<"batch">> ->
                     ?event(dev_cache, {write, {write_batch_called}}),
-                    maps:map(
+                    hb_maps:map(
                         fun(_, Value) ->
                             ?event(dev_cache, {write, {batch_item, Value}}),
                             write_single(Value, Opts)
                         end,
-                        hb_ao:get(<<"body">>, M2, Opts)
+                        hb_ao:get(<<"body">>, M2, Opts),
+                        Opts
                     );
                 _ ->
                     ?event(dev_cache, {write, {invalid_write_type, Type}}),
@@ -187,7 +188,7 @@ write_single(Msg, Opts) ->
 %% @returns true if the request is from an authorized writer, false
 %%          otherwise.
 is_trusted_writer(Req, Opts) ->
-    Signers = hb_message:signers(Req),
+    Signers = hb_message:signers(Req, Opts),
     ?event(dev_cache, {is_trusted_writer, {signers, Signers}, {req, Req}}),
     CacheWriters = hb_opts:get(cache_writers, [], Opts),
     ?event(dev_cache, {is_trusted_writer, {cache_writers, CacheWriters}}),
@@ -220,7 +221,7 @@ setup_test_env() ->
     application:ensure_all_started(hb),
     ?event(dev_cache, {setup_test_env, {hb_started}}),
     LocalStore = 
-		#{ <<"store-module">> => hb_store_fs, <<"prefix">> => StorePrefix },
+		#{ <<"store-module">> => hb_store_fs, <<"name">> => StorePrefix },
     ?event(dev_cache, {setup_test_env, {local_store_configured, LocalStore}}),
     hb_store:reset(LocalStore),
     ?event(dev_cache, {setup_test_env, {store_reset}}),
@@ -332,7 +333,7 @@ cache_write_message_test() ->
     ?event(dev_cache, {cache_api_test, {data_written, Path}}),
     {ok, ReadData} = hb_cache:read(Path, Opts),
     ?event(dev_cache, {cache_api_test, {data_read, ReadData}}),
-    ?assert(hb_message:match(TestData, ReadData, only_present)),
+    ?assert(hb_message:match(TestData, ReadData, only_present, Opts)),
     ?event(dev_cache, {cache_api_test}),
     ok.
 
@@ -342,7 +343,6 @@ cache_write_binary_test() ->
     {ok, Opts, _} = setup_test_env(),
     TestData = <<"test_binary">>,
     {ok, Path} = hb_cache:write(TestData, Opts),
-    ?event(dev_cache, {cache_api_test, {data_written, Path}}),
     {ok, ReadData} = hb_cache:read(Path, Opts),
     ?event(dev_cache, {cache_api_test, {data_read, ReadData}}),
     ?assertEqual(TestData, ReadData),
diff --git a/src/dev_cacheviz.erl b/src/dev_cacheviz.erl
index 7634e2f94..c44f0704e 100644
--- a/src/dev_cacheviz.erl
+++ b/src/dev_cacheviz.erl
@@ -1,7 +1,7 @@
 %%% @doc A device that generates renders (or renderable dot output) of a node's
 %%% cache.
 -module(dev_cacheviz).
--export([dot/3, svg/3]).
+-export([dot/3, svg/3, json/3, index/3, js/3]).
 -include("include/hb.hrl").
 
 %% @doc Output the dot representation of the cache, or a specific path within
@@ -28,3 +28,42 @@ svg(Base, Req, Opts) ->
     ?event(cacheviz, {dot, Dot}),
     Svg = hb_cache_render:dot_to_svg(Dot),
     {ok, #{ <<"content-type">> => <<"image/svg+xml">>, <<"body">> => Svg }}.
+
+%% @doc Return a JSON representation of the cache graph, suitable for use with
+%% the `graph.js' library. If the request specifies a `target' key, we use that
+%% target. Otherwise, we generate a new target by writing the message to the
+%% cache and using the ID of the written message.
+json(Base, Req, Opts) ->
+    ?event({json, {base, Base}, {req, Req}}),
+    Target =
+        case hb_ao:get(<<"target">>, Req, Opts) of
+            not_found -> 
+                case map_size(maps:without([<<"device">>], hb_private:reset(Base))) of
+                    0 ->
+                        all;
+                    _ ->
+                        ?event({writing_base_for_rendering, Base}),
+                        {ok, Path} = hb_cache:write(Base, Opts),
+                        ?event({wrote_message, Path}),
+                        ID = hb_message:id(Base, all, Opts),
+                        ?event({generated_id, ID}),
+                        ID
+                end;
+            <<".">> -> all;
+            ReqTarget -> ReqTarget
+        end,
+    MaxSize = hb_util:int(hb_ao:get(<<"max-size">>, Req, 250, Opts)),
+    ?event({max_size, MaxSize}),
+    ?event({generating_json_for, {target, Target}}),
+    Res = hb_cache_render:get_graph_data(Target, MaxSize, Opts),
+    ?event({graph_data, Res}),
+    Res.
+
+%% @doc Return a renderer in HTML form for the JSON format.
+index(Base, _, _Opts) ->
+    ?event({cacheviz_index, {base, Base}}),
+    dev_hyperbuddy:return_file(<<"cacheviz@1.0">>, <<"graph.html">>).
+
+%% @doc Return a JS library that can be used to render the JSON format.
+js(_, _, _Opts) ->
+    dev_hyperbuddy:return_file(<<"cacheviz@1.0">>, <<"graph.js">>).
\ No newline at end of file
diff --git a/src/dev_codec_ans104.erl b/src/dev_codec_ans104.erl
index 3b694daf9..b6a514538 100644
--- a/src/dev_codec_ans104.erl
+++ b/src/dev_codec_ans104.erl
@@ -1,587 +1,157 @@
 %%% @doc Codec for managing transformations from `ar_bundles'-style Arweave TX
 %%% records to and from TABMs.
 -module(dev_codec_ans104).
--export([id/1, to/1, from/1, commit/3, verify/3, committed/3, content_type/1]).
--export([serialize/1, deserialize/1]).
+-export([to/3, from/3, commit/3, verify/3, content_type/1]).
+-export([serialize/3, deserialize/3]).
 -include("include/hb.hrl").
 -include_lib("eunit/include/eunit.hrl").
 
-%%% The size at which a value should be made into a body item, instead of a
-%%% tag.
--define(MAX_TAG_VAL, 128).
-%%% The list of TX fields that users can set directly. Data is excluded because
-%%% it may be set by the codec in order to support nested messages.
--define(TX_KEYS,
-    [
-        <<"id">>,
-        <<"last_tx">>,
-        <<"owner">>,
-        <<"target">>,
-        <<"signature">>
-    ]
-).
-%%% The list of keys that should be forced into the tag list, rather than being
-%%% encoded as fields in the TX record.
--define(FORCED_TAG_FIELDS,
-    [
-        <<"quantity">>,
-        <<"manifest">>,
-        <<"data_size">>,
-        <<"data_tree">>,
-        <<"data_root">>,
-        <<"reward">>,
-        <<"denomination">>,
-        <<"signature_type">>
-    ]
-).
-%%% The list of tags that a user is explicitly committing to when they sign an
-%%% ANS-104 message.
--define(COMMITTED_TAGS, ?TX_KEYS ++ [<<"data">>]).
-%%% List of tags that should be removed during `to'. These relate to the nested
-%%% ar_bundles format that is used by the `ans104@1.0' codec.
--define(FILTERED_TAGS,
-    [
-        <<"bundle-format">>,
-        <<"bundle-map">>,
-        <<"bundle-version">>
-    ]
-).
-
 %% @doc Return the content type for the codec.
 content_type(_) -> {ok, <<"application/ans104">>}.
 
 %% @doc Serialize a message or TX to a binary.
-serialize(Msg) when is_map(Msg) ->
-    serialize(to(Msg));
-serialize(TX) when is_record(TX, tx) ->
+serialize(Msg, Req, Opts) when is_map(Msg) ->
+    serialize(to(Msg, Req, Opts), Req, Opts);
+serialize(TX, _Req, _Opts) when is_record(TX, tx) ->
     {ok, ar_bundles:serialize(TX)}.
 
 %% @doc Deserialize a binary ans104 message to a TABM.
-deserialize(#{ <<"body">> := Binary }) ->
-    deserialize(Binary);
-deserialize(Binary) when is_binary(Binary) ->
-    deserialize(ar_bundles:deserialize(Binary));
-deserialize(TX) when is_record(TX, tx) ->
-    {ok, from(TX)}.
-
-%% @doc Return the ID of a message.
-id(Msg) ->
-    TABM = dev_codec_structured:from(Msg),
-    {ok, hb_util:human_id((to(TABM))#tx.id)}.
-
-%% @doc Sign a message using the `priv_wallet' key in the options.
-commit(Msg, _Req, Opts) ->
-    ?event({committing, {input, Msg}}),
-    Signed = ar_bundles:sign_item(
-        to(hb_private:reset(Msg)),
-        Wallet = hb_opts:get(priv_wallet, no_viable_wallet, Opts)
-    ),
-    ?event({signed_tx, Signed}),
-    ID = hb_util:human_id(Signed#tx.id),
-    Owner = Signed#tx.owner,
-    Sig = Signed#tx.signature,
-    Address = hb_util:human_id(ar_wallet:to_address(Wallet)),
-    % Get the prior original tags from the commitment, if it exists.
-    PriorOriginalTags =
-        case hb_message:commitment(#{ <<"alg">> => <<"unsigned">> }, Msg) of
-            {ok, _, #{ <<"original-tags">> := OrigTags }} -> OrigTags;
-            _ -> undefined
-        end,
-    Commitment =
-        #{
-            <<"commitment-device">> => <<"ans104@1.0">>,
-            <<"committer">> => Address,
-            <<"alg">> => <<"rsa-pss">>,
-            <<"owner">> => Owner,
-            <<"signature">> => Sig
-        },
-    CommitmentWithOriginalTags =
-        case PriorOriginalTags of
-            undefined -> Commitment;
-            OriginalTags -> Commitment#{ <<"original-tags">> => OriginalTags }
-        end,
-    CommitmentWithHP =
-        case Msg of
-            #{ <<"hashpath">> := Hashpath } ->
-                CommitmentWithOriginalTags#{ <<"hashpath">> => Hashpath };
-            _ -> CommitmentWithOriginalTags
-        end,
-    MsgWithoutHP = maps:without([<<"hashpath">>], Msg),
-    {ok,
-        (hb_message:without_commitments(
-            #{
-                <<"commitment-device">> => <<"ans104@1.0">>,
-                <<"alg">> => <<"unsigned">>
-            },
-            MsgWithoutHP
-        ))#{
-            <<"commitments">> => #{
-                ID => CommitmentWithHP
-            }
-        }
-    }.
+deserialize(#{ <<"body">> := Binary }, Req, Opts) ->
+    deserialize(Binary, Req, Opts);
+deserialize(Binary, Req, Opts) when is_binary(Binary) ->
+    deserialize(ar_bundles:deserialize(Binary), Req, Opts);
+deserialize(TX, Req, Opts) when is_record(TX, tx) ->
+    from(TX, Req, Opts).
 
-%% @doc Return a list of committed keys from an ANS-104 message.
-committed(Msg = #{ <<"trusted-keys">> := RawTKeys, <<"commitments">> := Comms }, _Req, Opts) ->
-    % If the message has a `trusted-keys' field in the immediate layer, we validate
-    % that it also exists in the commitment's sub-map. If it exists there (which
-    % cannot be written to directly by users), we can trust that the stated keys
-    % are present in the message.
-    case hb_ao:get(hd(hb_ao:keys(Comms)), Comms, #{}) of
-        #{ <<"trusted-keys">> := RawTKeys } ->
-            committed_from_trusted_keys(Msg, RawTKeys, Opts);
-        _ ->
-            % If the key is not repeated, we cannot trust that the message has
-            % the keys in the commitment so we return an error.
-            throw({trusted_keys_not_found_in_commitment, Msg})
-    end;
-committed(Msg = #{ <<"original-tags">> := TagMap, <<"commitments">> := Comms }, _Req, Opts) ->
-    % If the message has an `original-tags' field, the committed fields are only
-    % those keys, and maps that are nested in the `data' field.
-    ?event({committed_from_original_tags, {input, Msg}}),
-    case hb_ao:get(hd(hb_ao:keys(Comms)), Comms, #{}) of
-        #{ <<"original-tags">> := TagMap } ->
-            TrustedKeys =
-                [
-                    maps:get(<<"name">>, Tag)
-                ||
-                    Tag <- maps:values(hb_ao:normalize_keys(TagMap))
-                ],
-            committed_from_trusted_keys(Msg, TrustedKeys, Opts);
-        _ ->
-            % Message appears to be tampered with.
-            throw({original_tags_not_found_in_commitment, Msg})
-    end;
-committed(Msg, Req, Opts) ->
-    ?event({running_committed, {input, Msg}}),
-    % Remove other commitments that were not 'promoted' to the base layer message
-    % by `message@1.0/committed'. This is safe because `to' will only proceed if 
-    % there is a single signature on the message. Subsequently, we can trust that
-    % the keys signed by that single commitment speak for 'all' of the 
-    % commitments.
-    MsgLessGivenComm = maps:without([<<"commitments">>], Msg),
-    ?event({to_verify, {input, MsgLessGivenComm}}),
-    case verify(MsgLessGivenComm, Req, Opts) of
-        {ok, true} ->
-            % The message validates, so we can trust that the original keys are
-            % all present in the message in its converted state.
-            Encoded = to(Msg),
-            ?event({verified_tx, Encoded}),
-            % Get the immediate (first-level) keys from the encoded message.
-            % This is safe because we know that the message is valid. We normalize
-            % the keys such that callers can rely on the keys being in a canonical
-            % form.
-            TagKeys = [ hb_ao:normalize_key(Key) || {Key ,_} <- Encoded#tx.tags ],
-            % Get the nested keys from the original message.
-            NestedKeys = maps:keys(maps:filter(fun(_, V) -> is_map(V) end, Msg)),
-            Implicit =
-                case lists:member(<<"ao-types">>, maps:keys(Msg)) of
-                    true -> dev_codec_structured:implicit_keys(Msg);
-                    false -> []
-                end,
-            % Return the immediate and nested keys. The `data' field is always
-            % committed, so we include it in the list of keys.
-            {ok, TagKeys ++ NestedKeys ++ Implicit ++ ?COMMITTED_TAGS};
-        _ ->
-            ?event({could_not_verify, {msg, MsgLessGivenComm}}),
-            {ok, []}
-    end.
-
-committed_from_trusted_keys(Msg, TrustedKeys, _Opts) ->
-    ?event({committed_from_trusted_keys, {trusted_keys, TrustedKeys}, {input, Msg}}),
-    NestedKeys = maps:keys(maps:filter(fun(_, V) -> is_map(V) end, Msg)),
-    TKeys = maps:values(hb_ao:normalize_keys(TrustedKeys)),
-    Implicit =
-        case lists:member(<<"ao-types">>, TKeys) of
-            true -> dev_codec_structured:implicit_keys(Msg);
-            false -> []
-        end,
+%% @doc Sign a message using the `priv_wallet' key in the options. Supports both
+%% the `hmac-sha256' and `rsa-pss-sha256' algorithms, offering unsigned and
+%% signed commitments.
+commit(Msg, Req = #{ <<"type">> := <<"unsigned">> }, Opts) ->
+    commit(Msg, Req#{ <<"type">> => <<"unsigned-sha256">> }, Opts);
+commit(Msg, Req = #{ <<"type">> := <<"signed">> }, Opts) ->
+    commit(Msg, Req#{ <<"type">> => <<"rsa-pss-sha256">> }, Opts);
+commit(Msg, Req = #{ <<"type">> := <<"rsa-pss-sha256">> }, Opts) ->
+    % Convert the given message to an ANS-104 TX record, sign it, and convert
+    % it back to a structured message.
+    {ok, TX} = to(hb_private:reset(Msg), Req, Opts),
+    Wallet = hb_opts:get(priv_wallet, no_viable_wallet, Opts),
+    Signed = ar_bundles:sign_item(TX, Wallet),
+    SignedStructured =
+        hb_message:convert(
+            Signed,
+            <<"structured@1.0">>,
+            <<"ans104@1.0">>,
+            Opts
+        ),
+    {ok, SignedStructured};
+commit(Msg, #{ <<"type">> := <<"unsigned-sha256">> }, Opts) ->
+    % Remove the commitments from the message, convert it to ANS-104, then back.
+    % This forces the message to be normalized and the unsigned ID to be
+    % recalculated.
     {
         ok,
-        lists:map(fun hb_ao:normalize_key/1, TKeys)
-            ++ Implicit
-            ++ NestedKeys
-            ++ ?COMMITTED_TAGS
+        hb_message:convert(
+            hb_maps:without([<<"commitments">>], Msg, Opts),
+            <<"ans104@1.0">>,
+            <<"structured@1.0">>,
+            Opts
+        )
     }.
 
 %% @doc Verify an ANS-104 commitment.
-verify(Msg, _Req, _Opts) ->
-    MsgWithoutCommitments =
-        maps:without(
-            [
-                <<"commitments">>,
-                <<"committer">>,
-                <<"alg">>
-            ],
-            hb_private:reset(Msg)
+verify(Msg, Req, Opts) ->
+    ?event({verify, {base, Msg}, {req, Req}}),
+    OnlyWithCommitment =
+        hb_private:reset(
+            hb_message:with_commitments(
+                Req,
+                Msg,
+                Opts
+            )
         ),
-    TX = to(MsgWithoutCommitments),
+    ?event({verify, {only_with_commitment, OnlyWithCommitment}}),
+    {ok, TX} = to(OnlyWithCommitment, Req, Opts),
+    ?event({verify, {encoded, TX}}),
     Res = ar_bundles:verify_item(TX),
     {ok, Res}.
 
 %% @doc Convert a #tx record into a message map recursively.
-from(Binary) when is_binary(Binary) -> Binary;
-from(TX) when is_record(TX, tx) ->
+from(Binary, _Req, _Opts) when is_binary(Binary) -> {ok, Binary};
+from(TX, Req, Opts) when is_record(TX, tx) ->
     case lists:keyfind(<<"ao-type">>, 1, TX#tx.tags) of
         false ->
-            do_from(TX);
+            do_from(TX, Req, Opts);
         {<<"ao-type">>, <<"binary">>} ->
-            TX#tx.data
+            {ok, TX#tx.data}
     end.
-do_from(RawTX) ->
+do_from(RawTX, Req, Opts) ->
     % Ensure the TX is fully deserialized.
-    TX = ar_bundles:deserialize(ar_bundles:normalize(RawTX)), % <- Is norm necessary?
-    OriginalTagMap = encoded_tags_to_map(TX#tx.tags),
-    % Get the raw fields and values of the tx record and pair them. Then convert 
-    % the list of key-value pairs into a map, removing irrelevant fields.
-    TXKeysMap =
-        maps:with(?TX_KEYS,
-            hb_ao:normalize_keys(
-                maps:from_list(
-                    lists:zip(
-                        record_info(fields, tx),
-                        tl(tuple_to_list(TX))
-                    )
-                )
-            )
-        ),
-    % Generate a TABM from the tags.
-    MapWithoutData = maps:merge(TXKeysMap, deduplicating_from_list(TX#tx.tags)),
-    ?event({tags_from_tx, {explicit, MapWithoutData}}),
-    DataMap =
-        case TX#tx.data of
-            Data when is_map(Data) ->
-                % If the data is a map, we need to recursively turn its children
-                % into messages from their tx representations.
-                maps:merge(
-                    MapWithoutData,
-                    maps:map(fun(_, InnerValue) -> from(InnerValue) end, Data)
-                );
-            Data when Data == ?DEFAULT_DATA -> MapWithoutData;
-            Data when is_binary(Data) -> MapWithoutData#{ <<"data">> => Data };
-            Data ->
-                ?event({unexpected_data_type, {explicit, Data}}),
-                ?event({was_processing, {explicit, TX}}),
-                throw(invalid_tx)
-        end,
-    % Merge the data map with the rest of the TX map and remove any keys that
-    % are not part of the message.
-    NormalizedDataMap =
-        hb_ao:normalize_keys(maps:merge(DataMap, MapWithoutData)),
-    %% Add the commitments to the message if the TX has a signature.
-    ?event({message_before_commitments, NormalizedDataMap}),
+    TX = ar_bundles:deserialize(ar_bundles:normalize(RawTX)),
+    ?event({parsed_tx, TX}),
+    % Get the fields, tags, and data from the TX.
+    Fields = dev_codec_ans104_from:fields(TX, Opts),
+    Tags = dev_codec_ans104_from:tags(TX, Opts),
+    Data = dev_codec_ans104_from:data(TX, Req, Tags, Opts),
+    ?event({parsed_components, {fields, Fields}, {tags, Tags}, {data, Data}}),
+    % Calculate the committed keys on from the TX.
+    Keys = dev_codec_ans104_from:committed(TX, Fields, Tags, Data, Opts),
+    ?event({determined_committed_keys, Keys}),
+    % Create the base message from the fields, tags, and data, filtering to
+    % include only the keys that are committed. Will throw if a key is missing.
+    Base = dev_codec_ans104_from:base(Keys, Fields, Tags, Data, Opts),
+    ?event({calculated_base_message, Base}),
+    % Add the commitments to the message if the TX has a signature.
     WithCommitments =
-        case TX#tx.signature of
-            ?DEFAULT_SIG ->
-                case normal_tags(TX#tx.tags) of
-                    true -> NormalizedDataMap;
-                    false ->
-                        ID = hb_util:human_id(TX#tx.id),
-                        NormalizedDataMap#{
-                            <<"commitments">> => #{
-                                ID => #{
-                                    <<"commitment-device">> => <<"ans104@1.0">>,
-                                    <<"alg">> => <<"unsigned">>,
-                                    <<"original-tags">> => OriginalTagMap
-                                }
-                            }
-                        }
-                end;
-            _ ->
-                Address = hb_util:human_id(ar_wallet:to_address(TX#tx.owner, TX#tx.signature_type)),
-                WithoutBaseCommitment =
-                    maps:without(
-                        [
-                            <<"id">>,
-                            <<"owner">>,
-                            <<"signature">>,
-                            <<"commitment-device">>,
-                            <<"committer">>,
-                            <<"alg">>,
-                            <<"original-tags">>
-                        ],
-                        NormalizedDataMap
-                    ),
-                ID = hb_util:human_id(TX#tx.id),
-                Commitment = #{
-                    <<"commitment-device">> => <<"ans104@1.0">>,
-                    <<"alg">> => <<"rsa-pss">>,
-                    <<"committer">> => Address,
-                    <<"owner">> => TX#tx.owner,
-                    <<"signature">> => TX#tx.signature
-                },
-                WithoutBaseCommitment#{
-                    <<"commitments">> => #{
-                        ID =>
-                            case normal_tags(TX#tx.tags) of
-                                true -> Commitment;
-                                false -> Commitment#{
-                                    <<"original-tags">> => OriginalTagMap
-                                }
-                            end
-                    }
-                }
-        end,
-    Res = maps:without(?FILTERED_TAGS, WithCommitments),
-    ?event({message_after_commitments, Res}),
-    Res.
-
-%% @doc Deduplicate a list of key-value pairs by key, generating a list of
-%% values for each normalized key if there are duplicates.
-deduplicating_from_list(Tags) ->
-    % Aggregate any duplicated tags into an ordered list of values.
-    Aggregated =
-        lists:foldl(
-            fun({Key, Value}, Acc) ->
-                NormKey = hb_ao:normalize_key(Key),
-                ?event({deduplicating_from_list, {key, NormKey}, {value, Value}, {acc, Acc}}),
-                case maps:get(NormKey, Acc, undefined) of
-                    undefined -> maps:put(NormKey, Value, Acc);
-                    Existing when is_list(Existing) ->
-                        maps:put(NormKey, Existing ++ [Value], Acc);
-                    ExistingSingle ->
-                        maps:put(NormKey, [ExistingSingle, Value], Acc)
-                end
-            end,
-            #{},
-            Tags
-        ),
-    ?event({deduplicating_from_list, {aggregated, Aggregated}}),
-    % Convert aggregated values into a structured-field list.
-    Res =
-        maps:map(
-            fun(_Key, Values) when is_list(Values) ->
-                % Convert Erlang lists of binaries into a structured-field list.
-                iolist_to_binary(
-                    hb_structured_fields:list(
-                        [
-                            {item, {string, Value}, []}
-                        ||
-                            Value <- Values
-                        ]
-                    )
-                );
-            (_Key, Value) ->
-                Value
-            end,
-            Aggregated
-        ),
-    ?event({deduplicating_from_list, {result, Res}}),
-    Res.
-
-%% @doc Check whether a list of key-value pairs contains only normalized keys.
-normal_tags(Tags) ->
-    lists:all(
-        fun({Key, _}) ->
-            hb_ao:normalize_key(Key) =:= Key
-        end,
-        Tags
-    ).
-
-%% @doc Convert an ANS-104 encoded tag list into a HyperBEAM-compatible map.
-encoded_tags_to_map(Tags) ->
-    hb_util:list_to_numbered_map(
-        lists:map(
-            fun({Key, Value}) ->
-                #{
-                    <<"name">> => Key,
-                    <<"value">> => Value
-                }
-            end,
-            Tags
-        )
-    ).
-
-%% @doc Convert a HyperBEAM-compatible map into an ANS-104 encoded tag list,
-%% recreating the original order of the tags.
-tag_map_to_encoded_tags(TagMap) ->
-    OrderedList =
-        hb_util:message_to_ordered_list(
-            maps:without([<<"priv">>], TagMap)),
-    %?event({ordered_list, {explicit, OrderedList}, {input, {explicit, Input}}}),
-    lists:map(
-        fun(#{ <<"name">> := Key, <<"value">> := Value }) ->
-            {Key, Value}
-        end,
-        OrderedList
-    ).
+        dev_codec_ans104_from:with_commitments(TX, Tags, Base, Keys, Opts),
+    ?event({parsed_message, WithCommitments}),
+    {ok, WithCommitments}.
 
 %% @doc Internal helper to translate a message to its #tx record representation,
 %% which can then be used by ar_bundles to serialize the message. We call the 
 %% message's device in order to get the keys that we will be checkpointing. We 
 %% do this recursively to handle nested messages. The base case is that we hit
 %% a binary, which we return as is.
-to(Binary) when is_binary(Binary) ->
+to(Binary, _Req, _Opts) when is_binary(Binary) ->
     % ar_bundles cannot serialize just a simple binary or get an ID for it, so
     % we turn it into a TX record with a special tag, tx_to_message will
     % identify this tag and extract just the binary.
-    #tx{
-        tags= [{<<"ao-type">>, <<"binary">>}],
-        data = Binary
+    {ok,
+        #tx{
+            tags = [{<<"ao-type">>, <<"binary">>}],
+            data = Binary
+        }
     };
-to(TX) when is_record(TX, tx) -> TX;
-to(RawTABM) when is_map(RawTABM) ->
-    % The path is a special case so we normalized it first. It may have been
-    % modified by `hb_ao' in order to set it to the current key that is
-    % being executed. We should check whether the path is in the
-    % `priv/AO-Core/Original-Path' field, and if so, use that instead of the
-    % stated path. This normalizes the path, such that the signed message will
-    % continue to validate correctly.
-    TABM = hb_ao:normalize_keys(maps:without([<<"commitments">>], RawTABM)),
-    Commitments = maps:get(<<"commitments">>, RawTABM, #{}),
-    TABMWithComm =
-        case maps:keys(Commitments) of
-            [] -> TABM;
-            [ID] ->
-                TABMWithoutCommitmentKeys =
-                    maps:merge(
-                        TABM,
-                        maps:without(
-                            [<<"commitment-device">>, <<"committer">>, <<"alg">>],
-                            maps:get(ID, Commitments)
-                        )
-                    ),
-                ?event({tabm_without_commitment_keys, TABMWithoutCommitmentKeys}),
-                TABMWithoutCommitmentKeys;
-            _ -> throw({multisignatures_not_supported_by_ans104, RawTABM})
-        end,
-    OriginalTagMap = maps:get(<<"original-tags">>, TABMWithComm, #{}),
-    OriginalTags = tag_map_to_encoded_tags(OriginalTagMap),
-    TABMNoOrigTags = maps:without([<<"original-tags">>], TABMWithComm),
-    % TODO: Is this necessary now? Do we want to pursue `original-path' as the
-    % mechanism for restoring original tags?
-    M =
-        case {maps:find(<<"path">>, TABMNoOrigTags), hb_private:from_message(TABMNoOrigTags)} of
-            {{ok, _}, #{ <<"ao-core">> := #{ <<"original-path">> := Path } }} ->
-                maps:put(<<"path">>, Path, TABMNoOrigTags);
-            _ -> TABMNoOrigTags
-        end,
-    % Translate the keys into a binary map. If a key has a value that is a map,
-    % we recursively turn its children into messages. Notably, we do not simply
-    % call message_to_tx/1 on the inner map because that would lead to adding
-    % an extra layer of nesting to the data.
-    %?event({message_to_tx, {keys, Keys}, {map, M}}),
-    MsgKeyMap =
-        maps:map(
-            fun(_Key, Msg) when is_map(Msg) -> to(Msg);
-               (_Key, Value) -> Value
-            end,
-            M
-        ),
-    MsgKeyMap2 = hb_ao:normalize_keys(MsgKeyMap),
-    % Iterate through the default fields, replacing them with the values from
-    % the message map if they are present.
-    ForcedTagFields = maps:with(?FORCED_TAG_FIELDS, MsgKeyMap2),
-    NormalizedMsgKeyMap = maps:without(?FORCED_TAG_FIELDS, MsgKeyMap2),
-    {RemainingMapWithoutForcedTags, BaseTXList} =
-        lists:foldl(
-            fun({Field, Default}, {RemMap, Acc}) ->
-                NormKey = hb_ao:normalize_key(Field),
-                case maps:find(NormKey, NormalizedMsgKeyMap) of
-                    error -> {RemMap, [Default | Acc]};
-                    {ok, Value} when is_binary(Default) andalso ?IS_ID(Value) ->
-                        % NOTE: Do we really want to do this type coercion?
-                        {
-                            maps:remove(NormKey, RemMap),
-                            [
-                                try hb_util:native_id(Value) catch _:_ -> Value end
-                            |
-                                Acc
-                            ]
-                        };
-                    {ok, Value} ->
-                        {
-                            maps:remove(NormKey, RemMap),
-                            [Value|Acc]
-                        }
-                end
-            end,
-            {NormalizedMsgKeyMap, []},
-            hb_message:default_tx_list()
-        ),
-    RemainingMap = maps:merge(RemainingMapWithoutForcedTags, ForcedTagFields),
-    % Rebuild the tx record from the new list of fields and values.
-    TXWithoutTags = list_to_tuple([tx | lists:reverse(BaseTXList)]),
-    % Calculate which set of the remaining keys will be used as tags.
-    {Remaining, RawDataItems} =
-        lists:partition(
-            fun({_Key, Value}) when is_binary(Value) ->
-                    case unicode:characters_to_binary(Value) of
-                        {error, _, _} -> false;
-                        _ -> byte_size(Value) =< ?MAX_TAG_VAL
-                    end;
-                (_) -> false
-            end,
-            maps:to_list(RemainingMap)
-        ),
-    ?event({remaining_keys_to_convert_to_tags, {explicit, Remaining}}),
-    ?event({original_tags, {explicit, OriginalTags}}),
-    % Check that the remaining keys are as we expect them to be, given the 
-    % original tags. We do this by re-calculating the expected tags from the
-    % original tags and comparing the result to the remaining keys.
-    if length(OriginalTags) > 0 ->
-        ExpectedTagsFromOriginal = deduplicating_from_list(OriginalTags),
-        NormRemaining = maps:from_list(Remaining),
-        case NormRemaining == ExpectedTagsFromOriginal of
-            true -> ok;
-            false ->
-                ?event(warning,
-                    {invalid_original_tags,
-                        {expected, ExpectedTagsFromOriginal},
-                        {given, NormRemaining}
-                    }
-                ),
-                throw({invalid_original_tags, OriginalTags, NormRemaining})
-        end;
-    true -> ok
-    end,
-    % Restore the original tags, or the remaining keys if there are no original
-    % tags.
-    TX =
-        TXWithoutTags#tx {
-            tags =
-                case OriginalTags of
-                    [] -> Remaining;
-                    _ -> OriginalTags
-                end
-        },
-    % Recursively turn the remaining data items into tx records.
-    DataItems = maps:from_list(lists:map(
-        fun({Key, Value}) ->
-            {hb_ao:normalize_key(Key), to(Value)}
-        end,
-        RawDataItems
-    )),
-    % Set the data based on the remaining keys.
-    TXWithData = 
-        case {TX#tx.data, maps:size(DataItems)} of
-            {Binary, 0} when is_binary(Binary) ->
-                TX;
-            {?DEFAULT_DATA, _} ->
-                TX#tx { data = DataItems };
-            {Data, _} when is_map(Data) ->
-                TX#tx { data = maps:merge(Data, DataItems) };
-            {Data, _} when is_record(Data, tx) ->
-                TX#tx { data = DataItems#{ <<"data">> => Data } };
-            {Data, _} when is_binary(Data) ->
-                TX#tx { data = DataItems#{ <<"data">> => to(Data) } }
-        end,
-    % ar_bundles:reset_ids(ar_bundles:normalize(TXWithData));
+to(TX, _Req, _Opts) when is_record(TX, tx) -> {ok, TX};
+to(RawTABM, Req, Opts) when is_map(RawTABM) ->
+    % Ensure that the TABM is fully loaded if the `bundle` key is set to true.
+    ?event({to, {inbound, RawTABM}, {req, Req}}),
+    MaybeBundle = dev_codec_ans104_to:maybe_load(RawTABM, Req, Opts),
+    TX0 = dev_codec_ans104_to:siginfo(MaybeBundle, Opts),
+    ?event({found_siginfo, TX0}),
+    % Calculate and normalize the `data', if applicable.
+    Data = dev_codec_ans104_to:data(MaybeBundle, Req, Opts),
+    ?event({calculated_data, Data}),
+    TX1 = TX0#tx { data = Data },
+    % Calculate the tags for the TX.
+    Tags = dev_codec_ans104_to:tags(TX1, MaybeBundle, Data, Opts),
+    ?event({calculated_tags, Tags}),
+    TX2 = TX1#tx { tags = Tags },
+    ?event({tx_before_id_gen, TX2}),
     Res =
-        try ar_bundles:reset_ids(ar_bundles:normalize(TXWithData))
+        try ar_bundles:reset_ids(ar_bundles:normalize(TX2))
         catch
-            _:Error ->
-                ?event({{reset_ids_error, Error}, {tx_without_data, TX}}),
+            Type:Error:Stacktrace ->
+                ?event({{reset_ids_error, Error}, {tx_without_data, TX2}}),
                 ?event({prepared_tx_before_ids,
-                    {tags, {explicit, TXWithData#tx.tags}},
-                    {data, TXWithData#tx.data}
+                    {tags, {explicit, TX2#tx.tags}},
+                    {data, TX2#tx.data}
                 }),
-                throw(Error)
+                erlang:raise(Type, Error, Stacktrace)
         end,
-    %?event({result, {explicit, Res}}),
-    Res;
-to(_Other) ->
-    throw(invalid_tx).
+    ?event({to_result, Res}),
+    {ok, Res};
+to(Other, _Req, _Opts) ->
+    throw({invalid_tx, Other}).
 
 %%% ANS-104-specific testing cases.
 
@@ -590,9 +160,9 @@ normal_tags_test() ->
         <<"first-tag">> => <<"first-value">>,
         <<"second-tag">> => <<"second-value">>
     },
-    Encoded = to(Msg),
+    {ok, Encoded} = to(Msg, #{}, #{}),
     ?event({encoded, Encoded}),
-    Decoded = from(Encoded),
+    {ok, Decoded} = from(Encoded, #{}, #{}),
     ?event({decoded, Decoded}),
     ?assert(hb_message:match(Msg, Decoded)).
 
@@ -605,14 +175,15 @@ from_maintains_tag_name_case_test() ->
     SignedTX = ar_bundles:sign_item(TX, hb:wallet()),
     ?event({signed_tx, SignedTX}),
     ?assert(ar_bundles:verify_item(SignedTX)),
-    TABM = from(SignedTX),
+    TABM = hb_util:ok(from(SignedTX, #{}, #{})),
     ?event({tabm, TABM}),
-    ConvertedTX = to(TABM),
+    ConvertedTX = hb_util:ok(to(TABM, #{}, #{})),
     ?event({converted_tx, ConvertedTX}),
     ?assert(ar_bundles:verify_item(ConvertedTX)),
     ?assertEqual(ConvertedTX, ar_bundles:normalize(SignedTX)).
 
 restore_tag_name_case_from_cache_test() ->
+    Opts = #{ store => hb_test_utils:test_store() },
     TX = #tx {
         tags = [
             {<<"Test-Tag">>, <<"test-value">>},
@@ -625,22 +196,22 @@ restore_tag_name_case_from_cache_test() ->
             SignedTX,
             <<"structured@1.0">>,
             <<"ans104@1.0">>,
-            #{}
+            Opts
         ),
     SignedID = hb_message:id(SignedMsg, all),
     ?event({signed_msg, SignedMsg}),
-    OnlyCommitted = hb_message:with_only_committed(SignedMsg),
+    OnlyCommitted = hb_message:with_only_committed(SignedMsg, Opts),
     ?event({only_committed, OnlyCommitted}),
-    {ok, ID} = hb_cache:write(SignedMsg, #{}),
+    {ok, ID} = hb_cache:write(SignedMsg, Opts),
     ?event({id, ID}),
-    {ok, ReadMsg} = hb_cache:read(SignedID, #{}),
+    {ok, ReadMsg} = hb_cache:read(SignedID, Opts),
     ?event({restored_msg, ReadMsg}),
-    ReadTX = to(ReadMsg),
+    {ok, ReadTX} = to(ReadMsg, #{}, Opts),
     ?event({restored_tx, ReadTX}),
     ?assert(hb_message:match(ReadMsg, SignedMsg)),
     ?assert(ar_bundles:verify_item(ReadTX)).
 
-duplicated_tag_name_test() ->
+unsigned_duplicated_tag_name_test() ->
     TX = ar_bundles:reset_ids(ar_bundles:normalize(#tx {
         tags = [
             {<<"Test-Tag">>, <<"test-value">>},
@@ -672,55 +243,186 @@ simple_to_conversion_test() ->
         <<"first-tag">> => <<"first-value">>,
         <<"second-tag">> => <<"second-value">>
     },
-    Encoded = to(Msg),
+    {ok, Encoded} = to(Msg, #{}, #{}),
     ?event({encoded, Encoded}),
-    Decoded = from(Encoded),
+    {ok, Decoded} = from(Encoded, #{}, #{}),
     ?event({decoded, Decoded}),
-    ?assert(hb_message:match(Msg, hb_message:uncommitted(Decoded))).
+    ?assert(hb_message:match(Msg, hb_message:uncommitted(Decoded, #{}))).
 
-only_committed_maintains_target_test() ->
-    TX = ar_bundles:sign_item(#tx {
-        target = crypto:strong_rand_bytes(32),
-        tags = [
-            {<<"test-tag">>, <<"test-value">>},
-            {<<"test-tag-2">>, <<"test-value-2">>}
-        ],
-        data = <<"test-data">>
-    }, ar_wallet:new()),
+% @doc Ensure that items with an explicitly defined target field lead to:
+% 1. A target being set in the `target' field of the TX record on inbound.
+% 2. The parsed message having a `target' field which is committed.
+% 3. The target field being placed back into the record, rather than the `tags',
+%    on re-encoding.
+external_item_with_target_field_test() ->
+    TX =
+        ar_bundles:sign_item(
+            #tx {
+                target = crypto:strong_rand_bytes(32),
+                tags = [
+                    {<<"test-tag">>, <<"test-value">>},
+                    {<<"test-tag-2">>, <<"test-value-2">>}
+                ],
+                data = <<"test-data">>
+            },
+            ar_wallet:new()
+        ),
+    EncodedTarget = hb_util:encode(TX#tx.target),
     ?event({tx, TX}),
     Decoded = hb_message:convert(TX, <<"structured@1.0">>, <<"ans104@1.0">>, #{}),
     ?event({decoded, Decoded}),
-    {ok, OnlyCommitted} = hb_message:with_only_committed(Decoded),
+    ?assertEqual(EncodedTarget, hb_maps:get(<<"target">>, Decoded, undefined, #{})),
+    {ok, OnlyCommitted} = hb_message:with_only_committed(Decoded, #{}),
     ?event({only_committed, OnlyCommitted}),
+    ?assertEqual(EncodedTarget, hb_maps:get(<<"target">>, OnlyCommitted, undefined, #{})),
     Encoded = hb_message:convert(OnlyCommitted, <<"ans104@1.0">>, <<"structured@1.0">>, #{}),
-    ?event({encoded, Encoded}),
+    ?assertEqual(TX#tx.target, Encoded#tx.target),
+    ?event({result, {initial, TX}, {result, Encoded}}),
+    ?assertEqual(TX, Encoded).
+
+% @doc Ensure that items made inside HyperBEAM use the tags to encode `target'
+% values, rather than the `target' field.
+generate_item_with_target_tag_test() ->
+    Msg =
+        #{
+            <<"target">> => Target = <<"NON-ID-TARGET">>,
+            <<"other-key">> => <<"other-value">>
+        },
+    {ok, TX} = to(Msg, #{}, #{}),
+    ?event({encoded_tx, TX}),
+    % The encoded TX should have ignored the `target' field, setting a tag instead.
+    ?assertEqual(?DEFAULT_TARGET, TX#tx.target),
+    Decoded = hb_message:convert(TX, <<"structured@1.0">>, <<"ans104@1.0">>, #{}),
+    ?event({decoded, Decoded}),
+    % The decoded message should have the `target' key set to the tag value.
+    ?assertEqual(Target, hb_maps:get(<<"target">>, Decoded, undefined, #{})),
+    {ok, OnlyCommitted} = hb_message:with_only_committed(Decoded, #{}),
+    ?event({only_committed, OnlyCommitted}),
+    % The target key should have been committed.
+    ?assertEqual(Target, hb_maps:get(<<"target">>, OnlyCommitted, undefined, #{})),
+    Encoded = hb_message:convert(OnlyCommitted, <<"ans104@1.0">>, <<"structured@1.0">>, #{}),
+    ?event({result, {initial, TX}, {result, Encoded}}),
+    ?assertEqual(TX, Encoded).
+
+generate_item_with_target_field_test() ->
+    Msg =
+        hb_message:commit(
+            #{
+                <<"target">> => Target = hb_util:encode(crypto:strong_rand_bytes(32)),
+                <<"other-key">> => <<"other-value">>
+            },
+            #{ priv_wallet => hb:wallet() },
+            <<"ans104@1.0">>
+        ),
+    {ok, TX} = to(Msg, #{}, #{}),
+    ?event({encoded_tx, TX}),
+    ?assertEqual(Target, hb_util:encode(TX#tx.target)),
+    Decoded = hb_message:convert(TX, <<"structured@1.0">>, <<"ans104@1.0">>, #{}),
+    ?event({decoded, Decoded}),
+    ?assertEqual(Target, hb_maps:get(<<"target">>, Decoded, undefined, #{})),
+    {ok, OnlyCommitted} = hb_message:with_only_committed(Decoded, #{}),
+    ?event({only_committed, OnlyCommitted}),
+    ?assertEqual(Target, hb_maps:get(<<"target">>, OnlyCommitted, undefined, #{})),
+    Encoded = hb_message:convert(OnlyCommitted, <<"ans104@1.0">>, <<"structured@1.0">>, #{}),
+    ?event({result, {initial, TX}, {result, Encoded}}),
     ?assertEqual(TX, Encoded).
 
-quantity_field_is_ignored_in_from_test() ->
-    % Ensure that converting from a signed TX with a quantity field results
-    % in a message _without_ a quantity field.
+type_tag_test() ->
     TX =
         ar_bundles:sign_item(
             #tx {
-                tags = [
-                    {<<"test-key">>, <<"value">>}
-                ],
-                quantity = 100
+                tags = [{<<"type">>, <<"test-value">>}]
             },
             ar_wallet:new()
         ),
     ?event({tx, TX}),
-    EncodedMsg = from(TX),
-    ?assertEqual(not_found, hb_ao:get(<<"quantity">>, EncodedMsg, #{})).
+    Structured = hb_message:convert(TX, <<"structured@1.0">>, <<"ans104@1.0">>, #{}),
+    ?event({structured, Structured}),
+    TX2 = hb_message:convert(Structured, <<"ans104@1.0">>, <<"structured@1.0">>, #{}),
+    ?event({after_conversion, TX2}),
+    ?assertEqual(TX, TX2).
 
-quantity_key_encoded_as_tag_test() ->
-    % Ensure that the reciprocal behavior works: converting a message with
-    % a quantity key should yield a tag, rather than a quantity field.
-    Msg = #{ <<"quantity">> => <<"100">> },
-    EncodedTX = to(Msg),
+ao_data_key_test() ->
+    Msg =
+        hb_message:commit(
+            #{
+                <<"other-key">> => <<"Normal value">>,
+                <<"body">> => <<"Body value">>
+            },
+            #{ priv_wallet => hb:wallet() },
+            <<"ans104@1.0">>
+        ),
     ?event({msg, Msg}),
-    ?assertEqual(0, EncodedTX#tx.quantity),
-    % Ensure that converting back to a message yields the original.
-    DecodedMsg2 = from(EncodedTX),
-    ?event({decoded_msg2, DecodedMsg2}),
-    ?assert(hb_message:match(Msg, DecodedMsg2) == true).
+    Enc = hb_message:convert(Msg, <<"ans104@1.0">>, #{}),
+    ?event({enc, Enc}),
+    ?assertEqual(<<"Body value">>, Enc#tx.data),
+    Dec = hb_message:convert(Enc, <<"structured@1.0">>, <<"ans104@1.0">>, #{}),
+    ?event({dec, Dec}),
+    ?assert(hb_message:verify(Dec, all, #{})).
+        
+simple_signed_to_httpsig_test() ->
+    Structured =
+        hb_message:commit(
+            #{ <<"test-tag">> => <<"test-value">> },
+            #{ priv_wallet => ar_wallet:new() },
+            #{
+                <<"commitment-device">> => <<"ans104@1.0">>
+            }
+        ),
+    ?event(debug_test, {msg, Structured}),
+    HTTPSig =
+        hb_message:convert(
+            Structured,
+            <<"httpsig@1.0">>,
+            <<"structured@1.0">>,
+            #{}
+        ),
+    ?event(debug_test, {httpsig, HTTPSig}),
+    Structured2 =
+        hb_message:convert(
+            HTTPSig,
+            <<"structured@1.0">>,
+            <<"httpsig@1.0">>,
+            #{}
+        ),
+    ?event(debug_test, {decoded, Structured2}),
+	Match = hb_message:match(Structured, Structured2, #{}),
+    ?assert(Match),
+    ?assert(hb_message:verify(Structured2, all, #{})),
+    HTTPSig2 = hb_message:convert(Structured2, <<"httpsig@1.0">>, <<"structured@1.0">>, #{}),
+    ?event(debug_test, {httpsig2, HTTPSig2}),
+    ?assert(hb_message:verify(HTTPSig2, all, #{})),
+    ?assert(hb_message:match(HTTPSig, HTTPSig2)).
+
+unsorted_tag_map_test() ->
+    TX =
+        ar_bundles:sign_item(
+            #tx{
+                format = ans104,
+                tags = [
+                    {<<"z">>, <<"position-1">>},
+                    {<<"a">>, <<"position-2">>}
+                ],
+                data = <<"data">>
+            },
+            ar_wallet:new()
+        ),
+    ?assert(ar_bundles:verify_item(TX)),
+    ?event(debug_test, {tx, TX}),
+    {ok, TABM} = dev_codec_ans104:from(TX, #{}, #{}),
+    ?event(debug_test, {tabm, TABM}),
+    {ok, Decoded} = dev_codec_ans104:to(TABM, #{}, #{}),
+    ?event(debug_test, {decoded, Decoded}),
+    ?assert(ar_bundles:verify_item(Decoded)).
+
+field_and_tag_ordering_test() ->
+    UnsignedTABM = #{
+        <<"a">> => <<"value1">>,
+        <<"z">> => <<"value2">>,
+        <<"target">> => <<"NON-ID-TARGET">>
+    },
+        
+    Wallet = hb:wallet(),
+    SignedTABM = hb_message:commit(
+        UnsignedTABM, #{priv_wallet => Wallet}, <<"ans104@1.0">>),
+    ?assert(hb_message:verify(SignedTABM)).
\ No newline at end of file
diff --git a/src/dev_codec_ans104_from.erl b/src/dev_codec_ans104_from.erl
new file mode 100644
index 000000000..1ebe8524e
--- /dev/null
+++ b/src/dev_codec_ans104_from.erl
@@ -0,0 +1,307 @@
+%%% @doc Library functions for decoding ANS-104-style data items to TABM form.
+-module(dev_codec_ans104_from).
+-export([fields/2, tags/2, data/4, committed/5, base/5]).
+-export([with_commitments/5]).
+-include("include/hb.hrl").
+
+%% @doc Return a TABM message containing the fields of the given decoded
+%% ANS-104 data item that should be included in the base message.
+fields(Item, _Opts) ->
+    case Item#tx.target of
+        ?DEFAULT_TARGET -> #{};
+        Target ->
+            #{
+                <<"target">> => hb_util:encode(Target)
+            }
+    end.
+
+%% @doc Return a TABM of the raw tags of the item, including all metadata
+%% (e.g. `ao-type', `ao-data-key', etc.)
+tags(Item, Opts) ->
+    Tags = hb_ao:normalize_keys(
+        deduplicating_from_list(Item#tx.tags, Opts),
+        Opts
+    ),
+    ao_types(Tags, Opts).
+
+%% @doc Ensure the encoded keys in the `ao-types' field are lowercased and
+%% normalized like the other keys in the tags field.
+ao_types(#{ <<"ao-types">> := AoTypes } = Tags, Opts) ->
+    AOTypes = dev_codec_structured:decode_ao_types(AoTypes, Opts),
+    % Normalize all keys in the ao-types map and re-encode
+    NormAOTypes =
+        maps:fold(
+            fun(Key, Val, Acc) ->
+                NormKey = hb_util:to_lower(hb_ao:normalize_key(Key)),
+                Acc#{ NormKey => Val }
+            end,
+            #{},
+            AOTypes
+        ),
+    EncodedAOTypes = dev_codec_structured:encode_ao_types(NormAOTypes, Opts),
+    Tags#{ <<"ao-types">> := EncodedAOTypes };
+ao_types(Tags, _Opts) ->
+    Tags.
+
+%% @doc Return a TABM of the keys and values found in the data field of the item.
+data(Item, Req, Tags, Opts) ->
+    % If the data field is empty, we return an empty map. If it is a map, we
+    % return it as such. Otherwise, we return a map with the data key set to
+    % the raw data value. This handles unbundling nested messages, as well as 
+    % applying the `ao-data-key' tag if given.
+    DataKey = maps:get(<<"ao-data-key">>, Tags, <<"data">>),
+    case {DataKey, Item#tx.data} of
+        {_, ?DEFAULT_DATA} -> #{};
+        {DataKey, Map} when is_map(Map) ->
+            % If the data is a map, we need to recursively turn its children
+            % into messages from their tx representations.
+            hb_ao:normalize_keys(
+                hb_maps:map(
+                    fun(_, InnerValue) ->
+                        hb_util:ok(dev_codec_ans104:from(InnerValue, Req, Opts))
+                    end,
+                    Map,
+                    Opts
+                ),
+                Opts
+            );
+        {DataKey, Data} -> #{ DataKey => Data }
+    end.
+
+%% @doc Calculate the list of committed keys for an item, based on its 
+%% components (fields, tags, and data).
+committed(Item, Fields, Tags, Data, Opts) ->
+    hb_util:unique(
+        data_keys(Data, Opts) ++
+        tag_keys(Item, Opts) ++
+        field_keys(Fields, Tags, Data, Opts)
+    ).
+
+%% @doc Return the list of the keys from the fields TABM.
+field_keys(BaseFields, Tags, Data, Opts) ->
+    HasTarget =
+        hb_maps:is_key(<<"target">>, BaseFields, Opts) orelse
+        hb_maps:is_key(<<"target">>, Tags, Opts) orelse
+        hb_maps:is_key(<<"target">>, Data, Opts),
+    case HasTarget of
+        true -> [<<"target">>];
+        false -> []
+    end.
+
+%% @doc Return the list of the keys from the data TABM.
+data_keys(Data, Opts) ->
+    hb_util:to_sorted_keys(Data, Opts).
+
+%% @doc Return the list of the keys from the tags TABM. Filter all metadata
+%% tags: `ao-data-key', `ao-types', `bundle-format', `bundle-version'.
+tag_keys(Item, _Opts) ->
+    MetaTags = [
+        <<"bundle-format">>,
+        <<"bundle-version">>,
+        <<"bundle-map">>,
+        <<"ao-data-key">>
+    ],
+    lists:filtermap(
+        fun({Tag, _}) ->
+            case lists:member(Tag, MetaTags) of
+                true -> false;
+                false -> {true, hb_util:to_lower(hb_ao:normalize_key(Tag))}
+            end
+        end,
+        Item#tx.tags
+    ).
+
+%% @doc Return the complete message for an item, less its commitments. The
+%% precidence order for choosing fields to place into the base message is:
+%% 1. Data
+%% 2. Tags
+%% 3. Fields
+base(CommittedKeys, Fields, Tags, Data, Opts) ->
+    hb_maps:from_list(
+        lists:map(
+            fun(Key) ->
+                case hb_maps:find(Key, Data, Opts) of
+                    error ->
+                        case hb_maps:find(Key, Fields, Opts) of
+                            error ->
+                                case hb_maps:find(Key, Tags, Opts) of
+                                    error -> throw({missing_key, Key});
+                                    {ok, Value} -> {Key, Value}
+                                end;
+                            {ok, Value} -> {Key, Value}
+                        end;
+                    {ok, Value} -> {Key, Value}
+                end
+            end,
+            CommittedKeys
+        )
+    ).
+
+%% @doc Return a message with the appropriate commitments added to it.
+with_commitments(Item, Tags, Base, CommittedKeys, Opts) ->
+    case Item#tx.signature of
+        ?DEFAULT_SIG ->
+            case normal_tags(Item#tx.tags) of
+                true -> Base;
+                false ->
+                    with_unsigned_commitment(Item, Tags, Base, CommittedKeys, Opts)
+            end;
+        _ -> with_signed_commitment(Item, Tags, Base, CommittedKeys, Opts)
+    end.
+
+%% @doc Returns a commitments message for an item, containing an unsigned
+%% commitment.
+with_unsigned_commitment(Item, Tags, UncommittedMessage, CommittedKeys, Opts) ->
+    ID = hb_util:human_id(Item#tx.unsigned_id),
+    UncommittedMessage#{
+        <<"commitments">> => #{
+            ID =>
+                filter_unset(
+                    #{
+                        <<"commitment-device">> => <<"ans104@1.0">>,
+                        <<"committed">> => CommittedKeys,
+                        <<"type">> => <<"unsigned-sha256">>,
+                        <<"bundle">> => bundle_commitment_key(Tags, Opts),
+                        <<"original-tags">> => original_tags(Item, Opts),
+                        <<"field-target">> =>
+                            case Item#tx.target of
+                                ?DEFAULT_TARGET -> unset;
+                                Target -> hb_util:encode(Target)
+                            end,
+                        <<"field-anchor">> =>
+                            case Item#tx.anchor of
+                                ?DEFAULT_LAST_TX -> unset;
+                                LastTX -> LastTX
+                            end
+                    },
+                    Opts
+                )
+        }
+    }.
+
+%% @doc Returns a commitments message for an item, containing a signed
+%% commitment.
+with_signed_commitment(Item, Tags, UncommittedMessage, CommittedKeys, Opts) ->
+    Address = hb_util:human_id(ar_wallet:to_address(Item#tx.owner)),
+    ID = hb_util:human_id(Item#tx.id),
+    Commitment =
+        filter_unset(
+            #{
+                <<"commitment-device">> => <<"ans104@1.0">>,
+                <<"committer">> => Address,
+                <<"committed">> => CommittedKeys,
+                <<"signature">> => hb_util:encode(Item#tx.signature),
+                <<"keyid">> =>
+                    <<"publickey:", (hb_util:encode(Item#tx.owner))/binary>>,
+                <<"type">> => <<"rsa-pss-sha256">>,
+                <<"bundle">> => bundle_commitment_key(Tags, Opts),
+                <<"original-tags">> => original_tags(Item, Opts),
+                <<"field-anchor">> =>
+                    case Item#tx.anchor of
+                        ?DEFAULT_LAST_TX -> unset;
+                        LastTX -> LastTX
+                    end,
+                <<"field-target">> =>
+                    case Item#tx.target of
+                        ?DEFAULT_TARGET -> unset;
+                        Target -> hb_util:encode(Target)
+                    end
+            },
+            Opts
+        ),
+    UncommittedMessage#{
+        <<"commitments">> => #{
+            ID => Commitment
+        }
+    }.
+
+%% @doc Return the bundle key for an item.
+bundle_commitment_key(Tags, Opts) ->
+    hb_util:bin(hb_maps:is_key(<<"bundle-format">>, Tags, Opts)).
+
+%% @doc Check whether a list of key-value pairs contains only normalized keys.
+normal_tags(Tags) ->
+    lists:all(
+        fun({Key, _}) ->
+            hb_util:to_lower(hb_ao:normalize_key(Key)) =:= Key
+        end,
+        Tags
+    ).
+
+%% @doc Return the original tags of an item if it is applicable. Otherwise,
+%% return `undefined'.
+original_tags(Item, _Opts) ->
+    case normal_tags(Item#tx.tags) of
+        true -> unset;
+        false -> encoded_tags_to_map(Item#tx.tags)
+    end.
+
+%% @doc Convert an ANS-104 encoded tag list into a HyperBEAM-compatible map.
+encoded_tags_to_map(Tags) ->
+    hb_util:list_to_numbered_message(
+        lists:map(
+            fun({Key, Value}) ->
+                #{
+                    <<"name">> => Key,
+                    <<"value">> => Value
+                }
+            end,
+            Tags
+        )
+    ).
+
+%% @doc Remove all undefined values from a map.
+filter_unset(Map, Opts) ->
+    hb_maps:filter(
+        fun(_, Value) ->
+            case Value of
+                unset -> false;
+                _ -> true
+            end
+        end,
+        Map,
+        Opts
+    ).
+
+%% @doc Deduplicate a list of key-value pairs by key, generating a list of
+%% values for each normalized key if there are duplicates.
+deduplicating_from_list(Tags, Opts) ->
+    % Aggregate any duplicated tags into an ordered list of values.
+    Aggregated =
+        lists:foldl(
+            fun({Key, Value}, Acc) ->
+                NormKey = hb_util:to_lower(hb_ao:normalize_key(Key)),
+                case hb_maps:get(NormKey, Acc, undefined, Opts) of
+                    undefined -> hb_maps:put(NormKey, Value, Acc, Opts);
+                    Existing when is_list(Existing) ->
+                        hb_maps:put(NormKey, Existing ++ [Value], Acc, Opts);
+                    ExistingSingle ->
+                        hb_maps:put(NormKey, [ExistingSingle, Value], Acc, Opts)
+                end
+            end,
+            #{},
+            Tags
+        ),
+    ?event({deduplicating_from_list, {aggregated, Aggregated}}),
+    % Convert aggregated values into a structured-field list.
+    Res =
+        hb_maps:map(
+            fun(_Key, Values) when is_list(Values) ->
+                % Convert Erlang lists of binaries into a structured-field list.
+                iolist_to_binary(
+                    hb_structured_fields:list(
+                        [
+                            {item, {string, Value}, []}
+                        ||
+                            Value <- Values
+                        ]
+                    )
+                );
+            (_Key, Value) ->
+                Value
+            end,
+            Aggregated,
+            Opts
+        ),
+    ?event({deduplicating_from_list, {result, Res}}),
+    Res.
\ No newline at end of file
diff --git a/src/dev_codec_ans104_to.erl b/src/dev_codec_ans104_to.erl
new file mode 100644
index 000000000..f6ba53b59
--- /dev/null
+++ b/src/dev_codec_ans104_to.erl
@@ -0,0 +1,310 @@
+%%% @doc Library functions for encoding messages to the ANS-104 format.
+-module(dev_codec_ans104_to).
+-export([maybe_load/3, siginfo/2, data/3, tags/4]).
+-include("include/hb.hrl").
+
+%% @doc Determine if the message should be loaded from the cache and re-converted
+%% to the TABM format. We do this if the `bundle' key is set to true.
+maybe_load(RawTABM, Req, Opts) ->
+    case hb_util:atom(hb_ao:get(<<"bundle">>, Req, false, Opts)) of
+        false -> RawTABM;
+        true ->
+            % Convert back to the fully loaded structured@1.0 message, then
+            % convert to TABM with bundling enabled.
+            Structured = hb_message:convert(RawTABM, <<"structured@1.0">>, Opts),
+            Loaded = hb_cache:ensure_all_loaded(Structured, Opts),
+            % Convert to TABM with bundling enabled.
+            LoadedTABM =
+                hb_message:convert(
+                    Loaded,
+                    tabm,
+                    #{
+                        <<"device">> => <<"structured@1.0">>,
+                        <<"bundle">> => true
+                    },
+                    Opts
+                ),
+            % Ensure the commitments from the original message are the only
+            % ones in the fully loaded message.
+            LoadedComms = maps:get(<<"commitments">>, RawTABM, #{}),
+            LoadedTABM#{ <<"commitments">> => LoadedComms }
+    end.
+
+%% @doc Calculate the fields for a message, returning an initial TX record.
+%% One of the nuances here is that the `target' field must be set correctly.
+%% If the message has a commitment, we extract the `field-target' if found and
+%% place it in the `target' field. If the message does not have a commitment,
+%% we check if the `target' field is set in the message. If it is encodable as
+%% a valid 32-byte binary ID (assuming it is base64url encoded in the `to' call),
+%% we place it in the `target' field. Otherwise, we leave it unset.
+siginfo(Message, Opts) ->
+    MaybeCommitment =
+        hb_message:commitment(
+            #{ <<"commitment-device">> => <<"ans104@1.0">> },
+            Message,
+            Opts
+        ),
+    case MaybeCommitment of
+        {ok, _, Commitment} -> commitment_to_tx(Commitment, Opts);
+        not_found ->
+            case hb_maps:find(<<"target">>, Message, Opts) of
+                {ok, EncodedTarget} ->
+                    case hb_util:safe_decode(EncodedTarget) of
+                        {ok, Target} when ?IS_ID(Target) ->
+                            #tx{ target = Target };
+                        _ -> #tx{}
+                    end;
+                error -> #tx{}
+            end;
+        multiple_matches ->
+            throw({multiple_ans104_commitments_unsupported, Message})
+    end.
+
+%% @doc Convert a commitment to a base TX record. Extracts the owner, signature,
+%% tags, and last TX from the commitment. If the value is not present, the
+%% default value is used.
+commitment_to_tx(Commitment, Opts) ->
+    Signature =
+        hb_util:decode(
+            maps:get(<<"signature">>, Commitment, hb_util:encode(?DEFAULT_SIG))
+        ),
+    Owner =
+        case hb_maps:find(<<"keyid">>, Commitment, Opts) of
+            {ok, KeyID} ->
+                hb_util:decode(
+                    dev_codec_httpsig_keyid:remove_scheme_prefix(KeyID)
+                );
+            error -> ?DEFAULT_OWNER
+        end,
+    Tags =
+        case hb_maps:find(<<"original-tags">>, Commitment, Opts) of
+            {ok, OriginalTags} -> original_tags_to_tags(OriginalTags);
+            error -> []
+        end,
+    LastTX =
+        case hb_maps:find(<<"field-anchor">>, Commitment, Opts) of
+            {ok, EncodedLastTX} -> hb_util:decode(EncodedLastTX);
+            error -> ?DEFAULT_LAST_TX
+        end,
+    Target =
+        case hb_maps:find(<<"field-target">>, Commitment, Opts) of
+            {ok, EncodedTarget} -> hb_util:decode(EncodedTarget);
+            error -> ?DEFAULT_TARGET
+        end,
+    ?event({commitment_owner, Owner}),
+    ?event({commitment_signature, Signature}),
+    ?event({commitment_tags, Tags}),
+    ?event({commitment_last_tx, LastTX}),
+    #tx{
+        owner = Owner,
+        signature = Signature,
+        tags = Tags,
+        anchor = LastTX,
+        target = Target
+    }.
+
+%% @doc Calculate the data field for a message.
+data(TABM, Req, Opts) ->
+    DataKey = inline_key(TABM),
+    % Translate the keys into a binary map. If a key has a value that is a map,
+    % we recursively turn its children into messages.
+    UnencodedNestedMsgs = data_messages(TABM, Opts),
+    NestedMsgs =
+        hb_maps:map(
+            fun(_, Msg) ->
+                hb_util:ok(dev_codec_ans104:to(Msg, Req, Opts))
+            end,
+            UnencodedNestedMsgs,
+            Opts
+        ),
+    DataVal = hb_maps:get(DataKey, TABM, ?DEFAULT_DATA),
+    ?event(debug_data, {data_val, DataVal}),
+    case {DataVal, hb_maps:size(NestedMsgs, Opts)} of
+        {Binary, 0} when is_binary(Binary) ->
+            % There are no nested messages, so we return the binary alone.
+            Binary;
+        {?DEFAULT_DATA, _} ->
+            NestedMsgs;
+        {DataVal, _} ->
+            NestedMsgs#{
+                DataKey => hb_util:ok(dev_codec_ans104:to(DataVal, Req, Opts))
+            }
+    end.
+
+%% @doc Calculate the data value for a message. The rules are:
+%% 1. There should be no more than 128 keys in the tags.
+%% 2. Each key must be equal or less to 1024 bytes.
+%% 3. Each value must be equal or less to 3072 bytes.
+%% Presently, if we exceed these limits, we throw an error.
+data_messages(TABM, Opts) when is_map(TABM) ->
+    UncommittedTABM =
+        hb_maps:without(
+            [<<"commitments">>, <<"data">>, <<"target">>],
+            hb_private:reset(TABM),
+            Opts
+        ),
+    % If there are too many keys in the TABM, throw an error.
+    if map_size(UncommittedTABM) > 128 ->
+        throw({too_many_keys, UncommittedTABM});
+    true ->
+        % If there are less than 128 keys, we return those that are large, or
+        % are nested messages.
+        hb_maps:filter(
+            fun(Key, Value) ->
+                case is_map(Value) of
+                    true -> true;
+                    false -> byte_size(Value) > 3072 orelse byte_size(Key) > 1024
+                end
+            end,
+            UncommittedTABM,
+            Opts
+        )
+    end.
+
+%% @doc Calculate the tags field for a data item. If the TX already has tags
+%% from the commitment decoding step, we use them. Otherwise we determine the
+%% keys to use from the `committed' field of the TABM.
+tags(#tx{ tags = ExistingTags }, _, _, _) when ExistingTags =/= [] ->
+    ExistingTags;
+tags(TX, TABM, Data, Opts) ->
+    DataKey = inline_key(TABM),
+    MaybeCommitment =
+        hb_message:commitment(
+            #{ <<"commitment-device">> => <<"ans104@1.0">> },
+            TABM,
+            Opts
+        ),
+    CommittedTagKeys =
+        case MaybeCommitment of
+            {ok, _, Commitment} ->
+                % There is already a commitment, so the tags and order are
+                % pre-determined. However, if the message has been bundled,
+                % any `+link`-suffixed keys in the committed list may need to
+                % be resolved to their base keys (e.g., `output+link` -> `output`).
+                % We normalize each committed key to whichever form actually
+                % exists in the current TABM to avoid missing keys.
+                lists:map(
+                    fun(CommittedKey) ->
+                        NormalizedKey = hb_ao:normalize_key(CommittedKey),
+                        BaseKey = hb_link:remove_link_specifier(NormalizedKey),
+                        case hb_maps:find(BaseKey, TABM, Opts) of
+                            {ok, _} -> BaseKey;
+                            error ->
+                                BaseKeyLink = <<BaseKey/binary, "+link">>,
+                                case hb_maps:find(BaseKeyLink, TABM, Opts) of
+                                    {ok, _} -> BaseKeyLink;
+                                    error -> BaseKey
+                                end
+                        end
+                    end,
+                    hb_util:message_to_ordered_list(
+                        hb_util:ok(
+                            hb_maps:find(<<"committed">>, Commitment, Opts)
+                        )
+                    )
+                ) --
+                    % If the target is set in the base TX from the
+                    % commitment, we check if the TABM equals that value. If it does,
+                    % we do not additionally add the target tag. If they differ, we
+                    % include it.
+                    case include_target_tag(TX, TABM, Opts) of
+                        false -> [<<"target">>];
+                        true -> []
+                    end;
+            not_found ->
+                % There is no commitment, so we need to generate the tags. The
+                % bundle-format and bundle-version tags are added by `ar_bundles`
+                % so we do not add them here. The ao-data-key tag is added if it
+                % is set to a non-default value, followed by the keys from the
+                % TABM (less the data keys and target key -- see 
+                % `include_target_tag/3` for rationale).
+                hb_util:list_without(
+                    [<<"commitments">>] ++
+                        if is_map(Data) -> hb_maps:keys(Data, Opts);
+                        true -> []
+                        end ++
+                        case include_target_tag(TX, TABM, Opts) of
+                            false -> [<<"target">>];
+                            true -> []
+                        end,
+                    hb_util:to_sorted_keys(hb_private:reset(TABM), Opts)
+                );
+            multiple_matches ->
+                throw({multiple_ans104_commitments_unsupported, TABM})
+        end,
+    ?event(
+        {tags_before_data_key,
+            {committed_tag_keys, CommittedTagKeys},
+            {data_key, DataKey},
+            {data, Data},
+            {tabm, TABM}
+        }),
+    committed_tag_keys_to_tags(TX, TABM, DataKey, CommittedTagKeys, Opts).
+
+%% @doc Return whether to include the `target' tag in the tags list.
+include_target_tag(TX, TABM, Opts) ->
+    case {TX#tx.target, hb_maps:get(<<"target">>, TABM, undefined, Opts)} of
+        {?DEFAULT_TARGET, _} -> true;
+        {FieldTarget, TagTarget} when FieldTarget =/= TagTarget -> false;
+        _ -> true
+    end.
+
+%% @doc Apply the `ao-data-key' to the committed keys to generate the list of
+%% tags to include in the message.
+committed_tag_keys_to_tags(TX, TABM, DataKey, Committed, Opts) ->
+    DataKeysToExclude =
+        case TX#tx.data of
+            Data when is_map(Data)-> maps:keys(Data);
+            _ -> []
+        end,
+    case DataKey of
+        <<"data">> -> [];
+        _ -> [{<<"ao-data-key">>, DataKey}]
+    end ++
+    lists:map(
+        fun(Key) ->
+            case hb_maps:find(Key, TABM, Opts) of
+                error -> throw({missing_committed_key, Key});
+                {ok, Value} -> {Key, Value}
+            end
+        end,
+        hb_util:list_without(
+            [DataKey | DataKeysToExclude],
+            Committed
+        )
+    ).
+
+%%% Utility functions
+    
+%% @doc Determine if an `ao-data-key` should be added to the message.
+inline_key(Msg) ->
+    InlineKey = maps:get(<<"ao-data-key">>, Msg, undefined),
+    case {
+        InlineKey,
+        maps:get(<<"data">>, Msg, ?DEFAULT_DATA) == ?DEFAULT_DATA,
+        maps:is_key(<<"body">>, Msg)
+            andalso not ?IS_LINK(maps:get(<<"body">>, Msg, undefined))
+    } of
+        {Explicit, _, _} when Explicit =/= undefined ->
+            % ao-data-key already exists, so we honor it.
+            InlineKey;
+        {_, true, true} -> 
+            % There is no specific data field set, but there is a body, so we
+            % use that as the `inline-key`.
+            <<"body">>;
+        _ ->
+            % Default: `data' resolves to `data'.
+            <<"data">>
+    end.
+
+%% @doc Convert a HyperBEAM-compatible map into an ANS-104 encoded tag list,
+%% recreating the original order of the tags.
+original_tags_to_tags(TagMap) ->
+    OrderedList = hb_util:message_to_ordered_list(hb_private:reset(TagMap)),
+    ?event({ordered_tagmap, {explicit, OrderedList}, {input, {explicit, TagMap}}}),
+    lists:map(
+        fun(#{ <<"name">> := Key, <<"value">> := Value }) ->
+            {Key, Value}
+        end,
+        OrderedList
+    ).
\ No newline at end of file
diff --git a/src/dev_codec_cookie.erl b/src/dev_codec_cookie.erl
new file mode 100644
index 000000000..8765e0c7d
--- /dev/null
+++ b/src/dev_codec_cookie.erl
@@ -0,0 +1,473 @@
+%%% @doc A utility device that manages setting and encoding/decoding the cookies
+%%% found in requests from a caller. This device implements the `~cookie@1.0'
+%%% codec, inline with the `~message@1.0' schema for conversion.
+%%% 
+%%% Additionally, a `commit' to a message using a secret generated and stored 
+%%% in the cookies of the caller, and a `verify' key that validates said
+%%% commitments. In addition, a `generate' key is provided to perform only the
+%%% generation side of the commitment process. The `finalize' key may be 
+%%% employed to add a `set' operation to the end of a message sequence, which
+%%% is used in hooks that need to ensure a caller always receives cookies
+%%% generated outside of the normal AO-Core execution flow. In totality, these
+%%% keys implement the `generator' interface type, and may be employed in
+%%% various contexts. For example, `~auth-hook@1.0' may be configured to use
+%%% this device to generate and store secrets in the cookies of the caller,
+%%% which are then used with the `~proxy-wallet@1.0' device to sign requests.
+%%% 
+%%% The `commit' and `verify' keys utilize the `~httpsig@1.0''s HMAC `secret'
+%%% commitment scheme, which uses a secret key to commit to a message, with the
+%%% `committer' being listed as a hash of the secret.
+%%% 
+%%% This device supports the following paths:
+%%% 
+%%% `/commit': Sets a `secret' key in the cookies of the caller. The name of 
+%%% the cookie is calculated as the hash of the secret. 
+%%% `/verify': Verifies the caller's request by checking the committer in the
+%%% request matches the secret in the cookies of the base message.
+%%% `/store': Sets the keys in the request message in the cookies of the caller.
+%%% `/extract': Extracts the cookies from a base message.
+%%% `/reset': Removes all cookie keys from the base message.
+%%% `/to': Converts a message containing cookie sources (`cookie', `set-cookie',
+%%% or `priv/cookie') into the format specified in the request message (e.g.
+%%% `set-cookie', `cookie').
+%%% `/from': Converts a message containing encoded cookies into a message
+%%% containing the cookies parsed and normalized.
+-module(dev_codec_cookie).
+%%% Public cookie manipulation API.
+-export([get_cookie/3, store/3, extract/3, reset/2]).
+%%% Public message codec API.
+-export([to/3, from/3]).
+%%% Public commit/verify API.
+-export([commit/3, verify/3]).
+%%% Generator API.
+-export([generate/3, finalize/3]).
+%%% Public utility functions.
+-export([opts/1]).
+-include_lib("eunit/include/eunit.hrl").
+-include("include/hb.hrl").
+
+%% @doc Get the private store options to use for functions in the cookie device.
+opts(Opts) -> hb_private:opts(Opts).
+
+%%% ~message@1.0 Commitments API keys.
+commit(Base, Req, RawOpts) -> dev_codec_cookie_auth:commit(Base, Req, RawOpts).
+verify(Base, Req, RawOpts) -> dev_codec_cookie_auth:verify(Base, Req, RawOpts).
+
+%% @doc Preprocessor keys that utilize cookies and the `~secret@1.0' device to
+%% sign inbound HTTP requests from users if they are not already signed. We use
+%% the `~hook@1.0' authentication framework to implement this.
+generate(Base, Req, Opts) ->
+    dev_codec_cookie_auth:generate(Base, Req, Opts).
+
+%% @doc Finalize an `on-request' hook by adding the `set-cookie' header to the
+%% end of the message sequence.
+finalize(Base, Request, Opts) ->
+    dev_codec_cookie_auth:finalize(Base, Request, Opts).
+
+%% @doc Get the cookie with the given key from the base message. The format of
+%% the cookie is determined by the `format' key in the request message:
+%% - `default': The cookie is returned in its raw form. It will be a message
+%%   if the source was a `set-cookie' header line containing attributes/flags,
+%%   or a binary if only the value was provided (as with the `cookie' header).
+%% - `set-cookie': The cookie is normalized to a message with `value',
+%%   `attributes', and `flags' keys.
+%% - `cookie': The cookie is normalized to a binary, ommitting any attributes
+%%   or flags.
+%% 
+%% The `format' may be specified in the request message as the `req:format' key.
+%% If no `format' is specified, the default is `default'.
+get_cookie(Base, Req, RawOpts) ->
+    Opts = opts(RawOpts),
+    {ok, Cookies} = extract(Base, Req, Opts),
+    Key = hb_maps:get(<<"key">>, Req, undefined, Opts),
+    case hb_maps:get(Key, Cookies, undefined, Opts) of
+        undefined -> {error, not_found};
+        Cookie ->
+            Format = hb_maps:get(<<"format">>, Req, <<"default">>, Opts),
+            case Format of
+                <<"default">> -> {ok, Cookie};
+                <<"set-cookie">> -> {ok, normalize_cookie_value(Cookie)};
+                <<"cookie">> -> {ok, value(Cookie)}
+            end
+    end.
+
+%% @doc Return the parsed and normalized cookies from a message.
+extract(Msg, Req, Opts) ->
+    {ok, MsgWithCookie} = from(Msg, Req, Opts),
+    Cookies = hb_private:get(<<"cookie">>, MsgWithCookie, #{}, Opts),
+    {ok, Cookies}.
+
+%% @doc Set the keys in the request message in the cookies of the caller. Removes
+%% a set of base keys from the request message before setting the remainder as
+%% cookies.
+store(Base, Req, RawOpts) ->
+    Opts = opts(RawOpts),
+    ?event({store, {base, Base}, {req, Req}}),
+    {ok, ExistingCookies} = extract(Base, Req, Opts),
+    ?event({store, {existing_cookies, ExistingCookies}}),
+    {ok, ResetBase} = reset(Base, Opts),
+    ?event({store, {reset_base, ResetBase}}),
+    MsgToSet =
+        hb_maps:without(
+            [
+                <<"path">>,
+                <<"accept-bundle">>,
+                <<"ao-peer">>,
+                <<"host">>,
+                <<"method">>,
+                <<"body">>
+            ],
+            hb_private:reset(Req),
+            Opts
+        ),
+    ?event({store, {msg_to_set, MsgToSet}}),
+    NewCookies = hb_maps:merge(ExistingCookies, MsgToSet, Opts),
+    NewBase = hb_private:set(ResetBase, <<"cookie">>, NewCookies, Opts),
+    {ok, NewBase}.
+
+%% @doc Remove all cookie keys from the given message (including `cookie' and
+%% `set-cookie' in the base, and `priv/cookie' in the request message).
+reset(Base, RawOpts) ->
+    Opts = opts(RawOpts),
+    WithoutBaseCookieKeys =
+        hb_maps:without(
+            [<<"cookie">>, <<"set-cookie">>],
+            Base,
+            Opts
+        ),
+    WithoutPrivCookie =
+        hb_private:set(
+            WithoutBaseCookieKeys,
+            <<"cookie">>,
+            unset,
+            Opts
+        ),
+    {ok, WithoutPrivCookie}.
+
+%% @doc Convert a message containing cookie sources (`cookie', `set-cookie',
+%% or `priv/cookie') into a message containing the cookies serialized as the
+%% specified `format' (given in the request message). The `format' may take the
+%% following values:
+%% 
+%% - `set-cookie': A list of encoded cookie binary header lines (e.g.
+%%   `"key1=value1; attr1=value2; flag1; flag2..."').
+%% - `cookie': A single, concatenated cookie header line without attributes or
+%%   flags (e.g. `"key1=value1; key2=value2; ..."').
+%% 
+%% Note that the `format: cookie' form is information lossy: All provided
+%% attributes and flags are discarded.
+to(Msg, Req, Opts) ->
+    ?event({to, {msg, Msg}, {req, Req}}),
+    CookieOpts = opts(Opts),
+    LoadedMsg = hb_cache:ensure_all_loaded(Msg, CookieOpts),
+    ?event({to, {loaded_msg, LoadedMsg}}),
+    do_to(LoadedMsg, Req, CookieOpts).
+do_to(Msg, Req = #{ <<"format">> := <<"set-cookie">> }, Opts) when is_map(Msg) ->
+    ?event({to_set_cookie, {msg, Msg}, {req, Req}}),
+    {ok, ExtractedParsedCookies} = extract(Msg, Req, Opts),
+    {ok, ResetBase} = reset(Msg, Opts),
+    SetCookieLines =
+        maps:values(
+            maps:map(
+                fun to_set_cookie_line/2,
+                ExtractedParsedCookies
+            )
+        ),
+    MsgWithSetCookie =
+        ResetBase#{
+            <<"set-cookie">> => SetCookieLines
+        },
+    {ok, MsgWithSetCookie};
+do_to(Msg, Req = #{ <<"format">> := <<"cookie">> }, Opts) when is_map(Msg) ->
+    ?event({to_cookie, {msg, Msg}, {req, Req}}),
+    {ok, ExtractedParsedCookies} = extract(Msg, Req, Opts),
+    {ok, ResetBase} = reset(Msg, Opts),
+    CookieLines =
+        hb_maps:values(
+            hb_maps:map(
+            fun to_cookie_line/2,
+                ExtractedParsedCookies,
+                Opts
+            ),
+            Opts
+        ),
+    ?event({to_cookie, {cookie_lines, CookieLines}}),
+    CookieLine = join(CookieLines, <<"; ">>),
+    {ok, ResetBase#{ <<"cookie">> => CookieLine }};
+do_to(Msg, _Req, _Opts) when is_map(Msg) ->
+    error({cookie_to_error, {no_format_specified, Msg}});
+do_to(Msg, _Req, _Opts) ->
+    error({cookie_to_error, {unexpected_message_format, Msg}}).
+
+%% @doc Convert a single cookie into a `set-cookie' header line. The cookie 
+%% may come in the form of `key => binary' or `key => cookie-message', where
+%% the cookie-message is a map with the following keys:
+%% 
+%% - `value': The raw binary cookie value.
+%% - `attributes': A map of cookie attribute key-value pairs.
+%% - `flags`: A list of cookie flags, represented as binaries.
+%% 
+%% If the cookie is a binary, we normalize it to a cookie-message before 
+%% processing.
+%% Note: Assumes that the cookies have all been loaded from the cache fully.
+to_set_cookie_line(Key, RawCookie) ->
+    Cookie = normalize_cookie_value(RawCookie),
+    % Encode the cookie key-value pair as a string to use as the base.
+    ValueBin =
+        <<
+            Key/binary, "=\"",
+            (maps:get(<<"value">>, Cookie))/binary,
+            "\""
+        >>,
+    % Encode the cookie attributes as key-value (non-quoted) pairs, separated
+    % by `;'.
+    ?event({to_line, {key, Key}, {cookie, {explicit, Cookie}}, {value, ValueBin}}),
+    AttributesBin =
+        case maps:get(<<"attributes">>, Cookie, #{}) of
+            EmptyAttributes when map_size(EmptyAttributes) == 0 ->
+                ?event({attributes, {none_in, Cookie}}),
+                <<>>;
+            Attributes ->
+                ?event({attributes, Attributes}),
+                JointAttributes =
+                    join(
+                        [
+                                << AttrKey/binary, "=", AttrValue/binary >>
+                            ||
+                                {AttrKey, AttrValue} <- to_sorted_list(Attributes)
+                        ],
+                        <<"; ">>
+                    ),
+                << "; ", JointAttributes/binary >>
+        end,
+    FlagsBin =
+        case maps:get(<<"flags">>, Cookie, []) of
+            [] -> <<>>;
+            Flags -> << "; ", (join(Flags, <<"; ">>))/binary >>
+        end,
+    << ValueBin/binary, AttributesBin/binary, FlagsBin/binary >>.
+
+%% @doc Convert a single cookie into a `cookie' header component. These
+%% components can be joined to form a `cookie' header line. This function
+%% reuses the `to_set_cookie_line' function to generate the components, but
+%% unsets the `attributes' and `flags' keys first.
+to_cookie_line(Key, Cookie) ->
+    to_set_cookie_line(Key, value(Cookie)).
+
+%% @doc Normalize a message containing a `cookie', `set-cookie', and potentially
+%% a `priv/cookie' key into a message with only the `priv/cookie' key.
+from(Msg, Req, Opts) ->
+    CookieOpts = opts(Opts),
+    LoadedMsg = hb_cache:ensure_all_loaded(Msg, Opts),
+    do_from(LoadedMsg, Req, CookieOpts).
+do_from(Msg, Req, Opts) when is_map(Msg) ->
+    {ok, ResetBase} = reset(Msg, Opts),
+    % Get the cookies, parsed, from each available source.
+    {ok, FromCookie} = from_cookie(Msg, Req, Opts),
+    {ok, FromSetCookie} = from_set_cookie(Msg, Req, Opts),
+    FromPriv = hb_private:get(<<"cookie">>, Msg, #{}, Opts),
+    % Merge all found cookies into a single map.
+    MergedMsg = hb_maps:merge(FromCookie, FromSetCookie, Opts),
+    AllParsed = hb_maps:merge(MergedMsg, FromPriv, Opts),
+    % Set the cookies in the private element of the message.
+    {ok, hb_private:set(ResetBase, <<"cookie">>, AllParsed, Opts)};
+do_from(CookiesMsg, _Req, _Opts) ->
+    error({cookie_from_error, {unexpected_message_format, CookiesMsg}}).
+
+%% @doc Convert the `cookie' key into a parsed cookie message. `cookie' headers
+%% are in the format of `key1=value1; key2=value2; ...'. There are no attributes
+%% or flags, so we split on `;' and return a map of key-value pairs. We also
+%% decode the values, in case they are URI-encoded.
+from_cookie(#{ <<"cookie">> := Cookie }, Req, Opts) ->
+    from_cookie(Cookie, Req, Opts);
+from_cookie(Cookies, Req, Opts) when is_list(Cookies) ->
+    MergedParsed =
+        lists:foldl(
+            fun(Cookie, Acc) ->
+                {ok, Parsed} = from_cookie(Cookie, Req, Opts),
+                hb_maps:merge(Acc, Parsed, Opts)
+            end,
+            #{},
+            Cookies
+        ),
+    {ok, MergedParsed};
+from_cookie(Cookie, _Req, _Opts) when is_binary(Cookie) ->
+    BinaryCookiePairs = split(semicolon, Cookie),
+    KeyValList =
+        lists:map(
+            fun(BinaryCookiePair) ->
+                {[Key, Value], _Rest} = split(pair, BinaryCookiePair),
+                {Key, hb_escape:decode(Value)}
+            end,
+            BinaryCookiePairs
+        ),
+    NormalizedMessage = maps:from_list(KeyValList),
+    {ok, NormalizedMessage};
+from_cookie(_MsgWithoutCookie, _Req, _Opts) ->
+    % The cookie key is not present in the message, so we return an empty map.
+    {ok, #{}}.
+
+%% @doc Convert a `set-cookie' header line into a cookie message. The `set-cookie'
+%% header has a `key=value' pair, and possibly attributes and flags. The form
+%% looks as follows: `key=value; attr1=value1; attr2=value2; flag1; flag2'.
+from_set_cookie(#{ <<"set-cookie">> := Cookie }, Req, Opts) ->
+    ?event({from_set_cookie, {cookie, Cookie}}),
+    from_set_cookie(Cookie, Req, Opts);
+from_set_cookie(MsgWithoutSet, _Req, _Opts) when is_map(MsgWithoutSet) ->
+    % The set-cookie key is not present in the message, so we return an empty map.
+    {ok, #{}};
+from_set_cookie(Lines, Req, Opts) when is_list(Lines) ->
+    MergedParsed =
+        lists:foldl(
+            fun(Line, Acc) ->
+                {ok, Parsed} = from_set_cookie(Line, Req, Opts),
+                hb_maps:merge(Acc, Parsed)
+            end,
+            #{},
+            Lines
+        ),
+    {ok, MergedParsed};
+from_set_cookie(Line, _Req, Opts) when is_binary(Line) ->
+    {[Key, Value], Rest} = split(pair, Line),
+    ValueDecoded = hb_escape:decode(Value),
+    % If there is no remaining binary after the pair, we have a simple key-value
+    % pair, returning just the binary as the value. Otherwise, we split the
+    % remaining binary into attributes and flags and return a message with the
+    % value and those parsed elements.
+    case Rest of
+        <<>> -> {ok, #{ Key => ValueDecoded }};
+        _ ->
+            AllAttrs = split(semicolon, Rest),
+            % We partition the attributes into pairs and flags, where flags are
+            % any attributes that do not contain an `=' character.
+            {AttrPairs, Flags} =
+                lists:partition(
+                    fun(Attr) ->
+                        case hb_util:split_depth_string_aware_single($=, Attr) of
+                            {no_match, _, _} -> false;
+                            {_, _, _} -> true
+                        end
+                    end,
+                    AllAttrs
+                ),
+            % We sort the flags and generate an attributes map from the pairs.
+            SortedFlags = to_sorted_list(Flags),
+            UnquotedFlags = lists:map(fun unquote/1, SortedFlags),
+            ?event(
+                {from_line,
+                    {key, Key},
+                    {value, {explicit, Value}},
+                    {attrs, AttrPairs},
+                    {flags, UnquotedFlags}
+                }
+            ),
+            Attributes =
+                maps:from_list(
+                    lists:map(
+                        fun(AttrPairBin) ->
+                            {[AttrKey, AttrValue], _} = split(pair, AttrPairBin),
+                            AttrKeyTrimmed = trim_bin(AttrKey),
+                            AttrValueTrimmed = trim_bin(AttrValue),
+                            {AttrKeyTrimmed, unquote(AttrValueTrimmed)}
+                        end,
+                        AttrPairs
+                    )
+                ),
+            MaybeAttributes =
+                if map_size(Attributes) > 0 -> #{ <<"attributes">> => Attributes };
+                true -> #{}
+                end,
+            MaybeFlags =
+                if length(UnquotedFlags) > 0 -> #{ <<"flags">> => UnquotedFlags };
+                true -> #{}
+                end,
+            MaybeAllAttributes = hb_maps:merge(MaybeAttributes, MaybeFlags, Opts),
+            {ok, #{ Key => MaybeAllAttributes#{ <<"value">> => ValueDecoded }}}
+    end.
+
+%%% Internal helpers
+
+%% @doc Takes a message or list of binaries and returns a sorted list of key-
+%% value pairs. Assumes that the message has been loaded from the cache fully.
+to_sorted_list(Msg) when is_map(Msg) ->
+    lists:keysort(
+        1,
+        [
+            {trim_bin(hb_util:bin(K)), trim_bin(V)}
+            || {K, V} <- maps:to_list(Msg)
+        ]
+    );
+to_sorted_list(Binaries) when is_list(Binaries) ->
+    lists:sort(
+        lists:map(
+            fun(Bin) -> trim_bin(hb_util:bin(Bin)) end,
+            Binaries
+        )
+    ).
+
+%% @doc Take a single parse cookie and return only the value (ignoring attributes
+%% and flags).
+value(Msg) when is_map(Msg) ->
+    maps:get(<<"value">>, Msg, Msg);
+value(Bin) when is_binary(Bin) ->
+    Bin.
+
+%% @doc Normalize a cookie value to a map with the following keys:
+%% - `value': The raw binary cookie value.
+%% - `attributes': A map of cookie attribute key-value pairs.
+%% - `flags`: A list of cookie flags, represented as binaries.
+normalize_cookie_value(Msg) when is_map(Msg) ->
+    Msg#{
+        <<"value">> => maps:get(<<"value">>, Msg, Msg),
+        <<"attributes">> => maps:get(<<"attributes">>, Msg, #{}),
+        <<"flags">> => maps:get(<<"flags">>, Msg, [])
+    };
+normalize_cookie_value(Bin) when is_binary(Bin) ->
+    #{
+        <<"value">> => Bin,
+        <<"attributes">> => #{},
+        <<"flags">> => []
+    }.
+
+%%% Internal helpers
+
+%% @doc Trim a binary of leading and trailing whitespace.
+trim_bin(Bin) when is_binary(Bin) ->
+    list_to_binary(string:trim(binary_to_list(Bin))).
+
+%% @doc Join a list of binaries into a `separator'-separated string. Abstracts
+%% the complexities of converting to/from string lists, as Erlang only provides
+%% a `binary:join` function as of OTP/28.
+join(Binaries, Separator) ->
+    hb_util:bin(
+        string:join(
+            lists:map(fun hb_util:list/1, Binaries),
+            hb_util:list(Separator)
+        )
+    ).
+
+%% @doc Split a binary by a separator type (`pair', `lines', or `attributes').
+%% Separator types that are plural return a list of all parts. Singular types
+%% return a single part and the remainder of the binary.
+split(pair, Bin) ->
+    [Key, ValueRest] = binary:split(Bin, <<"=">>),
+    {_, Value, Rest} = hb_util:split_depth_string_aware_single($;, ValueRest),
+    {[Key, unquote(Value)], trim_leading(Rest)};
+split(lines, Bin) ->
+    lists:map(fun trim_leading/1, hb_util:split_depth_string_aware($,, Bin));
+split(semicolon, Bin) ->
+    lists:map(fun trim_leading/1, hb_util:split_depth_string_aware($;, Bin)).
+
+%% @doc Remove leading whitespace from a binary, if present.
+trim_leading(Line) when not is_binary(Line) ->
+    trim_leading(hb_util:bin(Line));
+trim_leading(<<>>) -> <<>>;
+trim_leading(<<" ", Rest/binary>>) -> trim_leading(Rest);
+trim_leading(Line) -> Line.
+
+%% @doc Unquote a binary if it is quoted. If it is not quoted, we return the
+%% binary as is.
+unquote(<< $\", Rest/binary>>) ->
+    {Unquoted, _} = hb_util:split_escaped_single($\", Rest),
+    Unquoted;
+unquote(Bin) -> Bin.
\ No newline at end of file
diff --git a/src/dev_codec_cookie_auth.erl b/src/dev_codec_cookie_auth.erl
new file mode 100644
index 000000000..bc4077875
--- /dev/null
+++ b/src/dev_codec_cookie_auth.erl
@@ -0,0 +1,252 @@
+%%% @doc Implements the `message@1.0' commitment interface for the `~cookie@1.0',
+%%% as well as the `generator' interface type for the `~auth-hook@1.0' device.
+%%% See the [cookie codec](dev_codec_cookie.html) documentation for more details.
+-module(dev_codec_cookie_auth).
+-include_lib("eunit/include/eunit.hrl").
+-include("include/hb.hrl").
+-export([commit/3, verify/3]).
+-export([generate/3, finalize/3]).
+
+%% @doc Generate a new secret (if no `committer' specified), and use it as the
+%% key for the `httpsig@1.0' commitment. If a `committer' is given, we search 
+%% for it in the cookie message instead of generating a new secret. See the
+%% module documentation of `dev_codec_cookie' for more details on its scheme.
+generate(Base, Request, Opts) ->
+    {WithCookie, Secrets} =
+        case find_secrets(Request, Opts) of
+            [] ->
+                {ok, GeneratedSecret} = generate_secret(Base, Request, Opts),
+                {ok, Updated} = store_secret(GeneratedSecret, Request, Opts),
+                {Updated, [GeneratedSecret]};
+            FoundSecrets ->
+                {Request, FoundSecrets}
+        end,
+    ?event({normalized_cookies_found, {secrets, Secrets}}),
+    {
+        ok,
+        WithCookie#{
+            <<"secret">> => Secrets
+        }
+    }.
+
+%% @doc Finalize an `on-request' hook by adding the cookie to the chain of 
+%% messages. The inbound request has the same structure as a normal `~hook@1.0'
+%% on-request hook: The message sequence is the body of the request, and the
+%% request is the request message.
+finalize(Base, Request, Opts) ->
+    ?event(debug_auth, {finalize, {base, Base}, {request, Request}}),
+    maybe
+        {ok, SignedMsg} ?= hb_maps:find(<<"request">>, Request, Opts),
+        {ok, MessageSequence} ?= hb_maps:find(<<"body">>, Request, Opts),
+        % Cookie auth adds set-cookie to response
+        {ok, #{ <<"set-cookie">> := SetCookie }} =
+            dev_codec_cookie:to(
+                SignedMsg,
+                #{ <<"format">> => <<"set-cookie">> },
+                Opts
+            ),
+        {
+            ok,
+            MessageSequence ++
+                [#{ <<"path">> => <<"set">>, <<"set-cookie">> => SetCookie }]
+        }
+    else error ->
+        {error, no_request}
+    end.
+
+%% @doc Generate a new secret (if no `committer' specified), and use it as the
+%% key for the `httpsig@1.0' commitment. If a `committer' is given, we search 
+%% for it in the cookie message instead of generating a new secret. See the
+%% module documentation of `dev_codec_cookie' for more details on its scheme.
+commit(Base, Request, RawOpts) when ?IS_LINK(Request) ->
+    Opts = dev_codec_cookie:opts(RawOpts),
+    commit(Base, hb_cache:ensure_loaded(Request, Opts), Opts);
+commit(Base, Req = #{ <<"secret">> := Secret }, RawOpts) ->
+    Opts = dev_codec_cookie:opts(RawOpts),
+    commit(hb_cache:ensure_loaded(Secret, Opts), Base, Req, Opts);
+commit(Base, Request, RawOpts) ->
+    Opts = dev_codec_cookie:opts(RawOpts),
+    % Calculate the key to use for the commitment.
+    SecretRes =
+        case find_secret(Request, Opts) of
+            {ok, RawSecret} ->
+                {ok, RawSecret};
+            {error, no_secret} ->
+                generate_secret(Base, Request, Opts);
+            {error, not_found} ->
+                throw({error, <<"Necessary cookie not found in request.">>})
+        end,
+    case SecretRes of
+        {ok, Secret} -> commit(Secret, Base, Request, Opts);
+        {error, Err} -> {error, Err}
+    end.
+
+%% @doc Given the secret key, commit the message and set the cookie. This 
+%% function may be used by other devices via a direct module call, in order to
+%% commit a message and set the given secret key in the cookie.
+commit(Secret, Base, Request, Opts) ->
+    {ok, CommittedMsg} =
+        dev_codec_httpsig_proxy:commit(
+            <<"cookie@1.0">>,
+            Secret,
+            Base,
+            Request,
+            Opts
+        ),
+    store_secret(Secret, CommittedMsg, Opts).
+
+%% @doc Update the nonces for a given secret.
+store_secret(Secret, Msg, Opts) ->
+    CookieAddr = dev_codec_httpsig_keyid:secret_key_to_committer(Secret),
+    % Create the cookie parameters, using the name as the key and the secret as
+    % the value.
+    {ok, Cookies} = dev_codec_cookie:extract(Msg, #{}, Opts),
+    NewCookies = Cookies#{ <<"secret-", CookieAddr/binary>> => Secret },
+    {ok, WithCookie} = dev_codec_cookie:store(Msg, NewCookies, Opts),
+    {ok, WithCookie}.
+
+%% @doc Verify the HMAC commitment with the key being the secret from the 
+%% request cookies. We find the appropriate cookie from the cookie message by
+%% the committer ID given in the request message.
+verify(Base, ReqLink, RawOpts) when ?IS_LINK(ReqLink) ->
+    Opts = dev_codec_cookie:opts(RawOpts),
+    verify(Base, hb_cache:ensure_loaded(ReqLink, Opts), Opts);
+verify(Base, Req = #{ <<"secret">> := Secret }, RawOpts) ->
+    Opts = dev_codec_cookie:opts(RawOpts),
+    ?event({verify_with_explicit_key, {base, Base}, {request, Req}}),
+    dev_codec_httpsig_proxy:verify(
+        hb_util:decode(Secret),
+        Base,
+        Req,
+        Opts
+    );
+verify(Base, Request, RawOpts) ->
+    Opts = dev_codec_cookie:opts(RawOpts),
+    ?event({verify_finding_key, {base, Base}, {request, Request}}),
+    case find_secret(Request, Opts) of
+        {ok, Secret} ->
+            dev_codec_httpsig_proxy:verify(
+                hb_util:decode(Secret),
+                Base,
+                Request,
+                Opts
+            );
+        {error, Err} ->
+            {error, Err}
+    end.
+
+%% @doc Generate a new secret key for the given request. The user may specify
+%% a generator function in the request, which will be executed to generate the
+%% secret key. If no generator is specified, the default generator is used.
+%% A `generator` may be either a path or full message. If no path is present in
+%% a generator message, the `generate` path is assumed.
+generate_secret(_Base, Request, Opts) ->
+    case hb_maps:get(<<"generator">>, Request, undefined, Opts) of
+        undefined ->
+            % If no generator is specified, use the default generator.
+            case hb_opts:get(cookie_default_generator, <<"random">>, Opts) of
+                <<"random">> ->
+                    default_generator(Opts);
+                Provider ->
+                    execute_generator(Request#{<<"path">> => Provider}, Opts)
+        end;
+        Provider ->
+            % Execute the user's generator function.
+            execute_generator(Request#{<<"path">> => Provider}, Opts)
+    end.
+
+%% @doc Generate a new secret key using the default generator.
+default_generator(_Opts) ->
+    {ok, hb_util:encode(crypto:strong_rand_bytes(64))}.
+
+%% @doc Execute a generator function. See `generate_secret/3' for more details.
+execute_generator(GeneratorPath, Opts) when is_binary(GeneratorPath) ->
+    hb_ao:resolve(GeneratorPath, Opts);
+execute_generator(Generator, Opts) ->
+    Path = hb_maps:get(<<"path">>, Generator, <<"generate">>, Opts),
+    hb_ao:resolve(Generator#{ <<"path">> => Path }, Opts).
+
+%% @doc Find all secrets in the cookie of a message.
+find_secrets(Request, Opts) ->
+    maybe
+        {ok, Cookie} ?= dev_codec_cookie:extract(Request, #{}, Opts),
+        [
+            hb_maps:get(SecretRef, Cookie, secret_unavailable, Opts)
+        ||
+            SecretRef = <<"secret-", _/binary>> <- hb_maps:keys(Cookie)
+        ]
+    else error -> []
+    end.
+
+%% @doc Find the secret key for the given committer, if it exists in the cookie.
+find_secret(Request, Opts) ->
+    maybe
+        {ok, Committer} ?= hb_maps:find(<<"committer">>, Request, Opts),
+        find_secret(Committer, Request, Opts)
+    else error -> {error, no_secret}
+    end.
+find_secret(Committer, Request, Opts) ->
+    maybe
+        {ok, Cookie} ?= dev_codec_cookie:extract(Request, #{}, Opts),
+        {ok, _Secret} ?= hb_maps:find(<<"secret-", Committer/binary>>, Cookie, Opts)
+    else error -> {error, not_found}
+    end.
+
+%%% Tests
+
+%% @doc Call the cookie codec's `commit' and `verify' functions directly.
+directly_invoke_commit_verify_test() ->
+    Base = #{ <<"test-key">> => <<"test-value">> },
+    CommittedMsg =
+        hb_message:commit(
+            Base,
+            #{},
+            #{
+                <<"commitment-device">> => <<"cookie@1.0">>
+            }
+        ),
+    ?event({committed_msg, CommittedMsg}),
+    ?assertEqual(1, length(hb_message:signers(CommittedMsg, #{}))),
+    VerifyReq =
+        apply_cookie(
+            CommittedMsg#{
+                <<"committers">> => hb_message:signers(CommittedMsg, #{})
+            },
+            CommittedMsg,
+            #{}
+        ),
+    VerifyReqWithoutComms = hb_maps:without([<<"commitments">>], VerifyReq, #{}),
+    ?event({verify_req_without_comms, VerifyReqWithoutComms}),
+    ?assert(hb_message:verify(CommittedMsg, VerifyReqWithoutComms, #{})),
+    ok.
+
+%% @doc Set keys in a cookie and verify that they can be parsed into a message.
+http_set_get_cookies_test() ->
+    Node = hb_http_server:start_node(#{}),
+    {ok, SetRes} =
+        hb_http:get(
+            Node,
+            <<"/~cookie@1.0/store?k1=v1&k2=v2">>,
+            #{}
+        ),
+    ?event(debug_cookie, {set_cookie_test, {set_res, SetRes}}),
+    ?assertMatch(#{ <<"set-cookie">> := _ }, SetRes),
+    Req = apply_cookie(#{ <<"path">> => <<"/~cookie@1.0/extract">> }, SetRes, #{}),
+    {ok, Res} = hb_http:get(Node, Req, #{}),
+    ?assertMatch(#{ <<"k1">> := <<"v1">>, <<"k2">> := <<"v2">> }, Res),
+    ok.
+
+%%% Test Helpers
+
+%% @doc Takes the cookies from the `GenerateResponse' and applies them to the
+%% `Target' message.
+apply_cookie(NextReq, GenerateResponse, Opts) ->
+    {ok, Cookie} = dev_codec_cookie:extract(GenerateResponse, #{}, Opts),
+    {ok, NextWithParsedCookie} = dev_codec_cookie:store(NextReq, Cookie, Opts),
+    {ok, NextWithCookie} =
+        dev_codec_cookie:to(
+            NextWithParsedCookie,
+            #{ <<"format">> => <<"cookie">> },
+            Opts
+        ),
+    NextWithCookie.
\ No newline at end of file
diff --git a/src/dev_codec_cookie_test_vectors.erl b/src/dev_codec_cookie_test_vectors.erl
new file mode 100644
index 000000000..2994cf2a4
--- /dev/null
+++ b/src/dev_codec_cookie_test_vectors.erl
@@ -0,0 +1,764 @@
+%%% @doc A battery of cookie parsing and encoding test vectors.
+-module(dev_codec_cookie_test_vectors).
+-include_lib("eunit/include/eunit.hrl").
+-include("include/hb.hrl").
+
+%%% Test Helpers
+
+%% @doc Assert that when given the inputs in the test set, the outputs are
+%% all equal to the expected value when the function is applied to them.
+assert_set(TestSet, Fun) ->
+    {Inputs, Expected} = maps:get(TestSet, test_data()),
+    ?event(match_cookie, {starting_group_match, {inputs, {explicit, Inputs}}}),
+    lists:foreach(
+        fun(Input) ->
+            Res = Fun(Input),
+            ?event(
+                match_cookie,
+                {matching,
+                    {expected, {explicit, Expected}, {output, {explicit, Res}}}
+                }
+            ),
+            ?assertEqual(Expected, Res)
+        end,
+        Inputs
+    ).
+
+%% @doc Convert a cookie message to a string.
+to_string(CookieMsg) ->
+    {ok, BaseMsg} = dev_codec_cookie:store(#{}, CookieMsg, #{}),
+    {ok, Msg} =
+        dev_codec_cookie:to(
+            BaseMsg,
+            #{ <<"format">> => <<"set-cookie">> },
+            #{}
+        ),
+    hb_maps:get(<<"set-cookie">>, Msg, [], #{}).
+
+%% @doc Convert a string to a cookie message.
+from_string(String) ->
+    {ok, BaseMsg} =
+        dev_codec_cookie:from(
+            #{ <<"set-cookie">> => String },
+            #{},
+            #{}
+        ),
+    {ok, Cookie} = dev_codec_cookie:extract(BaseMsg, #{}, #{}),
+    Cookie.
+
+%%% Tests
+
+%% @doc returns a map of tuples of the form `testset_name => {[before], after}'.
+%% These sets are used to test the correctness of the parsing and serialization
+%% of cookie messages. The `before` is a list of inputs for which all of the
+%% outputs are expected to match the `after' value.
+test_data() ->
+    #{
+        from_string_raw_value =>
+            {
+                [<<"k1=v1">>, <<"k1=\"v1\"">>],
+                #{ <<"k1">> => <<"v1">> }
+            },
+        from_string_attributes =>
+            {
+                [<<"k1=v1; k2=v2">>, <<"k1=\"v1\"; k2=\"v2\"">>],
+                #{
+                    <<"k1">> =>
+                        #{
+                            <<"value">> => <<"v1">>,
+                            <<"attributes">> => #{ <<"k2">> => <<"v2">> }
+                        }
+                }
+            },
+        from_string_flags =>
+            {
+                [<<"k1=v1; k2=v2; f1; f2">>, <<"k1=\"v1\"; k2=\"v2\"; f1; f2">>],
+                #{
+                    <<"k1">> =>
+                        #{
+                            <<"value">> => <<"v1">>,
+                            <<"attributes">> => #{ <<"k2">> => <<"v2">> },
+                            <<"flags">> => [<<"f1">>, <<"f2">>]
+                        }
+                }
+            },
+        to_string_raw_value =>
+            {
+                [
+                    #{ <<"k1">> => <<"v1">> },
+                    #{ <<"k1">> => #{ <<"value">> => <<"v1">> } },
+                    #{
+                        <<"k1">> =>
+                            #{
+                                <<"value">> => <<"v1">>,
+                                <<"attributes">> => #{},
+                                <<"flags">> => []
+                            }
+                    }
+                ],
+                [<<"k1=\"v1\"">>]
+            },
+        to_string_attributes =>
+            {
+                [
+                    #{
+                        <<"k1">> =>
+                            #{
+                                <<"value">> => <<"v1">>,
+                                <<"attributes">> => #{ <<"k2">> => <<"v2">> }
+                            }
+                    },
+                    #{
+                        <<"k1">> =>
+                            #{
+                                <<"value">> => <<"v1">>,
+                                <<"attributes">> => #{ <<"k2">> => <<"v2">> },
+                                <<"flags">> => []
+                            }
+                    }
+                ],
+                [<<"k1=\"v1\"; k2=v2">>]
+            },
+        to_string_flags =>
+            {
+                [
+                    #{
+                        <<"k1">> =>
+                            #{
+                                <<"value">> => <<"v1">>,
+                                <<"flags">> => [<<"f1">>, <<"f2">>]
+                            }
+                    },
+                    #{
+                        <<"k1">> =>
+                            #{
+                                <<"value">> => <<"v1">>,
+                                <<"attributes">> => #{},
+                                <<"flags">> => [<<"f1">>, <<"f2">>]
+                            }
+                    }
+                ],
+                [<<"k1=\"v1\"; f1; f2">>]
+            },
+        parse_realworld_1 =>
+            {
+                [
+                    [
+                        <<"cart=110045_77895_53420; SameSite=Strict">>,
+                        <<"affiliate=e4rt45dw; SameSite=Lax">>
+                    ]
+                ],
+                #{
+                    <<"cart">> =>
+                        #{
+                            <<"value">> => <<"110045_77895_53420">>,
+                            <<"attributes">> => #{ <<"SameSite">> => <<"Strict">> }
+                        },
+                    <<"affiliate">> =>
+                        #{
+                            <<"value">> => <<"e4rt45dw">>,
+                            <<"attributes">> => #{ <<"SameSite">> => <<"Lax">> }
+                        }
+                }
+            },
+        parse_user_settings_and_permissions =>
+            {
+                [
+                    [
+                        <<"user_settings=notifications=true,privacy=strict,layout=grid; Path=/; HttpOnly; Secure">>,
+                        <<"user_permissions=\"read;write;delete\"; Path=/; SameSite=None; Secure">>
+                    ]
+                ],
+                #{
+                    <<"user_settings">> =>
+                        #{
+                            <<"value">> => <<"notifications=true,privacy=strict,layout=grid">>,
+                            <<"attributes">> => #{ <<"Path">> => <<"/">> },
+                            <<"flags">> => [<<"HttpOnly">>, <<"Secure">>]
+                        },
+                    <<"user_permissions">> =>
+                        #{
+                            <<"value">> => <<"read;write;delete">>,
+                            <<"attributes">> => #{ <<"Path">> => <<"/">>, <<"SameSite">> => <<"None">> },
+                            <<"flags">> => [<<"Secure">>]
+                        }
+                }
+            },
+        parse_session_and_temp_data =>
+            {
+                [
+                    [
+                        <<"SESSION_ID=abc123xyz ; path= /dashboard ; samesite=Strict ; Secure">>,
+                        <<"temp_data=cleanup_me; Max-Age=-1; Path=/">>
+                    ]
+                ],
+                #{
+                    <<"SESSION_ID">> =>
+                        #{
+                            <<"value">> => <<"abc123xyz ">>,
+                            <<"attributes">> => #{ <<"path">> => <<"/dashboard">>, <<"samesite">> => <<"Strict">> },
+                            <<"flags">> => [<<"Secure">>]
+                        },
+                    <<"temp_data">> =>
+                        #{
+                            <<"value">> => <<"cleanup_me">>,
+                            <<"attributes">> => #{ <<"Max-Age">> => <<"-1">>, <<"Path">> => <<"/">> }
+                        }
+                }
+            },
+        parse_empty_and_anonymous =>
+            {
+                [
+                    [
+                        <<"user_preference=; Path=/; HttpOnly">>,
+                        <<"=anonymous_session_123; Path=/guest">>
+                    ]
+                ],
+                #{
+                    <<"user_preference">> =>
+                        #{
+                            <<"value">> => <<"">>,
+                            <<"attributes">> => #{ <<"Path">> => <<"/">> },
+                            <<"flags">> => [<<"HttpOnly">>]
+                        },
+                    <<>> =>
+                        #{
+                            <<"value">> => <<"anonymous_session_123">>,
+                            <<"attributes">> => #{ <<"Path">> => <<"/guest">> }
+                        }
+                }
+            },
+        parse_app_config_and_analytics =>
+            {
+                [
+                    [
+                        <<"$app_config$=theme@dark!%20mode; Path=/">>,
+                        <<"analytics_session_data_with_very_long_name_for_tracking_purposes=comprehensive_user_behavior_analytics_data_including_page_views_click_events_scroll_depth_time_spent_geographic_location_device_info_browser_details_and_more; Path=/">>
+                    ]
+                ],
+                #{
+                    <<"$app_config$">> =>
+                        #{
+                            <<"value">> => <<"theme@dark! mode">>,
+                            <<"attributes">> => #{ <<"Path">> => <<"/">> }
+                        },
+                    <<"analytics_session_data_with_very_long_name_for_tracking_purposes">> =>
+                        #{
+                            <<"value">> => <<"comprehensive_user_behavior_analytics_data_including_page_views_click_events_scroll_depth_time_spent_geographic_location_device_info_browser_details_and_more">>,
+                            <<"attributes">> => #{ <<"Path">> => <<"/">> }
+                        }
+                }
+            },
+        parse_debug_and_tracking =>
+            {
+                [
+                    [
+                        <<"debug_info=\\tIndented\\t\\nMultiline\\n; Path=/">>,
+                        <<"tracking_id=user_12345; CustomAttr=CustomValue; Analytics=Enabled; Path=/; HttpOnly">>
+                    ]
+                ],
+                #{
+                    <<"debug_info">> =>
+                        #{
+                            <<"value">> => <<"\\tIndented\\t\\nMultiline\\n">>,
+                            <<"attributes">> => #{ <<"Path">> => <<"/">> }
+                        },
+                    <<"tracking_id">> =>
+                        #{
+                            <<"value">> => <<"user_12345">>,
+                            <<"attributes">> => #{
+                                <<"CustomAttr">> => <<"CustomValue">>,
+                                <<"Analytics">> => <<"Enabled">>,
+                                <<"Path">> => <<"/">>
+                            },
+                            <<"flags">> => [<<"HttpOnly">>]
+                        }
+                }
+            },
+        parse_cache_and_form_token =>
+            {
+                [
+                    [
+                        <<"cache_bust=v1.2.3; Expires=Mon, 99 Feb 2099 25:99:99 GMT; Path=/">>,
+                        <<"form_token=form_abc123; SameSite=Strick; Secure">>
+                    ]
+                ],
+                #{
+                    <<"cache_bust">> =>
+                        #{
+                            <<"value">> => <<"v1.2.3">>,
+                            <<"attributes">> => #{
+                                <<"Expires">> => <<"Mon, 99 Feb 2099 25:99:99 GMT">>,
+                                <<"Path">> => <<"/">>
+                            }
+                        },
+                    <<"form_token">> =>
+                        #{
+                            <<"value">> => <<"form_abc123">>,
+                            <<"attributes">> => #{ <<"SameSite">> => <<"Strick">> },
+                            <<"flags">> => [<<"Secure">>]
+                        }
+                }
+            },
+        parse_token_and_reactions =>
+            {
+                [
+                    [
+                        <<"access_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c; Path=/; HttpOnly; Secure">>,
+                        <<"reaction_prefs=👍👎; Path=/; Secure">>
+                    ]
+                ],
+                #{
+                    <<"access_token">> =>
+                        #{
+                            <<"value">> => <<"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c">>,
+                            <<"attributes">> => #{ <<"Path">> => <<"/">> },
+                            <<"flags">> => [<<"HttpOnly">>, <<"Secure">>]
+                        },
+                    <<"reaction_prefs">> =>
+                        #{
+                            <<"value">> => <<"👍👎">>,
+                            <<"attributes">> => #{ <<"Path">> => <<"/">> },
+                            <<"flags">> => [<<"Secure">>]
+                        }
+                }
+            },
+        parse_error_log_and_auth_token =>
+            {
+                [
+                    [
+                        <<"error_log=\"timestamp=2024-01-15 10:30:00\\nlevel=ERROR\\tmessage=Database connection failed\"; Path=/">>,
+                        <<"auth_token=bearer_xyz789; Secure; Path=/api; Secure; HttpOnly">>
+                    ]
+                ],
+                #{
+                    <<"error_log">> =>
+                        #{
+                            <<"value">> => <<"timestamp=2024-01-15 10:30:00\\nlevel=ERROR\\tmessage=Database connection failed">>,
+                            <<"attributes">> => #{ <<"Path">> => <<"/">> }
+                        },
+                    <<"auth_token">> =>
+                        #{
+                            <<"value">> => <<"bearer_xyz789">>,
+                            <<"attributes">> => #{ <<"Path">> => <<"/api">> },
+                            <<"flags">> => [<<"HttpOnly">>,<<"Secure">>, <<"Secure">>]
+                        }
+                }
+            },
+        parse_csrf_and_quick_setting =>
+            {
+                [
+                    [
+                        <<"csrf_token=abc123; \"HttpOnly\"; Path=/">>,
+                        <<"quick_setting=\"enabled\"">>
+                    ]
+                ],
+                #{
+                    <<"csrf_token">> =>
+                        #{
+                            <<"value">> => <<"abc123">>,
+                            <<"attributes">> => #{ <<"Path">> => <<"/">> },
+                            <<"flags">> => [<<"HttpOnly">>]
+                        },
+                    <<"quick_setting">> => <<"enabled">>
+                }
+            },
+        parse_admin_and_upload =>
+            {
+                [
+                    [
+                        <<"secret_key=confidential; Path=%2Fadmin">>,
+                        <<"admin_flag=true; Path=/">>
+                        
+                    ]
+                ],
+                #{
+                    <<"secret_key">> =>
+                        #{
+                            <<"value">> => <<"confidential">>,
+                            <<"attributes">> => #{ <<"Path">> => <<"%2Fadmin">> }
+                        },
+                    <<"admin_flag">> =>
+                        #{
+                            <<"value">> => <<"true">>,
+                            <<"attributes">> => #{ <<"Path">> => <<"/">> }
+                        }
+                }
+            },
+        parse_search_and_tags =>
+            {
+                [
+                    [
+                        <<"search_history=\"query,results\"; Path=/">>,
+                        <<"user_tags=\"work,personal\"; Path=/">>
+                    ]
+                ],
+                #{
+                    <<"search_history">> =>
+                        #{
+                            <<"value">> => <<"query,results">>,
+                            <<"attributes">> => #{ <<"Path">> => <<"/">> }
+                        },
+                    <<"user_tags">> =>
+                        #{
+                            <<"value">> => <<"work,personal">>,
+                            <<"attributes">> => #{ <<"Path">> => <<"/">> }
+                        }
+                }
+            },
+        to_string_realworld_1 =>
+            {
+                [
+                    #{
+                        <<"cart">> =>
+                            #{
+                                <<"value">> => <<"110045_77895_53420">>,
+                                <<"attributes">> => #{ <<"SameSite">> => <<"Strict">> }
+                            },
+                        <<"affiliate">> =>
+                            #{
+                                <<"value">> => <<"e4rt45dw">>,
+                                <<"attributes">> => #{ <<"SameSite">> => <<"Lax">> }
+                            }
+                    }
+                ],
+                [
+                    <<"affiliate=\"e4rt45dw\"; SameSite=Lax">>,
+                    <<"cart=\"110045_77895_53420\"; SameSite=Strict">>
+                ]
+            },
+        to_string_user_settings_and_permissions =>
+            {
+                [
+                    #{
+                        <<"user_settings">> =>
+                            #{
+                                <<"value">> => <<"notifications=true,privacy=strict,layout=grid">>,
+                                <<"attributes">> => #{ <<"Path">> => <<"/">> },
+                                <<"flags">> => [<<"HttpOnly">>, <<"Secure">>]
+                            },
+                        <<"user_permissions">> =>
+                            #{
+                                <<"value">> => <<"read;write;delete">>,
+                                <<"attributes">> => #{ <<"Path">> => <<"/">>, <<"SameSite">> => <<"None">> },
+                                <<"flags">> => [<<"Secure">>]
+                            }
+                    }
+                ],
+                [
+                    <<"user_permissions=\"read;write;delete\"; Path=/; SameSite=None; Secure">>,
+                    <<"user_settings=\"notifications=true,privacy=strict,layout=grid\"; Path=/; HttpOnly; Secure">>
+                ]
+            },
+        to_string_session_and_temp_data =>
+            {
+                [
+                    #{
+                        <<"SESSION_ID">> =>
+                            #{
+                                <<"value">> => <<"abc123xyz ">>,
+                                <<"attributes">> => #{ <<"path">> => <<"/dashboard">>, <<"samesite">> => <<"Strict">> },
+                                <<"flags">> => [<<"Secure">>]
+                            },
+                        <<"temp_data">> =>
+                            #{
+                                <<"value">> => <<"cleanup_me">>,
+                                <<"attributes">> => #{ <<"Max-Age">> => <<"-1">>, <<"Path">> => <<"/">> }
+                            }
+                    }
+                ],
+                [
+                    <<"SESSION_ID=\"abc123xyz \"; path=/dashboard; samesite=Strict; Secure">>,
+                    <<"temp_data=\"cleanup_me\"; Max-Age=-1; Path=/">>
+                ]
+            },
+        to_string_empty_and_anonymous =>
+            {
+                [
+                    #{
+                        <<"user_preference">> =>
+                            #{
+                                <<"value">> => <<"">>,
+                                <<"attributes">> => #{ <<"Path">> => <<"/">> },
+                                <<"flags">> => [<<"HttpOnly">>]
+                            },
+                        <<>> =>
+                            #{
+                                <<"value">> => <<"anonymous_session_123">>,
+                                <<"attributes">> => #{ <<"Path">> => <<"/guest">> }
+                            }
+                    }
+                ],
+                [
+                    <<"=\"anonymous_session_123\"; Path=/guest">>,
+                    <<"user_preference=\"\"; Path=/; HttpOnly">>
+                ]
+            },
+        to_string_app_config_and_analytics =>
+            {
+                [
+                    #{
+                        <<"$app_config$">> =>
+                            #{
+                                <<"value">> => <<"theme@dark!%20mode">>,
+                                <<"attributes">> => #{ <<"Path">> => <<"/">> }
+                            },
+                        <<"analytics_session_data_with_very_long_name_for_tracking_purposes">> =>
+                            #{
+                                <<"value">> => <<"comprehensive_user_behavior_analytics_data_including_page_views_click_events_scroll_depth_time_spent_geographic_location_device_info_browser_details_and_more">>,
+                                <<"attributes">> => #{ <<"Path">> => <<"/">> }
+                            }
+                    }
+                ],
+                [
+                    <<"$app_config$=\"theme@dark!%20mode\"; Path=/">>,
+                    <<"analytics_session_data_with_very_long_name_for_tracking_purposes=\"comprehensive_user_behavior_analytics_data_including_page_views_click_events_scroll_depth_time_spent_geographic_location_device_info_browser_details_and_more\"; Path=/">>
+                ]
+            },
+        to_string_debug_and_tracking =>
+            {
+                [
+                    #{
+                        <<"debug_info">> =>
+                            #{
+                                <<"value">> => <<"\\tIndented\\t\\nMultiline\\n">>,
+                                <<"attributes">> => #{ <<"Path">> => <<"/">> }
+                            },
+                        <<"tracking_id">> =>
+                            #{
+                                <<"value">> => <<"user_12345">>,
+                                <<"attributes">> => #{
+                                    <<"CustomAttr">> => <<"CustomValue">>,
+                                    <<"Analytics">> => <<"Enabled">>,
+                                    <<"Path">> => <<"/">>
+                                },
+                                <<"flags">> => [<<"HttpOnly">>]
+                            }
+                    }
+                ],
+                [
+                    <<"debug_info=\"\\tIndented\\t\\nMultiline\\n\"; Path=/">>,
+                    <<"tracking_id=\"user_12345\"; Analytics=Enabled; CustomAttr=CustomValue; Path=/; HttpOnly">>
+                ]
+            },
+        to_string_cache_and_form_token =>
+            {
+                [
+                    #{
+                        <<"cache_bust">> =>
+                            #{
+                                <<"value">> => <<"v1.2.3">>,
+                                <<"attributes">> => #{
+                                    <<"Expires">> => <<"Mon, 99 Feb 2099 25:99:99 GMT">>,
+                                    <<"Path">> => <<"/">>
+                                }
+                            },
+                        <<"form_token">> =>
+                            #{
+                                <<"value">> => <<"form_abc123">>,
+                                <<"attributes">> => #{ <<"SameSite">> => <<"Strick">> },
+                                <<"flags">> => [<<"Secure">>]
+                            }
+                    }
+                ],
+                [
+                    <<"cache_bust=\"v1.2.3\"; Expires=Mon, 99 Feb 2099 25:99:99 GMT; Path=/">>,
+                    <<"form_token=\"form_abc123\"; SameSite=Strick; Secure">>
+                ]
+            },
+        to_string_token_and_reactions =>
+            {
+                [
+                    #{
+                        <<"access_token">> =>
+                            #{
+                                <<"value">> => <<"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c">>,
+                                <<"attributes">> => #{ <<"Path">> => <<"/">> },
+                                <<"flags">> => [<<"HttpOnly">>, <<"Secure">>]
+                            },
+                        <<"reaction_prefs">> =>
+                            #{
+                                <<"value">> => <<"👍👎">>,
+                                <<"attributes">> => #{ <<"Path">> => <<"/">> },
+                                <<"flags">> => [<<"Secure">>]
+                            }
+                    }
+                ],
+                [
+                    <<"access_token=\"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c\"; Path=/; HttpOnly; Secure">>,
+                    <<"reaction_prefs=\"👍👎\"; Path=/; Secure">>
+                ]
+            },
+        to_string_error_log_and_auth_token =>
+            {
+                [
+                    #{
+                        <<"error_log">> =>
+                            #{
+                                <<"value">> => <<"timestamp=2024-01-15 10:30:00\\nlevel=ERROR\\tmessage=Database connection failed">>,
+                                <<"attributes">> => #{ <<"Path">> => <<"/">> }
+                            },
+                        <<"auth_token">> =>
+                            #{
+                                <<"value">> => <<"bearer_xyz789">>,
+                                <<"attributes">> => #{ <<"Path">> => <<"/api">> },
+                                <<"flags">> => [<<"HttpOnly">>, <<"Secure">>, <<"Secure">>]
+                            }
+                    }
+                ],
+                [
+                    <<"auth_token=\"bearer_xyz789\"; Path=/api; HttpOnly; Secure; Secure">>,
+                    <<"error_log=\"timestamp=2024-01-15 10:30:00\\nlevel=ERROR\\tmessage=Database connection failed\"; Path=/">>
+                ]
+            },
+        to_string_csrf_and_quick_setting =>
+            {
+                [
+                    #{
+                        <<"csrf_token">> =>
+                            #{
+                                <<"value">> => <<"abc123">>,
+                                <<"attributes">> => #{ <<"Path">> => <<"/">> },
+                                <<"flags">> => [<<"HttpOnly">>]
+                            },
+                        <<"quick_setting">> => <<"enabled">>
+                    }
+                ],
+                [
+                    <<"csrf_token=\"abc123\"; Path=/; HttpOnly">>,
+                    <<"quick_setting=\"enabled\"">>
+                ]
+            },
+        to_string_admin_and_upload =>
+            {
+                [
+                    #{
+                        <<"secret_key">> =>
+                            #{
+                                <<"value">> => <<"confidential">>,
+                                <<"attributes">> => #{ <<"Path">> => <<"%2Fadmin">> }
+                            },
+                        <<"admin_flag">> =>
+                            #{
+                                <<"value">> => <<"true">>,
+                                <<"attributes">> => #{ <<"Path">> => <<"/">> }
+                            }
+                    }
+                ],
+                [
+                    <<"admin_flag=\"true\"; Path=/">>,
+                    <<"secret_key=\"confidential\"; Path=%2Fadmin">>
+                ]
+            },
+        to_string_search_and_tags =>
+            {
+                [
+                    #{
+                        <<"search_history">> =>
+                            #{
+                                <<"value">> => <<"query,results">>,
+                                <<"attributes">> => #{ <<"Path">> => <<"/">> }
+                            },
+                        <<"user_tags">> =>
+                            #{
+                                <<"value">> => <<"work,personal">>,
+                                <<"attributes">> => #{ <<"Path">> => <<"/">> }
+                            }
+                    }
+                ],
+                [
+                    <<"search_history=\"query,results\"; Path=/">>,
+                    <<"user_tags=\"work,personal\"; Path=/">>
+                ]
+            }
+    }.
+
+from_string_basic_test() ->
+    assert_set(from_string_raw_value, fun from_string/1).
+
+from_string_attributes_test() ->
+    assert_set(from_string_attributes, fun from_string/1).
+
+from_string_flags_test() ->
+    assert_set(from_string_flags, fun from_string/1).
+
+to_string_basic_test() ->
+    assert_set(to_string_raw_value, fun to_string/1).
+
+to_string_attributes_test() ->
+    assert_set(to_string_attributes, fun to_string/1).
+
+to_string_flags_test() ->
+    assert_set(to_string_flags, fun to_string/1).
+
+parse_realworld_test() ->
+    assert_set(parse_realworld_1, fun from_string/1).
+
+parse_user_settings_and_permissions_test() ->
+    assert_set(parse_user_settings_and_permissions, fun from_string/1).
+
+parse_session_and_temp_data_test() ->
+    assert_set(parse_session_and_temp_data, fun from_string/1).
+
+parse_empty_and_anonymous_test() ->
+    assert_set(parse_empty_and_anonymous, fun from_string/1).
+
+parse_app_config_and_analytics_test() ->
+    assert_set(parse_app_config_and_analytics, fun from_string/1).
+
+parse_debug_and_tracking_test() ->
+    assert_set(parse_debug_and_tracking, fun from_string/1).
+
+parse_cache_and_form_token_test() ->
+    assert_set(parse_cache_and_form_token, fun from_string/1).
+
+parse_token_and_reactions_test() ->
+    assert_set(parse_token_and_reactions, fun from_string/1).
+
+parse_error_log_and_auth_token_test() ->
+    assert_set(parse_error_log_and_auth_token, fun from_string/1).
+
+parse_csrf_and_quick_setting_test() ->
+    assert_set(parse_csrf_and_quick_setting, fun from_string/1).
+
+parse_admin_and_upload_test() ->
+    assert_set(parse_admin_and_upload, fun from_string/1).
+
+parse_search_and_tags_test() ->
+    assert_set(parse_search_and_tags, fun from_string/1).
+
+to_string_realworld_1_test() ->
+    assert_set(to_string_realworld_1, fun to_string/1).
+
+to_string_user_settings_and_permissions_test() ->
+    assert_set(to_string_user_settings_and_permissions, fun to_string/1).
+
+to_string_session_and_temp_data_test() ->
+    assert_set(to_string_session_and_temp_data, fun to_string/1).
+
+to_string_empty_and_anonymous_test() ->
+    assert_set(to_string_empty_and_anonymous, fun to_string/1).
+
+to_string_app_config_and_analytics_test() ->
+    assert_set(to_string_app_config_and_analytics, fun to_string/1).
+
+to_string_debug_and_tracking_test() ->
+    assert_set(to_string_debug_and_tracking, fun to_string/1).
+
+to_string_cache_and_form_token_test() ->
+    assert_set(to_string_cache_and_form_token, fun to_string/1).
+
+to_string_token_and_reactions_test() ->
+    assert_set(to_string_token_and_reactions, fun to_string/1).
+
+to_string_error_log_and_auth_token_test() ->
+    assert_set(to_string_error_log_and_auth_token, fun to_string/1).
+
+to_string_csrf_and_quick_setting_test() ->
+    assert_set(to_string_csrf_and_quick_setting, fun to_string/1).
+
+to_string_admin_and_upload_test() ->
+    assert_set(to_string_admin_and_upload, fun to_string/1).
+
+to_string_search_and_tags_test() ->
+    assert_set(to_string_search_and_tags, fun to_string/1).
\ No newline at end of file
diff --git a/src/dev_codec_flat.erl b/src/dev_codec_flat.erl
index a63a66153..1d4dd9988 100644
--- a/src/dev_codec_flat.erl
+++ b/src/dev_codec_flat.erl
@@ -2,76 +2,78 @@
 %%% (potentially multi-layer) paths as their keys, and a normal TABM binary as 
 %%% their value.
 -module(dev_codec_flat).
--export([from/1, to/1, commit/3, verify/3, committed/3]).
+-export([from/3, to/3, commit/3, verify/3]).
 %%% Testing utilities
--export([serialize/1, deserialize/1]).
+-export([serialize/1, serialize/2, deserialize/1]).
 -include_lib("eunit/include/eunit.hrl").
 -include("include/hb.hrl").
 
 %%% Route signature functions to the `dev_codec_httpsig' module
 commit(Msg, Req, Opts) -> dev_codec_httpsig:commit(Msg, Req, Opts).
 verify(Msg, Req, Opts) -> dev_codec_httpsig:verify(Msg, Req, Opts).
-committed(Msg, Req, Opts) -> dev_codec_httpsig:committed(Msg, Req, Opts).
 
 %% @doc Convert a flat map to a TABM.
-from(Bin) when is_binary(Bin) ->
-    hb_util:ok(deserialize(Bin));
-from(Map) when is_map(Map) ->
-    maps:fold(
-        fun(Path, Value, Acc) ->
-            inject_at_path(hb_path:term_to_path_parts(Path), Value, Acc)
-        end,
-        #{},
-        Map
-    ).
-
-%% Helper function to inject a value at a specific path in a nested map
-inject_at_path([Key], Value, Map) ->
-    case maps:get(Key, Map, not_found) of
-        not_found ->
-            Map#{ Key => Value };
-        ExistingMap when is_map(ExistingMap) andalso is_map(Value) ->
-            % If both are maps, merge them
-            Map#{ Key => maps:merge(ExistingMap, Value) };
-        OldValue ->
-            % Otherwise, alert the user and fail
-            throw({path_collision,
-                {key, Key},
-                {existing, OldValue},
-                {value, Value}
-            })
-    end;
-inject_at_path([Key|Rest], Value, Map) ->
-    SubMap = maps:get(Key, Map, #{}),
-    maps:put(Key, inject_at_path(Rest, Value, SubMap), Map).
+from(Bin, _, _Opts) when is_binary(Bin) -> {ok, Bin};
+from(Map, Req, Opts) when is_map(Map) ->
+    {ok,
+        maps:fold(
+            fun(Path, Value, Acc) ->
+                case Value of
+                    [] ->
+                        ?event(error,
+                            {empty_list_value,
+                                {path, Path},
+                                {value, Value},
+                                {map, Map}
+                            }
+                        );
+                    _ ->
+                        ok
+                end,
+                hb_util:deep_set(
+                    hb_path:term_to_path_parts(Path, Opts),
+                    hb_util:ok(from(Value, Req, Opts)),
+                    Acc,
+                    Opts
+                )
+            end,
+            #{},
+            Map
+        )
+    }.
 
 %% @doc Convert a TABM to a flat map.
-to(Bin) when is_binary(Bin) -> Bin;
-to(Map) when is_map(Map) ->
-    maps:fold(
-        fun(Key, Value, Acc) ->
-            case to(Value) of
-                SubMap when is_map(SubMap) ->
-                    maps:fold(
-                        fun(SubKey, SubValue, InnerAcc) ->
-                            maps:put(
-                                hb_path:to_binary([Key, SubKey]),
-                                SubValue,
-                                InnerAcc
-                            )
-                        end,
-                        Acc,
-                        SubMap
-                    );
-                SimpleValue ->
-                    maps:put(hb_path:to_binary([Key]), SimpleValue, Acc)
-            end
-        end,
-        #{},
-        Map
-    ).
+to(Bin, _, _Opts) when is_binary(Bin) -> {ok, Bin};
+to(Map, Req, Opts) when is_map(Map) ->
+    Res = 
+        maps:fold(
+            fun(Key, Value, Acc) ->
+                case to(Value, Req, Opts) of
+                    {ok, SubMap} when is_map(SubMap) ->
+                        maps:fold(
+                            fun(SubKey, SubValue, InnerAcc) ->
+                                maps:put(
+                                    hb_path:to_binary([Key, SubKey]),
+                                    SubValue,
+                                    InnerAcc
+                                )
+                            end,
+                            Acc,
+                            SubMap
+                        );
+                    {ok, SimpleValue} ->
+                        maps:put(hb_path:to_binary([Key]), SimpleValue, Acc)
+                end
+            end,
+            #{},
+            Map
+        ),
+    {ok, Res}.
 
 serialize(Map) when is_map(Map) ->
+    serialize(Map, #{}).
+
+serialize(Map, Opts) when is_map(Map) ->
     Flattened = hb_message:convert(Map, <<"flat@1.0">>, #{}),
     {ok,
         iolist_to_binary(lists:foldl(
@@ -80,11 +82,11 @@ serialize(Map) when is_map(Map) ->
                         Acc,
                         hb_path:to_binary(Key),
                         <<": ">>,
-                        maps:get(Key, Flattened), <<"\n">>
+                        hb_maps:get(Key, Flattened, Opts), <<"\n">>
                     ]
                 end,
                 <<>>,
-                maps:keys(Flattened)
+                hb_util:to_sorted_keys(Flattened, Opts)
             )
         )
     }.
@@ -109,14 +111,14 @@ deserialize(Bin) when is_binary(Bin) ->
 simple_conversion_test() ->
     Flat = #{[<<"a">>] => <<"value">>},
     Nested = #{<<"a">> => <<"value">>},
-    ?assert(hb_message:match(Nested, dev_codec_flat:from(Flat))),
-    ?assert(hb_message:match(Flat, dev_codec_flat:to(Nested))).
+    ?assert(hb_message:match(Nested, hb_util:ok(dev_codec_flat:from(Flat, #{}, #{})))),
+    ?assert(hb_message:match(Flat, hb_util:ok(dev_codec_flat:to(Nested, #{}, #{})))).
 
 nested_conversion_test() ->
     Flat = #{<<"a/b">> => <<"value">>},
     Nested = #{<<"a">> => #{<<"b">> => <<"value">>}},
-    Unflattened = dev_codec_flat:from(Flat),
-    Flattened = dev_codec_flat:to(Nested),
+    Unflattened = hb_util:ok(dev_codec_flat:from(Flat, #{}, #{})),
+    Flattened = hb_util:ok(dev_codec_flat:to(Nested, #{}, #{})),
     ?assert(hb_message:match(Nested, Unflattened)),
     ?assert(hb_message:match(Flat, Flattened)).
 
@@ -133,8 +135,8 @@ multiple_paths_test() ->
         },
         <<"a">> => <<"3">>
     },
-    ?assert(hb_message:match(Nested, dev_codec_flat:from(Flat))),
-    ?assert(hb_message:match(Flat, dev_codec_flat:to(Nested))).
+    ?assert(hb_message:match(Nested, hb_util:ok(dev_codec_flat:from(Flat, #{}, #{})))),
+    ?assert(hb_message:match(Flat, hb_util:ok(dev_codec_flat:to(Nested, #{}, #{})))).
 
 path_list_test() ->
     Nested = #{
@@ -145,28 +147,27 @@ path_list_test() ->
             <<"a">> => <<"2">>
         }
     },
-    Flat = dev_codec_flat:to(Nested),
+    Flat = hb_util:ok(dev_codec_flat:to(Nested, #{}, #{})),
     lists:foreach(
         fun(Key) ->
             ?assert(not lists:member($\n, binary_to_list(Key)))
         end,
-        maps:keys(Flat)
+        hb_maps:keys(Flat, #{})
     ).
 
 binary_passthrough_test() ->
-	% Note: Modified for changes to the `from/1' function.
-	Bin = <<"raw: binary">>,
-	?assertEqual(#{<<"raw">> => <<"binary">>}, dev_codec_flat:from(Bin)),
-	?assertEqual(Bin, dev_codec_flat:to(Bin)).
+    Bin = <<"raw binary">>,
+    ?assertEqual(Bin, hb_util:ok(dev_codec_flat:from(Bin, #{}, #{}))),
+    ?assertEqual(Bin, hb_util:ok(dev_codec_flat:to(Bin, #{}, #{}))).
 
 deep_nesting_test() ->
     Flat = #{<<"a/b/c/d">> => <<"deep">>},
     Nested = #{<<"a">> => #{<<"b">> => #{<<"c">> => #{<<"d">> => <<"deep">>}}}},
-    Unflattened = dev_codec_flat:from(Flat),
-    Flattened = dev_codec_flat:to(Nested),
+    Unflattened = hb_util:ok(dev_codec_flat:from(Flat, #{}, #{})),
+    Flattened = hb_util:ok(dev_codec_flat:to(Nested, #{}, #{})),
     ?assert(hb_message:match(Nested, Unflattened)),
     ?assert(hb_message:match(Flat, Flattened)).
 
 empty_map_test() ->
-    ?assertEqual(#{}, dev_codec_flat:from(#{})),
-    ?assertEqual(#{}, dev_codec_flat:to(#{})).
\ No newline at end of file
+    ?assertEqual(#{}, hb_util:ok(dev_codec_flat:from(#{}, #{}, #{}))),
+    ?assertEqual(#{}, hb_util:ok(dev_codec_flat:to(#{}, #{}, #{}))).
\ No newline at end of file
diff --git a/src/dev_codec_http_auth.erl b/src/dev_codec_http_auth.erl
new file mode 100644
index 000000000..c221bb12f
--- /dev/null
+++ b/src/dev_codec_http_auth.erl
@@ -0,0 +1,175 @@
+%%% @doc Implements a two-step authentication process for HTTP requests, using
+%%% the `Basic' authentication scheme. This device is a viable implementation
+%%% of the `generator' interface type employed by `~auth-hook@1.0', as well as
+%%% the `~message@1.0' commitment scheme interface.
+%%%
+%%% `http-auth@1.0`'s `commit' and `verify' keys proxy to the `~httpsig@1.0'
+%%% secret key HMAC commitment scheme, utilizing a secret key derived from the
+%%% user's authentication information. Callers may also utilize the `generate'
+%%% key directly to derive entropy from HTTP Authorization headers provided by
+%%% the user. If no Authorization header is provided, the `generate' key will
+%%% return a `401 Unauthorized` response, which triggers a recipient's browser
+%%% to prompt the user for authentication details and resend the request.
+%%% 
+%%% The `generate' key derives secrets for it's users by calling PBKDF2 with
+%%% the user's authentication information. The parameters for the PBKDF2
+%%% algorithm are configurable, and can be specified in the request message:
+%%% 
+%%% <pre>
+%%%   salt:       The salt to use for the PBKDF2 algorithm. Defaults to
+%%%               `sha256("constant:ao")'.
+%%%   iterations: The number of iterations to use for the PBKDF2 algorithm.
+%%%               Defaults to `1,200,000'.
+%%%   alg:        The hashing algorithm to use with PBKDF2. Defaults to
+%%%               `sha256'.
+%%%   key-length: The length of the key to derive from PBKDF2. Defaults to
+%%%               `64'.
+%%% </pre>
+%%% 
+%%% The default iteration count was chosen at two times the recommendation of
+%%% OWASP in 2023 (600,000), and executes at a run rate of ~5-10 key derivations 
+%%% per second on modern CPU hardware. Additionally, the default salt was chosen
+%%% such that it is a public constant (needed in order for reproducibility 
+%%% between nodes), and hashed in order to provide additional entropy, in 
+%%% alignment with RFC 8018, Section 4.1.
+-module(dev_codec_http_auth).
+-export([commit/3, verify/3]).
+-export([generate/3]).
+-include("include/hb.hrl").
+-include_lib("eunit/include/eunit.hrl").
+
+%% @doc The default salt to use for the PBKDF2 algorithm. This value must be
+%% global across all nodes that intend to have a shared keyspace, although in
+%% instances where this is not possible, users may specify non-standard salts
+%% to the `/generate' path with the `salt' request key.
+-define(DEFAULT_SALT, <<"constant:ao">>).
+
+%% @doc Generate or extract a new secret and commit to the message with the
+%% `~httpsig@1.0/commit?type=hmac-sha256&scheme=secret' commitment mechanism.
+commit(Base, Req, Opts) ->
+    case generate(Base, Req, Opts) of
+        {ok, Key} ->
+            {ok, CommitRes} =
+                dev_codec_httpsig_proxy:commit(
+                    <<"http-auth@1.0">>,
+                    Key,
+                    Base,
+                    Req,
+                    Opts
+                ),
+            ?event({commit_result, CommitRes}),
+            {ok, CommitRes};
+        {error, Err} ->
+            {error, Err}
+    end.
+
+%% @doc Verify a given `Base' message with a derived `Key' using the
+%% `~httpsig@1.0' secret key HMAC commitment scheme.
+verify(Base, RawReq, Opts) ->
+    ?event({verify_invoked, {base, Base}, {req, RawReq}}),
+    {ok, Key} = generate(Base, RawReq, Opts),
+    ?event({verify_found_key, {key, Key}, {base, Base}, {req, RawReq}}),
+    {ok, VerifyRes} =
+        dev_codec_httpsig_proxy:verify(
+            Key,
+            Base,
+            RawReq,
+            Opts
+        ),
+    ?event({verify_result, VerifyRes}),
+    {ok, VerifyRes}.
+
+%% @doc Collect authentication information from the client. If the `raw' flag
+%% is set to `true', return the raw authentication information. Otherwise,
+%% derive a key from the authentication information and return it.
+generate(_Msg, ReqLink, Opts) when ?IS_LINK(ReqLink) ->
+    generate(_Msg, hb_cache:ensure_loaded(ReqLink, Opts), Opts);
+generate(_Msg, #{ <<"secret">> := Secret }, _Opts) ->
+    {ok, Secret};
+generate(_Msg, Req, Opts) ->
+    case hb_maps:get(<<"authorization">>, Req, undefined, Opts) of
+        <<"Basic ", Auth/binary>> ->
+            Decoded = base64:decode(Auth),
+            ?event(key_gen, {generated_key, {auth, Auth}, {decoded, Decoded}}),
+            case hb_maps:get(<<"raw">>, Req, false, Opts) of
+                true -> {ok, Decoded};
+                false -> derive_key(Decoded, Req, Opts)
+            end;
+        undefined ->
+            {error,
+                #{
+                    <<"status">> => 401,
+                    <<"www-authenticate">> => <<"Basic">>,
+                    <<"details">> => <<"No authorization header provided.">>
+                }
+            };
+        Unrecognized ->
+            {error,
+                #{
+                    <<"status">> => 400,
+                    <<"details">> =>
+                        <<"Unrecognized authorization header: ", Unrecognized/binary>>
+                }
+            }
+    end.
+
+%% @doc Derive a key from the authentication information using the PBKDF2
+%% algorithm and user specified parameters.
+derive_key(Decoded, Req, Opts) ->
+    Alg = hb_util:atom(hb_maps:get(<<"alg">>, Req, <<"sha256">>, Opts)),
+    Salt =
+        hb_maps:get(
+            <<"salt">>,
+            Req,
+            hb_crypto:sha256(?DEFAULT_SALT),
+            Opts
+        ),
+    Iterations = hb_maps:get(<<"iterations">>, Req, 2 * 600_000, Opts),
+    KeyLength = hb_maps:get(<<"key-length">>, Req, 64, Opts),
+    ?event(key_gen,
+        {derive_key,
+            {alg, Alg},
+            {salt, Salt},
+            {iterations, Iterations},
+            {key_length, KeyLength}
+        }
+    ),
+    case hb_crypto:pbkdf2(Alg, Decoded, Salt, Iterations, KeyLength) of
+        {ok, Key} ->
+            EncodedKey = hb_util:encode(Key),
+            {ok, EncodedKey};
+        {error, Err} ->
+            ?event(key_gen,
+                {pbkdf2_error,
+                    {alg, Alg},
+                    {salt, Salt},
+                    {iterations, Iterations},
+                    {key_length, KeyLength},
+                    {error, Err}
+                }
+            ),
+            {error,
+                #{
+                    <<"status">> => 500,
+                    <<"details">> => <<"Failed to derive key.">>
+                }
+            }
+    end.
+
+%%% Tests
+
+benchmark_pbkdf2_test() ->
+    Key = crypto:strong_rand_bytes(32),
+    Iterations = 2 * 600_000,
+    KeyLength = 32,
+    Derivations = 
+        hb_test_utils:benchmark(
+            fun() ->
+                hb_crypto:pbkdf2(sha256, Key, <<"salt">>, Iterations, KeyLength)
+            end
+        ),
+    hb_test_utils:benchmark_print(
+        <<"Derived">>,
+        <<"keys (1.2m iterations each)">>,
+        Derivations
+    ).
\ No newline at end of file
diff --git a/src/dev_codec_httpsig.erl b/src/dev_codec_httpsig.erl
index 2ad3b3d48..c104ec2ac 100644
--- a/src/dev_codec_httpsig.erl
+++ b/src/dev_codec_httpsig.erl
@@ -5,1230 +5,510 @@
 %%% are found in this module, while the codec functions are relayed to the 
 %%% `dev_codec_httpsig_conv' module.
 -module(dev_codec_httpsig).
-%%% Device API
--export([id/3, commit/3, committed/3, verify/3, reset_hmac/1, public_keys/1]).
 %%% Codec API functions
--export([to/1, from/1]).
+-export([to/3, from/3]).
+%%% Uni-directional codec support (_to_ binary/header+body components), but not 
+%%% back.
+-export([serialize/2, serialize/3]).
+%%% Commitment API functions
+-export([commit/3, verify/3]).
 %%% Public API functions
--export([add_content_digest/1]).
--export([add_derived_specifiers/1, remove_derived_specifiers/1]).
-% https://datatracker.ietf.org/doc/html/rfc9421#section-2.2.7-14
--define(EMPTY_QUERY_PARAMS, $?).
-% https://datatracker.ietf.org/doc/html/rfc9421#name-signature-parameters
--define(SIGNATURE_PARAMS, [created, expired, nonce, alg, keyid, tag]).
+-export([add_content_digest/2, normalize_for_encoding/3]).
 -include("include/hb.hrl").
 -include_lib("eunit/include/eunit.hrl").
--type fields() :: #{
-	binary() | atom() | string() => binary() | atom() | string()
-}.
--type request_message() :: #{
-	url => binary(),
-	method => binary(),
-	headers => fields(),
-	trailers => fields(),
-	is_absolute_form => boolean()
-}.
--type response_message() :: #{
-	status => integer(),
-	headers => fields(),
-	trailers => fields()
-}.
--type component_identifier() :: {
-	item,
-	{string, binary()},
-	{binary(), integer() | boolean() | {string | token | binary, binary()}}
-}.
-
-%%% A list of components that are `derived' in the context of RFC-9421 from the
-%%% request message.
--define(DERIVED_COMPONENTS, [
-    <<"method">>,
-    <<"target-uri">>,
-    <<"authority">>,
-    <<"scheme">>,
-    <<"request-target">>,
-    <<"path">>,
-    <<"query">>,
-    <<"query-param">>,
-    <<"status">>
-]).
 
 %%% Routing functions for the `dev_codec_httpsig_conv' module
-to(Msg) -> dev_codec_httpsig_conv:to(Msg).
-from(Msg) -> dev_codec_httpsig_conv:from(Msg).
-
-%%% A map that contains signature parameters metadata as described
-%%% in https://datatracker.ietf.org/doc/html/rfc9421#name-signature-parameters
-%%%
-%%% All values are optional, but in our use-case "alg" and "keyid" will
-%%% almost always be provided.
-%%%
-%%% #{
-%%% 	created => 1733165109, % a unix timestamp
-%%% 	expires => 1733165209, % a unix timestamp
-%%% 	nonce => <<"foobar">,
-%%% 	alg => <<"rsa-pss-sha512">>,
-%%% 	keyid => <<"6eVuWgpNgv3bxfNgFrIiTkzE8Yb0V2omShxS4uKyzpw">>
-%%% 	tag => <<"HyperBEAM">>
-%%% }
--type signature_params() ::
-    #{atom() | binary() | string() => binary() | integer()}.
-
-%%% The state encapsulated as the "Authority".
-%%% It includes an ordered list of parsed component identifiers, used for 
-%%% extracting values from the Request/Response Message Context, as well as 
-%%% the signature parameters used when creating the signature and encode in 
-%%% the signature base.
-%%%
-%%% This is effectively the State of an Authority, used to sign a Request/Response 
-%%% Message Context.
-%%%
-%%% #{
-%%% 	component_identifiers => [{item, {string, <<"@method">>}, []}]
-%%% 	sig_params => #{
-%%% 		created => 1733165109, % a unix timestamp
-%%% 		expires => 1733165209, % a unix timestamp
-%%% 		nonce => <<"foobar">,
-%%% 		alg => <<"rsa-pss-sha512">>,
-%%% 		keyid => <<"6eVuWgpNgv3bxfNgFrIiTkzE8Yb0V2omShxS4uKyzpw">>
-%%% 		tag => <<"HyperBEAM">>
-%%% 	}
-%%% }
--type authority_state() :: #{
-	component_identifiers => [component_identifier()],
-	% TODO: maybe refine this to be more explicit w.r.t valid signature params
-	sig_params => signature_params(),
-	key => binary()
-}.
-
-id(Msg, _Params, _Opts) ->
-    ?event({calculating_id, {msg, Msg}}),
-    case find_id(Msg) of
-        {ok, ID} -> {ok, hb_util:human_id(ID)};
-        {not_found, MsgToID} ->
-            {ok, MsgAfterReset} = reset_hmac(MsgToID),
-            {ok, ID} = find_id(MsgAfterReset),
-            {ok, hb_util:human_id(ID)}
+to(Msg, Req, Opts) -> dev_codec_httpsig_conv:to(Msg, Req, Opts).
+from(Msg, Req, Opts) -> dev_codec_httpsig_conv:from(Msg, Req, Opts).
+
+%% @doc Generate the `Opts' to use during AO-Core operations in the codec.
+opts(RawOpts) ->
+    RawOpts#{
+        hashpath => ignore,
+        cache_control => [<<"no-cache">>, <<"no-store">>],
+        force_message => false
+    }.
+
+%% @doc A helper utility for creating a direct encoding of a HTTPSig message.
+%% 
+%% This function supports two modes of operation:
+%% 1. `format: binary`, yielding a raw binary HTTP/1.1-style response that can 
+%%    either be stored or emitted raw accross a transport medium.
+%% 2. `format: components`, yielding a message containing `headers` and `body`
+%%    keys, suitable for use in connecting to HTTP-response flows implemented 
+%%    by other servers.
+%% 
+%% Optionally, the `index` key can be set to override resolution of the default
+%% index page into HTTP responses that do not contain their own `body` field.
+serialize(Msg, Opts) -> serialize(Msg, #{}, Opts).
+serialize(Msg, #{ <<"format">> := <<"components">> }, Opts) ->
+    % Convert to HTTPSig via TABM through calling `hb_message:convert` rather
+    % than executing `to/3` directly. This ensures that our responses are 
+    % normalized.
+    {ok, EncMsg} = hb_message:convert(Msg, <<"httpsig@1.0">>, Opts),
+    {ok,
+        #{
+            <<"body">> => hb_maps:get(<<"body">>, EncMsg, <<>>),
+            <<"headers">> => hb_maps:without([<<"body">>], EncMsg)
+        }
+    };
+serialize(Msg, _Req, Opts) ->
+    % We assume the default format of `binary` if none of the prior clauses
+    % match.
+    HTTPSig = hb_message:convert(Msg, <<"httpsig@1.0">>, Opts), 
+    {ok, dev_codec_httpsig_conv:encode_http_msg(HTTPSig, Opts) }.
+
+verify(Base, Req, RawOpts) ->
+    % A rsa-pss-sha512 commitment is verified by regenerating the signature
+    % base and validating against the signature.
+    Opts = opts(RawOpts),
+    {ok, EncMsg, EncComm, _} = normalize_for_encoding(Base, Req, Opts),
+    SigBase = signature_base(EncMsg, EncComm, Opts),
+    KeyRes = dev_codec_httpsig_keyid:req_to_key_material(Req, Opts),
+    RawSignature = hb_util:decode(Signature = maps:get(<<"signature">>, Req)),
+    ?event(debug_httpsig,
+        {
+            httpsig_verifying,
+            {signature, Signature},
+            {parsed_key_material, KeyRes},
+            {req, Req},
+            {signature_base, {string, SigBase}}
+        }
+    ),
+    case {KeyRes, maps:get(<<"type">>, Req)} of
+        {{ok, _, Key, _KeyID}, <<"rsa-pss-sha512">>} ->
+            ?event(httpsig_verify, {verify, {rsa_pss_sha512, {sig_base, SigBase}}}),
+            {
+                ok,
+                ar_wallet:verify(
+                    {{rsa, 65537}, Key},
+                    SigBase,
+                    RawSignature,
+                    sha512
+                )
+            };
+        {{ok, _, Key, KeyID}, <<"hmac-sha256">>} ->
+            % Generate the HMAC from the key and signature base.
+            ActualHMac =
+                hb_util:human_id(
+                    crypto:mac(hmac, sha256, Key, SigBase)
+                ),
+            ?event(httpsig_verify,
+                {verify,
+                    {hmac_sha256,
+                        {keyid, KeyID},
+                        {sig_base, SigBase},
+                        {actual_hmac, {string, ActualHMac}},
+                        {signature, {string, Signature}},
+                        {matches, Signature =:= ActualHMac}
+                    }
+                }),
+            {ok, Signature =:= ActualHMac};
+        {{error, Reason}, _Type} ->
+            ?event(httpsig_verify, {verify, {error, Reason}}),
+            {ok, false};
+        {{failure, Info}, _Type} ->
+            ?event(httpsig_verify, {verify, {failure, Info}}),
+            {failure, Info}
     end.
 
-%% @doc Find the ID of the message, which is the hmac of the fields referenced in
-%% the signature and signature input. If the message already has a signature-input,
-%% directly, it is treated differently: We relabel it as `x-signature-input' to
-%% avoid key collisions.
-find_id(Msg = #{ <<"commitments">> := Comms }) when map_size(Comms) > 1 ->
-    #{ <<"commitments">> := CommsWithoutHmac } =
-        hb_message:without_commitments(
-            #{ <<"alg">> => <<"hmac-sha256">> },
-            Msg
-        ),
-    IDs = maps:keys(CommsWithoutHmac),
-    case IDs of
-        [] -> throw({could_not_find_ids, CommsWithoutHmac});
-        [ID] ->
-            ?event({returning_single_id, ID}),
-            {ok, hb_util:human_id(ID)};
-        _ ->
-            ?event({multiple_ids, IDs}),
-            SortedIDs =
-                [
-                    {item, {string, hb_util:human_id(ID)}, []}
-                ||
-                    ID <- lists:sort(IDs)
-                ],
-            SFList = iolist_to_binary(hb_structured_fields:list(SortedIDs)),
-            ?event({sorted_ids, SortedIDs, {sf_list, SFList}}),
-            {ok, hb_util:human_id(crypto:hash(sha256, SFList))}
-    end;
-find_id(#{ <<"commitments">> := CommitmentMap }) ->
-    {ok, hd(maps:keys(CommitmentMap))};
-find_id(AttMsg = #{ <<"signature-input">> := UserSigInput }) ->
-    {not_found, (maps:without([<<"signature-input">>], AttMsg))#{
-        <<"x-signature-input">> => UserSigInput
-    }};
-find_id(Msg) ->
-    ?event({no_id, Msg}),
-    {not_found, Msg}.
-
-%% @doc Main entrypoint for signing a HTTP Message, using the standardized format.
-commit(MsgToSign, _Req, Opts) ->
+%% @doc Commit to a message using the HTTP-Signature format. We use the `type'
+%% parameter to determine the type of commitment to use. If the `type' parameter
+%% is `signed', we default to the rsa-pss-sha512 algorithm. If the `type'
+%% parameter is `unsigned', we default to the hmac-sha256 algorithm.
+commit(Msg, Req = #{ <<"type">> := <<"unsigned">> }, Opts) ->
+    commit(Msg, Req#{ <<"type">> => <<"hmac-sha256">> }, Opts);
+commit(Msg, Req = #{ <<"type">> := <<"signed">> }, Opts) ->
+    commit(Msg, Req#{ <<"type">> => <<"rsa-pss-sha512">> }, Opts);
+commit(MsgToSign, Req = #{ <<"type">> := <<"rsa-pss-sha512">> }, RawOpts) ->
+    ?event(
+        {generating_rsa_pss_sha512_commitment, {msg, MsgToSign}, {req, Req}}
+    ),
+    Opts = opts(RawOpts),
     Wallet = hb_opts:get(priv_wallet, no_viable_wallet, Opts),
-    NormMsg = hb_ao:normalize_keys(MsgToSign),
-    % The hashpath, if present, is encoded as a HTTP Sig tag,
-    % added as a field on the commitment, and then the field is removed from the Msg,
-    % so that it is not included in the actual signature matierial.
-    %
-    % In this sense, the hashpath is a property of the commitment
-    % and the signature metadata, not the message itself, being signed
-    % See https://datatracker.ietf.org/doc/html/rfc9421#section-2.3-4.12
-    {SigParams, MsgWithoutHP} =
-        case NormMsg of
-            #{ <<"priv">> := #{ <<"hashpath">> := HP }} ->
-                {#{ tag => HP }, NormMsg};
-            _ -> {#{}, NormMsg}
+    if Wallet =:= no_viable_wallet ->
+        throw({cannot_commit, no_viable_wallet, MsgToSign});
+    true ->
+        ok
+    end,
+    % Utilize the hashpath, if present, as the tag for the commitment.
+    MaybeTagMap =
+        case MsgToSign of
+            #{ <<"priv">> := #{ <<"hashpath">> := HP }} -> #{ <<"tag">> => HP };
+            _ -> #{}
         end,
-    EncWithoutBodyKeys =
-        maps:without(
-            [<<"signature">>, <<"signature-input">>, <<"body-keys">>, <<"priv">>],
-            hb_message:convert(MsgWithoutHP, <<"httpsig@1.0">>, Opts)
+    % Generate the unsigned commitment and signature base.
+    ToCommit = hb_ao:normalize_keys(keys_to_commit(MsgToSign, Req, Opts)),
+    ?event({to_commit, ToCommit}),
+    UnsignedCommitment =
+        maybe_bundle_tag_commitment(
+            MaybeTagMap#{
+                <<"commitment-device">> => <<"httpsig@1.0">>,
+                <<"type">> => <<"rsa-pss-sha512">>,
+                <<"keyid">> =>
+                    <<
+                        "publickey:",
+                        (base64:encode(ar_wallet:to_pubkey(Wallet)))/binary
+                    >>,
+                <<"committer">> =>
+                    hb_util:human_id(ar_wallet:to_address(Wallet)),
+                <<"committed">> => ToCommit
+            },
+            Req,
+            Opts
         ),
-    Enc = add_content_digest(EncWithoutBodyKeys),
-    ?event({encoded_to_httpsig_for_commitment, Enc}),
-    Authority = authority(lists:sort(maps:keys(Enc)), SigParams, Wallet),
-    {ok, {SignatureInput, Signature}} = sign_auth(Authority, #{}, Enc),
-    [ParsedSignatureInput] = hb_structured_fields:parse_list(SignatureInput),
-    % Set the name as `http-sig-[hex encoding of the first 8 bytes of the public key]'
+    {ok, EncMsg, EncComm, ModCommittedKeys} =
+        normalize_for_encoding(MsgToSign, UnsignedCommitment, Opts),
+    ?event({encoded_to_httpsig_for_commitment, MsgToSign}),
+    % Generate the signature base
+    SignatureBase = signature_base(EncMsg, EncComm, Opts),
+    ?event({rsa_signature_base, {string, SignatureBase}}),
+    ?event({mod_committed_keys, ModCommittedKeys}),
+    % Sign the signature base
+    Signature = ar_wallet:sign(Wallet, SignatureBase, sha512),
+    % Generate the ID of the signature
     ID = hb_util:human_id(crypto:hash(sha256, Signature)),
-    Address = ar_wallet:to_address(Wallet),
-    SigName = address_to_sig_name(Address),
-    % Calculate the id and place the signature into the `commitments' key of the message.
-    Commitment =
-        #{
-            <<"commitment-device">> => <<"httpsig@1.0">>,
-            <<"alg">> => <<"rsa-pss-sha512">>,
-            <<"committer">> => hb_util:human_id(Address),
-            % https://datatracker.ietf.org/doc/html/rfc9421#section-4.2-1
-            <<"signature">> =>
-                bin(hb_structured_fields:dictionary(
-                    #{ SigName => {item, {binary, Signature}, []} }
-                )),
-            <<"signature-input">> =>
-                bin(hb_structured_fields:dictionary(
-                    #{ SigName => ParsedSignatureInput }
-                ))
+    ?event({rsa_commit, {committed, ToCommit}}),
+    % Calculate the ID and place the signature into the `commitments' key of the
+    % message. After, we call `commit' again to add the hmac to the new
+    % message.
+    commit(
+        MsgToSign#{
+            <<"commitments">> =>
+                (maps:get(<<"commitments">>, MsgToSign, #{}))#{
+                    ID =>
+                        UnsignedCommitment#{
+                            <<"signature">> => hb_util:encode(Signature),
+                            <<"committed">> => ModCommittedKeys
+                        }
+                }
+        },
+        Req#{ <<"type">> => <<"hmac-sha256">> },
+        Opts
+    );
+commit(BaseMsg, Req = #{ <<"type">> := <<"hmac-sha256">> }, RawOpts) ->
+    % Extract the key material from the request.
+    Opts = opts(RawOpts),
+    ?event({req_to_key_material, {req, Req}}),
+    {ok, Scheme, Key, KeyID} = dev_codec_httpsig_keyid:req_to_key_material(Req, Opts),
+    Committer = dev_codec_httpsig_keyid:keyid_to_committer(Scheme, KeyID),
+    % Remove any existing hmac commitments with the given keyid before adding
+    % the new one.
+    Msg =
+        hb_message:without_commitments(
+            #{
+                <<"commitment-device">> => <<"httpsig@1.0">>,
+                <<"type">> => <<"hmac-sha256">>,
+                <<"keyid">> => KeyID
+            },
+            BaseMsg,
+            Opts
+        ),
+    % Extract the base commitments from the message.
+    Commitments = maps:get(<<"commitments">>, Msg, #{}),
+    CommittedKeys = keys_to_commit(Msg, Req, Opts),
+    % Create the commitment with the appropriate keyid, committed keys, and 
+    % bundle specifier.
+    CommitmentWithoutCommitter = #{
+        <<"commitment-device">> => <<"httpsig@1.0">>,
+        <<"type">> => <<"hmac-sha256">>,
+        <<"keyid">> => KeyID,
+        <<"committed">> => hb_ao:normalize_keys(CommittedKeys)
+    },
+    % If the committer is undefined, we do not need to add the `committer' key.
+    BaseCommitment =
+        if Committer =:= undefined -> CommitmentWithoutCommitter;
+        true -> CommitmentWithoutCommitter#{ <<"committer">> => Committer }
+        end,
+    UnauthedCommitment =
+        maybe_bundle_tag_commitment(
+            BaseCommitment,
+            Req,
+            Opts
+        ),
+    {ok, EncMsg, EncComm, ModCommittedKeys} =
+        normalize_for_encoding(Msg, UnauthedCommitment, Opts),
+    SigBase = signature_base(EncMsg, EncComm, Opts),    
+    HMac = hb_util:human_id(crypto:mac(hmac, sha256, Key, SigBase)),
+    ?event(httpsig_commit,
+        {hmac_commit,
+            {type, <<"hmac-sha256">>},
+            {keyid, KeyID},
+            {committer, Committer},
+            {committed, CommittedKeys},
+            {sig_base, SigBase},
+            {hmac, HMac}
+        }
+    ),
+    Res =
+        {
+            ok,
+            Msg#{
+                <<"commitments">> =>
+                    Commitments#{
+                        HMac =>
+                            UnauthedCommitment#{
+                                <<"signature">> => HMac,
+                                <<"committed">> => ModCommittedKeys
+                            }
+                    }
+            }
         },
-    OldCommitments = maps:get(<<"commitments">>, NormMsg, #{}),
-    reset_hmac(MsgWithoutHP#{<<"commitments">> =>
-        OldCommitments#{ ID => Commitment }
-    }).
+    ?event({hmac_generation_complete, Res}),
+    Res.
 
-%% @doc Return the list of committed keys from a message. The message will have
-%% had the `commitments' key removed and the signature inputs added to the
-%% root. Subsequently, we can parse that to get the list of committed keys.
-committed(RawMsg, Req, Opts) ->
-    Msg = to(RawMsg),
-    case maps:get(<<"signature-input">>, Msg, none) of
-        none -> {ok, []};
-        SigInput ->
-            do_committed(SigInput, Msg, Req, Opts)
+%% @doc Annotate the commitment with the `bundle' key if the request contains
+%% it.
+maybe_bundle_tag_commitment(Commitment, Req, _Opts) ->
+    case hb_util:atom(maps:get(<<"bundle">>, Req, false)) of
+        true -> Commitment#{ <<"bundle">> => <<"true">> };
+        false -> Commitment
     end.
 
-do_committed(SigInputStr, Msg, _Req, _Opts) ->
-    [{_SigInputName, SigInput} | _] = hb_structured_fields:parse_dictionary(
-        SigInputStr
-    ),
-    {list, ComponentIdentifiers, _SigParams} = SigInput,
-    BinComponentIdentifiers = lists:map(
-        fun({item, {_Kind, ID}, _Params}) -> ID end,
-        ComponentIdentifiers    
-    ),
-    Signed =
-        [<<"signature">>, <<"signature-input">>] ++
-            remove_derived_specifiers(BinComponentIdentifiers),
-    % Extract the implicit keys from the `ao-types' of the encoded message if
-    % the types key itself was signed.
-    SignedWithImplicit = Signed ++
-        case lists:member(<<"ao-types">>, Signed) of
-            true -> dev_codec_structured:implicit_keys(Msg);
-            false -> []
-        end,
-    case lists:member(<<"content-digest">>, SignedWithImplicit) of
-        false -> {ok, SignedWithImplicit};
-        true -> {ok, SignedWithImplicit ++ committed_from_body(Msg)}
+%% @doc Derive the set of keys to commit to from a `commit` request and a 
+%% base message.
+keys_to_commit(_Base, #{ <<"committed">> := Explicit}, _Opts) ->
+    % Case 1: Explicitly provided keys to commit.
+    % Add `+link` specifiers to the user given list as necessary, in order for
+    % their given keys to match the HTTPSig encoded TABM form.
+    hb_util:list_to_numbered_message(Explicit);
+keys_to_commit(Base, _Req, Opts) ->
+    % Extract the set of committed keys from the message.
+    case hb_message:committed(Base, #{ <<"committers">> => <<"all">> }, opts(Opts)) of
+        [] ->
+            % Case 3: Default to all keys in the TABM-encoded message, aside
+            % metadata.
+            hb_util:list_to_numbered_message(
+                lists:map(
+                    fun hb_link:remove_link_specifier/1,
+                    hb_util:to_sorted_keys(Base, Opts)
+                        -- [<<"commitments">>, <<"priv">>]
+                )
+            );
+        Keys ->
+            % Case 2: Replicate the raw keys that the existing commitments have
+            % used. This leads to a message whose commitments can be 'stacked'
+            % and represented together in HTTPSig format.
+            hb_util:list_to_numbered_message(Keys)
     end.
 
-%% @doc Return the list of committed keys from a message that are derived from
-%% the body components.
-committed_from_body(Msg) ->
-    % Body and inline-body-key are always committed if the
-    % content-digest is present.
-    [<<"body">>, <<"inline-body-key">>] ++
-        % If the inline-body-key is present, add it to the list of
-        % committed keys.
-        case maps:get(<<"inline-body-key">>, Msg, []) of
-            [] -> [];
-            InlineBodyKey -> [InlineBodyKey]
-        end
-        % If the body-keys are present, add them to the list of
-        % committed keys.
-        ++ case maps:get(<<"body-keys">>, Msg, []) of
-            [] -> [];
-            BodyKeys ->
-                ParsedList = case BodyKeys of
-                    List when is_list(List) -> List;
-                    RawBodyKeys when is_binary(RawBodyKeys) ->
-                        hb_structured_fields:parse_list(RawBodyKeys) 
-                end,
-                % Ensure a list of binaries, extracting the binary
-                % from the structured item if necessary
-                ParsedBodyKeys = lists:map(
-                    fun
-                        (BK) when is_binary(BK) -> BK;
-                        ({ item, {_, BK }, _}) -> BK
-                    end,
-                    ParsedList   
-                ),
-                % Grab the top most field on the body key
-                % because the top most being committed means all subsequent
-                % fields are also committed
-                Tops = lists:map(
-                    fun(BodyKey) ->
-                        hd(hb_path:term_to_path_parts(BodyKey, #{}))
-                    end,
-                    ParsedBodyKeys
-                ),
-                lists:sort(lists:uniq(Tops))
-        end.
-
-%% @doc If the `body' key is present, replace it with a content-digest.
-add_content_digest(Msg) ->
+%% @doc If the `body' key is present and a binary, replace it with a
+%% content-digest.
+add_content_digest(Msg, _Opts) ->
     case maps:get(<<"body">>, Msg, not_found) of
-        not_found -> Msg;
-        Body ->
+        Body when is_binary(Body) ->
             % Remove the body from the message and add the content-digest,
             % encoded as a structured field.
-            ?event({add_content_digest, {string, Body}}),
             (maps:without([<<"body">>], Msg))#{
                 <<"content-digest">> =>
-                    iolist_to_binary(hb_structured_fields:dictionary(
+                    hb_util:bin(hb_structured_fields:dictionary(
                         #{
                             <<"sha-256">> =>
                                 {item, {binary, hb_crypto:sha256(Body)}, []}
                         }
                     ))
-            }
+            };
+        _ -> Msg
     end.
 
-%% @doc Convert an address to a signature name that is short, unique to the
-%% address, and lowercase.
--spec address_to_sig_name(binary()) -> binary().
-address_to_sig_name(Address) when ?IS_ID(Address) ->
-    <<"http-sig-", (hb_util:to_hex(binary:part(hb_util:native_id(Address), 1, 8)))/binary>>;
-address_to_sig_name(OtherRef) ->
-    OtherRef.
-
-%%@doc Ensure that the commitments and hmac are properly encoded
-reset_hmac(RawMsg) ->
-    Msg = hb_message:convert(RawMsg, tabm, #{}),
-    WithoutHmac =
-        hb_message:without_commitments(
-            #{
-                <<"commitment-device">> => <<"httpsig@1.0">>,
-                <<"alg">> => <<"hmac-sha256">>
-            },
-            Msg
+%% @doc Given a base message and a commitment, derive the message and commitment
+%% normalized for encoding.
+normalize_for_encoding(Msg, Commitment, Opts) ->
+    % Extract the requested keys to include in the signature base.
+    RawInputs =
+        hb_util:message_to_ordered_list(
+            maps:get(<<"committed">>, Commitment, []),
+            Opts
         ),
-    Commitments = maps:get(<<"commitments">>, WithoutHmac, #{}),
-    AllSigs =
-        maps:from_list(lists:map(
-            fun ({Committer, #{ <<"signature">> := Signature }}) ->
-                SigNameFromDict = sig_name_from_dict(Signature),
-                ?event({name_options,
-                    {committer, Committer},
-                    {sig_name_from_dict, SigNameFromDict}}
-                ),
-                SigBin =
-                    maps:get(SigNameFromDict,
-                        maps:from_list(
-                            hb_structured_fields:parse_dictionary(Signature)
-                        )
-                    ),
-                {SigNameFromDict, SigBin}
-            end,
-            maps:to_list(Commitments)
-        )),
-    AllInputs =
-        maps:from_list(lists:map(
-            fun ({_Committer, #{ <<"signature-input">> := Inputs }}) ->
-                SigNameFromDict = sig_name_from_dict(Inputs),
-                Res = hb_structured_fields:parse_dictionary(Inputs),
-                SingleSigInput = maps:get(SigNameFromDict, maps:from_list(Res)),
-                {SigNameFromDict, SingleSigInput}
+    % Normalize the keys to their maybe-linked form, adding `+link` if necessary.
+    Inputs =
+        lists:map(
+            fun(Key) ->
+                NormalizedKey = hb_ao:normalize_key(Key),
+                case maps:is_key(NormalizedKey, Msg) of
+                    true -> NormalizedKey;
+                    false ->
+                        case maps:is_key(<<NormalizedKey/binary, "+link">>, Msg) of
+                            true -> <<NormalizedKey/binary, "+link">>;
+                            false -> NormalizedKey
+                        end
+                end
             end,
-            maps:to_list(Commitments)
-        )),
-    FlatInputs = lists:flatten(maps:values(AllInputs)),
-    HMacSigInfo =
-        case FlatInputs of
-            [] -> #{};
-            _ -> #{
-                <<"signature">> =>
-                    bin(hb_structured_fields:dictionary(AllSigs)),
-                <<"signature-input">> =>
-                    bin(hb_structured_fields:dictionary(AllInputs))
-            }
-        end,
-    ?event({pre_hmac_sig_input,
-        {string, maps:get(<<"signature-input">>, HMacSigInfo, none)}}),
-    HMacInputMsg = maps:merge(Msg, HMacSigInfo),
-    {ok, RawID} = hmac(HMacInputMsg),
-    ID = hb_util:human_id(RawID),
-    Res = {
-        ok,
-        maps:put(
-            <<"commitments">>,
-            Commitments#{
-                ID =>
-                    HMacSigInfo#{
-                        <<"commitment-device">> => <<"httpsig@1.0">>,
-                        <<"alg">> => <<"hmac-sha256">>
-                    }
+            RawInputs
+        ),
+    ?event({inputs, {list, Inputs}}),
+    % Filter the message down to only the requested keys, then encode it.
+    MsgWithOnlyInputs = maps:with(Inputs, Msg),
+    ?event({msg_with_only_inputs, maps:without([<<"commitments">>], MsgWithOnlyInputs)}),
+    {ok, EncodedWithSigInfo} =
+        to(
+            maps:without([<<"commitments">>], MsgWithOnlyInputs),
+            #{
+                <<"bundle">> =>
+                    hb_util:atom(maps:get(<<"bundle">>, Commitment, false))
             },
-            Msg
-        )
-    },
-    ?event({reset_hmac_complete, Res}),
-    Res.
-
-sig_name_from_dict(DictBin) ->
-    [{SigNameFromDict, _}] = hb_structured_fields:parse_dictionary(DictBin),
-    SigNameFromDict.
-
-%% @doc Generate the ID of the message, with the current signature and signature
-%% input as the components for the hmac.
-hmac(Msg) ->
-    % The message already has a signature and signature input, so we can use
-    % just those as the components for the hmac
-    EncodedMsg =
-        maps:without(
-            [<<"body-keys">>],
-            to(maps:without([<<"commitments">>, <<"body-keys">>], Msg))
+            Opts
         ),
-    % Remove the body and set the content-digest as a field
-    MsgWithContentDigest = add_content_digest(EncodedMsg),
-    % Find the keys to use for the hmac. These should be set by the signature
-    % input, but if that is not present, then use all the keys from the encoded
-    % message.
-    HMacKeys =
-        case maps:get(<<"signature-input">>, Msg, none) of
-            none -> 
-                ?event(no_sig_input_found),
-                maps:keys(MsgWithContentDigest);
-            SigInput ->
-                ?event(sig_input_found),
-                [{_, {list, Items, _}}|_]
-                    = hb_structured_fields:parse_dictionary(SigInput),
-                ?event({parsed_sig_input_dict, {explicit, Items}}),
-                [ Name || {item, {_, Name}, _} <- Items ]
+    % Remove the signature and signature-input keys from the encoded message,
+    % convert the `body' key to a `content-digest' key, if present.
+    Encoded = add_content_digest(EncodedWithSigInfo, Opts),
+    % Transform the list of requested keys to their `httpsig@1.0' equivalents.
+    EncodedKeys = maps:keys(Encoded),
+    EncodedKeysWithBodyKey =
+        case hb_maps:get(<<"ao-body-key">>, EncodedWithSigInfo, not_found) of
+            not_found ->
+                EncodedKeys;
+            AOBodyKey ->
+                hb_util:list_replace(
+                    EncodedKeys,
+                    AOBodyKey,
+                    [<<"body">>, <<"ao-body-key">>]
+                )
         end,
-    HMACSpecifiers = normalize_component_identifiers(HMacKeys),
-    % Generate the signature base
-    {_, SignatureBase} = signature_base(
-        #{
-            component_identifiers => HMACSpecifiers,
-            sig_params => #{
-                keyid => <<"ao">>,
-                alg => <<"hmac-sha256">>
-            }
-        },
-        #{},
-        MsgWithContentDigest
-    ),
-    ?event({hmac_keys, {explicit, HMacKeys}}),
-    ?event({hmac_base, {string, SignatureBase}}),
-    HMacValue = crypto:mac(hmac, sha256, <<"ao">>, SignatureBase),
-    ?event({hmac_result, {string, hb_util:human_id(HMacValue)}}),
-    {ok, HMacValue}.
-
-%% @doc Verify different forms of httpsig committed messages. `dev_message:verify'
-%% already places the keys from the commitment message into the root of the
-%% message.
-verify(MsgToVerify, #{ <<"commitment">> := ExpectedID, <<"alg">> := <<"hmac-sha256">> }, _Opts) ->
-    % Verify a hmac on the message
-    ?event({verify_hmac, {target, MsgToVerify}, {expected_id, ExpectedID}}),
-    {ok, ResetMsg} = reset_hmac(maps:without([<<"id">>], MsgToVerify)),
-    case maps:get(<<"commitments">>, ResetMsg, no_commitments) of
-        no_commitments -> {error, could_not_calculate_id};
-        #{ ExpectedID := #{ <<"alg">> := <<"hmac-sha256">> } } ->
-            ?event({hmac_verified, {id, ExpectedID}}),
-            {ok, true};
-        _ ->
-            ?event({hmac_failed_verification,
-                {recalculated_commitments,
-                    maps:keys(maps:get(<<"commitments">>, ResetMsg, #{}))
-                },
-                {expected_id, ExpectedID}}),
-            {ok, false}
-    end;
-verify(MsgToVerify, Req, _Opts) ->
-    % Validate a signed commitment.
-    ?event({verify, {target, MsgToVerify}, {req, Req}}),
-    % Parse the signature parameters into a map.
-    CommitmentID = maps:get(<<"commitment">>, Req),
-    Commitment =
-        maps:get(
-            CommitmentID,
-            maps:get(<<"commitments">>, MsgToVerify, #{})
+    % The keys to be used in encodings of the message:
+    KeysForEncoding =
+        hb_util:list_replace(
+            EncodedKeysWithBodyKey,
+            <<"body">>,
+            <<"content-digest">>
         ),
-    SigName = address_to_sig_name(maps:get(<<"committer">>, Commitment)),
-    {list, _SigInputs, ParamsKVList} =
-        maps:get(
-            SigName,
-            maps:from_list(
-                hb_structured_fields:parse_dictionary(
-                    maps:get(<<"signature-input">>, MsgToVerify)
-                )
-            )
+    % Calculate the keys that have been removed from the message, as a result
+    % of being added to the body. These keys will need to be removed from the
+    % `committed' list and re-added where the `content-digest' was.
+    BodyKeys =
+        lists:filter(
+            fun(Key) -> not key_present(Key, Encoded) end,
+            RawInputs
         ),
-    {string, Alg} = maps:get(<<"alg">>, Params = maps:from_list(ParamsKVList)),
-    AlgFromCommitment = maps:get(<<"alg">>, Commitment),
-    case Alg of
-        _ when AlgFromCommitment =/= Alg ->
-            {error, {commitment_alg_mismatch,
-                {from_commitment_message, AlgFromCommitment},
-                {from_signature_params, Alg}
-            }};
-        <<"rsa-pss-sha512">> when AlgFromCommitment =:= Alg ->
-            {string, KeyID} = maps:get(<<"keyid">>, Params),
-            PubKey = hb_util:decode(KeyID),
-            Address = hb_util:human_id(ar_wallet:to_address(PubKey)),
-            % Re-run the same conversion that was done when creating the signature.
-            Enc = hb_message:convert(MsgToVerify, <<"httpsig@1.0">>, #{}),
-            EncWithoutBodyKeys = maps:without([<<"body-keys">>], Enc),
-            % Add the signature data back into the encoded message.
-            EncWithSig =
-                EncWithoutBodyKeys#{
-                    <<"signature-input">> =>
-                        maps:get(<<"signature-input">>, MsgToVerify),
-                    <<"signature">> =>
-                        maps:get(<<"signature">>, MsgToVerify)
-                },
-            % If the content-digest is already present, we override it with a
-            % regenerated value. If those values match, then the signature will
-            % verify correctly. If they do not match, then the signature will
-            % fail to verify, as the signature bases will not be the same.
-            EncWithDigest = add_content_digest(EncWithSig),
-            ?event({encoded_msg_for_verification, EncWithDigest}),
-            Res = verify_auth(
-                #{
-                    key => {{rsa, 65537}, PubKey},
-                    sig_name => address_to_sig_name(Address)
-                },
-                EncWithDigest
-            ),
-            ?event({rsa_verify_res, Res}),
-            {ok, Res};
-        _ ->
-            {error, {unsupported_alg, Alg}}
-    end.
-
-public_keys(Commitment) ->
-    SigInputs = maps:get(<<"signature-input">>, Commitment),
-    lists:filtermap(
-        fun ({_SigName, {list, _, ParamsKVList}}) ->
-            case maps:get(<<"alg">>, Params = maps:from_list(ParamsKVList)) of
-                {string, <<"rsa-pss-sha512">>} ->
-                    {string, KeyID} = maps:get(<<"keyid">>, Params),
-                    PubKey = hb_util:decode(KeyID),
-                    {true, PubKey};
-                _ ->
-                    false
-            end
-        end,
-        hb_structured_fields:parse_dictionary(SigInputs)
-    ).
-
-%%% @doc A helper to validate and produce an "Authority" State
--spec authority(
-	[binary() | component_identifier()],
-	#{binary() => binary() | integer()},
-	{} %TODO: type out a key_pair
-) -> authority_state().
-authority(ComponentIdentifiers, SigParams, PubKey = {KeyType = {ALG, _}, _Pub})
-        when is_atom(ALG) ->
-    % Only the public key is provided, so use an stub binary for private
-    % which will trigger errors downstream if it's needed, which is what we want
-    authority(ComponentIdentifiers, SigParams, {{KeyType, <<>>, PubKey}, PubKey});
-authority(ComponentIdentifiers, SigParams, PrivKey = {KeyType = {ALG, _}, _, Pub})
-        when is_atom(ALG) ->
-    % Only the private key was provided, so derive the public from private
-    authority(ComponentIdentifiers, SigParams, {PrivKey, {KeyType, Pub}});
-authority(ComponentIdentifiers, SigParams, KeyPair = {{_, _, _}, {_, _}}) ->
-    #{
-		component_identifiers => add_derived_specifiers(ComponentIdentifiers),
-		% TODO: add checks to allow only valid signature parameters
-		% https://datatracker.ietf.org/doc/html/rfc9421#name-signature-parameters
-		sig_params => SigParams,
-		key_pair => KeyPair
-	}.
-
-%% @doc Takes a list of keys that will be used in the signature inputs and 
-%% ensures that they have deterministic sorting, as well as the coorect
-%% component identifiers if applicable.
-normalize_component_identifiers(ComponentIdentifiers) ->
-    Stripped =
-        lists:map(
-            fun(<<"@", Key/binary>>) -> Key; (Key) -> Key end,
-            ComponentIdentifiers
+    KeysForCommitment =
+        dev_codec_httpsig_siginfo:from_siginfo_keys(
+            EncodedWithSigInfo,
+            BodyKeys,
+            KeysForEncoding
         ),
-    lists:sort(add_derived_specifiers(Stripped)).
-
-%% @doc Normalize key parameters to ensure their names are correct.
-add_derived_specifiers(ComponentIdentifiers) ->
-    lists:flatten(
+    ?event(debug_httpsig,
+        {normalized_for_encoding,
+            {raw_inputs, Inputs},
+            {inputs_for_encoding, KeysForEncoding},
+            {final_for_commitment_message, KeysForCommitment},
+            {encoded_message, Encoded}
+        }
+    ),
+    {
+        ok,
+        Encoded,
+        Commitment#{ <<"committed">> => KeysForEncoding },
+        KeysForCommitment
+    }.
+
+%% @doc Calculate if a key or its `+link' TABM variant is present in a message.
+key_present(Key, Msg) ->
+    NormalizedKey = hb_ao:normalize_key(Key),
+    maps:is_key(NormalizedKey, Msg)
+        orelse maps:is_key(<<NormalizedKey/binary, "+link">>, Msg).
+
+%% @doc create the signature base that will be signed in order to create the
+%% Signature and SignatureInput.
+%%
+%% This implements a portion of RFC-9421 see:
+%% https://datatracker.ietf.org/doc/html/rfc9421#name-creating-the-signature-base
+signature_base(EncodedMsg, Commitment, Opts) ->
+	ComponentsLines =
+        signature_components_line(
+            EncodedMsg,
+            Commitment,
+            Opts
+        ),
+    ?event({component_identifiers_for_sig_base, ComponentsLines}),
+	ParamsLine = signature_params_line(Commitment, Opts),
+    SignatureBase = 
+        <<
+            ComponentsLines/binary, "\n",
+            "\"@signature-params\": ", ParamsLine/binary
+        >>,
+    ?event(signature_base, {signature_base, {string, SignatureBase}}),
+	SignatureBase.
+
+%% @doc Given a list of Component Identifiers and a Request/Response Message
+%% context, create the "signature-base-line" portion of the signature base
+%% TODO: catch duplicate identifier:
+%% https://datatracker.ietf.org/doc/html/rfc9421#section-2.5-7.2.2.5.2.1
+%%
+%% See https://datatracker.ietf.org/doc/html/rfc9421#section-2.5-7.2.1
+signature_components_line(Req, Commitment, _Opts) ->
+	ComponentsLines =
         lists:map(
-            fun(Key) ->
-                case lists:member(Key, ?DERIVED_COMPONENTS) of
-                    true -> << "@", Key/binary >>;
-                    false -> Key
+            fun(Name) ->
+                case maps:get(Name, Req, not_found) of
+                    not_found ->
+                        throw(
+                            {
+                                missing_key_for_signature_component_line,
+                                Name,
+                                {message, Req},
+                                {commitment, Commitment}
+                            }
+                        );
+                    Value ->
+                        << <<"\"">>/binary, Name/binary, <<"\"">>/binary, <<": ">>/binary, Value/binary>>
                 end
             end,
-            ComponentIdentifiers
-        )
-    ).
-
-%% @doc Remove derived specifiers from a list of component identifiers.
-remove_derived_specifiers(ComponentIdentifiers) ->
-    lists:map(
-        fun(<<"@", Key/binary>>) -> Key; (Key) -> Key end,
-        ComponentIdentifiers
-    ).
-
-%% @doc using the provided Authority and Request/Response Messages Context,
-%% create a Name, Signature and SignatureInput that can be used to additional
-%% signatures to a corresponding HTTP Message
--spec sign_auth(authority_state(), request_message(), response_message()) ->
-    {ok, {binary(), binary(), binary()}}.
-sign_auth(Authority, Req, Res) ->
-    {Priv, Pub} = maps:get(key_pair, Authority),
-    % Create the signature base and signature-input values
-    AuthorityWithSigParams = add_sig_params(Authority, Pub),
-	{SignatureInput, SignatureBase} =
-        signature_base(AuthorityWithSigParams, Req, Res),
-    % Now perform the actual signing
-    ?event(signature_base,
-        {signature_base_for_signing, {string, SignatureBase}}),
-	Signature = ar_wallet:sign(Priv, SignatureBase, sha512),
-	{ok, {SignatureInput, Signature}}.
+            maps:get(<<"committed">>, Commitment)
+        ),
+	iolist_to_binary(lists:join(<<"\n">>, ComponentsLines)).
 
-%% @doc Add the signature parameters to the authority state
-add_sig_params(Authority, {_KeyType, PubKey}) ->
-    maps:put(
-        sig_params,
-        maps:merge(
-            maps:get(sig_params, Authority),
-            #{
-                alg => <<"rsa-pss-sha512">>,
-                keyid => hb_util:encode(PubKey)
-            }
+%% @doc construct the "signature-params-line" part of the signature base.
+%%
+%% See https://datatracker.ietf.org/doc/html/rfc9421#section-2.5-7.3.2.4
+signature_params_line(RawCommitment, Opts) ->
+    Commitment =
+        maps:without(
+            [<<"signature">>, <<"signature-input">>],
+            RawCommitment
         ),
-        Authority
+    ?event(debug_enc, {signature_params_line, {commitment, Commitment}}),
+	hb_util:bin(
+        hb_structured_fields:list(
+            [
+                {
+                    list,
+                    lists:map(
+                        fun(Key) -> {item, {string, Key}, []} end,
+                        dev_codec_httpsig_siginfo:add_derived_specifiers(
+                            hb_util:message_to_ordered_list(
+                                maps:get(<<"committed">>, Commitment),
+                                Opts
+                            )
+                        )
+                    ),
+                    lists:map(
+                        fun ({<<"alg">>, Param}) when is_binary(Param) ->
+                            {<<"alg">>, {string, Param}};
+                        ({Name, Param}) when is_binary(Param) ->
+                            {Name, {string, Param}};
+                        ({Name, Param}) when is_integer(Param) ->
+                            {Name, Param}
+                        end,
+                        lists:sort(maps:to_list(
+                            maps:with(
+                                [
+                                    <<"created">>,
+                                    <<"expires">>,
+                                    <<"nonce">>,
+                                    <<"alg">>,
+                                    <<"keyid">>,
+                                    <<"tag">>,
+                                    <<"bundle">>
+                                ],
+                                Commitment#{ <<"alg">> => maps:get(<<"type">>, Commitment) }
+                            )
+                        ))
+                    )
+                }
+            ]
+        )
     ).
 
-%%% @doc same verify/3, but with an empty Request Message Context
-verify_auth(Verifier, Msg) ->
-    % Assume that the Msg is a response message, and use an empty Request 
-    % message context
-    %
-    % A corollary is that a signature containing any components from the request
-    % will produce an error. It is the caller's responsibility to provide the
-    % required Message Context in order to verify the signature
-    verify_auth(Verifier, #{}, Msg).
-
-%%% @doc Given the signature name, and the Request/Response Message Context
-%%% verify the named signature by constructing the signature base and comparing
-verify_auth(#{ sig_name := SigName, key := Key }, Req, Res) ->
-    % Signature and Signature-Input fields are each themself a dictionary 
-    % structured field.
-    % Ergo, we can use our same utilities to extract the value at the desired key,
-    % in this case, the signature name. Because our utilities already implement
-    % the relevant portions of RFC-9421, we get the error handling here as well.
-    % 
-    %  See https://datatracker.ietf.org/doc/html/rfc9421#section-3.2-3.2
-    SigNameParams = [{<<"key">>, {string, bin(SigName)}}],
-    SignatureIdentifier = {item, {string, <<"signature">>}, SigNameParams},
-    SignatureInputIdentifier =
-        {item, {string, <<"signature-input">>}, SigNameParams},
-    % extract signature and signature params
-    SigIdentifier = extract_field(SignatureIdentifier, Req, Res),
-    SigInputIdentifier = extract_field(SignatureInputIdentifier, Req, Res),
-    case {SigIdentifier, SigInputIdentifier} of
-        {{ok, {_, EncodedSignature}}, {ok, {_, SignatureInput}}} ->
-            % The signature may be encoded ie. as binary, so we need to parse it
-            % further as a structured field
-            {item, {_, Signature}, _} =
-                hb_structured_fields:parse_item(EncodedSignature),
-            % The value encoded within signature input is also a structured field,
-            % specifically an inner list that encodes the ComponentIdentifiers
-            % and the Signature Params.
-            % 
-            % So we must parse this value, and then use it to construct the 
-            % signature base
-            [{list, ComponentIdentifiers, SigParams}] =
-                hb_structured_fields:parse_list(SignatureInput),
-            SigParamsMap = lists:foldl(
-                % TODO: does not support SF decimal params
-                fun
-                    ({Name, {_Kind, Value}}, Map) -> maps:put(Name, Value, Map);
-                    ({Name, Value}, Map) -> maps:put(Name, Value, Map)
-                end,
-                #{},
-                SigParams
-            ),
-            ?event({sig_params_map, ComponentIdentifiers}),
-            % Construct the signature base using the parsed parameters
-            Authority = authority(ComponentIdentifiers, SigParamsMap, Key),
-            {_, SignatureBase} = signature_base(Authority, Req, Res),
-            ?event(signature_base,
-                {signature_base_for_verification, {string, SignatureBase}}),
-            {_Priv, Pub} = maps:get(key_pair, Authority),
-            % Now verify the signature base signed with the provided key matches
-            % the signature
-            ar_wallet:verify(Pub, SignatureBase, Signature, sha512);
-        % An issue with parsing the signature
-        {SignatureErr, {ok, _}} -> SignatureErr;
-        % An issue with parsing the signature input
-        {{ok, _}, SignatureInputErr} -> SignatureInputErr;
-        % An issue with parsing both, so just return the first one from the
-        % signature parsing
-        % TODO: maybe could merge the errors?
-        {SignatureErr, _} -> SignatureErr
-    end.
-
-%%% @doc create the signature base that will be signed in order to create the
-%%% Signature and SignatureInput.
-%%%
-%%% This implements a portion of RFC-9421 see:
-%%% https://datatracker.ietf.org/doc/html/rfc9421#name-creating-the-signature-base
-signature_base(Authority, Req, Res) when is_map(Authority) ->
-    ComponentIdentifiers = maps:get(component_identifiers, Authority),
-    ?event({component_identifiers_for_sig_base, ComponentIdentifiers}),
-	ComponentsLine = signature_components_line(ComponentIdentifiers, Req, Res),
-	ParamsLine =
-        signature_params_line(
-            ComponentIdentifiers,
-            maps:get(sig_params, Authority)),
-    SignatureBase = join_signature_base(ComponentsLine, ParamsLine),
-    ?event(signature_base, {signature_base, {string, SignatureBase}}),
-	{ParamsLine, SignatureBase}.
-
-join_signature_base(ComponentsLine, ParamsLine) ->
-    <<
-        ComponentsLine/binary, "\n",
-        "\"@signature-params\": ", ParamsLine/binary
-    >>.
-
-%%% @doc Given a list of Component Identifiers and a Request/Response Message
-%%% context, create the "signature-base-line" portion of the signature base
-%%% TODO: catch duplicate identifier:
-%%% https://datatracker.ietf.org/doc/html/rfc9421#section-2.5-7.2.2.5.2.1
-%%%
-%%% See https://datatracker.ietf.org/doc/html/rfc9421#section-2.5-7.2.1
-signature_components_line(ComponentIdentifiers, Req, Res) ->
-	ComponentsLines = lists:map(
-		fun({Name, DirectBinary}) when is_binary(DirectBinary) andalso is_binary(Name) ->
-			<<Name/binary, <<": ">>/binary, DirectBinary/binary>>;
-			(ComponentIdentifier) ->
-				% TODO: handle errors?
-				{ok, {I, V}} = identifier_to_component(ComponentIdentifier, Req, Res),
-				<<I/binary, <<": ">>/binary, V/binary>>
-		end,
-		ComponentIdentifiers
-	),
-	ComponentsLine = lists:join(<<"\n">>, ComponentsLines),
-	bin(ComponentsLine).
-
-%%% @doc construct the "signature-params-line" part of the signature base.
-%%%
-%%% See https://datatracker.ietf.org/doc/html/rfc9421#section-2.5-7.3.2.4
-signature_params_line(ComponentIdentifiers, SigParams) ->
-	SfList = sf_signature_params(ComponentIdentifiers, SigParams),
-	Res = hb_structured_fields:list(SfList),
-	bin(Res).
-
-%%% @doc Given a Component Identifier and a Request/Response Messages Context
-%%% extract the value represented by the Component Identifier, from the Messages
-%%% Context, and return the normalized form of the identifier, along with the
-%%% extracted encoded value.
-%%%
-%%% Generally speaking, a Component Identifier may reference a "Derived" Component,
-%%% a Message Field, or a sub-component of a Message Field.
-%%%
-%%% Since a Component Identifier is itself a Structured Field, it may also specify
-%%% parameters, which are used to describe behavior such as which Message to
-%%% derive a field or sub-component of the field, and how to encode the value as
-%%% part of the signature base.
-identifier_to_component(Identifier, Req, Res) when is_list(Identifier) ->
-	identifier_to_component(list_to_binary(Identifier), Req, Res);
-identifier_to_component(Identifier, Req, Res) when is_atom(Identifier) ->
-	identifier_to_component(atom_to_binary(Identifier), Req, Res);
-identifier_to_component(Identifier, Req, Res) when is_binary(Identifier) ->
-	identifier_to_component(
-        {item, {string, Identifier}, []},
-        Req,
-        Res
-    );
-identifier_to_component(ParsedIdentifier = {item, {X, Value}, Params}, Req, Res) ->
-	case Value of
-		<<$@, Rest/bits>> -> 
-            extract_field({item, {X, Rest}, Params}, Req, Res);
-		_ -> extract_field(ParsedIdentifier, Req, Res)
-	end.
-
-%%% @doc Given a Component Identifier and a Request/Response Messages Context
-%%% extract the value represented by the Component Identifier, from the Messages
-%%% Context, specifically a field on a Message within the Messages Context,
-%%% and return the normalized form of the identifier, along with the extracted
-%%% encoded value.
-%%%
-%%% This implements a portion of RFC-9421
-%%% See https://datatracker.ietf.org/doc/html/rfc9421#name-http-fields
-extract_field({item, {_Kind, IParsed}, IParams}, Req, Res) ->
-	IsStrictFormat = find_strict_format_param(IParams),
-	IsByteSequenceEncoded = find_byte_sequence_param(IParams),
-	DictKey = find_key_param(IParams),
-	case (IsStrictFormat orelse DictKey =/= false) andalso IsByteSequenceEncoded of
-		true ->
-			% https://datatracker.ietf.org/doc/html/rfc9421#section-2.5-7.2.2.5.2.2
-			{
-                conflicting_params_error,
-                <<
-                    "Component Identifier parameter 'bs' MUST not ",
-                    "be used with 'sf' or 'key'"
-                >>
-            };
-		_ ->
-			NormParsed = hb_ao:normalize_key(IParsed),
-			NormalizedItem =
-                hb_structured_fields:item(
-                    {item, {string, NormParsed}, IParams}
-                ),
-            IsRequestIdentifier = find_request_param(IParams),
-			% There may be multiple fields that match the identifier on the Msg,
-			% so we filter, instead of find
-            %?event({extracting_field, {identifier, Lowered}, {req, Req}, {res, Res}}),
-			case maps:get(NormParsed, if IsRequestIdentifier -> Req; true -> Res end, not_found) of
-				not_found ->
-					% https://datatracker.ietf.org/doc/html/rfc9421#section-2.5-7.2.2.5.2.6
-					{
-                        field_not_found_error,
-                        <<"Component Identifier for a field MUST be ",
-                            "present on the message">>,
-                        {key, NormParsed},
-                        {req, Req},
-                        {res, Res}
-                    };
-				FieldValue ->
-					% The Field was found, but we still need to potentially
-                    % parse it (it could be a Structured Field) and potentially
-                    % extract subsequent values ie. specific dictionary key and
-                    % its parameters, or further encode it
-					case
-						extract_field_value(
-                            [FieldValue],
-                            [DictKey, IsStrictFormat, IsByteSequenceEncoded])
-					of
-						{ok, Extracted} ->
-                            {ok, {bin(NormalizedItem), bin(Extracted)}};
-						E -> E
-					end
-			end
-	end.
-
-%%% @doc Extract values from the field and return the normalized field,
-%%% along with encoded value
-extract_field_value(RawFields, [Key, IsStrictFormat, IsByteSequenceEncoded]) ->
-	% TODO: (maybe this already works?) empty string for empty header
-	HasKey = case Key of false -> false; _ -> true end,
-	case not (HasKey orelse IsStrictFormat orelse IsByteSequenceEncoded) of
-        % No RFC-9421 parameterized encodings ie. "sf", "bs", "key"
-        % (see https://datatracker.ietf.org/doc/html/rfc9421#section-2.1-17)
-        % So simply normalize and return the field values.
-        % 
-        % This takes into account the list-based fields serialization
-        % described in https://datatracker.ietf.org/doc/html/rfc9421#section-2.1-5
-		true ->
-			Normalized = [trim_and_normalize(Field) || Field <- RawFields],
-			{ok, bin(lists:join(<<", ">>, Normalized))};
-		_ ->
-			case IsByteSequenceEncoded of
-				% https://datatracker.ietf.org/doc/html/rfc9421#section-2.1.3-2
-				true ->
-					SfList = [
-						{item, {binary, trim_and_normalize(Field)}, []}
-					 || Field <- RawFields
-					],
-					sf_encode(SfList);
-				_ ->
-                    % In all cases, multiple fields MUST be combined
-                    % into a single data structure, before serialization,
-                    %
-                    % See https://datatracker.ietf.org/doc/html/rfc9421#section-2.1.1-2
-                    % And https://datatracker.ietf.org/doc/html/rfc9421#section-2.1.2-2
-					Combined = bin(lists:join(<<", ">>, RawFields)),
-					case sf_parse(Combined) of
-						% https://datatracker.ietf.org/doc/html/rfc9421#section-2.1.1-3
-						{error, _} ->
-							{
-                                sf_parsing_error,
-                                <<"Component Identifier value could not ",
-                                    "be parsed as a structured field">>
-                            };
-						{ok, SF} ->
-							case HasKey of
-                                % https://datatracker.ietf.org/doc/html/rfc9421#section-2.1.1
-								false -> case IsStrictFormat of
-                                    % just re-serialize, which should properly
-                                    % format the data in Strict-Formatting style
-                                    true -> sf_encode(SF);
-                                    _ -> Combined
-                                end;
-								_ -> extract_dictionary_field_value(SF, Key)
-							end
-					end
-			end
-	end.
-
-%%% @doc Extract a value from a Structured Field, and return the normalized field,
-%%% along with the encoded value
-extract_dictionary_field_value(StructuredField = [Elem | _Rest], Key) ->
-	case Elem of
-		{Name, _} when is_binary(Name) ->
-			case lists:keyfind(Key, 1, StructuredField) of
-				% https://datatracker.ietf.org/doc/html/rfc9421#section-2.1.2-5
-				false ->
-					{
-                        sf_dicionary_key_not_found_error,
-                        <<"Component Identifier references key not ",
-                            "found in dictionary structured field">>,
-                        {key, Key},
-                        {structured_field, StructuredField}
-                    };
-				{_, Value} ->
-					sf_encode(Value)
-			end;
-		_ ->
-			{
-                sf_not_dictionary_error,
-                <<"Component Identifier cannot reference key on a ",
-                    "non-dictionary structured field">>
-            }
-	end.
-
-%%% @doc Given a Component Identifier and a Request/Response Messages Context
-%%% extract the value represented by the Component Identifier, from the Messages
-%%% Context, specifically a "Derived" Component within the Messages Context,
-%%% and return the normalized form of the identifier, along with the extracted
-%%% encoded value.
-%%%
-%%% This implements a portion of RFC-9421
-%%% See https://datatracker.ietf.org/doc/html/rfc9421#name-derived-components
-derive_component(Identifier, Req, Res) when map_size(Res) == 0 ->
-	derive_component(Identifier, Req, Res, req);
-derive_component(Identifier, Req, Res) ->
-	derive_component(Identifier, Req, Res, res).
-derive_component({item, {_Kind, IParsed}, IParams}, Req, Res, Subject) ->
-	case find_request_param(IParams) andalso Subject =:= req of
-		% https://datatracker.ietf.org/doc/html/rfc9421#section-2.5-7.2.2.5.2.3
-		true ->
-			{
-                req_identifier_error,
-                <<"A Component Identifier may not contain a req parameter ",
-                    "if the target is a request message">>
-            };
-		_ ->
-			Lowered = lower_bin(IParsed),
-			NormalizedItem =
-                hb_structured_fields:item(
-                    {item, {string, Lowered}, IParams}
-                ),
-			Result =
-				case Lowered of
-					% https://datatracker.ietf.org/doc/html/rfc9421#section-2.2-4.2.1
-					<<"@method">> ->
-						{ok, upper_bin(maps:get(<<"method">>, Req, <<>>))};
-					% https://datatracker.ietf.org/doc/html/rfc9421#section-2.2-4.4.1
-					<<"@target-uri">> ->
-						{ok, bin(maps:get(<<"path">>, Req, <<>>))};
-					% https://datatracker.ietf.org/doc/html/rfc9421#section-2.2-4.6.1
-					<<"@authority">> ->
-						URI = uri_string:parse(maps:get(<<"path">>, Req, <<>>)),
-						Authority = maps:get(host, URI, <<>>),
-						{ok, lower_bin(Authority)};
-					% https://datatracker.ietf.org/doc/html/rfc9421#section-2.2-4.8.1
-					<<"@scheme">> ->
-						URI = uri_string:parse(maps:get(<<"path">>, Req)),
-						Scheme = maps:get(scheme, URI, <<>>),
-						{ok, lower_bin(Scheme)};
-					% https://datatracker.ietf.org/doc/html/rfc9421#section-2.2-4.10.1
-					<<"@request-target">> ->
-						URI = uri_string:parse(maps:get(<<"path">>, Req)),
-						% If message contains the absolute form value, then
-						% the value must be the absolut url
-						%
-						% TODO: maybe better way to distinguish besides a flag
-						% on the request?
-						%
-						% See https://datatracker.ietf.org/doc/html/rfc9421#section-2.2.5-10
-						RequestTarget =
-							case maps:get(is_absolute_form, Req, false) of
-								true -> maps:get(url, Req);
-								_ ->
-                                    lists:join($?,
-                                        [
-                                            maps:get(path, URI, <<>>),
-                                            maps:get(query, URI, ?EMPTY_QUERY_PARAMS)
-                                        ]
-                                    )
-							end,
-						{ok, bin(RequestTarget)};
-					% https://datatracker.ietf.org/doc/html/rfc9421#section-2.2-4.12.1
-					<<"@path">> ->
-						URI = uri_string:parse(maps:get(<<"path">>, Req)),
-						Path = maps:get(path, URI),
-						{ok, bin(Path)};
-					% https://datatracker.ietf.org/doc/html/rfc9421#section-2.2-4.14.1
-					<<"@query">> ->
-						URI = uri_string:parse(maps:get(<<"path">>, Req)),
-						% No query params results in a "?" value
-						% See https://datatracker.ietf.org/doc/html/rfc9421#section-2.2.7-14
-						Query =
-							case maps:get(query, URI, <<>>) of
-								<<>> -> ?EMPTY_QUERY_PARAMS;
-								Q -> Q
-							end,
-						{ok, bin(Query)};
-					% https://datatracker.ietf.org/doc/html/rfc9421#section-2.2-4.16.1
-					<<"@query-param">> ->
-						case find_name_param(IParams) of
-							% The name parameter MUST be provided when specifiying a @query-param
-							% Derived Component. See https://datatracker.ietf.org/doc/html/rfc9421#section-2.2.8-1
-							false ->
-								{
-                                    req_identifier_error,
-                                    <<"@query_param Derived Component Identifier ",
-                                    "must specify a name parameter">>
-                                };
-							Name ->
-								URI = uri_string:parse(maps:get(<<"path">>, Req)),
-								QueryParams =
-                                    uri_string:dissect_query(maps:get(query, URI, "")),
-								QueryParam =
-									case lists:keyfind(Name, 1, QueryParams) of
-										{_, QP} -> QP;
-										% An missing or empty query param value results in
-										% an empty string value in the signature base
-										% https://datatracker.ietf.org/doc/html/rfc9421#section-2.2.8-4
-										_ -> ""
-									end,
-								{ok, bin(QueryParam)}
-						end;
-					% https://datatracker.ietf.org/doc/html/rfc9421#section-2.2-4.18.1
-					<<"@status">> ->
-						case Subject =:= req of
-							% https://datatracker.ietf.org/doc/html/rfc9421#section-2.2.9-8
-							true ->
-								{
-                                    res_identifier_error,
-                                    <<"@status Derived Component must not be ",
-                                    "used if target is a request message">>
-                                };
-							_ ->
-								Status = maps:get(<<"status">>, Res, <<"200">>),
-								{ok, Status}
-						end
-				end,
-            ?event({derive_component, IParsed, Result}),
-			case Result of
-				{ok, V} ->
-                    ?event({derive_component, IParsed, {ok, V}}),
-                    {ok, {bin(NormalizedItem), V}};
-				E -> E
-			end
-	end.
-
-%%%
-%%% Strucutured Field Utilities
-%%%
-
-%%% @doc construct the structured field Parameter for the signature parameter,
-%%% checking whether the parameter name is valid according RFC-9421
-%%% 
-%%% See https://datatracker.ietf.org/doc/html/rfc9421#section-2.3-3
-sf_signature_param({Name, Param}) ->
-    NormalizedName = bin(Name),
-    NormalizedNames = lists:map(fun bin/1, ?SIGNATURE_PARAMS),
-    case lists:member(NormalizedName, NormalizedNames) of
-        false -> {unknown_signature_param, NormalizedName};
-        % all signature params are either integer or string values
-        true -> case Param of
-            I when is_integer(I) -> {ok, {NormalizedName, Param}};
-            P when is_atom(P) orelse is_list(P) orelse is_binary(P) ->
-                {ok, {NormalizedName, {string, bin(P)}}};
-            P -> {invalid_signature_param_value, P}
-        end
-    end.
-
-%%% @doc construct the structured field List for the
-%%% "signature-params-line" part of the signature base.
-%%% 
-%%% Can be parsed into a binary by simply passing to hb_structured_fields:list/1
-%%%
-%%% See https://datatracker.ietf.org/doc/html/rfc9421#section-2.5-7.3.2.4
-sf_signature_params(ComponentIdentifiers, SigParams) when is_map(SigParams) ->
-    AsList = maps:to_list(SigParams),
-    Sorted = lists:sort(fun({Key1, _}, {Key2, _}) -> Key1 < Key2 end, AsList),
-    sf_signature_params(ComponentIdentifiers, Sorted);
-sf_signature_params(ComponentIdentifiers, SigParams) when is_list(SigParams) ->
-    [
-		{
-			list,
-			lists:map(
-                fun(ComponentIdentifier) ->
-					{item, {_Kind, Value}, Params} = sf_item(ComponentIdentifier),
-					{item, {string, lower_bin(Value)}, Params}
-				end,
-                ComponentIdentifiers
-            ),
-			lists:foldl(
-                fun (RawParam, Params) ->
-                    case sf_signature_param(RawParam) of
-                        {ok, Param} -> Params ++ [Param];
-                        % Ignore unknown signature parameters
-                        {unknown_signature_param, _} -> Params
-                        % TODO: what to do about invalid_signature_param_value?
-                        % For now will cause badmatch
-                    end
-                end,
-                [],
-                SigParams  
-            )
-		}
-	].
-
-%%% @doc Attempt to parse the binary into a data structure that represents
-%%% an HTTP Structured Field.
-%%%
-%%% Lacking some sort of "hint", there isn't a way to know which "kind" of
-%%% Structured Field the binary is, apriori. So we simply try each parser,
-%%% and return the first invocation that doesn't result in an error.
-%%%
-%%% If no parser is successful, then we return an error tuple
-sf_parse(Raw) when is_list(Raw) -> sf_parse(list_to_binary(Raw));
-sf_parse(Raw) when is_binary(Raw) ->
-	Parsers = [
-		fun hb_structured_fields:parse_list/1,
-		fun hb_structured_fields:parse_dictionary/1,
-		fun hb_structured_fields:parse_item/1
-	],
-	sf_parse(Parsers, Raw).
-
-sf_parse([], _Raw) ->
-    {error, undefined};
-sf_parse([Parser | Rest], Raw) ->
-    case catch Parser(Raw) of
-        % skip parsers that fail
-        {'EXIT', _} -> sf_parse(Rest, Raw);
-        Parsed -> {ok, Parsed}
-    end.
-
-%%% @doc Attempt to encode the data structure into an HTTP Structured Field.
-%%% This is the inverse of sf_parse.
-sf_encode(StructuredField = {list, _, _}) ->
-	% The value is an inner_list, and so needs to be wrapped with an outer list
-	% before being serialized
-	sf_encode(fun hb_structured_fields:list/1, [StructuredField]);
-sf_encode(StructuredField = {item, _, _}) ->
-	sf_encode(fun hb_structured_fields:item/1, StructuredField);
-sf_encode(StructuredField = [Elem | _Rest]) ->
-	sf_encode(
-		% Both an sf list and dictionary is represented in Erlang as a List of
-        % pairs but a dictionary's members will always be a pair whose first value
-		% is a binary, so we can match on that to determine which serializer to use
-		case Elem of
-			{Name, _} when is_binary(Name) ->
-                fun hb_structured_fields:dictionary/1;
-			_ ->
-                fun hb_structured_fields:list/1
-		end,
-		StructuredField
-	).
-sf_encode(Serializer, StructuredField) ->
-	case catch Serializer(StructuredField) of
-		{'EXIT', _} -> {error, <<"Could not serialize into structured field">>};
-		Parsed -> {ok, Parsed}
-	end.
-
-%%% @doc Attempt to parse the provided value into an HTTP Structured Field Item
-sf_item(SfItem = {item, {_Kind, _Parsed}, _Params}) ->
-	SfItem;
-sf_item(ComponentIdentifier) when is_list(ComponentIdentifier) ->
-	sf_item(list_to_binary(ComponentIdentifier));
-sf_item(ComponentIdentifier) when is_binary(ComponentIdentifier) ->
-    {item, {string, ComponentIdentifier}, []}.
-
-%%% @doc Given a parameter Name, extract the Parameter value from the HTTP
-%%% Structured Field data structure.
-%%%
-%%% If no value is found, then false is returned
-find_sf_param(Name, Params, Default) when is_list(Name) ->
-    find_sf_param(list_to_binary(Name), Params, Default);
-find_sf_param(Name, Params, Default) ->
-	% [{<<"name">>,{string,<<"baz">>}}]
-	case lists:keyfind(Name, 1, Params) of
-		false -> Default;
-		{_, {string, Value}} -> Value;
-		{_, {token, Value}} -> Value;
-		{_, {binary, Value}} -> Value;
-		{_, Value} -> Value
-	end.
-
-%%%
-%%% https://datatracker.ietf.org/doc/html/rfc9421#section-6.5.2-1
-%%% using functions allows encapsulating default values
-%%%
-find_strict_format_param(Params) -> find_sf_param(<<"sf">>, Params, false).
-find_key_param(Params) -> find_sf_param(<<"key">>, Params, false).
-find_byte_sequence_param(Params) -> find_sf_param(<<"bs">>, Params, false).
-find_trailer_param(Params) -> find_sf_param(<<"tr">>, Params, false).
-find_request_param(Params) -> find_sf_param(<<"req">>, Params, false).
-find_name_param(Params) -> find_sf_param(<<"name">>, Params, false).
-
-%%%
-%%% Data Utilities
-%%%
-
-% https://datatracker.ietf.org/doc/html/rfc9421#section-2.1-5
-trim_and_normalize(Bin) ->
-	binary:replace(trim_ws(Bin), <<$\n>>, <<" ">>, [global]).
-
-upper_bin(Item) when is_atom(Item) -> upper_bin(atom_to_list(Item));
-upper_bin(Item) when is_binary(Item) -> upper_bin(binary_to_list(Item));
-upper_bin(Item) when is_list(Item) -> bin(string:uppercase(Item)).
-
-lower_bin(Item) when is_atom(Item) -> lower_bin(atom_to_list(Item));
-lower_bin(Item) when is_binary(Item) -> lower_bin(binary_to_list(Item));
-lower_bin(Item) when is_list(Item) -> bin(string:lowercase(Item)).
-
-bin(Item) when is_atom(Item) -> atom_to_binary(Item, utf8);
-bin(Item) when is_integer(Item) ->
-    case Item of
-        % Treat integer as an ASCII code
-        N when N > 0 andalso N < 256 -> <<N>>;
-        N -> integer_to_binary(N)
-    end;
-bin(Item) ->
-    iolist_to_binary(Item).
-
-%%% @doc Recursively trim space characters from the beginning of the binary
-trim_ws(<<$\s, Bin/bits>>) -> trim_ws(Bin);
-%%% @doc No space characters at the beginning so now trim them from the end
-%%% recrusively
-trim_ws(Bin) -> trim_ws_end(Bin, byte_size(Bin) - 1).
-
-trim_ws_end(_, -1) ->
-	<<>>;
-trim_ws_end(Value, N) ->
-	case binary:at(Value, N) of
-		$\s ->
-			trim_ws_end(Value, N - 1);
-		% No more space characters matches on the end
-		% So extract the bytes up to N, and this is our trimmed value
-		_ ->
-			S = N + 1,
-			<<Trimmed:S/binary, _/bits>> = Value,
-			Trimmed
-	end.
-
 %%%
 %%% TESTS
 %%%
@@ -1238,7 +518,7 @@ trim_ws_end(Value, N) ->
 %% @doc Ensure that we can validate a signature on an extremely large and complex
 %% message that is sent over HTTP, signed with the codec.
 validate_large_message_from_http_test() ->
-    Node = hb_http_server:start_node(#{
+    Node = hb_http_server:start_node(Opts = #{
         force_signed => true,
         commitment_device => <<"httpsig@1.0">>,
         extra =>
@@ -1260,30 +540,63 @@ validate_large_message_from_http_test() ->
                 N <- lists:seq(1, 3)
             ]
     }),
-    {ok, Res} = hb_http:get(Node, <<"/~meta@1.0/info">>, #{}),
-    Signers = hb_message:signers(Res),
+    {ok, Res} = hb_http:get(Node, <<"/~meta@1.0/info">>, Opts),
+    Signers = hb_message:signers(Res, Opts),
     ?event({received, {signers, Signers}, {res, Res}}),
     ?assert(length(Signers) == 1),
-    ?assert(hb_message:verify(Res, Signers)),
+    ?assert(hb_message:verify(Res, Signers, Opts)),
     ?event({sig_verifies, Signers}),
-    ?assert(hb_message:verify(Res)),
+    ?assert(hb_message:verify(Res, all, Opts)),
     ?event({hmac_verifies, <<"hmac-sha256">>}),
-    {ok, OnlyCommitted} = hb_message:with_only_committed(Res),
+    {ok, OnlyCommitted} = hb_message:with_only_committed(Res, Opts),
     ?event({msg_with_only_committed, OnlyCommitted}),
-    ?assert(hb_message:verify(OnlyCommitted, Signers)),
+    ?assert(hb_message:verify(OnlyCommitted, Signers, Opts)),
     ?event({msg_with_only_committed_verifies, Signers}),
-    ?assert(hb_message:verify(OnlyCommitted)),
+    ?assert(hb_message:verify(OnlyCommitted, all, Opts)),
     ?event({msg_with_only_committed_verifies_hmac, <<"hmac-sha256">>}).
 
 committed_id_test() ->
     Msg = #{ <<"basic">> => <<"value">> },
     Signed = hb_message:commit(Msg, hb:wallet()),
+    ?assert(hb_message:verify(Signed, all, #{})),
     ?event({signed_msg, Signed}),
     UnsignedID = hb_message:id(Signed, none),
     SignedID = hb_message:id(Signed, all),
     ?event({ids, {unsigned_id, UnsignedID}, {signed_id, SignedID}}),
     ?assertNotEqual(UnsignedID, SignedID).
 
+commit_secret_key_test() ->
+    Msg = #{ <<"basic">> => <<"value">> },
+    CommittedMsg =
+        hb_message:commit(
+            Msg,
+            #{},
+            #{
+                <<"type">> => <<"hmac-sha256">>,
+                <<"secret">> => <<"test-secret">>,
+                <<"commitment-device">> => <<"httpsig@1.0">>,
+                <<"scheme">> => <<"secret">>
+            }
+        ),
+    ?event({committed_msg, CommittedMsg}),
+    Committers = hb_message:signers(CommittedMsg, #{}),
+    ?assert(length(Committers) == 1),
+    ?event({committers, Committers}),
+    ?assert(
+        hb_message:verify(
+            CommittedMsg,
+            #{ <<"committers">> => Committers, <<"secret">> => <<"test-secret">> },
+            #{}
+        )
+    ),
+    ?assertNot(
+        hb_message:verify(
+            CommittedMsg,
+            #{ <<"committers">> => Committers, <<"secret">> => <<"bad-secret">> },
+            #{}
+        )
+    ).
+
 multicommitted_id_test() ->
     Msg = #{ <<"basic">> => <<"value">> },
     Signed1 = hb_message:commit(Msg, Wallet1 = ar_wallet:new()),
@@ -1302,70 +615,15 @@ multicommitted_id_test() ->
     ?assert(hb_message:verify(Signed2, [Addr2, Addr1])),
     ?assert(hb_message:verify(Signed2, all)).
 
-%%% Unit Tests
-trim_ws_test() ->
-	?assertEqual(<<"hello world">>, trim_ws(<<"      hello world      ">>)),
-	?assertEqual(<<>>, trim_ws(<<"">>)),
-	?assertEqual(<<>>, trim_ws(<<"         ">>)),
-	ok.
-
-join_signature_base_test() ->
-	ParamsLine =
-		<<"(\"@method\" \"@path\" \"foo\";req \"foo\";key=\"a\");"
-		    "created=1733165109501;nonce=\"foobar\";keyid=\"key1\"">>,
-	ComponentsLine = <<"\"@method\": GET\n\"@path\": /id-123/Data\n\"foo\";"
-        "req: req-b-bar\n\"foo\";key=\"a\": 1">>,
-	?assertEqual(
-		<<
-            ComponentsLine/binary,
-            <<"\n">>/binary,
-            <<"\"@signature-params\": ">>/binary,
-            ParamsLine/binary
-        >>,
-		join_signature_base(ComponentsLine, ParamsLine)
-	).
-
-signature_params_line_test() ->
-	Params = #{created => 1733165109501, nonce => "foobar", keyid => "key1"},
-	ContentIdentifiers = [
-		<<"Content-Length">>,
-        <<"@method">>,
-        <<"@Path">>,
-        <<"content-type">>,
-        <<"example-dict">>
-	],
-	Result = signature_params_line(ContentIdentifiers, Params),
-	?assertEqual(
-        <<
-            "(\"content-length\" \"@method\" \"@path\" \"content-type\" \"example-dict\")"
-            ";created=1733165109501;keyid=\"key1\";nonce=\"foobar\""
-        >>,
-		Result
-	).
-
-derive_component_error_req_param_on_request_target_test() ->
-	Result =
-        derive_component(
-            {item, {string, <<"@query-param">>}, [{<<"req">>, true}]},
-            #{}, #{}, req),
-	?assertMatch(
-		{req_identifier_error, _},
-		Result
-	).
-
-derive_component_error_query_param_no_name_test() ->
-	Result =
-        derive_component(
-            {item,
-                {string, <<"@query-param">>},
-                [{<<"noname">>, {string, <<"foo">>}}]
-            }, #{}, #{}, req),
-	?assertMatch(
-		{req_identifier_error, _},
-		Result
-	).
-
-derive_component_error_status_req_target_test() ->
-	Result = derive_component({item, {string, <<"@status">>}, []}, #{}, #{}, req),
-	{E, _M} = Result,
-	?assertEqual(res_identifier_error, E).
+%% @doc Test that we can sign and verify a message with a link. We use 
+sign_and_verify_link_test() ->
+    Msg = #{
+        <<"normal">> => <<"typical-value">>,
+        <<"untyped">> => #{ <<"inner-untyped">> => <<"inner-value">> },
+        <<"typed">> => #{ <<"inner-typed">> => 123 }
+    },
+    NormMsg = hb_message:convert(Msg, <<"structured@1.0">>, #{}),
+    ?event({msg, NormMsg}),
+    Signed = hb_message:commit(NormMsg, hb:wallet()),
+    ?event({signed_msg, Signed}),
+    ?assert(hb_message:verify(Signed)).
diff --git a/src/dev_codec_httpsig_conv.erl b/src/dev_codec_httpsig_conv.erl
index 2c352a55e..9fb92551a 100644
--- a/src/dev_codec_httpsig_conv.erl
+++ b/src/dev_codec_httpsig_conv.erl
@@ -1,6 +1,6 @@
 
-%%% @doc A codec for the that marshals TABM encoded messages to and from the
-%%% "HTTP" message structure.
+%%% @doc A codec that marshals TABM encoded messages to and from the "HTTP"
+%%% message structure.
 %%% 
 %%% Every HTTP message is an HTTP multipart message.
 %%% See https://datatracker.ietf.org/doc/html/rfc7578
@@ -26,7 +26,7 @@
 %%%         - Otherwise encode the value as a part in the multipart response
 %%% 
 -module(dev_codec_httpsig_conv).
--export([to/1, from/1]).
+-export([to/3, from/3, encode_http_msg/2]).
 %%% Helper utilities
 -include("include/hb.hrl").
 -include_lib("eunit/include/eunit.hrl").
@@ -39,47 +39,121 @@
 
 %% @doc Convert a HTTP Message into a TABM.
 %% HTTP Structured Field is encoded into it's equivalent TABM encoding.
-from(Bin) when is_binary(Bin) -> Bin;
-from(HTTP) ->
-    % Decode the keys of the HTTP message
-    Body = maps:get(<<"body">>, HTTP, <<>>),
+from(Bin, _Req, _Opts) when is_binary(Bin) -> {ok, Bin};
+from(Link, _Req, _Opts) when ?IS_LINK(Link) -> {ok, Link};
+from(HTTP, _Req, Opts) ->
     % First, parse all headers excluding the signature-related headers, as they
     % are handled separately.
-    {_, InlinedKey} = inline_key(HTTP),
-    ?event({inlined_body_key, InlinedKey}),
-    Headers = maps:without([<<"body">>, <<"body-keys">>], HTTP),
-    ContentType = maps:get(<<"content-type">>, Headers, undefined),
-    % Next, we need to potentially parse the body and add to the TABM
-    % potentially as sub-TABMs.
-    WithBodyKeys = from_body(Headers, InlinedKey, ContentType, Body),
+    Headers = hb_maps:without([<<"body">>], HTTP, Opts),
+    % Next, we need to potentially parse the body, get the ordering of the body
+    % parts, and add them to the TABM.
+    {OrderedBodyKeys, BodyTABM} = body_to_tabm(HTTP, Opts),
+    % Merge the body keys with the headers.
+    WithBodyKeys = maps:merge(Headers, BodyTABM),
     % Decode the `ao-ids' key into a map. `ao-ids' is an encoding of literal
     % binaries whose keys (given that they are IDs) cannot be distributed as
     % HTTP headers.
-    WithIDs = ungroup_ids(WithBodyKeys),
+    WithIDs = ungroup_ids(WithBodyKeys, Opts),
     % Remove the signature-related headers, such that they can be reconstructed
     % from the commitments.
-    MsgWithoutSigs = maps:without(
+    MsgWithoutSigs = hb_maps:without(
         [<<"signature">>, <<"signature-input">>, <<"commitments">>],
-        WithIDs
-    ),
-    ?event({from_body, {headers, Headers}, {body, Body}, {msgwithoutatts, MsgWithoutSigs}}),
-    % Extract all hashpaths from the commitments of the message
-    HPs = extract_hashpaths(HTTP),
-    % Finally, we need to add the signatures to the TABM
-    {ok, MsgWithSigs} = commitments_from_signature(
-        maps:without(maps:keys(HPs), MsgWithoutSigs),
-        HPs,
-        maps:get(<<"signature">>, Headers, not_found),
-        maps:get(<<"signature-input">>, Headers, not_found)
+        WithIDs,
+        Opts
     ),
-    ?event({message_with_atts, MsgWithSigs}),
-    Res = maps:without(Removed = maps:keys(HPs) ++ [<<"content-digest">>], MsgWithSigs),
-    ?event({message_without_atts, Res, Removed}),
-    Res.
+    % Finally, we need to add the signatures to the TABM.
+    Commitments =
+        dev_codec_httpsig_siginfo:siginfo_to_commitments(
+            WithIDs,
+            OrderedBodyKeys,
+            Opts
+        ),
+    MsgWithSigs =
+        case ?IS_EMPTY_MESSAGE(Commitments) of
+            false -> MsgWithoutSigs#{ <<"commitments">> => Commitments };
+            true -> MsgWithoutSigs
+        end,
+    ?event({message_with_commitments, MsgWithSigs}),
+    Res =
+        hb_maps:without(
+            Removed =
+                hb_maps:keys(Commitments) ++
+                [<<"content-digest">>] ++
+                case maps:get(<<"content-type">>, MsgWithSigs, undefined) of
+                    <<"multipart/", _/binary>> -> [<<"content-type">>];
+                    _ -> []
+                end ++
+                case hb_message:is_signed_key(<<"ao-body-key">>, MsgWithSigs, Opts) of
+                    true -> [];
+                    false -> [<<"ao-body-key">>]
+                end,
+            MsgWithSigs,
+            Opts
+        ),
+    ?event({message_without_commitments, Res, Removed}),
+    {ok, Res}.
 
-from_body(TABM, _InlinedKey, _ContentType, <<>>) -> TABM;
-from_body(TABM, InlinedKey, ContentType, Body) ->
-    ?event({from_body, {from_headers, TABM}, {content_type, {explicit, ContentType}}, {body, Body}}),
+%% @doc Generate the body TABM from the `body' key of the encoded message.
+body_to_tabm(HTTP, Opts) ->
+    % Extract the body and content-type from the HTTP message.
+    Body = hb_maps:get(<<"body">>, HTTP, no_body, Opts),
+    ContentType = hb_maps:get(<<"content-type">>, HTTP, undefined, Opts),
+    {_, InlinedKey} = inline_key(HTTP),
+    ?event({inlined_body_key, InlinedKey}),
+    % Parse the body into a TABM.
+    {OrderedBodyKeys, BodyTABM} =
+        case body_to_parts(ContentType, Body, Opts) of
+            no_body -> {[], #{}};
+            {normal, RawBody} ->
+                % The body is not a multipart, so we just return the inlined key.
+                {[InlinedKey], #{ InlinedKey => RawBody }};
+            {multipart, Parts} ->
+                % Parse each part of the multipart body into an individual TABM,
+                % with its associated key.
+                OrderedBodyTABMs =
+                    lists:map(
+                        fun(Part) ->
+                            from_body_part(InlinedKey, Part, Opts)
+                        end,
+                        Parts
+                    ),
+                % Merge all of the parts into a single TABM.
+                {ok, MergedParts} =
+                    dev_codec_flat:from(
+                        maps:from_list(OrderedBodyTABMs),
+                        #{},
+                        Opts
+                    ),
+                % Calculate the ordered body keys of the multipart data. The
+                % nested body parts are labelled by `path`, rather than `key`:
+                % That is, a body part may contain a `/` in its key, representing
+                % that the nested form is not a direct child of the parent 
+                % message. Subsequently, we need to take just the first
+                % `path part' of the key and return the unique'd list.
+                {MessagePaths, _} = lists:unzip(OrderedBodyTABMs),
+                Keys =
+                    hb_util:unique(
+                        lists:map(
+                            fun(Path) ->
+                                hd(binary:split(Path, <<"/">>, [global]))
+                            end,
+                            MessagePaths
+                        )
+                    ),
+                % Return both as a pair.
+                {Keys, MergedParts}
+        end,
+    {OrderedBodyKeys, BodyTABM}.
+
+%% @doc Split the body into parts, if it is a multipart.
+body_to_parts(_ContentType, no_body, _Opts) -> no_body;
+body_to_parts(ContentType, Body, _Opts) ->
+    ?event(
+        {from_body,
+            {content_type, {explicit, ContentType}},
+            {body, Body}
+        }
+    ),
     Params =
         case ContentType of
             undefined -> [];
@@ -92,7 +166,7 @@ from_body(TABM, InlinedKey, ContentType, Body) ->
         false ->
             % The body is not a multipart, so just set as is to the Inlined key on
             % the TABM.
-            maps:put(InlinedKey, Body, TABM);
+            {normal, Body};
         {_, {_Type, Boundary}} ->
             % We need to manually parse the multipart body into key/values on the
             % TABM.
@@ -115,45 +189,29 @@ from_body(TABM, InlinedKey, ContentType, Body) ->
             % By taking into account all parts of the surrounding boundary above,
             % we get precisely the sub-part that we're interested without any
             % additional parsing
-            Parts = binary:split(BodyPart, [<<?CRLF/binary, "--", Boundary/binary>>], [global]),
-            % Finally, for each part within the sub-part, we need to parse it,
-            % potentially recursively as a sub-TABM, and then add it to the
-            % current TABM
-            {ok, GroupedTABM} = from_body_parts(TABM, InlinedKey, Parts),
-            FullTABM = dev_codec_flat:from(GroupedTABM),
-            FullTABM
+            {multipart, binary:split(
+                BodyPart,
+                [<<?CRLF/binary, "--", Boundary/binary>>],
+                [global]
+            )}
     end.
 
-from_body_parts (TABM, _InlinedKey, []) ->
-    % Ensure the accumulated body keys, if any, are encoded
-    % adhering to the TABM structure that all values must be
-    % maps or binaries
-    % 
-    % This prevents needing to have exceptions for <<"body-keys">>
-    % during parsing (it's just another binary)
-    WithEncodedBodyKeys =
-        case maps:get(<<"body-keys">>, TABM, undefined) of
-            undefined -> TABM;
-            % Assume already encoded
-            Bin when is_binary(Bin) -> TABM;
-            List when is_list(List) ->
-                TABM#{ <<"body-keys">> => encode_body_keys(List) }
-        end,
-    {ok, WithEncodedBodyKeys};
-from_body_parts(TABM, InlinedKey, [Part | Rest]) ->
+%% @doc Parse a single part of a multipart body into a TABM.
+from_body_part(InlinedKey, Part, Opts) ->
     % Extract the Headers block and Body. Only split on the FIRST double CRLF
-    [RawHeadersBlock, RawBody] =
+    {RawHeadersBlock, RawBody} =
         case binary:split(Part, [?DOUBLE_CRLF], []) of
             [XRawHeadersBlock] ->
-                % no body
-                [XRawHeadersBlock, <<>>];
-            [XRawHeadersBlock, XRawBody] -> [XRawHeadersBlock, XRawBody]
+                % The message has no body.
+                {XRawHeadersBlock, <<>>};
+            [XRawHeadersBlock, XRawBody] ->
+                {XRawHeadersBlock, XRawBody}
         end,
     % Extract individual headers
     RawHeaders = binary:split(RawHeadersBlock, ?CRLF, [global]),
     % Now we parse each header, splitting into {Key, Value}
     Headers =
-        maps:from_list(lists:filtermap(
+        hb_maps:from_list(lists:filtermap(
             fun(<<>>) -> false;
                (RawHeader) -> 
                     case binary:split(RawHeader, [<<": ">>]) of
@@ -167,7 +225,7 @@ from_body_parts(TABM, InlinedKey, [Part | Rest]) ->
         )),
     % The Content-Disposition is from the parent message,
     % so we separate off from the rest of the headers
-    case maps:get(<<"content-disposition">>, Headers, undefined) of
+    case hb_maps:get(<<"content-disposition">>, Headers, undefined, Opts) of
         undefined ->
             % A Content-Disposition header is required for each part
             % in the multipart body
@@ -188,157 +246,208 @@ from_body_parts(TABM, InlinedKey, [Part | Rest]) ->
                             false -> no_part_name_found
                         end
                 end,
-            RestHeaders = maps:without([<<"content-disposition">>], Headers),
+            Commitments =
+                dev_codec_httpsig_siginfo:siginfo_to_commitments(
+                    Headers#{ PartName => RawBody },
+                    [PartName],
+                    Opts
+                ),
+            RestHeaders =
+                hb_maps:without(
+                    [
+                        <<"content-disposition">>, 
+                        <<"content-type">>, 
+                        <<"ao-body-key">>, 
+                        <<"content-digest">>
+                    ],
+                    Headers,
+                    Opts
+                ),
+            PartNameSplit = binary:split(PartName, <<"/">>, [global]),
+            NestedPartName = lists:last(PartNameSplit),
             ParsedPart =
-                case maps:size(RestHeaders) of
+                case hb_maps:size(Commitments, Opts) of
                     0 ->
-                        % There are no headers besides the content disposition header
-                        % So simply use the the raw body binary as the part
-                        RawBody;
-                    _ ->
-                        case RawBody of
-                            <<>> -> RestHeaders;
-                            _ -> RestHeaders#{ <<"body">> => RawBody }
-                        end
-                end,
-            BodyKey = hd(binary:split(PartName, <<"/">>)),
-            TABMNext = TABM#{
-                PartName => ParsedPart,
-                <<"body-keys">> => maps:get(<<"body-keys">>, TABM, []) ++ [BodyKey]
-            },
-            from_body_parts(TABMNext, InlinedKey, Rest)
-    end.
-
-%% @doc Populate the `/commitments' key on the TABM with the dictionary of 
-%% signatures and their corresponding inputs.
-commitments_from_signature(Map, _HPs, not_found, _RawSigInput) ->
-    ?event({no_sigs_found_in_from, {msg, Map}}),
-    {ok, maps:without([<<"commitments">>], Map)};
-commitments_from_signature(Map, HPs, RawSig, RawSigInput) ->
-    SfSigsKV = hb_structured_fields:parse_dictionary(RawSig),
-    SfInputs = maps:from_list(hb_structured_fields:parse_dictionary(RawSigInput)),
-    ?event({adding_sigs_and_inputs, {sigs, SfSigsKV}, {inputs, SfInputs}}),
-    % Build a Map for Signatures by gathering each Signature
-    % with its corresponding Inputs.
-    % 
-    % Inputs are merged as fields on the Signature Map
-    Commitments = maps:from_list(lists:map(
-        fun ({SigName, Signature}) ->
-            ?event({adding_commitment, {sig, SigName}, {sig, Signature}, {inputs, SfInputs}}),
-            {list, SigInputs, ParamsKVList} = maps:get(SigName, SfInputs, #{}),
-            ?event({inputs, {signame, SigName}, {inputs, SigInputs}, {params, ParamsKVList}}),
-            % Find all hashpaths from the signature and add them to the 
-            % commitments message.
-            Hashpath =
-                lists:filtermap(
-                    fun ({item, BareItem, _}) ->
-                        case hb_structured_fields:from_bare_item(BareItem) of
-                            HP = <<"hashpath", _/binary>> -> {true, HP};
-                            _ -> false
+                        WithoutTypes = maps:without([<<"ao-types">>], RestHeaders),
+                        Types =
+                            hb_maps:get(
+                                <<"ao-types">>,
+                                RestHeaders,
+                                <<>>,
+                                Opts
+                            ),
+                        case {hb_maps:size(WithoutTypes, Opts), Types, RawBody} of
+                            {0, <<"empty-message">>, <<>>} ->
+                                % The message is empty, so we return an empty
+                                % map.
+                                #{};
+                            {_, _, <<>>} ->
+                                % There is no body to the message, so we return
+                                % just the headers.
+                                RestHeaders;
+                            {0, _, _} ->
+                                % There are no headers besides content-disposition,
+                                % so we return the body as is.
+                                RawBody;
+                            {_, _, _} ->
+                                % There are other headers, so we need to parse
+                                % the body as a TABM.
+                                {_, RawBodyKey} = inline_key(Headers),
+                                RestHeaders#{ RawBodyKey => RawBody }
                         end;
-                    (_) -> false
-                end,
-                SigInputs
-            ),
-            ?event({all_hashpaths, HPs}),
-            Hashpaths = maps:from_list(lists:map(
-                fun (HP) ->
-                    {HP, maps:get(HP, HPs, <<>>)}
+                    _ -> maps:get(NestedPartName, Commitments, #{})
                 end,
-                Hashpath
-            )),
-            ?event({hashpaths, Hashpaths}),
-            Params = maps:from_list(ParamsKVList),
-            {string, EncPubKey} = maps:get(<<"keyid">>, Params),
-            {string, Alg} = maps:get(<<"alg">>, Params),
-            PubKey = hb_util:decode(EncPubKey),
-            Address = hb_util:human_id(ar_wallet:to_address(PubKey)),
-            ?event({calculated_name,
-                {address, Address},
-                {sig, Signature},
-                {inputs, {explicit, SfInputs},
-                {implicit, Params}}
-            }),
-            SerializedSig = iolist_to_binary(
-                hb_structured_fields:dictionary(
-                    #{ SigName => Signature }
-                )
-            ),
-            {item, {binary, UnencodedSig}, _} = Signature,
-            {
-                hb_util:human_id(crypto:hash(sha256, UnencodedSig)),
-                Hashpaths#{
-                    <<"commitment-device">> => <<"httpsig@1.0">>,
-                    <<"committer">> => Address,
-                    <<"alg">> => Alg,
-                    <<"signature">> => SerializedSig,
-                    <<"signature-input">> =>
-                        iolist_to_binary(
-                            hb_structured_fields:dictionary(
-                                #{ SigName => maps:get(SigName, SfInputs) }
-                            )
-                        )
-                }
-            }
-        end,
-        SfSigsKV
-    )),
-    % Place the commitments as a top-level message on the parent message
-    ?event({adding_commitments, {msg, Map}, {commitments, Commitments}}),
-    Msg = Map#{ <<"commitments">> => Commitments },
-    % Reset the HMAC on the message if none is present
-    case hb_message:commitment(#{ <<"alg">> => <<"hmac-sha256">> }, Msg) of
-        X when (X == not_found) or (X == multiple_matches) ->
-            ?event({resetting_hmac, {msg, Msg}}),
-            dev_codec_httpsig:reset_hmac(Msg);
-        _ ->
-            ?event({hmac_already_present, {msg, Msg}}),
-            Msg
+            {PartName, ParsedPart}
     end.
 
 %%% @doc Convert a TABM into an HTTP Message. The HTTP Message is a simple Erlang Map
 %%% that can translated to a given web server Response API
-to(Bin) when is_binary(Bin) -> Bin;
-to(TABM) -> to(TABM, []).
-to(TABM, Opts) when is_map(TABM) ->
+to(TABM, Req, Opts) -> to(TABM, Req, [], Opts).
+to(Bin, _Req, _FormatOpts, _Opts) when is_binary(Bin) -> {ok, Bin};
+to(Link, _Req, _FormatOpts, _Opts) when ?IS_LINK(Link) -> {ok, Link};
+to(TABM, Req = #{ <<"index">> := true }, _FormatOpts, Opts) ->
+    % If the caller has specified that an `index` page is requested, we:
+    % 1. Convert the message to HTTPSig as usual.
+    % 2. Check if the `body` and `content-type` keys are set. If either are,
+    %    we return the message as normal.
+    % 3. If they are not, we convert the given message back to its original
+    %    form and resolve `path = index` upon it.
+    % 4. If this yields a result, we convert it to TABM and merge it with the
+    %    original HTTP-Sig encoded message. We prefer keys from the original
+    %    if conflicts arise.
+    % 5. The resulting combined message is returned to the user.
+    {ok, EncOriginal} = to(TABM, maps:without([<<"index">>], Req), Opts),
+    OrigBody = hb_maps:get(<<"body">>, EncOriginal, <<>>, Opts),
+    OrigContentType = hb_maps:get(<<"content-type">>, EncOriginal, <<>>, Opts),
+    case {OrigBody, OrigContentType} of
+        {<<>>, <<>>} ->
+            % The message has no body or content-type set. Resolve the `index`
+            % key upon it to derive it.
+            Structured = hb_message:convert(TABM, <<"structured@1.0">>, Opts),
+            try hb_ao:resolve(Structured, Req#{ <<"path">> => <<"index">> }, Opts) of
+                {ok, IndexMsg} ->
+                    % The index message has been calculated successfully. Convert
+                    % it to TABM format.
+                    IndexTABM = hb_message:convert(IndexMsg, tabm, Opts),
+                    % Merge the index message with the original, favoring the 
+                    % keys of the original in the event of conflict. Remove the
+                    % `priv` message, if present.
+                    Merged =
+                        hb_maps:merge(
+                            hb_private:reset(IndexTABM),
+                            hb_maps:without(
+                                [<<"body">>, <<"content-type">>],
+                                EncOriginal,
+                                Opts
+                            )
+                        ),
+                    % Return the merged result.
+                    {ok, Merged};
+                Err ->
+                    % The index resolution executed without error, but the result
+                    % was not a valid message. We log a warning for the operator
+                    % and return the original message to the caller.
+                    ?event(warning, {invalid_index_result, Err}),
+                    {ok, EncOriginal}
+            catch
+                Err:Details:Stacktrace ->
+                    % There was an error while generating the index page. We
+                    % log a warning for the operator and return the modified
+                    % message to the caller.
+                    ?event(warning,
+                        {error_generating_index,
+                            {type, Err},
+                            {details, Details},
+                            {stacktrace, Stacktrace}
+                        }
+                    ),
+                    {ok, EncOriginal}
+            end;
+        _ ->
+            % Return the encoded HTTPSig message without modification.
+            {ok, EncOriginal}
+    end;
+to(TABM, Req, FormatOpts, Opts) when is_map(TABM) ->
+    % Ensure that the material for the message is loaded, if the request is
+    % asking for a bundle.
+    Msg =
+        case hb_util:atom(hb_maps:get(<<"bundle">>, Req, false, Opts)) of
+            false -> TABM;
+            true ->
+                % Convert back to the fully loaded structured@1.0 message, then
+                % convert to TABM with bundling enabled.
+                Structured = hb_message:convert(TABM, <<"structured@1.0">>, Opts),
+                Loaded = hb_cache:ensure_all_loaded(Structured, Opts),
+                hb_message:convert(
+                    Loaded,
+                    tabm,
+                    #{
+                        <<"device">> => <<"structured@1.0">>,
+                        <<"bundle">> => true
+                    },
+                    Opts
+                )
+        end,
     % Group the IDs into a dictionary, so that they can be distributed as
     % HTTP headers. If we did not do this, ID keys would be lower-cased and
     % their comparability against the original keys would be lost.
-    WithGroupedIDs = group_ids(TABM),
     Stripped =
-        maps:without(
+        hb_maps:without(
             [
                 <<"commitments">>,
                 <<"signature">>,
                 <<"signature-input">>,
                 <<"priv">>
             ],
-            WithGroupedIDs
+            Msg,
+            Opts
         ),
-    ?event({stripped, Stripped}),
-    {InlineFieldHdrs, InlineKey} = inline_key(TABM),
-    Intermediate = do_to(Stripped, Opts ++ [{inline, InlineFieldHdrs, InlineKey}]),
-    % Finally, add the signatures to the HTTP message
-    case hb_message:commitment(#{ <<"alg">> => <<"hmac-sha256">> }, TABM) of
-        {ok, _, #{ <<"signature">> := Sig, <<"signature-input">> := SigInput }} ->
-            HPs = hashpaths_from_message(TABM),
-            EncWithHPs = maps:merge(Intermediate, HPs),
-            % Add the original signature encodings to the HTTP message
-            Res = EncWithHPs#{
-                <<"signature">> => Sig,
-                <<"signature-input">> => SigInput
-            },
-            ?event({final_encoded_msg, sigs_added, Res}),
-            Res;
-        _ ->
-            ?event({final_encoded_msg, no_sigs_added, Intermediate}),
-            Intermediate
-    end.
+    WithGroupedIDs = group_ids(Stripped),
+    ?event({grouped, WithGroupedIDs}),
+    {InlineFieldHdrs, InlineKey} = inline_key(WithGroupedIDs),
+    Intermediate =
+        do_to(
+            WithGroupedIDs,
+            FormatOpts ++ [{inline, InlineFieldHdrs, InlineKey}],
+            Opts
+        ),
+    % Finally, add the signatures to the encoded HTTP message with the
+    % commitments from the original message.
+    CommitmentsMap = case maps:get(<<"commitments">>, Msg, undefined) of
+        undefined ->
+            case maps:get(<<"signature">>, Msg, undefined) of
+                undefined -> #{};
+                Signature ->
+                    MaybeBundleTag = maps:with([<<"bundle">>], Msg),
+                    #{
+                        Signature => MaybeBundleTag#{
+                            <<"signature">> => Signature,
+                            <<"committed">> => maps:get(<<"committed">>, Msg, #{}),
+                            <<"keyid">> => maps:get(<<"keyid">>, Msg, <<>>),
+                            <<"commitment-device">> => <<"httpsig@1.0">>,
+                            <<"type">> => maps:get(<<"type">>, Msg, <<>>)
+                        }
+                    }
+            end;
+        Commitments ->
+            Commitments
+    end,
+    ?event({converting_commitments_to_siginfo, Msg}),
+    {ok,
+        maps:merge(
+            Intermediate,
+            dev_codec_httpsig_siginfo:commitments_to_siginfo(
+                TABM,
+                CommitmentsMap,
+                Opts
+            )
+        )
+    }.
 
-do_to(Binary, _Opts) when is_binary(Binary) -> Binary;
-do_to(TABM, Opts) when is_map(TABM) ->
+do_to(Binary, _FormatOpts, _Opts) when is_binary(Binary) -> Binary;
+do_to(TABM, FormatOpts, Opts) when is_map(TABM) ->
     InlineKey =
-        case lists:keyfind(inline, 1, Opts) of
+        case lists:keyfind(inline, 1, FormatOpts) of
             {inline, _InlineFieldHdrs, Key} -> Key;
             _ -> not_set
         end,
@@ -355,7 +464,7 @@ do_to(TABM, Opts) when is_map(TABM) ->
                     field_to_http(AccMap, {Key, Value}, #{})
             end,
             % Add any inline field denotations to the HTTP message
-            case lists:keyfind(inline, 1, Opts) of
+            case lists:keyfind(inline, 1, FormatOpts) of
                 {inline, InlineFieldHdrs, _InlineKey} -> InlineFieldHdrs;
                 _ -> #{}
             end,
@@ -363,7 +472,7 @@ do_to(TABM, Opts) when is_map(TABM) ->
         ),
     ?event({prepared_body_map, {msg, Enc0}}),
     BodyMap = maps:get(<<"body">>, Enc0, #{}),
-    GroupedBodyMap = group_maps(BodyMap),
+    GroupedBodyMap = group_maps(BodyMap, <<>>, #{}, Opts),
     Enc1 =
         case GroupedBodyMap of
             EmptyBody when map_size(EmptyBody) =:= 0 ->
@@ -384,13 +493,13 @@ do_to(TABM, Opts) when is_map(TABM) ->
                 % In all other cases, the mapping fallsthrough to the case below 
                 % that properly encodes a nested body within a sub-part
                 ?event({encoding_single_body, {body, UserBody}, {http, Enc0}}),
-                maps:put(<<"body">>, UserBody, Enc0);
+                hb_maps:put(<<"body">>, UserBody, Enc0, Opts);
             _ ->
                 % Otherwise, we need to encode the body map as the
                 % multipart body of the HTTP message
                 ?event({encoding_multipart, {bodymap, {explicit, GroupedBodyMap}}}),
                 PartList = hb_util:to_sorted_list(
-                    maps:map(
+                    hb_maps:map(
                         fun(Key, M = #{ <<"body">> := _ }) when map_size(M) =:= 1 ->
                             % If the map has only one key, and it is `body',
                             % then we must encode part name with the additional
@@ -400,13 +509,16 @@ do_to(TABM, Opts) when is_map(TABM) ->
                             encode_body_part(
                                 <<Key/binary, "/body">>,
                                 M,
-                                <<"body">>
+                                <<"body">>,
+                                Opts
                             );
-                           (Key, Value) ->
-                            encode_body_part(Key, Value, InlineKey)
+                        (Key, Value) ->
+                            encode_body_part(Key, Value, InlineKey, Opts)
                         end,
-                        GroupedBodyMap
-                    )
+                        GroupedBodyMap,
+                        Opts
+                    ),
+                    Opts
                 ),
                 Boundary = boundary_from_parts(PartList),
                 % Transform body into a binary, delimiting each part with the
@@ -430,25 +542,22 @@ do_to(TABM, Opts) when is_map(TABM) ->
                 FinalBody = iolist_to_binary(lists:join(?CRLF, lists:reverse(BodyList))),
                 % Ensure we append the Content-Type to be a multipart response
                 Enc0#{
-                    % TODO: Is this needed here?
-                    % We ought not be sending body-keys over the wire, so we either need
-                    % to remove this here, or at the edge
-                    <<"body-keys">> => encode_body_keys(PartList),
                     <<"content-type">> =>
                         <<"multipart/form-data; boundary=", "\"" , Boundary/binary, "\"">>,
                     <<"body">> => <<FinalBody/binary, ?CRLF/binary, "--", Boundary/binary, "--">>
                 }
         end,
-    % Add the content-digest to the HTTP message. `generate_content_digest/1'
+    % Add the content-digest to the HTTP message. `add_content_digest/1'
     % will return a map with the `content-digest' key set, but the body removed,
     % so we merge the two maps together to maintain the body and the content-digest.
-    Enc2 = case maps:get(<<"body">>, Enc1, <<>>) of
+    Enc2 = case hb_maps:get(<<"body">>, Enc1, <<>>, Opts) of
         <<>> -> Enc1;
         _ ->
             ?event({adding_content_digest, {msg, Enc1}}),
-            maps:merge(
+            hb_maps:merge(
                 Enc1,
-                dev_codec_httpsig:add_content_digest(Enc1)
+                dev_codec_httpsig:add_content_digest(Enc1, Opts),
+                Opts
             )
     end,
     ?event({final_body_map, {msg, Enc2}}),
@@ -464,7 +573,7 @@ do_to(TABM, Opts) when is_map(TABM) ->
 %% but standard RFC 8741 parsers will not. Subsequently, the resulting `ao-cased'
 %% key is not added to the `ao-types' map.
 group_ids(Map) ->
-    % Find all keys that are IDs
+    % Find all keys that are IDs.
     IDDict = maps:filter(fun(K, V) -> ?IS_ID(K) andalso is_binary(V) end, Map),
     % Convert the dictionary into a list of key-value pairs
     IDDictStruct =
@@ -485,7 +594,7 @@ group_ids(Map) ->
     end.
 
 %% @doc Decode the `ao-ids' key into a map.
-ungroup_ids(Msg = #{ <<"ao-ids">> := IDBin }) ->
+ungroup_ids(Msg = #{ <<"ao-ids">> := IDBin }, Opts) ->
     % Extract the ID binary from the Map
     EncodedIDsMap = hb_structured_fields:parse_dictionary(IDBin),
     % Convert the value back into a raw binary
@@ -495,25 +604,16 @@ ungroup_ids(Msg = #{ <<"ao-ids">> := IDBin }) ->
             EncodedIDsMap
         ),
     % Add the decoded IDs to the Map and remove the `ao-ids' key
-    maps:merge(maps:without([<<"ao-ids">>], Msg), maps:from_list(IDsMap));
-ungroup_ids(Msg) -> Msg.
+    hb_maps:merge(hb_maps:without([<<"ao-ids">>], Msg, Opts), hb_maps:from_list(IDsMap), Opts);
 
-%% @doc Encode a list of body parts into a binary.
-encode_body_keys(PartList) when is_list(PartList) ->
-    iolist_to_binary(hb_structured_fields:list(lists:map(
-        fun
-            ({PartName, _}) -> {item, {string, PartName}, []};
-            (PartName) when is_binary(PartName) -> {item, {string, PartName}, []}
-        end,
-        PartList
-    ))).
+ungroup_ids(Msg, _Opts) -> Msg.
 
 %% @doc Merge maps at the same level, if possible.
 group_maps(Map) ->
-    group_maps(Map, <<>>, #{}).
-group_maps(Map, Parent, Top) when is_map(Map) ->
+    group_maps(Map, <<>>, #{}, #{}).
+group_maps(Map, Parent, Top, Opts) when is_map(Map) ->
     ?event({group_maps, {map, Map}, {parent, Parent}, {top, Top}}),
-    {Flattened, NewTop} = maps:fold(
+    {Flattened, NewTop} = hb_maps:fold(
         fun(Key, Value, {CurMap, CurTop}) ->
             ?event({group_maps, {key, Key}, {value, Value}}),
             NormKey = hb_ao:normalize_key(Key),
@@ -523,9 +623,33 @@ group_maps(Map, Parent, Top) when is_map(Map) ->
                     _ -> <<Parent/binary, "/", NormKey/binary>>
                 end,
             case Value of
-                _ when is_map(Value) ->
-                    NewTop = group_maps(Value, FlatK, CurTop),
-                    {CurMap, NewTop};
+                _ when is_map(Value) orelse is_list(Value) ->
+                    NormMsg =
+                        if is_list(Value) ->
+                            hb_message:convert(
+                                Value,
+                                tabm,
+                                <<"structured@1.0">>,
+                                Opts
+                            );
+                        true ->
+                            Value
+                        end,
+                    case hb_maps:size(NormMsg, Opts) of
+                        0 ->
+                            {
+                                CurMap,
+                                hb_maps:put(
+                                    FlatK,
+                                    #{ <<"ao-types">> => <<"empty-message">> },
+                                    CurTop,
+                                    Opts
+                                )
+                            };
+                        _ ->
+                            NewTop = group_maps(NormMsg, FlatK, CurTop, Opts),
+                            {CurMap, NewTop}
+                    end;
                 _ ->
                     ?event({group_maps, {norm_key, NormKey}, {value, Value}}),
                     case byte_size(Value) > ?MAX_HEADER_LENGTH of
@@ -533,22 +657,23 @@ group_maps(Map, Parent, Top) when is_map(Map) ->
                         % within a part, so instead lift it to be a top level
                         % part
                         true ->
-                            NewTop = maps:put(FlatK, Value, CurTop),
+                            NewTop = hb_maps:put(FlatK, Value, CurTop, Opts),
                             {CurMap, NewTop};
                         % Encode the value in the current part
                         false ->
-                            NewCurMap = maps:put(NormKey, Value, CurMap),
+                            NewCurMap = hb_maps:put(NormKey, Value, CurMap, Opts),
                             {NewCurMap, CurTop}
                     end
             end
         end,
         {#{}, Top},
-        Map
+        Map,
+        Opts
     ),
-    case maps:size(Flattened) of
+    case hb_maps:size(Flattened, Opts) of
         0 -> NewTop;
         _ -> case Parent of
-            <<>> -> maps:merge(NewTop, Flattened);
+            <<>> -> hb_maps:merge(NewTop, Flattened, Opts);
             _ ->
                 Res = NewTop#{ Parent => Flattened },
                 ?event({returning_res, {res, Res}}),
@@ -576,28 +701,8 @@ boundary_from_parts(PartList) ->
     RawBoundary = crypto:hash(sha256, BodyBin),
     hb_util:encode(RawBoundary).
 
-%% Extract all hashpaths from the commitments of a given message
-hashpaths_from_message(Msg) ->
-    maps:fold(
-        fun (_, Comm, Acc) ->
-            maps:merge(Acc, extract_hashpaths(Comm))
-        end,
-        #{},
-        maps:get(<<"commitments">>, Msg, #{})
-    ).
-
-%% @doc Extract all keys labelled `hashpath*' from the commitments, and add them
-%% to the HTTP message as `hashpath*' keys.
-extract_hashpaths(Map) ->
-    maps:filter(
-        fun (<<"hashpath", _/binary>>, _) -> true;
-            (_, _) -> false
-        end,
-        Map
-    ).
-
 %% @doc Encode a multipart body part to a flat binary.
-encode_body_part(PartName, BodyPart, InlineKey) ->
+encode_body_part(PartName, BodyPart, InlineKey, Opts) ->
     % We'll need to prepend a Content-Disposition header
     % to the part, using the field name as the form part
     % name.
@@ -615,12 +720,14 @@ encode_body_part(PartName, BodyPart, InlineKey) ->
     % HB message field that resolves to the sub-message
     case BodyPart of
         BPMap when is_map(BPMap) ->
-            WithDisposition = maps:put(
-                <<"content-disposition">>,
-                Disposition,
-                BPMap
-            ),
-            encode_http_msg(WithDisposition);
+            WithDisposition =
+                hb_maps:put(
+                    <<"content-disposition">>,
+                    Disposition,
+                    BPMap,
+                    Opts
+                ),
+            encode_http_flat_msg(WithDisposition, Opts);
         BPBin when is_binary(BPBin) ->
             % A properly encoded inlined body part MUST have a CRLF between
             % it and the header block, so we MUST use two CRLF:
@@ -640,44 +747,58 @@ encode_body_part(PartName, BodyPart, InlineKey) ->
 %% In order to preserve the field name of the inlined
 %% part, an additional field may need to be added
 inline_key(Msg) ->
-    % The message can named a key whose value will be placed
-    % in the body as the inline part
-    % Otherwise, the Msg <<"body">> is used
-    % Otherwise, the Msg <<"data">> is used
-    InlineBodyKey = maps:get(<<"inline-body-key">>, Msg, false),
+    inline_key(Msg, #{}).
+
+inline_key(Msg, Opts) ->
+    % The message can name a key whose value will be placed in the body as the
+    % inline part. Otherwise, the Msg <<"body">> is used. If not present, the
+    % Msg <<"data">> is used.
+    InlineBodyKey = hb_maps:get(<<"ao-body-key">>, Msg, false, Opts),
     ?event({inlined, InlineBodyKey}),
-    case [
+    case {
         InlineBodyKey,
-        maps:is_key(<<"body">>, Msg),
-        maps:is_key(<<"data">>, Msg)
-    ] of
-        % inline-body-key already exists, so no need to add one
-        [Explicit, _, _] when Explicit =/= false -> {#{}, InlineBodyKey};
-        % inline-body-key defaults to <<"body">> (see below)
+        hb_maps:is_key(<<"body">>, Msg, Opts)
+            andalso not ?IS_LINK(maps:get(<<"body">>, Msg, Opts)),
+        hb_maps:is_key(<<"data">>, Msg, Opts)
+            andalso not ?IS_LINK(maps:get(<<"data">>, Msg, Opts))
+    } of
+        % ao-body-key already exists, so no need to add one
+        {Explicit, _, _} when Explicit =/= false -> {#{}, InlineBodyKey};
+        % ao-body-key defaults to <<"body">> (see below)
         % So no need to add one
-        [_, true, _] -> {#{}, <<"body">>};
-        % We need to preserve the inline-body-key, as the <<"data">> field,
+        {_, true, _} -> {#{}, <<"body">>};
+        % We need to preserve the ao-body-key, as the <<"data">> field,
         % so that it is preserved during encoding and decoding
-        [_, _, true] -> {#{<<"inline-body-key">> => <<"data">>}, <<"data">>};
+        {_, _, true} -> {#{<<"ao-body-key">> => <<"data">>}, <<"data">>};
         % default to body being the inlined part.
         % This makes this utility compatible for both encoding
         % and decoding httpsig@1.0 messages
         _ -> {#{}, <<"body">>}
     end.
 
-%% @doc Encode a HTTP message into a binary.
-encode_http_msg(Httpsig) ->
+%% @doc Encode a HTTP message into a binary, converting it to `httpsig@1.0'
+%% first.
+encode_http_msg(Msg, Opts) ->
+    % Convert the message to a HTTP-Sig encoded output.
+    Httpsig = hb_message:convert(Msg, <<"httpsig@1.0">>, Opts),
+    encode_http_flat_msg(Httpsig, Opts).
+
+%% @doc Encode a HTTP message into a binary. The input *must* be a raw map of 
+%% binary keys and values.
+encode_http_flat_msg(Httpsig, Opts) ->
     % Serialize the headers, to be included in the part of the multipart response
-    HeaderList = lists:foldl(
-        fun ({HeaderName, HeaderValue}, Acc) ->
-            ?event({encoding_http_header, {header, HeaderName}, {value, HeaderValue}}),
-            [<<HeaderName/binary, ": ", HeaderValue/binary>> | Acc]
-        end,
-        [],
-        maps:to_list(maps:without([<<"body">>], Httpsig))
-    ),
+    HeaderList =
+        lists:foldl(
+            fun ({HeaderName, RawHeaderVal}, Acc) ->
+                HVal = hb_cache:ensure_loaded(RawHeaderVal, Opts),
+                ?event({encoding_http_header, {header, HeaderName}, {value, HVal}}),
+                [<<HeaderName/binary, ": ", HVal/binary>> | Acc]
+            end,
+            [],
+            hb_maps:to_list(hb_maps:without([<<"body">>, <<"priv">>], Httpsig, Opts), Opts)
+        ),
     EncodedHeaders = iolist_to_binary(lists:join(?CRLF, lists:reverse(HeaderList))),
-    case maps:get(<<"body">>, Httpsig, <<>>) of
+    case hb_maps:get(<<"body">>, Httpsig, <<>>, Opts) of
         <<>> -> EncodedHeaders;
         % Some-Headers: some-value
         % content-type: image/png
@@ -688,9 +809,9 @@ encode_http_msg(Httpsig) ->
 
 %% @doc All maps are encoded into the body of the HTTP message
 %% to be further encoded later.
-field_to_http(Httpsig, {Name, Value}, _Opts) when is_map(Value) ->
+field_to_http(Httpsig, {Name, Value}, Opts) when is_map(Value) ->
     NormalizedName = hb_ao:normalize_key(Name),
-    OldBody = maps:get(<<"body">>, Httpsig, #{}),
+    OldBody = hb_maps:get(<<"body">>, Httpsig, #{}, Opts),
     Httpsig#{ <<"body">> => OldBody#{ NormalizedName => Value } };
 field_to_http(Httpsig, {Name, Value}, Opts) when is_binary(Value) ->
     NormalizedName = hb_ao:normalize_key(Name),
@@ -702,15 +823,16 @@ field_to_http(Httpsig, {Name, Value}, Opts) when is_binary(Value) ->
     %
     % Note that a "where" Opts may force the location of the encoded
     % value -- this is only a default location if not specified in Opts 
-    DefaultWhere = case {maps:get(where, Opts, headers), byte_size(Value)} of
-        {headers, Fits} when Fits =< ?MAX_HEADER_LENGTH -> headers;
-        _ -> body
-    end,
+    DefaultWhere =
+        case {maps:get(where, Opts, headers), byte_size(Value)} of
+            {headers, Fits} when Fits =< ?MAX_HEADER_LENGTH -> headers;
+            _ -> body
+        end,
     case maps:get(where, Opts, DefaultWhere) of
         headers ->
             Httpsig#{ NormalizedName => Value };
         body ->
-            OldBody = maps:get(<<"body">>, Httpsig, #{}),
+            OldBody = hb_maps:get(<<"body">>, Httpsig, #{}, Opts),
             Httpsig#{ <<"body">> => OldBody#{ NormalizedName => Value } }
     end.
 
@@ -798,5 +920,22 @@ group_maps_flat_compatible_test() ->
         }
     },
     Lifted = group_maps(Map),
-    ?assertEqual(dev_codec_flat:from(Lifted), Map),
+    ?assertEqual(dev_codec_flat:from(Lifted, #{}, #{}), {ok, Map}),
     ok.
+
+encode_message_with_links_test() ->
+    Msg = #{
+        <<"immediate-key">> => <<"immediate-value">>,
+        <<"typed-key">> => 4
+    },
+    {ok, Path} = hb_cache:write(Msg, #{}),
+    {ok, Read} = hb_cache:read(Path, #{}),
+    % Ensure that the message now has a lazy link
+    ?assertMatch({link, _, _}, maps:get(<<"typed-key">>, Read, #{})),
+    % Encode and decode the message as `httpsig@1.0`
+    Enc = hb_message:convert(Msg, <<"httpsig@1.0">>, #{}),
+    ?event({encoded, Enc}),
+    Dec = hb_message:convert(Enc, <<"structured@1.0">>, <<"httpsig@1.0">>, #{}),
+    % Ensure that the result is the same as the original message
+    ?event({decoded, Dec}),
+    ?assert(hb_message:match(Msg, Dec, strict, #{})).
\ No newline at end of file
diff --git a/src/dev_codec_httpsig_keyid.erl b/src/dev_codec_httpsig_keyid.erl
new file mode 100644
index 000000000..8c3d5f84b
--- /dev/null
+++ b/src/dev_codec_httpsig_keyid.erl
@@ -0,0 +1,151 @@
+%%% @doc A library for extracting and validating key material for `httpsig@1.0'
+%%% requests. Offers support for the following keyid schemes:
+%%% - `publickey': The keyid is an encoded public key with the `publickey:' prefix.
+%%% - `constant': The key is simply the keyid itself, including the `public:'
+%%%   prefix if given.
+%%% - `secret': The key is hashed and the `secret:' prefix is added to the
+%%%   result in order to generate a keyid.
+%%% 
+%%% These functions are abstracted in order to allow for the addition of new
+%%% schemes in the future.
+-module(dev_codec_httpsig_keyid).
+-export([req_to_key_material/2, keyid_to_committer/1, keyid_to_committer/2]).
+-export([secret_key_to_committer/1, remove_scheme_prefix/1]).
+-include_lib("include/hb.hrl").
+
+%%% The supported schemes for HMAC keys.
+-define(KEYID_SCHEMES, [constant, publickey, secret]).
+%%% The default schemes for each request type.
+-define(DEFAULT_SCHEMES_BY_TYPE, #{
+    <<"rsa-pss-sha512">> => publickey,
+    <<"hmac-sha256">> => constant
+}).
+%%% Default key to use for HMAC commitments.
+-define(HMAC_DEFAULT_KEY, <<"constant:ao">>).
+
+%% @doc Extract the key and keyid from a request, returning
+%% `{ok, Scheme, Key, KeyID}' or `{error, Reason}'.
+req_to_key_material(Req, Opts) ->
+    ?event({req_to_key_material, {req, Req}}),
+    KeyID = maps:get(<<"keyid">>, Req, undefined),
+    ?event({keyid_to_key_material, {keyid, KeyID}}),
+    case find_scheme(KeyID, Req, Opts) of
+        {ok, Scheme} ->
+            ?event({scheme_found, {scheme, Scheme}}),
+            ApplyRes = apply_scheme(Scheme, KeyID, Req),
+            ?event({apply_scheme_result, {apply_res, ApplyRes}}),
+            case ApplyRes of
+                {ok, _, CalcKeyID} when KeyID /= undefined, CalcKeyID /= KeyID ->
+                    {error, key_mismatch};
+                {ok, Key, CalcKeyID} ->
+                    {ok, Scheme, Key, CalcKeyID};
+                {error, Reason} ->
+                    {error, Reason}
+            end;
+        {error, undefined_scheme} ->
+            {ok, DefaultScheme} = req_to_default_scheme(Req, Opts),
+            req_to_key_material(Req#{ <<"scheme">> => DefaultScheme }, Opts);
+        {error, Reason} ->
+            {error, Reason}
+    end.
+
+%% @doc Find the scheme from a keyid or request. Returns `{ok, Scheme}' or
+%% `{error, Reason}'. If no scheme is provided in either the request message
+%% or the keyid (as a `scheme:' prefix), we default to the scheme specified in
+%% the request type. If a scheme is provided in the request, it must match the
+%% scheme in the keyid if also present.
+find_scheme(KeyID, Req = #{ <<"scheme">> := RawScheme }, Opts) ->
+    Scheme = hb_util:atom(RawScheme),
+    % Validate that the scheme in the request matches the scheme in the keyid.
+    case find_scheme(KeyID, maps:without([<<"scheme">>], Req), Opts) of
+        {ok, Scheme} -> {ok, Scheme};
+        {error, undefined_scheme} -> {ok, Scheme};
+        _OtherScheme -> {error, scheme_mismatch}
+    end;
+find_scheme(undefined, _Req, _Opts) ->
+    {error, undefined_scheme};
+find_scheme(KeyID, Req, Opts) ->
+    SchemeRes =
+        case binary:split(KeyID, <<":">>) of
+            [SchemeBin, _KeyID] -> {ok, SchemeBin};
+            [_NoSchemeKeyID] ->
+                % Determine the default scheme based on the `type' of the request.
+                req_to_default_scheme(Req, Opts)
+        end,
+    case SchemeRes of
+        {ok, Scheme} ->
+            case lists:member(SchemeAtom = hb_util:atom(Scheme), ?KEYID_SCHEMES) of
+                true -> {ok, SchemeAtom};
+                false -> {error, unknown_scheme}
+            end;
+        {error, Reason} ->
+            {error, Reason}
+    end.
+
+%% @doc Determine the default scheme based on the `type' of the request.
+req_to_default_scheme(Req, _Opts) ->
+    case maps:find(<<"type">>, Req) of
+        {ok, Type} ->
+            case maps:find(Type, ?DEFAULT_SCHEMES_BY_TYPE) of
+                {ok, Scheme} -> {ok, Scheme};
+                error -> {error, unsupported_scheme}
+            end;
+        error ->
+            {error, no_request_type}
+    end.
+
+%% @doc Apply the requested scheme to generate the key material (key and keyid).
+apply_scheme(publickey, KeyID, _Req) ->
+    % Remove the `publickey:' prefix from the keyid and return the key.
+    PubKey = base64:decode(remove_scheme_prefix(KeyID)),
+    {ok, PubKey, << "publickey:", (base64:encode(PubKey))/binary >>};
+apply_scheme(constant, RawKeyID, _Req) ->
+    % In the `constant' scheme, the key is simply the key itself, including the
+    % `constant:' prefix if given.
+    KeyID =
+        if RawKeyID == undefined -> ?HMAC_DEFAULT_KEY;
+        true -> RawKeyID
+        end,
+    {ok, KeyID, KeyID};
+apply_scheme(secret, _KeyID, Req) ->
+    % In the `secret' scheme, the key is hashed to generate a keyid.
+    Secret = maps:get(<<"secret">>, Req, undefined),
+    Committer = secret_key_to_committer(Secret),
+    {ok, Secret, << "secret:", Committer/binary >>};
+apply_scheme(_Scheme, _Key, _KeyID) ->
+    {error, unsupported_scheme}.
+
+%% @doc Given a keyid and a scheme, generate the committer value for a commitment.
+%% Returns `BinaryAddress' or `undefined' if the keyid implies no committer.
+keyid_to_committer(KeyID) ->
+    case find_scheme(KeyID, #{}, #{}) of
+        {ok, Scheme} -> keyid_to_committer(Scheme, KeyID);
+        {error, _} -> undefined
+    end.
+keyid_to_committer(publickey, KeyID) ->
+    % Note: There is a subtlety here. The `KeyID' is decoded with the 
+    % `hb_util:decode' function rather than `base64:decode'. The reason for this
+    % is that certain codecs (e.g. `ans104@1.0') encode the public key with
+    % `base64url' encoding, rather than the standard `base64' encoding in 
+    % HTTPSig. Our `hb_util:decode' function handles both cases returning the
+    % same raw bytes, and is subsequently safe.
+    hb_util:human_id(
+        ar_wallet:to_address(
+            hb_util:decode(remove_scheme_prefix(KeyID))
+        )
+    );
+keyid_to_committer(secret, KeyID) ->
+    remove_scheme_prefix(KeyID);
+keyid_to_committer(constant, _KeyID) ->
+    undefined.
+
+%% @doc Given a secret key, generate the committer value for a commitment.
+secret_key_to_committer(Key) ->
+    hb_util:human_id(hb_crypto:sha256(Key)).
+
+%% @doc Remove the `scheme:' prefix from a keyid.
+remove_scheme_prefix(KeyID) ->
+    case binary:split(KeyID, <<":">>) of
+        [_Scheme, Key] -> Key;
+        [Key] -> Key
+    end.
diff --git a/src/dev_codec_httpsig_proxy.erl b/src/dev_codec_httpsig_proxy.erl
new file mode 100644
index 000000000..501f52def
--- /dev/null
+++ b/src/dev_codec_httpsig_proxy.erl
@@ -0,0 +1,80 @@
+%%% @doc A utility module that contains proxy functions for calling the
+%%% `~httpsig@1.0' codec's HMAC commitment functions with secret keys.
+%%% 
+%%% These tools are helpful for implementing a standardized pattern:
+%%% 1. A device verifies a user's request/derives a secret key for them.
+%%% 2. The device then wants to commit a message with the user's secret key
+%%%    using the `secret:[h(secret)]' commitment scheme.
+%%% 3. The commitment must then be modified to reference a different device
+%%%    as the `commitment-device' key.
+%%% 4. When `/verify' is called, the `~httpsig@1.0' codec is used under-the-hood
+%%%    to validate the commitment on the re-derived secret key.
+%%% 
+%%% This module is currently used by the `~cookie@1.0' and `~http-auth@1.0'
+%%% devices.
+-module(dev_codec_httpsig_proxy).
+-export([commit/5, verify/4]).
+-include("include/hb.hrl").
+-include_lib("eunit/include/eunit.hrl").
+
+%% @doc Commit to a given `Base' message with a given `Secret', setting the 
+%% `commitment-device' key to `Device' afterwards.
+commit(Device, Secret, Base, Req, Opts) ->
+    % If there are no existing commitments, we use the unmodified base message.
+    % If there are, we remove the uncommitted parts of the message.
+    ExistingComms = hb_maps:get(<<"commitments">>, Base, #{}, Opts),
+    OnlyCommittedBase =
+        case map_size(ExistingComms) of
+            0 -> Base;
+            _ ->
+                hb_message:uncommitted(
+                    hb_message:with_only_committed(Base, Opts),
+                    Opts
+                )
+        end,
+    % Commit the message with the given key.
+    CommittedMsg =
+        hb_message:commit(
+            OnlyCommittedBase,
+            Opts,
+            Req#{
+                <<"commitment-device">> => <<"httpsig@1.0">>,
+                <<"type">> => <<"hmac-sha256">>,
+                <<"scheme">> => <<"secret">>,
+                <<"secret">> => Secret
+            }
+        ),
+    {ok, CommitmentID, Commitment} =
+        hb_message:commitment(
+            #{
+                <<"commitment-device">> => <<"httpsig@1.0">>,
+                <<"type">> => <<"hmac-sha256">>
+            },
+            CommittedMsg,
+            Opts
+        ),
+    % Modify the commitment device to the given device.
+    ModCommittedMsg =
+        CommittedMsg#{
+            <<"commitments">> =>
+                ExistingComms#{
+                    CommitmentID =>
+                        Commitment#{
+                            <<"commitment-device">> => Device
+                        }
+                }
+        },
+    ?event({cookie_commitment, {id, CommitmentID}, {commitment, ModCommittedMsg}}),
+    {ok, ModCommittedMsg}.
+
+%% @doc Verify a given `Base' message with a given `Secret' using the `~httpsig@1.0'
+%% HMAC commitment scheme.
+verify(Secret, Base, RawReq, Opts) ->
+    ProxyRequest =
+        RawReq#{
+            <<"commitment-device">> => <<"httpsig@1.0">>,
+            <<"path">> => <<"verify">>,
+            <<"secret">> => Secret
+        },
+    ?event({proxy_request, ProxyRequest}),
+    {ok, hb_message:verify(Base, ProxyRequest, Opts)}.
\ No newline at end of file
diff --git a/src/dev_codec_httpsig_siginfo.erl b/src/dev_codec_httpsig_siginfo.erl
new file mode 100644
index 000000000..0851a9ab4
--- /dev/null
+++ b/src/dev_codec_httpsig_siginfo.erl
@@ -0,0 +1,545 @@
+%% @doc A module for converting between commitments and their encoded `signature'
+%% and `signature-input' keys.
+-module(dev_codec_httpsig_siginfo).
+-export([commitments_to_siginfo/3, siginfo_to_commitments/3]).
+-export([committed_keys_to_siginfo/1, to_siginfo_keys/3, from_siginfo_keys/3]).
+-export([add_derived_specifiers/1, remove_derived_specifiers/1]).
+-export([commitment_to_sig_name/1]).
+-include("include/hb.hrl").
+-include_lib("eunit/include/eunit.hrl").
+
+%%% A list of components that are `derived' in the context of RFC-9421 from the
+%%% request message.
+-define(DERIVED_COMPONENTS, [
+    <<"method">>,
+    <<"target-uri">>,
+    <<"authority">>,
+    <<"scheme">>,
+    <<"request-target">>,
+    <<"path">>,
+    <<"query">>,
+    <<"query-param">>
+    % <<"status">> % Some libraries does not support it
+]).
+
+%% @doc Generate a `signature' and `signature-input' key pair from a commitment
+%% map.
+commitments_to_siginfo(_Msg, Comms, _Opts) when ?IS_EMPTY_MESSAGE(Comms) ->
+    #{};
+commitments_to_siginfo(Msg, Comms, Opts) ->
+    % Generate a SF item for each commitment's signature and signature-input.
+    {Sigs, SigInputs} =
+        maps:fold(
+            fun(_CommID, Commitment, {Sigs, SigInputs}) ->
+                {ok, SigNameRaw, SFSig, SFSigInput} =
+                    commitment_to_sf_siginfo(Msg, Commitment, Opts),
+                SigName = <<"comm-", SigNameRaw/binary>>,
+                {
+                    Sigs#{ SigName => SFSig },
+                    SigInputs#{ SigName => SFSigInput }
+                }
+            end,
+            {#{}, #{}},
+            Comms
+        ),
+    #{
+        <<"signature">> =>
+            hb_util:bin(hb_structured_fields:dictionary(Sigs)),
+        <<"signature-input">> =>
+            hb_util:bin(hb_structured_fields:dictionary(SigInputs))
+    }.
+
+%% @doc Generate a `signature' and `signature-input' key pair from a given
+%% commitment.
+commitment_to_sf_siginfo(Msg, Commitment, Opts) ->
+    % Generate the `alg' key from the commitment.
+    Alg = commitment_to_alg(Commitment, Opts),
+    % Find the public key from the commitment, which we will use as the
+    % `keyid' in the `signature-input' keys.
+    KeyID = maps:get(<<"keyid">>, Commitment, <<>>),
+    % Extract the signature from the commitment.
+    Signature = hb_util:decode(maps:get(<<"signature">>, Commitment)),
+    % Extract the keys present in the commitment.
+    CommittedKeys = to_siginfo_keys(Msg, Commitment, Opts),
+    ?event({normalized_for_enc, CommittedKeys, {commitment, Commitment}}),
+    % Extract the hashpath, used as a tag, from the commitment.
+    Tag = maps:get(<<"tag">>, Commitment, undefined),
+    % Extract other permissible values, if present.
+    Nonce = maps:get(<<"nonce">>, Commitment, undefined),
+    Created = maps:get(<<"created">>, Commitment, undefined),
+    Expires = maps:get(<<"expires">>, Commitment, undefined),
+    % Generate the name of the signature.
+    SigName = hb_util:to_lower(hb_util:human_id(crypto:hash(sha256, Signature))),
+    % Generate the signature input and signature structured-fields. These can 
+    % then be placed into a dictionary with other commitments and transformed
+    % into their binary representations.
+    SFSig = {item, {binary, Signature}, []},
+    AdditionalParams = get_additional_params(Commitment),
+    Params = 
+        lists:filter(
+            fun({_Key, undefined}) ->
+                false;
+               ({_Key, {_, Val}}) ->
+                Val =/= undefined
+            end,
+            [
+                {<<"alg">>, {string, Alg}},
+                {<<"keyid">>, {string, KeyID}},
+                {<<"tag">>, {string, Tag}},
+                {<<"created">>, Created},
+                {<<"expires">>, Expires},
+                {<<"nonce">>, {string, Nonce}}
+            ] ++ AdditionalParams
+        ),
+    SFSigInput =
+        {list,
+            [
+                {item, {string, Key}, []}
+            ||
+                Key <- CommittedKeys
+            ],
+            Params
+        },
+    ?event(
+        {sig_input,
+            {string,
+                hb_util:bin(
+                    hb_structured_fields:dictionary(
+                        #{ <<"comm">> => SFSigInput }
+                    )
+                )
+            }
+        }
+    ),
+    {ok, SigName, SFSig, SFSigInput}.
+
+get_additional_params(Commitment) ->
+    AdditionalParams =
+        sets:to_list(
+            sets:subtract(
+                sets:from_list(maps:keys(Commitment)), 
+                sets:from_list(
+                    [
+                        <<"alg">>,
+                        <<"keyid">>,
+                        <<"tag">>,
+                        <<"created">>,
+                        <<"expires">>,
+                        <<"nonce">>,
+                        <<"committed">>,
+                        <<"signature">>,
+                        <<"type">>,
+                        <<"commitment-device">>,
+                        <<"committer">>
+                    ]
+                )
+            )
+        ),
+    lists:map(fun(Param) ->
+        ParamValue = maps:get(Param, Commitment),
+        case ParamValue of
+            Val when is_atom(Val) ->
+                {Param, {string, atom_to_binary(Val, utf8)}};
+            Val when is_binary(Val) ->
+                {Param, {string, Val}};
+            Val when is_list(Val) ->
+                {Param, {string, list_to_binary(lists:join(<<", ">>, Val))}};
+            Val when is_map(Val) ->
+                Map = nested_map_to_string(Val),
+                {Param, {string, list_to_binary(lists:join(<<", ">>, Map))} }
+        end
+    end, AdditionalParams).
+
+nested_map_to_string(Map) ->
+    lists:map(fun(I) ->
+        case maps:get(I, Map) of
+            Val when is_map(Val) ->
+                Name = maps:get(<<"name">>, Val),
+                Value = hb_util:encode(maps:get(<<"value">>, Val)),
+                <<I/binary, ":", Name/binary, ":", Value/binary>>;
+            Val ->
+                Val
+        end
+    end, maps:keys(Map)).
+
+%% @doc Take a message with a `signature' and `signature-input' key pair and
+%% return a map of commitments.
+siginfo_to_commitments(
+        Msg =
+            #{
+                <<"signature">> := <<"comm-", SFSigBin/binary>>,
+                <<"signature-input">> := <<"comm-", SFSigInputBin/binary>>
+            },
+        BodyKeys,
+        Opts) ->
+    % Parse the signature and signature-input structured-fields.
+    SFSigs = hb_structured_fields:parse_dictionary(SFSigBin),
+    SFSigsInputs = hb_structured_fields:parse_dictionary(SFSigInputBin),
+    % Group parsed signature inputs and signatures into tuple pairs by their
+    % name.
+    CommitmentSFs =
+        [
+            {SFSig, element(2, lists:keyfind(SFSigName, 1, SFSigsInputs))}
+        ||
+            {SFSigName, SFSig} <- SFSigs
+        ],
+    % Convert each tuple into a commitment and its ID.
+    CommitmentMessages =
+        lists:map(
+            fun ({SFSig, SFSigInput}) ->
+                {ok, ID, Commitment} =
+                    sf_siginfo_to_commitment(
+                        Msg,
+                        BodyKeys,
+                        SFSig,
+                        SFSigInput,
+                        Opts
+                    ),
+                {ID, Commitment}
+            end,
+            CommitmentSFs
+        ),
+    % Convert the list of commitments into a map.
+    maps:from_list(CommitmentMessages);
+siginfo_to_commitments(_Msg, _BodyKeys, _Opts) ->
+    % If the message does not contain a `signature' or `signature-input' key,
+    % we return an empty map.
+    #{}.
+
+%% @doc Take a signature and signature-input as parsed structured-fields and 
+%% return a commitment.
+sf_siginfo_to_commitment(Msg, BodyKeys, SFSig, SFSigInput, Opts) ->
+    % Extract the signature and signature-input from the structured-fields.
+    {item, {binary, Sig}, []} = SFSig,
+    {list, SigInput, ParamsKV} = SFSigInput,
+    % Generate a commitment message from the signature-input parameters.
+    Commitment1 =
+        maps:from_list(
+            lists:map(
+                fun ({Key, {binary, Bin}}) -> {Key, hb_util:encode(Bin)};
+                    ({Key, BareItem}) ->
+                    Item =
+                        case hb_structured_fields:from_bare_item(BareItem) of
+                            Res when is_binary(Res) ->
+                                decoding_nested_map_binary(Res);
+                            Res ->
+                                Res
+                        end,
+                    {Key, Item}
+                end,
+                ParamsKV
+            )
+        ),
+    % Generate the `commitment-device' key and optionally, its `type' key from
+    % the `alg' key.
+    CommitmentDeviceKeys = commitment_to_device_specifiers(Commitment1, Opts),
+    % Merge the commitment parameters with the commitment device, removing the
+    % `alg' key.
+    Commitment2 =
+        maps:merge(
+            CommitmentDeviceKeys,
+            maps:remove(<<"alg">>, Commitment1)
+        ),
+    % Generate the committed keys by parsing the signature-input list.
+    RawCommittedKeys =
+        [
+            Key
+        ||
+            {item, {string, Key}, []} <- SigInput
+        ],
+    CommittedKeys = from_siginfo_keys(Msg, BodyKeys, RawCommittedKeys),
+    % Merge and cleanup the output.
+    % 1. Decode the `keyid` (typically a public key) to its raw byte form.
+    % 2. Decode the `signature` to its raw byte form.
+    % 3. Filter undefined keys.
+    % 4. Generate the ID for the commitment from the signature. We use a SHA2-256
+    %    hash of the signature, unless the signature is 32 bytes, in which case we
+    %    use the signature directly as the ID.
+    % 5. If the `keyid' is a public key (determined by length >= 32 bytes), set
+    %    the `committer' to its hash.
+    Commitment3 =
+        Commitment2#{
+            <<"signature">> => hb_util:encode(Sig),
+            <<"committed">> => CommittedKeys
+        },
+    KeyID = maps:get(<<"keyid">>, Commitment3, <<>>),
+    Commitment5 =
+        case dev_codec_httpsig_keyid:keyid_to_committer(KeyID) of
+            undefined ->
+                Commitment3;
+            Committer ->
+                Commitment3#{
+                    <<"committer">> => Committer
+                }
+        end,
+    ID =
+        if byte_size(Sig) == 32 -> hb_util:human_id(Sig);
+        true -> hb_util:human_id(crypto:hash(sha256, Sig))
+        end,
+    % Return the commitment and calculated ID.
+    {ok, ID, Commitment5}.
+
+decoding_nested_map_binary(Bin) ->
+    MapBinary =
+        lists:foldl(
+            fun (X, Acc) ->
+                case binary:split(X, <<":">>, [global]) of
+                    [ID, Key, Value] ->
+                        Acc#{
+                            ID => #{ 
+                                <<"name">> => Key,
+                                <<"value">> => hb_util:decode(Value)
+                            }
+                        };
+                    _ ->
+                        X
+                end
+            end,
+            #{},
+            binary:split(Bin, <<", ">>, [global])
+        ),
+    case MapBinary of
+        Res when is_map(Res) ->
+            Res;
+        Res ->
+            Res
+    end.
+
+%% @doc Normalize a list of AO-Core keys to their equivalents in `httpsig@1.0'
+%% format. This involves:
+%% - If the HTTPSig message given has an `ao-body-key' key and the committed keys
+%%   list contains it, we replace it in the list with the `body' key and add the
+%%   `ao-body-key' key.
+%% - If the list contains a `body' key, we replace it with the `content-digest'
+%%   key.
+%% - Otherwise, we return the list unchanged.
+to_siginfo_keys(Msg, Commitment, Opts) ->
+    {ok, _EncMsg, EncComm, _} =
+        dev_codec_httpsig:normalize_for_encoding(Msg, Commitment, Opts),
+    maps:get(<<"committed">>, EncComm).
+
+%% @doc Normalize a list of `httpsig@1.0' keys to their equivalents in AO-Core
+%% format. There are three stages:
+%% 1. Remove the @ prefix from the component identifiers, if present.
+%% 2. Replace `content-digest' with the body keys, if present.
+%% 3. Replace the `body' key again with the value of the `ao-body-key' key, if
+%%    present. This is possible because the keys derived from the body often
+%%    contain the `body' key itself.
+%% 4. If the `content-type' starts with `multipart/', we remove it.
+from_siginfo_keys(HTTPEncMsg, BodyKeys, SigInfoCommitted) ->
+    % 1. Remove specifiers from the list.
+    BaseCommitted = remove_derived_specifiers(SigInfoCommitted),
+    % 2. Replace the `content-digest' key with the `body' key, if present.
+    WithBody =
+        hb_util:list_replace(BaseCommitted, <<"content-digest">>, BodyKeys),
+    % 3. Replace the `body' key again with the value of the `ao-body-key' key,
+    %    if present.
+    ?event(
+        {from_siginfo_keys,
+            {body_keys, BodyKeys},
+            {raw_committed, SigInfoCommitted},
+            {with_body, {explicit, WithBody}}
+        }
+    ),
+    ListWithoutBodyKey =
+        case lists:member(<<"ao-body-key">>, WithBody) of
+            true ->
+                WithOrigBodyKey =
+                    hb_util:list_replace(
+                        WithBody,
+                        <<"body">>,
+                        maps:get(<<"ao-body-key">>, HTTPEncMsg)
+                    ),
+                ?event(
+                    {with_orig_body_key, WithOrigBodyKey}
+                ),
+                WithOrigBodyKey -- [<<"ao-body-key">>];
+            false ->
+                WithBody
+        end,
+    % 4. If the `content-type' starts with `multipart/', we remove it.
+    ListWithoutContentType =
+        case maps:get(<<"content-type">>, HTTPEncMsg, undefined) of
+            <<"multipart/", _/binary>> ->
+                hb_util:list_replace(ListWithoutBodyKey, <<"content-type">>, []);
+            _ ->
+                ListWithoutBodyKey
+        end,
+    Final =
+        hb_ao:normalize_keys(
+            lists:map(
+                fun hb_link:remove_link_specifier/1,
+                ListWithoutContentType
+            )
+        ),
+    ?event({from_siginfo_keys, {list, Final}}),
+    Final.
+
+%% @doc Convert committed keys to their siginfo format. This involves removing
+%% the `body' key from the committed keys, if present, and replacing it with
+%% the `content-digest' key.
+committed_keys_to_siginfo(Msg) when is_map(Msg) ->
+    committed_keys_to_siginfo(hb_util:message_to_ordered_list(Msg));
+committed_keys_to_siginfo([]) -> [];
+committed_keys_to_siginfo([<<"body">> | Rest]) ->
+    [<<"content-digest">> | Rest];
+committed_keys_to_siginfo([Key | Rest]) ->
+    [Key | committed_keys_to_siginfo(Rest)].
+
+%% @doc Convert an `alg` to a commitment device. If the `alg' has the form of
+%% a device specifier (`x@y.z...[/type]'), return the device. Otherwise, we 
+%% assume that the `alg' is a `type' of the `httpsig@1.0' algorithm.
+%% `type' is an optional key that allows for subtyping of the algorithm. When 
+%% provided, in the `alg' it is parsed and returned as the `type' key in the
+%% commitment message.
+commitment_to_device_specifiers(Commitment, Opts) when is_map(Commitment) ->
+    commitment_to_device_specifiers(maps:get(<<"alg">>, Commitment), Opts);
+commitment_to_device_specifiers(Alg, _Opts) ->
+    case binary:split(Alg, <<"@">>) of
+        [Type] ->
+            % The `alg' is not a device specifier, so we assume that it is a
+            % type of the `httpsig@1.0' algorithm.
+            #{
+                <<"commitment-device">> => <<"httpsig@1.0">>,
+                <<"type">> => Type
+            };
+        [DevName, Specifiers] ->
+            % The `alg' is a device specifier. We determine if a type is present
+            % by splitting on the `/` character.
+            case binary:split(Specifiers, <<"/">>) of
+                [_Version] ->
+                    % The `alg' is a device specifier without a type.
+                    #{
+                        <<"commitment-device">> => Alg
+                    };
+                [Version, Type] ->
+                    % The `alg' is a device specifier with a type.
+                    #{
+                        <<"commitment-device">> =>
+                            <<DevName/binary, "@", Version/binary>>,
+                        <<"type">> => Type
+                    }
+            end
+    end.
+
+%% @doc Calculate an `alg' string from a commitment message, using its 
+%% `commitment-device' and optionally, its `type' key.
+commitment_to_alg(#{ <<"commitment-device">> := <<"httpsig@1.0">>, <<"type">> := Type }, _Opts) ->
+    Type;
+commitment_to_alg(Commitment, _Opts) ->
+    Type =
+        case maps:get(<<"type">>, Commitment, undefined) of
+            undefined -> <<>>;
+            TypeSpecifier -> <<"/", TypeSpecifier/binary>>
+        end,
+    CommitmentDevice = maps:get(<<"commitment-device">>, Commitment),
+    <<CommitmentDevice/binary, Type/binary>>.
+
+%% @doc Generate a signature name from a commitment. The commitment message is
+%% not expected to be complete: Only the `commitment-device`, and the
+%% `committer' or `keyid' keys are required.
+commitment_to_sig_name(Commitment) ->
+    BaseStr =
+        case maps:get(<<"committer">>, Commitment, undefined) of
+            undefined -> maps:get(<<"keyid">>, Commitment);
+            Committer ->
+                <<
+                    (hb_util:to_hex(binary:part(hb_util:native_id(Committer), 1, 8)))
+                        /binary
+                >>
+        end,
+    DeviceStr =
+        binary:replace(
+            maps:get(
+                <<"commitment-device">>,
+                Commitment
+            ),
+            <<"@">>,
+            <<"-">>
+        ),
+    <<DeviceStr/binary, ".", BaseStr/binary>>.
+
+%% @doc Normalize key parameters to ensure their names are correct for inclusion
+%% in the `signature-input' and associated keys.
+add_derived_specifiers(ComponentIdentifiers) ->
+    % Remove the @ prefix from the component identifiers, if present.
+    Stripped =
+        lists:map(
+            fun(<<"@", Key/binary>>) -> Key; (Key) -> Key end,
+            ComponentIdentifiers
+        ),
+    % Add the @ prefix to the component identifiers, if they are derived.
+    lists:flatten(
+        lists:map(
+            fun(Key) ->
+                case lists:member(Key, ?DERIVED_COMPONENTS) of
+                    true -> << "@", Key/binary >>;
+                    false -> Key
+                end
+            end,
+            Stripped
+        )
+    ).
+
+%% @doc Remove derived specifiers from a list of component identifiers.
+remove_derived_specifiers(ComponentIdentifiers) ->
+    lists:map(
+        fun(<<"@", Key/binary>>) ->
+            Key;
+        (Key) ->
+            Key
+        end,
+        ComponentIdentifiers
+    ).
+
+%%% Tests.
+
+parse_alg_test() ->
+    ?assertEqual(
+        commitment_to_device_specifiers(#{ <<"alg">> => <<"rsa-pss-sha512">> }, #{}),
+        #{
+            <<"commitment-device">> => <<"httpsig@1.0">>,
+            <<"type">> => <<"rsa-pss-sha512">>
+        }
+    ),
+    ?assertEqual(
+        commitment_to_device_specifiers(
+            #{ <<"alg">> => <<"ans104@1.0/rsa-pss-sha256">> },
+            #{}),
+        #{
+            <<"commitment-device">> => <<"ans104@1.0">>,
+            <<"type">> => <<"rsa-pss-sha256">>
+        }
+    ).
+
+%% @doc Test that tag values with special characters are correctly encoded and
+%% decoded.
+escaped_value_test() ->
+    KeyID = crypto:strong_rand_bytes(32),
+    Committer = hb_util:human_id(ar_wallet:to_address(KeyID)),
+    Signature = crypto:strong_rand_bytes(512),
+    ID = hb_util:human_id(crypto:hash(sha256, Signature)),
+    Commitment = #{
+        <<"committed">> => #{},
+        <<"committer">> => Committer,
+        <<"commitment-device">> => <<"tx@1.0">>,
+        <<"keyid">> => <<"publickey:", (hb_util:encode(KeyID))/binary>>,
+        <<"original-tags">> => #{
+            <<"1">> => #{
+                <<"name">> => <<"Key">>,
+                <<"value">> => <<"value">>
+            },
+            <<"2">> => #{
+                <<"name">> => <<"Quotes">>,
+                <<"value">> => <<"{\"function\":\"mint\"}">>
+            }
+        },
+        <<"signature">> => hb_util:encode(Signature),
+        <<"type">> => <<"rsa-pss-sha256">>
+    },
+
+    SigInfo = commitments_to_siginfo(#{}, #{ ID => Commitment }, #{}),
+    Commitments = siginfo_to_commitments(SigInfo, #{}, #{}),
+    ?event(debug_test, {siginfo, {explicit, SigInfo}}),
+    ?event(debug_test, {commitments, {explicit, Commitments}}),
+    ?assertEqual(#{ ID => Commitment }, Commitments).
diff --git a/src/dev_codec_json.erl b/src/dev_codec_json.erl
index 7566c399f..7dd29ebd1 100644
--- a/src/dev_codec_json.erl
+++ b/src/dev_codec_json.erl
@@ -2,26 +2,71 @@
 %%% message as TABM and returns an encoded JSON string representation.
 %%% This codec utilizes the httpsig@1.0 codec for signing and verifying.
 -module(dev_codec_json).
--export([to/1, from/1, commit/3, verify/3, committed/1, content_type/1]).
+-export([to/3, from/3, commit/3, verify/3, committed/3, content_type/1]).
 -export([deserialize/3, serialize/3]).
+-include_lib("eunit/include/eunit.hrl").
+-include("include/hb.hrl").
 
 %% @doc Return the content type for the codec.
 content_type(_) -> {ok, <<"application/json">>}.
 
-%% @doc Encode a message to a JSON string.
-to(Msg) when is_binary(Msg) -> iolist_to_binary(json:encode(Msg));
-to(Msg) -> iolist_to_binary(json:encode(hb_private:reset(Msg))).
+%% @doc Encode a message to a JSON string, using JSON-native typing.
+to(Msg, _Req, _Opts) when is_binary(Msg) ->
+    {ok, hb_util:bin(json:encode(Msg))};
+to(Msg, Req, Opts) ->
+    % The input to this function will be a TABM message, so we:
+    % 1. Convert it to a structured message.
+    % 2. Load any linked items if we are in `bundle' mode.
+    % 3. Convert it back to a TABM message, this time preserving all types
+    %    aside `atom's -- for which JSON has no native support.
+    Restructured =
+        hb_message:convert(
+            hb_private:reset(Msg),
+            <<"structured@1.0">>,
+            tabm,
+            Opts
+        ),
+    Loaded =
+        case hb_maps:get(<<"bundle">>, Req, false, Opts) of
+            true ->
+                hb_cache:ensure_all_loaded(Restructured, Opts);
+            false ->
+                Restructured
+        end,
+    {ok, JSONStructured} =
+        dev_codec_structured:from(
+            Loaded,
+            Req#{ <<"encode-types">> => [<<"atom">>] },
+            Opts
+        ),
+    {ok, hb_json:encode(JSONStructured)}.
 
 %% @doc Decode a JSON string to a message.
-from(Map) when is_map(Map) -> Map;
-from(Json) -> json:decode(Json).
+from(Map, _Req, _Opts) when is_map(Map) -> {ok, Map};
+from(JSON, _Req, Opts) ->
+    % The JSON string will be a partially-TABM encoded message: Rich number
+    % and list types, but no `atom's. Subsequently, we convert it to a fully
+    % structured message after decoding, then turn the result back into a TABM.
+    % This is resource-intensive and could be improved, but ensures that the
+    % results are fully normalized.
+    Decoded = json:decode(JSON),
+    {ok, Structured} =
+        dev_codec_structured:to(
+            Decoded,
+            #{},
+            Opts
+        ),
+    {ok, TABM} = dev_codec_structured:from(Structured, #{}, Opts),
+    {ok, TABM}.
 
 commit(Msg, Req, Opts) -> dev_codec_httpsig:commit(Msg, Req, Opts).
 
 verify(Msg, Req, Opts) -> dev_codec_httpsig:verify(Msg, Req, Opts).
 
-committed(Msg) when is_binary(Msg) -> committed(from(Msg));
-committed(Msg) -> hb_message:committed(Msg).
+committed(Msg, Req, Opts) when is_binary(Msg) ->
+    committed(hb_util:ok(from(Msg, Req, Opts)), Req, Opts);
+committed(Msg, _Req, Opts) ->
+    hb_message:committed(Msg, all, Opts).
 
 %% @doc Deserialize the JSON string found at the given path.
 deserialize(Base, Req, Opts) ->
@@ -47,15 +92,33 @@ deserialize(Base, Req, Opts) ->
                 >>
             }};
         _ ->
-            Decoded = from(Payload),
-            {ok, Decoded}
+            from(Payload, Req, Opts)
     end.
 
 %% @doc Serialize a message to a JSON string.
-serialize(Base, _Msg, _Opts) ->
+serialize(Base, Msg, Opts) ->
     {ok,
         #{
             <<"content-type">> => <<"application/json">>,
-            <<"body">> => to(Base)
+            <<"body">> => hb_util:ok(to(Base, Msg, Opts))
         }
     }.
+
+%%% Tests
+
+decode_with_atom_test() ->
+    JSON =
+        <<"""
+        [
+            {
+                "store-module": "hb_store_fs",
+                "name": "cache-TEST/json-test-store",
+                "ao-types": "store-module=\"atom\""
+            }
+        ]
+        """>>,
+    Msg = hb_message:convert(JSON, <<"structured@1.0">>, <<"json@1.0">>, #{}),
+    ?assertMatch(
+        [#{ <<"store-module">> := hb_store_fs }|_],
+        hb_cache:ensure_all_loaded(Msg, #{})
+    ).
\ No newline at end of file
diff --git a/src/dev_codec_structured.erl b/src/dev_codec_structured.erl
index d60a057c2..6a7ed84aa 100644
--- a/src/dev_codec_structured.erl
+++ b/src/dev_codec_structured.erl
@@ -1,5 +1,13 @@
 %%% @doc A device implementing the codec interface (to/1, from/1) for 
-%%% HyperBEAM's internal, richly typed message format.
+%%% HyperBEAM's internal, richly typed message format. Supported rich types are:
+%%% - `integer'
+%%% - `float'
+%%% - `atom'
+%%% - `list'
+%%% 
+%%% Encoding to TABM can be limited to a subset of types (with other types
+%%% passing through in their rich representation) by specifying the types 
+%%% that should be encoded with the `encode-types' request key.
 %%% 
 %%% This format mirrors HTTP Structured Fields, aside from its limitations of 
 %%% compound type depths, as well as limited floating point representations.
@@ -9,50 +17,78 @@
 %%% 
 %%% For more details, see the HTTP Structured Fields (RFC-9651) specification.
 -module(dev_codec_structured).
--export([to/1, from/1, commit/3, committed/3, verify/3]).
--export([decode_value/2, encode_value/1, implicit_keys/1]).
+-export([to/3, from/3, commit/3, verify/3]).
+-export([encode_ao_types/2, decode_ao_types/2, is_list_from_ao_types/2]).
+-export([decode_value/2, encode_value/1, implicit_keys/2]).
 -include("include/hb.hrl").
 -include_lib("eunit/include/eunit.hrl").
 
+-define(SUPPORTED_TYPES, [<<"integer">>, <<"float">>, <<"atom">>, <<"list">>]).
+
 %%% Route signature functions to the `dev_codec_httpsig' module
 commit(Msg, Req, Opts) -> dev_codec_httpsig:commit(Msg, Req, Opts).
 verify(Msg, Req, Opts) -> dev_codec_httpsig:verify(Msg, Req, Opts).
-committed(Msg, Req, Opts) -> dev_codec_httpsig:committed(Msg, Req, Opts).
 
 %% @doc Convert a rich message into a 'Type-Annotated-Binary-Message' (TABM).
-from(Bin) when is_binary(Bin) -> Bin;
-from(Msg) when is_map(Msg) ->
-    NormKeysMap = hb_ao:normalize_keys(Msg),
+from(Bin, _Req, _Opts) when is_binary(Bin) -> {ok, Bin};
+from(List, Req, Opts) when is_list(List) ->
+    % Encode the list as a map, then -- if our request indicates that we are
+    % encoding lists -- add the `.' key to the `ao-types' field, indicating
+    % that this message is a list and return. Otherwise, if the downstream
+    % encoding did not set its own `ao-types' field, we convert the message
+    % back to a list.
+    {ok, DecodedAsMap} =
+        from(
+            hb_util:list_to_numbered_message(List),
+            Req,
+            Opts
+        ),
+    EncodingLists = lists:member(<<"list">>, find_encode_types(Req, Opts)),
+    EncodingHasAOTypes = hb_maps:is_key(<<"ao-types">>, DecodedAsMap, Opts),
+    case EncodingLists orelse EncodingHasAOTypes of
+        true ->
+            AOTypes = decode_ao_types(DecodedAsMap, Opts),
+            {ok, DecodedAsMap#{
+                <<"ao-types">> =>
+                    encode_ao_types(
+                        AOTypes#{
+                            <<".">> => <<"list">>
+                        },
+                        Opts
+                    )
+                }
+            };
+        false ->
+            % If the downstream encoding did not set its own `ao-types' field
+            % we return the message as a list.
+            {ok, hb_util:numbered_keys_to_list(DecodedAsMap, Opts)}
+    end;
+from(Msg, Req, Opts) when is_map(Msg) ->
+    % Normalize the message, offloading links to the cache.
+    NormLinks = hb_link:normalize(Msg, linkify_mode(Req, Opts), Opts),
+    NormKeysMap = hb_ao:normalize_keys(NormLinks, Opts),
+    EncodeTypes = find_encode_types(Req, Opts),
     {Types, Values} = lists:foldl(
         fun (Key, {Types, Values}) ->
-            case maps:find(Key, NormKeysMap) of
-                {ok, <<>>} ->
-                    BinKey = hb_ao:normalize_key(Key),
-                    {[{BinKey, <<"empty-binary">>} | Types], Values};
-                {ok, []} ->
-                    BinKey = hb_ao:normalize_key(Key),
-                    {[{BinKey, <<"empty-list">>} | Types], Values};
-                {ok, EmptyMap} when ?IS_EMPTY_MESSAGE(EmptyMap) ->
-                    BinKey = hb_ao:normalize_key(Key),
-                    {[{BinKey, <<"empty-message">>} | Types], Values};
+            case hb_maps:find(Key, NormKeysMap, Opts) of
                 {ok, Value} when is_binary(Value) ->
                     {Types, [{Key, Value} | Values]};
-                {ok, Map} when is_map(Map) ->
-                    {Types, [{Key, from(Map)} | Values]};
-                {ok, MsgList = [Msg1|_]} when is_map(Msg1) or is_list(Msg1) ->
-                    % We have a list of maps. Convert to a numbered map and
-                    % recurse.
-                    BinKey = hb_ao:normalize_key(Key),
-                    % Convert the list of maps into a numbered map and recurse
-                    NumberedMap = from(hb_ao:normalize_keys(MsgList)),
-                    {[{BinKey, <<"list">>} | Types], [{BinKey, NumberedMap} | Values]};
+                {ok, Nested} when is_map(Nested) or is_list(Nested) ->
+                    ?event({from_recursing, {nested, Nested}}),
+                    {Types, [{Key, hb_util:ok(from(Nested, Req, Opts))} | Values]};
                 {ok, Value} when
-                        is_atom(Value) or is_integer(Value)
-                        or is_list(Value) or is_float(Value) ->
+                        is_atom(Value) or is_integer(Value) or is_float(Value) ->
                     BinKey = hb_ao:normalize_key(Key),
                     ?event({encode_value, Value}),
-                    {Type, BinValue} = encode_value(Value),
-                    {[{BinKey, Type} | Types], [{BinKey, BinValue} | Values]};
+                    case maybe_encode_value(Value, EncodeTypes) of
+                        {Type, BinValue} ->
+                            {
+                                [{BinKey, Type} | Types],
+                                [{BinKey, BinValue} | Values]
+                            };
+                        skip ->
+                            {Types, [{Key, Value} | Values]}
+                    end;
                 {ok, {resolve, Operations}} when is_list(Operations) ->
                     {Types, [{Key, {resolve, Operations}} | Values]};
                 {ok, Function} when is_function(Function) ->
@@ -71,18 +107,20 @@ from(Msg) when is_map(Msg) ->
         lists:filter(
             fun(Key) ->
                 % Filter keys that the user could set directly, but
-                % should be regenerated when moving msg -> TX, as well
-                % as private keys.
+                % should be regenerated when converting. Additionally, we remove
+                % the `commitments' submessage, if applicable, as it should not
+                % be modified during encoding.
                 not lists:member(Key, ?REGEN_KEYS) andalso
-                    not hb_private:is_private(Key)
+                    not hb_private:is_private(Key) andalso
+                    not (Key == <<"commitments">>)
             end,
-            hb_util:to_sorted_keys(NormKeysMap)
+            hb_util:to_sorted_keys(NormKeysMap, Opts)
         )
     ),
     % Encode the AoTypes as a structured dictionary
     % And include as a field on the produced TABM
     WithTypes =
-        case Types of 
+        hb_maps:from_list(case Types of 
             [] -> Values;
             T ->
                 AoTypes = iolist_to_binary(hb_structured_fields:dictionary(
@@ -95,79 +133,109 @@ from(Msg) when is_map(Msg) ->
                     )
                 )),
                 [{<<"ao-types">>, AoTypes} | Values]
-        end,
-    maps:from_list(lists:reverse(WithTypes));
-from(Other) -> hb_path:to_binary(Other).
+        end),
+    % If the message has a `commitments' field, add it to the TABM unmodified.
+    {ok,
+        case maps:get(<<"commitments">>, Msg, not_found) of
+            not_found ->
+                WithTypes;
+            Commitments ->
+                WithTypes#{
+                    <<"commitments">> => Commitments
+                }
+        end
+    };
+from(Other, _Req, _Opts) -> {ok, hb_path:to_binary(Other)}.
+
+%% @doc Find the types that should be encoded from the request and options.
+find_encode_types(Req, Opts) ->
+    hb_maps:get(<<"encode-types">>, Req, ?SUPPORTED_TYPES, Opts).
+
+%% @doc Determine the type for a value.
+type(Int) when is_integer(Int) -> <<"integer">>;
+type(Float) when is_float(Float) -> <<"float">>;
+type(Atom) when is_atom(Atom) -> <<"atom">>;
+type(List) when is_list(List) -> <<"list">>;
+type(Other) -> Other.
+
+%% @doc Discern the linkify mode from the request and the options.
+linkify_mode(Req, Opts) ->
+    case hb_maps:get(<<"bundle">>, Req, not_found, Opts) of
+        not_found -> hb_opts:get(linkify_mode, offload, Opts);
+    	true ->
+            % The request is asking for a bundle, so we should _not_ linkify.
+            false;
+        false ->
+            % The request is asking for a flat message, so we should linkify.
+            true
+    end.
 
 %% @doc Convert a TABM into a native HyperBEAM message.
-to(Bin) when is_binary(Bin) -> Bin;
-to(TABM0) ->
-    Types = case maps:get(<<"ao-types">>, TABM0, <<>>) of
-        <<>> -> #{};
-        Bin -> parse_ao_types(Bin)
-    end,
-    % "empty values" will each have a type, but no corresponding value
-    % (because its empty)
-    % 
-    % So we first loop through Types and map over the each empty type to its
-    % equivalent empty value
-    TABM1 = maps:from_list(
-        maps:fold(
-            fun (Key, <<"empty-binary">>, Acc) -> [{Key, <<>>} | Acc];
-                (Key, <<"empty-list">>, Acc) -> [{Key, []} | Acc];
-                (Key, <<"empty-message">>, Acc) -> [{Key, #{}} | Acc];
-                (_Key, _Value, Acc) -> Acc
-            end,
-            [],
-            Types
-        )
-    ),
+to(Bin, _Req, _Opts) when is_binary(Bin) -> {ok, Bin};
+to(TABM0, Req, Opts) when is_list(TABM0) ->
+    % If we receive a list, we convert it to a message and run `to/3' on it. 
+    % Finally, we convert the result back to a list.
+    {ok, TABM1} = to(hb_util:list_to_numbered_message(TABM0), Req, Opts),
+    {ok, hb_util:numbered_keys_to_list(TABM1, Opts)};
+to(TABM0, Req, Opts) ->
+    Types = decode_ao_types(TABM0, Opts),
+    % Decode all links to their HyperBEAM-native, resolvable form.
+    TABM1 = hb_link:decode_all_links(TABM0),
     % 1. Remove 'ao-types' field
     % 2. Decode any binary values that have a type;
     % 3. Recursively decode any maps that we encounter;
     % 4. Return the remaining keys and values as a map.
-    hb_message:filter_default_keys(maps:fold(
-        fun (<<"ao-types">>, _Value, Acc) -> Acc;
-        (RawKey, BinValue, Acc) when is_binary(BinValue) ->
-            case maps:find(hb_ao:normalize_key(RawKey), Types) of
-                % The value is a binary, no parsing required
-                error -> Acc#{ RawKey => BinValue };
-                % Parse according to its type
-                {ok, Type} ->
-                    Decoded = decode_value(Type, BinValue),
-                    Acc#{ RawKey => Decoded }
-            end;
-        (RawKey, ChildTABM, Acc) when is_map(ChildTABM) ->
-            % Decode the child TABM
-            ChildDecoded = to(ChildTABM),
-            Acc#{
-                RawKey =>
-                    case maps:find(RawKey, Types) of
-                        error ->
-                            % The value is a map, so we return it as is
-                            ChildDecoded;
-                        {ok, <<"list">>} ->
-                            % The child is a list of maps, so we need to convert the
-                            % map into a list, while maintaining the correct order
-                            % of the keys
-                            hb_util:message_to_ordered_list(ChildDecoded)
-                    end
-            };
-        (RawKey, Value, Acc) ->
-            % We encountered a key that already has a converted type.
-            % We can just return it as is.
-            Acc#{ RawKey => Value }
-        end,
-        TABM1,
-        TABM0
+    ResMsg =
+        maps:fold(
+            fun (<<"ao-types">>, _Value, Acc) -> Acc;
+            (RawKey, BinValue, Acc) when is_binary(BinValue) ->
+                case hb_maps:find(hb_ao:normalize_key(RawKey), Types, Opts) of
+                    % The value is a binary, no parsing required
+                    error -> Acc#{ RawKey => BinValue };
+                    % Parse according to its type
+                    {ok, Type} ->
+                        Acc#{ RawKey => decode_value(Type, BinValue) }
+                end;
+            (RawKey, ChildTABM, Acc) when is_map(ChildTABM) ->
+                % Decode the child TABM
+                Acc#{
+                    RawKey => hb_util:ok(to(ChildTABM, Req, Opts))
+                };
+            (RawKey, Value, Acc) ->
+                % We encountered a key that already has a converted type.
+                % We can just return it as is.
+                Acc#{ RawKey => Value }
+            end,
+            #{},
+            TABM1
+        ),
+    % If the message is a list, we need to convert it back.
+    case maps:get(<<".">>, Types, not_found) of
+        not_found -> {ok, ResMsg};
+        <<"list">> -> {ok, hb_util:message_to_ordered_list(ResMsg, Opts)}
+    end.
+
+%% @doc Generate an `ao-types' structured field from a map of keys and their
+%% types.
+encode_ao_types(Types, _Opts) ->
+    iolist_to_binary(hb_structured_fields:dictionary(
+        lists:map(
+            fun(Key) ->
+                {ok, Item} = hb_structured_fields:to_item(maps:get(Key, Types)),
+                {hb_escape:encode(Key), Item}
+            end,
+            hb_util:to_sorted_keys(Types)
+        )
     )).
 
-%% @doc Parse the `ao-types' field of a TABM and return a map of keys and their
-%% types
-parse_ao_types(Msg) when is_map(Msg) ->
-    parse_ao_types(maps:get(<<"ao-types">>, Msg, <<>>));
-parse_ao_types(Bin) ->
-    maps:from_list(
+%% @doc Parse the `ao-types' field of a TABM if present, and return a map of
+%% keys and their types. If the given value is a list, we return an empty map
+%% as there can be no `ao-types'.
+decode_ao_types(List, _Opts) when is_list(List) -> #{};
+decode_ao_types(Msg, Opts) when is_map(Msg) ->
+    decode_ao_types(hb_maps:get(<<"ao-types">>, Msg, <<>>, Opts), Opts);
+decode_ao_types(Bin, _Opts) when is_binary(Bin) ->
+    hb_maps:from_list(
         lists:map(
             fun({Key, {item, {_, Value}, _}}) ->
                 {hb_escape:decode(Key), Value}
@@ -176,17 +244,36 @@ parse_ao_types(Bin) ->
         )
     ).
 
+%% @doc Determine if the `ao-types' field of a TABM indicates that the message
+%% is a list.
+is_list_from_ao_types(Types, Opts) when is_binary(Types) ->
+    is_list_from_ao_types(decode_ao_types(Types, Opts), Opts);
+is_list_from_ao_types(Types, _Opts) ->
+    case maps:find(<<".">>, Types) of
+        {ok, <<"list">>} -> true;
+        _ -> false
+    end.
+
 %% @doc Find the implicit keys of a TABM.
-implicit_keys(Req) ->
-    maps:keys(
-        maps:filtermap(
+implicit_keys(Req, Opts) ->
+    hb_maps:keys(
+        hb_maps:filtermap(
             fun(_Key, Val = <<"empty-", _/binary>>) -> {true, Val};
             (_Key, _Val) -> false
             end,
-            parse_ao_types(Req)
-        )
+            decode_ao_types(Req, Opts),
+            Opts
+        ),
+		Opts
     ).
 
+%% @doc Encode a value if it is in the list of supported types.
+maybe_encode_value(Value, EncodeTypes) ->
+    case lists:member(type(Value), EncodeTypes) of
+        true -> encode_value(Value);
+        false -> skip
+    end.
+
 %% @doc Convert a term to a binary representation, emitting its type for
 %% serialization as a separate tag.
 encode_value(Value) when is_integer(Value) ->
@@ -196,10 +283,9 @@ encode_value(Value) when is_float(Value) ->
     ?no_prod("Must use structured field representation for floats!"),
     {<<"float">>, float_to_binary(Value)};
 encode_value(Value) when is_atom(Value) ->
-    [EncodedIOList, _] =
-        hb_structured_fields:item(
-            {item, {string, atom_to_binary(Value, latin1)}, []}),
-    Encoded = list_to_binary(EncodedIOList),
+    EncodedIOList =
+        hb_structured_fields:item({item, {token, hb_util:bin(Value)}, []}),
+    Encoded = hb_util:bin(EncodedIOList),
     {<<"atom">>, Encoded};
 encode_value(Values) when is_list(Values) ->
     EncodedValues =
@@ -233,6 +319,7 @@ encode_value(Value) ->
 decode_value(Type, Value) when is_list(Type) ->
     decode_value(list_to_binary(Type), Value);
 decode_value(Type, Value) when is_binary(Type) ->
+    ?event({decoding, {type, Type}, {value, Value}}),
     decode_value(
         binary_to_existing_atom(
             list_to_binary(string:to_lower(binary_to_list(Type))),
@@ -248,8 +335,8 @@ decode_value(float, Value) ->
 decode_value(atom, Value) ->
     {item, {_, AtomString}, _} =
         hb_structured_fields:parse_item(Value),
-    binary_to_existing_atom(AtomString);
-decode_value(list, Value) ->
+    hb_util:atom(AtomString);
+decode_value(list, Value) when is_binary(Value) ->
     lists:map(
         fun({item, {string, <<"(ao-type-", Rest/binary>>}, _}) ->
             [Type, Item] = binary:split(Rest, <<") ">>),
@@ -258,8 +345,10 @@ decode_value(list, Value) ->
         end,
         hb_structured_fields:parse_list(iolist_to_binary(Value))
     );
+decode_value(list, Value) when is_map(Value) ->
+    hb_util:message_to_ordered_list(Value);
 decode_value(map, Value) ->
-    maps:from_list(
+    hb_maps:from_list(
         lists:map(
             fun({Key, {item, Item, _}}) ->
                 ?event({decoded_item, {explicit, Key}, Item}),
diff --git a/src/dev_copycat.erl b/src/dev_copycat.erl
new file mode 100644
index 000000000..61126a93d
--- /dev/null
+++ b/src/dev_copycat.erl
@@ -0,0 +1,20 @@
+%%% @doc A device for orchestrating indexing of messages from foreign sources
+%%% into a HyperBEAM node's caches.
+%%% 
+%%% Supported sources of messages are as follows:
+%%% - A remote Arweave GraphQL endpoint.
+%%% - A remote Arweave node.
+%%% Each source is implemented as a separate engine, with `dev_copycat_[ENGINE]'
+%%% as the module name.
+-module(dev_copycat).
+-export([graphql/3, arweave/3]).
+
+%% @doc Fetch data from a GraphQL endpoint for replication. See 
+%% `dev_copycat_graphql' for implementation details.
+graphql(Base, Request, Opts) ->
+    dev_copycat_graphql:graphql(Base, Request, Opts).
+
+%% @doc Fetch data from an Arweave node for replication. See `dev_copycat_arweave'
+%% for implementation details.
+arweave(Base, Request, Opts) ->
+    dev_copycat_arweave:arweave(Base, Request, Opts).
\ No newline at end of file
diff --git a/src/dev_copycat_arweave.erl b/src/dev_copycat_arweave.erl
new file mode 100644
index 000000000..6ff8f822f
--- /dev/null
+++ b/src/dev_copycat_arweave.erl
@@ -0,0 +1,77 @@
+%%% @doc A `~copycat@1.0' engine that fetches block data from an Arweave node for
+%%% replication. This engine works in _reverse_ chronological order by default,
+%%% fetching blocks from the latest known block towards the Genesis block. The
+%%% node avoids retrieving blocks that are already present in the cache using
+%%% `~arweave@2.9-pre''s built-in caching mechanism.
+-module(dev_copycat_arweave).
+-export([arweave/3]).
+-include_lib("include/hb.hrl").
+-include_lib("eunit/include/eunit.hrl").
+
+-define(ARWEAVE_DEVICE, <<"~arweave@2.9-pre">>).
+
+%% @doc Fetch blocks from an Arweave node between a given range, or from the
+%% latest known block towards the Genesis block. If no range is provided, we
+%% fetch blocks from the latest known block towards the Genesis block.
+arweave(_Base, Request, Opts) ->
+    {From, To} = parse_range(Request, Opts),
+    fetch_blocks(Request, From, To, Opts).
+
+%% @doc Parse the range from the request.
+parse_range(Request, Opts) ->
+    From =
+        case hb_maps:find(<<"from">>, Request, Opts) of
+            {ok, Height} -> Height;
+            error ->
+                {ok, LatestHeight} =
+                    hb_ao:resolve(
+                        <<?ARWEAVE_DEVICE/binary, "/current/height">>,
+                        Opts
+                    ),
+                LatestHeight
+        end,
+    To = hb_maps:get(<<"to">>, Request, 0, Opts),
+    {From, To}.
+
+%% @doc Fetch blocks from an Arweave node between a given range.
+fetch_blocks(Req, Current, Current, _Opts) ->
+    ?event(copycat_arweave,
+        {arweave_block_indexing_completed,
+            {reached_target, Current},
+            {initial_request, Req}
+        }
+    ),
+    {ok, Current};
+fetch_blocks(Req, Current, To, Opts) ->
+    BlockRes =
+        hb_ao:resolve(
+            <<
+                ?ARWEAVE_DEVICE/binary,
+                "/block=",
+                (hb_util:bin(Current))/binary
+            >>,
+            Opts
+        ),
+    process_block(BlockRes, Req, Current, To, Opts),
+    fetch_blocks(Req, Current - 1, To, Opts).
+
+%% @doc Process a block.
+process_block(BlockRes, _Req, Current, To, _Opts) ->
+    case BlockRes of
+        {ok, _} ->
+            ?event(
+                copycat_short,
+                {arweave_block_cached,
+                    {height, Current},
+                    {target, To}
+                }
+            );
+        {error, not_found} ->
+            ?event(
+                copycat_short,
+                {arweave_block_not_found,
+                    {height, Current},
+                    {target, To}
+                }
+            )
+    end.
\ No newline at end of file
diff --git a/src/dev_copycat_graphql.erl b/src/dev_copycat_graphql.erl
new file mode 100644
index 000000000..58c2b824a
--- /dev/null
+++ b/src/dev_copycat_graphql.erl
@@ -0,0 +1,238 @@
+%%% @doc A `~copycat@1.0' engine that fetches data from a GraphQL endpoint for
+%%% replication.
+-module(dev_copycat_graphql).
+-export([graphql/3]).
+-include_lib("include/hb.hrl").
+-include_lib("eunit/include/eunit.hrl").
+
+-define(SUPPORTED_FILTERS,
+    [<<"query">>, <<"tag">>, <<"owner">>, <<"recipient">>, <<"all">>]
+).
+
+%% @doc Takes a GraphQL query, optionally with a node address, and curses through
+%% each of the messages returned by the query, indexing them into the node's
+%% caches.
+graphql(Base, Req, Opts) ->
+    case parse_query(Base, Req, Opts) of
+        {ok, Query} ->
+            Node = maps:get(<<"node">>, Opts, undefined),
+            OpName = hb_maps:get(<<"operationName">>, Req, undefined, Opts),
+            Vars = hb_maps:get(<<"variables">>, Req, #{}, Opts),
+            index_graphql(0, Query, Vars, Node, OpName, Opts);
+        Other ->
+            Other
+    end.
+
+%% @doc Index a GraphQL query into the node's caches.
+index_graphql(Total, Query, Vars, Node, OpName, Opts) ->
+    maybe
+        ?event(
+            {graphql_run_called,
+                {query, {string, Query}},
+                {operation, OpName},
+                {variables, Vars}
+            }
+        ),
+        {ok, RawRes} ?= hb_gateway_client:query(Query, Vars, Node, OpName, Opts),
+        Res = hb_util:deep_get(<<"data/transactions">>, RawRes, #{}, Opts),
+        NodeStructs = hb_util:deep_get(<<"edges">>, Res, [], Opts),
+        ?event({graphql_request_returned_items, length(NodeStructs)}),
+        ?event(
+            {graphql_indexing_responses,
+                {query, {string, Query}},
+                {variables, Vars},
+                {result, Res}
+            }
+        ),
+        ParsedMsgs =
+            lists:filtermap(
+                fun(NodeStruct) ->
+                    Struct = hb_maps:get(<<"node">>, NodeStruct, not_found, Opts),
+                    try
+                        {ok, ParsedMsg} =
+                            hb_gateway_client:result_to_message(
+                                Struct,
+                                Opts
+                            ),
+                        {true, ParsedMsg}
+                    catch
+                        error:Reason ->
+                            ?event(
+                                warning,
+                                {indexer_graphql_parse_failed,
+                                    {struct, NodeStruct},
+                                    {reason, Reason}
+                                }
+                            ),
+                            false
+                    end
+                end,
+                NodeStructs
+            ),
+        ?event({graphql_parsed_msgs, length(ParsedMsgs)}),
+        WrittenMsgs =
+            lists:filter(
+                fun(ParsedMsg) ->
+                    try
+                        {ok, _} = hb_cache:write(ParsedMsg, Opts),
+                        true
+                    catch
+                        error:Reason ->
+                            ?event(
+                                warning,
+                                {indexer_graphql_write_failed,
+                                    {reason, Reason},
+                                    {msg, ParsedMsg}
+                                }
+                            ),
+                            false
+                    end
+                end,
+                ParsedMsgs
+            ),
+        NewTotal = Total + length(WrittenMsgs),
+        ?event(copycat_short,
+            {indexer_graphql_wrote,
+                {total, NewTotal},
+                {batch, length(WrittenMsgs)},
+                {batch_failures, length(ParsedMsgs) - length(WrittenMsgs)}
+            }
+        ),
+        HasNextPage = hb_util:deep_get(<<"pageInfo/hasNextPage">>, Res, false, Opts),
+        case HasNextPage of
+            true ->
+                % Get the last cursor from the node structures and recurse.
+                {ok, Cursor} =
+                    hb_maps:find(
+                        <<"cursor">>,
+                        lists:last(NodeStructs),
+                        Opts
+                    ),
+                index_graphql(
+                    NewTotal,
+                    Query,
+                    Vars#{ <<"after">> => Cursor },
+                    Node,
+                    OpName,
+                    Opts
+                );
+            false ->
+                {ok, NewTotal}
+        end
+    else
+        {error, Reason} ->
+            {error, Reason}
+    end.
+
+%% @doc Find or create a GraphQL query from a given base and request. We expect
+%% to find either a `query' field, a `tags' field, a `tag' and `value' field,
+%% an `owner' field, or a `recipient' field. If none of these fields are found,
+%% we return a query that will match all results known to an Arweave gateway.
+parse_query(Base, Req, Opts) ->
+    % Merge the keys of the base and request maps, and remove duplicates.
+    Merged = hb_maps:merge(Base, Req, Opts),
+    Keys = hb_maps:keys(Merged, Opts),
+    SupportedKeys = ?SUPPORTED_FILTERS,
+    ?event({finding_query, {supported, SupportedKeys}, {merged_req, Merged}}),
+    case lists:filter(fun(K) -> lists:member(K, SupportedKeys) end, Keys) of
+        [<<"query">>|_] ->
+            % Find the query in either the `query' field or the `body'.
+            case hb_maps:find(<<"query">>, Merged, Opts) of
+                {ok, QueryKeys} when is_map(QueryKeys) ->
+                    default_query(<<"tags">>, QueryKeys, Opts);
+                {ok, Bin} when is_binary(Bin) ->
+                    {ok, Bin};
+                _ ->
+                    case hb_maps:find(<<"body">>, Merged, Opts) of
+                        {ok, Bin} when is_binary(Bin) ->
+                            {ok, Bin};
+                        _ ->
+                            {error,
+                                #{
+                                    <<"body">> =>
+                                        <<"No query found in the request.">>
+                                }
+                            }
+                    end
+            end;
+        [<<"tag">>|_] ->
+            Key = hb_maps:get(<<"tag">>, Merged, <<>>, Opts),
+            Value = hb_maps:get(<<"value">>, Merged, <<>>, Opts),
+            default_query(<<"tag">>, {Key, Value}, Opts);
+        [FilterKey|_] ->
+            default_query(FilterKey, Merged, Opts);
+        [] ->
+            {error,
+                #{
+                    <<"body">> =>
+                        <<"No supported filter fields found. Supported filters: ",
+                            (
+                                lists:join(
+                                    <<", ">>,
+                                    lists:map(
+                                        fun(K) -> <<"\"", (K)/binary, "\"">> end,
+                                        SupportedKeys
+                                    )
+                                )
+                            )/binary
+                        >>
+                }
+            }
+    end.
+
+%% @doc Return a default query for a given filter type.
+default_query(<<"tags">>, RawMessage, Opts) ->
+    Message = hb_cache:ensure_all_loaded(RawMessage, Opts),
+    BinaryPairs =
+        lists:map(
+            fun({Key, Value}) -> {hb_util:bin(Key), hb_util:bin(Value)} end,
+            hb_maps:to_list(Message, Opts)
+        ),
+    TagsQueryStr =
+        hb_util:bin(
+            [
+                <<"{name: \"", Key/binary, "\", values: [\"", Value/binary, "\"]}">>
+            ||
+                {Key, Value} <- BinaryPairs
+            ]
+        ),
+    ?event({tags_query,
+        {message, Message},
+        {binary_pairs, BinaryPairs},
+        {tags_query_str, {string, TagsQueryStr}}
+    }),
+    {ok, <<"query($after: String) { ",
+        "transactions(after: $after, tags: [",
+            TagsQueryStr/binary,
+        "]) { ",
+        "edges { ", (hb_gateway_client:item_spec())/binary , " } ",
+        "pageInfo { hasNextPage }",
+    "} }">>};
+default_query(<<"tag">>, {Key, Value}, _Opts) ->
+    {ok, <<"query($after: String) { ",
+        "transactions(after: $after, tags: [",
+            "{name: \"", Key/binary, "\", values: [\"", Value/binary, "\"]}",
+        "]) { ",
+        "edges { ", (hb_gateway_client:item_spec())/binary , " } ",
+        "pageInfo { hasNextPage }",
+    "} }">>};
+default_query(<<"recipient">>, Merged, Opts) ->
+    Recipient = hb_maps:get(<<"recipient">>, Merged, <<>>, Opts),
+    {ok, <<"query($after: String) { ",
+        "transactions(after: $after, recipients: [\"", Recipient/binary, "\"]) { ",
+        "edges { ", (hb_gateway_client:item_spec())/binary , " } ",
+        "pageInfo { hasNextPage }",
+    "} }">>};
+default_query(<<"owner">>, Merged, Opts) ->
+    Owner = hb_maps:get(<<"owner">>, Merged, <<>>, Opts),
+    {ok, <<"query($after: String) { ",
+        "transactions(after: $after, owner: \"", Owner/binary, "\") { ",
+        "edges { ", (hb_gateway_client:item_spec())/binary , " } ",
+        "pageInfo { hasNextPage }",
+    "} }">>};
+default_query(<<"all">>, _Merged, _Opts) ->
+    {ok, <<"query($after: String) { ",
+        "transactions(after: $after) { ",
+        "edges { ", (hb_gateway_client:item_spec())/binary , " } ",
+        "pageInfo { hasNextPage }",
+    "} }">>}.
\ No newline at end of file
diff --git a/src/dev_cron.erl b/src/dev_cron.erl
index fab70dc68..4114f7de8 100644
--- a/src/dev_cron.erl
+++ b/src/dev_cron.erl
@@ -7,7 +7,7 @@
 
 %% @doc Exported function for getting device info.
 info(_) -> 
-	#{ exports => [info, once, every, stop] }.
+	#{ exports => [<<"info">>, <<"once">>, <<"every">>, <<"stop">>] }.
 
 info(_Msg1, _Msg2, _Opts) ->
 	InfoBody = #{
@@ -28,7 +28,7 @@ once(_Msg1, Msg2, Opts) ->
 		not_found ->
 			{error, <<"No cron path found in message.">>};
 		CronPath ->
-			ReqMsgID = hb_message:id(Msg2, all),
+			ReqMsgID = hb_message:id(Msg2, all, Opts),
 			% make the path specific for the end device to be used
 			ModifiedMsg2 =
                 maps:remove(
@@ -74,11 +74,11 @@ every(_Msg1, Msg2, Opts) ->
 			try 
 				IntervalMillis = parse_time(IntervalString),
 				if IntervalMillis =< 0 ->
-					throw({error, invalid_interval_value});
+					throw(invalid_interval_value);
 				true ->
 					ok
 				end,
-				ReqMsgID = hb_message:id(Msg2, all),
+				ReqMsgID = hb_message:id(Msg2, all, Opts),
 				ModifiedMsg2 =
                     maps:remove(
                         <<"cron-path">>,
@@ -100,11 +100,11 @@ every(_Msg1, Msg2, Opts) ->
 				hb_name:register(Name, Pid),
 				{ok, ReqMsgID}
 			catch
-				error:{invalid_time_unit, Unit} ->
+				_:{invalid_time_unit, Unit} ->
                     {error, <<"Invalid time unit: ", Unit/binary>>};
-				error:{invalid_interval_value} ->
+				_:invalid_interval_value ->
                     {error, <<"Invalid interval value.">>};
-				error:{Reason, _Stack} ->
+				_:Reason:_Stack ->
 					{error, {<<"Error parsing interval">>, Reason}}
 			end
 	end.
@@ -138,28 +138,24 @@ stop(_Msg1, Msg2, Opts) ->
 	end.
 
 every_worker_loop(CronPath, Req, Opts, IntervalMillis) ->
-	ReqSingleton = Req#{ <<"path">> => CronPath },
-	?event(
+    Req1 = Req#{<<"path">> => CronPath},
+    ?event(
         {cron_every_worker_executing,
             {path, CronPath},
-            {req_id, hb_message:id(Req, all)}
+            {req_id, hb_message:id(Req, all, Opts)}
         }
     ),
-	try
-		Result = dev_meta:handle(Opts, ReqSingleton),
-		?event({cron_every_worker_executed, {path, CronPath}, {result, Result}})
-	catch
-		Class:Reason:Stacktrace ->
-			?event(
-                {cron_every_worker_error,
+    try
+        dev_meta:handle(Opts, Req1),
+        ?event({cron_every_worker_executed, {path, CronPath}})
+    catch
+        Class:Reason:Stack ->
+            ?event(cron_error, {cron_every_worker_error,
                     {path, CronPath},
-                    {error, Class, Reason, Stacktrace}
-                }
-            ),
-			every_worker_loop(CronPath, Req, Opts, IntervalMillis)
-	end,
-	timer:sleep(IntervalMillis),
-	every_worker_loop(CronPath, Req, Opts, IntervalMillis).
+                    {error, Class, Reason, Stack}})
+    end,
+    timer:sleep(IntervalMillis),
+    every_worker_loop(CronPath, Req, Opts, IntervalMillis).
 
 %% @doc Parse a time string into milliseconds.
 parse_time(BinString) ->
@@ -172,7 +168,7 @@ parse_time(BinString) ->
 		"minute" ++ _ -> Amount * 60 * 1000;
 		"hour" ++ _ -> Amount * 60 * 60 * 1000;
 		"day" ++ _ -> Amount * 24 * 60 * 60 * 1000;
-		_ -> throw({error, invalid_time_unit, UnitStr})
+		_ -> throw({invalid_time_unit, UnitStr})
 	end.
 
 %%% Tests
@@ -188,7 +184,7 @@ stop_once_test() ->
 	OnceUrlPath = <<"/~cron@1.0/once?test-id=", TestWorkerNameId/binary,
 				 "&cron-path=/~test-device@1.0/delay">>,
 	{ok, OnceTaskID} = hb_http:get(Node, OnceUrlPath, #{}),
-	?event({'cron:stop_once:test:created', {task_id, OnceTaskID}}),
+	?event({cron_stop_once_test_created, {task_id, OnceTaskID}}),
 	% Give a short delay to ensure the task has started and called handle,
     % entering the sleep
 	timer:sleep(200),
@@ -199,7 +195,7 @@ stop_once_test() ->
 	% Call stop on the once task while it's sleeping
 	OnceStopPath = <<"/~cron@1.0/stop?task=", OnceTaskID/binary>>,
 	{ok, OnceStopResult} = hb_http:get(Node, OnceStopPath, #{}),
-	?event({'cron:stop_once:test:stopped', {result, OnceStopResult}}),
+	?event({cron_stop_once_test_stopped, OnceStopResult}),
 	% Verify success response from stop
 	?assertMatch(#{<<"status">> := 200}, OnceStopResult),
 	% Verify name is unregistered
@@ -208,7 +204,6 @@ stop_once_test() ->
 	timer:sleep(100),
 	% Verify process termination
 	?assertNot(erlang:is_process_alive(OncePid), "Process not killed by stop"),
-	
 	% Call stop again to verify 404 response
 	{error, <<"Task not found.">>} = hb_http:get(Node, OnceStopPath, #{}).
 
@@ -227,7 +222,7 @@ stop_every_test() ->
 				   "&interval=500-milliseconds",
 				   "&cron-path=/~test-device@1.0/increment_counter">>,
 	{ok, CronTaskID} = hb_http:get(Node, EveryUrlPath, #{}),
-	?event({'cron:stop_every:test:created', {task_id, CronTaskID}}),
+	?event({cron_stop_every_test_created, CronTaskID}),
 	% Verify the cron worker process was registered and is alive
 	CronWorkerPid = hb_name:lookup({<<"cron@1.0">>, CronTaskID}),
 	?assert(is_pid(CronWorkerPid)),
@@ -237,7 +232,7 @@ stop_every_test() ->
 	% Call stop on the cron task using its ID
 	EveryStopPath = <<"/~cron@1.0/stop?task=", CronTaskID/binary>>,
 	{ok, EveryStopResult} = hb_http:get(Node, EveryStopPath, #{}),
-	?event({'cron:stop_every:test:stopped', {result, EveryStopResult}}),
+	?event({cron_stop_every_test_stopped, EveryStopResult}),
 	% Verify success response
 	?assertMatch(#{<<"status">> := 200}, EveryStopResult),
 	% Verify the cron task name is unregistered (lookup returns undefined)
@@ -250,7 +245,7 @@ stop_every_test() ->
 	TestWorkerPid ! {get, self()},
 	receive
 		{state, State = #{count := Count}} ->
-			?event({'cron:stop_every:test:counter_state', {state, State}}),
+			?event({cron_stop_every_test_counter_state, State}),
 			?assert(Count > 0)
 	after 1000 ->
 		throw(no_response_from_worker)
@@ -283,7 +278,7 @@ once_executed_test() ->
 	% receive the state from the worker
 	receive
 		{state, State} ->
-			?event({once_executed_test_received_state, {state, State}}),
+			?event({once_executed_test_received_state, State}),
 			?assertMatch(#{ <<"test-id">> := ID }, State)
 	after 1000 ->
 		FinalLookup = hb_name:lookup({<<"test">>, ID}),
@@ -300,19 +295,19 @@ every_worker_loop_test() ->
 	UrlPath = <<"/~cron@1.0/every?test-id=", ID/binary, 
 		"&interval=500-milliseconds",
 		"&cron-path=/~test-device@1.0/increment_counter">>,
-	?event({'cron:every:test:sendUrl', {url_path, UrlPath}}),
+	?event({cron_every_test_send_url, UrlPath}),
 	{ok, ReqMsgId} = hb_http:get(Node, UrlPath, #{}),
-	?event({'cron:every:test:get_done', {req_id, ReqMsgId}}),
+	?event({cron_every_test_get_done, {req_id, ReqMsgId}}),
 	timer:sleep(1500),
 	PID ! {get, self()},
 	% receive the state from the worker
 	receive
 		{state, State = #{count := C}} ->
-			?event({'cron:every:test:received_state', {state, State}}),
+			?event({cron_every_test_received_state, State}),
 			?assert(C >= 3)
 	after 1000 ->
 		FinalLookup = hb_name:lookup({<<"test">>, ID}),
-		?event({'cron:every:test:timeout', {pid, PID}, {lookup_result, FinalLookup}}),
+		?event({cron_every_test_timeout, {pid, PID}, {lookup_result, FinalLookup}}),
 		throw({test_timeout_waiting_for_state, {id, ID}})
 	end.
 	
@@ -323,10 +318,10 @@ test_worker(State) ->
 	receive
 		{increment} ->
 			NewCount = maps:get(count, State, 0) + 1,
-			?event({'test_worker:incremented', {new_count, NewCount}}),
+			?event({test_worker_incremented, NewCount}),
 			test_worker(State#{count := NewCount});
 		{update, NewState} ->
-			 ?event({'test_worker:updated', {new_state, NewState}}),
+			 ?event({test_worker_updated, NewState}),
 			 test_worker(NewState);
 		{get, Pid} ->
 			Pid ! {state, State},
diff --git a/src/dev_dedup.erl b/src/dev_dedup.erl
index 6c5168d73..f19c1996b 100644
--- a/src/dev_dedup.erl
+++ b/src/dev_dedup.erl
@@ -1,8 +1,22 @@
-%%% @doc A device that deduplicates messages send to a process.
-%%% Only runs on the first pass of the `compute' key call if executed
-%%% in a stack. Currently the device stores its list of already seen 
-%%% items in memory, but at some point it will likely make sense to 
-%%% drop them in the cache.
+%%% @doc A device that deduplicates messages in an evaluation stream, returning
+%%% status `skip' if the message has already been seen.
+%%%
+%%% This device is typically used to ensure that a message is only executed
+%%% once, even if assigned multiple times, upon a `~process@1.0' evaluation.
+%%% It can, however, be used in many other contexts.
+%%%
+%%% This device honors the `pass' key if it is present in the message. If so,
+%%% it will only run on the first pass. Additionally, the device supports
+%%% a `subject-key' key that allows the caller to specify the key whose ID
+%%% should be used for deduplication. If the `subject-key' key is not present,
+%%% the device will use the `body' of the request as the subject. If the key is
+%%% set to `request', the device will use the entire request itself as the
+%%% subject.
+%%%
+%%% This device runs on the first pass of the `compute' key call if executed
+%%% in a stack, and not in subsequent passes. Currently the device stores its
+%%% list of already seen items in memory, but at some point it will likely make
+%%% sense to drop them in the cache.
 -module(dev_dedup).
 -export([info/1]).
 -include_lib("eunit/include/eunit.hrl").
@@ -10,38 +24,87 @@
 
 info(_M1) ->
     #{
-        handler => fun handle/4
+        default => fun handle/4,
+        exclude => [keys, set, id, commit]
     }.
 
-%% @doc Forward the keys function to the message device, handle all others
-%% with deduplication. We only act on the first pass.
+%% @doc Forward the keys and `set' functions to the message device, handle all
+%% others with deduplication. This allows the device to be used in any context
+%% where a key is called. If the `dedup-key
 handle(<<"keys">>, M1, _M2, _Opts) ->
     dev_message:keys(M1);
 handle(<<"set">>, M1, M2, Opts) ->
     dev_message:set(M1, M2, Opts);
 handle(Key, M1, M2, Opts) ->
     ?event({dedup_handle, {key, Key}, {msg1, M1}, {msg2, M2}}),
-    case hb_ao:get(<<"pass">>, {as, dev_message, M1}, 1, Opts) of
-        1 ->
-            Msg2ID = hb_message:id(M2, all),
-            Dedup = hb_ao:get(<<"dedup">>, {as, dev_message, M1}, [], Opts),
-            ?event({dedup_checking, {existing, Dedup}}),
-            case lists:member(Msg2ID, Dedup) of
+    % Find the relevant parameters from the messages. We search for the
+    % `dedup-key' key in the first message, and use that value as the key to
+    % look for in the second message.
+    SubjectKey =
+        hb_ao:get_first(
+            [
+                {{as, <<"message@1.0">>, M1}, <<"dedup-subject">>},
+                {{as, <<"message@1.0">>, M2}, <<"dedup-subject">>}
+            ],
+            <<"body">>,
+            Opts
+        ),
+    % Get the subject of the second message.
+    Subject =
+        if SubjectKey == <<"request">> ->
+            % The subject is the request itself.
+            M2;
+        true ->
+            % The subject is the value of the subject key, which will have
+            % defaulted to the `body' key if not set in the base message.
+            hb_ao:get_first(
+                [
+                    {{as, <<"message@1.0">>, M1}, SubjectKey},
+                    {{as, <<"message@1.0">>, M2}, SubjectKey}
+                ],
+                Opts
+            )
+        end,
+    % Is this the first pass, if we are executing in a stack?
+    FirstPass = hb_ao:get(<<"pass">>, {as, <<"message@1.0">>, M1}, 1, Opts) == 1,
+    % Get the list of already seen subjects.
+    DedupList = hb_ao:get(<<"dedup">>, {as, <<"message@1.0">>, M1}, [], Opts),
+    ?event({dedup_handle,
+        {key, Key},
+        {msg1, M1},
+        {msg2, M2},
+        {subject_key, SubjectKey},
+        {subject, Subject}
+    }),
+    case {FirstPass, Subject} of
+        {false, _} ->
+            % If this is not the first pass, we can skip the deduplication
+            % check.
+            {ok, M1};
+        {true, not_found} ->
+            % If the subject key is not present, we can skip the deduplication
+            % check.
+            {ok, M1};
+        {true, _} ->
+            % If this is the first pass, we need to check if the subject has
+            % already been seen.
+            SubjectID = hb_message:id(Subject, all),
+            ?event({dedup_checking, {existing, DedupList}}),
+            case lists:member(SubjectID, DedupList) of
                 true ->
-                    ?event({already_seen, Msg2ID}),
+                    ?event({already_seen, SubjectID}),
                     {skip, M1};
                 false ->
-                    ?event({not_seen, Msg2ID}),
-                    M3 = hb_ao:set(
-                        M1,
-                        #{ <<"dedup">> => [Msg2ID|Dedup] }
-                    ),
+                    ?event({not_seen, SubjectID}),
+                    M3 =
+                        hb_ao:set(
+                            M1,
+                            #{ <<"dedup">> => [SubjectID|DedupList] },
+                            Opts
+                        ),
                     ?event({dedup_updated, M3}),
                     {ok, M3}
-            end;
-        Pass ->
-            ?event({multipass_detected, skipping_dedup, {pass, Pass}}),
-            {ok, M1}
+            end
     end.
 
 %%% Tests
@@ -51,10 +114,11 @@ dedup_test() ->
     % Create a stack with a dedup device and 2 devices that will append to a
     % `Result' key.
 	Msg = #{
-		<<"device">> => <<"Stack@1.0">>,
+		<<"device">> => <<"stack@1.0">>,
+        <<"dedup-subject">> => <<"request">>,
 		<<"device-stack">> =>
 			#{
-				<<"1">> => <<"Dedup@1.0">>,
+				<<"1">> => <<"dedup@1.0">>,
 				<<"2">> => dev_stack:generate_append_device(<<"+D2">>),
 				<<"3">> => dev_stack:generate_append_device(<<"+D3">>)
 			},
@@ -82,13 +146,14 @@ dedup_with_multipass_test() ->
     % an additional pass. We want to ensure that Multipass is not hindered by
     % the dedup device.
 	Msg = #{
-		<<"device">> => <<"Stack@1.0">>,
+		<<"device">> => <<"stack@1.0">>,
+        <<"dedup-subject">> => <<"request">>,
 		<<"device-stack">> =>
 			#{
-				<<"1">> => <<"Dedup@1.0">>,
+				<<"1">> => <<"dedup@1.0">>,
 				<<"2">> => dev_stack:generate_append_device(<<"+D2">>),
 				<<"3">> => dev_stack:generate_append_device(<<"+D3">>),
-                <<"4">> => <<"Multipass@1.0">>
+                <<"4">> => <<"multipass@1.0">>
 			},
 		<<"result">> => <<"INIT">>,
         <<"passes">> => 2
diff --git a/src/dev_delegated_compute.erl b/src/dev_delegated_compute.erl
index 3af06da0b..052dbc7b5 100644
--- a/src/dev_delegated_compute.erl
+++ b/src/dev_delegated_compute.erl
@@ -11,24 +11,175 @@
 %% need to do anything special here.
 init(Msg1, _Msg2, _Opts) ->
     {ok, Msg1}.
-normalize(Msg1, _Msg2, _Opts) -> {ok, Msg1}.
-snapshot(Msg1, _Msg2, _Opts) -> {ok, Msg1}.
 
+%% @doc We assume that the compute engine stores its own internal state,
+%% with snapshots triggered only when HyperBEAM requests them. Subsequently,
+%% to load a snapshot, we just need to return the original message.
+normalize(Msg1, _Msg2, Opts) ->
+    case hb_maps:find(<<"snapshot">>, Msg1, Opts) of
+        error -> {ok, Msg1};
+        {ok, Snapshot} ->
+            Unset = hb_ao:set(Msg1, #{ <<"snapshot">> => unset }, Opts),
+            case hb_maps:get(<<"type">>, Snapshot, Opts) == <<"Checkpoint">> of
+                false -> Unset;
+                true ->
+                    load_state(Snapshot, Opts),
+                    Unset
+            end
+    end.
+
+%% @doc Attempt to load a snapshot into the delegated compute server.
+load_state(Snapshot, Opts) ->
+    ?event(debug_load_snapshot, {loading_snapshot, {snapshot, Snapshot}}),
+    Body = hb_maps:get(<<"data">>, Snapshot, Opts),
+    Headers = hb_maps:without([<<"data">>], Snapshot, Opts),
+    Res = do_relay(
+        <<"POST">>,
+        <<"/state">>,
+        Body,
+        Headers,
+        Opts#{
+            hashpath => ignore,
+            cache_control => [<<"no-store">>, <<"no-cache">>]
+        }
+    ),
+    ?event(debug_load_snapshot, {load_result, Res}),
+    Res.
+
+%% @doc Call the delegated server to compute the result. The endpoint is
+%% `POST /compute' and the body is the JSON-encoded message that we want to
+%% evaluate.
 compute(Msg1, Msg2, Opts) ->
-    RawProcessID = dev_process:process_id(Msg1, #{}, Opts),
     OutputPrefix = dev_stack:prefix(Msg1, Msg2, Opts),
-    ProcessID =
-        case RawProcessID of
-            not_found -> hb_ao:get(<<"process-id">>, Msg2, Opts);
-            ProcID -> ProcID
-        end,
-    Res = do_compute(ProcessID, Msg2, Opts),
-    case Res of
+    % Extract the process ID - this identifies which process to run compute
+    % against.
+    ProcessID = get_process_id(Msg1, Msg2, Opts),
+    % If request is an assignment, we will compute the result
+    % Otherwise, it is a dryrun
+    Type = hb_ao:get(<<"type">>, Msg2, not_found, Opts),
+    ?event({doing_delegated_compute, {msg2, Msg2}, {type, Type}}),
+    % Execute the compute via external CU
+    case Type of
+        <<"Assignment">> ->
+            Slot = hb_ao:get(<<"slot">>, Msg2, Opts),
+            Res = do_compute(ProcessID, Msg2, Opts);
+        _ ->
+            Slot = dryrun,
+            Res = do_dryrun(ProcessID, Msg2, Opts)
+    end,
+    handle_relay_response(Msg1, Msg2, Opts, Res, OutputPrefix, ProcessID, Slot).
+
+%% @doc Execute computation on a remote machine via relay and the JSON-Iface.
+do_compute(ProcID, Msg2, Opts) ->
+    ?event({do_compute_msg, {req, Msg2}}),
+    Slot = hb_ao:get(<<"slot">>, Msg2, Opts),
+    {ok, AOS2 = #{ <<"body">> := Body }} =
+        dev_scheduler_formats:assignments_to_aos2(
+            ProcID,
+            #{
+                Slot => Msg2
+            },
+            false,
+            Opts
+        ),
+    ?event({do_compute_body, {aos2, {string, Body}}}),
+    % Send to external CU via relay using /result endpoint
+    Response =
+        do_relay(
+            <<"POST">>,
+            <<"/result/", (hb_util:bin(Slot))/binary, "?process-id=", ProcID/binary>>,
+            Body,
+            AOS2,
+            Opts#{
+                hashpath => ignore,
+                cache_control => [<<"no-store">>, <<"no-cache">>]
+            }
+        ),
+    extract_json_res(Response, Opts).
+
+%% @doc Execute dry-run computation on a remote machine via relay and use
+%% the JSON-Iface to decode the response.
+do_dryrun(ProcID, Msg2, Opts) ->
+    ?event({do_dryrun_msg, {req, Msg2}}),
+    % Remove commitments from the message before sending to the external CU
+    Body = 
+        hb_json:encode(
+            dev_json_iface:message_to_json_struct(
+                hb_maps:without([<<"commitments">>], Msg2, Opts),
+                Opts
+            )
+        ),
+    ?event({do_dryrun_body, {string, Body}}),
+    % Send to external CU via relay using /dry-run endpoint
+    Response = do_relay(
+        <<"POST">>,
+        <<"/dry-run?process-id=", ProcID/binary>>,
+        Body,
+        #{},
+        Opts#{
+            hashpath => ignore,
+            cache_control => [<<"no-store">>, <<"no-cache">>]
+        }
+    ),
+    extract_json_res(Response, Opts).
+
+do_relay(Method, Path, Body, Headers, Opts) ->
+    ContentType =
+        hb_maps:get(
+            <<"content-type">>,
+            Headers,
+            <<"application/json">>,
+            Opts
+        ),
+    hb_ao:resolve(
+        #{
+            <<"device">> => <<"relay@1.0">>,
+            <<"content-type">> => ContentType
+        },
+        Headers#{
+            <<"path">> => <<"call">>,
+            <<"target">> => <<"payload">>,
+            <<"payload">> =>
+                Headers#{
+                    <<"path">> => Path,
+                    <<"method">> => Method,
+                    <<"body">> => Body,
+                    <<"content-type">> => ContentType
+                }
+        },
+        Opts
+    ).
+
+%% @doc Extract the JSON response from the delegated compute response.
+extract_json_res(Response, Opts) ->
+    case Response of 
+        {ok, Res} ->
+            JSONRes = hb_ao:get(<<"body">>, Res, Opts),
+            ?event({
+                delegated_compute_res_metadata,
+                {req, hb_maps:without([<<"body">>], Res, Opts)}
+            }),
+            {ok, JSONRes};
+        {Err, Error} when Err == error; Err == failure ->
+            {error, Error}
+    end.
+
+get_process_id(Msg1, Msg2, Opts) ->
+    RawProcessID = dev_process:process_id(Msg1, #{}, Opts),
+    case RawProcessID of
+        not_found -> hb_ao:get(<<"process-id">>, Msg2, Opts);
+        ProcID -> ProcID
+    end.
+
+%% @doc Handle the response from the delegated compute server. Assumes that the
+%% response is in AOS2-style format, decoding with the JSON-Iface.
+handle_relay_response(Msg1, Msg2, Opts, Response, OutputPrefix, ProcessID, Slot) ->
+    case Response of 
         {ok, JSONRes} ->
             ?event(
                 {compute_lite_res,
                     {process_id, ProcessID},
-                    {slot, hb_ao:get(<<"slot">>, Msg2, Opts)},
+                    {slot, Slot},
                     {json_res, {string, JSONRes}},
                     {req, Msg2}
                 }
@@ -52,52 +203,37 @@ compute(Msg1, Msg2, Opts) ->
             {error, Error}
     end.
 
-%% @doc Execute computation on a remote machine via relay and the JSON-Iface.
-do_compute(ProcID, Msg2, Opts) ->
-    ?event({do_compute_msg, {req, Msg2}}),
-    Slot = hb_ao:get(<<"slot">>, Msg2, Opts),
-    {ok, AOS2 = #{ <<"body">> := Body }} =
-        dev_scheduler_formats:assignments_to_aos2(
-            ProcID,
-            #{
-                Slot => Msg2
-            },
-            false,
-            Opts
-        ),
-    ?event({do_compute_msg, {aos2, {string, Body}}}),
+%% @doc Generate a snapshot of a running computation by calling the 
+%% `GET /snapshot' endpoint.
+snapshot(Msg, Msg2, Opts) ->
+    ?event({snapshotting, {req, Msg2}}),
+    ProcID = dev_process:process_id(Msg, #{}, Opts),
     Res = 
         hb_ao:resolve(
             #{
                 <<"device">> => <<"relay@1.0">>,
                 <<"content-type">> => <<"application/json">>
             },
-            AOS2#{
+            #{
                 <<"path">> => <<"call">>,
                 <<"relay-method">> => <<"POST">>,
-                <<"relay-body">> => Body,
-                <<"relay-path">> =>
-                    <<
-                        "/result/",
-                        (hb_util:bin(Slot))/binary,
-                        "?process-id=",
-                        ProcID/binary
-                    >>,
-                <<"content-type">> => <<"application/json">>
+                <<"relay-path">> => <<"/snapshot/", ProcID/binary>>,
+                <<"content-type">> => <<"application/json">>,
+                <<"body">> => <<"{}">>
             },
             Opts#{
                 hashpath => ignore,
                 cache_control => [<<"no-store">>, <<"no-cache">>]
             }
         ),
+    ?event({snapshotting_result, Res}),
     case Res of
         {ok, Response} ->
-            JSONRes = hb_ao:get(<<"body">>, Response, Opts),
-            ?event({
-                delegated_compute_res_metadata,
-                {req, maps:without([<<"body">>], Response)}
-            }),
-            {ok, JSONRes};
-        {Err, Error} when Err == error; Err == failure ->
-            {error, Error}
+            {ok, Response};
+        {error, Error} ->
+            {ok,
+                #{
+                    <<"error">> => <<"No checkpoint produced.">>,
+                    <<"error-details">> => Error
+                }}
     end.
\ No newline at end of file
diff --git a/src/dev_faff.erl b/src/dev_faff.erl
index 68f717a93..e047262e4 100644
--- a/src/dev_faff.erl
+++ b/src/dev_faff.erl
@@ -17,7 +17,7 @@
 %%% do not want to charge for requests, so we return `ok' and do not actually
 %%% debit the user's account. Similarly, we are not interested in taking payments
 %%% from users, so we do not implement `credit/3'.
--export([debit/3]).
+-export([charge/3]).
 -include("include/hb.hrl").
 
 %% @doc Decide whether or not to service a request from a given address.
@@ -33,14 +33,14 @@ estimate(_, Msg, NodeMsg) ->
 is_admissible(Msg, NodeMsg) ->
     AllowList = hb_opts:get(faff_allow_list, [], NodeMsg),
     Req = hb_ao:get(<<"request">>, Msg, NodeMsg),
-    Signers = hb_message:signers(Req),
+    Signers = hb_message:signers(Req, NodeMsg),
     ?event(payment, {is_admissible, {signers, Signers}, {allow_list, AllowList}}),
     lists:all(
         fun(Signer) -> lists:member(Signer, AllowList) end,
         Signers
     ).
 
-%% @doc Debit the user's account if the request is allowed.
-debit(_, Req, _NodeMsg) ->
-    ?event(payment, {debit, Req}),
+%% @doc Charge the user's account if the request is allowed.
+charge(_, Req, _NodeMsg) ->
+    ?event(payment, {charge, Req}),
     {ok, true}.
diff --git a/src/dev_genesis_wasm.erl b/src/dev_genesis_wasm.erl
index 6d31ae932..265e17939 100644
--- a/src/dev_genesis_wasm.erl
+++ b/src/dev_genesis_wasm.erl
@@ -2,7 +2,8 @@
 %%% processes, using HyperBEAM infrastructure. This allows existing `legacynet'
 %%% AO process definitions to be used in HyperBEAM.
 -module(dev_genesis_wasm).
--export([init/3, compute/3, normalize/3, snapshot/3]).
+-export([init/3, compute/3, normalize/3, snapshot/3, import/3]).
+-export([latest_checkpoint/2]).
 -include_lib("eunit/include/eunit.hrl").
 -include_lib("include/hb.hrl").
 
@@ -13,38 +14,52 @@
 init(Msg, _Msg2, _Opts) -> {ok, Msg}.
 
 %% @doc Normalize the device.
-normalize(Msg, _Msg2, _Opts) -> {ok, Msg}.
-
-%% @doc Snapshot the device.
-snapshot(Msg, _Msg2, _Opts) -> {ok, Msg}.
+normalize(Msg, Msg2, Opts) ->
+    case ensure_started(Opts) of
+        true ->
+            dev_delegated_compute:normalize(Msg, Msg2, Opts);
+        false ->
+            {error, #{
+                <<"status">> => 500,
+                <<"message">> => <<"Genesis-wasm server not running.">>
+            }}
+    end.
 
-%% @doc All the `delegated-compute@1.0' device to execute the request. We then apply
-%% the `patch@1.0' device, applying any state patches that the AO process may have
-%% requested.
+%% @doc Genesis-wasm device compute handler.
+%% Normal compute execution through external CU with state persistence
 compute(Msg, Msg2, Opts) ->
+    % Validate whether the genesis-wasm feature is enabled.
+    case delegate_request(Msg, Msg2, Opts) of
+        {ok, Msg3} ->
+            % Resolve the `patch@1.0' device.
+            {ok, Msg4} =
+                hb_ao:resolve(
+                    Msg3,
+                    {
+                        as,
+                        <<"patch@1.0">>,
+                        Msg2#{ <<"patch-from">> => <<"/results/outbox">> }
+                    },
+                    Opts
+                ),
+            % Return the patched message.
+            {ok, Msg4};
+        {error, Error} ->
+            % Return the error.
+            {error, Error}
+    end.
+
+%% @doc Snapshot the state of the process via the `delegated-compute@1.0' device.
+snapshot(Msg, Msg2, Opts) ->
+    delegate_request(Msg, Msg2, Opts).
+
+%% @doc Proxy a request to the delegated-compute@1.0 device, ensuring that
+%% the server is running.
+delegate_request(Msg, Msg2, Opts) ->
     % Validate whether the genesis-wasm feature is enabled.
     case ensure_started(Opts) of
         true ->
-            % Resolve the `delegated-compute@1.0' device.
-            case hb_ao:resolve(Msg, {as, <<"delegated-compute@1.0">>, Msg2}, Opts) of
-                {ok, Msg3} ->
-                    % Resolve the `patch@1.0' device.
-                    {ok, Msg4} =
-                        hb_ao:resolve(
-                            Msg3,
-                            {
-                                as,
-                                <<"patch@1.0">>,
-                                Msg2#{ <<"patch-from">> => <<"/results/outbox">> }
-                            },
-                            Opts
-                        ),
-                    % Return the patched message.
-                    {ok, Msg4};
-                {error, Error} ->
-                    % Return the error.
-                    {error, Error}
-            end;
+            do_compute(Msg, Msg2, Opts);
         false ->
             % Return an error if the genesis-wasm feature is disabled.
             {error, #{
@@ -55,10 +70,65 @@ compute(Msg, Msg2, Opts) ->
             }}
     end.
 
+
+%% @doc Handle normal compute execution with state persistence (GET method).
+do_compute(Msg, Msg2, Opts) ->
+    % Resolve the `delegated-compute@1.0' device.
+    case hb_ao:resolve(Msg, {as, <<"delegated-compute@1.0">>, Msg2}, Opts) of
+        {ok, Msg3} ->
+            PatchResult = 
+                hb_ao:resolve(
+                    Msg3,
+                    {
+                        as,
+                        <<"patch@1.0">>,
+                        Msg2#{ <<"patch-from">> => <<"/results/outbox">> }
+                    },
+                    Opts
+                ),
+            % Resolve the `patch@1.0' device.
+            case PatchResult of 
+                {ok, Msg4} ->
+                    % Return the patched message.
+                    {ok, Msg4};
+                {error, Error} ->
+                    % Return the error.
+                    {error, Error}
+            end;
+        {error, Error} ->
+            % Return the error.
+            {error, Error}
+    end.
+
 %% @doc Ensure the local `genesis-wasm@1.0' is live. If it not, start it.
 ensure_started(Opts) ->
     % Check if the `genesis-wasm@1.0' device is already running. The presence
     % of the registered name implies its availability.
+    {ok, Cwd} = file:get_cwd(),
+    ?event({ensure_started, cwd, Cwd}),
+    % Determine path based on whether we're in a release or development
+    GenesisWasmServerDir =
+        case init:get_argument(mode) of
+            {ok, [["embedded"]]} ->
+                % We're in release mode - genesis-wasm-server is in the release root
+                filename:join([Cwd, "genesis-wasm-server"]);
+            _ ->
+                % We're in development mode - look in the build directory
+                DevPath =
+                    filename:join(
+                        [
+                            Cwd,
+                            "_build",
+                            "genesis_wasm",
+                            "genesis-wasm-server"
+                        ]
+                    ),
+                case filelib:is_dir(DevPath) of
+                    true -> DevPath;
+                    false -> filename:join([Cwd, "./opt/_build/genesis-wasm-server"]) % Fallback
+                end
+        end,
+    ?event({ensure_started, genesis_wasm_server_dir, GenesisWasmServerDir}),
     ?event({ensure_started, genesis_wasm, self()}),
     IsRunning = is_genesis_wasm_server_running(Opts),
     IsCompiled = hb_features:genesis_wasm(),
@@ -73,26 +143,25 @@ ensure_started(Opts) ->
                 spawn(
                     fun() ->
                         ?event({genesis_wasm_booting, {pid, self()}}),
-                        % Create genesis_wasm cache dir, if it does not exist.
                         NodeURL =
                             "http://localhost:" ++
                             integer_to_list(hb_opts:get(port, no_port, Opts)),
-                        DBDir =
-                            filename:absname(
-                                hb_util:list(
-                                    hb_opts:get(
-                                        genesis_wasm_db_dir,
-                                        "cache-mainnet/genesis-wasm",
-                                        Opts
-                                    )
+                        RelativeDBDir =
+                            hb_util:list(
+                                hb_opts:get(
+                                    genesis_wasm_db_dir,
+                                    "cache-mainnet/genesis-wasm",
+                                    Opts
                                 )
                             ),
+                        DBDir =
+                            filename:absname(RelativeDBDir),
 						CheckpointDir =
                             filename:absname(
                                 hb_util:list(
                                     hb_opts:get(
                                         genesis_wasm_checkpoints_dir,
-                                        "cache-mainnet/genesis-wasm/checkpoints",
+                                        RelativeDBDir ++ "/checkpoints",
                                         Opts
                                     )
                                 )
@@ -103,19 +172,24 @@ ensure_started(Opts) ->
                         Port =
                             open_port(
                                 {spawn_executable,
-                                    "_build/genesis-wasm-server/launch-monitored.sh"
+                                    filename:join(
+                                        [
+                                            GenesisWasmServerDir,
+                                            "launch-monitored.sh"
+                                        ]
+                                    )
                                 },
                                 [
                                     binary, use_stdio, stderr_to_stdout,
-                                    {args, [
+                                    {args, Args = [
                                         "npm",
                                         "--prefix",
-                                        "_build/genesis-wasm-server",
+                                        GenesisWasmServerDir,
                                         "run",
-                                        "dev"
+                                        "start"
                                     ]},
                                     {env,
-                                        [
+                                        Env = [
                                             {"UNIT_MODE", "hbu"},
                                             {"HB_URL", NodeURL},
                                             {"PORT",
@@ -128,12 +202,12 @@ ensure_started(Opts) ->
                                                 )
                                             },
                                             {"DB_URL", DatabaseUrl},
-                                            {"NODE_CONFIG_ENV", "development"},
+                                            {"NODE_CONFIG_ENV", "production"},
                                             {"DEFAULT_LOG_LEVEL",
                                                 hb_util:list(
                                                     hb_opts:get(
                                                         genesis_wasm_log_level,
-                                                        "error",
+                                                        "debug",
                                                         Opts
                                                     )
                                                 )
@@ -150,12 +224,46 @@ ensure_started(Opts) ->
                                                 )
                                             },
 											{"DISABLE_PROCESS_FILE_CHECKPOINT_CREATION", "false"},
-											{"PROCESS_MEMORY_FILE_CHECKPOINTS_DIR", CheckpointDir}
+											{"PROCESS_MEMORY_FILE_CHECKPOINTS_DIR", CheckpointDir},
+                                            {"PROCESS_MEMORY_CACHE_MAX_SIZE",
+                                                hb_util:list(
+                                                    hb_opts:get(
+                                                        genesis_wasm_memory_cache_max_size,
+                                                        "17179869184", %% 16GB
+                                                        Opts
+                                                    )
+                                                )
+                                            },
+                                            {"PROCESS_WASM_SUPPORTED_EXTENSIONS",
+                                                hb_util:list(
+                                                    hb_opts:get(
+                                                        genesis_wasm_supported_extensions,
+                                                        "WeaveDrive",
+                                                        Opts
+                                                    )
+                                                )
+                                            },
+                                            {"PROCESS_WASM_MEMORY_MAX_LIMIT",
+                                                hb_util:list(
+                                                    hb_opts:get(
+                                                        genesis_wasm_memory_max_limit,
+                                                        "24_000_000_000",
+                                                        Opts
+                                                    )
+                                                )
+                                            }
                                         ]
                                     }
                                 ]
                             ),
                         ?event({genesis_wasm_port_opened, {port, Port}}),
+                        ?event(
+                            debug_genesis,
+                            {started_genesis_wasm,
+                                {args, Args},
+                                {env, maps:from_list(Env)}
+                            }
+                        ),
                         collect_events(Port)
                     end
                 ),
@@ -174,6 +282,148 @@ ensure_started(Opts) ->
             true
     end.
 
+%% @doc Find either a specific checkpoint by its ID, or find the most recent
+%% checkpoint via GraphQL.
+import(Base, Req, Opts) ->
+    PassedProcID = hb_maps:find(<<"process-id">>, Req, Opts),
+    ProcMsg =
+        case PassedProcID of
+            {ok, ProcessId} ->
+                {ok, CacheProcMsg} = hb_cache:read(ProcessId, Opts),
+                CacheProcMsg;
+            error ->
+                Base
+        end,
+    case hb_maps:find(<<"import">>, Req, Opts) of
+        {ok, ImportID} ->
+            case hb_cache:read(ImportID, Opts) of
+                {ok, CheckpointMessage} ->
+                    do_import(ProcMsg, CheckpointMessage, Opts);
+                not_found -> {error, not_found}
+            end;
+        error ->
+            ProcID = dev_process:process_id(ProcMsg, #{}, Opts),
+            case latest_checkpoint(ProcID, Opts) of
+                {ok, CheckpointMessage} ->
+                    do_import(ProcMsg, CheckpointMessage, Opts);
+                Err -> Err
+            end
+    end.
+
+%% @doc Find the most recent legacy checkpoint for a process.
+latest_checkpoint(ProcID, Opts) ->
+    case hb_opts:get(genesis_wasm_import_authorities, [], Opts) of
+        [] -> {error, no_import_authorities};
+        TrustedSigners -> latest_checkpoint(ProcID, TrustedSigners, Opts)
+    end.
+latest_checkpoint(ProcID, TrustedSigners, Opts) ->
+    Query =
+        <<
+            <<"""
+            query($ProcID: String!, $TrustedSigners: [String!]) {
+                transactions(
+                    tags: [
+                        { name: "Type" values: ["Checkpoint"] },
+                        { name: "Process" values: [$ProcID] }
+                    ],
+                    owners: $TrustedSigners,
+                    first: 1,
+                    sort: HEIGHT_DESC
+                ){
+                edges {
+            """>>/binary,
+            (hb_gateway_client:item_spec())/binary,
+            """
+                }
+            }}
+        """>>,
+    Variables =
+        #{
+            <<"ProcID">> => ProcID,
+            <<"TrustedSigners">> => TrustedSigners
+        },
+    case hb_gateway_client:query(Query, Variables, Opts) of
+        {error, Reason} ->
+            {error, Reason};
+        {ok, GqlMsg} ->
+            ?event(debug_proc_id, {gql_msg, GqlMsg}),
+            case hb_ao:get(<<"data/transactions/edges/1/node">>, GqlMsg, Opts) of
+                not_found -> {error, not_found};
+                Item -> hb_gateway_client:result_to_message(Item, Opts)
+            end
+    end.
+
+%% @doc Validate whether a checkpoint message is signed by a trusted snapshot
+%% authority and is for a `ao.TN.1' process or has `execution-device' set to
+%% `genesis-wasm@1.0', then normalize into a state snapshot.
+%% Save the state snapshot into the store.
+do_import(Proc, CheckpointMessage, Opts) ->
+    maybe
+        % Validate that the process is a valid target for importing a checkpoint.
+        Variant = hb_maps:get(<<"variant">>, Proc, false, Opts),
+        ExecutionDevice = hb_maps:get(<<"execution-device">>, Proc, false, Opts),
+        true ?=
+            (Variant == <<"ao.TN.1">>) orelse
+            (ExecutionDevice == <<"genesis-wasm@1.0">>) orelse
+            invalid_import_target,
+        CheckpointSigners = hb_message:signers(CheckpointMessage, Opts),
+        % Validate that the checkpoint message is signed by a trusted snapshot
+        % authority, and targets this process.
+        TrustedSigners = hb_opts:get(genesis_wasm_import_authorities, [], Opts),
+        true ?=
+            lists:any(
+                fun(Signer) -> lists:member(Signer, TrustedSigners) end,
+                CheckpointSigners
+            ) orelse untrusted,
+        true ?= hb_message:verify(CheckpointMessage, all, Opts) orelse unverified,
+        CheckpointTargetProcID = hb_maps:get(<<"process">>, CheckpointMessage, Opts),
+        ProcID = dev_process:process_id(Proc, #{}, Opts),
+        true ?= CheckpointTargetProcID == ProcID orelse process_mismatch,
+        % Normalize the checkpoint message into a process state message with 
+        % a state snapshot.
+        {ok, SlotBin} ?= hb_maps:find(<<"nonce">>, CheckpointMessage, Opts),
+        Slot = hb_util:int(SlotBin),
+        InitializedProc = dev_process:ensure_process_key(Proc, Opts),
+        WithSnapshot =
+            InitializedProc#{
+                <<"at-slot">> => Slot,
+                <<"snapshot">> => CheckpointMessage
+            },
+        % Save the state snapshot into the store.
+        {ok, _} ?= dev_process_cache:write(ProcID, Slot, WithSnapshot, Opts),
+        % Return the normalized process message.
+        {ok, WithSnapshot}
+    else
+        invalid_import_target ->
+            {error, #{
+                <<"status">> => 400,
+                <<"body">> =>
+                    <<
+                        "Process is not a valid target for importing a "
+                        "`~genesis-wasm@1.0' checkpoint."
+                    >>
+            }};
+        process_mismatch ->
+            {error, #{
+                <<"status">> => 400,
+                <<"body">> =>
+                    <<"Checkpoint message targets a different process.">>
+            }};
+        unverified ->
+            {error, #{
+                <<"status">> => 400,
+                <<"body">> =>
+                    <<"Checkpoint message is not verifiable.">>
+            }};
+        untrusted ->
+            {error, #{
+                <<"status">> => 400,
+                <<"body">> =>
+                    <<"Checkpoint message is not signed by a trusted snapshot "
+                        "authority.">>
+            }}
+    end.
+
 %% @doc Check if the genesis-wasm server is running, using the cached process ID
 %% if available.
 is_genesis_wasm_server_running(Opts) ->
@@ -244,5 +494,514 @@ log_server_events(Bin) when is_binary(Bin) ->
     log_server_events(binary:split(Bin, <<"\n">>, [global]));
 log_server_events([Remaining]) -> Remaining;
 log_server_events([Line | Rest]) ->
-    ?event(genesis_wasm_server, {server_logged, Line}),
-    log_server_events(Rest).
\ No newline at end of file
+    ?event(genesis_wasm_server, {server_logged, {string, Line}}),
+    log_server_events(Rest).
+
+%%% Tests
+-ifdef(ENABLE_GENESIS_WASM).
+
+import_legacy_checkpoint_test_() ->
+    { timeout, 900, fun import_legacy_checkpoint/0 }.
+import_legacy_checkpoint() ->
+    application:ensure_all_started(hb),
+    Opts = #{
+        priv_wallet => hb:wallet(),
+        genesis_wasm_import_authorities =>
+            [
+                <<"WjnS-s03HWsDSdMnyTdzB1eHZB2QheUWP_FVRVYxkXk">>
+            ]
+    },
+    ProcID = <<"NTE-RcHEeO15MYMUbXwWytRxn_IUJmXPKPOFVc5qZcg">>,
+    {ok, ProcWithCheckpoint} =
+        hb_ao:resolve(
+           <<"~genesis-wasm@1.0/import&process-id=", ProcID/binary>>,
+           Opts
+        ),
+    ?assertMatch(
+        Slot when Slot > 0,
+        hb_maps:get(<<"at-slot">>, ProcWithCheckpoint)
+    ),
+    ?assertMatch(
+        #{ <<"data">> := Data } when byte_size(Data) > 0,
+        hb_maps:get(<<"snapshot">>, ProcWithCheckpoint)
+    ),
+    ?assertMatch(
+        {ok, Slot, _} when Slot > 0,
+        dev_process_cache:latest(ProcID, Opts)
+    ),
+    {ok, _} = hb_ao:resolve(<<ProcID/binary, "~process@1.0/now">>, Opts).
+
+test_base_process() ->
+    test_base_process(#{}).
+test_base_process(Opts) ->
+    Wallet = hb_opts:get(priv_wallet, hb:wallet(), Opts),
+    Address = hb_util:human_id(ar_wallet:to_address(Wallet)),
+    hb_message:commit(#{
+        <<"device">> => <<"process@1.0">>,
+        <<"scheduler-device">> => <<"scheduler@1.0">>,
+        <<"scheduler-location">> => Address,
+        <<"type">> => <<"Process">>,
+        <<"test-random-seed">> => rand:uniform(1337)
+    }, #{ priv_wallet => Wallet }).
+
+test_wasm_process(WASMImage) ->
+    test_wasm_process(WASMImage, #{}).
+test_wasm_process(WASMImage, Opts) ->
+    Wallet = hb_opts:get(priv_wallet, hb:wallet(), Opts),
+    #{ <<"image">> := WASMImageID } = dev_wasm:cache_wasm_image(WASMImage, Opts),
+    hb_message:commit(
+        maps:merge(
+            hb_message:uncommitted(test_base_process(Opts)),
+            #{
+                <<"execution-device">> => <<"stack@1.0">>,
+                <<"device-stack">> => [<<"WASM-64@1.0">>],
+                <<"image">> => WASMImageID
+            }
+        ),
+        #{ priv_wallet => Wallet }
+    ).
+
+test_wasm_stack_process(Opts, Stack) ->
+    Wallet = hb_opts:get(priv_wallet, hb:wallet(), Opts),
+    Address = hb_util:human_id(ar_wallet:to_address(Wallet)),
+    WASMProc = test_wasm_process(<<"test/aos-2-pure-xs.wasm">>, Opts),
+    hb_message:commit(
+            maps:merge(
+                hb_message:uncommitted(WASMProc),
+                #{
+                    <<"device-stack">> => Stack,
+                    <<"execution-device">> => <<"genesis-wasm@1.0">>,
+                    <<"scheduler-device">> => <<"scheduler@1.0">>,
+                    <<"patch-from">> => <<"/results/outbox">>,
+                    <<"passes">> => 2,
+                    <<"stack-keys">> =>
+                        [
+                            <<"init">>,
+                            <<"compute">>,
+                            <<"snapshot">>,
+                            <<"normalize">>,
+                            <<"compute">>
+                        ],
+                    <<"scheduler">> => Address,
+                    <<"authority">> => Address,
+                    <<"module">> => <<"URgYpPQzvxxfYQtjrIQ116bl3YBfcImo3JEnNo8Hlrk">>,
+                    <<"data-protocol">> => <<"ao">>,
+                    <<"type">> => <<"Process">>
+                }
+            ),
+        #{ priv_wallet => Wallet }
+    ).
+
+test_genesis_wasm_process() ->
+    Opts = #{
+        genesis_wasm_db_dir => "cache-mainnet-test/genesis-wasm",
+        genesis_wasm_checkpoints_dir => "cache-mainnet-test/genesis-wasm/checkpoints",
+        genesis_wasm_log_level => "error",
+        genesis_wasm_port => 6363,
+        execution_device => <<"genesis-wasm@1.0">>
+    },
+    Wallet = hb_opts:get(priv_wallet, hb:wallet(), Opts),
+    Address = hb_util:human_id(ar_wallet:to_address(Wallet)),
+    WASMProc = test_wasm_process(<<"test/aos-2-pure-xs.wasm">>, Opts),
+    hb_message:commit(
+        maps:merge(
+            hb_message:uncommitted(WASMProc),
+            #{
+                <<"execution-device">> => <<"genesis-wasm@1.0">>,
+                <<"scheduler-device">> => <<"scheduler@1.0">>,
+                <<"push-device">> => <<"push@1.0">>,
+                <<"patch-from">> => <<"/results/outbox">>,
+                <<"passes">> => 1,
+                <<"scheduler">> => Address,
+                <<"authority">> => Address,
+                <<"module">> => <<"URgYpPQzvxxfYQtjrIQ116bl3YBfcImo3JEnNo8Hlrk">>,
+                <<"data-protocol">> => <<"ao">>,
+                <<"type">> => <<"Process">>
+            }),
+        #{ priv_wallet => Wallet }
+    ).
+
+schedule_test_message(Msg1, Text) ->
+    schedule_test_message(Msg1, Text, #{}).
+schedule_test_message(Msg1, Text, MsgBase) ->
+    Wallet = hb:wallet(),
+    UncommittedBase = hb_message:uncommitted(MsgBase),
+    Msg2 =
+        hb_message:commit(#{
+                <<"path">> => <<"schedule">>,
+                <<"method">> => <<"POST">>,
+                <<"body">> =>
+                    hb_message:commit(
+                        UncommittedBase#{
+                            <<"type">> => <<"Message">>,
+                            <<"test-label">> => Text
+                        },
+                        #{ priv_wallet => Wallet }
+                    )
+            },
+            #{ priv_wallet => Wallet }
+        ),
+    hb_ao:resolve(Msg1, Msg2, #{}).
+
+schedule_aos_call(Msg1, Code) ->
+    schedule_aos_call(Msg1, Code, <<"Eval">>, #{}).
+schedule_aos_call(Msg1, Code, Action) ->
+    schedule_aos_call(Msg1, Code, Action, #{}).
+schedule_aos_call(Msg1, Code, Action, Opts) ->
+    Wallet = hb_opts:get(priv_wallet, hb:wallet(), Opts),
+    ProcID = hb_message:id(Msg1, all),
+    Msg2 =
+        hb_message:commit(
+            #{
+                <<"action">> => Action,
+                <<"data">> => Code,
+                <<"target">> => ProcID,
+                <<"timestamp">> => os:system_time(millisecond)
+            },
+            #{ priv_wallet => Wallet }
+        ),
+    schedule_test_message(Msg1, <<"TEST MSG">>, Msg2).
+
+spawn_and_execute_slot_test_() ->
+    { timeout, 900, fun spawn_and_execute_slot/0 }.
+spawn_and_execute_slot() ->
+    application:ensure_all_started(hb),
+    Opts = #{
+        priv_wallet => hb:wallet(),
+        cache_control => <<"always">>,
+        store => hb_opts:get(store)
+    },
+    Msg1 = test_genesis_wasm_process(),
+    hb_cache:write(Msg1, Opts),
+    {ok, _SchedInit} = 
+        hb_ao:resolve(
+            Msg1,
+            #{
+                <<"method">> => <<"POST">>,
+                <<"path">> => <<"schedule">>,
+                <<"body">> => Msg1
+            },
+            Opts
+        ),
+    {ok, _} = schedule_aos_call(Msg1, <<"return 1+1">>),
+    {ok, _} = schedule_aos_call(Msg1, <<"return 2+2">>),
+    {ok, SchedulerRes} =
+        hb_ao:resolve(Msg1, #{
+            <<"method">> => <<"GET">>,
+            <<"path">> => <<"schedule">>
+        }, Opts),
+    % Verify process message is scheduled first
+    ?assertMatch(
+        <<"Process">>,
+        hb_ao:get(<<"assignments/0/body/type">>, SchedulerRes)
+    ),
+    % Verify messages are scheduled
+    ?assertMatch(
+        <<"return 1+1">>,
+        hb_ao:get(<<"assignments/1/body/data">>, SchedulerRes)
+    ),
+    ?assertMatch(
+        <<"return 2+2">>,
+        hb_ao:get(<<"assignments/2/body/data">>, SchedulerRes)
+    ),
+    {ok, Result} = hb_ao:resolve(Msg1, #{ <<"path">> => <<"now">> }, Opts),
+    ?assertEqual(<<"4">>, hb_ao:get(<<"results/data">>, Result)).
+
+compare_result_genesis_wasm_and_wasm_test_() ->
+    { timeout, 900, fun compare_result_genesis_wasm_and_wasm/0 }.
+compare_result_genesis_wasm_and_wasm() ->
+    application:ensure_all_started(hb),
+    Opts = #{
+        priv_wallet => hb:wallet(),
+        cache_control => <<"always">>,
+        store => hb_opts:get(store)
+    },
+    % Test with genesis-wasm
+    MsgGenesisWasm = test_genesis_wasm_process(),
+    hb_cache:write(MsgGenesisWasm, Opts),
+    {ok, _SchedInitGenesisWasm} =
+        hb_ao:resolve(
+            MsgGenesisWasm,
+            #{
+                <<"method">> => <<"POST">>,
+                <<"path">> => <<"schedule">>,
+                <<"body">> => MsgGenesisWasm
+            },
+            Opts
+        ),
+    % Test with wasm
+    MsgWasm = test_wasm_stack_process(Opts, [
+        <<"WASI@1.0">>,
+        <<"JSON-Iface@1.0">>,
+        <<"WASM-64@1.0">>,
+        <<"Multipass@1.0">>
+    ]),
+    hb_cache:write(MsgWasm, Opts),
+    {ok, _SchedInitWasm} =
+        hb_ao:resolve(
+            MsgWasm,
+            #{
+                <<"method">> => <<"POST">>,
+                <<"path">> => <<"schedule">>,
+                <<"body">> => MsgWasm
+            },
+            Opts
+        ),
+    % Schedule messages
+    {ok, _} = schedule_aos_call(MsgGenesisWasm, <<"return 1+1">>),
+    {ok, _} = schedule_aos_call(MsgGenesisWasm, <<"return 2+2">>),
+    {ok, _} = schedule_aos_call(MsgWasm, <<"return 1+1">>),
+    {ok, _} = schedule_aos_call(MsgWasm, <<"return 2+2">>),
+    % Get results
+    {ok, ResultGenesisWasm} = 
+        hb_ao:resolve(
+            MsgGenesisWasm,
+            #{ <<"path">> => <<"now">> },
+            Opts
+        ),
+    {ok, ResultWasm} = 
+        hb_ao:resolve(
+            MsgWasm,
+            #{ <<"path">> => <<"now">> },
+            Opts
+        ),
+    ?assertEqual(
+        hb_ao:get(<<"results/data">>, ResultGenesisWasm),
+        hb_ao:get(<<"results/data">>, ResultWasm)
+    ).
+
+send_message_between_genesis_wasm_processes_test_() ->
+    { timeout, 900, fun send_message_between_genesis_wasm_processes/0 }.
+send_message_between_genesis_wasm_processes() ->
+    application:ensure_all_started(hb),
+    Opts = #{
+        priv_wallet => hb:wallet(),
+        cache_control => <<"always">>,
+        store => hb_opts:get(store)
+    },
+    % Create receiver process with handler
+    MsgReceiver = test_genesis_wasm_process(),
+    hb_cache:write(MsgReceiver, Opts),
+    ProcId = dev_process:process_id(MsgReceiver, #{}, #{}),
+    {ok, _SchedInitReceiver} =
+        hb_ao:resolve(
+            MsgReceiver,
+        #{
+            <<"method">> => <<"POST">>,
+            <<"path">> => <<"schedule">>,
+            <<"body">> => MsgReceiver
+        },
+        Opts
+    ),
+    schedule_aos_call(MsgReceiver, <<"Number = 10">>),
+    schedule_aos_call(MsgReceiver, <<"
+    Handlers.add('foo', function(msg)
+        print(\"Number: \" .. Number * 2)
+        return Number * 2 end)
+    ">>),
+    schedule_aos_call(MsgReceiver, <<"return Number">>),
+    {ok, ResultReceiver} = hb_ao:resolve(MsgReceiver, <<"now">>, Opts),
+    ?assertEqual(<<"10">>, hb_ao:get(<<"results/data">>, ResultReceiver)),
+    % Create sender process to send message to receiver
+    MsgSender = test_genesis_wasm_process(),
+    hb_cache:write(MsgSender, Opts),
+    {ok, _SchedInitSender} =
+        hb_ao:resolve(
+            MsgSender,
+            #{
+                <<"method">> => <<"POST">>,
+                <<"path">> => <<"schedule">>,
+                <<"body">> => MsgSender
+            },
+            Opts
+        ),
+    {ok, SendMsgToReceiver} =
+        schedule_aos_call(
+            MsgSender,
+            <<"Send({ Target = \"", ProcId/binary, "\", Action = \"foo\" })">>
+        ),
+    {ok, ResultSender} = hb_ao:resolve(MsgSender, <<"now">>, Opts),
+    {ok, Slot} = hb_ao:resolve(SendMsgToReceiver, <<"slot">>, Opts),
+    {ok, Res} = 
+        hb_ao:resolve(
+            MsgSender,
+            #{
+                <<"path">> => <<"push">>,
+                <<"slot">> => Slot,
+                <<"result-depth">> => 1
+            },
+            Opts
+        ),
+    % Get schedule for receiver
+    {ok, ScheduleReceiver} =
+        hb_ao:resolve(
+            MsgReceiver,
+            #{
+                <<"method">> => <<"GET">>,
+                <<"path">> => <<"schedule">>
+            },
+            Opts
+        ),
+    ?assertEqual(
+        <<"foo">>,
+        hb_ao:get(<<"assignments/4/body/action">>, ScheduleReceiver)
+    ),
+    {ok, NewResultReceiver} = hb_ao:resolve(MsgReceiver, <<"now">>, Opts),
+    ?assertEqual(
+        <<"Number: 20">>,
+        hb_ao:get(<<"results/data">>, NewResultReceiver)
+    ).
+
+dryrun_genesis_wasm_test_() ->  
+    { timeout, 900, fun dryrun_genesis_wasm/0 }.
+dryrun_genesis_wasm() ->
+    application:ensure_all_started(hb),
+    Opts = #{
+        priv_wallet => hb:wallet(),
+        cache_control => <<"always">>,
+        store => hb_opts:get(store)
+    },
+    % Set up process with increment handler to receive messages
+    ProcReceiver = test_genesis_wasm_process(),
+    hb_cache:write(ProcReceiver, #{}),
+    {ok, _SchedInit1} = 
+        hb_ao:resolve(
+            ProcReceiver,
+            #{
+                <<"method">> => <<"POST">>,
+                <<"path">> => <<"schedule">>,
+                <<"body">> => ProcReceiver
+            },
+            Opts
+        ),
+    ProcReceiverId = dev_process:process_id(ProcReceiver, #{}, #{}),
+    % Initialize increment handler
+    {ok, _} = schedule_aos_call(ProcReceiver, <<"
+    Number = Number or 5
+    Handlers.add('Increment', function(msg) 
+        Number = Number + 1
+        ao.send({ Target = msg.From, Data = 'The current number is ' .. Number .. '!' })
+        return 'The current number is ' .. Number .. '!'
+    end)
+    ">>),
+    % Ensure Handlers were properly added
+    schedule_aos_call(ProcReceiver, <<"return #Handlers.list">>),
+    {ok, NumHandlers} =
+        hb_ao:resolve(
+            ProcReceiver,
+            <<"now/results/data">>,
+            Opts
+        ),
+    % _eval, _default, Increment
+    ?assertEqual(<<"3">>, NumHandlers),
+
+    schedule_aos_call(ProcReceiver, <<"return Number">>),
+    {ok, InitialNumber} = 
+        hb_ao:resolve(
+            ProcReceiver, 
+            <<"now/results/data">>,
+            Opts
+        ),
+    % Number is initialized to 5
+    ?assertEqual(<<"5">>, InitialNumber),
+    % Set up sender process to send Action: Increment to receiver
+    ProcSender = test_genesis_wasm_process(),
+    hb_cache:write(ProcSender, #{}),
+    {ok, _SchedInit2} = hb_ao:resolve(
+        ProcSender,
+        #{
+            <<"method">> => <<"POST">>,
+            <<"path">> => <<"schedule">>,
+            <<"body">> => ProcSender
+        },
+        Opts
+    ),
+    % First increment + push
+    {ok, ToPush}  = 
+        schedule_aos_call(
+            ProcSender,
+            <<
+                "Send({ Target = \"",
+                (ProcReceiverId)/binary,
+                "\", Action = \"Increment\" })"
+            >>
+        ),
+    SlotToPush = hb_ao:get(<<"slot">>, ToPush, Opts),
+    ?assertEqual(1, SlotToPush),
+    {ok, PushRes1} = 
+        hb_ao:resolve(
+            ProcSender,
+            #{
+                <<"path">> => <<"push">>,
+                <<"slot">> => SlotToPush,
+                <<"result-depth">> => 1
+            },
+            Opts
+        ),
+    % Check that number incremented normally
+    schedule_aos_call(ProcReceiver, <<"return Number">>),
+    {ok, AfterIncrementResult} =
+        hb_ao:resolve(
+            ProcReceiver, 
+            <<"now/results/data">>, 
+            Opts
+        ),
+    ?assertEqual(<<"6">>, AfterIncrementResult),
+
+    % Send another increment and push it
+    {ok, ToPush2}  = 
+        schedule_aos_call(
+            ProcSender,
+            <<
+                "Send({ Target = \"",
+                (ProcReceiverId)/binary,
+                "\", Action = \"Increment\" })"
+            >>
+        ),
+    SlotToPush2 = hb_ao:get(<<"slot">>, ToPush2, Opts),
+    ?assertEqual(3, SlotToPush2),
+    {ok, PushRes2} = 
+        hb_ao:resolve(
+            ProcSender,
+            #{
+                <<"path">> => <<"push">>,
+                <<"slot">> => SlotToPush2,
+                <<"result-depth">> => 1
+            },
+            Opts
+        ),
+    % Check that number incremented normally
+    schedule_aos_call(ProcReceiver, <<"return Number">>),
+    {ok, AfterIncrementResult2} =
+        hb_ao:resolve(
+            ProcReceiver, 
+            <<"now/results/data">>, 
+            Opts
+        ),
+    ?assertEqual(<<"7">>, AfterIncrementResult2),
+    % Test dryrun by calling compute with no assignment 
+    % Should return result without changing state
+    DryrunMsg =
+        hb_message:commit(
+            #{
+                <<"path">> => <<"as/compute">>,
+                <<"as-device">> => <<"execution">>,
+                <<"action">> => <<"Increment">>,
+                <<"target">> => ProcReceiverId
+            },
+            Opts
+        ),
+    {ok, DryrunResult} = hb_ao:resolve(ProcReceiver, DryrunMsg, Opts),
+    {ok, DryrunData} = 
+        hb_ao:resolve(DryrunResult, <<"results/outbox/1/Data">>, Opts),
+    ?assertEqual(<<"The current number is 8!">>, DryrunData),
+    % Ensure that number did not increment
+    schedule_aos_call(ProcReceiver, <<"return Number">>),
+    {ok, AfterDryrunResult} =
+        hb_ao:resolve(
+            ProcReceiver, 
+            <<"now/results/data">>, 
+            Opts
+        ),
+    ?assertEqual(<<"7">>, AfterDryrunResult).
+-endif.
diff --git a/src/dev_green_zone.erl b/src/dev_green_zone.erl
index 78609b7bd..78ce51ee8 100644
--- a/src/dev_green_zone.erl
+++ b/src/dev_green_zone.erl
@@ -5,7 +5,7 @@
 %%% and node identity cloning. All operations are protected by hardware 
 %%% commitment and encryption.
 -module(dev_green_zone).
--export([info/1, info/3, join/3, init/3, become/3, key/3]).
+-export([info/1, info/3, join/3, init/3, become/3, key/3, is_trusted/3]).
 -include("include/hb.hrl").
 -include_lib("eunit/include/eunit.hrl").
 -include_lib("public_key/include/public_key.hrl").
@@ -18,7 +18,17 @@
 %% @param _ Ignored parameter
 %% @returns A map with the `exports' key containing a list of allowed functions
 info(_) -> 
-    #{ exports => [info, init, join, become, key] }.
+    #{
+        exports =>
+            [
+                <<"info">>,
+                <<"init">>,
+                <<"join">>,
+                <<"become">>,
+                <<"key">>,
+                <<"is_trusted">>
+            ]
+    }.
 
 %% @doc Provides information about the green zone device and its API.
 %%
@@ -50,10 +60,6 @@ info(_Msg1, _Msg2, _Opts) ->
                 <<"required_node_opts">> => #{
                     <<"green_zone_peer_location">> => <<"Target peer's address">>,
                     <<"green_zone_peer_id">> => <<"Target peer's unique identifier">>
-                },
-                <<"optional_node_opts">> => #{
-                    <<"green_zone_adopt_config">> => 
-                        <<"Whether to adopt peer's configuration (default: true)">>
                 }
             },
             <<"key">> => #{
@@ -88,16 +94,55 @@ info(_Msg1, _Msg2, _Opts) ->
 -spec default_zone_required_opts(Opts :: map()) -> map().
 default_zone_required_opts(Opts) ->
     #{
-        trusted_device_signers => hb_opts:get(trusted_device_signers, [], Opts),
-        load_remote_devices => hb_opts:get(load_remote_devices, false, Opts),
-        preload_devices => hb_opts:get(preload_devices, [], Opts),
-        % store => hb_opts:get(store, [], Opts),
-        routes => hb_opts:get(routes, [], Opts),
-        on => hb_opts:get(on, undefined, Opts),
-        scheduling_mode => disabled,
-        initialized => permanent
+        % trusted_device_signers => hb_opts:get(trusted_device_signers, [], Opts),
+        % load_remote_devices => hb_opts:get(load_remote_devices, false, Opts),
+        % preload_devices => hb_opts:get(preload_devices, [], Opts),
+        % % store => hb_opts:get(store, [], Opts),
+        % routes => hb_opts:get(routes, [], Opts),
+        % on => hb_opts:get(on, undefined, Opts),
+        % scheduling_mode => disabled,
+        % initialized => permanent
     }.
 
+%% @doc Replace values of <<"self">> in a configuration map with corresponding values from Opts.
+%%
+%% This function iterates through all key-value pairs in the configuration map.
+%% If a value is <<"self">>, it replaces that value with the result of
+%% hb_opts:get(Key, not_found, Opts) where Key is the corresponding key.
+%%
+%% @param Config The configuration map to process
+%% @param Opts The options map to fetch replacement values from
+%% @returns A new map with <<"self">> values replaced
+-spec replace_self_values(Config :: map(), Opts :: map()) -> map().
+replace_self_values(Config, Opts) ->
+    maps:map(
+        fun(Key, Value) ->
+            case Value of
+                <<"self">> ->
+                    hb_opts:get(Key, not_found, Opts);
+                _ ->
+                    Value
+            end
+        end,
+        Config
+    ).
+
+%% @doc Returns `true' if the request is signed by a trusted node.
+is_trusted(_M1, Req, Opts) ->
+    Signers = hb_message:signers(Req, Opts),
+    {ok,
+        hb_util:bin(
+            lists:any(
+                fun(Signer) ->
+                    lists:member(
+                        Signer,
+                        maps:keys(hb_opts:get(trusted_nodes, #{}, Opts))
+                    )
+                end,
+                Signers
+            )
+        )
+    }.
 
 %% @doc Initialize the green zone for a node.
 %%
@@ -121,14 +166,18 @@ default_zone_required_opts(Opts) ->
 -spec init(M1 :: term(), M2 :: term(), Opts :: map()) -> {ok, binary()} | {error, binary()}.
 init(_M1, _M2, Opts) ->
     ?event(green_zone, {init, start}),
-    case hb_opts:validate_node_history(Opts) of
-        {ok, 1} ->
+    case hb_opts:get(green_zone_initialized, false, Opts) of
+        true ->
+            {error, <<"Green zone already initialized.">>};
+        false ->
             RequiredConfig = hb_opts:get(
                 <<"green_zone_required_config">>,
                 default_zone_required_opts(Opts),
                 Opts
             ),
-            ?event(green_zone, {init, required_config, RequiredConfig}),
+            % Process RequiredConfig to replace <<"self">> values with actual values from Opts
+            ProcessedRequiredConfig = replace_self_values(RequiredConfig, Opts),
+            ?event(green_zone, {init, required_config, ProcessedRequiredConfig}),
             % Check if a wallet exists; create one if absent.
             NodeWallet = case hb_opts:get(priv_wallet, undefined, Opts) of
                 undefined -> 
@@ -150,16 +199,16 @@ init(_M1, _M2, Opts) ->
                         ExistingAES
                 end,
             % Store the wallet, AES key, and an empty trusted nodes map.
-            hb_http_server:set_opts(Opts#{
+            hb_http_server:set_opts(NewOpts =Opts#{
                 priv_wallet => NodeWallet,
                 priv_green_zone_aes => GreenZoneAES,
                 trusted_nodes => #{},
-                green_zone_required_opts => RequiredConfig
+                green_zone_required_opts => ProcessedRequiredConfig,
+                green_zone_initialized => true
             }),
+            try_mount_encrypted_volume(GreenZoneAES, NewOpts),
             ?event(green_zone, {init, complete}),
-            {ok, <<"Green zone initialized successfully.">>};
-        {error, Reason} ->
-            {error, Reason}
+            {ok, <<"Green zone initialized successfully.">>}
     end.
     
 
@@ -190,18 +239,15 @@ init(_M1, _M2, Opts) ->
         {ok, map()} | {error, binary()}.
 join(M1, M2, Opts) ->
     ?event(green_zone, {join, start}),
-    case hb_opts:validate_node_history(Opts, 0, 1) of
-        {ok, _N} ->
-            PeerLocation = hb_opts:get(<<"green_zone_peer_location">>, undefined, Opts),
-            PeerID = hb_opts:get(<<"green_zone_peer_id">>, undefined, Opts),
-            ?event(green_zone, {join_peer, PeerLocation, PeerID}),
-            if (PeerLocation =:= undefined) or (PeerID =:= undefined) ->
-                validate_join(M1, M2, Opts);
-            true ->
-                join_peer(PeerLocation, PeerID, M1, M2, Opts)
-            end;
-        {error, Reason} ->
-            {error, Reason}
+    PeerLocation = hb_opts:get(<<"green_zone_peer_location">>, undefined, Opts),
+    PeerID = hb_opts:get(<<"green_zone_peer_id">>, undefined, Opts),
+    Identities = hb_opts:get(identities, #{}, Opts),
+    HasGreenZoneIdentity = maps:is_key(<<"green-zone">>, Identities),
+    ?event(green_zone, {join_peer, PeerLocation, PeerID, HasGreenZoneIdentity}),
+    if (not HasGreenZoneIdentity) andalso (PeerLocation =/= undefined) andalso (PeerID =/= undefined) ->
+        join_peer(PeerLocation, PeerID, M1, M2, Opts);
+    true ->
+        validate_join(M1, M2, hb_cache:ensure_all_loaded(Opts, Opts))
     end.
 
 %% @doc Encrypts and provides the node's private key for secure sharing.
@@ -228,7 +274,12 @@ key(_M1, _M2, Opts) ->
     ?event(green_zone, {get_key, start}),
     % Retrieve the shared AES key and the node's wallet.
     GreenZoneAES = hb_opts:get(priv_green_zone_aes, undefined, Opts),
-    {{KeyType, Priv, Pub}, _PubKey} = hb_opts:get(priv_wallet, undefined, Opts),
+    Identities = hb_opts:get(identities, #{}, Opts),
+    Wallet = case maps:find(<<"green-zone">>, Identities) of
+        {ok, #{priv_wallet := GreenZoneWallet}} -> GreenZoneWallet;
+        _ -> hb_opts:get(priv_wallet, undefined, Opts)
+    end,
+    {{KeyType, Priv, Pub}, _PubKey} = Wallet,
     ?event(green_zone, 
         {get_key, wallet, hb_util:human_id(ar_wallet:to_address(Pub))}),
     case GreenZoneAES of
@@ -298,8 +349,8 @@ become(_M1, _M2, Opts) ->
             ?event(green_zone, {become, getting_key, NodeLocation, NodeID}),
             {ok, KeyResp} = hb_http:get(NodeLocation, 
                                        <<"/~greenzone@1.0/key">>, Opts),
-            Signers = hb_message:signers(KeyResp),
-            case hb_message:verify(KeyResp, Signers) and 
+            Signers = hb_message:signers(KeyResp, Opts),
+            case hb_message:verify(KeyResp, Signers, Opts) and 
                  lists:member(NodeID, Signers) of
                 false ->
                     % The response is not from the expected peer.
@@ -339,22 +390,29 @@ finalize_become(KeyResp, NodeLocation, NodeID, GreenZoneAES, Opts) ->
     {KeyType, Priv, Pub} = binary_to_term(DecryptedBin),
     % Print the keypair
     ?event(green_zone, {become, keypair, Pub}),
-    % 8. Update the local wallet with the target node's keypair, thereby
-    %    cloning its identity.
-    ok = hb_http_server:set_opts(Opts#{
-        priv_wallet => {{KeyType, Priv, Pub}, {KeyType, Pub}}
-    }),
-    % Print the updated wallet address
-    Wallet = hb_opts:get(priv_wallet, undefined, Opts),
-    ?event(green_zone,
-        {become, wallet, hb_util:human_id(ar_wallet:to_address(Wallet))}
-    ),
+    % 8. Add the target node's keypair to the local node's identities.
+    GreenZoneWallet = {{KeyType, Priv, Pub}, {KeyType, Pub}},
+    Identities = hb_opts:get(identities, #{}, Opts),
+    UpdatedIdentities = Identities#{
+        <<"green-zone">> => #{
+            priv_wallet => GreenZoneWallet
+        }
+    },
+    NewOpts = Opts#{
+        identities => UpdatedIdentities
+    },
+    ok = 
+        hb_http_server:set_opts(
+            NewOpts
+        ),
+    try_mount_encrypted_volume(GreenZoneWallet, NewOpts),
     ?event(green_zone, {become, update_wallet, complete}),
     {ok, #{
-        <<"status">> => 200,
-        <<"message">> => <<"Successfully adopted target node identity">>,
-        <<"peer-location">> => NodeLocation,
-        <<"peer-id">> => NodeID
+        <<"body">> => #{
+            <<"message">> => <<"Successfully adopted target node identity">>,
+            <<"peer-location">> => NodeLocation,
+            <<"peer-id">> => NodeID
+        }
     }}.
 
 %% @doc Processes a join request to a specific peer node.
@@ -382,40 +440,42 @@ finalize_become(KeyResp, NodeLocation, NodeID, GreenZoneAES, Opts) ->
     M1 :: term(),
     M2 :: term(),
     Opts :: map()) -> {ok, map()} | {error, map() | binary()}.
-join_peer(PeerLocation, PeerID, _M1, M2, InitOpts) ->
+join_peer(PeerLocation, PeerID, _M1, _M2, InitOpts) ->
     % Check here if the node is already part of a green zone.
     GreenZoneAES = hb_opts:get(priv_green_zone_aes, undefined, InitOpts),
-    case (GreenZoneAES == undefined) andalso 
-         maybe_set_zone_opts(PeerLocation, PeerID, M2, InitOpts) of
-        {ok, Opts} ->
-            Wallet = hb_opts:get(priv_wallet, undefined, Opts),
-            {ok, Report} = dev_snp:generate(#{}, #{}, Opts),
+    case GreenZoneAES == undefined of
+        true ->
+            Wallet = hb_opts:get(priv_wallet, undefined, InitOpts),
+            {ok, Report} = dev_snp:generate(#{}, #{}, InitOpts),
             WalletPub = element(2, Wallet),
             ?event(green_zone, {remove_uncommitted, Report}),
             MergedReq = hb_ao:set(
                 Report, 
-                <<"public-key">>,
+                <<"public_key">>,
                 base64:encode(term_to_binary(WalletPub)),
-                Opts
+                InitOpts
             ),
             % Create an committed join request using the wallet.
-            Req = hb_message:commit(MergedReq, Wallet),
+            Req = hb_cache:ensure_all_loaded(
+                hb_message:commit(MergedReq, Wallet),
+                InitOpts
+            ),
             ?event({join_req, {explicit, Req}}),
             ?event({verify_res, hb_message:verify(Req)}),
             % Log that the commitment report is being sent to the peer.
             ?event(green_zone, {join, sending_commitment, PeerLocation, PeerID, Req}),
-            case hb_http:post(PeerLocation, <<"/~greenzone@1.0/join">>, Req, Opts) of
+            case hb_http:post(PeerLocation, <<"/~greenzone@1.0/join">>, Req, InitOpts) of
                 {ok, Resp} ->
                     % Log the response received from the peer.
                     ?event(green_zone, {join, join_response, PeerLocation, PeerID, Resp}),
                     % Ensure that the response is from the expected peer, avoiding
                     % the risk of a man-in-the-middle attack.
-                    Signers = hb_message:signers(Resp),
-                    ?event(green_zone, {join, signers, Signers}),
-                    IsVerified = hb_message:verify(Resp, Signers),
-                    ?event(green_zone, {join, verify, IsVerified}),
-                    IsPeerSigner = lists:member(PeerID, Signers),
-                    ?event(green_zone, {join, peer_is_signer, IsPeerSigner, PeerID}),	
+                    Signers = hb_message:signers(Resp, InitOpts),
+					?event(green_zone, {join, signers, Signers}),
+					IsVerified = hb_message:verify(Resp, Signers, InitOpts),
+					?event(green_zone, {join, verify, IsVerified}),
+					IsPeerSigner = lists:member(PeerID, Signers),
+					?event(green_zone, {join, peer_is_signer, IsPeerSigner, PeerID}),	
                     case IsPeerSigner andalso IsVerified of
                         false ->
                             % The response is not from the expected peer.
@@ -423,20 +483,17 @@ join_peer(PeerLocation, PeerID, _M1, M2, InitOpts) ->
                         true ->
                             % Extract the encrypted shared AES key (zone-key) 
                             % from the response.
-                            ZoneKey = hb_ao:get(<<"zone-key">>, Resp, Opts),
+                            ZoneKey = hb_ao:get(<<"zone-key">>, Resp, InitOpts),
                             % Decrypt the zone key using the local node's
                             % private key.
-                            {ok, AESKey} = decrypt_zone_key(ZoneKey, Opts),
+                            {ok, AESKey} = decrypt_zone_key(ZoneKey, InitOpts),
                             % Update local configuration with the retrieved
                             % shared AES key.
-                            ?event(green_zone, {oldOpts, {explicit, InitOpts}}),
-                            ?event(green_zone, {newOpts, {explicit, Opts}}),
-                            NewOpts = Opts#{
+                            ?event(green_zone, {opts, {explicit, InitOpts}}),
+                            NewOpts = InitOpts#{
                                 priv_green_zone_aes => AESKey
                             },
                             hb_http_server:set_opts(NewOpts),
-                            ?event(successfully_joined_greenzone),
-                            try_mount_encrypted_volume(AESKey, NewOpts),
                             {ok, #{ 
                                 <<"body">> => 
                                     <<"Node joined green zone successfully.">>, 
@@ -467,122 +524,6 @@ join_peer(PeerLocation, PeerID, _M1, M2, InitOpts) ->
             {error, Reason}
     end.
 
-%% @doc Adopts configuration from a peer when joining a green zone.
-%%
-%% This function handles the conditional adoption of peer configuration:
-%% 1. Checks if adoption is enabled (default: true)
-%% 2. Requests required configuration from the peer
-%% 3. Verifies the authenticity of the configuration
-%% 4. Creates a node message with appropriate settings
-%% 5. Updates the local node configuration
-%%
-%% Config options:
-%% - green_zone_adopt_config: Controls configuration adoption (boolean, list, or binary)
-%%
-%% @param PeerLocation The location of the peer node to join
-%% @param PeerID The ID of the peer node to join
-%% @param Req The request message with adoption preferences
-%% @param InitOpts A map of initial configuration options
-%% @returns `{ok, Map}' with updated configuration on success, or
-%% `{error, Binary}' if configuration retrieval fails
--spec maybe_set_zone_opts(
-    PeerLocation :: binary(),
-    PeerID :: binary(),
-    Req :: map(),
-    InitOpts :: map()) -> {ok, map()} | {error, binary()}.
-maybe_set_zone_opts(PeerLocation, PeerID, Req, InitOpts) ->
-    case hb_opts:get(<<"green_zone_adopt_config">>, true, InitOpts) of
-        false ->
-            % The node operator does not want to adopt the peer's config. Return
-            % the initial options unchanged.
-            {ok, InitOpts};
-        AdoptConfig ->
-            ?event(green_zone, 
-                {adopt_config, AdoptConfig, PeerLocation, PeerID, InitOpts}
-            ),
-            % Request the required config from the peer.
-            RequiredConfigRes =
-                hb_http:get(
-                    PeerLocation,
-                    <<"/~meta@1.0/info/green_zone_required_opts">>,
-                    InitOpts
-                ),
-            % Ensure the response is okay.
-            ?event({req_opts_get_result, RequiredConfigRes}),
-            case RequiredConfigRes of
-                {error, Reason} ->
-                    % Log the error and return the initial options.
-                    ?event(green_zone, 
-                        {join_error, get_req_opts_failed, Reason}
-                    ),
-                    {error, <<"Could not get required config from peer.">>};
-                {ok, RequiredConfig} ->
-                    % Print the required config response.
-                    Signers = hb_message:signers(RequiredConfig),
-                    ?event(green_zone, {req_conf_signers, {explicit, Signers}}),
-                    % Extract and log the verification steps
-                    IsVerified = hb_message:verify(RequiredConfig, Signers),
-                    ?event(green_zone, 
-                        {req_opts, {verified, IsVerified}, {signers, Signers}}
-                    ),
-                    % Combined check
-                    case lists:member(PeerID, Signers) andalso IsVerified of
-                        false ->
-                            % The response is not from the expected peer.
-                            {
-                                error, 
-                                <<"Peer gave invalid signature for required config.">>
-                            };
-                        true ->
-                            % Generate the node message that should be set prior
-                            % to joining a green zone.
-                            NodeMessage =
-                                calculate_node_message(
-                                    RequiredConfig, 
-                                    Req, 
-                                    AdoptConfig
-                                ),
-                            % Adopt the node message.
-                            hb_http_server:set_opts(NodeMessage, InitOpts)
-                    end
-            end
-    end.
-
-%% @doc Generate the node message that should be set prior to joining 
-%% a green zone.
-%%
-%% This function takes a required opts message, a request message, and an 
-%% `adopt-config' value. The `adopt-config' value can be a boolean, a list of
-%% fields that should be included in the node message from the request, or a
-%% binary string of fields to include, separated by commas.
-%%
-%% @param RequiredOpts The required configuration options from the peer node.
-%% @param Req The request message containing configuration options.
-%% @param AdoptConfig Boolean, list, or binary string indicating which fields
-%% to adopt.
-%% @returns A map containing the merged configuration to be used as the
-%% node message.
-calculate_node_message(RequiredOpts, Req, true) ->
-    % Remove irrelevant fields from the request.
-    StrippedReq =
-        maps:without(
-            [
-                <<"green_zone_adopt_config">>, <<"green_zone_peer_location">>,
-                <<"green_zone_peer_id">>, <<"path">>, <<"method">>
-            ],
-            hb_message:uncommitted(Req)
-        ),
-    % Convert atoms to binaries in RequiredOpts to prevent
-    % binary_to_existing_atom errors.
-    % The required config should override the request, if necessary.
-    maps:merge(StrippedReq, RequiredOpts);
-calculate_node_message(RequiredOpts, Req, <<"true">>) ->
-    calculate_node_message(RequiredOpts, Req, true);
-calculate_node_message(RequiredOpts, Req, List) when is_list(List) ->
-    calculate_node_message(RequiredOpts, maps:with(List, Req), true);
-calculate_node_message(RequiredOpts, Req, BinList) when is_binary(BinList) ->
-    calculate_node_message(RequiredOpts, hb_util:list(BinList), Req).
-
 %%%--------------------------------------------------------------------
 %%% Internal Functions
 %%%--------------------------------------------------------------------
@@ -605,7 +546,7 @@ calculate_node_message(RequiredOpts, Req, BinList) when is_binary(BinList) ->
 %% `{error, Binary}' on failure with error message
 -spec validate_join(M1 :: term(), Req :: map(), Opts :: map()) ->
         {ok, map()} | {error, binary()}.
-validate_join(_M1, Req, Opts) ->
+validate_join(M1, Req, Opts) ->
     case validate_peer_opts(Req, Opts) of
         true -> do_nothing;
         false -> throw(invalid_join_request)
@@ -616,19 +557,23 @@ validate_join(_M1, Req, Opts) ->
     NodeAddr = hb_ao:get(<<"address">>, Req, Opts),
     ?event(green_zone, {join, extract, {node_addr, NodeAddr}}),
     % Retrieve and decode the joining node's public key.
-    EncodedPubKey = hb_ao:get(<<"public-key">>, Req, Opts),
+    ?event(green_zone, {m1, {explicit, M1}}),
+    ?event(green_zone, {req, {explicit, Req}}),
+    EncodedPubKey = hb_ao:get(<<"public_key">>, Req, Opts),
+    ?event(green_zone, {encoded_pub_key, {explicit, EncodedPubKey}}),
     RequesterPubKey = case EncodedPubKey of
         not_found -> not_found;
         Encoded -> binary_to_term(base64:decode(Encoded))
     end,
-    ?event(green_zone, {join, public_key, ok}),
+    ?event(green_zone, {public_key, {explicit, RequesterPubKey}}),
     % Verify the commitment report provided in the join request.
-    case dev_snp:verify(Req, #{<<"target">> => <<"self">>}, Opts) of
-        {ok, true} ->
+    case dev_snp:verify(M1, Req, Opts) of
+        {ok, <<"true">>} ->
             % Commitment verified.
             ?event(green_zone, {join, commitment, verified}),
             % Retrieve the shared AES key used for encryption.
             GreenZoneAES = hb_opts:get(priv_green_zone_aes, undefined, Opts),
+            ?event(green_zone, {green_zone_aes, {explicit, GreenZoneAES}}),
             % Retrieve the local node's wallet to extract its public key.
             {WalletPubKey, _} = hb_opts:get(priv_wallet, undefined, Opts),
             % Add the joining node's details to the trusted nodes list.
@@ -643,9 +588,9 @@ validate_join(_M1, Req, Opts) ->
                 <<"body">>         => <<"Node joined green zone successfully.">>,
                 <<"node-address">> => NodeAddr,
                 <<"zone-key">>     => base64:encode(EncryptedPayload),
-                <<"public-key">>   => WalletPubKey
+                <<"public_key">>   => WalletPubKey
             }};
-        {ok, false} ->
+        {ok, <<"false">>} ->
             % Commitment failed.
             ?event(green_zone, {join, commitment, failed}),
             {error, <<"Received invalid commitment report.">>};
@@ -674,58 +619,35 @@ validate_peer_opts(Req, Opts) ->
     RequiredConfig =
         hb_ao:normalize_keys(
             hb_opts:get(green_zone_required_opts, #{}, Opts)),
-    ?event(green_zone, {validate_peer_opts, required_config, RequiredConfig}),
+    ConvertedRequiredConfig = 
+        hb_message:uncommitted(
+            hb_cache:ensure_all_loaded(
+                hb_message:commit(RequiredConfig, Opts),
+                Opts
+            )
+        ),
+    ?event(green_zone, {validate_peer_opts, required_config, ConvertedRequiredConfig}),
     PeerOpts =
         hb_ao:normalize_keys(
             hb_ao:get(<<"node-message">>, Req, undefined, Opts)),
-    ?event(green_zone, {validate_peer_opts, peer_opts, PeerOpts}),
-    % Add the required config itself to the required options of the peer. This
-    % enforces that the new peer will also enforce the required config on peers
-    % that join them.
-    FullRequiredOpts = RequiredConfig#{
-        green_zone_required_opts => RequiredConfig
-    },
-    ?event(green_zone, 
-        {validate_peer_opts, full_required_opts, FullRequiredOpts}
-    ),
-    % Debug: Check if PeerOpts is a map
-    ?event(green_zone, 
-        {validate_peer_opts, is_map_peer_opts, is_map(PeerOpts)}
-    ),
-    % Debug: Get node_history safely
-    NodeHistory = hb_ao:get(<<"node_history">>, PeerOpts, [], Opts),
-    ?event(green_zone, {validate_peer_opts, node_history, NodeHistory}),
-    % Debug: Check length of node_history
-    case NodeHistory of
-        List when length(List) =< 1 ->
-            ?event(green_zone, 
-                {validate_peer_opts, history_check, correct_length}
-            ),
-            % Debug: Try the match check separately
-            try
-                MatchCheck =
-                    hb_message:match(PeerOpts, FullRequiredOpts, only_present) ==
-                        true,
-                ?event(green_zone, 
-                    {validate_peer_opts, match_check, MatchCheck}
-                ),
-                % Final result
-                ?event(green_zone, 
-                    {validate_peer_opts, final_result, MatchCheck}
-                ),
-                MatchCheck
+    % Validate each item in node_history has required options
+    Result = try
+        case hb_opts:ensure_node_history(PeerOpts, ConvertedRequiredConfig) of
+            {ok, _} -> 
+                ?event(green_zone, {validate_peer_opts, history_items_check, valid}),
+                true;
+            {error, ErrorMsg} ->
+                ?event(green_zone, {validate_peer_opts, history_items_check, {invalid, ErrorMsg}}),
+                false
+        end
             catch
-                Error:Reason:Stacktrace ->
-                    ?event(green_zone,
-                        {validate_peer_opts,
-                            match_error,
-                            {Error, Reason, Stacktrace}
-                        }
-                    ),
+        HistError:HistReason:HistStacktrace ->
+            ?event(green_zone, {validate_peer_opts, history_items_error, 
+                {HistError, HistReason, HistStacktrace}}),
                     false
-            end;
-        false -> {error, not_a_list}
-    end.
+    end,
+    ?event(green_zone, {validate_peer_opts, final_result, Result}),
+    Result.
 
 %% @doc Adds a node to the trusted nodes list with its commitment report.
 %%
@@ -820,22 +742,23 @@ decrypt_zone_key(EncZoneKey, Opts) ->
 %% The encryption key used for the volume is the same AES key used for green zone
 %% communication, ensuring that only nodes in the green zone can access the data.
 %%
-%% @param AESKey The AES key obtained from joining the green zone.
+%% @param Key The password for the encrypted volume.
 %% @param Opts A map of configuration options.
 %% @returns ok (implicit) in all cases, with detailed event logs of the results.
-try_mount_encrypted_volume(AESKey, Opts) ->
-    ?event(green_zone, {try_mount_encrypted_volume, start}),
+try_mount_encrypted_volume(Key, Opts) ->
+    ?event(debug_volume, {try_mount_encrypted_volume, start}),
     % Set up options for volume mounting with default paths
     VolumeOpts = Opts#{
-        volume_key => AESKey
+        priv_volume_key => Key,
+        volume_skip_decryption => <<"true">>
     },
     % Call the dev_volume:mount function to handle the complete process
     case dev_volume:mount(undefined, undefined, VolumeOpts) of
         {ok, Result} ->
-            ?event(green_zone, {volume_mount, success, Result}),
+            ?event(debug_volume, {volume_mount, success, Result}),
             ok;
         {error, Error} ->
-            ?event(green_zone, {volume_mount, error, Error}),
+            ?event(debug_volume, {volume_mount, error, Error}),
             ok % Still return ok as this is an optional operation
     end.
 
@@ -869,5 +792,4 @@ rsa_wallet_integration_test() ->
     % Verify roundtrip
     ?assertEqual(PlainText, Decrypted),
     % Verify wallet structure
-    ?assertEqual(KeyType, {rsa, 65537}).
-
+    ?assertEqual(KeyType, {rsa, 65537}).
\ No newline at end of file
diff --git a/src/dev_hook.erl b/src/dev_hook.erl
index 2cb17f3e9..043d23f3f 100644
--- a/src/dev_hook.erl
+++ b/src/dev_hook.erl
@@ -55,6 +55,7 @@
 %%% node operator to register hooks to the node and find those that are
 %%% currently active.
 -module(dev_hook).
+%%% Backend API for calling hooks, used by devices as well as AO-Core.
 -export([info/1, on/3, find/2, find/3]).
 -include("include/hb.hrl").
 -include_lib("eunit/include/eunit.hrl").
@@ -119,13 +120,12 @@ execute_handlers(HookName, [Handler|Rest], Req, Opts) ->
             % If status is ok, continue with the next handler
             ?event(hook, {handler_executed_successfully, HookName, NewReq}),
             execute_handlers(HookName, Rest, NewReq, Opts);
-        {error, _} = Error ->
+        {Status, Res} ->
             % If status is error, halt execution and return the error
-            ?event({handler_error, HookName, Error}),
-            Error;
+            {Status, Res};
         Other ->
             % If status is unknown, convert to error and halt execution
-            ?event({unexpected_handler_result, HookName, Other}),
+            ?event(hook_error, {unexpected_handler_result, HookName, Other}),
             {failure,
                 <<
                     "Handler for hook `",
@@ -160,10 +160,21 @@ execute_handler(HookName, Handler, Req, Opts) ->
                 <<"path">> => hb_ao:get(<<"path">>, Handler, HookName, Opts),
                 <<"method">> => hb_ao:get(<<"method">>, Handler, <<"GET">>, Opts)
             },
-        PreparedReq =
-            case hb_ao:get(<<"hook/commit-request">>, Handler, false, Opts) of
-                true -> hb_message:commit(BaseReq, Opts);
-                false -> BaseReq
+        CommitReqBin = 
+            hb_util:bin(
+                hb_ao:get(<<"hook/commit-request">>, Handler, <<"false">>, Opts)
+            ),
+        {PreparedBase, PreparedReq} =
+            case CommitReqBin of
+                <<"true">> ->
+                    {
+                        case hb_message:signers(Handler, Opts) of
+                            [] -> hb_message:commit(Handler, Opts);
+                            _ -> Handler
+                        end,
+                        hb_message:commit(BaseReq, Opts)
+                    };
+                <<"false">> -> {Handler, BaseReq}
             end,
         ?event(hook,
             {resolving_handler, 
@@ -175,7 +186,7 @@ execute_handler(HookName, Handler, Req, Opts) ->
         % Resolve the prepared request upon the handler.
         {Status, Res} =
             hb_ao:resolve(
-                Handler,
+                PreparedBase,
                 PreparedReq,
                 Opts#{ hashpath => ignore }
             ),
@@ -195,7 +206,14 @@ execute_handler(HookName, Handler, Req, Opts) ->
     catch
         Error:Reason:Stacktrace ->
             % If an exception occurs during execution, log it and return an error.
-            ?event(hook, {handler_exception, Error, Reason, Stacktrace}),
+            ?event(hook_error,
+                {handler_exception,
+                    {while_executing, HookName},
+                    {error, Error},
+                    {reason, Reason},
+                    {stacktrace, {trace, Stacktrace}}
+                }
+            ),
             {failure, <<
                 "Handler for hook `",
                 (hb_ao:normalize_key(HookName))/binary,
diff --git a/src/dev_hyperbuddy.erl b/src/dev_hyperbuddy.erl
index ad98bb05d..78c74686c 100644
--- a/src/dev_hyperbuddy.erl
+++ b/src/dev_hyperbuddy.erl
@@ -1,23 +1,33 @@
 %%% @doc A device that renders a REPL-like interface for AO-Core via HTML.
 -module(dev_hyperbuddy).
--export([info/0, format/3, metrics/3]).
+-export([info/0, format/3, return_file/2, return_error/2]).
+-export([metrics/3, events/3]).
+-export([throw/3]).
 -include_lib("include/hb.hrl").
+-include_lib("eunit/include/eunit.hrl").
 
 %% @doc Export an explicit list of files via http.
 info() ->
     #{
         default => fun serve/4,
         routes => #{
+            % Default message viewer page:
             <<"index">> => <<"index.html">>,
+            % HyperBEAM default homepage:
+            <<"dashboard">> => <<"dashboard.html">>,
+            % Interactive REPL:
             <<"console">> => <<"console.html">>,
             <<"graph">> => <<"graph.html">>,
+            % Styling and scripts:
 			<<"styles.css">> => <<"styles.css">>,
 			<<"metrics.js">> => <<"metrics.js">>,
 			<<"devices.js">> => <<"devices.js">>,
 			<<"utils.js">> => <<"utils.js">>,
-			<<"main.js">> => <<"main.js">>,
-			<<"graph.js">> => <<"graph.js">>
-        }
+			<<"dashboard.js">> => <<"dashboard.js">>,
+			<<"graph.js">> => <<"graph.js">>,
+            <<"404.html">> => <<"404.html">>
+        },
+        excludes => [<<"return_file">>]
     }.
 
 %% @doc The main HTML page for the REPL device.
@@ -34,43 +44,183 @@ metrics(_, Req, Opts) ->
                 registry => prometheus_registry:exists(<<"default">>),
                 standalone => false}
             ),
-            RawHeaderMap = maps:from_list(prometheus_cowboy:to_cowboy_headers(HeaderList)),
-            Headers = maps:map(fun(_, Value) -> hb_util:bin(Value) end, RawHeaderMap),
+            RawHeaderMap =
+                hb_maps:from_list(
+                    prometheus_cowboy:to_cowboy_headers(HeaderList)
+                ),
+            Headers =
+                hb_maps:map(
+                    fun(_, Value) -> hb_util:bin(Value) end,
+                    RawHeaderMap,
+					Opts
+                ),
             {ok, Headers#{ <<"body">> => Body }};
         false ->
             {ok, #{ <<"body">> => <<"Prometheus metrics disabled.">> }}
     end.
 
+%% @doc Return the current event counters as a message.
+events(_, _Req, _Opts) ->
+    {ok, hb_event:counters()}.
+
 %% @doc Employ HyperBEAM's internal pretty printer to format a message.
-format(Base, _, _) ->
-    {ok, #{ <<"body">> => hb_util:bin(hb_message:format(Base)) }}.
+%% 
+%% The request and node message can also be printed if desired by changing the
+%% `format` key in the `format` call. This can be achieved easily using the
+%% default key semantics:
+%% ```
+%% GET /.../~hyperbuddy@1.0/format=request
+%% ```
+%% Or a list of environment components:
+%% ```
+%% GET /.../~hyperbuddy@1.0/format+list=request,node
+%% ```
+%% Valid components are `base`, `request`, and `node`. The string `all` can also
+%% be used to quickly include all of the components.
+%% 
+%% The `truncate-keys` key can also be used to truncate the number of keys
+%% printed for each component. The default value is `infinity` (print all keys).
+%% ```
+%% GET /.../~hyperbuddy@1.0/format=request?truncate-keys=20
+%% ```
+format(Base, Req, Opts) ->
+    % Find the scope of the environment that should be printed.
+    Scope =
+        lists:map(
+            fun hb_util:bin/1,
+            case hb_maps:get(<<"format">>, Req, <<"base">>, Opts) of
+                <<"all">> -> [<<"base">>, <<"request">>, <<"node">>];
+                Messages when is_list(Messages) -> Messages;
+                SingleScope -> [SingleScope]
+            end
+        ),
+    ?event(debug_format, {using_scope, Scope}),
+    CombinedMsg =
+        hb_maps:with(
+            Scope,
+            #{
+                <<"base">> => maps:without([<<"device">>], hb_private:reset(Base)),
+                <<"request">> => maps:without([<<"path">>], hb_private:reset(Req)),
+                <<"node">> => hb_private:reset(Opts)
+            },
+            Opts
+        ),
+    MsgBeforeLoad =
+        if map_size(CombinedMsg) == 1 ->
+            hb_maps:get(hd(maps:keys(CombinedMsg)), CombinedMsg, #{}, Opts);
+        true ->
+            CombinedMsg
+        end,
+    MsgLoaded = hb_cache:ensure_all_loaded(MsgBeforeLoad, Opts),
+    TruncateKeys =
+        hb_maps:get(
+            <<"truncate-keys">>,
+            Req,
+            hb_opts:get(debug_print_truncate, infinity, Opts),
+            Opts
+        ),
+    ?event(debug_format, {using_truncation, TruncateKeys}),
+    {ok,
+        #{
+            <<"body">> =>
+                hb_util:bin(
+                    hb_format:message(
+                        MsgLoaded,
+                        Opts#{
+                            linkify_mode => discard,
+                            cache_control => [<<"no-cache">>, <<"no-store">>],
+                            debug_print_truncate => TruncateKeys
+                        }
+                    )
+                )
+        }
+    }.
+
+%% @doc Test key for validating the behavior of the `500` HTTP response.
+throw(_Msg, _Req, Opts) ->
+    case hb_opts:get(mode, prod, Opts) of
+        prod -> {error, <<"Forced-throw unavailable in `prod` mode.">>};
+        debug -> throw({intentional_error, Opts})
+    end.
 
 %% @doc Serve a file from the priv directory. Only serves files that are explicitly
 %% listed in the `routes' field of the `info/0' return value.
-serve(<<"keys">>, M1, _M2, _Opts) -> dev_message:keys(M1);
+serve(<<"keys">>, M1, _M2, Opts) -> dev_message:keys(M1, Opts);
 serve(<<"set">>, M1, M2, Opts) -> dev_message:set(M1, M2, Opts);
-serve(<<"graph-data">>, _, _, Opts) -> hb_cache_render:get_graph_data(Opts);
-serve(Key, _, _, _) ->
+serve(Key, _, _, Opts) ->
     ?event({hyperbuddy_serving, Key}),
-    case maps:get(Key, maps:get(routes, info(), no_routes), undefined) of
+    Routes = hb_maps:get(routes, info(), no_routes, Opts),
+    case hb_maps:get(Key, Routes, undefined, Opts) of
         undefined -> {error, not_found};
         Filename -> return_file(Filename)
     end.
 
 %% @doc Read a file from disk and serve it as a static HTML page.
 return_file(Name) ->
+    return_file(<<"hyperbuddy@1.0">>, Name, #{}).
+return_file(Device, Name) ->
+    return_file(Device, Name, #{}).
+return_file(Device, Name, Template) ->
     Base = hb_util:bin(code:priv_dir(hb)),
-    Filename = <<Base/binary, "/html/hyperbuddy@1.0/", Name/binary >>,
+    Filename = <<Base/binary, "/html/", Device/binary, "/", Name/binary >>,
     ?event({hyperbuddy_serving, Filename}),
-    {ok, Body} = file:read_file(Filename),
-    {ok, #{
-        <<"body">> => Body,
-        <<"content-type">> =>
-            case filename:extension(Filename) of
-                <<".html">> -> <<"text/html">>;
-                <<".js">> -> <<"text/javascript">>;
-                <<".css">> -> <<"text/css">>;
-                <<".png">> -> <<"image/png">>;
-                <<".ico">> -> <<"image/x-icon">>
-            end
-    }}.
\ No newline at end of file
+    case file:read_file(Filename) of
+        {ok, RawBody} ->
+            Body = apply_template(RawBody, Template),
+            {ok, #{
+                <<"body">> => Body,
+                <<"content-type">> =>
+                    case filename:extension(Filename) of
+                        <<".html">> -> <<"text/html">>;
+                        <<".js">> -> <<"text/javascript">>;
+                        <<".css">> -> <<"text/css">>;
+                        <<".png">> -> <<"image/png">>;
+                        <<".ico">> -> <<"image/x-icon">>
+                    end
+                }
+            };
+        {error, _} ->
+            {error, not_found}
+    end.
+
+%% @doc Return an error page, with the `{{error}}` template variable replaced.
+return_error(Error, Opts) when not is_map(Error) ->
+    return_error(#{ <<"body">> => Error }, Opts);
+return_error(ErrorMsg, Opts) ->
+    return_file(
+        <<"hyperbuddy@1.0">>,
+        <<"500.html">>,
+        #{ <<"error">> => hb_format:error(ErrorMsg, Opts) }
+    ).
+
+%% @doc Apply a template to a body.
+apply_template(Body, Template) when is_map(Template) ->
+    apply_template(Body, maps:to_list(Template));
+apply_template(Body, []) ->
+    Body;
+apply_template(Body, [{Key, Value} | Rest]) ->
+    apply_template(
+        re:replace(
+            Body,
+            <<"\\{\\{", Key/binary, "\\}\\}">>,
+            hb_util:bin(Value),
+            [global, {return, binary}]
+        ),
+        Rest
+    ).
+
+%%% Tests
+
+return_templated_file_test() ->
+    {ok, #{ <<"body">> := Body }} =
+        return_file(
+            <<"hyperbuddy@1.0">>,
+            <<"500.html">>,
+            #{
+                <<"error">> => <<"This is an error message.">>
+            }
+        ),
+    ?assertNotEqual(
+        binary:match(Body, <<"This is an error message.">>),
+        nomatch
+    ).
\ No newline at end of file
diff --git a/src/dev_json_iface.erl b/src/dev_json_iface.erl
index 01e40c0af..878ccf869 100644
--- a/src/dev_json_iface.erl
+++ b/src/dev_json_iface.erl
@@ -36,15 +36,15 @@
 -module(dev_json_iface).
 -export([init/3, compute/3]).
 %%% Public interface helpers:
--export([message_to_json_struct/1, json_to_message/2]).
+-export([message_to_json_struct/2, json_to_message/2]).
 %%% Test helper exports:
--export([generate_stack/1, generate_stack/2, generate_aos_msg/2]).
+-export([generate_stack/1, generate_stack/2, generate_stack/3, generate_aos_msg/2]).
 -include_lib("eunit/include/eunit.hrl").
 -include("include/hb.hrl").
 
 %% @doc Initialize the device.
-init(M1, _M2, _Opts) ->
-    {ok, hb_ao:set(M1, #{<<"function">> => <<"handle">>})}.
+init(M1, _M2, Opts) ->
+    {ok, hb_ao:set(M1, #{<<"function">> => <<"handle">>}, Opts)}.
 
 %% @doc On first pass prepare the call, on second pass get the results.
 compute(M1, M2, Opts) ->
@@ -56,13 +56,15 @@ compute(M1, M2, Opts) ->
 
 %% @doc Prepare the WASM environment for execution by writing the process string and
 %% the message as JSON representations into the WASM environment.
-prep_call(M1, M2, Opts) ->
+prep_call(RawM1, RawM2, Opts) ->
+    M1 = hb_cache:ensure_all_loaded(RawM1, Opts),
+    M2 = hb_cache:ensure_all_loaded(RawM2, Opts),
     ?event({prep_call, M1, M2, Opts}),
     Process = hb_ao:get(<<"process">>, M1, Opts#{ hashpath => ignore }),
     Message = hb_ao:get(<<"body">>, M2, Opts#{ hashpath => ignore }),
     Image = hb_ao:get(<<"process/image">>, M1, Opts),
     BlockHeight = hb_ao:get(<<"block-height">>, M2, Opts),
-    Props = message_to_json_struct(denormalize_message(Message)),
+    Props = message_to_json_struct(denormalize_message(Message, Opts), Opts),
     MsgProps =
         Props#{
             <<"Module">> => Image,
@@ -71,122 +73,135 @@ prep_call(M1, M2, Opts) ->
     MsgJson = hb_json:encode(MsgProps),
     ProcessProps =
         #{
-            <<"Process">> => message_to_json_struct(Process)
+            <<"Process">> => message_to_json_struct(Process, Opts)
         },
     ProcessJson = hb_json:encode(ProcessProps),
     env_write(ProcessJson, MsgJson, M1, M2, Opts).
 
 %% @doc Normalize a message for AOS-compatibility.
-denormalize_message(Message) ->
+denormalize_message(Message, Opts) ->
     NormOwnerMsg =
-        case hb_message:signers(Message) of
+        case hb_message:signers(Message, Opts) of
             [] -> Message;
             [PrimarySigner|_] ->
-                {ok, _, Commitment} = hb_message:commitment(PrimarySigner, Message),
+                {ok, _, Commitment} = hb_message:commitment(PrimarySigner, Message, Opts),
                 Message#{
                     <<"owner">> => hb_util:human_id(PrimarySigner),
                     <<"signature">> =>
-                        hb_ao:get(<<"signature">>, Commitment, <<>>, #{})
+                        hb_ao:get(<<"signature">>, Commitment, <<>>, Opts)
                 }
         end,
     NormOwnerMsg#{
-        <<"id">> => hb_message:id(Message, all)
+        <<"id">> => hb_message:id(Message, all, Opts)
     }.
 
-message_to_json_struct(RawMsg) ->
-    message_to_json_struct(RawMsg, [owner_as_address]).
-message_to_json_struct(RawMsg, Features) ->
+message_to_json_struct(RawMsg, Opts) ->
+    message_to_json_struct(RawMsg, [owner_as_address], Opts).
+message_to_json_struct(RawMsg, Features, Opts) ->
     TABM = 
         hb_message:convert(
             hb_private:reset(RawMsg),
             tabm,
-            #{}
+            Opts
         ),
-    MsgWithoutCommitments = maps:without([<<"commitments">>], TABM),
+    MsgWithoutCommitments = hb_maps:without([<<"commitments">>], TABM, Opts),
     ID = hb_message:id(RawMsg, all),
     ?event({encoding, {id, ID}, {msg, RawMsg}}),
-    Last = hb_ao:get(<<"anchor">>, {as, <<"message@1.0">>, MsgWithoutCommitments}, <<>>, #{}),
-	Owner =
-        case hb_message:signers(RawMsg) of
-            [] -> <<>>;
+	{Owner, Signature} =
+        case hb_message:signers(RawMsg, Opts) of
+            [] -> {<<>>, <<>>};
             [Signer|_] ->
+                {ok, _, Commitment} =
+                    hb_message:commitment(Signer, RawMsg, Opts),
+                CommitmentSignature =
+                    hb_ao:get(<<"signature">>, Commitment, <<>>, Opts),
                 case lists:member(owner_as_address, Features) of
-                    true -> hb_util:native_id(Signer);
+                    true -> 
+                        {
+                            hb_util:native_id(Signer),
+                            CommitmentSignature
+                        };
                     false ->
-                        Commitment =
-                            hb_ao:get(
-                                <<"commitments/", Signer/binary>>,
-                                {as, <<"message@1.0">>, RawMsg},
-                                #{}
+                        CommitmentOwner =
+                            hb_ao:get_first(
+                                [
+                                    {Commitment, <<"key">>},
+                                    {Commitment, <<"owner">>}
+                                ],
+                                no_signing_public_key_found_in_commitment,
+                                Opts
                             ),
-                        case hb_ao:get(<<"owner">>, Commitment, #{}) of
-                            not_found ->
-                                % The signature is likely a HTTPsig, so we need 
-                                % to extract the owner from the signature.
-                                case dev_codec_httpsig:public_keys(Commitment) of
-                                    [] -> <<>>;
-                                    [PubKey|_] -> PubKey
-                                end;
-                            ANS104Owner -> ANS104Owner
-                        end
+                        {CommitmentOwner, CommitmentSignature}
                 end
         end,
-    Data = hb_ao:get(<<"data">>, {as, <<"message@1.0">>, MsgWithoutCommitments}, <<>>, #{}),
-    Target = hb_ao:get(<<"target">>, {as, <<"message@1.0">>, MsgWithoutCommitments}, <<>>, #{}),
-	
-	% Ethereum addresses are already encoded
-	EncodedOwner = case byte_size(Owner) of
-		42 -> Owner;
-		_ -> hb_util:encode(Owner)
-	end,
+    Last =
+        hb_ao:get(
+            <<"anchor">>,
+            {as, <<"message@1.0">>, MsgWithoutCommitments},
+            <<>>,
+            Opts
+        ),
+    Data =
+        hb_ao:get(
+            <<"data">>,
+            {as, <<"message@1.0">>, MsgWithoutCommitments},
+            <<>>,
+            Opts
+        ),
+    Target =
+        hb_ao:get(
+            <<"target">>,
+            {as, <<"message@1.0">>, MsgWithoutCommitments},
+            <<>>,
+            Opts
+        ),
     % Set "From" if From-Process is Tag or set with "Owner" address
     From =
         hb_ao:get(
             <<"from-process">>,
             {as, <<"message@1.0">>, MsgWithoutCommitments},
-            EncodedOwner,
-            #{}
+            hb_util:encode(Owner),
+            Opts
         ),
-    Sig = hb_ao:get(<<"signature">>, {as, <<"message@1.0">>, MsgWithoutCommitments}, <<>>, #{}),
     #{
         <<"Id">> => safe_to_id(ID),
         % NOTE: In Arweave TXs, these are called "last_tx"
         <<"Anchor">> => Last,
         % NOTE: When sent to ao "Owner" is the wallet address
-        <<"Owner">> => EncodedOwner,
+        <<"Owner">> => hb_util:encode(Owner),
         <<"From">> => case ?IS_ID(From) of true -> safe_to_id(From); false -> From end,
-        <<"Tags">> => prepare_tags(TABM),
+        <<"Tags">> => prepare_tags(TABM, Opts),
         <<"Target">> => safe_to_id(Target),
         <<"Data">> => Data,
         <<"Signature">> =>
-            case byte_size(Sig) of
+            case byte_size(Signature) of
                 0 -> <<>>;
-                512 -> hb_util:encode(Sig);
-                _ -> Sig
+                512 -> hb_util:encode(Signature);
+                _ -> Signature
             end
     }.
 
 %% @doc Prepare the tags of a message as a key-value list, for use in the 
 %% construction of the JSON-Struct message.
-prepare_tags(Msg) ->
+prepare_tags(Msg, Opts) ->
     % Prepare an ANS-104 message for JSON-Struct construction.
-    case hb_message:commitment(#{ <<"commitment-device">> => <<"ans104@1.0">> }, Msg, #{}) of
+    case hb_message:commitment(#{ <<"commitment-device">> => <<"ans104@1.0">> }, Msg, Opts) of
         {ok, _, Commitment} ->
-            case maps:find(<<"original-tags">>, Commitment) of
+            case hb_maps:find(<<"original-tags">>, Commitment, Opts) of
                 {ok, OriginalTags} ->
                     Res = hb_util:message_to_ordered_list(OriginalTags),
                     ?event({using_original_tags, Res}),
                     Res;
                 error -> 
-                    prepare_header_case_tags(Msg)
+                    prepare_header_case_tags(Msg, Opts)
             end;
         _ ->
-            prepare_header_case_tags(Msg)
+            prepare_header_case_tags(Msg, Opts)
     end.
 
 %% @doc Convert a message without an `original-tags' field into a list of
 %% key-value pairs, with the keys in HTTP header-case.
-prepare_header_case_tags(TABM) ->
+prepare_header_case_tags(TABM, Opts) ->
     % Prepare a non-ANS-104 message for JSON-Struct construction. 
     lists:map(
         fun({Name, Value}) ->
@@ -195,14 +210,16 @@ prepare_header_case_tags(TABM) ->
                 <<"value">> => maybe_list_to_binary(Value)
             }
         end,
-        maps:to_list(
-            maps:without(
+        hb_maps:to_list(
+            hb_maps:without(
                 [
                     <<"id">>, <<"anchor">>, <<"owner">>, <<"data">>,
                     <<"target">>, <<"signature">>, <<"commitments">>
                 ],
-                TABM
-            )
+                TABM,
+                Opts
+            ),
+			Opts
         )
     ).
 
@@ -215,7 +232,7 @@ json_to_message(Resp, Opts) when is_map(Resp) ->
     Output = 
         #{
             <<"outbox">> =>
-                maps:from_list(
+                hb_maps:from_list(
                     [
                         {MessageNum, preprocess_results(Msg, Opts)}
                     ||
@@ -226,7 +243,7 @@ json_to_message(Resp, Opts) when is_map(Resp) ->
                             )
                     ]
                 ),
-            <<"patches">> => lists:map(fun tags_to_map/1, Patches),
+            <<"patches">> => lists:map(fun(Patch) -> tags_to_map(Patch, Opts) end, Patches),
             <<"data">> => Data
         },
     {ok, Output};
@@ -351,87 +368,103 @@ env_write(ProcessStr, MsgStr, Base, Req, Opts) ->
     }.
 
 %% @doc Normalize the results of an evaluation.
-normalize_results(
-    Msg = #{ <<"Output">> := #{<<"data">> := Data} }) ->
-    {ok,
-        Data,
-        maps:get(<<"Messages">>, Msg, []),
-        maps:get(<<"patches">>, Msg, [])
-    };
 normalize_results(#{ <<"Error">> := Error }) ->
     {ok, Error, [], []};
-normalize_results(Other) ->
-    throw({invalid_results, Other}).
+normalize_results(Msg) ->
+    try
+        Output = maps:get(<<"Output">>, Msg, #{}),
+        Data = maps:get(<<"data">>, Output, maps:get(<<"Data">>, Msg, <<>>)),
+        {ok,
+            Data,
+            maps:get(<<"Messages">>, Msg, []),
+            maps:get(<<"patches">>, Msg, [])
+        }
+    catch
+        _:_ ->
+            {ok, <<>>, [], []}
+    end.
 
 %% @doc After the process returns messages from an evaluation, the
 %% signing node needs to add some tags to each message and spawn such that
 %% the target process knows these messages are created by a process.
-preprocess_results(Msg, _Opts) ->
-    Tags = tags_to_map(Msg),
+preprocess_results(Msg, Opts) ->
+    Tags = tags_to_map(Msg, Opts),
     FilteredMsg =
-        maps:without(
+        hb_maps:without(
             [<<"from-process">>, <<"from-image">>, <<"anchor">>, <<"tags">>],
-            Msg
+            Msg,
+            Opts
         ),
-    maps:merge(
-        maps:from_list(
+    hb_maps:merge(
+        hb_maps:from_list(
             lists:map(
                 fun({Key, Value}) ->
                     {hb_ao:normalize_key(Key), Value}
                 end,
-                maps:to_list(FilteredMsg)
+                hb_maps:to_list(FilteredMsg, Opts)
             )
         ),
-        Tags
+        Tags,
+        Opts
     ).
 
 %% @doc Convert a message with tags into a map of their key-value pairs.
-tags_to_map(Msg) ->
-    NormMsg = hb_ao:normalize_keys(Msg),
-    RawTags = maps:get(<<"tags">>, NormMsg, []),
+tags_to_map(Msg, Opts) ->
+    NormMsg = hb_util:lower_case_key_map(
+        hb_ao:normalize_keys(Msg, Opts), 
+    Opts),
+    RawTags = hb_maps:get(<<"tags">>, NormMsg, [], Opts),
     TagList =
         [
-            {maps:get(<<"name">>, Tag), maps:get(<<"value">>, Tag)}
+            {hb_maps:get(<<"name">>, Tag, Opts), hb_maps:get(<<"value">>, Tag, Opts)}
         ||
             Tag <- RawTags
         ],
-    maps:from_list(TagList).
+    hb_maps:from_list(TagList).
 
 %% @doc Post-process messages in the outbox to add the correct `from-process'
 %% and `from-image' tags.
 postprocess_outbox(Msg, Proc, Opts) ->
     AdjustedOutbox =
-        maps:map(
+        hb_maps:map(
             fun(_Key, XMsg) ->
                 XMsg#{
                     <<"from-process">> => hb_ao:get(id, Proc, Opts),
                     <<"from-image">> => hb_ao:get(<<"image">>, Proc, Opts)
                 }
             end,
-            hb_ao:get(<<"outbox">>, Msg, #{}, Opts)
+            hb_ao:get(<<"outbox">>, Msg, #{}, Opts),
+            Opts
         ),
     hb_ao:set(Msg, <<"outbox">>, AdjustedOutbox, Opts).
 
 %%% Tests
 
+normalize_test_opts(Opts) ->
+    Opts#{
+        priv_wallet => hb_opts:get(priv_wallet, hb:wallet(), Opts)
+    }.
+
 test_init() ->
     application:ensure_all_started(hb).
 
 generate_stack(File) ->
     generate_stack(File, <<"WASM">>).
-generate_stack(File, _Mode) ->
+generate_stack(File, Mode) ->
+    generate_stack(File, Mode, #{}).
+generate_stack(File, _Mode, RawOpts) ->
+    Opts = normalize_test_opts(RawOpts),
     test_init(),
-    Wallet = hb:wallet(),
-    Msg0 = dev_wasm:cache_wasm_image(File),
-    Image = hb_ao:get(<<"image">>, Msg0, #{}),
+    Msg0 = dev_wasm:cache_wasm_image(File, Opts),
+    Image = hb_ao:get(<<"image">>, Msg0, Opts),
     Msg1 = Msg0#{
-        <<"device">> => <<"Stack@1.0">>,
+        <<"device">> => <<"stack@1.0">>,
         <<"device-stack">> =>
             [
-                <<"WASI@1.0">>,
-                <<"JSON-Iface@1.0">>,
-                <<"WASM-64@1.0">>,
-                <<"Multipass@1.0">>
+                <<"wasi@1.0">>,
+                <<"json-iface@1.0">>,
+                <<"wasm-64@1.0">>,
+                <<"multipass@1.0">>
             ],
         <<"input-prefix">> => <<"process">>,
         <<"output-prefix">> => <<"wasm">>,
@@ -443,23 +476,25 @@ generate_stack(File, _Mode) ->
                 <<"image">> => Image,
                 <<"scheduler">> => hb:address(),
                 <<"authority">> => hb:address()
-            }, Wallet)
+            }, Opts)
     },
-    {ok, Msg2} = hb_ao:resolve(Msg1, <<"init">>, #{}),
+    {ok, Msg2} = hb_ao:resolve(Msg1, <<"init">>, Opts),
     Msg2.
 
 generate_aos_msg(ProcID, Code) ->
-    Wallet = hb:wallet(),
+    generate_aos_msg(ProcID, Code, #{}).
+generate_aos_msg(ProcID, Code, RawOpts) ->
+    Opts = normalize_test_opts(RawOpts),
     hb_message:commit(#{
         <<"path">> => <<"compute">>,
         <<"body">> => 
             hb_message:commit(#{
-                <<"Action">> => <<"Eval">>,
-                <<"Data">> => Code,
-                <<"Target">> => ProcID
-            }, Wallet),
+                <<"action">> => <<"Eval">>,
+                <<"data">> => Code,
+                <<"target">> => ProcID
+            }, Opts),
         <<"block-height">> => 1
-    }, Wallet).
+    }, Opts).
 
 basic_aos_call_test_() ->
     {timeout, 20, fun() ->
@@ -480,26 +515,29 @@ basic_aos_call_test_() ->
 aos_stack_benchmark_test_() ->
     {timeout, 20, fun() ->
         BenchTime = 5,
-        RawWASMMsg = generate_stack("test/aos-2-pure-xs.wasm"),
-        Proc = hb_ao:get(<<"process">>, RawWASMMsg, #{ hashpath => ignore }),
-        ProcID = hb_ao:get(id, Proc, #{}),
+        Opts = #{ store => hb_test_utils:test_store() },
+        RawWASMMsg = generate_stack("test/aos-2-pure-xs.wasm", <<"WASM">>, Opts),
+        Proc = hb_ao:get(<<"process">>, RawWASMMsg, Opts#{ hashpath => ignore }),
+        ProcID = hb_ao:get(id, Proc, Opts),
+        Msg = generate_aos_msg(ProcID, <<"return 1">>, Opts),
         {ok, Initialized} =
-        hb_ao:resolve(
-            RawWASMMsg,
-            generate_aos_msg(ProcID, <<"return 1">>),
-            #{}
-        ),
-        Msg = generate_aos_msg(ProcID, <<"return 1+1">>),
+            hb_ao:resolve(
+                RawWASMMsg,
+                Msg,
+                Opts
+            ),
+        Msg2 = generate_aos_msg(ProcID, <<"return 1+1">>, Opts),
         Iterations =
-            hb:benchmark(
-                fun() -> hb_ao:resolve(Initialized, Msg, #{}) end,
+            hb_test_utils:benchmark(
+                fun() -> hb_ao:resolve(Initialized, Msg2, Opts) end,
                 BenchTime
             ),
-        hb_util:eunit_print(
-            "Evaluated ~p AOS messages (minimal stack) in ~p sec (~.2f msg/s)",
-            [Iterations, BenchTime, Iterations / BenchTime]
+        hb_test_utils:benchmark_print(
+            <<"(Minimal AOS stack:) Evaluated">>,
+            <<"messages">>,
+            Iterations,
+            BenchTime
         ),
-		?debugFmt("Evaluated ~p AOS messages (minimal stack) in ~p sec (~.2f msg/s)", [Iterations, BenchTime, Iterations / BenchTime]),
         ?assert(Iterations >= 10),
         ok
     end}.
\ No newline at end of file
diff --git a/src/dev_local_name.erl b/src/dev_local_name.erl
index 61401b916..71a9563ab 100644
--- a/src/dev_local_name.erl
+++ b/src/dev_local_name.erl
@@ -52,22 +52,19 @@ register(_, Req, Opts) ->
 direct_register(Req, Opts) ->
     case hb_cache:write(hb_ao:get(<<"value">>, Req, Opts), Opts) of
         {ok, MsgPath} ->
+            NormKey = hb_ao:normalize_key(hb_ao:get(<<"key">>, Req, Opts)),
             hb_cache:link(
                 MsgPath,
-                LinkPath =
-                    [
-                        ?DEV_CACHE,
-                        Name = hb_ao:get(<<"key">>, Req, Opts)
-                    ],
+                LinkPath = << ?DEV_CACHE/binary, "/", NormKey/binary >>,
                 Opts
             ),
             load_names(Opts),
             ?event(
                 local_name,
                 {registered,
-                    Name,
-                    {link, LinkPath},
-                    {msg, MsgPath}
+                    {key, NormKey},
+                    {msg, MsgPath},
+                    {path, LinkPath}
                 }
             ),
             {ok, <<"Registered.">>};
@@ -90,11 +87,13 @@ load_names(Opts) ->
     LocalNames =
         maps:from_list(lists:map(
             fun(Key) ->
-                ?event(local_name, {loading, Key}),
-                case hb_cache:read([?DEV_CACHE, Key], Opts) of
+                NormKey = hb_ao:normalize_key(Key),
+                Path = << ?DEV_CACHE/binary, "/", NormKey/binary >>,
+                ?event(local_name, {loading, Path}),
+                case hb_cache:read(Path, Opts) of
                     {ok, Value} ->
                         {Key, Value};
-                    {error, _} ->
+                    _ ->
                         {Key, not_found}
                 end
             end,
@@ -114,13 +113,6 @@ update_names(LocalNames, Opts) ->
 
 generate_test_opts() ->
     Opts = #{
-        store =>
-            [
-                #{
-                    <<"store-module">> => hb_store_fs,
-                    <<"prefix">> => "cache-TEST/"
-                }
-            ],
         priv_wallet => ar_wallet:new()
     },
     Opts.
diff --git a/src/dev_lookup.erl b/src/dev_lookup.erl
index bb009d16b..bd6958be7 100644
--- a/src/dev_lookup.erl
+++ b/src/dev_lookup.erl
@@ -10,18 +10,21 @@ read(_M1, M2, Opts) ->
     ID = hb_ao:get(<<"target">>, M2, Opts),
     ?event({lookup, {id, ID}, {opts, Opts}}),
     case hb_cache:read(ID, Opts) of
-        {ok, Res} ->
-            ?event({lookup_result, Res}),
+        {ok, RawRes} ->
+            % We are sending the result over the wire, so make sure it is
+            % fully loaded, to save the recipient latency.
+            ?event({lookup_result, RawRes}),
             case hb_ao:get(<<"accept">>, M2, Opts) of
                 <<"application/aos-2">> ->
-                    Struct = dev_json_iface:message_to_json_struct(Res),
+                    Res = hb_cache:ensure_all_loaded(RawRes),
+                    Struct = dev_json_iface:message_to_json_struct(Res, Opts),
                     {ok,
                         #{
                             <<"body">> => hb_json:encode(Struct),
                             <<"content-type">> => <<"application/aos-2">>
                         }};
                 _ ->
-                    {ok, Res}
+                    {ok, RawRes}
             end;
         not_found ->
             ?event({lookup_not_found, ID}),
@@ -40,7 +43,7 @@ message_lookup_test() ->
     Msg = #{ <<"test-key">> => <<"test-value">>, <<"data">> => <<"test-data">> },
     {ok, ID} = hb_cache:write(Msg, #{}),
     {ok, RetrievedMsg} = read(#{}, #{ <<"target">> => ID }, #{}),
-    ?assertEqual(Msg, RetrievedMsg).
+    ?assert(hb_message:match(Msg, RetrievedMsg)).
 
 aos2_message_lookup_test() ->
     Msg = #{ <<"test-key">> => <<"test-value">>, <<"data">> => <<"test-data">> },
@@ -51,13 +54,14 @@ aos2_message_lookup_test() ->
             #{ <<"target">> => ID, <<"accept">> => <<"application/aos-2">> },
             #{}
         ),
-    Decoded = hb_json:decode(hb_ao:get(<<"body">>, RetrievedMsg, #{})),
+    
+    {ok, Decoded} = dev_json_iface:json_to_message(hb_ao:get(<<"body">>, RetrievedMsg, #{}), #{}),
     ?assertEqual(<<"test-data">>, hb_ao:get(<<"data">>, Decoded, #{})).
 
 http_lookup_test() ->
     Store = #{
         <<"store-module">> => hb_store_fs,
-        <<"prefix">> => <<"cache-mainnet">>
+        <<"name">> => <<"cache-mainnet">>
     },
     Opts = #{ store => [Store] },
     Msg = #{ <<"test-key">> => <<"test-value">>, <<"data">> => <<"test-data">> },
@@ -70,5 +74,5 @@ http_lookup_test() ->
         <<"accept">> => <<"application/aos-2">>
     }, Wallet),
     {ok, Res} = hb_http:post(Node, Req, Opts),
-    Decoded = hb_json:decode(hb_ao:get(<<"body">>, Res, Opts)),
-    ?assertEqual(<<"test-data">>, hb_ao:get(<<"data">>, Decoded, Opts)).
\ No newline at end of file
+    {ok, Decoded} = dev_json_iface:json_to_message(hb_ao:get(<<"body">>, Res, Opts), Opts),
+    ?assertEqual(<<"test-data">>, hb_ao:get(<<"Data">>, Decoded, Opts)).
\ No newline at end of file
diff --git a/src/dev_lua.erl b/src/dev_lua.erl
index 18ac19b1e..25920793d 100644
--- a/src/dev_lua.erl
+++ b/src/dev_lua.erl
@@ -2,9 +2,11 @@
 -module(dev_lua).
 -export([info/1, init/3, snapshot/3, normalize/3, functions/3]).
 %%% Public Utilities
--export([encode/1, decode/1]).
+-export([encode/2, decode/2]).
+-export([pure_lua_process_benchmark/1]).
 -include("include/hb.hrl").
 -include_lib("eunit/include/eunit.hrl").
+
 %%% The set of functions that will be sandboxed by default if `sandbox' is set 
 %%% to only `true'. Setting `sandbox' to a map allows the invoker to specify
 %%% which functions should be sandboxed and what to return instead. Providing
@@ -157,7 +159,10 @@ initialize(Base, Modules, Opts) ->
                 {ok, _, StateOut} =
                     luerl:do_dec(
                         ModuleBin,
-                        [{name, hb_util:list(ModuleID)}],
+                        [
+                            {name, hb_util:list(ModuleID)},
+                            {file, hb_util:list(ModuleID)}
+                        ],
                         StateIn
                     ),
                 StateOut
@@ -198,7 +203,7 @@ functions(Base, _Req, Opts) ->
                     >>,
                     State
                 ),
-            {ok, hb_util:message_to_ordered_list(decode(Res))}
+            {ok, hb_util:message_to_ordered_list(decode(Res, Opts))}
     end.
 
 %% @doc Sandbox (render inoperable) a set of Lua functions. Each function is
@@ -253,34 +258,37 @@ compute(Key, RawBase, Req, Opts) ->
             Opts#{ hashpath => ignore }
         ),
     ?event(debug_lua, parameters_found),
+    % Resolve all hyperstate links
+    ResolvedParams = hb_cache:ensure_all_loaded(Params, Opts),
     % Call the VM function with the given arguments.
     ?event(lua,
         {calling_lua_func,
             {function, Function},
-            {args, Params},
+            {args, ResolvedParams},
             {req, Req}
         }
     ),
     process_response(
         try luerl:call_function_dec(
             [Function],
-            encode(Params),
+            encode(ResolvedParams, Opts),
             State
         )
         catch
             _:Reason:Stacktrace -> {error, Reason, Stacktrace}
         end,
-        OldPriv
+        OldPriv,
+		Opts
     ).
 
 %% @doc Process a response to a Luerl invocation. Returns the typical AO-Core
 %% HyperBEAM response format.
-process_response({ok, [Result], NewState}, Priv) ->
-    process_response({ok, [<<"ok">>, Result], NewState}, Priv);
-process_response({ok, [Status, MsgResult], NewState}, Priv) ->
+process_response({ok, [Result], NewState}, Priv, Opts) ->
+    process_response({ok, [<<"ok">>, Result], NewState}, Priv, Opts);
+process_response({ok, [Status, MsgResult], NewState}, Priv, Opts) ->
     % If the result is a HyperBEAM device return (`{Status, Msg}'), decode it 
     % and add the previous `priv' element back into the resulting message.
-    case decode(MsgResult) of
+    case decode(MsgResult, Opts) of
         Msg when is_map(Msg) ->
             ?event(lua, {response, {status, Status}, {msg, Msg}}),
             {hb_util:atom(Status), Msg#{
@@ -290,22 +298,22 @@ process_response({ok, [Status, MsgResult], NewState}, Priv) ->
             }};
         NonMsgRes -> {hb_util:atom(Status), NonMsgRes}
     end;
-process_response({lua_error, RawError, State}, _Priv) ->
+process_response({lua_error, RawError, State}, _Priv, Opts) ->
     % An error occurred while calling the Lua function. Parse the stack trace
     % and return it.
-    Error = try decode(luerl:decode(RawError, State)) catch _:_ -> RawError end,
-    StackTrace = decode_stacktrace(luerl:get_stacktrace(State), State),
+    Error = try decode(luerl:decode(RawError, State), Opts) catch _:_ -> RawError end,
+    StackTrace = decode_stacktrace(luerl:get_stacktrace(State), State, Opts),
     ?event(lua_error, {lua_error, Error, {stacktrace, StackTrace}}),
     {error, #{
         <<"status">> => 500,
         <<"body">> => Error,
-        <<"trace">> => hb_ao:normalize_keys(StackTrace)
+        <<"trace">> => hb_ao:normalize_keys(StackTrace, Opts)
     }};
-process_response({error, Reason, Trace}, _Priv) ->
+process_response({error, Reason, Trace}, _Priv, _Opts) ->
     % An Erlang error occurred while calling the Lua function. Return it.
     ?event(lua_error, {trace, Trace}),
-    TraceBin = iolist_to_binary(hb_util:format_trace(Trace)),
-    ?event(lua_error, {formatted, TraceBin}),
+    TraceBin = iolist_to_binary(hb_format:trace(Trace)),
+    ?event(lua_error, {formatted, {string, TraceBin}}),
     ReasonBin = iolist_to_binary(io_lib:format("~p", [Reason])),
     {error, #{
         <<"status">> => 500,
@@ -321,12 +329,7 @@ snapshot(Base, _Req, Opts) ->
         not_found ->
             {error, <<"Cannot snapshot Lua state: state not initialized.">>};
         State ->
-            {ok,
-                #{
-                    <<"body">> =>
-                        term_to_binary(luerl:externalize(State))
-                }
-            }
+            {ok, #{ <<"body">> => term_to_binary(luerl:externalize(State)) }}
     end.
 
 %% @doc Restore the Lua state from a snapshot, if it exists.
@@ -339,7 +342,7 @@ normalize(Base, _Req, RawOpts) ->
                     not_found -> [];
                     Key -> [Key]
                 end,
-            ?event(
+            ?event(snapshot,
                 {attempting_to_restore_lua_state,
                     {msg1, Base}, {device_key, DeviceKey}
                 }
@@ -355,48 +358,68 @@ normalize(Base, _Req, RawOpts) ->
                 State ->
                     ExternalizedState = binary_to_term(State),
                     InternalizedState = luerl:internalize(ExternalizedState),
+                    ?event(snapshot, loaded_state_from_snapshot),
                     {ok, hb_private:set(Base, <<"state">>, InternalizedState, Opts)}
             end;
         _ ->
-            ?event(state_already_initialized),
+            ?event(snapshot, state_already_initialized),
             {ok, Base}
     end.
 
 %% @doc Decode a Lua result into a HyperBEAM `structured@1.0' message.
-decode(EncMsg = [{_K, _V} | _]) when is_list(EncMsg) ->
-    decode(maps:map(fun(_, V) -> decode(V) end, maps:from_list(EncMsg)));
-decode(Msg) when is_map(Msg) ->
+decode(EncMsg, _Opts) when is_list(EncMsg) andalso length(EncMsg) == 0 ->
+    % The value is an empty table, so we assume it is a message rather than
+    % a list.
+    #{};
+decode(EncMsg = [{_K, _V} | _], Opts) when is_list(EncMsg) ->
+    decode(
+        maps:map(
+            fun(_, V) -> decode(V, Opts) end,
+            maps:from_list(EncMsg)
+        ),
+        Opts
+    );
+decode(Msg, Opts) when is_map(Msg) ->
     % If the message is an ordered list encoded as a map, decode it to a list.
-    case hb_util:is_ordered_list(Msg) of
+    case hb_util:is_ordered_list(Msg, Opts) of
         true ->
-            lists:map(fun decode/1, hb_util:message_to_ordered_list(Msg));
+            lists:map(
+                fun(V) -> decode(V, Opts) end,
+                hb_util:message_to_ordered_list(Msg)
+            );
         false ->
             Msg
     end;
-decode(Other) ->
+decode(Other, _Opts) ->
     Other.
 
 %% @doc Encode a HyperBEAM `structured@1.0' message into a Lua term.
-encode(Map) when is_map(Map) ->
-    case hb_util:is_ordered_list(Map) of
-        true -> encode(hb_util:message_to_ordered_list(Map));
-        false -> maps:to_list(maps:map(fun(_, V) -> encode(V) end, Map))
-    end;
-encode(List) when is_list(List) ->
-    lists:map(fun encode/1, List);
-encode(Atom) when is_atom(Atom) and (Atom /= false) and (Atom /= true)->
+encode(Map, Opts) when is_map(Map) ->
+    hb_cache:ensure_all_loaded(
+        case hb_util:is_ordered_list(Map, Opts) of
+            true -> encode(hb_util:message_to_ordered_list(Map), Opts);
+            false -> maps:to_list(maps:map(fun(_, V) -> encode(V, Opts) end, Map))
+        end,
+        Opts
+    );
+encode(List, Opts) when is_list(List) ->
+    hb_cache:ensure_all_loaded(
+        lists:map(fun(V) -> encode(V, Opts) end, List),
+        Opts
+    );
+encode(Atom, _Opts) when is_atom(Atom) and (Atom /= false) and (Atom /= true)->
     hb_util:bin(Atom);
-encode(Other) ->
+encode(Other, _Opts) ->
     Other.
 
 %% @doc Parse a Lua stack trace into a list of messages.
-decode_stacktrace(StackTrace, State0) ->
-    decode_stacktrace(StackTrace, State0, []).
-decode_stacktrace([], _State, Acc) ->
+decode_stacktrace(StackTrace, State0, Opts) ->
+    decode_stacktrace(StackTrace, State0, [], Opts).
+decode_stacktrace([], _State, Acc, _Opts) ->
     lists:reverse(Acc);
-decode_stacktrace([{FuncBin, ParamRefs, FileInfo} | Rest], State0, Acc) ->
+decode_stacktrace([{FuncBin, ParamRefs, FileInfo} | Rest], State0, Acc, Opts) ->
     %% Decode all the Lua table refs into Erlang terms
-    DecodedParams = decode_params(ParamRefs, State0),
+    DecodedParams = decode_params(ParamRefs, State0, Opts),
     %% Pull out the line number
     Line = proplists:get_value(line, FileInfo),
     File = proplists:get_value(file, FileInfo, undefined),
@@ -404,7 +427,7 @@ decode_stacktrace([{FuncBin, ParamRefs, FileInfo} | Rest], State0, Acc) ->
     %% Build our message‐map
     Entry = #{
         <<"function">>   => FuncBin,
-        <<"parameters">> => hb_util:list_to_numbered_map(DecodedParams)
+        <<"parameters">> => hb_util:list_to_numbered_message(DecodedParams)
     },
     MaybeLine =
         if is_binary(File) andalso is_integer(Line) ->
@@ -419,14 +442,14 @@ decode_stacktrace([{FuncBin, ParamRefs, FileInfo} | Rest], State0, Acc) ->
         true ->
             #{}
         end,
-    decode_stacktrace(Rest, State0, [maps:merge(Entry, MaybeLine)|Acc]).
+    decode_stacktrace(Rest, State0, [maps:merge(Entry, MaybeLine)|Acc], Opts).
 
 %% @doc Decode a list of Lua references, as found in a stack trace, into a
 %% list of Erlang terms.
-decode_params([], _State) -> [];
-decode_params([Tref|Rest], State) ->
-    Decoded = decode(luerl:decode(Tref, State)),
-    [Decoded|decode_params(Rest, State)].
+decode_params([], _State, _Opts) -> [];
+decode_params([Tref|Rest], State, Opts) ->
+    Decoded = decode(luerl:decode(Tref, State), Opts),
+    [Decoded|decode_params(Rest, State, Opts)].
 
 %%% Tests
 simple_invocation_test() ->
@@ -441,7 +464,9 @@ simple_invocation_test() ->
     },
     ?assertEqual(2, hb_ao:get(<<"assoctable/b">>, Base, #{})).
 
-load_modules_by_id_test() ->
+load_modules_by_id_test_() ->
+    {timeout, 30, fun load_modules_by_id/0}.
+load_modules_by_id() ->
     % Start a node to ensure the HTTP services are available.
     _Node = hb_http_server:start_node(#{}),
     Module = <<"DosEHUAqhl_O5FH3vDqPlgGsG92Guxcm6nrwqnjsDKg">>,
@@ -546,7 +571,7 @@ direct_benchmark_test() ->
         },
         <<"parameters">> => []
     },
-    Iterations = hb:benchmark(
+    Iterations = hb_test_utils:benchmark(
         fun(X) ->
             {ok, _} = hb_ao:resolve(Base, <<"assoctable">>, #{}),
             ?event({iteration, X})
@@ -554,9 +579,11 @@ direct_benchmark_test() ->
         BenchTime
     ),
     ?event({iterations, Iterations}),
-    hb_util:eunit_print(
-        "Computed ~p Lua executions in ~ps (~.2f calls/s)",
-        [Iterations, BenchTime, Iterations / BenchTime]
+    hb_test_utils:benchmark_print(
+        <<"Direct Lua:">>,
+        <<"executions">>,
+        Iterations,
+        BenchTime
     ),
     ?assert(Iterations > 10).
 
@@ -590,6 +617,7 @@ lua_http_hook_test() ->
     {ok, Module} = file:read_file("test/test.lua"),
     Node = hb_http_server:start_node(
         #{
+            priv_wallet => ar_wallet:new(),
             on => #{
                 <<"request">> =>
                     #{
@@ -606,87 +634,115 @@ lua_http_hook_test() ->
 
 %% @doc Call a process whose `execution-device' is set to `lua@5.3a'.
 pure_lua_process_test() ->
-    Process = generate_lua_process("test/test.lua"),
+    Process = generate_lua_process("test/test.lua", #{}),
     {ok, _} = hb_cache:write(Process, #{}),
-    Message = generate_test_message(Process),
+    Message = generate_test_message(Process, #{}),
     {ok, _} = hb_ao:resolve(Process, Message, #{ hashpath => ignore }),
     {ok, Results} = hb_ao:resolve(Process, <<"now">>, #{}),
-    ?event({results, Results}),
     ?assertEqual(42, hb_ao:get(<<"results/output/body">>, Results, #{})).
 
+%% @doc Call a process whose `execution-device' is set to `lua@5.3a'.
+pure_lua_restore_test() ->
+    Opts = #{ process_cache_frequency => 1 },
+    Process = generate_lua_process("test/test.lua", Opts),
+    {ok, _} = hb_cache:write(Process, Opts),
+    Message = generate_test_message(Process, Opts, #{ <<"path">> => <<"inc">>}),
+    {ok, _} = hb_ao:resolve(Process, Message, Opts#{ hashpath => ignore }),
+    {ok, Count1} = hb_ao:resolve(Process, <<"now/count">>, Opts),
+    ?assertEqual(1, Count1),
+    hb_ao:resolve(
+        Process,
+        generate_test_message(Process, #{}, #{ <<"path">> => <<"inc">>}),
+        Opts
+    ),
+    {ok, Count2} = hb_ao:resolve(Process, <<"now/count">>, Opts),
+    ?assertEqual(2, Count2).
+
 pure_lua_process_benchmark_test_() ->
-    {timeout, 30, fun() ->
-        BenchMsgs = 200,
-        Process = generate_lua_process("test/test.lua"),
-        Message = generate_test_message(Process),
-        lists:foreach(
-            fun(X) ->
-                hb_ao:resolve(Process, Message, #{ hashpath => ignore }),
-                ?event(debug_lua, {scheduled, X})
-            end,
-            lists:seq(1, BenchMsgs)
-        ),
-        ?event(debug_lua, {executing, BenchMsgs}),
-        BeforeExec = os:system_time(millisecond),
-        {ok, _} = hb_ao:resolve(
-            Process,
-            <<"now">>,
-            #{ hashpath => ignore, process_cache_frequency => 50 }
-        ),
-        AfterExec = os:system_time(millisecond),
-        ?event(debug_lua, {execution_time, (AfterExec - BeforeExec) / BenchMsgs}),
-        hb_util:eunit_print(
-            "Computed ~p pure Lua process executions in ~ps (~.2f calls/s)",
-            [
-                BenchMsgs,
-                (AfterExec - BeforeExec) / 1000,
-                BenchMsgs / ((AfterExec - BeforeExec) / 1000)
-            ]
-        )
+    {timeout,
+        30,
+        fun() ->
+            pure_lua_process_benchmark(#{
+                process_snapshot_slots => 50
+            })
     end}.
+pure_lua_process_benchmark(Opts) ->
+    BenchMsgs = 50,
+    hb:init(),
+    Process = generate_lua_process("test/test.lua", Opts),
+    {ok, _} = hb_cache:write(Process, Opts),
+    Message = generate_test_message(Process, Opts),
+    lists:foreach(
+        fun(X) ->
+            hb_ao:resolve(Process, Message, Opts#{ hashpath => ignore }),
+            ?event(debug_lua, {scheduled, X})
+        end,
+        lists:seq(1, BenchMsgs)
+    ),
+    ?event(debug_lua, {executing, BenchMsgs}),
+    BeforeExec = os:system_time(millisecond),
+    {ok, _} = hb_ao:resolve(Process, <<"now">>, Opts),
+    AfterExec = os:system_time(millisecond),
+    hb_test_utils:benchmark_print(
+        <<"Pure Lua process: Computed">>,
+        <<"slots">>,
+        BenchMsgs,
+        (AfterExec - BeforeExec) / 1000
+    ).
 
 invoke_aos_test() ->
-    Process = generate_lua_process("test/hyper-aos.lua"),
-    {ok, _} = hb_cache:write(Process, #{}),
-    Message = generate_test_message(Process),
-    {ok, _} = hb_ao:resolve(Process, Message, #{ hashpath => ignore }),
-    {ok, Results} = hb_ao:resolve(Process, <<"now/results/output/data">>, #{}),
-    ?assertEqual(<<"1">>, Results).
+    Opts = #{ priv_wallet => hb:wallet() },
+    Process = generate_lua_process("test/hyper-aos.lua", Opts),
+    {ok, _Proc} = hb_cache:write(Process, Opts),
+    Message = generate_test_message(Process, Opts),
+    {ok, _Assignment} = hb_ao:resolve(Process, Message, Opts#{ hashpath => ignore }),
+    {ok, Results} = hb_ao:resolve(Process, <<"now/results/output">>, Opts),
+    ?assertEqual(<<"1">>, hb_ao:get(<<"data">>, Results, #{})),
+    ?assertEqual(<<"aos> ">>, hb_ao:get(<<"prompt">>, Results, #{})).
 
 aos_authority_not_trusted_test() ->
-    Process = generate_lua_process("test/hyper-aos.lua"),
+    Opts = #{ priv_wallet => ar_wallet:new() },
+    Process = generate_lua_process("test/hyper-aos.lua", Opts),
     ProcID = hb_message:id(Process, all),
-    {ok, _} = hb_cache:write(Process, #{}),
-    GuestWallet = ar_wallet:new(),
-    Message = hb_message:commit(#{
-        <<"path">> => <<"schedule">>,
-        <<"method">> => <<"POST">>,
-        <<"body">> =>
-            hb_message:commit(
-                #{
-                    <<"target">> => ProcID,
-                    <<"type">> => <<"Message">>,
-                    <<"data">> => <<"1 + 1">>,
-                    <<"random-seed">> => rand:uniform(1337),
-                    <<"action">> => <<"Eval">>,
-                    <<"from-process">> => <<"1234">>
-
-        }, GuestWallet)
-      }, GuestWallet
+    {ok, _} = hb_cache:write(Process, Opts),
+    Message = hb_message:commit(
+        #{
+            <<"path">> => <<"schedule">>,
+            <<"method">> => <<"POST">>,
+            <<"body">> =>
+                hb_message:commit(
+                    #{
+                        <<"target">> => ProcID,
+                        <<"type">> => <<"Message">>,
+                        <<"data">> => <<"1 + 1">>,
+                        <<"random-seed">> => rand:uniform(1337),
+                        <<"action">> => <<"Eval">>,
+                        <<"from-process">> => <<"1234">>
+                    },
+                    Opts
+                )
+        },
+        Opts
     ),
-    {ok, _} = hb_ao:resolve(Process, Message, #{ hashpath => ignore }),
-    {ok, Results} = hb_ao:resolve(Process, <<"now/results/output/data">>, #{}),
-    ?assertEqual(Results, <<"Message is not trusted.">>).
+    ?event({message, Message}),
+    {ok, _} = hb_ao:resolve(Process, Message, Opts#{ hashpath => ignore }),
+    {ok, Results} = hb_ao:resolve(Process, <<"now/results/output/data">>, Opts),
+    ?assertEqual(<<"Message is not trusted.">>, Results).
 
 %% @doc Benchmark the performance of Lua executions.
 aos_process_benchmark_test_() ->
     {timeout, 30, fun() ->
-        BenchMsgs = 200,
-        Process = generate_lua_process("test/hyper-aos.lua"),
-        Message = generate_test_message(Process),
+        BenchMsgs = 10,
+        Opts = #{
+            process_async_cache => true,
+            hashpath => ignore,
+            process_snapshot_slots => 50
+        },
+        Process = generate_lua_process("test/hyper-aos.lua", Opts),
+        Message = generate_test_message(Process, Opts),
         lists:foreach(
             fun(X) ->
-                hb_ao:resolve(Process, Message, #{ hashpath => ignore }),
+                hb_ao:resolve(Process, Message, Opts),
                 ?event(debug_lua, {scheduled, X})
             end,
             lists:seq(1, BenchMsgs)
@@ -696,76 +752,90 @@ aos_process_benchmark_test_() ->
         {ok, _} = hb_ao:resolve(
             Process,
             <<"now">>,
-            #{ hashpath => ignore, process_cache_frequency => 50 }
+            Opts
         ),
         AfterExec = os:system_time(millisecond),
-        ?event(debug_lua, {execution_time, (AfterExec - BeforeExec) / BenchMsgs}),
-        hb_util:eunit_print(
-            "Computed ~p AOS process executions in ~ps (~.2f calls/s)",
-            [
-                BenchMsgs,
-                (AfterExec - BeforeExec) / 1000,
-                BenchMsgs / ((AfterExec - BeforeExec) / 1000)
-            ]
+        hb_test_utils:benchmark_print(
+            <<"HyperAOS process: Computed">>,
+            <<"slots">>,
+            BenchMsgs,
+            (AfterExec - BeforeExec) / 1000
         )
     end}.
 
 %%% Test helpers
 
 %% @doc Generate a Lua process message.
-generate_lua_process(File) ->
-    Wallet = hb:wallet(),
+generate_lua_process(File, Opts) ->
+    NormOpts = Opts#{ priv_wallet => hb_opts:get(priv_wallet, hb:wallet(), Opts) },
+    Wallet = hb_opts:get(priv_wallet, hb:wallet(), NormOpts),
+    Address = hb_util:human_id(ar_wallet:to_address(Wallet)),
     {ok, Module} = file:read_file(File),
-    hb_message:commit(#{
-        <<"device">> => <<"process@1.0">>,
-        <<"type">> => <<"Process">>,
-        <<"scheduler-device">> => <<"scheduler@1.0">>,
-        <<"execution-device">> => <<"lua@5.3a">>,
-        <<"module">> => #{
-            <<"content-type">> => <<"application/lua">>,
-            <<"body">> => Module
+    hb_message:commit(
+        #{
+            <<"device">> => <<"process@1.0">>,
+            <<"type">> => <<"Process">>,
+            <<"scheduler-device">> => <<"scheduler@1.0">>,
+            <<"execution-device">> => <<"lua@5.3a">>,
+            <<"module">> => #{
+                <<"content-type">> => <<"application/lua">>,
+                <<"body">> => Module
+            },
+            <<"authority">> => [ 
+                Address, 
+                <<"E3FJ53E6xtAzcftBpaw2E1H4ZM9h6qy6xz9NXh5lhEQ">>
+            ], 
+            <<"scheduler-location">> =>
+                hb_util:human_id(ar_wallet:to_address(Wallet)),
+            <<"test-random-seed">> => rand:uniform(1337)
         },
-        <<"authority">> => [ 
-          hb:address(), 
-          <<"E3FJ53E6xtAzcftBpaw2E1H4ZM9h6qy6xz9NXh5lhEQ">>
-        ], 
-        <<"scheduler-location">> =>
-            hb_util:human_id(ar_wallet:to_address(Wallet)),
-        <<"test-random-seed">> => rand:uniform(1337)
-    }, Wallet).
+        NormOpts
+    ).
 
 %% @doc Generate a test message for a Lua process.
-generate_test_message(Process) ->
+generate_test_message(Process, Opts) ->
+    generate_test_message(
+        Process,
+        Opts,
+        <<""" 
+        Count = 0
+        function add() 
+            Send({Target = 'Foo', Data = 'Bar' });
+            Count = Count + 1 
+        end
+        add()
+        return Count
+        """>>
+    ).
+generate_test_message(Process, Opts, ToEval) when is_binary(ToEval) ->
+    generate_test_message(
+        Process,
+        Opts,
+        #{
+            <<"action">> => <<"Eval">>,
+            <<"body">> => #{
+                <<"content-type">> => <<"application/lua">>,
+                <<"body">> => hb_util:bin(ToEval) 
+            }
+        }
+    );
+generate_test_message(Process, Opts, MsgBase) ->
     ProcID = hb_message:id(Process, all),
-    Wallet = hb:wallet(),
-    Code = """ 
-      Count = 0
-      function add() 
-        Send({Target = 'Foo', Data = 'Bar' });
-        Count = Count + 1 
-      end
-      add()
-      return Count
-    """,
+    NormOpts = Opts#{ priv_wallet => hb_opts:get(priv_wallet, hb:wallet(), Opts) },
     hb_message:commit(#{
             <<"path">> => <<"schedule">>,
             <<"method">> => <<"POST">>,
             <<"body">> =>
                 hb_message:commit(
-                    #{
+                    MsgBase#{
                         <<"target">> => ProcID,
                         <<"type">> => <<"Message">>,
-                        <<"body">> => #{
-                            <<"content-type">> => <<"application/lua">>,
-                            <<"body">> => list_to_binary(Code) 
-                        },
-                        <<"random-seed">> => rand:uniform(1337),
-                        <<"action">> => <<"Eval">>
+                        <<"random-seed">> => rand:uniform(1337)
                     },
-                    Wallet
+                    NormOpts
                 )
         },
-        Wallet
+        NormOpts
     ).
 
 %% @doc Generate a stack message for the Lua process.
@@ -773,7 +843,7 @@ generate_stack(File) ->
     Wallet = hb:wallet(),
     {ok, Module} = file:read_file(File),
     Msg1 = #{
-        <<"device">> => <<"Stack@1.0">>,
+        <<"device">> => <<"stack@1.0">>,
         <<"device-stack">> =>
             [
                 <<"json-iface@1.0">>,
diff --git a/src/dev_lua_lib.erl b/src/dev_lua_lib.erl
index 502fe59a9..ab7bbcc08 100644
--- a/src/dev_lua_lib.erl
+++ b/src/dev_lua_lib.erl
@@ -15,9 +15,14 @@
 %%% Library functions. Each exported function is _automatically_ added to the
 %%% Lua environment, except for the `install/3' function, which is used to
 %%% install the library in the first place.
--export([resolve/3, set/3, event/3, install/3]).
+-export([get/3, resolve/3, set/3, event/3, install/3]).
 -include("include/hb.hrl").
 
+%%% The set of devices that must be included in the device sandbox for an
+%%% execution that is able to perform AO-Core resolutions. Without the following
+%%% devices, all resolutions will fail.
+-define(MINIMAL_AO_CORE_DEVICES, [<<"structured@1.0">>]).
+
 %% @doc Install the library into the given Lua environment.
 install(Base, State, Opts) ->
     % Calculate and set the new `preloaded_devices' option.
@@ -44,11 +49,17 @@ install(Base, State, Opts) ->
                             ),
                         Dev
                     end,
-                    hb_util:message_to_ordered_list(DevNames)
+                    hb_util:message_to_ordered_list(
+                        hb_util:unique(DevNames ++ ?MINIMAL_AO_CORE_DEVICES)
+                    )
                 )
         end,
     ?event({adding_ao_core_resolver, {device_sandbox, AdmissibleDevs}}),
-    ExecOpts = Opts#{ preloaded_devices => AdmissibleDevs },
+    ExecOpts =
+        Opts#{
+            preloaded_devices => AdmissibleDevs,
+            hashpath => ignore
+        },
     % Initialize the AO-Core resolver.
     BaseAOTable =
         case luerl:get_table_keys_dec([ao], State) of
@@ -57,13 +68,13 @@ install(Base, State, Opts) ->
                 #{};
             {ok, ExistingTable, _} ->
                 ?event({existing_ao_table, ExistingTable}),
-                dev_lua:decode(ExistingTable)
+                dev_lua:decode(ExistingTable, Opts)
         end,
     ?event({base_ao_table, BaseAOTable}),
     {ok, State2} =
         luerl:set_table_keys_dec(
             [ao],
-            dev_lua:encode(BaseAOTable),
+            dev_lua:encode(BaseAOTable, Opts),
             State
         ),
     {
@@ -80,7 +91,8 @@ install(Base, State, Opts) ->
                                 lists:map(
                                     fun(Arg) ->
                                         dev_lua:decode(
-                                            luerl:decode(Arg, ImportState)
+                                            luerl:decode(Arg, ImportState),
+                                            Opts
                                         )
                                     end,
                                     RawArgs
@@ -89,7 +101,7 @@ install(Base, State, Opts) ->
                             {Res, ResState} =
                                 ?MODULE:FuncName(Args, ImportState, ExecOpts),
                             % Encode the response for return to Lua
-                            return(Res, ResState)
+                            return(Res, ResState, Opts)
                         end,
                         StateIn
                     ),
@@ -107,9 +119,9 @@ install(Base, State, Opts) ->
     }.
 
 %% @doc Helper function for returning a result from a Lua function.
-return(Result, ExecState) ->
+return(Result, ExecState, Opts) ->
     ?event(lua_import, {import_returning, {result, Result}}),
-    TableEncoded = dev_lua:encode(Result),
+    TableEncoded = dev_lua:encode(hb_cache:ensure_all_loaded(Result, Opts), Opts),
     {ReturnParams, ResultingState} =
         lists:foldr(
             fun(LuaEncoded, {Params, StateIn}) ->
@@ -127,7 +139,7 @@ return(Result, ExecState) ->
 %% (using `hb_ao:resolve_many/2') variants.
 resolve([SingletonMsg], ExecState, ExecOpts) ->
     ?event({ao_core_resolver, {msg, SingletonMsg}}),
-    ParsedMsgs = hb_singleton:from(SingletonMsg),
+    ParsedMsgs = hb_singleton:from(SingletonMsg, ExecOpts),
     ?event({parsed_msgs_to_resolve, ParsedMsgs}),
     resolve({many, ParsedMsgs}, ExecState, ExecOpts);
 resolve([Base, Path], ExecState, ExecOpts) when is_binary(Path) ->
@@ -147,6 +159,13 @@ resolve({many, Msgs}, ExecState, ExecOpts) ->
             {[<<"error">>, Error], ExecState}
     end.
 
+%% @doc A wrapper for `hb_ao''s `get' functionality.
+get([Key, Base], ExecState, ExecOpts) ->
+    ?event({ao_core_get, {base, Base}, {key, Key}}),
+    NewRes = hb_ao:get(convert_as(Key), convert_as(Base), ExecOpts),
+    ?event({ao_core_get_result, {result, NewRes}}),
+    {[NewRes], ExecState}.
+
 %% @doc Converts any `as' terms from Lua to their HyperBEAM equivalents.
 convert_as([<<"as">>, Device, RawMsg]) ->
     {as, Device, RawMsg};
diff --git a/src/dev_lua_test.erl b/src/dev_lua_test.erl
index 399e7c769..0d945934e 100644
--- a/src/dev_lua_test.erl
+++ b/src/dev_lua_test.erl
@@ -44,7 +44,11 @@ parse_spec(Str) when is_list(Str) ->
 parse_spec(tests) ->
     % The user has not given a test spec, so we default to running all tests in
     % the `LUA_SCRIPTS' directory (defaulting to `scripts/').
-    {ok, Files} = file:list_dir(ScriptDir = hb_opts:get(lua_scripts)),
+    Files = 
+        case file:list_dir(ScriptDir = hb_opts:get(lua_scripts)) of
+            {ok, FileList} -> FileList;
+            {error, enoent} -> []
+        end,
     RelevantFiles = 
         lists:filter(
             fun(File) ->
@@ -150,7 +154,7 @@ exec_test(State, Function) ->
     case Status of
         ok -> ok;
         error ->
-            hb_util:debug_print(Result, <<"Lua">>, Function, 1),
+            hb_format:print(Result, <<"Lua">>, Function, 1),
             ?assertEqual(
                 ok,
                 Status
diff --git a/src/dev_lua_test_ledgers.erl b/src/dev_lua_test_ledgers.erl
new file mode 100644
index 000000000..33e5215d7
--- /dev/null
+++ b/src/dev_lua_test_ledgers.erl
@@ -0,0 +1,953 @@
+%%% A collection of Eunit tests for the `lua@5.3a` device, and the 
+%%% `hyper-token.lua` script. These tests are designed to validate the
+%%% functionality of both of these components, and to provide examples
+%%% of how to use the `lua@5.3a` device.
+%%% 
+%%% The module is split into four components:
+%%% 1. A simple ledger client library.
+%%% 2. Assertion functions that verify specific invariants about the state
+%%%    of ledgers in a test environment.
+%%% 3. Utility functions for normalizing the state of a test environment.
+%%% 4. Test cases that generate and manipulate ledger networks in test
+%%%    environments.
+%%% 
+%%% Many client and utility functions in this module handle the conversion of
+%%% wallet IDs to human-readable addresses when found in transfers, balances,
+%%% and other fields. This is done to make the test cases more readable and
+%%% easier to understand -- be careful if following their patterns in other
+%%% contexts to either mimic a similar pattern, or to ensure you pass addresses
+%%% in these contexts rather that full wallet objects.
+-module(dev_lua_test_ledgers).
+-include_lib("eunit/include/eunit.hrl").
+-include_lib("include/hb.hrl").
+
+%%% Ledger client library.
+%%% 
+%%% A simple, thin library for generating ledgers and interacting with 
+%%% `hyper-token.lua` processes.
+
+%% @doc Generate a Lua process definition message.
+ledger(Script, Opts) ->
+    ledger(Script, #{}, Opts).
+ledger(Script, Extra, Opts) ->
+    % If the `balance' key is set in the `Extra' map, ensure that any wallets
+    % given as keys in the message are converted to human-readable addresses.
+    HostWallet = hb_opts:get(priv_wallet, hb:wallet(), Opts),
+    ModExtra =
+        case maps:get(<<"balance">>, Extra, undefined) of
+            undefined -> Extra;
+            RawBalance ->
+                Extra#{
+                    <<"balance">> =>
+                        maps:from_list(
+                            lists:map(
+                                fun({ID, Amount}) when ?IS_ID(ID) ->
+                                    {hb_util:human_id(ID), Amount};
+                                ({Wallet, Amount}) when is_tuple(Wallet) ->
+                                    {
+                                        hb_util:human_id(
+                                            ar_wallet:to_address(Wallet)
+                                        ),
+                                        Amount
+                                    }
+                                end,
+                                maps:to_list(RawBalance)
+                            )
+                        )
+                }
+        end,
+    Proc =
+        hb_message:commit(
+            maps:merge(
+                #{
+                    <<"device">> => <<"process@1.0">>,
+                    <<"type">> => <<"Process">>,
+                    <<"scheduler-device">> => <<"scheduler@1.0">>,
+                    <<"scheduler">> => hb_util:human_id(HostWallet),
+                    <<"execution-device">> => <<"lua@5.3a">>,
+                    <<"authority">> => hb_util:human_id(HostWallet),
+                    <<"module">> => lua_script(Script)
+                },
+                ModExtra
+            ),
+            Opts#{ priv_wallet => HostWallet }
+        ),
+    hb_cache:write(Proc, Opts),
+    Proc.
+
+%% @doc Generate a Lua `script' key from a file or list of files.
+lua_script(Files) when is_list(Files) ->
+    [
+        #{
+            <<"content-type">> => <<"application/lua">>,
+            <<"module">> => File,
+            <<"body">> =>
+                hb_util:ok(
+                    file:read_file(
+                        if is_binary(File) -> binary_to_list(File);
+                           true -> File
+                        end
+                    )
+                )
+        }
+    ||
+        File <- Files
+    ];
+lua_script(File) when is_binary(File) ->
+    hd(lua_script([File])).
+
+%% @doc Generate a test sub-ledger process definition message.
+subledger(Root, Opts) ->
+    subledger(Root, #{}, Opts).
+subledger(Root, Extra, Opts) ->
+    BareRoot =
+        maps:without(
+            [<<"token">>, <<"balance">>],
+            hb_message:uncommitted(Root)
+        ),
+    Proc = 
+        hb_message:commit(
+            maps:merge(
+                BareRoot#{
+                    <<"token">> => hb_message:id(Root, all)
+                },
+                Extra
+            ),
+            hb_opts:get(priv_wallet, hb:wallet(), Opts)
+        ),
+    hb_cache:write(Proc, Opts),
+    Proc.
+
+%% @doc Generate a test transfer message.
+transfer(ProcMsg, Sender, Recipient, Quantity, Opts) ->
+    transfer(ProcMsg, Sender, Recipient, Quantity, undefined, Opts).
+transfer(ProcMsg, Sender, Recipient, Quantity, Route, Opts) ->
+    MaybeRoute =
+        if Route == undefined -> #{};
+           true ->
+                #{
+                    <<"route">> =>
+                        if is_map(Route) -> hb_message:id(Route, all);
+                        true -> Route
+                        end
+                }
+        end,
+    Xfer =
+        hb_message:commit(#{
+            <<"path">> => <<"push">>,
+            <<"body">> =>
+                hb_message:commit(MaybeRoute#{
+                        <<"action">> => <<"Transfer">>,
+                        <<"target">> => hb_message:id(ProcMsg, all),
+                        <<"recipient">> => hb_util:human_id(Recipient),
+                        <<"quantity">> => Quantity
+                    },
+                    Sender
+                )
+            },
+            Sender
+        ),
+    hb_ao:resolve(
+        ProcMsg,
+        Xfer,
+        Opts#{ priv_wallet => hb_opts:get(priv_wallet, hb:wallet(), Opts) }
+    ).
+
+%% @doc Request that a peer register with a without sub-ledger.
+register(ProcMsg, Peer, Opts) when is_map(Peer) ->
+    register(ProcMsg, hb_message:id(Peer, all), Opts);
+register(ProcMsg, PeerID, RawOpts) ->
+    Opts =
+        RawOpts#{
+            priv_wallet => hb_opts:get(priv_wallet, hb:wallet(), RawOpts)
+        },
+    Reg =
+        hb_message:commit(
+            #{
+                <<"path">> => <<"push">>,
+                <<"body">> =>
+                    hb_message:commit(
+                        #{
+                            <<"action">> => <<"register-remote">>,
+                            <<"target">> => hb_message:id(ProcMsg, all),
+                            <<"peer">> => PeerID
+                        },
+                        Opts
+                    )
+            },
+            Opts
+        ),
+    hb_ao:resolve(
+        ProcMsg,
+        Reg,
+        Opts
+    ).
+
+%% @doc Retreive a single balance from the ledger.
+balance(ProcMsg, User, Opts) when not ?IS_ID(User) ->
+    balance(ProcMsg, hb_util:human_id(ar_wallet:to_address(User)), Opts);
+balance(ProcMsg, ID, Opts) ->
+    hb_ao:get(<<"now/balance/", ID/binary>>, ProcMsg, 0, Opts).
+
+%% @doc Get the total balance for an ID across all ledgers in a set.
+balance_total(Procs, ID, Opts) ->
+    lists:sum(
+        lists:map(
+            fun(Proc) -> balance(Proc, ID, Opts) end,
+            maps:values(normalize_env(Procs))
+        )
+    ).
+
+%% @doc Get the balances of a ledger.
+balances(ProcMsg, Opts) ->
+    balances(now, ProcMsg, Opts).
+balances(initial, ProcMsg, Opts) ->
+    balances(<<"">>, ProcMsg, Opts);
+balances(Mode, ProcMsg, Opts) when is_atom(Mode) ->
+    balances(hb_util:bin(Mode), ProcMsg, Opts);
+balances(Prefix, ProcMsg, Opts) ->
+    Balances = hb_ao:get(<<Prefix/binary, "/balance">>, ProcMsg, #{}, Opts),
+    hb_private:reset(hb_cache:ensure_all_loaded(Balances, Opts)).
+
+%% @doc Get the supply of a ledger, either `now` or `initial`.
+supply(ProcMsg, Opts) ->
+    supply(now, ProcMsg, Opts).
+supply(Mode, ProcMsg, Opts) ->
+    lists:sum(maps:values(balances(Mode, ProcMsg, Opts))).
+
+%% @doc Calculate the supply of tokens in all sub-ledgers, from the balances of
+%% the root ledger.
+subledger_supply(RootProc, AllProcs, Opts) ->
+    supply(now, RootProc, Opts) - user_supply(RootProc, AllProcs, Opts).
+
+%% @doc Calculate the supply of tokens held by users on a ledger, excluding
+%% those held in sub-ledgers.
+user_supply(Proc, AllProcs, Opts) ->
+    NormProcs = normalize_without_root(Proc, AllProcs),
+    SubledgerIDs = maps:keys(NormProcs),
+    lists:sum(
+        maps:values(
+            maps:without(
+                SubledgerIDs,
+                balances(now, Proc, Opts)
+            )
+        )
+    ).
+
+%% @doc Get the local expectation of a ledger's balances with peer ledgers.
+ledgers(ProcMsg, Opts) ->
+    case hb_cache:ensure_all_loaded(
+        hb_ao:get(<<"now/ledgers">>, ProcMsg, #{}, Opts),
+        Opts
+    ) of
+        Msg when is_map(Msg) -> hb_private:reset(Msg);
+        [] -> #{}
+    end.
+
+%% @doc Generate a complete overview of the test environment's balances and 
+%% ledgers. Optionally, a map of environment names can be provided to make the
+%% output more readable.
+map(Procs, Opts) ->
+    NormProcs = normalize_env(Procs),
+    maps:merge_with(
+        fun(Key, Balances, Ledgers) ->
+            MaybeRoot =
+                case maps:get(Key, NormProcs, #{}) of
+                    #{ <<"token">> := _ } -> #{};
+                    _ -> #{ root => true }
+                end,
+            MaybeRoot#{
+                balances => Balances,
+                ledgers => Ledgers
+            }
+        end,
+        maps:map(fun(_, Proc) -> balances(Proc, Opts) end, NormProcs),
+        maps:map(fun(_, Proc) -> ledgers(Proc, Opts) end, NormProcs)
+    ).
+map(Procs, EnvNames, Opts) ->
+    apply_names(map(Procs, Opts), EnvNames, Opts).
+
+%% @doc Apply a map of environment names to elements in either a map or list.
+%% Expects a map of `ID or ProcMsg or Wallet => Name' as the `EnvNames' argument,
+%% and a potentially deep map or list of elements to apply the names to.
+apply_names(Map, EnvNames, Opts) ->
+    IDs =
+        maps:from_list(
+            lists:filtermap(
+                fun({Key, V}) ->
+                    try {true, {hb_util:human_id(Key), V}}
+                    catch _:_ ->
+                        try {true, {hb_message:id(Key, all), V}}
+                        catch _:_ -> false
+                        end
+                    end
+                end,
+                maps:to_list(EnvNames)
+            )
+        ),
+    do_apply_names(Map, maps:merge(IDs, EnvNames), Opts).
+do_apply_names(Map, EnvNames, Opts) when is_map(Map) ->
+    maps:from_list(
+        lists:map(
+            fun({Key, Proc}) ->
+                {
+                    apply_names(Key, EnvNames, Opts),
+                    apply_names(Proc, EnvNames, Opts)
+                }
+            end,
+            maps:to_list(Map)
+        )
+    );
+do_apply_names(List, EnvNames, Opts) when is_list(List) ->
+    lists:map(
+        fun(Proc) ->
+            apply_names(Proc, EnvNames, Opts)
+        end,
+        List
+    );
+do_apply_names(Item, Names, _Opts) when is_map_key(Item, Names) ->
+    maps:get(Item, Names);
+do_apply_names(Item, Names, _Opts) ->
+    try maps:get(hb_util:human_id(Item), Names, Item)
+    catch _:_ -> Item
+    end.
+
+%%% Test ledger network invariants.
+%%% 
+%%% Complex assertions that verify specific invariants about the state of
+%%% ledgers in a test environment. These are used to validate the correctness
+%%% of the `hyper-token.lua` script. Tested invariants are listed below.
+%%% 
+%%% For every timestep `t_n`, the following invariants must hold:
+%%% 1. The root ledger supply at `t_0` must match the current supply.
+%%% 2. For every sub-ledger `l`, each expected balance held in `l/now/ledgers`
+%%%    must equal the balance found at `peer/now/balance/l`.
+%%% 3. The sum of all values in `/now/balance` across all sub-ledgers must
+%%%    equal the root ledger's supply.
+
+%% @doc Execute all invariant checks for a pair of root ledger and sub-ledgers.
+verify_net(RootProc, AllProcs, Opts) ->
+    verify_net_supply(RootProc, AllProcs, Opts),
+    verify_net_peer_balances(AllProcs, Opts).
+
+%% @doc Verify that the initial supply of tokens on the root ledger is the same
+%% as the current supply. This invariant will not hold for sub-ledgers, as they
+%% 'mint' tokens in their local supply when they receive them from other ledgers.
+verify_root_supply(RootProc, Opts) ->
+    ?assert(
+        supply(initial, RootProc, Opts) ==
+        supply(now, RootProc, Opts) +
+            lists:sum(maps:values(ledgers(RootProc, Opts)))
+    ).
+
+%% @doc Verify that the sum of all spendable balances held by ledgers in a
+%% test network is equal to the initial supply of tokens.
+verify_net_supply(RootProc, AllProcs, Opts) ->
+    verify_root_supply(RootProc, Opts),
+    StartingRootSupply = supply(initial, RootProc, Opts),
+    NormProcsWithoutRoot = normalize_without_root(RootProc, AllProcs),
+    SubledgerIDs = maps:keys(NormProcsWithoutRoot),
+    RootUserSupply = user_supply(RootProc, NormProcsWithoutRoot, Opts),
+    SubledgerSupply = subledger_supply(RootProc, AllProcs, Opts),
+    ?event({verify_net_supply, {root, RootUserSupply}, {subledger, SubledgerSupply}}),
+    ?assert(
+        StartingRootSupply ==
+        RootUserSupply + SubledgerSupply
+    ).
+
+%% @doc Verify the consistency of all expected ledger balances with their peer
+%% ledgers and the actual balances held.
+verify_net_peer_balances(AllProcs, Opts) ->
+    NormProcs = normalize_env(AllProcs),
+    maps:map(
+        fun(ValidateProc, _) ->
+            verify_peer_balances(ValidateProc, NormProcs, Opts)
+        end,
+        NormProcs
+    ).
+
+%% @doc Verify that a ledger's expectation of its balances with peer ledgers
+%% is consistent with the actual balances held.
+verify_peer_balances(ValidateProc, AllProcs, Opts) ->
+    Ledgers = ledgers(ValidateProc, Opts),
+    NormProcs = normalize_env(AllProcs),
+    maps:map(
+        fun(PeerID, ExpectedBalance) ->
+            ?assertEqual(
+                ExpectedBalance,
+                balance(ValidateProc,
+                    maps:get(PeerID, NormProcs),
+                    Opts
+                )
+            )
+        end,
+        Ledgers
+    ).
+
+%%% Test utilities.
+
+%% @doc Normalize a set of processes, representing ledgers in a test environment,
+%% to a canonical form: A map of `ID => Proc`.
+normalize_env(Procs) when is_map(Procs) ->
+    normalize_env(maps:values(Procs));
+normalize_env(Procs) when is_list(Procs) ->
+    maps:from_list(
+        lists:map(
+            fun(Proc) ->
+                {hb_message:id(Proc, all), Proc}
+            end,
+            Procs
+        )
+    ).
+
+%% @doc Return the normalized environment without the root ledger.
+normalize_without_root(RootProc, Procs) ->
+    maps:without([hb_message:id(RootProc, all)], normalize_env(Procs)).
+
+%% @doc Create a node message for the test that avoids looking up unknown 
+%% recipients via remote stores. This improves test performance.
+test_opts() ->
+    hb:init(),
+    #{}.
+
+%%% Test cases.
+
+%% @doc Test the `transfer` function.
+%% 1. Alice has 100 tokens on a root ledger.
+%% 2. Alice sends 1 token to Bob.
+%% 3. Alice has 99 tokens, and Bob has 1 token.
+transfer_test_() -> {timeout, 30, fun transfer/0}.
+transfer() ->
+    Opts = test_opts(),
+    Alice = ar_wallet:new(),
+    Bob = ar_wallet:new(),
+    Proc =
+        ledger(
+            <<"scripts/hyper-token.lua">>,
+            #{ <<"balance">> => #{ Alice => 100 } },
+            Opts
+        ),
+    ?assertEqual(100, supply(Proc, Opts)),
+    transfer(Proc, Alice, Bob, 1, Opts),
+    ?assertEqual(99, balance(Proc, Alice, Opts)),
+    ?assertEqual(1, balance(Proc, Bob, Opts)),
+    ?assertEqual(100, supply(Proc, Opts)).
+
+%% @doc User's must not be able to send tokens they do not own. We test three
+%% cases:
+%% 1. Transferring a token when the sender has no tokens.
+%% 2. Transferring a token when the sender has less tokens than the amount
+%%    being transferred.
+%% 3. Transferring a binary-encoded amount of tokens that exceed the quantity
+%%    of tokens the sender has available.
+transfer_unauthorized_test_() -> {timeout, 30, fun transfer_unauthorized/0}.
+transfer_unauthorized() ->
+    Opts = test_opts(),
+    Alice = ar_wallet:new(),
+    Bob = ar_wallet:new(),
+    Proc =
+        ledger(
+            <<"scripts/hyper-token.lua">>,
+            #{ <<"balance">> => #{ Alice => 100 } },
+            Opts
+        ),
+    % 1. Transferring a token when the sender has no tokens.
+    Result = transfer(Proc, Bob, Alice, 1, Opts),
+    ?event({unauthorized_transfer, {result, Result}}),
+    % 2. Transferring a token when the sender has less tokens than the amount
+    %    being transferred.
+    transfer(Proc, Alice, Bob, 101, Opts),
+    ?event({unauthorized_transfer, {result, Result}}),
+    receive after 1000 -> ok end,
+    ?event({env, map([Proc], #{ Alice => alice, Bob => bob }, Opts)}),
+    ?assertEqual(100, balance(Proc, Alice, Opts)),
+    ?assertEqual(0, balance(Proc, Bob, Opts)),
+    % 3. Transferring a binary-encoded amount of tokens that exceed the quantity
+    %    of tokens the sender has available.
+    transfer(Proc, Alice, Bob, <<"101">>, Opts),
+    ?assertEqual(100, balance(Proc, Alice, Opts)),
+    ?assertEqual(0, balance(Proc, Bob, Opts)),
+    % Validate the final supply of tokens.
+    ?assertEqual(100, supply(Proc, Opts)).
+
+%% @doc Verify that a user can deposit tokens into a sub-ledger.
+subledger_deposit_test_() -> {timeout, 30, fun subledger_deposit/0}.
+subledger_deposit() ->
+    Opts = test_opts(),
+    Alice = ar_wallet:new(),
+    Proc =
+        ledger(
+            <<"scripts/hyper-token.lua">>,
+            #{ <<"balance">> => #{ Alice => 100 } },
+            Opts
+        ),
+    SubLedger = subledger(Proc, Opts),
+    % 1. Alice has tokens on the root ledger.
+    ?assertEqual(100, balance(Proc, Alice, Opts)),
+    % 2. Alice deposits tokens into the sub-ledger.
+    transfer(Proc, Alice, Alice, 10, SubLedger, Opts),
+    ?event({after_deposit, {result, map([Proc, SubLedger], Opts)} }),
+    ?assertEqual(90, balance(Proc, Alice, Opts)),
+    ?assertEqual(10, balance(SubLedger, Alice, Opts)),
+    % Verify all invariants.
+    verify_net(Proc, [SubLedger], Opts).
+
+%% @doc Simulate inter-ledger payments between users on a single sub-ledger:
+%% 1. Alice has tokens on the root ledger.
+%% 2. Alice sends tokens to the sub-ledger from the root ledger.
+%% 3. Alice sends tokens to Bob on the sub-ledger.
+%% 4. Bob sends tokens to Alice on the root ledger.
+subledger_transfer_test_() -> {timeout, 10, fun subledger_transfer/0}.
+subledger_transfer() ->
+    Opts = test_opts(),
+    Alice = ar_wallet:new(),
+    Bob = ar_wallet:new(),
+    RootLedger =
+        ledger(
+            <<"scripts/hyper-token.lua">>,
+            #{ <<"balance">> => #{ Alice => 100 } },
+            Opts
+        ),
+    SubLedger = subledger(RootLedger, Opts),
+    EnvNames = #{
+        Alice => alice,
+        Bob => bob,
+        RootLedger => root,
+        SubLedger => subledger
+    },
+    % 1. Alice has tokens on the root ledger.
+    ?assertEqual(100, balance(RootLedger, Alice, Opts)),
+    ?event(token_log, {map, map([RootLedger], EnvNames, Opts)}),
+    % 2. Alice sends tokens to the sub-ledger from the root ledger.
+    transfer(RootLedger, Alice, Alice, 10, SubLedger, Opts),
+    ?assertEqual(90, balance(RootLedger, Alice, Opts)),
+    ?assertEqual(10, balance(SubLedger, Alice, Opts)),
+    % 3. Alice sends tokens to Bob on the sub-ledger.
+    transfer(SubLedger, Alice, Bob, 8, Opts),
+    ?event(token_log, 
+        {state_after_subledger_user_xfer,
+            {names, map([RootLedger, SubLedger], EnvNames, Opts)},
+            {ids, map([RootLedger, SubLedger], Opts)}
+        }),
+    % 4. Bob sends tokens to Alice on the root ledger.
+    transfer(SubLedger, Bob, Bob, 7, RootLedger, Opts),
+    % Validate the balances of the root and sub-ledgers.
+    Map = map([RootLedger, SubLedger], EnvNames, Opts),
+    ?event(token_log, {map, map([RootLedger, SubLedger], Opts)}),
+    ?assertEqual(
+        #{
+            root => #{
+                balances => #{ alice => 90, bob => 7.0, subledger => 3.0 },
+                ledgers => #{},
+                root => true
+            },
+            subledger => #{
+                balances => #{ alice => 2, bob => 1 },
+                ledgers => #{}
+            }
+        },
+        Map
+    ),
+    % Validate all invariants.
+    verify_net(RootLedger, [SubLedger], Opts).
+
+%% @doc Verify that peer ledgers on the same token are able to register mutually
+%% to establish a peer-to-peer connection.
+%% 
+%% Disabled as explicit peer registration is not required for `hyper-token.lua'
+%% to function.
+subledger_registration_test_disabled() ->
+    Opts = test_opts(),
+    Alice = ar_wallet:new(),
+    RootLedger =
+        ledger(
+            <<"scripts/hyper-token.lua">>,
+            #{ <<"balance">> => #{ Alice => 100 } },
+            Opts
+        ),
+    SubLedger1 = subledger(RootLedger, Opts),
+    SubLedger2 = subledger(RootLedger, Opts),
+    Names = #{
+        SubLedger1 => subledger1,
+        SubLedger2 => subledger2
+    },
+    ?event(debug,
+        {subledger,
+            {sl1, hb_message:id(SubLedger1, none)},
+            {sl2, hb_message:id(SubLedger2, none)}
+        }
+    ),
+    % There are no registered peers on either sub-ledger.
+    ?assertEqual(0, map_size(ledgers(SubLedger1, Opts))),
+    ?assertEqual(0, map_size(ledgers(SubLedger2, Opts))),
+    % Alice registers with SubLedger1.
+    register(SubLedger1, SubLedger2, Opts),
+    ?event({map, map([SubLedger1, SubLedger2], Names, Opts)}),
+    ?event({sl1_ledgers, ledgers(SubLedger1, Opts)}),
+    ?event({sl2_ledgers, ledgers(SubLedger2, Opts)}),
+    % SubLedger1 and SubLedger2 are now aware of each other.
+    ?assertEqual(1, map_size(ledgers(SubLedger1, Opts))),
+    ?assertEqual(1, map_size(ledgers(SubLedger2, Opts))),
+    % Alice can send tokens to Bob on SubLedger2.
+    verify_net(RootLedger, [SubLedger1, SubLedger2], Opts).
+
+single_subledger_to_subledger_test_() -> {timeout, 30, fun single_subledger_to_subledger/0}.
+single_subledger_to_subledger() ->
+    Opts = test_opts(),
+    Alice = ar_wallet:new(),
+    Bob = ar_wallet:new(),
+    RootLedger =
+        ledger(
+            <<"scripts/hyper-token.lua">>,
+            #{ <<"balance">> => #{ Alice => 100 } },
+            Opts
+        ),
+    SubLedger1 = subledger(RootLedger, Opts),
+    SL1ID = hb_message:id(SubLedger1, signed, Opts),
+    ?event({sl1ID, SL1ID}),
+    SubLedger2 = subledger(RootLedger, Opts),
+    SL2ID = hb_message:id(SubLedger2, signed, Opts),
+    ?event({sl2ID, SL2ID}),
+    Names = #{
+        Alice => alice,
+        Bob => bob,
+        RootLedger => root,
+        SubLedger1 => subledger1,
+        SubLedger2 => subledger2
+    },
+    ?event({root_ledger, RootLedger}),
+    ?event({sl1, SubLedger1}),
+    ?event({sl2, SubLedger2}),
+    ?assertEqual(100, balance(RootLedger, Alice, Opts)),
+    % 2. Alice sends 90 tokens to herself on SubLedger1.
+    ?event({transfer_1}),
+    transfer(RootLedger, Alice, Alice, 90, SubLedger1, Opts),
+    ?assertEqual(10, balance(RootLedger, Alice, Opts)),
+    ?assertEqual(90, balance(SubLedger1, Alice, Opts)),
+    ?event({transfer_2}),
+    PushRes = transfer(SubLedger1, Alice, Alice, 80, SubLedger2, Opts),
+    ?event({push_res, PushRes}),
+    ?event({map, map([RootLedger, SubLedger1, SubLedger2], Opts)}),
+    ?assertEqual(80, balance(SubLedger2, Alice, Opts)),
+    ?assertEqual(10, balance(SubLedger1, Alice, Opts)).
+
+%% @doc Verify that registered sub-ledgers are able to send tokens to each other
+%% without the need for messages on the root ledger.
+subledger_to_subledger_test_() -> {timeout, 30, fun subledger_to_subledger/0}.
+subledger_to_subledger() ->
+    Opts = test_opts(),
+    Alice = ar_wallet:new(),
+    Bob = ar_wallet:new(),
+    RootLedger =
+        ledger(
+            <<"scripts/hyper-token.lua">>,
+            #{ <<"balance">> => #{ Alice => 100 } },
+            Opts
+        ),
+    SubLedger1 = subledger(RootLedger, Opts),
+    SubLedger2 = subledger(RootLedger, Opts),
+    Names = #{
+        Alice => alice,
+        Bob => bob,
+        RootLedger => root,
+        SubLedger1 => subledger1,
+        SubLedger2 => subledger2
+    },
+    % 1. Alice has tokens on the root ledger.
+    ?assertEqual(100, balance(RootLedger, Alice, Opts)),
+    % 2. Alice sends 90 tokens to herself on SubLedger1.
+    transfer(RootLedger, Alice, Alice, 90, SubLedger1, Opts),
+    % 3. Alice sends 10 tokens to Bob on SubLedger2.
+    transfer(SubLedger1, Alice, Bob, 10, SubLedger2, Opts),
+    ?event({map, map([RootLedger, SubLedger1, SubLedger2], Names, Opts)}),
+    ?assertEqual(10, balance(RootLedger, Alice, Opts)),
+    ?assertEqual(80, balance(SubLedger1, Alice, Opts)),
+    ?assertEqual(10, balance(SubLedger2, Bob, Opts)),
+    verify_net(RootLedger, [SubLedger1, SubLedger2], Opts),
+    % 5. Bob sends 5 tokens to himself on SubLedger1.
+    transfer(SubLedger2, Bob, Bob, 5, SubLedger1, Opts),
+    transfer(SubLedger2, Bob, Alice, 4, SubLedger1, Opts),
+    ?event({map, map([RootLedger, SubLedger1, SubLedger2], Names, Opts)}),
+    ?assertEqual(10, balance(RootLedger, Alice, Opts)),
+    ?assertEqual(5, balance(SubLedger1, Bob, Opts)),
+    ?assertEqual(84, balance(SubLedger1, Alice, Opts)),
+    ?assertEqual(1, balance(SubLedger2, Bob, Opts)),
+    verify_net(RootLedger, [SubLedger1, SubLedger2], Opts).
+
+%% @doc Verify that a ledger can send tokens to a peer ledger that is not
+%% registered with it yet. Each peer ledger must have precisely the same process
+%% base message, granting transitive security properties: If a peer trusts its
+%% own compute and assignment mechanism, then it can trust messages from exact
+%% duplicates of itself. In order for this to be safe, the peer ledger network's
+%% base process message must implement sufficicient rollback protections and 
+%% compute correctness guarantees.
+unregistered_peer_transfer_test_() -> {timeout, 30, fun unregistered_peer_transfer/0}.
+unregistered_peer_transfer() ->
+    Opts = #{},
+    Alice = ar_wallet:new(),
+    Bob = ar_wallet:new(),
+    RootLedger =
+        ledger(
+            <<"scripts/hyper-token.lua">>,
+            #{ <<"balance">> => #{ Alice => 100 } },
+            Opts
+        ),
+    SubLedgers = [ subledger(RootLedger, Opts) || _ <- lists:seq(1, 3) ],
+    SubLedger1 = lists:nth(1, SubLedgers),
+    SubLedger2 = lists:nth(2, SubLedgers),
+    SubLedger3 = lists:nth(3, SubLedgers),
+    Names = #{
+        Alice => alice,
+        Bob => bob,
+        RootLedger => root,
+        SubLedger1 => subledger1,
+        SubLedger2 => subledger2,
+        SubLedger3 => subledger3
+    },
+    % 1. Alice has tokens on the root ledger.
+    ?assertEqual(100, balance(RootLedger, Alice, Opts)),
+    transfer(RootLedger, Alice, Alice, 90, SubLedger1, Opts),
+    % Verify the state before the multi-hop transfer.
+    ?assertEqual(10, balance(RootLedger, Alice, Opts)),
+    ?assertEqual(90, balance(SubLedger1, Alice, Opts)),
+    % 4. Alice sends 10 tokens to Bob on SubLedger3, via SubLedger2.
+    transfer(RootLedger, Alice, Bob, 10, SubLedger2, Opts),
+    ?assertEqual(0, balance(RootLedger, Alice, Opts)),
+    ?assertEqual(90, balance(SubLedger1, Alice, Opts)),
+    ?assertEqual(10, balance(SubLedger2, Bob, Opts)),
+    % 5. Bob sends 10 tokens to himself on SubLedger3.
+    transfer(SubLedger1, Alice, Bob, 50, SubLedger3, Opts),
+    % Verify the final state of all ledgers.
+    ?event(debug,
+        {map,
+            map(
+                [RootLedger, SubLedger1, SubLedger2, SubLedger3],
+                Names,
+                Opts
+            )
+        }
+    ),
+    ?assertEqual(0, balance(RootLedger, Alice, Opts)),
+    ?assertEqual(40, balance(SubLedger1, Alice, Opts)),
+    ?assertEqual(10, balance(SubLedger2, Bob, Opts)),
+    ?assertEqual(50, balance(SubLedger3, Bob, Opts)),
+    verify_net(RootLedger, SubLedgers, Opts).
+
+%% @doc Verify that sub-ledgers can request and enforce multiple scheduler
+%% commitments. `hyper-token' always validates that peer `base' processes
+%% (the uncommitted process ID without its `scheduler' and `authority' fields)
+%% match. It allows us to specify additional constraints on the `scheduler' and
+%% `authority' fields while matching against the local ledger's base process
+%% message. This test validates the correctness of these constraints.
+%% 
+%% The grammar supported by `hyper-token.lua' allows for the following, where 
+%% `X = scheduler | authority`:
+%% - `X`: A list of `X`s that must (by default) be present in the
+%%   peer ledger's `X' field.
+%% - `X-match`: A count of the number of `X`s that must be present in the
+%%   peer ledger's `X' field.
+%% - `X-required`: A list of `X`s that always must be present in the
+%%   peer ledger's `X' field.
+multischeduler_test_disabled() -> {timeout, 30, fun multischeduler/0}.
+multischeduler() ->
+    BaseOpts = test_opts(),
+    NodeWallet = ar_wallet:new(),
+    Scheduler2 = ar_wallet:new(),
+    Scheduler3 = ar_wallet:new(),
+    Opts = BaseOpts#{
+        priv_wallet => NodeWallet,
+        identities => #{
+            <<"extra-scheduler">> => #{
+                priv_wallet => Scheduler2
+            }
+        }
+    },
+    Alice = ar_wallet:new(),
+    Bob = ar_wallet:new(),
+    RootLedger =
+        ledger(
+            <<"scripts/hyper-token.lua">>,
+            ProcExtra = 
+                #{
+                    <<"balance">> => #{ Alice => 100 },
+                    <<"scheduler">> =>
+                        [
+                            hb_util:human_id(NodeWallet),
+                            hb_util:human_id(Scheduler2)
+                        ],
+                    <<"scheduler-required">> =>
+                        [
+                            hb_util:human_id(NodeWallet)
+                        ]
+                },
+            Opts
+        ),
+    % Alice has tokens on the root ledger. She moves them to Bob.
+    transfer(RootLedger, Alice, Bob, 100, Opts),
+    ?assertEqual(100, balance(RootLedger, Bob, Opts)),
+    % Create a new process with with the same schedulers, but do not provide
+    % the extra scheduler in the `identities' map.
+    OptsWithoutHostWallet = maps:remove(priv_wallet, Opts),
+    RootLedger2 =
+        ledger(
+            <<"scripts/hyper-token.lua">>,
+            ProcExtra,
+            OptsWithoutHostWallet
+        ),
+    % Alice has tokens on the root ledger. She tries to move them to Bob.
+    transfer(RootLedger2, Alice, Bob, 100, OptsWithoutHostWallet),
+    % The transfer should fail because only one signature will be provided on 
+    % the assignment.
+    ?assertEqual(0, balance(RootLedger2, Bob, OptsWithoutHostWallet)),
+    % The transfer should succeed if:
+    % - Set the `authority-required' field to contain the host wallet, while
+    % - Setting the `authority-match' field to 1.
+    OptsWithoutExtraScheduler = #{ priv_wallet => NodeWallet },
+    RootLedger3 =
+        ledger(
+            <<"scripts/hyper-token.lua">>,
+            ProcExtra#{
+                <<"scheduler-match">> => 1
+            },
+            OptsWithoutExtraScheduler
+        ),
+    transfer(RootLedger3, Alice, Bob, 100, OptsWithoutExtraScheduler),
+    ?assertEqual(100, balance(RootLedger3, Bob, OptsWithoutExtraScheduler)),
+    % Ensure that another subledger can be registered to this process with the
+    % the necessary scheduler shared, but an additional scheduler not shared.
+    % Further, we ensure that the `scheduler-required' field is satisfied by
+    % creating a subledger that has two different schedulers, excluding the
+    % host wallet.
+    OptsWithSchedulers = OptsWithoutExtraScheduler#{
+        identities => #{
+            <<"scheduler-1">> => #{
+                priv_wallet => Scheduler3
+            },
+            <<"scheduler-2">> => #{
+                priv_wallet => Scheduler2
+            },
+            <<"scheduler-3">> => #{
+                priv_wallet => Scheduler3
+            }
+        }
+    },
+    % Create 3 subledgers with the same process, but different schedulers. Two
+    % that are valid (containing the `scheduler-required' field), and one that
+    % is invalid (does not contain the scheduler from `scheduler-required').
+    Subledger1 =
+        subledger(
+            RootLedger3,
+            #{
+                <<"scheduler">> =>
+                    [
+                        hb_util:human_id(NodeWallet),
+                        hb_util:human_id(Scheduler2)
+                    ],
+                <<"scheduler-required">> =>
+                    [
+                        hb_util:human_id(NodeWallet)
+                    ]
+            },
+            OptsWithSchedulers
+        ),
+    Subledger2 =
+        subledger(
+            RootLedger3,
+            #{
+                <<"scheduler">> =>
+                    [
+                        hb_util:human_id(NodeWallet),
+                        hb_util:human_id(Scheduler3)
+                    ],
+                <<"scheduler-required">> =>
+                    [hb_util:human_id(NodeWallet)]
+            },
+            OptsWithSchedulers
+        ),
+    Subledger3 =
+        subledger(
+            RootLedger3,
+            #{
+                <<"scheduler-required">> => [hb_util:human_id(NodeWallet)],
+                <<"scheduler">> =>
+                    [
+                        hb_util:human_id(Scheduler2),
+                        hb_util:human_id(Scheduler3)
+                    ]
+            },
+            OptsWithSchedulers
+        ),
+    % Create a map of names for the ledgers for use in logging.
+    Names = #{
+        Alice => alice,
+        Bob => bob,
+        RootLedger3 => root,
+        Subledger1 => subledger1,
+        Subledger2 => subledger2,
+        Subledger3 => subledger3
+    },
+    % Bob has tokens on the root ledger. He moves them to Alice on Subledger1.
+    transfer(RootLedger3, Bob, Alice, 100, Subledger1, OptsWithSchedulers),
+    transfer(Subledger1, Alice, Bob, 100, Subledger2, OptsWithSchedulers),
+    % Validate the balance has been transferred to Alice on Subledger2.
+    ?assertEqual(100, balance(Subledger2, Bob, OptsWithSchedulers)),
+    % Alice cannot move tokens to Bob on Subledger3, because the
+    % `scheduler-required' field is not satisfied by the subledger.
+    ?event(debug_base,
+        {map,
+            map(
+                [RootLedger3, Subledger1, Subledger2, Subledger3],
+                Names,
+                OptsWithSchedulers
+            )
+        }
+    ),
+    transfer(Subledger2, Bob, Alice, 50, Subledger3, OptsWithSchedulers),
+    % Validate the balance has not been transferred to Bob on Subledger3.
+    ?assertEqual(0, balance(Subledger3, Alice, OptsWithSchedulers)),
+    transfer(Subledger2, Bob, Alice, 50, Subledger1, OptsWithSchedulers),
+    % Validate that the remaining balance has been transferred to Alice on
+    % Subledger1.
+    ?assertEqual(50, balance(Subledger1, Alice, OptsWithSchedulers)),
+    transfer(Subledger1, Alice, Bob, 50, RootLedger3, OptsWithSchedulers),
+    % Validate that the balance has been transferred to Bob on the root ledger.
+    ?assertEqual(50, balance(RootLedger3, Bob, OptsWithSchedulers)).
+
+%% @doc Ensure that the `hyper-token.lua' script can parse comma-separated
+%% IDs in the `scheduler' field of a message.
+comma_separated_scheduler_list_test() ->
+    NodeWallet = hb:wallet(),
+    Scheduler2 = ar_wallet:new(),
+    Alice = ar_wallet:new(),
+    Bob = ar_wallet:new(),
+    Opts = (test_opts())#{ priv_wallet => NodeWallet, identities => #{
+        <<"extra-scheduler">> => #{
+            priv_wallet => Scheduler2
+        }
+    } },
+    Ledger =
+        ledger(
+            <<"scripts/hyper-token.lua">>,
+            ProcExtra = 
+                #{
+                    <<"balance">> => #{ Alice => 100 },
+                    <<"scheduler">> =>
+                        iolist_to_binary(
+                            [
+                                <<"\"">>,
+                                hb_util:human_id(NodeWallet),
+                                <<"\",\"">>,
+                                hb_util:human_id(Scheduler2),
+                                <<"\"">>
+                            ]
+                        ),
+                    <<"scheduler-required">> =>
+                        [
+                            hb_util:human_id(NodeWallet)
+                        ]
+                },
+            Opts
+        ),
+    % Alice has tokens on the root ledger. She moves them to Bob.
+    transfer(Ledger, Alice, Bob, 100, Opts),
+    ?assertEqual(100, balance(Ledger, Bob, Opts)).
diff --git a/src/dev_manifest.erl b/src/dev_manifest.erl
index ab2263bc4..10d97539a 100644
--- a/src/dev_manifest.erl
+++ b/src/dev_manifest.erl
@@ -1,52 +1,69 @@
 %%% @doc An Arweave path manifest resolution device. Follows the v1 schema:
 %%% https://specs.ar.io/?tx=lXLd0OPwo-dJLB_Amz5jgIeDhiOkjXuM3-r0H_aiNj0
 -module(dev_manifest).
--export([info/0]).
+-export([index/3, info/0]).
 -include("include/hb.hrl").
+-include_lib("eunit/include/eunit.hrl").
 
 %% @doc Use the `route/4' function as the handler for all requests, aside 
 %% from `keys' and `set', which are handled by the default resolver.
 info() ->
     #{
         default => fun route/4,
-        excludes => [keys, set]
+        excludes => [keys, set, committers]
     }.
 
+%% @doc Return the fallback index page when the manifest itself is requested.
+index(M1, M2, Opts) ->
+    ?event({manifest_index_request, M1, M2}),
+    case route(<<"index">>, M1, M2, Opts) of
+        {ok, Index} ->
+            ?event({manifest_index_returned, Index}),
+            {ok, Index};
+        {error, not_found} ->
+            {error, not_found}
+    end.
+
 %% @doc Route a request to the associated data via its manifest.
 route(<<"index">>, M1, M2, Opts) ->
     ?event({manifest_index, M1, M2}),
     case manifest(M1, M2, Opts) of
         {ok, JSONStruct} ->
             ?event({manifest_json_struct, JSONStruct}),
-            case hb_ao:resolve(JSONStruct, [<<"index">>, <<"path">>], Opts) of
-                {ok, Path} ->
+            % Get the path to the index page from the manifest. We make
+            % sure to use `hb_maps:get/4' to ensure that we do not recurse
+            % on the `index' key with an `ao' resolve.
+            Index =
+                hb_maps:get(
+                    <<"index">>,
+                    JSONStruct,
+                    #{},
+                    Opts
+                ),
+            ?event({manifest_index_found, Index}),
+            Path = hb_maps:get(<<"path">>, Index, Opts),
+            case Path of
+                not_found ->
+                    ?event({manifest_path_not_found, <<"index/path">>}),
+                    {error, not_found};
+                _ ->
                     ?event({manifest_path, Path}),
-                    route(Path, M1, M2, Opts);
-                _ -> {error, not_found}
+                    route(Path, M1, M2, Opts)
             end;
         {error, not_found} ->
+            ?event(manifest_not_parsed),
             {error, not_found}
     end;
 route(Key, M1, M2, Opts) ->
     ?event({manifest_lookup, Key}),
-    {ok, JSONStruct} = manifest(M1, M2, Opts),
-    ?event({manifest_json_struct, JSONStruct}),
-    case hb_ao:resolve(JSONStruct, [<<"paths">>, Key], Opts) of
-        {ok, Entry} ->
-            ID = maps:get(<<"id">>, Entry),
-            ?event({manifest_serving, ID}),
-            case hb_cache:read(ID, Opts) of
-                {ok, Data} ->
-                    ?event({manifest_data, Data}),
-                    {ok, Data};
-                {error, not_found} ->
-                    Fallback = hb_ao:get(JSONStruct, <<"fallback">>, Opts),
-                    FallbackID = maps:get(<<"id">>, Fallback),
-                    ?event({manifest_serving_fallback, FallbackID}),
-                    hb_cache:read(FallbackID, Opts)
-            end;
-        _ -> {error, not_found}
-    end.
+    {ok, Manifest} = manifest(M1, M2, Opts),
+    {ok,
+        hb_ao:get(
+            <<"paths/", Key/binary>>,
+            {as, <<"message@1.0">>, Manifest},
+            Opts
+        )
+    }.
 
 %% @doc Find and deserialize a manifest from the given base.
 manifest(Base, _Req, Opts) ->
@@ -59,8 +76,70 @@ manifest(Base, _Req, Opts) ->
             Opts
         ),
     ?event({manifest_json, JSON}),
-    hb_ao:resolve(
-        #{ <<"device">> => <<"json@1.0">>, <<"body">> => JSON },
-        <<"deserialize">>,
+    Structured = 
+        hb_cache:ensure_all_loaded(
+            hb_message:convert(JSON, <<"structured@1.0">>, <<"json@1.0">>, Opts),
+            Opts
+        ),
+    ?event({manifest_structured, {explicit, Structured}}),
+    Linkified = linkify(Structured, Opts),
+    ?event({manifest_linkified, {explicit, Linkified}}),
+    {ok, Linkified}.
+
+%% @doc Generate a nested message of links to content from a parsed (and
+%% structured) manifest.
+linkify(#{ <<"id">> := ID }, Opts) ->
+    LinkOptsBase = (maps:with([store], Opts))#{ scope => [local, remote]},
+    {link, ID, LinkOptsBase#{ <<"type">> => <<"link">>, <<"lazy">> => false }};
+linkify(Manifest, Opts) when is_map(Manifest) ->
+    hb_maps:map(
+        fun(_Key, Val) -> linkify(Val, Opts) end,
+        Manifest,
         Opts
-    ).
\ No newline at end of file
+    );
+linkify(Manifest, Opts) when is_list(Manifest) ->
+    lists:map(
+        fun(Item) -> linkify(Item, Opts) end,
+        Manifest
+    );
+linkify(Manifest, _Opts) ->
+    Manifest.
+
+%%% Tests
+
+resolve_test() ->
+    Opts = #{ store => hb_opts:get(store, no_viable_store, #{}) },
+    IndexPage = #{
+        <<"content-type">> => <<"text/html">>,
+        <<"body">> => <<"Page 1">>
+    },
+    {ok, IndexID} = hb_cache:write(IndexPage, Opts),
+    Page2 = #{
+        <<"content-type">> => <<"text/html">>,
+        <<"body">> => <<"Page 2">>
+    },
+    {ok, Page2ID} = hb_cache:write(Page2, Opts),
+    Manifest = #{
+        <<"paths">> => #{
+            <<"nested">> => #{ <<"page2">> => #{ <<"id">> => Page2ID } },
+            <<"page1">> => #{ <<"id">> => IndexID }
+        },
+        <<"index">> => #{ <<"path">> => <<"page1">> }
+    },
+    JSON = hb_message:convert(Manifest, <<"json@1.0">>, <<"structured@1.0">>, Opts),
+    ManifestMsg =
+        #{
+            <<"device">> => <<"manifest@1.0">>,
+            <<"body">> => JSON
+        },
+    {ok, ManifestID} = hb_cache:write(ManifestMsg, Opts),
+    ?event({manifest_id, ManifestID}),
+    Node = hb_http_server:start_node(Opts),
+    ?assertMatch(
+        {ok, #{ <<"body">> := <<"Page 1">> }},
+        hb_http:get(Node, << ManifestID/binary, "/index" >>, Opts)
+    ),
+    {ok, Res} = hb_http:get(Node, << ManifestID/binary, "/nested/page2" >>, Opts),
+    ?event({manifest_resolve_test, Res}),
+    ?assertEqual(<<"Page 2">>, Res),
+    ok.
\ No newline at end of file
diff --git a/src/dev_message.erl b/src/dev_message.erl
index 5b70bd267..e27aa553d 100644
--- a/src/dev_message.erl
+++ b/src/dev_message.erl
@@ -6,11 +6,13 @@
 %%% behaviour of the device when these keys are set.
 -module(dev_message).
 %%% Base AO-Core reserved keys:
--export([info/0, keys/1]).
--export([set/3, set_path/3, remove/2, get/2, get/3]).
+-export([info/0, keys/1, keys/2]).
+-export([set/3, set_path/3, remove/2, remove/3, get/3, get/4]).
 %%% Commitment-specific keys:
 -export([id/1, id/2, id/3]).
 -export([commit/3, committed/3, committers/1, committers/2, committers/3, verify/3]).
+%%% Non-protocol enforced keys:
+-export([index/3]).
 -include_lib("eunit/include/eunit.hrl").
 -include("include/hb.hrl").
 -define(DEFAULT_ID_DEVICE, <<"httpsig@1.0">>).
@@ -31,10 +33,42 @@
 %% @doc Return the info for the identity device.
 info() ->
     #{
-        default => fun get/3
-        %exports => ?DEVICE_KEYS
+        default => fun dev_message:get/4
     }.
 
+%% @doc Generate an index page for a message, in the event that the `body' and
+%% `content-type' of a message returned to the client are both empty. We do this
+%% as follows:
+%% 1. Find the `default_index' key of the node message. If it is a binary,
+%%    it is assumed to be the name of a device, and we execute the resolution
+%%    `as` that ID.
+%% 2. Merge the base message with the default index message, favoring the default
+%%    index message's keys over those in the base message, unless the default
+%%    was a device name.
+%% 3. Execute the `default_index_path` (base: `index') upon the message,
+%%    giving the rest of the request unchanged.
+index(Msg, Req, Opts) ->
+    case hb_opts:get(default_index, not_found, Opts) of
+        not_found ->
+            {error, <<"No default index message set.">>};
+        DefaultIndex ->
+            hb_ao:resolve(
+                case is_map(DefaultIndex) of
+                    true -> maps:merge(Msg, DefaultIndex);
+                    false -> {as, DefaultIndex, Msg}
+                end,
+                Req#{
+                    <<"path">> =>
+                        case hb_maps:find(<<"path">>, DefaultIndex, Opts) of
+                            {ok, Path} -> Path;
+                            _ ->
+                                hb_opts:get(default_index_path, <<"index">>, Opts)
+                        end
+                },
+                Opts
+            )
+    end.
+
 %% @doc Return the ID of a message, using the `committers' list if it exists.
 %% If the `committers' key is `all', return the ID including all known 
 %% commitments -- `none' yields the ID without any commitments. If the 
@@ -50,78 +84,121 @@ info() ->
 %% if/when non-map message structures are created.
 id(Base) -> id(Base, #{}).
 id(Base, Req) -> id(Base, Req, #{}).
-id(Base, _, NodeOpts) when not is_map(Base) ->
+id(Base, _, NodeOpts) when is_binary(Base) ->
     % Return the hashpath of the message in native format, to match the native
     % format of the message ID return.
     {ok, hb_util:human_id(hb_path:hashpath(Base, NodeOpts))};
-id(Base, Req, NodeOpts) ->
+id(RawBase, Req, NodeOpts) ->
+    % Ensure that the base message is a normalized before proceeding.
+    IDOpts = NodeOpts#{ linkify_mode => discard },
+    Base =
+        ensure_commitments_loaded(
+            hb_message:convert(RawBase, tabm, IDOpts),
+            NodeOpts
+        ),
     % Remove the commitments from the base message if there are none, after
     % filtering for the committers specified in the request.
     ModBase = #{ <<"commitments">> := Commitments }
-        = with_relevant_commitments(Base, Req, NodeOpts),
-    case maps:keys(Commitments) of
+        = with_relevant_commitments(Base, Req, IDOpts),
+    ?event(debug_commitments,
+        {generating_ids,
+            {selected_commitments, Commitments},
+            {req, Req},
+            {msg, Base}
+        }
+    ),
+    case hb_maps:keys(Commitments) of
         [] ->
             % If there are no commitments, we must (re)calculate the ID.
-            ?event(ids, no_commitments_found_in_id_call),
-            calculate_ids(maps:without([<<"commitments">>], ModBase), Req, NodeOpts);
-        [ID] ->
-            % If there is only one commitment, return the ID of the message.
-            ?event(ids, using_precalculated_id),
-            {ok, ID};
+            ?event(debug_id, no_commitments_found_in_id_call),
+            calculate_id(hb_maps:without([<<"commitments">>], ModBase), Req, IDOpts);
         IDs ->
-            % If there are multiple commitments, sort them, concatenate them as
-            % a structured field string, and return the hash of the result.
-            ?event(ids, multiple_commitments_found_in_id_call),
-            SortedIDs = lists:sort(IDs),
-            IDsLine = iolist_to_binary(lists:join(<<", ">>, SortedIDs)),
-            {ok, hb_util:human_id(hb_crypto:sha256(IDsLine))}
+            % Accumulate the relevant IDs into a single value. This is performed 
+            % by module arithmetic of each of the IDs. The effect of this is that:
+            % 1. New IDs can be added to the combined ID without requiring any
+            %    recalculation of other IDs.
+            % 2. New IDs can be added in any order, and will compare to the same
+            %    value as if they were added in other orders.
+            % 3. Subsequently, combined IDs cannot be used to express ordering of
+            %    the underlying commitments.
+            % This works for single IDs as well as lists of IDs, because the 
+            % accumulation function starts with a buffer of zero encoded as a 
+            % 256-bit binary. Subsequently, a single ID on its own 'accumulates' 
+            % to itself.
+            ?event(debug_id, {accumulating_existing_ids, IDs}),
+            {ok,
+                hb_util:human_id(
+                    hb_crypto:accumulate(
+                        lists:map(fun hb_util:native_id/1, IDs)
+                    )
+                )
+            }
     end.
 
-calculate_ids(Base, Req, NodeOpts) ->
-    % Find the ID device for the message.
+calculate_id(Base, Req, NodeOpts) ->
     % Find the ID device for the message.
+    ?event(linkify, {calculate_ids, {base, Base}}),
     IDMod =
-        case id_device(Base) of
+        case id_device(Base, NodeOpts) of
             {ok, IDDev} -> IDDev;
             {error, Error} -> throw({id, Error})
         end,
-    ?event({using_id_device, {idmod, IDMod}, {modbase, Base}}),
+    ?event(linkify, {generating_id, {idmod, IDMod}, {base, Base}}),
     % Get the device module from the message, or use the default if it is not
     % set. We can tell if the device is not set (or is the default) by checking 
     % whether the device module is the same as this module.
     DevMod =
-        case hb_ao:message_to_device(#{ <<"device">> => IDMod }, NodeOpts) of
+        case hb_ao_device:message_to_device(#{ <<"device">> => IDMod }, NodeOpts) of
             ?MODULE ->
-                hb_ao:message_to_device(
+                hb_ao_device:message_to_device(
                     #{ <<"device">> => ?DEFAULT_ID_DEVICE },
                     NodeOpts
                 );
             Module -> Module
         end,
-    % Apply the function's `id' function with the appropriate arguments. If it
-    % doesn't exist, error.
-    case hb_ao:find_exported_function(Base, DevMod, id, 3, NodeOpts) of
+    % Apply the function's default `commit' function with the appropriate arguments.
+    % If it doesn't exist, error.
+    case hb_ao_device:find_exported_function(Base, DevMod, commit, 3, NodeOpts) of
         {ok, Fun} ->
-            ?event(id, {called_id_device, IDMod}, NodeOpts),
-            apply(Fun, hb_ao:truncate_args(Fun, [Base, Req, NodeOpts]));
+            ?event(debug_id, {called_id_device, IDMod}, NodeOpts),
+            {ok, #{ <<"commitments">> := Comms} } = 
+                apply(
+                    Fun,
+                    hb_ao_device:truncate_args(
+                        Fun,
+                        [Base, Req#{ <<"type">> => <<"unsigned">> }, NodeOpts]
+                    )
+                ),
+            ?event(debug_id,
+                {generated_id,
+                    {type, unsigned},
+                    {commitments, maps:keys(Comms)}
+                }
+            ),
+            {ok, hd(maps:keys(Comms))};
         not_found -> throw({id, id_resolver_not_found_for_device, DevMod})
     end.
 
 %% @doc Locate the ID device of a message. The ID device is determined the
 %% `device' set in _all_ of the commitments. If no commitments are present,
 %% the default device (`httpsig@1.0') is used.
-id_device(#{ <<"commitments">> := Commitments }) ->
+id_device(#{ <<"commitments">> := Commitments }, Opts) ->
     % Get the device from the first commitment.
     UnfilteredDevs =
-        maps:map(
+        hb_maps:map(
             fun(_, #{ <<"commitment-device">> := CommitmentDev }) ->
                 CommitmentDev;
             (_, _) -> undefined
             end,
-            Commitments
+            Commitments,
+            Opts
         ),
     % Filter out the undefined devices.
-    Devs = lists:filter(fun(Dev) -> Dev =/= undefined end, maps:values(UnfilteredDevs)),
+    Devs =
+        lists:filter(
+            fun(Dev) -> Dev =/= undefined end,
+            hb_maps:values(UnfilteredDevs, Opts)
+        ),
     % If there are no devices, return the default.
     case Devs of
         [] -> {ok, ?DEFAULT_ID_DEVICE};
@@ -134,25 +211,29 @@ id_device(#{ <<"commitments">> := Commitments }) ->
                 true -> {ok, FirstDev}
             end
     end;
-id_device(_) ->
+id_device(_, _) ->
     {ok, ?DEFAULT_ID_DEVICE}.
 
 %% @doc Return the committers of a message that are present in the given request.
 committers(Base) -> committers(Base, #{}).
 committers(Base, Req) -> committers(Base, Req, #{}).
-committers(#{ <<"commitments">> := Commitments }, _, _NodeOpts) ->
-    ?event({commitments, Commitments}),
+committers(#{ <<"commitments">> := Commitments }, _, NodeOpts) ->
+    ?event(debug_commitments, {calculating_committers, {commitments, Commitments}}),
     {ok,
-        maps:values(
-            maps:filtermap(
+        hb_maps:values(
+            hb_maps:filtermap(
                 fun(_ID, Commitment) ->
-                    case maps:get(<<"committer">>, Commitment, undefined) of
+                    Committer = maps:get(<<"committer">>, Commitment, undefined),
+                    ?event(debug_commitments, {committers, {committer, Committer}}),
+                    case Committer of
                         undefined -> false;
                         Committer -> {true, Committer}
                     end
                 end,
-                Commitments
-            )
+                Commitments,
+                NodeOpts
+            ),
+            NodeOpts
         )
     };
 committers(_, _, _) ->
@@ -163,9 +244,8 @@ committers(_, _, _) ->
 %% the default device (`httpsig@1.0') is used.
 commit(Self, Req, Opts) ->
     {ok, Base} = hb_message:find_target(Self, Req, Opts),
-    % Encode to a TABM.
     AttDev =
-        case maps:get(<<"commitment-device">>, Req, not_specified) of
+        case hb_maps:get(<<"commitment-device">>, Req, not_specified, Opts) of
             not_specified ->
                 hb_opts:get(commitment_device, no_viable_commitment_device, Opts);
             Dev -> Dev
@@ -173,11 +253,34 @@ commit(Self, Req, Opts) ->
     % We _do not_ set the `device' key in the message, as the device will be
     % part of the commitment. Instead, we find the device module's `commit'
     % function and apply it.
-    AttMod = hb_ao:message_to_device(#{ <<"device">> => AttDev }, Opts),
-    {ok, AttFun} = hb_ao:find_exported_function(Base, AttMod, commit, 3, Opts),
-    Encoded = hb_message:convert(Base, tabm, Opts),
-    {ok, Committed} = apply(AttFun, hb_ao:truncate_args(AttFun, [Encoded, Req, Opts])),
-    {ok, hb_message:convert(Committed, <<"structured@1.0">>, Opts)}.
+    CommitOpts =
+        case hb_maps:get(<<"type">>, Req, <<"signed">>) of
+            <<"unsigned">> ->
+                Opts#{ linkify_mode => discard };
+            _ ->
+                Opts#{ linkify_mode => offload }
+        end,
+    AttMod = hb_ao_device:message_to_device(#{ <<"device">> => AttDev }, CommitOpts),
+    {ok, AttFun} = hb_ao_device:find_exported_function(Base, AttMod, commit, 3, CommitOpts),
+    % Encode to a TABM
+    Loaded =
+        ensure_commitments_loaded(
+            hb_message:convert(Base, tabm, CommitOpts),
+            Opts
+        ),
+    {ok, Committed} =
+        apply(
+            AttFun,
+            hb_ao_device:truncate_args(
+                AttFun,
+                [
+                    Loaded,
+                    Req#{ <<"type">> => maps:get(<<"type">>, Req, <<"signed">>) },
+                    CommitOpts
+                ]
+            )
+        ),
+    {ok, hb_message:convert(Committed, <<"structured@1.0">>, tabm, CommitOpts)}.
 
 %% @doc Verify a message. By default, all commitments are verified. The
 %% `committers' key in the request can be used to specify that only the 
@@ -185,93 +288,120 @@ commit(Self, Req, Opts) ->
 %% commitments can be specified using the `commitments' key.
 verify(Self, Req, Opts) ->
     % Get the target message of the verification request.
-    {ok, Base} = hb_message:find_target(Self, Req, Opts),
+    {ok, RawBase} = hb_message:find_target(Self, Req, Opts),
+    Base =
+        hb_message:convert(
+            ensure_commitments_loaded(
+                RawBase,
+                Opts
+            ),
+            tabm,
+            Opts
+        ),
+    ?event(verify, {verify, {base_found, Base}}),
     Commitments = maps:get(<<"commitments">>, Base, #{}),
     IDsToVerify = commitment_ids_from_request(Base, Req, Opts),
-    % Remove the commitments from the base message.
-    ?event({verifying_commitments, Commitments}),
+    % Generate the new commitment request base messsage by removing the keys
+    % used by this function (path, committers, commitments) and returning the
+    % remaining keys. This message will then be merged with each commitment
+    % message to generate the final request, allowing the caller to pass 
+    % additional keys to the commitment device.
+    ReqBase =
+        maps:without(
+            [<<"path">>, <<"committers">>, <<"commitments">>],
+            Req
+        ),
     % Verify the commitments. Stop execution if any fail.
     Res =
         lists:all(
             fun(CommitmentID) ->
-                ?event(
-                    {verify_commitment,
+                {ok, Res} =
+                    verify_commitment(
+                        Base,
+                        maps:merge(
+                            ReqBase,
+                            maps:get(CommitmentID, Commitments)
+                        ),
+                        Opts
+                    ),
+                ?event(verify,
+                    {verify_commitment_res,
                         {commitment_id, CommitmentID},
-                        {target, Base}}
-                ),
-                {ok, Res} = exec_for_commitment(
-                    verify,
-                    Base,
-                    maps:get(CommitmentID, Commitments),
-                    Req#{ <<"commitment">> => CommitmentID },
-                    Opts
-                ),
-                ?event({verify_commitment_res, {commitment_id, CommitmentID}, {res, Res}}),
+                        {res, Res}
+                    }),
                 Res
             end,
             IDsToVerify
         ),
-    ?event({verify_res, Res}),
+    ?event(verify, {verify, {res, Res}}),
     {ok, Res}.
 
 %% @doc Execute a function for a single commitment in the context of its
 %% parent message.
 %% Note: Assumes that the `commitments' key has already been removed from the
 %% message if applicable.
-exec_for_commitment(Func, Base, Commitment, Req, Opts) ->
-    ?event({executing_for_commitment, {func, Func}, {base, Base}, {commitment, Commitment}, {req, Req}}),
-    CommitmentMessage =
-        maps:merge(Base, maps:without([<<"commitment-device">>], Commitment)),
+verify_commitment(Base, Commitment, Opts) ->
+    ?event(verify, {verifying_commitment, {commitment, Commitment}, {msg, Base}}),
     AttDev =
-        maps:get(
+        hb_maps:get(
             <<"commitment-device">>,
             Commitment,
-            ?DEFAULT_ATT_DEVICE
+            ?DEFAULT_ATT_DEVICE,
+            Opts
         ),
     AttMod =
-        hb_ao:message_to_device(
+        hb_ao_device:message_to_device(
             #{ <<"device">> => AttDev },
             Opts
         ),
     {ok, AttFun} =
-        hb_ao:find_exported_function(
-            CommitmentMessage,
+        hb_ao_device:find_exported_function(
+            Base,
             AttMod,
-            Func,
+            verify,
             3,
             Opts
         ),
-    Encoded = hb_message:convert(CommitmentMessage, tabm, Opts),
-    apply(AttFun, [Encoded, Req, Opts]).
+    apply(AttFun, [Base, Commitment, Opts]).
 
 %% @doc Return the list of committed keys from a message.
 committed(Self, Req, Opts) ->
-    % Get the target message of the verification request.
-    {ok, Base} = hb_message:find_target(Self, Req, Opts),
+    % Get the target message of the verification request and ensure its 
+    % commitments are loaded.
+    {ok, RawBase} =
+        hb_message:find_target(
+            Self,
+            Req,
+            Opts
+        ),
+    Base = ensure_commitments_loaded(RawBase, Opts),
     CommitmentIDs = commitment_ids_from_request(Base, Req, Opts),
+    ?event(debug_commitments,
+        {calculating_committed,
+            {commitment_ids, CommitmentIDs},
+            {req, Req}
+        }
+    ),
     Commitments = maps:get(<<"commitments">>, Base, #{}),
     % Get the list of committed keys from each committer.
     CommitmentKeys =
         lists:map(
             fun(CommitmentID) ->
                 Commitment = maps:get(CommitmentID, Commitments),
-                {ok, CommittedKeys} =
-                    exec_for_commitment(
-                        committed,
-                        Base,
-                        Commitment,
-                        #{ <<"commitment">> => CommitmentID },
-                        Opts
-                    ),
-                ?event({committed_keys, {commitment_id, CommitmentID}, {keys, CommittedKeys}}),
-                CommittedKeys
+                % The committed keys will be a TABM encoded numbered map
+                % so we must decode it to its underlying list of normalized keys
+                % for comparison purposes.
+                hb_util:message_to_ordered_list(
+                    maps:get(<<"committed">>, Commitment),
+                    Opts
+                )
             end,
             CommitmentIDs
         ),
     % Remove commitments that are not in *every* committer's list.
     % To start, we need to create the super-set of committed keys.
     AllCommittedKeys =
-        lists:foldl(
+        lists:foldr(
             fun(Key, Acc) ->
                 case lists:member(Key, Acc) of
                     true -> Acc;
@@ -293,8 +423,22 @@ committed(Self, Req, Opts) ->
             end,
             AllCommittedKeys
         ),
-    ?event({only_committed_keys, OnlyCommittedKeys}),
-    {ok, OnlyCommittedKeys}.
+    % Remove any `+link` suffixes from TABM-form committed keys if the `raw` flag
+    % is not set. This means that callers to `committed/3' will receive a list of
+    % keys that they can match  against the 'normal' representation of the message
+    % in devices, etc., without exposure to TABM-specifics. If `raw' is set, the
+    % recipient receives the `committed` list in its unprocessed form.
+    CommittedNormalizedKeys =
+        case maps:get(<<"raw">>, Req, false) of
+            true -> OnlyCommittedKeys;
+            false ->
+                lists:map(
+                    fun hb_link:remove_link_specifier/1,
+                    OnlyCommittedKeys
+                )
+        end,
+    ?event({only_committed_keys, CommittedNormalizedKeys}),
+    {ok, CommittedNormalizedKeys}.
 
 %% @doc Return a message with only the relevant commitments for a given request.
 %% See `commitment_ids_from_request/3' for more information on the request format.
@@ -314,37 +458,28 @@ commitment_ids_from_request(Base, Req, Opts) ->
     ReqCommitters =
         case maps:get(<<"committers">>, Req, <<"none">>) of
             X when is_list(X) -> X;
-            Descriptor -> hb_ao:normalize_key(Descriptor)
+            CommitterDescriptor -> hb_ao:normalize_key(CommitterDescriptor)
         end,
-    RawReqCommitments =
-        maps:get(
-            <<"commitments">>,
-            Req,
-            case ReqCommitters of
-                <<"none">> -> <<"all">>;
-                _ -> <<"none">>
-            end
-        ),
+    RawReqCommitments = maps:get(<<"commitments">>, Req, <<"none">>),
     ReqCommitments =
         case RawReqCommitments of
             X2 when is_list(X2) -> X2;
-            Descriptor2 -> hb_ao:normalize_key(Descriptor2)
+            CommitmentDescriptor -> hb_ao:normalize_key(CommitmentDescriptor)
         end,
-    ?event({commitment_ids_from_request, {req_commitments, ReqCommitments}, {req_committers, ReqCommitters}}),
+    ?event(debug_commitments,
+        {commitment_ids_from_request,
+            {req_commitments, ReqCommitments},
+            {req_committers, ReqCommitters}}
+    ),
     % Get the commitments to verify.
     FromCommitmentIDs =
         case ReqCommitments of
             <<"none">> -> [];
-            <<"all">> -> maps:keys(Commitments);
+            <<"all">> -> hb_maps:keys(Commitments, Opts);
             CommitmentIDs ->
-                CommitmentIDs =
-                    if is_list(CommitmentIDs) -> CommitmentIDs;
-                    true -> [CommitmentIDs]
-                    end,
-                lists:map(
-                    fun(CommitmentID) -> maps:get(CommitmentID, Commitments) end,
-                    CommitmentIDs
-                )
+                if is_list(CommitmentIDs) -> CommitmentIDs;
+                true -> [CommitmentIDs]
+                end
         end,
     FromCommitterAddrs =
         case ReqCommitters of
@@ -352,29 +487,60 @@ commitment_ids_from_request(Base, Req, Opts) ->
                 ?event(no_commitment_ids_for_committers),
                 [];
             <<"all">> ->
-                ?event(getting_commitment_ids_for_all_committers),
+                ?event(debug_commitments, {getting_commitment_ids_for_all_committers}),
                 {ok, Committers} = committers(Base, Req, Opts),
-                ?event({commitment_ids_from_committers, Committers}),
-                commitment_ids_from_committers(Committers, Commitments);
+                ?event(debug_commitments, {commitment_ids_from_committers, Committers}),
+                commitment_ids_from_committers(Committers, Commitments, Opts);
             RawCommitterAddrs ->
-                ?event({getting_commitment_ids_for_specific_committers, RawCommitterAddrs}),
+                ?event({getting_commitment_ids_for_committers, RawCommitterAddrs}),
                 CommitterAddrs =
                     if is_list(RawCommitterAddrs) -> RawCommitterAddrs;
                     true -> [RawCommitterAddrs]
                     end,
-                commitment_ids_from_committers(CommitterAddrs, Commitments)
+                commitment_ids_from_committers(CommitterAddrs, Commitments, Opts)
+        end,
+    Res =
+        case FromCommitterAddrs ++ FromCommitmentIDs of
+            [] ->
+                % The request is for no committers, and no explicit commitments.
+                % Subsequently, we return the commitment using the default
+                % commitment device, if it exists.
+                lists:filter(
+                    fun(CommitmentID) ->
+                        Comm = maps:get(CommitmentID, Commitments),
+                        Dev = maps:get(<<"commitment-device">>, Comm, undefined),
+                        case Dev of
+                            ?DEFAULT_ATT_DEVICE ->
+                                not hb_maps:is_key(<<"committer">>, Comm);
+                            _ -> false
+                        end
+                    end,
+                    maps:keys(Commitments)
+                );
+            FinalCommitmentIDs -> FinalCommitmentIDs
         end,
-    Res = FromCommitterAddrs ++ FromCommitmentIDs,
     ?event({commitment_ids_from_request, {base, Base}, {req, Req}, {res, Res}}),
     Res.
 
+%% @doc Ensure that the `commitments` submessage of a base message is fully
+%% loaded into local memory.
+ensure_commitments_loaded(NonRelevant, _Opts) when not is_map(NonRelevant) ->
+    NonRelevant;
+ensure_commitments_loaded(M = #{ <<"commitments">> := Link}, Opts) when ?IS_LINK(Link) ->
+    M#{
+        <<"commitments">> => hb_cache:ensure_all_loaded(Link, Opts)
+    };
+ensure_commitments_loaded(M, _Opts) ->
+    M.
+
 %% @doc Returns a list of commitment IDs in a commitments map that are relevant
 %% for a list of given committer addresses.
-commitment_ids_from_committers(CommitterAddrs, Commitments) ->
+commitment_ids_from_committers(CommitterAddrs, Commitments, Opts) ->
     % Get the IDs of all commitments for each committer.
     Comms =
         lists:map(
-            fun(CommitterAddr) ->
+            fun(RawCommitterAddr) ->
+                CommitterAddr = hb_cache:ensure_loaded(RawCommitterAddr, Opts),
                 % For each committer, filter the commitments to only
                 % include those with the matching committer address.
                 IDs = 
@@ -382,13 +548,14 @@ commitment_ids_from_committers(CommitterAddrs, Commitments) ->
                         fun(ID, Msg) ->
                             % If the committer address matches, return
                             % the ID. If not, ignore the commitment.
-                            case maps:get(<<"committer">>, Msg, undefined) of
+                            case hb_maps:get(<<"committer">>, Msg, undefined) of
                                 CommitterAddr -> {true, ID};
                                 _ -> false
                             end
                         end,
                         Commitments
-                    )),
+                    )
+                ),
                 {CommitterAddr, IDs}
             end,
             CommitterAddrs
@@ -424,12 +591,12 @@ commitment_ids_from_committers(CommitterAddrs, Commitments) ->
 set(Message1, NewValuesMsg, Opts) ->
     OriginalPriv = hb_private:from_message(Message1),
 	% Filter keys that are in the default device (this one).
-    {ok, NewValuesKeys} = keys(NewValuesMsg),
+    {ok, NewValuesKeys} = keys(NewValuesMsg, Opts),
 	KeysToSet =
 		lists:filter(
 			fun(Key) ->
 				not lists:member(Key, ?DEVICE_KEYS ++ [<<"set-mode">>]) andalso
-					(maps:get(Key, NewValuesMsg, undefined) =/= undefined)
+					(hb_maps:get(Key, NewValuesMsg, undefined, Opts) =/= undefined)
 			end,
 			NewValuesKeys
 		),
@@ -438,21 +605,21 @@ set(Message1, NewValuesMsg, Opts) ->
 	ConflictingKeys =
 		lists:filter(
 			fun(Key) -> lists:member(Key, KeysToSet) end,
-			maps:keys(Message1)
+			hb_maps:keys(Message1, Opts)
 		),
     UnsetKeys =
         lists:filter(
             fun(Key) ->
-                case maps:get(Key, NewValuesMsg, not_found) of
+                case hb_maps:get(Key, NewValuesMsg, not_found, Opts) of
                     unset -> true;
                     _ -> false
                 end
             end,
-            maps:keys(Message1)
+            hb_maps:keys(Message1, Opts)
         ),
     % Base message with keys-to-unset removed
-    BaseValues = maps:without(UnsetKeys, Message1),
-    ?event(
+    BaseValues = hb_maps:without(UnsetKeys, Message1, Opts),
+    ?event(message_set,
         {performing_set,
             {conflicting_keys, ConflictingKeys},
             {keys_to_unset, UnsetKeys},
@@ -461,10 +628,10 @@ set(Message1, NewValuesMsg, Opts) ->
         }
     ),
     % Create the map of new values
-    NewValues = maps:from_list(
+    NewValues = hb_maps:from_list(
         lists:filtermap(
             fun(Key) ->
-                case maps:get(Key, NewValuesMsg, undefined) of
+                case hb_maps:get(Key, NewValuesMsg, undefined, Opts) of
                     undefined -> false;
                     unset -> false;
                     Value -> {true, {Key, Value}}
@@ -482,12 +649,13 @@ set(Message1, NewValuesMsg, Opts) ->
             },
             Opts
         ),
-    ?event(
+    ?event(message_set,
         {setting,
             {committed_keys, CommittedKeys},
             {keys_to_set, KeysToSet},
             {message, Message1}
-        }),
+        }
+    ),
     OverwrittenCommittedKeys =
         lists:filtermap(
             fun(Key) ->
@@ -507,69 +675,153 @@ set(Message1, NewValuesMsg, Opts) ->
         hb_private:set_priv(
             case maps:get(<<"set-mode">>, NewValuesMsg, <<"deep">>) of
                 <<"explicit">> -> maps:merge(BaseValues, NewValues);
-                _ -> hb_util:deep_merge(BaseValues, NewValues)
+                _ -> do_deep_merge(BaseValues, NewValues, Opts)
             end,
             OriginalPriv
         ),
     case OverwrittenCommittedKeys of
-        [] -> {ok, Merged};
+        [] ->
+            ?event(message_set, {no_overwritten_committed_keys, {merged, Merged}}),
+            {ok, Merged};
         _ ->
             % We did overwrite some keys, but do their values match the original?
             % If not, we must remove the commitments.
-            case hb_message:match(Merged, Message1) of
-                true -> {ok, Merged};
-                false -> {ok, maps:without([<<"commitments">>], Merged)}
+            case hb_message:match(Merged, Message1, Opts) of
+                true ->
+                    ?event(message_set, {set_keys_matched, {merged, Merged}}),
+                    {ok, Merged};
+                % {error, {Details, {trace, Stacktrace}}} ->
+                %     erlang:raise(error, Details, Stacktrace);
+                % {mismatch, Type, Path, Val1, Val2} ->
+                %     ?event(
+                %         set_conflict,
+                %         {set_conflict_removing_commitments,
+                %             {merged, Merged},
+                %             {mismatch, Type},
+                %             {path, Path},
+                %             {expected, Val1},
+                %             {received, Val2}
+                %         }
+                %     ),
+                _ ->
+                    {ok, hb_maps:without([<<"commitments">>], Merged, Opts)}
             end
     end.
 
+%% @doc Deep merge keys in a message, utilizing the set device of any child
+%% keys that are themselves messages.
+do_deep_merge(BaseValues, NewValues, Opts) ->
+    {WithNestedMerges, StillToDeepMerge} =
+        maps:fold(
+            fun(Key, NewValue, {Acc, ToDeepMerge})
+                    when is_map(NewValue)
+                    andalso is_map(map_get(Key, Acc)) ->
+                {
+                    Acc#{
+                        Key =>
+                            hb_util:ok(
+                                hb_ao:resolve(
+                                    map_get(Key, Acc),
+                                    NewValue#{
+                                        <<"path">> => <<"set">>
+                                    },
+                                    Opts
+                                ),
+                                Opts
+                            )
+                    },
+                    ToDeepMerge
+                };
+            (Key, _, {Acc, ToDeepMerge}) ->
+                {Acc, [Key | ToDeepMerge]}
+            end,
+            {BaseValues, []},
+            NewValues
+        ),
+    hb_util:deep_merge(
+        WithNestedMerges,
+        maps:with(StillToDeepMerge, NewValues),
+        Opts
+    ).
+
 %% @doc Special case of `set/3' for setting the `path' key. This cannot be set
-%% using the normal `set' function, as the `path' is a reserved key, necessary 
-%% for AO-Core to know the key to evaluate in requests.
-set_path(Message1, #{ <<"value">> := Value }, _Opts) ->
-    {ok, Message1#{ <<"path">> => Value }}.
+%% using the normal `set' function, as the `path' is a reserved key, used to
+%% transmit the present key that is being executed. Subsequently, to call `path'
+%% we would need to set `path' to `set', removing the ability to specify its 
+%% new value.
+set_path(Base, #{ <<"value">> := Value }, Opts) ->
+    set_path(Base, Value, Opts);
+set_path(Base, Value, Opts) when not is_map(Value) ->
+    % Determine whether the `path' key is committed. If it is, we remove the
+    % commitment if the new value is different. We try to minimize work by
+    % doing the `hb_maps:get` first, as it is far cheaper than calculating
+    % the committed keys.
+    BaseWithCorrectedComms =
+        case hb_maps:get(<<"path">>, Base, undefined, Opts) of
+            Value -> Base;
+            _ ->
+                % The new value is different, but is it committed? If so, we
+                % must remove the commitments.
+                case hb_message:is_signed_key(<<"path">>, Base, Opts) of
+                  true -> hb_message:uncommitted(Base, Opts);
+                  false -> Base
+                end
+        end,
+    case Value of
+        unset ->
+            {ok, hb_maps:without([<<"path">>], BaseWithCorrectedComms, Opts)};
+        _ ->
+            BaseWithCorrectedComms#{ <<"path">> => Value }
+    end.
 
 %% @doc Remove a key or keys from a message.
-remove(Message1, #{ <<"item">> := Key }) ->
-    remove(Message1, #{ <<"items">> => [Key] });
-remove(Message1, #{ <<"items">> := Keys }) ->
-    { ok, maps:without(Keys, Message1) }.
+remove(Message1, Key) ->
+	remove(Message1, Key, #{}).
+
+remove(Message1, #{ <<"item">> := Key }, Opts) ->
+    remove(Message1, #{ <<"items">> => [Key] }, Opts);
+remove(Message1, #{ <<"items">> := Keys }, Opts) ->
+    { ok, hb_maps:without(Keys, Message1, Opts) }.
 
 %% @doc Get the public keys of a message.
-keys(Msg) when not is_map(Msg) ->
-    case hb_ao:normalize_keys(Msg) of
-        NormMsg when is_map(NormMsg) -> keys(NormMsg);
+keys(Msg) ->
+	keys(Msg, #{}).
+
+keys(Msg, Opts) when not is_map(Msg) ->
+    case hb_ao:normalize_keys(Msg, Opts) of
+        NormMsg when is_map(NormMsg) -> keys(NormMsg, Opts);
         _ -> throw(badarg)
     end;
-keys(Msg) ->
+keys(Msg, Opts) ->
     {
         ok,
         lists:filter(
             fun(Key) -> not hb_private:is_private(Key) end,
-            maps:keys(Msg)
+            hb_maps:keys(Msg, Opts)
         )
     }.
 
 %% @doc Return the value associated with the key as it exists in the message's
 %% underlying Erlang map. First check the public keys, then check case-
 %% insensitively if the key is a binary.
-get(Key, Msg) -> get(Key, Msg, #{ <<"path">> => <<"get">> }).
-get(Key, Msg, _Msg2) ->
+get(Key, Msg, Opts) -> get(Key, Msg, #{ <<"path">> => <<"get">> }, Opts).
+get(Key, Msg, _Msg2, Opts) ->
     case hb_private:is_private(Key) of
         true -> {error, not_found};
         false ->
-            case maps:get(Key, Msg, not_found) of
-                not_found -> case_insensitive_get(Key, Msg);
+            case hb_maps:get(Key, Msg, not_found, Opts) of
+                not_found -> case_insensitive_get(Key, Msg, Opts);
                 Value -> {ok, Value}
             end
     end.
 
 %% @doc Key matching should be case insensitive, following RFC-9110, so we 
 %% implement a case-insensitive key lookup rather than delegating to
-%% `maps:get/2'. Encode the key to a binary if it is not already.
-case_insensitive_get(Key, Msg) ->
-    NormKey = hb_ao:normalize_key(Key),
-    NormMsg = hb_ao:normalize_keys(Msg),
-    case maps:get(NormKey, NormMsg, not_found) of
+%% `hb_maps:get/2'. Encode the key to a binary if it is not already.
+case_insensitive_get(Key, Msg, Opts) ->
+    NormKey = hb_util:to_lower(hb_util:bin(Key)),
+    NormMsg = hb_ao:normalize_keys(Msg, Opts),
+    case hb_maps:get(NormKey, NormMsg, not_found, Opts) of
         not_found -> {error, not_found};
         Value -> {ok, Value}
     end.
@@ -578,7 +830,7 @@ case_insensitive_get(Key, Msg) ->
 
 %%% Internal module functionality tests:
 get_keys_mod_test() ->
-    ?assertEqual([a], maps:keys(#{a => 1})).
+    ?assertEqual([a], hb_maps:keys(#{a => 1}, #{})).
 
 is_private_mod_test() ->
     ?assertEqual(true, hb_private:is_private(<<"private">>)),
@@ -591,10 +843,10 @@ keys_from_device_test() ->
     ?assertEqual({ok, [<<"a">>]}, hb_ao:resolve(#{ <<"a">> => 1 }, keys, #{})).
 
 case_insensitive_get_test() ->
-	?assertEqual({ok, 1}, case_insensitive_get(<<"a">>, #{ <<"a">> => 1 })),
-	?assertEqual({ok, 1}, case_insensitive_get(<<"a">>, #{ <<"A">> => 1 })),
-	?assertEqual({ok, 1}, case_insensitive_get(<<"A">>, #{ <<"a">> => 1 })),
-	?assertEqual({ok, 1}, case_insensitive_get(<<"A">>, #{ <<"A">> => 1 })).
+	?assertEqual({ok, 1}, case_insensitive_get(<<"a">>, #{ <<"a">> => 1 }, #{})),
+%	?assertEqual({ok, 1}, case_insensitive_get(<<"a">>, #{ <<"A">> => 1 }, #{})),
+	?assertEqual({ok, 1}, case_insensitive_get(<<"A">>, #{ <<"a">> => 1 }, #{})).
+	%?assertEqual({ok, 1}, case_insensitive_get(<<"A">>, #{ <<"A">> => 1 }, #{})).
 
 private_keys_are_filtered_test() ->
     ?assertEqual(
@@ -701,7 +953,4 @@ verify_test() ->
             #{ <<"path">> => <<"verify">>, <<"body">> => Signed },
             #{ hashpath => ignore }
         )
-    ).
-
-run_test() ->
-    hb_message:deep_multisignature_test().
+    ).
\ No newline at end of file
diff --git a/src/dev_meta.erl b/src/dev_meta.erl
index a0e428fd3..cfe34f323 100644
--- a/src/dev_meta.erl
+++ b/src/dev_meta.erl
@@ -8,6 +8,7 @@
 %%% the AO-Core resolver has returned a result.
 -module(dev_meta).
 -export([info/1, info/3, build/3, handle/2, adopt_node_message/2, is/2, is/3]).
+-export([is_operator/2]).
 -include("include/hb.hrl").
 -include_lib("eunit/include/eunit.hrl").
 %%% Include the auto-generated build info header file.
@@ -22,8 +23,27 @@
 %% info call will match the three-argument version of the function. If in the 
 %% future the `request' is added as an argument to AO-Core's internal `info'
 %% function, we will need to find a different approach.
-info(_) -> #{ exports => [info, build] }.
+info(_) -> #{ exports => [<<"info">>, <<"build">>] }.
 
+%% @doc Utility function for determining if a request is from the `operator' of
+%% the node.
+is_operator(Request, NodeMsg) ->
+    RequestSigners = hb_message:signers(Request, NodeMsg),
+    Operator =
+        hb_opts:get(
+            operator,
+            case hb_opts:get(priv_wallet, no_viable_wallet, NodeMsg) of
+                no_viable_wallet -> unclaimed;
+                Wallet -> ar_wallet:to_address(Wallet)
+            end,
+            NodeMsg
+        ),
+    EncOperator =
+        case Operator of
+            unclaimed -> unclaimed;
+            NativeAddress -> hb_util:human_id(NativeAddress)
+        end,
+    EncOperator == unclaimed orelse lists:member(EncOperator, RequestSigners).
 %% @doc Emits the version number and commit hash of the HyperBEAM node source,
 %% if available.
 %% 
@@ -48,8 +68,16 @@ build(_, _, _NodeMsg) ->
 %% other messages are routed to the `handle_resolve/2' function.
 handle(NodeMsg, RawRequest) ->
     ?event({singleton_tabm_request, RawRequest}),
-    NormRequest = hb_singleton:from(RawRequest),
-    ?event(http, {request, hb_ao:normalize_keys(NormRequest)}),
+    NormRequest = hb_singleton:from(RawRequest, NodeMsg),
+    ?event(
+        http,
+        {request,
+            hb_cache:ensure_all_loaded(
+                hb_ao:normalize_keys(NormRequest, NodeMsg),
+                NodeMsg
+            )
+        }
+    ),
     case hb_opts:get(initialized, false, NodeMsg) of
         false ->
             Res =
@@ -57,7 +85,8 @@ handle(NodeMsg, RawRequest) ->
                     hb_ao:force_message(
                         handle_initialize(NormRequest, NodeMsg),
                         NodeMsg
-                    )
+                    ),
+                    NodeMsg
                 ),
             Res;
         _ -> handle_resolve(RawRequest, NormRequest, NodeMsg)
@@ -81,10 +110,6 @@ handle_initialize([], _NodeMsg) ->
 %% as-is, aside all keys that are private (according to `hb_private').
 info(_, Request, NodeMsg) ->
     case hb_ao:get(<<"method">>, Request, NodeMsg) of
-        <<"GET">> ->
-            ?event({get_config_req, Request, NodeMsg}),
-            DynamicKeys = add_dynamic_keys(NodeMsg),	
-            embed_status({ok, filter_node_msg(DynamicKeys)});
         <<"POST">> ->
             case hb_ao:get(<<"initialized">>, NodeMsg, not_found, NodeMsg) of
                 permanent ->
@@ -92,35 +117,52 @@ info(_, Request, NodeMsg) ->
                         {error,
                             <<"The node message of this machine is already "
                                 "permanent. It cannot be changed.">>
-                        }
+                        },
+                        NodeMsg
                     );
                 _ ->
                     update_node_message(Request, NodeMsg)
             end;
-        _ -> embed_status({error, <<"Unsupported Meta/info method.">>})
+        _ ->
+            ?event({get_config_req, Request, NodeMsg}),
+            DynamicKeys = add_dynamic_keys(NodeMsg),	
+            embed_status({ok, filter_node_msg(DynamicKeys, NodeMsg)}, NodeMsg)
     end.
 
 %% @doc Remove items from the node message that are not encodable into a
 %% message.
-filter_node_msg(Msg) when is_map(Msg) ->
-    maps:map(fun(_, Value) -> filter_node_msg(Value) end, hb_private:reset(Msg));
-filter_node_msg(Msg) when is_list(Msg) ->
-    lists:map(fun filter_node_msg/1, Msg);
-filter_node_msg(Tuple) when is_tuple(Tuple) ->
+filter_node_msg(Msg, NodeMsg) when is_map(Msg) ->
+    hb_maps:map(fun(_, Value) -> filter_node_msg(Value, NodeMsg) end, hb_private:reset(Msg), NodeMsg);
+filter_node_msg(Msg, NodeMsg) when is_list(Msg) ->
+    lists:map(fun(Item) -> filter_node_msg(Item, NodeMsg) end, Msg);
+filter_node_msg(Tuple, _NodeMsg) when is_tuple(Tuple) ->
     <<"Unencodable value.">>;
-filter_node_msg(Other) ->
+filter_node_msg(Other, _NodeMsg) ->
     Other.
 
 %% @doc Add dynamic keys to the node message.
 add_dynamic_keys(NodeMsg) ->
-    case hb_opts:get(priv_wallet, no_viable_wallet, NodeMsg) of
-        no_viable_wallet ->
-            NodeMsg;
-        Wallet ->
-            %% Create a new map with address and merge it (overwriting existing)
-            Address = hb_util:id(ar_wallet:to_address(Wallet)),
-            NodeMsg#{ address => Address, <<"address">> => Address }
-    end.
+    UpdatedNodeMsg = 
+        case hb_opts:get(priv_wallet, no_viable_wallet, NodeMsg) of
+            no_viable_wallet ->
+                NodeMsg;
+            Wallet ->
+                %% Create a new map with address and merge it (overwriting existing)
+                Address = hb_util:id(ar_wallet:to_address(Wallet)),
+                NodeMsg#{ address => Address, <<"address">> => Address }
+        end,
+    add_identity_addresses(UpdatedNodeMsg).
+
+add_identity_addresses(NodeMsg) ->
+    Identities = hb_opts:get(identities, #{}, NodeMsg),
+    NewIdentities = maps:map(fun(_, Identity) ->
+        Identity#{
+            <<"address">> => hb_util:human_id(
+                hb_opts:get(priv_wallet, hb:wallet(), Identity)
+            )
+        }
+    end, Identities),
+    NodeMsg#{ <<"identities">> => NewIdentities }.
 
 %% @doc Validate that the request is signed by the operator of the node, then
 %% allow them to update the node message.
@@ -128,7 +170,7 @@ update_node_message(Request, NodeMsg) ->
     case is(admin, Request, NodeMsg) of
         false ->
             ?event({set_node_message_fail, Request}),
-            embed_status({error, <<"Unauthorized">>});
+            embed_status({error, <<"Unauthorized">>}, NodeMsg);
         true ->
             case adopt_node_message(Request, NodeMsg) of
                 {ok, NewNodeMsg} ->
@@ -146,11 +188,12 @@ update_node_message(Request, NodeMsg) ->
                                     ),
                                 <<"history-length">> => length(NewH)
                             }
-                        }
+                        },
+                        NodeMsg
                     );
                 {error, Reason} ->
                     ?event({set_node_message_fail, Request, Reason}),
-                    embed_status({error, Reason})
+                    embed_status({error, Reason}, NodeMsg)
             end
     end.
 
@@ -174,44 +217,29 @@ adopt_node_message(Request, NodeMsg) ->
 handle_resolve(Req, Msgs, NodeMsg) ->
     TracePID = hb_opts:get(trace, no_tracer_set, NodeMsg),
     % Apply the pre-processor to the request.
-    case resolve_hook(<<"request">>, Req, Msgs, NodeMsg) of
+    ?event(http_request,
+        {resolve_hook,
+            {raw_request, Req},
+            {parsed_request_sequence, Msgs}
+        }
+    ),
+    LoadedMsgs = hb_cache:ensure_all_loaded(Msgs, NodeMsg),
+    case resolve_hook(<<"request">>, Req, LoadedMsgs, NodeMsg) of
         {ok, PreProcessedMsg} ->
-            ?event(
-                {result_after_preprocessing,
-                    hb_ao:normalize_keys(PreProcessedMsg)}
-            ),
+            ?event(http_request, {request_after_preprocessing, PreProcessedMsg}),
             AfterPreprocOpts = hb_http_server:get_opts(NodeMsg),
             % Resolve the request message.
-            HTTPOpts =
-                maps:merge(
-                    AfterPreprocOpts,
-                    hb_opts:get(http_extra_opts, #{}, NodeMsg)
-                ),
+            HTTPOpts = hb_maps:merge(
+                AfterPreprocOpts,
+                hb_opts:get(http_extra_opts, #{}, NodeMsg),
+				NodeMsg
+            ),
             Res =
-                try
-                    hb_ao:resolve_many(
-                        PreProcessedMsg,
-                        HTTPOpts#{ force_message => true, trace => TracePID }
-                    )
-                catch
-                    throw:{necessary_message_not_found, MsgID} ->
-                        ID = hb_util:human_id(MsgID),
-                        {error, #{
-                            <<"status">> => 404,
-                            <<"unavailable">> => ID,
-                            <<"body">> =>
-                                <<
-                                    "Message necessary to resolve request ",
-                                    "not found: ",
-                                    ID/binary
-                                >>
-                        }}
-                end,
-            {ok, StatusEmbeddedRes} =
-                embed_status(
-                    Res
+                hb_ao:resolve_many(
+                    PreProcessedMsg,
+                    HTTPOpts#{ force_message => true, trace => TracePID }
                 ),
-            ?event({res, StatusEmbeddedRes}),
+            {ok, StatusEmbeddedRes} = embed_status(Res, NodeMsg),
             AfterResolveOpts = hb_http_server:get_opts(NodeMsg),
             % Apply the post-processor to the result.
             Output = maybe_sign(
@@ -221,13 +249,19 @@ handle_resolve(Req, Msgs, NodeMsg) ->
                         Req,
                         StatusEmbeddedRes,
                         AfterResolveOpts
-                    )
+                    ),
+                    NodeMsg
                 ),
                 NodeMsg
             ),
-            ?event(http, {response, Output}),
+            ?event(http_request,
+                {http_request,
+                    {request, Req},
+                    {result, Output}
+                }
+            ),
             Output;
-        Res -> embed_status(hb_ao:force_message(Res, NodeMsg))
+        Res -> embed_status(hb_ao:force_message(Res, NodeMsg), NodeMsg)
     end.
 
 %% @doc Execute a hook from the node message upon the user's request. The
@@ -246,24 +280,36 @@ resolve_hook(HookName, InitiatingRequest, Body, NodeMsg) ->
     ?event(hook, {resolve_hook, HookName, HookReq}),
     case dev_hook:on(HookName, HookReq, NodeMsg) of
         {ok, #{ <<"body">> := ResponseBody }} ->
+            ?event(hook,
+                {resolve_hook_success,
+                    {name, HookName},
+                    {response_body, ResponseBody}
+                }
+            ),
             {ok, ResponseBody};
         {error, _} = Error ->
+            ?event(hook,
+                {resolve_hook_error,
+                    {name, HookName},
+                    {error, Error}
+                }
+            ),
             Error;
         Other ->
             {error, Other}
     end.
 
 %% @doc Wrap the result of a device call in a status.
-embed_status({ErlStatus, Res}) when is_map(Res) ->
-    case lists:member(<<"status">>, hb_message:committed(Res)) of
+embed_status({ErlStatus, Res}, NodeMsg) when is_map(Res) ->
+    case lists:member(<<"status">>, hb_message:committed(Res, all, NodeMsg)) of
         false ->
-            HTTPCode = status_code({ErlStatus, Res}),
+            HTTPCode = status_code({ErlStatus, Res}, NodeMsg),
             {ok, Res#{ <<"status">> => HTTPCode }};
         true ->
             {ok, Res}
     end;
-embed_status({ErlStatus, Res}) ->
-    HTTPCode = status_code({ErlStatus, Res}),
+embed_status({ErlStatus, Res}, NodeMsg) ->
+    HTTPCode = status_code({ErlStatus, Res}, NodeMsg),
     {ok, #{ <<"status">> => HTTPCode, <<"body">> => Res }}.
 
 %% @doc Calculate the appropriate HTTP status code for an AO-Core result.
@@ -271,44 +317,66 @@ embed_status({ErlStatus, Res}) ->
 %% 1. The status code from the message.
 %% 2. The HTTP representation of the status code.
 %% 3. The default status code.
-status_code({ErlStatus, Msg}) ->
-    case message_to_status(Msg) of
-        default -> status_code(ErlStatus);
+status_code({ErlStatus, Msg}, NodeMsg) ->
+    case message_to_status(Msg, NodeMsg) of
+        default -> status_code(ErlStatus, NodeMsg);
         RawStatus -> RawStatus
     end;
-status_code(ok) -> 200;
-status_code(error) -> 400;
-status_code(created) -> 201;
-status_code(not_found) -> 404;
-status_code(failure) -> 500;
-status_code(unavailable) -> 503.
+status_code(ok, _NodeMsg) -> 200;
+status_code(error, _NodeMsg) -> 400;
+status_code(created, _NodeMsg) -> 201;
+status_code(not_found, _NodeMsg) -> 404;
+status_code(failure, _NodeMsg) -> 500;
+status_code(unavailable, _NodeMsg) -> 503;
+status_code(unauthorized, _NodeMsg) -> 401;
+status_code(forbidden, _NodeMsg) -> 403;
+status_code(_, _NodeMsg) -> 200.
 
 %% @doc Get the HTTP status code from a transaction (if it exists).
-message_to_status(#{ <<"body">> := Status }) when is_atom(Status) ->
-    status_code(Status);
-message_to_status(Item) when is_map(Item) ->
+message_to_status(#{ <<"body">> := Status }, NodeMsg) when is_atom(Status) ->
+    status_code(Status, NodeMsg);
+message_to_status(Item, NodeMsg) when is_map(Item) ->
     % Note: We use `dev_message' directly here, such that we do not cause 
     % additional AO-Core calls for every request. This is particularly important
     % if a remote server is being used for all AO-Core requests by a node.
-    case dev_message:get(<<"status">>, Item) of
+    case dev_message:get(<<"status">>, Item, NodeMsg) of
         {ok, RawStatus} when is_integer(RawStatus) -> RawStatus;
-        {ok, RawStatus} when is_atom(RawStatus) -> status_code(RawStatus);
-        {ok, RawStatus} -> binary_to_integer(RawStatus);
+        {ok, RawStatus} when is_atom(RawStatus) ->
+            status_code(RawStatus, NodeMsg);
+        {ok, RawStatus} ->
+            % If we can convert the status to an integer, do so.
+            try binary_to_integer(RawStatus)
+            catch
+                error:badarg ->
+                    % We can't convert the status to an integer, but we may be
+                    % able to convert it to an existing atom status code.
+                    try
+                        status_code(
+                            binary_to_existing_atom(RawStatus, latin1),
+                            NodeMsg
+                        )
+                    catch
+                        error:badarg ->
+                            % We can't convert the status to an integer or atom,
+                            % so we return the default status code.
+                            default
+                    end
+            end;
         _ -> default
     end;
-message_to_status(Item) when is_atom(Item) ->
-    status_code(Item);
-message_to_status(_Item) ->
+message_to_status(Item, NodeMsg) when is_atom(Item) ->
+    status_code(Item, NodeMsg);
+message_to_status(_Item, _NodeMsg) ->
     default.
 
 %% @doc Sign the result of a device call if the node is configured to do so.
 maybe_sign({Status, Res}, NodeMsg) ->
     {Status, maybe_sign(Res, NodeMsg)};
 maybe_sign(Res, NodeMsg) ->
-    ?event({maybe_sign, Res, NodeMsg}),
+    ?event({maybe_sign, Res}),
     case hb_opts:get(force_signed, false, NodeMsg) of
         true ->
-            case hb_message:signers(Res) of
+            case hb_message:signers(Res, NodeMsg) of
                 [] -> hb_message:commit(Res, NodeMsg);
                 _ -> Res
             end;
@@ -321,7 +389,7 @@ is(Request, NodeMsg) ->
     is(operator, Request, NodeMsg).
 is(admin, Request, NodeMsg) ->
     % Does the caller have the right to change the node message?
-    RequestSigners = hb_message:signers(Request),
+    RequestSigners = hb_message:signers(Request, NodeMsg),
     ValidOperator =
         hb_util:bin(
             hb_opts:get(
@@ -351,7 +419,7 @@ is(operator, Req, NodeMsg) ->
     % Get the operator from the node message
     Operator = hb_opts:get(operator, unclaimed, NodeMsg),
     % Get the request signers
-    RequestSigners = hb_message:signers(Req),
+    RequestSigners = hb_message:signers(Req, NodeMsg),
     % Ensure the operator is present in the request
     lists:member(Operator, RequestSigners);
 is(initiator, Request, NodeMsg) ->
@@ -364,9 +432,9 @@ is(initiator, Request, NodeMsg) ->
             false;
         [InitializationRequest | _] ->
             % Extract signature from first entry
-            InitializationRequestSigners = hb_message:signers(InitializationRequest),
+            InitializationRequestSigners = hb_message:signers(InitializationRequest, NodeMsg),
             % Get request signers
-            RequestSigners = hb_message:signers(Request),
+            RequestSigners = hb_message:signers(Request, NodeMsg),
             % Ensure all signers of the initalization request are present in the
             % request.
             AllSignersPresent =
@@ -389,10 +457,13 @@ is(initiator, Request, NodeMsg) ->
 
 %% @doc Test that we can get the node message.
 config_test() ->
-    Node = hb_http_server:start_node(#{ test_config_item => <<"test">> }),
-    {ok, Res} = hb_http:get(Node, <<"/~meta@1.0/info">>, #{}),
-    ?event({res, Res}),
-    ?assertEqual(<<"test">>, hb_ao:get(<<"test_config_item">>, Res, #{})).
+	StoreOpts = #{
+		<<"store-module">> => hb_store_fs,
+		<<"name">> => <<"cache-TEST">>
+	},
+    Node = hb_http_server:start_node(Opts = #{ test_config_item => <<"test">>, store => StoreOpts }),
+    {ok, Res} = hb_http:get(Node, <<"/~meta@1.0/info">>, Opts),
+    ?assertEqual(<<"test">>, hb_ao:get(<<"test_config_item">>, Res, Opts)).
 
 %% @doc Test that we can't get the node message if the requested key is private.
 priv_inaccessible_test() ->
@@ -410,7 +481,11 @@ priv_inaccessible_test() ->
 %% @doc Test that we can't set the node message if the request is not signed by
 %% the owner of the node.
 unauthorized_set_node_msg_fails_test() ->
-    Node = hb_http_server:start_node(#{ priv_wallet => ar_wallet:new() }),
+	StoreOpts = #{
+		<<"store-module">> => hb_store_fs,
+		<<"name">> => <<"cache-TEST">>
+	},
+    Node = hb_http_server:start_node(Opts = #{ store => StoreOpts, priv_wallet => ar_wallet:new() }),
     {error, _} =
         hb_http:post(
             Node,
@@ -419,22 +494,27 @@ unauthorized_set_node_msg_fails_test() ->
                     <<"path">> => <<"/~meta@1.0/info">>,
                     <<"evil_config_item">> => <<"BAD">>
                 },
-                ar_wallet:new()
+                Opts#{ priv_wallet => ar_wallet:new() }
             ),
             #{}
         ),
-    {ok, Res} = hb_http:get(Node, <<"/~meta@1.0/info">>, #{}),
-    ?assertEqual(not_found, hb_ao:get(<<"evil_config_item">>, Res, #{})),
-    ?assertEqual(0, length(hb_ao:get(<<"node_history">>, Res, [], #{}))).
+    {ok, Res} = hb_http:get(Node, <<"/~meta@1.0/info">>, Opts),
+    ?assertEqual(not_found, hb_ao:get(<<"evil_config_item">>, Res, Opts)),
+    ?assertEqual(0, length(hb_ao:get(<<"node_history">>, Res, [], Opts))).
 
 %% @doc Test that we can set the node message if the request is signed by the
 %% owner of the node.
 authorized_set_node_msg_succeeds_test() ->
+	StoreOpts = #{
+		<<"store-module">> => hb_store_fs,
+		<<"name">> => <<"cache-TEST">>
+	},
     Owner = ar_wallet:new(),
     Node = hb_http_server:start_node(
-        #{
+        Opts = #{
             operator => hb_util:human_id(ar_wallet:to_address(Owner)),
-            test_config_item => <<"test">>
+            test_config_item => <<"test">>,
+			store => StoreOpts
         }
     ),
     {ok, SetRes} =
@@ -445,15 +525,15 @@ authorized_set_node_msg_succeeds_test() ->
                     <<"path">> => <<"/~meta@1.0/info">>,
                     <<"test_config_item">> => <<"test2">>
                 },
-                Owner
+                Opts#{ priv_wallet => Owner }
             ),
-            #{}
+            Opts
         ),
     ?event({res, SetRes}),
-    {ok, Res} = hb_http:get(Node, <<"/~meta@1.0/info">>, #{}),
+    {ok, Res} = hb_http:get(Node, <<"/~meta@1.0/info">>, Opts),
     ?event({res, Res}),
-    ?assertEqual(<<"test2">>, hb_ao:get(<<"test_config_item">>, Res, #{})),
-    ?assertEqual(1, length(hb_ao:get(<<"node_history">>, Res, [], #{}))).
+    ?assertEqual(<<"test2">>, hb_ao:get(<<"test_config_item">>, Res, Opts)),
+    ?assertEqual(1, length(hb_ao:get(<<"node_history">>, Res, [], Opts))).
 
 %% @doc Test that an uninitialized node will not run computation.
 uninitialized_node_test() ->
@@ -464,12 +544,17 @@ uninitialized_node_test() ->
 
 %% @doc Test that a permanent node message cannot be changed.
 permanent_node_message_test() ->
+	StoreOpts = #{
+		<<"store-module">> => hb_store_fs,
+		<<"name">> => <<"cache-TEST">>
+	},
     Owner = ar_wallet:new(),
     Node = hb_http_server:start_node(
-        #{
+        Opts =#{
             operator => <<"unclaimed">>,
             initialized => false,
-            test_config_item => <<"test">>
+            test_config_item => <<"test">>,
+			store => StoreOpts
         }
     ),
     {ok, SetRes1} =
@@ -481,14 +566,14 @@ permanent_node_message_test() ->
                     <<"test_config_item">> => <<"test2">>,
                     initialized => <<"permanent">>
                 },
-                Owner
+                Opts#{ priv_wallet => Owner }
             ),
-            #{}
+            Opts
         ),
     ?event({set_res, SetRes1}),
-    {ok, Res} = hb_http:get(Node, #{ <<"path">> => <<"/~meta@1.0/info">> }, #{}),
+    {ok, Res} = hb_http:get(Node, #{ <<"path">> => <<"/~meta@1.0/info">> }, Opts),
     ?event({get_res, Res}),
-    ?assertEqual(<<"test2">>, hb_ao:get(<<"test_config_item">>, Res, #{})),
+    ?assertEqual(<<"test2">>, hb_ao:get(<<"test_config_item">>, Res, Opts)),
     {error, SetRes2} =
         hb_http:post(
             Node,
@@ -497,24 +582,29 @@ permanent_node_message_test() ->
                     <<"path">> => <<"/~meta@1.0/info">>,
                     <<"test_config_item">> => <<"bad_value">>
                 },
-                Owner
+                Opts#{ priv_wallet => Owner }
             ),
-            #{}
+            Opts
         ),
     ?event({set_res, SetRes2}),
-    {ok, Res2} = hb_http:get(Node, #{ <<"path">> => <<"/~meta@1.0/info">> }, #{}),
+    {ok, Res2} = hb_http:get(Node, #{ <<"path">> => <<"/~meta@1.0/info">> }, Opts),
     ?event({get_res, Res2}),
-    ?assertEqual(<<"test2">>, hb_ao:get(<<"test_config_item">>, Res2, #{})),
-    ?assertEqual(1, length(hb_ao:get(<<"node_history">>, Res2, [], #{}))).
+    ?assertEqual(<<"test2">>, hb_ao:get(<<"test_config_item">>, Res2, Opts)),
+    ?assertEqual(1, length(hb_ao:get(<<"node_history">>, Res2, [], Opts))).
 
 %% @doc Test that we can claim the node correctly and set the node message after.
 claim_node_test() ->
+	StoreOpts = #{
+		<<"store-module">> => hb_store_fs,
+		<<"name">> => <<"cache-TEST">>
+	},
     Owner = ar_wallet:new(),
     Address = ar_wallet:to_address(Owner),
     Node = hb_http_server:start_node(
-        #{
+        Opts = #{
             operator => unclaimed,
-            test_config_item => <<"test">>
+            test_config_item => <<"test">>,
+			store => StoreOpts
         }
     ),
     {ok, SetRes} =
@@ -525,14 +615,14 @@ claim_node_test() ->
                     <<"path">> => <<"/~meta@1.0/info">>,
                     <<"operator">> => hb_util:human_id(Address)
                 },
-                Owner
+                Opts#{ priv_wallet => Owner}
             ),
-            #{}
+            Opts
         ),
     ?event({res, SetRes}),
-    {ok, Res} = hb_http:get(Node, <<"/~meta@1.0/info">>, #{}),
+    {ok, Res} = hb_http:get(Node, <<"/~meta@1.0/info">>, Opts),
     ?event({res, Res}),
-    ?assertEqual(hb_util:human_id(Address), hb_ao:get(<<"operator">>, Res, #{})),
+    ?assertEqual(hb_util:human_id(Address), hb_ao:get(<<"operator">>, Res, Opts)),
     {ok, SetRes2} =
         hb_http:post(
             Node,
@@ -541,15 +631,15 @@ claim_node_test() ->
                     <<"path">> => <<"/~meta@1.0/info">>,
                     <<"test_config_item">> => <<"test2">>
                 },
-                Owner
+                Opts#{ priv_wallet => Owner }
             ),
-            #{}
+            Opts
         ),
     ?event({res, SetRes2}),
-    {ok, Res2} = hb_http:get(Node, <<"/~meta@1.0/info">>, #{}),
+    {ok, Res2} = hb_http:get(Node, <<"/~meta@1.0/info">>, Opts),
     ?event({res, Res2}),
-    ?assertEqual(<<"test2">>, hb_ao:get(<<"test_config_item">>, Res2, #{})),
-    ?assertEqual(2, length(hb_ao:get(<<"node_history">>, Res2, [], #{}))).
+    ?assertEqual(<<"test2">>, hb_ao:get(<<"test_config_item">>, Res2, Opts)),
+    ?assertEqual(2, length(hb_ao:get(<<"node_history">>, Res2, [], Opts))).
 
 %% Test that we can use a hook upon a request.
 request_response_hooks_test() ->
diff --git a/src/dev_multipass.erl b/src/dev_multipass.erl
index 954c3d1c0..e3ab47b7b 100644
--- a/src/dev_multipass.erl
+++ b/src/dev_multipass.erl
@@ -13,8 +13,8 @@ info(_M1) ->
 
 %% @doc Forward the keys function to the message device, handle all others
 %% with deduplication. We only act on the first pass.
-handle(<<"keys">>, M1, _M2, _Opts) ->
-    dev_message:keys(M1);
+handle(<<"keys">>, M1, _M2, Opts) ->
+    dev_message:keys(M1, Opts);
 handle(<<"set">>, M1, M2, Opts) ->
     dev_message:set(M1, M2, Opts);
 handle(_Key, M1, _M2, Opts) ->
@@ -30,7 +30,7 @@ handle(_Key, M1, _M2, Opts) ->
 basic_multipass_test() ->
     Msg1 =
         #{
-            <<"device">> => <<"Multipass@1.0">>,
+            <<"device">> => <<"multipass@1.0">>,
             <<"passes">> => 2,
             <<"pass">> => 1
         },
diff --git a/src/dev_node_process.erl b/src/dev_node_process.erl
index e213c915f..433767d21 100644
--- a/src/dev_node_process.erl
+++ b/src/dev_node_process.erl
@@ -46,7 +46,13 @@ spawn_register(Name, Opts) ->
             % We have found the base process definition. Augment it with the 
             % node's address as necessary, then commit to the result.
             ?event(node_process, {registering, {name, Name}, {base_def, BaseDef}}),
-            Signed = hb_message:commit(augment_definition(BaseDef, Opts), Opts),
+            Signed =
+                hb_message:commit(
+                    augment_definition(BaseDef, Opts),
+                    Opts,
+                    hb_opts:get(node_process_spawn_codec, <<"httpsig@1.0">>, Opts)
+                ),
+            ?event(node_process, {signed, {name, Name}, {signed, Signed}}),
             ID = hb_message:id(Signed, signed, Opts),
             ?event(node_process, {spawned, {name, Name}, {process, Signed}}),
             % `POST' to the schedule device for the process to start its sequence.
@@ -91,11 +97,24 @@ augment_definition(BaseDef, Opts) ->
                 hb_opts:get(priv_wallet, no_viable_wallet, Opts)
             )
         ),
+    SchedulersFromBase =
+        hb_util:binary_to_strings(
+            hb_ao:get(<<"scheduler">>, BaseDef, <<>>, Opts)
+        ),
+    AuthoritiesFromBase =
+        hb_util:binary_to_strings(
+            hb_ao:get(<<"authority">>, BaseDef, <<>>, Opts)
+        ),
+    Schedulers = (SchedulersFromBase -- [Address]) ++ [Address],
+    Authorities = (AuthoritiesFromBase -- [Address]) ++ [Address],
+    % Normalize the scheduler and authority lists to binary strings.
     hb_ao:set(
-        BaseDef,
         #{
-            <<"scheduler">> => Address
-        }
+            <<"scheduler">> => Schedulers,
+            <<"authority">> => Authorities
+        },
+        BaseDef,
+        Opts
     ).
 
 %%% Tests
@@ -119,17 +138,6 @@ generate_test_opts() ->
     }).
 generate_test_opts(Defs) ->
     #{
-        store =>
-            [
-                #{
-                    <<"store-module">> => hb_store_fs,
-                    <<"prefix">> =>
-                        <<
-                            "cache-TEST-",
-                            (integer_to_binary(os:system_time(millisecond)))/binary
-                        >>
-                }
-            ],
         node_processes => Defs,
         priv_wallet => ar_wallet:new()
     }.
@@ -158,7 +166,10 @@ lookup_spawn_test() ->
         ?TEST_NAME,
         Opts
     ),
-    ?assertEqual(Process1, Process2).
+    ?assertEqual(
+        hb_cache:ensure_all_loaded(Process1, Opts),
+        hb_cache:ensure_all_loaded(Process2, Opts)
+    ).
 
 %% @doc Test that a process can be spawned, executed upon, and its result retrieved.
 lookup_execute_test() ->
diff --git a/src/dev_p4.erl b/src/dev_p4.erl
index badd5e23a..b072ae1bd 100644
--- a/src/dev_p4.erl
+++ b/src/dev_p4.erl
@@ -25,13 +25,13 @@
 %%% A ledger device should implement the following keys:
 %%% <pre>
 %%%             `POST /credit?message=PaymentMessage&request=RequestMessage'
-%%%             `POST /debit?amount=PriceMessage&request=RequestMessage'
+%%%             `POST /charge?amount=PriceMessage&request=RequestMessage'
 %%%             `GET /balance?request=RequestMessage'
 %%% </pre>
 %%%
 %%% The `type' key is optional and defaults to `pre'. If `type' is set to `post',
-%%% the debit must be applied to the ledger, whereas the `pre' type is used to
-%%% check whether the debit would succeed before execution.
+%%% the charge must be applied to the ledger, whereas the `pre' type is used to
+%%% check whether the charge would succeed before execution.
 -module(dev_p4).
 -export([request/3, response/3, balance/3]).
 -include("include/hb.hrl").
@@ -40,6 +40,7 @@
 %%% The default list of routes that should not be charged for.
 -define(DEFAULT_NON_CHARGABLE_ROUTES, [
     #{ <<"template">> => <<"/~p4@1.0/balance">> },
+    #{ <<"template">> => <<"/~p4@1.0/topup">> },
     #{ <<"template">> => <<"/~meta@1.0/*">> }
 ]).
 
@@ -76,10 +77,6 @@ request(State, Raw, NodeMsg) ->
             },
             ?event({p4_pricing_request, {devmsg, PricingMsg}, {req, PricingReq}}),
             case hb_ao:resolve(PricingMsg, PricingReq, NodeMsg) of
-                {error, Error} ->
-                    % The device is unable to estimate the cost of the request,
-                    % so we don't proceed.
-                    {error, {error_calculating_price, Error}};
                 {ok, <<"infinity">>} ->
                     % The device states that under no circumstances should we
                     % proceed with the request.
@@ -98,7 +95,7 @@ request(State, Raw, NodeMsg) ->
                     LedgerReq = #{
                         <<"path">> => <<"balance">>,
                         <<"target">> =>
-                            case hb_message:signers(Request) of
+                            case hb_message:signers(Request, NodeMsg) of
                                 [Signer] -> Signer;
                                 [] -> <<"unknown">>;
                                 Multiple -> Multiple
@@ -137,7 +134,7 @@ request(State, Raw, NodeMsg) ->
                                 }
                             ),
                             {error, #{
-                                <<"status">> => 429,
+                                <<"status">> => 402,
                                 <<"body">> => <<"Insufficient funds">>,
                                 <<"price">> => Price,
                                 <<"balance">> => Balance
@@ -156,7 +153,18 @@ request(State, Raw, NodeMsg) ->
                                 <<"status">> => 500,
                                 <<"body">> => <<"Error checking ledger balance.">>
                             }}
-                    end
+                    end;
+                {ErrType, Err} ->
+                    % The device is unable to estimate the cost of the request,
+                    % so we don't proceed.
+                    ?event({p4_pricing_error, {type, ErrType}}),
+                    {error,
+                        #{
+                            <<"type">> => ErrType,
+                            <<"body">> =>
+                                <<"Could not estimate price of request.">>
+                        }
+                    }
             end
     end.
 
@@ -197,27 +205,47 @@ response(State, RawResponse, NodeMsg) ->
                 end,
             ?event(payment, {p4_post_pricing_response, PricingRes}),
             case PricingRes of
+                {ok, 0} ->
+                    % The pricing device has estimated the cost of the request
+                    % to be zero, so we proceed.
+                    {ok, #{ <<"body">> => Response }};
                 {ok, Price} ->
                     % We have successfully determined the cost of the request,
-                    % so we proceed to debit the user's account. We sign the
+                    % so we proceed to charge the user's account. We sign the
                     % request with the node's private key, as it is the node
-                    % that is performing the debit, not the user.
+                    % that is performing the charge, not the user.
                     LedgerReq =
                         hb_message:commit(
                             #{
-                                <<"path">> => <<"debit">>,
+                                <<"path">> => <<"charge">>,
                                 <<"quantity">> => Price,
                                 <<"account">> =>
-                                    case hb_message:signers(Request) of
+                                    case hb_message:signers(Request, NodeMsg) of
                                         [Signer] -> Signer;
-                                        [] -> <<"unknown">>;
                                         Multiple -> Multiple
                                     end,
+                                <<"recipient">> =>
+                                    case hb_opts:get(p4_recipient, undefined, NodeMsg) of
+                                        Addr when ?IS_ID(Addr) ->
+                                            hb_util:human_id(Addr);
+                                        _ ->
+                                            case hb_opts:get(operator, undefined, NodeMsg) of
+                                                undefined ->
+                                                    <<"unknown">>;
+                                                Operator->
+                                                    hb_util:human_id(Operator)
+                                            end
+                                    end,
                                 <<"request">> => Request
                             },
-                            hb_opts:get(priv_wallet, no_viable_wallet, NodeMsg)
+                            NodeMsg
                         ),
-                    ?event({p4_ledger_request, LedgerReq}),
+                    ?event(payment,
+                        {post_charge,
+                            {msg, LedgerMsg},
+                            {req, LedgerReq}
+                        }
+                    ),
                     case hb_ao:resolve(LedgerMsg, LedgerReq, NodeMsg) of
                         {ok, _} ->
                             ?event(payment, {p4_post_ledger_response, {ok, Price}}),
@@ -225,7 +253,7 @@ response(State, RawResponse, NodeMsg) ->
                             {ok, #{ <<"body">> => Response }};
                         {error, Error} ->
                             ?event(payment, {p4_post_ledger_response, {error, Error}}),
-                            % The debit failed, so we return the error from the
+                            % The charge failed, so we return the error from the
                             % ledger device.
                             {error, Error}
                     end;
@@ -249,7 +277,7 @@ balance(_, Req, NodeMsg) ->
                 <<"path">> => <<"balance">>,
                 <<"request">> => Req
             },
-            ?event(debug, {ledger_message, {ledger_msg, LedgerMsg}}),
+            ?event({ledger_message, {ledger_msg, LedgerMsg}}),
             case hb_ao:resolve(LedgerMsg, LedgerReq, NodeMsg) of
                 {ok, Balance} ->
                     {ok, Balance};
@@ -373,17 +401,32 @@ non_chargable_route_test() ->
     ?event({res3, Res3}),
     ?assertMatch({error, _}, Res3).
 
-%% @doc Ensure that Lua modules can be used as pricing and ledger devices. Our
-%% modules come in two parts:
-%% - A `process' module which is executed as a persistent `local-process' on the
-%%   node, and which maintains the state of the ledger.
-%% - A `client' module, which is executed as a `p4@1.0' device, marshalling
-%%   requests to the `process' module.
-lua_pricing_test() ->
+%% @doc Ensure that Lua scripts can be used as pricing and ledger devices. Our
+%% scripts come in two components:
+%% 1. A `process' script which is executed as a persistent `local-process' on the
+%%   node, and which maintains the state of the ledger. This process runs 
+%%   `hyper-token.lua' as its base, then adds the logic of `hyper-token-p4.lua'
+%%   to it. This secondary script implements the `charge' function that `p4@1.0'
+%%   will call to charge a user's account.
+%% 2. A `client' script, which is executed as a `p4@1.0' ledger device, which
+%%   uses `~push@1.0' to send requests to the ledger `process'.
+hyper_token_ledger_test_() ->
+    {timeout, 60, fun hyper_token_ledger/0}.
+hyper_token_ledger() ->
+    % Create the wallets necessary and read the files containing the scripts.
     HostWallet = ar_wallet:new(),
-    ClientWallet = ar_wallet:new(),
-    {ok, ProcessScript} = file:read_file("scripts/p4-payment-process.lua"),
-    {ok, ClientScript} = file:read_file("scripts/p4-payment-client.lua"),
+    HostAddress = hb_util:human_id(HostWallet),
+    OperatorWallet = ar_wallet:new(),
+    OperatorAddress = hb_util:human_id(OperatorWallet),
+    AliceWallet = ar_wallet:new(),
+    AliceAddress = hb_util:human_id(AliceWallet),
+    BobWallet = ar_wallet:new(),
+    BobAddress = hb_util:human_id(BobWallet),
+    {ok, TokenScript} = file:read_file("scripts/hyper-token.lua"),
+    {ok, ProcessScript} = file:read_file("scripts/hyper-token-p4.lua"),
+    {ok, ClientScript} = file:read_file("scripts/hyper-token-p4-client.lua"),
+    % Create the processor device, contains component (1): The script that 
+    % pushes requests to the ledger `process'.
     Processor =
         #{
             <<"device">> => <<"p4@1.0">>,
@@ -391,51 +434,69 @@ lua_pricing_test() ->
             <<"pricing-device">> => <<"simple-pay@1.0">>,
             <<"module">> => #{
                 <<"content-type">> => <<"text/x-lua">>,
-                <<"name">> => <<"scripts/p4-payment-client.lua">>,
+                <<"name">> => <<"scripts/hyper-token-p4-client.lua">>,
                 <<"body">> => ClientScript
             },
             <<"ledger-path">> => <<"/ledger~node-process@1.0">>
         },
+    % Start the node with the processor and the `local-process' ledger 
+    % (component 2) running the `hyper-token.lua' and `hyper-token-p4.lua'
+    % scripts. `hyper-token.lua' implements the core token ledger, while
+    % `hyper-token-p4.lua' implements the `charge' function that `p4@1.0' will
+    % call to charge a user's account upon charges. We initialize the ledger
+    % with 100 tokens for Alice.
     Node =
         hb_http_server:start_node(
             #{
+                store => [hb_test_utils:test_store()],
                 priv_wallet => HostWallet,
                 p4_non_chargable_routes =>
                     [
                         #{
-                            <<"template">> =>
-                                <<"/*~node-process@1.0/*">>
+                            <<"template">> => <<"/*~node-process@1.0/*">>
                         }
                     ],
                 on => #{
                     <<"request">> => Processor,
                     <<"response">> => Processor
                 },
-                operator => ar_wallet:to_address(HostWallet),
+                operator => OperatorAddress,
                 node_processes => #{
                     <<"ledger">> => #{
                         <<"device">> => <<"process@1.0">>,
                         <<"execution-device">> => <<"lua@5.3a">>,
                         <<"scheduler-device">> => <<"scheduler@1.0">>,
-                        <<"module">> => #{
-                            <<"content-type">> => <<"text/x-lua">>,
-                            <<"name">> => <<"scripts/p4-payment-process.lua">>,
-                            <<"body">> => ProcessScript
-                        },
-                        <<"operator">> =>
-                            hb_util:human_id(ar_wallet:to_address(HostWallet))
+                        <<"module">> => [
+                            #{
+                                <<"content-type">> => <<"text/x-lua">>,
+                                <<"name">> => <<"scripts/hyper-token.lua">>,
+                                <<"body">> => TokenScript
+                            },
+                            #{
+                                <<"content-type">> => <<"text/x-lua">>,
+                                <<"name">> => <<"scripts/hyper-token-p4.lua">>,
+                                <<"body">> => ProcessScript
+                            }
+                        ],
+                        <<"balance">> => #{ AliceAddress => 100 },
+                        <<"admin">> => HostAddress
+                        % <<"operator">> =>
+                        %     hb_util:human_id(ar_wallet:to_address(HostWallet))
                     }
                 }
             }
         ),
+    % To start, we attempt a request from Bob, which should fail because he
+    % has no tokens.
     Req = #{
         <<"path">> => <<"/greeting">>,
         <<"greeting">> => <<"Hello, world!">>
     },
-    SignedReq = hb_message:commit(Req, ClientWallet),
+    SignedReq = hb_message:commit(Req, BobWallet),
     Res = hb_http:get(Node, SignedReq, #{}),
     ?event({expected_failure, Res}),
     ?assertMatch({error, _}, Res),
+    % We then move 50 tokens from Alice to Bob.
     {ok, TopupRes} =
         hb_http:post(
             Node,
@@ -445,32 +506,32 @@ lua_pricing_test() ->
                     <<"body">> =>
                         hb_message:commit(
                             #{
-                                <<"path">> => <<"credit-notice">>,
-                                <<"quantity">> => 100,
-                                <<"recipient">> =>
-                                    hb_util:human_id(
-                                        ar_wallet:to_address(ClientWallet)
-                                    )
+                                <<"path">> => <<"transfer">>,
+                                <<"quantity">> => 50,
+                                <<"recipient">> => BobAddress
                             },
-                            HostWallet
+                            AliceWallet
                         )
                 },
                 HostWallet
             ),
             #{}
         ),
+    % We now attempt Bob's request again, which should succeed.
     ?event({topup_res, TopupRes}),
     ResAfterTopup = hb_http:get(Node, SignedReq, #{}),
     ?event({res_after_topup, ResAfterTopup}),
     ?assertMatch({ok, <<"Hello, world!">>}, ResAfterTopup),
-    {ok, Balance} =
+    % We now check the balance of Bob. It should have been charged 2 tokens from
+    % the 50 Alice sent him.
+    {ok, Balances} =
         hb_http:get(
             Node,
-            <<
-                "/ledger~node-process@1.0/now/balance/",
-                    (hb_util:human_id(ar_wallet:to_address(ClientWallet)))/binary
-            >>,
+            <<"/ledger~node-process@1.0/now/balance">>,
             #{}
         ),
-    ?event({balance, Balance}),
-    ?assertMatch(#{ <<"body">> := <<"98">> }, Balance).
\ No newline at end of file
+    ?event(debug_charge, {balances, Balances}),
+    ?assertMatch(48, hb_ao:get(BobAddress, Balances, #{})),
+    % Finally, we check the balance of the operator. It should be 2 tokens,
+    % the amount that was charged from Alice.
+    ?assertMatch(2, hb_ao:get(OperatorAddress, Balances, #{})).
\ No newline at end of file
diff --git a/src/dev_patch.erl b/src/dev_patch.erl
index f7ef33e26..2e57c48e7 100644
--- a/src/dev_patch.erl
+++ b/src/dev_patch.erl
@@ -100,6 +100,7 @@ move(Mode, Msg1, Msg2, Opts) ->
         % Get the source of the patches from the message. Makes the `maybe'
         % statement return `{error, not_found}' if the source is not found.
         {ok, Source} ?= hb_ao:resolve(FromMsg, PatchFrom, Opts),
+        ?event({source, Source}),
         % Find all messages with the PATCH request.
         {ToWrite, NewSourceValue} =
             case Mode of
@@ -111,7 +112,17 @@ move(Mode, Msg1, Msg2, Opts) ->
                             Device = hb_ao:get(<<"device">>, Msg, Opts)
                                 == <<"patch@1.0">>,
                             if Method orelse Device ->
-                                {PatchAcc#{Key => Msg}, NewSourceAcc};
+                                {
+                                    PatchAcc#{
+                                        Key =>
+                                            hb_maps:without(
+                                                [<<"commitments">>, <<"Tags">>],
+                                                Msg,
+                                                Opts
+                                            )
+                                    },
+                                    NewSourceAcc
+                                };
                             true ->
                                 {PatchAcc, NewSourceAcc#{ Key => Msg }}
                             end
@@ -160,6 +171,7 @@ move(Mode, Msg1, Msg2, Opts) ->
                         ToWrite
                     )
             end,
+        ?event({to_write, ToWriteMod}),
         % Find the target to apply the patches to, and apply them.
         PatchedResult =
             hb_ao:set(
@@ -341,4 +353,56 @@ req_prefix_test() ->
     ?assertEqual(
         not_found,
         hb_ao:get(<<"results/outbox/1">>, ResolvedState, #{})
-    ).
\ No newline at end of file
+    ).
+
+custom_set_patch_test() ->
+    hb:init(),
+    % Apply a patch from a message containing a device with a custom `set' key
+    % (the `~trie@1.0' device in this example).
+    ID1 = hb_util:human_id(<<0:256>>),
+    ID2 = hb_util:human_id(crypto:strong_rand_bytes(32)),
+    State0 = #{
+        <<"device">> => <<"patch@1.0">>,
+        <<"results">> => #{
+            <<"outbox">> => #{
+                <<"1">> => #{
+                    <<"device">> => <<"patch@1.0">>,
+                    <<"balances">> => #{
+                        <<"device">> => <<"trie@1.0">>
+                    }
+                },
+                <<"2">> => #{
+                    <<"device">> => <<"patch@1.0">>,
+                    <<"balances">> => #{
+                        <<"A">> => <<"50">>,
+                        ID2 => <<"250">>
+                    }
+                }
+            }
+        },
+        <<"other-message">> => <<"other-value">>,
+        <<"patch-from">> => <<"/results/outbox">>
+    },
+    {ok, State1} = hb_ao:resolve(State0, <<"compute">>, #{}),
+    ?event(debug_test, {resolved_state, State1}),
+    ?assertEqual(<<"50">>, hb_ao:get(<<"balances/A">>, State1, #{})),
+    ?assertEqual(<<"250">>, hb_ao:get(<<"balances/", ID2/binary>>, State1, #{})),
+    State2 =
+        State1#{
+            <<"results">> => #{
+                <<"outbox">> => #{
+                    <<"1">> => #{
+                        <<"device">> => <<"patch@1.0">>,
+                        <<"balances">> => #{
+                            ID1 => <<"1">>,
+                            ID2 => <<"500">>
+                        }
+                    }
+                }
+            }
+        },
+    {ok, State3} = hb_ao:resolve(State2, <<"compute">>, #{}),
+    ?event(debug_test, {resolved_state, State3}),
+    ?assertEqual(<<"1">>, hb_ao:get(<<"balances/", ID1/binary>>, State3, #{})),
+    ?assertEqual(<<"50">>, hb_ao:get(<<"balances/A">>, State3, #{})),
+    ?assertEqual(<<"500">>, hb_ao:get(<<"balances/", ID2/binary>>, State3, #{})).
\ No newline at end of file
diff --git a/src/dev_poda.erl b/src/dev_poda.erl
index 46960f285..ab9ede9fb 100644
--- a/src/dev_poda.erl
+++ b/src/dev_poda.erl
@@ -1,4 +1,5 @@
 %%% @doc A simple exemplar decentralized proof of authority consensus algorithm
+%%% A simple exemplar decentralized proof of authority consensus algorithm
 %%% for AO processes. This device is split into two flows, spanning three
 %%% actions.
 %%% 
@@ -10,7 +11,7 @@
 -module(dev_poda).
 -export([init/2, execute/3]).
 -export([is_user_signed/1]).
--export([push/2]).
+-export([push/3]).
 -include("include/hb.hrl").
 -hb_debug(print).
 
@@ -46,25 +47,27 @@ execute(Outer = #tx { data = #{ <<"body">> := Msg } }, S = #{ <<"pass">> := 1 },
                     ?event({poda_validated, ok}),
                     % Add the validations to the VFS.
                     Comms =
-                        maps:to_list(
+                        hb_maps:to_list(
                             case Msg of 
                                 #tx { data = #{ <<"commitments">> := #tx { data = X } }} -> X;
                                 #tx { data = #{ <<"commitments">> := X }} -> X;
                                 #{ <<"commitments">> := X } -> X
-                            end
+                            end,
+                            Opts
                         ),
                     VFS1 =
                         lists:foldl(
                             fun({_, Commitment}, Acc) ->
                                 Id = ar_bundles:signer(Commitment),
                                 Encoded = hb_util:encode(Id),
-                                maps:put(
+                                hb_maps:put(
                                     <<"/commitments/", Encoded/binary>>,
                                     Commitment#tx.data,
-                                    Acc
+                                    Acc,
+									Opts
                                 )
                             end,
-                            maps:get(vfs, S, #{}),
+                            hb_maps:get(vfs, S, #{}, Opts),
                             Comms
                         ),
                     % Update the arg prefix to include the unwrapped message.
@@ -74,7 +77,7 @@ execute(Outer = #tx { data = #{ <<"body">> := Msg } }, S = #{ <<"pass">> := 1 },
                             % the actual message, then replace `/Message' with it.
                             Outer#tx{
                                 data = (Outer#tx.data)#{
-                                    <<"body">> => maps:get(<<"body">>, Msg#tx.data)
+                                    <<"body">> => hb_maps:get(<<"body">>, Msg#tx.data, Opts)
                                 }
                             }
                         ]
@@ -106,7 +109,7 @@ validate_stage(2, Commitments, Content, Opts) ->
             fun({_, Comm}) ->
                 ar_bundles:verify_item(Comm)
             end,
-            maps:to_list(Commitments)
+            hb_maps:to_list(Commitments, Opts)
         ) of
         true -> validate_stage(3, Content, Commitments, Opts);
         false -> {false, <<"Invalid commitments">>}
@@ -116,7 +119,7 @@ validate_stage(3, Content, Commitments, Opts = #{ <<"quorum">> := Quorum }) ->
     Validations =
         lists:filter(
             fun({_, Comm}) -> validate_commitment(Content, Comm, Opts) end,
-            maps:to_list(Commitments)
+            hb_maps:to_list(Commitments, Opts)
         ),
     ?event({poda_validations, length(Validations)}),
     case length(Validations) >= Quorum of
@@ -129,8 +132,8 @@ validate_stage(3, Content, Commitments, Opts = #{ <<"quorum">> := Quorum }) ->
 validate_commitment(Msg, Comm, Opts) ->
     MsgID = hb_util:encode(ar_bundles:id(Msg, unsigned)),
     AttSigner = hb_util:encode(ar_bundles:signer(Comm)),
-    ?event({poda_commitment, {signer, AttSigner, maps:get(authorities, Opts)}, {msg_id, MsgID}}),
-    ValidSigner = lists:member(AttSigner, maps:get(authorities, Opts)),
+    ?event({poda_commitment, {signer, AttSigner, hb_maps:get(authorities, Opts, undefined, Opts)}, {msg_id, MsgID}}),
+    ValidSigner = lists:member(AttSigner, hb_maps:get(authorities, Opts, undefined, Opts)),
     ValidSignature = ar_bundles:verify_item(Comm),
     RelevantMsg = ar_bundles:id(Comm, unsigned) == MsgID orelse
         (lists:keyfind(<<"commitment-for">>, 1, Comm#tx.tags)
@@ -177,34 +180,36 @@ is_user_signed(_) -> true.
 
 %% @doc Hook used by the MU pathway (currently) to add commitments to an
 %% outbound message if the computation requests it.
-push(_Item, S = #{ <<"results">> := ResultsMsg }) ->
-    NewRes = commit_to_results(ResultsMsg, S),
+push(_Item, S = #{ <<"results">> := ResultsMsg }, Opts) ->
+    NewRes = commit_to_results(ResultsMsg, S, Opts),
     {ok, S#{ <<"results">> => NewRes }}.
 
-commit_to_results(Msg, S) ->
+commit_to_results(Msg, S, Opts) ->
     case is_map(Msg#tx.data) of
         true ->
             % Add commitments to the outbox and spawn items.
-            maps:map(
+            hb_maps:map(
                 fun(Key, IndexMsg) ->
                     ?no_prod("Currently we only commit to the outbox and spawn items."
                         "Make it general?"),
                     case lists:member(Key, [<<"/outbox">>, <<"/spawn">>]) of
                         true ->
                             ?event({poda_starting_to_commit_to_result, Key}),
-                            maps:map(
-                                fun(_, DeepMsg) -> add_commitments(DeepMsg, S) end,
-                                IndexMsg#tx.data
+                            hb_maps:map(
+                                fun(_, DeepMsg) -> add_commitments(DeepMsg, S, Opts) end,
+                                IndexMsg#tx.data,
+								Opts	
                             );
                         false -> IndexMsg
                     end
                 end,
-                Msg#tx.data
+                Msg#tx.data,
+				Opts
             );
         false -> Msg
     end.
 
-add_commitments(NewMsg, S = #{ <<"assignment">> := Assignment, <<"store">> := _Store, <<"logger">> := _Logger, <<"wallet">> := Wallet }) ->
+add_commitments(NewMsg, S = #{ <<"assignment">> := Assignment, <<"store">> := _Store, <<"logger">> := _Logger, <<"wallet">> := Wallet }, Opts) ->
     Process = find_process(NewMsg, S),
     case is_record(Process, tx) andalso lists:member({<<"device">>, <<"PODA">>}, Process#tx.tags) of
         true ->
@@ -217,10 +222,10 @@ add_commitments(NewMsg, S = #{ <<"assignment">> := Assignment, <<"store">> := _S
             ?event({poda_add_commitments_from, InitAuthorities, {self,hb:address()}}),
             Commitments = pfiltermap(
                 fun(Address) ->
-                    case hb_router:find(compute, ar_bundles:id(Process, unsigned), Address) of
+                    case hb_router:find(compute, ar_bundles:id(Process, unsigned), Address, Opts) of
                         {ok, ComputeNode} ->
                             ?event({poda_asking_peer_for_commitment, ComputeNode, <<"commit-to">>, MsgID}),
-                            Res = hb_client:compute(
+                            Res = hb_client:resolve(
                                 ComputeNode,
                                 ar_bundles:id(Process, signed),
                                 ar_bundles:id(Assignment, signed),
@@ -246,7 +251,7 @@ add_commitments(NewMsg, S = #{ <<"assignment">> := Assignment, <<"store">> := _S
                     ar_bundles:normalize(
                         #tx {
                             data = 
-                                maps:from_list(
+                                hb_maps:from_list(
                                     lists:zipwith(
                                         fun(Index, Comm) -> {integer_to_binary(Index), Comm} end,
                                         lists:seq(1, length([LocalCommitment | Commitments])),
@@ -312,7 +317,7 @@ find_process(Item, #{ <<"logger">> := _Logger, <<"store">> := Store }) ->
     case Item#tx.target of
         X when X =/= <<>> ->
             ?event({poda_find_process, hb_util:id(Item#tx.target)}),
-            {ok, Proc} = hb_cache:read_message(Store, hb_util:id(Item#tx.target)),
+            {ok, Proc} = hb_cache:read(Store, hb_util:id(Item#tx.target)),
             Proc;
         _ ->
             case lists:keyfind(<<"type">>, 1, Item#tx.tags) of
diff --git a/src/dev_process.erl b/src/dev_process.erl
index 1799e8a50..a0a720207 100644
--- a/src/dev_process.erl
+++ b/src/dev_process.erl
@@ -47,7 +47,7 @@
 %%%                      assignments, in addition to `/Results'.
 -module(dev_process).
 %%% Public API
--export([info/1, compute/3, schedule/3, slot/3, now/3, push/3, snapshot/3]).
+-export([info/1, as/3, compute/3, schedule/3, slot/3, now/3, push/3, snapshot/3]).
 -export([ensure_process_key/2]).
 %%% Public utilities
 -export([as_process/2, process_id/3]).
@@ -60,8 +60,14 @@
 -include_lib("include/hb.hrl").
 
 %% The frequency at which the process state should be cached. Can be overridden
-%% with the `cache_frequency' option.
--define(DEFAULT_CACHE_FREQ, 1).
+%% with the `process_snapshot_slots' or `process_snapshot_time' options.
+-if(TEST == true).
+-define(DEFAULT_SNAPSHOT_SLOTS, 1).
+-define(DEFAULT_SNAPSHOT_TIME, undefined).
+-else.
+-define(DEFAULT_SNAPSHOT_SLOTS, undefined).
+-define(DEFAULT_SNAPSHOT_TIME, 60).
+-endif.
 
 %% @doc When the info key is called, we should return the process exports.
 info(_Msg1) ->
@@ -69,15 +75,61 @@ info(_Msg1) ->
         worker => fun dev_process_worker:server/3,
         grouper => fun dev_process_worker:group/3,
         await => fun dev_process_worker:await/5,
-        excludes => [
-            <<"test">>,
-            <<"init">>,
-            <<"ping_ping_script">>,
-            <<"schedule_aos_call">>,
-            <<"test_aos_process">>,
-            <<"dev_test_process">>,
-            <<"test_wasm_process">>
-        ]
+        exports =>
+            [
+                <<"info">>,
+                <<"as">>,
+                <<"compute">>,
+                <<"now">>,
+                <<"schedule">>,
+                <<"slot">>,
+                <<"snapshot">>,
+                <<"push">>
+            ]
+    }.
+
+%% @doc Return the process state with the device swapped out for the device
+%% of the given key.
+as(RawMsg1, Msg2, Opts) ->
+    {ok, Msg1} = ensure_loaded(RawMsg1, Msg2, Opts),
+    Key = 
+        hb_ao:get_first(
+            [
+                {{as, <<"message@1.0">>, Msg2}, <<"as">>},
+                {{as, <<"message@1.0">>, Msg2}, <<"as-device">>}
+            ],
+            <<"execution">>,
+            Opts
+        ),
+    {ok,
+        hb_util:deep_merge(
+            ensure_process_key(Msg1, Opts),
+            #{
+                <<"device">> =>
+                    hb_maps:get(
+                        << Key/binary, "-device">>,
+                        Msg1,
+                        default_device(Msg1, Key, Opts),
+                        Opts
+                    ),
+                % Configure input prefix for proper message routing within the
+                % device
+                <<"input-prefix">> =>
+                    case hb_maps:get(<<"input-prefix">>, Msg1, not_found, Opts) of
+                        not_found -> <<"process">>;
+                        Prefix -> Prefix
+                    end,
+                % Configure output prefixes for result organization
+                <<"output-prefixes">> =>
+                    hb_maps:get(
+                        <<Key/binary, "-output-prefixes">>,
+                        Msg1,
+                        undefined, % Undefined in set will be ignored.
+                        Opts
+                    )
+            },
+            Opts
+        )
     }.
 
 %% @doc Returns the default device for a given piece of functionality. Expects
@@ -87,7 +139,7 @@ info(_Msg1) ->
 %% using infrastructure that should not be present on nodes in the future.
 default_device(Msg1, Key, Opts) ->
     NormKey = hb_ao:normalize_key(Key),
-    case {NormKey, hb_ao:get(<<"process/variant">>, {as, dev_message, Msg1}, Opts)} of
+    case {NormKey, hb_util:deep_get(<<"process/variant">>, Msg1, Opts)} of
         {<<"execution">>, <<"ao.TN.1">>} -> <<"genesis-wasm@1.0">>;
         _ -> default_device_index(NormKey)
     end.
@@ -100,7 +152,7 @@ schedule(Msg1, Msg2, Opts) ->
     run_as(<<"scheduler">>, Msg1, Msg2, Opts).
 
 slot(Msg1, Msg2, Opts) ->
-    ?event({slot_called, {msg1, Msg1}, {msg2, Msg2}, {opts, Opts}}),
+    ?event({slot_called, {msg1, Msg1}, {msg2, Msg2}}),
     run_as(<<"scheduler">>, Msg1, Msg2, Opts).
 
 next(Msg1, _Msg2, Opts) ->
@@ -109,7 +161,7 @@ next(Msg1, _Msg2, Opts) ->
 snapshot(RawMsg1, _Msg2, Opts) ->
     Msg1 = ensure_process_key(RawMsg1, Opts),
     {ok, SnapshotMsg} = run_as(
-        <<"Execution">>,
+        <<"execution">>,
         Msg1,
         #{ <<"path">> => <<"snapshot">>, <<"mode">> => <<"Map">> },
         Opts#{
@@ -117,15 +169,11 @@ snapshot(RawMsg1, _Msg2, Opts) ->
             hashpath => ignore
         }
     ),
-    ProcID = hb_message:id(Msg1, all),
-    Slot = hb_ao:get(<<"at-slot">>, Msg1, Opts),
+    ProcID = hb_message:id(Msg1, all, Opts),
+    Slot = hb_ao:get(<<"at-slot">>, {as, <<"message@1.0">>, Msg1}, Opts),
     {ok,
         hb_private:set(
-            hb_ao:set(
-                SnapshotMsg,
-                #{ <<"cache-control">> => [<<"store">>] },
-                Opts
-            ),
+            SnapshotMsg#{ <<"cache-control">> => [<<"store">>] },
             #{ <<"priv/additional-hashpaths">> =>
                     [
                         hb_path:to_binary([ProcID, <<"snapshot">>, Slot])
@@ -141,15 +189,19 @@ process_id(Msg1, Msg2, Opts) ->
         not_found ->
             process_id(ensure_process_key(Msg1, Opts), Msg2, Opts);
         Process ->
-            hb_message:id(Process, all)
+            hb_message:id(
+                Process,
+                hb_util:atom(maps:get(<<"commitments">>, Msg2, <<"all">>)),
+                Opts
+            )
     end.
 
 %% @doc Before computation begins, a boot phase is required. This phase
 %% allows devices on the execution stack to initialize themselves. We set the
 %% `Initialized' key to `True' to indicate that the process has been
 %% initialized.
-init(Msg1, _Msg2, Opts) ->
-    ?event({init_called, {msg1, Msg1}, {opts, Opts}}),
+init(Msg1, Msg2, Opts) ->
+    ?event({init_called, {msg1, Msg1}, {msg2, Msg2}}),
     {ok, Initialized} =
         run_as(<<"execution">>, Msg1, #{ <<"path">> => init }, Opts),
     {
@@ -164,13 +216,30 @@ init(Msg1, _Msg2, Opts) ->
         )
     }.
 
-%% @doc Compute the result of an assignment applied to the process state, if it 
-%% is the next message.
+%% @doc Compute the result of an assignment applied to the process state.
+%% This function serves as the main entry point for compute operations and routes
+%% between two distinct execution paths:
+%% 
+%% - GET method: Normal compute execution that applies messages to process state
+%%   and advances the state permanently. Used for regular process execution.
+%% 
+%% - POST method: Dryrun compute execution that simulates message processing
+%%   without permanently modifying process state. Used for testing message 
+%%   handlers and previewing results. The POST method is the key entry point
+%%   for the dryrun functionality that allows external clients to test
+%%   message processing without side effects.
 compute(Msg1, Msg2, Opts) ->
-    % If we do not have a live state, restore or initialize one.
     ProcBase = ensure_process_key(Msg1, Opts),
     ProcID = process_id(ProcBase, #{}, Opts),
-    case hb_ao:get(<<"slot">>, {as, <<"message@1.0">>, Msg2}, Opts) of
+    TargetSlot =
+        hb_ao:get_first(
+            [
+                {{as, <<"message@1.0">>, Msg2}, <<"compute">>},
+                {{as, <<"message@1.0">>, Msg2}, <<"slot">>}
+            ],
+            Opts
+        ),
+    case TargetSlot of
         not_found ->
             % The slot is not set, so we need to serve the latest known state.
             % We do this by setting the `process_now_from_cache' option to `true'.
@@ -187,7 +256,7 @@ compute(Msg1, Msg2, Opts) ->
                             {result, Result}
                         }
                     ),
-                    {ok, Result};
+                    {ok, without_snapshot(Result, Opts)};
                 not_found ->
                     {ok, Loaded} = ensure_loaded(ProcBase, Msg2, Opts),
                     ?event(compute,
@@ -209,13 +278,20 @@ compute(Msg1, Msg2, Opts) ->
 %% we reach the target slot that the user has requested.
 compute_to_slot(ProcID, Msg1, Msg2, TargetSlot, Opts) ->
     CurrentSlot = hb_ao:get(<<"at-slot">>, Msg1, Opts#{ hashpath => ignore }),
-    ?event(compute, {starting_compute, {current, CurrentSlot}, {target, TargetSlot}}),
+    ?event(compute_short,
+        {starting_compute,
+            {proc_id, ProcID},
+            {current, CurrentSlot},
+            {target, TargetSlot}
+        }
+    ),
     case CurrentSlot of
         CurrentSlot when CurrentSlot > TargetSlot ->
             % The cache should already have the result, so we should never end up
             % here. Depending on the type of process, 'rewinding' may require
             % re-computing from a significantly earlier checkpoint, so for now
             % we throw an error.
+            ?event(compute, {error_already_calculated_slot,  {target, TargetSlot}, {current, CurrentSlot}}),
             throw(
                 {error,
                     {already_calculated_slot,
@@ -225,9 +301,17 @@ compute_to_slot(ProcID, Msg1, Msg2, TargetSlot, Opts) ->
                 }
             );
         CurrentSlot when CurrentSlot == TargetSlot ->
-            % We reached the target height so we return.
+            % We reached the target height so we force a snapshot and return.
             ?event(compute, {reached_target_slot_returning_state, TargetSlot}),
-            {ok, as_process(Msg1, Opts)};
+            store_result(
+                true,
+                ProcID,
+                TargetSlot,
+                Msg1,
+                Msg2,
+                Opts
+            ),
+            {ok, without_snapshot(as_process(Msg1, Opts), Opts)};
         CurrentSlot ->
             % Compute the next state transition.
             NextSlot = CurrentSlot + 1,
@@ -236,6 +320,13 @@ compute_to_slot(ProcID, Msg1, Msg2, TargetSlot, Opts) ->
                 {error, Res} ->
                     % If the scheduler device cannot provide a next message,
                     % we return its error details, along with the current slot.
+                    ?event(compute,
+                        {error_getting_schedule,
+                            {error, Res},
+                            {phase, <<"get-schedule">>},
+                            {attempted_slot, NextSlot}
+                        }
+                    ),
                     {error, Res#{
                         <<"phase">> => <<"get-schedule">>,
                         <<"attempted-slot">> => NextSlot
@@ -261,6 +352,13 @@ compute_to_slot(ProcID, Msg1, Msg2, TargetSlot, Opts) ->
                                     Error;
                                 true -> #{ <<"error">> => Error }
                                 end,
+                            ?event(compute,
+                                {error_computing_slot,
+                                    {error, ErrMsg},
+                                    {phase, <<"compute">>},
+                                    {attempted_slot, NextSlot}
+                                }
+                            ),
                             {error,
                                 ErrMsg#{
                                     <<"phase">> => <<"compute">>,
@@ -278,41 +376,53 @@ compute_slot(ProcID, State, RawInputMsg, ReqMsg, Opts) ->
     NextSlot = hb_util:int(hb_ao:get(<<"slot">>, RawInputMsg, Opts)),
     % If the input message does not have a path, set it to `compute'.
     InputMsg =
-        case hb_path:from_message(request, RawInputMsg) of
+        case hb_path:from_message(request, RawInputMsg, Opts) of
             undefined -> RawInputMsg#{ <<"path">> => <<"compute">> };
             _ -> RawInputMsg
         end,
-    ?event({input_msg, InputMsg}),
+    ?event(compute, {input_msg, InputMsg}),
     ?event(compute, {executing, {proc_id, ProcID}, {slot, NextSlot}}, Opts),
     % Unset the previous results.
     UnsetResults = hb_ao:set(State, #{ <<"results">> => unset }, Opts),
     Res = run_as(<<"execution">>, UnsetResults, InputMsg, Opts),
     case Res of
-        {ok, Msg3} ->
-            ?event(compute_short, {executed, {slot, NextSlot}, {proc_id, ProcID}}, Opts),
+        {ok, NewProcStateMsg} ->
             % We have now transformed slot n -> n + 1. Increment the current slot.
-            Msg3SlotAfter = hb_ao:set(Msg3, #{ <<"at-slot">> => NextSlot }, Opts),
+            NewProcStateMsgWithSlot =
+                hb_ao:set(
+                    NewProcStateMsg,
+                    #{ <<"device">> => <<"process@1.0">>, <<"at-slot">> => NextSlot },
+                    Opts
+                ),
             % Notify any waiters that the result for a slot is now available.
             dev_process_worker:notify_compute(
                 ProcID,
                 NextSlot,
-                {ok, Msg3SlotAfter},
+                {ok, NewProcStateMsgWithSlot},
                 Opts
             ),
-            store_result(ProcID, NextSlot, Msg3SlotAfter, ReqMsg, Opts),
-            {ok, Msg3SlotAfter};
+            ProcStateWithSnapshot =
+                store_result(
+                    false,
+                    ProcID,
+                    NextSlot,
+                    NewProcStateMsgWithSlot,
+                    ReqMsg,
+                    Opts
+                ),
+            {ok, ProcStateWithSnapshot};
         {error, Error} ->
             {error, Error}
     end.
 
 %% @doc Store the resulting state in the cache, potentially with the snapshot
 %% key.
-store_result(ProcID, Slot, Msg3, Msg2, Opts) ->
-    % Cache the `Memory' key every `Cache-Frequency' slots.
-    Freq = hb_opts:get(process_cache_frequency, ?DEFAULT_CACHE_FREQ, Opts),
+store_result(ForceSnapshot, ProcID, Slot, Msg3, Msg2, Opts) ->
+    % Cache the `Snapshot' key as frequently as the node is configured to.
     Msg3MaybeWithSnapshot =
-        case Slot rem Freq of
-            0 ->
+        case ForceSnapshot orelse should_snapshot(Slot, Msg3, Opts) of
+            false -> Msg3;
+            true ->
                 ?event(compute_debug,
                     {snapshotting, {proc_id, ProcID}, {slot, Slot}}, Opts),
                 {ok, Snapshot} = snapshot(Msg3, Msg2, Opts),
@@ -322,11 +432,29 @@ store_result(ProcID, Slot, Msg3, Msg2, Opts) ->
 						{snapshot, Snapshot}
 					}
 				),
-                ?event(compute_debug,
-                    {snapshot_generated, {proc_id, ProcID}, {slot, Slot}}, Opts),
-				Msg3#{ <<"snapshot">> => Snapshot };
-            _ -> 
-                Msg3
+                ?event(snapshot,
+                    {snapshot_generated,
+                        {proc_id, ProcID},
+                        {slot, Slot},
+                        {snapshot, Snapshot}
+                    },
+                    Opts
+                ),
+				WithLastSnapshot =
+                    hb_private:set(
+                        Msg3#{ <<"snapshot">> => Snapshot },
+                        <<"last-snapshot">>,
+                        os:system_time(second),
+                        Opts
+                    ),
+                ?event(debug_interval,
+                    {snapshot_with_last_snapshot,
+                        {proc_id, ProcID},
+                        {slot, Slot},
+                        {snapshot, WithLastSnapshot}
+                    }
+                ),
+                hb_cache:ensure_all_loaded(WithLastSnapshot, Opts)
         end,
     ?event(compute, {caching_result, {proc_id, ProcID}, {slot, Slot}}, Opts),
     Writer = 
@@ -340,6 +468,57 @@ store_result(ProcID, Slot, Msg3, Msg2, Opts) ->
         false ->
             Writer(),
             ?event(compute, {caching_completed, {proc_id, ProcID}, {slot, Slot}}, Opts)
+    end,
+    hb_maps:without([<<"snapshot">>], Msg3MaybeWithSnapshot, Opts).
+
+%% @doc Should we snapshot a new full state result? First, we check if the 
+%% `process_snapshot_time' option is set. If it is, we check if the elapsed time
+%% since the last snapshot is greater than the value. We also check the
+%% `process_snapshot_slots' option. If it is set, we check if the slot is
+%% a multiple of the interval. If either are true, we must snapshot.
+should_snapshot(Slot, Msg3, Opts) ->
+    should_snapshot_slots(Slot, Opts)
+        orelse should_snapshot_time(Msg3, Opts).
+
+%% @doc Calculate if we should snapshot based on the number of slots.
+should_snapshot_slots(Slot, Opts) ->
+    case hb_opts:get(process_snapshot_slots, ?DEFAULT_SNAPSHOT_SLOTS, Opts) of
+        Undef when (Undef == undefined) or (Undef == <<"false">>) ->
+            false;
+        RawSnapshotSlots ->
+            SnapshotSlots = hb_util:int(RawSnapshotSlots),
+            Slot rem SnapshotSlots == 0
+    end.
+
+%% @doc Calculate if we should snapshot based on the elapsed time since the last
+%% snapshot.
+should_snapshot_time(Msg3, Opts) ->
+    case hb_opts:get(process_snapshot_time, ?DEFAULT_SNAPSHOT_TIME, Opts) of
+        Undef when (Undef == undefined) or (Undef == <<"false">>) ->
+            false;
+        RawSecs ->
+            Secs = hb_util:int(RawSecs),
+            case hb_private:get(<<"last-snapshot">>, Msg3, undefined, Opts) of
+                undefined ->
+                    ?event(
+                        debug_interval,
+                        {no_last_snapshot,
+                            {interval, Secs},
+                            {msg, Msg3}
+                        }
+                    ),
+                    true;
+                OldTimestamp ->
+                    ?event(
+                        debug_interval,
+                        {calculating,
+                            {secs, Secs},
+                            {timestamp, OldTimestamp},
+                            {now, os:system_time(second)}
+                        }
+                    ),
+                    os:system_time(second) > OldTimestamp + hb_util:int(Secs)
+            end
     end.
 
 %% @doc Returns the known state of the process at either the current slot, or
@@ -366,7 +545,8 @@ now(RawMsg1, Msg2, Opts) ->
             % than computing it.
             LatestKnown = dev_process_cache:latest(ProcessID, [], Opts),
             case LatestKnown of
-                {ok, LatestSlot, LatestMsg} ->
+                {ok, LatestSlot, RawLatestMsg} ->
+                    LatestMsg = without_snapshot(RawLatestMsg, Opts),
                     ?event(compute_short,
                         {serving_latest_cached_state,
                             {proc_id, ProcessID},
@@ -412,8 +592,8 @@ push(Msg1, Msg2, Opts) ->
 ensure_loaded(Msg1, Msg2, Opts) ->
     % Get the nonce we are currently on and the inbound nonce.
     TargetSlot = hb_ao:get(<<"slot">>, Msg2, undefined, Opts),
-    ProcID = process_id(Msg1, Msg2, Opts),
-    ?event({ensure_loaded, {msg1, Msg1}, {msg2, Msg2}, {opts, Opts}}),
+    ProcID = process_id(Msg1, #{}, Opts),
+    ?event({ensure_loaded, {msg1, Msg1}, {msg2, Msg2}}),
     case hb_ao:get(<<"initialized">>, Msg1, Opts) of
         <<"true">> ->
             ?event(already_initialized),
@@ -424,7 +604,7 @@ ensure_loaded(Msg1, Msg2, Opts) ->
             LoadRes =
                 dev_process_cache:latest(
                     ProcID,
-                    [<<"snapshot">>],
+                    [<<"snapshot+link">>],
                     TargetSlot,
                     Opts
                 ),
@@ -436,27 +616,54 @@ ensure_loaded(Msg1, Msg2, Opts) ->
                 }
             ),
             case LoadRes of
-                {ok, LoadedSlot, SnapshotMsg} ->
+                {ok, MaybeLoadedSlot, MaybeLoadedSnapshotMsg} ->
                     % Restore the devices in the executor stack with the
                     % loaded state. This allows the devices to load any
                     % necessary 'shadow' state (state not represented in
                     % the public component of a message) into memory.
                     % Do not update the hashpath while we do this, and remove
                     % the snapshot key after we have normalized the message.
-                    ?event(compute, {loaded_state_checkpoint, ProcID, LoadedSlot}),
+                    LoadedSnapshotMsg =
+                        hb_cache:ensure_all_loaded(
+                            MaybeLoadedSnapshotMsg,
+                            Opts
+                        ),
+                    Process = hb_maps:get(<<"process">>, LoadedSnapshotMsg, Opts),
+                    #{ <<"commitments">> := HmacCommits} =
+                        hb_message:with_commitments(
+                            #{ <<"type">> => <<"hmac-sha256">>},
+                            Process,
+                            Opts),
+                    #{ <<"commitments">> := SignCommits } =
+                        hb_message:with_commitments(ProcID, Process, Opts),
+                    UpdateProcess = hb_maps:put(
+                        <<"commitments">>,
+                        hb_maps:merge(HmacCommits, SignCommits),
+                        Process,
+                        Opts
+                    ),
+                    LoadedSnapshotMsg2 =
+                        LoadedSnapshotMsg#{
+                            <<"process">> => UpdateProcess,
+                            <<"initialized">> => <<"true">>
+                        },
+                    LoadedSlot = hb_cache:ensure_all_loaded(MaybeLoadedSlot, Opts),
+                    ?event(compute, {found_state_checkpoint, ProcID, LoadedSnapshotMsg2}),
                     {ok, Normalized} =
                         run_as(
                             <<"execution">>,
-                            SnapshotMsg,
+                            LoadedSnapshotMsg2,
                             normalize,
                             Opts#{ hashpath => ignore }
                         ),
-                    NormalizedWithoutSnapshot = maps:remove(<<"snapshot">>, Normalized),
-                    ?event({loaded_state_checkpoint_result,
-                        {proc_id, ProcID},
-                        {slot, LoadedSlot},
-                        {after_normalization, NormalizedWithoutSnapshot}
-                    }),
+                    NormalizedWithoutSnapshot = without_snapshot(Normalized, Opts),
+                    ?event(snapshot,
+                        {loaded_state_checkpoint_result,
+                            {proc_id, ProcID},
+                            {slot, LoadedSlot},
+                            {after_normalization, NormalizedWithoutSnapshot}
+                        }
+                    ),
                     {ok, NormalizedWithoutSnapshot};
                 not_found ->
                     % If we do not have a checkpoint, initialize the
@@ -471,47 +678,65 @@ ensure_loaded(Msg1, Msg2, Opts) ->
             end
     end.
 
+%% @doc Remove the `snapshot' key from a message and return it.
+without_snapshot(Msg, Opts) ->
+    hb_maps:remove(<<"snapshot">>, Msg, Opts).
+
 %% @doc Run a message against Msg1, with the device being swapped out for
 %% the device found at `Key'. After execution, the device is swapped back
 %% to the original device if the device is the same as we left it.
+run_as(Key, Msg1, Path, Opts) when not is_map(Path) ->
+    run_as(Key, Msg1, #{ <<"path">> => Path }, Opts);
 run_as(Key, Msg1, Msg2, Opts) ->
-    BaseDevice = hb_ao:get(<<"device">>, {as, dev_message, Msg1}, Opts),
+    % Store the original device so we can restore it after execution
+    BaseDevice = hb_maps:get(<<"device">>, Msg1, not_found, Opts),
     ?event({running_as, {key, {explicit, Key}}, {req, Msg2}}),
-    {ok, PreparedMsg} =
-        dev_message:set(
+    % Prepare the message with the specialized device configuration.
+    % This sets up the device context for the specific operation type.
+    PreparedMsg =
+        hb_util:deep_merge(
             ensure_process_key(Msg1, Opts),
             #{
                 <<"device">> =>
-                    DeviceSet = hb_ao:get(
-                        << Key/binary, "-device">>,
-                        {as, dev_message, Msg1},
-                        default_device(Msg1, Key, Opts),
-                        Opts
-                    ),
+                    DeviceSet =
+                        hb_maps:get(
+                            << Key/binary, "-device">>,
+                            Msg1,
+                            default_device(Msg1, Key, Opts),
+                            Opts
+                        ),
+                % Configure input prefix for proper message routing within the device
                 <<"input-prefix">> =>
-                    case hb_ao:get(<<"input-prefix">>, Msg1, Opts) of
+                    case hb_maps:get(<<"input-prefix">>, Msg1, not_found, Opts) of
                         not_found -> <<"process">>;
                         Prefix -> Prefix
                     end,
+                % Configure output prefixes for result organization
                 <<"output-prefixes">> =>
-                    hb_ao:get(
+                    hb_maps:get(
                         <<Key/binary, "-output-prefixes">>,
-                        {as, dev_message, Msg1},
+                        Msg1,
                         undefined, % Undefined in set will be ignored.
                         Opts
                     )
             },
             Opts
         ),
+    ?event(debug_prefix,
+        {input_prefix, hb_maps:get(<<"output-prefixes">>, PreparedMsg, not_found, Opts)
+    }),
+    % Execute the message through the specialized device.
     {Status, BaseResult} =
         hb_ao:resolve(
             PreparedMsg,
             Msg2,
             Opts
         ),
+    % Restore the original device context after execution.
+    % This ensures the process maintains its identity after device delegation.
     case {Status, BaseResult} of
         {ok, #{ <<"device">> := DeviceSet }} ->
-            {ok, hb_ao:set(BaseResult, #{ <<"device">> => BaseDevice })};
+            {ok, hb_ao:set(BaseResult, #{ <<"device">> => BaseDevice }, Opts)};
         _ ->
             ?event({returning_base_result, BaseResult}),
             {Status, BaseResult}
@@ -526,16 +751,16 @@ as_process(Msg1, Opts) ->
 
 %% @doc Helper function to store a copy of the `process' key in the message.
 ensure_process_key(Msg1, Opts) ->
-    case hb_ao:get(<<"process">>, Msg1, Opts#{ hashpath => ignore }) of
+    case hb_maps:get(<<"process">>, Msg1, not_found, Opts) of
         not_found ->
             % If the message has lost its signers, we need to re-read it from
             % the cache. This can happen if the message was 'cast' to a different
             % device, leading the signers to be unset.
             ProcessMsg =
-                case hb_message:signers(Msg1) of
+                case hb_message:signers(Msg1, Opts) of
                     [] ->
                         ?event({process_key_not_found_no_signers, {msg1, Msg1}}),
-                        case hb_cache:read(hb_message:id(Msg1, all), Opts) of
+                        case hb_cache:read(hb_message:id(Msg1, all, Opts), Opts) of
                             {ok, Proc} -> Proc;
                             not_found ->
                                 % Fallback to the original message if we cannot
@@ -552,11 +777,19 @@ ensure_process_key(Msg1, Opts) ->
                         Msg1
                 end,
             {ok, Committed} = hb_message:with_only_committed(ProcessMsg, Opts),
-            Res = hb_ao:set(
-                Msg1,
-                #{ <<"process">> => Committed },
-                Opts#{ hashpath => ignore }
+            ?event(
+                {process_key_before_set,
+                    {msg1, Msg1},
+                    {process_msg, {explicit, ProcessMsg}},
+                    {committed, Committed}
+                }
             ),
+            Res =
+                hb_ao:set(
+                    hb_message:uncommitted(Msg1, Opts),
+                    #{ <<"process">> => Committed },
+                    Opts#{ hashpath => ignore }
+                ),
             ?event({set_process_key_res, {msg1, Msg1}, {process_msg, ProcessMsg}, {res, Res}}),
             Res;
         _ -> Msg1
@@ -578,7 +811,7 @@ test_base_process(Opts) ->
     hb_message:commit(#{
         <<"device">> => <<"process@1.0">>,
         <<"scheduler-device">> => <<"scheduler@1.0">>,
-        <<"scheduler-location">> => Address,
+        <<"scheduler-location">> => hb_opts:get(scheduler, Address, Opts),
         <<"type">> => <<"Process">>,
         <<"test-random-seed">> => rand:uniform(1337)
     }, Wallet).
@@ -589,15 +822,16 @@ test_wasm_process(WASMImage, Opts) ->
     Wallet = hb_opts:get(priv_wallet, hb:wallet(), Opts),
     #{ <<"image">> := WASMImageID } = dev_wasm:cache_wasm_image(WASMImage, Opts),
     hb_message:commit(
-        maps:merge(
-            hb_message:uncommitted(test_base_process(Opts)),
+        hb_maps:merge(
+            hb_message:uncommitted(test_base_process(Opts), Opts),
             #{
                 <<"execution-device">> => <<"stack@1.0">>,
-                <<"device-stack">> => [<<"WASM-64@1.0">>],
+                <<"device-stack">> => [<<"wasm-64@1.0">>],
                 <<"image">> => WASMImageID
-            }
+            },
+			Opts
         ),
-        Wallet
+        Opts#{ priv_wallet => Wallet}
     ).
 
 %% @doc Generate a process message with a random number, and the 
@@ -606,18 +840,18 @@ test_aos_process() ->
     test_aos_process(#{}).
 test_aos_process(Opts) ->
     test_aos_process(Opts, [
-        <<"WASI@1.0">>,
-        <<"JSON-Iface@1.0">>,
-        <<"WASM-64@1.0">>,
-        <<"Multipass@1.0">>
+        <<"wasi@1.0">>,
+        <<"json-iface@1.0">>,
+        <<"wasm-64@1.0">>,
+        <<"multipass@1.0">>
     ]).
 test_aos_process(Opts, Stack) ->
     Wallet = hb_opts:get(priv_wallet, hb:wallet(), Opts),
     Address = hb_util:human_id(ar_wallet:to_address(Wallet)),
     WASMProc = test_wasm_process(<<"test/aos-2-pure-xs.wasm">>, Opts),
     hb_message:commit(
-        maps:merge(
-            hb_message:uncommitted(WASMProc),
+        hb_maps:merge(
+            hb_message:uncommitted(WASMProc, Opts),
             #{
                 <<"device-stack">> => Stack,
                 <<"execution-device">> => <<"stack@1.0">>,
@@ -632,10 +866,12 @@ test_aos_process(Opts, Stack) ->
                         <<"snapshot">>,
                         <<"normalize">>
                     ],
-                <<"scheduler">> => Address,
-                <<"authority">> => Address
-            }),
-        Wallet
+                <<"scheduler">> =>
+                    hb_opts:get(scheduler, Address, Opts),
+                <<"authority">> =>
+                    hb_opts:get(authority, Address, Opts)
+            }, Opts),
+        Opts#{ priv_wallet => Wallet}
     ).
 
 %% @doc Generate a device that has a stack of two `dev_test's for 
@@ -644,18 +880,18 @@ test_aos_process(Opts, Stack) ->
 dev_test_process() ->
     Wallet = hb:wallet(),
     hb_message:commit(
-        maps:merge(test_base_process(), #{
+        hb_maps:merge(test_base_process(), #{
             <<"execution-device">> => <<"stack@1.0">>,
             <<"device-stack">> => [<<"test-device@1.0">>, <<"test-device@1.0">>]
-        }),
+        }, #{}),
         Wallet
     ).
 
-schedule_test_message(Msg1, Text) ->
-    schedule_test_message(Msg1, Text, #{}).
-schedule_test_message(Msg1, Text, MsgBase) ->
+schedule_test_message(Msg1, Text, Opts) ->
+    schedule_test_message(Msg1, Text, #{}, Opts).
+schedule_test_message(Msg1, Text, MsgBase, Opts) ->
     Wallet = hb:wallet(),
-    UncommittedBase = hb_message:uncommitted(MsgBase),
+    UncommittedBase = hb_message:uncommitted(MsgBase, Opts),
     Msg2 =
         hb_message:commit(#{
                 <<"path">> => <<"schedule">>,
@@ -666,12 +902,12 @@ schedule_test_message(Msg1, Text, MsgBase) ->
                             <<"type">> => <<"Message">>,
                             <<"test-label">> => Text
                         },
-                        Wallet
+                        Opts#{ priv_wallet => Wallet}
                     )
             },
-            Wallet
+			Opts#{ priv_wallet => Wallet}
         ),
-    {ok, _} = hb_ao:resolve(Msg1, Msg2, #{}).
+    {ok, _} = hb_ao:resolve(Msg1, Msg2, Opts).
 
 schedule_aos_call(Msg1, Code) ->
     schedule_aos_call(Msg1, Code, #{}).
@@ -685,9 +921,9 @@ schedule_aos_call(Msg1, Code, Opts) ->
                 <<"data">> => Code,
                 <<"target">> => ProcID
             },
-            Wallet
+            Opts#{priv_wallet => Wallet}
         ),
-    schedule_test_message(Msg1, <<"TEST MSG">>, Msg2).
+    schedule_test_message(Msg1, <<"TEST MSG">>, Msg2, Opts).
 
 schedule_wasm_call(Msg1, FuncName, Params) ->
     schedule_wasm_call(Msg1, FuncName, Params, #{}).
@@ -703,36 +939,38 @@ schedule_wasm_call(Msg1, FuncName, Params, Opts) ->
                     <<"function">> => FuncName,
                     <<"parameters">> => Params
                 },
-                Wallet
+                Opts#{ priv_wallet => Wallet}
             )
-    }, Wallet),
+    }, Opts#{ priv_wallet => Wallet}),
     ?assertMatch({ok, _}, hb_ao:resolve(Msg1, Msg2, Opts)).
 
-schedule_on_process_test() ->
-    init(),
-    Msg1 = test_aos_process(),
-    schedule_test_message(Msg1, <<"TEST TEXT 1">>),
-    schedule_test_message(Msg1, <<"TEST TEXT 2">>),
-    ?event(messages_scheduled),
-    {ok, SchedulerRes} =
-        hb_ao:resolve(Msg1, #{
-            <<"method">> => <<"GET">>,
-            <<"path">> => <<"schedule">>
-        }, #{}),
-    ?assertMatch(
-        <<"TEST TEXT 1">>,
-        hb_ao:get(<<"assignments/0/body/Test-Label">>, SchedulerRes)
-    ),
-    ?assertMatch(
-        <<"TEST TEXT 2">>,
-        hb_ao:get(<<"assignments/1/body/Test-Label">>, SchedulerRes)
-    ).
+schedule_on_process_test_() ->
+	{timeout, 30, fun()->
+		init(),
+		Msg1 = test_aos_process(),
+		schedule_test_message(Msg1, <<"TEST TEXT 1">>, #{}),
+		schedule_test_message(Msg1, <<"TEST TEXT 2">>, #{}),
+		?event(messages_scheduled),
+		{ok, SchedulerRes} =
+			hb_ao:resolve(Msg1, #{
+				<<"method">> => <<"GET">>,
+				<<"path">> => <<"schedule">>
+			}, #{}),
+		?assertMatch(
+			<<"TEST TEXT 1">>,
+			hb_ao:get(<<"assignments/0/body/test-label">>, SchedulerRes)
+		),
+		?assertMatch(
+			<<"TEST TEXT 2">>,
+			hb_ao:get(<<"assignments/1/body/test-label">>, SchedulerRes)
+		)
+	end}.
 
 get_scheduler_slot_test() ->
     init(),
     Msg1 = test_base_process(),
-    schedule_test_message(Msg1, <<"TEST TEXT 1">>),
-    schedule_test_message(Msg1, <<"TEST TEXT 2">>),
+    schedule_test_message(Msg1, <<"TEST TEXT 1">>, #{}),
+    schedule_test_message(Msg1, <<"TEST TEXT 2">>, #{}),
     Msg2 = #{
         <<"path">> => <<"slot">>,
         <<"method">> => <<"GET">>
@@ -745,7 +983,7 @@ get_scheduler_slot_test() ->
 recursive_path_resolution_test() ->
     init(),
     Msg1 = test_base_process(),
-    schedule_test_message(Msg1, <<"TEST TEXT 1">>),
+    schedule_test_message(Msg1, <<"TEST TEXT 1">>, #{}),
     CurrentSlot =
         hb_ao:resolve(
             Msg1,
@@ -762,8 +1000,8 @@ recursive_path_resolution_test() ->
 test_device_compute_test() ->
     init(),
     Msg1 = dev_test_process(),
-    schedule_test_message(Msg1, <<"TEST TEXT 1">>),
-    schedule_test_message(Msg1, <<"TEST TEXT 2">>),
+    schedule_test_message(Msg1, <<"TEST TEXT 1">>, #{}),
+    schedule_test_message(Msg1, <<"TEST TEXT 2">>, #{}),
     ?assertMatch(
         {ok, <<"TEST TEXT 2">>},
         hb_ao:resolve(
@@ -818,9 +1056,10 @@ http_wasm_process_by_id_test() ->
         port => 10000 + rand:uniform(10000),
         priv_wallet => SchedWallet,
         cache_control => <<"always">>,
+        process_async_cache => false,
         store => #{
             <<"store-module">> => hb_store_fs,
-            <<"prefix">> => <<"cache-mainnet">>
+            <<"name">> => <<"cache-mainnet">>
         }
     }),
     Wallet = ar_wallet:new(),
@@ -882,14 +1121,14 @@ aos_browsable_state_test_() ->
         init(),
         Msg1 = test_aos_process(),
         schedule_aos_call(Msg1,
-            <<"table.insert(ao.outbox.Messages, { Target = ao.id, ",
-                "Action = \"State\", ",
-                "Data = { Deep = 4, Bool = true } })">>
+            <<"table.insert(ao.outbox.Messages, { target = ao.id, ",
+                "action = \"State\", ",
+                "data = { deep = 4, bool = true } })">>
         ),
         Msg2 = #{ <<"path">> => <<"compute">>, <<"slot">> => 0 },
         {ok, Msg3} =
             hb_ao:resolve_many(
-                [Msg1, Msg2, <<"results">>, <<"outbox">>, 1, <<"data">>, <<"Deep">>],
+                [Msg1, Msg2, <<"results">>, <<"outbox">>, 1, <<"data">>, <<"deep">>],
                 #{ cache_control => <<"always">> }
             ),
         ID = hb_message:id(Msg1),
@@ -907,7 +1146,7 @@ aos_state_access_via_http_test_() ->
             cache_control => <<"always">>,
             store => #{
                 <<"store-module">> => hb_store_fs,
-                <<"prefix">> => <<"cache-mainnet">>
+                <<"name">> => <<"cache-mainnet">>
             },
             force_signed_requests => true
         }),
@@ -920,8 +1159,8 @@ aos_state_access_via_http_test_() ->
             <<"type">> => <<"Message">>,
             <<"action">> => <<"Eval">>,
             <<"data">> =>
-                <<"table.insert(ao.outbox.Messages, { Target = ao.id,",
-                    " Action = \"State\", Data = { ",
+                <<"table.insert(ao.outbox.Messages, { target = ao.id,",
+                    " action = \"State\", data = { ",
                         "[\"content-type\"] = \"text/html\", ",
                         "[\"body\"] = \"<h1>Hello, world!</h1>\"",
                     "}})">>,
@@ -960,13 +1199,13 @@ aos_state_patch_test_() ->
         Wallet = hb:wallet(),
         init(),
         Msg1Raw = test_aos_process(#{}, [
-            <<"WASI@1.0">>,
-            <<"JSON-Iface@1.0">>,
-            <<"WASM-64@1.0">>,
+            <<"wasi@1.0">>,
+            <<"json-iface@1.0">>,
+            <<"wasm-64@1.0">>,
             <<"patch@1.0">>,
-            <<"Multipass@1.0">>
+            <<"multipass@1.0">>
         ]),
-        {ok, Msg1} = hb_message:with_only_committed(Msg1Raw),
+        {ok, Msg1} = hb_message:with_only_committed(Msg1Raw, #{}),
         ProcID = hb_message:id(Msg1, all),
         Msg2 = (hb_message:commit(#{
             <<"data-protocol">> => <<"ao">>,
@@ -997,15 +1236,15 @@ do_test_restore() ->
     % 1. Set variables in Lua.
     % 2. Return the variable.
     % Execute the first computation, then the second as a disconnected process.
-    Opts = #{ process_cache_frequency => 1 },
+    Opts = #{ process_cache_frequency => 1, process_async_cache => false },
     init(),
     Store = hb_opts:get(store, no_viable_store, Opts),
     ResetRes = hb_store:reset(Store),
     ?event({reset_store, {result, ResetRes}, {store, Store}}),
-    Msg1 = test_aos_process(),
-    schedule_aos_call(Msg1, <<"X = 42">>),
-    schedule_aos_call(Msg1, <<"X = 1337">>),
-    schedule_aos_call(Msg1, <<"return X">>),
+    Msg1 = test_aos_process(Opts),
+    schedule_aos_call(Msg1, <<"X = 42">>, Opts),
+    schedule_aos_call(Msg1, <<"X = 1337">>, Opts),
+    schedule_aos_call(Msg1, <<"return X">>, Opts),
     % Compute the first message.
     {ok, _} =
         hb_ao:resolve(
@@ -1034,16 +1273,25 @@ now_results_test_() ->
 prior_results_accessible_test_() ->
 	{timeout, 30, fun() ->
 		init(),
+        Opts = #{
+            process_async_cache => false
+        },
 		Msg1 = test_aos_process(),
 		schedule_aos_call(Msg1, <<"return 1+1">>),
 		schedule_aos_call(Msg1, <<"return 2+2">>),
-		?assertEqual({ok, <<"4">>}, hb_ao:resolve(Msg1, <<"now/results/data">>, #{})),
-		?assertMatch({ok, #{ <<"results">> := #{ <<"data">> := <<"4">> } }},
-			hb_ao:resolve(
-				Msg1,
-				#{ <<"path">> => <<"compute">>, <<"slot">> => 1 },
-				#{}
-			)
+		?assertEqual(
+            {ok, <<"4">>},
+            hb_ao:resolve(Msg1, <<"now/results/data">>, Opts)
+        ),
+        {ok, Results} = 
+            hb_ao:resolve(
+                Msg1,
+                #{ <<"path">> => <<"compute">>, <<"slot">> => 1 },
+                Opts
+            ),
+		?assertMatch(
+            #{ <<"results">> := #{ <<"data">> := <<"4">> } },
+            hb_cache:ensure_all_loaded(Results, Opts)
 		)
 	end}.
 
@@ -1093,7 +1341,7 @@ simple_wasm_persistent_worker_benchmark_test() ->
             #{ <<"path">> => <<"compute">>, <<"slot">> => 1 },
             #{ spawn_worker => true, process_workers => true }
         ),
-    Iterations = hb:benchmark(
+    Iterations = hb_test_utils:benchmark(
         fun(Iteration) ->
             schedule_wasm_call(
                 Initialized,
@@ -1112,11 +1360,11 @@ simple_wasm_persistent_worker_benchmark_test() ->
         BenchTime
     ),
     ?event(benchmark, {scheduled, Iterations}),
-    hb_util:eunit_print(
-        "Scheduled and evaluated ~p simple wasm process messages in ~p s (~.2f msg/s)",
-        [Iterations, BenchTime, Iterations / BenchTime]
+    hb_format:eunit_print(
+        "Scheduled and evaluated ~p simple wasm process messages in ~p s (~s msg/s)",
+        [Iterations, BenchTime, hb_util:human_int(Iterations / BenchTime)]
     ),
-    ?assert(Iterations > 2),
+    ?assert(Iterations >= 2),
     ok.
 
 aos_persistent_worker_benchmark_test_() ->
@@ -1133,7 +1381,7 @@ aos_persistent_worker_benchmark_test_() ->
             {ok, _},
             hb_ao:resolve(Msg1, FirstSlotMsg2, #{ spawn_worker => true })
         ),
-        Iterations = hb:benchmark(
+        Iterations = hb_test_utils:benchmark(
             fun(Iteration) ->
                 schedule_aos_call(
                     Msg1,
@@ -1151,9 +1399,9 @@ aos_persistent_worker_benchmark_test_() ->
             BenchTime
         ),
         ?event(benchmark, {scheduled, Iterations}),
-        hb_util:eunit_print(
-            "Scheduled and evaluated ~p AOS process messages in ~p s (~.2f msg/s)",
-            [Iterations, BenchTime, Iterations / BenchTime]
+        hb_format:eunit_print(
+            "Scheduled and evaluated ~p AOS process messages in ~p s (~s msg/s)",
+            [Iterations, BenchTime, hb_util:human_int(Iterations / BenchTime)]
         ),
         ?assert(Iterations >= 2),
         ok
diff --git a/src/dev_process_cache.erl b/src/dev_process_cache.erl
index 129f05d9f..9d2c99f0c 100644
--- a/src/dev_process_cache.erl
+++ b/src/dev_process_cache.erl
@@ -26,10 +26,17 @@ write(ProcID, Slot, Msg, Opts) ->
     MsgIDPath =
         path(
             ProcID,
-            ID = hb_util:human_id(hb_ao:get(id, Msg)),
+            ID = hb_message:id(Msg, uncommitted, Opts),
             Opts
         ),
-    ?event({linking_id, {proc_id, ProcID}, {slot, Slot}, {id, ID}, {path, MsgIDPath}}),
+    ?event(
+        {linking_id,
+            {proc_id, ProcID},
+            {slot, Slot},
+            {id, ID},
+            {path, MsgIDPath}
+        }
+    ),
     hb_cache:link(Root, MsgIDPath, Opts),
     % Return the slot number path.
     {ok, SlotNumPath}.
@@ -60,7 +67,13 @@ latest(ProcID, Opts) -> latest(ProcID, [], Opts).
 latest(ProcID, RequiredPath, Opts) ->
     latest(ProcID, RequiredPath, undefined, Opts).
 latest(ProcID, RawRequiredPath, Limit, Opts) ->
-    ?event({latest_called, {proc_id, ProcID}, {required_path, RawRequiredPath}, {limit, Limit}, {opts, Opts}}),
+    ?event(
+        {latest_called,
+            {proc_id, ProcID},
+            {required_path, RawRequiredPath},
+            {limit, Limit}
+        }
+    ),
     % Convert the required path to a list of _binary_ keys.
     RequiredPath =
         case RawRequiredPath of
@@ -123,7 +136,7 @@ first_with_path(ProcID, RequiredPath, [Slot | Rest], Opts, Store) ->
     ResolvedPath = hb_store:resolve(Store, RawPath),
     ?event({trying_slot, {slot, Slot}, {path, RawPath}, {resolved_path, ResolvedPath}}),
     case hb_store:type(Store, ResolvedPath) of
-        no_viable_store ->
+        not_found ->
             first_with_path(ProcID, RequiredPath, Rest, Opts, Store);
         _ ->
             Slot
@@ -176,7 +189,7 @@ find_latest_outputs(Opts) ->
     ResetRes = hb_store:reset(Store),
     ?event({reset_store, {result, ResetRes}, {store, Store}}),
     Proc1 = dev_process:test_aos_process(),
-    ProcID = hb_util:human_id(hb_ao:get(id, Proc1)),
+    ProcID = hb_util:human_id(hb_ao:get(id, Proc1, Opts)),
     % Create messages for the slots, with only the middle slot having a
     % `/Process' field, while the top slot has a `/Deep/Process' field.
     Msg0 = #{ <<"Results">> => #{ <<"Result-Number">> => 0 } },
diff --git a/src/dev_process_worker.erl b/src/dev_process_worker.erl
index 6452ad3fa..af9184176 100644
--- a/src/dev_process_worker.erl
+++ b/src/dev_process_worker.erl
@@ -64,7 +64,7 @@ server(GroupName, Msg1, Opts) ->
                 hb_ao:resolve(
                     Msg1,
                     #{ <<"path">> => <<"compute">>, <<"slot">> => TargetSlot },
-                    maps:merge(ListenerOpts, ServerOpts)
+                    hb_maps:merge(ListenerOpts, ServerOpts, Opts)
                 ),
             ?event(worker, {work_done, {group, GroupName}, {req, Msg2}, {res, Res}}),
             send_notification(Listener, GroupName, TargetSlot, Res),
@@ -171,8 +171,8 @@ test_init() ->
 info_test() ->
     test_init(),
     M1 = dev_process:test_wasm_process(<<"test/aos-2-pure-xs.wasm">>),
-    Res = hb_ao:info(M1, #{}),
-    ?assertEqual(fun dev_process_worker:group/3, maps:get(grouper, Res)).
+    Res = hb_ao_device:info(M1, #{}),
+    ?assertEqual(fun dev_process_worker:group/3, hb_maps:get(grouper, Res, undefined, #{})).
 
 grouper_test() ->
     test_init(),
diff --git a/src/dev_profile.erl b/src/dev_profile.erl
new file mode 100644
index 000000000..f70e80673
--- /dev/null
+++ b/src/dev_profile.erl
@@ -0,0 +1,372 @@
+%%% @doc A module for running different profiling tools upon HyperBEAM executions.
+%%% This device allows a variety of profiling tools to be used and for their
+%%% outputs to be returned as messages, or displayed locally on the console.
+%%% 
+%%% When called from an AO-Core request, the path at the given key is resolved.
+%%% If the `eval' function is instead directly invoked via Erlang, the first
+%%% argument may be a function to profile instead.
+-module(dev_profile).
+-export([info/1, eval/1, eval/2, eval/3, eval/4]).
+-include_lib("eunit/include/eunit.hrl").
+-include("include/hb.hrl").
+
+%% @doc Default to the `eval' function.
+info(_) ->
+    #{
+        excludes => [<<"keys">>, <<"set">>],
+        default => fun eval/4
+    }.
+
+%% @doc Invoke a profiling tool on a function or an AO-Core resolution. If a 
+%% message is provided as the first argument, a function to profile is produced
+%% from an AO-Core resolution of the path referenced by `path` key. For example,
+%% `/~profile@1.0/run?run=/~meta@1.0/build' will resolve to the `build' function
+%% in the `~meta@1.0' device. The `request` message (if provided) is passed 
+%% downstream to the profiling engine as well as the AO-Core resolution.
+%% 
+%% If the `return-mode' option is not set, we default to `console' for Erlang
+%% invocations. We determine this by checking if the first argument is a
+%% function. This is not possible if the function has been invoked by an
+%% AO-Core resolution.
+%% 
+%% When in `return-mode: console' mode, the return format will be
+%% `{EngineOut, Res}' where `EngineOut' is the output from the engine, and `Res'
+%% is the result of the function or resolution. In `return-mode: message' mode,
+%% the return format will be `{ok, EngineMessage}' where `EngineMessage' is the
+%% output from the engine formatted as an AO-Core message.
+eval(Fun) -> eval(Fun, #{}).
+eval(Fun, Opts) -> eval(Fun, #{}, Opts).
+eval(Fun, Req, Opts) when is_function(Fun) ->
+    do_eval(
+        Fun,
+        case return_mode(Req, Opts, undefined) of
+            undefined -> Req#{ <<"return-mode">> => <<"open">> };
+            _ -> Req
+        end,
+        Opts
+    );
+eval(Base, Request, Opts) ->
+    eval(<<"eval">>, Base, Request, Opts).
+eval(PathKey, Base, Req, Opts) when not is_function(Base) ->
+    case hb_ao:get(PathKey, Req, undefined, Opts) of
+        undefined ->
+            {
+                error,
+                <<
+                    "Path key `",
+                    (hb_util:bin(PathKey))/binary,
+                    "` not found in request."
+                >>
+            };
+        Path ->
+            do_eval(
+                fun() -> hb_ao:resolve(Req#{ <<"path">> => Path }, Opts) end,
+                Req,
+                Opts
+            )
+    end.
+
+do_eval(Fun, Req, Opts) ->
+    % Validate the request and options, then invoke the engine-specific profile
+    % function. We match the user-requested engine against the supported engines
+    % on the node. Each engine takes three arguments:
+    % 1. The function to profile.
+    % 2. The request message containing user-provided options.
+    % 3. The node options.
+    maybe
+        true ?= validate_enabled(Opts),
+        true ?= validate_signer(Req, Opts),
+        true ?= validate_return_mode(Req, Opts),
+        {ok, ProfileEngine} ?= engine(hb_ao:get(<<"engine">>, Req, default, Opts)),
+        ProfileEngine(Fun, Req, Opts)
+    else
+        {unknown_engine, Unknown} ->
+            {error, <<"Unsupported engine `", (hb_util:bin(Unknown))/binary, "`">>};
+        {validation_error, disabled} ->
+            {error, <<"Profiling is disabled.">>};
+        {validation_error, invalid_request} ->
+            {error, <<"Invalid request.">>}
+    end.
+
+%%% Validation helpers:
+
+%% @doc Find the profiling options. The supported options for `profiling' in the
+%% node message are:
+%%  - `true' to enable profiling to allow all requests to be profiled.
+%%  - `false' to disable all profiling.
+%%  - A list of signers whose requests are allowed to be profiled.
+%% If the `profiling' option is not set, check the following other node config
+%% options to determine if profiling should be enabled:
+%%  - Node message key `mode': `prod' => false, others continue;
+%%  - `TEST` build flag: `true' => true, others => false.
+find_profiling_config(Opts) ->
+    case hb_opts:get(profiling, not_found, Opts) of
+        not_found ->
+            case hb_opts:get(mode, prod, Opts) of
+                prod -> false;
+                _ -> hb_features:test()
+            end;
+        EnableProfiling -> EnableProfiling
+    end.
+
+%% @doc Validate that profiling is enabled. 
+%% 
+%% Return the calculated value _only_ if it is false. If it is not, return
+%% true. This allows the `profiling` option to also be used to set a list
+%% of valid signers for profiling requests.
+validate_enabled(Opts) ->
+    case find_profiling_config(Opts) of
+        false -> {validation_error, disabled};
+        _ -> true
+    end.
+
+%% @doc Validate that the request return mode is acceptable. We only allow the
+%% `open' mode if the node is in `debug' mode.
+validate_return_mode(Req, Opts) ->
+    case return_mode(Req, Opts) of
+        <<"open">> -> hb_opts:get(mode, prod, Opts) == debug;
+        _ -> true
+    end.
+
+%% @doc Validate that the request is from a valid signer, if set by the node
+%% operator. If the `profiling' config option is `true', all requests are
+%% allowed. If it is a list, check if the request is from a valid signer.
+validate_signer(Req, Opts) ->
+    case find_profiling_config(Opts) of
+        ValidSigners when is_list(ValidSigners) ->
+            lists:any(
+                fun(Signer) -> lists:member(Signer, ValidSigners) end,
+                hb_message:signers(Req, Opts)
+            );
+        EnableProfiling -> EnableProfiling
+    end orelse {validation_error, invalid_signer}.
+
+%% @doc Return the profiling function for the given engine.
+engine(<<"eflame">>) -> {ok, fun eflame_profile/3};
+engine(<<"eprof">>) -> {ok, fun eprof_profile/3};
+engine(<<"event">>) -> {ok, fun event_profile/3};
+engine(default) -> {ok, default()};
+engine(Unknown) -> {unknown_engine, Unknown}.
+
+%% @doc Return the default profiling engine to use. `eflame' if preferred if
+%% available, falling back to `eprof' if not.
+default() ->
+    case hb_features:eflame() of
+        true -> fun eflame_profile/3;
+        false -> fun eprof_profile/3
+    end.
+
+%%% Profiling engines.
+
+-ifdef(ENABLE_EFLAME).
+%% @doc Profile a function using the `eflame' tool. This tool is only available
+%% if HyperBEAM was built with the `eflame' feature (`rebar3 as eflame ...').
+%% If the return mode is `open` and the `profiler_allow_open` option is `true`,
+%% we open the flame graph. The command to open the graph is specified by the
+%% `profiler_open_cmd' node option, or `open' if not set. A delay of 500ms is
+%% added to allow the file to be opened before it is cleaned up. This delay can
+%% be configured by the `profiler_open_delay' node option, or 500ms if not set.
+eflame_profile(Fun, Req, Opts) ->
+    File = temp_file(),
+    Res = eflame:apply(normal, File, Fun, []),
+    MergeStacks = hb_maps:get(<<"mode">>, Req, <<"merge">>, Opts),
+    EflameDir = code:lib_dir(eflame),
+    % Get the name of the function to profile. If the path in the request is
+    % set, attempt to find it. If that is not found, we use the bare path.
+    % This follows the semantics of the request evaluation scheme, in which the
+    % user's provided path is a pointer to the actual path to resolve. If the
+    % path is not set, we use Erlang's short string encoding of the function.
+    Name =
+        case hb_maps:get(<<"path">>, Req, undefined, Opts) of
+            undefined ->
+                hb_escape:encode(hb_util:bin(io_lib:format("~p", [Fun])));
+            Path ->
+                hb_escape:encode_ampersand(
+                    hb_escape:encode_quotes(
+                        hb_maps:get(Path, Req, Path, Opts)
+                    )
+                )
+        end,
+    StackToFlameScript = hb_util:bin(filename:join(EflameDir, "flamegraph.pl")),
+    FlameArg =
+        case MergeStacks of
+            <<"merge">> -> <<"">>;
+            <<"time">> -> <<"--flamechart">>
+        end,
+    PreparedCommand = 
+        hb_util:list(
+            <<
+                "cat ", (hb_util:bin(File))/binary,
+                " | uniq -c | awk '{print $2, \" \", $1}' | ",
+                StackToFlameScript/binary, " ", FlameArg/binary,
+                " --title=\"", Name/binary, "\" 2>/dev/null"
+            >>
+        ),
+    Flame = hb_util:bin(os:cmd(PreparedCommand)),
+    ?event(debug_profile,
+        {flame_graph,
+            {name, Name},
+            {command, PreparedCommand},
+            {flame, Flame}
+        }
+    ),
+    file:delete(File),
+    case return_mode(Req, Opts) of
+        <<"open">> ->
+            % We cannot return a text version of the flame graph, so we open it
+            % on the local machine.
+            file:write_file(
+                SVG = filename:absname(temp_file(<<"svg">>)),
+                Flame
+            ),
+            ?event(debug_profile, {svg, SVG}),
+            case hb_opts:get(profiler_allow_open, true, Opts) of
+                true ->
+                    OpenCmd = hb_opts:get(profiler_open_cmd, "open", Opts),
+                    CmdRes = os:cmd(OpenCmd ++ " " ++ hb_util:list(SVG)),
+                    timer:sleep(hb_opts:get(profiler_open_delay, 500, Opts)),
+                    ?event(debug_profile, {open_command_result, CmdRes}),
+                    file:delete(SVG),
+                    {ok, Res};
+                _ ->
+                    {SVG, Res}
+            end;
+        <<"message">> ->
+            % We can return the flame graph as an SVG image suitable for output
+            % to a browser.
+            {ok,
+                #{
+                    <<"content-type">> => <<"image/svg+xml">>,
+                    <<"body">> => Flame
+                }
+            }
+    end.
+-else.
+eflame_profile(_Fun, _Req, _Opts) ->
+    {error, <<"eflame is not enabled.">>}.
+-endif.
+
+%% @doc Profile a function using the `eprof' tool.
+eprof_profile(Fun, Req, Opts) ->
+    File = temp_file(),
+    % Attempt to profile the function, stopping the profiler afterwards.
+    Res =
+        try 
+            eprof:start(),
+            eprof:start_profiling([self()]),
+            Fun()
+        catch
+            _:_ -> {error, <<"Execution of function to profile failed.">>}
+        after eprof:stop_profiling()
+        end,
+    % If we are writing to the console we do not need to write and read the
+    % file.
+    case return_mode(Req, Opts) of
+        <<"message">> -> eprof:log(File);
+        _ -> do_nothing
+    end,
+    eprof:analyze(total),
+    eprof:stop(),
+    case return_mode(Req, Opts) of
+        <<"message">> ->
+            {ok, Log} = file:read_file(File),
+            file:delete(File),
+            {
+                ok,
+                #{
+                    <<"content-type">> => <<"text/plain">>,
+                    <<"body">> => Log
+                }
+            };
+        _ ->
+            Res
+    end.
+
+%% @doc Profile using HyperBEAM's events.
+event_profile(Fun, Req, Opts) ->
+    Start = hb_event:counters(),
+    Res = Fun(),
+    End = hb_event:counters(),
+    Diff = hb_message:diff(Start, End, Opts),
+    case return_mode(Req, Opts) of
+        <<"message">> ->
+            {ok, Diff};
+        _ ->
+            hb_format:print(Diff),
+            Res
+    end.
+
+%%% Engine helpers: Generalized tools useful for multiple engines.
+
+%% @doc Get the return mode of a profiler run. The run mode is set to `console'
+%% by the default handler if the profiler is called from Erlang, and `message'
+%% if the profiler is called from AO-Core.
+return_mode(Req, Opts) ->
+    return_mode(Req, Opts, <<"message">>).
+return_mode(Req, Opts, Default) ->
+    hb_ao:get(<<"return-mode">>, Req, Default, Opts).
+
+%% @doc Returns a temporary filename for use in a profiling run.
+temp_file() -> temp_file(<<"out">>).
+temp_file(Ext) ->
+    <<
+        "profile-",
+        (integer_to_binary(os:system_time(microsecond)))/binary,
+        ".",
+        Ext/binary
+    >>.
+
+%%% Tests.
+
+eprof_fun_test() -> test_engine(function, <<"eprof">>).
+eprof_resolution_test() -> test_engine(resolution, <<"eprof">>).
+
+-ifdef(ENABLE_EFLAME).
+eflame_fun_test() -> test_engine(function, <<"eflame">>).
+eflame_resolution_test() -> test_engine(resolution, <<"eflame">>).
+-endif.
+
+%%% Test utilities.
+
+%% @doc Run a test and validate the output for a given engine.
+test_engine(Type, Engine) ->
+    validate_profiler_output(Engine, test_profiler_exec(Type, Engine)).
+
+%% @doc Invoke an engine in either a function (as called from Erlang) or
+%% resolution context. We get the build information from the node in order to
+%% simulate some basic compute that is performant.
+test_profiler_exec(function, Engine) ->
+    eval(
+        fun() -> dev_meta:build(#{}, #{}, #{}) end,
+        #{ <<"engine">> => Engine, <<"return-mode">> => <<"message">> },
+        #{}
+    );
+test_profiler_exec(resolution, Engine) ->
+    hb_ao:resolve(
+        #{
+            <<"path">> => <<"/~profile@1.0/run?run=/~meta@1.0/build">>,
+            <<"engine">> => Engine, <<"return-mode">> => <<"message">> },
+        #{}
+    ).
+
+%% @doc Verify the expected type of output from a profiler.
+validate_profiler_output(<<"eprof">>, Res) ->
+    ?assertMatch(
+        {ok,
+            #{
+                <<"content-type">> := <<"text/plain">>,
+                <<"body">> := Body
+            }
+        } when byte_size(Body) > 100,
+        Res
+    );
+validate_profiler_output(<<"eflame">>, Res) ->
+    ?assertMatch(
+        {ok,
+            #{
+                <<"content-type">> := <<"image/svg+xml">>,
+                <<"body">> := Body
+            }
+        } when byte_size(Body) > 100,
+        Res
+    ).
\ No newline at end of file
diff --git a/src/dev_push.erl b/src/dev_push.erl
index c555eefe9..df12229d2 100644
--- a/src/dev_push.erl
+++ b/src/dev_push.erl
@@ -27,23 +27,23 @@ push(Base, Req, Opts) ->
             case schedule_initial_message(Process, Req, Opts) of
                 {ok, Assignment} ->
                     case find_type(hb_ao:get(<<"body">>, Assignment, Opts), Opts) of
-                        <<"Message">> ->
+                        <<"Process">> ->
                             ?event(push,
-                                {pushing_message,
+                                {initializing_process,
                                     {base, Process},
-                                    {assignment, Assignment}
-                                },
+                                    {assignment, Assignment}},
                                 Opts
                             ),
-                            push_with_mode(Process, Assignment, Opts);
-                        <<"Process">> ->
+                            {ok, Assignment};
+                        _ ->
                             ?event(push,
-                                {initializing_process,
+                                {pushing_message,
                                     {base, Process},
-                                    {assignment, Assignment}},
+                                    {assignment, Assignment}
+                                },
                                 Opts
                             ),
-                            {ok, Assignment}
+                            push_with_mode(Process, Assignment, Opts)
                     end;
                 {error, Res} -> {error, Res}
             end;
@@ -72,15 +72,30 @@ is_async(Process, Req, Opts) ->
     ).
 
 %% @doc Push a message or slot number, including its downstream results.
-do_push(Process, Assignment, Opts) ->
+do_push(PrimaryProcess, Assignment, Opts) ->
     Slot = hb_ao:get(<<"slot">>, Assignment, Opts),
-    ID = dev_process:process_id(Process, #{}, Opts),
-    ?event(push, {push_computing_outbox, {process_id, ID}, {slot, Slot}}),
-    {Status, Result} = hb_ao:resolve(
-        {as, <<"process@1.0">>, Process},
-        #{ <<"path">> => <<"compute/results">>, <<"slot">> => Slot },
-        Opts#{ hashpath => ignore }
+    ID = dev_process:process_id(PrimaryProcess, #{}, Opts),
+    UncommittedID =
+        dev_process:process_id(
+            PrimaryProcess,
+            #{ <<"commitments">> => <<"none">> },
+            Opts
+        ),
+    BaseID = calculate_base_id(PrimaryProcess, Opts),
+    ?event(debug,
+        {push_computing_outbox,
+            {process_id, ID},
+            {base_id, BaseID},
+            {slot, Slot}
+        }
     ),
+    ?event(push, {push_computing_outbox, {process_id, ID}, {slot, Slot}}),
+    {Status, Result} =
+        hb_ao:resolve(
+            {as, <<"process@1.0">>, PrimaryProcess},
+            #{ <<"path">> => <<"compute/results">>, <<"slot">> => Slot },
+            Opts#{ hashpath => ignore }
+        ),
     % Determine if we should include the full compute result in our response.
     IncludeDepth = hb_ao:get(<<"result-depth">>, Assignment, 1, Opts),
     AdditionalRes =
@@ -90,6 +105,18 @@ do_push(Process, Assignment, Opts) ->
         end,
     ?event(push_depth, {depth, IncludeDepth, {assignment, Assignment}}),
     ?event(push, {push_computed, {process, ID}, {slot, Slot}}),
+    ?event(debug,
+        {push_computed,
+            {status, Status},
+            {assignment, Assignment},
+            {request, hb_maps:get(<<"body">>, Assignment, Assignment, Opts)},
+            {result,
+                if is_list(Result) ->
+                    hb_ao:normalize_keys(Result);
+                true -> Result
+                end
+            }
+        }),
     case {Status, hb_ao:get(<<"outbox">>, Result, #{}, Opts)} of
         {ok, NoResults} when ?IS_EMPTY_MESSAGE(NoResults) ->
             ?event(push_short, {done, {process, {string, ID}}, {slot, Slot}}),
@@ -97,18 +124,45 @@ do_push(Process, Assignment, Opts) ->
         {ok, Outbox} ->
             ?event(push, {push_found_outbox, {outbox, Outbox}}),
             Downstream =
-                maps:map(
-                    fun(Key, MsgToPush = #{ <<"target">> := Target }) ->
+                hb_maps:map(
+                    fun(Key, RawMsgToPush = #{ <<"target">> := Target }) ->
+                        MsgToPush =
+                            case maybe_evaluate_message(RawMsgToPush, Opts) of
+                                {ok, R} -> R;
+                                Err ->
+                                    #{
+                                        <<"resolve">> => <<"error">>,
+                                        <<"target">> => ID,
+                                        <<"status">> => 400,
+                                        <<"outbox-index">> => Key,
+                                        <<"reason">> => Err,
+                                        <<"source">> => RawMsgToPush
+                                    }
+                            end,
                         case hb_cache:read(Target, Opts) of
-                            {ok, PushBase} ->
+                            {ok, DownstreamProcess} ->
                                 push_result_message(
-                                    PushBase,
+                                    DownstreamProcess,
                                     MsgToPush,
                                     #{
                                         <<"process">> => ID,
                                         <<"slot">> => Slot,
                                         <<"outbox-key">> => Key,
-                                        <<"result-depth">> => IncludeDepth
+                                        <<"result-depth">> => IncludeDepth,
+                                        <<"from-base">> => BaseID,
+                                        <<"from-uncommitted">> => UncommittedID,
+                                        <<"from-scheduler">> =>
+                                            hb_ao:get(
+                                                <<"scheduler">>,
+                                                PrimaryProcess,
+                                                Opts
+                                            ),
+                                        <<"from-authority">> =>
+                                            hb_ao:get(
+                                                <<"authority">>,
+                                                PrimaryProcess,
+                                                Opts
+                                            )
                                     },
                                     Opts
                                 );
@@ -124,13 +178,18 @@ do_push(Process, Assignment, Opts) ->
                        (Key, Msg) ->
                             #{
                                 <<"response">> => <<"error">>,
-                                <<"status">> => 422,
+                                <<"status">> => 404,
                                 <<"outbox-index">> => Key,
-                                <<"reason">> => <<"No target process found.">>,
+                                <<"reason">> =>
+                                    <<"Target process not available.">>,
                                 <<"message">> => Msg
                             }
                     end,
-                    hb_ao:normalize_keys(Outbox)
+                    hb_util:lower_case_key_map(
+                        hb_ao:normalize_keys(hb_private:reset(Outbox)),
+                        Opts
+                    ),
+                    Opts
                 ),
             {ok, maps:merge(Downstream, AdditionalRes#{
                 <<"slot">> => Slot,
@@ -141,12 +200,47 @@ do_push(Process, Assignment, Opts) ->
             {error, Error}
     end.
 
+
+%% @doc If the outbox message has a path we interpret it as a request to perform
+%% AO-Core eval and schedule the result. Additionally, we  remove the `target` 
+%% from the base message before execution and re-add it to the result, such that
+%% the target to schedule the execution result upon is not confused with
+%% functional components of the evaluation.
+maybe_evaluate_message(Message, Opts) ->
+    case hb_ao:get(<<"resolve">>, Message, Opts) of
+        not_found -> 
+            {ok, Message};
+        ResolvePath ->
+            ReqMsg =
+                maps:without(
+                    [<<"target">>],
+                    Message
+                ),
+            ResolveOpts = Opts#{ force_message => true },
+            case hb_ao:resolve(ReqMsg#{ <<"path">> => ResolvePath }, ResolveOpts) of
+                {ok, EvalRes} ->
+                    {
+                        ok,
+                        EvalRes#{
+                            <<"target">> =>
+                                hb_ao:get(
+                                    <<"target">>,
+                                    Message,
+                                    Opts
+                                )
+                        }
+                    };
+                Err -> Err
+            end
+    end.
+
 %% @doc Push a downstream message result. The `Origin' map contains information
 %% about the origin of the message: The process that originated the message,
 %% the slot number from which it was sent, and the outbox key of the message,
 %% and the depth to which downstream results should be included in the message.
 push_result_message(TargetProcess, MsgToPush, Origin, Opts) ->
-    case hb_ao:get(<<"target">>, MsgToPush, undefined, Opts) of
+    NormMsgToPush = hb_util:lower_case_key_map(MsgToPush, Opts),
+    case hb_ao:get(<<"target">>, NormMsgToPush, undefined, Opts) of
         undefined ->
             ?event(push,
                 {skip_no_target, {msg, MsgToPush}, {origin, Origin}},
@@ -178,10 +272,10 @@ push_result_message(TargetProcess, MsgToPush, Origin, Opts) ->
                     ),
                     {ok, TargetBase} = hb_cache:read(TargetID, Opts),
                     TargetAsProcess = dev_process:ensure_process_key(TargetBase, Opts),
-                    RecvdID = hb_message:id(TargetBase, all),
+                    RecvdID = hb_message:id(TargetBase, all, Opts),
                     ?event(push, {recvd_id, {id, RecvdID}, {msg, TargetAsProcess}}),
                     % Push the message downstream. We decrease the result-depth.
-                    Resurse =
+                    Recurse =
                         hb_ao:resolve(
                             {as, <<"process@1.0">>, TargetAsProcess},
                             #{
@@ -197,7 +291,7 @@ push_result_message(TargetProcess, MsgToPush, Origin, Opts) ->
                             },
                             Opts#{ cache_control => <<"always">> }
                         ),
-                    case Resurse of
+                    case Recurse of
                         {ok, Downstream} ->
                             #{
                                 <<"id">> => PushedMsgID,
@@ -255,6 +349,24 @@ split_target(RawTarget) ->
         _ -> {RawTarget, <<>>}
     end.
 
+%% @doc Calculate the base ID for a process. The base ID is not just the 
+%% uncommitted process ID. It also excludes the `authority' and `scheduler'
+%% keys.
+calculate_base_id(GivenProcess, Opts) ->
+    Process =
+        case hb_ao:get(<<"process">>, GivenProcess, Opts#{ hashpath => ignore }) of
+            not_found -> GivenProcess;
+            Proc -> Proc
+        end,
+    BaseProcess = maps:without([<<"authority">>, <<"scheduler">>], Process),
+    {ok, BaseID} = hb_ao:resolve(
+        BaseProcess,
+        #{ <<"path">> => <<"id">> },
+        Opts
+    ),
+    ?event({push_generated_base, {id, BaseID}, {base, BaseProcess}}),
+    BaseID.
+
 %% @doc Add the necessary keys to the message to be scheduled, then schedule it.
 %% If the remote scheduler does not support the given codec, it will be
 %% downgraded and re-signed.
@@ -272,29 +384,38 @@ schedule_result(TargetProcess, MsgToPush, Codec, Origin, Opts) ->
         },
         Opts
     ),
-    SignedReq =
-        #{
-            <<"method">> => <<"POST">>,
-            <<"path">> => <<"schedule">>,
-            <<"body">> =>
-                SignedMsg = hb_message:commit(
-                    additional_keys(Origin, MsgToPush, Opts),
-                    Opts,
-                    Codec
-                )
-        },
-    ?event(
+    AugmentedMsg = augment_message(Origin, MsgToPush, Opts),
+    ?event(push, {prepared_msg, {msg, AugmentedMsg}}, Opts),
+    % Load the `accept-id`'d wallet into the `Opts` map, if requested.
+    SignedMsg = apply_security(AugmentedMsg, TargetProcess, Codec, Opts),
+    ScheduleReq = #{
+        <<"path">> => <<"schedule">>,
+        <<"method">> => <<"POST">>,
+        <<"body">> => SignedMsg
+    },
+    ?event(push, {schedule_req, {req, ScheduleReq}}, Opts),
+    ?event(debug,
         {push_scheduling_result,
-            {signed_req, SignedReq},
-            {verifies, hb_message:verify(SignedMsg, signers)}
+            {signed_req, SignedMsg},
+            {verifies, hb_message:verify(SignedMsg, signers, Opts)}
         }
     ),
     {ErlStatus, Res} =
-        hb_ao:resolve(
-            {as, <<"process@1.0">>, TargetProcess},
-            SignedReq,
-            Opts#{ cache_control => <<"always">> }
-        ),
+        case hb_message:signers(SignedMsg, Opts) of
+            [] ->
+                {error,
+                    <<
+                        "Application of security policy failed: ",
+                        "No identities matching authority were found."
+                    >>
+                };
+            _Committers ->
+                hb_ao:resolve(
+                    {as, <<"process@1.0">>, TargetProcess},
+                    ScheduleReq,
+                    Opts#{ cache_control => <<"always">> }
+                )
+        end,
     ?event(push, {push_sched_result, {status, ErlStatus}, {response, Res}}, Opts),
     case {ErlStatus, hb_ao:get(<<"status">>, Res, 200, Opts)} of
         {ok, 200} ->
@@ -333,19 +454,123 @@ schedule_result(TargetProcess, MsgToPush, Codec, Origin, Opts) ->
 
 %% @doc Set the necessary keys in order for the recipient to know where the
 %% message came from.
-additional_keys(Origin, ToSched, Opts) ->
+augment_message(Origin, ToSched, Opts) ->
     ?event(push, {adding_keys, {origin, Origin}, {to, ToSched}}, Opts),
-    hb_ao:set(
-        ToSched,
-        #{
-            <<"data-protocol">> => <<"ao">>,
-            <<"variant">> => <<"ao.N.1">>,
-            <<"type">> => <<"Message">>,
-            <<"from-process">> => maps:get(<<"process">>, Origin)
-        },
-        Opts#{ hashpath => ignore }
+    hb_message:uncommitted(
+        hb_ao:set(
+            ToSched,
+            #{
+                <<"data-protocol">> => <<"ao">>,
+                <<"variant">> => <<"ao.N.1">>,
+                <<"type">> => <<"Message">>,
+                <<"from-process">> => maps:get(<<"process">>, Origin),
+                <<"from-uncommitted">> => maps:get(<<"from-uncommitted">>, Origin),
+                <<"from-base">> => maps:get(<<"from-base">>, Origin),
+                <<"from-scheduler">> => maps:get(<<"from-scheduler">>, Origin),
+                <<"from-authority">> => maps:get(<<"from-authority">>, Origin)
+            },
+            Opts#{ hashpath => ignore }
+        )
+    ).
+
+%% @doc Apply the recipient's security policy to the message. Observes the 
+%% following parameters in order to calculate the appropriate security policy:
+%% - `policy': A message that generates a security policy message.
+%% - `authority': A single committer, or list of comma separated committers.
+%% - (Default: Signs with default wallet)
+apply_security(Msg, TargetProcess, Codec, Opts) ->
+    apply_security(policy, Msg, TargetProcess, Codec, Opts).
+apply_security(policy, Msg, TargetProcess, Codec, Opts) ->
+    case hb_ao:get(<<"policy">>, TargetProcess, not_found, Opts) of
+        not_found -> apply_security(authority, Msg, TargetProcess, Codec, Opts);
+        Policy ->
+            case hb_ao:resolve(Policy, Opts) of
+                {ok, PolicyOpts} ->
+                    case hb_ao:get(<<"accept-committers">>, PolicyOpts, Opts) of
+                        not_found ->
+                            apply_security(
+                                authority,
+                                Msg,
+                                TargetProcess,
+                                Codec,
+                                Opts
+                            );
+                        Committers ->
+                            commit_result(Msg, Committers, Codec, Opts)
+                    end;
+                {error, Error} ->
+                    ?event(push, {policy_error, {error, Error}}, Opts),
+                    apply_security(authority, Msg, TargetProcess, Codec, Opts)
+            end
+    end;
+apply_security(authority, Msg, TargetProcess, Codec, Opts) ->
+    case hb_ao:get(<<"authority">>, TargetProcess, Opts) of
+        not_found -> apply_security(default, Msg, TargetProcess, Codec, Opts);
+    	Authorities when is_list(Authorities) ->
+            % The `authority` key has already been parsed into a list of
+            % committers. Sign with all local valid keys.
+            commit_result(Msg, Authorities, Codec, Opts);
+        Authority ->
+            % Parse the authority string into a list of committers. Sign with
+            % all local valid keys.
+            ?event(push, {found_authority, {authority, Authority}}, Opts),
+            commit_result(
+                Msg,
+                hb_util:binary_to_strings(Authority),
+                Codec,
+                Opts
+            )
+    end;
+apply_security(default, Msg, TargetProcess, Codec, Opts) ->
+    ?event(push, {default_policy, {target, TargetProcess}}, Opts),
+    commit_result(
+        Msg,
+        [hb_util:human_id(hb_opts:get(priv_wallet, no_viable_wallet, Opts))],
+        Codec,
+        Opts
     ).
 
+% @doc Attempt to sign a result message with the given committers.
+commit_result(Msg, [], Codec, Opts) ->
+    case hb_opts:get(push_always_sign, true, Opts) of
+        true -> hb_message:commit(hb_message:uncommitted(Msg), Opts, Codec);
+        false -> Msg
+    end;
+commit_result(Msg, Committers, Codec, Opts) ->
+    Signed = lists:foldl(
+        fun(Committer, Acc) ->
+            case hb_opts:as(Committer, Opts) of
+                {ok, CommitterOpts} ->
+                    ?event(debug_commit, {signing_with_identity, Committer}),
+                    hb_message:commit(Acc, CommitterOpts, Codec);
+                {error, not_found} ->
+                    ?event(debug_commit, desired_signer_not_available_on_node),
+                    ?event(push,
+                        {policy_warning,
+                            {
+                                unknown_committer,
+                                Committer
+                            }
+                        },
+                        Opts
+                    ),
+                    Acc
+            end
+        end,
+        hb_message:uncommitted(Msg),
+        Committers
+    ),
+    ?event(debug_commit,
+        {signed_message_as, {explicit, hb_message:signers(Signed, Opts)}}
+    ),
+    case hb_message:signers(Signed, Opts) of
+        [] ->
+            ?event(debug_commit, signing_with_default_identity),
+            commit_result(Msg, [], Codec, Opts);
+        _FoundSigners ->
+            Signed
+    end.
+
 %% @doc Push a message or a process, prior to pushing the resulting slot number.
 schedule_initial_message(Base, Req, Opts) ->
     ModReq = Req#{ <<"path">> => <<"schedule">>, <<"method">> => <<"POST">> },
@@ -368,7 +593,7 @@ schedule_initial_message(Base, Req, Opts) ->
 
 remote_schedule_result(Location, SignedReq, Opts) ->
     ?event(push, {remote_schedule_result, {location, Location}, {req, SignedReq}}, Opts),
-    {Node, RedirectPath} = parse_redirect(Location),
+    {Node, RedirectPath} = parse_redirect(Location, Opts),
     Path =
         case find_type(SignedReq, Opts) of
             <<"Process">> -> <<"/schedule">>;
@@ -377,7 +602,7 @@ remote_schedule_result(Location, SignedReq, Opts) ->
     % Store a copy of the message for ourselves.
     {ok, _} = hb_cache:write(SignedReq, Opts),
     ?event(push, {remote_schedule_result, {path, Path}}, Opts),
-    case hb_http:post(Node, Path, maps:without([<<"path">>], SignedReq), Opts) of
+    case hb_http:post(Node, Path, hb_maps:without([<<"path">>], SignedReq, Opts), Opts) of
         {ok, Res} ->
             ?event(push, {remote_schedule_result, {res, Res}}, Opts),
             case hb_ao:get(<<"status">>, Res, 200, Opts) of
@@ -399,15 +624,15 @@ find_type(Req, Opts) ->
         Opts
     ).
 
-parse_redirect(Location) ->
+parse_redirect(Location, Opts) ->
     Parsed = uri_string:parse(Location),
     Node =
         uri_string:recompose(
-            (maps:remove(query, Parsed))#{
+            (hb_maps:remove(query, Parsed, Opts))#{
                 path => <<"/schedule">>
             }
         ),
-    {Node, maps:get(path, Parsed)}.
+    {Node, hb_maps:get(path, Parsed, undefined, Opts)}.
 
 %%% Tests
 
@@ -415,19 +640,73 @@ full_push_test_() ->
     {timeout, 30, fun() ->
         dev_process:init(),
         Opts = #{
+            process_async_cache => false,
             priv_wallet => hb:wallet(),
+            cache_control => <<"always">>
+        },
+        Msg1 = dev_process:test_aos_process(Opts),
+        hb_cache:write(Msg1, Opts),
+        {ok, SchedInit} =
+            hb_ao:resolve(Msg1, #{
+                <<"method">> => <<"POST">>,
+                <<"path">> => <<"schedule">>,
+                <<"body">> => Msg1
+            },
+            Opts
+        ),
+        ?event({test_setup, {msg1, Msg1}, {sched_init, SchedInit}}),
+        Script = ping_pong_script(2),
+        ?event({script, Script}),
+        {ok, Msg2} = dev_process:schedule_aos_call(Msg1, Script, Opts),
+        ?event({msg_sched_result, Msg2}),
+        {ok, StartingMsgSlot} =
+            hb_ao:resolve(Msg2, #{ <<"path">> => <<"slot">> }, Opts),
+        ?event({starting_msg_slot, StartingMsgSlot}),
+        Msg3 =
+            #{
+                <<"path">> => <<"push">>,
+                <<"slot">> => StartingMsgSlot
+            },
+        {ok, _} = hb_ao:resolve(Msg1, Msg3, Opts),
+        ?assertEqual(
+            {ok, <<"Done.">>},
+            hb_ao:resolve(Msg1, <<"now/results/data">>, Opts)
+        )
+    end}.
+
+push_as_identity_test_() ->
+    {timeout, 90, fun() ->
+        dev_process:init(),
+        % Create a new identity for the scheduler.
+        DefaultWallet = hb:wallet(),
+        SchedulingWallet = ar_wallet:new(),
+        SchedulingID = hb_util:human_id(SchedulingWallet),
+        ComputeWallet = ar_wallet:new(),
+        ComputeID = hb_util:human_id(ComputeWallet),
+        Opts = #{
+            priv_wallet => DefaultWallet,
             cache_control => <<"always">>,
-            store => [
-                #{ <<"store-module">> => hb_store_fs, <<"prefix">> => <<"cache-TEST">> },
-                #{ <<"store-module">> => hb_store_gateway,
-                    <<"store">> => #{
-                        <<"store-module">> => hb_store_fs,
-                        <<"prefix">> => <<"cache-TEST">>
-                    }
+            identities => #{
+                SchedulingID => #{
+                    priv_wallet => SchedulingWallet,
+                    store => [hb_test_utils:test_store()]
+                },
+                ComputeID => #{
+                    priv_wallet => ComputeWallet
                 }
-            ]
+            }
         },
-        Msg1 = dev_process:test_aos_process(Opts),
+        % Create a new test AOS process, which will use the given identities as
+        % its authority and scheduler.
+        Msg1 =
+            dev_process:test_aos_process(
+                Opts#{
+                    authority => ComputeID,
+                    scheduler => [SchedulingID, ComputeID]
+                }
+            ),
+        ?event({msg1, Msg1}),
+        % Perform the remainder of the test as with `full_push_test_/0'.
         hb_cache:write(Msg1, Opts),
         {ok, SchedInit} =
             hb_ao:resolve(Msg1, #{
@@ -454,6 +733,20 @@ full_push_test_() ->
         ?assertEqual(
             {ok, <<"Done.">>},
             hb_ao:resolve(Msg1, <<"now/results/data">>, Opts)
+        ),
+        % Validate that the scheduler's wallet was used to sign the message.
+        Committers =
+            hb_ao:get(
+                <<"schedule/assignments/2/committers">>,
+                Msg1,
+                Opts
+            ),
+        ?assert(lists:member(SchedulingID, Committers)),
+        ?assert(lists:member(ComputeID, Committers)),
+        % Validate that the compute wallet was used to sign the message.
+        ?assertEqual(
+            [ComputeID],
+            hb_ao:get(<<"schedule/assignments/2/body/committers">>, Msg1, Opts)
         )
     end}.
 
@@ -462,13 +755,7 @@ multi_process_push_test_() ->
         dev_process:init(),
         Opts = #{
             priv_wallet => hb:wallet(),
-            cache_control => <<"always">>,
-            store => [
-                #{
-                    <<"store-module">> => hb_store_fs,
-                    <<"prefix">> => <<"cache-TEST">>
-                }
-            ]
+            cache_control => <<"always">>
         },
         Proc1 = dev_process:test_aos_process(Opts),
         hb_cache:write(Proc1, Opts),
@@ -528,7 +815,7 @@ push_with_redirect_hint_test_disabled() ->
             [
                 #{
                     <<"store-module">> => hb_store_fs,
-                    <<"prefix">> => <<"cache-TEST">>
+                    <<"name">> => <<"cache-TEST">>
                 }
             ],
         ExtOpts = #{ priv_wallet => ar_wallet:new(), store => Stores },
@@ -604,20 +891,22 @@ push_with_redirect_hint_test_disabled() ->
         ?assertEqual({ok, <<"GOT PONG">>}, AfterPush)
     end}.
 
-push_prompts_encoding_change_test() ->
+push_prompts_encoding_change_test_() ->
+    {timeout, 30, fun push_prompts_encoding_change/0}.
+push_prompts_encoding_change() ->
     dev_process:init(),
     Opts = #{
         priv_wallet => hb:wallet(),
         cache_control => <<"always">>,
         store =>
             [
-                #{ <<"store-module">> => hb_store_fs, <<"prefix">> => <<"cache-TEST">> },
+                #{ <<"store-module">> => hb_store_fs, <<"name">> => <<"cache-TEST">> },
                 % Include a gateway store so that we can get the legacynet 
                 % process when needed.
                 #{ <<"store-module">> => hb_store_gateway,
                     <<"store">> => #{
                         <<"store-module">> => hb_store_fs,
-                        <<"prefix">> => <<"cache-TEST">>
+                        <<"name">> => <<"cache-TEST">>
                     }
                 }
             ]
@@ -641,6 +930,91 @@ push_prompts_encoding_change_test() ->
         ),
     ?assertMatch({error, #{ <<"status">> := 422 }}, Res).
 
+oracle_push_test_() -> {timeout, 30, fun oracle_push/0}.
+oracle_push() ->
+    dev_process:init(),
+    Client = dev_process:test_aos_process(),
+    {ok, _} = hb_cache:write(Client, #{}),
+    {ok, _} = dev_process:schedule_aos_call(Client, oracle_script()),
+    Msg3 =
+        #{
+            <<"path">> => <<"push">>,
+            <<"slot">> => 0
+        },
+    {ok, PushResult} = hb_ao:resolve(Client, Msg3, #{ priv_wallet => hb:wallet() }),
+    ?event({result, PushResult}),
+    ComputeRes =
+        hb_ao:resolve(
+            Client,
+            <<"now/results/data">>,
+            #{ priv_wallet => hb:wallet() }
+        ),
+    ?event({compute_res, ComputeRes}),
+    ?assertMatch({ok, _}, ComputeRes).
+
+-ifdef(ENABLE_GENESIS_WASM).
+%% @doc Test that a message that generates another message which resides on an
+%% ANS-104 scheduler leads to `~push@1.0` re-signing the message correctly.
+%% Requires `ENABLE_GENESIS_WASM' to be enabled.
+nested_push_prompts_encoding_change_test_() ->
+    {timeout, 30, fun nested_push_prompts_encoding_change/0}.
+nested_push_prompts_encoding_change() ->
+    dev_process:init(),
+    Opts = #{
+        priv_wallet => hb:wallet(),
+        cache_control => <<"always">>,
+        store => hb_opts:get(store)
+    },
+    ?event(push_debug, {opts, Opts}),
+    Msg1 = dev_process:test_aos_process(Opts),
+    hb_cache:write(Msg1, Opts),
+    {ok, SchedInit} =
+        hb_ao:resolve(Msg1, #{
+            <<"method">> => <<"POST">>,
+            <<"path">> => <<"schedule">>,
+            <<"body">> => Msg1
+        },
+        Opts
+    ),
+    ?event({test_setup, {msg1, Msg1}, {sched_init, SchedInit}}),
+    Script = message_to_legacynet_scheduler_script(),
+    ?event({script, Script}),
+    {ok, Msg2} = dev_process:schedule_aos_call(Msg1, Script),
+    ?event(push, {msg_sched_result, Msg2}),
+    {ok, StartingMsgSlot} =
+        hb_ao:resolve(Msg2, #{ <<"path">> => <<"slot">> }, Opts),
+    ?event({starting_msg_slot, StartingMsgSlot}),
+    Msg3 =
+        #{
+            <<"path">> => <<"push">>,
+            <<"slot">> => StartingMsgSlot
+        },
+    {ok, Res} = hb_ao:resolve(Msg1, Msg3, Opts),
+    ?event(push, {res, Res}),
+    Msg = hb_message:commit(#{
+        <<"path">> => <<"push">>,
+        <<"method">> => <<"POST">>,
+        <<"body">> =>
+            hb_message:commit(
+                #{
+                    <<"target">> => hb_message:id(Msg1, all, Opts),
+                    <<"action">> => <<"Ping">>
+                },
+                Opts
+            )
+    }, Opts),
+    ?event(push, {msg1, Msg}),
+    Res2 =
+        hb_ao:resolve_many(
+            [
+                hb_message:id(Msg1, all, Opts),
+                {as, <<"process@1.0">>, <<>>},
+                Msg
+            ],
+            Opts
+        ),
+    ?assertMatch({ok, #{ <<"1">> := #{ <<"resulted-in">> := _ }}}, Res2).
+-endif.
 %%% Test helpers
 
 ping_pong_script(Limit) ->
@@ -672,5 +1046,43 @@ reply_script() ->
                print("Done.")
            end
         )
+        """
+    >>.
+
+message_to_legacynet_scheduler_script() ->
+    <<
+        """
+        Handlers.add("Ping",
+           { Action = "Ping" },
+           function(m)
+               print("Pinging...")
+               print(m.From)
+               Send({
+                    Target = "QQiMcAge5ZtxcUV7ruxpi16KYRE8UBP0GAAqCIJPXz0",
+                    Action = "Ping"
+                })
+               print("Done.")
+           end
+        )
+        """
+    >>.
+
+oracle_script() ->
+    <<
+        """
+        Handlers.add("Oracle",
+            function(m)
+                return true
+            end,
+            function(m)
+                print(m.Body)
+            end
+        )
+        Send({
+            target = ao.id,
+            resolve = "/~relay@1.0/call",
+            ["relay-path"] = "https://arweave.net"
+        })
+        
         """
     >>.
\ No newline at end of file
diff --git a/src/dev_query.erl b/src/dev_query.erl
new file mode 100644
index 000000000..1a20903b7
--- /dev/null
+++ b/src/dev_query.erl
@@ -0,0 +1,332 @@
+%%% @doc A discovery engine for searching for and returning messages found in
+%%% a node's cache, through supported stores.
+%%% 
+%%% This device supports various modes of matching, including:
+%%%
+%%% - `all' (default): Match all keys in the request message.
+%%% - `base': Match all keys in the base message.
+%%% - `only': Match only the key(s) specified in the `only' key.
+%%% 
+%%% The `only' key can be a binary, a map, or a list of keys. If it is a binary,
+%%% it is split on commas to get a list of keys to search for. If it is a message,
+%%% it is used directly as the match spec. If it is a list, it is assumed to be
+%%% a list of keys that we should select from the request or base message and
+%%% use as the match spec.
+%%%
+%%% The `return' key can be used to specify the type of data to return.
+%%%
+%%% - `count': Return the number of matches.
+%%% - `paths': Return the paths of the matches in a list.
+%%% - `messages': Return the messages associated with each match in a list.
+%%% - `first-path': Return the first path of the matches.
+%%% - `first-message': Return the first message of the matches.
+%%% - `boolean': Return a boolean indicating whether any matches were found.
+-module(dev_query).
+%%% Message matching API:
+-export([info/1, only/3, all/3, base/3]).
+%%% GraphQL API:
+-export([graphql/3, has_results/3]).
+%%% Test setup:
+-export([test_setup/0]).
+-include_lib("eunit/include/eunit.hrl").
+-include("include/hb.hrl").
+
+%%% Keys that should typically be excluded from searches.
+-define(
+    DEFAULT_EXCLUDES,
+    [<<"path">>, <<"commitments">>, <<"return">>, <<"exclude">>, <<"only">>]
+).
+
+info(_Opts) ->
+    #{
+        excludes => [<<"keys">>, <<"set">>],
+        default => fun default/4
+    }.
+
+%% @doc Execute the query via GraphQL.
+graphql(Req, Base, Opts) ->
+    dev_query_graphql:handle(Req, Base, Opts).
+
+%% @doc Return whether a GraphQL esponse in a message has transaction results.
+%% This key is used in HB's gateway client multirequest configuration to
+%% determine if the response from the node should be considered admissible.
+has_results(Base, Req, Opts) ->
+    JSON =
+        hb_ao:get_first(
+            [
+                {{as, <<"message@1.0">>, Base}, <<"body">>},
+                {{as, <<"message@1.0">>, Req}, <<"body">>}
+            ],
+            <<"{}">>,
+            Opts
+        ),
+    Decoded = hb_json:decode(JSON),
+    ?event(debug_multi, {has_results, {decoded_json, Decoded}}),
+    case Decoded of
+        #{ <<"data">> := #{ <<"transactions">> := #{ <<"edges">> := Nodes } } }
+                when length(Nodes) > 0 ->
+            {ok, true};
+        _ -> {ok, false}
+    end.
+
+%% @doc Search for the keys specified in the request message.
+default(_, Base, Req, Opts) ->
+    all(Base, Req, Opts).
+
+%% @doc Search the node's store for all of the keys and values in the request,
+%% aside from the `commitments' and `path' keys.
+all(Base, Req, Opts) ->
+    match(Req, Base, Req, Opts).
+
+%% @doc Search the node's store for all of the keys and values in the base
+%% message, aside from the `commitments' and `path' keys.
+base(Base, Req, Opts) ->
+    match(Base, Base, Req, Opts).
+
+%% @doc Search only for the (list of) key(s) specified in `only' in the request.
+%% The `only' key can be a binary, a map, or a list of keys. See the moduledoc
+%% for semantics.
+only(Base, Req, Opts) ->
+    case hb_maps:get(<<"only">>, Req, not_found, Opts) of
+        KeyBin when is_binary(KeyBin) ->
+            % The descriptor is a binary, so we split it on commas to get a
+            % list of keys to search for. If there is only one key, we
+            % return a list with that key.
+            match(binary:split(KeyBin, <<",">>, [global]), Base, Req, Opts);
+        Spec when is_map(Spec) ->
+            % The descriptor is a map, so we use it as the match spec.
+            match(Spec, Base, Req, Opts);
+        Keys when is_list(Keys) ->
+            % The descriptor is a list, so we assume that it is a list of
+            % keys that we should select from the request and use as the
+            % match spec.
+            match(Keys, Base, Req, Opts);
+        not_found ->
+            % We cannot find the key to match upon. Return an error.
+            {error, not_found}
+    end.
+
+%% @doc Match the request against the base message, using the keys to select
+%% the values from the request and (if not found) the values from the base
+%% message.
+match(Keys, Base, Req, Opts) when is_list(Keys) ->
+    UserSpec =
+        maps:from_list(
+            lists:filtermap(
+                fun(Key) ->
+                    % Search for the value in the request. If not found,
+                    % look in the base message.
+                    Value =
+                        hb_maps:get(
+                            Key,
+                            Req,
+                            hb_maps:get(Key, Base, not_found, Opts),
+                            Opts
+                        ),
+                    if Value == not_found -> false;
+                    true -> {true, {Key, Value}}
+                    end
+                end,
+                Keys
+            )
+        ),
+    match(UserSpec, Base, Req, Opts);
+match(UserSpec, _Base, Req, Opts) ->
+    ?event({matching, {spec, UserSpec}}),
+    FilteredSpec =
+        hb_maps:without(
+            hb_maps:get(<<"exclude">>, Req, ?DEFAULT_EXCLUDES, Opts),
+            UserSpec
+        ),
+    ReturnType = hb_maps:get(<<"return">>, Req, <<"paths">>, Opts),
+    ?event({matching, {spec, FilteredSpec}, {return, ReturnType}}),
+    case hb_cache:match(FilteredSpec, Opts) of
+        {ok, Matches} when ReturnType == <<"count">> ->
+            ?event({matched, {paths, Matches}}),
+            {ok, length(Matches)};
+        {ok, Matches} when ReturnType == <<"paths">> ->
+            ?event({matched, {paths, Matches}}),
+            {ok, Matches};
+        {ok, Matches} when ReturnType == <<"messages">> ->
+            ?event({matched, {paths, Matches}}),
+            Messages =
+                lists:map(
+                    fun(Path) ->
+                        hb_util:ok(hb_cache:read(Path, Opts))
+                    end,
+                    Matches
+                ),
+            ?event({matched, {messages, Messages}}),
+            {ok, Messages};
+        {ok, Matches} when ReturnType == <<"first-path">> ->
+            ?event({matched, {paths, Matches}}),
+            {ok, hd(Matches)};
+        {ok, Matches} when ReturnType == <<"first">>
+                orelse ReturnType == <<"first-message">> ->
+            ?event({matched, {paths, Matches}}),
+            {ok, hb_util:ok(hb_cache:read(hd(Matches), Opts))};
+        {ok, Matches} when ReturnType == <<"boolean">> ->
+            ?event({matched, {paths, Matches}}),
+            {ok, length(Matches) > 0};
+        not_found when ReturnType == <<"boolean">> ->
+            {ok, false};
+        not_found ->
+            {error, not_found}
+    end.
+
+%%% Tests
+
+%% @doc Return test options with a test store.
+test_setup() ->
+    Store = hb_test_utils:test_store(hb_store_lmdb),
+    Opts = #{ store => Store, priv_wallet => hb:wallet() },
+    % Write a simple message.
+    hb_cache:write(
+        #{
+            <<"basic">> => <<"binary-value">>,
+            <<"basic-2">> => <<"binary-value-2">>
+        },
+        Opts
+    ),
+    % Write a nested and committed message.
+    hb_cache:write(
+        hb_message:commit(
+            #{
+                <<"test-key">> => <<"test-value">>,
+                <<"test-key-2">> => <<"test-value-2">>,
+                <<"nested">> => Nested = #{
+                    <<"test-key-3">> => <<"test-value-3">>,
+                    <<"test-key-4">> => <<"test-value-4">>
+                }
+            },
+            Opts
+        ),
+        Opts
+    ),
+    % Write a list message with complex keys.
+    hb_cache:write([<<"a">>, 2, ok], Opts),
+    {ok, Opts, #{ <<"nested">> => hb_message:id(Nested, all, Opts) }}.
+
+%% @doc Search for and find a basic test key.
+basic_test() ->
+    {ok, Opts, _} = test_setup(),
+    {ok, [ID]} = hb_ao:resolve(<<"~query@1.0/all?basic=binary-value">>, Opts),
+    {ok, Read} = hb_cache:read(ID, Opts),
+    ?assertEqual(<<"binary-value">>, hb_maps:get(<<"basic">>, Read)),
+    ?assertEqual(<<"binary-value-2">>, hb_maps:get(<<"basic-2">>, Read)),
+    {ok, [Msg]} =
+        hb_ao:resolve(
+            <<"~query@1.0/all?basic-2=binary-value-2&return=messages">>,
+            Opts
+        ),
+    ?assertEqual(<<"binary-value-2">>, hb_maps:get(<<"basic-2">>, Msg)),
+    ok.
+
+%% @doc Ensure that we can search for and match only a single key.
+only_test() ->
+    {ok, Opts, _} = test_setup(),
+    {ok, [Msg]} =
+        hb_ao:resolve(
+            <<"~query@1.0/only=basic&basic=binary-value&wrong=1&return=messages">>,
+            Opts
+        ),
+    ?assertEqual(<<"binary-value">>, hb_maps:get(<<"basic">>, Msg)),
+    ok.
+
+%% @doc Ensure that we can specify multiple keys to match.
+multiple_test() ->
+    {ok, Opts, _} = test_setup(),
+    {ok, [Msg]} =
+        hb_ao:resolve(
+            <<
+                "~query@1.0/only=basic,basic-2",
+                "&basic=binary-value&basic-2=binary-value-2",
+                "&return=messages"
+            >>,
+            Opts
+        ),
+    ?assertEqual(<<"binary-value">>, hb_maps:get(<<"basic">>, Msg)),
+    ?assertEqual(<<"binary-value-2">>, hb_maps:get(<<"basic-2">>, Msg)),
+    ok.
+
+%% @doc Search for and find a nested test key.
+nested_test() ->
+    {ok, Opts, _} = test_setup(),
+    {ok, [MsgWithNested]} =
+        hb_ao:resolve(
+            <<"~query@1.0/all?test-key=test-value&return=messages">>,
+            Opts
+        ),
+    ?assert(hb_maps:is_key(<<"nested">>, MsgWithNested, Opts)),
+    Nested = hb_maps:get(<<"nested">>, MsgWithNested, undefined, Opts),
+    ?assertEqual(<<"test-value-3">>, hb_maps:get(<<"test-key-3">>, Nested, Opts)),
+    ?assertEqual(<<"test-value-4">>, hb_maps:get(<<"test-key-4">>, Nested, Opts)),
+    ok.
+
+%% @doc Search for and find a list message with typed elements.
+list_test() ->
+    {ok, Opts, _} = test_setup(),
+    {ok, [Msg]} =
+        hb_ao:resolve(
+            <<"~query@1.0/all?2+integer=2&3+atom=ok&return=messages">>,
+            Opts
+        ),
+    ?assertEqual([<<"a">>, 2, ok], Msg),
+    ok.
+
+%% @doc Ensure user's can opt not to specify a key to resolve, instead specifying
+%% only the matchable keys in the message.
+return_key_test() ->
+    {ok, Opts, _} = test_setup(),
+    {ok, [ID]} =
+        hb_ao:resolve(
+            <<"~query@1.0/basic=binary-value">>,
+            Opts
+        ),
+    {ok, Msg} = hb_cache:read(ID, Opts),
+    ?assertEqual(<<"binary-value">>, hb_maps:get(<<"basic">>, Msg, Opts)),
+    ok.
+
+%% @doc Validate the functioning of various return types.
+return_types_test() ->
+    {ok, Opts, _} = test_setup(),
+    {ok, [Msg]} =
+        hb_ao:resolve(
+            <<"~query@1.0/basic=binary-value&return=messages">>,
+            Opts
+        ),
+    ?assertEqual(<<"binary-value">>, hb_maps:get(<<"basic">>, Msg, Opts)),
+    ?assertEqual(
+        {ok, 1},
+        hb_ao:resolve(
+            <<"~query@1.0/basic=binary-value&return=count">>,
+            Opts
+        )
+    ),
+    ?assertEqual(
+        {ok, true},
+        hb_ao:resolve(
+            <<"~query@1.0/basic=binary-value&return=boolean">>,
+            Opts
+        )
+    ),
+    ?assertEqual(
+        {ok, <<"binary-value">>},
+        hb_ao:resolve(
+            <<"~query@1.0/basic=binary-value&return=first-message/basic">>,
+            Opts
+        )
+    ),
+    ok.
+
+http_test() ->
+    {ok, Opts, _} = test_setup(),
+    Node = hb_http_server:start_node(Opts),
+    {ok, Msg} =
+        hb_http:get(
+            Node,
+            <<"~query@1.0/only=basic&basic=binary-value?return=first">>,
+            Opts
+        ),
+    ?assertEqual(<<"binary-value">>, hb_maps:get(<<"basic">>, Msg, Opts)),
+    ok.
\ No newline at end of file
diff --git a/src/dev_query_arweave.erl b/src/dev_query_arweave.erl
new file mode 100644
index 000000000..bbc5b8cbe
--- /dev/null
+++ b/src/dev_query_arweave.erl
@@ -0,0 +1,316 @@
+%%% @doc An implementation of the Arweave GraphQL API, inside the `~query@1.0'
+%%% device.
+-module(dev_query_arweave).
+%%% AO-Core API:
+-export([query/4]).
+-include_lib("eunit/include/eunit.hrl").
+-include("include/hb.hrl").
+
+%% @doc The arguments that are supported by the Arweave GraphQL API.
+-define(SUPPORTED_QUERY_ARGS,
+    [
+        <<"height">>,
+        <<"id">>,
+        <<"ids">>,
+        <<"tags">>,
+        <<"owners">>,
+        <<"recipients">>
+    ]
+).
+
+%% @doc Handle an Arweave GraphQL query for either transactions or blocks.
+query(List, <<"edges">>, _Args, _Opts) ->
+    {ok, [{ok, Msg} || Msg <- List]};
+query(Msg, <<"node">>, _Args, _Opts) ->
+    {ok, Msg};
+query(Obj, <<"transaction">>, Args, Opts) ->
+    case query(Obj, <<"transactions">>, Args, Opts) of
+        {ok, []} -> {ok, null};
+        {ok, [Msg|_]} -> {ok, Msg}
+    end;
+query(Obj, <<"transactions">>, Args, Opts) ->
+    ?event({transactions_query,
+        {object, Obj},
+        {field, <<"transactions">>},
+        {args, Args}
+    }),
+    Matches = match_args(Args, Opts),
+    ?event({transactions_matches, Matches}),
+    Messages =
+        lists:filtermap(
+            fun(Match) ->
+                case hb_cache:read(Match, Opts) of
+                    {ok, Msg} -> {true, Msg};
+                    not_found -> false
+                end
+            end,
+            Matches
+        ),
+    {ok, Messages};
+query(Obj, <<"block">>, Args, Opts) ->
+    case query(Obj, <<"blocks">>, Args, Opts) of
+        {ok, []} -> {ok, null};
+        {ok, [Msg|_]} -> {ok, Msg}
+    end;
+query(Obj, <<"blocks">>, Args, Opts) ->
+    ?event({blocks, 
+            {object, Obj}, 
+            {field, <<"blocks">>}, 
+            {args, Args}
+        }),
+    Matches = match_args(Args, Opts),
+    ?event({blocks_matches, Matches}),
+    Blocks =
+        lists:filtermap(
+            fun(Match) ->
+                case hb_cache:read(Match, Opts) of
+                    {ok, Msg} -> {true, Msg};
+                    not_found -> false
+                end
+            end,
+            Matches
+        ),
+    % Return the blocks as a list of messages.
+    % Individual access methods are defined below.
+    {ok, Blocks};
+query(Block, <<"previous">>, _Args, Opts) ->
+    {ok, hb_maps:get(<<"previous_block">>, Block, null, Opts)};
+query(Block, <<"height">>, _Args, Opts) ->
+    {ok, hb_maps:get(<<"height">>, Block, null, Opts)};
+query(Block, <<"timestamp">>, _Args, Opts) ->
+    {ok, hb_maps:get(<<"timestamp">>, Block, null, Opts)};
+query(Msg, <<"signature">>, _Args, Opts) ->
+    % Return the signature of the transaction.
+    % Other TX access methods are defined below.
+    case hb_maps:get(<<"commitments">>, Msg, not_found, Opts) of
+        not_found -> {ok, null};
+        Commitments ->
+            case maps:to_list(Commitments) of
+                [] -> {ok, null};
+                [{_CommitmentID, Commitment} | _] ->
+                    {ok, hb_maps:get(<<"signature">>, Commitment, null, Opts)}
+            end
+    end;
+query(Msg, <<"owner">>, _Args, Opts) ->
+    ?event({query_owner, Msg}),
+    case hb_message:commitments(#{ <<"committer">> => '_' }, Msg, Opts) of
+        not_found -> {ok, null};
+        Commitments ->
+            case hb_maps:keys(Commitments) of
+                [] -> {ok, null};
+                [CommID | _] ->
+                    {ok, Commitment} = hb_maps:find(CommID, Commitments, Opts),
+                    {ok, Address} = hb_maps:find(<<"committer">>, Commitment, Opts),
+                    {ok, KeyID} = hb_maps:find(<<"keyid">>, Commitment, Opts),
+                    Key = dev_codec_httpsig_keyid:remove_scheme_prefix(KeyID),
+                    {ok, #{
+                        <<"address">> => Address,
+                        <<"key">> => Key
+                    }}
+            end
+    end;
+query(#{ <<"key">> := Key }, <<"key">>, _Args, _Opts) ->
+    {ok, Key};
+query(#{ <<"address">> := Address }, <<"address">>, _Args, _Opts) ->
+    {ok, Address};
+query(Msg, <<"fee">>, _Args, Opts) ->
+    {ok, hb_maps:get(<<"fee">>, Msg, 0, Opts)};
+query(Msg, <<"quantity">>, _Args, Opts) ->
+    {ok, hb_maps:get(<<"quantity">>, Msg, 0, Opts)};
+query(Number, <<"winston">>, _Args, _Opts) when is_number(Number) ->
+    {ok, Number};
+query(Msg, <<"recipient">>, _Args, Opts) ->
+    case find_field_key(<<"field-target">>, Msg, Opts) of
+        {ok, null} -> {ok, <<"">>};
+        OkRes -> OkRes
+    end;
+query(Msg, <<"anchor">>, _Args, Opts) ->
+    case find_field_key(<<"field-anchor">>, Msg, Opts) of
+        {ok, null} -> {ok, <<"">>};
+        {ok, Anchor} -> {ok, hb_util:human_id(Anchor)}
+    end;
+query(Msg, <<"data">>, _Args, Opts) ->
+    Data =
+        hb_ao:get_first(
+            [
+                {{as, <<"message@1.0">>, Msg}, <<"data">>},
+                {{as, <<"message@1.0">>, Msg}, <<"body">>}
+            ],
+            <<>>,
+            Opts
+        ),
+    Type = hb_maps:get(<<"content-type">>, Msg, null, Opts),
+    {ok, #{ <<"data">> => Data, <<"type">> => Type }};
+query(#{ <<"data">> := Data }, <<"size">>, _Args, _Opts) ->
+    {ok, byte_size(Data)};
+query(#{ <<"type">> := Type }, <<"type">>, _Args, _Opts) ->
+    {ok, Type};
+query(Obj, Field, Args, _Opts) ->
+    ?event({unimplemented_transactions_query,
+        {object, Obj},
+        {field, Field},
+        {args, Args}
+    }),
+    {ok, <<"Not implemented.">>}.
+
+%% @doc Find and return a value from the fields of a message (from its
+%% commitments).
+find_field_key(Field, Msg, Opts) ->
+    case hb_message:commitments(#{ Field => '_' }, Msg, Opts) of
+        not_found -> {ok, null};
+        Commitments ->
+            case hb_maps:keys(Commitments) of
+                [] -> {ok, null};
+                [CommID | _] ->
+                    {ok, Commitment} = hb_maps:find(CommID, Commitments, Opts),
+                    case hb_maps:find(Field, Commitment, Opts) of
+                        {ok, Value} -> {ok, Value};
+                        error -> {ok, null}
+                    end
+            end
+    end.
+
+%% @doc Progressively generate matches from each argument for a transaction
+%% query.
+match_args(Args, Opts) when is_map(Args) ->
+    match_args(
+        maps:to_list(
+            maps:with(
+                ?SUPPORTED_QUERY_ARGS,
+                Args
+            )
+        ),
+        [],
+        Opts
+    ).
+match_args([], Results, Opts) ->
+    ?event({match_args_results, Results}),
+    Matches =
+        lists:foldl(
+            fun(Result, Acc) ->
+                hb_util:list_with(resolve_ids(Result, Opts), Acc)
+            end,
+            resolve_ids(hd(Results), Opts),
+            tl(Results)
+        ),
+    hb_util:unique(
+        lists:flatten(
+            [
+                all_ids(ID, Opts)
+            ||
+                ID <- Matches
+            ]
+        )
+    );
+match_args([{Field, X} | Rest], Acc, Opts) ->
+    MatchRes = match(Field, X, Opts),
+    ?event({match, {field, Field}, {arg, X}, {match_res, MatchRes}}),
+    case MatchRes of
+        {ok, Result} ->
+            match_args(Rest, [Result | Acc], Opts);
+        _Error ->
+            match_args(Rest, Acc, Opts)
+    end.
+
+%% @doc Generate a match upon `tags' in the arguments, if given.
+match(_, null, _) -> ignore;
+match(<<"height">>, Heights, Opts) ->
+    Min = hb_maps:get(<<"min">>, Heights, 0, Opts),
+    Max =
+        case hb_maps:find(<<"max">>, Heights, Opts) of
+            {ok, GivenMax} -> GivenMax;
+            error ->
+                {ok, Latest} = dev_arweave_block_cache:latest(Opts),
+                Latest
+        end,
+    #{ store := ScopedStores } = scope(Opts),
+    {ok,
+        lists:filtermap(
+            fun(Height) ->
+                Path = dev_arweave_block_cache:path(Height, Opts),
+                case hb_store:type(ScopedStores, Path) of
+                    not_found -> false;
+                    _ -> {true, hb_store:resolve(ScopedStores, Path)}
+                end
+            end,
+            lists:seq(Min, Max)
+        )
+    };
+match(<<"id">>, ID, _Opts) ->
+    {ok, [ID]};
+match(<<"ids">>, IDs, _Opts) ->
+    {ok, IDs};
+match(<<"tags">>, Tags, Opts) ->
+    hb_cache:match(dev_query_graphql:keys_to_template(Tags), Opts);
+match(<<"owners">>, Owners, Opts) ->
+    {ok, matching_commitments(<<"committer">>, Owners, Opts)};
+match(<<"owner">>, Owner, Opts) ->
+    Res =  matching_commitments(<<"committer">>, Owner, Opts),
+    ?event({match_owner, Owner, Res}),
+    {ok, Res};
+match(<<"recipients">>, Recipients, Opts) ->
+    {ok, matching_commitments(<<"field-target">>, Recipients, Opts)};
+match(UnsupportedFilter, _, _) ->
+    throw({unsupported_query_filter, UnsupportedFilter}).
+
+%% @doc Return the base IDs for messages that have a matching commitment.
+matching_commitments(Field, Values, Opts) when is_list(Values) ->
+    hb_util:unique(lists:flatten(
+        lists:map(
+            fun(Value) -> matching_commitments(Field, Value, Opts) end,
+            Values
+        )
+    ));
+matching_commitments(Field, Value, Opts) when is_binary(Value) ->
+    case hb_cache:match(#{ Field => Value }, Opts) of
+        {ok, IDs} ->
+            ?event(
+                {found_matching_commitments,
+                    {field, Field},
+                    {value, Value},
+                    {ids, IDs}
+                }
+            ),
+            lists:map(fun(ID) -> commitment_id_to_base_id(ID, Opts) end, IDs);
+        not_found -> not_found
+    end.
+
+%% @doc Convert a commitment message's ID to a base ID.
+commitment_id_to_base_id(ID, Opts) ->
+    Store = hb_opts:get(store, no_store, Opts),
+    ?event({commitment_id_to_base_id, ID}),
+    case hb_store:read(Store, << ID/binary, "/signature">>) of
+        {ok, EncSig} ->
+            Sig = hb_util:decode(EncSig),
+            ?event({commitment_id_to_base_id_sig, Sig}),
+            hb_util:encode(hb_crypto:sha256(Sig));
+        not_found -> not_found
+    end.
+
+%% @doc Find all IDs for a message, by any of its other IDs.
+all_ids(ID, Opts) ->
+    Store = hb_opts:get(store, no_store, Opts),
+    case hb_store:list(Store, << ID/binary, "/commitments">>) of
+        {ok, []} -> [ID];
+        {ok, CommitmentIDs} -> CommitmentIDs;
+        _ -> []
+    end.
+
+%% @doc Scope the stores used for block matching. The searched stores can be
+%% scoped by setting the `query_arweave_scope' option.
+scope(Opts) ->
+    Scope = hb_opts:get(query_arweave_scope, [local], Opts),
+    hb_store:scope(Opts, Scope).
+
+%% @doc Resolve a list of IDs to their store paths, using the stores provided.
+resolve_ids(IDs, Opts) ->
+    Scoped = scope(Opts),
+    lists:map(
+        fun(ID) ->
+            case hb_cache:read(ID, Opts) of
+                {ok, Msg} -> hb_message:id(Msg, uncommitted, Scoped);
+                not_found -> ID
+            end
+        end,
+        IDs
+    ).
\ No newline at end of file
diff --git a/src/dev_query_graphql.erl b/src/dev_query_graphql.erl
new file mode 100644
index 000000000..6907afcc2
--- /dev/null
+++ b/src/dev_query_graphql.erl
@@ -0,0 +1,453 @@
+%%% @doc A GraphQL interface for querying a node's cache. Accessible through the
+%%% `~query@1.0/graphql' device key.
+-module(dev_query_graphql).
+%%% AO-Core API:
+-export([handle/3]).
+%%% GraphQL Callbacks:
+-export([execute/4]).
+%%% Submodule helpers:
+-export([keys_to_template/1, test_query/3, test_query/4]).
+-include_lib("eunit/include/eunit.hrl").
+-include("include/hb.hrl").
+
+%%% Constants.
+-define(DEFAULT_QUERY_TIMEOUT, 10000).
+-define(START_TIMEOUT, 3000).
+
+%%% `Message' query keys.
+-define(MESSAGE_QUERY_KEYS,
+    [
+        <<"id">>,
+        <<"message">>,
+        <<"keys">>,
+        <<"tags">>,
+        <<"name">>,
+        <<"value">>,
+        <<"cursor">>
+    ]
+).
+
+%% @doc Returns the complete GraphQL schema.
+schema() ->
+    hb_util:ok(file:read_file("scripts/schema.gql")).
+
+%% @doc Ensure that the GraphQL schema and context are initialized. Can be 
+%% called many times.
+ensure_started() -> ensure_started(#{}).
+ensure_started(Opts) ->
+    case hb_name:lookup(graphql_controller) of
+        PID when is_pid(PID) -> ok;
+        undefined ->
+            Parent = self(),
+            PID =
+                spawn_link(
+                    fun() ->
+                        init(Opts),
+                        Parent ! {started, self()},
+                        receive stop -> ok end
+                    end
+                ),
+            receive {started, PID} -> ok
+            after ?START_TIMEOUT -> exit(graphql_start_timeout)
+            end
+    end.
+
+%% @doc Initialize the GraphQL schema and context. Should only be called once.
+init(_Opts) ->
+    ?event(graphql_init_called),
+    application:ensure_all_started(graphql),
+    ?event(graphql_application_started),
+    GraphQLOpts =
+        #{
+            scalars => #{ default => ?MODULE },
+            interfaces => #{ default => ?MODULE },
+            unions => #{ default => ?MODULE },
+            objects => #{ default => ?MODULE },
+            enums => #{ default => ?MODULE }
+        },
+    ok = graphql:load_schema(GraphQLOpts, schema()),
+    ?event(graphql_schema_loaded),
+    Root =
+        {root,
+            #{
+                query => 'Query',
+                interfaces => []
+            }
+        },
+    ok = graphql:insert_schema_definition(Root),
+    ?event(graphql_schema_definition_inserted),
+    ok = graphql:validate_schema(),
+    ?event(graphql_schema_validated),
+    hb_name:register(graphql_controller, self()),
+    ?event(graphql_controller_registered),
+    ok.
+
+handle(_Base, RawReq, Opts) ->
+    ?event({request, RawReq}),
+    Req =
+        case hb_maps:find(<<"query">>, RawReq, Opts) of
+            {ok, _} -> RawReq;
+            error ->
+                % Parse the query, assuming that the request body is a JSON
+                % object with the necessary fields.
+                hb_json:decode(hb_maps:get(<<"body">>, RawReq, <<>>, Opts))
+        end,
+    ?event({request, {processed, Req}}),
+    Query = hb_maps:get(<<"query">>, Req, <<>>, Opts),
+    OpName = hb_maps:get(<<"operationName">>, Req, undefined, Opts),
+    Vars = hb_maps:get(<<"variables">>, Req, #{}, Opts),
+    ?event(
+        {graphql_run_called,
+            {query, Query},
+            {operation, OpName},
+            {variables, Vars}
+        }
+    ),
+    ensure_started(),
+    case graphql:parse(Query) of
+        {ok, AST} ->
+            ?event(graphql_parsed),
+            try
+                ?event(graphql_type_checking),
+                {ok, #{fun_env := FunEnv, ast := AST2 }} = graphql:type_check(AST),
+                ?event(graphql_type_checked_successfully),
+                ok = graphql:validate(AST2),
+                ?event(graphql_validated),
+                Coerced = graphql:type_check_params(FunEnv, OpName, Vars),
+                ?event(graphql_type_checked_params),
+                Ctx =
+                    #{
+                        params => Coerced,
+                        operation_name => OpName,
+                        default_timeout =>
+                            hb_opts:get(
+                                query_timeout,
+                                ?DEFAULT_QUERY_TIMEOUT,
+                                Opts
+                            ),
+                        opts => Opts
+                    },
+                ?event(graphql_context_created),
+                Response = graphql:execute(Ctx, AST2),
+                ?event(graphql_executed),
+                JSON = hb_json:encode(Response),
+                ?event({graphql_response, {bytes, byte_size(JSON)}}),
+                {ok,
+                    #{
+                        <<"content-type">> => <<"application/json">>,
+                        <<"body">> => JSON
+                    }
+                }
+            catch
+                throw:Error:Stacktrace ->
+                    ?event({graphql_error, {error, Error}, {trace, Stacktrace}}),
+                    {error, Error}
+            end
+    end.
+
+%% @doc The main entrypoint for resolving GraphQL elements, called by the
+%% GraphQL library. We split the resolution flows into two separated functions:
+%% `message_query/4' for the HyperBEAM native API, and `dev_query_arweave:query/4'
+%% for the Arweave-compatible API.
+execute(#{opts := Opts}, Obj, Field, Args) ->
+    ?event({graphql_query, {object, Obj}, {field, Field}, {args, Args}}),
+    case lists:member(Field, ?MESSAGE_QUERY_KEYS) of
+        true -> message_query(Obj, Field, Args, Opts);
+        false -> dev_query_arweave:query(Obj, Field, Args, Opts)
+    end.
+
+%% @doc Handle a HyperBEAM `message' query.
+message_query(Obj, <<"message">>, #{<<"keys">> := Keys}, Opts) ->
+    Template = keys_to_template(Keys),
+    ?event(
+        {graphql_execute_called,
+            {object, Obj},
+            {field, <<"message">>},
+            {raw_keys, Keys},
+            {template, Template}
+        }
+    ),
+    case hb_cache:match(Template, Opts) of
+        {ok, [ID | _IDs]} ->
+            ?event({graphql_cache_match_found, ID}),
+            {ok, Msg} = hb_cache:read(ID, Opts),
+            ?event({graphql_cache_read, Msg}),
+            {ok, Msg};
+        not_found ->
+            ?event(graphql_cache_match_not_found),
+            {ok, #{<<"id">> => <<"not-found">>, <<"keys">> => #{}}}
+    end;
+message_query(Msg, Field, _Args, Opts) when Field =:= <<"keys">>; Field =:= <<"tags">> ->
+    OnlyKeys =
+        hb_maps:to_list(
+            hb_private:reset(
+                hb_maps:without(
+                    [<<"data">>, <<"body">>],
+                    hb_message:uncommitted(Msg, Opts),
+                    Opts
+                )
+            ),
+            Opts
+        ),
+    ?event({message_query_keys_or_tags, {object, Msg}, {only_keys, OnlyKeys}}),
+    Res = {
+        ok,
+        [
+            {ok,
+                #{
+                    <<"name">> => Name,
+                    <<"value">> => hb_cache:ensure_loaded(Value, Opts)
+                }
+            }
+        ||
+            {Name, Value} <- OnlyKeys
+        ]
+    },
+    ?event({message_query_keys_or_tags_result, Res}),
+    Res;
+message_query(Msg, Field, _Args, Opts)
+        when Field =:= <<"name">> orelse Field =:= <<"value">> ->
+    ?event({message_query_name_or_value, {object, Msg}, {field, Field}}),
+    {ok, hb_maps:get(Field, Msg, null, Opts)};
+message_query(Msg = #{ <<"independent_hash">> := _ }, <<"id">>, _Args, Opts) ->
+    {ok, hb_maps:get(<<"independent_hash">>, Msg, null, Opts)};
+message_query(Msg, <<"id">>, _Args, Opts) ->
+    ?event({message_query_id, {object, Msg}}),
+    {ok, hb_message:id(Msg, all, Opts)};
+message_query(_Msg, <<"cursor">>, _Args, _Opts) ->
+    {ok, <<"">>};
+message_query(_Obj, _Field, _, _) ->
+    {ok, <<"Not found.">>}.
+
+keys_to_template(Keys) ->
+    maps:from_list(lists:foldl(
+        fun(#{<<"name">> := Name, <<"value">> := Value}, Acc) ->
+            [{Name, Value} | Acc];
+        (#{<<"name">> := Name, <<"values">> := [Value]}, Acc) ->
+            [{Name, Value} | Acc];
+        (#{<<"name">> := Name, <<"values">> := Values}, _Acc) ->
+            throw(
+                {multivalue_tag_search_not_supported, #{
+                    <<"name">> => Name,
+                    <<"values">> => Values
+                }}
+            )
+        end,
+        [],
+        Keys
+    )).
+
+%%% Test helpers.
+
+test_query(Node, Query, Opts) ->
+    test_query(Node, Query, undefined, Opts).
+test_query(Node, Query, Variables, Opts) ->
+    test_query(Node, Query, Variables, undefined, Opts).
+test_query(Node, Query, Variables, OperationName, Opts) ->
+    UnencodedPayload =
+        maps:filter(
+            fun(_, undefined) -> false;
+                (_, _) -> true
+            end,
+            #{
+                <<"query">> => Query,
+                <<"variables">> => Variables,
+                <<"operationName">> => OperationName
+            }
+        ),
+    ?event({test_query_unencoded_payload, UnencodedPayload}),
+    {ok, Res} =
+        hb_http:post(
+            Node,
+            #{
+                <<"path">> => <<"~query@1.0/graphql">>,
+                <<"content-type">> => <<"application/json">>,
+                <<"codec-device">> => <<"json@1.0">>,
+                <<"body">> => hb_json:encode(UnencodedPayload)
+            },
+            Opts
+        ),
+    hb_json:decode(hb_maps:get(<<"body">>, Res, <<>>, Opts)).
+
+%%% Tests
+
+lookup_test() ->
+    {ok, Opts, _} = dev_query:test_setup(),
+    Node = hb_http_server:start_node(Opts),
+    Query =
+        <<""" 
+            query GetMessage { 
+                message(
+                    keys: 
+                        [
+                            { 
+                                name: "basic", 
+                                value: "binary-value" 
+                            }
+                        ]
+                ) {
+                    id
+                    keys {
+                        name
+                        value
+                    }
+                }
+            }
+        """>>,
+    Res = test_query(Node, Query, Opts),
+    ?event({test_response, Res}),
+    ?assertMatch(
+        #{ <<"data">> := 
+            #{ 
+                <<"message">> :=
+                    #{ 
+                        <<"id">> := _,
+                        <<"keys">> := 
+                            [
+                                #{ 
+                                    <<"name">> := <<"basic">>,
+                                    <<"value">> := <<"binary-value">>
+                                },
+                                #{ 
+                                    <<"name">> := <<"basic-2">>,
+                                    <<"value">> := <<"binary-value-2">> 
+                                }
+                            ] 
+                    } 
+            } 
+        },
+        Res
+    ).
+
+%%% Tests for the GraphQL interface of the dev_query module.
+%%% This test checks if the GraphQL query can be executed with variables.
+%%% NEED_TO_BE_FIXED: due to `application:ensure_all_started(graphql)` in `run/4`,
+%%% only one test can be run at a time, as it will load the schema and context.
+lookup_with_vars_test() ->
+    {ok, Opts, _} = dev_query:test_setup(),
+    Node = hb_http_server:start_node(Opts),
+    {ok, Res} =
+        hb_http:post(
+            Node,
+            #{
+                <<"path">> => <<"~query@1.0/graphql">>,
+                <<"content-type">> => <<"application/json">>,
+                <<"codec-device">> => <<"json@1.0">>,
+                <<"body">> =>
+                    hb_json:encode(#{
+                        <<"query">> => 
+                            <<""" 
+                                query GetMessage($keys: [KeyInput]) { 
+                                    message(
+                                        keys: $keys
+                                    ) {
+                                        id
+                                        keys {
+                                            name
+                                            value
+                                        }
+                                    }
+                                }
+                            """>>,
+                        <<"operationName">> => <<"GetMessage">>,
+                        <<"variables">> => #{
+                            <<"keys">> => 
+                                [
+                                    #{
+                                        <<"name">> => <<"basic">>,
+                                        <<"value">> => <<"binary-value">>
+                                    }
+                                ]
+                        }
+                    })
+            },
+            Opts
+        ),
+    Object = hb_json:decode(hb_maps:get(<<"body">>, Res, <<>>, Opts)),
+    ?event({test_response, Object}),
+    ?assertMatch(
+        #{ <<"data">> := 
+            #{ 
+                <<"message">> :=
+                    #{ 
+                        <<"id">> := _,
+                        <<"keys">> := 
+                            [
+                                #{ 
+                                    <<"name">> := <<"basic">>,
+                                    <<"value">> := <<"binary-value">>
+                                },
+                                #{ 
+                                    <<"name">> := <<"basic-2">>,
+                                    <<"value">> := <<"binary-value-2">> 
+                                }
+                            ] 
+                    } 
+            } 
+        },
+        Object
+    ).
+
+lookup_without_opname_test() ->
+    {ok, Opts, _} = dev_query:test_setup(),
+    Node = hb_http_server:start_node(Opts),
+    {ok, Res} =
+        hb_http:post(
+            Node,
+            #{
+                <<"path">> => <<"~query@1.0/graphql">>,
+                <<"content-type">> => <<"application/json">>,
+                <<"codec-device">> => <<"json@1.0">>,
+                <<"body">> =>
+                    hb_json:encode(#{
+                        <<"query">> => 
+                            <<""" 
+                                query($keys: [KeyInput]) { 
+                                    message(
+                                        keys: $keys
+                                    ) {
+                                        id
+                                        keys {
+                                            name
+                                            value
+                                        }
+                                    }
+                                }
+                            """>>,
+                        <<"variables">> => #{
+                            <<"keys">> => 
+                                [
+                                    #{
+                                        <<"name">> => <<"basic">>,
+                                        <<"value">> => <<"binary-value">>
+                                    }
+                                ]
+                        }
+                    })
+            },
+            Opts
+        ),
+    Object = hb_json:decode(hb_maps:get(<<"body">>, Res, <<>>, Opts)),
+    ?event({test_response, Object}),
+    ?assertMatch(
+        #{ <<"data">> := 
+            #{ 
+                <<"message">> :=
+                    #{ 
+                        <<"id">> := _,
+                        <<"keys">> := 
+                            [
+                                #{ 
+                                    <<"name">> := <<"basic">>,
+                                    <<"value">> := <<"binary-value">>
+                                },
+                                #{ 
+                                    <<"name">> := <<"basic-2">>,
+                                    <<"value">> := <<"binary-value-2">> 
+                                }
+                            ] 
+                    } 
+            } 
+        },
+        Object
+    ).
\ No newline at end of file
diff --git a/src/dev_query_test_vectors.erl b/src/dev_query_test_vectors.erl
new file mode 100644
index 000000000..98b4715ca
--- /dev/null
+++ b/src/dev_query_test_vectors.erl
@@ -0,0 +1,770 @@
+%%% @doc A suite of test queries and responses for the `~query@1.0' device's
+%%% GraphQL implementation.
+-module(dev_query_test_vectors).
+-include("include/hb.hrl").
+-include_lib("eunit/include/eunit.hrl").
+
+%%% Test helpers.
+
+write_test_message(Opts) ->
+    hb_cache:write(
+        Msg = hb_message:commit(
+            #{
+                <<"data-protocol">> => <<"ao">>,
+                <<"variant">> => <<"ao.N.1">>,
+                <<"type">> => <<"Message">>,
+                <<"action">> => <<"Eval">>,
+                <<"data">> => <<"test data">>
+            },
+            Opts,
+            #{
+                <<"commitment-device">> => <<"ans104@1.0">>
+            }
+        ),
+        Opts
+    ),
+    {ok, Msg}.
+
+%% @doc Populate the cache with three test blocks.
+get_test_blocks(Node) ->
+    InitialHeight = 1745749,
+    FinalHeight = 1745750,
+    lists:foreach(
+        fun(Height) ->
+            {ok, _} =
+                hb_http:request(
+                    <<"GET">>,
+                    Node,
+                    <<"/~arweave@2.9-pre/block=", (hb_util:bin(Height))/binary>>,
+                    #{}
+                )
+        end,
+        lists:seq(InitialHeight, FinalHeight)
+    ).
+
+%% Helper function to write test message with Recipient
+write_test_message_with_recipient(Recipient, Opts) ->
+    hb_cache:write(
+        Msg = hb_message:commit(
+            #{
+                <<"data-protocol">> => <<"ao">>,
+                <<"variant">> => <<"ao.N.1">>,
+                <<"type">> => <<"Message">>,
+                <<"action">> => <<"Eval">>,
+                <<"content-type">> => <<"text/plain">>,
+                <<"data">> => <<"test data">>,
+                <<"target">> => Recipient
+            },
+            Opts,
+            #{
+                <<"commitment-device">> => <<"ans104@1.0">>
+            }
+        ),
+        Opts
+    ),
+    {ok, Msg}.
+
+%%% Tests
+
+simple_blocks_query_test() ->
+    Opts =
+        #{
+            priv_wallet => hb:wallet(),
+            store => [hb_test_utils:test_store(hb_store_lmdb)]
+        },
+    Node = hb_http_server:start_node(Opts),
+    get_test_blocks(Node),
+    Query =
+        <<"""
+            query {
+                blocks(
+                    ids: ["V7yZNKPQLIQfUu8r8-lcEaz4o7idl6LTHn5AHlGIFF8TKfxIe7s_yFxjqan6OW45"]
+                ) {
+                    edges {
+                        node {
+                            id
+                            previous
+                            height
+                            timestamp
+                        }
+                    }
+                }
+            }
+        """>>,
+    ?assertMatch(
+        #{
+            <<"data">> := #{
+                <<"blocks">> := #{
+                    <<"edges">> := [
+                        #{
+                            <<"node">> := #{
+                                <<"id">> := _,
+                                <<"previous">> := _,
+                                <<"height">> := 1745749,
+                                <<"timestamp">> := 1756866695
+                            }
+                        }
+                    ]
+                }
+            }
+        },
+        dev_query_graphql:test_query(Node, Query, #{}, Opts)
+    ).
+
+block_by_height_query_test() ->
+    Opts =
+        #{
+            priv_wallet => hb:wallet(),
+            store => [hb_test_utils:test_store(hb_store_lmdb)]
+        },
+    Node = hb_http_server:start_node(Opts),
+    get_test_blocks(Node),
+    Query =
+        <<"""
+            query {
+                blocks( height: {min: 1745749, max: 1745750} ) {
+                    edges {
+                        node {
+                            id
+                            previous
+                            height
+                            timestamp
+                        }
+                    }
+                }
+            }
+        """>>,
+    ?assertMatch(
+        #{
+            <<"data">> := #{
+                <<"blocks">> := #{
+                    <<"edges">> := [
+                        #{
+                            <<"node">> := #{
+                                <<"id">> := _,
+                                <<"previous">> := _,
+                                <<"height">> := 1745749,
+                                <<"timestamp">> := 1756866695
+                            }
+                        },
+                        #{
+                            <<"node">> := #{
+                                <<"id">> := _,
+                                <<"previous">> := _,
+                                <<"height">> := 1745750,
+                                <<"timestamp">> := _
+                            }
+                        }
+                    ]
+                }
+            }
+        },
+        dev_query_graphql:test_query(Node, Query, #{}, Opts)
+    ).
+
+simple_ans104_query_test() ->
+    Opts =
+        #{
+            priv_wallet => hb:wallet(),
+            store => [hb_test_utils:test_store(hb_store_lmdb)]
+        },
+    Node = hb_http_server:start_node(Opts),
+    {ok, WrittenMsg} = write_test_message(Opts),
+    ?assertMatch(
+        {ok, [_]},
+        hb_cache:match(#{<<"type">> => <<"Message">>}, Opts)
+    ),
+    Query =
+        <<"""
+            query($owners: [String!]) {
+                transactions(
+                    tags:
+                        [
+                            {name: "type" values: ["Message"]},
+                            {name: "variant" values: ["ao.N.1"]}
+                        ],
+                        owners: $owners
+                    ) {
+                    edges {
+                        node {
+                            id,
+                            tags {
+                                name,
+                                value
+                            }
+                        }
+                    }
+                }
+            }
+        """>>,
+    Res =
+        dev_query_graphql:test_query(
+            Node,
+            Query,
+            #{
+                <<"owners">> => [hb:address()]
+            },
+            Opts
+        ),
+    ExpectedID = hb_message:id(WrittenMsg, all, Opts),
+    ?event({expected_id, ExpectedID}),
+    ?event({simple_ans104_query_test, Res}),
+    ?assertMatch(
+        #{
+            <<"data">> := #{
+                <<"transactions">> := #{
+                    <<"edges">> :=
+                        [#{
+                            <<"node">> :=
+                                #{
+                                    <<"id">> := ExpectedID,
+                                    <<"tags">> :=
+                                        [#{ <<"name">> := _, <<"value">> := _ }|_]
+                                }
+                        }]
+                }
+            }
+        } when ?IS_ID(ExpectedID),
+        Res
+    ).
+
+%% @doc Test transactions query with tags filter
+transactions_query_tags_test() ->
+    Opts =
+        #{
+            priv_wallet => hb:wallet(),
+            store => [hb_test_utils:test_store(hb_store_lmdb)]
+        },
+    Node = hb_http_server:start_node(Opts),
+    {ok, WrittenMsg} = write_test_message(Opts),
+    ?assertMatch(
+        {ok, [_]},
+        hb_cache:match(#{<<"type">> => <<"Message">>}, Opts)
+    ),
+    Query =
+        <<"""
+            query {
+                transactions(
+                    tags: [
+                        {name: "type", values: ["Message"]},
+                        {name: "variant", values: ["ao.N.1"]}
+                    ]
+                ) {
+                    edges {
+                        node {
+                            id
+                            tags {
+                                name
+                                value
+                            }
+                        }
+                    }
+                }
+            }
+        """>>,
+    Res =
+        dev_query_graphql:test_query(
+            Node,
+            Query,
+            #{},
+            Opts
+        ),
+    ExpectedID = hb_message:id(WrittenMsg, all, Opts),
+    ?event({expected_id, ExpectedID}),
+    ?event({transactions_query_tags_test, Res}),
+    ?assertMatch(
+        #{
+            <<"data">> := #{
+                <<"transactions">> := #{
+                    <<"edges">> :=
+                        [#{
+                            <<"node">> :=
+                                #{
+                                    <<"id">> := ExpectedID,
+                                    <<"tags">> :=
+                                        [#{ <<"name">> := _, <<"value">> := _ }|_]
+                                }
+                        }]
+                }
+            }
+        } when ?IS_ID(ExpectedID),
+        Res
+    ).
+
+%% @doc Test transactions query with owners filter
+transactions_query_owners_test() ->
+    Opts =
+        #{
+            priv_wallet => hb:wallet(),
+            store => [hb_test_utils:test_store(hb_store_lmdb)]
+        },
+    Node = hb_http_server:start_node(Opts),
+    {ok, WrittenMsg} = write_test_message(Opts),
+    ?assertMatch(
+        {ok, [_]},
+        hb_cache:match(#{<<"type">> => <<"Message">>}, Opts)
+    ),
+    Query =
+        <<"""
+            query($owners: [String!]) {
+                transactions(
+                    owners: $owners
+                ) {
+                    edges {
+                        node {
+                            id
+                            tags {
+                                name
+                                value
+                            }
+                        }
+                    }
+                }
+            }
+        """>>,
+    Res =
+        dev_query_graphql:test_query(
+            Node,
+            Query,
+            #{
+                <<"owners">> => [hb:address()]
+            },
+            Opts
+        ),
+    ExpectedID = hb_message:id(WrittenMsg, all, Opts),
+    ?event({expected_id, ExpectedID}),
+    ?event({transactions_query_owners_test, Res}),
+    ?assertMatch(
+        #{
+            <<"data">> := #{
+                <<"transactions">> := #{
+                    <<"edges">> :=
+                        [#{
+                            <<"node">> :=
+                                #{
+                                    <<"id">> := ExpectedID,
+                                    <<"tags">> :=
+                                        [#{ <<"name">> := _, <<"value">> := _ }|_]
+                                }
+                        }]
+                }
+            }
+        } when ?IS_ID(ExpectedID),
+        Res
+    ).
+
+%% @doc Test transactions query with recipients filter
+transactions_query_recipients_test() ->
+    Opts =
+        #{
+            priv_wallet => hb:wallet(),
+            store => [hb_test_utils:test_store(hb_store_lmdb)]
+        },
+    Node = hb_http_server:start_node(Opts),
+    Alice = ar_wallet:new(),
+    ?event({alice, Alice, {explicit, hb_util:human_id(Alice)}}),
+    AliceAddress = hb_util:human_id(Alice),
+    {ok, WrittenMsg} = write_test_message_with_recipient(AliceAddress, Opts),
+    ?assertMatch(
+        {ok, [_]},
+        hb_cache:match(#{<<"type">> => <<"Message">>}, Opts)
+    ),
+    Query =
+        <<"""
+            query($recipients: [String!]) {
+                transactions(
+                    recipients: $recipients
+                ) {
+                    edges {
+                        node {
+                            id
+                            tags {
+                                name
+                                value
+                            }
+                        }
+                    }
+                }
+            }
+        """>>,
+    Res =
+        dev_query_graphql:test_query(
+            Node,
+            Query,
+            #{
+                <<"recipients">> => [AliceAddress]
+            },
+            Opts
+        ),
+    ExpectedID = hb_message:id(WrittenMsg, all, Opts),
+    ?event({expected_id, ExpectedID}),
+    ?event({transactions_query_recipients_test, Res}),
+    ?assertMatch(
+        #{
+            <<"data">> := #{
+                <<"transactions">> := #{
+                    <<"edges">> :=
+                        [#{
+                            <<"node">> :=
+                                #{
+                                    <<"id">> := ExpectedID,
+                                    <<"tags">> :=
+                                        [#{ <<"name">> := _, <<"value">> := _ }|_]
+                                }
+                        }]
+                }
+            }
+        } when ?IS_ID(ExpectedID),
+        Res
+    ).
+
+%% @doc Test transactions query with ids filter
+transactions_query_ids_test() ->
+    Opts =
+        #{
+            priv_wallet => hb:wallet(),
+            store => [hb_test_utils:test_store(hb_store_lmdb)]
+        },
+    Node = hb_http_server:start_node(Opts),
+    {ok, WrittenMsg} = write_test_message(Opts),
+    ExpectedID = hb_message:id(WrittenMsg, all, Opts),
+    ?assertMatch(
+        {ok, [_]},
+        hb_cache:match(#{<<"type">> => <<"Message">>}, Opts)
+    ),
+    Query =
+        <<"""
+            query($ids: [ID!]) {
+                transactions(
+                    ids: $ids
+                ) {
+                    edges {
+                        node {
+                            id
+                            tags {
+                                name
+                                value
+                            }
+                        }
+                    }
+                }
+            }
+        """>>,
+    Res =
+        dev_query_graphql:test_query(
+            Node,
+            Query,
+            #{
+                <<"ids">> => [ExpectedID]
+            },
+            Opts
+        ),
+    ?event({expected_id, ExpectedID}),
+    ?event({transactions_query_ids_test, Res}),
+    ?assertMatch(
+        #{
+            <<"data">> := #{
+                <<"transactions">> := #{
+                    <<"edges">> :=
+                        [#{
+                            <<"node">> :=
+                                #{
+                                    <<"id">> := ExpectedID,
+                                    <<"tags">> :=
+                                        [#{ <<"name">> := _, <<"value">> := _ }|_]
+                                }
+                        }]
+                }
+            }
+        } when ?IS_ID(ExpectedID),
+        Res
+    ).
+
+%% @doc Test transactions query with combined filters
+transactions_query_combined_test() ->
+    Opts =
+        #{
+            priv_wallet => hb:wallet(),
+            store => [hb_test_utils:test_store(hb_store_lmdb)]
+        },
+    Node = hb_http_server:start_node(Opts),
+    {ok, WrittenMsg} = write_test_message(Opts),
+    ExpectedID = hb_message:id(WrittenMsg, all, Opts),
+    ?assertMatch(
+        {ok, [_]},
+        hb_cache:match(#{<<"type">> => <<"Message">>}, Opts)
+    ),
+    Query =
+        <<"""
+            query($owners: [String!], $ids: [ID!]) {
+                transactions(
+                    owners: $owners,
+                    ids: $ids,
+                    tags: [
+                        {name: "type", values: ["Message"]}
+                    ]
+                ) {
+                    edges {
+                        node {
+                            id
+                            tags {
+                                name
+                                value
+                            }
+                        }
+                    }
+                }
+            }
+        """>>,
+    Res =
+        dev_query_graphql:test_query(
+            Node,
+            Query,
+            #{
+                <<"owners">> => [hb:address()],
+                <<"ids">> => [ExpectedID]
+            },
+            Opts
+        ),
+    ?event({expected_id, ExpectedID}),
+    ?event({transactions_query_combined_test, Res}),
+    ?assertMatch(
+        #{
+            <<"data">> := #{
+                <<"transactions">> := #{
+                    <<"edges">> :=
+                        [#{
+                            <<"node">> :=
+                                #{
+                                    <<"id">> := ExpectedID,
+                                    <<"tags">> :=
+                                        [#{ <<"name">> := _, <<"value">> := _ }|_]
+                                }
+                        }]
+                }
+            }
+        } when ?IS_ID(ExpectedID),
+        Res
+    ).
+
+
+%% @doc Test single transaction query by ID
+transaction_query_by_id_test() ->
+    Opts =
+        #{
+            priv_wallet => hb:wallet(),
+            store => [hb_test_utils:test_store(hb_store_lmdb)]
+        },
+    Node = hb_http_server:start_node(Opts),
+    {ok, WrittenMsg} = write_test_message(Opts),
+    ExpectedID = hb_message:id(WrittenMsg, all, Opts),
+    ?assertMatch(
+        {ok, [_]},
+        hb_cache:match(#{<<"type">> => <<"Message">>}, Opts)
+    ),
+    Query =
+        <<"""
+            query($id: ID!) {
+                transaction(id: $id) {
+                    id
+                    tags {
+                        name
+                        value
+                    }
+                }
+            }
+        """>>,
+    Res =
+        dev_query_graphql:test_query(
+            Node,
+            Query,
+            #{
+                <<"id">> => ExpectedID
+            },
+            Opts
+        ),
+    ?event({expected_id, ExpectedID}),
+    ?event({transaction_query_by_id_test, Res}),
+    ?assertMatch(
+        #{
+            <<"data">> := #{
+                <<"transaction">> := #{
+                    <<"id">> := ExpectedID,
+                    <<"tags">> :=
+                        [#{ <<"name">> := _, <<"value">> := _ }|_]
+                }
+            }
+        } when ?IS_ID(ExpectedID),
+        Res
+    ).
+
+%% @doc Test single transaction query with more fields  
+transaction_query_full_test() ->
+    Opts =
+        #{
+            priv_wallet => SenderKey = hb:wallet(),
+            store => [hb_test_utils:test_store(hb_store_lmdb)]
+        },
+    Node = hb_http_server:start_node(Opts),
+    Alice = ar_wallet:new(),
+    ?event({alice, Alice, {explicit, hb_util:human_id(Alice)}}),
+    AliceAddress = hb_util:human_id(Alice),
+    SenderAddress = hb_util:human_id(SenderKey),
+    SenderPubKey = hb_util:encode(ar_wallet:to_pubkey(SenderKey)),
+    {ok, WrittenMsg} = write_test_message_with_recipient(AliceAddress, Opts),
+    ExpectedID = hb_message:id(WrittenMsg, all, Opts),
+    ?assertMatch(
+        {ok, [_]},
+        hb_cache:match(#{<<"type">> => <<"Message">>}, Opts)
+    ),
+    Query =
+        <<"""
+            query($id: ID!) {
+                transaction(id: $id) {
+                    id
+                    anchor
+                    signature
+                    recipient
+                    owner {
+                        address
+                        key
+                    }
+                    tags {
+                        name
+                        value
+                    }
+                    data {
+                        size
+                        type
+                    }
+                }
+            }
+        """>>,
+    Res =
+        dev_query_graphql:test_query(
+            Node,
+            Query,
+            #{
+                <<"id">> => ExpectedID
+            },
+            Opts
+        ),
+    ?event({expected_id, ExpectedID}),
+    ?event({transaction_query_full_test, Res}),
+    ?assertMatch(
+        #{
+            <<"data">> := #{
+                <<"transaction">> := #{
+                    <<"id">> := ExpectedID,
+                    <<"recipient">> := AliceAddress,
+                    <<"anchor">> := <<"">>,
+                    <<"owner">> := #{
+                        <<"address">> := SenderAddress,
+                        <<"key">> := SenderPubKey
+                    },
+                    <<"data">> := #{
+                        <<"size">> := <<"9">>,
+                        <<"type">> := <<"text/plain">>
+                    },
+                    <<"tags">> :=
+                        [#{ <<"name">> := _, <<"value">> := _ }|_]
+                    % Note: other fields may be "Not implemented." for now
+                }
+            }
+        } when ?IS_ID(ExpectedID),
+        Res
+    ).
+
+%% @doc Test single transaction query with non-existent ID
+transaction_query_not_found_test() ->
+    Opts =
+        #{
+            priv_wallet => hb:wallet(),
+            store => [hb_test_utils:test_store(hb_store_lmdb)]
+        },
+    Res =
+        dev_query_graphql:test_query(
+            hb_http_server:start_node(Opts),
+            <<"""
+                query($id: ID!) {
+                    transaction(id: $id) {
+                        id
+                        tags {
+                            name
+                            value
+                        }
+                    }
+                }
+            """>>,
+            #{
+                <<"id">> => hb_util:encode(crypto:strong_rand_bytes(32))
+            },
+            Opts
+        ),
+    % Should return null for non-existent transaction
+    ?assertMatch(
+        #{
+            <<"data">> := #{
+                <<"transaction">> := null
+            }
+        },
+        Res
+    ).
+
+%% @doc Test parsing, storing, and querying a transaction with an anchor.
+transaction_query_with_anchor_test() ->
+    Opts =
+        #{
+            priv_wallet => hb:wallet(),
+            store => [hb_test_utils:test_store(hb_store_lmdb)]
+        },
+    Node = hb_http_server:start_node(Opts),
+    {ok, ID} =
+        hb_cache:write(
+            hb_message:convert(
+                ar_bundles:sign_item(
+                    #tx {
+                        anchor = AnchorID = crypto:strong_rand_bytes(32),
+                        data = <<"test-data">>
+                    },
+                    hb:wallet()
+                ),
+                <<"structured@1.0">>,
+                <<"ans104@1.0">>,
+                Opts
+            ),
+            Opts
+        ),
+    EncodedAnchor = hb_util:encode(AnchorID),
+    Query =
+        <<"""
+            query($id: ID!) {
+                transaction(id: $id) {
+                    data {
+                        size
+                        type
+                    }
+                    anchor
+                }
+            }
+        """>>,
+    Res =
+        dev_query_graphql:test_query(
+            Node,
+            Query,
+            #{
+                <<"id">> => ID
+            },
+            Opts
+        ),
+    ?event({transaction_query_with_anchor_test, Res}),
+    ?assertMatch(
+        #{
+            <<"data">> := #{
+                <<"transaction">> := #{
+                    <<"anchor">> := EncodedAnchor
+                }
+            }
+        },
+        Res
+    ).
\ No newline at end of file
diff --git a/src/dev_relay.erl b/src/dev_relay.erl
index cfe4b322c..0cc7d4373 100644
--- a/src/dev_relay.erl
+++ b/src/dev_relay.erl
@@ -27,60 +27,141 @@
 %% - `target': The target message to relay. Defaults to the original message.
 %% - `relay-path': The path to relay the message to. Defaults to the original path.
 %% - `method': The method to use for the request. Defaults to the original method.
-%% - `requires-sign': Whether the request requires signing before dispatching.
+%% - `commit-request': Whether the request should be committed before dispatching.
 %% Defaults to `false'.
 call(M1, RawM2, Opts) ->
+    ?event({relay_call, {m1, M1}, {raw_m2, RawM2}}),
     {ok, BaseTarget} = hb_message:find_target(M1, RawM2, Opts),
+    ?event({relay_call, {message_to_relay, BaseTarget}}),
     RelayPath =
         hb_ao:get_first(
             [
-                {BaseTarget, <<"path">>},
+                {M1, <<"path">>},
+                {{as, <<"message@1.0">>, BaseTarget}, <<"path">>},
                 {RawM2, <<"relay-path">>},
-                {M1, <<"relay-path">>},
-                {M1, <<"path">>}
+                {M1, <<"relay-path">>}
+            ],
+            Opts
+        ),
+    RelayDevice =
+        hb_ao:get_first(
+            [
+                {M1, <<"relay-device">>},
+                {{as, <<"message@1.0">>, BaseTarget}, <<"relay-device">>},
+                {RawM2, <<"relay-device">>}
+            ],
+            Opts
+        ),
+    RelayPeer =
+        hb_ao:get_first(
+            [
+                {M1, <<"peer">>},
+                {{as, <<"message@1.0">>, BaseTarget}, <<"peer">>},
+                {RawM2, <<"peer">>}
             ],
             Opts
         ),
     RelayMethod =
         hb_ao:get_first(
             [
-                {BaseTarget, <<"method">>},
+                {M1, <<"method">>},
+                {{as, <<"message@1.0">>, BaseTarget}, <<"method">>},
                 {RawM2, <<"relay-method">>},
                 {M1, <<"relay-method">>},
-                {RawM2, <<"method">>},
-                {M1, <<"method">>}
+                {RawM2, <<"method">>}
             ],
             Opts
         ),
     RelayBody =
         hb_ao:get_first(
             [
-                {BaseTarget, <<"body">>},
+                {M1, <<"body">>},
+                {{as, <<"message@1.0">>, BaseTarget}, <<"body">>},
                 {RawM2, <<"relay-body">>},
                 {M1, <<"relay-body">>},
-                {RawM2, <<"body">>},
-                {M1, <<"body">>}
+                {RawM2, <<"body">>}
             ],
             Opts
         ),
-    TargetMod1 = BaseTarget#{
-        <<"method">> => RelayMethod,
-        <<"body">> => RelayBody,
-        <<"path">> => RelayPath
-    },
+    Commit =
+        hb_ao:get_first(
+            [
+                {{as, <<"message@1.0">>, BaseTarget}, <<"commit-request">>},
+                {RawM2, <<"relay-commit-request">>},
+                {M1, <<"relay-commit-request">>},
+                {RawM2, <<"commit-request">>},
+                {M1, <<"commit-request">>}
+            ],
+            false,
+            Opts
+        ),
+    TargetMod1 =
+        if RelayBody == not_found -> BaseTarget;
+        true -> BaseTarget#{<<"body">> => RelayBody}
+        end,
     TargetMod2 =
-        case hb_ao:get(<<"requires-sign">>, BaseTarget, false, Opts) of
-            true -> hb_message:commit(TargetMod1, Opts);
-            false -> TargetMod1
+        TargetMod1#{
+            <<"method">> => RelayMethod,
+            <<"path">> => RelayPath
+        },
+    TargetMod3 =
+        case RelayDevice of
+            not_found -> hb_maps:without([<<"device">>], TargetMod2);
+            _ -> TargetMod2#{<<"device">> => RelayDevice}
         end,
+    TargetMod4 = 
+        hb_maps:without(
+            [<<"commitments">>],
+            TargetMod3,
+            Opts
+        ),
+    TargetMod5 =
+        case Commit of
+            true ->
+                case hb_opts:get(relay_allow_commit_request, false, Opts) of
+                    true ->
+                        ?event(debug_relay, {recommitting, TargetMod4}, Opts),
+                        Committed = hb_message:commit(TargetMod4, Opts),
+                        ?event(debug_relay, {relay_call, {committed, Committed}}, Opts),
+                        true = hb_message:verify(Committed, all),
+                        Committed;
+                    false ->
+                        throw(relay_commit_request_not_allowed)
+                end;
+            false -> TargetMod4
+        end,
+    ?event(debug_relay, {relay_call, {without_http_params, TargetMod4}}),
+    ?event(debug_relay, {relay_call, {with_http_params, TargetMod5}}),
+    true = hb_message:verify(TargetMod5),
+
+    ?event(debug_relay, {relay_call, {verified, true}}),
     Client =
-        case hb_ao:get(<<"http-client">>, BaseTarget, Opts) of
+        case hb_maps:get(<<"http-client">>, BaseTarget, not_found, Opts) of
             not_found -> hb_opts:get(relay_http_client, Opts);
             RequestedClient -> RequestedClient
         end,
-    ?event({relaying_message, TargetMod2}),
-    % Let `hb_http:request/2' handle finding the peer and dispatching the request.
-    hb_http:request(TargetMod2, Opts#{ http_client => Client }).
+    % Let `hb_http:request/2' handle finding the peer and dispatching the
+    % request, unless the peer is explicitly given.
+    HTTPOpts = Opts#{ http_client => Client, http_only_result => false },
+    Res = case RelayPeer of
+        not_found ->
+            hb_http:request(TargetMod5, HTTPOpts);
+        _ ->
+            ?event(debug_relay, {relaying_to_peer, RelayPeer}),
+            hb_http:request(
+                RelayMethod,
+                RelayPeer,
+                RelayPath,
+                TargetMod5,
+                HTTPOpts
+            )
+    end,
+    case Res of
+        {ok, R} ->
+            {ok, hb_maps:without([<<"set-cookie">>], R)};
+        Err -> Err
+    end.
+
 
 %% @doc Execute a request in the same way as `call/3', but asynchronously. Always
 %% returns `<<"OK">>'.
@@ -122,48 +203,105 @@ call_get_test() ->
         ),
     ?assertEqual(true, byte_size(Body) > 10_000).
 
-%% @doc Test that the `preprocess/3' function re-routes a request to remote
-%% peers, according to the node's routing table.
-request_hook_reroute_to_nearest_test() ->
-    Peer1 = <<"https://compute-1.forward.computer">>,
-    Peer2 = <<"https://compute-2.forward.computer">>,
-    HTTPSOpts = #{ http_client => httpc },
-    {ok, Address1} = hb_http:get(Peer1, <<"/~meta@1.0/info/address">>, HTTPSOpts),
-    {ok, Address2} = hb_http:get(Peer2, <<"/~meta@1.0/info/address">>, HTTPSOpts),
+relay_nearest_test() ->
+    Peer1 = hb_http_server:start_node(#{ priv_wallet => W1 = ar_wallet:new() }),
+    Peer2 = hb_http_server:start_node(#{ priv_wallet => W2 = ar_wallet:new() }),
+    Address1 = hb_util:human_id(ar_wallet:to_address(W1)),
+    Address2 = hb_util:human_id(ar_wallet:to_address(W2)),
     Peers = [Address1, Address2],
     Node =
-        hb_http_server:start_node(#{
+        hb_http_server:start_node(Opts = #{
+            store => hb_opts:get(store),
             priv_wallet => ar_wallet:new(),
+            routes => [
+                #{
+                    <<"template">> => <<"/.*">>,
+                    <<"strategy">> => <<"Nearest">>,
+                    <<"nodes">> => [
+                        #{
+                            <<"prefix">> => Peer1,
+                            <<"wallet">> => Address1
+                        },
+                        #{
+                            <<"prefix">> => Peer2,
+                            <<"wallet">> => Address2
+                        }
+                    ]
+                }
+            ]
+        }),
+    {ok, RelayRes} =
+        hb_http:get(
+            Node,
+            <<"/~relay@1.0/call?relay-path=/~meta@1.0/info">>,
+            Opts#{ http_only_result => false }
+        ),
+    ?event(
+        {relay_res,
+            {response, RelayRes},
+            {signer, hb_message:signers(RelayRes, Opts)},
+            {peers, Peers}
+        }
+    ),
+    HasValidSigner =
+        lists:any(
+            fun(Peer) ->
+                lists:member(Peer, hb_message:signers(RelayRes, Opts))
+            end,
+            Peers
+        ),
+    ?assert(HasValidSigner).
+
+%% @doc Test that a `relay@1.0/call' correctly commits requests as specified.
+%% We validate this by configuring two nodes: One that will execute a given
+%% request from a user, but only if the request is committed. The other node
+%% re-routes all requests to the first node, using `call`'s `commit-request'
+%% key to sign the request during proxying. The initial request is not signed,
+%% such that the first node would otherwise reject the request outright.
+commit_request_test() ->
+    Port = 10000 + rand:uniform(10000),
+    Wallet = ar_wallet:new(),
+    Executor =
+        hb_http_server:start_node(
+            #{
+                port => Port,
+                force_signed_requests => true
+            }
+        ),
+    Node =
+        hb_http_server:start_node(#{
+            priv_wallet => Wallet,
+            relay_allow_commit_request => true,
             routes =>
                 [
                     #{
-                        <<"template">> => <<"/.*~process@1.0/.*">>,
+                        <<"template">> => <<"/test-key">>,
                         <<"strategy">> => <<"Nearest">>,
                         <<"nodes">> => [
                             #{
-                                <<"prefix">> => Peer1,
-                                <<"wallet">> => Address1
-                            },
-                            #{
-                                <<"prefix">> => Peer2,
-                                <<"wallet">> => Address2
+                                <<"wallet">> => hb_util:human_id(Wallet),
+                                <<"prefix">> => Executor
                             }
                         ]
                     }
                 ],
-            on => #{ <<"request">> => #{ <<"device">> => <<"relay@1.0">> } }
+            on => #{
+                <<"request">> =>
+                    #{
+                        <<"device">> => <<"router@1.0">>,
+                        <<"path">> => <<"preprocess">>,
+                        <<"commit-request">> => true
+                    }
+                }
         }),
     {ok, Res} =
         hb_http:get(
             Node,
-            <<"/CtOVB2dBtyN_vw3BdzCOrvcQvd9Y1oUGT-zLit8E3qM~process@1.0/slot">>,
+            #{
+                <<"path">> => <<"test-key">>,
+                <<"test-key">> => <<"value">>
+            },
             #{}
         ),
     ?event({res, Res}),
-    HasValidSigner = lists:any(
-        fun(Peer) ->
-            lists:member(Peer, hb_message:signers(Res))
-        end,
-        Peers
-    ),
-    ?assert(HasValidSigner).
\ No newline at end of file
+    ?assertEqual(<<"value">>, Res).
\ No newline at end of file
diff --git a/src/dev_router.erl b/src/dev_router.erl
index a7ff1c9b3..6394a425f 100644
--- a/src/dev_router.erl
+++ b/src/dev_router.erl
@@ -32,7 +32,17 @@
 %% @doc Exported function for getting device info, controls which functions are
 %% exposed via the device API.
 info(_) -> 
-    #{ exports => [info, routes, route, match, register, preprocess] }.
+    #{
+        exports =>
+            [
+                <<"info">>,
+                <<"routes">>,
+                <<"route">>,
+                <<"match">>,
+                <<"register">>,
+                <<"preprocess">>
+            ]
+    }.
 
 %% @doc HTTP info response providing information about this device
 info(_Msg1, _Msg2, _Opts) ->
@@ -58,11 +68,16 @@ info(_Msg1, _Msg2, _Opts) ->
             },
             <<"register">> => #{
                 <<"description">> => <<"Register a route with a remote router node">>,
-                <<"required_node_opts">> => #{
-                    <<"router_peer_location">> => <<"Location of the router peer">>,
-                    <<"router_prefix">> => <<"Prefix for the route">>,
-                    <<"router_price">> => <<"Price for the route">>,
-                    <<"router_template">> => <<"Template to match the route">>
+                <<"node-message">> => #{
+                    <<"routes">> => 
+                        [
+                            #{
+                                <<"registration-peer">> => <<"Location of the router peer">>,
+                                <<"prefix">> => <<"Prefix for the route">>,
+                                <<"price">> => <<"Price for the route">>,
+                                <<"template">> => <<"Template to match the route">>
+                            }
+                        ]
                 }
             },
             <<"preprocess">> => #{
@@ -70,76 +85,57 @@ info(_Msg1, _Msg2, _Opts) ->
             }
         }
     },
-    {ok, #{<<"status">> => 200, <<"body">> => InfoBody}}.
+    {ok, InfoBody}.
 
-%% A exposed register function that allows telling the current node to register
-%% a new route with a remote router node. This function should also be itempotent
+%% @doc Register function that allows telling the current node to register
+%% a new route with a remote router node. This function should also be idempotent.
 %% so that it can be called only once.
-register(_M1, _M2, Opts) ->
-    Registered = hb_opts:get(router_registered, false, Opts),
-    % Check if the route is already registered
-    case Registered of
-        true ->
-            {error, <<"Route already registered.">>};
-        false ->
-            % Validate node history
-            case hb_opts:validate_node_history(Opts) of
-                {ok, _} ->
-                    RouterNode = hb_opts:get(<<"router_peer_location">>, not_found, Opts),
-                    Prefix = hb_opts:get(<<"router_prefix">>, not_found, Opts),
-                    Price = hb_opts:get(<<"router_price">>, not_found, Opts),
-                    Template = hb_opts:get(<<"router_template">>, not_found, Opts),
-                    {ok, Attestion} = dev_snp:generate(
-                        #{}, 
-                        #{}, 
-                        #{ 
-                            priv_wallet => hb:wallet(), 
-                            snp_trusted => hb_opts:get(snp_trusted, [#{}], Opts)
-                        }
+register(_M1, M2, Opts) ->
+    %% Extract all required parameters from options
+    %% These values will be used to construct the registration message
+    RouterOpts = hb_opts:get(router_opts, #{}, Opts),
+    RouterRegMsgs =
+        case hb_maps:get(<<"offered">>, RouterOpts, #{}, Opts) of
+            RegList when is_list(RegList) -> RegList;
+            RegMsg when is_map(RegMsg) -> [RegMsg]
+        end,
+    lists:foreach(
+        fun(RegMsg) ->
+            RouterNode =
+                hb_ao:get(
+                    <<"registration-peer">>,
+                    RegMsg,
+                    not_found,
+                    Opts
+                ),
+            {ok, SigOpts} =
+                case hb_ao:get(<<"as">>, M2, not_found, Opts) of
+                    not_found -> {ok, Opts};
+                    AsID -> hb_opts:as(AsID, Opts)
+                end,
+            % Post registration request to the router node
+            % The message includes our route details and attestation
+            % for verification
+            {ok, Res} =
+                hb_http:post(
+                    RouterNode,
+                    <<"/~router@1.0/routes">>,
+                    hb_message:commit(
+                        #{
+                            <<"subject">> => <<"self">>,
+                            <<"action">> => <<"register">>,
+                            <<"route">> => RegMsg
+                        },
+                        SigOpts
                     ),
-                    ?event(debug_register, {attestion, Attestion}),
-                    % Check if any required parameters are missing
-                    case hb_opts:check_required_opts([
-                        {<<"router_peer_location">>, RouterNode},
-                        {<<"router_prefix">>, Prefix},
-                        {<<"router_price">>, Price},
-                        {<<"router_template">>, Template}
-                    ], Opts) of
-                        {ok, _} ->
-                            case hb_http:post(RouterNode, #{
-                                <<"path">> => <<"/router~node-process@1.0/schedule">>,
-                                <<"method">> => <<"POST">>,
-                                <<"body">> =>
-                                    hb_message:commit(
-                                        #{
-                                            <<"path">> => <<"register">>,
-                                            <<"route">> =>
-                                                #{
-                                                    <<"prefix">> => Prefix,
-                                                    <<"template">> => Template,
-                                                    <<"price">> => Price
-                                                },
-                                            <<"body">> => Attestion
-                                        },
-                                        Opts
-                                    )
-                            }, Opts) of
-                                {ok, _} ->
-                                    hb_http_server:set_opts(
-                                        Opts#{ router_registered => true }
-                                    ),
-                                    {ok, <<"Route registered.">>};
-                                {error, _} ->
-                                    {error, <<"Failed to register route.">>}
-                            end;
-                        {error, ErrorMsg} ->
-                            {error, ErrorMsg}
-                    end;
-                {error, Reason} ->
-                    % Node history validation failed
-                    {error, Reason}
-            end
-    end.
+                    Opts
+                ),
+            ?event({registered, {msg, M2}, {res, Res}}),
+            {ok, <<"Route registered.">>}
+        end,
+        RouterRegMsgs
+    ),
+    {ok, <<"Routes registered.">>}.
 
 %% @doc Device function that returns all known routes.
 routes(M1, M2, Opts) ->
@@ -148,30 +144,65 @@ routes(M1, M2, Opts) ->
     ?event({routes, Routes}),
     case hb_ao:get(<<"method">>, M2, Opts) of
         <<"POST">> ->
-            Owner = hb_opts:get(operator, undefined, Opts),
-            RouteOwners = hb_opts:get(route_owners, [Owner], Opts),
-            Signers = hb_message:signers(M2),
-            IsTrusted =
-                lists:any(
-                    fun(Signer) -> lists:member(Signer, Signers) end,
-                    RouteOwners
-                ),
-            case IsTrusted of
-                true ->
-                    % Minimize the work performed by AO-Core to make the sort
-                    % more efficient.
-                    SortOpts = Opts#{ hashpath => ignore },
-                    NewRoutes =
-                        lists:sort(
-                            fun(X, Y) ->
-                                hb_ao:get(<<"priority">>, X, SortOpts)
-                                    < hb_ao:get(<<"priority">>, Y, SortOpts)
-                            end,
-                            [M2|Routes]
+            RouterOpts = hb_opts:get(router_opts, #{}, Opts),
+            ?event(debug_route_reg, {router_opts, RouterOpts}),
+            case hb_maps:get(<<"registrar">>, RouterOpts, not_found, Opts) of
+                not_found ->
+                    % There is no registrar; register if and only if the message
+                    % is signed by an authorized operator.
+                    ?event(debug_route_reg, no_registrar),
+                    Owner = hb_opts:get(operator, undefined, Opts),
+                    RouteOwners = hb_opts:get(route_owners, [Owner], Opts),
+                    Signers = hb_message:signers(M2, Opts),
+                    IsTrusted =
+                        lists:any(
+                            fun(Signer) -> lists:member(Signer, Signers) end,
+                            RouteOwners
                         ),
-                    ok = hb_http_server:set_opts(Opts#{ routes => NewRoutes }),
-                    {ok, <<"Route added.">>};
-                false -> {error, not_authorized}
+                    case IsTrusted of
+                        true ->
+                            % Minimize the work performed by AO-Core to make the sort
+                            % more efficient.
+                            SortOpts = Opts#{ hashpath => ignore },
+                            NewRoutes =
+                                lists:sort(
+                                    fun(X, Y) ->
+                                        hb_ao:get(<<"priority">>, X, SortOpts)
+                                            < hb_ao:get(<<"priority">>, Y, SortOpts)
+                                    end,
+                                    [M2|Routes]
+                                ),
+                            ok = hb_http_server:set_opts(Opts#{ routes => NewRoutes }),
+                            {ok, <<"Route added.">>};
+                        false -> {error, not_authorized}
+                    end;
+                Registrar ->
+                    % Parse the registrar message and execute the route 
+                    % registration against it.
+                    RegistrarPath =
+                        hb_maps:get(
+                            <<"registrar-path">>,
+                            RouterOpts,
+                            not_found,
+                            Opts
+                        ),
+                    ?event(debug_route_reg,
+                        {registrar_found, {msg, Registrar}, {path, RegistrarPath}}
+                    ),
+                    RegReq =
+                        case RegistrarPath of
+                            not_found -> M2;
+                            RegPath ->
+                                M2#{ <<"path">> => RegPath }
+                        end,
+                    RegistrarMsgs = hb_singleton:from(Registrar, Opts) ++ [RegReq],
+                    ?event(debug_route_reg, {registrar_msgs, RegistrarMsgs}),
+                    case hb_ao:resolve_many(RegistrarMsgs, Opts) of
+                        {ok, _} ->
+                            {ok, <<"Route added.">>};
+                        {error, Error} ->
+                            {error, Error}
+                    end
             end;
         _ ->
             {ok, Routes}
@@ -207,7 +238,7 @@ route(_, Msg, Opts) ->
     case (R =/= no_matches) andalso hb_ao:get(<<"node">>, R, Opts) of
         false -> {error, no_matches};
         Node when is_binary(Node) -> {ok, Node};
-        Node when is_map(Node) -> apply_route(Msg, Node);
+        Node when is_map(Node) -> apply_route(Msg, Node, Opts);
         not_found ->
             ModR = apply_routes(Msg, R, Opts),
             case hb_ao:get(<<"strategy">>, R, Opts) of
@@ -229,17 +260,18 @@ route(_, Msg, Opts) ->
                     }),
                     case Chosen of
                         [Node] when is_map(Node) ->
-                            apply_route(Msg, Node);
+                            apply_route(Msg, Node, Opts);
                         [NodeURI] -> {ok, NodeURI};
                         _ChosenNodes ->
                             {ok,
                                 hb_ao:set(
                                     <<"nodes">>,
-                                    maps:map(
+                                    hb_maps:map(
                                         fun(Node) ->
-                                            hb_util:ok(apply_route(Msg, Node))
+                                            hb_util:ok(apply_route(Msg, Node, Opts))
                                         end,
-                                        Chosen
+                                        Chosen,
+                                        Opts
                                     ),
                                     Opts
                                 )
@@ -248,26 +280,18 @@ route(_, Msg, Opts) ->
             end
     end.
 
-%% @doc Find the target path to route for a request message.
-find_target_path(Msg, Opts) ->
-    case hb_ao:get(<<"route-path">>, Msg, not_found, Opts) of
-        not_found ->
-            ?event({find_target_path, {msg, Msg}, {opts, Opts}, not_found}),
-            hb_ao:get(<<"path">>, Msg, no_path, Opts);
-        RoutePath -> RoutePath
-    end.
-
 %% @doc Load the current routes for the node. Allows either explicit routes from
 %% the node message's `routes' key, or dynamic routes generated by resolving the
-%% `route_provider' message.
+%% `<<"provider">>' message.
 load_routes(Opts) ->
-    case hb_opts:get(route_provider, not_found, Opts) of
+    RouterOpts = hb_opts:get(router_opts, #{}, Opts),
+    case hb_maps:get(<<"provider">>, RouterOpts, not_found, Opts) of
         not_found -> hb_opts:get(routes, [], Opts);
         RoutesProvider ->
-            ProviderMsgs = hb_singleton:from(RoutesProvider),
-            ?event({route_provider, ProviderMsgs}),
+            ProviderMsgs = hb_singleton:from(RoutesProvider, Opts),
+            ?event({<<"provider">>, ProviderMsgs}),
             case hb_ao:resolve_many(ProviderMsgs, Opts) of
-                {ok, Routes} -> Routes;
+                {ok, Routes} -> hb_cache:ensure_all_loaded(Routes, Opts);
                 {error, Error} -> throw({routes, routes_provider_failed, Error})
             end
     end.
@@ -293,16 +317,16 @@ apply_routes(Msg, R, Opts) ->
     NodesWithRouteApplied =
         lists:map(
             fun(N) ->
-                ?event(debug, {apply_route, {msg, Msg}, {node, N}}),
-                case apply_route(Msg, N) of
+                ?event({apply_route, {msg, Msg}, {node, N}}),
+                case apply_route(Msg, N, Opts) of
                     {ok, URI} when is_binary(URI) -> N#{ <<"uri">> => URI };
-                    {ok, RMsg} -> maps:merge(N, RMsg);
+                    {ok, RMsg} -> hb_maps:merge(N, RMsg);
                     {error, _} -> N
                 end
             end,
-            hb_util:message_to_ordered_list(Nodes)
+            hb_util:message_to_ordered_list(Nodes, Opts)
         ),
-    ?event(debug, {nodes_after_apply, NodesWithRouteApplied}),
+    ?event({nodes_after_apply, NodesWithRouteApplied}),
     R#{ <<"nodes">> => NodesWithRouteApplied }.
 
 %% @doc Apply a node map's rules for transforming the path of the message.
@@ -310,38 +334,60 @@ apply_routes(Msg, R, Opts) ->
 %% - `opts': A map of options to pass to the request.
 %% - `prefix': The prefix to add to the path.
 %% - `suffix': The suffix to add to the path.
-%% - `replace': A regex to replace in the path.
-apply_route(Msg, Route = #{ <<"opts">> := Opts }) ->
+%% - `match' and `with': A regex to replace in the path.
+apply_route(Msg, Route, Opts) ->
+    % LoadedRoute = hb_cache:ensure_all_loaded(Route, Opts),
+    RouteOpts = hb_maps:get(<<"opts">>, Route, #{}),
     {ok, #{
-        <<"opts">> => Opts,
-        <<"uri">> => hb_util:ok(apply_route(Msg, maps:without([<<"opts">>], Route)))
-    }};
-apply_route(#{ <<"route-path">> := Path }, R) ->
-    apply_route(#{ <<"path">> => Path }, R);
-apply_route(#{ <<"path">> := Path }, #{ <<"prefix">> := Prefix }) ->
+        <<"opts">> => RouteOpts,
+        <<"uri">> =>
+            hb_util:ok(
+                do_apply_route(
+                    Msg,
+                    hb_maps:without([<<"opts">>], Route, Opts),
+                    Opts
+                )
+            )
+    }}.
+do_apply_route(#{ <<"route-path">> := Path }, R, Opts) ->
+    do_apply_route(#{ <<"path">> => Path }, R, Opts);
+do_apply_route(#{ <<"path">> := RawPath }, #{ <<"prefix">> := RawPrefix }, Opts) ->
+    Path = hb_cache:ensure_loaded(RawPath, Opts),
+    Prefix = hb_cache:ensure_loaded(RawPrefix, Opts),
     {ok, <<Prefix/binary, Path/binary>>};
-apply_route(#{ <<"path">> := Path }, #{ <<"suffix">> := Suffix }) ->
+do_apply_route(#{ <<"path">> := RawPath }, #{ <<"suffix">> := RawSuffix }, Opts) ->
+    Path = hb_cache:ensure_loaded(RawPath, Opts),
+    Suffix = hb_cache:ensure_loaded(RawSuffix, Opts),
     {ok, <<Path/binary, Suffix/binary>>};
-apply_route(#{ <<"path">> := Path }, #{ <<"match">> := Match, <<"with">> := With }) ->
+do_apply_route(
+        #{ <<"path">> := RawPath },
+        #{ <<"match">> := RawMatch, <<"with">> := RawWith },
+        Opts) ->
+    Path = hb_cache:ensure_loaded(RawPath, Opts),
+    Match = hb_cache:ensure_loaded(RawMatch, Opts),
+    With = hb_cache:ensure_loaded(RawWith, Opts),
     % Apply the regex to the path and replace the first occurrence.
-    case re:replace(Path, Match, With, [global]) of
+    case re:replace(Path, Match, With, [global, {return, binary}]) of
         NewPath when is_binary(NewPath) ->
             {ok, NewPath};
-        _ -> {error, invalid_replace_args}
+        _ ->
+            {error, invalid_replace_args}
     end.
 
 %% @doc Find the first matching template in a list of known routes. Allows the
 %% path to be specified by either the explicit `path' (for internal use by this
 %% module), or `route-path' for use by external devices and users.
 match(Base, Req, Opts) ->
-    ?event(debug_preprocess, {routeReq, Req}),
     ?event(debug_preprocess,
-        {routes,
-            hb_ao:get(<<"routes">>, {as, <<"message@1.0">>, Base}, [], Opts)}
-        ),
+        {matching_routes,
+            {base, Base},
+            {req, Req}
+        }
+    ),
+    TargetPath = hb_util:find_target_path(Req, Opts),
     Match =
         match_routes(
-            Req#{ <<"path">> => find_target_path(Req, Opts) },
+            Req#{ <<"path">> => TargetPath },
             hb_ao:get(<<"routes">>, {as, <<"message@1.0">>, Base}, [], Opts),
             Opts
         ),
@@ -352,9 +398,9 @@ match(Base, Req, Opts) ->
 
 match_routes(ToMatch, Routes, Opts) ->
     match_routes(
-        ToMatch,
-        Routes,
-        hb_ao:keys(hb_ao:normalize_keys(Routes)),
+        hb_cache:ensure_all_loaded(ToMatch, Opts),
+        hb_cache:ensure_all_loaded(Routes, Opts),
+        hb_ao:keys(hb_ao:normalize_keys(Routes, Opts)),
         Opts
     ).
 match_routes(#{ <<"path">> := Explicit = <<"http://", _/binary>> }, _, _, _) ->
@@ -372,27 +418,18 @@ match_routes(ToMatch, Routes, [XKey|Keys], Opts) ->
             #{},
             Opts#{ hashpath => ignore }
         ),
-    case template_matches(ToMatch, Template, Opts) of
+    case hb_util:template_matches(ToMatch, Template, Opts) of
         true -> XM#{ <<"reference">> => hb_path:to_binary([<<"routes">>, XKey]) };
         false -> match_routes(ToMatch, Routes, Keys, Opts)
     end.
 
-%% @doc Check if a message matches a message template or path regex.
-template_matches(ToMatch, Template, _Opts) when is_map(Template) ->
-    hb_message:match(Template, ToMatch, primary);
-template_matches(ToMatch, Regex, Opts) when is_binary(Regex) ->
-    MsgPath = find_target_path(ToMatch, Opts),
-    Matches = hb_path:regex_matches(MsgPath, Regex),
-    ?event(debug_template_matches, {matches, Matches, msg_path, MsgPath, regex, Regex}),
-    Matches.
-
 %% @doc Implements the load distribution strategies if given a cluster.
 choose(0, _, _, _, _) -> [];
 choose(N, <<"Random">>, _, Nodes, _Opts) ->
     Node = lists:nth(rand:uniform(length(Nodes)), Nodes),
     [Node | choose(N - 1, <<"Random">>, nop, lists:delete(Node, Nodes), _Opts)];
 choose(N, <<"By-Weight">>, _, Nodes, Opts) ->
-    ?event(debug, {nodes, Nodes}),
+    ?event({nodes, Nodes}),
     NodesWithWeight =
         [
             { Node, hb_util:float(hb_ao:get(<<"weight">>, Node, Opts)) }
@@ -476,15 +513,15 @@ binary_to_bignum(Bin) when ?IS_ID(Bin) ->
     Num.
 
 %% @doc Preprocess a request to check if it should be relayed to a different node.
-preprocess(_Msg1, Msg2, Opts) ->
-    Req = hb_ao:get(<<"request">>, Msg2, Opts),
+preprocess(Msg1, Msg2, Opts) ->
+    Req = hb_ao:get(<<"request">>, Msg2, Opts#{ hashpath => ignore }),
     ?event(debug_preprocess, {called_preprocess,Req}),
     TemplateRoutes = load_routes(Opts),
     ?event(debug_preprocess, {template_routes, TemplateRoutes}),
-    {_, Match} = match(#{ <<"routes">> => TemplateRoutes }, Req, Opts),
-    ?event(debug_preprocess, {match, Match}),
-    case Match of
-        no_matching_route -> 
+    Res = hb_http:message_to_request(Req, Opts),
+    ?event(debug_preprocess, {match, Res}),
+    case Res of
+        {error, _} -> 
             ?event(debug_preprocess, preprocessor_did_not_match),
             case hb_opts:get(router_preprocess_default, <<"local">>, Opts) of
                 <<"local">> ->
@@ -504,22 +541,70 @@ preprocess(_Msg1, Msg2, Opts) ->
                             }]
                     }}
             end;
-        _ -> 
-            ?event(debug_preprocess, {matched_route, Match}),
-            {ok,
+        {ok, _Method, Node, _Path, _MsgWithoutMeta, _ReqOpts} ->
+            ?event(debug_preprocess, {matched_route, {explicit, Res}}),
+            CommitRequest =
+                hb_util:atom(
+                    hb_ao:get_first(
+                        [
+                            {Msg1, <<"commit-request">>}
+                        ],
+                        false,
+                        Opts
+                    )
+                ),
+            MaybeCommit =
+                case CommitRequest of
+                    true -> #{ <<"commit-request">> => true };
+                    false -> #{}
+                end,
+            % Construct a request to `relay@1.0/call' which will proxy a request
+            % to `apply@1.0/body' with the original request body as the argument.
+            % This allows us to potentially sign the request before sending it,
+            % letting the recipient node charge/verify us as necessary, without
+            % explicitly signing the user's request itself.
+            % 
+            % We additionally ensure that the request itself has a commitment,
+            % such that headers added by the relaying node are not added to the
+            % user's request.
+            UserReqWithCommit =
+                case hb_message:signers(Req, Opts) of
+                    [] ->
+                        hb_message:commit(
+                            Req,
+                            Opts,
+                            #{
+                                <<"commitment-device">> => <<"httpsig@1.0">>,
+                                <<"type">> => <<"unsigned">>
+                            }
+                        );
+                    _ ->
+                        Req
+                end,
+            RelayReq =
+                #{
+                    <<"device">> => <<"apply@1.0">>,
+                    <<"path">> => <<"user-path">>,
+                    <<"source">> => <<"user-message">>,
+                    <<"user-path">> => hb_maps:get(<<"path">>, Req, Opts),
+                    <<"user-message">> => UserReqWithCommit
+                },
+            ?event(debug_preprocess, {prepared_relay_req, RelayReq}),
+            {
+                ok,
                 #{
                     <<"body">> =>
                         [
-                            #{ <<"device">> => <<"relay@1.0">> },
+                            MaybeCommit#{
+                                <<"device">> => <<"relay@1.0">>,
+                                <<"relay-device">> => <<"apply@1.0">>,
+                                <<"method">> => <<"POST">>,
+                                <<"peer">> => Node
+                            },
                             #{
                                 <<"path">> => <<"call">>,
-                                <<"target">> => <<"body">>,
-                                <<"body">> =>
-                                    hb_ao:get(
-                                        <<"request">>,
-                                        Msg2,
-                                        Opts#{ hashpath => ignore }
-                                    )
+                                <<"target">> => <<"proxy-message">>,
+                                <<"proxy-message">> => RelayReq
                             }
                         ]
                 }
@@ -528,36 +613,47 @@ preprocess(_Msg1, Msg2, Opts) ->
 
 %%% Tests
 
-route_provider_test() ->
-    Node = hb_http_server:start_node(#{
-        route_provider => #{
-            <<"path">> => <<"/test-key/routes">>,
-            <<"test-key">> => #{
-                <<"routes">> => [
-                    #{
-                        <<"template">> => <<"*">>,
-                        <<"node">> => <<"testnode">>
+test_provider_test() ->
+    Node =
+        hb_http_server:start_node(Opts =
+            #{
+                router_opts => #{
+                    <<"provider">> => #{
+                        <<"path">> => <<"/test-key/routes">>,
+                        <<"test-key">> => #{
+                            <<"routes">> => [
+                                #{
+                                    <<"template">> => <<"*">>,
+                                    <<"node">> => <<"testnode">>
+                                }
+                            ]
+                        }
                     }
-                ]
+                },
+                store => #{
+                    <<"store-module">> => hb_store_fs,
+                    <<"name">> => <<"cache-TEST">>
+                }
             }
-        }
-    }),
+        ),
     ?assertEqual(
         {ok, <<"testnode">>},
-        hb_http:get(Node, <<"/~router@1.0/routes/1/node">>, #{})
+        hb_http:get(Node, <<"/~router@1.0/routes/1/node">>, Opts)
     ).
 
-dynamic_route_provider_test() ->
+dynamic_provider_test() ->
     {ok, Script} = file:read_file("test/test.lua"),
     Node = hb_http_server:start_node(#{
-        route_provider => #{
-            <<"device">> => <<"lua@5.3a">>,
-            <<"path">> => <<"route_provider">>,
-            <<"module">> => #{
-                <<"content-type">> => <<"application/lua">>,
-                <<"body">> => Script
-            },
-            <<"node">> => <<"test-dynamic-node">>
+        router_opts => #{
+            <<"provider">> => #{
+                <<"device">> => <<"lua@5.3a">>,
+                <<"path">> => <<"provider">>,
+                <<"module">> => #{
+                    <<"content-type">> => <<"application/lua">>,
+                    <<"body">> => Script
+                },
+                <<"node">> => <<"test-dynamic-node">>
+            }
         },
         priv_wallet => ar_wallet:new()
     }),
@@ -566,12 +662,16 @@ dynamic_route_provider_test() ->
         hb_http:get(Node, <<"/~router@1.0/routes/1/node">>, #{})
     ).
 
-local_process_route_provider_test() ->
+local_process_provider_test_() ->
+    {timeout, 30, fun local_process_provider/0}.
+local_process_provider() ->
     {ok, Script} = file:read_file("test/test.lua"),
     Node = hb_http_server:start_node(#{
         priv_wallet => ar_wallet:new(),
-        route_provider => #{
-            <<"path">> => <<"/router~node-process@1.0/now/known-routes">>
+        router_opts => #{
+            <<"provider">> => #{
+                <<"path">> => <<"/router~node-process@1.0/now/known-routes">>
+            }
         },
         node_processes => #{
             <<"router">> => #{
@@ -599,46 +699,47 @@ local_process_route_provider_test() ->
                 hb_util:ok(
                     hb_http:get(
                         Node,
-                        <<"/~router@1.0/route?route-path=test2">>,
-                        #{
-                            <<"route-path">> => <<"test2">>
-                        }
+                        <<"/~router@1.0/route&route-path=test2/uri">>,
+                        #{}
                     )
                 )
             end,
             lists:seq(1, 10)
         ),
     ?event({responses, Responses}),
-    ?assertEqual(2, sets:size(sets:from_list(Responses))).
+    ?assertEqual(2, length(hb_util:unique(Responses))).
 
-%% @doc Example of a Lua module being used as the `route_provider' for a
+%% @doc Example of a Lua module being used as the `<<"provider">>' for a
 %% HyperBEAM node. The module utilized in this example dynamically adjusts the
 %% likelihood of routing to a given node, depending upon price and performance.
-local_dynamic_router_test() ->
+local_dynamic_router_test_() ->
+    {timeout, 60, fun local_dynamic_router/0}.
+local_dynamic_router() ->
     BenchRoutes = 50,
+    TestNodes = 5,
     {ok, Module} = file:read_file(<<"scripts/dynamic-router.lua">>),
-    Run = hb_util:bin(rand:uniform(1337)),
     Node = hb_http_server:start_node(Opts = #{
-        store => [
-            #{
-                <<"store-module">> => hb_store_fs,
-                <<"prefix">> => <<"cache-TEST/dynrouter-", Run/binary>>
-            }
-        ],
+        store => hb_test_utils:test_store(),
         priv_wallet => ar_wallet:new(),
-        route_provider => #{
-            <<"path">> =>
-                RouteProvider =
-                    <<"/router~node-process@1.0/compute/routes~message@1.0">>
+        router_opts => #{
+            <<"registrar">> => #{
+                <<"device">> => <<"router@1.0">>,
+                <<"path">> => <<"/router1~node-process@1.0/schedule">>
+            },
+            <<"provider">> => #{
+                <<"path">> =>
+                    RouteProvider =
+                        <<"/router1~node-process@1.0/compute/routes~message@1.0">>
+            }
         },
         node_processes => #{
-            <<"router">> => #{
+            <<"router1">> => #{
                 <<"device">> => <<"process@1.0">>,
                 <<"execution-device">> => <<"lua@5.3a">>,
                 <<"scheduler-device">> => <<"scheduler@1.0">>,
                 <<"module">> => #{
                     <<"content-type">> => <<"application/lua">>,
-                    <<"module">> => <<"dynamic-router">>,
+                    <<"name">> => <<"dynamic-router">>,
                     <<"body">> => Module
                 },
                 % Set module-specific factors for the test
@@ -651,34 +752,37 @@ local_dynamic_router_test() ->
     Store = hb_opts:get(store, no_store, Opts),
     ?event(debug_dynrouter, {store, Store}),
     % Register workers with the dynamic router with varied prices.
-    lists:foreach(fun(X) ->
-        hb_http:post(
-            Node,
-            #{
-                <<"path">> => <<"/router~node-process@1.0/schedule">>,
-                <<"method">> => <<"POST">>,
-                <<"body">> =>
-                    hb_message:commit(
-                        #{
-                            <<"path">> => <<"register">>,
-                            <<"route">> =>
-                                #{
-                                    <<"prefix">> =>
-                                        <<
-                                            "https://test-node-",
-                                                (hb_util:bin(X))/binary,
-                                                ".com"
-                                        >>,
-                                    <<"template">> => <<"/.*~process@1.0/.*">>,
-                                    <<"price">> => X * 250
-                                }
-                        },
-                        Opts
-                    )
-            },
-            Opts
-        )
-    end, lists:seq(1, 5)),
+    lists:foreach(
+        fun(X) ->
+            hb_http:post(
+                Node,
+                #{
+                    <<"path">> => <<"/router1~node-process@1.0/schedule">>,
+                    <<"method">> => <<"POST">>,
+                    <<"body">> =>
+                        hb_message:commit(
+                            #{
+                                <<"path">> => <<"register">>,
+                                <<"route">> =>
+                                    #{
+                                        <<"prefix">> => 
+                                            <<
+                                                "https://test-node-",
+                                                    (hb_util:bin(X))/binary,
+                                                    ".com"
+                                            >>,
+                                        <<"template">> => <<"/.*~process@1.0/.*">>,
+                                        <<"price">> => X * 250
+                                    }
+                            },
+                            Opts
+                        )
+                },
+                Opts
+            )
+        end,
+        lists:seq(1, TestNodes)
+    ),
     % Force computation of the current state. This should be done with a 
     % background worker (ex: a `~cron@1.0/every' task).
     hb_http:get(Node, <<"/router~node-process@1.0/now">>, #{}),
@@ -694,14 +798,14 @@ local_dynamic_router_test() ->
                     hb_http:get(
                         Node,
                         <<"/~router@1.0/route/uri?route-path=/procID~process@1.0/now">>,
-                        #{}
+                        Opts
                     )
                 )
             end,
             lists:seq(1, BenchRoutes)
         ),
     AfterExec = os:system_time(millisecond),
-    hb_util:eunit_print(
+    hb_format:eunit_print(
         "Calculated ~p routes in ~ps (~.2f routes/s)",
         [
             BenchRoutes,
@@ -723,18 +827,183 @@ local_dynamic_router_test() ->
     ?event(debug_distribution, {distribution_of_responses, Dist}),
     ?assert(length(UniqueResponses) > 1).
 
-%% @doc Example of a Lua module being used as the `route_provider' for a
+%% @doc Test that verifies dynamic router functionality and template-based pricing.
+%% Sets up a two-node system: an execution node with p4@1.0 processing and a proxy
+%% node with router@1.0 for dynamic routing. The test confirms that:
+%% - dev_simple_pay correctly uses template matching via <<"router@1.0">> -> routes
+%%   to determine pricing for different routes (e.g., "/c" route with price 0)
+%% - Dynamic routing works with Lua-based route providers that adjust routing
+%%   likelihood based on price and performance factors
+%% - Request preprocessing and routing happens correctly between nodes
+%% - Non-chargeable routes are properly handled via template patterns
+dynamic_router_pricing_test_() ->
+    {timeout, 30, fun dynamic_router_pricing/0}.
+dynamic_router_pricing() ->
+    {ok, Module} = file:read_file(<<"scripts/dynamic-router.lua">>),
+    {ok, ClientScript} = file:read_file("scripts/hyper-token-p4-client.lua"),
+    {ok, TokenScript} = file:read_file("scripts/hyper-token.lua"),
+    {ok, ProcessScript} = file:read_file("scripts/hyper-token-p4.lua"),
+    ExecWallet = hb:wallet(<<"test/admissible-report-wallet.json">>),
+    ProxyWallet = ar_wallet:new(),
+    ExecNodeAddr = hb_util:human_id(ar_wallet:to_address(ExecWallet)),
+    Processor =
+        #{
+            <<"device">> => <<"p4@1.0">>,
+            <<"ledger-device">> => <<"lua@5.3a">>,
+            <<"pricing-device">> => <<"simple-pay@1.0">>,
+            <<"ledger-path">> => <<"/ledger2~node-process@1.0">>,
+            <<"module">> => #{
+                <<"content-type">> => <<"text/x-lua">>,
+                <<"name">> => <<"scripts/hyper-token-p4-client.lua">>,
+                <<"body">> => ClientScript
+            }
+        },
+    ExecNode =
+        hb_http_server:start_node(
+            ExecOpts = #{
+                priv_wallet => ExecWallet, 
+                port => 10009,
+                store => hb_test_utils:test_store(),
+                node_processes => #{
+                    <<"ledger2">> => #{
+                        <<"device">> => <<"process@1.0">>,
+                        <<"execution-device">> => <<"lua@5.3a">>,
+                        <<"scheduler-device">> => <<"scheduler@1.0">>,
+                        <<"authority-match">> => 1,
+                        <<"admin">> => ExecNodeAddr,
+                        <<"token">> =>
+                            <<"iVplXcMZwiu5mn0EZxY-PxAkz_A9KOU0cmRE0rwej3E">>,                 
+                        <<"module">> => [
+                            #{
+                                <<"content-type">> => <<"text/x-lua">>,
+                                <<"name">> => <<"scripts/hyper-token.lua">>,
+                                <<"body">> => TokenScript
+                            },
+                            #{
+                                <<"content-type">> => <<"text/x-lua">>,
+                                <<"name">> => <<"scripts/hyper-token-p4.lua">>,
+                                <<"body">> => ProcessScript
+                            }
+                        ],              
+                        <<"authority">> => ExecNodeAddr              
+                    }
+                },
+                p4_recipient => ExecNodeAddr, 
+                p4_non_chargable_routes => [
+                    #{ <<"template">> => <<"/*~node-process@1.0/*">> },
+                    #{ <<"template">> => <<"/*~router@1.0/*">> }
+                ],
+                on => #{
+                    <<"request">> => Processor,
+                    <<"response">> => Processor
+                },
+                node_process_spawn_codec => <<"ans104@1.0">>,
+                router_opts => #{
+                    <<"offered">> => [
+                        #{
+                            <<"registration-peer">> => <<"http://localhost:10010">>,         
+                            <<"template">> => <<"/c">>,  
+                            <<"prefix">> => <<"http://localhost:10009">>,
+                            <<"price">> => 0
+                        },
+                        #{
+                            <<"registration-peer">> => <<"http://localhost:10010">>,         
+                            <<"template">> => <<"/b">>,  
+                            <<"prefix">> => <<"http://localhost:10009">>,                   
+                            <<"price">> => 1
+                        }
+                    ]
+                }
+            }
+        ),
+    RouterNode = hb_http_server:start_node(#{
+        port => 10010,
+        store => hb_test_utils:test_store(),
+        priv_wallet => ProxyWallet,
+        on => 
+            #{
+                <<"request">> => #{
+                    <<"device">> => <<"router@1.0">>,
+                    <<"path">> => <<"preprocess">>,
+                    <<"commit-request">> => true
+                }
+            },
+        router_opts => #{
+            <<"provider">> => #{
+                <<"path">> =>
+                    <<"/router2~node-process@1.0/compute/routes~message@1.0">>
+            },
+            <<"registrar">> => #{
+                <<"path">> => <<"/router2~node-process@1.0">>
+            },
+            <<"registrar-path">> => <<"schedule">>
+        },
+        relay_allow_commit_request => true,
+        node_processes => #{
+            <<"router2">> => #{
+                <<"type">> => <<"Process">>,
+                <<"device">> => <<"process@1.0">>,
+                <<"execution-device">> => <<"lua@5.3a">>,
+                <<"scheduler-device">> => <<"scheduler@1.0">>,
+                <<"module">> => #{
+                    <<"content-type">> => <<"application/lua">>,
+                    <<"module">> => <<"dynamic-router">>,
+                    <<"body">> => Module
+                },
+                % Set module-specific factors for the test
+                <<"pricing-weight">> => 9,
+                <<"performance-weight">> => 1,
+                <<"score-preference">> => 4,
+                <<"is-admissible">> => #{ 
+                    <<"path">> => <<"default">>,
+                    <<"default">> => <<"false">>
+                },
+                <<"trusted-peer">> => ExecNodeAddr
+            }
+        }
+    }),
+    ?event(
+        debug_load_routes,
+        {node_message, hb_http:get(RouterNode, <<"/~meta@1.0/info">>, #{})}
+    ),
+    % Register workers with the dynamic router with varied prices.
+    {ok, <<"Routes registered.">>} =
+        hb_http:post(
+            ExecNode,
+            <<"/~router@1.0/register">>,
+            #{}
+        ),
+    % Force computation of the current state.
+    {Status, _NodeRoutes} =
+        hb_http:get(
+            RouterNode,
+            <<"/router2~node-process@1.0/now/at-slot">>,
+            #{}
+        ),
+    ?assertEqual(ok, Status),
+    % Check that path /c is free
+    {ok, CRes} = hb_http:get(RouterNode, <<"/c?c+list=1">>, #{}),
+    ?event(debug_dynrouter, {res_msg, CRes}),
+    ?assertEqual(1, hb_maps:get(<<"1">>, CRes, not_found)),
+    % Check that path /b is not free and returns Insufficient funds
+    {error, BRes} = hb_http:get(RouterNode, <<"/b?b+list=1">>, #{}),
+    ?event(debug_dynrouter, {res_msg, BRes}),
+    ?assertEqual(<<"Insufficient funds">>, hb_maps:get(<<"body">>, BRes, not_found)).
+
+
+%% @doc Example of a Lua module being used as the `<<"provider">>' for a
 %% HyperBEAM node. The module utilized in this example dynamically adjusts the
 %% likelihood of routing to a given node, depending upon price and performance.
 %% also include preprocessing support for routing
-dynamic_router_test() ->
+dynamic_router_test_() ->
+    {timeout, 30, fun dynamic_router/0}.
+dynamic_router() ->
     {ok, Module} = file:read_file(<<"scripts/dynamic-router.lua">>),
-    Run = hb_util:bin(rand:uniform(1337)),
     ExecWallet = hb:wallet(<<"test/admissible-report-wallet.json">>),
     ProxyWallet = ar_wallet:new(),
     ExecNode =
         hb_http_server:start_node(
-            ExecOpts = #{ priv_wallet => ExecWallet }
+            ExecOpts = #{ priv_wallet => ExecWallet, store => hb_test_utils:test_store() }
         ),
     Node = hb_http_server:start_node(ProxyOpts = #{
         snp_trusted => [
@@ -753,12 +1022,7 @@ dynamic_router_test() ->
                     <<"95a34faced5e487991f9cc2253a41cbd26b708bf00328f98dddbbf6b3ea2892e">>
             }
         ],
-        store => [
-            #{
-                <<"store-module">> => hb_store_fs,
-                <<"prefix">> => <<"cache-TEST/dynrouter-", Run/binary>>
-            }
-        ],
+        store => hb_test_utils:test_store(),
         priv_wallet => ProxyWallet,
         on => 
             #{
@@ -767,8 +1031,10 @@ dynamic_router_test() ->
                     <<"path">> => <<"preprocess">>
                 }
             },
-        route_provider => #{
-            <<"path">> => <<"/router~node-process@1.0/compute/routes~message@1.0">>
+        router_opts => #{
+            <<"provider">> => #{
+                <<"path">> => <<"/router~node-process@1.0/compute/routes~message@1.0">>
+            }
         },
         node_processes => #{
             <<"router">> => #{
@@ -786,8 +1052,8 @@ dynamic_router_test() ->
                 <<"performance-weight">> => 1,
                 <<"score-preference">> => 4,
                 <<"is-admissible">> => #{ 
-                  <<"device">> => <<"snp@1.0">>,
-                  <<"path">> => <<"verify">>
+                    <<"device">> => <<"snp@1.0">>,
+                    <<"path">> => <<"verify">>
                 }
             }
         }
@@ -825,7 +1091,7 @@ dynamic_router_test() ->
     end, lists:seq(1, 1)),
     % Force computation of the current state. This should be done with a 
     % background worker (ex: a `~cron@1.0/every' task).
-    {Status, NodeRoutes} = hb_http:get(Node, <<"/router~node-process@1.0/now">>, #{}),
+    {Status, NodeRoutes} = hb_http:get(Node, <<"/router~node-process@1.0/now/at-slot">>, #{}),
     ?event(debug_dynrouter, {got_node_routes, NodeRoutes}),
     ?assertEqual(ok, Status),
     ProxyWalletAddr = hb_util:human_id(ar_wallet:to_address(ProxyWallet)),
@@ -844,14 +1110,14 @@ dynamic_router_test() ->
     ),
     % Ensure that computation is done by the exec node.
     {ok, ResMsg} = hb_http:get(Node, <<"/c?c+list=1">>, ExecOpts),
-    ?assertEqual([ExecNodeAddr], hb_message:signers(ResMsg)).
+    ?assertEqual([ExecNodeAddr], hb_message:signers(ResMsg, ExecOpts)).
 
 %% @doc Demonstrates routing tables being dynamically created and adjusted
 %% according to the real-time performance of nodes. This test utilizes the
 %% `dynamic-router' script to manage routes and recalculate weights based on the
 %% reported performance.
 dynamic_routing_by_performance_test_() ->
-    {timeout, 30, fun dynamic_routing_by_performance/0}.
+    {timeout, 60, fun dynamic_routing_by_performance/0}.
 dynamic_routing_by_performance() ->
     % Setup test parameters
     TestNodes = 4,
@@ -860,19 +1126,15 @@ dynamic_routing_by_performance() ->
     % Start the main node for the test, loading the `dynamic-router' script and
     % the http_monitor to generate performance messages.
     {ok, Script} = file:read_file(<<"scripts/dynamic-router.lua">>),
-    Run = hb_util:bin(rand:uniform(1337_000)),
     Node = hb_http_server:start_node(Opts = #{
         relay_http_client => gun,
-        store => [
-            #{
-                <<"store-module">> => hb_store_fs,
-                <<"prefix">> => <<"cache-TEST/dynrouter-", Run/binary>>
-            }
-        ],
+        store => hb_test_utils:test_store(),
         priv_wallet => ar_wallet:new(),
-        route_provider => #{
-            <<"path">> =>
-                <<"/perf-router~node-process@1.0/compute/routes~message@1.0">>
+        router_opts => #{
+            <<"provider">> => #{
+                <<"path">> =>
+                    <<"/perf-router~node-process@1.0/compute/routes~message@1.0">>
+            }
         },
         node_processes => #{
             <<"perf-router">> => #{
@@ -910,6 +1172,7 @@ dynamic_routing_by_performance() ->
                 XNode =
                     hb_http_server:start_node(
                         #{
+                            store => hb_test_utils:test_store(),
                             on =>
                                 #{
                                     <<"request">> => #{
@@ -1006,8 +1269,8 @@ dynamic_routing_by_performance() ->
             )
         ),
     ?event(debug_dynrouter, {worker_weights, {explicit, WeightsByWorker}}),
-    ?assert(maps:get(1, WeightsByWorker) > 0.4),
-    ?assert(maps:get(TestNodes, WeightsByWorker) < 0.3),
+    ?assert(maps:get(1, WeightsByWorker) > 0.5),
+    ?assert(maps:get(TestNodes, WeightsByWorker) < 0.5),
     ok.
 
 weighted_random_strategy_test() ->
@@ -1017,9 +1280,11 @@ weighted_random_strategy_test() ->
             #{ <<"host">> => <<"2">>, <<"weight">> => 99 }
         ],
     SimRes = simulate(1000, 1, Nodes, <<"By-Weight">>),
-    [One, _] = simulation_distribution(SimRes, Nodes),
-    ?assert(One < 25),
-    ?assert(One > 4).
+    [HitsOnFirstHost, _] = simulation_distribution(SimRes, Nodes),
+    ProportionOfFirstHost = HitsOnFirstHost / 1000,
+    ?event(debug_weighted_random, {proportion_of_first_host, ProportionOfFirstHost}),
+    ?assert(ProportionOfFirstHost < 0.05),
+    ?assert(ProportionOfFirstHost >= 0.0001).
 
 strategy_suite_test_() ->
     lists:map(
@@ -1187,7 +1452,7 @@ device_call_from_singleton_test() ->
         <<"node">> => <<"old">>,
         <<"priority">> => 10
     }]},
-    Msgs = hb_singleton:from(#{ <<"path">> => <<"~router@1.0/routes">> }),
+    Msgs = hb_singleton:from(#{ <<"path">> => <<"~router@1.0/routes">> }, NodeOpts),
     ?event({msgs, Msgs}),
     ?assertEqual(
         {ok, Routes},
@@ -1249,48 +1514,64 @@ add_route_test() ->
     {ok, Recvd} = GetRes,
     ?assertMatch(<<"new">>, Recvd).
 
-relay_nearest_test() ->
-    Peer1 = <<"https://compute-1.forward.computer">>,
-    Peer2 = <<"https://compute-2.forward.computer">>,
-    HTTPSOpts = #{ http_client => httpc },
-    {ok, Address1} = hb_http:get(Peer1, <<"/~meta@1.0/info/address">>, HTTPSOpts),
-    {ok, Address2} = hb_http:get(Peer2, <<"/~meta@1.0/info/address">>, HTTPSOpts),
+%% @doc Test that the `preprocess/3' function re-routes a request to remote
+%% peers via `~relay@1.0', according to the node's routing table.
+request_hook_reroute_to_nearest_test() ->
+    Peer1 = hb_http_server:start_node(#{ priv_wallet => W1 = ar_wallet:new() }),
+    Peer2 = hb_http_server:start_node(#{ priv_wallet => W2 = ar_wallet:new() }),
+    Address1 = hb_util:human_id(ar_wallet:to_address(W1)),
+    Address2 = hb_util:human_id(ar_wallet:to_address(W2)),
     Peers = [Address1, Address2],
     Node =
-        hb_http_server:start_node(#{
+        hb_http_server:start_node(Opts = #{
             priv_wallet => ar_wallet:new(),
-            routes => [
-                #{
-                    <<"template">> => <<"/.*~process@1.0/.*">>,
-                    <<"strategy">> => <<"Nearest">>,
-                    <<"nodes">> => [
-                        #{
-                            <<"prefix">> => Peer1,
-                            <<"wallet">> => Address1
-                        },
-                        #{
-                            <<"prefix">> => Peer2,
-                            <<"wallet">> => Address2
-                        }    
-                    ]
-                }
-            ]
+            routes =>
+                [
+                    #{
+                        <<"template">> => <<"/.*/.*/.*">>,
+                        <<"strategy">> => <<"Nearest">>,
+                        <<"nodes">> =>
+                            lists:map(
+                                fun({Address, Node}) ->
+                                    #{
+                                        <<"prefix">> => Node,
+                                        <<"wallet">> => Address
+                                    }
+                                end,
+                                [
+                                    {Address1, Peer1},
+                                    {Address2, Peer2}
+                                ]
+                            )
+                    }
+                ],
+            on => #{ <<"request">> => #{ <<"device">> => <<"relay@1.0">> } }
         }),
-    {ok, RelayRes} =
-        hb_http:get(
-            Node,
-            <<
-                "/~relay@1.0/call?relay-path=",
-                    "/CtOVB2dBtyN_vw3BdzCOrvcQvd9Y1oUGT-zLit8E3qM~process@1.0",
-                    "/slot"
-            >>,
-            #{}
-        ),
-    HasValidSigner =
-        lists:any(
-            fun(Peer) -> lists:member(Peer, hb_message:signers(RelayRes)) end,
-            Peers
+    Res =
+        lists:map(
+            fun(_) ->
+                hb_util:ok(
+                    hb_http:get(
+                        Node,
+                        <<"/~meta@1.0/info/address">>,
+                        Opts#{ http_only_result => true }
+                    )
+                )
+            end,
+            lists:seq(1, 3)
         ),
+    ?event(debug_test,
+        {res, {
+            {response, Res},
+            {signers, hb_message:signers(Res, Opts)}
+        }}
+    ),
+    HasValidSigner = lists:any(
+        fun(Peer) ->
+            lists:member(Peer, Res)
+        end,
+        Peers
+    ),
     ?assert(HasValidSigner).
 
 %%% Statistical test utilities
@@ -1332,7 +1613,7 @@ simulation_occurences(SimRes, Nodes) ->
         fun(NearestNodes, Acc) ->
             lists:foldl(
                 fun(Node, Acc2) ->
-                    Acc2#{ Node => maps:get(Node, Acc2) + 1 }
+                    Acc2#{ Node => hb_maps:get(Node, Acc2, 0, #{}) + 1 }
                 end,
                 Acc,
                 NearestNodes
@@ -1343,7 +1624,7 @@ simulation_occurences(SimRes, Nodes) ->
     ).
 
 simulation_distribution(SimRes, Nodes) ->
-    maps:values(simulation_occurences(SimRes, Nodes)).
+    hb_maps:values(simulation_occurences(SimRes, Nodes), #{}).
 
 within_norms(SimRes, Nodes, TestSize) ->
     Distribution = simulation_distribution(SimRes, Nodes),
diff --git a/src/dev_scheduler.erl b/src/dev_scheduler.erl
index 51f55f7c2..2d597e8b9 100644
--- a/src/dev_scheduler.erl
+++ b/src/dev_scheduler.erl
@@ -22,6 +22,8 @@
 %%% CU-flow functions:
 -export([slot/3, status/3, next/3]).
 -export([start/0, checkpoint/1]).
+%%% Utility functions:
+-export([parse_schedulers/1]).
 %%% Test helper exports:
 -export([test_process/0]).
 -include("include/hb.hrl").
@@ -29,7 +31,7 @@
 %%% The maximum number of assignments that we will query/return at a time.
 -define(MAX_ASSIGNMENT_QUERY_LEN, 1000).
 %%% The timeout for a lookahead worker.
--define(LOOKAHEAD_TIMEOUT, 200).
+-define(LOOKAHEAD_TIMEOUT, 1500).
 
 %% @doc Helper to ensure that the environment is started.
 start() ->
@@ -46,18 +48,27 @@ info() ->
     #{
         exports =>
             [
-                location,
-                status,
-                next,
-                schedule,
-                slot,
-                init,
-                checkpoint
+                <<"location">>,
+                <<"status">>,
+                <<"next">>,
+                <<"schedule">>,
+                <<"slot">>,
+                <<"init">>,
+                <<"checkpoint">>
             ],
         excludes => [set, keys],
         default => fun router/4
     }.
 
+%% @doc General utility functions that are available to other modules.
+parse_schedulers(SchedLoc) when is_list(SchedLoc) -> SchedLoc;
+parse_schedulers(SchedLoc) when is_binary(SchedLoc) ->
+    binary:split(
+        binary:replace(SchedLoc, <<"\"">>, <<"">>, [global]),
+        <<",">>,
+        [global, trim_all]
+    ).
+
 %% @doc The default handler for the scheduler device.
 router(_, Msg1, Msg2, Opts) ->
     ?event({scheduler_router_called, {msg2, Msg2}, {opts, Opts}}),
@@ -85,46 +96,33 @@ next(Msg1, Msg2, Opts) ->
     ?event(next, {last_processed, LastProcessed, {message_cache, length(Schedule)}}),
     % Get the assignments from the message cache, local cache, or fetch from
     % the SU. Returns an ordered list of assignments.
-    {LookaheadWorker, [NextAssignment|Assignments]} =
-        case Schedule of
-            [_Next|_] -> {undefined, Schedule};
-            _ ->
-                ProcID = dev_process:process_id(Msg1, Msg2, Opts),
-                case check_lookahead_and_local_cache(Msg1, ProcID, LastProcessed + 1, Opts) of
-                    {ok, Worker, Assignment} ->
-                        ?event(next_debug,
-                            {in_cache,
-                                {slot, LastProcessed + 1},
-                                {assignment, Assignment}
-                            }
-                        ),
-                        ?event(next_profiling, read_assignment),
-                        {Worker, [Assignment]};
-                    not_found ->
-                        {ok, RecvdAssignments} =
-                            hb_ao:resolve(
-                                Msg1,
-                                #{
-                                    <<"method">> => <<"GET">>,
-                                    <<"path">> => <<"schedule/assignments">>,
-                                    <<"from">> => LastProcessed
-                                },
-                                Opts#{ scheduler_follow_redirects => true }
-                            ),
-                        % Convert the assignments to an ordered list of messages,
-                        % after removing all keys before the last processed slot.
-                        {undefined, hb_util:message_to_ordered_list(
-                            maps:filter(
-                                fun(<<"priv">>, _) -> false;
-                                   (<<"commitments">>, _) -> false;
-                                   (Slot, _) -> hb_util:int(Slot) > LastProcessed
-                                end,
-                                RecvdAssignments
-                            )
-                        )}
-                end
-        end,
+    NextAssignment =
+        find_next_assignment(
+            Msg1,
+            Msg2,
+            Schedule,
+            LastProcessed,
+            Opts
+        ),
     ?event(next_profiling, got_assignments),
+    case NextAssignment of
+        {error, Reason} ->
+            ?event(next_profiling, got_no_assignments),
+            {error, Reason};
+        {ok, [], _} ->
+            {error, #{
+                <<"status">> => 404,
+                <<"reason">> =>
+                    <<"Requested slot not yet available in schedule.">>
+            }
+        };
+        {ok, Assignments, Lookahead} ->
+            ?event(next_profiling, got_assignments),
+            validate_next_slot(Msg1, Assignments, Lookahead, LastProcessed, Opts)
+    end.
+
+%% @doc Validate the `next` slot generated by `find_next_assignment`.
+validate_next_slot(Msg1, [NextAssignment|Assignments], Lookahead, Last, Opts) ->
     % Paranoia: Get the slot of the next assignment, to ensure that it is the
     % last processed slot + 1.
     NextAssignmentSlot =
@@ -136,7 +134,7 @@ next(Msg1, Msg2, Opts) ->
             )
         )
         catch
-            error:badarg -> invalid_slot
+            error:badarg -> slot_not_processable
         end,
     ?event(next_profiling, found_next_assignment_slot),
     ?event(debug_next, {norm_assignments, Assignments}),
@@ -144,35 +142,109 @@ next(Msg1, Msg2, Opts) ->
     % Remove assignments that are below the last processed slot.
     ?event(debug_next,
         {calculating_next_from_assignments,
-            {last_processed, LastProcessed},
+            {last_processed, Last},
             {next_slot_from_assignment, NextAssignmentSlot},
             {assignments_received, length(Assignments)}
         }),
-    ExpectedSlot = LastProcessed + 1,
+    ExpectedSlot = Last + 1,
     case NextAssignmentSlot of
         ExpectedSlot ->
             ?event(next_profiling, setting_cache),
             ?event(next, {setting_cache, {assignments, length(Assignments)}}),
             NextState =
-                hb_private:set(
-                    Msg1,
-                    #{ <<"scheduler@1.0">> => #{
-                        <<"assignments">> => Assignments,
-                        <<"lookahead-worker">> => LookaheadWorker
-                    }},
-                    Opts
-                ),
+                case hb_util:atom(hb_opts:get(scheduler_in_memory_cache, true, Opts)) of
+                    true ->
+                        hb_private:set(
+                            Msg1,
+                            #{ <<"scheduler@1.0">> => #{
+                                <<"assignments">> => Assignments,
+                                <<"lookahead-worker">> => Lookahead
+                            }},
+                            Opts
+                        );
+                    false ->
+                        Msg1#{
+                            <<"scheduler@1.0">> => #{
+                                <<"lookahead-worker">> => Lookahead
+                            }
+                        }
+                end,
             ?event(debug_next,
-                {next_returning, {slot, NextAssignmentSlot}, {message, NextAssignment}}),
+                {next_returning,
+                    {slot, NextAssignmentSlot},
+                    {message, NextAssignment}
+                }
+            ),
             ?event(next, {next_returning, {slot, NextAssignmentSlot}}),
 			?event(next_profiling, returning),
             {ok, #{ <<"body">> => NextAssignment, <<"state">> => NextState }};
-        _ ->
+        slot_not_processable ->
             {error,
                 #{
-                    <<"status">> => 503,
-                    <<"body">> => <<"No assignment found for next slot.">>
+                    <<"status">> => 500,
+                    <<"reason">> =>
+                        <<"Unprocessable slot value received in assignment.">>
                 }
+            };
+        UnexpectedSlot ->
+            {error,
+                #{
+                    <<"status">> => 404,
+                    <<"reason">> =>
+                        <<"Received assignment slot does not match expected slot.">>,
+                    <<"unexpected-slot">> => UnexpectedSlot,
+                    <<"expected-slot">> => ExpectedSlot
+                }
+            }
+    end.
+
+%% @doc Get the assignments for a process from the message cache, local cache,
+%% or the inbox (thanks to a lookahead-worker).
+find_next_assignment(_Msg1, _Msg2, Schedule = [_Next|_], _LastSlot, _Opts) ->
+    {ok, Schedule, undefined};
+find_next_assignment(Msg1, Msg2, _Schedule, LastSlot, Opts) ->
+    ProcID = dev_process:process_id(Msg1, Msg2, Opts),
+    LocalCacheRes =
+        case hb_util:atom(hb_opts:get(scheduler_ignore_local_cache, false, Opts)) of
+            true -> not_found;
+            false ->
+                check_lookahead_and_local_cache(Msg1, ProcID, LastSlot + 1, Opts)
+        end,
+    case LocalCacheRes of
+        {ok, Worker, Assignment} ->
+            ?event(next_debug,
+                {in_cache,
+                    {slot, LastSlot + 1},
+                    {assignment, Assignment}
+                }
+            ),
+            ?event(next_profiling, read_assignment),
+            {ok, [Assignment], Worker};
+        not_found ->
+            {ok, RecvdAssignments} =
+                hb_ao:resolve(
+                    Msg1,
+                    #{
+                        <<"method">> => <<"GET">>,
+                        <<"path">> => <<"schedule/assignments">>,
+                        <<"from">> => LastSlot
+                    },
+                    Opts#{ scheduler_follow_redirects => true }
+                ),
+            % Convert the assignments to an ordered list of messages,
+            % after removing all keys before the last processed slot.
+            {
+                ok,
+                hb_util:message_to_ordered_list(
+                    maps:filter(
+                        fun(<<"priv">>, _) -> false;
+                            (<<"commitments">>, _) -> false;
+                            (Slot, _) -> hb_util:int(Slot) > LastSlot
+                        end,
+                        RecvdAssignments
+                    )
+                ),
+                undefined
             }
     end.
 
@@ -201,7 +273,8 @@ spawn_lookahead_worker(ProcID, Slot, Opts) ->
             ),
             case dev_scheduler_cache:read(ProcID, Slot, Opts) of
                 {ok, Assignment} ->
-                    Caller ! {assignment, ProcID, Slot, Assignment};
+                    LoadedAssignment = hb_cache:ensure_all_loaded(Assignment, Opts),
+                    Caller ! {assignment, ProcID, Slot, LoadedAssignment};
                 not_found ->
                     fail
             end
@@ -243,14 +316,14 @@ check_lookahead_and_local_cache(Worker, ProcID, TargetSlot, Opts) when is_pid(Wo
             ),
             {ok, NewWorker, Assignment}
     after ?LOOKAHEAD_TIMEOUT ->
-        ?event(next_lookahead, {lookahead_worker_timed_out, {slot, TargetSlot}}),
+        ?event(next_lookahead, {lookahead_read_timeout, {slot, TargetSlot}}),
         erlang:exit(Worker, timeout),
         check_lookahead_and_local_cache(undefined, ProcID, TargetSlot, Opts)
     end;
 check_lookahead_and_local_cache(undefined, ProcID, TargetSlot, Opts) ->
     % The lookahead worker has not found an assignment for the target
     % slot yet, so we check our local cache.
-    ?event(next_lookahead, {no_lookahead_worker, {slot, TargetSlot}}),
+    ?event(next_lookahead, {reading_local_cache, {slot, TargetSlot}}),
     case dev_scheduler_cache:read(ProcID, TargetSlot, Opts) of
         not_found -> not_found;
         {ok, Assignment} ->
@@ -260,7 +333,7 @@ check_lookahead_and_local_cache(undefined, ProcID, TargetSlot, Opts) ->
             % if we have them locally, ahead of time.
             Worker =
                 case hb_opts:get(scheduler_lookahead, true, Opts) of
-                    false -> unset;
+                    false -> undefined;
                     true ->
                         % We found the assignment in our local cache, so
                         % optionally spawn a new Erlang process to fetch
@@ -268,7 +341,7 @@ check_lookahead_and_local_cache(undefined, ProcID, TargetSlot, Opts) ->
                         % ahead of time.
                         spawn_lookahead_worker(ProcID, TargetSlot + 1, Opts)
                 end,
-            {ok, Worker, Assignment}
+            {ok, Worker, hb_cache:ensure_all_loaded(Assignment, Opts)}
     end.
 
 %% @doc Returns information about the entire scheduler.
@@ -324,19 +397,30 @@ get_location(_Msg1, Req, Opts) ->
 
 %% @doc Generate a new scheduler location record and register it. We both send 
 %% the new scheduler-location to the given registry, and return it to the caller.
-post_location(Msg1, RawReq, Opts) ->
+post_location(Msg1, RawReq, RawOpts) ->
+    Opts =
+        case dev_whois:ensure_host(RawOpts) of
+            {ok, NewOpts} -> NewOpts;
+            _ -> RawOpts
+        end,
     % Ensure that the request is signed by the operator.
     Req =
-        case hb_ao:get(<<"target">>, RawReq, not_found, Opts) of
+        case hb_ao:get_first(
+            [{Msg1, <<"target">>}, {RawReq, <<"target">>}],
+            not_found,
+            Opts
+        ) of
             not_found -> RawReq;
+            <<"self">> -> Msg1;
+            <<"request">> -> RawReq;
             Target -> hb_ao:get(Target, RawReq, not_found, Opts)
         end,
-    {ok, OnlyCommitted} = hb_message:with_only_committed(Req),
+    {ok, OnlyCommitted} = hb_message:with_only_committed(Req, Opts),
     ?event(scheduler_location,
         {scheduler_location_registration_request, OnlyCommitted}
     ),
     % Gather metadata for request validation.
-    Signers = hb_message:signers(OnlyCommitted),
+    Signers = hb_message:signers(OnlyCommitted, Opts),
     Self =
         hb_util:human_id(
             ar_wallet:to_address(
@@ -418,8 +502,8 @@ post_location(Msg1, RawReq, Opts) ->
             Codec =
                 hb_ao:get_first(
                     [
-                        {Msg1, <<"accept-codec">>},
-                        {OnlyCommitted, <<"accept-codec">>}
+                        {Msg1, <<"require-codec">>},
+                        {OnlyCommitted, <<"require-codec">>}
                     ],
                     <<"httpsig@1.0">>,
                     Opts
@@ -439,7 +523,12 @@ post_location(Msg1, RawReq, Opts) ->
             ?event(scheduler_location,
                 {uploading_signed_scheduler_location, Signed}
             ),
-            {UploadStatus, _} = hb_client:upload(Signed, Opts),
+            % Asynchronously upload the location record to Arweave.
+            spawn(
+                fun() ->
+                    hb_client:upload(Signed, Opts)
+                end
+            ),
             % Post the new scheduler location to the peers specified in the
             % `scheduler_location_notify_peers' option.
             Results =
@@ -459,7 +548,7 @@ post_location(Msg1, RawReq, Opts) ->
                 ),
             ?event(scheduler_location,
                 {scheduler_location_registration_success,
-                    {arweave_publication_status, UploadStatus},
+                    {arweave_publication, async_upload_initiated},
                     {foreign_peers_notified, length(Results)}
                 }
             ),
@@ -470,9 +559,9 @@ post_location(Msg1, RawReq, Opts) ->
 %% scheduling a new message.
 schedule(Msg1, Msg2, Opts) ->
     ?event({resolving_schedule_request, {msg2, Msg2}, {state_msg, Msg1}}),
-    case hb_ao:get(<<"method">>, Msg2, <<"GET">>, Opts) of
-        <<"POST">> -> post_schedule(Msg1, Msg2, Opts);
-        <<"GET">> -> get_schedule(Msg1, Msg2, Opts)
+    case hb_util:key_to_atom(hb_ao:get(<<"method">>, Msg2, <<"GET">>, Opts)) of
+        post -> post_schedule(Msg1, Msg2, Opts);
+        get -> get_schedule(Msg1, Msg2, Opts)
     end.
 
 %% @doc Schedules a new message on the SU. Searches Msg1 for the appropriate ID,
@@ -488,16 +577,16 @@ post_schedule(Msg1, Msg2, Opts) ->
     % - If not, use the target as the ProcessID.
     ProcID =
         case hb_ao:get(<<"type">>, ToSched, not_found, Opts) of
-            <<"Process">> -> hb_message:id(ToSched, all);
+            <<"Process">> -> hb_message:id(ToSched, all, Opts);
             _ ->
                 case hb_ao:get(<<"target">>, ToSched, not_found, Opts) of
                     not_found -> find_target_id(Msg1, Msg2, Opts);
-                    Target -> Target
+                    Target -> hb_util:human_id(Target)
                 end
         end,
     ?event({proc_id, ProcID}),
     % Filter all unsigned keys from the source message.
-    case hb_message:with_only_committed(ToSched) of
+    case hb_message:with_only_committed(ToSched, Opts) of
         {ok, OnlyCommitted} ->
             ?event(
                 {post_schedule,
@@ -510,7 +599,7 @@ post_schedule(Msg1, Msg2, Opts) ->
             % correct remote scheduler.
             case find_server(ProcID, Msg1, ToSched, Opts) of
                 {local, PID} ->
-                    ?event({scheduling_message_locally, {proc_id, ProcID}, {pid, PID}}),
+                    ?event({scheduling_locally, {proc_id, ProcID}, {pid, PID}}),
                     do_post_schedule(ProcID, PID, OnlyCommitted, Opts);
                 {redirect, Redirect} ->
                     ?event({process_is_remote, {redirect, Redirect}}),
@@ -520,7 +609,12 @@ post_schedule(Msg1, Msg2, Opts) ->
                                 {redirect, Redirect},
                                 {msg, OnlyCommitted}
                             }),
-                            post_remote_schedule(ProcID, Redirect, OnlyCommitted, Opts);
+                            post_remote_schedule(
+                                ProcID,
+                                Redirect,
+                                OnlyCommitted,
+                                Opts
+                            );
                         false -> {ok, Redirect}
                     end;
                 {error, Error} ->
@@ -546,10 +640,22 @@ do_post_schedule(ProcID, PID, Msg2, Opts) ->
     Verified =
         case hb_opts:get(verify_assignments, true, Opts) of
             true ->
-                ?event({verifying_message_before_scheduling, Msg2}),
-                hb_message:verify(Msg2, signers);
+                ?event(debug_scheduler_verify,
+                    {verifying_message_before_scheduling, Msg2}
+                ),
+                Res = length(hb_message:signers(Msg2, Opts)) > 0
+                    andalso hb_message:verify(Msg2, signers, Opts),
+                ?event(debug_scheduler_verify, {verified, Res}),
+                Res;
+            accept_unsigned ->
+                ?event(
+                    debug_scheduler_verify,
+                    {accepting_unsigned_message_before_scheduling, Msg2}
+                ),
+                hb_message:verify(Msg2, signers, Opts);
             false -> true
         end,
+    ?event({verified, Verified}),
     % Handle scheduling of the message if the message is valid.
     case {Verified, hb_ao:get(<<"type">>, Msg2, Opts)} of
         {false, _} ->
@@ -557,12 +663,19 @@ do_post_schedule(ProcID, PID, Msg2, Opts) ->
                 #{
                     <<"status">> => 400,
                     <<"body">> => <<"Message is not valid.">>,
-                    <<"reason">> => <<"Given message does not correctly validate.">>
+                    <<"reason">> => <<"Given message is invalid.">>
                 }
             };
         {true, <<"Process">>} ->
             {ok, _} = hb_cache:write(Msg2, Opts),
-            spawn(fun() -> hb_client:upload(Msg2, Opts) end),
+            spawn(
+                fun() ->
+                    {ok, Results} = hb_client:upload(Msg2, Opts),
+                    ?event(
+                        {uploaded_process, {proc_id, ProcID}, {results, Results}}
+                    )
+                end
+            ),
             ?event(
                 {registering_new_process,
                     {proc_id, ProcID},
@@ -572,6 +685,13 @@ do_post_schedule(ProcID, PID, Msg2, Opts) ->
             ),
             {ok, dev_scheduler_server:schedule(PID, Msg2)};
         {true, _} ->
+            ?event(
+                {scheduling_message,
+                    {proc_id, ProcID},
+                    {pid, PID},
+                    {is_alive, is_process_alive(PID)}
+                }
+            ),
             % If Message2 is not a process, use the ID of Message1 as the PID
             {ok, dev_scheduler_server:schedule(PID, Msg2)}
     end.
@@ -592,36 +712,8 @@ find_server(ProcID, Msg1, ToSched, Opts) ->
                     {local, PID};
                 not_found ->
                     ?event({no_pid_in_local_registry, ProcID}),
-                    % Find the process from the message.
-                    Proc =
-                        case hb_ao:get(<<"process">>, Msg1, not_found, Opts#{ hashpath => ignore }) of
-                            not_found ->
-                                case (ToSched =/= undefined) andalso (hb_message:id(ToSched, all) == ProcID) of
-                                    true -> ToSched;
-                                    false ->
-                                        ?event(
-                                            {reading_cache,
-                                                {proc_id, ProcID},
-                                                {store, hb_opts:get(store, Opts)}
-                                            }
-                                        ),
-                                        case hb_message:id(Msg1, all) of
-                                            ProcID -> Msg1;
-                                            _ ->
-                                                case hb_cache:read(ProcID, Opts) of
-                                                    {ok, P} -> P;
-                                                    not_found ->
-                                                        throw({process_not_available, ProcID})
-                                                end
-                                        end
-                                end;
-                            P -> P
-                        end,
+                    Proc = find_process_message(ProcID, Msg1, ToSched, Opts),
                     ?event({found_process, {process, Proc}, {msg1, Msg1}}),
-                    % Check if we are the scheduler for this process.
-                    Address = hb_util:human_id(ar_wallet:to_address(
-                        hb_opts:get(priv_wallet, hb:wallet(), Opts))),
-                    ?event({local_address, Address}),
                     SchedLoc =
                         hb_ao:get_first(
                             [
@@ -639,25 +731,95 @@ find_server(ProcID, Msg1, ToSched, Opts) ->
                     case SchedLoc of
                         not_found ->
                             {error, <<"No scheduler information provided.">>};
-                        Address ->
-                            % We are the scheduler. Start the server if it has not already
-                            % been started.
-                            {local, dev_scheduler_registry:find(ProcID, true, Opts)};
                         _ ->
-                            % We are not the scheduler. Find it and return a redirect.
-                            find_remote_scheduler(ProcID, SchedLoc, Opts)
+                            ?event(
+                                {confirming_if_scheduler_is_local,
+                                    {addr, SchedLoc}
+                                }
+                            ),
+                            ParsedLoc = parse_schedulers(SchedLoc),
+                            case is_local_scheduler(ProcID, Proc, ParsedLoc, Opts) of
+                                {ok, PID} ->
+                                    % We are the scheduler. Start the server if
+                                    % it has not already been started, with the
+                                    % given options.
+                                    {local, PID};
+                                false ->
+                                    % We are not the scheduler. Find it and
+                                    % return a redirect.
+                                    find_remote_scheduler(ProcID, ParsedLoc, Opts)
+                            end
                     end
             end
     end.
 
+%% @doc Find the process message for a given process ID and base message.
+find_process_message(ProcID, Msg1, ToSched, Opts) ->
+    % Find the process from the message.
+    MaybeProcessMsg =
+        hb_ao:get(
+            <<"process">>,
+            Msg1,
+            not_found,
+            Opts#{ hashpath => ignore }
+        ),
+    case MaybeProcessMsg of
+        not_found ->
+            ToSchedIsProc =
+                (ToSched =/= undefined)
+                andalso (hb_message:id(ToSched, all) == ProcID),
+            case ToSchedIsProc of
+                true -> ToSched;
+                false ->
+                    ?event(
+                        {reading_cache,
+                            {proc_id, ProcID},
+                            {store, hb_opts:get(store, Opts)}
+                        }
+                    ),
+                    case hb_message:id(Msg1, all) of
+                        ProcID -> Msg1;
+                        _ ->
+                            case hb_cache:read(ProcID, Opts) of
+                                {ok, P} -> P;
+                                not_found ->
+                                    throw({
+                                        process_not_available,
+                                        ProcID
+                                    })
+                            end
+                    end
+            end;
+        P -> P
+    end.
+
+%% @doc Determine if a scheduler is local. If so, return the PID and options.
+%% We start the local server if we _can_ be the scheduler and it does not already
+%% exist.
+is_local_scheduler(_, _, [], _Opts) -> false;
+is_local_scheduler(ProcID, ProcMsg, [Scheduler | Rest], Opts) ->
+    case is_local_scheduler(ProcID, ProcMsg, Scheduler, Opts) of
+        {ok, PID} -> {ok, PID};
+        false -> is_local_scheduler(ProcID, ProcMsg, Rest, Opts)
+    end;
+is_local_scheduler(ProcID, ProcMsg, Scheduler, Opts) ->
+    case hb_opts:as(Scheduler, Opts) of
+        {ok, _} ->
+            {
+                ok,
+                dev_scheduler_registry:find(ProcID, ProcMsg, Opts)
+            };
+        {error, _} -> false
+    end.
+
 %% @doc If a hint is present in the string, return it. Else, return not_found.
 get_hint(Str, Opts) when is_binary(Str) ->
     case hb_opts:get(scheduler_follow_hints, true, Opts) of
         true ->
             case binary:split(Str, <<"?">>, [global]) of
                 [_, QS] ->
-                    QueryMap = maps:from_list(uri_string:dissect_query(QS)),
-                    case maps:get(<<"hint">>, QueryMap, not_found) of
+                    QueryMap = hb_maps:from_list(uri_string:dissect_query(QS)),
+                    case hb_maps:get(<<"hint">>, QueryMap, not_found, Opts) of
                         not_found -> not_found;
                         Hint -> {ok, Hint}
                     end;
@@ -704,7 +866,17 @@ without_hint(Target) ->
         _ -> throw({invalid_operation_target, Target})
     end.
 
-%% @doc Use the SchedulerLocation to the remote path and return a redirect.
+%% @doc Use the SchedulerLocation to find the remote path and return a redirect.
+%% If there are multiple locations, try each one in turn until we find the first
+%% that matches.
+find_remote_scheduler(_ProcID, [], _Opts) -> {error, not_found};
+find_remote_scheduler(ProcID, [Scheduler | Rest], Opts) ->
+    case find_remote_scheduler(ProcID, Rest, Opts) of
+        {error, not_found} ->
+            find_remote_scheduler(ProcID, Scheduler, Opts);
+        {ok, Redirect} ->
+            {ok, Redirect}
+    end;
 find_remote_scheduler(ProcID, Scheduler, Opts) ->
     % Parse the scheduler location to see if it has a hint. If there is a hint,
     % we will use it to construct a redirect message.
@@ -725,13 +897,22 @@ find_remote_scheduler(ProcID, Scheduler, Opts) ->
                         {ok, SchedMsg} ->
                             % We have found the location. Cache it and use it to
                             % construct a redirect message.
-                            dev_scheduler_cache:write_location(
-                                SchedMsg,
-                                Opts
+                            Res =
+                                dev_scheduler_cache:write_location(
+                                    SchedMsg,
+                                    Opts
+                                ),
+                            ?event(scheduler_location,
+                                {cached_scheduler_location, {res, Res}}
                             ),
                             generate_redirect(ProcID, SchedMsg, Opts);
                         {error, Res} ->
-                            ?event({error_finding_scheduler, {error, Res}}),
+                            ?event(
+                                scheduler_location,
+                                {failed_to_find_scheduler_location_from_gateway,
+                                    {error, Res}
+                                }
+                            ),
                             {error, Res}
                     end
             end
@@ -744,8 +925,8 @@ slot(M1, M2, Opts) ->
     case find_server(ProcID, M1, Opts) of
         {local, PID} ->
             ?event({getting_current_slot, {proc_id, ProcID}}),
-            {Timestamp, Hash, Height} = ar_timestamp:get(),
-            #{ current := CurrentSlot, wallet := Wallet } =
+            {Timestamp, Height, Hash} = ar_timestamp:get(),
+            #{ current := CurrentSlot, wallets := Wallets } =
                 dev_scheduler_server:info(PID),
             {ok, #{
                 <<"process">> => ProcID,
@@ -754,7 +935,7 @@ slot(M1, M2, Opts) ->
                 <<"block-height">> => Height,
                 <<"block-hash">> => Hash,
                 <<"cache-control">> => <<"no-store">>,
-                <<"wallet-address">> => hb_util:human_id(ar_wallet:to_address(Wallet))
+                <<"addresses">> => lists:map(fun hb_util:human_id/1, Wallets)
             }};
         {redirect, Redirect} ->
             case hb_opts:get(scheduler_follow_redirects, true, Opts) of
@@ -806,9 +987,9 @@ remote_slot(<<"ao.TN.1">>, ProcID, Node, Opts) ->
                     ?event({got_slot_response, {assignment, A}}),
                     {ok, #{
                         <<"process">> => ProcID,
-                        <<"current">> => maps:get(<<"slot">>, A),
-                        <<"timestamp">> => maps:get(<<"timestamp">>, A),
-                        <<"block-height">> => maps:get(<<"block-height">>, A),
+                        <<"current">> => hb_maps:get(<<"slot">>, A, undefined, Opts),
+                        <<"timestamp">> => hb_maps:get(<<"timestamp">>, A, undefined, Opts),
+                        <<"block-height">> => hb_maps:get(<<"block-height">>, A, undefined, Opts),
                         <<"block-hash">> => hb_util:encode(<<0:256>>),
                         <<"cache-control">> => <<"no-store">>
                     }};
@@ -836,7 +1017,7 @@ remote_slot(<<"ao.TN.1">>, ProcID, Node, Opts) ->
 %% two slots -- labelled as `from' and `to'. If the schedule is not local,
 %% we redirect to the remote scheduler or proxy based on the node opts.
 get_schedule(Msg1, Msg2, Opts) ->
-    ProcID = find_target_id(Msg1, Msg2, Opts),
+    ProcID = hb_util:human_id(find_target_id(Msg1, Msg2, Opts)),
     From =
         case hb_ao:get(<<"from">>, Msg2, not_found, Opts) of
             not_found -> 0;
@@ -849,7 +1030,14 @@ get_schedule(Msg1, Msg2, Opts) ->
             ToRes -> hb_util:int(ToRes)
         end,
     Format = hb_ao:get(<<"accept">>, Msg2, <<"application/http">>, Opts),
-    ?event({parsed_get_schedule, {process, ProcID}, {from, From}, {to, To}, {format, Format}}),
+    ?event(
+        {parsed_get_schedule,
+            {process, ProcID},
+            {from, From},
+            {to, To},
+            {format, Format}
+        }
+    ),
     case find_server(ProcID, Msg1, Opts) of
         {local, _PID} ->
             generate_local_schedule(Format, ProcID, From, To, Opts);
@@ -861,21 +1049,14 @@ get_schedule(Msg1, Msg2, Opts) ->
                         {ok, Res} ->
                             case uri_string:percent_decode(Format) of
                                 <<"application/aos-2">> ->
-                                    {ok, Formatted} = dev_scheduler_formats:assignments_to_aos2(
+                                    dev_scheduler_formats:assignments_to_aos2(
                                         ProcID,
                                         hb_ao:get(
                                             <<"assignments">>, Res, [], Opts),
                                         hb_util:atom(hb_ao:get(
                                             <<"continues">>, Res, false, Opts)),
                                         Opts
-                                    ),
-                                    ?event({formatted_assignments,
-                                        {body,
-                                            {string, hb_ao:get(<<"body">>, Formatted, Opts)}
-                                        },
-                                        {full, Formatted}}
-                                    ),
-                                    {ok, Formatted};
+                                    );
                                 _ ->
                                     {ok, Res}
                             end;
@@ -980,13 +1161,13 @@ do_get_remote_schedule(ProcID, LocalAssignments, From, To, Redirect, Opts) ->
             <<"ao.N.1">> ->
                 <<
                     ProcID/binary,
-                    "/schedule?from=", FromBin/binary, ToParam
+                    "/schedule?from=", FromBin/binary, ToParam/binary
                 >>;
             <<"ao.TN.1">> ->
                 <<
                     ProcID/binary, "?proc-id=", ProcID/binary,
                     FromBin/binary, ToParam/binary,
-                    "&limit=1000"
+                    "&limit=", (hb_util:bin(?MAX_ASSIGNMENT_QUERY_LEN))/binary
                 >>
         end,
     ?event({getting_remote_schedule, {node, {string, Node}}, {path, {string, Path}}}),
@@ -997,6 +1178,7 @@ do_get_remote_schedule(ProcID, LocalAssignments, From, To, Redirect, Opts) ->
                     {ok, NormSched} = 
                         case Variant of
                             <<"ao.N.1">> ->
+                                cache_remote_schedule(Variant, ProcID, Res, Opts),
                                 {ok, Res};
                             <<"ao.TN.1">> ->
                                 JSONRes =
@@ -1008,14 +1190,15 @@ do_get_remote_schedule(ProcID, LocalAssignments, From, To, Redirect, Opts) ->
                                             Opts#{ hashpath => ignore }
                                         )
                                     ),
-                                Filtered = filter_json_assignments(JSONRes, To, From),
+                                cache_remote_schedule(Variant, ProcID, JSONRes, Opts),
+                                ?event(debug_aos2, {json_res, {json, JSONRes}}),
+                                Filtered = filter_json_assignments(JSONRes, To, From, Opts),
                                 dev_scheduler_formats:aos2_to_assignments(
                                     ProcID,
                                     Filtered,
                                     Opts
                                 )
                         end,
-                    cache_remote_schedule(NormSched, Opts),
                     % Add existing local assignments we read to the remote schedule.
                     % In order to do this, we need to first convert the remote
                     % assignments to a list, maintaining the order of the keys.
@@ -1026,7 +1209,8 @@ do_get_remote_schedule(ProcID, LocalAssignments, From, To, Redirect, Opts) ->
                                     <<"assignments">>,
                                     NormSched,
                                     Opts
-                                )
+                                ),
+								Opts
                             )
                         ),
                     % Merge the local assignments with the remote assignments,
@@ -1066,30 +1250,52 @@ do_get_remote_schedule(ProcID, LocalAssignments, From, To, Redirect, Opts) ->
     end.
 
 %% @doc Cache a schedule received from a remote scheduler.
-cache_remote_schedule(Schedule, Opts) ->
+cache_remote_schedule(<<"ao.TN.1">>, ProcID, Schedule, Opts) ->
+    % If the schedule has a variant of ao.TN.1, we add this to the raw assignment
+    % before caching it.
+    ModSchedule =
+        lists:map(
+            fun(Assignment) ->
+                Assignment#{
+                    <<"variant">> => <<"ao.TN.1">>,
+                    <<"slot">> =>
+                        hb_maps:get(<<"cursor">>, Assignment, undefined, Opts),
+                    <<"process">> => ProcID
+                }
+            end,
+            hb_util:ok(hb_maps:find(<<"edges">>, Schedule, Opts))
+        ),
+    cache_remote_schedule(common, ProcID, ModSchedule, Opts);
+cache_remote_schedule(<<"ao.N.1">>, ProcID, Schedule, Opts) ->
+    Assignments =
+        hb_ao:get(
+            <<"assignments">>,
+            Schedule,
+            Opts#{ hashpath => ignore }
+        ),
+    cache_remote_schedule(common, ProcID, Assignments, Opts);
+cache_remote_schedule(_, _ProcID, Schedule, Opts) ->
     Cacher =
         fun() ->
             ?event(debug_sched, {caching_remote_schedule, {schedule, Schedule}}),
-            Assignments =
-                hb_ao:get(
-                    <<"assignments">>,
-                    Schedule,
-                    Opts#{ hashpath => ignore }
-                ),
             lists:foreach(
                 fun(Assignment) ->
                     % We do not care about the result of the write because it is only
                     % an additional cache.
                     ?event(debug_sched,
                         {writing_assignment,
-                            {assignment, maps:get(<<"slot">>, Assignment)}
+                            {assignment, hb_maps:get(<<"slot">>, Assignment, undefined, Opts)}
                         }
                     ),
                     dev_scheduler_cache:write(Assignment, Opts)
                 end,
                 AssignmentList =
                     hb_util:message_to_ordered_list(
-                        maps:without([<<"priv">>], hb_ao:normalize_keys(Assignments))
+                        hb_maps:without(
+                            [<<"priv">>],
+                            hb_ao:normalize_keys(Schedule, Opts),
+                            Opts
+                        )
                     )
             ),
             ?event(debug_sched,
@@ -1105,24 +1311,25 @@ cache_remote_schedule(Schedule, Opts) ->
 node_from_redirect(Redirect, Opts) ->
     uri_string:recompose(
         (
-            maps:remove(
+            hb_maps:remove(
                 query,
                 uri_string:parse(
                     hb_ao:get(<<"location">>, Redirect, Opts)
-                )
+                ),
+				Opts
             )
         )#{path => <<"/">>}
     ).
 
 %% @doc Filter JSON assignment results from a remote legacy scheduler.
-filter_json_assignments(JSONRes, To, From) ->
-    Edges = maps:get(<<"edges">>, JSONRes, []),
+filter_json_assignments(JSONRes, To, From, Opts) ->
+    Edges = hb_maps:get(<<"edges">>, JSONRes, [], Opts),
     Filtered =
         lists:filter(
             fun(Edge) ->
-                Node = maps:get(<<"node">>, Edge),
-                Assignment = maps:get(<<"assignment">>, Node),
-                Tags = maps:get(<<"tags">>, Assignment),
+                Node = hb_maps:get(<<"node">>, Edge, undefined, Opts),
+                Assignment = hb_maps:get(<<"assignment">>, Node, undefined, Opts),
+                Tags = hb_maps:get(<<"tags">>, Assignment, undefined, Opts),
                 Nonces = 
                     lists:filtermap(
                         fun(#{ <<"name">> := <<"Nonce">>, <<"value">> := Nonce }) ->
@@ -1145,7 +1352,7 @@ post_remote_schedule(RawProcID, Redirect, OnlyCommitted, Opts) ->
     ProcID = without_hint(RawProcID),
     Location = hb_ao:get(<<"location">>, Redirect, Opts),
     Parsed = uri_string:parse(Location),
-    Node = uri_string:recompose((maps:remove(query, Parsed))#{path => <<"/">>}),
+    Node = uri_string:recompose((hb_maps:remove(query, Parsed, Opts))#{path => <<"/">>}),
     Variant = hb_ao:get(<<"variant">>, Redirect, <<"ao.N.1">>, Opts),
     case Variant of
         <<"ao.N.1">> ->
@@ -1156,7 +1363,34 @@ post_remote_schedule(RawProcID, Redirect, OnlyCommitted, Opts) ->
             },
             hb_http:post(Node, PostMsg, RemoteOpts);
         <<"ao.TN.1">> ->
-            post_legacy_schedule(ProcID, OnlyCommitted, Node, RemoteOpts)
+            % Ensure that the message is signed with ANS-104.
+            WithANS104Comms =
+                hb_message:with_commitments(
+                    #{ <<"commitment-device">> => <<"ans104@1.0">> },
+                    OnlyCommitted,
+                    Opts
+                ),
+            ?event(debug_downgrade,
+                {with_ans104_comms,
+                    {only_committed, OnlyCommitted},
+                    {with_only_ans104_comms, WithANS104Comms}
+                }
+            ),
+            case hb_message:signers(WithANS104Comms, Opts) of
+                [] ->
+                    {error, #{
+                        <<"status">> => 422,
+                        <<"body">> =>
+                            <<
+                                "Process resides on legacy scheduler. ",
+                                "Message must be signed with ANS-104."
+                            >>
+                    }};
+                _ ->
+                    % The message is signed with ANS-104, so we can post it to
+                    % the legacy scheduler.
+                    post_legacy_schedule(ProcID, WithANS104Comms, Node, RemoteOpts)
+            end
     end.
 
 post_legacy_schedule(ProcID, OnlyCommitted, Node, Opts) ->
@@ -1177,15 +1411,19 @@ post_legacy_schedule(ProcID, OnlyCommitted, Node, Opts) ->
             ),
             {ok, ar_bundles:serialize(Item)}
         catch
-            _:_ ->
+            Class:Reason ->
                 {error,
                     #{
                         <<"status">> => 422,
                         <<"body">> =>
                             <<
-                                "Failed to post schedule on ", Node/binary,
-                                " for ", ProcID/binary, ". Try different encoding?"
-                            >>
+                                "Failed to encode message for legacy scheduler on ",
+                                Node/binary,
+                                ". Try different encoding?"
+                            >>,
+                        <<"class">> => Class,
+                        <<"reason">> =>
+                            iolist_to_binary(io_lib:format("~p", [Reason]))
                     }
                 }
         end,
@@ -1220,9 +1458,10 @@ post_legacy_schedule(ProcID, OnlyCommitted, Node, Opts) ->
                         ),
                     % Legacy SUs return only the ID of the assignment, so we need
                     % to read and return it.
-                    ID = maps:get(<<"id">>, JSONRes),
+                    ID = hb_maps:get(<<"id">>, JSONRes, undefined, Opts),
                     ?event({remote_schedule_result_id, ID, {json, JSONRes}}),
-                    case hb_http:get(Node, << ID/binary, "?process-id=", ProcID/binary>>, LegacyOpts) of
+                    LegacyPath = << ID/binary, "?process-id=", ProcID/binary>>,
+                    case hb_http:get(Node, LegacyPath, LegacyOpts) of
                         {ok, AssignmentRes} ->
                             ?event({received_full_assignment, AssignmentRes}),
                             AssignmentJSON =
@@ -1238,7 +1477,12 @@ post_legacy_schedule(ProcID, OnlyCommitted, Node, Opts) ->
                         {error, PostErr} -> {error, PostErr}
                     end;
                 {error, Resp = #{ <<"status">> := 404 }} ->
-                    ?event({legacy_scheduler_not_found, {url, {string, P}}, {resp, Resp}}),
+                    ?event(
+                        {legacy_scheduler_not_found,
+                            {url, {string, P}},
+                            {resp, Resp}
+                        }
+                    ),
                     {error, Resp};
                 {error, PostRes} ->
                     ?event({remote_schedule_proxy_error, {error, PostRes}}),
@@ -1266,21 +1510,21 @@ find_target_id(Msg1, Msg2, Opts) ->
             case hb_ao:resolve(Msg2, <<"type">>, TempOpts) of
                 {ok, <<"Process">>} ->
                     % Msg2 is a Process, so the ID is at Msg2/id
-                    hb_message:id(Msg2, all);
+                    hb_message:id(Msg2, all, Opts);
                 _ ->
                     case hb_ao:resolve(Msg1, <<"process">>, TempOpts) of
                         {ok, Process} ->
                             % ID found at Msg1/process/id
-                            hb_message:id(Process, all);
+                            hb_message:id(Process, all, Opts);
                         _ ->
                             % Does the message have a type of Process?
                             case hb_ao:get(<<"type">>, Msg1, TempOpts) of
                                 <<"Process">> ->
                                     % Yes, so try Msg1/id
-                                    hb_message:id(Msg1, all);
+                                    hb_message:id(Msg1, all, Opts);
                                 _ ->
                                     % No, so the ID is at Msg2/id
-                                    hb_message:id(Msg2, all)
+                                    hb_message:id(Msg2, all, Opts)
                             end
                 end
             end
@@ -1290,13 +1534,25 @@ find_target_id(Msg1, Msg2, Opts) ->
 
 %% @doc Search the given base and request message pair to find the message to
 %% schedule. The precidence order for search is as follows:
-%% 1. `Msg2/body'
-%% 2. `Msg2'
+%% 1. A key in `Msg2' with the value `self', indicating that the entire message
+%%    is the subject.
+%% 2. A key in `Msg2' with another value, present in that message.
+%% 3. The body of the message.
+%% 4. The message itself.
 find_message_to_schedule(_Msg1, Msg2, Opts) ->
-    case hb_ao:resolve(Msg2, <<"body">>, Opts#{ hashpath => ignore }) of
-        {ok, Body} ->
-            Body;
-        _ -> Msg2
+    Subject =
+        hb_ao:get(
+            <<"subject">>,
+            Msg2,
+            not_found,
+            Opts#{ hashpath => ignore }
+        ),
+    case Subject of
+        <<"self">> -> Msg2;
+        not_found ->
+            hb_ao:get(<<"body">>, Msg2, Msg2, Opts#{ hashpath => ignore });
+        Subject ->
+            hb_ao:get(Subject, Msg2, Opts#{ hashpath => ignore })
     end.
 
 %% @doc Generate a `GET /schedule' response for a process.
@@ -1372,13 +1628,13 @@ checkpoint(State) -> {ok, State}.
 
 %% @doc Generate a _transformed_ process message, not as they are generated 
 %% by users. See `dev_process' for examples of AO process messages.
-test_process() -> test_process(hb:wallet()).
-test_process(Wallet) when not is_binary(Wallet) ->
+test_process() -> test_process(#{ priv_wallet => hb:wallet()}).
+test_process(#{ priv_wallet := Wallet})  ->
     test_process(hb_util:human_id(ar_wallet:to_address(Wallet)));
 test_process(Address) ->
     #{
         <<"device">> => <<"scheduler@1.0">>,
-        <<"device-stack">> => [<<"Cron@1.0">>, <<"WASM-64@1.0">>, <<"PODA@1.0">>],
+        <<"device-stack">> => [<<"cron@1.0">>, <<"wasm-64@1.0">>, <<"poda@1.0">>],
         <<"image">> => <<"wasm-image-id">>,
         <<"type">> => <<"Process">>,
         <<"scheduler-location">> => Address,
@@ -1396,7 +1652,8 @@ status_test() ->
 
 register_new_process_test() ->
     start(),
-    Msg1 = test_process(),
+    Opts = #{ priv_wallet => hb:wallet() },
+    Msg1 = hb_message:commit(test_process(Opts), Opts),
     ?event({test_registering_new_process, {msg, Msg1}}),
     ?assertMatch({ok, _},
         hb_ao:resolve(
@@ -1430,7 +1687,7 @@ register_location_on_boot_test() ->
             store => [
                 #{
                     <<"store-module">> => hb_store_fs,
-                    <<"prefix">> => <<"cache-TEST/scheduler-location-notified">>
+                    <<"name">> => <<"cache-TEST/scheduler-location-notified">>
                 }
             ]
         }),
@@ -1443,8 +1700,10 @@ register_location_on_boot_test() ->
                         <<"device">> => <<"scheduler@1.0">>,
                         <<"path">> => <<"location">>,
                         <<"method">> => <<"POST">>,
-                        <<"accept-codec">> => <<"ans104@1.0">>,
-                        <<"hook">> =>#{
+                        <<"target">> => <<"self">>,
+                        <<"require-codec">> => <<"ans104@1.0">>,
+                        <<"url">> => <<"https://hyperbeam-test-ignore.com">>,
+                        <<"hook">> => #{
                             <<"result">> => <<"ignore">>,
                             <<"commit-request">> => true
                         }
@@ -1456,17 +1715,20 @@ register_location_on_boot_test() ->
     {ok, CurrentLocation} =
         hb_http:get(
             RegisteringNode,
-            <<"/~scheduler@1.0/location">>,
             #{
                 <<"method">> => <<"GET">>,
+                <<"path">> => <<"/~scheduler@1.0/location">>,
                 <<"address">> =>
                     hb_util:human_id(ar_wallet:to_address(RegisteringNodeWallet))
-            }
+            },
+            #{}
         ),
     ?event({current_location, CurrentLocation}),
     ?assertMatch(
-        #{ <<"url">> := Location, <<"nonce">> := 0 }
-            when is_binary(Location),
+        #{
+            <<"url">> := <<"https://hyperbeam-test-ignore.com">>,
+            <<"nonce">> := 0
+        },
         hb_ao:get(<<"body">>, CurrentLocation, #{})
     ).
 
@@ -1517,12 +1779,14 @@ redirect_to_hint_test() ->
         )
     ).
 
-redirect_from_graphql_test() ->
+redirect_from_graphql_test_() ->
+    {timeout, 60, fun redirect_from_graphql/0}.
+redirect_from_graphql() ->
     start(),
     Opts =
         #{ store =>
             [
-                #{ <<"store-module">> => hb_store_fs, <<"prefix">> => <<"cache-mainnet">> },
+                #{ <<"store-module">> => hb_store_fs, <<"name">> => <<"cache-mainnet">> },
                 #{ <<"store-module">> => hb_store_gateway, <<"store">> => false }
             ]
         },
@@ -1589,15 +1853,18 @@ http_init() -> http_init(#{}).
 http_init(Opts) ->
     start(),
     Wallet = ar_wallet:new(),
-    Node = hb_http_server:start_node(
-        Opts#{
-            priv_wallet => Wallet,
-            store => [
-                #{ <<"store-module">> => hb_store_fs, <<"prefix">> => <<"cache-mainnet">> },
-                #{ <<"store-module">> => hb_store_gateway, <<"store">> => false }
-            ]
-        }),
-    {Node, Wallet}.
+	ExtendedOpts = Opts#{
+		priv_wallet => Wallet,
+		store => [
+			#{
+                <<"store-module">> => hb_store_lmdb,
+                <<"name">> => <<"cache-mainnet/lmdb">>
+            },
+			#{ <<"store-module">> => hb_store_gateway, <<"store">> => false }
+		]
+	},
+    Node = hb_http_server:start_node(ExtendedOpts),
+    {Node, ExtendedOpts}.
 
 register_scheduler_test() ->
     start(),
@@ -1607,7 +1874,7 @@ register_scheduler_test() ->
         <<"url">> => <<"https://hyperbeam-test-ignore.com">>,
         <<"method">> => <<"POST">>,
         <<"nonce">> => 1,
-        <<"accept-codec">> => <<"ans104@1.0">>
+        <<"require-codec">> => <<"ans104@1.0">>
     }, Wallet),
     {ok, Res} = hb_http:post(Node, Msg1, #{}),
     ?assertMatch(#{ <<"url">> := Location } when is_binary(Location), Res).
@@ -1652,12 +1919,14 @@ http_get_schedule(N, PMsg, From, To, Format) ->
         <<"accept">> => Format
     }, Wallet), #{}).
 
-http_get_schedule_redirect_test() ->
+http_get_schedule_redirect_test_() ->
+    {timeout, 60, fun http_get_schedule_redirect/0}.
+http_get_schedule_redirect() ->
     Opts =
         #{
             store =>
                 [
-                    #{ <<"store-module">> => hb_store_fs, <<"prefix">> => <<"cache-mainnet">> },
+                    #{ <<"store-module">> => hb_store_fs, <<"name">> => <<"cache-mainnet">> },
                     #{ <<"store-module">> => hb_store_gateway, <<"opts">> => #{} }
                 ],
                 scheduler_follow_redirects => false
@@ -1665,87 +1934,106 @@ http_get_schedule_redirect_test() ->
     {N, _Wallet} = http_init(Opts),
     start(),
     ProcID = <<"0syT13r0s0tgPmIed95bJnuSqaD29HQNN8D3ElLSrsc">>,
-    Res = hb_http:get(N, <<"/", ProcID/binary, "/schedule">>, #{}),
+    Res = hb_http:get(N, <<"/", ProcID/binary, "/schedule">>, Opts),
     ?assertMatch({ok, #{ <<"location">> := Location }} when is_binary(Location), Res).
 
-http_post_schedule_test() ->
-    {N, W} = http_init(),
-    PMsg = hb_message:commit(test_process(W), W),
+http_post_schedule_test_() ->
+    {timeout, 60, fun http_post_schedule/0}.
+http_post_schedule() ->
+    {N, Opts} = http_init(),
+    PMsg = hb_message:commit(test_process(Opts), Opts),
     Msg1 = hb_message:commit(#{
         <<"path">> => <<"/~scheduler@1.0/schedule">>,
         <<"method">> => <<"POST">>,
         <<"body">> => PMsg
-    }, W),
-    {ok, _Res} = hb_http:post(N, Msg1, #{}),
+    }, Opts),
+    {ok, _Res} = hb_http:post(N, Msg1, Opts),
     {ok, Res2} =
         http_post_schedule_sign(
             N,
             #{ <<"inner">> => <<"test-message">> },
             PMsg,
-            W
+            Opts
         ),
-    ?assertEqual(<<"test-message">>, hb_ao:get(<<"body/inner">>, Res2, #{})),
+    ?assertEqual(<<"test-message">>, hb_ao:get(<<"body/inner">>, Res2, Opts)),
     ?assertMatch({ok, #{ <<"current">> := 1 }}, http_get_slot(N, PMsg)).
 
 http_get_schedule_test_() ->
 	{timeout, 20, fun() ->
-		{Node, Wallet} = http_init(),
-		PMsg = hb_message:commit(test_process(Wallet), Wallet),
+		{Node, Opts} = http_init(),
+		PMsg = hb_message:commit(test_process(Opts), Opts),
 		Msg1 = hb_message:commit(#{
 			<<"path">> => <<"/~scheduler@1.0/schedule">>,
 			<<"method">> => <<"POST">>,
 			<<"body">> => PMsg
-		}, Wallet),
+		}, Opts),
 		Msg2 = hb_message:commit(#{
 			<<"path">> => <<"/~scheduler@1.0/schedule">>,
 			<<"method">> => <<"POST">>,
-			<<"body">> => PMsg
-		}, Wallet),
-		{ok, _} = hb_http:post(Node, Msg1, #{}),
+			<<"body">> =>
+                hb_message:commit(
+                    #{
+                        <<"target">> =>
+                            hb_util:human_id(
+                                hb_message:id(PMsg, all, Opts)
+                            ),
+                        <<"body">> => <<"test-message">>,
+                        <<"type">> => <<"Message">>
+                    },
+                    Opts
+                )
+		}, Opts),
+		{ok, _} = hb_http:post(Node, Msg1, Opts),
 		lists:foreach(
-			fun(_) -> {ok, _} = hb_http:post(Node, Msg2, #{}) end,
+			fun(_) ->
+                {ok, Res} = hb_http:post(Node, Msg2, Opts),
+                ?event(debug_scheduler_test, {res, Res})
+            end,
 			lists:seq(1, 10)
 		),
 		?assertMatch({ok, #{ <<"current">> := 10 }}, http_get_slot(Node, PMsg)),
+        ?debug_wait(5000),
 		{ok, Schedule} = http_get_schedule(Node, PMsg, 0, 10),
-		Assignments = hb_ao:get(<<"assignments">>, Schedule, #{}),
+		Assignments = hb_ao:get(<<"assignments">>, Schedule, Opts),
 		?assertEqual(
 			12, % +1 for the hashpath
-			length(maps:values(Assignments))
+			hb_maps:size(Assignments, Opts)
 		)
 	end}.
     
 
 http_get_legacy_schedule_test_() ->
-    {timeout, 10, fun() ->
+    {timeout, 60, fun() ->
         Target = <<"CtOVB2dBtyN_vw3BdzCOrvcQvd9Y1oUGT-zLit8E3qM">>,
-        {Node, _Wallet} = http_init(),
-        Res = hb_http:get(Node, <<"/~scheduler@1.0/schedule&target=", Target/binary>>, #{}),
-        ?assertMatch({ok, #{ <<"assignments">> := As }} when map_size(As) > 0, Res)
+        {Node, Opts} = http_init(),
+        {ok, Res} = hb_http:get(Node, <<"/~scheduler@1.0/schedule&target=", Target/binary>>, Opts),
+		LoadedRes = hb_cache:ensure_all_loaded(Res, Opts),
+        ?assertMatch(#{ <<"assignments">> := As } when map_size(As) > 0, LoadedRes)
     end}.
 
 http_get_legacy_slot_test_() ->
-    {timeout, 10, fun() ->
+    {timeout, 60, fun() ->
         Target = <<"CtOVB2dBtyN_vw3BdzCOrvcQvd9Y1oUGT-zLit8E3qM">>,
-        {Node, _Wallet} = http_init(),
-        Res = hb_http:get(Node, <<"/~scheduler@1.0/slot&target=", Target/binary>>, #{}),
+        {Node, Opts} = http_init(),
+        Res = hb_http:get(Node, <<"/~scheduler@1.0/slot&target=", Target/binary>>, Opts),
         ?assertMatch({ok, #{ <<"current">> := Slot }} when Slot > 0, Res)
     end}.
 
 http_get_legacy_schedule_slot_range_test_() ->
-    {timeout, 10, fun() ->
+    {timeout, 60, fun() ->
         Target = <<"zrhm4OpfW85UXfLznhdD-kQ7XijXM-s2fAboha0V5GY">>,
-        {Node, _Wallet} = http_init(),
-        Res = hb_http:get(Node, <<"/~scheduler@1.0/schedule&target=", Target/binary,
-            "&from=0&to=10">>, #{}),
-        ?event({res, Res}),
-        ?assertMatch({ok, #{ <<"assignments">> := As }} when map_size(As) == 11, Res)
+        {Node, Opts} = http_init(),
+        {ok, Res} = hb_http:get(Node, <<"/~scheduler@1.0/schedule&target=", Target/binary,
+            "&from=0&to=10">>, Opts),
+		LoadedRes = hb_cache:ensure_all_loaded(Res, Opts),
+        ?event({res, LoadedRes}),
+        ?assertMatch(#{ <<"assignments">> := As } when map_size(As) == 11, LoadedRes)
     end}.
 
 http_get_legacy_schedule_as_aos2_test_() ->
-    {timeout, 10, fun() ->
+    {timeout, 60, fun() ->
         Target = <<"CtOVB2dBtyN_vw3BdzCOrvcQvd9Y1oUGT-zLit8E3qM">>,
-        {Node, _Wallet} = http_init(),
+        {Node, Opts} = http_init(),
         {ok, Res} =
             hb_http:get(
                 Node,
@@ -1756,33 +2044,35 @@ http_get_legacy_schedule_as_aos2_test_() ->
                 },
                 #{}
             ),
-        Decoded = hb_json:decode(hb_ao:get(<<"body">>, Res, #{})),
+        Decoded = hb_json:decode(hb_ao:get(<<"body">>, Res, Opts)),
         ?assertMatch(#{ <<"edges">> := As } when length(As) > 0, Decoded)
     end}.
 
-http_post_legacy_schedule_test_() ->
-    {timeout, 10, fun() ->
-        {Node, Wallet} = http_init(),
+http_post_legacy_schedule_test_disabled() ->
+    {timeout, 60, fun() ->
+        {Node, Opts} = http_init(),
         Target = <<"zrhm4OpfW85UXfLznhdD-kQ7XijXM-s2fAboha0V5GY">>,
-        Msg1 = hb_message:commit(#{
-            <<"path">> => <<"/~scheduler@1.0/schedule">>,
-            <<"method">> => <<"POST">>,
-            <<"body">> =>
-                hb_message:commit(
-                    #{
-                        <<"data-protocol">> => <<"ao">>,
-                        <<"variant">> => <<"ao.TN.1">>,
-                        <<"type">> => <<"Message">>,
-                        <<"action">> => <<"ping">>,
-                        <<"target">> => Target,
-                        <<"test-from">> => hb_util:human_id(hb:address())
-                    },
-                    Wallet,
-                    <<"ans104@1.0">>
-                )
-        }, Wallet),
-        {Status, Res} = hb_http:post(Node, Msg1, #{}),
-        ?event({status, Status}),
+        Signed =
+            hb_message:commit(
+                #{
+                    <<"data-protocol">> => <<"ao">>,
+                    <<"variant">> => <<"ao.TN.1">>,
+                    <<"type">> => <<"Message">>,
+                    <<"action">> => <<"ping">>,
+                    <<"target">> => Target,
+                    <<"test-from">> => hb_util:human_id(hb:address())
+                },
+                Opts,
+                <<"ans104@1.0">>
+            ),
+        WithMethodAndPath =
+            Signed#{
+                <<"path">> => <<"/~scheduler@1.0/schedule">>,
+                <<"method">> => <<"POST">>
+            },
+        ?event(debug_downgrade, {signed, Signed}),
+        {Status, Res} = hb_http:post(Node, WithMethodAndPath, Opts),
+        ?event(debug_downgrade, {status, Status}),
         ?event({res, Res}),
         ?assertMatch(
             {ok, #{ <<"slot">> := Slot }} when Slot > 0,
@@ -1791,15 +2081,15 @@ http_post_legacy_schedule_test_() ->
     end}.
 
 http_get_json_schedule_test_() ->
-	{timeout, 20, fun() ->
-		{Node, Wallet} = http_init(),
-		PMsg = hb_message:commit(test_process(Wallet), Wallet),
+	{timeout, 60, fun() ->
+		{Node, Opts} = http_init(),
+		PMsg = hb_message:commit(test_process(Opts), Opts),
 		Msg1 = hb_message:commit(#{
 			<<"path">> => <<"/~scheduler@1.0/schedule">>,
 			<<"method">> => <<"POST">>,
 			<<"body">> => PMsg
-		}, Wallet),
-		{ok, _} = hb_http:post(Node, Msg1, #{}),
+		}, Opts),
+		{ok, _} = hb_http:post(Node, Msg1, Opts),
 		Msg2 = hb_message:commit(#{
 			<<"path">> => <<"/~scheduler@1.0/schedule">>,
 			<<"method">> => <<"POST">>,
@@ -1809,23 +2099,23 @@ http_get_json_schedule_test_() ->
 						<<"inner">> => <<"test">>,
 						<<"target">> => hb_util:human_id(hb_message:id(PMsg, all))
 					},
-					Wallet
+					Opts
 				)
 			},
-			Wallet
+			Opts
 		),
 		lists:foreach(
-			fun(_) -> {ok, _} = hb_http:post(Node, Msg2, #{}) end,
+			fun(_) -> {ok, _} = hb_http:post(Node, Msg2, Opts) end,
 			lists:seq(1, 10)
 		),
 		?assertMatch({ok, #{ <<"current">> := 10 }}, http_get_slot(Node, PMsg)),
 		{ok, Schedule} = http_get_schedule(Node, PMsg, 0, 10, <<"application/aos-2">>),
 		?event({schedule, Schedule}),
-		JSON = hb_ao:get(<<"body">>, Schedule, #{}),
+		JSON = hb_ao:get(<<"body">>, Schedule, Opts),
 		Assignments = hb_json:decode(JSON),
 		?assertEqual(
 			11, % +1 for the hashpath
-			length(maps:get(<<"edges">>, Assignments))
+			length(hb_maps:get(<<"edges">>, Assignments))
 		)
 	end}.
 
@@ -1835,13 +2125,13 @@ single_resolution(Opts) ->
     start(),
     BenchTime = 1,
     Wallet = hb_opts:get(priv_wallet, hb:wallet(), Opts),
-    Msg1 = test_process(Wallet),
+    Msg1 = test_process(Opts#{ priv_wallet => Wallet }),
     ?event({benchmark_start, ?MODULE}),
     MsgToSchedule = hb_message:commit(#{
         <<"type">> => <<"Message">>,
         <<"test-key">> => <<"test-val">>
-    }, Wallet),
-    Iterations = hb:benchmark(
+    }, Opts),
+    Iterations = hb_test_utils:benchmark(
         fun(_) ->
             MsgX = #{
                 <<"path">> => <<"schedule">>,
@@ -1856,31 +2146,33 @@ single_resolution(Opts) ->
     Msg3 = #{
         <<"path">> => <<"slot">>,
         <<"method">> => <<"GET">>,
-        <<"process">> => hb_util:human_id(hb_message:id(Msg1, all))
+        <<"process">> => hb_util:human_id(hb_message:id(Msg1, all, Opts))
     },
     ?assertMatch({ok, #{ <<"current">> := CurrentSlot }}
             when CurrentSlot == Iterations - 1,
         hb_ao:resolve(Msg1, Msg3, Opts)),
     ?event(bench, {res, Iterations - 1}),
-    hb_util:eunit_print(
-        "Scheduled ~p messages through AO-Core in ~p seconds (~.2f msg/s)",
-        [Iterations, BenchTime, Iterations / BenchTime]
+    hb_test_utils:benchmark_print(
+        <<"Scheduled through AO-Core:">>,
+        <<"messages">>,
+        Iterations,
+        BenchTime
     ),
     ?assert(Iterations > 3).
 
 many_clients(Opts) ->
     BenchTime = 1,
     Processes = hb_opts:get(workers, 25, Opts),
-    {Node, Wallet} = http_init(Opts),
-    PMsg = hb_message:commit(test_process(Wallet), Wallet),
+    {Node, Opts} = http_init(Opts),
+    PMsg = hb_message:commit(test_process(Opts), Opts),
     Msg1 = hb_message:commit(#{
         <<"path">> => <<"/~scheduler@1.0/schedule">>,
         <<"method">> => <<"POST">>,
         <<"process">> => PMsg,
-        <<"body">> => hb_message:commit(#{ <<"inner">> => <<"test">> }, Wallet)
-    }, Wallet),
+        <<"body">> => hb_message:commit(#{ <<"inner">> => <<"test">> }, Opts)
+    }, Opts),
     {ok, _} = hb_http:post(Node, Msg1, Opts),
-	    Iterations = hb:benchmark(
+	    Iterations = hb_test_utils:benchmark(
         fun(X) ->
             {ok, _} = hb_http:post(Node, Msg1, Opts),
             ?event(bench, {iteration, X, self()})
@@ -1889,7 +2181,7 @@ many_clients(Opts) ->
         Processes
     ),
     ?event({iterations, Iterations}),
-    hb_util:eunit_print(
+    hb_format:eunit_print(
         "Scheduled ~p messages with ~p workers through HTTP in ~ps (~.2f msg/s)",
         [Iterations, Processes, BenchTime, Iterations / BenchTime]
     ),
@@ -1919,55 +2211,55 @@ benchmark_suite(Port, Base) ->
             requires => [hb_store_fs],
             opts => #{
                 store => #{ <<"store-module">> => hb_store_fs, 
-                    <<"prefix">> => <<Base/binary, PortBin/binary, "-A">>
+                    <<"name">> => <<Base/binary, PortBin/binary, "-A">>
                 },
                 scheduling_mode => local_confirmation,
                 port => Port
             },
-            desc => "FS store, local conf."
+            desc => <<"FS store, local conf.">>
         },
         #{
             name => fs_aggressive,
             requires => [hb_store_fs],
             opts => #{
                 store => #{ <<"store-module">> => hb_store_fs, 
-                    <<"prefix">> => <<Base/binary, PortBin/binary, "-B">>
+                    <<"name">> => <<Base/binary, PortBin/binary, "-B">>
                 },
                 scheduling_mode => aggressive,
                 port => Port + 1
             },
-            desc => "FS store, aggressive conf."
+            desc => <<"FS store, aggressive conf.">>
         },
         #{
             name => rocksdb,
             requires => [hb_store_rocksdb],
             opts => #{
                 store => #{ <<"store-module">> => hb_store_rocksdb, 
-                    <<"prefix">> => <<Base/binary, PortBin/binary, "-C">>
+                    <<"name">> => <<Base/binary, PortBin/binary, "-C">>
                 },
                 scheduling_mode => local_confirmation,
                 port => Port + 2
             },
-            desc => "RocksDB store, local conf."
+            desc => <<"RocksDB store, local conf.">>
         },
         #{
             name => rocksdb_aggressive,
             requires => [hb_store_rocksdb],
             opts => #{
                 store => #{ <<"store-module">> => hb_store_rocksdb, 
-                    <<"prefix">> => <<Base/binary, PortBin/binary, "-D">>
+                    <<"name">> => <<Base/binary, PortBin/binary, "-D">>
                 },
                 scheduling_mode => aggressive,
                 port => Port + 3
             },
-            desc => "RocksDB store, aggressive conf."
+            desc => <<"RocksDB store, aggressive conf.">>
         },
         #{
             name => rocksdb_extreme_aggressive_h3,
             requires => [http3],
             opts => #{
                 store => #{ <<"store-module">> => hb_store_rocksdb, 
-                    <<"prefix">> =>
+                    <<"name">> =>
                           <<
                               Base/binary,
                               "run-",
@@ -1978,6 +2270,6 @@ benchmark_suite(Port, Base) ->
                 protocol => http3,
                 workers => 100
             },
-            desc => "100xRocksDB store, aggressive conf, http/3."
+            desc => <<"100xRocksDB store, aggressive conf, http/3.">>
         }
-    ].
\ No newline at end of file
+    ].
diff --git a/src/dev_scheduler_cache.erl b/src/dev_scheduler_cache.erl
index 488aea515..a7cf4f5b2 100644
--- a/src/dev_scheduler_cache.erl
+++ b/src/dev_scheduler_cache.erl
@@ -1,15 +1,34 @@
+%%% @doc A module that provides a cache for scheduler assignments and locations.
 -module(dev_scheduler_cache).
--export([write/2, read/3, list/2, latest/2, read_location/2, write_location/2]).
+-export([write/2, write_spawn/2, write_location/2]).
+-export([read/3, read_location/2]).
+-export([list/2, latest/2]).
 -include("include/hb.hrl").
+-include_lib("eunit/include/eunit.hrl").
 
-%%% Assignment cache functions
+%%% The pseudo-path prefix which the scheduler cache should use.
+-define(SCHEDULER_CACHE_PREFIX, <<"~scheduler@1.0">>).
+
+%% @doc Merge the scheduler store with the main store. Used before writing
+%% to the cache.
+opts(Opts) ->
+    Opts#{
+        store =>
+            hb_opts:get(
+                scheduler_store,
+                hb_opts:get(store, no_viable_store, Opts),
+                Opts
+            )
+    }.
 
 %% @doc Write an assignment message into the cache.
-write(Assignment, Opts) ->
+write(RawAssignment, RawOpts) ->
+    Assignment = hb_cache:ensure_all_loaded(RawAssignment, RawOpts),
+    Opts = opts(RawOpts),
     Store = hb_opts:get(store, no_viable_store, Opts),
     % Write the message into the main cache
-    ProcID = hb_ao:get(<<"process">>, Assignment),
-    Slot = hb_ao:get(<<"slot">>, Assignment),
+    ProcID = hb_ao:get(<<"process">>, Assignment, Opts),
+    Slot = hb_ao:get(<<"slot">>, Assignment, Opts),
     ?event(
         {writing_assignment,
             {proc_id, ProcID},
@@ -27,6 +46,7 @@ write(Assignment, Opts) ->
                 hb_store:path(
                     Store,
                     [
+                        ?SCHEDULER_CACHE_PREFIX,
                         <<"assignments">>,
                         hb_util:human_id(ProcID),
                         hb_ao:normalize_key(Slot)
@@ -39,31 +59,47 @@ write(Assignment, Opts) ->
             {error, Reason}
     end.
 
+%% @doc Write the initial assignment message to the cache.
+write_spawn(RawInitMessage, Opts) ->
+    InitMessage = hb_cache:ensure_all_loaded(RawInitMessage, Opts),
+    hb_cache:write(InitMessage, opts(Opts)).
+
 %% @doc Get an assignment message from the cache.
 read(ProcID, Slot, Opts) when is_integer(Slot) ->
-    read(ProcID, integer_to_list(Slot), Opts);
-read(ProcID, Slot, Opts) ->
+    read(ProcID, hb_util:bin(Slot), Opts);
+read(ProcID, Slot, RawOpts) ->
+    Opts = opts(RawOpts),
     Store = hb_opts:get(store, no_viable_store, Opts),
     ResolvedPath =
         P2 = hb_store:resolve(
             Store,
             P1 = hb_store:path(Store, [
+                ?SCHEDULER_CACHE_PREFIX,
                 "assignments",
                 hb_util:human_id(ProcID),
                 Slot
             ])
         ),
+    ?event(
+        {read_assignment,
+            {proc_id, ProcID},
+            {slot, Slot},
+            {store, Store}
+        }
+    ),
     ?event({resolved_path, {p1, P1}, {p2, P2}, {resolved, ResolvedPath}}),
     case hb_cache:read(ResolvedPath, Opts) of
         {ok, Assignment} ->
             % If the slot key is not present, the format of the assignment is
             % AOS2, so we need to convert it to the canonical format.
-            case hb_ao:get(<<"slot">>, Assignment, Opts) of
-                not_found ->
-                    Norm = dev_scheduler_formats:aos2_normalize_types(Assignment),
+            case hb_ao:get(<<"variant">>, Assignment, Opts) of
+                <<"ao.TN.1">> ->
+                    Loaded = hb_cache:ensure_all_loaded(Assignment, Opts),
+                    Norm = dev_scheduler_formats:aos2_to_assignment(Loaded, Opts),
+                    ?event({normalized_aos2_assignment, Norm}),
                     {ok, Norm};
-                _ ->
-                    {ok, Assignment}
+                <<"ao.N.1">> ->
+                    {ok, hb_cache:ensure_all_loaded(Assignment, Opts)}
             end;
         not_found ->
             ?event(debug_sched, {read_assignment, {res, not_found}}),
@@ -71,9 +107,11 @@ read(ProcID, Slot, Opts) ->
     end.
 
 %% @doc Get the assignments for a process.
-list(ProcID, Opts) ->
+list(ProcID, RawOpts) ->
+    Opts = opts(RawOpts),
     hb_cache:list_numbered(
         hb_store:path(hb_opts:get(store, no_viable_store, Opts), [
+            ?SCHEDULER_CACHE_PREFIX,
             "assignments",
             hb_util:human_id(ProcID)
         ]),
@@ -81,7 +119,8 @@ list(ProcID, Opts) ->
     ).
 
 %% @doc Get the latest assignment from the cache.
-latest(ProcID, Opts) ->
+latest(ProcID, RawOpts) ->
+    Opts = opts(RawOpts),
     ?event({getting_assignments_from_cache, {proc_id, ProcID}, {opts, Opts}}),
     case dev_scheduler_cache:list(ProcID, Opts) of
         [] ->
@@ -108,25 +147,38 @@ latest(ProcID, Opts) ->
     end.
 
 %% @doc Read the latest known scheduler location for an address.
-read_location(Address, Opts) ->
-    Res = hb_cache:read(
-        hb_store:path(hb_opts:get(store, no_viable_store, Opts), [
-            "scheduler-locations",
-            hb_util:human_id(Address)
-        ]),
-        Opts
-    ),
-    ?event({read_location_msg, {address, Address}, {res, Res}}),
+read_location(Address, RawOpts) ->
+    Opts = opts(RawOpts),
+    Res =
+        hb_cache:read(
+            hb_store:path(hb_opts:get(store, no_viable_store, Opts), [
+                ?SCHEDULER_CACHE_PREFIX,
+                "locations",
+                hb_util:human_id(Address)
+            ]),
+            Opts
+        ),
+    Event =
+        case Res of
+            {ok, _} -> found_in_store;
+            not_found -> not_found_in_store;
+            _ -> local_lookup_unexpected_result
+        end,
+    ?event(scheduler_location, {Event, {address, Address}, {res, Res}}),
     Res.
 
 %% @doc Write the latest known scheduler location for an address.
-write_location(LocMsg, Opts) ->
-    Signers = hb_message:signers(LocMsg),
-    ?event({writing_location_msg,
-        {signers, Signers},
-        {location_msg, LocMsg}
-    }),
-    case hb_message:verify(LocMsg, all) andalso hb_cache:write(LocMsg, Opts) of
+write_location(LocationMsg, RawOpts) ->
+    Opts = opts(RawOpts),
+    Signers = hb_message:signers(LocationMsg, Opts),
+    ?event(
+        scheduler_location,
+        {caching_locally,
+            {signers, Signers},
+            {location_msg, LocationMsg}
+        }
+    ),
+    case hb_cache:write(LocationMsg, Opts) of
         {ok, RootPath} ->
             lists:foreach(
                 fun(Signer) ->
@@ -136,7 +188,8 @@ write_location(LocMsg, Opts) ->
                         hb_store:path(
                             hb_opts:get(store, no_viable_store, Opts),
                             [
-                                "scheduler-locations",
+                                ?SCHEDULER_CACHE_PREFIX,
+                                "locations",
                                 hb_util:human_id(Signer)
                             ]
                         )
@@ -152,3 +205,377 @@ write_location(LocMsg, Opts) ->
             ?event(warning, {failed_to_cache_location_msg, {reason, Reason}}),
             {error, Reason}
     end.
+
+%%% Tests
+
+%% @doc Test that a volatile schedule is lost on restart.
+volatile_schedule_test() ->
+    VolStore = hb_test_utils:test_store(hb_store_fs, <<"volatile-sched">>),
+    NonVolStore = hb_test_utils:test_store(hb_store_fs, <<"non-volatile-sched">>),
+    Opts = #{
+        store => [NonVolStore],
+        scheduler_store => [VolStore]
+    },
+    hb_store:start(VolStore),
+    hb_store:start(NonVolStore),
+    Assignment = #{
+        <<"variant">> => <<"ao.N.1">>,
+        <<"process">> => ProcID = hb_util:human_id(crypto:strong_rand_bytes(32)),
+        <<"slot">> => 1,
+        <<"hash-chain">> => <<"test-hash-chain">>
+    },
+    ?assertEqual(ok, write(Assignment, Opts)),
+    ?assertMatch({1, _}, latest(ProcID, Opts)),
+    ?assertEqual({ok, Assignment}, read(ProcID, 1, Opts)),
+    hb_store:stop(VolStore),
+    hb_store:reset(VolStore),
+    hb_store:start(VolStore),
+    ?assertMatch(not_found, latest(ProcID, Opts)),
+    ?assertMatch(not_found, read(ProcID, 1, Opts)).
+
+%% @doc Test concurrent writes to scheduler store from multiple processes.
+concurrent_scheduler_write_test() ->
+    VolStore = hb_test_utils:test_store(hb_store_fs, <<"concurrent-vol">>),
+    NonVolStore = hb_test_utils:test_store(hb_store_fs, <<"concurrent-nonvol">>),
+    Opts = #{
+        store => [NonVolStore],
+        scheduler_store => [VolStore]
+    },
+    hb_store:start(VolStore),
+    hb_store:start(NonVolStore),
+    Workers = 50,
+    ProcID = hb_util:human_id(crypto:strong_rand_bytes(32)),
+    Parent = self(),
+    lists:foreach(fun(Slot) ->
+        spawn_link(fun() ->
+            Assignment = #{
+                <<"process">> => ProcID,
+                <<"slot">> => Slot,
+                <<"hash-chain">> =>
+                    <<"concurrent-test-", (integer_to_binary(Slot))/binary>>
+            },
+            Result = write(Assignment, Opts),
+            Parent ! {write_result, Slot, Result}
+        end)
+    end, lists:seq(1, Workers)),
+    Results =
+        lists:map(
+            fun(Slot) ->
+                receive
+                    {write_result, Slot, Result} -> 
+                        ?event(testing, {write_result, Slot, Result}),
+                        Result
+                after 5000 ->
+                    timeout
+                end
+            end,
+            lists:seq(1, Workers)
+        ),
+    ?event(testing, {concurrent_write_results, Results,Workers}),
+    ?assertEqual(lists:duplicate(Workers, ok), Results),
+    AllSlots = list(ProcID, Opts),
+    ?event(testing, {all_slots, AllSlots}),
+    ?assertEqual(Workers, length(AllSlots)),
+    ?assertEqual(lists:seq(1, Workers), lists:sort(AllSlots)).
+
+%% @doc Test concurrent reads during writes to detect race conditions.
+concurrent_read_write_test() ->
+    VolStore = hb_test_utils:test_store(hb_store_fs, <<"race-vol">>),
+    NonVolStore = hb_test_utils:test_store(hb_store_fs, <<"race-nonvol">>),
+    Opts = #{
+        store => [NonVolStore],
+        scheduler_store => [VolStore]
+    },
+    hb_store:start(VolStore),
+    hb_store:start(NonVolStore),
+    ProcID = hb_util:human_id(crypto:strong_rand_bytes(32)),
+    Parent = self(),
+    ?event(testing, {concurrent_test_proc_id, ProcID}),
+    spawn_link(fun() ->
+        lists:foreach(fun(Slot) ->
+            Assignment = #{
+                <<"variant">> => <<"ao.N.1">>,
+                <<"process">> => ProcID,
+                <<"slot">> => Slot,
+                <<"hash-chain">> => <<"race-test-", (integer_to_binary(Slot))/binary>>
+            },
+            write(Assignment, Opts),
+            timer:sleep(1)
+        end, lists:seq(1, 100)),
+        ?event(testing, {writer_completed}),
+        Parent ! writer_done
+    end),
+    lists:foreach(
+        fun(ReaderNum) ->
+            spawn_link(fun() ->
+                ReadResults = lists:map(fun(Slot) ->
+                    timer:sleep(rand:uniform(5)),
+                    case read(ProcID, Slot, Opts) of
+                        {ok, _} -> success;
+                        not_found -> not_found
+                    end
+                end, lists:seq(1, 100)),
+                SuccessCount = length([R || R <- ReadResults, R == success]),
+                ?event(testing, {reader_done, ReaderNum, SuccessCount}),
+                Parent ! {reader_done, ReaderNum, ReadResults}
+            end)
+        end,
+        lists:seq(1, 10)
+    ),
+    receive 
+        writer_done -> ok
+    after 15000 -> 
+        ?assert(false) 
+    end,
+    AllReaderResults = lists:map(fun(ReaderNum) ->
+        receive
+            {reader_done, ReaderNum, Results} -> Results
+        after 5000 ->
+            ?assert(false),
+            []
+        end
+    end, lists:seq(1, 10)),
+    FinalSlots = list(ProcID, Opts),
+    ?event(testing, {final_verification, {slots_found, length(FinalSlots)}}),
+    ?assertEqual(100, length(FinalSlots)),
+    ?assertEqual(lists:seq(1, 100), lists:sort(FinalSlots)),
+    TotalSuccessfulReads = lists:sum([
+        length([R || R <- Results, R == success]) || Results <- AllReaderResults
+    ]),
+    ?event(testing, {
+        concurrent_read_stats,
+        {total_successful_reads, TotalSuccessfulReads}
+    }),
+    ?assert(TotalSuccessfulReads > 0).
+
+%% @doc Test writing a large volume of assignments to stress memory. Helps
+%% identify memory leaks and also, checks performance issues.
+large_assignment_volume_test() ->
+    VolStore = hb_test_utils:test_store(hb_store_fs, <<"volume-vol">>),
+    NonVolStore = hb_test_utils:test_store(hb_store_fs, <<"volume-nonvol">>),
+    Opts = #{
+        store => [NonVolStore],
+        scheduler_store => [VolStore]
+    },
+    hb_store:start(VolStore),
+    hb_store:start(NonVolStore),
+    VolumeSize = 1000,
+    ProcID = hb_util:human_id(crypto:strong_rand_bytes(32)),
+    StartTime = erlang:monotonic_time(millisecond),
+    lists:foreach(
+        fun(Slot) ->
+            Assignment = #{
+                <<"variant">> => <<"ao.N.1">>,
+                <<"process">> => ProcID,
+                <<"slot">> => Slot,
+                <<"hash-chain">> => crypto:strong_rand_bytes(64)
+            },
+            ?assertEqual(ok, write(Assignment, Opts))
+        end,
+        lists:seq(1, VolumeSize)
+    ),
+    EndTime = erlang:monotonic_time(millisecond),
+    ?event(testing, {large_volume_write_time, EndTime - StartTime}),
+    AllSlots = list(ProcID, Opts),
+    ?assertEqual(VolumeSize, length(AllSlots)),
+    ?assertEqual(lists:seq(1, VolumeSize), lists:sort(AllSlots)),
+    ReadStartTime = erlang:monotonic_time(millisecond),
+    lists:foreach(fun(Slot) ->
+        ?assertMatch({ok, _}, read(ProcID, Slot, Opts))
+    end, lists:seq(1, VolumeSize)),
+    ReadEndTime = erlang:monotonic_time(millisecond),
+    ?event(testing, {large_volume_read_time, ReadEndTime - ReadStartTime}).
+
+%% @doc Test rapid store restarts under load.
+rapid_restart_test() ->
+    VolStore = hb_test_utils:test_store(hb_store_fs, <<"restart-vol">>),
+    NonVolStore = hb_test_utils:test_store(hb_store_fs, <<"restart-nonvol">>),
+    Opts = #{
+        store => [NonVolStore],
+        scheduler_store => [VolStore]
+    },
+    hb_store:start(VolStore),
+    hb_store:start(NonVolStore),
+    ProcID = hb_util:human_id(crypto:strong_rand_bytes(32)),
+    lists:foreach(
+        fun(Cycle) ->
+            lists:foreach(
+                fun(Slot) ->
+                    Assignment = #{
+                        <<"variant">> => <<"ao.N.1">>,
+                        <<"process">> => ProcID,
+                        <<"slot">> => Slot + (Cycle * 10),
+                        <<"hash-chain">> =>
+                            <<"restart-cycle-", (integer_to_binary(Cycle))/binary>>
+                    },
+                    ?assertEqual(ok, write(Assignment, Opts))
+                end,
+                lists:seq(1, 10)
+            ),
+            SlotsBeforeRestart = list(ProcID, Opts),
+            ?assertMatch([_|_], SlotsBeforeRestart),
+            ?event(testing, {
+                restart_cycle, Cycle, {slots_before, length(SlotsBeforeRestart)}
+            }),
+            hb_store:stop(VolStore),
+            timer:sleep(10),
+            hb_store:reset(VolStore),
+            hb_store:start(VolStore),
+            SlotsAfterRestart = list(ProcID, Opts),
+            ?assertEqual([], SlotsAfterRestart),
+            ?event({restart_verified, Cycle, {slots_after, length(SlotsAfterRestart)}})
+        end,
+        lists:seq(1, 5)
+    ).
+
+%% @doc Test scheduler store behavior during reset store operations.
+mixed_store_reset_operations_test() ->
+    VolStore = hb_test_utils:test_store(hb_store_fs, <<"mixed-vol">>),
+    NonVolStore = hb_test_utils:test_store(hb_store_fs, <<"mixed-nonvol">>),
+    Opts = #{
+        store => [NonVolStore],
+        scheduler_store => [VolStore]
+    },
+    hb_store:start(VolStore),
+    hb_store:start(NonVolStore),
+    ProcID = hb_util:human_id(crypto:strong_rand_bytes(32)),
+    Assignment1 = #{
+        <<"variant">> => <<"ao.N.1">>,
+        <<"process">> => ProcID,
+        <<"slot">> => 1,
+        <<"hash-chain">> => <<"mixed-test-1">>
+    },
+    ?assertEqual(ok, write(Assignment1, Opts)),
+    ?event(testing, {assignment_written, ProcID}),
+    hb_store:reset(NonVolStore),
+    ReadAfterNonVolReset = read(ProcID, 1, Opts),
+    ?assertMatch({ok, _}, ReadAfterNonVolReset),
+    ?event(testing, {after_nonvol_reset, ReadAfterNonVolReset}),
+    hb_store:reset(VolStore),
+    ReadAfterVolReset = read(ProcID, 1, Opts),
+    ?assertEqual(not_found, ReadAfterVolReset),
+    ?event(testing, {after_vol_reset, ReadAfterVolReset}).
+
+%% @doc Test handling of invalid assignment data.
+invalid_assignment_stress_test() ->
+    VolStore = hb_test_utils:test_store(hb_store_fs, <<"invalid-vol">>),
+    NonVolStore = hb_test_utils:test_store(hb_store_fs, <<"invalid-nonvol">>),
+    Opts = #{
+        store => [NonVolStore],
+        scheduler_store => [VolStore]
+    },
+    hb_store:start(VolStore),
+    hb_store:start(NonVolStore),
+    InvalidAssignments = [
+        #{},
+        #{<<"process">> => <<"invalid">>},
+        #{<<"slot">> => 1},
+        #{<<"process">> => <<>>, <<"slot">> => 1},
+        #{<<"process">> => <<"valid">>, <<"slot">> => -1},
+        #{<<"process">> => <<"valid">>, <<"slot">> => <<"not-integer">>}
+    ],
+    ?event(testing, {testing_invalid_assignments, length(InvalidAssignments)}),
+    Results = lists:map(fun(Assignment) ->
+        Result = try
+            write(Assignment, Opts)
+        catch
+            _:_ -> error
+        end,
+        ?assertNotEqual(ok, Result),
+        Result
+    end, InvalidAssignments),
+    
+    ErrorCount = length([R || R <- Results, R == error]),
+    ?event(
+        {invalid_assignment_results,
+            {errors, ErrorCount},
+            {total, length(InvalidAssignments)}
+        }
+    ),
+    ?assertEqual(6, ErrorCount).
+
+%% @doc Test scheduler location operations under stress.
+scheduler_location_stress_test() ->
+    VolStore = hb_test_utils:test_store(hb_store_fs, <<"location-vol">>),
+    NonVolStore = hb_test_utils:test_store(hb_store_fs, <<"location-nonvol">>),
+    Wallet = ar_wallet:new(),
+    Opts = #{
+        store => [NonVolStore],
+        scheduler_store => [VolStore],
+        priv_wallet => Wallet
+    },
+    hb_store:start(VolStore),
+    hb_store:start(NonVolStore),
+    LocationCount = 10,
+    ?event(testing, {location_stress_test_starting, LocationCount}),
+    Results =
+        lists:map(
+            fun(N) ->
+                LocationMsg = #{
+                    <<"scheduler">> =>
+                        hb_util:human_id(ar_wallet:to_address(Wallet)),
+                    <<"location">> =>
+                        <<
+                            "http://scheduler",
+                            (integer_to_binary(N))/binary,
+                            ".com"
+                        >>,
+                    <<"timestamp">> => erlang:system_time(millisecond),
+                    <<"ttl">> => 3600000
+                },
+                Result =
+                    try
+                        write_location(LocationMsg, Opts)
+                    catch
+                        Res -> 
+                            ?event(testing, {location_write_error, {error, Res}}),
+                            ok 
+                    end,
+                ?assert(Result == ok orelse element(1, Result) == error),
+                Result
+            end,
+            lists:seq(1, LocationCount)
+        ),
+    SuccessCount = length([R || R <- Results, R == ok]),
+    ?event(
+        {location_stress_results,
+            {successes, SuccessCount},
+            {total, LocationCount}
+        }
+    ).
+
+%% @doc Test system behavior with corrupted data in volatile store.
+volatile_store_corruption_test() ->
+    VolStore = hb_test_utils:test_store(hb_store_fs, <<"corruption-vol">>),
+    NonVolStore = hb_test_utils:test_store(hb_store_fs, <<"corruption-nonvol">>),
+    Opts = #{
+        store => [NonVolStore],
+        scheduler_store => [VolStore]
+    },
+    hb_store:start(VolStore),
+    hb_store:start(NonVolStore),
+    ProcID = hb_util:human_id(crypto:strong_rand_bytes(32)),
+    Assignment = #{
+        <<"variant">> => <<"ao.N.1">>,
+        <<"process">> => ProcID,
+        <<"slot">> => 1,
+        <<"hash-chain">> => <<"corruption-test">>
+    },
+    ?assertEqual(ok, write(Assignment, Opts)),
+    ReadBeforeCorruption = read(ProcID, 1, Opts),
+    ?assertMatch({ok, _}, ReadBeforeCorruption),
+    ?event(testing, {before_corruption, ReadBeforeCorruption}),
+    hb_store:reset(VolStore),
+    ?event(testing, {volatile_store_reset}),
+    ReadAfterCorruption = read(ProcID, 1, Opts),
+    SlotsAfterCorruption = list(ProcID, Opts),
+    LatestAfterCorruption = latest(ProcID, Opts),
+    ?assertEqual(not_found, ReadAfterCorruption),
+    ?assertEqual([], SlotsAfterCorruption),
+    ?assertEqual(not_found, LatestAfterCorruption),
+    ?event(testing,
+        { corruption_recovery_verified,
+            { read, ReadAfterCorruption },
+            { list, length(SlotsAfterCorruption) }, 
+            { latest, LatestAfterCorruption }
+    }).
\ No newline at end of file
diff --git a/src/dev_scheduler_formats.erl b/src/dev_scheduler_formats.erl
index 7ebcd8506..864c601dc 100644
--- a/src/dev_scheduler_formats.erl
+++ b/src/dev_scheduler_formats.erl
@@ -28,7 +28,7 @@ assignments_to_bundle(ProcID, Assignments, More, TimeInfo, RawOpts) ->
         <<"block-height">> => hb_util:int(Height),
         <<"block-hash">> => hb_util:human_id(Hash),
         <<"assignments">> =>
-            maps:from_list(
+            hb_maps:from_list(
                 lists:map(
                     fun(Assignment) ->
                         {
@@ -93,24 +93,23 @@ assignments_to_aos2(ProcID, Assignments, More, RawOpts) ->
 cursor(Assignment, RawOpts) ->
     Opts = format_opts(RawOpts),
     hb_ao:get(<<"slot">>, Assignment, Opts).
-
 %% @doc Convert an assignment to an AOS2-compatible JSON structure.
 assignment_to_aos2(Assignment, RawOpts) ->
     Opts = format_opts(RawOpts),
     Message = hb_ao:get(<<"body">>, Assignment, Opts),
-    AssignmentWithoutBody = maps:without([<<"body">>], Assignment),
+    AssignmentWithoutBody = hb_maps:without([<<"body">>], Assignment, Opts),
     #{
         <<"message">> =>
-            dev_json_iface:message_to_json_struct(Message),
+            dev_json_iface:message_to_json_struct(Message, Opts),
         <<"assignment">> =>
-            dev_json_iface:message_to_json_struct(AssignmentWithoutBody)
+            dev_json_iface:message_to_json_struct(AssignmentWithoutBody, Opts)
     }.
 
 %% @doc Convert an AOS2-style JSON structure to a normalized HyperBEAM
 %% assignments response.
 aos2_to_assignments(ProcID, Body, RawOpts) ->
     Opts = format_opts(RawOpts),
-    Assignments = maps:get(<<"edges">>, Body, Opts),
+    Assignments = hb_maps:get(<<"edges">>, Body, Opts, Opts),
     ?event({raw_assignments, Assignments}),
     ParsedAssignments =
         lists:map(
@@ -136,18 +135,18 @@ aos2_to_assignments(ProcID, Body, RawOpts) ->
 aos2_to_assignment(A, RawOpts) ->
     Opts = format_opts(RawOpts),
     % Unwrap the node if it is provided
-    Node = maps:get(<<"node">>, A, A),
+    Node = hb_maps:get(<<"node">>, A, A, Opts),
     ?event({node, Node}),
     {ok, Assignment} =
         hb_gateway_client:result_to_message(
-            aos2_normalize_data(maps:get(<<"assignment">>, Node)),
+            aos2_normalize_data(hb_maps:get(<<"assignment">>, Node, undefined, Opts)),
             Opts
         ),
     NormalizedAssignment = aos2_normalize_types(Assignment),
     {ok, Message} =
-        case maps:get(<<"message">>, Node) of
+        case hb_maps:get(<<"message">>, Node, undefined, Opts) of
             null ->
-                MessageID = maps:get(<<"message">>, Assignment),
+                MessageID = hb_maps:get(<<"message">>, Assignment, undefined, Opts),
                 ?event(error, {scheduler_did_not_provide_message, MessageID}),
                 case hb_cache:read(MessageID, Opts) of
                     {ok, Msg} -> {ok, Msg};
diff --git a/src/dev_scheduler_registry.erl b/src/dev_scheduler_registry.erl
index 5d209586c..3277a6d27 100644
--- a/src/dev_scheduler_registry.erl
+++ b/src/dev_scheduler_registry.erl
@@ -14,62 +14,98 @@ get_wallet() ->
     % TODO: We might want to use a different wallet per SU later.
     hb:wallet().
 
-%%% @doc Find a process associated with the processor ID in the local registry
-%%% If the process is not found, it will not create a new one 
+%% @doc Find a process associated with the processor ID in the local registry
+%% If the process is not found, it will not create a new one 
 find(ProcID) -> find(ProcID, false).
 
-%%% @doc Find a process associated with the processor ID in the local registry
-%%% If the process is not found and `GenIfNotHosted' is true, it attemps to create a new one 
-find(ProcID, GenIfNotHosted) ->
-    find(ProcID, GenIfNotHosted, #{ priv_wallet => hb:wallet() }).
+%% @doc Find a process associated with the processor ID in the local registry
+%% If the process is not found and `GenIfNotHosted' is true, it attemps to 
+%% create a new one 
+find(ProcID, ProcMsgOrFalse) ->
+    find(ProcID, ProcMsgOrFalse, #{ priv_wallet => hb:wallet() }).
 
-%%% @doc Same as `find/2' but with additional options passed when spawning a new process (if needed)
-find(ProcID, GenIfNotHosted, Opts) ->
-    case hb_name:lookup({dev_scheduler, ProcID}) of
-        undefined -> maybe_new_proc(ProcID, GenIfNotHosted, Opts);
+%% @doc Same as `find/2' but with additional options passed when spawning a 
+%% new process (if needed)
+find(ProcID, ProcMsgOrFalse, Opts) ->
+    case hb_name:lookup({<<"scheduler@1.0">>, ProcID}) of
+        undefined -> maybe_new_proc(ProcID, ProcMsgOrFalse, Opts);
         Pid -> Pid
     end.
 
-%%% @doc Return a list of all currently registered ProcID.
+%% @doc Return a list of all currently registered ProcID.
 get_processes() ->
     ?event({getting_processes, hb_name:all()}),
-    [ ProcID || {{dev_scheduler, ProcID}, _} <- hb_name:all() ].
+    [ ProcID || {{<<"scheduler@1.0">>, ProcID}, _} <- hb_name:all() ].
 
 maybe_new_proc(_ProcID, false, _Opts) -> not_found;
-maybe_new_proc(ProcID, _GenIfNotHosted, Opts) -> 
-    dev_scheduler_server:start(ProcID, Opts).
+maybe_new_proc(ProcID, ProcMsg, Opts) -> 
+    dev_scheduler_server:start(ProcID, ProcMsg, Opts).
 
 %%% Tests
 
--define(TEST_PROC_ID1, <<0:256>>).
--define(TEST_PROC_ID2, <<1:256>>).
+test_opts() ->
+    #{
+        store => hb_test_utils:test_store(),
+        priv_wallet => hb:wallet()
+    }.
+
+generate_test_procs(Opts) ->
+    [
+        hb_message:commit(
+            #{
+                <<"type">> => <<"Process">>,
+                <<"image">> => <<0:(1024*32)>>
+            },
+            Opts
+        ),
+        hb_message:commit(
+            #{
+                <<"type">> => <<"Process">>,
+                <<"image">> => <<0:(1024*32)>>
+            },
+            Opts
+        )
+    ].
 
 find_non_existent_process_test() ->
+    Opts = test_opts(),
+    [Proc1, _Proc2] = generate_test_procs(Opts),
     start(),
-    ?assertEqual(not_found, ?MODULE:find(?TEST_PROC_ID1)).
+    ?assertEqual(not_found, ?MODULE:find(hb_message:id(Proc1, all))).
 
 create_and_find_process_test() ->
+    Opts = test_opts(),
+    [Proc1, _Proc2] = generate_test_procs(Opts),
+    ID = hb_message:id(Proc1, all, Opts),
     start(),
-    Pid1 = ?MODULE:find(?TEST_PROC_ID1, true),
+    Pid1 = ?MODULE:find(ID, Proc1),
     ?assert(is_pid(Pid1)),
-    ?assertEqual(Pid1, ?MODULE:find(?TEST_PROC_ID1)).
+    ?assertEqual(Pid1, ?MODULE:find(ID, Proc1)).
 
 create_multiple_processes_test() ->
+    Opts = test_opts(),
+    [Proc1, Proc2] = generate_test_procs(Opts),
     start(),
-    Pid1 = ?MODULE:find(?TEST_PROC_ID1, true),
-    Pid2 = ?MODULE:find(?TEST_PROC_ID2, true),
+    ID1 = hb_message:id(Proc1, all, Opts),
+    ID2 = hb_message:id(Proc2, all, Opts),
+    Pid1 = ?MODULE:find(ID1, Proc1),
+    Pid2 = ?MODULE:find(ID2, Proc2),
     ?assert(is_pid(Pid1)),
     ?assert(is_pid(Pid2)),
     ?assertNotEqual(Pid1, Pid2),
-    ?assertEqual(Pid1, ?MODULE:find(?TEST_PROC_ID1)),
-    ?assertEqual(Pid2, ?MODULE:find(?TEST_PROC_ID2)).
+    ?assertEqual(Pid1, ?MODULE:find(ID1, Proc1)),
+    ?assertEqual(Pid2, ?MODULE:find(ID2, Proc2)).
 
 get_all_processes_test() ->
+    Opts = test_opts(),
+    [Proc1, Proc2] = generate_test_procs(Opts),
     start(),
-    ?MODULE:find(?TEST_PROC_ID1, true),
-    ?MODULE:find(?TEST_PROC_ID2, true),
+    ID1 = hb_message:id(Proc1, all, Opts),
+    ID2 = hb_message:id(Proc2, all, Opts),
+    ?MODULE:find(ID1, Proc1),
+    ?MODULE:find(ID2, Proc2),
     Processes = ?MODULE:get_processes(),
     ?assert(length(Processes) >= 2),
     ?event({processes, Processes}),
-    ?assert(lists:member(?TEST_PROC_ID1, Processes)),
-    ?assert(lists:member(?TEST_PROC_ID2, Processes)).
\ No newline at end of file
+    ?assert(lists:member(ID1, Processes)),
+    ?assert(lists:member(ID2, Processes)).
\ No newline at end of file
diff --git a/src/dev_scheduler_server.erl b/src/dev_scheduler_server.erl
index 5f39a070a..81d564de2 100644
--- a/src/dev_scheduler_server.erl
+++ b/src/dev_scheduler_server.erl
@@ -2,29 +2,54 @@
 %%% It acts as a deliberate 'bottleneck' to prevent the server accidentally
 %%% assigning multiple messages to the same slot.
 -module(dev_scheduler_server).
--export([start/2, schedule/2, stop/1]).
+-export([start/3, schedule/2, stop/1]).
 -export([info/1]).
 -include_lib("eunit/include/eunit.hrl").
 -include("include/hb.hrl").
 
+%%% By default, we wait 10 seconds for a response from the scheduler before
+%%% throwing an error on the client. If the scheduler is not able to sequence
+%%% the message within this time, it will be discarded upon recipient by the
+%%% server. This avoids situations in which the client did not receive 
+%%% confirmation of the assignment, but the scheduler still processes it.
+-define(DEFAULT_TIMEOUT, 10000).
+
 %% @doc Start a scheduling server for a given computation.
-start(ProcID, Opts) ->
+start(ProcID, Proc, Opts) ->
     ?event(scheduling, {starting_scheduling_server, {proc_id, ProcID}}),
     spawn_link(
         fun() ->
+            % Before we start, register the scheduler name.
+            case hb_name:register({<<"scheduler@1.0">>, ProcID}) of
+                ok -> ok;
+                error ->
+                    throw(
+                        {another_scheduler_is_already_registered,
+                            {proc_id, ProcID}
+                        }
+                    )
+            end,
+            % Write the process to the cache. We are the provider-of-last-resort
+            % for this data.
+            dev_scheduler_cache:write_spawn(Proc, Opts),
             case hb_opts:get(scheduling_mode, disabled, Opts) of
                 disabled ->
                     throw({scheduling_disabled_on_node, {requested_for, ProcID}});
                 _ -> ok
             end,
-            hb_name:register({dev_scheduler, ProcID}),
             {CurrentSlot, HashChain} =
                 case dev_scheduler_cache:latest(ProcID, Opts) of
                     not_found ->
                         ?event({starting_new_schedule, {proc_id, ProcID}}),
                         {-1, <<>>};
                     {Slot, Chain} ->
-                        ?event({continuing_schedule, {proc_id, ProcID}, {current_slot, Slot}}),
+                        ?event(
+                            {continuing_schedule,
+                                {proc_id, ProcID},
+                                {current_slot, Slot},
+                                {hash_chain, Chain}
+                            }
+                        ),
                         {Slot, Chain}
                 end,
             ?event(
@@ -38,22 +63,60 @@ start(ProcID, Opts) ->
                 #{
                     id => ProcID,
                     current => CurrentSlot,
-                    wallet => hb_opts:get(priv_wallet, hb:wallet(), Opts),
                     hash_chain => HashChain,
+                    wallets => commitment_wallets(Proc, Opts),
+                    mode =>
+                        hb_opts:get(
+                            scheduling_mode,
+                            remote_confirmation,
+                            Opts
+                        ),
                     opts => Opts
                 }
             )
         end
     ).
 
+%% @doc Determine the appropriate list of keys to use to commit assignments for
+%% a process.
+commitment_wallets(ProcMsg, Opts) ->
+    SchedulerVal =
+        hb_ao:get_first(
+            [
+                {ProcMsg, <<"scheduler">>},
+                {ProcMsg, <<"scheduler-location">>}
+            ],
+            [],
+            Opts
+        ),
+    lists:filtermap(
+        fun(Scheduler) ->
+            case hb_opts:as(Scheduler, Opts) of
+                {ok, #{ priv_wallet := Wallet }} -> {true, Wallet};
+                _ -> false
+            end
+        end,
+        dev_scheduler:parse_schedulers(SchedulerVal)
+    ).
+
 %% @doc Call the appropriate scheduling server to assign a message.
 schedule(AOProcID, Message) when is_binary(AOProcID) ->
     schedule(dev_scheduler_registry:find(AOProcID), Message);
 schedule(ErlangProcID, Message) ->
-    ErlangProcID ! {schedule, Message, self()},
+    ?event(
+        {scheduling_message,
+            {proc_id, ErlangProcID},
+            {message, Message},
+            {is_alive, is_process_alive(ErlangProcID)}
+        }
+    ),
+    AbortTime = scheduler_time() + ?DEFAULT_TIMEOUT,
+    ErlangProcID ! {schedule, Message, self(), AbortTime},
     receive
         {scheduled, Message, Assignment} ->
             Assignment
+    after ?DEFAULT_TIMEOUT ->
+        throw({scheduler_timeout, {proc_id, ErlangProcID}, {message, Message}})
     end.
 
 %% @doc Get the current slot from the scheduling server.
@@ -70,8 +133,23 @@ stop(ProcID) ->
 %% returns the current slot.
 server(State) ->
     receive
-        {schedule, Message, Reply} ->
-            server(assign(State, Message, Reply));
+        {schedule, Message, Reply, AbortTime} ->
+            case SchedTime = scheduler_time() > AbortTime of
+                true ->
+                    % Ignore scheduling requests if they are too old. The
+                    % `abort-time' signals to us that the client has already
+                    % given up on the request, so in order to maintain
+                    % predictability we ignore it.
+                    ?event(error,
+                        {received_old_schedule_request,
+                            {abort_time, AbortTime},
+                            {sched_time, SchedTime}
+                        }
+                    ),
+                    server(State);
+                false ->
+                    server(assign(State, Message, Reply))
+            end;
         {info, Reply} ->
             Reply ! {info, State},
             server(State);
@@ -90,32 +168,49 @@ assign(State, Message, ReplyPID) ->
 
 %% @doc Generate and store the actual assignment message.
 do_assign(State, Message, ReplyPID) ->
-    HashChain = next_hashchain(maps:get(hash_chain, State), Message),
+    % Ensure that only committed keys from the message are included in the
+    % assignment.
+    {ok, OnlyAttested} =
+        hb_message:with_only_committed(
+            Message,
+            Opts = maps:get(opts, State)
+        ),
+    HashChain =
+        next_hashchain(
+            maps:get(hash_chain, State),
+            OnlyAttested,
+            Opts
+        ),
     NextSlot = maps:get(current, State) + 1,
     % Run the signing of the assignment and writes to the disk in a separate
     % process.
     AssignFun =
         fun() ->
             {Timestamp, Height, Hash} = ar_timestamp:get(),
-            Assignment = hb_message:commit(#{
-                <<"path">> =>
-                    case hb_path:from_message(request, Message) of
-                        undefined -> <<"compute">>;
-                        Path -> Path
-                    end,
-                <<"data-protocol">> => <<"ao">>,
-                <<"variant">> => <<"ao.N.1">>,
-                <<"process">> => hb_util:id(maps:get(id, State)),
-                <<"epoch">> => <<"0">>,
-                <<"slot">> => NextSlot,
-                <<"block-height">> => Height,
-                <<"block-hash">> => hb_util:human_id(Hash),
-                <<"block-timestamp">> => Timestamp,
-                % Note: Local time on the SU, not Arweave
-                <<"timestamp">> => erlang:system_time(millisecond),
-                <<"hash-chain">> => hb_util:id(HashChain),
-                <<"body">> => Message
-            }, maps:get(wallet, State)),
+            Assignment =
+                commit_assignment(
+                    #{
+                        <<"path">> =>
+                            case hb_path:from_message(request, Message, Opts) of
+                                undefined -> <<"compute">>;
+                                Path -> Path
+                            end,
+                        <<"data-protocol">> => <<"ao">>,
+                        <<"variant">> => <<"ao.N.1">>,
+                        <<"process">> => hb_util:id(maps:get(id, State)),
+                        <<"epoch">> => <<"0">>,
+                        <<"slot">> => NextSlot,
+                        <<"block-height">> => Height,
+                        <<"block-hash">> => hb_util:human_id(Hash),
+                        <<"block-timestamp">> => Timestamp,
+                        % Note: Local time on the SU, not Arweave
+                        <<"timestamp">> => scheduler_time(),
+                        <<"hash-chain">> => hb_util:id(HashChain),
+                        <<"body">> => OnlyAttested,
+                        <<"type">> => <<"Assignment">>
+                    },
+                    State
+                ),
             AssignmentID = hb_message:id(Assignment, all),
             ?event(scheduling,
                 {assigned,
@@ -132,7 +227,7 @@ do_assign(State, Message, ReplyPID) ->
                 State
             ),
             ?event(starting_message_write),
-            ok = dev_scheduler_cache:write(Assignment, maps:get(opts, State)),
+            ok = dev_scheduler_cache:write(Assignment, Opts),
             maybe_inform_recipient(
                 local_confirmation,
                 ReplyPID,
@@ -142,7 +237,7 @@ do_assign(State, Message, ReplyPID) ->
             ),
             ?event(writes_complete),
             ?event(uploading_assignment),
-            hb_client:upload(Assignment, maps:get(opts, State)),
+            hb_client:upload(Assignment, Opts),
             ?event(uploads_complete),
             maybe_inform_recipient(
                 remote_confirmation,
@@ -152,7 +247,7 @@ do_assign(State, Message, ReplyPID) ->
                 State
             )
         end,
-    case hb_opts:get(scheduling_mode, sync, maps:get(opts, State)) of
+    case hb_opts:get(scheduling_mode, sync, Opts) of
         aggressive ->
             spawn(AssignFun);
         Other ->
@@ -164,53 +259,71 @@ do_assign(State, Message, ReplyPID) ->
         hash_chain := HashChain
     }.
 
+%% @doc Commit to the assignment using all of our appropriate wallets.
+commit_assignment(BaseAssignment, State) ->
+    Wallets = maps:get(wallets, State),
+    Opts = maps:get(opts, State),
+    lists:foldr(
+        fun(Wallet, Assignment) ->
+            hb_message:commit(Assignment, Opts#{ priv_wallet => Wallet })
+        end,
+        BaseAssignment,
+        Wallets
+    ).
+
+%% @doc Potentially inform the caller that the assignment has been scheduled.
+%% The main assignment loop calls this function repeatedly at different stages
+%% of the assignment process. The scheduling mode determines which stages
+%% trigger an update.
 maybe_inform_recipient(Mode, ReplyPID, Message, Assignment, State) ->
-    case hb_opts:get(scheduling_mode, remote_confirmation, maps:get(opts, State)) of
+    case maps:get(mode, State) of
         Mode -> ReplyPID ! {scheduled, Message, Assignment};
         _ -> ok
     end.
 
 %% @doc Create the next element in a chain of hashes that links this and prior
 %% assignments.
-next_hashchain(HashChain, Message) ->
+next_hashchain(HashChain, Message, Opts) ->
     ?event({creating_next_hashchain, {hash_chain, HashChain}, {message, Message}}),
-    ID = hb_message:id(Message, all),
+    ID = hb_message:id(Message, all, Opts),
     crypto:hash(
         sha256,
         << HashChain/binary, ID/binary >>
     ).
 
+%% @doc Return the current time in milliseconds.
+scheduler_time() ->
+    erlang:system_time(millisecond).
+
 %% TESTS
 
 %% @doc Test the basic functionality of the server.
-new_proc_test_() ->
-	{timeout, 20, fun() -> 
-		Wallet = ar_wallet:new(),
-		SignedItem = hb_message:commit(
-			#{ <<"data">> => <<"test">>, <<"random-key">> => rand:uniform(10000) },
-			Wallet
-		),
-		SignedItem2 = hb_message:commit(
-			#{ <<"data">> => <<"test2">> },
-			Wallet
-		),
-		SignedItem3 = hb_message:commit(
-			#{
-				<<"data">> => <<"test2">>,
-				<<"deep-key">> =>
-					#{ <<"data">> => <<"test3">> }
-			},
-			Wallet
-		),
-		dev_scheduler_registry:find(hb_ao:get(id, SignedItem), true),
-		schedule(ID = hb_ao:get(id, SignedItem), SignedItem),
-		schedule(ID, SignedItem2),
-		schedule(ID, SignedItem3),
-		?assertMatch(
-			#{ current := 2 },
-			dev_scheduler_server:info(dev_scheduler_registry:find(ID))
-		)
-	end}.
+new_proc_test() ->
+    Wallet = ar_wallet:new(),
+    SignedItem = hb_message:commit(
+        #{ <<"data">> => <<"test">>, <<"random-key">> => rand:uniform(10000) },
+        #{ priv_wallet => Wallet }
+    ),
+    SignedItem2 = hb_message:commit(
+        #{ <<"data">> => <<"test2">> },
+        #{ priv_wallet => Wallet }
+    ),
+    SignedItem3 = hb_message:commit(
+        #{
+            <<"data">> => <<"test2">>,
+            <<"deep-key">> =>
+                #{ <<"data">> => <<"test3">> }
+        },
+        #{ priv_wallet => Wallet }
+    ),
+    dev_scheduler_registry:find(hb_message:id(SignedItem, all), SignedItem),
+    schedule(ID = hb_message:id(SignedItem, all), SignedItem),
+    schedule(ID, SignedItem2),
+    schedule(ID, SignedItem3),
+    ?assertMatch(
+        #{ current := 2 },
+        dev_scheduler_server:info(dev_scheduler_registry:find(ID))
+    ).
     
 
 % benchmark_test() ->
@@ -222,7 +335,7 @@ new_proc_test_() ->
 %     ),
 %     dev_scheduler_registry:find(ID = hb_ao:get(id, SignedItem), true),
 %     ?event({benchmark_start, ?MODULE}),
-%     Iterations = hb:benchmark(
+%     Iterations = hb_test_utils:benchmark(
 %         fun(X) ->
 %             MsgX = #{
 %                 path => <<"Schedule">>,
@@ -237,7 +350,7 @@ new_proc_test_() ->
 %         end,
 %         BenchTime
 %     ),
-%     hb_util:eunit_print(
+%     hb_formatter:eunit_print(
 %         "Scheduled ~p messages in ~p seconds (~.2f msg/s)",
 %         [Iterations, BenchTime, Iterations / BenchTime]
 %     ),
diff --git a/src/dev_secret.erl b/src/dev_secret.erl
new file mode 100644
index 000000000..ce01df21a
--- /dev/null
+++ b/src/dev_secret.erl
@@ -0,0 +1,1147 @@
+%%% @doc A device that allows a node to create, export, and commit messages with
+%%% secrets that are stored on the node itself. Users of this device must specify
+%%% an `access-control' message which requests are validated against before 
+%%% access to secrets is granted.
+%%% 
+%%% This device is intended for use in situations in which the node is trusted
+%%% by the user, for example if it is running on their own machine or in a
+%%% TEE-protected environment that they deem to be secure.
+%%% 
+%%% # Authentication Flow
+%%% 
+%%% Each secret is associated with an `access-control' message and a list of
+%%% `controllers' that may access it. The `access-control' system is pluggable
+%%% -- users may configure their messages to call any AO-Core device that is
+%%% executable on the host node. The default `access-control' message uses the
+%%% `~cookie@1.0' device's `generate' and `verify' keys to authenticate users.
+%%% 
+%%% During secret generation:
+%%% 1. This device creates the secret and determines its `committer' address.
+%%% 2. The device invokes the caller's `access-control' message with the `commit'
+%%%    path and the `keyid' in the request.
+%%% 3. The `access-control' message sets up authentication (e.g., creates cookies,
+%%%    secrets) and returns a response, containing a commitment with a `keyid'
+%%%    field. This `keyid' is used to identify the user's 'access secret' which
+%%%    grants them the ability to use the device's 'hidden' secret in the future.
+%%% 4. This device stores both the secret and the initialized `access-control'
+%%%    message, as well as its other metadata.
+%%% 5. This device returns the initialized `access-control' message with the
+%%%    secret's `keyid' added to the `body' field.
+%%% 
+%%% During secret operations (commit, export, etc.):
+%%% 1. This device retrieves the stored `access-control' message for the
+%%%    secret either from persistent storage or from the node message's private
+%%%    element. The keyid of the `access secret' is either provided by the 
+%%%    user in the request, or is determined from a provided `secret' parameter
+%%%    in the request.
+%%% 2. This device calls the `access-control' message with path `verify' and
+%%%    the user's request.
+%%% 3. The `access-control' message verifies the request (e.g., checks cookies,
+%%%    provided authentication credentials, etc.).
+%%% 4. If verification passes, the device performs the requested operation.
+%%% 5. If verification fails, a 400 error is returned.
+%%% 
+%%% # Access Control Message Requirements
+%%% 
+%%% Access control messages are fully customizable by callers, but must support
+%%% two paths:
+%%% 
+%%% `/commit': Called during secret generation to bind the `access-control'
+%%%            template message to the given `keyid' (secret reference).
+%%%  - Input:  Request message containing `keyid' field with the secret's `keyid'
+%%%            in the `body' field.
+%%%  - Output: Response message with authentication setup (cookies, tokens, etc.).
+%%%            This message will be used as the `Base' message for the `verify'
+%%%            path.
+%%% 
+%%% `/verify': Called before allowing an operation that requires access to a
+%%%            secret to proceed.
+%%%   - Base:    The initialized `access-control' message from the `commit' path.
+%%%   - Request: Caller's request message with authentication credentials.
+%%%   - Output:  `false' if an error has occurred. If the request is valid, the
+%%%            `access-control' message should return either `true' or a modification
+%%%            of the request message which will be used for any subsequent
+%%%            operations.
+%%% 
+%%% The default `access-control' message is `~cookie@1.0', which uses HTTP
+%%% cookies with secrets to authenticate users.
+%%% 
+%%% # Secret Generation Parameters
+%%% 
+%%% The following parameters are supported by the `generate' key:
+%%% 
+%%% ```
+%%% /generate
+%%%     - `access-control' (optional): The `access-control' message to use.
+%%%                  Defaults to `#{<<"device">> => <<"cookie@1.0">>}'.
+%%%     - `keyid' (optional): The `keyid' of the secret to generate. If not
+%%%                  provided, the secret's address will be used as the name.
+%%%     - `persist' (optional): How the node should persist the secret. Options:
+%%%       - `client': The secret is generated on the server, but not persisted.
+%%%                  The full secret key is returned for the user to store.
+%%%       - `in-memory': The wallet is generated on the server and persisted only
+%%%                  in local memory, never written to disk.
+%%%       - `non-volatile': The wallet is persisted to non-volatile storage on 
+%%%                  the node. The store used by this option is segmented from
+%%%                  the node's main storage, configurable via the `priv_store'
+%%%                  node message option.
+%%%     - `controllers' (optional): A list of controllers that may access the
+%%%                  secret. Defaults to the node's `wallet_admin' option if set,
+%%%                  or its operator address if not.
+%%%     - `required-controllers' (optional): The number of controllers that must
+%%%                  sign the secret for it to be valid. Defaults to `1'.
+%%%     
+%%%     The response will contain authentication setup (such as cookies) from the
+%%%     `access-control' message, plus the secret's `keyid' in the `body' field.
+%%%     The secret's key is not returned to the user unless the `persist' option
+%%%     is set to `client'. If it is, the `~cookie@1.0' device will be employed
+%%%     to set the user's cookie with the secret.
+%%% 
+%%% /import
+%%%     Parameters:
+%%%     - `key' (optional): The JSON-encoded secret to import.
+%%%     - `cookie' (optional): A structured-fields cookie containing a map with
+%%%       a `key' field which is a JSON-encoded secret.
+%%%     - `access-control' (optional): The `access-control' message to use.
+%%%     - `persist' (optional): How the node should persist the secret. The
+%%%       supported options are as with the `generate' key.
+%%% 
+%%%     Imports a secret for hosting from the user. Executes as `generate' does,
+%%%     except that it expects the key to store to be provided either directly
+%%%     via the `key' parameter as a `keyid' field in the cookie Structured-Fields
+%%%     map. Support for loading the key from the cookie is provided such that
+%%%     a previously-generated secret by the user can have its persistence mode
+%%%     changed.
+%%% 
+%%% /list
+%%%     Parameters:
+%%%     - `keyids' (optional): A list of `keyid's to list. If not provided,
+%%%       all secrets will be listed via the `keyid' that is must be provided
+%%%       in order to access them.
+%%% 
+%%%     Lists all hosted secrets on the node by the `keyid' that is used to
+%%%     access them. If `keyids' is provided, only the secrets with those
+%%%     `keyid's will be listed.
+%%% 
+%%% /commit
+%%%     Parameters:
+%%%     - `keyid' (optional): The `keyid' of the secret to commit with.
+%%%     - Authentication credentials as required by the `access-control' message.
+%%% 
+%%%     Commits the given message using the specified secret after authentication.
+%%%     If no `keyid' parameter is provided, the request's authentication data
+%%%     (such as cookies) must contain secret identification.
+%%% 
+%%% /export
+%%%     Parameters:
+%%%     - `keyids' (optional): A list of `keyid's to export, or `all' to
+%%%       export all secrets for which the request passes authentication.
+%%% 
+%%%     Exports a given secret or set of secrets. If multiple secrets are
+%%%     requested, the result is a message with form `keyid => #{ `key` =>
+%%%     JSON-encoded secret, `access-control' => `access-control' message,
+%%%     `controllers' => [address, ...], `required-controllers' => integer,
+%%%     `persist' => `client' | `in-memory' | `non-volatile' }'.
+%%% 
+%%%     A secret will be exported if:
+%%%     - The given request passes each requested secret's `access-control'
+%%%       message; or
+%%%     - The request passes each requested secret's `controllers' parameter
+%%%       checks.
+%%% 
+%%% /sync
+%%%     Parameters:
+%%%     - `node': The peer node to pull secrets from.
+%%%     - `as' (optional): The identity it should use when signing its request
+%%%       to the remote peer.
+%%%     - `keyids' (optional): A list of `keyid's to export, or `all' to load
+%%%       every available secret. Defaults to `all'.
+%%% 
+%%%     Attempts to download all (or a given subset of) secrets from the given
+%%%     node and import them. If the `keyids' parameter is provided, only the
+%%%     secrets with those `keyid's will be imported. The `as' parameter is
+%%%     used to inform the node which key it should use to sign its request to
+%%%     the remote peer, such that its request validates against the secret's
+%%%     `access-control' messages on the remote peer.
+%%% '''
+-module(dev_secret).
+-export([generate/3, import/3, list/3, commit/3, export/3, sync/3]).
+-include_lib("eunit/include/eunit.hrl").
+-include("include/hb.hrl").
+
+-define(DEFAULT_AUTH_DEVICE, <<"cookie@1.0">>).
+
+%% @doc Generate a new wallet for a user and register it on the node. If the
+%% `committer' field is provided, we first check whether there is a wallet
+%% already registered for it. If there is, we return the wallet details.
+generate(Base, Request, Opts) ->
+    case request_to_wallets(Base, Request, Opts) of
+        [] ->
+            % No wallets found, create a new one.
+            Wallet = ar_wallet:new(),
+            register_wallet(Wallet, Base, Request, Opts);
+        [WalletDetails] ->
+            ?event({details, WalletDetails}),
+            % Wallets found, return them.
+            {
+                ok,
+                WalletDetails#{
+                    <<"body">> =>
+                        hb_maps:get(
+                            <<"keyid">>,
+                            Base,
+                            Opts
+                        )
+                }
+            }
+    end.
+
+%% @doc Import a wallet for hosting on the node. Expects the keys to be either
+%% provided as a list of keys, or a single key in the `key' field. If neither
+%% are provided, the keys are extracted from the cookie.
+import(Base, Request, Opts) ->
+    Wallets =
+        case hb_maps:find(<<"key">>, Request, Opts) of
+            {ok, Keys} when is_list(Keys) ->
+                [ wallet_from_key(Key) || Key <- Keys ];
+            {ok, Key} ->
+                [ wallet_from_key(hb_escape:decode_quotes(Key)) ];
+            error ->
+                request_to_wallets(Base, Request, Opts)
+        end,
+    case Wallets of
+        [] ->
+            {error, <<"No viable wallets found to import.">>};
+        Wallets ->
+            import_wallets(Wallets, Base, Request, Opts)
+    end.
+
+%% @doc Register a series of wallets, returning a summary message with the
+%% list of imported wallets, as well as merged cookies.
+import_wallets(Wallets, Base, Request, Opts) ->
+    Res =
+        lists:foldl(
+            fun(Wallet, Acc) ->
+                case register_wallet(Wallet, Base, Request, Opts) of
+                    {ok, RegRes} ->
+                        % Merge the private element of the registration response
+                        % into the accumulator.
+                        WalletAddress = hb_maps:get(<<"wallet-address">>, RegRes, Opts),
+                        OldImported = hb_maps:get(<<"imported">>, Acc, [], Opts),
+                        Merged =
+                            hb_private:merge(
+                                Acc,
+                                RegRes,
+                                Opts
+                            ),
+                        Merged#{
+                            <<"imported">> => [ WalletAddress | OldImported ]
+                        };
+                    {error, _} -> Acc
+                end
+            end,
+            #{},
+            Wallets
+        ),
+    {ok,
+        Res#{
+            <<"body">> =>
+                addresses_to_binary(hb_maps:get(<<"imported">>, Res, [], Opts))
+        }
+    }.
+
+%% @doc Transform a wallet key serialized form into a wallet.
+wallet_from_key(Key) when is_binary(Key) ->
+    ar_wallet:from_json(Key);
+wallet_from_key(Key) ->
+    Key.
+
+%% @doc Register a wallet on the node.
+register_wallet(Wallet, Base, Request, Opts) ->
+    % Find the wallet's address.
+    {PrivKey, _} = Wallet,
+    Address = hb_util:human_id(ar_wallet:to_address(Wallet)),
+    % Determine how to persist the wallet.
+    PersistMode = hb_ao:get(<<"persist">>, Request, <<"in-memory">>, Opts),
+    % Get the authentication message from the request. If the message is a path
+    % or a message with a `path' field, we resolve it to get the base.
+    {ok, BaseAccessControl} =
+        case hb_ao:get(<<"access-control">>, Base, undefined, Opts) of
+            undefined ->
+                ?event(
+                    debug_auth,
+                    {defaulting_access_control, {base, Base}, {request, Request}}
+                ),
+                {ok, #{ <<"device">> => ?DEFAULT_AUTH_DEVICE }};
+            AuthPath when is_binary(AuthPath) ->
+                hb_ao:resolve(AuthPath, Opts);
+            Msg ->
+                case hb_maps:is_key(<<"path">>, Msg, Opts) of
+                    true -> hb_ao:resolve(Msg, Opts);
+                    false -> {ok, Msg}
+                end
+        end,
+    AccessControl =
+        BaseAccessControl#{
+            <<"wallet-address">> => hb_util:human_id(Address)
+        },
+    Controllers =
+        hb_ao:get(<<"controllers">>, Request, default, Opts),
+    RequiredControllers =
+        hb_util:int(hb_ao:get(<<"required-controllers">>, Request, 1, Opts)),
+    % Call authentication device to set up auth. Pass the wallet address as the
+    % nonce. Some auth devices may use the nonce to track the messages that
+    % they have committed.
+    AuthRequest =
+        case hb_ao:get(<<"secret">>, Base, undefined, Opts) of
+            undefined ->
+                Request#{
+                    <<"path">> => <<"commit">>
+                };
+            Secret ->
+                Request#{
+                    <<"path">> => <<"commit">>,
+                    <<"secret">> => Secret
+                }
+        end,
+    ?event({register_wallet, {access_control, AccessControl}, {request, AuthRequest}}),
+    case hb_ao:resolve(AccessControl, AuthRequest, Opts) of
+        {ok, InitializedAuthMsg} ->
+            ?event({register_wallet_success, {initialized_auth_msg, InitializedAuthMsg}}),
+            % Find the new signer address.
+            PriorSigners = hb_message:signers(AccessControl, Opts),
+            NewSigners = hb_message:signers(InitializedAuthMsg, Opts),
+            [Committer] = NewSigners -- PriorSigners,
+            % Store wallet details.
+            WalletDetails =
+                #{
+                    <<"wallet">> => ar_wallet:to_json(PrivKey),
+                    <<"address">> => hb_util:human_id(Address),
+                    <<"persist">> => PersistMode,
+                    <<"access-control">> => hb_private:reset(InitializedAuthMsg),
+                    <<"committer">> => Committer,
+                    <<"controllers">> => parse_controllers(Controllers, Opts),
+                    <<"required-controllers">> => RequiredControllers
+                },
+            persist_registered_wallet(WalletDetails, InitializedAuthMsg, Opts);
+        {error, Reason} ->
+            ?event({register_wallet_error, {reason, Reason}}),
+            {error, Reason}
+    end.
+
+%% @doc Persist a wallet and return the auth response. Optionally takes a
+%% response base that is used as the message to build upon for the eventual
+%% user-response.
+persist_registered_wallet(WalletDetails, Opts) ->
+    persist_registered_wallet(WalletDetails, #{}, Opts).
+persist_registered_wallet(WalletDetails, RespBase, Opts) ->
+    % Add the wallet address as the body of the response.
+    Address = hb_maps:get(<<"address">>, WalletDetails, undefined, Opts),
+    ?event({resp_base, RespBase, WalletDetails}),
+    AccessControl = hb_maps:get(<<"access-control">>, WalletDetails, #{}, Opts),
+    {ok, _, Commitment} = hb_message:commitment(#{}, AccessControl, Opts),
+    KeyID = hb_maps:get(<<"keyid">>, Commitment, Opts),
+    Base = RespBase#{ <<"body">> => KeyID },
+    % Determine how to persist the wallet.
+    case hb_maps:get(<<"persist">>, WalletDetails, <<"in-memory">>, Opts) of
+        <<"client">> ->
+            ?event({wallet_details, WalletDetails}),
+            % Find the necessary wallet details to set the cookie on the client.
+            JSONKey = hb_maps:get(<<"wallet">>, WalletDetails, undefined, Opts),
+            % Don't store, set the cookie in the response.
+            hb_ao:resolve(
+                Base#{ <<"device">> => <<"cookie@1.0">> },
+                #{
+                    <<"path">> => <<"store">>,
+                    <<"wallet-", Address/binary>> => hb_escape:encode_quotes(JSONKey)
+                },
+                Opts
+            );
+        PersistMode ->
+            % Store wallet and return auth response with wallet info.
+            store_wallet(
+                hb_util:key_to_atom(PersistMode, existing),
+                KeyID,
+                WalletDetails,
+                Opts
+            ),
+            ?event(
+                {stored_and_returning,
+                    {auth_response, Base},
+                    {wallet_details, WalletDetails}
+                }
+            ),
+            % Return auth response with wallet info added.
+            {ok, Base}
+    end.
+
+%% @doc List all hosted wallets
+list(_Base, _Request, Opts) ->
+    {ok, list_wallets(Opts)}.
+
+%% @doc Sign a message with a wallet.
+commit(Base, Request, Opts) ->
+    ?event({commit_invoked, {base, Base}, {request, Request}}),
+    case request_to_wallets(Base, Request, Opts) of
+        [] -> {error, <<"No wallets found to sign with.">>};
+        WalletDetailsList ->
+            ?event(
+                {commit_signing,
+                    {request, Request},
+                    {wallet_list, WalletDetailsList}
+                }
+            ),
+            {
+                ok,
+                lists:foldl(
+                    fun(WalletDetails, Acc) ->
+                        ?event(
+                            {invoking_commit_message,
+                                {message, Acc},
+                                {wallet, WalletDetails}
+                            }
+                        ),
+                        commit_message(Acc, WalletDetails, Opts)
+                    end,
+                    Base,
+                    WalletDetailsList
+                )
+            }
+    end.
+
+%% @doc Take a request and return the wallets it references. Performs validation
+%% of access rights for the wallets before returning them.
+request_to_wallets(Base, Request, Opts) ->
+    % Get the wallet references or keys from the request or cookie.
+    ?event({request_to_wallets, {base, Base}, {request, Request}}),
+    Keys =
+        hb_ao:get_first(
+            [
+                {Request, <<"secret">>},
+                {Base, <<"secret">>}
+            ],
+            <<"all">>,
+            Opts
+        ),
+    ?event({request_to_wallets, {keys, Keys}}),
+    WalletKeyIDs =
+        case hb_maps:get(<<"keyids">>, Request, not_found, Opts) of
+            not_found ->
+                case Keys of
+                    <<"all">> ->
+                            % Get the wallet name from the cookie.
+                        wallets_from_cookie(Request, Opts);
+                    _ -> secrets_to_keyids(Keys)
+                end;
+        KeyIDs -> lists:map(fun(KeyID) ->
+                    Wallet = find_wallet(KeyID, Opts),
+                    {secret, KeyID, hb_maps:get(<<"wallet">>, Wallet, Opts) }
+                end, KeyIDs)
+    end,
+    ?event({attempting_to_load_wallets, {keyids, WalletKeyIDs}, {request, Request}}),
+    lists:filtermap(
+        fun(WalletKeyID) ->
+            case load_and_verify(WalletKeyID, Base, Request, Opts) of
+                {ok, WalletDetails} ->
+                    ?event({request_to_wallets, {loaded_wallet, WalletDetails}}),
+                    {true, WalletDetails};
+                {error, Reason} ->
+                    ?event(
+                        {failed_to_load_wallet,
+                            {keyid, WalletKeyID},
+                            {reason, Reason}
+                        }
+                    ),
+                    false
+            end
+        end,
+        WalletKeyIDs
+    ).
+
+%% @doc Load a wallet from a keyid and verify we have the authority to access it.
+load_and_verify({wallet, WalletKey}, _Base, _Request, _Opts) ->
+    % Return the wallet key.
+    Wallet = ar_wallet:from_json(WalletKey),
+    PubKey = ar_wallet:to_pubkey(Wallet),
+    Address = ar_wallet:to_address(PubKey),
+    {ok, #{
+        <<"wallet">> => WalletKey,
+        <<"address">> => hb_util:human_id(Address),
+        <<"persist">> => <<"client">>,
+        <<"committer">> => << "publickey:", (hb_util:encode(PubKey))/binary >>
+    }};
+load_and_verify({secret, KeyID, _}, _Base, Request, Opts) ->
+    % Get the wallet from the node's options.
+    case find_wallet(KeyID, Opts) of
+        not_found -> {error, <<"Wallet not hosted on node.">>};
+        WalletDetails ->
+            case verify_controllers(WalletDetails, Request, Opts) of
+                true ->
+                    % If the request is already signed by an exporter
+                    % return the request as-is with the wallet.
+                    {ok, WalletDetails};
+                false ->
+                    case verify_auth(WalletDetails, Request, Opts) of
+                        {ok, true} ->
+                            {ok, WalletDetails};
+                        {ok, false} ->
+                            {error, <<"Verification failed.">>};
+                        {error, Reason} ->
+                            {error, Reason}
+                    end
+            end
+    end.
+
+%% @doc Validate if a calling message has the required `controllers' for the
+%% given wallet.
+verify_controllers(WalletDetails, Request, Opts) ->
+    RequiredControllers =
+        hb_util:int(hb_maps:get(<<"required-controllers">>, WalletDetails, 1, Opts)),
+    Controllers =
+        parse_controllers(
+            hb_maps:get(<<"controllers">>, WalletDetails, [], Opts),
+            Opts
+        ),
+    PresentControllers =
+        lists:filter(
+            fun(Signer) ->
+                lists:member(Signer, Controllers)
+            end,
+            hb_message:signers(Request, Opts)
+        ),
+    length(PresentControllers) >= RequiredControllers.
+
+%% @doc Verify a wallet for a given request.
+verify_auth(WalletDetails, Req, Opts) ->
+    AuthBase = hb_maps:get(<<"access-control">>, WalletDetails, #{}, Opts),
+    AuthRequest =
+        Req#{
+            <<"path">> => <<"verify">>,
+            <<"committer">> =>
+                hb_maps:get(<<"committer">>, WalletDetails, undefined, Opts)
+        },
+    ?event({verify_wallet, {auth_base, AuthBase}, {request, AuthRequest}}),
+    hb_ao:resolve(AuthBase, AuthRequest, Opts).
+
+%% @doc Parse cookie from a message to extract wallets.
+wallets_from_cookie(Msg, Opts) ->
+    % Parse the cookie as a Structured-Fields map.
+    ParsedCookie =
+        try dev_codec_cookie:extract(Msg, #{ <<"format">> => <<"cookie">> }, Opts) of
+            {ok, CookieMsg} -> CookieMsg
+        catch _:_ -> {error, <<"Invalid cookie format.">>}
+        end,
+        ?event({parsed_cookie, ParsedCookie}),
+    % Get the wallets that we should be able to access from the parsed cookie.
+    % We determine their type from the `type-' prefix of the key.
+    lists:flatten(lists:filtermap(
+        fun({<<"secret-", Address/binary >>, Key}) ->
+            DecodedKey = hb_escape:decode_quotes(Key),
+            ?event({wallet_from_cookie, {key, DecodedKey},{ address, Address}}),
+            {true, secrets_to_keyids(DecodedKey)};
+           ({<<"wallet-", Address/binary >>, Key}) ->
+            DecodedKey = hb_escape:decode_quotes(Key),
+            ?event({wallet_from_cookie, {key, DecodedKey}, {address, Address}}),
+            {true, [{wallet, DecodedKey}]};
+           ({_Irrelevant, _}) -> false
+        end,
+        hb_maps:to_list(ParsedCookie, Opts)
+    )).
+
+%% @doc Sign a message using hb_message:commit, taking either a wallet as a 
+%% JSON-encoded string or a wallet details message with a `key' field.
+commit_message(Message, NonMap, Opts) when not is_map(NonMap) ->
+    commit_message(Message, #{ <<"wallet">> => NonMap }, Opts);
+commit_message(Message, #{ <<"wallet">> := Key }, Opts) when is_binary(Key) ->
+    commit_message(Message, ar_wallet:from_json(Key), Opts);
+commit_message(Message, #{ <<"wallet">> := Key }, Opts) ->
+    ?event({committing_with_proxy, {message, Message}, {wallet, Key}}),
+    hb_message:commit(Message, Opts#{ priv_wallet => Key }).
+
+%% @doc Export wallets from a request. The request should contain a source of
+%% wallets (cookies, keys, or wallet names), or a specific list/name of a
+%% wallet to authenticate and export.
+export(Base, Request, Opts) ->
+    PrivOpts = priv_store_opts(Opts),
+    ModReq =
+        case hb_ao:get(<<"keyids">>, Request, not_found, Opts) of
+            <<"all">> ->
+                AllLocalWallets = list_wallets(Opts),
+                Request#{ <<"keyids">> => AllLocalWallets };
+            _ -> Request
+        end,
+    ?event({export, {base, Base}, {request, ModReq}}),
+    case request_to_wallets(Base, ModReq, Opts) of
+        [] -> {error, <<"No wallets found to export.">>};
+        Wallets ->
+            {
+                ok,
+                lists:map(
+                    fun(Wallet) ->
+                        Loaded = hb_cache:ensure_all_loaded(Wallet, PrivOpts),
+                        ?event({exported, {wallet, Loaded}}),
+                        Loaded
+                    end,
+                    Wallets
+                )
+            }
+    end.    
+
+%% @doc Sync wallets from a remote node
+sync(_Base, Request, Opts) ->
+    case hb_ao:get(<<"node">>, Request, undefined, Opts) of
+        undefined ->
+            {error, <<"Node not specified.">>};
+        Node ->
+            Wallets = hb_maps:get(<<"keyids">>, Request, <<"all">>, Opts),
+            SignAsOpts =
+                case hb_ao:get(<<"as">>, Request, undefined, Opts) of
+                    undefined -> Opts;
+                    SignAs -> hb_opts:as(SignAs, Opts)
+                end,
+            ExportRequest =
+                (hb_message:commit(
+                    #{ <<"keyids">> => Wallets },
+                    SignAsOpts
+                ))#{ <<"path">> => <<"/~secret@1.0/export">> },
+            ?event({sync, {export_req, ExportRequest}}),
+            case hb_http:get(Node, ExportRequest, SignAsOpts) of
+                {ok, ExportResponse} ->
+                    ExportedWallets = export_response_to_list(ExportResponse, #{}),
+                    ?event({sync, {received_wallets, ExportedWallets}}),
+                    % Import each wallet. Ignore wallet imports that fail.
+                        lists:filtermap(
+                            fun(Wallet) ->
+                                ?event({sync, {importing, {wallet, Wallet}}}),
+                                case persist_registered_wallet(Wallet, SignAsOpts) of
+                                    {ok, #{ <<"body">> := Address }} ->
+                                        ?event({sync, {imported, Address}}),
+                                        {true, Address};
+                                    {error, Reason} ->
+                                        ?event({sync, {process_import_error, Reason}}),
+                                        false
+                                end
+                            end,
+                            ExportedWallets
+                        ),
+                    {ok, ExportedWallets};
+                {error, Reason} ->
+                    ?event({sync, {error, Reason}}),
+                    {error, Reason}
+            end
+    end.
+
+%%% Helper functions
+
+%% @doc Convert a key to a wallet reference.
+secrets_to_keyids(Secrets) when is_list(Secrets) ->
+    [ hd(secrets_to_keyids(Secret)) || Secret <- Secrets ];
+secrets_to_keyids(Secret) when is_binary(Secret) ->
+    ?event({secrets_to_keyids, {secret, Secret}}),
+    KeyID = dev_codec_httpsig_keyid:secret_key_to_committer(Secret),
+    [ {secret, <<"secret:", KeyID/binary>>, Secret} ].
+
+%% @doc Parse the exportable setting for a wallet and return a list of addresses
+%% which are allowed to export the wallet.
+parse_controllers(default, Opts) ->
+    case hb_opts:get(wallet_admin, undefined, Opts) of
+        undefined -> 
+            case hb_opts:get(operator, undefined, Opts) of
+                undefined ->
+                    [hb_util:human_id(hb_opts:get(priv_wallet, undefined, Opts))];
+                Op -> [hb_util:human_id(Op)]
+            end;
+        Admin -> [Admin]
+    end;
+parse_controllers(true, Opts) -> parse_controllers(default, Opts);
+parse_controllers(false, _Opts) -> [];
+parse_controllers(Addresses, _Opts) when is_list(Addresses) -> Addresses;
+parse_controllers(Address, _Opts) when is_binary(Address) -> [Address].
+
+%% @doc Store a wallet in the appropriate location.
+store_wallet(in_memory, KeyID, Details, Opts) ->
+    % Get existing wallets
+    CurrentWallets = hb_opts:get(priv_wallet_hosted, #{}, Opts),
+    % Add new wallet
+    UpdatedWallets = CurrentWallets#{ KeyID => Details },
+    ?event({wallet_store, {updated_wallets, UpdatedWallets}}),
+    % Update the node's options with the new wallets.
+    hb_http_server:set_opts(Opts#{ priv_wallet_hosted => UpdatedWallets }),
+    ok;
+store_wallet(non_volatile, KeyID, Details, Opts) ->
+    % Find the private store of the node.
+    PrivOpts = priv_store_opts(Opts),
+    {ok, Msg} = hb_cache:write(#{ KeyID => Details }, PrivOpts),
+    PrivStore = hb_opts:get(priv_store, undefined, PrivOpts),
+    % Link the wallet to the store.
+    ok = hb_store:make_link(PrivStore, Msg, <<"wallet@1.0/", KeyID/binary>>).
+
+%% @doc Find the wallet by name or address in the node's options.
+find_wallet(KeyID, Opts) ->
+    case find_wallet(in_memory, KeyID, Opts) of
+        not_found -> find_wallet(non_volatile, KeyID, Opts);
+        Wallet -> Wallet
+    end.
+
+%% @doc Loop over the wallets and find the reference to the wallet.
+find_wallet(in_memory, KeyID, Opts) ->
+    Wallets = hb_opts:get(priv_wallet_hosted, #{}, Opts),
+    ?event({find_wallet, {keyid, KeyID}, {wallets, Wallets}}),
+    case hb_maps:find(KeyID, Wallets, Opts) of
+        {ok, Wallet} -> Wallet;
+        error -> not_found
+    end;
+find_wallet(non_volatile, KeyID, Opts) ->
+    PrivOpts = priv_store_opts(Opts),
+    Store = hb_opts:get(priv_store, undefined, PrivOpts),
+    Resolved = hb_store:resolve(Store, <<"wallet@1.0/", KeyID/binary>>),
+    case hb_cache:read(Resolved, PrivOpts) of
+        {ok, Wallet} ->
+            WalletDetails = hb_maps:get(KeyID, Wallet, not_found, PrivOpts),
+            hb_cache:ensure_all_loaded(WalletDetails, PrivOpts);
+        _ -> not_found
+    end.
+
+%% @doc Generate a list of all hosted wallets.
+list_wallets(Opts) ->
+    list_wallets(in_memory, Opts) ++ list_wallets(non_volatile, Opts).
+list_wallets(in_memory, Opts) ->
+    hb_maps:keys(hb_opts:get(priv_wallet_hosted, #{}, Opts));
+list_wallets(non_volatile, Opts) ->
+    PrivOpts = priv_store_opts(Opts),
+    hb_cache:ensure_all_loaded(hb_cache:list(<<"wallet@1.0/">>, PrivOpts), PrivOpts).
+
+%% @doc Generate a new `Opts' message with the `priv_store' as the only `store'
+%% option.
+priv_store_opts(Opts) ->
+    hb_private:opts(Opts).
+
+%% @doc Convert an export response into a list of wallet details. This is
+%% necessary because if a received result over HTTP is a list with a 
+%% commitment attached, it will result in a message with numbered keys but
+%% also additional keys for the commitment etc.
+export_response_to_list(ExportResponse, Opts) ->
+    hb_util:numbered_keys_to_list(ExportResponse, Opts).
+
+%% @doc Convert a list of addresses to a binary string. If the input is a
+%% binary already, it is returned as-is.
+addresses_to_binary(Addresses) when is_list(Addresses) ->
+    hb_util:bin(string:join(
+        lists:map(fun hb_util:list/1, Addresses),
+        ", "
+    ));
+addresses_to_binary(Address) when is_binary(Address) ->
+    Address.
+
+%% @doc Convert a binary string to a list of addresses. If the input is a
+%% list already, it is returned as-is.
+binary_to_addresses(AddressesBin) when is_binary(AddressesBin) ->
+    binary:split(AddressesBin, <<",">>, [global]);
+binary_to_addresses(Addresses) when is_list(Addresses) ->
+    Addresses.
+
+
+%%% Tests
+
+%% @doc Helper function to test wallet generation and verification flow.
+test_wallet_generate_and_verify(GeneratePath, ExpectedName, CommitParams) ->
+    Node = hb_http_server:start_node(#{
+        priv_wallet => ar_wallet:new()
+    }),
+    % Generate wallet with specified parameters
+    {ok, GenResponse} = hb_http:get(Node, GeneratePath, #{}),
+    % Should get wallet name in body, wallet-address, and auth cookie
+    ?assertMatch(#{<<"body">> := _}, GenResponse),
+    WalletAddr = maps:get(<<"wallet-address">>, GenResponse),
+    case ExpectedName of
+        undefined -> 
+            % For unnamed wallets, just check it's a non-empty binary
+            ?assert(is_binary(WalletAddr) andalso byte_size(WalletAddr) > 0);
+        _ -> 
+            % For named wallets, check exact match
+            ?assertEqual(ExpectedName, WalletAddr)            
+    end,
+    ?assertMatch(#{ <<"priv">> := #{ <<"cookie">> := _ } }, GenResponse),
+    #{ <<"priv">> := Priv } = GenResponse,
+    % Now verify by signing a message
+    TestMessage =
+        maps:merge(
+            #{
+                <<"device">> => <<"secret@1.0">>,
+                <<"path">> => <<"commit">>,
+                <<"body">> => <<"Test message">>,
+                <<"priv">> => Priv
+            },
+            CommitParams
+        ),
+    ?event({signing_with_cookie, {test_message, TestMessage}}),
+    {ok, SignedMessage} = hb_http:post(Node, TestMessage, #{}),
+    % Should return signed message with correct signer
+    ?assertMatch(#{ <<"body">> := <<"Test message">> }, SignedMessage),
+    ?assert(hb_message:signers(SignedMessage, #{}) =:= [WalletAddr]).
+
+client_persist_generate_and_verify_test() ->
+    test_wallet_generate_and_verify(
+        <<"/~secret@1.0/generate?persist=client">>,
+        undefined,
+        #{}
+    ).
+
+cookie_wallet_generate_and_verify_test() ->
+    test_wallet_generate_and_verify(
+        <<"/~secret@1.0/generate?persist=in-memory">>,
+        undefined,
+        #{}
+    ).
+
+non_volatile_persist_generate_and_verify_test() ->
+    test_wallet_generate_and_verify(
+        <<"/~secret@1.0/generate?persist=non-volatile">>,
+        undefined,
+        #{}
+    ).
+
+import_wallet_with_key_test() ->
+    Node = hb_http_server:start_node(#{
+        priv_wallet => ar_wallet:new()
+    }),
+    % Create a test wallet key to import (in real scenario from user).
+    TestWallet = ar_wallet:new(),
+    % WalletAddress = hb_util:human_id(TestWallet),
+    WalletKey = hb_escape:encode_quotes(ar_wallet:to_json(TestWallet)),
+    WalletAddress = hb_util:human_id(ar_wallet:to_address(TestWallet)),
+    % Import the wallet with a specific name.
+    ImportUrl =
+        <<"/~secret@1.0/import?wallet=imported-wallet&persist=in-memory&key=",
+            WalletKey/binary>>,
+    {ok, ImportResponse} = hb_http:get(Node, ImportUrl, #{}),
+    ?event({resp, ImportResponse, WalletAddress}),
+    Imported = hb_maps:get(<<"imported">>, ImportResponse, #{}),
+    % Response should come from auth device with wallet name in body.
+    % Wallet name is the address of the wallet.
+    ?assertMatch([WalletAddress], Imported),
+    % Should include cookie setup from auth device.
+    ?assert(maps:is_key(<<"set-cookie">>, ImportResponse)).
+
+list_wallets_test() ->
+    Node = hb_http_server:start_node(#{
+        priv_wallet => ar_wallet:new()
+    }),
+    % Generate some wallets first.
+    {ok, Msg1} =
+        hb_http:get(
+            Node,
+            <<"/~secret@1.0/generate?persist=in-memory">>,
+            #{}
+        ),
+        ?event({msg1, Msg1}),
+    {ok, Msg2} =
+        hb_http:get(
+            Node,
+            <<"/~secret@1.0/generate?persist=in-memory">>,
+            #{}
+        ),
+    WalletAddress1 = maps:get(<<"body">>, Msg1),
+    WalletAddress2 = maps:get(<<"body">>, Msg2),
+    ?assertEqual(WalletAddress1, maps:get(<<"body">>, Msg1)),
+    ?assertEqual(WalletAddress2, maps:get(<<"body">>, Msg2)),
+    % List all wallets (no authentication required for listing).
+    {ok, Wallets} = hb_http:get(Node, <<"/~secret@1.0/list">>, #{}),
+    % Each wallet entry should be a wallet name.
+    ?assert(
+        lists:all(
+            fun(Wallet) -> lists:member(Wallet, hb_maps:values(Wallets)) end,
+            [WalletAddress1, WalletAddress2]
+        )
+    ).
+
+commit_with_cookie_wallet_test() ->
+    Node = hb_http_server:start_node(#{
+        priv_wallet => ar_wallet:new()
+    }),
+    % Generate a client wallet to get a cookie with full wallet key.
+    {ok, GenResponse} =
+        hb_http:get(Node, <<"/~secret@1.0/generate?persist=client">>, #{}),
+    WalletName = maps:get(<<"wallet-address">>, GenResponse),
+    #{ <<"priv">> := Priv } = GenResponse,
+    % Use the cookie to sign a message (no wallet parameter needed).
+    TestMessage = #{
+        <<"device">> => <<"secret@1.0">>,
+        <<"path">> => <<"commit">>,
+        <<"body">> => <<"Test data">>,
+        <<"priv">> => Priv
+    },
+    {ok, SignedMessage} = hb_http:post(Node, TestMessage, #{}),
+    % Should return the signed message with signature attached.
+    ?assert(hb_message:signers(SignedMessage, #{}) =:= [WalletName]).
+
+export_wallet_test() ->
+    Node = hb_http_server:start_node(#{}),
+    % Generate a wallet to export.
+    {ok, GenResponse} =
+        hb_http:get(
+            Node,
+            <<"/~secret@1.0/generate?persist=in-memory">>,
+            #{}
+        ),
+    #{ <<"priv">> := Priv } = GenResponse,
+    WalletAddress = maps:get(<<"wallet-address">>, GenResponse),
+    % Export the wallet with authentication.
+    {ok, ExportResponse} =
+        hb_http:get(
+            Node,
+            #{
+                <<"path">> => <<"/~secret@1.0/export/1">>,
+                <<"priv">> => Priv
+            },
+            #{}
+        ),
+    ?event({export_test, {export_response, ExportResponse}}),
+    % Should return wallet details including key, auth, exportable, persist.
+    ?assertMatch(#{<<"wallet">> := _, <<"persist">> := <<"in-memory">>}, ExportResponse),
+    ?assert(maps:is_key(<<"access-control">>, ExportResponse)),
+    ?assert(maps:is_key(<<"controllers">>, ExportResponse)),
+    % Should return the correct wallet address in the response.
+    ?assertEqual(WalletAddress, maps:get(<<"address">>, ExportResponse)),
+    AccessControl = maps:get(<<"access-control">>, ExportResponse),
+    ?assertEqual(WalletAddress, maps:get(<<"wallet-address">>, AccessControl)).
+
+export_non_volatile_wallet_test() ->
+        Node = hb_http_server:start_node(#{
+            priv_wallet => ar_wallet:new()
+        }),
+        % Generate a wallet to export.
+        {ok, GenResponse} =
+            hb_http:get(
+                Node,
+                <<"/~secret@1.0/generate?persist=non-volatile">>,
+                #{}
+            ),
+        #{ <<"priv">> := Priv } = GenResponse,
+        % Export the wallet with authentication.
+        {ok, ExportResponse} =
+            hb_http:get(
+                Node,
+                #{
+                    <<"device">> => <<"secret@1.0">>,
+                    <<"path">> => <<"export/1">>,
+                    <<"priv">> => Priv
+                },
+                #{}
+            ),
+        % Should return wallet details including key, auth, exportable, persist.
+        ?assertMatch(
+            #{<<"wallet">> := _, <<"persist">> := <<"non-volatile">>},
+            ExportResponse
+        ),
+        ?assert(maps:is_key(<<"access-control">>, ExportResponse)),
+        ?assert(maps:is_key(<<"controllers">>, ExportResponse)).
+
+export_individual_batch_wallets_test() ->
+    Node =
+        hb_http_server:start_node(
+            AdminOpts =
+                #{
+                    priv_wallet => AdminWallet = ar_wallet:new()
+                }
+        ),
+    % Generate multiple wallets and collect auth cookies.
+    {ok, #{ <<"body">> := WalletKeyID1 }} =
+        hb_http:get(
+            Node,
+            <<"/~secret@1.0/generate?persist=in-memory&exportable=",
+                (hb_util:human_id(AdminWallet))/binary>>,
+            #{}
+        ),
+    {ok, #{ <<"body">> := WalletKeyID2 }} =
+        hb_http:get(
+            Node,
+            <<"/~secret@1.0/generate?persist=in-memory&exportable=",
+                (hb_util:human_id(AdminWallet))/binary>>,
+            #{}
+        ),
+    % Export all wallets.
+    {ok, ExportAllResponse} =
+        hb_http:get(
+            Node,
+            (hb_message:commit(
+                #{
+                    <<"device">> => <<"secret@1.0">>,
+                    <<"keyids">> => [WalletKeyID1, WalletKeyID2]
+                },
+                AdminOpts
+            ))#{ <<"path">> => <<"/~secret@1.0/export">> },
+            #{}
+        ),
+
+    % Export single wallet by address.
+    {ok, ExportWallet1Response} =
+    hb_http:get(
+        Node,
+        (hb_message:commit(
+            #{
+                <<"device">> => <<"secret@1.0">>,
+                <<"keyids">> => [WalletKeyID1]
+            },
+            AdminOpts
+        ))#{ <<"path">> => <<"/~secret@1.0/export">> },
+        #{}
+    ),
+    
+    ?assert(is_map(ExportAllResponse)),
+    ?assert(is_map(ExportWallet1Response)),
+    ExportedAllWallets =
+        [
+            <<
+                "secret:",
+                (hb_maps:get(<<"committer">>, Wallet, undefined, #{}))/binary
+            >>
+        ||
+            Wallet <- export_response_to_list(ExportAllResponse, #{})
+        ],
+    ExportedSingleWallets =
+        [
+            <<
+                "secret:",
+                (hb_maps:get(<<"committer">>, Wallet, undefined, #{}))/binary
+            >>
+        ||
+            Wallet <- export_response_to_list(ExportWallet1Response, #{})
+        ],
+    ?event({exported_wallets, {exported_wallets, ExportedAllWallets}}),
+    ?assert(length(ExportedAllWallets) >= 2),
+    ?assert(length(ExportedSingleWallets) == 1),
+    % Each exported wallet should have the required structure.
+    lists:foreach(
+        fun(Addr) ->
+            ?assert(lists:member(Addr, ExportedAllWallets))
+        end,
+        [WalletKeyID1, WalletKeyID2]
+    ),
+    ?assert(lists:member(WalletKeyID1, ExportedSingleWallets)).
+
+            
+
+export_batch_all_wallets_test() ->
+    % Remove all previous cached wallets.
+    hb_store:reset(hb_opts:get(priv_store, no_wallet_store, #{})),
+    Node =
+        hb_http_server:start_node(
+            AdminOpts =
+                #{
+                    priv_wallet => AdminWallet = ar_wallet:new()
+                }
+        ),
+    % Generate multiple wallets and collect auth cookies.
+    {ok, #{ <<"wallet-address">> := WalletAddr1 }} =
+        hb_http:get(
+            Node,
+            <<"/~secret@1.0/generate?persist=in-memory&exportable=",
+                (hb_util:human_id(AdminWallet))/binary>>,
+            #{}
+        ),
+    {ok, #{ <<"wallet-address">> := WalletAddr2 }} =
+        hb_http:get(
+            Node,
+            <<"/~secret@1.0/generate?persist=in-memory&exportable=",
+                (hb_util:human_id(AdminWallet))/binary>>,
+            #{}
+        ),
+    % Export all wallets.
+    {ok, ExportResponse} =
+        hb_http:get(
+            Node,
+            (hb_message:commit(
+                #{
+                    <<"device">> => <<"secret@1.0">>,
+                    <<"keyids">> => <<"all">>
+                },
+                AdminOpts
+            ))#{ <<"path">> => <<"/~secret@1.0/export">> },
+            #{}
+        ),
+    ?event({export_batch_test, {export_response, ExportResponse}}),
+    ?assert(is_map(ExportResponse)),
+    ExportedWallets =
+        [
+            hb_maps:get(<<"address">>, Wallet, undefined, #{})
+        ||
+            Wallet <- export_response_to_list(ExportResponse, #{})
+        ],
+    ?event({exported_wallets, {exported_wallets, ExportedWallets}}),
+    ?assert(length(ExportedWallets) >= 2),
+    % Each exported wallet should have the required structure.
+    lists:foreach(
+        fun(Addr) ->
+            ?assert(lists:member(Addr, ExportedWallets))
+        end,
+        [WalletAddr1, WalletAddr2]
+    ).
+
+sync_wallets_test() ->
+    % Remove all previous cached wallets.
+    hb_store:reset(hb_opts:get(priv_store, no_wallet_store, #{})),
+    Node =
+        hb_http_server:start_node(#{
+            priv_wallet => Node1Wallet = ar_wallet:new()
+        }),
+    % Start a second node to sync from.
+    Node2 =
+        hb_http_server:start_node(#{
+            priv_wallet => ar_wallet:new(),
+            wallet_admin => hb_util:human_id(Node1Wallet)
+        }),
+    % Generate a wallet on the second node.
+    {ok, GenResponse} =
+        hb_http:get(
+            Node2,
+            <<"/~secret@1.0/generate?persist=in-memory">>,
+            #{}
+        ),
+    WalletKeyID = maps:get(<<"body">>, GenResponse),
+    % Test sync to the first node from the second.
+    {ok, _} =
+        hb_http:get(
+            Node,
+            <<"/~secret@1.0/sync?node=", Node2/binary, "&wallets=all">>,
+            #{}
+        ),
+    % Get the wallet list from the first node.
+    {ok, WalletList} = hb_http:get(Node, <<"/~secret@1.0/list">>, #{}),
+    ?event({sync_wallets_test, {wallet_list, WalletList}}),
+    % Should return a map of successfully imported wallets or list of names.
+    ?assert(lists:member(WalletKeyID, hb_maps:values(WalletList))).
+
+sync_non_volatile_wallets_test() ->
+    % Remove all the previous cached wallets.
+    hb_store:reset(hb_opts:get(priv_store, no_wallet_store, #{})),
+    Node =
+        hb_http_server:start_node(#{
+            priv_wallet => Node1Wallet = ar_wallet:new()
+        }),
+    % Start a second node to sync from.
+    Node2 =
+        hb_http_server:start_node(#{
+            priv_wallet => ar_wallet:new(),
+            wallet_admin => hb_util:human_id(Node1Wallet)
+        }),
+    % Generate a wallet on the second node.
+    {ok, GenResponse} =
+        hb_http:get(
+            Node2,
+            <<"/~secret@1.0/generate?persist=non-volatile">>,
+            #{}
+        ),
+    WalletName = maps:get(<<"body">>, GenResponse),
+    % Test sync to the first node from the second.
+    {ok, _} =
+        hb_http:get(
+            Node,
+            <<"/~secret@1.0/sync?node=", Node2/binary, "&wallets=all">>,
+            #{}
+        ),
+    % Get the wallet list from the first node.
+    {ok, WalletList} = hb_http:get(Node, <<"/~secret@1.0/list">>, #{}),
+    ?event({sync_wallets_test, {wallet_list, WalletList}}),
+    % Should return a map of successfully imported wallets or list of names.
+    ?assert(lists:member(WalletName, hb_maps:values(WalletList))).
\ No newline at end of file
diff --git a/src/dev_simple_pay.erl b/src/dev_simple_pay.erl
index 6c68653c6..075a9f993 100644
--- a/src/dev_simple_pay.erl
+++ b/src/dev_simple_pay.erl
@@ -1,19 +1,32 @@
 %%% @doc A simple device that allows the operator to specify a price for a
-%%% request and then charge the user for it, on a per message basis.
+%%% request and then charge the user for it, on a per route and optionally
+%%% per message basis.
+%%% 
+%%% The device's pricing rules are as follows:
+%%%
+%%% 1. If the request is from the operator, the cost is 0.
+%%% 2. If the request matches one of the `router_opts/offered' routes, the
+%%%    explicit price of the route is used.
+%%% 3. Else, the price is calculated by counting the number of messages in the
+%%%    request, and multiplying by the `simple_pay_price' node option, plus the
+%%%    price of the apply subrequest if applicable. Subrequests are priced by
+%%%    recursively calling `estimate/3' upon them. In the case of an `apply@1.0'
+%%%    subrequest, the two initiating apply messages are not counted towards the
+%%%    message count price.
+%%% 
 %%% The device's ledger is stored in the node message at `simple_pay_ledger',
 %%% and can be topped-up by either the operator, or an external device. The 
 %%% price is specified in the node message at `simple_pay_price'.
 %%% This device acts as both a pricing device and a ledger device, by p4's
 %%% definition.
 -module(dev_simple_pay).
--export([estimate/3, debit/3, balance/3, topup/3]).
+-export([estimate/3, charge/3, balance/3, topup/3]).
 -include("include/hb.hrl").
 -include_lib("eunit/include/eunit.hrl").
 
-%% @doc Estimate the cost of a request by counting the number of messages in
-%% the request, then multiplying by the per-message price. The operator does
-%% not pay for their own requests.
-estimate(_, EstimateReq, NodeMsg) ->
+%% @doc Estimate the cost of the request, using the rules outlined in the
+%% moduledoc.
+estimate(_Base, EstimateReq, NodeMsg) ->
     Req = hb_ao:get(<<"request">>, EstimateReq, NodeMsg#{ hashpath => ignore }),
     case is_operator(Req, NodeMsg) of
         true ->
@@ -22,28 +35,107 @@ estimate(_, EstimateReq, NodeMsg) ->
             ),
             {ok, 0};
         false ->
-            Messages =
-                hb_singleton:from(
-                    hb_ao:get(<<"request">>, EstimateReq, NodeMsg)
-                ),
-            {ok, length(Messages) * hb_opts:get(simple_pay_price, 1, NodeMsg)}
+            ?event(payment, {starting_estimate, {req, Req}}),
+            ReqSequence = hb_singleton:from(Req, NodeMsg),
+            ?event(payment,
+                {estimating_cost,
+                    {singleton, Req},
+                    {request_sequence, ReqSequence}
+                }
+            ),
+            % Get the user's request to match against router registration options
+            case price_from_routes(Req, NodeMsg) of
+                no_matches ->
+                    {ok, ApplyPrice, SeqWithoutApply} = apply_price(ReqSequence, NodeMsg),
+                    MessageCountPrice = price_from_count(SeqWithoutApply, NodeMsg),
+                    Price = MessageCountPrice + ApplyPrice,
+                    ?event(payment,
+                        {calculated_generic_route_price,
+                            {price, Price},
+                            {message_count_price, MessageCountPrice},
+                            {apply_price, ApplyPrice}
+                        }),
+                    {ok, Price};
+                Price ->
+                    ?event(payment,
+                        {calculated_specific_route_price,
+                            {price, Price}
+                        }
+                    ),
+                    {ok, Price}
+            end
+    end.
+
+%% @doc If the request is for the `apply@1.0' device, we should price the
+%% inner request in addition to the price of the outer request.
+apply_price([{as, Device, Msg} | Rest], NodeMsg) ->
+    apply_price([Msg#{ <<"device">> => Device } | Rest], NodeMsg);
+apply_price(
+        [Req = #{ <<"device">> := <<"apply@1.0">> }, #{ <<"path">> := Path } | Rest],
+        NodeMsg
+    ) ->
+    UserPath = hb_maps:get(Path, Req, <<"">>, NodeMsg),
+    UserMessage =
+        case hb_maps:find(<<"source">>, Req, NodeMsg) of
+            {ok, Source} -> hb_maps:get(Source, Req, Req, NodeMsg);
+            error -> Req
+        end,
+    UserRequest =
+        hb_maps:without(
+            [<<"device">>],
+            UserMessage#{ <<"path">> => UserPath }
+        ),
+    ?event(payment, {estimating_price_of_subrequest, {req, UserRequest}}),
+    {ok, Price} = estimate(#{}, #{ <<"request">> => UserRequest }, NodeMsg),
+    ?event(payment, {price_of_apply_subrequest, {price, Price}}),
+    {ok, Price, Rest};
+apply_price(Seq, _) ->
+    {ok, 0, Seq}.
+
+%% @doc Calculate the price of a request based on the offered routes, if
+%% applicable.
+price_from_routes(UserRequest, NodeMsg) ->
+    RouterOpts = hb_opts:get(<<"router_opts">>, #{}, NodeMsg),
+    Routes = hb_maps:get(<<"offered">>, RouterOpts, [], NodeMsg),
+    MatchRes =
+        dev_router:match(
+            #{ <<"routes">> => Routes },
+            UserRequest,
+            NodeMsg
+        ),
+    case MatchRes of
+        {ok, OfferedRoute} ->
+            Price = hb_maps:get(<<"price">>, OfferedRoute, 0, NodeMsg),
+            ?event(payment, {price_from_routes, {price, Price}}),
+            Price;
+        _ ->
+            no_matches
     end.
 
+%% @doc Calculate the price of a request based on the number of messages in
+%% the request, if the node is configured to do so.
+price_from_count(Messages, NodeMsg) ->
+    Price =
+        hb_util:int(hb_opts:get(simple_pay_price, 1, NodeMsg))
+            * length(Messages),
+    ?event(payment, {price_from_count, {price, Price}, {count, length(Messages)}}),
+    Price.
+
 %% @doc Preprocess a request by checking the ledger and charging the user. We 
 %% can charge the user at this stage because we know statically what the price
 %% will be
-debit(_, RawReq, NodeMsg) ->
-    ?event(payment, {debit, RawReq}),
+charge(_, RawReq, NodeMsg) ->
+    ?event(payment, {charge, RawReq}),
     Req = hb_ao:get(<<"request">>, RawReq, NodeMsg#{ hashpath => ignore }),
-    case hb_message:signers(Req) of
+    case hb_message:signers(Req, NodeMsg) of
         [] ->
-            ?event(payment, {debit, {error, <<"No signers">>}}),
+            ?event(payment, {charge, {error, <<"No signers">>}}),
             {ok, false};
         [Signer] ->
             UserBalance = get_balance(Signer, NodeMsg),
             Price = hb_ao:get(<<"quantity">>, RawReq, 0, NodeMsg),
             ?event(payment,
-                {debit,
+                {charge,
                     {user, Signer},
                     {balance, UserBalance},
                     {price, Price}
@@ -59,16 +151,16 @@ debit(_, RawReq, NodeMsg) ->
                     {ok, true};
                 false ->
                     ?event(payment,
-                        {debit,
+                        {charge,
                             {user, Signer},
                             {balance, UserBalance},
                             {price, Price}
                         }
                     ),
                     {error, #{
-                        <<"status">> => 429,
+                        <<"status">> => 402,
                         <<"body">> => <<"Insufficient funds. "
-                            "User balance before debit: ",
+                            "User balance before charge: ",
                                 (hb_util:bin(UserBalance))/binary,
                             ". Price of request: ",
                                 (hb_util:bin(Price))/binary,
@@ -76,7 +168,13 @@ debit(_, RawReq, NodeMsg) ->
                                 (hb_util:bin(NewBalance))/binary,
                             ".">>
                     }}
-            end
+            end;
+        MultipleSigners ->
+            ?event(payment, {charge, {error_multiple_signers, MultipleSigners}}),
+            {error, #{
+                <<"status">> => 400,
+                <<"body">> => <<"Multiple signers in charge.">>
+            }}
     end.
 
 %% @doc Get the balance of a user in the ledger.
@@ -84,11 +182,11 @@ balance(_, RawReq, NodeMsg) ->
     Target =
         case hb_ao:get(<<"request">>, RawReq, NodeMsg#{ hashpath => ignore }) of
             not_found ->
-                case hb_message:signers(RawReq) of
+                case hb_message:signers(RawReq, NodeMsg) of
                     [] -> hb_ao:get(<<"target">>, RawReq, undefined, NodeMsg);
                     [Signer] -> Signer
                 end;
-            Req -> hd(hb_message:signers(Req))
+            Req -> hd(hb_message:signers(Req, NodeMsg))
         end,
     {ok, get_balance(Target, NodeMsg)}.
 
@@ -152,14 +250,19 @@ topup(_, Req, NodeMsg) ->
 
 %% @doc Check if the request is from the operator.
 is_operator(Req, NodeMsg) ->
-    Signers = hb_message:signers(Req),
-    OperatorAddr = hb_util:human_id(hb_opts:get(operator, undefined, NodeMsg)),
+    is_operator(Req, NodeMsg, hb_opts:get(operator, undefined, NodeMsg)).
+
+is_operator(Req, NodeMsg, OperatorAddr) when ?IS_ID(OperatorAddr) ->
+    Signers = hb_message:signers(Req, NodeMsg),
+    HumanOperatorAddr = hb_util:human_id(OperatorAddr),
     lists:any(
         fun(Signer) ->
-            OperatorAddr =:= hb_util:human_id(Signer)
+            HumanOperatorAddr =:= hb_util:human_id(Signer)
         end,
         Signers
-    ).
+    );
+is_operator(_, _, _) ->
+    false.
 
 %%% Tests
 
@@ -198,11 +301,11 @@ get_balance_and_top_up_test() ->
             Node,
             Req = hb_message:commit(
                 #{<<"path">> => <<"/~simple-pay@1.0/balance">>},
-                ClientWallet
+                Opts#{ priv_wallet => ClientWallet }
             ),
-            #{}
+            Opts
         ),
-    ?event({req_signers, hb_message:signers(Req)}),
+    ?event({req_signers, hb_message:signers(Req, Opts)}),
     % Balance is given during the request, before the charge is made, so we 
     % should expect to see the original balance.
     ?assertEqual(100, Res),
@@ -216,9 +319,9 @@ get_balance_and_top_up_test() ->
                     <<"amount">> => 100,
                     <<"recipient">> => ClientAddress
                 },
-                HostWallet
+                Opts#{ priv_wallet => HostWallet }
             ),
-            #{}
+            Opts
         ),
     % The balance should now be 180, as the topup will have been added and will
     % not have generated a charge in itself. The top-up did not generate a charge
@@ -228,9 +331,43 @@ get_balance_and_top_up_test() ->
         hb_http:get(
             Node,
             hb_message:commit(
-                #{<<"path">> => <<"/~simple-pay@1.0/balance">>},
-                ClientWallet
+                #{<<"path">> => <<"/~p4@1.0/balance">>},
+                Opts#{ priv_wallet => ClientWallet }
             ),
-            #{}
+            Opts
         ),
     ?assertEqual(180, Res2).
+
+apply_price_test() ->
+    ClientWallet = ar_wallet:new(),
+    ClientAddress = hb_util:human_id(ar_wallet:to_address(ClientWallet)),
+    ClientOpts = #{ priv_wallet => ClientWallet },
+    {HostAddress, _HostWallet, Opts} =
+        test_opts(#{ ClientAddress => 100 }),
+    Node = hb_http_server:start_node(Opts),
+    ?event({host_address, HostAddress}),
+    ?event({client_address, ClientAddress}),
+    % The balance should now be 80, as the check will have charged us 20.
+    {ok, _} =
+        hb_http:post(
+            Node,
+            hb_message:commit(
+                #{
+                    <<"path">> => <<"/~apply@1.0/user-path">>,
+                    <<"user-path">> => <<"/~scheduler@1.0/status/keys/1">>,
+                    <<"user-message">> => #{ <<"a">> => 1 }
+                },
+                ClientOpts
+            ),
+            ClientOpts
+        ),
+    {ok, Res2} =
+        hb_http:get(
+            Node,
+            hb_message:commit(
+                #{ <<"path">> => <<"/~p4@1.0/balance">> },
+                Opts#{ priv_wallet => ClientWallet }
+            ),
+            Opts
+        ),
+    ?assertEqual(60, Res2).
\ No newline at end of file
diff --git a/src/dev_snp.erl b/src/dev_snp.erl
index 96a68f48a..aea38c63f 100644
--- a/src/dev_snp.erl
+++ b/src/dev_snp.erl
@@ -1,64 +1,42 @@
-%%% @doc This device offers an interface for validating AMD SEV-SNP commitments,
-%%% as well as generating them, if called in an appropriate environment.
+%%% @doc This device provides an interface for validating and generating AMD SEV-SNP 
+%%% commitment reports.
+%%%
+%%% AMD SEV-SNP (Secure Encrypted Virtualization - Secure Nested Paging) is a 
+%%% hardware-based security technology that provides confidential computing 
+%%% capabilities. This module handles the cryptographic validation of attestation 
+%%% reports and the generation of commitment reports for trusted execution environments.
+%%%
+%%% The device supports two main operations:
+%%% 1. Verification of remote node attestation reports with comprehensive validation
+%%% 2. Generation of local attestation reports for proving node identity and software integrity
 -module(dev_snp).
--export([generate/3, verify/3, trusted/3]).
+-export([generate/3, verify/3]).
 -include("include/hb.hrl").
 -include_lib("eunit/include/eunit.hrl").
+
+%% Configuration constants
 -define(COMMITTED_PARAMETERS, [vcpus, vcpu_type, vmm_type, guest_features,
     firmware, kernel, initrd, append]).
 
-%%% Test constants
-%% Matching commitment report is found in `test/snp-commitment' in 
-%% `dev_codec_flat:serialize/1''s format. Alternatively, set the `TEST_NODE'
-%% constant to a live node to run the tests against it.
--define(TEST_NODE, undefined).
--define(TEST_TRUSTED_SOFTWARE, #{
-    vcpus => 1,
-    vcpu_type => 5, 
-    vmm_type => 1,
-    guest_features => 1,
-    firmware =>
-        <<
-            "b8c5d4082d5738db6b0fb0294174992738645df70c44cdecf7fad3a62244b788e"
-                "7e408c582ee48a74b289f3acec78510"
-        >>,
-    kernel =>
-        <<"69d0cd7d13858e4fcef6bc7797aebd258730f215bc5642c4ad8e4b893cc67576">>,
-    initrd =>
-        <<"853ebf56bc6ba5f08bd5583055a457898ffa3545897bee00103d3066b8766f5c">>,
-    append =>
-        <<"6cb8a0082b483849054f93b203aa7d98439736e44163d614f79380ca368cc77e">>
-}).
-
-real_node_test() ->
-    application:ensure_all_started(hb),
-    if ?TEST_NODE == undefined ->
-        {skip, <<"Test node not set.">>};
-    true ->
-        {ok, Report} =
-            hb_http:get(
-                ?TEST_NODE,
-                <<"/~snp@1.0/generate">>,
-                #{
-                    <<"is-trusted-device">> => <<"snp@1.0">>
-                }
-            ),
-        ?event({snp_report_rcvd, Report}),
-        ?event({report_verifies, hb_message:verify(Report)}),
-        Result =
-            verify(
-                Report,
-                #{ <<"target">> => <<"self">> },
-                #{ snp_trusted => [?TEST_TRUSTED_SOFTWARE] }
-            ),
-        ?event({snp_validation_res, Result}),
-        ?assertEqual({ok, true}, Result)
-    end.
+%% SNP-specific constants
+-define(DEBUG_FLAG_BIT, 19).
+-define(REPORT_DATA_VERSION, 1).
 
+%% Test configuration constants
+-define(TEST_VCPUS_COUNT, 32).
+-define(TEST_VCPU_TYPE, 5).
+-define(TEST_VMM_TYPE, 1).
+-define(TEST_GUEST_FEATURES, 1).
+-define(TEST_FIRMWARE_HASH, <<"b8c5d4082d5738db6b0fb0294174992738645df70c44cdecf7fad3a62244b788e7e408c582ee48a74b289f3acec78510">>).
+-define(TEST_KERNEL_HASH, <<"69d0cd7d13858e4fcef6bc7797aebd258730f215bc5642c4ad8e4b893cc67576">>).
+-define(TEST_INITRD_HASH, <<"544045560322dbcd2c454bdc50f35edf0147829ec440e6cb487b4a1503f923c1">>).
+-define(TEST_APPEND_HASH, <<"95a34faced5e487991f9cc2253a41cbd26b708bf00328f98dddbbf6b3ea2892e">>).
 
-%% @doc Verify an commitment report message; validating the identity of a 
-%% remote node, its ephemeral private address, and the integrity of the report.
-%% The checks that must be performed to validate the report are:
+%% @doc Verify an AMD SEV-SNP commitment report message.
+%%
+%% This function validates the identity of a remote node, its ephemeral private
+%% address, and the integrity of the hardware-backed attestation report.
+%% The verification process performs the following checks:
 %% 1. Verify the address and the node message ID are the same as the ones
 %%    used to generate the nonce.
 %% 2. Verify the address that signed the message is the same as the one used
@@ -68,75 +46,326 @@ real_node_test() ->
 %%    measurement, are trusted.
 %% 5. Verify the measurement is valid.
 %% 6. Verify the report's certificate chain to hardware root of trust.
+%%
+%% Required configuration in NodeOpts map:
+%% - snp_trusted: List of trusted software configurations
+%% - snp_enforced_keys: Keys to enforce during validation (optional)
+%%
+%% @param M1 The previous message in the verification chain
+%% @param M2 The message containing the SNP commitment report
+%% @param NodeOpts A map of configuration options for verification
+%% @returns `{ok, Binary}' with "true" on successful verification, or
+%% `{error, Reason}' on failure with specific error details
+-spec verify(M1 :: term(), M2 :: term(), NodeOpts :: map()) ->
+    {ok, binary()} | {error, term()}.
 verify(M1, M2, NodeOpts) ->
     ?event(snp_verify, verify_called),
-    % Search for a `body' key in the message, and if found use it as the source
-    % of the report. If not found, use the message itself as the source.
-    MsgWithJSONReport =
-        hb_util:ok(
-            hb_message:with_only_committed(
-                hb_ao:get(<<"body">>, M2, M2, NodeOpts#{ hashpath => ignore }),
+    maybe
+        {ok, {Msg, Address, NodeMsgID, ReportJSON, MsgWithJSONReport}} 
+            ?= extract_and_normalize_message(M2, NodeOpts),
+        % Perform all validation steps
+        {ok, NonceResult} ?= verify_nonce(Address, NodeMsgID, Msg, NodeOpts),
+        {ok, SigResult} ?= 
+            verify_signature_and_address(
+                MsgWithJSONReport, 
+                Address, 
                 NodeOpts
-            )
-        ),
-    % Normalize the request message
-    ReportJSON = hb_ao:get(<<"report">>, MsgWithJSONReport, NodeOpts),
-    Report = hb_json:decode(ReportJSON),
-    Msg =
-        maps:merge(
-            maps:without([<<"report">>], MsgWithJSONReport),
-            Report
+            ),
+        {ok, DebugResult} ?= verify_debug_disabled(Msg),
+        {ok, TrustedResult} ?= verify_trusted_software(M1, Msg, NodeOpts),
+        {ok, MeasurementResult} ?= verify_measurement(Msg, ReportJSON, NodeOpts),
+        {ok, ReportResult} ?= verify_report_integrity(ReportJSON),
+        Valid = lists:all(
+            fun(Bool) -> Bool end, 
+                [
+                    NonceResult, 
+                    SigResult, 
+                    DebugResult, 
+                    TrustedResult, 
+                    MeasurementResult, 
+                    ReportResult
+                ]
+            ),
+        ?event({final_validation_result, Valid}),
+        {ok, hb_util:bin(Valid)}
+    else
+        {error, Reason} -> {error, Reason}
+    end.
+
+%% @doc Generate an AMD SEV-SNP commitment report and emit it as a message.
+%%
+%% This function creates a hardware-backed attestation report containing all
+%% necessary data to validate the node's identity and software configuration.
+%% The generation process performs the following operations:
+%% 1. Loads and validates the provided configuration options
+%% 2. Retrieves or creates a cryptographic wallet for node identity
+%% 3. Generates a unique nonce using the node's address and message ID
+%% 4. Extracts trusted software configuration from local options
+%% 5. Generates the hardware attestation report using the NIF interface
+%% 6. Packages the report with all verification data into a message
+%%
+%% Required configuration in Opts map:
+%% - priv_wallet: Node's cryptographic wallet (created if not provided)
+%% - snp_trusted: List of trusted software configurations (represents the 
+%% configuration of the local node generating the report)
+%%
+%% @param _M1 Ignored parameter
+%% @param _M2 Ignored parameter  
+%% @param Opts A map of configuration options for report generation
+%% @returns `{ok, Map}' on success with the complete report message, or
+%% `{error, Reason}' on failure with error details
+-spec generate(M1 :: term(), M2 :: term(), Opts :: map()) ->
+    {ok, map()} | {error, term()}.
+generate(_M1, _M2, Opts) ->
+    maybe
+        LoadedOpts = hb_cache:ensure_all_loaded(Opts, Opts),
+        ?event({generate_opts, {explicit, LoadedOpts}}),
+        % Validate wallet availability
+        {ok, ValidWallet} ?= 
+            case hb_opts:get(priv_wallet, no_viable_wallet, LoadedOpts) of
+                no_viable_wallet -> {error, no_wallet_available};
+                Wallet -> {ok, Wallet}
+            end,
+        % Generate address and node message components
+        Address = hb_util:human_id(ar_wallet:to_address(ValidWallet)),
+        NodeMsg = hb_private:reset(LoadedOpts),
+        {ok, PublicNodeMsgID} ?= dev_message:id(
+            NodeMsg,
+            #{ <<"committers">> => <<"none">> },
+            LoadedOpts
         ),
-    % Step 1: Verify the nonce.
-    Address = hb_ao:get(<<"address">>, Msg, NodeOpts),
-    ?event({snp_address, Address}),
-    NodeMsgID =
-        case hb_ao:get(<<"node-message">>, Msg, NodeOpts#{ hashpath => ignore }) of
-            undefined ->
-                case hb_ao:get(<<"node-message-id">>, Msg, NodeOpts) of
-                    undefined -> {error, missing_node_msg_id};
-                    ID -> ID
-                end;
-            NodeMsg -> hb_util:ok(dev_message:id(NodeMsg, #{}, NodeOpts))
+        RawPublicNodeMsgID = hb_util:native_id(PublicNodeMsgID),
+        ?event({snp_node_msg, NodeMsg}),
+        % Generate the commitment report components
+        ?event({snp_address, byte_size(Address)}),
+        ReportData = generate_nonce(Address, RawPublicNodeMsgID),
+        ?event({snp_report_data, byte_size(ReportData)}),
+        % Extract local hashes
+        {ok, ValidLocalHashes} ?= 
+            case hb_opts:get(snp_trusted, [#{}], LoadedOpts) of
+                [] -> {error, no_trusted_configs};
+                [FirstConfig | _] -> {ok, FirstConfig};
+                _ -> {error, invalid_trusted_configs_format}
+            end,
+        ?event(snp_local_hashes, {explicit, ValidLocalHashes}),
+        % Generate the hardware attestation report
+        {ok, ReportJSON} ?= case get(mock_snp_nif_enabled) of
+            true ->
+                % Return mocked response for testing
+                MockResponse = get(mock_snp_nif_response),
+                {ok, MockResponse};
+            _ ->
+                % Call actual NIF function
+                dev_snp_nif:generate_attestation_report(
+                    ReportData, 
+                    ?REPORT_DATA_VERSION
+                )
         end,
-    ?event({snp_node_msg_id, NodeMsgID}),
+        ?event({snp_report_json, ReportJSON}),
+        ?event({snp_report_generated, {nonce, ReportData}, {report, ReportJSON}}),
+        % Package the complete report message
+        ReportMsg = #{
+            <<"local-hashes">> => ValidLocalHashes,
+            <<"nonce">> => hb_util:encode(ReportData),
+            <<"address">> => Address,
+            <<"node-message">> => NodeMsg,
+            <<"report">> => ReportJSON
+        },
+        ?event({snp_report_msg, ReportMsg}),
+        {ok, ReportMsg}
+    else
+        {error, Reason} -> {error, Reason};
+        Error -> {error, Error}
+    end.
+
+%% @doc Extract and normalize the SNP commitment message from the input.
+%%
+%% This function processes the raw message and extracts all necessary components
+%% for verification:
+%% 1. Searches for a `body' key in the message, using it as the report source
+%% 2. Applies message commitment and signing filters
+%% 3. Extracts and decodes the JSON report
+%% 4. Normalizes the message structure by merging report data
+%% 5. Extracts the node address and message ID
+%%
+%% @param M2 The input message containing the SNP report
+%% @param NodeOpts A map of configuration options
+%% @returns `{ok, {Msg, Address, NodeMsgID, ReportJSON, MsgWithJSONReport}}'
+%% on success with all extracted components, or `{error, Reason}' on failure
+-spec extract_and_normalize_message(M2 :: term(), NodeOpts :: map()) ->
+    {ok, {map(), binary(), binary(), binary(), map()}} | {error, term()}.
+extract_and_normalize_message(M2, NodeOpts) ->
+    maybe
+        % Search for a `body' key in the message, and if found use it as the source
+        % of the report. If not found, use the message itself as the source.
+        ?event({node_opts, {explicit, NodeOpts}}),
+        RawMsg = hb_ao:get(<<"body">>, M2, M2, NodeOpts#{ hashpath => ignore }),
+        ?event({msg, {explicit, RawMsg}}),
+        MsgWithJSONReport =
+            hb_util:ok(
+                hb_message:with_only_committed(
+                    hb_message:with_only_committers(
+                        RawMsg,
+                        hb_message:signers(
+                    RawMsg,
+                            NodeOpts
+                        ),
+                        NodeOpts
+                    ),
+                    NodeOpts
+                )
+            ),
+        ?event({msg_with_json_report, {explicit, MsgWithJSONReport}}),
+        % Normalize the request message
+        ReportJSON = hb_ao:get(<<"report">>, MsgWithJSONReport, NodeOpts),
+        Report = hb_json:decode(ReportJSON),
+        Msg =
+            maps:merge(
+                maps:without([<<"report">>], MsgWithJSONReport),
+                Report
+            ),
+        
+        % Extract address and node message ID
+        Address = hb_ao:get(<<"address">>, Msg, NodeOpts),
+        ?event({snp_address, Address}),
+        {ok, NodeMsgID} ?= extract_node_message_id(Msg, NodeOpts),
+        ?event({snp_node_msg_id, NodeMsgID}),
+        {ok, {Msg, Address, NodeMsgID, ReportJSON, MsgWithJSONReport}}
+    else
+        {error, Reason} -> {error, Reason};
+        Error -> {error, Error}
+    end.
+
+
+%% @doc Extract the node message ID from the SNP message.
+%%
+%% This function handles the extraction of the node message ID, which can be
+%% provided either directly as a field or embedded within a node message that
+%% needs to be processed to generate the ID.
+%%
+%% @param Msg The normalized SNP message
+%% @param NodeOpts A map of configuration options
+%% @returns `{ok, NodeMsgID}' on success with the extracted ID, or
+%% `{error, missing_node_msg_id}' if no ID can be found
+-spec extract_node_message_id(Msg :: map(), NodeOpts :: map()) ->
+    {ok, binary()} | {error, missing_node_msg_id}.
+extract_node_message_id(Msg, NodeOpts) ->
+    case {hb_ao:get(<<"node-message">>, Msg, NodeOpts#{ hashpath => ignore }),
+          hb_ao:get(<<"node-message-id">>, Msg, NodeOpts)} of
+        {undefined, undefined} ->
+            {error, missing_node_msg_id};
+        {undefined, ID} ->
+            {ok, ID};
+        {NodeMsg, _} ->
+            dev_message:id(NodeMsg, #{}, NodeOpts)
+    end.
+
+%% @doc Verify that the nonce in the report matches the expected value.
+%%
+%% This function validates that the nonce in the SNP report was generated
+%% using the correct address and node message ID, ensuring the report
+%% corresponds to the expected request.
+%%
+%% @param Address The node's address used in nonce generation
+%% @param NodeMsgID The node message ID used in nonce generation
+%% @param Msg The normalized SNP message containing the nonce
+%% @param NodeOpts A map of configuration options
+%% @returns `{ok, true}' if the nonce matches, or `{error, nonce_mismatch}' on failure
+-spec verify_nonce(Address :: binary(), NodeMsgID :: binary(), 
+    Msg :: map(), NodeOpts :: map()) -> {ok, true} | {error, nonce_mismatch}.
+verify_nonce(Address, NodeMsgID, Msg, NodeOpts) ->
     Nonce = hb_util:decode(hb_ao:get(<<"nonce">>, Msg, NodeOpts)),
     ?event({snp_nonce, Nonce}),
     NonceMatches = report_data_matches(Address, NodeMsgID, Nonce),
     ?event({nonce_matches, NonceMatches}),
-    % Step 2: Verify the address and the signature.
-    Signers = hb_message:signers(MsgWithJSONReport),
+    case NonceMatches of
+        true -> {ok, true};
+        false -> {error, nonce_mismatch}
+    end.
+
+%% @doc Verify that the message signature and signing address are valid.
+%%
+%% This function validates that:
+%% 1. The message signature is cryptographically valid
+%% 2. The address that signed the message matches the address in the report
+%%
+%% @param MsgWithJSONReport The message containing the JSON report and signatures
+%% @param Address The expected signing address from the report
+%% @param NodeOpts A map of configuration options
+%% @returns `{ok, true}' if both signature and address are valid, or
+%% `{error, signature_or_address_invalid}' on failure
+-spec verify_signature_and_address(MsgWithJSONReport :: map(), 
+    Address :: binary(), NodeOpts :: map()) ->
+    {ok, true} | {error, signature_or_address_invalid}.
+verify_signature_and_address(MsgWithJSONReport, Address, NodeOpts) ->
+    Signers = hb_message:signers(MsgWithJSONReport, NodeOpts),
     ?event({snp_signers, {explicit, Signers}}),
     SigIsValid = hb_message:verify(MsgWithJSONReport, Signers),
     ?event({snp_sig_is_valid, SigIsValid}),
     AddressIsValid = lists:member(Address, Signers),
     ?event({address_is_valid, AddressIsValid, {signer, Signers}, {address, Address}}),
-    % Step 3: Verify that the debug flag is disabled.
+    case SigIsValid andalso AddressIsValid of
+        true -> {ok, true};
+        false -> {error, signature_or_address_invalid}
+    end.
+
+%% @doc Verify that the debug flag is disabled in the SNP policy.
+%%
+%% This function checks the SNP policy to ensure that debug mode is disabled,
+%% which is required for production environments to maintain security guarantees.
+%%
+%% @param Msg The normalized SNP message containing the policy
+%% @returns `{ok, true}' if debug is disabled, or `{error, debug_enabled}' if enabled
+-spec verify_debug_disabled(Msg :: map()) -> {ok, true} | {error, debug_enabled}.
+verify_debug_disabled(Msg) ->
     DebugDisabled = not is_debug(Msg),
     ?event({debug_disabled, DebugDisabled}),
-    % Step 4: Verify measurement data (firmware, kernel, OS image) is trusted.
-    IsTrustedSoftware = execute_is_trusted(M1, Msg, NodeOpts),
+    case DebugDisabled of
+        true -> {ok, true};
+        false -> {error, debug_enabled}
+    end.
+
+%% @doc Verify that the software configuration is trusted.
+%%
+%% This function validates that the firmware, kernel, and other system
+%% components match approved configurations by delegating to the
+%% software trust validation system.
+%%
+%% @param M1 The previous message in the verification chain
+%% @param Msg The normalized SNP message containing software hashes
+%% @param NodeOpts A map of configuration options including trusted software list
+%% @returns `{ok, true}' if the software is trusted, or `{error, untrusted_software}' 
+%% on failure
+-spec verify_trusted_software(M1 :: term(), Msg :: map(), NodeOpts :: map()) ->
+    {ok, true} | {error, untrusted_software}.
+verify_trusted_software(M1, Msg, NodeOpts) ->
+    {ok, IsTrustedSoftware} = execute_is_trusted(M1, Msg, NodeOpts),
     ?event({trusted_software, IsTrustedSoftware}),
-    % Step 5: Verify the measurement against the report's measurement.
-    Args =
-        maps:from_list(
-            lists:map(
-                fun({Key, Val}) -> {binary_to_existing_atom(Key), Val} end,
-                maps:to_list(
-                    maps:with(
-                        lists:map(
-                            fun atom_to_binary/1,
-                            ?COMMITTED_PARAMETERS
-                        ),
-                        hb_ao:get(<<"local-hashes">>, Msg, NodeOpts)
-                    )
-                )
-            )
-        ),
+    case IsTrustedSoftware of
+        true -> {ok, true};
+        false -> {error, untrusted_software}
+    end.
+
+%% @doc Verify that the measurement in the SNP report is valid.
+%%
+%% This function validates the SNP measurement by:
+%% 1. Extracting committed parameters from the message
+%% 2. Computing the expected launch digest using those parameters
+%% 3. Comparing the computed digest with the measurement in the report
+%%
+%% @param Msg The normalized SNP message containing local hashes
+%% @param ReportJSON The raw JSON report containing the measurement
+%% @param NodeOpts A map of configuration options
+%% @returns `{ok, true}' if the measurement is valid, or 
+%% `{error, measurement_invalid}' on failure
+-spec verify_measurement(Msg :: map(), ReportJSON :: binary(), 
+    NodeOpts :: map()) -> {ok, true} | {error, measurement_invalid}.
+verify_measurement(Msg, ReportJSON, NodeOpts) ->
+    Args = extract_measurement_args(Msg, NodeOpts),
     ?event({args, { explicit, Args}}),
-    {ok,Expected} = dev_snp_nif:compute_launch_digest(Args),
+    {ok, Expected} = dev_snp_nif:compute_launch_digest(Args),
     ExpectedBin = list_to_binary(Expected),
-    ?event({expected_measurement, ExpectedBin}),
+    ?event({expected_measurement, {explicit, Expected}}),
     Measurement = hb_ao:get(<<"measurement">>, Msg, NodeOpts),
     ?event({measurement, {explicit,Measurement}}),
     {Status, MeasurementIsValid} =
@@ -146,204 +375,540 @@ verify(M1, M2, NodeOpts) ->
         ),
     ?event({status, Status}),
     ?event({measurement_is_valid, MeasurementIsValid}),
-    % Step 6: Check the report's integrity.
+    case MeasurementIsValid of
+        true -> {ok, true};
+        false -> {error, measurement_invalid}
+    end.
+
+%% @doc Extract measurement arguments from the SNP message.
+%%
+%% This function extracts and formats the committed parameters needed for
+%% measurement computation from the local hashes in the message.
+%%
+%% @param Msg The normalized SNP message containing local hashes
+%% @param NodeOpts A map of configuration options
+%% @returns A map of measurement arguments with atom keys
+-spec extract_measurement_args(Msg :: map(), NodeOpts :: map()) -> map().
+extract_measurement_args(Msg, NodeOpts) ->
+    maps:from_list(
+        lists:map(
+            fun({Key, Val}) -> {binary_to_existing_atom(Key), Val} end,
+            maps:to_list(
+                maps:with(
+                    lists:map(fun atom_to_binary/1, ?COMMITTED_PARAMETERS),
+                    hb_cache:ensure_all_loaded(
+                        hb_ao:get(<<"local-hashes">>, Msg, NodeOpts),
+                        NodeOpts
+                    )
+                )
+            )
+        )
+    ).
+
+%% @doc Verify the integrity of the SNP report's digital signature.
+%%
+%% This function validates the cryptographic signature of the SNP report
+%% against the hardware root of trust to ensure the report has not been
+%% tampered with and originates from genuine AMD SEV-SNP hardware.
+%%
+%% @param ReportJSON The raw JSON report to verify
+%% @returns `{ok, true}' if the report signature is valid, or
+%% `{error, report_signature_invalid}' on failure
+-spec verify_report_integrity(ReportJSON :: binary()) ->
+    {ok, true} | {error, report_signature_invalid}.
+verify_report_integrity(ReportJSON) ->
     {ok, ReportIsValid} = dev_snp_nif:verify_signature(ReportJSON),
     ?event({report_is_valid, ReportIsValid}),
-    Valid =
-        lists:all(
-            fun({ok, Bool}) -> Bool; (Bool) -> Bool end,
-            [
-                NonceMatches,
-                SigIsValid,
-                AddressIsValid,
-                DebugDisabled,
-                IsTrustedSoftware,
-                MeasurementIsValid,
-                ReportIsValid
-            ]
-        ),
-    ?event({final_validation_result, Valid}),
-    {ok, hb_util:bin(Valid)}.
+    case ReportIsValid of
+        true -> {ok, true};
+        false -> {error, report_signature_invalid}
+    end.
 
-%% @doc Generate an commitment report and emit it as a message, including all of 
-%% the necessary data to generate the nonce (ephemeral node address + node
-%% message ID), as well as the expected measurement (firmware, kernel, and VMSAs
-%% hashes).
-generate(_M1, _M2, Opts) ->
-    ?event({generate_opts, {explicit, Opts}}),
-    Wallet = hb_opts:get(priv_wallet, no_viable_wallet, Opts),
-    Address = hb_util:human_id(ar_wallet:to_address(Wallet)),
-    % ?event({snp_wallet, Wallet}),
-    % Remove the `priv*' keys from the options.
-    {ok, PublicNodeMsgID} =
-        dev_message:id(
-                NodeMsg = hb_private:reset(Opts),
-                #{ <<"committers">> => <<"none">> },
-                Opts
-            ),
-    RawPublicNodeMsgID = hb_util:native_id(PublicNodeMsgID),
-    ?event({snp_node_msg, NodeMsg}),
-    ?event({snp_node_msg_id, byte_size(RawPublicNodeMsgID)}),
-    ?event({snp_node_msg_id_bin, {explicit, io:format("~p", [RawPublicNodeMsgID])}}),
-    % Generate the commitment report.
-    ?event({snp_address,  byte_size(Address)}),
-    ReportData = generate_nonce(Address, RawPublicNodeMsgID),
-    ?event({snp_report_data, byte_size(ReportData)}),
-
-    LocalHashes = hd(hb_opts:get(snp_trusted, [#{}], Opts)),
-    ?event(snp_local_hashes, {explicit, LocalHashes}),
-    
-    {ok, ReportJSON} = dev_snp_nif:generate_attestation_report(ReportData, 1),
-    ?event({snp_report_json, ReportJSON}),
+%% @doc Check if the node's debug policy is enabled.
+%%
+%% This function examines the SNP policy field to determine if debug mode
+%% is enabled by checking the debug flag bit in the policy bitmask.
+%%
+%% @param Report The SNP report containing the policy field
+%% @returns `true' if debug mode is enabled, `false' otherwise
+-spec is_debug(Report :: map()) -> boolean().
+is_debug(Report) ->
+    (hb_ao:get(<<"policy">>, Report, #{}) band (1 bsl ?DEBUG_FLAG_BIT)) =/= 0.
 
-    ?event(
-        {snp_report_generated,
-            {nonce, ReportData},
-            {report, ReportJSON}
-        }
-    ),
-    ReportMsg = hb_message:commit(#{
-        <<"local-hashes">> => LocalHashes,
-        <<"nonce">> => hb_util:encode(ReportData),
-        <<"address">> => Address,
-        <<"node-message">> => NodeMsg,
-        <<"report">> => ReportJSON
-    }, Wallet),
-    
-    ?event({verify_res, hb_message:verify(ReportMsg)}),
-    ?event({snp_report_msg, ReportMsg}),
-    {ok, ReportMsg}.
 
-%% @doc Ensure that the node's debug policy is disabled.
-is_debug(Report) ->
-    (hb_ao:get(<<"policy">>, Report, #{}) band (1 bsl 19)) =/= 0.
-
-%% @doc Ensure that all of the software hashes are trusted. The caller may set
-%% a specific device to use for the `is-trusted' key. The device must then
-%% implement the `trusted' resolver.
-execute_is_trusted(M1, Msg, NodeOpts) ->
-    % Generate a modified version of the base message, with the 
-    % `is-trusted-device' key set as the device, if provided by the caller.
-    % If not provided, use the default resolver (this module's `trusted'
-    % function).
-    ModM1 =
-        case hb_ao:get(<<"is-trusted-device">>, M1, NodeOpts) of
-            not_found -> M1#{ <<"device">> => <<"snp@1.0">> };
-            Device -> {as, Device, M1}
-        end,
-    LocalHashes = hb_ao:get(<<"local-hashes">>, Msg, NodeOpts),
-    Result = lists:all(
-        fun(ReportKey) ->
-            ?event(trusted, {report_key, {explicit, ReportKey}}),
-            ReportVal = hb_ao:get(ReportKey, LocalHashes, NodeOpts),
-            ?event(trusted, {report_val, {explicit, ReportVal}}),
-            QueryMsg = #{
-                <<"path">> => <<"trusted">>,
-                <<"key">> => ReportKey,
-                <<"body">> => ReportVal
-            },
-            ?event(trusted, {query_msg, {explicit, QueryMsg}}),
-            % ?event({is_trusted_query, {base, ModM1}, {query, QueryMsg}}),
-            % Resolve the query message against the modified base message.
-            {ok, KeyIsTrusted} = hb_ao:resolve(ModM1, QueryMsg, NodeOpts),
-            % ?event(
-            %     {is_software_component_trusted,
-            %         {key, ReportKey},
-            %         {trusted, ReportKey},
-            %         {result, KeyIsTrusted}
-            %     }
-            % ),
-            KeyIsTrusted
-        end,
-        ?COMMITTED_PARAMETERS
-    ),
-    ?event({is_all_software_trusted, Result}),
-    {ok, Result}.
-
-%% @doc Validates if a given message parameter matches a trusted value from the SNP trusted list
-%% Returns {ok, true} if the message is trusted, {ok, false} otherwise
-trusted(_Msg1, Msg2, NodeOpts) ->
-    % Extract the key name to check and the expected value from the message
-    Key = hb_ao:get(<<"key">>, Msg2, NodeOpts),
-    Body = hb_ao:get(<<"body">>, Msg2, not_found, NodeOpts),
-    ?event(trusted, {key, {explicit, Key}}),
-    ?event(trusted, {body, {explicit, Body}}),
-    %% Get trusted software list from node options
-    % This is the set of approved configurations for attestation
+%% @doc Validate that all software hashes match trusted configurations.
+%%
+%% This function ensures that the firmware, kernel, and other system components
+%% in the SNP report match approved configurations. The validation process:
+%% 1. Extracts local hashes from the message
+%% 2. Filters hashes to only include enforced keys
+%% 3. Compares filtered hashes against trusted software configurations
+%% 4. Returns true only if the configuration matches a trusted entry
+%%
+%% Configuration options in NodeOpts map:
+%% - snp_trusted: List of maps containing trusted software configurations
+%% - snp_enforced_keys: Keys to enforce during validation (defaults to all 
+%%   committed parameters)
+%%
+%% @param _M1 Ignored parameter
+%% @param Msg The SNP message containing local software hashes
+%% @param NodeOpts A map of configuration options including trusted software
+%% @returns `{ok, true}' if software is trusted, `{ok, false}' otherwise
+-spec execute_is_trusted(M1 :: term(), Msg :: map(), NodeOpts :: map()) ->
+    {ok, boolean()}.
+execute_is_trusted(_M1, Msg, NodeOpts) ->
+    FilteredLocalHashes = get_filtered_local_hashes(Msg, NodeOpts),
     TrustedSoftware = hb_opts:get(snp_trusted, [#{}], NodeOpts),
-    %% Check if the value exists in any of the trusted maps in the list
+    ?event({trusted_software, {explicit, TrustedSoftware}}),
     IsTrusted = 
-        case TrustedSoftware of
-            % Handle empty trusted software list
-            [] -> 
-                false;
-            % Process list of trusted configurations
-            [_|_] when is_list(TrustedSoftware) ->
-                % Check if any trusted configuration matches
-                lists:any(
-                    fun(TrustedMap) ->
-                        % Check if this entry is a valid map
-                        is_map(TrustedMap) andalso
-                        % Get the value for the specified key from the trusted entry
-                        case hb_ao:get(Key, TrustedMap, not_found, NodeOpts) of
-                            not_found -> false;
-                            PropertyName ->
-                                ?event(trusted, {property_name, { explicit, PropertyName}}),
-                                % Compare to see if it matches the expected value
-                                PropertyName == Body
-                        end
-                    end,
-                    TrustedSoftware
-                );
-            
-            % Handle other cases (should not normally happen)
-            _ -> false
-        end,
-    %% Return the trust validation result
+        is_software_trusted(
+            FilteredLocalHashes, 
+            TrustedSoftware, 
+            NodeOpts
+        ),
+    ?event({is_all_software_trusted, IsTrusted}),
     {ok, IsTrusted}.
 
-%% @doc Ensure that the report data matches the expected report data.
+%% @doc Extract local hashes filtered to only include enforced keys.
+%%
+%% This function retrieves the local software hashes from the message and
+%% filters them to only include the keys that are configured for enforcement.
+%%
+%% @param Msg The SNP message containing local hashes
+%% @param NodeOpts A map of configuration options
+%% @returns A map of filtered local hashes with only enforced keys
+-spec get_filtered_local_hashes(Msg :: map(), NodeOpts :: map()) -> map().
+get_filtered_local_hashes(Msg, NodeOpts) ->
+    LocalHashes = hb_ao:get(<<"local-hashes">>, Msg, NodeOpts),
+    EnforcedKeys = get_enforced_keys(NodeOpts),
+    ?event({enforced_keys, {explicit, EnforcedKeys}}),
+    FilteredLocalHashes = hb_cache:ensure_all_loaded(
+        maps:with(EnforcedKeys, LocalHashes),
+        NodeOpts
+    ),
+    ?event({filtered_local_hashes, {explicit, FilteredLocalHashes}}),
+    FilteredLocalHashes.
+
+%% @doc Get the list of enforced keys for software validation.
+%%
+%% This function retrieves the configuration specifying which software
+%% component keys should be enforced during trust validation.
+%%
+%% @param NodeOpts A map of configuration options
+%% @returns A list of binary keys that should be enforced
+-spec get_enforced_keys(NodeOpts :: map()) -> [binary()].
+get_enforced_keys(NodeOpts) ->
+    lists:map(
+        fun atom_to_binary/1,
+        hb_opts:get(snp_enforced_keys, ?COMMITTED_PARAMETERS, NodeOpts)
+    ).
+
+%% @doc Check if filtered local hashes match any trusted configurations.
+%%
+%% This function compares the filtered local hashes against a list of
+%% trusted software configurations, returning true if any configuration
+%% matches exactly. It handles three cases:
+%% 1. Empty list of trusted configurations (returns false)
+%% 2. Valid list of trusted configurations (performs matching)
+%% 3. Invalid trusted software configuration (returns false)
+%%
+%% @param FilteredLocalHashes The software hashes to validate
+%% @param TrustedSoftware List of trusted software configurations or invalid input
+%% @param NodeOpts Configuration options for matching
+%% @returns `true' if hashes match a trusted configuration, `false' otherwise
+-spec is_software_trusted(map(), [] | [map()] | term(), map()) -> boolean().
+is_software_trusted(_FilteredLocalHashes, [], _NodeOpts) ->
+    false;
+is_software_trusted(FilteredLocalHashes, TrustedSoftware, NodeOpts) 
+    when is_list(TrustedSoftware) ->
+    lists:any(
+        fun(TrustedMap) ->
+            Match = 
+                hb_message:match(
+                    FilteredLocalHashes,
+                    TrustedMap,
+                    primary, 
+                    NodeOpts
+                ),
+            ?event({match, {explicit, Match}}),
+            is_map(TrustedMap) andalso Match == true
+        end,
+        TrustedSoftware
+    );
+is_software_trusted(_FilteredLocalHashes, _TrustedSoftware, _NodeOpts) ->
+    false.
+
+%% @doc Validate that the report data matches the expected nonce.
+%%
+%% This function ensures that the nonce in the SNP report was generated
+%% using the same address and node message ID that are expected for this
+%% verification request.
+%%
+%% @param Address The node's address used in nonce generation
+%% @param NodeMsgID The node message ID used in nonce generation  
+%% @param ReportData The actual nonce data from the SNP report
+%% @returns `true' if the report data matches the expected nonce, `false' otherwise
+-spec report_data_matches(Address :: binary(), NodeMsgID :: binary(), 
+    ReportData :: binary()) -> boolean().
 report_data_matches(Address, NodeMsgID, ReportData) ->
     ?event({generated_nonce, {explicit, generate_nonce(Address, NodeMsgID)}}),
     ?event({expected_nonce, {explicit, ReportData}}),
     generate_nonce(Address, NodeMsgID) == ReportData.
 
-%% @doc Generate the nonce to use in the commitment report.
+%% @doc Generate the nonce to use in the SNP commitment report.
+%%
+%% This function creates a unique nonce by concatenating the node's native
+%% address and message ID. This nonce is embedded in the hardware attestation
+%% report to bind it to a specific verification request.
+%%
+%% @param RawAddress The node's raw address identifier
+%% @param RawNodeMsgID The raw node message identifier
+%% @returns A binary nonce formed by concatenating the native address and message ID
+-spec generate_nonce(RawAddress :: binary(), RawNodeMsgID :: binary()) -> binary().
 generate_nonce(RawAddress, RawNodeMsgID) ->
     Address = hb_util:native_id(RawAddress),
     NodeMsgID = hb_util:native_id(RawNodeMsgID),
     << Address/binary, NodeMsgID/binary >>.
 
-%% Generate an commitment report and emit it via HTTP.
-% generate_test() ->
-% 	Trusted =
-% 		#{
-% 			vcpus => 1,
-% 			vcpu_type => 5, 
-% 			vmm_type => 1,
-% 			guest_features => 16#1,
-% 			firmware =>
-%               "b8c5d4082d5738db6b0fb0294174992738645df70c44cdecf7fad3a62244b7"
-%                   "88e7e408c582ee48a74b289f3acec78510",
-% 			kernel =>
-%               "69d0cd7d13858e4fcef6bc7797aebd258730f215bc5642c4ad8e4b893cc67576",
-% 			initrd =>
-%               "02e28b6c718bf0a5260d6f34d3c8fe0d71bf5f02af13e1bc695c6bc162120da1",
-% 			append =>
-%               "56e1e5190622c8c6b9daa4fe3ad83f3831c305bb736735bf795b284cb462c9e7"
-% 		},
-%     Wallet = ar_wallet:new(),
-%     Addr = hb_util:human_id(ar_wallet:to_address(Wallet)),
-%     Node = hb_http_server:start_node(
-%         #{
-%             force_signed => true,
-%             priv_wallet => Wallet,
-% 			snp_hashes => Trusted
-%         }
-%     ),
-%     {ok, Report} = hb_http:get(Node, <<"/\~snp@1.0/generate">>, #{}),
-%     ?event({snp_report_rcvd, Report}),
-%     ?assertEqual(Addr, hb_ao:get(<<"address">>, Report, #{})),
-% 	ValidationRes = verify(#{ <<"trusted">> => Trusted}, #{ <<"body">> => Report }, #{}),
-% 	?event({snp_validation_res, ValidationRes}),
-%     ?assertEqual({ok, true}, ValidationRes).
\ No newline at end of file
+%% Test helper functions and data
+get_test_hashes() ->
+    #{
+        <<"vcpus">> => ?TEST_VCPUS_COUNT,
+        <<"vcpu_type">> => ?TEST_VCPU_TYPE,
+        <<"vmm_type">> => ?TEST_VMM_TYPE,
+        <<"guest_features">> => ?TEST_GUEST_FEATURES,
+        <<"firmware">> => ?TEST_FIRMWARE_HASH,
+        <<"kernel">> => ?TEST_KERNEL_HASH,
+        <<"initrd">> => ?TEST_INITRD_HASH,
+        <<"append">> => ?TEST_APPEND_HASH
+    }.
+
+%% Verification test helpers
+setup_test_nodes() ->
+    ProxyWallet = hb:wallet(<<"test/admissible-report-wallet.json">>),
+    ProxyOpts = #{
+        store => hb_opts:get(store),
+        priv_wallet => ProxyWallet
+    },
+    _ReportNode = hb_http_server:start_node(ProxyOpts),
+    VerifyingNode = hb_http_server:start_node(#{
+        priv_wallet => ar_wallet:new(),
+        store => hb_opts:get(store),
+        snp_trusted => [
+            #{
+                <<"vcpus">> => ?TEST_VCPUS_COUNT,
+                <<"vcpu_type">> => ?TEST_VCPU_TYPE,
+                <<"vmm_type">> => ?TEST_VMM_TYPE,
+                <<"guest_features">> => ?TEST_GUEST_FEATURES,
+                <<"firmware">> => ?TEST_FIRMWARE_HASH,
+                <<"kernel">> => ?TEST_KERNEL_HASH,
+                <<"initrd">> => ?TEST_INITRD_HASH,
+                <<"append">> => ?TEST_APPEND_HASH
+            }
+        ],
+        snp_enforced_keys => [
+            vcpu_type, vmm_type, guest_features,
+            firmware, kernel, initrd, append
+        ]
+    }),
+    {ProxyOpts, VerifyingNode}.
+
+
+%% @doc Load test SNP report data from file.
+%%
+%% This function loads a sample SNP attestation report from a test file.
+%% The test will fail if the file doesn't exist, ensuring predictable test data.
+%%
+%% @returns Binary containing test SNP report JSON data
+%% @throws {error, {file_not_found, Filename}} if test file doesn't exist
+-spec load_test_report_data() -> binary().
+load_test_report_data() ->
+    TestFile = <<"test/admissible-report.json">>,
+    case file:read_file(TestFile) of
+        {ok, Data} -> 
+            Data;
+        {error, enoent} ->
+            throw({error, {file_not_found, TestFile}});
+        {error, Reason} ->
+            throw({error, {file_read_error, TestFile, Reason}})
+    end.
+
+
+%% Individual test cases
+execute_is_trusted_exact_match_should_fail_test() ->
+    % Test case: Exact match with trusted software should fail when vcpus differ
+    Msg = #{
+        <<"local-hashes">> => (get_test_hashes())#{
+            <<"vcpus">> => 16
+        }
+    },
+    NodeOpts = #{
+        snp_trusted => [get_test_hashes()],
+        snp_enforced_keys => [
+            vcpus, vcpu_type, vmm_type, guest_features,
+            firmware, kernel, initrd, append
+        ]
+    },
+    {ok, Result} = execute_is_trusted(#{}, Msg, NodeOpts),
+    ?assertEqual(false, Result).
+
+execute_is_trusted_subset_match_should_pass_test() ->
+    % Test case: Match with subset of keys in trusted software should pass
+    Msg = #{
+        <<"local-hashes">> => (get_test_hashes())#{
+            <<"vcpus">> => 16
+        }
+    },
+    NodeOpts = #{
+        snp_trusted => [get_test_hashes()],
+        snp_enforced_keys => [
+            vcpu_type, vmm_type, guest_features,
+            firmware, kernel, initrd, append
+        ]
+    },
+    {ok, Result} = execute_is_trusted(#{}, Msg, NodeOpts),
+    ?assertEqual(true, Result).
+
+verify_test() ->
+    % Note: If this test fails, it may be because the unsigned ID of the node
+    % message in `test/admissible-report.eterm` has changed. If the format ever
+    % changes, this value will need to be updated. Recalculate the unsigned ID
+    % of the `Request/node-message' field, decode `Request/address', concatenate
+    % the two, and encode. The result will be the new `Request/nonce' value.
+    {ProxyOpts, VerifyingNode} = setup_test_nodes(),
+    {ok, [Request]} = file:consult(<<"test/admissible-report.eterm">>),
+    {ok, Result} = hb_http:post(
+        VerifyingNode,
+        <<"/~snp@1.0/verify">>,
+        hb_message:commit(Request, ProxyOpts),
+        ProxyOpts
+    ),
+    ?event({verify_test_result, Result}),
+    ?assertEqual(true, hb_util:atom(Result)).
+
+
+%% @doc Test successful report generation with valid configuration.
+generate_success_test() ->
+    % Set up test configuration
+    TestWallet = ar_wallet:new(),
+    TestOpts = #{
+        priv_wallet => TestWallet,
+        snp_trusted => [#{
+            <<"vcpus">> => ?TEST_VCPUS_COUNT,
+            <<"vcpu_type">> => ?TEST_VCPU_TYPE,
+            <<"firmware">> => ?TEST_FIRMWARE_HASH,
+            <<"kernel">> => ?TEST_KERNEL_HASH
+        }]
+    },
+    % Load test report data from file
+    TestReportJSON = load_test_report_data(),
+    % Mock the NIF function to return test data
+    ok = mock_snp_nif(TestReportJSON),
+    try
+        % Call generate function
+        {ok, Result} = generate(#{}, #{}, TestOpts),
+        % Verify the result structure
+        ?assert(is_map(Result)),
+        ?assert(maps:is_key(<<"local-hashes">>, Result)),
+        ?assert(maps:is_key(<<"nonce">>, Result)),
+        ?assert(maps:is_key(<<"address">>, Result)),
+        ?assert(maps:is_key(<<"node-message">>, Result)),
+        ?assert(maps:is_key(<<"report">>, Result)),
+        % Verify the report content
+        ?assertEqual(TestReportJSON, maps:get(<<"report">>, Result)),
+        % Verify local hashes match the first trusted config
+        ExpectedHashes = maps:get(<<"local-hashes">>, Result),
+        ?assertEqual(?TEST_VCPUS_COUNT, maps:get(<<"vcpus">>, ExpectedHashes)),
+        ?assertEqual(?TEST_VCPU_TYPE, maps:get(<<"vcpu_type">>, ExpectedHashes)),
+        % Verify nonce is properly encoded
+        Nonce = maps:get(<<"nonce">>, Result),
+        ?assert(is_binary(Nonce)),
+        ?assert(byte_size(Nonce) > 0),
+        % Verify address is present and properly formatted
+        Address = maps:get(<<"address">>, Result),
+        ?assert(is_binary(Address)),
+        ?assert(byte_size(Address) > 0)
+    after
+        % Clean up mock
+        unmock_snp_nif()
+    end.
+
+%% @doc Test error handling when wallet is missing.
+generate_missing_wallet_test() ->
+    TestOpts = #{
+        % No priv_wallet provided
+        snp_trusted => [#{ <<"firmware">> => ?TEST_FIRMWARE_HASH }]
+    },
+    % Mock the NIF function (shouldn't be called)
+    ok = mock_snp_nif(<<"dummy_report">>),
+    try
+        % Call generate function - should fail
+        Result = generate(#{}, #{}, TestOpts),
+        ?assertMatch({error, no_wallet_available}, Result)
+    after
+        unmock_snp_nif()
+    end.
+
+%% @doc Test error handling when trusted configurations are missing.
+generate_missing_trusted_configs_test() ->
+    TestWallet = ar_wallet:new(),
+    TestOpts = #{
+        priv_wallet => TestWallet,
+        snp_trusted => [] % Empty trusted configs
+    },
+    
+    % Mock the NIF function (shouldn't be called)
+    ok = mock_snp_nif(<<"dummy_report">>),
+    
+    try
+        % Call generate function - should fail
+        Result = generate(#{}, #{}, TestOpts),
+        ?assertMatch({error, no_trusted_configs}, Result)
+    after
+        unmock_snp_nif()
+    end.
+
+%% @doc Test successful round-trip: generate then verify with same configuration.
+verify_mock_generate_success_test_() ->
+    { timeout, 30, fun verify_mock_generate_success/0 }.
+verify_mock_generate_success() ->
+    % Set up test configuration
+    TestWallet = ar_wallet:new(),
+    TestTrustedConfig = #{
+        <<"vcpus">> => 32,
+        <<"vcpu_type">> => ?TEST_VCPU_TYPE,
+        <<"vmm_type">> => ?TEST_VMM_TYPE,
+        <<"guest_features">> => ?TEST_GUEST_FEATURES,
+        <<"firmware">> => ?TEST_FIRMWARE_HASH,
+        <<"kernel">> => ?TEST_KERNEL_HASH,
+        <<"initrd">> => ?TEST_INITRD_HASH,
+        <<"append">> => ?TEST_APPEND_HASH
+    },
+    GenerateOpts = #{
+        priv_wallet => TestWallet,
+        snp_trusted => [TestTrustedConfig]
+    },
+    % Load test report data and set up mock
+    TestReportJSON = load_test_report_data(),
+    ok = mock_snp_nif(TestReportJSON),
+    try
+        % Step 1: Generate a test report using mocked SNP
+        {ok, GeneratedMsg} = generate(#{}, #{}, GenerateOpts),
+        % Verify the generated message structure
+        ?assert(is_map(GeneratedMsg)),
+        ?assert(maps:is_key(<<"report">>, GeneratedMsg)),
+        ?assert(maps:is_key(<<"address">>, GeneratedMsg)),
+        ?assert(maps:is_key(<<"nonce">>, GeneratedMsg)),
+        % Step 2: Set up verification options with the same trusted config
+        VerifyOpts = #{
+            snp_trusted => [TestTrustedConfig],
+            snp_enforced_keys => [vcpu_type, vmm_type, guest_features,
+                                 firmware, kernel, initrd, append]
+        },
+        % Step 3: Verify the generated report
+        {ok, VerifyResult} = 
+            verify(
+                #{}, 
+                hb_message:commit(GeneratedMsg, GenerateOpts), 
+                VerifyOpts
+            ),
+        % Step 4: Assert that verification succeeds
+        ?assertEqual(<<"true">>, VerifyResult),
+        % Additional validation: verify specific fields
+        ReportData = maps:get(<<"report">>, GeneratedMsg),
+        ?assertEqual(TestReportJSON, ReportData),
+        LocalHashes = maps:get(<<"local-hashes">>, GeneratedMsg),
+        ?assertEqual(TestTrustedConfig, LocalHashes)
+    after
+        % Clean up mock
+        unmock_snp_nif()
+    end.
+
+%% @doc Test verification failure when using wrong trusted configuration.
+verify_mock_generate_wrong_config_test_() ->
+    { timeout, 30, fun verify_mock_generate_wrong_config/0 }.
+verify_mock_generate_wrong_config() ->
+    % Set up test configuration for generation
+    TestWallet = ar_wallet:new(),
+    GenerateTrustedConfig = #{
+        <<"vcpus">> => ?TEST_VCPUS_COUNT,
+        <<"vcpu_type">> => ?TEST_VCPU_TYPE,
+        <<"vmm_type">> => ?TEST_VMM_TYPE,
+        <<"guest_features">> => ?TEST_GUEST_FEATURES,
+        <<"firmware">> => ?TEST_FIRMWARE_HASH,
+        <<"kernel">> => ?TEST_KERNEL_HASH,
+        <<"initrd">> => ?TEST_INITRD_HASH,
+        <<"append">> => ?TEST_APPEND_HASH
+    },
+    GenerateOpts = #{
+        priv_wallet => TestWallet,
+        snp_trusted => [GenerateTrustedConfig]
+    },
+    % Load test report data and set up mock
+    TestReportJSON = load_test_report_data(),
+    ok = mock_snp_nif(TestReportJSON),
+    try
+        % Step 1: Generate a test report
+        {ok, GeneratedMsg} = generate(#{}, #{}, GenerateOpts),
+        % Step 2: Set up verification with DIFFERENT trusted config
+        WrongTrustedConfig = #{
+            <<"vcpus">> => 32, % Different from generation config
+            <<"vcpu_type">> => 3, % Different from generation config  
+            <<"firmware">> => <<"different_firmware_hash">>,
+            <<"kernel">> => <<"different_kernel_hash">>
+        },
+        VerifyOpts = #{
+            snp_trusted => [WrongTrustedConfig],
+            snp_enforced_keys => [vcpus, vcpu_type, firmware, kernel]
+        },
+        % Step 3: Verify the generated report with wrong config
+        VerifyResult = 
+            verify(
+                #{}, 
+                hb_message:commit(GeneratedMsg, GenerateOpts), 
+                VerifyOpts
+            ),
+        ?event({verify_result, {explicit, VerifyResult}}),
+        % Step 4: Assert that verification fails (either as error or false result)
+        case VerifyResult of
+            {ok, <<"false">>} ->
+                % Verification completed but returned false (all validations ran)
+                ok;
+            {error, _Reason} ->
+                % Verification failed early (expected for wrong config)
+                ok;
+            Other ->
+                % Unexpected result - should fail the test
+                ?assertEqual({ok, <<"false">>}, Other)
+        end
+    after
+        % Clean up mock
+        unmock_snp_nif()
+    end.
+
+%% @doc Mock the SNP NIF function to return test data.
+%%
+%% This function sets up a simple mock for dev_snp_nif:generate_attestation_report
+%% to return predefined test data instead of calling actual hardware.
+%% Uses process dictionary for simple mocking without external dependencies.
+%%
+%% @param TestReportJSON The test report data to return
+%% @returns ok if mocking is successful
+-spec mock_snp_nif(ReportJSON :: binary()) -> ok.
+mock_snp_nif(TestReportJSON) ->
+    % Use process dictionary for simple mocking
+    put(mock_snp_nif_response, TestReportJSON),
+    put(mock_snp_nif_enabled, true),
+    ok.
+
+%% @doc Clean up SNP NIF mocking.
+%%
+%% This function removes the mock setup and restores normal NIF behavior.
+%%
+%% @returns ok
+-spec unmock_snp_nif() -> ok.
+unmock_snp_nif() ->
+    % Clean up process dictionary mock
+    erase(mock_snp_nif_response),
+    erase(mock_snp_nif_enabled),
+    ok.
\ No newline at end of file
diff --git a/src/dev_stack.erl b/src/dev_stack.erl
index 6ba8ad8c4..27c89816f 100644
--- a/src/dev_stack.erl
+++ b/src/dev_stack.erl
@@ -97,20 +97,20 @@
 %%% In this example, the `device' key is mutated a number of times, but the
 %%% resulting HashPath remains correct and verifiable.
 -module(dev_stack).
--export([info/1, router/4, prefix/3, input_prefix/3, output_prefix/3]).
+-export([info/2, router/4, prefix/3, input_prefix/3, output_prefix/3]).
 %%% Test exports
 -export([generate_append_device/1]).
 -include_lib("eunit/include/eunit.hrl").
 
 -include("include/hb.hrl").
 
-info(Msg) ->
-    maps:merge(
+info(Msg, Opts) ->
+    hb_maps:merge(
         #{
             handler => fun router/4,
             excludes => [<<"set">>, <<"keys">>]
         },
-        case maps:get(<<"stack-keys">>, Msg, not_found) of
+        case hb_maps:get(<<"stack-keys">>, Msg, not_found, Opts) of
             not_found -> #{};
             StackKeys -> #{ exports => StackKeys }
         end
@@ -131,9 +131,9 @@ output_prefix(Msg1, _Msg2, Opts) ->
 %% @doc The device stack key router. Sends the request to `resolve_stack',
 %% except for `set/2' which is handled by the default implementation in
 %% `dev_message'.
-router(<<"keys">>, Message1, Message2, _Opts) ->
+router(<<"keys">>, Message1, Message2, Opts) ->
 	?event({keys_called, {msg1, Message1}, {msg2, Message2}}),
-	dev_message:keys(Message1);
+	dev_message:keys(Message1, Opts);
 router(Key, Message1, Message2, Opts) ->
     case hb_path:matches(Key, <<"transform">>) of
         true -> transformer_message(Message1, Opts);
@@ -166,20 +166,21 @@ router(Message1, Message2, Opts) ->
 %% 		keyInDevice executed on DeviceName against Msg1.
 transformer_message(Msg1, Opts) ->
 	?event({creating_transformer, {for, Msg1}}),
-    BaseInfo = info(Msg1),
+    BaseInfo = info(Msg1, Opts),
 	{ok, 
 		Msg1#{
 			<<"device">> => #{
 				info =>
 					fun() ->
-                        maps:merge(
+                        hb_maps:merge(
                             BaseInfo,
                             #{
                                 handler =>
                                     fun(Key, MsgX1) ->
                                         transform(MsgX1, Key, Opts)
                                     end
-                            }
+                            },
+							Opts
                         )
 					end,
 				<<"type">> => <<"stack-transformer">>
@@ -261,7 +262,7 @@ transform(Msg1, Key, Opts) ->
 %% @doc The main device stack execution engine. See the moduledoc for more
 %% information.
 resolve_fold(Message1, Message2, Opts) ->
-	{ok, InitDevMsg} = dev_message:get(<<"device">>, Message1),
+	{ok, InitDevMsg} = dev_message:get(<<"device">>, Message1, Opts),
     StartingPassValue =
         hb_ao:get(<<"pass">>, {as, dev_message, Message1}, unset, Opts),
     PreparedMessage = hb_ao:set(Message1, <<"pass">>, 1, Opts),
@@ -351,7 +352,7 @@ resolve_map(Message1, Message2, Opts) ->
             Opts
         ),
     Res = {ok,
-        maps:filtermap(
+        hb_maps:filtermap(
             fun(Key, _Dev) ->
                 {ok, OrigWithDev} = transform(Message1, Key, Opts),
                 case hb_ao:resolve(OrigWithDev, Message2, Opts) of
@@ -359,7 +360,8 @@ resolve_map(Message1, Message2, Opts) ->
                     _ -> false
                 end
             end,
-            maps:without(?AO_CORE_KEYS, hb_ao:normalize_keys(DevKeys))
+            hb_maps:without(?AO_CORE_KEYS, hb_ao:normalize_keys(DevKeys, Opts), Opts),
+			Opts
         )
     },
     Res.
@@ -413,15 +415,15 @@ transform_internal_call_device_test() ->
 	AppendDev = generate_append_device(<<"_">>),
 	Msg1 =
 		#{
-			<<"device">> => <<"Stack@1.0">>,
+			<<"device">> => <<"stack@1.0">>,
 			<<"device-stack">> =>
 				#{
 					<<"1">> => AppendDev,
-					<<"2">> => <<"Message@1.0">>
+					<<"2">> => <<"message@1.0">>
 				}
 		},
 	?assertMatch(
-		<<"Message@1.0">>,
+		<<"message@1.0">>,
 		hb_ao:get(
 			<<"device">>,
 			element(2, transform(Msg1, <<"2">>, #{}))
@@ -432,7 +434,7 @@ transform_internal_call_device_test() ->
 %% return a version of msg1 with only that device attached.
 transform_external_call_device_test() ->
 	Msg1 = #{
-		<<"device">> => <<"Stack@1.0">>,
+		<<"device">> => <<"stack@1.0">>,
 		<<"device-stack">> =>
 			#{
 				<<"make-cool">> =>
@@ -443,10 +445,10 @@ transform_external_call_device_test() ->
 									handler =>
 										fun(<<"keys">>, MsgX1) ->
                                             ?event({test_dev_keys_called, MsgX1}),
-											{ok, maps:keys(MsgX1)};
+											{ok, hb_maps:keys(MsgX1, #{})};
 										(Key, MsgX1) ->
 											{ok, Value} =
-												dev_message:get(Key, MsgX1),
+												dev_message:get(Key, MsgX1, #{}),
 											dev_message:set(
 												MsgX1,
 												#{ Key =>
@@ -484,7 +486,7 @@ example_device_for_stack_test() ->
 
 simple_stack_execute_test() ->
 	Msg = #{
-		<<"device">> => <<"Stack@1.0">>,
+		<<"device">> => <<"stack@1.0">>,
 		<<"device-stack">> =>
 			#{
 				<<"1">> => generate_append_device(<<"!D1!">>),
@@ -500,7 +502,7 @@ simple_stack_execute_test() ->
 
 many_devices_test() ->
 	Msg = #{
-		<<"device">> => <<"Stack@1.0">>,
+		<<"device">> => <<"stack@1.0">>,
 		<<"device-stack">> =>
 			#{
 				<<"1">> => generate_append_device(<<"+D1">>),
@@ -527,7 +529,7 @@ many_devices_test() ->
 benchmark_test() ->
     BenchTime = 0.3,
 	Msg = #{
-		<<"device">> => <<"Stack@1.0">>,
+		<<"device">> => <<"stack@1.0">>,
 		<<"device-stack">> =>
 			#{
 				<<"1">> => generate_append_device(<<"+D1">>),
@@ -539,7 +541,7 @@ benchmark_test() ->
 		<<"result">> => <<"INIT">>
 	},
     Iterations =
-        hb:benchmark(
+        hb_test_utils:benchmark(
             fun() ->
                 hb_ao:resolve(Msg,
                     #{
@@ -552,9 +554,11 @@ benchmark_test() ->
             end,
             BenchTime
         ),
-    hb_util:eunit_print(
-        "Evaluated ~p stack messages in ~p seconds (~.2f msg/s)",
-        [Iterations, BenchTime, Iterations / BenchTime]
+    hb_test_utils:benchmark_print(
+        <<"Stack:">>,
+        <<"resolutions">>,
+        Iterations,
+        BenchTime
     ),
     ?assert(Iterations >= 10).
 
@@ -577,7 +581,7 @@ test_prefix_msg() ->
             end
     },
     #{
-        <<"device">> => <<"Stack@1.0">>,
+        <<"device">> => <<"stack@1.0">>,
         <<"device-stack">> => #{ <<"1">> => Dev, <<"2">> => Dev }
     }.
 
@@ -651,7 +655,7 @@ input_output_prefixes_passthrough_test() ->
 
 reinvocation_test() ->
 	Msg = #{
-		<<"device">> => <<"Stack@1.0">>,
+		<<"device">> => <<"stack@1.0">>,
 		<<"device-stack">> =>
 			#{
 				<<"1">> => generate_append_device(<<"+D1">>),
@@ -673,7 +677,7 @@ reinvocation_test() ->
 
 skip_test() ->
 	Msg1 = #{
-		<<"device">> => <<"Stack@1.0">>,
+		<<"device">> => <<"stack@1.0">>,
 		<<"device-stack">> =>
 			#{
 				<<"1">> => generate_append_device(<<"+D1">>, skip),
@@ -695,7 +699,7 @@ pass_test() ->
     % recursively calls the device by forcing its response to be `pass'
     % until that happens.
 	Msg = #{
-		<<"device">> => <<"Stack@1.0">>,
+		<<"device">> => <<"stack@1.0">>,
 		<<"device-stack">> =>
 			#{
 				<<"1">> => generate_append_device(<<"+D1">>, pass)
@@ -710,7 +714,7 @@ pass_test() ->
 not_found_test() ->
     % Ensure that devices not exposing a key are safely skipped.
 	Msg = #{
-		<<"device">> => <<"Stack@1.0">>,
+		<<"device">> => <<"stack@1.0">>,
 		<<"device-stack">> =>
 			#{
 				<<"1">> => generate_append_device(<<"+D1">>),
@@ -734,7 +738,7 @@ not_found_test() ->
 
 simple_map_test() ->
     Msg = #{
-        <<"device">> => <<"Stack@1.0">>,
+        <<"device">> => <<"stack@1.0">>,
         <<"device-stack">> =>
             #{
                 <<"1">> => generate_append_device(<<"+D1">>),
diff --git a/src/dev_test.erl b/src/dev_test.erl
index e1afec706..37912c9e0 100644
--- a/src/dev_test.erl
+++ b/src/dev_test.erl
@@ -1,14 +1,15 @@
 -module(dev_test).
+-export([info/3]).
 -export([info/1, test_func/1, compute/3, init/3, restore/3, snapshot/3, mul/2]).
 -export([update_state/3, increment_counter/3, delay/3]).
--export([info/3]).
+-export([index/3, postprocess/3, load/3]).
 -include_lib("eunit/include/eunit.hrl").
 -include("include/hb.hrl").
 
 %%% A simple test device for AO-Core, so that we can test the functionality that
 %%% depends on using Erlang's module system.
 %%% 
-%%% NOTE: This device is labelled `Test-Device/1.0' to avoid conflicts with
+%%% NOTE: This device is labelled `test-device/1.0' to avoid conflicts with
 %%% other testing functionality -- care should equally be taken to avoid
 %%% using the `test' key in other settings.
 
@@ -45,6 +46,19 @@ info(_Msg1, _Msg2, _Opts) ->
 	},
 	{ok, #{<<"status">> => 200, <<"body">> => InfoBody}}.
 
+%% @doc Example index handler.
+index(Msg, _Req, Opts) ->
+    Name = hb_ao:get(<<"name">>, Msg, <<"turtles">>, Opts),
+    {ok,
+        #{
+            <<"content-type">> => <<"text/html">>,
+            <<"body">> => <<"i like ", Name/binary, "!">>
+        }
+    }.
+
+%% @doc Return a message with the device set to this module.
+load(Base, _, _Opts) ->
+    {ok, Base#{ <<"device">> => <<"test-device@1.0">> }}.
 
 test_func(_) ->
 	{ok, <<"GOOD_FUNCTION">>}.
@@ -103,9 +117,16 @@ mul(Msg1, Msg2) ->
     {ok, #{ <<"state">> => State, <<"results">> => [Arg1 * Arg2] }}.
 
 %% @doc Do nothing when asked to snapshot.
-snapshot(_Msg1, _Msg2, _Opts) ->
+snapshot(Msg1, Msg2, _Opts) ->
+    ?event({snapshot_called, {msg1, Msg1}, {msg2, Msg2}}),
     {ok, #{}}.
 
+%% @doc Set the `postprocessor-called' key to true in the HTTP server.
+postprocess(_Msg, #{ <<"body">> := Msgs }, Opts) ->
+    ?event({postprocess_called, Opts}),
+    hb_http_server:set_opts(Opts#{ <<"postprocessor-called">> => true }),
+    {ok, Msgs}.
+
 %% @doc Find a test worker's PID and send it an update message.
 update_state(_Msg, Msg2, _Opts) ->
     case hb_ao:get(<<"test-id">>, Msg2) of
@@ -171,7 +192,7 @@ delay(Msg1, Req, Opts) ->
 device_with_function_key_module_test() ->
 	Msg =
 		#{
-			<<"device">> => <<"Test-Device@1.0">>
+			<<"device">> => <<"test-device@1.0">>
 		},
 	?assertEqual(
 		{ok, <<"GOOD_FUNCTION">>},
@@ -179,7 +200,7 @@ device_with_function_key_module_test() ->
 	).
 
 compute_test() ->
-    Msg0 = #{ <<"device">> => <<"Test-Device@1.0">> },
+    Msg0 = #{ <<"device">> => <<"test-device@1.0">> },
     {ok, Msg1} = hb_ao:resolve(Msg0, init, #{}),
     Msg2 =
         hb_ao:set(
@@ -206,6 +227,6 @@ compute_test() ->
     ?assertEqual([2, 1], hb_ao:get(<<"already-seen">>, Msg5, #{})).
 
 restore_test() ->
-    Msg1 = #{ <<"device">> => <<"Test-Device@1.0">>, <<"already-seen">> => [1] },
+    Msg1 = #{ <<"device">> => <<"test-device@1.0">>, <<"already-seen">> => [1] },
     {ok, Msg3} = hb_ao:resolve(Msg1, <<"restore">>, #{}),
     ?assertEqual([1], hb_private:get(<<"test-key/started-state">>, Msg3, #{})).
\ No newline at end of file
diff --git a/src/dev_trie.erl b/src/dev_trie.erl
new file mode 100644
index 000000000..2f4e62349
--- /dev/null
+++ b/src/dev_trie.erl
@@ -0,0 +1,567 @@
+%%% @doc Implements a multi-layer prefix tree for efficiently storing large
+%%% datasets in nested messages.
+%%% 
+%%% Each element of the trie is available using simply resolving its name,
+%%% despite the underlying data structure. Additionally, calling the AO-Core
+%%% `set' function will correctly handle putting the values into the correct
+%%% locations in the tree, re-generating only the necessary identifiers.
+%%% 
+%%% In this implementation of the `trie' structure, `set'ting a value over a
+%%% node in the tree that would otherwise be a prefix branch will fully replace
+%%% any existing values at that node. For example:
+%%% 
+%%% ```
+%%%     Trie = #{ aaa => 1, aab => 2, aba => 3 }
+%%%     set(Trie, #{ aa => 4 }) => #{ aa => 4, aba => 3 }
+%%% ```
+%%% 
+%%% The depth of the prefix trie can be configured by using the `set-depth' key
+%%% in the `set' request.
+-module(dev_trie).
+-export([info/0, get/3, set/3]).
+-include_lib("eunit/include/eunit.hrl").
+-include("include/hb.hrl").
+
+%%% @doc How many prefix layers should new keys be separated into by default?
+-define(DEFAULT_LAYERS, 2).
+
+info() ->
+    #{
+        default => fun get/4
+    }.
+
+%% @doc Get the value of a key from the trie in a base message. The function
+%% calls recursively to find the value, matching the largest prefix of the key
+%% as it recurses.
+get(Key, Trie, Req, Opts) ->
+    get(Trie, Req#{ <<"key">> => Key }, Opts).
+get(Trie, Req, Opts) ->
+    case hb_maps:find(<<"key">>, Req, Opts) of
+        error -> {error, <<"`key' parameter is required for trie lookup.">>};
+        {ok, <<>>} -> {ok, Trie};
+        {ok, Key} ->
+            % If we have a key to search for, find the longest prefix match
+            % amongst the keys in the trie and recurse, until there are no more
+            % bytes of the key to match on.
+            case longest_match(Key, Trie, Opts) of
+                <<>> -> {error, not_found};
+                Prefix ->
+                    % Find the child node and the remaining key.
+                    get(
+                        remove_prefix(Prefix, Key),
+                        hb_maps:get(Prefix, Trie, Opts),
+                        #{},
+                        Opts
+                    )
+            end
+    end.
+
+%% @doc Find the longest match for a key in a message representing a layer of 
+%% the trie.
+longest_match(Key, Trie, Opts) ->
+    longest_match(<<>>, Key, hb_maps:keys(Trie, Opts) -- [<<"device">>], Opts).
+longest_match(Best, _Key, [], _Opts) -> Best;
+longest_match(_Best, Key, [Key | _Keys], _Opts) -> Key;
+longest_match(Best, Key, [XKey | Keys], Opts) ->
+    case binary:longest_common_prefix([XKey, Key]) of
+        NewLength when NewLength > byte_size(Best) ->
+            longest_match(binary:part(Key, 0, NewLength), Key, Keys, Opts);
+        _ ->
+            longest_match(Best, Key, Keys, Opts)
+    end.
+
+%% @doc Set keys and their values in the trie. The `set-depth' key determines
+%% how many layers of the trie the keys should be separated into.
+set(Base, Req, Opts) ->
+    {ok, do_set(Base, filter_short(Req, Opts), Opts)}.
+do_set(Link, Req, Opts) when ?IS_LINK(Link) ->
+    do_set(hb_cache:ensure_loaded(Link, Opts), Req, Opts);
+do_set(NonTrie, Req, Opts) when not is_map(NonTrie) ->
+    % We are attempting to set a value on a non-trie, so we wipe the entire
+    % base and replace it with a new trie.
+    do_set(#{}, Req, Opts);
+do_set(Trie, Req, Opts) ->
+    Insertable = hb_maps:without([<<"set-depth">>, <<"path">>], Req, Opts),
+    ?event(debug_trie, {set, {trie, Trie}, {inserting, Insertable}}),
+    Depth = hb_maps:get(<<"set-depth">>, Req, ?DEFAULT_LAYERS, Opts),
+    % If we are setting a terminal value (indicated by the presence of an empty
+    % string key or a depth of 0), we simply return it.
+    case {hb_maps:find(<<>>, Insertable, Opts), Depth} of
+        {{ok, Terminal}, _} -> Terminal;
+        {_, 0} -> hb_ao:set(Trie, Insertable, Opts);
+        {_, SetDepth} ->
+            % Split keys from the request into groups for each sub-branch of the
+            % trie that they should be inserted into. Each group is then inserted
+            % in a single recursive call.
+            % After all groups are inserted, the new trie has its commitments
+            % normalized and is returned.
+            NewTrie =
+                hb_maps:fold(
+                    fun(Subkey, SubReq, Acc) ->
+                        Acc#{
+                            Subkey =>
+                                do_set(
+                                    hb_maps:get(Subkey, Acc, #{}, Opts),
+                                    SubReq#{
+                                        <<"set-depth">> => SetDepth - 1
+                                    },
+                                    Opts
+                                )
+                        }
+                    end,
+                    Trie,
+                    group_keys(Trie, Insertable, Opts),
+                    Opts
+                ),
+            Linkified =
+                hb_message:convert(
+                    NewTrie,
+                    <<"structured@1.0">>,
+                    <<"structured@1.0">>,
+                    Opts
+                ),
+            WithoutHMac =
+                hb_message:without_commitments(
+                    #{ <<"type">> => <<"unsigned">> },
+                    Linkified,
+                    Opts
+                ),
+            hb_message:commit(WithoutHMac, Opts, #{ <<"type">> => <<"unsigned">> })
+    end.
+
+%% @doc Filter all keys that are shorter than the default prefix depth.
+filter_short(Req, _Opts) ->
+    maps:filter(
+        fun(Key, _Value) -> byte_size(Key) >= ?DEFAULT_LAYERS end,
+        Req
+    ).
+
+%% @doc Take a request of keys and values, then return a new map of requests
+%% with keys split into sub-requests for each best-matching sub-trie of the base.
+%% The keys in each sub-request should be updated to have the group prefix
+%% removed.
+%% 
+%% For example, given the following setup:
+%% ```
+%% Trie = #{ <<"a">> => Trie2, <<"b">> => Trie3 }
+%% Req = #{ <<"a1">> => 1, <<"a2">> => 2, <<"b1">> => 3, <<"b2">> => 4 }
+%% ```
+%% The function should return:
+%% ```
+%% #{
+%%     <<"a">> => #{ <<"1">> => 1, <<"2">> => 2 },
+%%     <<"b">> => #{ <<"1">> => 3, <<"2">> => 4 }
+%% }
+%% ```
+group_keys(Trie, Req, Opts) ->
+    SubReqs = 
+        maps:groups_from_list(
+            fun(ReqKey) ->
+                case longest_match(ReqKey, Trie, Opts) of
+                    <<>> -> binary:part(ReqKey, 0, 1);
+                    BestMatch -> BestMatch
+                end
+            end,
+            hb_maps:keys(Req, Opts) -- [<<>>, <<"set-depth">>]
+        ),
+    Res = maps:map(
+        fun(Subkey, SubKeys) ->
+            maps:from_list(
+                lists:map(
+                    fun(SubReqKey) ->
+                        {
+                            remove_prefix(Subkey, SubReqKey),
+                            hb_maps:get(SubReqKey, Req, Opts)
+                        }
+                    end,
+                    SubKeys
+                )
+            )
+        end,
+        SubReqs
+    ),
+    ?event({grouped_keys, {explicit, Res}}),
+    Res.
+
+remove_prefix(Prefix, Key) ->
+    binary:part(
+        Key,
+        byte_size(Prefix),
+        byte_size(Key) - byte_size(Prefix)
+    ).
+
+%%% Tests
+
+immediate_get_test() ->
+    ?assertEqual(
+        1,
+        hb_ao:get(
+            <<"abc">>,
+            #{
+                <<"device">> => <<"trie@1.0">>,
+                <<"abc">> => 1
+            },
+            #{}
+        )
+    ).
+
+immediate_set_test() ->
+    ?assert(
+        hb_message:match(
+            #{ <<"a">> => 1, <<"b">> => 2 },
+            hb_ao:set(
+                #{ <<"device">> => <<"trie@1.0">>, <<"a">> => 1},
+                #{ <<"b">> => 2 },
+                #{}
+            ),
+            primary
+        )
+    ).
+
+second_layer_get_test() ->
+    ?assertEqual(
+        <<"layer-2">>,
+        hb_ao:get(
+            <<"ab">>,
+            #{
+                <<"device">> => <<"trie@1.0">>,
+                <<"a">> => #{ <<"b">> => <<"layer-2">> }
+            },
+            #{}
+        )
+    ).
+
+second_layer_set_test() ->
+    ?assert(
+        hb_message:match(
+            #{ <<"a">> => #{ <<"b">> => 2, <<"c">> => 3 } },
+            hb_ao:set(
+                #{ <<"device">> => <<"trie@1.0">>, <<"a">> => #{ <<"b">> => 2 } },
+                #{ <<"ac">> => 3 },
+                #{}
+            ),
+            primary
+        )
+    ).
+
+set_multiple_test() ->
+    ?assert(
+        hb_message:match(
+            #{
+                <<"a">> => #{ <<"b">> => 2, <<"c">> => 3, <<"d">> => 4 },
+                <<"b">> => #{ <<"a">> => 5 }
+            },
+            hb_ao:set(
+                #{ <<"device">> => <<"trie@1.0">>, <<"a">> => #{ <<"b">> => 2 } },
+                #{ <<"ac">> => 3, <<"ad">> => 4, <<"ba">> => 5 },
+                #{}
+            ),
+            primary
+        )
+    ).
+
+large_balance_table_test() ->
+    TotalBalances = 3_000,
+    ?event(debug_trie, {large_balance_table_test, {total_balances, TotalBalances}}),
+    Balances =
+        maps:from_list(
+            [
+                {
+                    hb_util:human_id(crypto:strong_rand_bytes(32)),
+                    hb_util:bin(rand:uniform(1_000_000_000_000))
+                }
+            ||
+                _ <- lists:seq(1, TotalBalances)
+            ]
+        ),
+    ?event({created_balances, {keys, maps:size(Balances)}}),
+    {ok, BaseTrie} =
+        hb_ao:resolve(
+            #{ <<"device">> => <<"trie@1.0">> },
+            Balances#{ <<"path">> => <<"set">> },
+            #{}
+        ),
+    ?event(debug_trie, {created_trie, maps:size(BaseTrie)}),
+    UpdateBalanceA = 
+        lists:nth(
+            rand:uniform(TotalBalances), 
+            maps:keys(Balances)
+        ),
+    UpdateBalanceB = 
+        lists:nth(
+            rand:uniform(TotalBalances), 
+            maps:keys(Balances)
+        ),
+    UpdatedTrie =
+        hb_ao:set(
+            BaseTrie,
+            #{
+                UpdateBalanceA => <<"0">>,
+                UpdateBalanceB => <<"0">>
+            },
+            #{}
+        ),
+    ?event(debug_trie, {updated_trie, maps:size(UpdatedTrie)}),
+    ?event(debug_trie, {checking_updates, {keys, [UpdateBalanceA, UpdateBalanceB]}}),
+    ?assertEqual(
+        <<"0">>,
+        hb_ao:get(UpdateBalanceA, UpdatedTrie, #{})
+    ),
+    ?event(debug_trie, {checked_update, UpdateBalanceA}),
+    ?assertEqual(
+        <<"0">>,
+        hb_ao:get(UpdateBalanceB, UpdatedTrie, #{})
+    ),
+    ?event(debug_trie, {checked_update, UpdateBalanceB}).
+
+%% @doc Test robust updating of existing terminal values plus adding new ones
+update_existing_values_test() ->
+    InitialTrie = #{
+        <<"device">> => <<"trie@1.0">>,
+        <<"alice">> => <<"100">>,
+        <<"bob">> => <<"200">>,
+        <<"charlie">> => <<"300">>
+    },
+    UpdatedTrie =
+        hb_ao:set(
+            InitialTrie,
+            #{
+                <<"alice">> => <<"150">>,    % Update existing terminal value
+                <<"bob">> => <<"250">>,      % Update another existing value  
+                <<"diana">> => <<"400">>,    % Add completely new value
+                <<"eve">> => <<"500">>,      % Add another new value
+                <<"frank">> => <<"600">>     % Add third new value
+            },
+            #{}
+        ),
+    ?assertEqual(<<"150">>, hb_ao:get(<<"alice">>, UpdatedTrie, #{})),
+    ?assertEqual(<<"250">>, hb_ao:get(<<"bob">>, UpdatedTrie, #{})),
+    ?assertEqual(<<"400">>, hb_ao:get(<<"diana">>, UpdatedTrie, #{})),
+    ?assertEqual(<<"500">>, hb_ao:get(<<"eve">>, UpdatedTrie, #{})),
+    ?assertEqual(<<"600">>, hb_ao:get(<<"frank">>, UpdatedTrie, #{})),    
+    % Verify charlie still exists (wasn't touched in this update)
+    ?assertEqual(<<"300">>, hb_ao:get(<<"charlie">>, UpdatedTrie, #{})),
+    % Test another round of updates to ensure robustness
+    FinalTrie =
+        hb_ao:set(
+            UpdatedTrie,
+            #{
+                <<"alice">> => <<"175">>,    % Update alice again
+                <<"frank">> => <<"600">>     % Add yet another new value
+            },
+            #{}
+        ),
+    % Verify the second round of updates
+    AliceResult = hb_ao:get(<<"alice">>, FinalTrie, #{}),
+    FrankResult = hb_ao:get(<<"frank">>, FinalTrie, #{}),
+    ?event(debug_trie, {alice_retrieval, AliceResult}),
+    ?event(debug_trie, {frank_retrieval, FrankResult}),
+    ?assertEqual(<<"175">>, AliceResult),
+    ?assertEqual(<<"600">>, FrankResult),
+    % Ensure all other values are still intact
+    ?assertEqual(<<"250">>, hb_ao:get(<<"bob">>, FinalTrie, #{})),
+    ?assertEqual(<<"300">>, hb_ao:get(<<"charlie">>, FinalTrie, #{})),
+    ?assertEqual(<<"400">>, hb_ao:get(<<"diana">>, FinalTrie, #{})),
+    ?assertEqual(<<"500">>, hb_ao:get(<<"eve">>, FinalTrie, #{})).
+
+%% @doc Test commitment integrity after setting and re-setting keys
+commitment_integrity_test() ->
+    Wallet = hb:wallet(),
+    InitialMsg = hb_message:commit(#{
+        <<"device">> => <<"trie@1.0">>,
+        <<"key1">> => <<"value1">>,
+        <<"key2">> => <<"value2">>
+    }, Wallet),
+    % Verify initial commitments exist
+    InitialCommitted = hb_message:committed(InitialMsg, all, #{}),
+    ?assert(length(InitialCommitted) > 0),
+    % Update the trie with individual key updates
+    UpdatedMsg =
+        hb_ao:set(
+            InitialMsg,
+            #{
+                <<"key1">> => <<"updated-value1">>,
+                <<"key3">> => <<"new-value3">>
+            },
+            #{}
+        ),
+    % Verify commitments are maintained after update
+    UpdatedCommitted = hb_message:committed(UpdatedMsg, all, #{}),
+    ?assert(length(UpdatedCommitted) > 0),
+    ?assertEqual(
+        <<"updated-value1">>,
+        hb_ao:get(<<"key1">>, UpdatedMsg, #{})
+    ),
+    ?assertEqual(
+        <<"value2">>,
+        hb_ao:get(<<"key2">>, UpdatedMsg, #{})
+    ),
+    ?assertEqual(
+        <<"new-value3">>,
+        hb_ao:get(<<"key3">>, UpdatedMsg, #{})
+    ).
+
+%% @doc Test keys shorter than the default prefix depth
+short_keys_test() ->
+    % Test single-byte keys (shorter than DEFAULT_LAYERS = 2)
+    ShortKeyTrie = #{
+        <<"device">> => <<"trie@1.0">>
+    },
+    % Insert single-byte keys
+    UpdatedTrie =
+        hb_ao:set(
+            ShortKeyTrie,
+            #{
+                <<"a">> => <<"value-a">>,
+                <<"b">> => <<"value-b">>,
+                <<"0">> => <<"value-0">>,
+                <<"1">> => <<"value-1">>
+            },
+            #{}
+        ),
+    % Verify all short keys can be retrieved
+    ?assertEqual(
+        <<"value-a">>,
+        hb_ao:get(<<"a">>, UpdatedTrie, #{})
+    ),
+    ?assertEqual(
+        <<"value-b">>,
+        hb_ao:get(<<"b">>, UpdatedTrie, #{})
+    ),
+    ?assertEqual(
+        <<"value-0">>,
+        hb_ao:get(<<"0">>, UpdatedTrie, #{})
+    ),
+    ?assertEqual(
+        <<"value-1">>,
+        hb_ao:get(<<"1">>, UpdatedTrie, #{})
+    ).
+
+%% @doc Test that mixed key lengths work with trie depth calculation
+mixed_key_lengths_test() ->
+    Trie0 =
+        hb_ao:set(
+            #{
+                <<"device">> => <<"trie@1.0">>
+            },
+            #{
+                <<"x">> => <<"single">>,
+                <<"yz">> => <<"double">>,
+                <<"abc">> => <<"triple">>
+            },
+            #{}
+        ),
+    ?assertEqual(<<"single">>, hb_ao:get(<<"x">>, Trie0, #{})),
+    ?assertEqual(<<"double">>, hb_ao:get(<<"yz">>, Trie0, #{})),
+    ?assertEqual(<<"triple">>, hb_ao:get(<<"abc">>, Trie0, #{})),
+    % Update a short key value.
+    Trie1 =
+        hb_ao:set(
+            Trie0,
+            #{
+                <<"x">> => <<"updated-single">>,
+                <<"ab">> => <<"overwritten-trie">>
+            },
+            #{}
+        ),
+    ?assertEqual(<<"updated-single">>, hb_ao:get(<<"x">>, Trie1, #{})),
+    ?assertEqual(<<"overwritten-trie">>, hb_ao:get(<<"ab">>, Trie1, #{})).
+
+%% @doc Test trie behavior with custom set-depth
+custom_depth_test() ->
+    Trie = #{
+        <<"device">> => <<"trie@1.0">>
+    },
+    UpdatedTrie =
+        hb_ao:set(
+            Trie,
+            #{
+                <<"set-depth">> => 1,
+                <<"very-long-key-1">> => <<"value1">>,
+                <<"very-long-key-2">> => <<"value2">>,
+                <<"different-prefix">> => <<"value3">>
+            },
+            #{}
+        ),
+    ?assertEqual(
+        <<"value1">>, 
+        hb_ao:get(<<"very-long-key-1">>, UpdatedTrie, #{})
+    ),
+    ?assertEqual(
+        <<"value2">>, 
+        hb_ao:get(<<"very-long-key-2">>, UpdatedTrie, #{})
+    ),
+    ?assertEqual(
+        <<"value3">>, 
+        hb_ao:get(<<"different-prefix">>, UpdatedTrie, #{})
+    ).
+
+%% @doc Test error conditions and boundary cases  
+error_conditions_test() ->
+    Trie = #{
+        <<"device">> => <<"trie@1.0">>
+    },
+    ?assertEqual(
+        not_found,
+        hb_ao:get(<<"nonexistent">>, Trie, #{})
+    ),
+    ZeroDepthTrie =
+        hb_ao:set(
+            Trie,
+            #{
+                <<"set-depth">> => 0,
+                <<"key1">> => <<"value1">>,
+                <<"key2">> => <<"value2">>
+            },
+            #{}
+        ),
+    ?assertEqual(<<"value1">>, hb_ao:get(<<"key1">>, ZeroDepthTrie, #{})),
+    ?assertEqual(<<"value2">>, hb_ao:get(<<"key2">>, ZeroDepthTrie, #{})). 
+
+%% @doc Test the critical single-byte key case (like "0" in AO token)
+single_byte_key_test() ->
+    Trie = #{
+        <<"device">> => <<"trie@1.0">>
+    },
+    UpdatedTrie =
+        hb_ao:set(
+            Trie,
+            #{
+                <<"0">> => <<"zero-balance">>,
+                <<"1">> => <<"one-balance">>,
+                <<"abc">> => <<"normal-key">>
+            },
+            #{}
+        ),
+    ?assertEqual(<<"zero-balance">>, hb_ao:get(<<"0">>, UpdatedTrie, #{})),
+    ?assertEqual(<<"one-balance">>, hb_ao:get(<<"1">>, UpdatedTrie, #{})),
+    ?assertEqual(<<"normal-key">>, hb_ao:get(<<"abc">>, UpdatedTrie, #{})).
+
+%% @doc Test trie structural integrity with deeper nesting
+deep_nesting_test() ->
+    Trie = #{
+        <<"device">> => <<"trie@1.0">>
+    },
+    Step1 =
+        hb_ao:set(
+            Trie,
+            #{ <<"level1">> => <<"value1">> },
+            #{}
+        ),
+    
+    Step2 =
+        hb_ao:set(
+            Step1,
+            #{ <<"level2">> => <<"value2">> },
+            #{}
+        ),
+    ?assertEqual(<<"value1">>, hb_ao:get(<<"level1">>, Step2, #{})),
+    ?assertEqual(<<"value2">>, hb_ao:get(<<"level2">>, Step2, #{})),
+    Step3 =
+        hb_ao:set(
+            Trie,
+            #{ <<"level1a">> => <<"value1a">>, <<"level1b">> => <<"value1b">> },
+            #{}
+        ),
+    ?assertEqual(<<"value1a">>, hb_ao:get(<<"level1a">>, Step3, #{})),
+    ?assertEqual(<<"value1b">>, hb_ao:get(<<"level1b">>, Step3, #{})).
\ No newline at end of file
diff --git a/src/dev_volume.erl b/src/dev_volume.erl
index 62a0a4705..528b52848 100644
--- a/src/dev_volume.erl
+++ b/src/dev_volume.erl
@@ -1,9 +1,9 @@
 %%% @doc Secure Volume Management for HyperBEAM Nodes
 %%%
-%%% This module handles encrypted storage operations for HyperBEAM, providing 
-%%% a robust and secure approach to data persistence. It manages the complete 
-%%% lifecycle of encrypted volumes from detection to creation, formatting, and 
-%%% mounting.
+%%% This module handles encrypted storage operations for HyperBEAM, 
+%%% providing a robust and secure approach to data persistence. It manages 
+%%% the complete lifecycle of encrypted volumes from detection to creation, 
+%%% formatting, and mounting.
 %%%
 %%% Key responsibilities:
 %%% - Volume detection and initialization
@@ -13,33 +13,36 @@
 %%% - Automatic handling of various system states 
 %%%   (new device, existing partition, etc.)
 %%%
-%%% The primary entry point is the `mount/3' function, which orchestrates the 
-%%% entire process based on the provided configuration parameters. This module 
-%%% works alongside `hb_volume' which provides the low-level operations for 
-%%% device manipulation.
+%%% The primary entry point is the `mount/3' function, which orchestrates 
+%%% the entire process based on the provided configuration parameters. This 
+%%% module works alongside `hb_volume' which provides the low-level 
+%%% operations for device manipulation.
 %%%
 %%% Security considerations:
 %%% - Ensures data at rest is protected through LUKS encryption
 %%% - Provides proper volume sanitization and secure mounting
-%%% - IMPORTANT: This module only applies configuration set in node options and
-%%%   does NOT accept disk operations via HTTP requests. It cannot format arbitrary
-%%%   disks as all operations are safeguarded by host operating system permissions
-%%%   enforced upon the HyperBEAM environment.
+%%% - IMPORTANT: This module only applies configuration set in node options 
+%%%   and does NOT accept disk operations via HTTP requests. It cannot 
+%%%   format arbitrary disks as all operations are safeguarded by host 
+%%%   operating system permissions enforced upon the HyperBEAM environment.
 -module(dev_volume).
 -export([info/1, info/3, mount/3, public_key/3]).
 -include("include/hb.hrl").
 -include_lib("eunit/include/eunit.hrl").
 -include_lib("public_key/include/public_key.hrl").
 
-%% @doc Exported function for getting device info, controls which functions are
-%% exposed via the device API.
+%% @doc Exported function for getting device info, controls which functions 
+%% are exposed via the device API.
 info(_) -> 
-    #{ exports => [info, mount, public_key] }.
+    ?event(debug_volume, {info, entry, device_info_requested}),
+    #{ exports => [<<"info">>, <<"mount">>, <<"public_key">>] }.
 
 %% @doc HTTP info response providing information about this device
 info(_Msg1, _Msg2, _Opts) ->
+    ?event(debug_volume, {info, http_request, starting}),
     InfoBody = #{
-        <<"description">> => <<"Secure Volume Management for HyperBEAM Nodes">>,
+        <<"description">> => 
+            <<"Secure Volume Management for HyperBEAM Nodes">>,
         <<"version">> => <<"1.0">>,
         <<"api">> => #{
             <<"info">> => #{
@@ -48,20 +51,25 @@ info(_Msg1, _Msg2, _Opts) ->
             <<"mount">> => #{
                 <<"description">> => <<"Mount an encrypted volume">>,
                 <<"required_node_opts">> => #{
-                    <<"volume_key">> => <<"The encryption key">>,
+                    <<"priv_volume_key">> => <<"The encryption key">>,
                     <<"volume_device">> => <<"The base device path">>,
                     <<"volume_partition">> => <<"The partition path">>,
                     <<"volume_partition_type">> => <<"The partition type">>,
-                    <<"volume_name">> => <<"The name for the encrypted volume">>,
-                    <<"volume_mount_point">> => <<"Where to mount the volume">>,
-                    <<"volume_store_path">> => <<"The store path on the volume">>
+                    <<"volume_name">> => 
+                        <<"The name for the encrypted volume">>,
+                    <<"volume_mount_point">> => 
+                        <<"Where to mount the volume">>,
+                    <<"volume_store_path">> => 
+                        <<"The store path on the volume">>
                 }
             },
             <<"public_key">> => #{
-                <<"description">> => <<"Get the node's public key for encrypted key exchange">>
+                <<"description">> => 
+                    <<"Get the node's public key for encrypted key exchange">>
             }
         }
     },
+    ?event(debug_volume, {info, http_response, success}),
     {ok, #{<<"status">> => 200, <<"body">> => InfoBody}}.
 
 %% @doc Handles the complete process of secure encrypted volume mounting.
@@ -71,12 +79,12 @@ info(_Msg1, _Msg2, _Opts) ->
 %% 2. Checks if the base device exists
 %% 3. Checks if the partition exists on the device
 %% 4. If the partition exists, attempts to mount it
-%% 5. If the partition doesn't exist, creates it, formats it with encryption 
-%%    and mounts it
+%% 5. If the partition doesn't exist, creates it, formats it with 
+%%    encryption and mounts it
 %% 6. Updates the node's store configuration to use the mounted volume
 %%
 %% Config options in Opts map:
-%% - volume_key: (Required) The encryption key
+%% - priv_volume_key: (Required) The encryption key
 %% - volume_device: Base device path
 %% - volume_partition: Partition path
 %% - volume_partition_type: Filesystem type
@@ -89,19 +97,29 @@ info(_Msg1, _Msg2, _Opts) ->
 %% @param Opts A map of configuration options for volume operations.
 %% @returns `{ok, Binary}' on success with operation result message, or
 %% `{error, Binary}' on failure with error message.
--spec mount(term(), term(), map()) -> {ok, binary()} | {error, binary()}.
+-spec mount(term(), term(), map()) -> 
+    {ok, binary()} | {error, binary()}.
 mount(_M1, _M2, Opts) ->
+    ?event(debug_volume, {mount, entry, starting}),
     % Check if an encrypted key was sent in the request
-    EncryptedKey = hb_opts:get(volume_key, not_found, Opts),
+    EncryptedKey = hb_opts:get(priv_volume_key, not_found, Opts),
     % Determine if we need to decrypt a key or use one from config
-    ?event(debug_mount, {mount, encrypted_key, EncryptedKey}),
-    Key = case decrypt_volume_key(EncryptedKey, Opts) of
-        {ok, DecryptedKey} ->
-            ?event(debug_mount, {mount, decrypted_key, DecryptedKey}),
-            DecryptedKey;
-        {error, DecryptError} ->
-            ?event(debug_mount, {mount, key_decrypt_error, DecryptError}),
-            not_found
+    SkipDecryption = hb_opts:get(volume_skip_decryption, 
+        <<"false">>, Opts),
+    Key = case SkipDecryption of
+        <<"true">> ->
+            ?event(debug_mount, {mount, skip_decryption, true}),
+            EncryptedKey;
+        _ ->
+            ?event(debug_volume, {decrypt_volume_key}),
+            case decrypt_volume_key(EncryptedKey, Opts) of
+                {ok, DecryptedKey} -> DecryptedKey;
+                {error, DecryptError} ->
+                    ?event(debug_mount, 
+                        {mount, key_decrypt_error, DecryptError}
+                    ),
+                    not_found
+            end
     end,
     Device = hb_opts:get(volume_device, not_found, Opts),
     Partition = hb_opts:get(volume_partition, not_found, Opts),
@@ -109,9 +127,18 @@ mount(_M1, _M2, Opts) ->
     VolumeName = hb_opts:get(volume_name, not_found, Opts),
     MountPoint = hb_opts:get(volume_mount_point, not_found, Opts),
     StorePath = hb_opts:get(volume_store_path, not_found, Opts),
+    ?event(debug_volume, 
+        {mount, options_extracted, 
+            {
+                device, Device, partition, Partition, 
+                partition_type, PartitionType, volume_name, VolumeName, 
+                mount_point, MountPoint, store_path, StorePath
+            }
+        }
+    ),
     % Check for missing required node options
     case hb_opts:check_required_opts([
-        {<<"volume_key">>, Key},
+        {<<"priv_volume_key">>, Key},
         {<<"volume_device">>, Device},
         {<<"volume_partition">>, Partition},
         {<<"volume_partition_type">>, PartitionType},
@@ -120,44 +147,47 @@ mount(_M1, _M2, Opts) ->
         {<<"volume_store_path">>, StorePath}
     ], Opts) of
         {ok, _} ->
-            ?event(debug_mount, {mount, device, Device}),
-            ?event(debug_mount, {mount, partition, Partition}),
-            ?event(debug_mount, {mount, partition_type, PartitionType}),
-            ?event(debug_mount, {mount, mount_point, MountPoint}),	
             check_base_device(
                 Device, Partition, PartitionType, VolumeName, 
                 MountPoint, StorePath, Key, Opts
             );
         {error, ErrorMsg} ->
-            ?event(mount, {error, ErrorMsg}),
+            ?event(debug_volume, {mount, required_opts_error, ErrorMsg}),
             {error, ErrorMsg}
     end.
 
 %% @doc Returns the node's public key for secure key exchange.
 %%
 %% This function retrieves the node's wallet and extracts the public key
-%% for encryption purposes. It allows users to securely exchange encryption keys
-%% by first encrypting their volume key with the node's public key.
+%% for encryption purposes. It allows users to securely exchange 
+%% encryption keys by first encrypting their volume key with the node's 
+%% public key.
 %%
-%% The process ensures that sensitive keys are never transmitted in plaintext.
-%% The encrypted key can then be securely sent to the node, which will decrypt it
-%% using its private key before using it for volume encryption.
+%% The process ensures that sensitive keys are never transmitted in 
+%% plaintext. The encrypted key can then be securely sent to the node, 
+%% which will decrypt it using its private key before using it for volume 
+%% encryption.
 %%
 %% @param _M1 Ignored parameter.
 %% @param _M2 Ignored parameter.
 %% @param Opts A map of configuration options.
 %% @returns `{ok, Map}' containing the node's public key on success, or
 %% `{error, Binary}' if the node's wallet is not available.
--spec public_key(term(), term(), map()) -> {ok, map()} | {error, binary()}.
+-spec public_key(term(), term(), map()) -> 
+    {ok, map()} | {error, binary()}.
 public_key(_M1, _M2, Opts) ->
-    ?event(volume, {public_key, start}),
     % Retrieve the node's wallet
     case hb_opts:get(priv_wallet, undefined, Opts) of
         undefined ->
             % Node doesn't have a wallet yet
-            ?event(volume, {public_key, error, <<"no wallet found">>}),
+            ?event(debug_volume, 
+                {public_key, wallet_error, no_wallet_found}
+            ),
             {error, <<"Node wallet not available">>};
         {{_KeyType, _Priv, Pub}, _PubKey} ->
+            ?event(debug_volume, 
+                {public_key, wallet_found, key_conversion_starting}
+            ),
             % Convert to a standard RSA format (PKCS#1 or X.509)
             RsaPubKey = #'RSAPublicKey'{
                 publicExponent = 65537,  % Common RSA exponent
@@ -167,33 +197,45 @@ public_key(_M1, _M2, Opts) ->
             DerEncoded = public_key:der_encode('RSAPublicKey', RsaPubKey),
             % Base64 encode for transmission
             Base64Key = base64:encode(DerEncoded),
+            ?event(debug_volume, {public_key, success, key_encoded}),
             {ok, #{
                 <<"status">> => 200,
                 <<"public_key">> => Base64Key,
-                <<"message">> => <<"Use this public key to encrypt your volume key">>
+                <<"message">> => 
+                    <<"Use this public key to encrypt your volume key">>
             }}
     end.
 
 %% @doc Decrypts an encrypted volume key using the node's private key.
 %%
-%% This function takes an encrypted key (typically sent by a client who encrypted
-%% it with the node's public key) and decrypts it using the node's private RSA key.
+%% This function takes an encrypted key (typically sent by a client who 
+%% encrypted it with the node's public key) and decrypts it using the 
+%% node's private RSA key.
 %%
 %% @param EncryptedKey The encrypted volume key (Base64 encoded).
 %% @param Opts A map of configuration options.
 %% @returns `{ok, DecryptedKey}' on successful decryption, or
 %% `{error, Binary}' if decryption fails.
--spec decrypt_volume_key(binary(), map()) -> {ok, binary()} | {error, binary()}.
+-spec decrypt_volume_key(binary(), map()) -> 
+    {ok, binary()} | {error, binary()}.
 decrypt_volume_key(EncryptedKeyBase64, Opts) ->
     % Decode the encrypted key
     try
         EncryptedKey = base64:decode(EncryptedKeyBase64),
-        ?event(debug_mount, {decrypt_volume_key, encrypted_key, EncryptedKey}),
+        ?event(debug_volume, 
+            {decrypt_volume_key, base64_decoded, success}
+        ),
         % Retrieve the node's wallet with private key
         case hb_opts:get(priv_wallet, undefined, Opts) of
             undefined ->
+                ?event(debug_volume, 
+                    {decrypt_volume_key, wallet_error, no_wallet}
+                ),
                 {error, <<"Node wallet not available for decryption">>};
             {{_KeyType = {rsa, E}, Priv, Pub}, _PubKey} ->
+                ?event(debug_volume, 
+                    {decrypt_volume_key, wallet_found, creating_private_key}
+                ),
                 % Create RSA private key record for decryption
                 RsaPrivKey = #'RSAPrivateKey'{
                     publicExponent = E,
@@ -201,16 +243,26 @@ decrypt_volume_key(EncryptedKeyBase64, Opts) ->
                     privateExponent = crypto:bytes_to_integer(Priv)
                 },
                 % Decrypt the key
-                DecryptedKey = public_key:decrypt_private(EncryptedKey, RsaPrivKey),
+                DecryptedKey = 
+                    public_key:decrypt_private(
+                        EncryptedKey, 
+                        RsaPrivKey
+                    ),
+                ?event(debug_volume, 
+                    {decrypt_volume_key, decryption_success, key_decrypted}
+                ),
                 {ok, DecryptedKey}
         end
     catch
         _:Error ->
-            ?event(debug_mount, {decrypt_volume_key, error, Error}),
+            ?event(debug_volume, 
+                {decrypt_volume_key, decryption_error, Error}
+            ),
             {error, <<"Failed to decrypt volume key">>}
     end.
 
-%% @doc Check if the base device exists and if it does, check if the partition exists.
+%% @doc Check if the base device exists and if it does, check if the 
+%% partition exists.
 %% @param Device The base device to check.
 %% @param Partition The partition to check.
 %% @param PartitionType The type of partition to check.
@@ -228,14 +280,22 @@ check_base_device(
     Device, Partition, PartitionType, VolumeName, MountPoint, StorePath, 
     Key, Opts
 ) ->
+    ?event(debug_volume, 
+        {check_base_device, entry, {checking_device, Device}}
+    ),
     case hb_volume:check_for_device(Device) of
         false ->
             % Base device doesn't exist
-            ?event(debug_mount, 
-                {device_check, error, <<"Base device not found">>}
+            ?event(debug_volume, 
+                {check_base_device, device_not_found, Device}
             ),
             {error, <<"Base device not found">>};
         true ->
+            ?event(debug_volume, 
+                {check_base_device, device_found, 
+                    {proceeding_to_partition_check, Device}
+                }
+            ),
             check_partition(
                 Device, Partition, PartitionType, VolumeName, 
                 MountPoint, StorePath, Key, Opts
@@ -261,13 +321,26 @@ check_partition(
     Device, Partition, PartitionType, VolumeName, MountPoint, StorePath, 
     Key, Opts
 ) ->
+    ?event(debug_volume, 
+        {check_partition, entry, {checking_partition, Partition}}
+    ),
     case hb_volume:check_for_device(Partition) of
         true ->
+            ?event(debug_volume, 
+                {check_partition, partition_exists, 
+                    {mounting_existing, Partition}
+                }
+            ),
             % Partition exists, try mounting it
             mount_existing_partition(
                 Partition, Key, MountPoint, VolumeName, StorePath, Opts
             );
         false ->
+            ?event(debug_volume, 
+                {check_partition, partition_not_exists, 
+                    {creating_new, Partition}
+                }
+            ),
             % Partition doesn't exist, create it
             create_and_mount_partition(
                 Device, Partition, PartitionType, Key, 
@@ -290,13 +363,23 @@ check_partition(
 mount_existing_partition(
     Partition, Key, MountPoint, VolumeName, StorePath, Opts
 ) ->
-    ?event(debug_mount, {mount_volume, attempt, Partition}),
+    ?event(debug_volume, 
+        {mount_existing_partition, entry, 
+            {attempting_mount, Partition, MountPoint}
+        }
+    ),
     case hb_volume:mount_disk(Partition, Key, MountPoint, VolumeName) of
         {ok, MountResult} ->
-            ?event(debug_mount, {mount_volume, success, MountResult}),
+            ?event(debug_volume, 
+                {mount_existing_partition, mount_success, MountResult}
+            ),
             update_store_path(StorePath, Opts);
         {error, MountError} ->
-            ?event(debug_mount, {mount_volume, error, MountError}),
+            ?event(debug_volume, 
+                {mount_existing_partition, mount_error, 
+                    {error, MountError}
+                }
+            ),
             {error, <<"Failed to mount volume">>}
     end.
 
@@ -318,15 +401,27 @@ create_and_mount_partition(
     Device, Partition, PartitionType, Key, 
     MountPoint, VolumeName, StorePath, Opts
 ) ->
-    ?event(debug_mount, {create_partition, attempt, Device}),
+    ?event(debug_volume, 
+        {create_and_mount_partition, entry, 
+            {creating_partition, Device, PartitionType}
+        }
+    ),
     case hb_volume:create_partition(Device, PartitionType) of
         {ok, PartitionResult} ->
-            ?event(debug_mount, {partition_create, success, PartitionResult}),
+            ?event(debug_volume, 
+                {create_and_mount_partition, partition_created, 
+                    PartitionResult
+                }
+            ),
             format_and_mount(
                 Partition, Key, MountPoint, VolumeName, StorePath, Opts
             );
         {error, PartitionError} ->
-            ?event(debug_mount, {partition_create, error, PartitionError}),
+            ?event(debug_volume, 
+                {create_and_mount_partition, partition_error, 
+                    {error, PartitionError}
+                }
+            ),
             {error, <<"Failed to create partition">>}
     end.
 
@@ -345,14 +440,25 @@ create_and_mount_partition(
 format_and_mount(
     Partition, Key, MountPoint, VolumeName, StorePath, Opts
 ) ->
+    ?event(debug_volume, 
+        {format_and_mount, entry, {formatting_partition, Partition}}
+    ),
     case hb_volume:format_disk(Partition, Key) of
         {ok, FormatResult} ->
-            ?event(debug_mount, {format_disk, success, FormatResult}),
+            ?event(debug_volume, 
+                {format_and_mount, format_success, 
+                    {result, FormatResult}
+                }
+            ),
             mount_formatted_partition(
                 Partition, Key, MountPoint, VolumeName, StorePath, Opts
             );
         {error, FormatError} ->
-            ?event(debug_mount, {format_disk, error, FormatError}),
+            ?event(debug_volume, 
+                {format_and_mount, format_error, 
+                    {error, FormatError}
+                }
+            ),
             {error, <<"Failed to format disk">>}
     end.
 
@@ -371,12 +477,25 @@ format_and_mount(
 mount_formatted_partition(
     Partition, Key, MountPoint, VolumeName, StorePath, Opts
 ) ->
+    ?event(debug_volume, 
+        {mount_formatted_partition, entry, 
+            {mounting_formatted, Partition, MountPoint}
+        }
+    ),
     case hb_volume:mount_disk(Partition, Key, MountPoint, VolumeName) of
         {ok, RetryMountResult} ->
-            ?event(debug_mount, {mount_volume, success, RetryMountResult}),
+            ?event(debug_volume, 
+                {mount_formatted_partition, mount_success, 
+                    {result, RetryMountResult}
+                }
+            ),
             update_store_path(StorePath, Opts);
         {error, RetryMountError} ->
-            ?event(debug_mount, {mount_volume, error, RetryMountError}),
+            ?event(debug_volume, 
+                {mount_formatted_partition, mount_error, 
+                    {error, RetryMountError}
+                }
+            ),
             {error, <<"Failed to mount newly formatted volume">>}
     end.
 
@@ -385,15 +504,30 @@ mount_formatted_partition(
 %% @param Opts The options to update.
 %% @returns `{ok, Binary}' on success with operation result message, or
 %% `{error, Binary}' on failure with error message.
--spec update_store_path(term(), map()) -> {ok, binary()} | {error, binary()}.
+-spec update_store_path(term(), map()) -> 
+    {ok, binary()} | {error, binary()}.
 update_store_path(StorePath, Opts) ->
+    ?event(debug_volume, 
+        {update_store_path, entry, {updating_store, StorePath}}
+    ),
     CurrentStore = hb_opts:get(store, [], Opts),
+    ?event(debug_volume, 
+        {update_store_path, current_store, CurrentStore}
+    ),
     case hb_volume:change_node_store(StorePath, CurrentStore) of
         {ok, #{<<"store">> := NewStore} = StoreResult} ->
-            ?event(debug_mount, {store_update, success, StoreResult}),
-            update_node_config(NewStore, Opts);
+            ?event(debug_volume, 
+                {update_store_path, store_change_success, 
+                    {result, StoreResult}
+                }
+            ),
+            update_node_config(StorePath, NewStore, Opts);
         {error, StoreError} ->
-            ?event(debug_mount, {store_update, error, StoreError}),
+            ?event(debug_volume, 
+                {update_store_path, store_change_error, 
+                    {error, StoreError}
+                }
+            ),
             {error, <<"Failed to update store">>}
     end.
 
@@ -402,8 +536,37 @@ update_store_path(StorePath, Opts) ->
 %% @param Opts The options to update the node's configuration with.
 %% @returns `{ok, Binary}' on success with operation result message, or
 %% `{error, Binary}' on failure with error message.
--spec update_node_config(term(), map()) -> {ok, binary()} | {error, binary()}.
-update_node_config(NewStore, Opts) ->
-    ok = hb_http_server:set_opts(Opts#{store => NewStore}),
-    ?event(debug_mount, {store_update, config_updated}),
-    {ok, <<"Volume mounted and store updated successfully">>}.
+-spec update_node_config(term(), term(), map()) -> 
+    {ok, binary()} | {error, binary()}.
+update_node_config(StorePath, NewStore, Opts) ->
+    ?event(debug_volume, 
+        {update_node_config, entry, 
+            {updating_config, StorePath, NewStore}
+        }
+    ),
+    GenesisWasmDBDir = 
+        hb_opts:get(
+            genesis_wasm_db_dir,
+            "cache-mainnet/genesis-wasm", 
+            Opts
+        ),
+    ?event(debug_volume, 
+        {update_node_config, genesis_dir, GenesisWasmDBDir}
+    ),
+    BinaryGenesisWasmDBDir = list_to_binary(GenesisWasmDBDir),
+    FullGenesisPath = 
+        <<StorePath/binary, "/", BinaryGenesisWasmDBDir/binary>>,
+    ?event(debug_volume, 
+        {update_node_config, full_path_created, FullGenesisPath}
+    ),
+    ok = 
+        hb_http_server:set_opts(
+            Opts#{
+                store => NewStore, 
+                genesis_wasm_db_dir => FullGenesisPath
+            }
+        ),
+    ?event(debug_volume, 
+        {update_node_config, config_updated, success}
+    ),
+    {ok, <<"Volume mounted and store updated successfully">>}.
\ No newline at end of file
diff --git a/src/dev_wasi.erl b/src/dev_wasi.erl
index bb766d440..cfb522c72 100644
--- a/src/dev_wasi.erl
+++ b/src/dev_wasi.erl
@@ -48,7 +48,7 @@ init(M1, _M2, Opts) ->
             M1,
             #{
                 <<"wasm/stdlib/wasi_snapshot_preview1">> =>
-                    #{ <<"device">> => <<"WASI@1.0">>}
+                    #{ <<"device">> => <<"wasi@1.0">>}
             },
             Opts
         ),
@@ -233,7 +233,7 @@ generate_wasi_stack(File, Func, Params) ->
     Msg0 = dev_wasm:cache_wasm_image(File),
     Msg1 = Msg0#{
         <<"device">> => <<"stack@1.0">>,
-        <<"device-stack">> => [<<"WASI@1.0">>, <<"WASM-64@1.0">>],
+        <<"device-stack">> => [<<"wasi@1.0">>, <<"wasm-64@1.0">>],
         <<"output-prefixes">> => [<<"wasm">>, <<"wasm">>],
         <<"stack-keys">> => [<<"init">>, <<"compute">>],
         <<"function">> => Func,
diff --git a/src/dev_wasm.erl b/src/dev_wasm.erl
index f942c2c6b..e4f33143d 100644
--- a/src/dev_wasm.erl
+++ b/src/dev_wasm.erl
@@ -226,7 +226,8 @@ compute(RawM1, M2, Opts) ->
                             #{
                                 <<"results/", Prefix/binary, "/type">> => ResType,
                                 <<"results/", Prefix/binary, "/output">> => Res
-                            }
+                            },
+                            Opts
                         )
                     }
             end;
@@ -289,7 +290,7 @@ terminate(M1, M2, Opts) ->
     hb_beamr:stop(Instance),
     {ok, hb_private:set(M1,
         #{
-            <<Prefix/binary, "/Instance">> => unset
+            <<Prefix/binary, "/instance">> => unset
         },
         Opts
     )}.
@@ -322,13 +323,7 @@ import(Msg1, Msg2, Opts) ->
             "/",
             FuncName/binary
         >>,
-    StatePath =
-        <<
-            Prefix/binary,
-            "/stdlib/",
-            ModName/binary,
-            "/state"
-        >>,
+    StatePath = << Prefix/binary, "/stdlib/", ModName/binary, "/state" >>,
     AdjustedMsg2 = Msg2#{ <<"path">> => AdjustedPath },
     % 2. Add the current state to the message at the stdlib path.
     AdjustedMsg1 =
@@ -368,7 +363,8 @@ undefined_import_stub(Msg1, Msg2, Opts) ->
                         X -> X
                     end
                 ]
-        }
+        },
+        Opts
     ),
     {ok, #{ state => Msg3, results => [0] }}.
 
@@ -384,7 +380,7 @@ input_prefix_test() ->
     #{ <<"image">> := ImageID } = cache_wasm_image("test/test.wasm"),
     Msg1 =
         #{
-            <<"device">> => <<"WASM-64@1.0">>,
+            <<"device">> => <<"wasm-64@1.0">>,
             <<"input-prefix">> => <<"test-in">>,
             <<"test-in">> => #{ <<"image">> => ImageID }
         },
@@ -407,7 +403,7 @@ process_prefixes_test() ->
     init(),
     Msg1 =
         #{
-            <<"device">> => <<"WASM-64@1.0">>,
+            <<"device">> => <<"wasm-64@1.0">>,
             <<"output-prefix">> => <<"wasm">>,
             <<"input-prefix">> => <<"process">>,
             <<"process">> => cache_wasm_image("test/test.wasm")
@@ -461,7 +457,7 @@ imported_function_test() ->
             [2, 5],
             #{
                 <<"stdlib/my_lib">> =>
-                    #{ <<"device">> => <<"Test-Device@1.0">> }
+                    #{ <<"device">> => <<"test-device@1.0">> }
             }
         )
     ).
@@ -472,27 +468,27 @@ benchmark_test() ->
     Msg0 = cache_wasm_image("test/test-64.wasm"),
     {ok, Msg1} = hb_ao:resolve(Msg0, <<"init">>, #{}),
     Msg2 =
-        maps:merge(
+        hb_maps:merge(
             Msg1,
-            hb_ao:set(
-                #{
-                    <<"function">> => <<"fac">>,
-                    <<"parameters">> => [5.0]
-                },
-                #{ hashpath => ignore }
-            )
+            #{
+                <<"function">> => <<"fac">>,
+                <<"parameters">> => [5.0]
+            },
+			#{}
         ),
     Iterations =
-        hb:benchmark(
+        hb_test_utils:benchmark(
             fun() ->
                 hb_ao:resolve(Msg2, <<"compute">>, #{})
             end,
             BenchTime
         ),
     ?event(benchmark, {scheduled, Iterations}),
-    hb_util:eunit_print(
-        "Evaluated ~p WASM messages through AO-Core in ~p seconds (~.2f msg/s)",
-        [Iterations, BenchTime, Iterations / BenchTime]
+    hb_test_utils:benchmark_print(
+        <<"Through AO-Core:">>,
+        <<"resolutions">>,
+        Iterations,
+        BenchTime
     ),
     ?assert(Iterations > 5),
     ok.
@@ -504,7 +500,7 @@ state_export_and_restore_test() ->
     Msg0 = cache_wasm_image("test/pow_calculator.wasm"),
     {ok, Msg1} = hb_ao:resolve(Msg0, <<"init">>, #{}),
     Msg2 =
-        maps:merge(
+        hb_maps:merge(
             Msg1,
             Extras = #{
                 <<"function">> => <<"pow">>,
@@ -512,9 +508,10 @@ state_export_and_restore_test() ->
                 <<"stdlib">> =>
                     #{
                         <<"my_lib">> =>
-                            #{ <<"device">> => <<"Test-Device@1.0">> }
+                            #{ <<"device">> => <<"test-device@1.0">> }
                     }
-            }
+            },
+			#{}
         ),
     ?event({after_setup, Msg2}),
     % Compute a computation and export the state.
@@ -523,7 +520,7 @@ state_export_and_restore_test() ->
     {ok, State} = hb_ao:resolve(Msg3a, <<"snapshot">>, #{}),
     ?event({state_res, State}),
     % Restore the state without calling Init.
-    NewMsg1 = maps:merge(Msg0, Extras#{ <<"snapshot">> => State }),
+    NewMsg1 = hb_maps:merge(Msg0, Extras#{ <<"snapshot">> => State }, #{}),
     ?assertEqual(
         {ok, [4]},
         hb_ao:resolve(NewMsg1, <<"compute/results/output">>, #{})
@@ -538,7 +535,7 @@ cache_wasm_image(Image, Opts) ->
     Msg = #{ <<"body">> => Bin },
     {ok, ID} = hb_cache:write(Msg, Opts),
     #{
-        <<"device">> => <<"WASM-64@1.0">>,
+        <<"device">> => <<"wasm-64@1.0">>,
         <<"image">> => ID
     }.
 
@@ -548,7 +545,7 @@ test_run_wasm(File, Func, Params, AdditionalMsg) ->
     {ok, Msg1} = hb_ao:resolve(Msg0, <<"init">>, #{}),
     ?event({after_init, Msg1}),
     Msg2 =
-        maps:merge(
+        hb_maps:merge(
             Msg1,
             hb_ao:set(
                 #{
@@ -557,7 +554,8 @@ test_run_wasm(File, Func, Params, AdditionalMsg) ->
                 },
                 AdditionalMsg,
                 #{ hashpath => ignore }
-            )
+            ),
+			#{}
         ),
     ?event({after_setup, Msg2}),
     {ok, StateRes} = hb_ao:resolve(Msg2, <<"compute">>, #{}),
diff --git a/src/dev_whois.erl b/src/dev_whois.erl
new file mode 100644
index 000000000..61011c489
--- /dev/null
+++ b/src/dev_whois.erl
@@ -0,0 +1,68 @@
+%%% @doc A device for returning the IP/host information of a requester or
+%%% itself.
+-module(dev_whois).
+%%% Device API
+-export([node/3, echo/3]).
+%%% Public utilities
+-export([ensure_host/1]).
+-include("include/hb.hrl").
+-include_lib("eunit/include/eunit.hrl").
+
+%% @doc Return the calculated host information for the requester.
+echo(_, Req, Opts) ->
+    {ok, hb_maps:get(<<"ao-peer">>, Req, <<"unknown">>, Opts)}.
+
+%% @doc Return the host information for the node. Sets the `host' key in the
+%% node message if it is not already set.
+node(_, _, Opts) ->
+    case ensure_host(Opts) of
+        {ok, NewOpts} ->
+            {ok, hb_opts:get(host, <<"unknown">>, NewOpts)};
+        Error ->
+            Error
+    end.
+
+%% @doc Return the node message ensuring that the host is set. If it is not, we
+%% attempt to find the host information from the specified bootstrap node.
+ensure_host(Opts) ->
+    case hb_opts:get(host, <<"unknown">>, Opts) of
+        <<"unknown">> ->
+            case bootstrap_node_echo(Opts) of
+                {ok, Host} ->
+                    % Set the host information in the persisted node message.
+                    hb_http_server:set_opts(NewOpts = Opts#{ host => Host }),
+                    {ok, NewOpts};
+                Error ->
+                    Error
+            end;
+        _ ->
+            {ok, Opts}
+    end.
+
+%% @doc Find the local host information from the specified bootstrap node.
+bootstrap_node_echo(Opts) ->
+    case hb_opts:get(host_bootstrap_node, false, Opts) of
+        false ->
+            {error, <<"No bootstrap node configured.">>};
+        BootstrapNode ->
+            hb_http:get(BootstrapNode, <<"/~whois@1.0/echo">>, Opts)
+    end.
+
+%%% Tests
+
+find_self_test() ->
+    BoostrapNode =
+        hb_http_server:start_node(#{
+            priv_wallet => ar_wallet:new()
+        }),
+    PeerNode =
+        hb_http_server:start_node(#{
+            port => Port = rand:uniform(40000) + 10000,
+            priv_wallet => ar_wallet:new(),
+            host_bootstrap_node => BoostrapNode,
+            http_client => httpc
+        }),
+    ?event({nodes, {peer, PeerNode}, {bootstrap, BoostrapNode}}),
+    {ok, ReceivedPeerHost} = hb_http:get(PeerNode, <<"/~whois@1.0/node">>, #{}),
+    ?event({find_self_test, ReceivedPeerHost}),
+    ?assertEqual(<<"127.0.0.1:", (hb_util:bin(Port))/binary>>, ReceivedPeerHost).
\ No newline at end of file
diff --git a/src/hb.erl b/src/hb.erl
index 9525cc4d5..ee8fc7964 100644
--- a/src/hb.erl
+++ b/src/hb.erl
@@ -82,14 +82,14 @@
 %%% modules of the hyperbeam node.
 -module(hb).
 %%% Configuration and environment:
--export([init/0, now/0, build/0]).
+-export([init/0, now/0, build/0, deploy_scripts/0]).
 %%% Base start configurations:
 -export([start_simple_pay/0, start_simple_pay/1, start_simple_pay/2]).
 -export([topup/3, topup/4]).
 -export([start_mainnet/0, start_mainnet/1]).
 %%% Debugging tools:
 -export([no_prod/3]).
--export([read/1, read/2, debug_wait/4, profile/1, benchmark/2, benchmark/3]).
+-export([read/1, read/2, debug_wait/4]).
 %%% Node wallet and address management:
 -export([address/0, wallet/0, wallet/1]).
 -include("include/hb.hrl").
@@ -123,7 +123,7 @@ start_mainnet(Opts) ->
     hb_http_server:start_node(
         FinalOpts =
             BaseOpts#{
-                store => #{ <<"store-module">> => hb_store_fs, <<"prefix">> => <<"cache-mainnet">> },
+                store => #{ <<"store-module">> => hb_store_fs, <<"name">> => <<"cache-mainnet">> },
                 priv_wallet => Wallet
             }
     ),
@@ -135,9 +135,9 @@ start_mainnet(Opts) ->
     io:format(
         "Started mainnet node at http://localhost:~p~n"
         "Operator: ~s~n",
-        [maps:get(port, Opts), Address]
+        [hb_maps:get(port, Opts, undefined, Opts), Address]
     ),
-    <<"http://localhost:", (integer_to_binary(maps:get(port, Opts)))/binary>>.
+    <<"http://localhost:", (integer_to_binary(hb_maps:get(port, Opts, undefined, Opts)))/binary>>.
 
 %%% @doc Start a server with a `simple-pay@1.0' pre-processor.
 start_simple_pay() ->
@@ -159,7 +159,7 @@ do_start_simple_pay(Opts) ->
         gun,
         os_mon
     ]),
-    Port = maps:get(port, Opts),
+    Port = hb_maps:get(port, Opts, undefined, Opts),
     Processor =
         #{
             <<"device">> => <<"p4@1.0">>,
@@ -181,6 +181,36 @@ do_start_simple_pay(Opts) ->
     ),
     <<"http://localhost:", (integer_to_binary(Port))/binary>>.
 
+%% @doc Upload all scripts from the `scripts' directory to the node to Arweave,
+%% printing their IDs.
+deploy_scripts() ->
+    deploy_scripts("scripts/").
+deploy_scripts(Dir) ->
+    Files = filelib:wildcard(Dir ++ "*.lua"),
+    lists:foreach(fun(File) ->
+        {ok, Script} = file:read_file(File),
+        Msg =
+            hb_message:commit(
+                #{
+                    <<"data-protocol">> => <<"ao">>,
+                    <<"variant">> => <<"ao.N.1">>,
+                    <<"type">> => <<"module">>,
+                    <<"content-type">> => <<"application/lua">>,
+                    <<"name">> => hb_util:bin(File),
+                    <<"body">> => Script
+                },
+                wallet(),
+                <<"ans104@1.0">>
+            ),
+        {Status, _} = hb_client:upload(Msg, #{}, <<"ans104@1.0">>),
+        io:format(
+            "~s: ~s (upload status: ~p)~n",
+            [File, hb_util:id(Msg), Status]
+        )
+    end, Files),
+    ok.
+
+
 %% @doc Helper for topping up a user's balance on a simple-pay node.
 topup(Node, Amount, Recipient) ->
     topup(Node, Amount, Recipient, wallet()).
@@ -198,9 +228,11 @@ topup(Node, Amount, Recipient, Wallet) ->
 wallet() ->
     wallet(hb_opts:get(priv_key_location)).
 wallet(Location) ->
+    wallet(Location, #{}).
+wallet(Location, Opts) ->
     case file:read_file_info(Location) of
         {ok, _} ->
-            ar_wallet:load_keyfile(Location);
+            ar_wallet:load_keyfile(Location, Opts);
         {error, _} -> 
             Res = ar_wallet:new_keyfile(?DEFAULT_KEY_TYPE, Location),
             ?event({created_new_keyfile, Location, address(Res)}),
@@ -248,53 +280,8 @@ now() ->
 build() ->
     r3:do(compile, [{dir, "src"}]).
 
-%% @doc Utility function to start a profiling session and run a function,
-%% then analyze the results. Obviously -- do not use in production.
-profile(Fun) ->
-    eprof:start_profiling([self()]),
-    try
-        Fun()
-    after
-        eprof:stop_profiling()
-    end,
-    eprof:analyze(total).
-
 %% @doc Utility function to wait for a given amount of time, printing a debug
 %% message to the console first.
 debug_wait(T, Mod, Func, Line) ->
     ?event(wait, {debug_wait, {T, Mod, Func, Line}}),
-    receive after T -> ok end.
-
-%% @doc Run a function as many times as possible in a given amount of time.
-benchmark(Fun, TLen) ->
-    T0 = erlang:system_time(millisecond),
-    hb_util:until(
-        fun() -> erlang:system_time(millisecond) - T0 > (TLen * 1000) end,
-        Fun,
-        0
-    ).
-
-%% @doc Run multiple instances of a function in parallel for a given amount of time.
-benchmark(Fun, TLen, Procs) ->
-    Parent = self(),
-    receive X -> ?event(benchmark, {start_benchmark_worker, X}) end,
-    StartWorker =
-        fun(_) ->
-            Ref = make_ref(),
-            ?event(benchmark, {start_benchmark_worker, Ref}),
-            spawn_link(fun() ->
-                Count = benchmark(Fun, TLen),
-                Parent ! {work_complete, Ref, Count}
-            end),
-            Ref
-        end,
-    CollectRes =
-        fun(R) ->
-            receive
-                {work_complete, R, Count} ->
-                    ?event(benchmark, {work_complete, R, Count}),
-                    Count
-            end
-        end,
-    Refs = lists:map(StartWorker, lists:seq(1, Procs)),
-    lists:sum(lists:map(CollectRes, Refs)).
\ No newline at end of file
+    receive after T -> ok end.
\ No newline at end of file
diff --git a/src/hb_ao.erl b/src/hb_ao.erl
index dfff9ce30..f80ae12b8 100644
--- a/src/hb_ao.erl
+++ b/src/hb_ao.erl
@@ -3,29 +3,32 @@
 %%% 
 %%% At the implementation level, every message is simply a collection of keys,
 %%% dictated by its `Device', that can be resolved in order to yield their
-%%% values. Each key may return another message or a raw value:
+%%% values. Each key may contain a link to another message or a raw value:
 %%% 
-%%% 	`ao(Message1, Message2) -> {Status, Message3}'
+%%% 	`ao(BaseMessage, RequestMessage) -> {Status, Result}'
 %%% 
-%%% Under-the-hood, `AO-Core(Message1, Message2)' leads to the evaluation of
-%%% `DeviceMod:PathPart(Message1, Message2)', which defines the user compute
-%%% to be performed. If `Message1' does not specify a device, `dev_message' is
-%%% assumed. The key to resolve is specified by the `Path' field of the message.
+%%% Under-the-hood, `AO-Core(BaseMessage, RequestMessage)' leads to a lookup of
+%%% the `device' key of the base message, followed by the evaluation of
+%%% `DeviceMod:PathPart(BaseMessage, RequestMessage)', which defines the user 
+%%% compute to be performed. If `BaseMessage' does not specify a device, 
+%%% `~message@1.0' is assumed. The key to resolve is specified by the `path' 
+%%% field of the message.
 %%% 
-%%% After each output, the `HashPath' is updated to include the `Message2'
+%%% After each output, the `HashPath' is updated to include the `RequestMessage'
 %%% that was executed upon it.
 %%% 
 %%% Because each message implies a device that can resolve its keys, as well
 %%% as generating a merkle tree of the computation that led to the result,
-%%% you can see AO-Core protocol as a system for cryptographically chaining 
+%%% you can see the AO-Core protocol as a system for cryptographically chaining 
 %%% the execution of `combinators'. See `docs/ao-core-protocol.md' for more 
 %%% information about AO-Core.
 %%% 
-%%% The `Fun(Message1, Message2)' pattern is repeated throughout the HyperBEAM 
-%%% codebase, sometimes with `MessageX' replaced with `MX' or `MsgX' for brevity.
+%%% The `key(BaseMessage, RequestMessage)' pattern is repeated throughout the 
+%%% HyperBEAM codebase, sometimes with `BaseMessage' replaced with `Msg1', `M1'
+%%% or similar, and `RequestMessage' replaced with `Msg2', `M2', etc.
 %%% 
-%%% Message3 can be either a new message or a raw output value (a binary, integer,
-%%% float, atom, or list of such values).
+%%% The result of any computation can be either a new message or a raw literal 
+%%% value (a binary, integer, float, atom, or list of such values).
 %%% 
 %%% Devices can be expressed as either modules or maps. They can also be 
 %%% referenced by an Arweave ID, which can be used to load a device from 
@@ -92,15 +95,14 @@
 -module(hb_ao).
 %%% Main AO-Core API:
 -export([resolve/2, resolve/3, resolve_many/2]).
--export([normalize_key/1, normalize_key/2, normalize_keys/1]).
--export([message_to_fun/3, message_to_device/2, load_device/2, find_exported_function/5]).
+-export([normalize_key/1, normalize_key/2, normalize_keys/1, normalize_keys/2]).
 -export([force_message/2]).
 %%% Shortcuts and tools:
--export([info/2, keys/1, keys/2, keys/3, truncate_args/2]).
+-export([keys/1, keys/2, keys/3]).
 -export([get/2, get/3, get/4, get_first/2, get_first/3]).
--export([set/2, set/3, set/4, remove/2, remove/3]).
+-export([set/3, set/4, remove/2, remove/3]).
 %%% Exports for tests in hb_ao_test_vectors.erl:
--export([deep_set/4, is_exported/4]).
+-export([deep_set/4]).
 -include("include/hb.hrl").
 
 -define(TEMP_OPTS, [add_key, force_message, cache_control, spawn_worker]).
@@ -123,16 +125,30 @@
 %%     11: Notify waiters.
 %%     12: Fork worker.
 %%     13: Recurse or terminate.
+resolve(Path, Opts) when is_binary(Path) ->
+    resolve(#{ <<"path">> => Path }, Opts);
+resolve(SingletonMsg, _Opts)
+        when is_map(SingletonMsg), not is_map_key(<<"path">>, SingletonMsg) ->
+    {error, <<"Attempted to resolve a message without a path.">>};
 resolve(SingletonMsg, Opts) ->
-    resolve_many(hb_singleton:from(SingletonMsg), Opts).
+    resolve_many(hb_singleton:from(SingletonMsg, Opts), Opts).
 
 resolve(Msg1, Path, Opts) when not is_map(Path) ->
     resolve(Msg1, #{ <<"path">> => Path }, Opts);
 resolve(Msg1, Msg2, Opts) ->
-    PathParts = hb_path:from_message(request, Msg2),
-    ?event(ao_core, {stage, 1, prepare_multimessage_resolution, {path_parts, PathParts}}),
+    PathParts = hb_path:from_message(request, Msg2, Opts),
+    ?event(
+        ao_core,
+        {stage, 1, prepare_multimessage_resolution, {path_parts, PathParts}}
+    ),
     MessagesToExec = [ Msg2#{ <<"path">> => Path } || Path <- PathParts ],
-    ?event(ao_core, {stage, 1, prepare_multimessage_resolution, {messages_to_exec, MessagesToExec}}),
+    ?event(ao_core,
+        {stage,
+            1,
+            prepare_multimessage_resolution,
+            {messages_to_exec, MessagesToExec}
+        }
+    ),
     resolve_many([Msg1 | MessagesToExec], Opts).
 
 %% @doc Resolve a list of messages in sequence. Take the output of the first
@@ -149,7 +165,7 @@ resolve_many([ID], Opts) when ?IS_ID(ID) ->
     %    pairs and outputs. With only a single ID, there is not a valid pairing
     %    to use in looking up a cached result.
     ?event(ao_core, {stage, na, resolve_directly_to_id, ID, {opts, Opts}}, Opts),
-    try {ok, ensure_loaded(ID, Opts)}
+    try {ok, ensure_message_loaded(ID, Opts)}
     catch _:_:_ -> {error, not_found}
     end;
 resolve_many(ListMsg, Opts) when is_map(ListMsg) ->
@@ -178,11 +194,13 @@ resolve_many(MsgList, Opts) ->
     Res = do_resolve_many(MsgList, Opts),
     ?event(ao_core, {resolve_many_complete, {res, Res}, {req, MsgList}}, Opts),
     Res.
-do_resolve_many([Msg3], _Opts) ->
-    ?event(ao_core, {stage, 13, resolve_complete, Msg3}),
-    {ok, Msg3};
+do_resolve_many([], _Opts) ->
+    {failure, <<"Attempted to resolve an empty message sequence.">>};
+do_resolve_many([Msg3], Opts) ->
+    ?event(ao_core, {stage, 11, resolve_complete, Msg3}),
+    hb_cache:ensure_loaded(maybe_force_message(Msg3, Opts), Opts);
 do_resolve_many([Msg1, Msg2 | MsgList], Opts) ->
-    ?event(ao_core, {stage, 0, resolve_many, {msg1, Msg1}, {msg2, Msg2}, {opts, Opts}}),
+    ?event(ao_core, {stage, 0, resolve_many, {msg1, Msg1}, {msg2, Msg2}}),
     case resolve_stage(1, Msg1, Msg2, Opts) of
         {ok, Msg3} ->
             ?event(ao_core,
@@ -199,21 +217,37 @@ do_resolve_many([Msg1, Msg2 | MsgList], Opts) ->
         Res ->
             % The result is not a resolvable message. Return it.
             ?event(ao_core, {stage, 13, resolve_many_terminating_early, Res}),
-            Res
+            maybe_force_message(Res, Opts)
     end.
 
-resolve_stage(1, {as, DevID, ID}, Msg2, Opts) when ?IS_ID(ID) ->
-    % Normalize `as' requests with a raw ID as the path.
-    resolve_stage(1, {as, DevID, #{ <<"path">> => ID }}, Msg2, Opts);
+resolve_stage(1, Link, Msg2, Opts) when ?IS_LINK(Link) ->
+    % If the first message is a link, we should load the message and
+    % continue with the resolution.
+    ?event(ao_core, {stage, 1, resolve_base_link, {link, Link}}, Opts),
+    resolve_stage(1, hb_cache:ensure_loaded(Link, Opts), Msg2, Opts);
+resolve_stage(1, Msg1, Link, Opts) when ?IS_LINK(Link) ->
+    % If the second message is a link, we should load the message and
+    % continue with the resolution.
+    ?event(ao_core, {stage, 1, resolve_req_link, {link, Link}}, Opts),
+    resolve_stage(1, Msg1, hb_cache:ensure_loaded(Link, Opts), Opts);
+resolve_stage(1, {as, DevID, Ref}, Msg2, Opts) when ?IS_ID(Ref) orelse ?IS_LINK(Ref) ->
+    % Normalize `as' requests with a raw ID or link as the path. Links will be
+    % loaded in following stages.
+    resolve_stage(1, {as, DevID, #{ <<"path">> => Ref }}, Msg2, Opts);
+resolve_stage(1, {as, DevID, Link}, Msg2, Opts) when ?IS_LINK(Link) ->
+    % If the first message is an `as' with a link, we should load the message and
+    % continue with the resolution.
+    ?event(ao_core, {stage, 1, resolve_base_as_link, {link, Link}}, Opts),
+    resolve_stage(1, {as, DevID, hb_cache:ensure_loaded(Link, Opts)}, Msg2, Opts);
 resolve_stage(1, {as, DevID, Raw = #{ <<"path">> := ID }}, Msg2, Opts) when ?IS_ID(ID) ->
     % If the first message is an `as' with an ID, we should load the message and
     % apply the non-path elements of the sub-request to it.
     ?event(ao_core, {stage, 1, subresolving_with_load, {dev, DevID}, {id, ID}}, Opts),
-    RemMsg1 = maps:without([<<"path">>], Raw),
+    RemMsg1 = hb_maps:without([<<"path">>], Raw, Opts),
     ?event(subresolution, {loading_message, {id, ID}, {params, RemMsg1}}, Opts),
-    Msg1b = ensure_loaded(ID, Opts),
+    Msg1b = ensure_message_loaded(ID, Opts),
     ?event(subresolution, {loaded_message, {msg, Msg1b}}, Opts),
-    Msg1c = maps:merge(Msg1b, RemMsg1),
+    Msg1c = hb_maps:merge(Msg1b, RemMsg1, Opts),
     ?event(subresolution, {merged_message, {msg, Msg1c}}, Opts),
     Msg1d = set(Msg1c, <<"device">>, DevID, Opts),
     ?event(subresolution, {loaded_parameterized_message, {msg, Msg1d}}, Opts),
@@ -223,20 +257,18 @@ resolve_stage(1, Raw = {as, DevID, SubReq}, Msg2, Opts) ->
     % As this is the first message, we will then continue to execute the request
     % on the result.
     ?event(ao_core, {stage, 1, subresolving_base, {dev, DevID}, {subreq, SubReq}}, Opts),
-    ?event(subresolution, {as, {dev, DevID}, {subreq, SubReq}, {msg2, Msg2}}, Opts),
-    case subresolve(#{}, DevID, SubReq, Opts) of
+    ?event(subresolution, {as, {dev, DevID}, {subreq, SubReq}, {msg2, Msg2}}),
+    case subresolve(SubReq, DevID, SubReq, Opts) of
         {ok, SubRes} ->
             % The subresolution has returned a new message. Continue with it.
             ?event(subresolution,
-                {continuing_with_subresolved_message, {msg1, SubRes}},
-                Opts
+                {continuing_with_subresolved_message, {msg1, SubRes}}
             ),
             resolve_stage(1, SubRes, Msg2, Opts);
         OtherRes ->
             % The subresolution has returned an error. Return it.
             ?event(subresolution,
-                {subresolution_error, {msg1, Raw}, {res, OtherRes}},
-                Opts
+                {subresolution_error, {msg1, Raw}, {res, OtherRes}}
             ),
             OtherRes
     end;
@@ -245,11 +277,21 @@ resolve_stage(1, RawMsg1, Msg2Outer = #{ <<"path">> := {as, DevID, Msg2Inner} },
     % the `Msg2Inner' into the `Msg2Outer' message first. We return the result
     % of the sub-resolution directly.
     ?event(ao_core, {stage, 1, subresolving_from_request, {dev, DevID}}, Opts),
+    LoadedInner = ensure_message_loaded(Msg2Inner, Opts),
     Msg2 =
-        maps:merge(
-            Msg2Outer,
-            if is_map(Msg2Inner) -> Msg2Inner; true -> #{ <<"path">> => Msg2Inner } end
+        hb_maps:merge(
+            set(Msg2Outer, <<"path">>, unset, Opts),
+            if is_binary(LoadedInner) -> #{ <<"path">> => LoadedInner };
+            true -> LoadedInner
+            end,
+			Opts
         ),
+    ?event(subresolution,
+        {subresolving_request_before_execution,
+            {dev, DevID},
+            {msg2, Msg2}
+        }
+    ),
     subresolve(RawMsg1, DevID, Msg2, Opts);
 resolve_stage(1, {resolve, Subres}, Msg2, Opts) ->
     % If the first message is a `{resolve, Subres}' tuple, we should execute it
@@ -308,7 +350,7 @@ resolve_stage(1, Msg1, Msg2, Opts) when is_list(Msg1) ->
     % Normalize lists to numbered maps (base=1) if necessary.
     ?event(ao_core, {stage, 1, list_normalize}, Opts),
     resolve_stage(1,
-        normalize_keys(Msg1),
+        normalize_keys(Msg1, Opts),
         Msg2,
         Opts
     );
@@ -319,8 +361,8 @@ resolve_stage(1, RawMsg1, RawMsg2, Opts) ->
     % Normalize the path to a private key containing the list of remaining
     % keys to resolve.
     ?event(ao_core, {stage, 1, normalize}, Opts),
-    Msg1 = normalize_keys(RawMsg1),
-    Msg2 = normalize_keys(RawMsg2),
+    Msg1 = normalize_keys(RawMsg1, Opts),
+    Msg2 = normalize_keys(RawMsg2, Opts),
     resolve_stage(2, Msg1, Msg2, Opts);
 resolve_stage(2, Msg1, Msg2, Opts) ->
     ?event(ao_core, {stage, 2, cache_lookup}, Opts),
@@ -344,8 +386,8 @@ resolve_stage(3, Msg1, Msg2, Opts) when not is_map(Msg1) or not is_map(Msg2) ->
 resolve_stage(3, Msg1, Msg2, Opts) ->
     ?event(ao_core, {stage, 3, validation_check}, Opts),
     % Validation check: Check if the message is valid.
-    %Msg1Valid = (hb_message:signers(Msg1) == []) orelse hb_message:verify(Msg1),
-    %Msg2Valid = (hb_message:signers(Msg2) == []) orelse hb_message:verify(Msg2),
+    %Msg1Valid = (hb_message:signers(Msg1, Opts) == []) orelse hb_message:verify(Msg1, Opts),
+    %Msg2Valid = (hb_message:signers(Msg2, Opts) == []) orelse hb_message:verify(Msg2, Opts),
     ?no_prod("Enable message validity checks!"),
     case {true, true} of
         _ -> resolve_stage(4, Msg1, Msg2, Opts);
@@ -360,7 +402,7 @@ resolve_stage(4, Msg1, Msg2, Opts) ->
     % the `dev_process' device 'groups' all calls to the same process onto
     % calls to a single executor. By default, `{Msg1, Msg2}' is used as the
     % group name.
-    case hb_persistent:find_or_register(Msg1, Msg2, maps:without(?TEMP_OPTS, Opts)) of
+    case hb_persistent:find_or_register(Msg1, Msg2, hb_maps:without(?TEMP_OPTS, Opts, Opts)) of
         {leader, ExecName} ->
             % We are the leader for this resolution. Continue to the next stage.
             case hb_opts:get(spawn_worker, false, Opts) of
@@ -420,7 +462,7 @@ resolve_stage(5, Msg1, Msg2, ExecName, Opts) ->
     % execute Msg2 on Msg1.
 	{ResolvedFunc, NewOpts} =
 		try
-            UserOpts = maps:without(?TEMP_OPTS, Opts),
+            UserOpts = hb_maps:without(?TEMP_OPTS, Opts, Opts),
 			Key = hb_path:hd(Msg2, UserOpts),
 			% Try to load the device and get the function to call.
             ?event(
@@ -432,7 +474,7 @@ resolve_stage(5, Msg1, Msg2, ExecName, Opts) ->
                     {opts, Opts}
                 }
             ),
-			{Status, _Mod, Func} = message_to_fun(Msg1, Key, UserOpts),
+			{Status, _Mod, Func} = hb_ao_device:message_to_fun(Msg1, Key, UserOpts),
 			?event(
 				{found_func_for_exec,
                     {key, Key},
@@ -483,30 +525,17 @@ resolve_stage(5, Msg1, Msg2, ExecName, Opts) ->
 resolve_stage(6, Func, Msg1, Msg2, ExecName, Opts) ->
     ?event(ao_core, {stage, 6, ExecName, execution}, Opts),
 	% Execution.
-	% First, determine the arguments to pass to the function.
-	% While calculating the arguments we unset the add_key option.
-	UserOpts1 = maps:remove(trace, maps:without(?TEMP_OPTS, Opts)),
-    % Unless the user has explicitly requested recursive spawning, we
-    % unset the spawn_worker option so that we do not spawn a new worker
-    % for every resulting execution.
-    UserOpts2 =
-        case maps:get(spawn_worker, UserOpts1, false) of
-            recursive -> UserOpts1;
-            _ -> maps:remove(spawn_worker, UserOpts1)
-        end,
+    ExecOpts = execution_opts(Opts),
 	Args =
-		case maps:get(add_key, Opts, false) of
-			false -> [Msg1, Msg2, UserOpts2];
-			Key -> [Key, Msg1, Msg2, UserOpts2]
+		case hb_maps:get(add_key, Opts, false, Opts) of
+			false -> [Msg1, Msg2, ExecOpts];
+			Key -> [Key, Msg1, Msg2, ExecOpts]
 		end,
     % Try to execute the function.
     Res = 
         try
-            MsgRes =
-                maybe_force_message(
-                    apply(Func, truncate_args(Func, Args)),
-                    Opts
-                ),
+            TruncatedArgs = hb_ao_device:truncate_args(Func, Args),
+            MsgRes = maybe_profiled_apply(Func, TruncatedArgs, Msg1, Msg2, Opts),
             ?event(
                 ao_result,
                 {
@@ -596,16 +625,17 @@ resolve_stage(9, Msg1, Msg2, {ok, Msg3}, ExecName, Opts) when is_map(Msg3) ->
     resolve_stage(10, Msg1, Msg2,
         case hb_opts:get(hashpath, update, Opts#{ only => local }) of
             update ->
-                Priv = hb_private:from_message(Msg3),
+                NormMsg3 = Msg3,
+                Priv = hb_private:from_message(NormMsg3),
                 HP = hb_path:hashpath(Msg1, Msg2, Opts),
                 if not is_binary(HP) or not is_map(Priv) ->
-                    throw({invalid_hashpath, {hp, HP}, {msg3, Msg3}});
+                    throw({invalid_hashpath, {hp, HP}, {msg3, NormMsg3}});
                 true ->
-                    {ok, Msg3#{ <<"priv">> => Priv#{ <<"hashpath">> => HP } }}
+                    {ok, NormMsg3#{ <<"priv">> => Priv#{ <<"hashpath">> => HP } }}
                 end;
             reset ->
                 Priv = hb_private:from_message(Msg3),
-                {ok, Msg3#{ <<"priv">> => maps:without([<<"hashpath">>], Priv) }};
+                {ok, Msg3#{ <<"priv">> => hb_maps:without([<<"hashpath">>], Priv, Opts) }};
             ignore ->
                 Priv = hb_private:from_message(Msg3),
                 if not is_map(Priv) ->
@@ -668,31 +698,30 @@ subresolve(RawMsg1, DevID, ReqPath, Opts) when is_binary(ReqPath) ->
     subresolve(RawMsg1, DevID, #{ <<"path">> => ReqPath }, Opts);
 subresolve(RawMsg1, DevID, Req, Opts) ->
     % First, ensure that the message is loaded from the cache.
-    Msg1 = ensure_loaded(RawMsg1, Opts),
+    Msg1 = ensure_message_loaded(RawMsg1, Opts),
     ?event(subresolution,
-        {subresolving, {msg1, Msg1}, {dev, DevID}, {req, Req}},
-        Opts
+        {subresolving, {msg1, Msg1}, {dev, DevID}, {req, Req}}
     ),
     % Next, set the device ID if it is given.
     Msg1b =
         case DevID of
             undefined -> Msg1;
-            _ -> set(Msg1, <<"device">>, DevID, maps:without(?TEMP_OPTS, Opts))
+            _ -> set(Msg1, <<"device">>, DevID, hb_maps:without(?TEMP_OPTS, Opts, Opts))
         end,
     % If there is no path but there are elements to the request, we set these on
     % the base message. If there is a path, we do not modify the base message 
     % and instead apply the request message directly.
-    case hb_path:from_message(request, Req) of
+    case hb_path:from_message(request, Req, Opts) of
         undefined ->
             Msg1c =
-                case map_size(maps:without([<<"path">>], Req)) of
+                case map_size(hb_maps:without([<<"path">>], Req, Opts)) of
                     0 -> Msg1b;
                     _ ->
                         set(
-                            Msg1b,
-                            maps:without([<<"path">>], Req),
-                            Opts#{ force_message => false }
-                        )
+							Msg1b,
+							set(Req, <<"path">>, unset, Opts),
+							Opts#{ force_message => false }
+						)
                 end,
             ?event(subresolution,
                 {subresolve_modified_base, Msg1c},
@@ -701,27 +730,107 @@ subresolve(RawMsg1, DevID, Req, Opts) ->
             {ok, Msg1c};
         Path ->
             ?event(subresolution,
-                {exec_subrequest_on_base, {mod_base, Msg1b}, {req, Path}},
-                Opts
+                {exec_subrequest_on_base,
+                    {mod_base, Msg1b},
+                    {req, Path},
+                    {req, Req}
+                }
             ),
             Res = resolve(Msg1b, Req, Opts),
-            ?event(subresolution,
-                {subresolved_with_new_device, {res, Res}},
-                Opts
-            ),
+            ?event(subresolution, {subresolved_with_new_device, {res, Res}}),
             Res
     end.
 
-%% @doc Ensure that the message is loaded from the cache if it is an ID. If is
-%% not loadable or already present, we raise an error.
-ensure_loaded(MsgID, Opts) when ?IS_ID(MsgID) ->
+%% @doc If the `AO_PROFILING' macro is defined (set by building/launching with
+%% `rebar3 as ao_profiling') we record statistics about the execution of the
+%% function. This is a costly operation, so if it is not defined, we simply
+%% apply the function and return the result.
+-ifndef(AO_PROFILING).
+maybe_profiled_apply(Func, Args, _Msg1, _Msg2, _Opts) ->
+    apply(Func, Args).
+-else.
+maybe_profiled_apply(Func, Args, Msg1, Msg2, Opts) ->
+    CallStack = erlang:get(ao_stack),
+    ?event(ao_trace,
+        {profiling_apply,
+            {func, Func},
+            {args, Args},
+            {call_stack, CallStack}
+        }
+    ),
+    Key =
+        case hb_maps:get(<<"device">>, Msg1, undefined, Opts) of
+            undefined ->
+                hb_util:bin(erlang:fun_to_list(Func));
+            Device ->
+                case hb_maps:get(<<"path">>, Msg2, undefined, Opts) of
+                    undefined ->
+                        hb_util:bin(erlang:fun_to_list(Func));
+                    Path ->
+                        MethodStr =
+                            case hb_maps:get(<<"method">>, Msg2, undefined, Opts) of
+                                undefined -> <<"">>;
+                                <<"GET">> -> <<"">>;
+                                Method -> <<"<", Method/binary, ">">>
+                            end,
+                        << 
+                            (hb_util:bin(Device))/binary,
+                            "/",
+                            MethodStr/binary,
+                            (hb_util:bin(Path))/binary
+                        >>
+                end
+        end,
+    put(
+        ao_stack,
+        case CallStack of
+            undefined -> [Key];
+            Stack -> [Key | Stack]
+        end
+    ),
+    {ExecMicroSecs, Res} = timer:tc(fun() -> apply(Func, Args) end),
+    put(ao_stack, CallStack),
+    hb_event:increment(<<"ao-call-counts">>, Key, Opts),
+    hb_event:increment(<<"ao-total-durations">>, Key, Opts, ExecMicroSecs),
+    case CallStack of
+        undefined -> ok;
+        [Caller|_] ->
+            hb_event:increment(
+                <<"ao-callers:", Key/binary>>,
+                hb_util:bin(
+                    [
+                        <<"duration:">>,
+                        Caller
+                    ]
+                ),
+                Opts,
+                ExecMicroSecs
+            ),
+            hb_event:increment(
+                <<"ao-callers:", Key/binary>>,
+                hb_util:bin(
+                    [
+                        <<"calls:">>,
+                        Caller
+                    ]),
+                Opts
+            )
+    end,
+    Res.
+-endif.
+
+%% @doc Ensure that a message is loaded from the cache if it is an ID, or 
+%% a link, such that it is ready for execution.
+ensure_message_loaded(MsgID, Opts) when ?IS_ID(MsgID) ->
     case hb_cache:read(MsgID, Opts) of
         {ok, LoadedMsg} ->
             LoadedMsg;
         not_found ->
-            throw({necessary_message_not_found, MsgID})
+            throw({necessary_message_not_found, <<"/">>, MsgID})
     end;
-ensure_loaded(Msg, _Opts) ->
+ensure_message_loaded(MsgLink, Opts) when ?IS_LINK(MsgLink) ->
+    hb_cache:ensure_loaded(MsgLink, Opts);
+ensure_message_loaded(Msg, _Opts) ->
     Msg.
 
 %% @doc Catch all return if the message is invalid.
@@ -763,31 +872,6 @@ error_infinite(Msg1, Msg2, Opts) ->
         }
     }.
 
-error_invalid_intermediate_status(Msg1, Msg2, Msg3, RemainingPath, Opts) ->
-    ?event(
-        ao_core,
-        {error, {type, invalid_intermediate_status},
-            {msg2, Msg2},
-            {msg3, Msg3},
-            {remaining_path, RemainingPath},
-            {opts, Opts}
-        },
-        Opts
-    ),
-    ?event(ao_result, 
-        {intermediate_failure, {msg1, Msg1},
-            {msg2, Msg2}, {msg3, Msg3},
-            {remaining_path, RemainingPath}, {opts, Opts}}),
-    {
-        error,
-        #{
-            <<"status">> => 422,
-            <<"body">> => Msg3,
-            <<"key">> => maps:get(<<"path">>, Msg2, <<"Key unknown.">>),
-            <<"remaining-path">> => RemainingPath
-        }
-    }.
-
 %% @doc Handle an error in a device call.
 error_execution(ExecGroup, Msg2, Whence, {Class, Exception, Stacktrace}, Opts) ->
     Error = {error, Whence, {Class, Exception, Stacktrace}},
@@ -806,25 +890,27 @@ maybe_force_message({Status, Res}, Opts) ->
     case hb_opts:get(force_message, false, Opts) of
         true -> force_message({Status, Res}, Opts);
         false -> {Status, Res}
-    end.
+    end;
+maybe_force_message(Res, Opts) ->
+    maybe_force_message({ok, Res}, Opts).
 
 force_message({Status, Res}, Opts) when is_list(Res) ->
-    force_message({Status, normalize_keys(Res)}, Opts);
+    force_message({Status, normalize_keys(Res, Opts)}, Opts);
 force_message({Status, Subres = {resolve, _}}, _Opts) ->
     {Status, Subres};
 force_message({Status, Literal}, _Opts) when not is_map(Literal) ->
-    ?event({force_message_from_literal, Literal}),
+    ?event(encode_result, {force_message_from_literal, Literal}),
     {Status, #{ <<"ao-result">> => <<"body">>, <<"body">> => Literal }};
 force_message({Status, M = #{ <<"status">> := Status, <<"body">> := Body }}, _Opts)
         when map_size(M) == 2 ->
-    ?event({force_message_from_literal_with_status, M}),
+    ?event(encode_result, {force_message_from_literal_with_status, M}),
     {Status, #{
         <<"status">> => Status,
         <<"ao-result">> => <<"body">>,
         <<"body">> => Body
     }};
 force_message({Status, Map}, _Opts) ->
-    ?event({force_message_from_map, Map}),
+    ?event(encode_result, {force_message_from_map, Map}),
     {Status, Map}.
 
 %% @doc Shortcut for resolving a key in a message without its status if it is
@@ -877,16 +963,17 @@ keys(Msg, Opts, keep) ->
     %    `keys' function on its device.
     % 2. Ensure that the result is normalized to a message (not just a list)
     %    with `normalize_keys'.
-    % 3. Now we have a map of the original keys, so we can use `maps:values' to
+    % 3. Now we have a map of the original keys, so we can use `hb_maps:values' to
     %    get a list of them.
     % 4. Normalize each of those keys in turn.
     try
         lists:map(
             fun normalize_key/1,
-            maps:values(
+            hb_maps:values(
                 normalize_keys(
-                    get(<<"keys">>, Msg, Opts)
-                )
+                    hb_private:reset(get(<<"keys">>, Msg, Opts))
+                ),
+                Opts
             )
         )
     catch
@@ -910,11 +997,14 @@ keys(Msg, Opts, remove) ->
 %% Like the `get/3' function, this function honors the `error_strategy' option.
 %% `set' works with maps and recursive paths while maintaining the appropriate
 %% `HashPath' for each step.
-set(Msg1, Msg2) ->
-    set(Msg1, Msg2, #{}).
 set(RawMsg1, RawMsg2, Opts) when is_map(RawMsg2) ->
-    Msg1 = normalize_keys(RawMsg1),
-    Msg2 = maps:without([<<"hashpath">>, <<"priv">>], normalize_keys(RawMsg2)),
+    Msg1 = normalize_keys(RawMsg1, Opts),
+    Msg2 =
+        hb_maps:without(
+            [<<"hashpath">>, <<"priv">>],
+            normalize_keys(RawMsg2, Opts),
+            Opts
+        ),
     ?event(ao_internal, {set_called, {msg1, Msg1}, {msg2, Msg2}}, Opts),
     % Get the next key to set. 
     case keys(Msg2, internal_opts(Opts)) of
@@ -924,7 +1014,7 @@ set(RawMsg1, RawMsg2, Opts) when is_map(RawMsg2) ->
             % getting via `maps' if it is not found.
             Val =
                 case get(Key, Msg2, internal_opts(Opts)) of
-                    not_found -> maps:get(Key, Msg2);
+                    not_found -> hb_maps:get(Key, Msg2, undefined, Opts);
                     Body -> Body
                 end,
             ?event({got_val_to_set, {key, Key}, {val, Val}, {msg2, Msg2}}),
@@ -939,7 +1029,7 @@ set(Msg1, Key, Value, Opts) ->
     % For an individual key, we run deep_set with the key as the path.
     % This handles both the case that the key is a path as well as the case
     % that it is a single key.
-    Path = hb_path:term_to_path_parts(Key),
+    Path = hb_path:term_to_path_parts(Key, Opts),
     % ?event(
     %     {setting_individual_key,
     %         {msg1, Msg1},
@@ -960,28 +1050,35 @@ deep_set(Msg, [], Value, Opts) when is_map(Msg) or is_list(Msg) ->
 deep_set(_Msg, [], Value, _Opts) ->
     Value;
 deep_set(Msg, [Key], Value, Opts) ->
-    DevRes = device_set(Msg, Key, Value, Opts),
-    ?event(debug, {deep_device_set_result, {msg, Msg}, {key, Key}, {res, DevRes}}),
-    DevRes;
+    device_set(Msg, Key, Value, Opts);
 deep_set(Msg, [Key|Rest], Value, Opts) ->
     case resolve(Msg, Key, Opts) of 
         {ok, SubMsg} ->
-            ?event(debug,
+            ?event(debug_set,
                 {traversing_deeper_to_set,
                     {current_key, Key},
                     {current_value, SubMsg},
                     {rest, Rest}
-                }
+                },
+                Opts
             ),
-            Res = device_set(Msg, Key, deep_set(SubMsg, Rest, Value, Opts), <<"explicit">>, Opts),
-            ?event(debug, {deep_set_result, {msg, Msg}, {key, Key}, {res, Res}}),
+            Res =
+                device_set(
+                    Msg,
+                    Key,
+                    deep_set(SubMsg, Rest, Value, Opts),
+                    <<"explicit">>,
+                    Opts
+                ),
+            ?event(debug_set, {deep_set, {msg, Msg}, {key, Key}, {res, Res}}, Opts),
             Res;
         _ ->
-            ?event(debug,
+            ?event(debug_set,
                 {creating_new_map,
                     {current_key, Key},
                     {rest, Rest}
-                }
+                },
+                Opts
             ),
             Msg#{ Key => deep_set(#{}, Rest, Value, Opts) }
     end.
@@ -1008,15 +1105,18 @@ device_set(Msg, Key, Value, Mode, Opts) ->
             <<"deep">> -> ReqWithoutMode;
             <<"explicit">> -> ReqWithoutMode#{ <<"set-mode">> => Mode }
         end,
-	?event(
-        debug,
+    ?event(
+        debug_set,
         {
             calling_device_set,
-            {msg, Msg},
-            {applying_set, Req}
-        }
+            {base, Msg},
+            {key, Key},
+            {value, Value},
+            {full_req, Req}
+        },
+        Opts
     ),
-	Res =
+    Res =
         hb_util:ok(
             resolve(
                 Msg,
@@ -1025,12 +1125,12 @@ device_set(Msg, Key, Value, Mode, Opts) ->
             ),
             internal_opts(Opts)
         ),
-	?event(
-        ao_internal,
+    ?event(
+        debug_set,
         {device_set_result, Res},
         Opts
     ),
-	Res.
+    Res.
 
 %% @doc Remove a key from a message, using its underlying device.
 remove(Msg, Key) -> remove(Msg, Key, #{}).
@@ -1044,206 +1144,9 @@ remove(Msg, Key, Opts) ->
         Opts
     ).
 
-%% @doc Truncate the arguments of a function to the number of arguments it
-%% actually takes.
-truncate_args(Fun, Args) ->
-    {arity, Arity} = erlang:fun_info(Fun, arity),
-    lists:sublist(Args, Arity).
-
-%% @doc Calculate the Erlang function that should be called to get a value for
-%% a given key from a device.
-%%
-%% This comes in 7 forms:
-%% 1. The message does not specify a device, so we use the default device.
-%% 2. The device has a `handler' key in its `Dev:info()' map, which is a
-%% function that takes a key and returns a function to handle that key. We pass
-%% the key as an additional argument to this function.
-%% 3. The device has a function of the name `Key', which should be called
-%% directly.
-%% 4. The device does not implement the key, but does have a default handler
-%% for us to call. We pass it the key as an additional argument.
-%% 5. The device does not implement the key, and has no default handler. We use
-%% the default device to handle the key.
-%% Error: If the device is specified, but not loadable, we raise an error.
-%%
-%% Returns {ok | add_key, Fun} where Fun is the function to call, and add_key
-%% indicates that the key should be added to the start of the call's arguments.
-message_to_fun(Msg, Key, Opts) ->
-    % Get the device module from the message.
-	Dev = message_to_device(Msg, Opts),
-    Info = info(Dev, Msg, Opts),
-    % Is the key exported by the device?
-    Exported = is_exported(Info, Key),
-	?event(
-        ao_devices,
-        {message_to_fun,
-            {dev, Dev},
-            {key, Key},
-            {is_exported, Exported},
-            {opts, Opts}
-        },
-		Opts
-    ),
-    % Does the device have an explicit handler function?
-    case {maps:find(handler, Info), Exported} of
-        {{ok, Handler}, true} ->
-			% Case 2: The device has an explicit handler function.
-			?event(
-                ao_devices,
-                {handler_found, {dev, Dev}, {key, Key}, {handler, Handler}}
-            ),
-			{Status, Func} = info_handler_to_fun(Handler, Msg, Key, Opts),
-            {Status, Dev, Func};
-		_ ->
-			?event(ao_devices, {no_override_handler, {dev, Dev}, {key, Key}}),
-			case {find_exported_function(Msg, Dev, Key, 3, Opts), Exported} of
-				{{ok, Func}, true} ->
-					% Case 3: The device has a function of the name `Key'.
-					{ok, Dev, Func};
-				_ ->
-					case {maps:find(default, Info), Exported} of
-						{{ok, DefaultFunc}, true} when is_function(DefaultFunc) ->
-							% Case 4: The device has a default handler.
-                            ?event({found_default_handler, {func, DefaultFunc}}),
-							{add_key, Dev, DefaultFunc};
-                        {{ok, DefaultMod}, true} when is_atom(DefaultMod) ->
-							?event({found_default_handler, {mod, DefaultMod}}),
-                            {Status, Func} =
-                                message_to_fun(
-                                    Msg#{ device => DefaultMod }, Key, Opts
-                                ),
-                            {Status, Dev, Func};
-						_ ->
-							% Case 5: The device has no default handler.
-							% We use the default device to handle the key.
-							case default_module() of
-								Dev ->
-									% We are already using the default device,
-									% so we cannot resolve the key. This should
-									% never actually happen in practice, but it
-									% resolves an infinite loop that can occur
-									% during development.
-									throw({
-										error,
-										default_device_could_not_resolve_key,
-										{key, Key}
-									});
-								DefaultDev ->
-                                    ?event(
-                                        {
-                                            using_default_device,
-                                            {dev, DefaultDev}
-                                        }),
-                                    message_to_fun(
-                                        Msg#{ device => DefaultDev },
-                                        Key,
-                                        Opts
-                                    )
-							end
-					end
-			end
-	end.
-
-%% @doc Extract the device module from a message.
-message_to_device(Msg, Opts) ->
-    case dev_message:get(device, Msg) of
-        {error, not_found} ->
-            % The message does not specify a device, so we use the default device.
-            default_module();
-        {ok, DevID} ->
-            case load_device(DevID, Opts) of
-                {error, Reason} ->
-                    % Error case: A device is specified, but it is not loadable.
-                    throw({error, {device_not_loadable, DevID, Reason}});
-                {ok, DevMod} -> DevMod
-            end
-    end.
-
-%% @doc Parse a handler key given by a device's `info'.
-info_handler_to_fun(Handler, _Msg, _Key, _Opts) when is_function(Handler) ->
-	{add_key, Handler};
-info_handler_to_fun(HandlerMap, Msg, Key, Opts) ->
-	case maps:find(excludes, HandlerMap) of
-		{ok, Exclude} ->
-			case lists:member(Key, Exclude) of
-				true ->
-					{ok, MsgWithoutDevice} =
-						dev_message:remove(Msg, #{ item => device }),
-					message_to_fun(
-						MsgWithoutDevice#{ device => default_module() },
-						Key,
-						Opts
-					);
-				false -> {add_key, maps:get(func, HandlerMap)}
-			end;
-		error -> {add_key, maps:get(func, HandlerMap)}
-	end.
-
-%% @doc Find the function with the highest arity that has the given name, if it
-%% exists.
-%%
-%% If the device is a module, we look for a function with the given name.
-%%
-%% If the device is a map, we look for a key in the map. First we try to find
-%% the key using its literal value. If that fails, we cast the key to an atom
-%% and try again.
-find_exported_function(Msg, Dev, Key, MaxArity, Opts) when is_map(Dev) ->
-	case maps:get(normalize_key(Key), normalize_keys(Dev), not_found) of
-		not_found -> not_found;
-		Fun when is_function(Fun) ->
-			case erlang:fun_info(Fun, arity) of
-				{arity, Arity} when Arity =< MaxArity ->
-					case is_exported(Msg, Dev, Key, Opts) of
-						true -> {ok, Fun};
-						false -> not_found
-					end;
-				_ -> not_found
-			end
-	end;
-find_exported_function(_Msg, _Mod, _Key, Arity, _Opts) when Arity < 0 ->
-    not_found;
-find_exported_function(Msg, Mod, Key, Arity, Opts) when not is_atom(Key) ->
-	try hb_util:key_to_atom(Key, false) of
-		KeyAtom -> find_exported_function(Msg, Mod, KeyAtom, Arity, Opts)
-	catch _:_ -> not_found
-	end;
-find_exported_function(Msg, Mod, Key, Arity, Opts) ->
-	case erlang:function_exported(Mod, Key, Arity) of
-		true ->
-			case is_exported(Msg, Mod, Key, Opts) of
-				true -> {ok, fun Mod:Key/Arity};
-				false -> not_found
-			end;
-		false ->
-			find_exported_function(Msg, Mod, Key, Arity - 1, Opts)
-	end.
-
-%% @doc Check if a device is guarding a key via its `exports' list. Defaults to
-%% true if the device does not specify an `exports' list. The `info' function is
-%% always exported, if it exists. Elements of the `exludes' list are not
-%% exported. Note that we check for info _twice_ -- once when the device is
-%% given but the info result is not, and once when the info result is given.
-%% The reason for this is that `info/3' calls other functions that may need to
-%% check if a key is exported, so we must avoid infinite loops. We must, however,
-%% also return a consistent result in the case that only the info result is
-%% given, so we check for it in both cases.
-is_exported(_Msg, _Dev, info, _Opts) -> true;
-is_exported(Msg, Dev, Key, Opts) ->
-	is_exported(info(Dev, Msg, Opts), Key).
-is_exported(_, info) -> true;
-is_exported(Info = #{ excludes := Excludes }, Key) ->
-    case lists:member(normalize_key(Key), lists:map(fun normalize_key/1, Excludes)) of
-        true -> false;
-        false -> is_exported(maps:remove(excludes, Info), Key)
-    end;
-is_exported(#{ exports := Exports }, Key) ->
-    lists:member(normalize_key(Key), lists:map(fun normalize_key/1, Exports));
-is_exported(_Info, _Key) -> true.
-
 %% @doc Convert a key to a binary in normalized form.
 normalize_key(Key) -> normalize_key(Key, #{}).
-normalize_key(Key, _Opts) when ?IS_ID(Key) -> Key;
-normalize_key(Key, _Opts) when is_binary(Key) -> hb_util:to_lower(Key);
+normalize_key(Key, _Opts) when is_binary(Key) -> Key;
 normalize_key(Key, _Opts) when is_atom(Key) -> atom_to_binary(Key);
 normalize_key(Key, _Opts) when is_integer(Key) -> integer_to_binary(Key);
 normalize_key(Key, _Opts) when is_list(Key) ->
@@ -1259,186 +1162,52 @@ normalize_key(Key, _Opts) when is_list(Key) ->
     end.
 
 %% @doc Ensure that a message is processable by the AO-Core resolver: No lists.
-normalize_keys(Msg1) when is_list(Msg1) ->
-    normalize_keys(maps:from_list(
-        lists:zip(
-            lists:seq(1, length(Msg1)),
-            Msg1
-        )
-    ));
-normalize_keys(Map) when is_map(Map) ->
-    maps:from_list(
+normalize_keys(Msg) -> normalize_keys(Msg, #{}).
+normalize_keys(Msg1, Opts) when is_list(Msg1) ->
+    normalize_keys(
+		hb_maps:from_list(
+        	lists:zip(
+            	lists:seq(1, length(Msg1)),
+            	Msg1
+			)
+        ),
+		Opts
+	);
+
+normalize_keys(Map, Opts) when is_map(Map) ->
+    hb_maps:from_list(
         lists:map(
             fun({Key, Value}) when is_map(Value) ->
                 {hb_ao:normalize_key(Key), Value};
             ({Key, Value}) ->
                 {hb_ao:normalize_key(Key), Value}
             end,
-            maps:to_list(Map)
+            hb_maps:to_list(Map, Opts)
         )
     );
-normalize_keys(Other) -> Other.
-
-%% @doc Load a device module from its name or a message ID.
-%% Returns {ok, Executable} where Executable is the device module. On error,
-%% a tuple of the form {error, Reason} is returned.
-load_device(Map, _Opts) when is_map(Map) -> {ok, Map};
-load_device(ID, _Opts) when is_atom(ID) ->
-    try ID:module_info(), {ok, ID}
-    catch _:_ -> {error, not_loadable}
-    end;
-load_device(ID, Opts) when ?IS_ID(ID) ->
-    ?event(device_load, {requested_load, {id, ID}}, Opts),
-	case hb_opts:get(load_remote_devices, false, Opts) of
-        false ->
-            {error, remote_devices_disabled};
-		true ->
-            ?event(device_load, {loading_from_cache, {id, ID}}, Opts),
-			{ok, Msg} = hb_cache:read(ID, Opts),
-            ?event(device_load, {received_device, {id, ID}, {msg, Msg}}, Opts),
-            TrustedSigners = hb_opts:get(trusted_device_signers, [], Opts),
-			Trusted =
-				lists:any(
-					fun(Signer) ->
-						lists:member(Signer, TrustedSigners)
-					end,
-					hb_message:signers(Msg)
-				),
-            ?event(device_load,
-                {verifying_device_trust,
-                    {id, ID},
-                    {trusted, Trusted},
-                    {signers, hb_message:signers(Msg)}
-                },
-                Opts
-            ),
-			case Trusted of
-				false -> {error, device_signer_not_trusted};
-				true ->
-                    ?event(device_load, {loading_device, {id, ID}}, Opts),
-					case maps:get(<<"content-type">>, Msg, undefined) of
-						<<"application/beam">> ->
-                            case verify_device_compatibility(Msg, Opts) of
-                                ok ->
-                                    ModName =
-                                        hb_util:key_to_atom(
-                                            maps:get(<<"module-name">>, Msg),
-                                            new_atoms
-                                        ),
-                                    case erlang:load_module(ModName, maps:get(<<"body">>, Msg)) of
-                                        {module, _} ->
-                                            {ok, ModName};
-                                        {error, Reason} ->
-                                            {error, {device_load_failed, Reason}}
-                                    end;
-                                {error, Reason} ->
-                                    {error, {device_load_failed, Reason}}
-                            end;
-                        Other ->
-                            {error,
-                                {device_load_failed,
-                                    {incompatible_content_type, Other},
-                                    {expected, <<"application/beam">>},
-                                    {found, Other}
-                                }
-                            }
-                    end
-			end
-	end;
-load_device(ID, Opts) ->
-    NormKey =
-        case is_atom(ID) of
-            true -> ID;
-            false -> normalize_key(ID)
-        end,
-    case lists:search(
-        fun (#{ <<"name">> := Name }) -> Name =:= NormKey end,
-        Preloaded = hb_opts:get(preloaded_devices, [], Opts)
-    ) of
-        false -> {error, {module_not_admissable, NormKey, Preloaded}};
-        {value, #{ <<"module">> := Mod }} -> load_device(Mod, Opts)
-    end.
-
-%% @doc Verify that a device is compatible with the current machine.
-verify_device_compatibility(Msg, Opts) ->
-    ?event(device_load, {verifying_device_compatibility, {msg, Msg}}, Opts),
-    Required =
-        lists:filtermap(
-            fun({<<"requires-", Key/binary>>, Value}) ->
-                {true,
-                    {
-                        hb_util:key_to_atom(
-                            hb_ao:normalize_key(Key),
-                            new_atoms
-                        ),
-                        Value
-                    }
-                };
-            (_) -> false
-            end,
-            maps:to_list(Msg)
-        ),
-    ?event(device_load,
-        {discerned_requirements,
-            {required, Required},
-            {msg, Msg}
-        },
-        Opts
-    ),
-    FailedToMatch =
-        lists:filtermap(
-            fun({Property, Value}) ->
-                % The values of these properties are _not_ 'keys', but we normalize
-                % them as such in order to make them comparable.
-                SystemValue = erlang:system_info(Property),
-                Res = normalize_key(SystemValue) == normalize_key(Value),
-                % If the property matched, we remove it from the list of required
-                % properties. If it doesn't we return it with the found value, such
-                % that the caller knows which properties were not satisfied.
-                case Res of
-                    true -> false;
-                    false -> {true, {Property, Value}}
-                end
-            end,
-            Required
-        ),
-    case FailedToMatch of
-        [] -> ok;
-        _ -> {error, {failed_requirements, FailedToMatch}}
-    end.
-
-%% @doc Get the info map for a device, optionally giving it a message if the
-%% device's info function is parameterized by one.
-info(Msg, Opts) ->
-    info(message_to_device(Msg, Opts), Msg, Opts).
-info(DevMod, Msg, Opts) ->
-	%?event({calculating_info, {dev, DevMod}, {msg, Msg}}),
-	case find_exported_function(Msg, DevMod, info, 1, Opts) of
-		{ok, Fun} ->
-			Res = apply(Fun, truncate_args(Fun, [Msg, Opts])),
-			% ?event({
-            %     info_result,
-            %     {dev, DevMod},
-            %     {args, truncate_args(Fun, [Msg])},
-            %     {result, Res}
-            % }),
-			Res;
-		not_found -> #{}
-	end.
-
-%% @doc The default device is the identity device, which simply returns the
-%% value associated with any key as it exists in its Erlang map. It should also
-%% implement the `set' key, which returns a `Message3' with the values changed
-%% according to the `Message2' passed to it.
-default_module() -> dev_message.
+normalize_keys(Other, _Opts) -> Other.
 
 %% @doc The execution options that are used internally by this module
 %% when calling itself.
 internal_opts(Opts) ->
-    maps:merge(Opts, #{
+    hb_maps:merge(Opts, #{
         topic => hb_opts:get(topic, ao_internal, Opts),
         hashpath => ignore,
         cache_control => [<<"no-cache">>, <<"no-store">>],
         spawn_worker => false,
         await_inprogress => false
     }).
+
+%% @doc Return the node message that should be used in order to perform
+%% recursive executions.
+execution_opts(Opts) ->
+	% First, determine the arguments to pass to the function.
+	% While calculating the arguments we unset the add_key option.
+	Opts1 = hb_maps:remove(trace, hb_maps:without(?TEMP_OPTS, Opts, Opts), Opts),
+    % Unless the user has explicitly requested recursive spawning, we
+    % unset the spawn_worker option so that we do not spawn a new worker
+    % for every resulting execution.
+    case hb_maps:get(spawn_worker, Opts1, false, Opts) of
+        recursive -> Opts1;
+        _ -> hb_maps:remove(spawn_worker, Opts1, Opts)
+    end.
\ No newline at end of file
diff --git a/src/hb_ao_device.erl b/src/hb_ao_device.erl
new file mode 100644
index 000000000..ab63e5fe2
--- /dev/null
+++ b/src/hb_ao_device.erl
@@ -0,0 +1,442 @@
+%%% @doc A library for working with HyperBEAM-compatible AO-Core devices.
+%%% Offers services for loading, verifying executability, and extracting Erlang
+%%% functions from a device.
+-module(hb_ao_device).
+-export([truncate_args/2, message_to_fun/3, message_to_device/2, load/2]).
+-export([is_direct_key_access/3, is_direct_key_access/4]).
+-export([find_exported_function/5, is_exported/4, info/2, info/3, default/0]).
+-include("include/hb.hrl").
+
+%%% All keys in the `message@1.0` device that are not resolved to underlying
+%%% data in the their Erlang map representations.
+-define(MESSAGE_KEYS, [
+    <<"get">>,
+    <<"set">>,
+    <<"remove">>,
+    <<"keys">>,
+    <<"id">>,
+    <<"commit">>,
+    <<"verify">>,
+    <<"committers">>,
+    <<"committed">>
+]).
+
+%% @doc Truncate the arguments of a function to the number of arguments it
+%% actually takes.
+truncate_args(Fun, Args) ->
+    {arity, Arity} = erlang:fun_info(Fun, arity),
+    lists:sublist(Args, Arity).
+
+%% @doc Calculate the Erlang function that should be called to get a value for
+%% a given key from a device.
+%%
+%% This comes in 7 forms:
+%% 1. The message does not specify a device, so we use the default device.
+%% 2. The device has a `handler' key in its `Dev:info()' map, which is a
+%% function that takes a key and returns a function to handle that key. We pass
+%% the key as an additional argument to this function.
+%% 3. The device has a function of the name `Key', which should be called
+%% directly.
+%% 4. The device does not implement the key, but does have a default handler
+%% for us to call. We pass it the key as an additional argument.
+%% 5. The device does not implement the key, and has no default handler. We use
+%% the default device to handle the key.
+%% Error: If the device is specified, but not loadable, we raise an error.
+%%
+%% Returns {ok | add_key, Fun} where Fun is the function to call, and add_key
+%% indicates that the key should be added to the start of the call's arguments.
+message_to_fun(Msg, Key, Opts) ->
+    % Get the device module from the message.
+	Dev = message_to_device(Msg, Opts),
+    Info = info(Dev, Msg, Opts),
+    % Is the key exported by the device?
+    Exported = is_exported(Info, Key, Opts),
+	?event(
+        ao_devices,
+        {message_to_fun,
+            {dev, Dev},
+            {key, Key},
+            {is_exported, Exported},
+            {opts, Opts}
+        },
+		Opts
+    ),
+    % Does the device have an explicit handler function?
+    case {hb_maps:find(handler, Info, Opts), Exported} of
+        {{ok, Handler}, true} ->
+			% Case 2: The device has an explicit handler function.
+			?event(
+                ao_devices,
+                {handler_found, {dev, Dev}, {key, Key}, {handler, Handler}}
+            ),
+			{Status, Func} = info_handler_to_fun(Handler, Msg, Key, Opts),
+            {Status, Dev, Func};
+		_ ->
+			?event(ao_devices, {no_override_handler, {dev, Dev}, {key, Key}}),
+			case {find_exported_function(Msg, Dev, Key, 3, Opts), Exported} of
+				{{ok, Func}, true} ->
+					% Case 3: The device has a function of the name `Key'.
+					{ok, Dev, Func};
+				_ ->
+					case {hb_maps:find(default, Info, Opts), Exported} of
+						{{ok, DefaultFunc}, true} when is_function(DefaultFunc) ->
+							% Case 4: The device has a default handler.
+                            ?event({found_default_handler, {func, DefaultFunc}}),
+							{add_key, Dev, DefaultFunc};
+                        {{ok, DefaultMod}, true} when is_atom(DefaultMod) ->
+							?event({found_default_handler, {mod, DefaultMod}}),
+                            {Status, Func} =
+                                message_to_fun(
+                                    Msg#{ <<"device">> => DefaultMod }, Key, Opts
+                                ),
+                            {Status, Dev, Func};
+						_ ->
+							% Case 5: The device has no default handler.
+							% We use the default device to handle the key.
+							case default() of
+								Dev ->
+									% We are already using the default device,
+									% so we cannot resolve the key. This should
+									% never actually happen in practice, but it
+									% resolves an infinite loop that can occur
+									% during development.
+									throw({
+										error,
+										default_device_could_not_resolve_key,
+										{key, Key}
+									});
+								DefaultDev ->
+                                    ?event(
+                                        {
+                                            using_default_device,
+                                            {dev, DefaultDev}
+                                        }),
+                                    message_to_fun(
+                                        Msg#{ <<"device">> => DefaultDev },
+                                        Key,
+                                        Opts
+                                    )
+							end
+					end
+			end
+	end.
+
+%% @doc Extract the device module from a message.
+message_to_device(Msg, Opts) ->
+    case dev_message:get(<<"device">>, Msg, Opts) of
+        {error, not_found} ->
+            % The message does not specify a device, so we use the default device.
+            default();
+        {ok, DevID} ->
+            case load(DevID, Opts) of
+                {error, Reason} ->
+                    % Error case: A device is specified, but it is not loadable.
+                    throw({error, {device_not_loadable, DevID, Reason}});
+                {ok, DevMod} -> DevMod
+            end
+    end.
+
+%% @doc Parse a handler key given by a device's `info'.
+info_handler_to_fun(Handler, _Msg, _Key, _Opts) when is_function(Handler) ->
+	{add_key, Handler};
+info_handler_to_fun(HandlerMap, Msg, Key, Opts) ->
+	case hb_maps:find(excludes, HandlerMap, Opts) of
+		{ok, Exclude} ->
+			case lists:member(Key, Exclude) of
+				true ->
+					{ok, MsgWithoutDevice} =
+						dev_message:remove(Msg, #{ item => device }, Opts),
+					message_to_fun(
+						MsgWithoutDevice#{ <<"device">> => default() },
+						Key,
+						Opts
+					);
+				false -> {add_key, hb_maps:get(func, HandlerMap, undefined, Opts)}
+			end;
+		error -> {add_key, hb_maps:get(func, HandlerMap, undefined, Opts)}
+	end.
+
+%% @doc Find the function with the highest arity that has the given name, if it
+%% exists.
+%%
+%% If the device is a module, we look for a function with the given name.
+%%
+%% If the device is a map, we look for a key in the map. First we try to find
+%% the key using its literal value. If that fails, we cast the key to an atom
+%% and try again.
+find_exported_function(Msg, Dev, Key, MaxArity, Opts) when is_map(Dev) ->
+    NormKey = hb_ao:normalize_key(Key),
+    NormDev = hb_ao:normalize_keys(Dev, Opts),
+	case hb_maps:get(NormKey, NormDev, not_found, Opts) of
+		not_found -> not_found;
+		Fun when is_function(Fun) ->
+			case erlang:fun_info(Fun, arity) of
+				{arity, Arity} when Arity =< MaxArity ->
+					case is_exported(Msg, Dev, Key, Opts) of
+						true -> {ok, Fun};
+						false -> not_found
+					end;
+				_ -> not_found
+			end
+	end;
+find_exported_function(_Msg, _Mod, _Key, Arity, _Opts) when Arity < 0 ->
+    not_found;
+find_exported_function(Msg, Mod, Key, Arity, Opts) when not is_atom(Key) ->
+	try hb_util:key_to_atom(Key, false) of
+		KeyAtom -> find_exported_function(Msg, Mod, KeyAtom, Arity, Opts)
+	catch _:_ -> not_found
+	end;
+find_exported_function(Msg, Mod, Key, Arity, Opts) ->
+	case erlang:function_exported(Mod, Key, Arity) of
+		true ->
+			case is_exported(Msg, Mod, Key, Opts) of
+				true -> {ok, fun Mod:Key/Arity};
+				false -> not_found
+			end;
+		false ->
+			find_exported_function(Msg, Mod, Key, Arity - 1, Opts)
+	end.
+
+%% @doc Check if a device is guarding a key via its `exports' list. Defaults to
+%% true if the device does not specify an `exports' list. The `info' function is
+%% always exported, if it exists. Elements of the `exludes' list are not
+%% exported. Note that we check for info _twice_ -- once when the device is
+%% given but the info result is not, and once when the info result is given.
+%% The reason for this is that `info/3' calls other functions that may need to
+%% check if a key is exported, so we must avoid infinite loops. We must, however,
+%% also return a consistent result in the case that only the info result is
+%% given, so we check for it in both cases.
+is_exported(_Msg, _Dev, info, _Opts) -> true;
+is_exported(Msg, Dev, Key, Opts) ->
+	is_exported(info(Dev, Msg, Opts), Key, Opts).
+is_exported(_, info, _Opts) -> true;
+is_exported(Info = #{ excludes := Excludes }, Key, Opts) ->
+    NormKey = hb_ao:normalize_key(Key),
+    case lists:member(NormKey, lists:map(fun hb_ao:normalize_key/1, Excludes)) of
+        true -> false;
+        false -> is_exported(hb_maps:remove(excludes, Info, Opts), Key, Opts)
+    end;
+is_exported(#{ exports := Exports }, Key, _Opts) ->
+    lists:member(
+        hb_ao:normalize_key(Key),
+        lists:map(fun hb_ao:normalize_key/1, Exports)
+    );
+is_exported(_Info, _Key, _Opts) -> true.
+
+%% @doc Load a device module from its name or a message ID.
+%% Returns {ok, Executable} where Executable is the device module. On error,
+%% a tuple of the form {error, Reason} is returned.
+load(Map, _Opts) when is_map(Map) -> {ok, Map};
+load(ID, _Opts) when is_atom(ID) ->
+    try ID:module_info(), {ok, ID}
+    catch _:_ -> {error, not_loadable}
+    end;
+load(ID, Opts) when ?IS_ID(ID) ->
+    ?event(device_load, {requested_load, {id, ID}}, Opts),
+	case hb_opts:get(load_remote_devices, false, Opts) of
+        false ->
+            {error, remote_devices_disabled};
+		true ->
+            ?event(device_load, {loading_from_cache, {id, ID}}, Opts),
+			{ok, Msg} = hb_cache:read(ID, Opts),
+            ?event(device_load, {received_device, {id, ID}, {msg, Msg}}, Opts),
+            TrustedSigners = hb_opts:get(trusted_device_signers, [], Opts),
+			Trusted =
+				lists:any(
+					fun(Signer) ->
+						lists:member(Signer, TrustedSigners)
+					end,
+					hb_message:signers(Msg, Opts)
+				),
+            ?event(device_load,
+                {verifying_device_trust,
+                    {id, ID},
+                    {trusted, Trusted},
+                    {signers, hb_message:signers(Msg, Opts)}
+                },
+                Opts
+            ),
+			case Trusted of
+				false -> {error, device_signer_not_trusted};
+				true ->
+                    ?event(device_load, {loading_device, {id, ID}}, Opts),
+					case hb_maps:get(<<"content-type">>, Msg, undefined, Opts) of
+						<<"application/beam">> ->
+                            case verify_device_compatibility(Msg, Opts) of
+                                ok ->
+                                    ModName =
+                                        hb_util:key_to_atom(
+                                            hb_maps:get(
+                                                <<"module-name">>,
+                                                Msg,
+                                                undefined,
+                                                Opts
+                                            ),
+                                            new_atoms
+                                        ),
+                                    LoadRes = 
+                                        erlang:load_module(
+                                            ModName,
+                                            hb_maps:get(
+                                                <<"body">>,
+                                                Msg,
+                                                undefined,
+                                                Opts
+                                            )
+                                        ),
+                                    case LoadRes of
+                                        {module, _} ->
+                                            {ok, ModName};
+                                        {error, Reason} ->
+                                            {error, {device_load_failed, Reason}}
+                                    end;
+                                {error, Reason} ->
+                                    {error, {device_load_failed, Reason}}
+                            end;
+                        Other ->
+                            {error,
+                                {device_load_failed,
+                                    {incompatible_content_type, Other},
+                                    {expected, <<"application/beam">>},
+                                    {found, Other}
+                                }
+                            }
+                    end
+			end
+	end;
+load(ID, Opts) ->
+    NormKey =
+        case is_atom(ID) of
+            true -> ID;
+            false -> hb_ao:normalize_key(ID)
+        end,
+    case lists:search(
+        fun (#{ <<"name">> := Name }) -> Name =:= NormKey end,
+        Preloaded = hb_opts:get(preloaded_devices, [], Opts)
+    ) of
+        false -> {error, {module_not_admissable, NormKey, Preloaded}};
+        {value, #{ <<"module">> := Mod }} -> load(Mod, Opts)
+    end.
+
+%% @doc Verify that a device is compatible with the current machine.
+verify_device_compatibility(Msg, Opts) ->
+    ?event(device_load, {verifying_device_compatibility, {msg, Msg}}, Opts),
+    Required =
+        lists:filtermap(
+            fun({<<"requires-", Key/binary>>, Value}) ->
+                {true,
+                    {
+                        hb_util:key_to_atom(
+                            hb_ao:normalize_key(Key),
+                            new_atoms
+                        ),
+                        hb_cache:ensure_loaded(Value, Opts)
+                    }
+                };
+            (_) -> false
+            end,
+            hb_maps:to_list(Msg, Opts)
+        ),
+    ?event(device_load,
+        {discerned_requirements,
+            {required, Required},
+            {msg, Msg}
+        },
+        Opts
+    ),
+    FailedToMatch =
+        lists:filtermap(
+            fun({Property, Value}) ->
+                % The values of these properties are _not_ 'keys', but we normalize
+                % them as such in order to make them comparable.
+                SystemValue = erlang:system_info(Property),
+                Res = hb_ao:normalize_key(SystemValue) == hb_ao:normalize_key(Value),
+                % If the property matched, we remove it from the list of required
+                % properties. If it doesn't we return it with the found value, such
+                % that the caller knows which properties were not satisfied.
+                case Res of
+                    true -> false;
+                    false -> {true, {Property, Value}}
+                end
+            end,
+            Required
+        ),
+    case FailedToMatch of
+        [] -> ok;
+        _ -> {error, {failed_requirements, FailedToMatch}}
+    end.
+
+%% @doc Get the info map for a device, optionally giving it a message if the
+%% device's info function is parameterized by one.
+info(Msg, Opts) ->
+    info(message_to_device(Msg, Opts), Msg, Opts).
+info(DevMod, Msg, Opts) ->
+	%?event({calculating_info, {dev, DevMod}, {msg, Msg}}),
+    case find_exported_function(Msg, DevMod, info, 2, Opts) of
+		{ok, Fun} ->
+			Res = apply(Fun, truncate_args(Fun, [Msg, Opts])),
+			% ?event({
+            %     info_result,
+            %     {dev, DevMod},
+            %     {args, truncate_args(Fun, [Msg])},
+            %     {result, Res}
+            % }),
+			Res;
+		not_found -> #{}
+	end.
+
+%% @doc Determine if a device is a `direct access': If there is a literal key
+%% in the message's Erlang map representation, will it always be returned?
+is_direct_key_access(Base, Req, Opts) ->
+    is_direct_key_access(Base, Req, Opts, unknown).
+is_direct_key_access(Base, Req, Opts, MaybeStore) when ?IS_ID(Base) ->
+    Store =
+        if MaybeStore =:= unknown -> hb_opts:get(store, no_viable_store, Opts);
+        true -> MaybeStore
+        end,
+    DevPath = hb_store:resolve(Store, [Base, <<"device">>]),
+    case hb_store:read(Store, DevPath) of
+        {ok, Dev} ->
+            do_is_direct_key_access(Dev, Req, Opts);
+        not_found ->
+            case hb_store:type(Store, Base) of
+                not_found -> unknown;
+                _ -> do_is_direct_key_access(<<"message@1.0">>, Req, Opts)
+            end
+    end;
+is_direct_key_access(Base, Req, Opts, _) when is_map(Base) ->
+    do_is_direct_key_access(hb_maps:find(<<"device">>, Base, Opts), Req, Opts).
+
+do_is_direct_key_access(DevRes, #{ <<"path">> := Key }, Opts) ->
+    do_is_direct_key_access(DevRes, Key, Opts);
+do_is_direct_key_access({_Status, DevRes}, Key, Opts) ->
+    do_is_direct_key_access(DevRes, Key, Opts);
+do_is_direct_key_access(not_found, Key, Opts) ->
+    do_is_direct_key_access(<<"message@1.0">>, Key, Opts);
+do_is_direct_key_access(error, Key, Opts) ->
+    do_is_direct_key_access(<<"message@1.0">>, Key, Opts);
+do_is_direct_key_access(<<"message@1.0">>, Key, _Opts) ->
+    not lists:member(Key, ?MESSAGE_KEYS);
+do_is_direct_key_access(Dev, NormKey, Opts) ->
+    ?event(read_cached, {calculating_info, {device, Dev}}),
+    case info(#{ <<"device">> => Dev}, Opts) of
+        Info = #{ exports := Exports }
+            when not is_map_key(handler, Info) andalso not is_map_key(default, Info) ->
+            ?event(read_cached,
+                {exports,
+                    {device, Dev},
+                    {key, NormKey},
+                    {exports, Exports}
+                }
+            ),
+            not lists:member(NormKey, Exports ++ ?MESSAGE_KEYS);
+        _ -> false
+    end;
+do_is_direct_key_access(_, _, _) ->
+    false.
+
+%% @doc The default device is the identity device, which simply returns the
+%% value associated with any key as it exists in its Erlang map. It should also
+%% implement the `set' key, which returns a `Message3' with the values changed
+%% according to the `Message2' passed to it.
+default() -> dev_message.
\ No newline at end of file
diff --git a/src/hb_ao_test_vectors.erl b/src/hb_ao_test_vectors.erl
index fd62382a9..c6ea97dcf 100644
--- a/src/hb_ao_test_vectors.erl
+++ b/src/hb_ao_test_vectors.erl
@@ -4,17 +4,25 @@
 -include_lib("eunit/include/eunit.hrl").
 -include_lib("include/hb.hrl").
 
-%% Easy hook to make a test executable via the command line:
+%% The time to run the benchmarks for in seconds.
+-define(BENCHMARK_TIME, 0.25).
+%% The number of iterations to run each benchmark for.
+-define(BENCHMARK_ITERATIONS, 1_000).
+
+%% @doc Easy hook to make a test executable via the command line:
 %% `rebar3 eunit --test hb_ao_test_vectors:run_test'
 %% Comment/uncomment out as necessary.
 run_test() ->
-    hb_test_utils:run(step_hook, normal, test_suite(), test_opts()).
+    skip.
 
 %% @doc Run each test in the file with each set of options. Start and reset
 %% the store for each test.
-run_all_test_() ->
+suite_test_() ->
     hb_test_utils:suite_with_opts(test_suite(), test_opts()).
 
+benchmark_test_() ->
+    hb_test_utils:suite_with_opts(benchmark_suite(), test_opts()).
+
 test_suite() ->
     [
         {resolve_simple, "resolve simple",
@@ -31,6 +39,8 @@ test_suite() ->
             fun as_path_test/1},
         {continue_as, "continue as",
             fun continue_as_test/1},
+        {multiple_as_subresolutions, "multiple as subresolutions",
+            fun multiple_as_subresolutions_test/1},
         {resolve_key_twice, "resolve key twice",
             fun resolve_key_twice_test/1},
         {resolve_from_multiple_keys, "resolve from multiple keys",
@@ -78,8 +88,38 @@ test_suite() ->
             fun step_hook_test/1}
     ].
 
+benchmark_suite() ->
+    [
+        {benchmark_simple, "simple resolution benchmark",
+            fun benchmark_simple_test/1},
+        {benchmark_multistep, "multistep resolution benchmark",
+            fun benchmark_multistep_test/1},
+        {benchmark_get, "get benchmark",
+            fun benchmark_get_test/1},
+        {benchmark_set, "single value set benchmark",
+            fun benchmark_set_test/1},
+        {benchmark_set_multiple, "set two keys benchmark",
+            fun benchmark_set_multiple_test/1},
+        {benchmark_set_multiple_deep, "set two keys deep benchmark",
+            fun benchmark_set_multiple_deep_test/1}
+    ].
+
 test_opts() ->
     [
+        #{
+            name => normal,
+            desc => "Default opts",
+            opts => #{},
+            skip => []
+        },
+        #{
+            name => without_hashpath,
+            desc => "Default without hashpath",
+            opts => #{
+                hashpath => ignore
+            },
+            skip => []
+        },
         #{
             name => no_cache,
             desc => "No cache read or write",
@@ -89,7 +129,7 @@ test_opts() ->
                 spawn_worker => false,
                 store => #{
                     <<"store-module">> => hb_store_fs,
-                    <<"prefix">> => <<"cache-TEST/fs">>
+                    <<"name">> => <<"cache-TEST/fs">>
                 }
             },
             skip => [load_as]
@@ -103,7 +143,7 @@ test_opts() ->
                 spawn_worker => false,
                 store => #{
                     <<"store-module">> => hb_store_fs,
-                    <<"prefix">> => <<"cache-TEST/fs">>
+                    <<"name">> => <<"cache-TEST/fs">>
                 }
             },
             skip => [
@@ -122,30 +162,32 @@ test_opts() ->
                 spawn_worker => false,
                 store => #{
                     <<"store-module">> => hb_store_fs,
-                    <<"prefix">> => <<"cache-TEST/fs">>
+                    <<"name">> => <<"cache-TEST/fs">>
                 }
             },
             skip => [
-                % Exclude tests that return a list on its own for now, as raw 
-                % lists cannot be cached yet.
+                % Skip test with locally defined device, amongst others.
+                resolve_id,
+                start_as,
+                start_as_with_parameters,
+                as_path,
+                multiple_as_subresolutions,
+                key_from_id_device_with_args,
                 set_new_messages,
                 resolve_from_multiple_keys,
                 resolve_path_element,
+                device_with_default_handler_function,
+                device_with_handler_function,
                 denormalized_device_key,
-                % Skip test with locally defined device
+                get_with_device,
+                get_as_with_device,
+                set_with_device,
+                device_exports,
+                device_excludes,
                 deep_set_with_device,
-                as
-                % Skip tests that call hb_ao utils (which have their own 
-                % cache settings).
+                as,
+                step_hook
             ]
-        },
-        #{
-            name => normal,
-            desc => "Default opts",
-            opts => #{
-                cache_lookup_hueristics => false
-            },
-            skip => []
         }
     ].
 
@@ -166,14 +208,19 @@ exec_dummy_device(SigningWallet, Opts) ->
                     <<"variant">> => <<"ao.N.1">>,
                     <<"content-type">> => <<"application/beam">>,
                     <<"module-name">> => ModName,
-                    <<"requires-otp-release">> => erlang:system_info(otp_release),
+                    <<"requires-otp-release">> =>
+                        hb_util:bin(erlang:system_info(otp_release)),
                     <<"body">> => Bin
-                }
+                },
+				Opts
             ),
-            SigningWallet
+            Opts
         ),
     {ok, ID} = hb_cache:write(DevMsg, Opts),
-    ?assertEqual({ok, DevMsg}, hb_cache:read(ID, Opts)),
+    % Ensure that we can read the device message from the cache and that it matches
+    % the original message.
+    {ok, ReadMsg} = hb_cache:read(ID, Opts),
+    ?assertEqual(DevMsg, hb_cache:ensure_all_loaded(ReadMsg, Opts)),
     % Create a base message with the device ID, then request a dummy path from
     % it.
     hb_ao:resolve(
@@ -190,7 +237,7 @@ load_device_test() ->
         trusted_device_signers => [hb_util:human_id(ar_wallet:to_address(Wallet))],
         store => Store = #{
             <<"store-module">> => hb_store_fs,
-            <<"prefix">> => <<"cache-TEST/fs">>
+            <<"name">> => <<"cache-TEST/fs">>
         },
         priv_wallet => Wallet
     },
@@ -206,7 +253,7 @@ untrusted_load_device_test() ->
         trusted_device_signers => [hb_util:human_id(ar_wallet:to_address(TrustedWallet))],
         store => Store = #{
             <<"store-module">> => hb_store_fs,
-            <<"prefix">> => <<"cache-TEST/fs">>
+            <<"name">> => <<"cache-TEST/fs">>
         },
         priv_wallet => UntrustedWallet
     },
@@ -225,7 +272,7 @@ resolve_simple_test(Opts) ->
 resolve_id_test(Opts) ->
     ?assertMatch(
         ID when byte_size(ID) == 43,
-        hb_ao:get(id, #{ test_key => <<"1">> }, Opts)
+        hb_ao:get(<<"id">>, #{ <<"test_key">> => <<"1">> }, Opts)
     ).
 
 resolve_key_twice_test(Opts) ->
@@ -279,15 +326,15 @@ generate_device_with_keys_using_args() ->
         key_using_only_state =>
             fun(State) ->
                 {ok,
-                    <<(maps:get(<<"state_key">>, State))/binary>>
+                    <<(hb_maps:get(<<"state_key">>, State))/binary>>
                 }
             end,
         key_using_state_and_msg =>
             fun(State, Msg) ->
                 {ok,
                     <<
-                        (maps:get(<<"state_key">>, State))/binary,
-                        (maps:get(<<"msg_key">>, Msg))/binary
+                        (hb_maps:get(<<"state_key">>, State))/binary,
+                        (hb_maps:get(<<"msg_key">>, Msg))/binary
                     >>
                 }
             end,
@@ -295,9 +342,9 @@ generate_device_with_keys_using_args() ->
             fun(State, Msg, Opts) ->
                 {ok,
                     <<
-                        (maps:get(<<"state_key">>, State))/binary,
-                        (maps:get(<<"msg_key">>, Msg))/binary,
-                        (maps:get(<<"opts_key">>, Opts))/binary
+                        (hb_maps:get(<<"state_key">>, State, undefined, Opts))/binary,
+                        (hb_maps:get(<<"msg_key">>, Msg, undefined, Opts))/binary,
+                        (hb_maps:get(<<"opts_key">>, Opts, undefined, Opts))/binary
                     >>
                 }
             end
@@ -493,7 +540,7 @@ set_with_device_test(Opts) ->
                 #{
                     <<"set">> =>
                         fun(State, _Msg) ->
-                            Acc = maps:get(<<"set_count">>, State, <<"">>),
+                            Acc = hb_maps:get(<<"set_count">>, State, <<"">>, Opts),
                             {ok,
                                 State#{
                                     <<"set_count">> => << Acc/binary, "." >>
@@ -523,7 +570,7 @@ deep_set_test(Opts) ->
         hb_ao:set(Msg, [<<"a">>, <<"b">>, <<"c">>], <<"2">>, Opts)).
 
 deep_set_new_messages_test() ->
-    Opts = maps:get(opts, hd(test_opts())),
+    Opts = hb_maps:get(opts, hd(test_opts())),
     % Test that new messages are created when the path does not exist.
     Msg0 = #{ <<"a">> => #{ <<"b">> => #{ <<"c">> => <<"1">> } } },
     Msg1 = hb_ao:set(Msg0, <<"d/e">>, <<"3">>, Opts),
@@ -576,7 +623,7 @@ deep_set_with_device_test(Opts) ->
                 % A device where the set function modifies the key
                 % and adds a modified flag.
                 {Key, Val} =
-                    hd(maps:to_list(maps:without([<<"path">>, <<"priv">>], Msg2))),
+                    hd(hb_maps:to_list(hb_maps:without([<<"path">>, <<"priv">>], Msg2, Opts), Opts)),
                 {ok, Msg1#{ Key => Val, <<"modified">> => true }}
             end
     },
@@ -607,10 +654,10 @@ deep_set_with_device_test(Opts) ->
 
 device_exports_test(Opts) ->
 	Msg = #{ <<"device">> => dev_message },
-	?assert(hb_ao:is_exported(Msg, dev_message, info, Opts)),
-	?assert(hb_ao:is_exported(Msg, dev_message, set, Opts)),
+	?assert(hb_ao_device:is_exported(Msg, dev_message, info, Opts)),
+	?assert(hb_ao_device:is_exported(Msg, dev_message, set, Opts)),
 	?assert(
-        hb_ao:is_exported(
+        hb_ao_device:is_exported(
             Msg,
             dev_message,
             not_explicitly_exported,
@@ -622,14 +669,14 @@ device_exports_test(Opts) ->
 		set => fun(_, _) -> {ok, <<"SET">>} end
 	},
 	Msg2 = #{ <<"device">> => Dev },
-	?assert(hb_ao:is_exported(Msg2, Dev, info, Opts)),
-	?assert(hb_ao:is_exported(Msg2, Dev, set, Opts)),
-	?assert(not hb_ao:is_exported(Msg2, Dev, not_exported, Opts)),
+	?assert(hb_ao_device:is_exported(Msg2, Dev, info, Opts)),
+	?assert(hb_ao_device:is_exported(Msg2, Dev, set, Opts)),
+	?assert(not hb_ao_device:is_exported(Msg2, Dev, not_exported, Opts)),
     Dev2 = #{
         info =>
             fun() ->
                 #{
-                    exports => [test1, <<"Test2">>],
+                    exports => [test1, <<"test2">>],
                     handler =>
                         fun() ->
                             {ok, <<"Handler-Value">>}
@@ -637,14 +684,14 @@ device_exports_test(Opts) ->
                 }
             end
     },
-    Msg3 = #{ <<"device">> => Dev2, <<"Test1">> => <<"BAD1">>, <<"test3">> => <<"GOOD3">> },
+    Msg3 = #{ <<"device">> => Dev2, <<"test1">> => <<"BAD1">>, <<"test3">> => <<"GOOD3">> },
     ?assertEqual(<<"Handler-Value">>, hb_ao:get(<<"test1">>, Msg3, Opts)),
     ?assertEqual(<<"Handler-Value">>, hb_ao:get(<<"test2">>, Msg3, Opts)),
     ?assertEqual(<<"GOOD3">>, hb_ao:get(<<"test3">>, Msg3, Opts)),
     ?assertEqual(<<"GOOD4">>,
         hb_ao:get(
-            <<"Test4">>,
-            hb_ao:set(Msg3, <<"Test4">>, <<"GOOD4">>, Opts)
+            <<"test4">>,
+            hb_ao:set(Msg3, <<"test4">>, <<"GOOD4">>, Opts)
         )
     ),
     ?assertEqual(not_found, hb_ao:get(<<"test5">>, Msg3, Opts)).
@@ -663,19 +710,19 @@ device_excludes_test(Opts) ->
             end
     },
     Msg = #{ <<"device">> => Dev, <<"Test-Key">> => <<"Test-Value">> },
-    ?assert(hb_ao:is_exported(Msg, Dev, <<"test-key2">>, Opts)),
-    ?assert(not hb_ao:is_exported(Msg, Dev, set, Opts)),
+    ?assert(hb_ao_device:is_exported(Msg, Dev, <<"test-key2">>, Opts)),
+    ?assert(not hb_ao_device:is_exported(Msg, Dev, set, Opts)),
     ?assertEqual(<<"Handler-Value">>, hb_ao:get(<<"test-key2">>, Msg, Opts)),
     ?assertMatch(#{ <<"test-key2">> := <<"2">> },
         hb_ao:set(Msg, <<"test-key2">>, <<"2">>, Opts)).
 
 denormalized_device_key_test(Opts) ->
-	Msg = #{ <<"Device">> => dev_test },
+	Msg = #{ <<"device">> => dev_test },
 	?assertEqual(dev_test, hb_ao:get(device, Msg, Opts)),
 	?assertEqual(dev_test, hb_ao:get(<<"device">>, Msg, Opts)),
 	?assertEqual({module, dev_test},
 		erlang:fun_info(
-            element(3, hb_ao:message_to_fun(Msg, test_func, Opts)),
+            element(3, hb_ao_device:message_to_fun(Msg, test_func, Opts)),
             module
         )
     ).
@@ -772,6 +819,34 @@ continue_as_test(Opts) ->
         )
     ).
 
+multiple_as_subresolutions_test(Opts) ->
+    % Test that multiple as subresolutions in a sequence are handled correctly.
+    Msg = #{
+        <<"device">> => <<"test-device@1.0">>,
+        <<"test-message">> =>
+            #{
+                <<"test-key">> => <<"MESSAGE-1">>,
+                <<"test-message-2">> =>
+                    #{ <<"test-key-2">> => <<"MESSAGE-2">> }
+            }
+    },
+    Res = hb_ao:resolve_many(
+        [
+            {as, <<"message@1.0">>, Msg},
+            #{ <<"path">> => <<"test-message">> },
+            #{ <<"path">> => <<"test-message-2">>, <<"extraneous">> => <<"1">> },
+            <<"test-key-2">>
+        ],
+        Opts
+    ),
+    ?assertEqual({ok, <<"MESSAGE-2">>}, Res),
+    % Attempt to resolve a sequence of more complex messages.
+    Path = <<"/~meta@1.0/info/~hyperbuddy@1.0/format">>,
+    Parsed = hb_singleton:from(Path, Opts),
+    ?event(subresolution, {parsed_sequence, Parsed}),
+    Res2 = hb_ao:resolve(Path, Opts),
+    ?assertMatch({ok, #{ <<"body">> := Bin }} when is_binary(Bin), Res2).
+
 step_hook_test(InitOpts) ->
     % Test that the step hook is called correctly. We do this by sending ourselves
     % a message each time the hook is called. We also send a `reference', such 
@@ -816,4 +891,114 @@ step_hook_test(InitOpts) ->
         )
     ),
     % Test that the step hook was called.
-    ?assert(receive {step, Ref} -> true after 100 -> false end).
\ No newline at end of file
+    ?assert(receive {step, Ref} -> true after 100 -> false end).
+
+%%% Benchmark tests
+benchmark_simple_test(Opts) ->
+    Time =
+        hb_test_utils:benchmark_iterations(
+            fun(I) -> hb_ao:resolve(#{ <<"a">> => I }, <<"a">>, Opts) end,
+            ?BENCHMARK_ITERATIONS
+        ),
+    hb_test_utils:benchmark_print(
+        <<"Single-step resolutions:">>,
+        ?BENCHMARK_ITERATIONS,
+        Time
+    ).
+
+benchmark_multistep_test(Opts) ->
+    Time =
+        hb_test_utils:benchmark_iterations(
+            fun(I) ->
+                hb_ao:resolve(
+                    #{
+                        <<"iteration">> => I,
+                        <<"a">> => #{
+                            <<"b">> => #{ <<"return">> => I }
+                        }
+                    },
+                    <<"a/b/return">>,
+                    Opts
+                )
+            end,
+            ?BENCHMARK_ITERATIONS
+        ),
+    hb_test_utils:benchmark_print(
+        <<"Multistep resolutions:">>,
+        ?BENCHMARK_ITERATIONS,
+        Time
+    ).
+
+benchmark_get_test(Opts) ->
+    Time =
+        hb_test_utils:benchmark_iterations(
+            fun(I) ->
+                hb_ao:get(
+                    <<"a">>,
+                    #{ <<"a">> => <<"1">>, <<"iteration">> => I },
+                    Opts
+                )
+            end,
+            ?BENCHMARK_ITERATIONS
+        ),
+    hb_test_utils:benchmark_print(
+        <<"Get operations:">>,
+        ?BENCHMARK_ITERATIONS,
+        Time
+    ).
+
+benchmark_set_test(Opts) ->
+    Time =
+        hb_test_utils:benchmark_iterations(
+            fun(I) ->
+                hb_ao:set(
+                    #{ <<"a">> => <<"1">>, <<"iteration">> => I },
+                    <<"a">>,
+                    <<"2">>,
+                    Opts
+                )
+            end,
+            ?BENCHMARK_ITERATIONS
+        ),
+    hb_test_utils:benchmark_print(
+        <<"Single value set operations:">>,
+        ?BENCHMARK_ITERATIONS,
+        Time
+    ).
+
+benchmark_set_multiple_test(Opts) ->
+    Time =
+        hb_test_utils:benchmark_iterations(
+            fun(I) ->
+                hb_ao:set(
+                    #{ <<"a">> => <<"1">>, <<"iteration">> => I },
+                    #{ <<"a">> => <<"1a">>, <<"b">> => <<"2">> },
+                    Opts
+                )
+            end,
+            ?BENCHMARK_ITERATIONS
+        ),
+    hb_test_utils:benchmark_print(
+        <<"Set two keys operations:">>,
+        ?BENCHMARK_ITERATIONS,
+        Time
+    ).
+
+
+benchmark_set_multiple_deep_test(Opts) ->
+    Time =
+        hb_test_utils:benchmark_iterations(
+            fun(I) ->
+                hb_ao:set(
+                    #{ <<"a">> => #{ <<"b">> => <<"1">> } },
+                    #{ <<"a">> => #{ <<"b">> => <<"2">>, <<"c">> => I } },
+                    Opts
+                )
+            end,
+            ?BENCHMARK_ITERATIONS
+        ),
+    hb_test_utils:benchmark_print(
+        <<"Set two keys operations:">>,
+        ?BENCHMARK_ITERATIONS,
+        Time
+    ).
\ No newline at end of file
diff --git a/src/hb_beamr.erl b/src/hb_beamr.erl
index 4cfb8e0ce..76020500b 100644
--- a/src/hb_beamr.erl
+++ b/src/hb_beamr.erl
@@ -311,7 +311,7 @@ benchmark_test() ->
     BenchTime = 1,
     {ok, File} = file:read_file("test/test-64.wasm"),
     {ok, WASM, _ImportMap, _Exports} = start(File),
-    Iterations = hb:benchmark(
+    Iterations = hb_test_utils:benchmark(
         fun() ->
             {ok, [Result]} = call(WASM, "fac", [5.0]),
             ?assertEqual(120.0, Result)
@@ -320,8 +320,10 @@ benchmark_test() ->
     ),
     ?event(benchmark, {scheduled, Iterations}),
     ?assert(Iterations > 1000),
-    hb_util:eunit_print(
-        "Executed ~s calls through Beamr in ~p seconds (~.2f call/s)",
-        [hb_util:human_int(Iterations), BenchTime, Iterations / BenchTime]
+    hb_test_utils:benchmark_print(
+        <<"Direct beamr: Executed">>,
+        <<"calls">>,
+        Iterations,
+        BenchTime
     ),
     ok.
\ No newline at end of file
diff --git a/src/hb_cache.erl b/src/hb_cache.erl
index 6665343c4..4cf036555 100644
--- a/src/hb_cache.erl
+++ b/src/hb_cache.erl
@@ -20,22 +20,155 @@
 %%% Before writing a message to the store, we convert it to Type-Annotated
 %%% Binary Messages (TABMs), such that each of the keys in the message is
 %%% either a map or a direct binary.
+%%% 
+%%% Nested keys are lazily loaded from the stores, such that large deeply
+%%% nested messages where only a small part of the data is actually used are
+%%% not loaded into memory unnecessarily. In order to ensure that a message is
+%%% loaded from the cache after a `read', we can use the `ensure_loaded/1' and
+%%% `ensure_all_loaded/1' functions. Ensure loaded will load the exact value
+%%% that has been requested, while ensure all loaded will load the entire 
+%%% structure of the message into memory.
+%%% 
+%%% Lazily loadable `links' are expressed as a tuple of the following form:
+%%% `{link, ID, LinkOpts}', where `ID' is the path to the data in the store,
+%%% and `LinkOpts' is a map of suggested options to use when loading the data.
+%%% In particular, this module ensures to stash the `store' option in `LinkOpts',
+%%% such that the `read' function can use the correct store without having to
+%%% search unnecessarily. By providing an `Opts' argument to `ensure_loaded' or
+%%% `ensure_all_loaded', the caller can specify additional options to use when
+%%% loading the data -- overriding the suggested options in the link.
 -module(hb_cache).
+-export([ensure_loaded/1, ensure_loaded/2, ensure_all_loaded/1, ensure_all_loaded/2]).
 -export([read/2, read_resolved/3, write/2, write_binary/3, write_hashpath/2, link/3]).
--export([list/2, list_numbered/2]).
+-export([match/2, list/2, list_numbered/2]).
 -export([test_unsigned/1, test_signed/1]).
 -include("include/hb.hrl").
 -include_lib("eunit/include/eunit.hrl").
 
+%% @doc Ensure that a value is loaded from the cache if it is an ID or a link.
+%% If it is not loadable we raise an error. If the value is a message, we will
+%% load only the first `layer' of it: Representing all nested messages inside 
+%% the result as links. If the value has an associated `type' key in the extra
+%% options, we apply it to the read value, 'lazily' recreating a `structured@1.0'
+%% form.
+ensure_loaded(Msg) ->
+    ensure_loaded(Msg, #{}).
+ensure_loaded(Msg, Opts) ->
+    ensure_loaded([], Msg, Opts).
+ensure_loaded(Ref, {Status, Msg}, Opts) when Status == ok; Status == error ->
+    {Status, ensure_loaded(Ref, Msg, Opts)};
+ensure_loaded(Ref,
+        Lk = {link, ID, LkOpts = #{ <<"type">> := <<"link">>, <<"lazy">> := Lazy }},
+        RawOpts) ->
+    % The link is to a submessage; either in lazy (unresolved) form, or direct
+    % form.
+    UnscopedOpts = hb_util:deep_merge(RawOpts, LkOpts, RawOpts),
+    Opts = hb_store:scope(UnscopedOpts, hb_opts:get(scope, local, LkOpts)),
+    Store = hb_opts:get(store, no_viable_store, Opts),
+    ?event(debug_cache,
+        {loading_multi_link,
+            {link, ID},
+            {link_opts, LkOpts},
+            {store, Store}
+        }
+    ),
+    case hb_cache:read(ID, hb_util:deep_merge(Opts, LkOpts, Opts)) of
+        {ok, Next} ->
+            ?event(debug_cache,
+                {loaded,
+                    {link, ID},
+                    {store, Store}
+                }),
+            case Lazy of
+                true ->
+                    % We have resolved the ID of the submessage, so we continue
+                    % to load the submessage itself.
+                    ensure_loaded(
+                        {link,
+                            Next,
+                            #{
+                                <<"type">> => <<"link">>,
+                                <<"lazy">> => false
+                            }
+                        },
+                        Opts
+                    );
+                false ->
+                    % The already had the ID of the submessage, so now we have
+                    % the data, we simply return it.
+                    Next
+            end;
+        not_found ->
+            report_ensure_loaded_not_found(Ref, Lk, Opts)
+    end;
+ensure_loaded(Ref, Link = {link, ID, LinkOpts = #{ <<"lazy">> := true }}, RawOpts) ->
+    % If the user provided their own options, we merge them and _overwrite_
+    % the options that are already set in the link.
+    UnscopedOpts = hb_util:deep_merge(RawOpts, LinkOpts, RawOpts),
+    Opts = hb_store:scope(UnscopedOpts, hb_opts:get(scope, local, LinkOpts)),
+    case hb_cache:read(ID, Opts) of
+        {ok, LoadedMsg} ->
+            ?event(caching,
+                {lazy_loaded,
+                    {link, ID},
+                    {msg, LoadedMsg},
+                    {link_opts, LinkOpts}
+                }
+            ),
+            case hb_maps:get(<<"type">>, LinkOpts, undefined, Opts) of
+                undefined -> LoadedMsg;
+                Type -> dev_codec_structured:decode_value(Type, LoadedMsg)
+            end;
+        not_found ->
+            report_ensure_loaded_not_found(Ref, Link, Opts)
+    end;
+ensure_loaded(Ref, {link, ID, LinkOpts}, Opts) ->
+	ensure_loaded(Ref, {link, ID, LinkOpts#{ <<"lazy">> => true}}, Opts);
+ensure_loaded(_Ref, Msg, _Opts) when not ?IS_LINK(Msg) ->
+    Msg.
+
+%% @doc Report that a value was not found in the cache. If a key is provided,
+%% we report that the key was not found, otherwise we report that the link was
+%% not found.
+report_ensure_loaded_not_found(Ref, Lk, Opts) ->
+    ?event(link_error, {link_not_resolvable, {ref, Ref}, {link, Lk}, {opts, Opts}}),
+    throw(
+        {necessary_message_not_found,
+            hb_path:to_binary(lists:reverse(Ref)),
+            hb_link:format_unresolved(Lk, Opts, 0)
+        }
+    ).
+
+%% @doc Ensure that all of the components of a message (whether a map, list,
+%% or immediate value) are recursively fully loaded from the stores into memory.
+%% This is a catch-all function that is useful in situations where ensuring a
+%% message contains no links is important, but it carries potentially extreme
+%% performance costs.
+ensure_all_loaded(Msg) ->
+    ensure_all_loaded(Msg, #{}).
+ensure_all_loaded(Msg, Opts) ->
+    ensure_all_loaded([], Msg, Opts).
+ensure_all_loaded(Ref, Link, Opts) when ?IS_LINK(Link) ->
+    ensure_all_loaded(Ref, ensure_loaded(Ref, Link, Opts), Opts);
+ensure_all_loaded(Ref, Msg, Opts) when is_map(Msg) ->
+    maps:map(fun(K, V) -> ensure_all_loaded([K|Ref], V, Opts) end, Msg);
+ensure_all_loaded(Ref, Msg, Opts) when is_list(Msg) ->
+    lists:map(
+        fun({N, V}) -> ensure_all_loaded([N|Ref], V, Opts) end,
+        hb_util:number(Msg)
+    );
+ensure_all_loaded(Ref, Msg, Opts) ->
+    ensure_loaded(Ref, Msg, Opts).
+
 %% @doc List all items in a directory, assuming they are numbered.
 list_numbered(Path, Opts) ->
     SlotDir = hb_store:path(hb_opts:get(store, no_viable_store, Opts), Path),
-    [ to_integer(Name) || Name <- list(SlotDir, Opts) ].
+    [ hb_util:int(Name) || Name <- list(SlotDir, Opts) ].
 
 %% @doc List all items under a given path.
 list(Path, Opts) when is_map(Opts) and not is_map_key(<<"store-module">>, Opts) ->
     case hb_opts:get(store, no_viable_store, Opts) of
-        no_viable_store -> [];
+        not_found -> [];
         Store ->
             list(Path, Store)
     end;
@@ -44,9 +177,32 @@ list(Path, Store) ->
     case hb_store:list(Store, ResolvedPath) of
         {ok, Names} -> Names;
         {error, _} -> [];
-        no_viable_store -> []
+        not_found -> []
+    end.
+
+%% @doc Match a template message against the cache, returning a list of IDs
+%% that match the template. We match on the binary representation of values,
+%% rather than their types explicitly, such that 'AO-Types' keys that are
+%% only partial matches do not cause the match to fail.
+match(MatchSpec, Opts) ->
+    Spec = hb_message:convert(MatchSpec, tabm, <<"structured@1.0">>, Opts),
+    ConvertedMatchSpec =
+        maps:map(
+            fun(_, Value) ->
+                generate_binary_path(Value, Opts)
+            end,
+            maps:without([<<"ao-types">>], hb_ao:normalize_keys(Spec, Opts))
+        ),
+    case hb_store:match(hb_opts:get(store, no_viable_store, Opts), ConvertedMatchSpec) of
+        {ok, Matches} -> {ok, Matches};
+        _ -> not_found
     end.
 
+%% @doc Generate the path at which a binary value should be stored.
+generate_binary_path(Bin, Opts) ->
+    Hashpath = hb_path:hashpath(Bin, Opts),
+    <<"data/", Hashpath/binary>>.
+
 %% @doc Write a message to the cache. For raw binaries, we write the data at
 %% the hashpath of the data (by default the SHA2-256 hash of the data). We link
 %% the unattended ID's hashpath for the keys (including `/commitments') on the
@@ -58,92 +214,67 @@ list(Path, Store) ->
 %% the commitments of the inner messages. We do not, however, store the IDs from
 %% commitments on signed _inner_ messages. We may wish to revisit this.
 write(RawMsg, Opts) when is_map(RawMsg) ->
-    % Use the _structured_ format for calculating alternative IDs, but the
-    % _tabm_ format for writing to the store.
-    case hb_message:with_only_committed(RawMsg, Opts) of
-        {ok, Msg} ->
-            AllIDs = calculate_all_ids(RawMsg, Opts),
-            ?event({writing_full_message, {all_ids, AllIDs}, {msg, Msg}}),
-            Tabm = hb_message:convert(Msg, tabm, <<"structured@1.0">>, Opts),
-            ?event({tabm, Tabm}),
-            try do_write_message(
-                Tabm,
-                AllIDs,
-                hb_opts:get(store, no_viable_store, Opts),
+    {ok, Msg} = hb_message:with_only_committed(RawMsg, Opts),
+    TABM = hb_message:convert(Msg, tabm, <<"structured@1.0">>, Opts),
+    ?event(debug_cache, {writing_full_message, {msg, TABM}}),
+    try
+        do_write_message(
+            TABM,
+            hb_opts:get(store, no_viable_store, Opts),
+            Opts
+        )
+    catch
+        Type:Reason:Stacktrace ->
+            ?event(error,
+                {cache_write_error,
+                    {type, Type},
+                    {reason, Reason},
+                    {stacktrace, {trace, Stacktrace}}
+                },
                 Opts
-            )
-            catch
-                Type:Reason:Stacktrace ->
-                    ?event(error,
-                        {cache_write_error,
-                            {type, Type},
-                            {reason, Reason},
-                            {stacktrace, Stacktrace}
-                        },
-                        Opts
-                    ),
-                    {error, no_viable_store}
-            end;
-        {error, Err} ->
-            {error, Err}
+            ),
+            erlang:raise(Type, Reason, Stacktrace)
     end;
+write(List, Opts) when is_list(List) ->
+    write(hb_message:convert(List, tabm, <<"structured@1.0">>, Opts), Opts);
 write(Bin, Opts) when is_binary(Bin) ->
-    % When asked to write only a binary, we do not calculate any alternative IDs.
-    do_write_message(Bin, [], hb_opts:get(store, no_viable_store, Opts), Opts).
+    do_write_message(Bin, hb_opts:get(store, no_viable_store, Opts), Opts).
 
-do_write_message(Bin, AllIDs, Store, Opts) when is_binary(Bin) ->
-    % Write the binary in the store at its given hash. Return the path.
-    Hashpath = hb_path:hashpath(Bin, Opts),
-    ok = hb_store:write(Store, Path = <<"data/", Hashpath/binary>>, Bin),
-    lists:map(fun(ID) -> hb_store:make_link(Store, Path, ID) end, AllIDs),
+do_write_message(Bin, Store, Opts) when is_binary(Bin) ->
+    % Write the binary in the store at its calculated content-hash.
+    % Return the path.
+    ok = hb_store:write(Store, Path = generate_binary_path(Bin, Opts), Bin),
+    %lists:map(fun(ID) -> hb_store:make_link(Store, Path, ID) end, AllIDs),
     {ok, Path};
-do_write_message(Msg, AllIDs, Store, Opts) when is_map(Msg) ->
-    % Get the ID of the unsigned message.
-    {ok, UncommittedID} =
-        dev_message:id(Msg, #{ <<"committers">> => <<"none">> }, Opts),
-    AltIDs = AllIDs -- [UncommittedID],
-    ?event({writing_message_with_unsigned_id, UncommittedID, {alt_ids, AltIDs}}),
-    MsgHashpathAlg = hb_path:hashpath_alg(Msg),
-    hb_store:make_group(Store, UncommittedID),
-    % Write the keys of the message into the store, rolling the keys into
-    % hashpaths (having only two parts) as we do so.
-    % We start by writing the group, such that if the message is empty, we
-    % still have a group in the store.
+do_write_message(List, Store, Opts) when is_list(List) ->
+    do_write_message(
+        hb_message:convert(List, tabm, <<"structured@1.0">>, Opts),
+        Store,
+        Opts
+    );
+do_write_message(Msg, Store, Opts) when is_map(Msg) ->
+    ?event(debug_cache, {writing_message, Msg}),
+    % Calculate the IDs of the message.
+    UncommittedID = hb_message:id(Msg, none, Opts#{ linkify_mode => discard }),
+    AltIDs = calculate_all_ids(Msg, Opts) -- [UncommittedID],
+    MsgHashpathAlg = hb_path:hashpath_alg(Msg, Opts),
+    ?event(debug_cache, {writing_message, {id, UncommittedID}, {alt_ids, AltIDs}, {original, Msg}}),
+    % Write all of the keys of the message into the store.
     hb_store:make_group(Store, UncommittedID),
     maps:map(
-        fun(<<"device">>, Map) when is_map(Map) ->
-            ?event(error, {request_to_write_device_map, Map}),
-            throw({device_map_cannot_be_written, Map});
-        (Key, Value) ->
-            ?event({writing_subkey, {key, Key}, {value, Value}}),
-            KeyHashPath =
-                hb_path:hashpath(
-                    UncommittedID,
-                    hb_path:to_binary(Key),
-                    MsgHashpathAlg,
-                    Opts
-                ),
-            ?event({key_hashpath_from_unsigned, KeyHashPath}),
-            ValueAltIDs = calculate_all_ids(Value, Opts),
-            {ok, Path} = do_write_message(Value, ValueAltIDs, Store, Opts),
-            hb_store:make_link(Store, Path, KeyHashPath),
-            ?event(
-                {
-                    {link, KeyHashPath},
-                    {data_path, Path}
-                }
-            ),
-            Path
+        fun(Key, Value) ->
+            write_key(UncommittedID, Key, MsgHashpathAlg, Value, Store, Opts)
         end,
-        hb_private:reset(Msg)
+        maps:without([<<"priv">>], Msg)
     ),
     % Write the commitments to the store, linking each commitment ID to the
     % uncommitted message.
     lists:map(
         fun(AltID) ->
-            ?event({linking_commitment,
-                {uncommitted_id, UncommittedID},
-                {committed_id, AltID}
+            ?event(debug_cache,
+                {linking_commitment,
+                    {uncommitted_id, UncommittedID},
+                    {committed_id, AltID}
             }),
             hb_store:make_link(Store, UncommittedID, AltID)
         end,
@@ -151,15 +282,79 @@ do_write_message(Msg, AllIDs, Store, Opts) when is_map(Msg) ->
     ),
     {ok, UncommittedID}.
 
+%% @doc Write a single key for a message into the store.
+write_key(Base, <<"commitments">>, _HPAlg, RawCommitments, Store, Opts) ->
+    % The commitments are a special case: We calculate the single-part hashpath
+    % for the `baseID/commitments` key, then write each commitment to the store
+    % and link it to `baseCommHP/commitmentID`.
+    Commitments = prepare_commitments(RawCommitments, Opts),
+    CommitmentsBase = commitment_path(Base, Opts),
+    ok = hb_store:make_group(Store, CommitmentsBase),
+    ?event(
+        {writing_commitments,
+            {base, Base},
+            {commitments_message, Commitments},
+            {commitments_base, CommitmentsBase}
+        }
+    ),
+    maps:map(
+        fun(BaseCommID, Commitment) ->
+            ?event(debug_cache, {writing_commitment, {commitment, Commitment}}),
+            {ok, CommMsgID} = do_write_message(Commitment, Store, Opts),
+            hb_store:make_link(
+                Store,
+                CommMsgID,
+                << CommitmentsBase/binary, "/", BaseCommID/binary >>
+            )
+        end,
+        Commitments
+    ),
+    % Link the commitments base to `base/commitments`.
+    hb_store:make_link(Store, CommitmentsBase, <<Base/binary, "/commitments">>);
+write_key(Base, Key, HPAlg, Value, Store, Opts) ->
+    KeyHashPath =
+        hb_path:hashpath(
+            Base,
+            hb_path:to_binary(Key),
+            HPAlg,
+            Opts
+        ),
+    {ok, Path} = do_write_message(Value, Store, Opts),
+    hb_store:make_link(Store, Path, KeyHashPath),
+    {ok, Path}.
+
+%% @doc The `structured@1.0` encoder does not typically encode `commitments`,
+%% subsequently, when we encounter a commitments message we prepare its contents
+%% separately, then write each to the store.
+prepare_commitments(RawCommitments, Opts) ->
+    Commitments = ensure_all_loaded(RawCommitments, Opts),
+    maps:map(
+        fun(_, StructuredCommitment) ->
+            hb_message:convert(StructuredCommitment, tabm, Opts)
+        end,
+        Commitments
+    ).
+
+%% @doc Generate the commitment path for a given base path.
+commitment_path(Base, Opts) ->
+    hb_path:hashpath(<<Base/binary, "/commitments">>, Opts).
+
 %% @doc Calculate the IDs for a message.
 calculate_all_ids(Bin, _Opts) when is_binary(Bin) -> [];
-calculate_all_ids(Msg, _Opts) ->
+calculate_all_ids(Msg, Opts) ->
     Commitments =
-        maps:without(
+        hb_maps:without(
             [<<"priv">>],
-            maps:get(<<"commitments">>, Msg, #{})
+            hb_maps:get(<<"commitments">>, Msg, #{}, Opts),
+			Opts
         ),
-    maps:keys(Commitments).
+    CommIDs = hb_maps:keys(Commitments, Opts),
+    ?event({calculating_ids, {msg, Msg}, {commitments, Commitments}, {comm_ids, CommIDs}}),
+    All = hb_message:id(Msg, all, Opts#{ linkify_mode => discard }),
+    case lists:member(All, CommIDs) of
+        true -> CommIDs;
+        false -> [All | CommIDs]
+    end.
 
 %% @doc Write a hashpath and its message to the store and link it.
 write_hashpath(Msg = #{ <<"priv">> := #{ <<"hashpath">> := HP } }, Opts) ->
@@ -178,116 +373,316 @@ write_binary(Hashpath, Bin, Opts) ->
     write_binary(Hashpath, Bin, hb_opts:get(store, no_viable_store, Opts), Opts).
 write_binary(Hashpath, Bin, Store, Opts) ->
     ?event({writing_binary, {hashpath, Hashpath}, {bin, Bin}, {store, Store}}),
-    {ok, Path} = do_write_message(Bin, [Hashpath], Store, Opts),
+    {ok, Path} = do_write_message(Bin, Store, Opts),
+    hb_store:make_link(Store, Path, Hashpath),
     {ok, Path}.
 
 %% @doc Read the message at a path. Returns in `structured@1.0' format: Either a
 %% richly typed map or a direct binary.
 read(Path, Opts) ->
-    case store_read(Path, hb_opts:get(store, no_viable_store, Opts), Opts) of
-        not_found -> not_found;
-        {ok, Res} ->
-            ?event({applying_types_to_read_message, Res}),
-            Structured = dev_codec_structured:to(Res),
-            ?event({finished_read, Structured}),
-            {ok, Structured}
-    end.
+    store_read(Path, hb_opts:get(store, no_viable_store, Opts), Opts).
 
-%% @doc List all of the subpaths of a given path, read each in turn, returning a
-%% flat map. We track the paths that we have already read to avoid circular
-%% links.
-store_read(Path, Store, Opts) ->
-    store_read(Path, Store, Opts, []).
-store_read(_Path, no_viable_store, _, _AlreadyRead) ->
+%% @doc List all of the subpaths of a given path and return a map of keys and
+%% links to the subpaths, including their types.
+store_read(_Path, no_viable_store, _) ->
     not_found;
-store_read(Path, Store, Opts, AlreadyRead) ->
-    case lists:member(Path, AlreadyRead) of
-        true ->
-            ?event(read_error,
-                {circular_links_detected,
-                    {path, Path},
-                    {already_read, AlreadyRead}
-                }
-            ),
-            throw({circular_links_detected, Path, {already_read, AlreadyRead}});
-        false ->
-            do_read(Path, Store, Opts, AlreadyRead)
-    end.
-
-%% @doc Read a path from the store. Unsafe: May recurse indefinitely if circular
-%% links are present.
-do_read(Path, Store, Opts, AlreadyRead) ->
-    ResolvedFullPath = hb_store:resolve(Store, PathToBin = hb_path:to_binary(Path)),
-    ?event({reading, {path, PathToBin}, {resolved, ResolvedFullPath}}),
+store_read(Path, Store, Opts) ->
+    ResolvedFullPath = hb_store:resolve(Store, PathBin = hb_path:to_binary(Path)),
+    ?event({reading,
+        {original_path, {string, PathBin}},
+        {fully_resolved_path, ResolvedFullPath},
+        {store, Store}
+    }),
     case hb_store:type(Store, ResolvedFullPath) of
         not_found -> not_found;
-        no_viable_store -> not_found;
         simple ->
+            ?event({reading_data, ResolvedFullPath}),
             case hb_store:read(Store, ResolvedFullPath) of
                 {ok, Bin} -> {ok, Bin};
-                {error, _} -> not_found
+                not_found -> not_found
             end;
-        _ ->
+        composite ->
+            ?event({reading_composite, ResolvedFullPath}),
             case hb_store:list(Store, ResolvedFullPath) of
-                {ok, Subpaths} ->
+                {ok, RawSubpaths} ->
+                    Subpaths =
+                        lists:map(fun hb_util:bin/1, RawSubpaths),
                     ?event(
                         {listed,
                             {original_path, Path},
                             {subpaths, {explicit, Subpaths}}
                         }
                     ),
-                    Msg =
-                        maps:from_list(
-                            lists:map(
-                                fun(Subpath) ->
-                                    ?event({reading_subpath, {path, Subpath}, {store, Store}}),
-                                    Res = store_read(
-                                        [ResolvedFullPath, Subpath],
-                                        Store,
-                                        Opts,
-                                        [ResolvedFullPath | AlreadyRead]
-                                    ),
-                                    case Res of
-                                        not_found ->
-                                            ?event(error,
-                                                {subpath_not_found,
-                                                    {parent, Path},
-                                                    {resolved_parent, {string, ResolvedFullPath}},
-                                                    {subpath, Subpath},
-                                                    {all_subpaths, Subpaths},
-                                                    {store, Store}
-                                                }
-                                            ),
-                                            TriedPath = hb_path:to_binary([ResolvedFullPath, Subpath]),
-                                            throw({subpath_not_found,
-                                                {parent, Path},
-                                                {resolved_parent, ResolvedFullPath},
-                                                {failed_path, TriedPath}
-                                            });
-                                        {ok, Data} ->
-                                            {iolist_to_binary([Subpath]), Data}
-                                    end
-                                end,
-                                Subpaths
-                            )
-                        ),
-                    ?event({read_message, Msg}),
+                    % Generate links for all subpaths except `commitments' and
+                    % `ao-types'. `commitments' is always read in its entirety,
+                    % such that all messages have their IDs and signatures
+                    % locally available.
+                    Msg = prepare_links(ResolvedFullPath, Subpaths, Store, Opts),
+                    ?event(
+                        {completed_read,
+                            {resolved_path, ResolvedFullPath},
+                            {explicit, Msg}
+                        }
+                    ),
                     {ok, Msg};
-                _ -> not_found
+                _ ->
+                    ?event({empty_composite_message, ResolvedFullPath}),
+                    {ok, #{}}
             end
     end.
 
-%% @doc Read the output of a prior computation, given Msg1, Msg2, and some
-%% options.
-read_resolved(MsgID1, MsgID2, Opts) when ?IS_ID(MsgID1) and ?IS_ID(MsgID2) ->
-    ?event({cache_lookup, {msg1, MsgID1}, {msg2, MsgID2}, {opts, Opts}}),
-    read(<<MsgID1/binary, "/", MsgID2/binary>>, Opts);
-read_resolved(MsgID1, Msg2, Opts) when ?IS_ID(MsgID1) and is_map(Msg2) ->
-    {ok, MsgID2} = dev_message:id(Msg2, #{ <<"committers">> => <<"all">> }, Opts),
-    read(<<MsgID1/binary, "/", MsgID2/binary>>, Opts);
-read_resolved(Msg1, Msg2, Opts) when is_map(Msg1) and is_map(Msg2) ->
-    read(hb_path:hashpath(Msg1, Msg2, Opts), Opts);
-read_resolved(_, _, _) -> not_found.
+%% @doc Prepare a set of links from a listing of subpaths.
+prepare_links(RootPath, Subpaths, Store, Opts) ->
+    {ok, Implicit, Types} = read_ao_types(RootPath, Subpaths, Store, Opts),
+    Res =
+        maps:from_list(lists:filtermap(
+            fun(<<"ao-types">>) -> false;
+                (<<"commitments">>) ->
+                    % List the commitments for this message, and load them into
+                    % memory. If there no commitments at the path, we exclude
+                    % commitments from the list of links.
+                    CommPath =
+                        hb_store:resolve(
+                            Store,
+                            hb_store:path(Store, [RootPath, <<"commitments">>])
+                        ),
+                    ?event(
+                        {reading_commitments,
+                            {root_path, RootPath},
+                            {commitments_path, CommPath}
+                        }
+                    ),
+                    case hb_store:list(Store, CommPath) of
+                        {ok, CommitmentIDs} ->
+                            ?event(
+                                {found_commitments,
+                                    {path, CommPath},
+                                    {ids, CommitmentIDs}
+                                }
+                            ),
+                            % We have commitments, so we read each commitment
+                            % into memory, and return it as part of the message.
+                            {
+                                true,
+                                {
+                                    <<"commitments">>,
+                                    maps:from_list(lists:map(
+                                        fun(CommitmentID) ->
+                                            {ok, Commitment} =
+                                                read(
+                                                    <<
+                                                        CommPath/binary,
+                                                        "/",
+                                                        CommitmentID/binary
+                                                    >>,
+                                                    Opts
+                                                ),
+                                            {
+                                                CommitmentID,
+                                                ensure_all_loaded(
+                                                    Commitment,
+                                                    Opts
+                                                )
+                                            }
+                                        end,
+                                        CommitmentIDs
+                                    ))
+                                }
+                            };
+                        _ ->
+                            false
+                    end;
+                (Subpath) ->
+                    ?event(
+                        {returning_link,
+                            {subpath, Subpath}
+                        }
+                    ),
+                    SubkeyPath = hb_store:path(Store, [RootPath, Subpath]),
+                    case hb_link:is_link_key(Subpath) of
+                        false ->
+                            % The key is a literal value, not a nested composite
+                            % message. Subsequently, we return a resolvable link
+                            % to the subpath, leaving the key as-is.
+                            {true,
+                                {
+                                    Subpath,
+                                    {link,
+                                        SubkeyPath,
+                                        (case Types of
+                                            #{ Subpath := Type } ->
+                                                % We have an `ao-types' entry for the
+                                                % subpath, so we return a link to the
+                                                % subpath with `lazy' set to `true'
+                                                % because we need to resolve the link
+                                                % to get the final value.
+                                                #{
+                                                    <<"type">> => Type,
+                                                    <<"lazy">> => true
+                                                };
+                                            _ ->
+                                                % We do not have an `ao-types' entry for the
+                                                % subpath, so we return a link to the
+                                                % subpath with `lazy' set to `true',
+                                                % because the subpath is a literal
+                                                % value.
+                                                #{
+                                                    <<"lazy">> => true
+                                                }
+                                        end)#{ store => Store }
+                                    }
+                                }
+                            };
+                        true ->
+                            % The key is an encoded link, so we create a resolvable
+                            % link to the underlying link. This requires that we
+                            % dereference the link twice in order to get the final
+                            % value. Returning the data this way avoids having to
+                            % read each of the link keys themselves, which may be
+                            % a large quantity.
+                            {true,
+                                {
+                                    binary:part(Subpath, 0, byte_size(Subpath) - 5),
+                                    {link, SubkeyPath, #{
+                                        <<"type">> => <<"link">>,
+                                        <<"lazy">> => true
+                                    }}
+                                }
+                            }
+                    end
+                end,
+            Subpaths
+        )),
+    Merged = maps:merge(Res, Implicit),
+    % Convert the message to an ordered list if the ao-types indicate that it
+    % should be so.
+    case dev_codec_structured:is_list_from_ao_types(Types, Opts) of
+        true ->
+            hb_util:message_to_ordered_list(Merged, Opts);
+        false ->
+            Merged
+    end.
+
+%% @doc Read and parse the ao-types for a given path if it is in the supplied
+%% list of subpaths, returning a map of keys and their types.
+read_ao_types(Path, Subpaths, Store, Opts) ->
+    ?event({reading_ao_types, {path, Path}, {subpaths, {explicit, Subpaths}}}),
+    case lists:member(<<"ao-types">>, Subpaths) of
+        true ->
+            {ok, TypesBin} =
+                hb_store:read(
+                    Store,
+                    hb_store:path(Store, [Path, <<"ao-types">>])
+                ),
+            Types = dev_codec_structured:decode_ao_types(TypesBin, Opts),
+            ?event({parsed_ao_types, {types, Types}}),
+            {ok, types_to_implicit(Types), Types};
+        false ->
+            ?event({no_ao_types_key_found, {path, Path}, {subpaths, Subpaths}}),
+            {ok, #{}, #{}}
+    end.
+
+%% @doc Convert a map of ao-types to an implicit map of types.
+types_to_implicit(Types) ->
+    maps:filtermap(
+        fun(_K, <<"empty-message">>) -> {true, #{}};
+           (_K, <<"empty-list">>) -> {true, []};
+           (_K, <<"empty-binary">>) -> {true, <<>>};
+           (_, _) -> false
+        end,
+        Types
+    ).
+
+%% @doc Read the result of a computation, using hueristics. The supported
+%% hueristics are as follows:
+%% 1. If the base message is an ID, we try to determine if the message has an
+%% if the message has an explicit device. If it does not, we can simply read the
+%% key and return it if it exists, as this is the behavior of `message@1.0'.
+%% 2. If the base message is loaded (a map), we determine if it has an explicit,
+%% non-direct data access device. If it does, we simply read the key from the
+%% message and return it if it exists.
+%% 2. If the message has an explicit device, we attempt to read the hashpath to
+%% see if it has already been computed.
+read_resolved(BaseMsg, Key, Opts) when is_binary(Key) ->
+    read_resolved(BaseMsg, #{ <<"path">> => Key }, Opts);
+read_resolved({link, ID, LinkOpts}, Req, Opts) ->
+    read_resolved(ID, Req, maps:merge(LinkOpts, Opts));
+read_resolved(BaseMsgID, Req = #{ <<"path">> := Key }, Opts) when ?IS_ID(BaseMsgID) ->
+    Store = hb_opts:get(store, no_viable_store, Opts),
+    NormKey = hb_ao:normalize_key(Key, Opts),
+    case hb_ao_device:is_direct_key_access(BaseMsgID, Req, Opts, Store) of
+        unknown -> miss;
+        false ->
+            ?event(read_cached,
+                {found_non_message_device,
+                    {key, NormKey}
+                }
+            ),
+            read_hashpath(BaseMsgID, Req, Opts);
+        true ->
+            % Either the message does not exist in the store, or there is no
+            % explicit device in the message. If the message exists this implies
+            % that the default (`message@1.0`) device will be used to execute
+            % the key. Subsequently, we can simply read the key and return it if
+            % it exists.
+            ?event(read_cached,
+                {skipping_execution_store_lookup,
+                    {base_msg, BaseMsgID},
+                    {key, NormKey}
+                }
+            ),
+            KeyPath = hb_store:resolve(Store, [BaseMsgID, Key]),
+            {hit, read(KeyPath, Opts)}
+    end;
+read_resolved(BaseMsg, Req = #{ <<"path">> := Key }, Opts) when is_map(BaseMsg) ->
+    % The base message is loaded, so we determine if it has an explicit device
+    % and perform a direct lookup if it does not.
+    NormKey = hb_ao:normalize_key(Key, Opts),
+    case hb_ao_device:is_direct_key_access(BaseMsg, Req, Opts) of
+        false -> read_hashpath(BaseMsg, Req, Opts);
+        true ->
+            ?event(read_cached,
+                {skip_execution_memory_lookup,
+                    {path, NormKey}
+                }
+            ),
+            {hit, read_in_memory_key(BaseMsg, NormKey, Opts)}
+    end;
+read_resolved(Base, Req, Opts) ->
+    read_hashpath(Base, Req, Opts).
+
+%% @doc Return a key from an in-memory message, returning the same form as
+%% a store read (`{Status, Value}').
+read_in_memory_key(BaseMsg, NormKey, _Opts) ->
+    % For now, just wrap maps:find.
+    case maps:find(NormKey, BaseMsg) of
+        error ->
+            ?event(read_cached, {key_not_found, {key, NormKey}}),
+            not_found;
+        {ok, Value} ->
+            ?event(read_cached, {key_found, {key, NormKey}}),
+            {ok, Value}
+    end.
+
+%% @doc Read the output of a prior computation, given BaseMsg and Req.
+read_hashpath(BaseMsgID, ReqID, Opts) when ?IS_ID(BaseMsgID) and ?IS_ID(ReqID) ->
+    ?event({cache_lookup, {msg1, BaseMsgID}, {msg2, ReqID}, {opts, Opts}}),
+    case read(<<BaseMsgID/binary, "/", ReqID/binary>>, Opts) of
+        {ok, Msg} -> {hit, {ok, Msg}};
+        not_found -> miss
+    end;
+read_hashpath(BaseMsgID, Req, Opts) when ?IS_ID(BaseMsgID) and is_map(Req) ->
+    {ok, ReqID} = dev_message:id(Req, #{ <<"committers">> => <<"all">> }, Opts),
+    case read(<<BaseMsgID/binary, "/", ReqID/binary>>, Opts) of
+        {ok, Msg} -> {hit, {ok, Msg}};
+        not_found -> miss
+    end;
+read_hashpath(BaseMsg, Req, Opts) when is_map(BaseMsg) and is_map(Req) ->
+    case read(hb_path:hashpath(BaseMsg, Req, Opts), Opts) of
+        {ok, Msg} -> {hit, {ok, Msg}};
+        not_found -> miss
+    end;
+read_hashpath(_, _, _) -> miss.
 
 %% @doc Make a link from one path to another in the store.
 %% Note: Argument order is `link(Src, Dst, Opts)'.
@@ -298,11 +693,6 @@ link(Existing, New, Opts) ->
         New
     ).
 
-to_integer(Value) when is_list(Value) ->
-    list_to_integer(Value);
-to_integer(Value) when is_binary(Value) ->
-    binary_to_integer(Value).
-
 %%% Tests
 
 test_unsigned(Data) ->
@@ -316,35 +706,67 @@ test_signed(Data) -> test_signed(Data, ar_wallet:new()).
 test_signed(Data, Wallet) ->
     hb_message:commit(test_unsigned(Data), Wallet).
 
-test_store_binary(Opts) ->
+test_store_binary(Store) ->
     Bin = <<"Simple unsigned data item">>,
+    ?event(debug_store_test, {store, Store}),
+    Opts = #{ store => Store },
     {ok, ID} = write(Bin, Opts),
     {ok, RetrievedBin} = read(ID, Opts),
     ?assertEqual(Bin, RetrievedBin).
 
-test_store_unsigned_empty_message(Opts) ->
-	Store = hb_opts:get(store, no_viable_store, Opts),
+test_store_unsigned_empty_message(Store) ->
+    ?event(debug_store_test, {store, Store}),
     hb_store:reset(Store),
     Item = #{},
+    Opts = #{ store => Store },
     {ok, Path} = write(Item, Opts),
     {ok, RetrievedItem} = read(Path, Opts),
-    ?event({retrieved_item, {path, {string, Path}}, {item, RetrievedItem}}),
-    ?assert(hb_message:match(Item, RetrievedItem)).
+    ?event(
+        {retrieved_item,
+            {path, {string, Path}},
+            {expected, Item},
+            {got, RetrievedItem}
+        }
+    ),
+    MatchRes = hb_message:match(Item, RetrievedItem, strict, Opts),
+    ?event({match_result, MatchRes}),
+    ?assert(MatchRes).
+
+test_store_unsigned_nested_empty_message(Store) ->
+    ?event(debug_store_test, {store, Store}),
+    hb_store:reset(Store),
+    Item =
+        #{ <<"layer1">> =>
+            #{ <<"layer2">> =>
+                #{ <<"layer3">> =>
+                    #{ <<"a">> => <<"b">>}
+                },
+                <<"layer3b">> => #{ <<"c">> => <<"d">>},
+                <<"layer3c">> => #{}
+            }
+        },
+    Opts = #{ store => Store },
+    {ok, Path} = write(Item, Opts),
+    {ok, RetrievedItem} = read(Path, Opts),
+    ?assert(hb_message:match(Item, RetrievedItem, strict, Opts)).
 
 %% @doc Test storing and retrieving a simple unsigned item
-test_store_simple_unsigned_message(Opts) ->
+test_store_simple_unsigned_message(Store) ->
     Item = test_unsigned(<<"Simple unsigned data item">>),
+    ?event(debug_store_test, {store, Store}),
+    Opts = #{ store => Store },
     %% Write the simple unsigned item
     {ok, _Path} = write(Item, Opts),
     %% Read the item back
     ID = hb_util:human_id(hb_ao:get(id, Item)),
     {ok, RetrievedItem} = read(ID, Opts),
-    ?assert(hb_message:match(Item, RetrievedItem)),
+    ?assert(hb_message:match(Item, RetrievedItem, strict, Opts)),
     ok.
 
-test_store_ans104_message(Opts) ->
-    Store = hb_opts:get(store, no_viable_store, Opts),
+test_store_ans104_message(Store) ->
+    ?event(debug_store_test, {store, Store}),
     hb_store:reset(Store),
+    Opts = #{ store => Store },
     Item = #{ <<"type">> => <<"ANS104">>, <<"content">> => <<"Hello, world!">> },
     Committed = hb_message:commit(Item, hb:wallet()),
     {ok, _Path} = write(Committed, Opts),
@@ -353,43 +775,49 @@ test_store_ans104_message(Opts) ->
     ?event({test_message_ids, {uncommitted, UncommittedID}, {committed, CommittedID}}),
     {ok, RetrievedItem} = read(CommittedID, Opts),
     {ok, RetrievedItemU} = read(UncommittedID, Opts),
-    ?assert(hb_message:match(Committed, RetrievedItem)),
-    ?assert(hb_message:match(Committed, RetrievedItemU)),
+    ?assert(hb_message:match(Committed, RetrievedItem, strict, Opts)),
+    ?assert(hb_message:match(Committed, RetrievedItemU, strict, Opts)),
     ok.
 
 %% @doc Test storing and retrieving a simple unsigned item
-test_store_simple_signed_message(Opts) ->
-    Store = hb_opts:get(store, no_viable_store, Opts),
+test_store_simple_signed_message(Store) ->
+    ?event(debug_store_test, {store, Store}),
+    Opts = #{ store => Store },
     hb_store:reset(Store),
     Wallet = ar_wallet:new(),
     Address = hb_util:human_id(ar_wallet:to_address(Wallet)),
-    Item = test_signed(#{ <<"l2-test-key">> => <<"l2-test-value">> }, Wallet),
-    ?event({writing_message, Item}),
+    Item = test_signed(<<"Simple signed data item">>, Wallet),
+    ?event({writing_test_message, Item}),
     %% Write the simple unsigned item
     {ok, _Path} = write(Item, Opts),
-    %% Read the item back
-    {ok, UID} = dev_message:id(Item, #{ <<"committers">> => <<"none">> }, Opts),
-    {ok, RetrievedItemU} = read(UID, Opts),
-    ?event({retreived_unsigned_message, {expected, Item}, {got, RetrievedItemU}}),
-    ?assert(hb_message:match(Item, RetrievedItemU)),
+    % %% Read the item back
+    % {ok, UID} = dev_message:id(Item, #{ <<"committers">> => <<"none">> }, Opts),
+    % {ok, RetrievedItemUnsig} = read(UID, Opts),
+    % ?event({retreived_unsigned_message, {expected, Item}, {got, RetrievedItemUnsig}}),
+    % MatchRes = hb_message:match(Item, RetrievedItemUnsig, strict, Opts),
+    % ?event({match_result, MatchRes}),
+    % ?assert(MatchRes),
     {ok, CommittedID} = dev_message:id(Item, #{ <<"committers">> => [Address] }, Opts),
-    {ok, RetrievedItemS} = read(CommittedID, Opts),
-    ?assert(hb_message:match(Item, RetrievedItemS)),
+    {ok, RetrievedItemSigned} = read(CommittedID, Opts),
+    ?event({retreived_signed_message, {expected, Item}, {got, RetrievedItemSigned}}),
+    MatchResSigned = hb_message:match(Item, RetrievedItemSigned, strict, Opts),
+    ?event({match_result_signed, MatchResSigned}),
+    ?assert(MatchResSigned),
     ok.
 
 %% @doc Test deeply nested item storage and retrieval
-test_deeply_nested_complex_message(Opts) ->
-    Store = hb_opts:get(store, no_viable_store, Opts),
+test_deeply_nested_complex_message(Store) ->
+    ?event(debug_store_test, {store, Store}),
     hb_store:reset(Store),
     Wallet = ar_wallet:new(),
-    Address = hb_util:human_id(ar_wallet:to_address(Wallet)),
+    Opts = #{ store => Store, priv_wallet => Wallet },
     %% Create nested data
-    Level3SignedSubmessage = test_signed([1,2,3], Wallet),
+    Level3SignedSubmessage = test_signed([1,2,3], Opts#{priv_wallet => Wallet}),
     Outer =
         hb_message:commit(
             #{
                 <<"level1">> =>
-                    hb_message:commit(
+                    InnerSigned = hb_message:commit(
                         #{
                             <<"level2">> =>
                                 #{
@@ -401,58 +829,141 @@ test_deeply_nested_complex_message(Opts) ->
                             <<"g">> => [<<"h">>, <<"i">>],
                             <<"j">> => 1337
                         },
-                        ar_wallet:new()
+                        Opts
                     ),
                 <<"a">> => <<"b">>
             },
-            Wallet
+            Opts
         ),
-    {ok, UID} = dev_message:id(Outer, #{ <<"committers">> => <<"none">> }, Opts),
+    UID = hb_message:id(Outer, none, Opts),
     ?event({string, <<"================================================">>}),
-    {ok, CommittedID} = dev_message:id(Outer, #{ <<"committers">> => [Address] }, Opts),
+    CommittedID = hb_message:id(Outer, signed, Opts),
     ?event({string, <<"================================================">>}),
     ?event({test_message_ids, {uncommitted, UID}, {committed, CommittedID}}),
     %% Write the nested item
     {ok, _} = write(Outer, Opts),
     %% Read the deep value back using subpath
-    {ok, DeepMsg} =
-        read(
-            [
-                OuterID = hb_util:human_id(UID),
-                <<"level1">>,
-                <<"level2">>,
-                <<"level3">>
-            ],
-            Opts
-        ),
-    ?event({deep_message, DeepMsg}),
-    %% Assert that the retrieved item matches the original deep value
-    ?assertEqual([1,2,3], hb_ao:get(<<"other-test-key">>, DeepMsg)),
-    ?event({deep_message_match, {read, DeepMsg}, {write, Level3SignedSubmessage}}),
-    ?assert(hb_message:match(Level3SignedSubmessage, DeepMsg)),
+	OuterID = hb_util:human_id(UID),
     {ok, OuterMsg} = read(OuterID, Opts),
-    ?assert(hb_message:match(Outer, OuterMsg)),
+	EnsuredLoadedOuter = hb_cache:ensure_all_loaded(OuterMsg, Opts),
+    ?event({deep_message, {explicit, EnsuredLoadedOuter}}),
+    %% Assert that the retrieved item matches the original deep value
+    ?assertEqual(
+        [1,2,3],
+        hb_ao:get(
+            <<"level1/level2/level3/other-test-key">>,
+            EnsuredLoadedOuter,
+            Opts
+        )
+    ),
+    ?event(
+        {deep_message_match,
+            {read, EnsuredLoadedOuter},
+            {write, Level3SignedSubmessage}
+        }
+    ),
     ?event({reading_committed_outer, {id, CommittedID}, {expect, Outer}}),
     {ok, CommittedMsg} = read(hb_util:human_id(CommittedID), Opts),
-    ?assert(hb_message:match(Outer, CommittedMsg)).
+	EnsuredLoadedCommitted = hb_cache:ensure_all_loaded(CommittedMsg, Opts),
+	?assertEqual(
+        [1,2,3],
+        hb_ao:get(
+            <<"level1/level2/level3/other-test-key">>,
+            EnsuredLoadedCommitted,
+            Opts
+        )
+    ).
 
-test_message_with_message(Opts) ->
-    Store = hb_opts:get(store, no_viable_store, Opts),
+test_message_with_list(Store) ->
     hb_store:reset(Store),
+    Opts = #{ store => Store },
     Msg = test_unsigned([<<"a">>, <<"b">>, <<"c">>]),
     ?event({writing_message, Msg}),
     {ok, Path} = write(Msg, Opts),
     {ok, RetrievedItem} = read(Path, Opts),
-    ?assert(hb_message:match(Msg, RetrievedItem)).
+    ?assert(hb_message:match(Msg, RetrievedItem, strict, Opts)).
+
+test_match_message(Store) when map_get(<<"store-module">>, Store) =/= hb_store_lmdb ->
+    skip;
+test_match_message(Store) ->
+    hb_store:reset(Store),
+    Opts = #{ store => Store },
+    % Write two messages that match the template, and a third that does not.
+    {ok, ID1} = hb_cache:write(#{ <<"x">> => <<"1">> }, Opts),
+    {ok, ID2} = hb_cache:write(#{ <<"y">> => <<"2">>, <<"z">> => <<"3">> }, Opts),
+    {ok, ID2b} = hb_cache:write(#{ <<"x">> => <<"4">>, <<"z">> => <<"3">> }, Opts),
+    {ok, ID3} = hb_cache:write(#{ <<"z">> => <<"5">>, <<"c">> => <<"d">> }, Opts),
+    % Match the template, and ensure that we get two matches.
+    {ok, MatchedItems} = match(#{ <<"z">> => <<"3">> }, Opts),
+    ?assertEqual(2, length(MatchedItems)),
+    ?assert(
+        lists:all(
+            fun(ID) ->
+                {ok, Msg} = read(ID, Opts),
+                hb_maps:get(<<"z">>, Msg, Opts) =:= <<"3">> andalso
+                    lists:member(ID, [ID2, ID2b])
+            end,
+            MatchedItems
+        )
+    ),
+    {ok, MatchedItems2} = match(#{ <<"x">> => <<"4">> }, Opts),
+    ?assertEqual(1, length(MatchedItems2)),
+    ?assertEqual([ID2b], MatchedItems2).
+
+test_match_linked_message(Store) when map_get(<<"store-module">>, Store) =/= hb_store_lmdb ->
+    skip;
+test_match_linked_message(Store) ->
+    hb_store:reset(Store),
+    Opts = #{ store => Store },
+    Msg = #{ <<"a">> => Inner = #{ <<"b">> => <<"c">>, <<"d">> => <<"e">> } },
+    {ok, _ID} = write(Msg, Opts),
+    {ok, [MatchedID]} = match(#{ <<"b">> => <<"c">> }, Opts),
+    {ok, Read1} = read(MatchedID, Opts),
+    ?assertEqual(
+        #{ <<"b">> => <<"c">>, <<"d">> => <<"e">> },
+        hb_cache:ensure_all_loaded(Read1, Opts)
+    ),
+    {ok, [MatchedID2]} = match(#{ <<"a">> => Inner }, Opts),
+    {ok, Read2} = read(MatchedID2, Opts),
+    ?assertEqual(#{ <<"a">> => Inner }, ensure_all_loaded(Read2, Opts)).
+
+test_match_typed_message(Store) when map_get(<<"store-module">>, Store) =/= hb_store_lmdb ->
+    skip;
+test_match_typed_message(Store) ->
+    hb_store:reset(Store),
+    Opts = #{ store => Store },
+    % Add some messages that should not match the template, as well as the main
+    % message that should match the template.
+    write(#{ <<"atom-value">> => atom, <<"wrong">> => <<"wrong">> }, Opts),
+    write(#{ <<"integer-value">> => 1337, <<"wrong">> => <<"wrong-2">> }, Opts),
+    Msg =
+        #{
+            <<"int-key">> => 1337,
+            <<"other-key">> => <<"other-test-value">>,
+            <<"atom-key">> => atom
+        },
+    {ok, _ID} = write(Msg, Opts),
+    {ok, [MatchedID]} = match(#{ <<"int-key">> => 1337 }, Opts),
+    {ok, Read1} = read(MatchedID, Opts),
+    ?assertEqual(Msg, ensure_all_loaded(Read1, Opts)),
+    {ok, [MatchedID2]} = match(#{ <<"atom-key">> => atom }, Opts),
+    {ok, Read2} = read(MatchedID2, Opts),
+    ?assertEqual(Msg, ensure_all_loaded(Read2, Opts)).
 
 cache_suite_test_() ->
     hb_store:generate_test_suite([
-        {"store unsigned empty message", fun test_store_unsigned_empty_message/1},
+        {"store unsigned empty message",
+            fun test_store_unsigned_empty_message/1},
         {"store binary", fun test_store_binary/1},
+        {"store unsigned nested empty message",
+            fun test_store_unsigned_nested_empty_message/1},
         {"store simple unsigned message", fun test_store_simple_unsigned_message/1},
         {"store simple signed message", fun test_store_simple_signed_message/1},
         {"deeply nested complex message", fun test_deeply_nested_complex_message/1},
-        {"message with message", fun test_message_with_message/1}
+        {"message with list", fun test_message_with_list/1},
+        {"match message", fun test_match_message/1},
+        {"match linked message", fun test_match_linked_message/1},
+        {"match typed message", fun test_match_typed_message/1}
     ]).
 
 %% @doc Test that message whose device is `#{}' cannot be written. If it were to
@@ -460,7 +971,7 @@ cache_suite_test_() ->
 test_device_map_cannot_be_written_test() ->
     try
         Opts = #{ store => StoreOpts =
-            [#{ <<"store-module">> => hb_store_fs, <<"prefix">> => <<"cache-TEST">> }] },
+            [#{ <<"store-module">> => hb_store_fs, <<"name">> => <<"cache-TEST">> }] },
         hb_store:reset(StoreOpts),
         Danger = #{ <<"device">> => #{}},
         write(Danger, Opts),
@@ -469,7 +980,7 @@ test_device_map_cannot_be_written_test() ->
         _:_:_ -> ?assert(true)
     end.
 
+%% @doc Run a specific test with a given store module.
 run_test() ->
-    Opts = #{ store => StoreOpts = 
-        [#{ <<"store-module">> => hb_store_fs, <<"prefix">> => <<"cache-TEST">> }]},
-    test_store_unsigned_empty_message(Opts).
\ No newline at end of file
+    Store = hb_test_utils:test_store(hb_store_lmdb),
+    test_match_message(Store).
\ No newline at end of file
diff --git a/src/hb_cache_control.erl b/src/hb_cache_control.erl
index c6df68b69..2a2ec8e75 100644
--- a/src/hb_cache_control.erl
+++ b/src/hb_cache_control.erl
@@ -10,7 +10,7 @@
 %%% When other cache control settings are not specified, we default to the
 %%% following settings.
 -define(DEFAULT_STORE_OPT, false).
--define(DEFAULT_LOOKUP_OPT, false).
+-define(DEFAULT_LOOKUP_OPT,  true).
 
 %%% Public API
 
@@ -51,26 +51,24 @@ lookup(Msg1, Msg2, Opts) ->
             ?event({skip_cache_check, lookup_disabled}),
             {continue, Msg1, Msg2};
         Settings = #{ <<"lookup">> := true } ->
-            OutputScopedOpts = 
+            OutputScopedOpts =
                 hb_store:scope(
-                    hb_opts:get(store_scope_resolved, local, Opts),
-                    Opts
+                    Opts,
+                    hb_opts:get(store_scope_resolved, local, Opts)
                 ),
             case hb_cache:read_resolved(Msg1, Msg2, OutputScopedOpts) of
-                {ok, Msg3} ->
+                {hit, not_found} ->
+                    {error, not_found};
+                {hit, {ok, Res}} ->
                     ?event(caching,
                         {cache_hit,
-                            case is_binary(Msg3) of
-                                true -> hb_path:hashpath(Msg1, Msg2, Opts);
-                                false -> hb_path:hashpath(Msg3, Opts)
-                            end,
                             {msg1, Msg1},
                             {msg2, Msg2},
-                            {msg3, Msg3}
+                            {msg3, Res}
                         }
                     ),
-                    {ok, Msg3};
-                not_found ->
+                    {ok, Res};
+                _ ->
                     ?event(caching, {result_cache_miss, Msg1, Msg2}),
                     case Settings of
                         #{ <<"only-if-cached">> := true } ->
@@ -105,27 +103,49 @@ lookup(Msg1, Msg2, Opts) ->
 %% @doc Dispatch the cache write to a worker process if requested.
 %% Invoke the appropriate cache write function based on the type of the message.
 dispatch_cache_write(Msg1, Msg2, Msg3, Opts) ->
-    Dispatch =
-        fun() ->
-            hb_cache:write(Msg1, Opts),
-            hb_cache:write(Msg2, Opts),
-            case Msg3 of
-                <<_/binary>> ->
-                    hb_cache:write_binary(
-                        hb_path:hashpath(Msg1, Msg2, Opts),
-                        Msg3,
-                        Opts
-                    );
-                Map when is_map(Map) ->
-                    hb_cache:write(Msg3, Opts);
-                _ ->
-                    ?event({cannot_write_result, Msg3}),
-                    skip_caching
-            end
-        end,
     case hb_opts:get(async_cache, false, Opts) of
-        true -> spawn(Dispatch);
-        false -> Dispatch()
+        true ->
+            find_or_spawn_async_writer(Opts) ! {write, Msg1, Msg2, Msg3, Opts},
+            ok;
+        false ->
+            perform_cache_write(Msg1, Msg2, Msg3, Opts)
+    end.
+
+%% @doc Find our async cacher process, or spawn one if none exists.
+find_or_spawn_async_writer(_Opts) ->
+    case erlang:get({hb_cache_control, async_writer}) of
+        undefined ->
+            PID = spawn(fun() -> async_writer() end),
+            erlang:put({hb_cache_control, async_writer}, PID),
+            PID;
+        PID ->
+            PID
+    end.
+
+%% @doc Optional worker process to write messages to the cache.
+async_writer() ->
+    receive
+        {write, Msg1, Msg2, Msg3, Opts} ->
+            perform_cache_write(Msg1, Msg2, Msg3, Opts);
+        stop -> ok
+    end.
+
+%% @doc Internal function to write a compute result to the cache.
+perform_cache_write(Msg1, Msg2, Msg3, Opts) ->
+    hb_cache:write(Msg1, Opts),
+    hb_cache:write(Msg2, Opts),
+    case Msg3 of
+        <<_/binary>> ->
+            hb_cache:write_binary(
+                hb_path:hashpath(Msg1, Msg2, Opts),
+                Msg3,
+                Opts
+            );
+        Map when is_map(Map) ->
+            hb_cache:write(Msg3, Opts);
+        _ ->
+            ?event({cannot_write_result, Msg3}),
+            skip_caching
     end.
 
 %% @doc Generate a message to return when `only_if_cached' was specified, and
@@ -163,6 +183,8 @@ necessary_messages_not_found_error(Msg1, Msg2, Opts) ->
 
 %% @doc Determine whether we are likely to be faster looking up the result in
 %% our cache (hoping we have it), or executing it directly.
+exec_likely_faster_heuristic(_M1, _M2, _) ->
+    false;
 exec_likely_faster_heuristic({as, _, Msg1}, Msg2, Opts) ->
     exec_likely_faster_heuristic(Msg1, Msg2, Opts);
 exec_likely_faster_heuristic(Msg1, Msg2, Opts) ->
@@ -180,7 +202,7 @@ is_explicit_lookup(Msg1, #{ <<"path">> := Key }, Opts) ->
     % If we have `only-if-cached' in the opts, we always force lookup, too.
     case specifiers_to_cache_settings(hb_opts:get(cache_control, [], Opts)) of
         #{ <<"only-if-cached">> := true } -> false;
-        _ -> is_map(Msg1) andalso maps:is_key(Key, Msg1)
+        _ -> is_map(Msg1) andalso hb_maps:is_key(Key, Msg1, Opts)
     end.
 
 %% @doc Derive cache settings from a series of option sources and the opts,
@@ -193,7 +215,7 @@ is_explicit_lookup(Msg1, #{ <<"path">> := Key }, Opts) ->
 derive_cache_settings(SourceList, Opts) ->
     lists:foldr(
         fun(Source, Acc) ->
-            maybe_set(Acc, cache_source_to_cache_settings(Source))
+            maybe_set(Acc, cache_source_to_cache_settings(Source, Opts), Opts)
         end,
         #{ <<"store">> => ?DEFAULT_STORE_OPT, <<"lookup">> => ?DEFAULT_LOOKUP_OPT },
         [{opts, Opts}|lists:filter(fun erlang:is_map/1, SourceList)]
@@ -201,16 +223,16 @@ derive_cache_settings(SourceList, Opts) ->
 
 %% @doc Takes a key and two maps, returning the first map with the key set to
 %% the value of the second map _if_ the value is not undefined.
-maybe_set(Map1, Map2) ->
+maybe_set(Map1, Map2, Opts) ->
     lists:foldl(
         fun(Key, AccMap) ->
-            case maps:get(Key, Map2) of
+            case hb_maps:get(Key, Map2, undefined, Opts) of
                 undefined -> AccMap;
-                Value -> maps:put(Key, Value, AccMap)
+                Value -> hb_maps:put(Key, Value, AccMap, Opts)
             end
         end,
         Map1,
-        maps:keys(Map2)
+        hb_maps:keys(Map2, Opts)
     ).
 
 %% @doc Convert a cache source to a cache setting. The setting _must_ always be
@@ -219,16 +241,16 @@ maybe_set(Map1, Map2) ->
 %% cases, except where an `Opts' specifies that hashpaths should not be updated,
 %% which leads to the result not being cached (as it may be stored with an 
 %% incorrect hashpath).
-cache_source_to_cache_settings({opts, Opts}) ->
+cache_source_to_cache_settings({opts, Opts}, _) ->
     CCMap = specifiers_to_cache_settings(hb_opts:get(cache_control, [], Opts)),
     case hb_opts:get(hashpath, update, Opts) of
         ignore -> CCMap#{ <<"store">> => false };
         _ -> CCMap
     end;
-cache_source_to_cache_settings(Msg) ->
-    case dev_message:get(<<"cache-control">>, Msg) of
+cache_source_to_cache_settings(Msg, Opts) ->
+    case hb_maps:find(<<"cache-control">>, Msg, Opts) of
         {ok, CC} -> specifiers_to_cache_settings(CC);
-        {error, not_found} -> #{}
+        _ -> #{}
     end.
 
 %% @doc Convert a cache control list as received via HTTP headers into a 
@@ -346,7 +368,8 @@ message_without_cache_control_test() ->
 opts_source_cache_control_test() ->
     Result =
         cache_source_to_cache_settings(
-            {opts, opts_with_cc([<<"no-store">>])}
+            {opts, opts_with_cc([<<"no-store">>])},
+            #{}
         ),
     ?assertEqual(#{
         <<"store">> => false,
@@ -356,7 +379,7 @@ opts_source_cache_control_test() ->
 
 message_source_cache_control_test() ->
     Msg = msg_with_cc([<<"no-cache">>]),
-    Result = cache_source_to_cache_settings(Msg),
+    Result = cache_source_to_cache_settings(Msg, #{}),
     ?assertEqual(#{
         <<"store">> => undefined,
         <<"lookup">> => false,
diff --git a/src/hb_cache_render.erl b/src/hb_cache_render.erl
index 43f5f99f9..aa5a191f2 100644
--- a/src/hb_cache_render.erl
+++ b/src/hb_cache_render.erl
@@ -1,10 +1,10 @@
 %%% @doc A module that helps to render given Key graphs into the .dot files
 -module(hb_cache_render).
 -export([render/1, render/2, cache_path_to_dot/2, cache_path_to_dot/3, dot_to_svg/1]).
+-export([get_graph_data/3, cache_path_to_graph/3]).
 % Preparing data for testing
 -export([prepare_unsigned_data/0, prepare_signed_data/0,
     prepare_deeply_nested_complex_message/0]).
--export([cache_path_to_graph/3, get_graph_data/1]).
 -include("include/hb.hrl").
 
 %% @doc Render the given Key into svg
@@ -23,80 +23,97 @@ render(ToRender, StoreOrOpts) ->
 cache_path_to_dot(ToRender, StoreOrOpts) ->
     cache_path_to_dot(ToRender, #{}, StoreOrOpts).
 cache_path_to_dot(ToRender, RenderOpts, StoreOrOpts) ->
-    graph_to_dot(cache_path_to_graph(ToRender, RenderOpts, StoreOrOpts)).
+    graph_to_dot(cache_path_to_graph(ToRender, RenderOpts, StoreOrOpts), StoreOrOpts).
 
 %% @doc Main function to collect graph elements
 cache_path_to_graph(ToRender, GraphOpts, StoreOrOpts) when is_map(StoreOrOpts) ->
     Store = hb_opts:get(store, no_viable_store, StoreOrOpts),
-    cache_path_to_graph(ToRender, GraphOpts, Store);
-cache_path_to_graph(all, GraphOpts, Store) ->
-    {ok, Keys} = hb_store:list(Store, "/"),
-    cache_path_to_graph(Store, GraphOpts, Keys);
-cache_path_to_graph(InitPath, GraphOpts, Store) when is_binary(InitPath) ->
-    {ok, Keys} = hb_store:list(Store, InitPath),
-    cache_path_to_graph(Store, GraphOpts, Keys);
-cache_path_to_graph(Store, GraphOpts, RootKeys) ->
+    ?event({store, Store}),
+    cache_path_to_graph(ToRender, GraphOpts, Store, StoreOrOpts).
+cache_path_to_graph(all, GraphOpts, Store, Opts) ->
+    Keys = 
+        case hb_store:list(Store, <<"/">>) of
+            {ok, KeyList} -> KeyList;
+            not_found -> []
+        end,
+    ?event({all_keys, Keys}),
+    cache_path_to_graph(Store, GraphOpts, Keys, Opts);
+cache_path_to_graph(InitPath, GraphOpts, Store, Opts) when is_binary(InitPath) ->
+    cache_path_to_graph(Store, GraphOpts, [InitPath], Opts);
+cache_path_to_graph(Store, GraphOpts, RootKeys, Opts) ->
     % Use a map to track nodes, arcs and visited paths (to avoid cycles)
     EmptyGraph = GraphOpts#{ nodes => #{}, arcs => #{}, visited => #{} },
     % Process all root keys and get the final graph
     lists:foldl(
-        fun(Key, Acc) -> traverse_store(Store, Key, undefined, Acc) end,
+        fun(Key, Acc) -> traverse_store(Store, Key, undefined, Acc, Opts) end,
         EmptyGraph,
         RootKeys
     ).
 
 %% @doc Traverse the store recursively to build the graph
-traverse_store(Store, Key, Parent, Graph) ->
+traverse_store(Store, Path, Parent, Graph, Opts) ->
     % Get the path and check if we've already visited it
-    JoinedPath = hb_store:join(Key),
-    ResolvedPath = hb_store:resolve(Store, Key),
+    JoinedPath = hb_store:join(Path),
+    ResolvedPath =
+        case hb_link:is_link_key(JoinedPath) of
+            true ->
+                ?event({is_link_key, {path, Path}, {res_path, JoinedPath}}),
+                {ok, Link} = hb_store:read(Store, hb_store:resolve(Store, JoinedPath)),
+                ?event({resolved_link, {read, Link}}),
+                hb_store:resolve(Store, Link);
+            false -> hb_store:resolve(Store, Path)
+        end,
+    ?event({traverse_store, {path, Path}, {joined_path, JoinedPath}, {resolved_path, ResolvedPath}, {parent, Parent}}),
     % Skip if we've already processed this node
-    case maps:get(visited, Graph, #{}) of
-        #{JoinedPath := _} -> Graph;
+    case hb_maps:get(visited, Graph, #{}, Opts) of
+        #{ JoinedPath := _ } -> Graph;
         _ ->
             % Mark as visited to avoid cycles
-            Graph1 = Graph#{visited => maps:put(JoinedPath, true, maps:get(visited, Graph, #{}))},
+            Graph1 = Graph#{visited => hb_maps:put(JoinedPath, true, hb_maps:get(visited, Graph, #{}, Opts), Opts)},
+            % ?event({traverse_store, {key, Key}, {graph1, Graph1}}),
             % Process node based on its type
-            case hb_store:type(Store, Key) of
+            case hb_store:type(Store, ResolvedPath) of
                 simple -> 
-                    process_simple_node(Store, Key, Parent, ResolvedPath, JoinedPath, Graph1);
+                    process_simple_node(Store, Path, Parent, ResolvedPath, JoinedPath, Graph1, Opts);
                 composite -> 
-                    process_composite_node(Store, Key, Parent, ResolvedPath, JoinedPath, Graph1);
+                    process_composite_node(Store, Path, Parent, ResolvedPath, JoinedPath, Graph1, Opts);
                 _ -> 
+                    ?event({unknown_node_type, {path, Path}, {type, hb_store:type(Store, Path)}}),
                     Graph1
             end
     end.
 
 %% @doc Process a simple (leaf) node
-process_simple_node(Store, Key, Parent, ResolvedPath, JoinedPath, Graph) ->
+process_simple_node(_Store, _Key, Parent, ResolvedPath, JoinedPath, Graph, Opts) ->
+    % ?event({process_simple_node, {key, Key}, {resolved_path, ResolvedPath}}),
     % Add the node to the graph
-    case maps:get(render_data, Graph, true) of
+    case hb_maps:get(render_data, Graph, true, Opts) of
         false -> Graph;
         true ->
-            Graph1 = add_node(Graph, ResolvedPath, "lightblue"),
+            Graph1 = add_node(Graph, ResolvedPath, "lightblue", Opts),
             % If we have a parent, add an arc from parent to this node
             case Parent of
                 undefined -> Graph1;
                 ParentPath -> 
                     Label = extract_label(JoinedPath),
-                    add_arc(Graph1, ParentPath, ResolvedPath, Label)
+                    add_arc(Graph1, ParentPath, ResolvedPath, Label, Opts)
             end
     end.
 
 %% @doc Process a composite (directory) node
-process_composite_node(_Store, "data", _Parent, _ResolvedPath, _JoinedPath, Graph) ->
+process_composite_node(_Store, <<"data">>, _Parent, _ResolvedPath, _JoinedPath, Graph, _Opts) ->
     % Data is a special case: It contains every binary item in the store.
     % We don't need to render it.
     Graph;
-process_composite_node(Store, Key, Parent, ResolvedPath, JoinedPath, Graph) ->
+process_composite_node(Store, _Key, Parent, ResolvedPath, JoinedPath, Graph, Opts) ->
     % Add the node to the graph
-    Graph1 = add_node(Graph, ResolvedPath, "lightcoral"),
+    Graph1 = add_node(Graph, ResolvedPath, "lightcoral", Opts),
     % If we have a parent, add an arc from parent to this node
     Graph2 = case Parent of
         undefined -> Graph1;
         ParentPath -> 
             Label = extract_label(JoinedPath),
-            add_arc(Graph1, ParentPath, ResolvedPath, Label)
+            add_arc(Graph1, ParentPath, ResolvedPath, Label, Opts)
     end,
     % Process children recursively
     case hb_store:list(Store, ResolvedPath) of
@@ -104,7 +121,7 @@ process_composite_node(Store, Key, Parent, ResolvedPath, JoinedPath, Graph) ->
             lists:foldl(
                 fun(SubItem, Acc) ->
                     ChildKey = [ResolvedPath, SubItem],
-                    traverse_store(Store, ChildKey, ResolvedPath, Acc)
+                    traverse_store(Store, ChildKey, ResolvedPath, Acc, Opts)
                 end,
                 Graph2,
                 SubItems
@@ -113,15 +130,15 @@ process_composite_node(Store, Key, Parent, ResolvedPath, JoinedPath, Graph) ->
     end.
 
 %% @doc Add a node to the graph
-add_node(Graph, ID, Color) ->
-    Nodes = maps:get(nodes, Graph, #{}),
-    Graph#{nodes => maps:put(ID, {ID, Color}, Nodes)}.
+add_node(Graph, ID, Color, Opts) ->
+    Nodes = hb_maps:get(nodes, Graph, #{}, Opts),
+    Graph#{nodes => hb_maps:put(ID, {ID, Color}, Nodes, Opts)}.
 
 %% @doc Add an arc to the graph
-add_arc(Graph, From, To, Label) ->
+add_arc(Graph, From, To, Label, Opts) ->
     ?event({insert_arc, {id1, From}, {id2, To}, {label, Label}}),
-    Arcs = maps:get(arcs, Graph, #{}),
-    Graph#{arcs => maps:put({From, To, Label}, true, Arcs)}.
+    Arcs = hb_maps:get(arcs, Graph, #{}, Opts),
+    Graph#{arcs => hb_maps:put({From, To, Label}, true, Arcs, Opts)}.
 
 %% @doc Extract a label from a path
 extract_label(Path) ->
@@ -136,39 +153,41 @@ extract_label(Path) ->
     end.
 
 %% @doc Generate the DOT file from the graph
-graph_to_dot(Graph) ->
+graph_to_dot(Graph, Opts) ->
     % Create graph header
     Header = [
         <<"digraph filesystem {\n">>,
         <<"  node [shape=circle];\n">>
     ],
     % Create nodes section
-    Nodes = maps:fold(
+    Nodes = hb_maps:fold(
         fun(ID, {Label, Color}, Acc) ->
             [
                 Acc,
                 io_lib:format(
                     <<"  \"~s\" [label=\"~s\", color=~s, style=filled];~n">>,
-                    [ID, hb_util:short_id(hb_util:bin(Label)), Color]
+                    [ID, hb_format:short_id(hb_util:bin(Label)), Color]
                 )
             ]
         end,
         [],
-        maps:get(nodes, Graph, #{})
+        hb_maps:get(nodes, Graph, #{}, Opts),
+		Opts
     ),
     % Create arcs section
-    Arcs = maps:fold(
+    Arcs = hb_maps:fold(
         fun({From, To, Label}, _, Acc) ->
             [
                 Acc,
                 io_lib:format(
                     <<"  \"~s\" -> \"~s\" [label=\"~s\"];~n">>,
-                    [From, To, hb_util:short_id(hb_util:bin(Label))]
+                    [From, To, hb_format:short_id(hb_util:bin(Label))]
                 )
             ]
         end,
         [],
-        maps:get(arcs, Graph, #{})
+        hb_maps:get(arcs, Graph, #{}, Opts),
+		Opts
     ),
     % Create graph footer
     Footer = <<"}\n">>,
@@ -202,74 +221,67 @@ collect_output(Port, Acc) ->
     end.
 
 %% @doc Get graph data for the Three.js visualization
-get_graph_data(Opts) ->
-    % Get the store from options
-    Store = hb_opts:get(store, no_viable_store, Opts),
-    
+get_graph_data(Base, MaxSize, Opts) ->
     % Try to generate graph using hb_cache_render
-    Graph = try
-        % Use hb_cache_render to build the graph
-        {ok, Keys} = hb_store:list(Store, "/"),
-        cache_path_to_graph(Store, #{}, Keys)
-    catch
-        Error:Reason:Stack -> 
-            ?event({hyperbuddy_graph_error, Error, Reason, Stack}),
-            #{nodes => #{}, arcs => #{}, visited => #{}}
-    end,
-    
+    Graph =
+        try
+            % Use hb_cache_render to build the graph
+            cache_path_to_graph(Base, #{}, Opts)
+        catch
+            Error:Reason:Stack -> 
+                ?event({hyperbuddy_graph_error, Error, Reason, Stack}),
+                #{nodes => #{}, arcs => #{}, visited => #{}}
+        end,
     % Extract nodes and links for the visualization
     NodesMap = maps:get(nodes, Graph, #{}),
     ArcsMap = maps:get(arcs, Graph, #{}),
-    
-    % Limit to top 500 nodes if there are too many
+    % Limit to top `MaxSize` nodes if there are too many
     NodesList = 
-        case maps:size(NodesMap) > 50000 of
+        case maps:size(NodesMap) > MaxSize of
             true ->
                 % Take a subset of nodes
                 {ReducedNodes, _} = lists:split(
-                    500,
+                    MaxSize,
                     maps:to_list(NodesMap)
                 ),
                 ReducedNodes;
             false ->
                 maps:to_list(NodesMap)
         end,
-    
     % Get node IDs for filtering links
     NodeIds = [ID || {ID, _} <- NodesList],
-    
     % Convert to JSON format for web visualization
-    Nodes = [
-        #{
-            <<"id">> => ID,
-            <<"label">> => get_label(hb_util:bin(ID)),
-            <<"type">> => get_node_type(Color)
-        }
-        || {ID, {_, Color}} <- NodesList
-    ],
-    
+    Nodes =
+        [
+                #{
+                    <<"id">> => ID,
+                    <<"label">> => get_label(hb_util:bin(ID)),
+                    <<"type">> => get_node_type(Color)
+                }
+            ||
+                {ID, {_, Color}} <- NodesList
+        ],
     % Filter links to only include those between nodes we're showing
-    FilteredLinks = [
-        {From, To, Label}
-        || {From, To, Label} <- maps:keys(ArcsMap),
-           lists:member(From, NodeIds) andalso lists:member(To, NodeIds)
-    ],
-    
-    Links = [
-        #{
-            <<"source">> => From,
-            <<"target">> => To,
-            <<"label">> => Label
-        }
-        || {From, To, Label} <- FilteredLinks
-    ],
-    
+    FilteredLinks =
+        [
+                {From, To, Label}
+            ||
+                {From, To, Label} <- maps:keys(ArcsMap),
+                    lists:member(From, NodeIds)
+                    andalso lists:member(To, NodeIds)
+        ],
+    Links =
+        [
+                #{
+                    <<"source">> => From,
+                    <<"target">> => To,
+                    <<"label">> => Label
+                }
+            ||
+                {From, To, Label} <- FilteredLinks
+        ],
     % Return the JSON data
-    JsonData = hb_json:encode(#{
-        <<"nodes">> => Nodes,
-        <<"links">> => Links
-    }),
-    
+    JsonData = hb_json:encode(#{ <<"nodes">> => Nodes, <<"links">> => Links }),
     {ok, #{
         <<"body">> => JsonData,
         <<"content-type">> => <<"application/json">>
@@ -300,7 +312,7 @@ prepare_unsigned_data() ->
     Opts = #{
         store => #{
             <<"store-module">> => hb_store_fs,
-            <<"prefix">> => <<"cache-TEST/render-fs">>
+            <<"name">> => <<"cache-TEST/render-fs">>
         }
     },
     Item = test_unsigned(#{ <<"key">> => <<"Simple unsigned data item">> }),
@@ -310,7 +322,7 @@ prepare_signed_data() ->
     Opts = #{
         store => #{
             <<"store-module">> => hb_store_fs,
-            <<"prefix">> => <<"cache-TEST/render-fs">>
+            <<"name">> => <<"cache-TEST/render-fs">>
         }
     },
     Wallet = ar_wallet:new(),
@@ -322,7 +334,7 @@ prepare_deeply_nested_complex_message() ->
     Opts = #{
         store => #{
             <<"store-module">> => hb_store_fs,
-            <<"prefix">> => <<"cache-TEST/render-fs">>
+            <<"name">> => <<"cache-TEST/render-fs">>
         }
     },
     Wallet = ar_wallet:new(),
diff --git a/src/hb_client.erl b/src/hb_client.erl
index 9d520744d..51428aca9 100644
--- a/src/hb_client.erl
+++ b/src/hb_client.erl
@@ -4,7 +4,7 @@
 %% Arweave node API
 -export([arweave_timestamp/0]).
 %% Arweave bundling and data access API
--export([upload/2]).
+-export([upload/2, upload/3]).
 %% Tests
 -include_lib("eunit/include/eunit.hrl").
 -include("include/hb.hrl").
@@ -27,17 +27,18 @@ resolve(Node, Msg1, Msg2, Opts) ->
     ),
     hb_http:post(
         Node,
-        maps:merge(prefix_keys(<<"1.">>, Msg1, Opts), TABM2),
+        hb_maps:merge(prefix_keys(<<"1.">>, Msg1, Opts), TABM2, Opts),
         Opts
     ).
 
 prefix_keys(Prefix, Message, Opts) ->
-    maps:fold(
+    hb_maps:fold(
         fun(Key, Val, Acc) ->
-            maps:put(<<Prefix/binary, Key/binary>>, Val, Acc)
+            hb_maps:put(<<Prefix/binary, Key/binary>>, Val, Acc, Opts)
         end,
         #{},
-        hb_message:convert(Message, tabm, Opts)
+        hb_message:convert(Message, tabm, Opts),
+		Opts
     ).
 
 routes(Node, Opts) ->
@@ -70,24 +71,34 @@ add_route(Node, Route, Opts) ->
 %% @doc Grab the latest block information from the Arweave gateway node.
 arweave_timestamp() ->
     case hb_opts:get(mode) of
-        debug -> {0, 0, <<0:256>>};
+        debug -> {0, 0, hb_util:human_id(<<0:256>>)};
         prod ->
             {ok, {{_, 200, _}, _, Body}} =
                 httpc:request(
                     <<(hb_opts:get(gateway))/binary, "/block/current">>
                 ),
-            Fields = hb_json:decode(Body),
-            Timestamp = maps:get(<<"timestamp">>, Fields),
-            Hash = maps:get(<<"indep_hash">>, Fields),
-            Height = maps:get(<<"height">>, Fields),
+            Fields = hb_json:decode(hb_util:bin(Body)),
+            Timestamp = hb_maps:get(<<"timestamp">>, Fields),
+            Hash = hb_maps:get(<<"indep_hash">>, Fields),
+            Height = hb_maps:get(<<"height">>, Fields),
             {Timestamp, Height, Hash}
     end.
 
 %%% Bundling and data access API
 
 %% @doc Upload a data item to the bundler node.
+%% Note: Uploads once per commitment device. Callers should filter the 
+%% commitments to only include the ones they are interested in, if this is not
+%% the desired behavior.
 upload(Msg, Opts) ->
-    upload(Msg, Opts, hb_ao:get(<<"codec-device">>, Msg, <<"httpsig@1.0">>, Opts)).
+    UploadResults = 
+        lists:map(
+            fun(Device) ->
+                upload(Msg, Opts, Device)
+            end,
+            hb_message:commitment_devices(Msg, Opts)
+        ),
+    {ok, UploadResults}.
 upload(Msg, Opts, <<"httpsig@1.0">>) ->
     case hb_opts:get(bundler_httpsig, not_found, Opts) of
         not_found ->
@@ -147,7 +158,7 @@ upload_raw_ans104_with_anchor_test() ->
     Serialized = ar_bundles:serialize(
         ar_bundles:sign_item(#tx{
             data = <<"TEST">>,
-            last_tx = crypto:strong_rand_bytes(32),
+            anchor = crypto:strong_rand_bytes(32),
             tags = [{<<"test-tag">>, <<"test-value">>}]
         }, hb:wallet())
     ),
diff --git a/src/hb_crypto.erl b/src/hb_crypto.erl
index 017ae8c13..d5914151d 100644
--- a/src/hb_crypto.erl
+++ b/src/hb_crypto.erl
@@ -12,7 +12,8 @@
 %%% The accumulate algorithm is experimental and at this point only exists to
 %%% allow us to test multiple HashPath algorithms in HyperBEAM.
 -module(hb_crypto).
--export([sha256/1, sha256_chain/2, accumulate/2]).
+-export([sha256/1, sha256_chain/2, accumulate/1, accumulate/2]).
+-export([pbkdf2/5]).
 -include("include/hb.hrl").
 -include_lib("eunit/include/eunit.hrl").
 
@@ -22,10 +23,18 @@ sha256_chain(ID1, ID2) when ?IS_ID(ID1) ->
 sha256_chain(ID1, ID2) ->
     throw({cannot_chain_bad_ids, ID1, ID2}).
 
-%% @doc Accumulate two IDs into a single commitment.
-%% Experimental! This is not necessarily a cryptographically-secure operation.
-accumulate(ID1 = << ID1Int:256 >>, ID2) when ?IS_ID(ID1) ->
-    << ID2Int:256 >> = sha256_chain(ID1, ID2),
+%% @doc Accumulate two IDs, or a list of IDs, into a single commitment. This 
+%% function requires that the IDs given are already cryptographically-secure,
+%% 256-bit values. No further cryptographic operations are performed upon the
+%% values, they are simply added together.
+%% 
+%% This is useful in situations where the ordering of the IDs is not important,
+%% or explicitly detrimental to the utility of the final commitment. No ordering
+%% information is preserved in the final commitment.
+accumulate(IDs) when is_list(IDs) ->
+    lists:foldl(fun accumulate/2, << 0:256 >>, IDs).
+accumulate(ID1 = << ID1Int:256 >>, ID2 = << ID2Int:256 >>)
+        when (byte_size(ID1) =:= 32) and (byte_size(ID2) =:= 32) ->
     << (ID1Int + ID2Int):256 >>;
 accumulate(ID1, ID2) ->
     throw({cannot_accumulate_bad_ids, ID1, ID2}).
@@ -35,6 +44,21 @@ accumulate(ID1, ID2) ->
 sha256(Data) ->
     crypto:hash(sha256, Data).
 
+%% @doc Wrap Erlang's `crypto:pbkdf2_hmac/5' to provide a standard interface.
+pbkdf2(Alg, Password, Salt, Iterations, KeyLength) ->
+    case crypto:pbkdf2_hmac(Alg, Password, Salt, Iterations, KeyLength) of
+        Key when is_binary(Key) -> {ok, Key};
+        {Tag, CFileInfo, Desc} ->
+            ?event(
+                {pbkdf2_error,
+                    {tag, Tag},
+                    {desc, Desc},
+                    {c_file_info, CFileInfo}
+                }
+            ),
+            {error, Desc}
+    end.
+
 %%% Tests
 
 %% @doc Count the number of leading zeroes in a bitstring.
diff --git a/src/hb_debugger.erl b/src/hb_debugger.erl
index 652542ca8..0b6e0eb0e 100644
--- a/src/hb_debugger.erl
+++ b/src/hb_debugger.erl
@@ -11,7 +11,25 @@
 %%% 
 %%% Boot time is approximately 10 seconds.
 -module(hb_debugger).
--export([start/0, start_and_break/2, start_and_break/3, await_breakpoint/0]).
+-export([start/0, start_and_break/2, start_and_break/3, start_and_break/4]).
+-export([profile_and_stop/1]).
+-export([await_breakpoint/0]).
+
+%% @doc Profile a function with eflame and stop the node.
+profile_and_stop(Fun) ->
+    {ok, F} = file:open("profiling-output", [write]),
+    group_leader(F, self()),
+    io:format("profiling-output: started.~n"),
+    io:format("Profiling function: ~p.~n", [Fun]),
+    Res =
+        dev_profile:eval(
+            Fun,
+            #{ <<"return-mode">> => <<"open">>, <<"engine">> => <<"eflame">> },
+            #{}
+        ),
+    io:format("Profiling complete. Res: ~p~n", [Res]),
+    init:stop(),
+    erlang:halt().
 
 %% Wait for another node (which we assume to be the debugger) to be attached,
 %% then return to the caller.
@@ -54,22 +72,58 @@ interpret(Module) ->
     after 250 -> false
     end.
 
+%% @doc Interpret modules from a list of atom prefixes.
+interpret_modules(Prefixes) when is_binary(Prefixes) ->
+    interpret_modules(binary:split(Prefixes, <<",">>, [global, trim_all]));
+interpret_modules(Prefixes) when is_list(Prefixes) ->
+    RelevantModules =
+        lists:filter(
+            fun(Mod) ->
+                ModBin = hb_util:bin(Mod),
+                lists:any(
+                    fun(Prefix) ->
+                        PrefixBin = hb_util:bin(Prefix),
+                        binary:longest_common_prefix([ModBin, PrefixBin]) ==
+                            byte_size(PrefixBin)
+                    end,
+                    Prefixes
+                )
+            end,
+            hb_util:all_hb_modules()
+        ),
+    io:format("Relevant modules: ~p.~n", [RelevantModules]),
+    lists:foreach(
+        fun(Mod) ->
+            io:format("Interpreting module: ~p.~n", [Mod]),
+            interpret(Mod)
+        end,
+        RelevantModules
+    ),
+    RelevantModules.
+
 %% @doc A bootstrapping function to wait for an external debugger to be attached,
 %% then add a breakpoint on the specified `Module:Function(Args)', then call it.
 start_and_break(Module, Function) ->
-    start_and_break(Module, Function, []).
+    start_and_break(Module, Function, [], []).
 start_and_break(Module, Function, Args) ->
-    start(),
-    interpret(Module),
-    SetRes = int:break_in(Module, Function, length(Args)),
-    io:format(
-        "Breakpoint set. Result from `int:break_in/3': ~p.~n",
-        [SetRes]
-    ),
-    io:format("Invoking function...~n", []),
-    apply(Module, Function, Args),
-    io:format("Function invoked. Terminating.~n", []),
-    init:stop().
+    start_and_break(Module, Function, Args, []).
+start_and_break(Module, Function, Args, DebuggerScope) ->
+    timer:sleep(1000),
+    spawn(fun() ->
+        start(),
+        interpret(Module),
+        interpret_modules(DebuggerScope),
+        SetRes = int:break_in(Module, Function, length(Args)),
+        io:format(
+            "Breakpoint set. Result from `int:break_in/3`: ~p.~n",
+            [SetRes]
+        ),
+        io:format("Invoking function...~n", []),
+        apply(Module, Function, Args),
+        io:format("Function invoked. Terminating.~n", []),
+        init:stop(),
+        erlang:halt()
+    end).
 
 %% @doc Await a debugger to be attached to the node.
 await_debugger() -> await_debugger(0).
diff --git a/src/hb_escape.erl b/src/hb_escape.erl
index eaf97bd71..41cdc4d7d 100644
--- a/src/hb_escape.erl
+++ b/src/hb_escape.erl
@@ -1,12 +1,18 @@
-%%% @doc Escape and unescape mixed case values for use in HTTP headers.
-%%% This is necessary for encodings of AO-Core messages for transmission in 
+%%% @doc Functions for escaping and unescaping mixed case values, for use in HTTP
+%%% headers. Both percent-encoding and escaping of double-quoted strings
+%%% (`"' => `\"') are supported.
+%%%
+%%% This is necessary for encodings of AO-Core messages for transmission in
 %%% HTTP/2 and HTTP/3, because uppercase header keys are explicitly disallowed.
 %%% While most map keys in HyperBEAM are normalized to lowercase, IDs are not.
 %%% Subsequently, we encode all header keys to lowercase %-encoded URI-style
 %%% strings because transmission.
 -module(hb_escape).
--export([encode/1, decode/1, encode_keys/1, decode_keys/1]).
+-export([encode/1, decode/1, encode_keys/2, decode_keys/2]).
+-export([encode_quotes/1, decode_quotes/1]).
+-export([encode_ampersand/1]).
 -include_lib("eunit/include/eunit.hrl").
+-include("include/hb.hrl").
 
 %% @doc Encode a binary as a URI-encoded string.
 encode(Bin) when is_binary(Bin) ->
@@ -16,25 +22,47 @@ encode(Bin) when is_binary(Bin) ->
 decode(Bin) when is_binary(Bin) ->
     list_to_binary(percent_unescape(binary_to_list(Bin))).
 
+%% @doc Encode a string with escaped quotes.
+encode_quotes(String) when is_binary(String) ->
+    list_to_binary(encode_quotes(binary_to_list(String)));
+encode_quotes([]) -> [];
+encode_quotes([$\" | Rest]) -> [$\\, $\" | encode_quotes(Rest)];
+encode_quotes([C | Rest]) -> [C | encode_quotes(Rest)].
+
+%% @doc Decode a string with escaped quotes.
+decode_quotes(String) when is_binary(String) ->
+    list_to_binary(decode_quotes(binary_to_list(String)));
+decode_quotes([]) -> [];
+decode_quotes([$\\, $\" | Rest]) -> [$\" | decode_quotes(Rest)];
+decode_quotes([$\" | Rest]) -> decode_quotes(Rest);
+decode_quotes([C | Rest]) -> [C | decode_quotes(Rest)].
+
+%% @doc Encode ampersands as &amp; for XML output.
+encode_ampersand(String) when is_binary(String) ->
+    list_to_binary(encode_ampersand(binary_to_list(String)));
+encode_ampersand([]) -> [];
+encode_ampersand([$& | Rest]) -> [$&, $a, $m, $p, $; | encode_ampersand(Rest)];
+encode_ampersand([C | Rest]) -> [C | encode_ampersand(Rest)].
+
 %% @doc Return a message with all of its keys decoded.
-decode_keys(Msg) when is_map(Msg) ->
-    maps:from_list(
+decode_keys(Msg, Opts) when is_map(Msg) ->
+    hb_maps:from_list(
         lists:map(
             fun({Key, Value}) -> {decode(Key), Value} end,
-            maps:to_list(Msg)
+            hb_maps:to_list(Msg, Opts)
         )
     );
-decode_keys(Other) -> Other.
+decode_keys(Other, _Opts) -> Other.
 
 %% @doc URI encode keys in the base layer of a message. Does not recurse.
-encode_keys(Msg) when is_map(Msg) ->
-    maps:from_list(
+encode_keys(Msg, Opts) when is_map(Msg) ->
+    hb_maps:from_list(
         lists:map(
             fun({Key, Value}) -> {encode(Key), Value} end,
-            maps:to_list(Msg)
+            hb_maps:to_list(Msg, Opts)
         )
     );
-encode_keys(Other) -> Other.
+encode_keys(Other, _Opts) -> Other.
 
 %% @doc Escape a list of characters as a URI-encoded string.
 percent_escape([]) -> [];
@@ -42,7 +70,7 @@ percent_escape([C | Cs]) when C >= $a, C =< $z -> [C | percent_escape(Cs)];
 percent_escape([C | Cs]) when C >= $0, C =< $9 -> [C | percent_escape(Cs)];
 percent_escape([C | Cs]) when
         C == $.; C == $-; C == $_; C == $/;
-        C == $?; C == $&; C == $+ ->
+        C == $?; C == $& ->
     [C | percent_escape(Cs)];
 percent_escape([C | Cs]) -> [escape_byte(C) | percent_escape(Cs)].
 
@@ -78,12 +106,24 @@ escape_unescape_identity_test() ->
     TestCases = [
         <<"hello">>,
         <<"hello, world!">>,
+        <<"hello+list">>,
         <<"special@chars#here">>,
         <<"UPPERCASE">>,
         <<"MixedCASEstring">>,
         <<"12345">>,
         <<>> % Empty string
     ],
+    ?event(parsing,
+        {escape_unescape_identity_test,
+            {test_cases,
+                [
+                        {Case, {explicit, encode(Case)}}
+                    ||
+                        Case <- TestCases
+                ]
+            }
+        }
+    ),
     lists:foreach(fun(TestCase) ->
         ?assertEqual(TestCase, decode(encode(TestCase)))
     end, TestCases).
diff --git a/src/hb_event.erl b/src/hb_event.erl
index f7cf99283..63468ca70 100644
--- a/src/hb_event.erl
+++ b/src/hb_event.erl
@@ -1,10 +1,21 @@
 %%% @doc Wrapper for incrementing prometheus counters.
 -module(hb_event).
--export([log/1, log/2, log/3, log/4, log/5, log/6, increment/3]).
+-export([counters/0, diff/1, diff/2]).
+-export([log/1, log/2, log/3, log/4, log/5, log/6]).
+-export([increment/3, increment/4, increment_callers/1]).
 -include("include/hb.hrl").
+-include_lib("eunit/include/eunit.hrl").
 
 -define(OVERLOAD_QUEUE_LENGTH, 10000).
 
+-ifdef(NO_EVENTS).
+log(_X) -> ok.
+log(_Topic, _X) -> ok.
+log(_Topic, _X, _Mod) -> ok.
+log(_Topic, _X, _Mod, _Func) -> ok.
+log(_Topic, _X, _Mod, _Func, _Line) -> ok.
+log(_Topic, _X, _Mod, _Func, _Line, _Opts) -> ok.
+-else.
 %% @doc Debugging log logging function. For now, it just prints to standard
 %% error.
 log(X) -> log(global, X).
@@ -14,40 +25,39 @@ log(Topic, X, Mod, Func) -> log(Topic, X, Mod, Func, undefined).
 log(Topic, X, Mod, Func, Line) -> log(Topic, X, Mod, Func, Line, #{}).
 log(Topic, X, Mod, undefined, Line, Opts) -> log(Topic, X, Mod, "", Line, Opts);
 log(Topic, X, Mod, Func, undefined, Opts) -> log(Topic, X, Mod, Func, "", Opts);
-log(Topic, X, ModAtom, Func, Line, Opts) when is_atom(ModAtom) ->
-    % Increment by message adding Topic as label
-    try increment(Topic, X, Opts) catch _:_ -> ignore_error end,
-    % Check if the module has the `hb_debug' attribute set to `print'.
-    case lists:member({hb_debug, [print]}, ModAtom:module_info(attributes)) of
-        true -> hb_util:debug_print(X, atom_to_list(ModAtom), Func, Line);
-        false -> 
-            % Check if the module has the `hb_debug' attribute set to `no_print'.
-            case lists:keyfind(hb_debug, 1, ModAtom:module_info(attributes)) of
-                {hb_debug, [no_print]} -> X;
-                _ -> log(Topic, X, hb_util:bin(ModAtom), Func, Line, Opts)
-            end
-    end;
 log(Topic, X, Mod, Func, Line, Opts) ->
     % Check if the debug_print option has the topic in it if set.
-    case Printable = hb_opts:get(debug_print, false, Opts) of
-        EventList when is_list(EventList) ->
-            case lists:member(Mod, EventList)
-                orelse lists:member(hb_util:bin(Topic), EventList)
-            of
-                true -> hb_util:debug_print(X, Mod, Func, Line);
-                false -> X
-            end;
-        true -> hb_util:debug_print(X, Mod, Func, Line);
+    case should_print(Topic, Opts) orelse should_print(Mod, Opts) of
+        true -> hb_format:print(X, Mod, Func, Line, Opts);
         false -> X
     end,
-	handle_tracer(Topic, X, Opts),
+	%handle_tracer(Topic, X, Opts),
+    try increment(Topic, X, Opts) catch _:_ -> ok end,
     % Return the logged value to the caller. This allows callers to insert 
     % `?event(...)' macros into the flow of other executions, without having to
     % break functional style.
     X.
+-endif.
+
+%% @doc Determine if the topic should be printed. Uses a cache in the process
+%% dictionary to avoid re-checking the same topic multiple times.
+should_print(Topic, Opts) ->
+    case erlang:get({event_print, Topic}) of
+        {cached, X} -> X;
+        undefined ->
+            Result =
+                case hb_opts:get(debug_print, false, Opts) of
+                    EventList when is_list(EventList) ->
+                        lists:member(Topic, EventList);
+                    true -> true;
+                    false -> false
+                end,
+            erlang:put({event_print, Topic}, {cached, Result}),
+            Result
+    end.
 
 handle_tracer(Topic, X, Opts) ->
-	AllowedTopics = [http, ao_core, ao_result],
+	AllowedTopics = [http, ao_result],
 	case lists:member(Topic, AllowedTopics) of
 		true -> 
 			case hb_opts:get(trace, undefined, Opts) of
@@ -76,31 +86,116 @@ handle_tracer(Topic, X, Opts) ->
 %% @doc Increment the counter for the given topic and message. Registers the
 %% counter if it doesn't exist. If the topic is `global', the message is ignored.
 %% This means that events must specify a topic if they want to be counted,
-%% filtering debug messages. Similarly, events with a topic that begins with
-%% `debug' are ignored.
-increment(global, _Message, _Opts) -> ignored;
-increment(ao_core, _Message, _Opts) -> ignored;
-increment(ao_internal, _Message, _Opts) -> ignored;
-increment(ao_devices, _Message, _Opts) -> ignored;
-increment(ao_subresolution, _Message, _Opts) -> ignored;
-increment(signature_base, _Message, _Opts) -> ignored;
-increment(id_base, _Message, _Opts) -> ignored;
-increment(parsing, _Message, _Opts) -> ignored;
-increment(Topic, Message, _Opts) ->
+%% filtering debug messages.
+%% 
+%% This function uses a series of hard-coded topics to ignore explicitly in
+%% order to quickly filter events that are executed so frequently that they
+%% would otherwise cause heavy performance costs.
+increment(Topic, Message, Opts) ->
+    increment(Topic, Message, Opts, 1).
+increment(global, _Message, _Opts, _Count) -> ignored;
+increment(ao_core, _Message, _Opts, _Count) -> ignored;
+increment(ao_internal, _Message, _Opts, _Count) -> ignored;
+increment(ao_devices, _Message, _Opts, _Count) -> ignored;
+increment(ao_subresolution, _Message, _Opts, _Count) -> ignored;
+increment(signature_base, _Message, _Opts, _Count) -> ignored;
+increment(id_base, _Message, _Opts, _Count) -> ignored;
+increment(parsing, _Message, _Opts, _Count) -> ignored;
+increment(Topic, Message, _Opts, Count) ->
     case parse_name(Message) of
         <<"debug", _/binary>> -> ignored;
         EventName ->
             TopicBin = parse_name(Topic),
-            case hb_name:lookup(?MODULE) of
+            case find_event_server() of
                 Pid when is_pid(Pid) ->
-                    Pid ! {increment, TopicBin, EventName};
+                    Pid ! {increment, TopicBin, EventName, Count};
                 undefined ->
                     PID = spawn(fun() -> server() end),
                     hb_name:register(?MODULE, PID),
-                    PID ! {increment, TopicBin, EventName}
+                    PID ! {increment, TopicBin, EventName, Count}
             end
     end.
 
+%% @doc Increment the call paths and individual upstream calling functions of
+%% the current execution. This function generates the stacktrace itself. It is
+%% **extremely** expensive, so it should only be used in very specific cases.
+%% Do not ship code that calls this function to prod.
+increment_callers(Topic) ->
+    increment_callers(Topic, erlang).
+increment_callers(Topic, Type) ->
+    BinTopic = hb_util:bin(Topic),
+    increment(
+        <<BinTopic/binary, "-call-paths">>,
+        hb_format:trace_short(Type),
+        #{}
+    ),
+    lists:foreach(
+        fun(Caller) ->
+            increment(<<BinTopic/binary, "-callers">>, Caller, #{})
+        end,
+        hb_format:trace_to_list(hb_format:get_trace(Type))
+    ).
+
+%% @doc Return a message containing the current counter values for all logged
+%% HyperBEAM events. The result comes in a form as follows:
+%%      /GroupName/EventName -> Count
+%% Where the `EventName` is derived from the value of the first term sent to the
+%% `?event(...)' macros.
+counters() ->
+    UnaggregatedCounts =
+        [
+            {Group, Name, Count}
+        ||
+            {{default, <<"event">>, [Group, Name], _}, Count, _} <- raw_counters()
+        ],
+    lists:foldl(
+        fun({Group, Name, Count}, Acc) -> 
+            Acc#{
+                Group => (maps:get(Group, Acc, #{}))#{
+                    Name => maps:get(Name, maps:get(Group, Acc, #{}), 0) + Count
+                }
+            }
+        end,
+        #{},
+        UnaggregatedCounts
+    ).
+
+%% @doc Return the change in the event counters before and after executing the
+%% given function.
+diff(Fun) ->
+    diff(Fun, #{}).
+diff(Fun, Opts) ->
+    EventsBefore = counters(),
+    Res = Fun(),
+    EventsAfter = counters(),
+    {hb_message:diff(EventsBefore, EventsAfter, Opts), Res}.
+
+-ifdef(NO_EVENTS).
+raw_counters() ->
+    [].
+-else.
+raw_counters() ->
+    ets:tab2list(prometheus_counter_table).
+-endif.
+
+%% @doc Find the event server, creating it if it doesn't exist. We cache the
+%% result in the process dictionary to avoid looking it up multiple times.
+find_event_server() ->
+    case erlang:get({event_server, ?MODULE}) of
+        {cached, Pid} -> Pid;
+        undefined ->
+            PID =
+                case hb_name:lookup(?MODULE) of
+                    Pid when is_pid(Pid) -> Pid;
+                    undefined ->
+                        NewServer = spawn(fun() -> server() end),
+                        hb_name:register(?MODULE, NewServer),
+                        NewServer
+                end,
+            erlang:put({event_server, ?MODULE}, {cached, PID}),
+            PID
+    end.
+
 server() ->
     await_prometheus_started(),
     prometheus_counter:declare(
@@ -112,19 +207,25 @@ server() ->
     handle_events().
 handle_events() ->
     receive
-        {increment, TopicBin, EventName} ->
+        {increment, TopicBin, EventName, Count} ->
             case erlang:process_info(self(), message_queue_len) of
                 {message_queue_len, Len} when Len > ?OVERLOAD_QUEUE_LENGTH ->
-                    ?debug_print(
-                        {warning,
-                            prometheus_event_queue_overloading,
-                            {queue, Len},
-                            {current_message, EventName}
-                        }
-                    );
+                    % Print a warning, but do so less frequently the more 
+                    % overloaded the system is.
+                    case rand:uniform(max(1000, Len - ?OVERLOAD_QUEUE_LENGTH)) of
+                        1 ->
+                            ?debug_print(
+                                {warning,
+                                    prometheus_event_queue_overloading,
+                                    {queue, Len},
+                                    {current_message, EventName}
+                                }
+                            );
+                        _ -> ignored
+                    end;
                 _ -> ignored
             end,
-            prometheus_counter:inc(<<"event">>, [TopicBin, EventName]),
+            prometheus_counter:inc(<<"event">>, [TopicBin, EventName], Count),
             handle_events()
     end.
 
@@ -146,4 +247,43 @@ parse_name(Name) when is_binary(Name) ->
     Name;
 parse_name(Name) when is_list(Name) ->
     iolist_to_binary(Name);
-parse_name(_) -> no_event_name.
\ No newline at end of file
+parse_name(_) -> no_event_name.
+
+%%% Benchmark tests
+
+%% @doc Benchmark the performance of a full log of an event.
+benchmark_event_test() ->
+    Iterations =
+        hb_test_utils:benchmark(
+            fun() ->
+                log(test_module, {test, 1})
+            end
+        ),
+    hb_test_utils:benchmark_print(<<"Recorded">>, <<"events">>, Iterations),
+    ?assert(Iterations >= 1000),
+    ok.
+
+%% @doc Benchmark the performance of looking up whether a topic and module
+%% should be printed.
+benchmark_print_lookup_test() ->
+    DefaultOpts = hb_opts:default_message_with_env(),
+    Iterations =
+        hb_test_utils:benchmark(
+            fun() ->
+                should_print(test_module, DefaultOpts)
+                    orelse should_print(test_event, DefaultOpts)
+            end
+        ),
+    hb_test_utils:benchmark_print(<<"Looked-up">>, <<"topics">>, Iterations),
+    ?assert(Iterations >= 1000),
+    ok.
+
+%% @doc Benchmark the performance of incrementing an event.
+benchmark_increment_test() ->
+    Iterations =
+        hb_test_utils:benchmark(
+            fun() -> increment(test_module, {test, 1}, #{}) end
+        ),
+    hb_test_utils:benchmark_print(<<"Incremented">>, <<"events">>, Iterations),
+    ?assert(Iterations >= 1000),
+    ok.
\ No newline at end of file
diff --git a/src/hb_examples.erl b/src/hb_examples.erl
index 93fd2680f..f115da62c 100644
--- a/src/hb_examples.erl
+++ b/src/hb_examples.erl
@@ -13,7 +13,9 @@
 %% 4. The relay succeeds when the client has enough balance.
 %% 5. The received message is signed by the host using http-sig and validates
 %%    correctly.
-relay_with_payments_test() ->
+relay_with_payments_test_() ->
+    {timeout, 30, fun relay_with_payments/0}.
+relay_with_payments() ->
     HostWallet = ar_wallet:new(),
     ClientWallet = ar_wallet:new(),
     ClientAddress = hb_util:human_id(ar_wallet:to_address(ClientWallet)),
@@ -59,15 +61,17 @@ relay_with_payments_test() ->
     Res2 = hb_http:get(HostNode, ClientMessage1, #{}),
     ?assertMatch({ok, #{ <<"body">> := Bin }} when byte_size(Bin) > 10_000, Res2),
     {ok, Resp} = Res2,
-    ?assert(length(hb_message:signers(Resp)) > 0),
-    ?assert(hb_message:verify(Resp)).
+    ?assert(length(hb_message:signers(Resp, #{})) > 0),
+    ?assert(hb_message:verify(Resp, all, #{})).
 
 %% @doc Gain signed WASM responses from a node and verify them.
 %% 1. Start the client with a small balance.
 %% 2. Execute a simple WASM function on the host node.
 %% 3. Verify the response is correct and signed by the host node.
 %% 4. Get the balance of the client and verify it has been deducted.
-paid_wasm_test() ->
+paid_wasm_test_() ->
+    {timeout, 30, fun paid_wasm/0}.
+paid_wasm() ->
     HostWallet = ar_wallet:new(),
     ClientWallet = ar_wallet:new(),
     ClientAddress = hb_util:human_id(ar_wallet:to_address(ClientWallet)),
@@ -79,7 +83,13 @@ paid_wasm_test() ->
         },
     HostNode =
         hb_http_server:start_node(
-            #{
+            Opts = #{
+				store => [
+					#{
+						<<"store-module">> => hb_store_fs,
+						<<"name">> => <<"cache-TEST">>
+					}
+				],
                 simple_pay_ledger => #{ ClientAddress => 100 },
                 simple_pay_price => 10,
                 operator => ar_wallet:to_address(HostWallet),
@@ -99,21 +109,21 @@ paid_wasm_test() ->
                 <<"body">> => WASMFile,
                 <<"parameters+list">> => <<"3.0">>
             },
-            ClientWallet
+            Opts#{ priv_wallet => ClientWallet }
         ),
-    {ok, Res} = hb_http:post(HostNode, ClientMessage1, #{}),
+    {ok, Res} = hb_http:post(HostNode, ClientMessage1, Opts),
     % Check that the message is signed by the host node.
-    ?assert(length(hb_message:signers(Res)) > 0),
-    ?assert(hb_message:verify(Res)),
+    ?assert(length(hb_message:signers(Res, Opts)) > 0),
+    ?assert(hb_message:verify(Res, all, Opts)),
     % Now we have the results, we can verify them.
-    ?assertMatch(6.0, hb_ao:get(<<"output/1">>, Res, #{})),
+    ?assertMatch(6.0, hb_ao:get(<<"output/1">>, Res, Opts)),
     % Check that the client's balance has been deducted.
     ClientMessage2 =
         hb_message:commit(
-            #{<<"path">> => <<"/~simple-pay@1.0/balance">>},
+            #{<<"path">> => <<"/~p4@1.0/balance">>},
             ClientWallet
         ),
-    {ok, Res2} = hb_http:get(HostNode, ClientMessage2, #{}),
+    {ok, Res2} = hb_http:get(HostNode, ClientMessage2, Opts),
     ?assertMatch(60, Res2).
 
 create_schedule_aos2_test_disabled() ->
@@ -191,4 +201,169 @@ schedule(ProcMsg, Target, Wallet, Node) ->
             Wallet
         ),
     ?event({signed_req, SignedReq}),
-    hb_http:post(Node, SignedReq, #{}).
\ No newline at end of file
+    hb_http:post(Node, SignedReq, #{}).
+
+
+%% @doc Test that we can schedule an ANS-104 data item on a relayed node. The
+%% input to the relaying server comes in the form of a serialized ANS-104
+%% data item, which should then be correctly deserialized and sent to the
+%% scheduler node.
+relay_schedule_ans104_test() ->
+    SchedulerWallet = ar_wallet:new(),
+    ComputeWallet = ar_wallet:new(),
+    RelayWallet = ar_wallet:new(),
+    ?event(debug_test,
+        {wallets,
+            {scheduler, hb_util:human_id(SchedulerWallet)},
+            {compute, hb_util:human_id(ComputeWallet)},
+            {relay, hb_util:human_id(RelayWallet)}
+        }
+    ),
+    Scheduler =
+        hb_http_server:start_node(
+            #{
+                on => #{
+                    <<"start">> => #{
+                        <<"device">> => <<"scheduler@1.0">>,
+                        <<"path">> => <<"location">>,
+                        <<"method">> => <<"POST">>,
+                        <<"target">> => <<"self">>,
+                        <<"require-codec">> => <<"ans104@1.0">>,
+                        <<"hook">> => #{
+                            <<"result">> => <<"ignore">>,
+                            <<"commit-request">> => true
+                        }
+                    }
+                },
+                store => [hb_test_utils:test_store()],
+                priv_wallet => SchedulerWallet
+            }
+        ),
+    ?event(debug_test, {scheduler, Scheduler}),
+    Compute =
+        hb_http_server:start_node(
+            #{
+                priv_wallet => ComputeWallet,
+                store =>
+                    [
+                        ComputeStore = hb_test_utils:test_store(),
+                        #{
+                            <<"store-module">> => hb_store_remote_node,
+                            <<"name">> => <<"cache-TEST/remote-node">>,
+                            <<"node">> => Scheduler
+                        }
+                    ]
+            }
+        ),
+    % Get the scheduler location of the scheduling node and write it to the
+    % compute node's store.
+    {ok, SchedulerLocation} =
+        hb_http:get(
+            Scheduler,
+            <<"/~scheduler@1.0/location">>,
+            #{}
+        ),
+    ?event({scheduler_location, SchedulerLocation}),
+    dev_scheduler_cache:write_location(
+        hb_maps:get(<<"body">>, SchedulerLocation, <<"NO BODY">>, #{}),
+        #{ store => [ComputeStore] }
+    ),
+    % Create the relaying server.
+    Relay =
+        hb_http_server:start_node(#{
+            priv_wallet => RelayWallet,
+            relay_allow_commit_request => true,
+            store => [hb_test_utils:test_store()],
+            routes =>
+                [
+                    #{
+                        <<"template">> => <<"^/push">>,
+                        <<"strategy">> => <<"Nearest">>,
+                        <<"nodes">> => [
+                            #{
+                                <<"wallet">> => hb_util:human_id(SchedulerWallet),
+                                <<"prefix">> => Scheduler
+                            }
+                        ]
+                    },
+                    #{
+                        <<"template">> => <<"^/.*">>,
+                        <<"strategy">> => <<"Nearest">>,
+                        <<"nodes">> => [
+                            #{
+                                <<"wallet">> => hb_util:human_id(ComputeWallet),
+                                <<"prefix">> => Compute
+                            }
+                        ]
+                    }
+                ],
+            on => #{
+                <<"request">> =>
+                    #{
+                        <<"device">> => <<"router@1.0">>,
+                        <<"path">> => <<"preprocess">>,
+                        <<"commit-request">> => true
+                    }
+            }
+        }),
+    ?event(debug_test,
+        {nodes,
+            {scheduler, {url, Scheduler}, {wallet, hb_util:human_id(SchedulerWallet)}},
+            {compute, {url, Compute}, {wallet, hb_util:human_id(ComputeWallet)}},
+            {relay, {url, Relay}, {wallet, hb_util:human_id(RelayWallet)}}
+        }
+    ),
+    ClientOpts =
+        #{
+            store => [hb_test_utils:test_store()],
+            priv_wallet => ar_wallet:new()
+        },
+    % Create process to schedule, then send it to the relaying server as
+    % a serialized ANS-104 data item.
+    Process =
+        hb_message:commit(
+            #{
+                <<"device">> => <<"process@1.0">>,
+                <<"execution-device">> => <<"test-device@1.0">>,
+                <<"push-device">> => <<"push@1.0">>,
+                <<"scheduler">> => hb_util:human_id(SchedulerWallet),
+                <<"scheduler-device">> => <<"scheduler@1.0">>,
+                <<"module">> => <<"URgYpPQzvxxfYQtjrIQ116bl3YBfcImo3JEnNo8Hlrk">>
+            },
+            ClientOpts,
+            #{ <<"commitment-device">> => <<"ans104@1.0">> }
+        ),
+    % Push the initial message via the scheduler node.
+    ScheduleRes =
+        hb_http:post(
+            Relay,
+            Process#{
+                <<"path">> => <<"push">>,
+                <<"codec-device">> => <<"ans104@1.0">>
+            },
+            ClientOpts
+        ),
+    ?event(debug_test, {post_result, ScheduleRes}),
+    ?assertMatch({ok, #{ <<"status">> := 200, <<"slot">> := 0 }}, ScheduleRes),
+    % Push another message via the compute node.
+    ProcID = hb_message:id(Process, all, ClientOpts),
+    ToPush =
+        hb_message:commit(
+            #{
+                <<"test-key">> => <<"value">>,
+                <<"rand-key">> => hb_util:encode(crypto:strong_rand_bytes(32))
+            },
+            ClientOpts,
+            #{ <<"commitment-device">> => <<"ans104@1.0">> }
+        ),
+    PushRes =
+        hb_http:post(
+            Relay,
+            ToPush#{
+                <<"path">> => <<ProcID/binary, "/push">>,
+                <<"codec-device">> => <<"ans104@1.0">>
+            },
+            ClientOpts
+        ),
+    ?event(debug_test, {post_result, PushRes}),
+    ?assertMatch({ok, #{ <<"status">> := 200, <<"slot">> := 1 }}, PushRes).
\ No newline at end of file
diff --git a/src/hb_features.erl b/src/hb_features.erl
index 5f9378baf..8cd922f37 100644
--- a/src/hb_features.erl
+++ b/src/hb_features.erl
@@ -6,7 +6,7 @@
 %%% Public API.
 -export([all/0, enabled/1]).
 %%% Individual feature flags.
--export([http3/0, rocksdb/0, test/0, genesis_wasm/0]).
+-export([http3/0, rocksdb/0, test/0, genesis_wasm/0, eflame/0]).
 
 %% @doc Returns a list of all feature flags that the node supports.
 all() ->
@@ -20,7 +20,7 @@ all() ->
             end,
             ?MODULE:module_info(exports)
         ),
-    maps:from_list(
+    hb_maps:from_list(
         lists:map(
             fun(Name) ->
                 {Name, ?MODULE:Name()}
@@ -31,7 +31,7 @@ all() ->
 
 %% @doc Returns true if the feature flag is enabled.
 enabled(Feature) ->
-    maps:get(Feature, all(), false).
+    hb_maps:get(Feature, all(), false).
 
 %%% Individual feature flags.
 %%% These functions use the `-ifdef' macro to conditionally return a boolean
@@ -56,6 +56,12 @@ genesis_wasm() -> true.
 genesis_wasm() -> false.
 -endif.
 
+-ifdef(ENABLE_EFLAME).
+eflame() -> true.
+-else.
+eflame() -> false.
+-endif.
+
 -ifdef(TEST).
 test() -> true.
 -else.
diff --git a/src/hb_format.erl b/src/hb_format.erl
new file mode 100644
index 000000000..e6651f72a
--- /dev/null
+++ b/src/hb_format.erl
@@ -0,0 +1,898 @@
+%%% @doc Formatting and debugging utilities for HyperBEAM.
+%%%
+%%% This module provides text formatting capabilities for debugging output,
+%%% message pretty-printing, stack trace formatting, and human-readable
+%%% representations of binary data and cryptographic identifiers.
+%%% 
+%%% The functions in this module are primarily used for development and
+%%% debugging purposes, supporting the logging and diagnostic infrastructure
+%%% throughout the HyperBEAM system.
+-module(hb_format).
+%%% Public API.
+-export([term/1, term/2, term/3]).
+-export([print/1, print/3, print/4, print/5, eunit_print/2]).
+-export([message/1, message/2, message/3]).
+-export([binary/1, error/2, trace/1, trace_short/0, trace_short/1]).
+-export([indent/2, indent/3, indent/4, indent_lines/2, maybe_multiline/3]).
+-export([remove_leading_noise/1, remove_trailing_noise/1, remove_noise/1]).
+%%% Public Utility Functions.
+-export([escape_format/1, short_id/1, trace_to_list/1]).
+-export([get_trace/1, print_trace/4, trace_macro_helper/5, print_trace_short/4]).
+-include("include/hb.hrl").
+
+%%% Characters that are considered noise and should be removed from strings
+%%% with the `remove_noise_[leading|trailing]' functions.
+-define(NOISE_CHARS, " \t\n,").
+
+%% @doc Print a message to the standard error stream, prefixed by the amount
+%% of time that has elapsed since the last call to this function.
+print(X) ->
+    print(X, <<>>, #{}).
+print(X, Info, Opts) ->
+    io:format(
+        standard_error,
+        "=== HB DEBUG ===~s==>~n~s~n",
+        [Info, term(X, Opts, 0)]
+    ),
+    X.
+print(X, Mod, Func, LineNum) ->
+    print(X, debug_trace(Mod, Func, LineNum, #{}), #{}).
+print(X, Mod, Func, LineNum, Opts) ->
+    Now = erlang:system_time(millisecond),
+    Last = erlang:put(last_debug_print, Now),
+    TSDiff = case Last of undefined -> 0; _ -> Now - Last end,
+    Info =
+        hb_util:bin(
+            io_lib:format(
+                "[~pms in ~s @ ~s]",
+                [
+                    TSDiff,
+                    case server_id() of
+                        undefined -> hb_util:bin(io_lib:format("~p", [self()]));
+                        ServerID ->
+                            hb_util:bin(
+                                io_lib:format(
+                                    "~s (~p)",
+                                    [short_id(ServerID), self()]
+                                )
+                            )
+                    end,
+                    debug_trace(Mod, Func, LineNum, Opts)
+                ]
+            )
+        ),
+    print(X, Info, Opts).
+
+%% @doc Retreive the server ID of the calling process, if known.
+server_id() ->
+    server_id(#{ server_id => undefined }).
+server_id(Opts) ->
+    case hb_opts:get(server_id, undefined, Opts) of
+        undefined -> get(server_id);
+        ServerID -> ServerID
+    end.
+
+%% @doc Generate the appropriate level of trace for a given call.
+debug_trace(Mod, Func, Line, Opts) ->
+    case hb_opts:get(debug_print_trace, false, #{}) of
+        short ->
+            Trace =
+                case hb_opts:get(debug_trace_type, erlang, Opts) of
+                    erlang -> get_trace(erlang);
+                    ao ->
+                        % If we are printing AO-Core traces, we add the module
+                        % and line number to the end to show exactly where in
+                        % the handler-flow the event arose.
+                        [
+                            hb_util:bin(trace_element({Mod, Line}))
+                        |
+                            get_trace(ao)
+                        ]
+                end,
+            trace_short(Trace);
+        false ->
+            io_lib:format("~p:~w ~p", [Mod, Line, Func])
+    end.
+
+%% @doc Convert a term to a string for debugging print purposes.
+term(X) -> term(X, #{}).
+term(X, Opts) -> term(X, Opts, 0).
+term(X, Opts, Indent) ->
+    try do_term(X, Opts, Indent)
+    catch A:B:C ->
+        Mode = hb_opts:get(mode, prod, Opts),
+        PrintFailPreference = hb_opts:get(debug_print_fail_mode, quiet, Opts),
+        case {Mode, PrintFailPreference} of
+            {debug, quiet} ->
+                indent("[!Format failed!] ~p", [X], Opts, Indent);
+            {debug, _} ->
+                indent(
+                    "[PRINT FAIL:] ~80p~n===== PRINT ERROR WAS ~p:~p =====~n~s",
+                    [
+                        X,
+                        A,
+                        B,
+                        hb_util:bin(
+                            trace(
+                                C,
+                                hb_opts:get(stack_print_prefixes, [], #{})
+                            )
+                        )
+                    ],
+                    Opts,
+                    Indent
+                );
+            _ ->
+                indent("[!Format failed!]", [], Opts, Indent)
+        end
+    end.
+
+do_term(
+    { { {rsa, _PublicExpnt1}, _Priv1, _Priv2 },
+      { {rsa, _PublicExpnt2}, Pub }
+    },
+    Opts, Indent
+) ->
+    address(Pub, Opts, Indent);
+do_term(
+    { AtomValue,
+      {
+        { {rsa, _PublicExpnt1}, _Priv1, _Priv2 },
+        { {rsa, _PublicExpnt2}, Pub }
+      }
+    },
+    Opts, Indent
+) ->
+    AddressString = address(Pub, Opts, Indent),
+    indent("~p: ~s", [AtomValue, AddressString], Opts, Indent);
+do_term({explicit, X}, Opts, Indent) ->
+    indent("[Explicit:] ~p", [X], Opts, Indent);
+do_term({string, X}, Opts, Indent) ->
+    indent("~s", [X], Opts, Indent);
+do_term({trace, Trace}, Opts, Indent) ->
+    indent("~n~s", [trace(Trace)], Opts, Indent);
+do_term({as, undefined, Msg}, Opts, Indent) ->
+    "\n" ++ indent("Subresolve => ", [], Opts, Indent) ++
+        maybe_multiline(Msg, Opts, Indent + 1);
+do_term({as, DevID, Msg}, Opts, Indent) ->
+    "\n" ++ indent("Subresolve as ~s => ", [DevID], Opts, Indent) ++
+        maybe_multiline(Msg, Opts, Indent + 1);
+do_term({X, Y}, Opts, Indent) when is_atom(X) and is_atom(Y) ->
+    indent("~p: ~p", [X, Y], Opts, Indent);
+do_term({X, Y}, Opts, Indent) when is_record(Y, tx) ->
+    indent("~p: [TX item]~n~s",
+        [X, ar_bundles:format(Y, Indent + 1, Opts)],
+        Opts,
+        Indent
+    );
+do_term({X, Y}, Opts, Indent) when is_map(Y); is_list(Y) ->
+    Formatted = maybe_multiline(Y, Opts, Indent + 1),
+    indent(
+        case is_binary(X) of
+            true -> "~s";
+            false -> "~p"
+        end ++ "~s",
+        [
+            X,
+            case is_multiline(Formatted) of
+                true -> " ==>" ++ Formatted;
+                false -> ": " ++ Formatted
+            end
+        ],
+        Opts,
+        Indent
+    );
+do_term({X, Y}, Opts, Indent) ->
+    indent(
+        "~s: ~s",
+        [
+            remove_leading_noise(term(X, Opts, Indent)),
+            remove_leading_noise(term(Y, Opts, Indent))
+        ],
+        Opts,
+        Indent
+    );
+do_term(TX, Opts, Indent) when is_record(TX, tx) ->
+    indent("[TX item]~n~s",
+        [ar_bundles:format(TX, Indent, Opts)],
+        Opts,
+        Indent
+    );
+do_term(MaybePrivMap, Opts, Indent) when is_map(MaybePrivMap) ->
+    Map = hb_private:reset(MaybePrivMap),
+    case maybe_short(Map, Opts, Indent) of
+        {ok, SimpleFmt} -> SimpleFmt;
+        error ->
+            "\n" ++ lists:flatten(message(Map, Opts, Indent))
+    end;
+do_term(Tuple, Opts, Indent) when is_tuple(Tuple) ->
+    tuple(Tuple, Opts, Indent);
+do_term(X, Opts, Indent) when is_binary(X) ->
+    indent("~s", [binary(X)], Opts, Indent);
+do_term(Str = [X | _], Opts, Indent) when is_integer(X) andalso X >= 32 andalso X < 127 ->
+    indent("~s", [Str], Opts, Indent);
+do_term(MsgList, Opts, Indent) when is_list(MsgList) ->
+    list(MsgList, Opts, Indent);
+do_term(X, Opts, Indent) ->
+    indent("~80p", [X], Opts, Indent).
+
+%% @doc If the user attempts to print a wallet, format it as an address.
+address(Wallet, Opts, Indent) ->
+    indent("Wallet [Addr: ~s]",
+        [short_id(hb_util:human_id(ar_wallet:to_address(Wallet)))], 
+        Opts, 
+        Indent
+    ).
+
+%% @doc Helper function to format tuples with arity greater than 2.
+tuple(Tuple, Opts, Indent) ->
+    to_lines(lists:map(
+        fun(Elem) ->
+            term(Elem, Opts, Indent)
+        end,
+        tuple_to_list(Tuple)
+    )).
+
+%% @doc Format a list. Comes in three forms: all on one line, individual items
+%% on their own line, or each item a multi-line string.
+list(MsgList, Opts, Indent) ->
+    case maybe_short(MsgList, Opts, Indent) of
+        {ok, SimpleFmt} -> SimpleFmt;
+        error ->
+            {ToPrint, Footer} =
+                case max_keys(Opts) of
+                    Max when length(MsgList) > Max ->
+                        {
+                            lists:sublist(MsgList, Max),
+                            hb_util:bin(
+                                io_lib:format(
+                                    "[+ ~p additional list elements]",
+                                    [length(MsgList) - Max]
+                                )
+                            )
+                        };
+                    _ -> {MsgList, <<>>}
+                end,
+            "\n" ++
+                indent("List [~w] {", [length(MsgList)], Opts, Indent) ++
+                list_lines(ToPrint, Footer, Opts, Indent)
+    end.
+
+%% @doc Format a list as a multi-line string.
+list_lines(MsgList, Footer, Opts, Indent) ->
+    Numbered = hb_util:number(MsgList),
+    Lines =
+        lists:map(
+            fun({N, Msg}) ->
+                list_item(N, Msg, Opts, Indent)
+            end,
+            Numbered
+        ),
+    AnyLong =
+        lists:any(
+            fun({Mode, _}) -> Mode == multiline end,
+            Lines
+        ),
+    IndentedFooterList =
+        if Footer == <<>> -> "";
+        true -> hb_util:list(indent(Footer, Indent + 1)) ++ "\n"
+        end,
+    case AnyLong of
+        false ->
+            "\n" ++
+                remove_trailing_noise(
+                    lists:flatten(
+                        lists:map(
+                            fun({_, Line}) ->
+                                Line
+                            end,
+                            Lines
+                        )
+                    )
+                ) ++ "\n" ++
+                IndentedFooterList ++
+                indent("}", [], Opts, Indent);
+        true ->
+            "\n" ++
+            lists:flatten(lists:map(
+                fun({N, Msg}) ->
+                    {_, Line} = list_item(multiline, N, Msg, Opts, Indent),
+                    Line
+                end,
+                Numbered
+            )) ++
+            IndentedFooterList ++
+            indent("}", [], Opts, Indent)
+    end.
+
+%% @doc Format a single element of a list.
+list_item(N, Msg, Opts, Indent) ->
+    case list_item(short, N, Msg, Opts, Indent) of
+        {short, String} -> {short, String};
+        error -> list_item(multiline, N, Msg, Opts, Indent)
+    end.
+list_item(short, N, Msg, Opts, Indent) ->
+    case maybe_short(Msg, Opts, Indent) of
+        {ok, SimpleFmt} ->
+            {short, indent("~s => ~s~n", [N, SimpleFmt], Opts, Indent + 1)};
+        error -> error
+    end;
+list_item(multiline, N, Msg, Opts, Indent) ->
+    Formatted =
+        case is_multiline(Base = term(Msg, Opts, Indent + 2)) of
+            true -> Base;
+            false -> remove_leading_noise(Base)
+        end,
+    {
+        multiline,
+        indent(
+            "~s => ~s~n",
+            [N, Formatted], 
+            Opts,
+            Indent + 1
+        )
+    }.
+
+%% @doc Join a list of strings and remove trailing noise.
+to_lines(Elems) ->
+    remove_trailing_noise(do_to_lines(Elems)).
+do_to_lines([]) -> [];
+do_to_lines(In =[RawElem | Rest]) ->
+    Elem = lists:flatten(RawElem),
+    case lists:member($\n, Elem) of
+        true -> lists:flatten(lists:join("\n", In));
+        false -> Elem ++ ", " ++ do_to_lines(Rest)
+    end.
+
+%% @doc Remove any leading or trailing noise from a string.
+remove_noise(Str) ->
+    remove_leading_noise(remove_trailing_noise(Str)).
+
+%% @doc Remove any leading whitespace from a string.
+remove_leading_noise(Str) ->
+    remove_leading_noise(Str, ?NOISE_CHARS).
+remove_leading_noise(Bin, Noise) when is_binary(Bin) ->
+    hb_util:bin(remove_leading_noise(hb_util:list(Bin), Noise));
+remove_leading_noise([], _) -> [];
+remove_leading_noise([Char|Str], Noise) ->
+    case lists:member(Char, Noise) of
+        true ->
+            remove_leading_noise(Str, Noise);
+        false -> [Char|Str]
+    end.
+
+%% @doc Remove trailing noise characters from a string. By default, this is
+%% whitespace, newlines, and `,'.
+remove_trailing_noise(Str) ->
+    removing_trailing_noise(Str, ?NOISE_CHARS).
+removing_trailing_noise(Bin, Noise) when is_binary(Bin) ->
+    removing_trailing_noise(binary:bin_to_list(Bin), Noise);
+removing_trailing_noise(BinList, Noise) when is_list(BinList) ->
+    case lists:member(lists:last(BinList), Noise) of
+        true ->
+            removing_trailing_noise(lists:droplast(BinList), Noise);
+        false -> BinList
+    end.
+
+%% @doc Format a string with an indentation level.
+indent(Str, Indent) -> indent(Str, #{}, Indent).
+indent(Str, Opts, Indent) -> indent(Str, [], Opts, Indent).
+indent(FmtStr, Terms, Opts, Ind) ->
+    IndentSpaces = hb_opts:get(debug_print_indent, Opts),
+    EscapedFmt = escape_format(FmtStr),
+    lists:droplast(
+        lists:flatten(
+            io_lib:format(
+                [$\s || _ <- lists:seq(1, Ind * IndentSpaces)] ++
+                    lists:flatten(hb_util:list(EscapedFmt)) ++ "\n",
+                Terms
+            )
+        )
+    ).
+
+%% @doc Escape a string for use as an io_lib:format specifier.
+escape_format(Str) when is_list(Str) ->
+    re:replace(
+        Str,
+        "~([a-z\\-_]+@[0-9]+\\.[0-9]+)", "~~\\1",
+        [global, {return, list}]
+    );
+escape_format(Else) -> Else.
+
+%% @doc Format an error message as a string.
+error(ErrorMsg, Opts) ->
+    Type = hb_ao:get(<<"type">>, ErrorMsg, <<"">>, Opts),
+    Details = hb_ao:get(<<"details">>, ErrorMsg, <<"">>, Opts),
+    Stacktrace = hb_ao:get(<<"stacktrace">>, ErrorMsg, <<"">>, Opts),
+    hb_util:bin(
+        [
+            <<"Termination type: '">>, Type,
+            <<"'\n\nStacktrace:\n\n">>, Stacktrace,
+            <<"\n\nError details:\n\n">>, Details
+        ]
+    ).
+
+%% @doc Take a series of strings or a combined string and format as a
+%% single string with newlines and indentation to the given level. Note: This
+%% function returns a binary.
+indent_lines(Strings, Indent) when is_binary(Strings) ->
+    indent_lines(binary:split(Strings, <<"\n">>, [global]), Indent);
+indent_lines(Strings, Indent) when is_list(Strings) ->
+    hb_util:bin(lists:join(
+        "\n",
+        [
+            indent(hb_util:list(String), #{}, Indent)
+        ||
+            String <- Strings
+        ]
+    )).
+
+%% @doc Format a binary as a short string suitable for printing.
+binary(Bin) ->
+    case short_id(Bin) of
+        undefined ->
+            MaxBinPrint = hb_opts:get(debug_print_binary_max),
+            Printable =
+                binary:part(
+                    Bin,
+                    0,
+                    case byte_size(Bin) of
+                        X when X < MaxBinPrint -> X;
+                        _ -> MaxBinPrint
+                    end
+                ),
+            PrintSegment =
+                case is_human_binary(Printable) of
+                    true -> Printable;
+                    false -> hb_util:encode(Printable)
+                end,
+            lists:flatten(
+                [
+                    "\"",
+                    [PrintSegment],
+                    case Printable == Bin of
+                        true -> "\"";
+                        false ->
+                            io_lib:format(
+                                "...\" <~s bytes>",
+                                [hb_util:human_int(byte_size(Bin))]
+                            )
+                    end
+                ]
+            );
+        ShortID ->
+            lists:flatten(io_lib:format("~s", [ShortID]))
+    end.
+
+
+%% @doc Format a map as either a single line or a multi-line string depending
+%% on the value of the `debug_print_map_line_threshold' runtime option.
+maybe_multiline(X, Opts, Indent) ->
+    case maybe_short(X, Opts, Indent) of
+        {ok, SimpleFmt} -> SimpleFmt;
+        error ->
+            "\n" ++ lists:flatten(message(X, Opts, Indent))
+    end.
+
+%% @doc Attempt to generate a short formatting of a message, using the given
+%% node options.
+maybe_short(X, Opts, _Indent) ->
+    MaxLen = hb_opts:get(debug_print_map_line_threshold, 100, Opts),
+    SimpleFmt =
+        case is_binary(X) of
+            true -> binary(X);
+            false -> io_lib:format("~p", [X])
+        end,
+    case is_multiline(SimpleFmt) orelse (lists:flatlength(SimpleFmt) > MaxLen) of
+        true -> error;
+        false -> {ok, SimpleFmt}
+    end.
+
+%% @doc Is the given string a multi-line string?
+is_multiline(Str) ->
+    lists:member($\n, Str).
+
+%% @doc Format and print an indented string to standard error.
+eunit_print(FmtStr, FmtArgs) ->
+    io:format(
+        standard_error,
+        "~n~s ",
+        [indent(FmtStr ++ "...", FmtArgs, #{}, 4)]
+    ).
+
+%% @doc Print the trace of the current stack, up to the first non-hyperbeam
+%% module. Prints each stack frame on a new line, until it finds a frame that
+%% does not start with a prefix in the `stack_print_prefixes' hb_opts.
+%% Optionally, you may call this function with a custom label and caller info,
+%% which will be used instead of the default.
+print_trace(Stack, CallMod, CallFunc, CallLine) ->
+    print_trace(Stack, "HB TRACE",
+        lists:flatten(io_lib:format("[~s:~w ~p]",
+            [CallMod, CallLine, CallFunc])
+    )).
+
+print_trace(Stack, Label, CallerInfo) ->
+    io:format(standard_error, "=== ~s ===~s==>~n~s",
+        [
+            Label, CallerInfo,
+            lists:flatten(trace(Stack))
+        ]).
+
+%% @doc Format a stack trace as a list of strings, one for each stack frame.
+%% Each stack frame is formatted if it matches the `stack_print_prefixes'
+%% option. At the first frame that does not match a prefix in the
+%% `stack_print_prefixes' option, the rest of the stack is not formatted.
+trace(Stack) ->
+    trace(Stack, hb_opts:get(stack_print_prefixes, [], #{})).
+trace([], _) -> [];
+trace([Item|Rest], Prefixes) ->
+    case element(1, Item) of
+        Atom when is_atom(Atom) ->
+            case true of %is_hb_module(Atom, Prefixes) of
+                true ->
+                    [
+                        trace(Item, Prefixes) |
+                        trace(Rest, Prefixes)
+                    ];
+                false -> []
+            end;
+        _ -> []
+    end;
+trace({Func, ArityOrTerm, Extras}, Prefixes) ->
+    trace({no_module, Func, ArityOrTerm, Extras}, Prefixes);
+trace({Mod, Func, ArityOrTerm, Extras}, _Prefixes) ->
+    ExtraMap = hb_maps:from_list(Extras),
+    indent(
+        "~p:~p/~p [~s]~n",
+        [
+            Mod, Func, ArityOrTerm,
+            case hb_maps:get(line, ExtraMap, undefined) of
+                undefined -> "No details";
+                Line ->
+                    hb_maps:get(file, ExtraMap)
+                        ++ ":" ++ integer_to_list(Line)
+            end
+        ],
+        #{},
+        1
+    ).
+
+%% @doc Print a trace to the standard error stream.
+print_trace_short(Trace, Mod, Func, Line) ->
+    io:format(standard_error, "=== [ HB SHORT TRACE ~p:~w ~p ] ==> ~s~n",
+        [
+            Mod, Line, Func,
+            trace_short(Trace)
+        ]
+    ).
+
+%% @doc Return a list of calling modules and lines from a trace, removing all
+%% frames that do not match the `stack_print_prefixes' option.
+trace_to_list(Trace) ->
+    Prefixes = hb_opts:get(stack_print_prefixes, [], #{}),
+    lists:filtermap(
+        fun(TraceItem) when is_binary(TraceItem) ->
+            {true, TraceItem};
+           (TraceItem) ->
+            Formatted = trace_element(TraceItem),
+            case hb_util:is_hb_module(Formatted, Prefixes) of
+                true -> {true, Formatted};
+                false -> false
+            end
+        end,
+        Trace
+    ).
+
+%% @doc Format a trace to a short string.
+trace_short() -> trace_short(get_trace(erlang)).
+trace_short(Type) when is_atom(Type) -> trace_short(get_trace(Type));
+trace_short(Trace) when is_list(Trace) ->
+    lists:join(" / ", lists:reverse(trace_to_list(Trace))).
+
+%% @doc Format a trace element in form `mod:line' or `mod:func' for Erlang
+%% traces, or their raw form for others.
+trace_element(Bin) when is_binary(Bin) -> Bin;
+trace_element({Mod, Line}) ->
+    lists:flatten(io_lib:format("~p:~p", [Mod, Line]));
+trace_element({Mod, _, _, [{file, _}, {line, Line}|_]}) ->
+    lists:flatten(io_lib:format("~p:~p", [Mod, Line]));
+trace_element({Mod, Func, _ArityOrTerm, _Extras}) ->
+    lists:flatten(io_lib:format("~p:~p", [Mod, Func])).
+
+%% @doc Utility function to help macro `?trace/0' remove the first frame of the
+%% stack trace.
+trace_macro_helper(Fun, {_, {_, Stack}}, Mod, Func, Line) ->
+    Fun(Stack, Mod, Func, Line).
+
+%% @doc Get the trace of the current execution. If the argument is `erlang',
+%% we return the Erlang stack trace. If the argument is `ao', we return the
+%% AO-Core execution stack.
+get_trace(erlang) ->
+    case catch error(debugging_print) of
+        {_, {_, Stack}} -> normalize_trace(Stack);
+        _ -> []
+    end;
+get_trace(ao) ->
+    case get(ao_stack) of
+        undefined -> [];
+        Stack -> Stack
+    end.
+
+%% @doc Remove all calls from this module from the top of a trace.
+normalize_trace([]) -> [];
+normalize_trace([{Mod, _, _, _}|Rest]) when Mod == ?MODULE ->
+    normalize_trace(Rest);
+normalize_trace(Trace) -> Trace.
+
+%% @doc Format a message for printing, optionally taking an indentation level
+%% to start from.
+message(Item) -> message(Item, #{}).
+message(Item, Opts) -> message(Item, Opts, 0).
+message(Bin, Opts, Indent) when is_binary(Bin) ->
+    indent(
+        binary(Bin),
+        Opts,
+        Indent
+    );
+message(List, Opts, Indent) when is_list(List) ->
+    % Remove the leading newline from the formatted list, if it exists.
+    case term(List, Opts, Indent) of
+        [$\n | String] -> String;
+        String -> String
+    end;
+message(RawMap, Opts, Indent) when is_map(RawMap) ->
+    % Should we filter out the priv key?
+    FilterPriv = hb_opts:get(debug_show_priv, false, Opts),
+    MainPriv = hb_maps:get(<<"priv">>, RawMap, #{}, Opts),
+    % Add private keys to the output if they are not hidden. Opt takes 3 forms:
+    % 1. `false' -- never show priv
+    % 2. `if_present' -- show priv only if there are keys inside
+    % 2. `always' -- always show priv
+    PrivKeys =
+        case {FilterPriv, MainPriv} of
+            {false, _} -> [];
+            {if_present, #{}} -> [];
+            {_, Priv} -> [{<<"!Private!">>, Priv}]
+        end,
+    Map =
+        case FilterPriv of
+            false -> RawMap;
+            _ -> hb_private:reset(RawMap)
+        end,
+    % Define helper functions for formatting elements of the map.
+    ValOrUndef =
+        fun(<<"hashpath">>) ->
+            case Map of
+                #{ <<"priv">> := #{ <<"hashpath">> := HashPath } } ->
+                    short_id(HashPath);
+                _ ->
+                    undefined
+            end;
+        (Key) ->
+            case dev_message:get(Key, Map, Opts) of
+                {ok, Val} ->
+                    case short_id(Val) of
+                        undefined -> Val;
+                        ShortID -> ShortID
+                    end;
+                {error, _} -> undefined
+            end
+        end,
+    FilterUndef =
+        fun(List) ->
+            lists:filter(fun({_, undefined}) -> false; (_) -> true end, List)
+        end,
+    % Prepare the metadata row for formatting.
+    % Note: We try to get the IDs _if_ they are *already* in the map. We do not
+    % force calculation of the IDs here because that may cause significant
+    % overhead unless the `debug_ids' option is set.
+    IDMetadata =
+        case hb_opts:get(debug_ids, false, #{}) of
+            false ->
+                [
+                    {<<"#P">>, ValOrUndef(<<"hashpath">>)},
+                    {<<"*U">>, ValOrUndef(<<"unsigned_id">>)},
+                    {<<"*S">>, ValOrUndef(<<"id">>)}
+                ];
+            true ->
+                {ok, UID} = dev_message:id(Map, #{}, Opts),
+                {ok, ID} =
+                    dev_message:id(Map, #{ <<"commitments">> => <<"all">> }, Opts),
+                [
+                    {<<"#P">>, short_id(ValOrUndef(<<"hashpath">>))},
+                    {<<"*U">>, short_id(UID)}
+                ] ++
+                case ID of
+                    UID -> [];
+                    _ -> [{<<"*S">>, short_id(ID)}]
+                end
+        end,
+    CommitterMetadata =
+        case hb_opts:get(debug_committers, true, Opts) of
+            false -> [];
+            true ->
+                case dev_message:committers(Map, #{}, Opts) of
+                    {ok, []} -> [];
+                    {ok, [Committer]} ->
+                        [{<<"Comm.">>, short_id(Committer)}];
+                    {ok, Committers} ->
+                        [
+                            {
+                                <<"Comms.">>,
+                                string:join(
+                                    lists:map(
+                                        fun(X) ->
+                                            [short_id(X)]
+                                        end,
+                                        Committers
+                                    ),
+                                    ", "
+                                )
+                            }
+                        ]
+                end
+        end,
+    % Concatenate the present metadata rows.
+    Metadata = FilterUndef(lists:flatten([IDMetadata, CommitterMetadata])),
+    % Format the metadata row.
+    Header =
+        indent("Message [~s] {",
+            [
+                string:join(
+                    [
+                        io_lib:format("~s: ~s", [Lbl, Val])
+                        ||
+                            {Lbl, Val} <- Metadata,
+                            Val /= undefined
+                    ],
+                    ", "
+                )
+            ],
+            Opts,
+            Indent
+        ),
+    % Put the path and device rows into the output at the _top_ of the map.
+    PriorityKeys =
+        [
+            {<<"device">>, ValOrUndef(<<"device">>)},
+            {<<"path">>, ValOrUndef(<<"path">>)},
+            {<<"commitments">>, ValOrUndef(<<"commitments">>)}
+        ],
+    % Concatenate the path and device rows with the rest of the key values.
+    UnsortedGeneralKVs =
+        maps:to_list(
+            maps:without(
+                [ PriorityKey || {PriorityKey, _} <- PriorityKeys ],
+                Map
+            )
+        ),
+    % Truncate the keys to print if there are too many. The `truncate' option
+    % may be an integer representing the maximum number of keys that should be
+    % printed, or the atom `infinity' to print all keys.
+    {TruncatedKeys, FooterKeys} =
+        case max_keys(Opts) of
+            Max when length(UnsortedGeneralKVs) > Max ->
+                {
+                    lists:sublist(UnsortedGeneralKVs, Max),
+                    [
+                        {
+                            <<"...">>,
+                            hb_util:bin(
+                                io_lib:format(
+                                    "[+ ~p additional keys]",
+                                    [length(UnsortedGeneralKVs) - Max]
+                                )
+                            )
+                        }
+                    |
+                        PrivKeys
+                    ]
+                };
+            _ -> {UnsortedGeneralKVs, PrivKeys}
+        end,
+    KeyVals =
+        FilterUndef(PriorityKeys) ++
+        lists:sort(
+            fun({K1, _}, {K2, _}) -> K1 < K2 end,
+            TruncatedKeys
+        ) ++
+        FooterKeys,
+    % Format the remaining 'normal' keys and values.
+    Res = lists:map(
+        fun({Key, Val}) ->
+            NormKey = hb_ao:normalize_key(Key, Opts#{ error_strategy => ignore }),
+            KeyStr = 
+                case NormKey of
+                    undefined ->
+                        io_lib:format("~p [!!! INVALID KEY !!!]", [Key]);
+                    _ ->
+                        hb_ao:normalize_key(Key)
+                end,
+            indent(
+                "~s => ~s~n",
+                [
+                    lists:flatten([KeyStr]),
+                    case Val of
+                        NextMap when is_map(NextMap) ->
+                            maybe_multiline(NextMap, Opts, Indent + 2);
+                        Next when is_list(Next); is_record(Next, tx) ->
+                            remove_leading_noise(term(Next, Opts, Indent + 2));
+                        _ when (byte_size(Val) == 32) ->
+                            Short = short_id(Val),
+                            io_lib:format("~s [*]", [Short]);
+                        _ when byte_size(Val) == 43 ->
+                            short_id(Val);
+                        _ when byte_size(Val) == 87 ->
+                            io_lib:format("~s [#p]", [short_id(Val)]);
+                        Bin when is_binary(Bin) ->
+                            binary(Bin);
+                        Link when ?IS_LINK(Link) ->
+                            remove_leading_noise(
+                                hb_util:bin(
+                                    hb_link:format(Link, Opts, Indent + 2)
+                                )
+                            );
+                        Other ->
+                            io_lib:format("~p", [Other])
+                    end
+                ],
+                Opts,
+                Indent + 1
+            )
+        end,
+        KeyVals
+    ),
+    case Res of
+        [] -> lists:flatten(Header ++ " [Empty] }");
+        _ ->
+            lists:flatten(
+                Header ++ ["\n"] ++ Res ++ indent("}", Indent)
+            )
+    end;
+message(Item, Opts, Indent) ->
+    % Whatever we have is not a message map.
+    indent("~p", [Item], Opts, Indent).
+
+%%% Utility functions.
+
+%% @doc Return a short ID for the different types of IDs used in AO-Core.
+short_id(Bin) when is_binary(Bin) andalso byte_size(Bin) == 32 ->
+    short_id(hb_util:human_id(Bin));
+short_id(Bin) when is_binary(Bin) andalso byte_size(Bin) == 43 ->
+    << FirstTag:5/binary, _:33/binary, LastTag:5/binary >> = Bin,
+    << FirstTag/binary, "..", LastTag/binary >>;
+short_id(Bin) when byte_size(Bin) > 43 andalso byte_size(Bin) < 100 ->
+    case binary:split(Bin, <<"/">>, [trim_all, global]) of
+        [First, Second] when byte_size(Second) == 43 ->
+            FirstEnc = short_id(First),
+            SecondEnc = short_id(Second),
+            << FirstEnc/binary, "/", SecondEnc/binary >>;
+        [First, Key] ->
+            FirstEnc = short_id(First),
+            << FirstEnc/binary, "/", Key/binary >>;
+        _ ->
+            Bin
+    end;
+short_id(<< "/", SingleElemHashpath/binary >>) ->
+    Enc = short_id(SingleElemHashpath),
+    if is_binary(Enc) -> << "/", Enc/binary >>;
+    true -> undefined
+    end;
+short_id(Key) when byte_size(Key) < 43 -> Key;
+short_id(_) -> undefined.
+
+%% @doc Determine whether a binary is human-readable.
+is_human_binary(Bin) when is_binary(Bin) ->
+    case unicode:characters_to_binary(Bin) of
+        {error, _, _} -> false;
+        _ -> true
+    end.
+
+%% Determine the maximum number of keys to print for messages, given a node
+%% `Opts`.
+max_keys(Opts) ->
+    case hb_opts:get(debug_print_truncate, 20, Opts) of
+        Max when is_integer(Max) -> Max;
+        infinity -> infinity;
+        Term -> hb_util:int(Term)
+    end.
\ No newline at end of file
diff --git a/src/hb_gateway_client.erl b/src/hb_gateway_client.erl
index 8a8660bbc..353fd7394 100644
--- a/src/hb_gateway_client.erl
+++ b/src/hb_gateway_client.erl
@@ -8,7 +8,8 @@
 %%% module will be deprecated.
 -module(hb_gateway_client).
 %% Raw access primitives:
--export([read/2, data/2, result_to_message/2]).
+-export([query/2, query/3, query/4, query/5]).
+-export([read/2, data/2, result_to_message/2, item_spec/0]).
 %% Application-specific data access functions:
 -export([scheduler_location/2]).
 -include_lib("include/hb.hrl").
@@ -33,70 +34,73 @@
 %%   ar: String!
 %% }
 read(ID, Opts) ->
-    Query = case maps:is_key(<<"subindex">>, Opts) of
+    {Query, Variables} = case maps:is_key(<<"subindex">>, Opts) of
       true -> 
         Tags = subindex_to_tags(maps:get(<<"subindex">>, Opts)),
-        #{
-            <<"query">> =>
-                <<
-                    "query($transactionIds: [ID!]!) { ",
-                        "transactions(ids: $transactionIds,",
-                        "tags: ", (Tags)/binary , ",",
-                        "first: 1){ ",
-                            "edges { ", (item_spec())/binary , " } ",
-                        "} ",
-                    "} "
-                >>,
-            <<"variables">> =>
-                #{
-                    <<"transactionIds">> => [hb_util:human_id(ID)]
-                }
+        {
+            <<
+                "query($transactionIds: [ID!]!) { ",
+                    "transactions(ids: $transactionIds,",
+                    "tags: ", (Tags)/binary , ",",
+                    "first: 1){ ",
+                        "edges { ", (item_spec())/binary , " } ",
+                    "} ",
+                "} "
+            >>,
+            #{
+                <<"transactionIds">> => [hb_util:human_id(ID)]
+            }
         };
       false -> 
-        #{
-            <<"query">> =>
-                <<
-                    "query($transactionIds: [ID!]!) { ",
-                        "transactions(ids: $transactionIds, first: 1){ ",
-                            "edges { ", (item_spec())/binary , " } ",
-                        "} ",
-                    "} "
-                >>,
-            <<"variables">> =>
-                #{
-                    <<"transactionIds">> => [hb_util:human_id(ID)]
-                }
+        {
+            <<
+                "query($transactionIds: [ID!]!) { ",
+                    "transactions(ids: $transactionIds, first: 1){ ",
+                        "edges { ", (item_spec())/binary , " } ",
+                    "} ",
+                "} "
+            >>,
+            #{
+                <<"transactionIds">> => [hb_util:human_id(ID)]
+            }
         }
     end,
-    case query(Query, Opts) of
+    case query(Query, Variables, Opts) of
         {error, Reason} -> {error, Reason};
         {ok, GqlMsg} ->
             case hb_ao:get(<<"data/transactions/edges/1/node">>, GqlMsg, Opts) of
-                not_found -> {error, not_found};
-                Item = #{<<"id">> := ID} -> result_to_message(ID, Item, Opts)
+                not_found ->
+                    ?event({read_not_found, {id, ID}, {gql_msg, GqlMsg}}),
+                    {error, not_found};
+                Item ->
+                    ?event({read_found, {id, ID}, {item, Item}}),
+                    result_to_message(ID, Item, Opts)
             end
     end.
 
 %% @doc Gives the fields of a transaction that are needed to construct an
 %% ANS-104 message.
 item_spec() ->
-    <<"node { ",
-        "id ",
-        "anchor ",
-        "signature ",
-        "recipient ",
-        "owner { key } ",
-        "fee { winston } ",
-        "quantity { winston } ",
-        "tags { name value } ",
-        "data { size } "
-    "}">>.
+    <<"""
+        node {
+            id
+            anchor
+            signature
+            recipient
+            owner { key }
+            fee { winston }
+            quantity { winston }
+            tags { name value }
+            data { size }
+        }
+        cursor
+    """>>.
 
 %% @doc Get the data associated with a transaction by its ID, using the node's
 %% Arweave `gateway' peers. The item is expected to be available in its 
 %% unmodified (by caches or other proxies) form at the following location:
-%%      https://&lt;gateway&gt;/raw/&lt;id&gt;
-%% where `&lt;id&gt;' is the base64-url-encoded transaction ID.
+%%      https://<gateway>/raw/<id>
+%% where `<id>' is the base64-url-encoded transaction ID.
 data(ID, Opts) ->
     Req = #{
         <<"multirequest-accept-status">> => 200,
@@ -122,26 +126,40 @@ data(ID, Opts) ->
 %% @doc Find the location of the scheduler based on its ID, through GraphQL.
 scheduler_location(Address, Opts) ->
     Query =
-        #{
-            <<"query">> =>
-                <<"query($SchedulerAddrs: [String!]!) { ",
-                    "transactions(owners: $SchedulerAddrs, tags: { name: \"Type\" values: [\"Scheduler-Location\"] }, first: 1){ ",
-                        "edges { ",
-                            (item_spec())/binary ,
-                        " } ",
-                    "} ",
-                "}">>,
-            <<"variables">> =>
-                #{
-                    <<"SchedulerAddrs">> => [Address]
-                }
-        },
-    case query(Query, Opts) of
-        {error, Reason} -> {error, Reason};
+        <<"query($SchedulerAddrs: [String!]!) { ",
+                "transactions(",
+                "owners: $SchedulerAddrs, ",
+                "tags: { name: \"Type\" values: [\"Scheduler-Location\"] }, ",
+                "first: 1",
+            "){ ",
+                "edges { ",
+                    (item_spec())/binary ,
+                " } ",
+            "} ",
+        "}">>,
+    Variables = #{ <<"SchedulerAddrs">> => [Address] },
+    case query(Query, Variables, Opts) of
+        {error, Reason} ->
+            ?event({scheduler_location, {query, Query}, {error, Reason}}),
+            {error, Reason};
         {ok, GqlMsg} ->
+            ?event({scheduler_location_req, {query, Query}, {response, GqlMsg}}),
             case hb_ao:get(<<"data/transactions/edges/1/node">>, GqlMsg, Opts) of
-                not_found -> {error, not_found};
-                Item = #{ <<"id">> := ID } -> result_to_message(ID, Item, Opts)
+                not_found ->
+                    ?event(scheduler_location,
+                        {graphql_scheduler_location_not_found,
+                            {address, Address}
+                        }
+                    ),
+                    {error, not_found};
+                Item = #{ <<"id">> := ID } ->
+                    ?event(scheduler_location,
+                        {found_via_graphql,
+                            {address, Address},
+                            {id, ID}
+                        }
+                    ),
+                    result_to_message(ID, Item, Opts)
             end
     end.
         
@@ -149,45 +167,82 @@ scheduler_location(Address, Opts) ->
 %% a list of URLs to use, optionally as a tuple with an additional map of options
 %% to use for the request.
 query(Query, Opts) ->
+    query(Query, undefined, Opts).
+query(Query, Variables, Opts) ->
+    query(Query, Variables, undefined, Opts).
+query(Query, Variables, Node, Opts) ->
+    query(Query, Variables, Node, undefined, Opts).
+query(Query, Variables, Node, Operation, Opts) ->
+    % Either use the given node if provided, or use the local machine's routes
+    % to find the GraphQL endpoint.
+    Path =
+        case Node of
+            undefined -> <<"/graphql">>;
+            _ -> << Node/binary, "/graphql">>
+        end,
+    ?event(graphql,
+        {request,
+            {path, Path},
+            {query, Query},
+            {variables, Variables},
+            {operation, Operation}
+        }
+    ),
+    CombinedQuery =
+        maps:filter(
+            fun(_, V) -> V =/= undefined end,
+            #{
+                <<"query">> => Query,
+                <<"variables">> => Variables,
+                <<"operationName">> => Operation
+            }
+        ),
+    % Find the routes for the GraphQL API.
     Res = hb_http:request(
         #{
             % Add options for the HTTP request, in case it is being made to
             % many nodes.
-            <<"multirequest-accept-status">> => 200,
             <<"multirequest-responses">> => 1,
+            <<"multirequest-admissible-status">> => 200,
+            <<"multirequest-admissible">> =>
+                #{
+                    <<"device">> => <<"query@1.0">>,
+                    <<"path">> => <<"has-results">>
+                },
             % Main request fields
             <<"method">> => <<"POST">>,
             <<"path">> => <<"/graphql">>,
             <<"content-type">> => <<"application/json">>,
-            <<"body">> => hb_json:encode(Query)
+            <<"body">> => hb_json:encode(CombinedQuery)
         },
         Opts
     ),
     case Res of
         {ok, Msg} ->
-            {ok,
-                hb_json:decode(
-                    hb_ao:get(<<"body">>, Msg, <<>>, Opts)
-                )
-            };
+            {ok, hb_json:decode(hb_ao:get(<<"body">>, Msg, <<>>, Opts))};
         {error, Reason} -> {error, Reason}
     end.
 
 %% @doc Takes a GraphQL item node, matches it with the appropriate data from a
 %% gateway, then returns `{ok, ParsedMsg}'.
 result_to_message(Item, Opts) ->
-    case hb_ao:get(<<"id">>, Item, Opts) of
+    case hb_maps:get(<<"id">>, Item, not_found, Opts) of
         ExpectedID when is_binary(ExpectedID) ->
             result_to_message(ExpectedID, Item, Opts);
         _ ->
             result_to_message(undefined, Item, Opts)
     end.
 result_to_message(ExpectedID, Item, Opts) ->
-    GQLOpts = Opts#{ hashpath => ignore },
+    GQLOpts =
+        Opts#{
+            hashpath => ignore,
+            cache_control => [<<"no-cache">>, <<"no-store">>]
+        },
     % We have the headers, so we can get the data.
     Data =
-        case hb_ao:get(<<"data">>, Item, GQLOpts) of
+        case hb_maps:get(<<"data">>, Item, not_found, GQLOpts) of
             BinData when is_binary(BinData) -> BinData;
+            #{ <<"size">> := 0 } -> <<>>;
             _ ->
                 {ok, Bytes} = data(ExpectedID, Opts),
                 Bytes
@@ -195,18 +250,22 @@ result_to_message(ExpectedID, Item, Opts) ->
     DataSize = byte_size(Data),
     ?event(gateway, {data, {id, ExpectedID}, {data, Data}, {item, Item}}, Opts),
     % Convert the response to an ANS-104 message.
-    Tags = hb_ao:get(<<"tags">>, Item, GQLOpts),
-	Signature = hb_util:decode(hb_ao:get(<<"signature">>, Item, GQLOpts)),
-	SignatureType = case byte_size(Signature) of
-		65 -> {ecdsa, 256};
-		512 -> {rsa, 65537};
-		_ -> unsupported_tx_signature_type
-	end,
+    Tags = hb_maps:get(<<"tags">>, Item, tags_not_found, GQLOpts),
+	Signature =
+        hb_util:decode(
+            hb_maps:get(<<"signature">>, Item, not_found, GQLOpts)
+        ),
+	SignatureType =
+        case byte_size(Signature) of
+            65 -> {ecdsa, 256};
+            512 -> {rsa, 65537};
+            _ -> unsupported_tx_signature_type
+        end,
     TX =
-        #tx {
+        ar_bundles:reset_ids(#tx {
             format = ans104,
-            id = hb_util:decode(ExpectedID),
-            last_tx = normalize_null(hb_ao:get(<<"anchor">>, Item, GQLOpts)),
+            anchor =
+                normalize_null(hb_maps:get(<<"anchor">>, Item, not_found, GQLOpts)),
             signature = Signature,
             signature_type = SignatureType,
             target =
@@ -220,8 +279,9 @@ result_to_message(ExpectedID, Item, Opts) ->
                     )
                 ),
             owner =
-                hb_util:decode(hb_ao:get(<<"owner/key">>,
-                    Item, GQLOpts)),
+                hb_util:decode(
+                    hb_util:deep_get(<<"owner/key">>, Item, GQLOpts)
+                ),
             tags =
                 [
                     {Name, Value}
@@ -230,12 +290,12 @@ result_to_message(ExpectedID, Item, Opts) ->
                 ],
             data_size = DataSize,
             data = Data
-        },
+        }),
     ?event({raw_ans104, TX}),
     ?event({ans104_form_response, TX}),
-    TABM = dev_codec_ans104:from(TX),
+    TABM = hb_util:ok(dev_codec_ans104:from(TX, #{}, Opts)),
     ?event({decoded_tabm, TABM}),
-    Structured = dev_codec_structured:to(TABM),
+    Structured = hb_util:ok(dev_codec_structured:to(TABM, #{}, Opts)),
     % Some graphql nodes do not grant the `anchor' or `last_tx' fields, so we
     % verify the data item and optionally add the explicit keys as committed
     % fields _if_ the node desires it.
@@ -249,28 +309,42 @@ result_to_message(ExpectedID, Item, Opts) ->
                 % to trust the GraphQL API anyway?
                 case hb_opts:get(ans104_trust_gql, false, Opts) of
                     false ->
-                        ?event(warning, {gql_verify_failed, returning_unverifiable_tx}),
+                        ?event(
+                            warning,
+                            {gql_verify_failed, returning_unverifiable_tx}
+                        ),
                         Structured;
                     true ->
                         % The node trusts the GraphQL API, so we add the explicit
                         % keys as committed fields.
-                        ?event(warning, {gql_verify_failed, adding_trusted_fields, {tags, Tags}}),
-                        Comms = maps:get(<<"commitments">>, Structured),
-                        AttName = hd(maps:keys(Comms)),
-                        Comm = maps:get(AttName, Comms),
+                        ?event(warning,
+                            {gql_verify_failed,
+                                adding_trusted_fields,
+                                {tags, Tags}
+                            }
+                        ),
+                        Comms = hb_maps:get(<<"commitments">>, Structured, #{}, Opts),
+                        AttName = hd(hb_maps:keys(Comms, Opts)),
+                        Comm = hb_maps:get(AttName, Comms, not_found, Opts),
                         Structured#{
                             <<"commitments">> => #{
                                 AttName =>
                                     Comm#{
                                         <<"trusted-keys">> =>
-                                            hb_ao:normalize_keys([
+                                            hb_ao:normalize_keys(
+                                                [
                                                     hb_ao:normalize_key(Name)
                                                 ||
                                                     #{ <<"name">> := Name } <-
-                                                        maps:values(
-                                                            hb_ao:normalize_keys(Tags)
+                                                        hb_maps:values(
+                                                            hb_ao:normalize_keys(
+                                                                Tags,
+                                                                Opts
+                                                            ),
+                                                            Opts
                                                         )
-                                                ]
+                                                ],
+												Opts
                                             )
                                     }
                             }
@@ -319,16 +393,20 @@ subindex_to_tags(Subindex) ->
 ans104_no_data_item_test() ->
     % Start a random node so that all of the services come up.
     _Node = hb_http_server:start_node(#{}),
-    {ok, Res} = read(<<"0Tb9mULcx8MjYVgXleWMVvqo1_jaw_P6AO_CJMTj0XE">>, #{}),
+    {ok, Res} = read(<<"BOogk_XAI3bvNWnxNxwxmvOfglZt17o4MOVAdPNZ_ew">>, #{}),
     ?event(gateway, {get_ans104_test, Res}),
-    ?event(gateway, {signer, hb_message:signers(Res)}),
+    ?event(gateway, {signer, hb_message:signers(Res, #{})}),
     ?assert(true).
 
 %% @doc Test that we can get the scheduler location.
 scheduler_location_test() ->
     % Start a random node so that all of the services come up.
     _Node = hb_http_server:start_node(#{}),
-    {ok, Res} = scheduler_location(<<"fcoN_xJeisVsPXA-trzVAuIiqO3ydLQxM-L4XbrQKzY">>, #{}),
+    {ok, Res} =
+        scheduler_location(
+            <<"fcoN_xJeisVsPXA-trzVAuIiqO3ydLQxM-L4XbrQKzY">>,
+            #{}
+        ),
     ?event(gateway, {get_scheduler_location_test, Res}),
     ?assertEqual(<<"Scheduler-Location">>, hb_ao:get(<<"Type">>, Res, #{})),
     ?event(gateway, {scheduler_location, {explicit, hb_ao:get(<<"url">>, Res, #{})}}),
@@ -354,7 +432,7 @@ l2_dataitem_test() ->
 %% @doc Test optimistic index
 ao_dataitem_test() ->
     _Node = hb_http_server:start_node(#{}),
-    {ok, Res} = read(<<"oyo3_hCczcU7uYhfByFZ3h0ELfeMMzNacT-KpRoJK6g">>, #{ }),
+    {ok, Res} = read(<<"oyo3_hCczcU7uYhfByFZ3h0ELfeMMzNacT-KpRoJK6g">>, #{}),
     ?event(gateway, {l2_dataitem, Res}),
     Data = maps:get(<<"data">>, Res),
     ?assertEqual(<<"Hello World">>, Data).
\ No newline at end of file
diff --git a/src/hb_http.erl b/src/hb_http.erl
index a6f1edf1f..6b374b0fd 100644
--- a/src/hb_http.erl
+++ b/src/hb_http.erl
@@ -6,11 +6,13 @@
 -module(hb_http).
 -export([start/0]).
 -export([get/2, get/3, post/3, post/4, request/2, request/4, request/5]).
--export([reply/4, accept_to_codec/2]).
+-export([message_to_request/2, reply/4, accept_to_codec/2]).
 -export([req_to_tabm_singleton/3]).
 -include("include/hb.hrl").
 -include_lib("eunit/include/eunit.hrl").
 
+-define(DEFAULT_FILTER_KEYS, [<<"content-length">>]).
+
 start() ->
     httpc:set_options([{max_keep_alive_length, 0}]),
     ok.
@@ -31,6 +33,8 @@ get(Node, Message, Opts) ->
 
 %% @doc Posts a message to a URL on a remote peer via HTTP. Returns the
 %% resulting message in deserialized form.
+post(Node, Path, Opts) when is_binary(Path) ->
+    post(Node, #{ <<"path">> => Path }, Opts);
 post(Node, Message, Opts) ->
     post(Node,
         hb_ao:get(
@@ -63,11 +67,16 @@ request(Method, Peer, Path, Opts) ->
 request(Method, Config = #{ <<"nodes">> := Nodes }, Path, Message, Opts) when is_list(Nodes) ->
     % The request has a `route' (see `dev_router' for more details), so we use the
     % `multirequest' functionality, rather than a single request.
-    multirequest(Config, Method, Path, Message, Opts);
-request(Method, #{ <<"opts">> := NodeOpts, <<"uri">> := URI }, _Path, Message, Opts) ->
+    hb_http_multi:request(Config, Method, Path, Message, Opts);
+request(Method, #{ <<"opts">> := ReqOpts, <<"uri">> := URI }, _Path, Message, Opts) ->
     % The request has a set of additional options, so we apply them to the
     % request.
-    MergedOpts = maps:merge(Opts, NodeOpts),
+    MergedOpts =
+        hb_maps:merge(
+            Opts,
+            hb_opts:mimic_default_types(ReqOpts, new_atoms, Opts),
+            Opts
+        ),
     % We also recalculate the request. The order of precidence here is subtle:
     % We favor the args given to the function, but the URI rules take precidence
     % over that.
@@ -81,7 +90,7 @@ request(Method, Peer, Path, RawMessage, Opts) ->
     ?event({request, {method, Method}, {peer, Peer}, {path, Path}, {message, RawMessage}}),
     Req =
         prepare_request(
-            hb_ao:get(
+            hb_maps:get(
                 <<"codec-device">>,
                 RawMessage,
                 <<"httpsig@1.0">>,
@@ -94,7 +103,9 @@ request(Method, Peer, Path, RawMessage, Opts) ->
             Opts
         ),
     StartTime = os:system_time(millisecond),
+    % Perform the HTTP request.
     {_ErlStatus, Status, Headers, Body} = hb_http_client:req(Req, Opts),
+    % Process the response.
     EndTime = os:system_time(millisecond),
     ?event(http_outbound,
         {
@@ -110,19 +121,43 @@ request(Method, Peer, Path, RawMessage, Opts) ->
         },
         Opts
     ),
-    HeaderMap = maps:from_list(Headers),
-    NormHeaderMap = hb_ao:normalize_keys(HeaderMap),
+    % Convert the set-cookie headers into a cookie message, if they are present.
+    % We do this by extracting the set-cookie headers and converting them into a
+    % cookie message if they are present.
+    SetCookieLines =
+        [
+            KeyVal
+        ||
+            {<<"set-cookie">>, KeyVal} <- Headers
+        ],
+    MaybeSetCookie =
+        case SetCookieLines of
+            [] -> #{};
+            _ ->
+                ?event(
+                    debug_cookie,
+                    {normalizing_setcookie_headers,
+                        {set_cookie_lines, [ {string, Line} || Line <- SetCookieLines ]}
+                    },
+                    Opts
+                ),
+                {ok, MsgWithCookies} =
+                    dev_codec_cookie:from(
+                        #{ <<"set-cookie">> => SetCookieLines },
+                        #{},
+                        Opts
+                    ),
+                ?event(debug_cookie, {msg_with_cookies, MsgWithCookies}),
+                MsgWithCookies
+        end,
+    % Merge the set-cookie message into the header map, which itself is
+    % constructed from the header key-value pair list.
+    HeaderMap = hb_maps:merge(hb_maps:from_list(Headers), MaybeSetCookie, Opts),
+    NormHeaderMap = hb_ao:normalize_keys(HeaderMap, Opts),
     ?event(http_outbound,
         {normalized_response_headers, {norm_header_map, NormHeaderMap}},
         Opts
     ),
-    BaseStatus =
-        case Status of
-            201 -> created;
-            X when X < 400 -> ok;
-            X when X < 500 -> error;
-            _ -> failure
-        end,
     ?event(http_short,
         {received,
             {status, Status},
@@ -132,12 +167,21 @@ request(Method, Peer, Path, RawMessage, Opts) ->
             {path, {string, Path}},
             {body_size, byte_size(Body)}
         }),
-    case maps:get(<<"ao-result">>, NormHeaderMap, undefined) of
+    ReturnAOResult =
+        hb_opts:get(http_only_result, true, Opts) andalso
+        hb_maps:get(<<"ao-result">>, NormHeaderMap, false, Opts),
+    case ReturnAOResult of
         Key when is_binary(Key) ->
             Msg = http_response_to_httpsig(Status, NormHeaderMap, Body, Opts),
-            ?event(http_outbound, {result_is_single_key, {key, Key}, {msg, Msg}}, Opts),
-            case maps:get(Key, Msg, undefined) of
-                undefined ->
+            ?event(
+                http_outbound,
+                {result_is_single_key, {key, Key}, {msg, Msg}},
+                Opts
+            ),
+            case {Key, hb_maps:get(Key, Msg, undefined, Opts)} of
+                {<<"body">>, undefined} ->
+                    {response_status_to_atom(Status), <<>>};
+                {_, undefined} ->
                     {failure,
                         <<
                             "Result key '",
@@ -150,44 +194,91 @@ request(Method, Peer, Path, RawMessage, Opts) ->
                             Body/binary
                         >>
                     };
-                Value -> {BaseStatus, Value}
+                {_, Value} ->
+                    {response_status_to_atom(Status), Value}
             end;
-        undefined ->
-            case maps:get(<<"codec-device">>, NormHeaderMap, <<"httpsig@1.0">>) of
-                <<"httpsig@1.0">> ->
-                    ?event(http_outbound, {result_is_httpsig, {body, Body}}, Opts),
-                    {
-                        BaseStatus,
-                        http_response_to_httpsig(Status, NormHeaderMap, Body, Opts)
-                    };
-                <<"ans104@1.0">> ->
-                    ?event(http_outbound, {result_is_ans104, {body, Body}}, Opts),
-                    Deserialized = ar_bundles:deserialize(Body),
-                    % We don't need to add the status to the message, because
-                    % it is already present in the encoded ANS-104 message.
-                    {
-                        BaseStatus,
-                        hb_message:convert(
-                            Deserialized,
-                            <<"structured@1.0">>,
-                            <<"ans104@1.0">>,
-                            Opts
-                        )
-                    }
-            end
+        false ->
+            % Find the codec device from the headers, if set.
+            CodecDev =
+                hb_maps:get(
+                    <<"codec-device">>,
+                    NormHeaderMap,
+                    <<"httpsig@1.0">>,
+                    Opts
+                ),
+            outbound_result_to_message(
+                CodecDev,
+                Status,
+                NormHeaderMap,
+                Body,
+                Opts
+            )
+    end.
+
+%% @doc Convert a HTTP status code to a status atom.
+response_status_to_atom(Status) ->
+    case Status of
+        201 -> created;
+        X when X < 400 -> ok;
+        X when X < 500 -> error;
+        _ -> failure
     end.
 
+%% @doc Convert an HTTP response to a message.
+outbound_result_to_message(<<"ans104@1.0">>, Status, Headers, Body, Opts) ->
+    ?event(http_outbound,
+        {result_is_ans104, {headers, Headers}, {body, Body}},
+        Opts
+    ),
+    try ar_bundles:deserialize(Body) of
+        Deserialized ->
+            {
+                response_status_to_atom(Status),
+                hb_message:convert(
+                    Deserialized,
+                    <<"structured@1.0">>,
+                    <<"ans104@1.0">>,
+                    Opts
+                )
+            }
+    catch
+      _Class:ExceptionPattern:Stacktrace ->
+        % The response message had a `codec-device: ans104@1.0', but we
+        % failed to deserialize it, so we fallback to HTTPSig.
+        ?event(http_outbound,
+            {failed_to_deserialize_ans104_attempting_httpsig,
+                {headers, Headers},
+                {body, Body},
+                {error, ExceptionPattern},
+                {stacktrace, {trace, Stacktrace}}
+            },
+            Opts
+        ),
+        outbound_result_to_message(<<"httpsig@1.0">>, Status, Headers, Body, Opts)
+    end;
+outbound_result_to_message(<<"httpsig@1.0">>, Status, Headers, Body, Opts) ->
+    ?event(http_outbound, {result_is_httpsig, {body, Body}}, Opts),
+    {
+        response_status_to_atom(Status),
+        http_response_to_httpsig(Status, Headers, Body, Opts)
+    }.
+
 %% @doc Convert a HTTP response to a httpsig message.
 http_response_to_httpsig(Status, HeaderMap, Body, Opts) ->
-    (hb_message:convert(
-        maps:merge(
-            HeaderMap#{ <<"status">> => hb_util:bin(Status) },
-            case Body of
-                <<>> -> #{};
-                _ -> #{ <<"body">> => Body }
-            end
+    BinStatus = hb_util:bin(Status),
+    BodyMap = case byte_size(Body) of
+        0 -> #{};
+        _ -> #{ <<"body">> => Body }
+    end,
+    ConvertFrom = 
+        hb_maps:merge(
+            HeaderMap#{ <<"status">> => BinStatus },
+            BodyMap,
+			Opts
         ),
-        <<"structured@1.0">>,
+    (hb_message:convert(
+        ConvertFrom,
+        #{ <<"device">> => <<"structured@1.0">>, <<"bundle">> => true },
         <<"httpsig@1.0">>,
         Opts
     ))#{ <<"status">> => hb_util:int(Status) }.
@@ -212,7 +303,7 @@ route_to_request(M, {ok, #{ <<"uri">> := XPath, <<"opts">> := ReqOpts}}, Opts) -
     % We must remove the path and host from the message, because they are not
     % valid for outbound requests. The path is retrieved from the route, and
     % the host should already be known to the caller.
-    MsgWithoutMeta = maps:without([<<"path">>, <<"host">>], M),
+    MsgWithoutMeta = hb_maps:without([<<"path">>, <<"host">>], M, Opts),
     Port =
         case maps:get(port, URI, undefined) of
             undefined ->
@@ -234,7 +325,7 @@ route_to_request(M, {ok, #{ <<"uri">> := XPath, <<"opts">> := ReqOpts}}, Opts) -
         end,
     Path = iolist_to_binary(PathParts),
     ?event(http_outbound, {parsed_req, {node, Node}, {method, Method}, {path, Path}}),
-    {ok, Method, Node, Path, MsgWithoutMeta, hb_util:deep_merge(Opts, ReqOpts)};
+    {ok, Method, Node, Path, MsgWithoutMeta, hb_util:deep_merge(Opts, ReqOpts, Opts)};
 route_to_request(M, {ok, Routes}, Opts) ->
     ?event(http_outbound, {found_routes, {req, M}, {routes, Routes}}),
     % The result is a route, so we leave it to `request' to handle it.
@@ -243,212 +334,129 @@ route_to_request(M, {ok, Routes}, Opts) ->
     % We must remove the path and host from the message, because they are not
     % valid for outbound requests. The path is retrieved from the route, and
     % the host should already be known to the caller.
-    MsgWithoutMeta = maps:without([<<"path">>, <<"host">>], M),
+    MsgWithoutMeta = hb_maps:without([<<"path">>, <<"host">>], M, Opts),
     {ok, Method, Routes, Path, MsgWithoutMeta, Opts};
 route_to_request(M, {error, Reason}, _Opts) ->
     {error, {no_viable_route, {reason, Reason}, {message, M}}}.
 
 %% @doc Turn a set of request arguments into a request message, formatted in the
-%% preferred format.
+%% preferred format. This function honors the `accept-bundle' option, if it is
+%% already present in the message, and sets it to `true' if it is not.
 prepare_request(Format, Method, Peer, Path, RawMessage, Opts) ->
-    Message = hb_ao:normalize_keys(RawMessage),
+    Message = hb_ao:normalize_keys(RawMessage, Opts),
+    % Generate a `cookie' key for the message, if an unencoded cookie is
+    % present.
+    {MaybeCookie, WithoutCookie} =
+        case dev_codec_cookie:extract(Message, #{}, Opts) of
+            {ok, NoCookies} when map_size(NoCookies) == 0 ->
+                {#{}, Message};
+            {ok, _Cookies} ->
+                {ok, #{ <<"cookie">> := CookieLines }} =
+                    dev_codec_cookie:to(
+                        Message,
+                        #{ <<"format">> => <<"cookie">> },
+                        Opts
+                    ),
+                {ok, CookieReset} = dev_codec_cookie:reset(Message, Opts),
+                ?event(http, {cookie_lines, CookieLines}),
+                {
+                    #{ <<"cookie">> => CookieLines },
+                    CookieReset
+                }
+        end,
+    % Remove the private components from the message, if they are present.
+    WithoutPriv = hb_private:reset(WithoutCookie),
+    % Add the `accept-bundle: true' key to the message, if the caller has not
+    % set an explicit preference.
+    WithAcceptBundle =
+        case hb_maps:get(<<"accept-bundle">>, Message, not_found, Opts) of
+            not_found -> WithoutPriv#{ <<"accept-bundle">> => true };
+            _ -> WithoutPriv
+        end,
+    % Determine the `ao-peer-port' from the message to send or the node message.
+    % `port_external' can be set in the node message to override the port that
+    % the peer node should receive. This allows users to proxy requests to their
+    % HB node from another port.
+    WithSelfPort =
+        WithAcceptBundle#{
+            <<"ao-peer-port">> =>
+                hb_maps:get(
+                    <<"ao-peer-port">>,
+                    WithAcceptBundle,
+                    hb_opts:get(
+                        port_external,
+                        hb_opts:get(port, undefined, Opts),
+                        Opts
+                    ),
+                    Opts
+                )
+        },
     BinPeer = if is_binary(Peer) -> Peer; true -> list_to_binary(Peer) end,
     BinPath = hb_path:normalize(hb_path:to_binary(Path)),
     ReqBase = #{ peer => BinPeer, path => BinPath, method => Method },
     case Format of
         <<"httpsig@1.0">> ->
             FullEncoding =
-                hb_message:convert(Message, <<"httpsig@1.0">>, Opts),
-            Body = maps:get(<<"body">>, FullEncoding, <<>>),
-            Headers = maps:without([<<"body">>], FullEncoding),
-
+                hb_message:convert(
+                    WithSelfPort,
+                    #{
+                        <<"device">> => <<"httpsig@1.0">>,
+                        <<"bundle">> => true
+                    },
+                    Opts
+                ),
+            Body = hb_maps:get(<<"body">>, FullEncoding, <<>>, Opts),
+            Headers = hb_maps:without([<<"body">>], FullEncoding, Opts),
 			?event(http, {request_headers, {explicit, {headers, Headers}}}),
 			?event(http, {request_body, {explicit, {body, Body}}}),
-            maps:merge(ReqBase, #{ headers => Headers, body => Body });
+            hb_maps:merge(
+                ReqBase,
+                #{ headers => maps:merge(MaybeCookie, Headers), body => Body },
+                Opts
+            );
         <<"ans104@1.0">> ->
+            ?event(debug_accept, {request_message, {message, Message}}),
+            {ok, FilteredMessage} =
+                case hb_message:signers(Message, Opts) of
+                    [] -> WithSelfPort;
+                    _ ->
+                        hb_message:with_only_committed(WithSelfPort, Opts)
+                end,
             ReqBase#{
                 headers =>
-                    #{
+                    MaybeCookie#{
                         <<"codec-device">> => <<"ans104@1.0">>,
-                        <<"content-type">> => <<"application/ans104">>
+                        <<"content-type">> => <<"application/ans104">>,
+                        <<"accept-bundle">> =>
+                            hb_util:bin(
+                                hb_ao:get(
+                                    <<"accept-bundle">>,
+                                    WithSelfPort,
+                                    true,
+                                    Opts
+                                )
+                            )
                     },
                 body =>
                     ar_bundles:serialize(
-                        hb_message:convert(Message, <<"ans104@1.0">>, Opts)
+                        hb_message:convert(
+                            FilteredMessage,
+                            #{
+                                <<"device">> => <<"ans104@1.0">>,
+                                <<"bundle">> => true
+                            },
+                            Opts
+                        )
                     )
             };
         _ ->
             ReqBase#{
-                headers => maps:without([<<"body">>], Message),
+                headers =>
+                    maps:merge(MaybeCookie, maps:without([<<"body">>], Message)),
                 body => maps:get(<<"body">>, Message, <<>>)
             }
     end.
 
-%% @doc Dispatch the same HTTP request to many nodes. Can be configured to
-%% await responses from all nodes or just one, and to halt all requests after
-%% after it has received the required number of responses, or to leave all
-%% requests running until they have all completed. Default: Race for first
-%% response.
-%%
-%% Expects a config message of the following form:
-%%      /Nodes/1..n: Hostname | #{ hostname => Hostname, address => Address }
-%%      /Responses: Number of responses to gather
-%%      /Stop-After: Should we stop after the required number of responses?
-%%      /Parallel: Should we run the requests in parallel?
-multirequest(Config, Method, Path, Message, Opts) ->
-    MultiOpts = #{
-        nodes := Nodes,
-        responses := Responses,
-        stop_after := StopAfter,
-        accept_status := Statuses,
-        parallel := Parallel
-    } = multirequest_opts(Config, Message, Opts),
-    ?event(http,
-        {multirequest_opts_parsed,
-            {config, Config},
-            {message, Message},
-            {multirequest_opts, MultiOpts}
-        }),
-    AllResults =
-        if Parallel ->
-            parallel_multirequest(
-                Nodes, Responses, StopAfter, Method, Path, Message, Statuses, Opts);
-        true ->
-            serial_multirequest(
-                Nodes, Responses, Method, Path, Message, Statuses, Opts)
-        end,
-    ?event(http, {multirequest_results, {results, AllResults}}),
-    case AllResults of
-        [] -> {error, no_viable_responses};
-        Results -> if Responses == 1 -> hd(Results); true -> Results end
-    end.
-
-%% @doc Get the multirequest options from the config or message. The options in 
-%% the message take precidence over the options in the config.
-multirequest_opts(Config, Message, Opts) ->
-    Opts#{
-        nodes =>
-            multirequest_opt(<<"nodes">>, Config, Message, #{}, Opts),
-        responses =>
-            multirequest_opt(<<"responses">>, Config, Message, 1, Opts),
-        stop_after =>
-            multirequest_opt(<<"stop-after">>, Config, Message, true, Opts),
-        accept_status =>
-            multirequest_opt(<<"accept-status">>, Config, Message, <<"All">>, Opts),
-        parallel =>
-            multirequest_opt(<<"parallel">>, Config, Message, false, Opts)
-    }.
-
-%% @doc Get a value for a multirequest option from the config or message.
-multirequest_opt(Key, Config, Message, Default, Opts) ->
-    hb_ao:get_first(
-        [
-            {Message, <<"multirequest-", Key/binary>>},
-            {Config, Key}
-        ],
-        Default,
-        Opts#{ hashpath => ignore }
-    ).
-
-%% @doc Serially request a message, collecting responses until the required
-%% number of responses have been gathered. Ensure that the statuses are
-%% allowed, according to the configuration.
-serial_multirequest(_Nodes, 0, _Method, _Path, _Message, _Statuses, _Opts) -> [];
-serial_multirequest([], _, _Method, _Path, _Message, _Statuses, _Opts) -> [];
-serial_multirequest([Node|Nodes], Remaining, Method, Path, Message, Statuses, Opts) ->
-    {ErlStatus, Res} = request(Method, Node, Path, Message, Opts),
-    BaseStatus = hb_ao:get(<<"status">>, Res, Opts),
-    case (ErlStatus == ok) andalso allowed_status(BaseStatus, Statuses) of
-        true ->
-            ?event(http, {admissible_status, {response, Res}}),
-            [
-                {ErlStatus, Res}
-            |
-                serial_multirequest(Nodes, Remaining - 1, Method, Path, Message, Statuses, Opts)
-            ];
-        false ->
-            ?event(http, {inadmissible_status, {response, Res}}),
-            serial_multirequest(Nodes, Remaining, Method, Path, Message, Statuses, Opts)
-    end.
-
-%% @doc Dispatch the same HTTP request to many nodes in parallel.
-parallel_multirequest(Nodes, Responses, StopAfter, Method, Path, Message, Statuses, Opts) ->
-    Ref = make_ref(),
-    Parent = self(),
-    Procs = lists:map(
-        fun(Node) ->
-            spawn(
-                fun() ->
-                    Res = request(Method, Node, Path, Message, Opts),
-                    receive no_reply -> stopping
-                    after 0 -> Parent ! {Ref, self(), Res}
-                    end
-                end
-            )
-        end,
-        Nodes
-    ),
-    parallel_responses([], Procs, Ref, Responses, StopAfter, Statuses, Opts).
-
-%% @doc Check if a status is allowed, according to the configuration.
-allowed_status(_, <<"All">>) -> true;
-allowed_status(_ResponseMsg = #{ <<"status">> := Status }, Statuses) ->
-    allowed_status(Status, Statuses);
-allowed_status(Status, Statuses) when is_integer(Statuses) ->
-    allowed_status(Status, [Statuses]);
-allowed_status(Status, Statuses) when is_binary(Status) ->
-    allowed_status(binary_to_integer(Status), Statuses);
-allowed_status(Status, Statuses) when is_binary(Statuses) ->
-    % Convert the statuses to a list of integers.
-    allowed_status(
-        Status,
-        lists:map(fun binary_to_integer/1, binary:split(Statuses, <<",">>))
-    );
-allowed_status(Status, Statuses) when is_list(Statuses) ->
-    lists:member(Status, Statuses).
-
-%% @doc Collect the necessary number of responses, and stop workers if
-%% configured to do so.
-parallel_responses(Res, Procs, Ref, 0, false, _Statuses, _Opts) ->
-    lists:foreach(fun(P) -> P ! no_reply end, Procs),
-    empty_inbox(Ref),
-    {ok, Res};
-parallel_responses(Res, Procs, Ref, 0, true, _Statuses, _Opts) ->
-    lists:foreach(fun(P) -> exit(P, kill) end, Procs),
-    empty_inbox(Ref),
-    Res;
-parallel_responses(Res, Procs, Ref, Awaiting, StopAfter, Statuses, Opts) ->
-    receive
-        {Ref, Pid, {Status, NewRes}} ->
-            case allowed_status(Status, Statuses) of
-                true ->
-                    parallel_responses(
-                        [NewRes | Res],
-                        lists:delete(Pid, Procs),
-                        Ref,
-                        Awaiting - 1,
-                        StopAfter,
-                        Statuses,
-                        Opts
-                    );
-                false ->
-                    parallel_responses(
-                        Res,
-                        lists:delete(Pid, Procs),
-                        Ref,
-                        Awaiting,
-                        StopAfter,
-                        Statuses,
-                        Opts
-                    )
-            end
-    end.
-
-%% @doc Empty the inbox of the current process for all messages with the given
-%% reference.
-empty_inbox(Ref) ->
-    receive {Ref, _} -> empty_inbox(Ref) after 0 -> ok end.
-
 %% @doc Reply to the client's HTTP request with a message.
 reply(Req, TABMReq, Message, Opts) ->
     Status =
@@ -459,61 +467,105 @@ reply(Req, TABMReq, Message, Opts) ->
     reply(Req, TABMReq, Status, Message, Opts).
 reply(Req, TABMReq, BinStatus, RawMessage, Opts) when is_binary(BinStatus) ->
     reply(Req, TABMReq, binary_to_integer(BinStatus), RawMessage, Opts);
-reply(Req, TABMReq, Status, RawMessage, Opts) ->
-    Message = hb_ao:normalize_keys(RawMessage),
-    {ok, HeadersBeforeCors, EncodedBody} = encode_reply(TABMReq, Message, Opts),
+reply(InitReq, TABMReq, Status, RawMessage, Opts) ->
+    KeyNormMessage = hb_ao:normalize_keys(RawMessage, Opts),
+    {ok, Req, Message} = reply_handle_cookies(InitReq, KeyNormMessage, Opts),
+    {ok, HeadersBeforeCors, EncodedBody} =
+        encode_reply(
+            Status,
+            TABMReq,
+            Message,
+            Opts
+        ),
     % Get the CORS request headers from the message, if they exist.
     ReqHdr = cowboy_req:header(<<"access-control-request-headers">>, Req, <<"">>),
-    HeadersWithCors = add_cors_headers(HeadersBeforeCors, ReqHdr),
+    HeadersWithCors = add_cors_headers(HeadersBeforeCors, ReqHdr, Opts),
     EncodedHeaders = hb_private:reset(HeadersWithCors),
     ?event(http,
         {http_replying,
             {status, {explicit, Status}},
-            {path, maps:get(<<"path">>, Req, undefined_path)},
+            {path, hb_maps:get(<<"path">>, Req, undefined_path, Opts)},
             {raw_message, RawMessage},
-            {enc_headers, EncodedHeaders},
+            {enc_headers, {explicit, EncodedHeaders}},
             {enc_body, EncodedBody}
         }
     ),
-    % Cowboy handles cookies in headers separately, so we need to manipulate
-    % the request to set the cookies such that they will be sent over the wire
-    % unmodified.
-    SetCookiesReq =
-        case maps:get(<<"set-cookie">>, EncodedHeaders, undefined) of
-            undefined -> Req#{ resp_headers => EncodedHeaders };
-            Cookies ->
-                Req#{
-                    resp_headers => EncodedHeaders,
-                    resp_cookies => #{ <<"__HB_SET_COOKIE">> => Cookies }
-                }
-        end,
-    Req2 = cowboy_req:stream_reply(Status, #{}, SetCookiesReq),
-    cowboy_req:stream_body(EncodedBody, nofin, Req2),
+    ReqBeforeStream = Req#{ resp_headers => EncodedHeaders },
+    PostStreamReq = cowboy_req:stream_reply(Status, #{}, ReqBeforeStream),
+    cowboy_req:stream_body(EncodedBody, nofin, PostStreamReq),
     EndTime = os:system_time(millisecond),
-    ?event(http, {reply_headers, {explicit, {ok, Req2, no_state}}}),
+    ?event(http, {reply_headers, {explicit, PostStreamReq}}),
     ?event(http_short,
         {sent,
             {status, Status},
-            {duration, EndTime - maps:get(start_time, Req)},
+            {duration, EndTime - hb_maps:get(start_time, Req, undefined, Opts)},
             {method, cowboy_req:method(Req)},
             {path,
                 {string,
                     uri_string:percent_decode(
-                        hb_ao:get(<<"path">>, TABMReq, <<"[NO PATH]">>, Opts)
+                        hb_maps:get(<<"path">>, TABMReq, <<"[NO PATH]">>, Opts)
                     )
                 }
             },
             {body_size, byte_size(EncodedBody)}
         }
     ),
-    {ok, Req2, no_state}.
+    {ok, PostStreamReq, no_state}.
+
+%% @doc Handle replying with cookies if the message contains them. Returns the
+%% new Cowboy `Req` object, and the message with the cookies removed. Both
+%% `set-cookie' and `cookie' fields are treated as viable sources of cookies.
+reply_handle_cookies(Req, Message, Opts) ->
+    {ok, Cookies} = dev_codec_cookie:extract(Message, #{}, Opts),
+    ?event(debug_cookie, {encoding_reply_cookies, {explicit, Cookies}}),
+    case Cookies of
+        NoCookies when map_size(NoCookies) == 0 -> {ok, Req, Message};
+        _ ->
+            % The internal values of the `cookie' field will be stored in the
+            % `priv_store' by default, so we let `dev_codec_cookie:opts/1'
+            % reset the options.
+            {ok, #{ <<"set-cookie">> := SetCookieLines }} =
+                dev_codec_cookie:to(
+                    Message,
+                    #{ <<"format">> => <<"set-cookie">> },
+                    Opts
+                ),
+            ?event(debug_cookie, {outbound_set_cookie_lines, SetCookieLines}),
+            % Add the cookies to the response headers.
+            FinalReq =
+                lists:foldl(
+                    fun(FullCookieLine, ReqAcc) ->
+                        [CookieRef, _] = binary:split(FullCookieLine, <<"=">>),
+                        RespCookies = maps:get(resp_cookies, ReqAcc, #{}),
+                        % Note: Cowboy handles cookies peculiarly. The key
+                        % given in the `resp_cookies' map is not used directly
+                        % in the response headers. Nonetheless, we use the
+                        % key parsed from the cookie line as the key, but do not
+                        % be surprised if while debugging you see a different
+                        % key created by Cowboy in the response headers.
+                        ReqAcc#{
+                            resp_cookies =>
+                                RespCookies#{ CookieRef => FullCookieLine }
+                        }
+                    end,
+                    Req,
+                    SetCookieLines
+                ),
+            {ok, CookieReset} = dev_codec_cookie:reset(Message, Opts),
+            {
+                ok,
+                FinalReq,
+                CookieReset
+            }
+    end.
 
 %% @doc Add permissive CORS headers to a message, if the message has not already
 %% specified CORS headers.
-add_cors_headers(Msg, ReqHdr) ->
+add_cors_headers(Msg, ReqHdr, Opts) ->
     CorHeaders = #{
         <<"access-control-allow-origin">> => <<"*">>,
-        <<"access-control-allow-methods">> => <<"GET, POST, PUT, DELETE, OPTIONS">>
+        <<"access-control-allow-methods">> => <<"GET, POST, PUT, DELETE, OPTIONS">>,
+        <<"access-control-expose-headers">> => <<"*">>
     },
      WithAllowHeaders = case ReqHdr of
         <<>> -> CorHeaders;
@@ -522,41 +574,96 @@ add_cors_headers(Msg, ReqHdr) ->
         }
     end,
     % Keys in the given message will overwrite the defaults listed below if 
-    % included, due to `maps:merge''s precidence order.
-    maps:merge(WithAllowHeaders, Msg).
+    % included, due to `hb_maps:merge''s precidence order.
+    hb_maps:merge(WithAllowHeaders, Msg, Opts).
 
 %% @doc Generate the headers and body for a HTTP response message.
-encode_reply(TABMReq, Message, Opts) ->
-    Codec = accept_to_codec(TABMReq, Opts),
+encode_reply(Status, TABMReq, Message, Opts) ->
+    Codec = accept_to_codec(TABMReq, Message, Opts),
     ?event(http, {encoding_reply, {codec, Codec}, {message, Message}}),
     BaseHdrs =
-        maps:merge(
+        hb_maps:merge(
             #{
                 <<"codec-device">> => Codec
             },
             case codec_to_content_type(Codec, Opts) of
                     undefined -> #{};
                     CT -> #{ <<"content-type">> => CT }
-            end
+            end,
+			Opts
         ),
+    AcceptBundle =
+        hb_util:atom(
+            hb_maps:get(<<"accept-bundle">>, TABMReq, false, Opts)
+        ),
+    ?event(http,
+        {encoding_reply,
+            {status, Status},
+            {codec, Codec},
+            {should_bundle, AcceptBundle},
+            {response_message, Message}
+        }
+    ),
     % Codecs generally do not need to specify headers outside of the content-type,
     % aside the default `httpsig@1.0' codec, which expresses its form in HTTP
     % documents, and subsequently must set its own headers.
-    case Codec of
-        <<"httpsig@1.0">> ->
-            EncMessage =
+    case {Status, Codec, AcceptBundle} of
+        {500, <<"httpsig@1.0">>, false} ->
+            ?event(debug_accept,
+                {returning_500_error,
+                    {status, Status},
+                    {codec, Codec},
+                    {bundle, AcceptBundle}
+                }
+            ),
+            {ok, ErrMsg} =
+                dev_hyperbuddy:return_error(Message, Opts),
+            {ok,
+                maps:without([<<"body">>], ErrMsg),
+                maps:get(<<"body">>, ErrMsg, <<>>)
+            };
+        {404, <<"httpsig@1.0">>, false} ->
+            {ok, ErrMsg} =
+                dev_hyperbuddy:return_file(
+                    <<"hyperbuddy@1.0">>,
+                    <<"404.html">>
+                ),
+            {ok,
+                maps:without([<<"body">>], ErrMsg),
+                maps:get(<<"body">>, ErrMsg, <<>>)
+            };
+        {_, <<"httpsig@1.0">>, _} ->
+            TABM =
                 hb_message:convert(
                     Message,
-                    <<"httpsig@1.0">>,
+                    tabm,
                     <<"structured@1.0">>,
-                    #{ topic => ao_internal }
+                    Opts#{ topic => ao_internal }
+                ),
+            {ok, EncMessage} =
+                dev_codec_httpsig:to(
+                    TABM,
+                    case AcceptBundle of
+                        true ->
+                            #{
+                                <<"path">> => <<"to">>,
+                                <<"bundle">> => true
+                            };
+                        false ->
+                            TABMReq#{
+                                <<"path">> => <<"to">>,
+                                <<"index">> =>
+                                    hb_opts:get(generate_index, true, Opts)
+                            }
+                    end,
+                    Opts
                 ),
             {
                 ok,
-                maps:without([<<"body">>], EncMessage),
-                maps:get(<<"body">>, EncMessage, <<>>)
+                hb_maps:without([<<"body">>], EncMessage, Opts),
+                hb_maps:get(<<"body">>, EncMessage, <<>>, Opts)
             };
-        <<"ans104@1.0">> ->
+        {_, <<"ans104@1.0">>, _} ->
             % The `ans104@1.0' codec is a binary format, so we must serialize
             % the message to a binary before sending it.
             {
@@ -566,9 +673,21 @@ encode_reply(TABMReq, Message, Opts) ->
                     hb_message:convert(
                         hb_message:with_only_committers(
                             Message,
-                            hb_message:signers(Message)
+                            hb_message:signers(Message, Opts),
+							Opts
                         ),
-                        <<"ans104@1.0">>,
+                        #{
+                            <<"device">> => <<"ans104@1.0">>,
+                            <<"bundle">> =>
+                                hb_util:atom(
+                                    hb_ao:get(
+                                        <<"accept-bundle">>,
+                                        {as, <<"message@1.0">>, TABMReq},
+                                        true,
+                                        Opts
+                                    )
+                                )
+                        },
                         <<"structured@1.0">>,
                         Opts#{ topic => ao_internal }
                     )
@@ -577,44 +696,62 @@ encode_reply(TABMReq, Message, Opts) ->
         _ ->
             % Other codecs are already in binary format, so we can just convert
             % the message to the codec. We also include all of the top-level 
-            % fields in the message and return them as headers.
-            ExtraHdrs = maps:filter(fun(_, V) -> not is_map(V) end, Message),
-            ?event({extra_headers, {headers, {explicit, ExtraHdrs}}, {message, Message}}),
+            % fields, except for maps and lists, in the message and return them 
+            % as headers.
+            ExtraHdrs =
+                hb_maps:filter(
+                    fun(Key, V) ->
+                        not is_map(V)
+                            andalso not is_list(V)
+                            andalso Key =/= <<"body">>
+                            andalso Key =/= <<"data">>
+                    end,
+                    Message,
+                    Opts
+                ),
+            % Encode all header values as strings.
+            EncodedExtraHdrs =
+                maps:map(
+                    fun(_K, V) -> hb_util:bin(V) end,
+                    ExtraHdrs
+                ),
             {ok,
-                maps:merge(BaseHdrs, ExtraHdrs),
+                hb_maps:merge(EncodedExtraHdrs, BaseHdrs, Opts),
                 hb_message:convert(
                     Message,
-                    Codec,
+                    #{ <<"device">> => Codec, <<"bundle">> => AcceptBundle },
                     <<"structured@1.0">>,
                     Opts#{ topic => ao_internal }
                 )
             }
     end.
 
-%% @doc Calculate the codec name to use for a reply given its initiating Cowboy
-%% request, the parsed TABM request, and the response message. The precidence
+%% @doc Calculate the codec name to use for a reply given the original parsed 
+%% singleton TABM request and the response message. The precidence
 %% order for finding the codec is:
-%% 1. The `accept-codec' field in the message
-%% 2. The `accept' field in the request headers
-%% 3. The default codec
+%% 1. If the `content-type' field is present in the response message, we always
+%%    use `httpsig@1.0', as the device is expected to have already encoded the
+%%    message and the `body' field.
+%% 2. The `accept-codec' field in the original request.
+%% 3. The `accept' field in the original request.
+%% 4. The default codec
 %% Options can be specified in mime-type format (`application/*') or in
 %% AO device format (`device@1.0').
-accept_to_codec(TABMReq, Opts) ->
-    AcceptCodec =
-        maps:get(
-            <<"accept-codec">>,
-            TABMReq,
-            mime_to_codec(maps:get(<<"accept">>, TABMReq, <<"*/*">>), Opts)
-        ),
-    ?event(http, {accept_to_codec, AcceptCodec}),
-    case AcceptCodec of
-        not_specified ->
-            % We hold off until confirming that the codec is not directly in the
-            % message before calling `hb_opts:get/3', as it is comparatively
-            % expensive.
-            default_codec(Opts);
-        _ -> AcceptCodec
-    end.
+accept_to_codec(OriginalReq, Opts) ->
+    accept_to_codec(OriginalReq, undefined, Opts).
+accept_to_codec(#{ <<"require-codec">> := RequiredCodec }, _Reply, Opts) ->
+    mime_to_codec(RequiredCodec, Opts);
+accept_to_codec(_OriginalReq, #{ <<"content-type">> := _ }, _Opts) ->
+    <<"httpsig@1.0">>;
+accept_to_codec(OriginalReq, _, Opts) ->
+    Accept = hb_maps:get(<<"accept">>, OriginalReq, <<"*/*">>, Opts),
+    ?event(debug_accept,
+        {accept_to_codec,
+            {original_req, OriginalReq},
+            {accept, Accept}
+        }
+    ),
+    mime_to_codec(Accept, Opts).
 
 %% @doc Find a codec name from a mime-type.
 mime_to_codec(<<"application/", Mime/binary>>, Opts) ->
@@ -623,13 +760,24 @@ mime_to_codec(<<"application/", Mime/binary>>, Opts) ->
             nomatch -> << Mime/binary, "@1.0" >>;
             _ -> Mime
         end,
-    try hb_ao:message_to_device(#{ <<"device">> => Name }, Opts)
-    catch _:Error ->
-        ?event(http, {accept_to_codec_error, {name, Name}, {error, Error}}),
-        default_codec(Opts)
+    case hb_ao_device:load(Name, Opts) of
+        {ok, _} -> Name;
+        {error, _} ->
+            Default = default_codec(Opts),
+            ?event(http,
+                {codec_parsing_error,
+                    {given, Name},
+                    {defaulting_to, Default}
+                }
+            ),
+            Default
     end;
 mime_to_codec(<<"device/", Name/binary>>, _Opts) -> Name;
-mime_to_codec(_, _Opts) -> not_specified.
+mime_to_codec(Device, Opts) ->
+    case binary:match(Device, <<"@">>) of
+        nomatch -> default_codec(Opts);
+        _ -> Device
+    end.
 
 %% @doc Return the default codec for the given options.
 default_codec(Opts) ->
@@ -651,15 +799,51 @@ codec_to_content_type(Codec, Opts) ->
         CT -> CT
     end.
 
-%% @doc Convert a cowboy request to a normalized message.
+%% @doc Convert a cowboy request to a normalized message. We first parse the
+%% `primitive' message from the request: A message (represented as an Erlang
+%% map) of binary keys and values for the request headers and query parameters.
+%% We then determine the codec to use for the request, decode it, and merge it
+%% overriding the keys of the `primitive' message.
 req_to_tabm_singleton(Req, Body, Opts) ->
-    case cowboy_req:header(<<"codec-device">>, Req, <<"httpsig@1.0">>) of
+    FullPath =
+        <<
+            (cowboy_req:path(Req))/binary,
+            "?",
+            (cowboy_req:qs(Req))/binary
+        >>,
+    Headers = cowboy_req:headers(Req),
+    {ok, _Path, QueryKeys} = hb_singleton:from_path(FullPath),
+    PrimitiveMsg = maps:merge(Headers, QueryKeys),
+    Codec =
+        case hb_maps:find(<<"codec-device">>, PrimitiveMsg, Opts) of
+            {ok, ExplicitCodec} -> ExplicitCodec;
+            error ->
+                case hb_maps:find(<<"content-type">>, PrimitiveMsg, Opts) of
+                    {ok, ContentType} -> mime_to_codec(ContentType, Opts);
+                    error -> default_codec(Opts)
+                end
+        end,
+    ?event(http,
+        {parsing_req,
+            {path, FullPath},
+            {query, QueryKeys},
+            {headers, Headers},
+            {primitive_message, PrimitiveMsg}
+        }
+    ),
+    ?event({req_to_tabm_singleton, {codec, Codec}}),
+    case Codec of
         <<"httpsig@1.0">> ->
-			?event({req_to_tabm_singleton, {request, {explicit, Req}, {body, {string, Body}}}}),
-            httpsig_to_tabm_singleton(Req, Body, Opts);
+			?event(
+                {req_to_tabm_singleton,
+                    {request, {explicit, Req},
+                    {body, {string, Body}}
+                }}
+            ),
+            httpsig_to_tabm_singleton(PrimitiveMsg, Req, Body, Opts);
         <<"ans104@1.0">> ->
             Item = ar_bundles:deserialize(Body),
-            ?event(ans104,
+            ?event(debug_accept,
                 {deserialized_ans104,
                     {item, Item},
                     {exact, {explicit, Item}}
@@ -675,12 +859,13 @@ req_to_tabm_singleton(Req, Body, Opts) ->
                             <<"ans104@1.0">>,
                             Opts
                         ),
-                    maybe_add_unsigned(Req, ANS104, Opts);
+                    normalize_unsigned(PrimitiveMsg, Req, ANS104, Opts);
                 false ->
                     throw({invalid_ans104_signature, Item})
             end;
         Codec ->
             % Assume that the codec stores the encoded message in the `body' field.
+            ?event(http, {decoding_body, {codec, Codec}, {body, {string, Body}}}),
             Decoded =
                 hb_message:convert(
                     Body,
@@ -688,17 +873,19 @@ req_to_tabm_singleton(Req, Body, Opts) ->
                     Codec,
                     Opts
                 ),
-            ?event(debug,
+            ReqMessage = hb_maps:merge(PrimitiveMsg, Decoded, Opts),
+            ?event(
                 {verifying_encoded_message,
+                    {codec, Codec},
                     {body, {string, Body}},
-                    {decoded, Decoded}
+                    {decoded, ReqMessage}
                 }
             ),
-            case hb_message:verify(Decoded, all) of
+            case hb_message:verify(ReqMessage, all) of
                 true ->
-                    maybe_add_unsigned(Req, Decoded, Opts);
+                    normalize_unsigned(PrimitiveMsg, Req, ReqMessage, Opts);
                 false ->
-                    throw({invalid_signature, Decoded})
+                    throw({invalid_commitment, ReqMessage})
             end
     end.
 
@@ -707,58 +894,64 @@ req_to_tabm_singleton(Req, Body, Opts) ->
 %% In particular, the signatures are verified if present and required by the 
 %% node configuration. Additionally, non-committed fields are removed from the
 %% message if it is signed, with the exception of the `path' and `method' fields.
-httpsig_to_tabm_singleton(Req = #{ headers := RawHeaders }, Body, Opts) ->
-    Msg = dev_codec_httpsig_conv:from(
-        RawHeaders#{ <<"body">> => Body }
-    ),
-    {ok, SignedMsg} =
-        dev_codec_httpsig:reset_hmac(
-            hb_util:ok(remove_unsigned_fields(Msg, Opts))
+httpsig_to_tabm_singleton(PrimMsg, Req, Body, Opts) ->
+    {ok, Decoded} =
+        hb_message:with_only_committed(
+            hb_message:convert(
+                PrimMsg#{ <<"body">> => Body },
+                <<"structured@1.0">>,
+                <<"httpsig@1.0">>,
+                Opts
+            ),
+            Opts
         ),
+    ?event(http, {decoded, Decoded}, Opts),
     ForceSignedRequests = hb_opts:get(force_signed_requests, false, Opts),
-    case (not ForceSignedRequests) orelse hb_message:verify(SignedMsg) of
+    case (not ForceSignedRequests) orelse hb_message:verify(Decoded, all, Opts) of
         true ->
-            ?event(http_verify, {verified_signature, SignedMsg}),
-            Signers = hb_message:signers(SignedMsg),
+            ?event(http_verify, {verified_signature, Decoded}),
+            Signers = hb_message:signers(Decoded, Opts),
             case Signers =/= [] andalso hb_opts:get(store_all_signed, false, Opts) of
                 true ->
-                    ?event(http_verify, {storing_signed_from_wire, SignedMsg}),
+                    ?event(http_verify, {storing_signed_from_wire, Decoded}),
                     {ok, _} =
-                        hb_cache:write(Msg,
+                        hb_cache:write(Decoded,
                             Opts#{
                                 store =>
                                     #{
                                         <<"store-module">> => hb_store_fs,
-                                        <<"prefix">> => <<"cache-http">>
+                                        <<"name">> => <<"cache-http">>
                                     }
                             }
                         );
                 false ->
                     do_nothing
             end,
-            maybe_add_unsigned(Req, SignedMsg, Opts);
+            normalize_unsigned(PrimMsg, Req, Decoded, Opts);
         false ->
             ?event(http_verify,
                 {invalid_signature,
-                    {raw, RawHeaders},
-                    {signed, SignedMsg},
+                    {signed, Decoded},
                     {force, ForceSignedRequests}
                 }
             ),
-            throw({invalid_signature, SignedMsg})
+            throw({invalid_commitments, Decoded})
     end.
 
 %% @doc Add the method and path to a message, if they are not already present.
+%% Remove browser-added fields that are unhelpful during processing (for example,
+%% `content-length').
 %% The precidence order for finding the path is:
 %% 1. The path in the message
 %% 2. The path in the request URI
-maybe_add_unsigned(Req = #{ headers := RawHeaders }, Msg, Opts) ->
+normalize_unsigned(PrimMsg, Req = #{ headers := RawHeaders }, Msg, Opts) ->
+    ?event({adding_method_and_path_from_request, {explicit, Req}}),
     Method = cowboy_req:method(Req),
     MsgPath =
-        hb_ao:get(
+        hb_maps:get(
             <<"path">>,
             Msg,
-            maps:get(
+            hb_maps:get(
                 <<"path">>, 
                 RawHeaders,
                 iolist_to_binary(
@@ -770,16 +963,79 @@ maybe_add_unsigned(Req = #{ headers := RawHeaders }, Msg, Opts) ->
                             scheme => undefined
                         }
                     )
-                )
+                ),
+                Opts
             ),
             Opts
         ),
-    Msg#{ <<"method">> => Method, <<"path">> => MsgPath }.
-
-remove_unsigned_fields(Msg, _Opts) ->
-    case hb_message:signers(Msg) of
-        [] -> {ok, Msg};
-        _ -> hb_message:with_only_committed(Msg)
+    FilterKeys = hb_opts:get(http_inbound_filter_keys, ?DEFAULT_FILTER_KEYS, Opts),
+    FilteredMsg = hb_message:without_unless_signed(FilterKeys, Msg, Opts),
+    BaseMsg =
+        FilteredMsg#{
+            <<"method">> => Method,
+            <<"path">> => MsgPath,
+            <<"accept-bundle">> =>
+                maps:get(
+                    <<"accept-bundle">>,
+                    Msg,
+                    maps:get(
+                        <<"accept-bundle">>,
+                        PrimMsg,
+                        maps:get(<<"accept-bundle">>, RawHeaders, false)
+                    )
+                ),
+            <<"accept">> =>
+                Accept = maps:get(
+                    <<"accept">>,
+                    Msg,
+                    maps:get(
+                        <<"accept">>,
+                        PrimMsg,
+                        maps:get(<<"accept">>, RawHeaders, <<"*/*">>)
+                    )
+                )
+        },
+    ?event(debug_accept, {normalize_unsigned, {accept, Accept}}),
+    % Parse and add the cookie from the request, if present. We reinstate the
+    % `cookie' field in the message, as it is not typically signed, yet should
+    % be honored by the node anyway.
+    {ok, WithCookie} =
+        case maps:get(<<"cookie">>, RawHeaders, undefined) of
+            undefined -> {ok, BaseMsg};
+            Cookie ->
+                dev_codec_cookie:from(
+                    BaseMsg#{ <<"cookie">> => Cookie },
+                    Req,
+                    Opts
+                )
+        end,
+    % If the body is empty and unsigned, we remove it.
+    NormalBody =
+        case hb_maps:get(<<"body">>, WithCookie, undefined, Opts) of
+            <<"">> -> hb_message:without_unless_signed(<<"body">>, WithCookie, Opts);
+            _ -> WithCookie
+        end,
+    case hb_maps:get(<<"ao-peer-port">>, NormalBody, undefined, Opts) of
+        undefined -> NormalBody;
+        P2PPort ->
+            % Calculate the peer address from the request. We honor the 
+            % `x-real-ip' header if it is present.
+            RealIP =
+                case hb_maps:get(<<"x-real-ip">>, RawHeaders, undefined, Opts) of
+                    undefined ->
+                        {{A, B, C, D}, _} = cowboy_req:peer(Req),
+                        hb_util:bin(
+                            io_lib:format(
+                                "~b.~b.~b.~b",
+                                [A, B, C, D]
+                            )
+                        );
+                    IP -> IP
+                end,
+            Peer = <<RealIP/binary, ":", (hb_util:bin(P2PPort))/binary>>,
+            (hb_message:without_unless_signed(<<"ao-peer-port">>, NormalBody, Opts))#{
+                <<"ao-peer">> => Peer
+            }
     end.
 
 %%% Tests
@@ -827,7 +1083,7 @@ wasm_compute_request(ImageFile, Func, Params, ResultPath) ->
     Wallet = hb:wallet(),
     hb_message:commit(#{
         <<"path">> => <<"/init/compute/results", ResultPath/binary>>,
-        <<"device">> => <<"WASM-64@1.0">>,
+        <<"device">> => <<"wasm-64@1.0">>,
         <<"function">> => Func,
         <<"parameters">> => Params,
         <<"body">> => Bin
@@ -837,25 +1093,31 @@ run_wasm_unsigned_test() ->
     Node = hb_http_server:start_node(#{force_signed => false}),
     Msg = wasm_compute_request(<<"test/test-64.wasm">>, <<"fac">>, [3.0]),
     {ok, Res} = post(Node, Msg, #{}),
+    ?event({res, Res}),
     ?assertEqual(6.0, hb_ao:get(<<"output/1">>, Res, #{})).
 
 run_wasm_signed_test() ->
+    Opts = #{ priv_wallet => hb:wallet() },
     URL = hb_http_server:start_node(#{force_signed => true}),
     Msg = wasm_compute_request(<<"test/test-64.wasm">>, <<"fac">>, [3.0], <<"">>),
-    {ok, Res} = post(URL, Msg, #{}),
+    {ok, Res} = post(URL, hb_message:commit(Msg, Opts), Opts),
     ?assertEqual(6.0, hb_ao:get(<<"output/1">>, Res, #{})).
 
 get_deep_unsigned_wasm_state_test() ->
     URL = hb_http_server:start_node(#{force_signed => false}),
-    Msg = wasm_compute_request(
-        <<"test/test-64.wasm">>, <<"fac">>, [3.0], <<"">>),
+    Msg = wasm_compute_request(<<"test/test-64.wasm">>, <<"fac">>, [3.0], <<"">>),
     {ok, Res} = post(URL, Msg, #{}),
     ?assertEqual(6.0, hb_ao:get(<<"/output/1">>, Res, #{})).
 
 get_deep_signed_wasm_state_test() ->
     URL = hb_http_server:start_node(#{force_signed => true}),
-    Msg = wasm_compute_request(
-        <<"test/test-64.wasm">>, <<"fac">>, [3.0], <<"/output">>),
+    Msg =
+        wasm_compute_request(
+            <<"test/test-64.wasm">>,
+            <<"fac">>,
+            [3.0],
+            <<"/output">>
+        ),
     {ok, Res} = post(URL, Msg, #{}),
     ?assertEqual(6.0, hb_ao:get(<<"1">>, Res, #{})).
 
@@ -868,87 +1130,95 @@ cors_get_test() ->
     ).
 
 ans104_wasm_test() ->
-    URL = hb_http_server:start_node(#{force_signed => true}),
+    TestStore = [hb_test_utils:test_store()],
+    TestOpts =
+        #{
+            force_signed => true,
+            store => TestStore,
+            priv_wallet => ar_wallet:new()
+        },
+    ClientStore = [hb_test_utils:test_store()],
+    ClientOpts = #{ store => ClientStore, priv_wallet => hb:wallet() },
+    URL = hb_http_server:start_node(TestOpts),
     {ok, Bin} = file:read_file(<<"test/test-64.wasm">>),
-    Wallet = hb:wallet(),
-    Msg = hb_message:commit(#{
-        <<"path">> => <<"/init/compute/results">>,
-        <<"accept-codec">> => <<"ans104@1.0">>,
-        <<"codec-device">> => <<"ans104@1.0">>,
-        <<"device">> => <<"WASM-64@1.0">>,
-        <<"function">> => <<"fac">>,
-        <<"parameters">> => [3.0],
-        <<"body">> => Bin
-    }, Wallet, <<"ans104@1.0">>),
+    Msg =
+        hb_message:commit(
+            #{
+                <<"require-codec">> => <<"ans104@1.0">>,
+                <<"codec-device">> => <<"ans104@1.0">>,
+                <<"device">> => <<"wasm-64@1.0">>,
+                <<"function">> => <<"fac">>,
+                <<"parameters">> => [3.0],
+                <<"body">> => Bin
+            },
+            ClientOpts,
+            #{ <<"device">> => <<"ans104@1.0">>, <<"bundle">> => true }
+        ),
+    ?assert(hb_message:verify(Msg, all, ClientOpts)),
     ?event({msg, Msg}),
-    {ok, Res} = post(URL, Msg, #{}),
+    {ok, Res} =
+        post(
+            URL,
+            Msg#{ <<"path">> => <<"/init/compute/results">> },
+            ClientOpts
+        ),
     ?event({res, Res}),
-    ?assertEqual(6.0, hb_ao:get(<<"output/1">>, Res, #{})).
+    ?assertEqual(6.0, hb_ao:get(<<"output/1">>, Res, ClientOpts)).
 
 send_large_signed_request_test() ->
-    % Note: If the signature scheme ever changes, we will need to do
-    % `hb_message:commit(hb_message:uncommitted(Req), #{})' to get a freshly
-    % signed request.
+    % Note: If the signature scheme ever changes, we will need to run the 
+    % following to get a freshly signed request.
+    %    file:write_file(
+    %        "test/large-message.eterm",
+    %        hb_util:bin(
+    %            io_lib:format(
+    %               "~p.", 
+    %                [
+    %                    hb_cache:ensure_all_loaded(hb_message:commit(
+    %                        hb_message:uncommitted(hd(hb_util:ok(
+    %                            file:consult(<<"test/large-message.eterm">>)
+    %                       ))),
+    %                        #{ priv_wallet => hb:wallet() }
+    %                    ))
+    %                ]
+    %            )
+    %        )
+    %    ).
     {ok, [Req]} = file:consult(<<"test/large-message.eterm">>),
     % Get the short trace length from the node message in the large, stored
     % request. 
-    ?event({request_message, Req}),
     ?assertMatch(
         {ok, 5},
         post(
             hb_http_server:start_node(),
             <<"/node-message/short_trace_len">>,
             Req,
-            #{ http_client => httpc }
+            #{ http_client => gun }
         )
     ).
 
-send_encoded_node_message_test(Config, Codec) ->
-    NodeURL = hb_http_server:start_node(
-        #{
-            priv_wallet => ar_wallet:new(),
-            operator => <<"unclaimed">>
-        }
-    ),
+index_test() ->
+    NodeURL = hb_http_server:start_node(),
     {ok, Res} =
-        post(
+        get(
             NodeURL,
-            <<"/~meta@1.0/info">>,
             #{
-                <<"codec-device">> => Codec,
-                <<"body">> => Config
+                <<"path">> => <<"/~test-device@1.0/load">>,
+                <<"accept-bundle">> => false
             },
             #{}
         ),
-    ?event(debug, {res, Res}),
-    ?assertEqual(
-        {ok, <<"b">>},
-        hb_http:get(
-            NodeURL,
-            <<"/~meta@1.0/info/test_optionb">>,
-            #{}
-        )
-    ),
-    ?assertEqual(
-        {ok, <<"c">>},
-        hb_http:get(
-            NodeURL,
-            <<"/~meta@1.0/info/test_deep/c">>,
-            #{}
-        )
-    ).
-
-send_flat_encoded_node_message_test() ->
-    send_encoded_node_message_test(
-        <<"test_option: a\ntest_optionb: b\ntest_deep/c: c">>,
-        <<"flat@1.0">>
-    ).
+    ?assertEqual(<<"i like turtles!">>, hb_ao:get(<<"body">>, Res, #{})).
 
-send_json_encoded_node_message_test() ->
-    send_encoded_node_message_test(
-        <<
-            "{\"test_option\": \"a\", \"test_optionb\": \"b\", \"test_deep\": "
-                "{\"c\": \"c\"}}"
-        >>,
-        <<"json@1.0">>
-    ).
\ No newline at end of file
+index_request_test() ->
+    URL = hb_http_server:start_node(),
+    {ok, Res} =
+        get(
+            URL,
+            #{
+                <<"path">> => <<"/~test-device@1.0/load?name=dogs">>,
+                <<"accept-bundle">> => false
+            },
+            #{}
+        ),
+    ?assertEqual(<<"i like dogs!">>, hb_ao:get(<<"body">>, Res, #{})).
diff --git a/src/hb_http_benchmark_tests.erl b/src/hb_http_benchmark_tests.erl
index f62b725c1..905b899a2 100644
--- a/src/hb_http_benchmark_tests.erl
+++ b/src/hb_http_benchmark_tests.erl
@@ -11,7 +11,7 @@
 % unsigned_resolve_benchmark_test() ->
 %     BenchTime = 1,
 %     URL = hb_http_server:start_node(#{force_signed => false}),
-%     Iterations = hb:benchmark(
+%     Iterations = hb_test_utils:benchmark(
 %         fun() ->
 %             hb_http:post(URL,
 %                 #{
@@ -23,7 +23,7 @@
 %         end,
 %         BenchTime
 %     ),
-%     hb_util:eunit_print(
+%     hb_formatter:eunit_print(
 %         "Resolved ~p messages through AO-Core via HTTP in ~p seconds (~.2f msg/s)",
 %         [Iterations, BenchTime, Iterations / BenchTime]
 %     ),
@@ -33,7 +33,7 @@
 %     BenchTime = 1,
 %     BenchWorkers = 16,
 %     URL = hb_http_server:start_node(#{force_signed => false}),
-%     Iterations = hb:benchmark(
+%     Iterations = hb_test_utils:benchmark(
 %         fun(_Count) ->
 %             hb_http:post(
 %                 URL,
@@ -47,7 +47,7 @@
 %         BenchTime,
 %         BenchWorkers
 %     ),
-%     hb_util:eunit_print(
+%     hb_formatter:eunit_print(
 %         "Resolved ~p messages via HTTP (~p workers) in ~p seconds (~.2f msg/s)",
 %         [Iterations, BenchWorkers, BenchTime, Iterations / BenchTime]
 %     ),
@@ -67,7 +67,7 @@
 %     BenchTime = 1,
 %     URL = hb_http_server:start_node(#{force_signed => false}),
 %     Msg = wasm_compute_request(<<"test/test-64.wasm">>, <<"fac">>, [10]),
-%     Iterations = hb:benchmark(
+%     Iterations = hb_test_utils:benchmark(
 %         fun(_) ->
 %             case hb_http:post(URL, Msg, #{}) of
 %                 {ok, _} -> 1;
@@ -76,7 +76,7 @@
 %         end,
 %         BenchTime
 %     ),
-%     hb_util:eunit_print(
+%     hb_formatter:eunit_print(
 %         "Resolved ~p WASM invocations via HTTP in ~p seconds (~.2f msg/s)",
 %         [Iterations, BenchTime, Iterations / BenchTime]
 %     ),
@@ -87,7 +87,7 @@
 %     BenchTime = 1,
 %     URL = hb_http_server:start_node(#{force_signed => true}),
 %     Msg = wasm_compute_request(<<"test/test-64.wasm">>, <<"fac">>, [10]),
-%     Iterations = hb:benchmark(
+%     Iterations = hb_test_utils:benchmark(
 %         fun(_) ->
 %             case hb_http:post(URL, Msg, #{}) of
 %                 {ok, _} -> 1;
@@ -96,7 +96,7 @@
 %         end,
 %         BenchTime
 %     ),
-%     hb_util:eunit_print(
+%     hb_formatter:eunit_print(
 %         "Resolved ~p WASM invocations via HTTP in ~p seconds (~.2f msg/s)",
 %         [Iterations, BenchTime, Iterations / BenchTime]
 %     ),
@@ -107,7 +107,7 @@
 %     BenchWorkers = 16,
 %     URL = hb_http_server:start_node(#{force_signed => false}),
 %     Msg = wasm_compute_request(<<"test/test-64.wasm">>, <<"fac">>, [10]),
-%     Iterations = hb:benchmark(
+%     Iterations = hb_test_utils:benchmark(
 %         fun(X) ->
 %             ?event({post_start, X}),
 %             case hb_http:post(URL, Msg, #{}) of
@@ -119,7 +119,7 @@
 %         BenchTime,
 %         BenchWorkers
 %     ),
-%     hb_util:eunit_print(
+%     hb_formatter:eunit_print(
 %         "Resolved ~p WASM invocations via HTTP (~p workers) in ~p seconds (~.2f msg/s)",
 %         [Iterations, BenchWorkers, BenchTime, Iterations / BenchTime]
 %     ),
@@ -130,7 +130,7 @@
 %     BenchWorkers = 16,
 %     URL = hb_http_server:start_node(#{force_signed => true}),
 %     Msg = wasm_compute_request(<<"test/test-64.wasm">>, <<"fac">>, [10]),
-%     Iterations = hb:benchmark(
+%     Iterations = hb_test_utils:benchmark(
 %         fun(_) ->
 %             case hb_http:post(URL, Msg, #{}) of
 %                 {ok, _ResMsg} ->
@@ -141,7 +141,7 @@
 %         BenchTime,
 %         BenchWorkers
 %     ),
-%     hb_util:eunit_print(
+%     hb_formatter:eunit_print(
 %         "Resolved ~p WASM invocations via HTTP (~p workers) in ~p seconds (~.2f msg/s)",
 %         [Iterations, BenchWorkers, BenchTime, Iterations / BenchTime]
 %     ),
@@ -156,7 +156,7 @@
 % %     Proc = hb_ao:get(process, Msg1, #{ hashpath => ignore }),
 % %     ProcID = hb_util:id(Proc),
 % %     ?event({benchmark_start, ?MODULE}),
-% %     Iterations = hb:benchmark(
+% %     Iterations = hb_test_utils:benchmark(
 % %         fun(X) ->
 % %             MsgX = #{
 % %                 <<"device">> => <<"Scheduler@1.0">>,
@@ -186,7 +186,7 @@
 % %     },
 % %     Res = hb_http:post(URL, Msg3),
 % %     ?event({slot_result, Res}),
-% %     hb_util:eunit_print(
+% %     hb_formatter:eunit_print(
 % %         "Scheduled ~p messages through AO-Core in ~p seconds (~.2f msg/s)",
 % %         [Iterations, BenchTime, Iterations / BenchTime]
 % %     ),
diff --git a/src/hb_http_client.erl b/src/hb_http_client.erl
index eda7482ed..4df7e3ce9 100644
--- a/src/hb_http_client.erl
+++ b/src/hb_http_client.erl
@@ -40,13 +40,28 @@ httpc_req(Args, _, Opts) ->
         443 -> "https";
         _ -> "http"
     end,
-    ?event(http, {httpc_req, Args}),
+    ?event(http_client, {httpc_req, {explicit, Args}}),
     URL = binary_to_list(iolist_to_binary([Scheme, "://", Host, ":", integer_to_binary(Port), Path])),
-    FilteredHeaders = maps:remove(<<"content-type">>, Headers),
+    FilteredHeaders = hb_maps:without([<<"content-type">>, <<"cookie">>], Headers, Opts),
     HeaderKV =
-        [ {binary_to_list(Key), binary_to_list(Value)} || {Key, Value} <- maps:to_list(FilteredHeaders) ],
+        [
+            {binary_to_list(Key), binary_to_list(Value)}
+        ||
+            {Key, Value} <- hb_maps:to_list(FilteredHeaders, Opts)
+        ] ++
+        [
+            {<<"cookie">>, CookieLine}
+        ||
+            CookieLine <-
+                case hb_maps:get(<<"cookie">>, Headers, [], Opts) of
+                    Binary when is_binary(Binary) ->
+                        [Binary];
+                    List when is_list(List) ->
+                        List
+                end
+        ],
     Method = binary_to_existing_atom(hb_util:to_lower(RawMethod)),
-    ContentType = maps:get(<<"content-type">>, Headers, <<"application/octet-stream">>),
+    ContentType = hb_maps:get(<<"content-type">>, Headers, <<"application/octet-stream">>, Opts),
     Request =
         case Method of
             get ->
@@ -62,7 +77,7 @@ httpc_req(Args, _, Opts) ->
                     Body
                 }
         end,
-    ?event(http, {httpc_req, Method, URL, Request}),
+    ?event({http_client_outbound, Method, URL, Request}),
     HTTPCOpts = [{full_result, true}, {body_format, binary}],
 	StartTime = os:system_time(millisecond),
     case httpc:request(Method, Request, [], HTTPCOpts) of
@@ -74,7 +89,7 @@ httpc_req(Args, _, Opts) ->
                 ||
                     {Key, Value} <- RawRespHeaders
                 ],
-            ?event(http, {httpc_resp, Status, RespHeaders, RespBody}),
+            ?event(http_client, {httpc_resp, Status, RespHeaders, RespBody}),
             record_duration(#{
                     <<"request-method">> => method_to_bin(Method),
                     <<"request-path">> => hb_util:bin(Path),
@@ -85,7 +100,7 @@ httpc_req(Args, _, Opts) ->
             ),
             {ok, Status, RespHeaders, RespBody};
         {error, Reason} ->
-            ?event(http, {httpc_error, Reason}),
+            ?event(http_client, {httpc_error, Reason}),
             {error, Reason}
     end.
 
@@ -198,7 +213,7 @@ maybe_invoke_monitor(Details, Opts) ->
                 },
             % Use the singleton parse to generate the message sequence to 
             % execute.
-            ReqMsgs = hb_singleton:from(Req),
+            ReqMsgs = hb_singleton:from(Req, Opts),
             Res = hb_ao:resolve_many(ReqMsgs, Opts),
             ?event(http_monitor, {resolved_monitor, Res})
     end.
@@ -232,6 +247,7 @@ init(Opts) ->
     end.
 
 init_prometheus(Opts) ->
+    application:ensure_all_started([prometheus, prometheus_cowboy]),
 	prometheus_counter:new([
 		{name, gun_requests_total},
 		{labels, [http_method, route, status_class]},
@@ -277,17 +293,18 @@ init_prometheus(Opts) ->
 
 handle_call({get_connection, Args, Opts}, From,
 		#state{ pid_by_peer = PIDPeer, status_by_pid = StatusByPID } = State) ->
-	Peer = maps:get(peer, Args),
-	case maps:get(Peer, PIDPeer, not_found) of
+	Peer = hb_maps:get(peer, Args, undefined, Opts),
+	case hb_maps:get(Peer, PIDPeer, not_found, Opts) of
 		not_found ->
-			{ok, PID} = open_connection(Args, maps:merge(State#state.opts, Opts)),
+			{ok, PID} = open_connection(Args, hb_maps:merge(State#state.opts, Opts, Opts)),
 			MonitorRef = monitor(process, PID),
-			PIDPeer2 = maps:put(Peer, PID, PIDPeer),
+			PIDPeer2 = hb_maps:put(Peer, PID, PIDPeer, Opts),
 			StatusByPID2 =
-                maps:put(
+                hb_maps:put(
                     PID,
                     {{connecting, [{From, Args}]}, MonitorRef, Peer},
-					StatusByPID
+					StatusByPID,
+					Opts
                 ),
 			{
                 reply,
@@ -298,16 +315,17 @@ handle_call({get_connection, Args, Opts}, From,
                 }
             };
 		PID ->
-			case maps:get(PID, StatusByPID) of
+			case hb_maps:get(PID, StatusByPID, undefined, Opts) of
 				{{connecting, PendingRequests}, MonitorRef, Peer} ->
 					StatusByPID2 =
-                        maps:put(PID,
+                        hb_maps:put(PID,
                             {
                                 {connecting, [{From, Args} | PendingRequests]},
                                 MonitorRef,
                                 Peer
                             },
-                            StatusByPID
+                            StatusByPID,
+							Opts
                         ),
 					{noreply, State#state{ status_by_pid = StatusByPID2 }};
 				{connected, _MonitorRef, Peer} ->
@@ -324,30 +342,30 @@ handle_cast(Cast, State) ->
 	{noreply, State}.
 
 handle_info({gun_up, PID, _Protocol}, #state{ status_by_pid = StatusByPID } = State) ->
-	case maps:get(PID, StatusByPID, not_found) of
+	case hb_maps:get(PID, StatusByPID, not_found) of
 		not_found ->
 			%% A connection timeout should have occurred.
 			{noreply, State};
 		{{connecting, PendingRequests}, MonitorRef, Peer} ->
 			[gen_server:reply(ReplyTo, {ok, PID}) || {ReplyTo, _} <- PendingRequests],
-			StatusByPID2 = maps:put(PID, {connected, MonitorRef, Peer}, StatusByPID),
+			StatusByPID2 = hb_maps:put(PID, {connected, MonitorRef, Peer}, StatusByPID),
 			inc_prometheus_gauge(outbound_connections),
 			{noreply, State#state{ status_by_pid = StatusByPID2 }};
 		{connected, _MonitorRef, Peer} ->
 			?event(warning,
-                {gun_up_pid_already_exists, {peer, ar_util:format_peer(Peer)}}),
+                {gun_up_pid_already_exists, {peer, Peer}}),
 			{noreply, State}
 	end;
 
 handle_info({gun_error, PID, Reason},
 		#state{ pid_by_peer = PIDByPeer, status_by_pid = StatusByPID } = State) ->
-	case maps:get(PID, StatusByPID, not_found) of
+	case hb_maps:get(PID, StatusByPID, not_found) of
 		not_found ->
 			?event(warning, {gun_connection_error_with_unknown_pid}),
 			{noreply, State};
 		{Status, _MonitorRef, Peer} ->
-			PIDByPeer2 = maps:remove(Peer, PIDByPeer),
-			StatusByPID2 = maps:remove(PID, StatusByPID),
+			PIDByPeer2 = hb_maps:remove(Peer, PIDByPeer),
+			StatusByPID2 = hb_maps:remove(PID, StatusByPID),
 			Reason2 =
 				case Reason of
 					timeout ->
@@ -371,14 +389,14 @@ handle_info({gun_error, PID, Reason},
 
 handle_info({gun_down, PID, Protocol, Reason, _KilledStreams, _UnprocessedStreams},
 			#state{ pid_by_peer = PIDByPeer, status_by_pid = StatusByPID } = State) ->
-	case maps:get(PID, StatusByPID, not_found) of
+	case hb_maps:get(PID, StatusByPID, not_found) of
 		not_found ->
 			?event(warning,
                 {gun_connection_down_with_unknown_pid, {protocol, Protocol}}),
 			{noreply, State};
 		{Status, _MonitorRef, Peer} ->
-			PIDByPeer2 = maps:remove(Peer, PIDByPeer),
-			StatusByPID2 = maps:remove(PID, StatusByPID),
+			PIDByPeer2 = hb_maps:remove(Peer, PIDByPeer),
+			StatusByPID2 = hb_maps:remove(PID, StatusByPID),
 			Reason2 =
 				case Reason of
 					{Type, _} ->
@@ -403,12 +421,12 @@ handle_info({gun_down, PID, Protocol, Reason, _KilledStreams, _UnprocessedStream
 
 handle_info({'DOWN', _Ref, process, PID, Reason},
 		#state{ pid_by_peer = PIDByPeer, status_by_pid = StatusByPID } = State) ->
-	case maps:get(PID, StatusByPID, not_found) of
+	case hb_maps:get(PID, StatusByPID, not_found) of
 		not_found ->
 			{noreply, State};
 		{Status, _MonitorRef, Peer} ->
-			PIDByPeer2 = maps:remove(Peer, PIDByPeer),
-			StatusByPID2 = maps:remove(PID, StatusByPID),
+			PIDByPeer2 = hb_maps:remove(Peer, PIDByPeer),
+			StatusByPID2 = hb_maps:remove(PID, StatusByPID),
 			case Status of
 				{connecting, PendingRequests} ->
 					reply_error(PendingRequests, Reason);
@@ -430,7 +448,7 @@ handle_info(Message, State) ->
 
 terminate(Reason, #state{ status_by_pid = StatusByPID }) ->
 	?event(info,{http_client_terminating, {reason, Reason}}),
-	maps:map(fun(PID, _Status) -> gun:shutdown(PID) end, StatusByPID),
+	hb_maps:map(fun(PID, _Status) -> gun:shutdown(PID) end, StatusByPID),
 	ok.
 
 %%% ==================================================================
@@ -441,7 +459,12 @@ terminate(Reason, #state{ status_by_pid = StatusByPID }) ->
 inc_prometheus_gauge(Name) ->
     case application:get_application(prometheus) of
         undefined -> ok;
-        _ -> prometheus_gauge:inc(Name)
+        _ ->
+            try prometheus_gauge:inc(Name)
+            catch _:_ ->
+                init_prometheus(#{}),
+                prometheus_gauge:inc(Name)
+            end
     end.
 
 %% @doc Safe wrapper for prometheus_gauge:dec/2.
@@ -460,8 +483,6 @@ inc_prometheus_counter(Name, Labels, Value) ->
 open_connection(#{ peer := Peer }, Opts) ->
     {Host, Port} = parse_peer(Peer, Opts),
     ?event(http_outbound, {parsed_peer, {peer, Peer}, {host, Host}, {port, Port}}),
-	ConnectTimeout =
-		hb_opts:get(http_connect_timeout, no_connect_timeout, Opts),
     BaseGunOpts =
         #{
             http_opts =>
@@ -474,7 +495,12 @@ open_connection(#{ peer := Peer }, Opts) ->
                         )
                 },
             retry => 0,
-            connect_timeout => ConnectTimeout
+            connect_timeout =>
+                hb_opts:get(
+                    http_connect_timeout,
+                    no_connect_timeout,
+                    Opts
+                )
         },
     Transport =
         case Port of
@@ -510,7 +536,7 @@ parse_peer(Peer, Opts) ->
         URI = #{ host := Host } ->
             {
                 hb_util:list(Host),
-                case maps:get(scheme, URI, undefined) of
+                case hb_maps:get(scheme, URI, undefined, Opts) of
                     <<"https">> -> 443;
                     _ -> hb_opts:get(port, 8734, Opts)
                 end
@@ -522,8 +548,8 @@ reply_error([], _Reason) ->
 reply_error([PendingRequest | PendingRequests], Reason) ->
 	ReplyTo = element(1, PendingRequest),
 	Args = element(2, PendingRequest),
-	Method = maps:get(method, Args),
-	Path = maps:get(path, Args),
+	Method = hb_maps:get(method, Args),
+	Path = hb_maps:get(path, Args),
 	record_response_status(Method, Path, {error, Reason}),
 	gen_server:reply(ReplyTo, {error, Reason}),
 	reply_error(PendingRequests, Reason).
@@ -564,20 +590,43 @@ request(PID, Args, Opts) ->
         inet:start_timer(
             hb_opts:get(http_request_send_timeout, no_request_send_timeout, Opts)
         ),
-	Method = maps:get(method, Args),
-	Path = maps:get(path, Args),
-	Headers = maps:get(headers, Args, []),
-	Body = maps:get(body, Args, <<>>),
-    ?event(http, {gun_request, {method, Method}, {path, Path}, {headers, Headers}, {body, Body}}),
+	Method = hb_maps:get(method, Args, undefined, Opts),
+	Path = hb_maps:get(path, Args, undefined, Opts),
+    HeaderMap = hb_maps:get(headers, Args, #{}, Opts),
+    % Normalize cookie header lines from the header map. We support both
+    % lists of cookie lines and a single cookie line.
+	HeadersWithoutCookie =
+        hb_maps:to_list(
+            hb_maps:without([<<"cookie">>], HeaderMap, Opts),
+            Opts
+        ),
+    CookieLines =
+        case hb_maps:get(<<"cookie">>, HeaderMap, [], Opts) of
+            BinCookieLine when is_binary(BinCookieLine) -> [BinCookieLine];
+            CookieLinesList -> CookieLinesList
+        end,
+    CookieHeaders = [ {<<"cookie">>, CookieLine} || CookieLine <- CookieLines ],
+    Headers = HeadersWithoutCookie ++ CookieHeaders,
+	Body = hb_maps:get(body, Args, <<>>, Opts),
+    ?event(
+        http_client,
+        {gun_request,
+            {method, Method},
+            {path, Path},
+            {headers, {explicit, Headers}},
+            {body, {explicit, {body, Body}}}
+        },
+        Opts
+    ),
 	Ref = gun:request(PID, Method, Path, Headers, Body),
 	ResponseArgs =
         #{
             pid => PID, stream_ref => Ref,
-			timer => Timer, limit => maps:get(limit, Args, infinity),
+			timer => Timer, limit => hb_maps:get(limit, Args, infinity, Opts),
 			counter => 0, acc => [], start => os:system_time(microsecond),
-			is_peer_request => maps:get(is_peer_request, Args, true)
+			is_peer_request => hb_maps:get(is_peer_request, Args, true, Opts)
         },
-	Response = await_response(maps:merge(Args, ResponseArgs), Opts),
+	Response = await_response(hb_maps:merge(Args, ResponseArgs, Opts), Opts),
 	record_response_status(Method, Path, Response),
 	inet:stop_timer(Timer),
 	Response.
@@ -618,8 +667,8 @@ await_response(Args, Opts) ->
 			download_metric(FinData, Args),
 			upload_metric(Args),
 			{ok,
-                maps:get(status, Args),
-                maps:get(headers, Args),
+                hb_maps:get(status, Args, undefined, Opts),
+                hb_maps:get(headers, Args, undefined, Opts),
                 FinData
             };
 		{error, timeout} = Response ->
diff --git a/src/hb_http_multi.erl b/src/hb_http_multi.erl
new file mode 100644
index 000000000..549ff9756
--- /dev/null
+++ b/src/hb_http_multi.erl
@@ -0,0 +1,284 @@
+%%% @doc An interface for resolving requests across multiple HTTP servers, either
+%%% concurrently or sequentially, and processing the results in a configurable
+%%% manner.
+%%% 
+%%% The `Config' message for a call to `request/5' may contain the following
+%%% fields:
+%%% 
+%%% - `multirequest-nodes': A list of nodes to request from.
+%%% - `multirequest-responses': The number of responses to gather.
+%%% - `multirequest-stop-after': Whether to stop after the required number of
+%%%   responses.
+%%% - `multirequest-parallel': Whether to run the requests in parallel.
+%%% - `multirequest-admissible': A message to resolve against the response.
+%%% - `multirequest-admissible-status': The statuses that are admissible.
+%%% 
+%%% The `admissible' message is executed as a `base' message, with its `path'
+%%% field moved to the request (or set to `is-admissible' if not present):
+%%% ```
+%%%     resolve(Base, Response#{ <<"path">> => Base/path OR /is-admissible }, Opts)
+%%% '''
+-module(hb_http_multi).
+-export([request/5]).
+-include("include/hb.hrl").
+
+%% @doc Dispatch the same HTTP request to many nodes. Can be configured to
+%% await responses from all nodes or just one, and to halt all requests after
+%% after it has received the required number of responses, or to leave all
+%% requests running until they have all completed. Additionally, filters can
+%% be applied to the responses to determine if they are admissible -- both on
+%% `status' only, or as an AO-Core resolution on the response message.
+%% 
+%% Default: Race for first response.
+%%
+%% Expects a config message of the following form:
+%%      /Nodes/1..n: Hostname | #{ hostname => Hostname, address => Address }
+%%      /Responses: Number of responses to gather
+%%      /Stop-After: Should we stop after the required number of responses?
+%%      /Parallel: Should we run the requests in parallel?
+request(Config, Method, Path, Message, Opts) ->
+    #{
+        nodes := Nodes,
+        responses := Responses,
+        stop_after := StopAfter,
+        admissible := Admissible,
+        admissible_status := Statuses,
+        parallel := Parallel
+    } = multirequest_opts(Config, Message, Opts),
+    MultirequestMsg =
+        hb_message:without_unless_signed(
+            lists:filter(
+                fun(<<"multirequest-", _/binary>>) -> true; (_) -> false end,
+                hb_maps:keys(Message)
+            ),
+            Message,
+            Opts
+        ),
+    ?event(debug_multi,
+        {multirequest_opts_parsed,
+            {config, Config},
+            {method, Method},
+            {path, Path},
+            {raw_message, Message},
+            {message_to_send, MultirequestMsg}
+        }),
+    AllResults =
+        if Parallel ->
+            parallel_multirequest(
+                Nodes,
+                Responses,
+                StopAfter,
+                Method,
+                Path,
+                MultirequestMsg,
+                Admissible,
+                Statuses,
+                Opts
+            );
+        true ->
+            serial_multirequest(
+                Nodes,
+                Responses,
+                Method,
+                Path,
+                MultirequestMsg,
+                Admissible,
+                Statuses,
+                Opts
+            )
+        end,
+    ?event(http, {multirequest_results, {results, AllResults}}),
+    case AllResults of
+        [] -> {error, no_viable_responses};
+        Results -> if Responses == 1 -> hd(Results); true -> Results end
+    end.
+
+%% @doc Get the multirequest options from the config or message. The options in 
+%% the message take precidence over the options in the config.
+multirequest_opts(Config, Message, Opts) ->
+    Opts#{
+        nodes =>
+            multirequest_opt(<<"nodes">>, Config, Message, #{}, Opts),
+        responses =>
+            multirequest_opt(<<"responses">>, Config, Message, 1, Opts),
+        stop_after =>
+            multirequest_opt(<<"stop-after">>, Config, Message, true, Opts),
+        admissible =>
+            multirequest_opt(<<"admissible">>, Config, Message, undefined, Opts),
+        admissible_status =>
+            multirequest_opt(<<"admissible-status">>, Config, Message, <<"All">>, Opts),
+        parallel =>
+            multirequest_opt(<<"parallel">>, Config, Message, false, Opts)
+    }.
+
+%% @doc Get a value for a multirequest option from the config or message.
+multirequest_opt(Key, Config, Message, Default, Opts) ->
+    hb_ao:get_first(
+        [
+            {Message, <<"multirequest-", Key/binary>>},
+            {Config, Key}
+        ],
+        Default,
+        Opts#{ hashpath => ignore }
+    ).
+
+%% @doc Check if a response is admissible, according to the configuration. First,
+%% we check the Erlang response status to check for `ok'. If the response is
+%% not `ok', it is not admissible.
+%% 
+%% If the response is `ok', we check the status and the response message against
+%% the configuration.
+is_admissible(ok, Res, Admissible, Statuses, Opts) ->
+    ?event(debug_multi,
+        {is_admissible,
+            {response, Res},
+            {admissible, Admissible},
+            {statuses, Statuses}
+        }
+    ),
+    AdmissibleStatus = admissible_status(Res, Statuses),
+    ?event(debug_multi, {admissible_status, {result, AdmissibleStatus}}),
+    AdmissibleResponse = admissible_response(Res, Admissible, Opts),
+    ?event(debug_multi, {admissible_response, {result, AdmissibleResponse}}),
+    AdmissibleStatus andalso AdmissibleResponse;
+is_admissible(_, _, _, _, _) -> false.
+
+%% @doc Serially request a message, collecting responses until the required
+%% number of responses have been gathered. Ensure that the statuses are
+%% allowed, according to the configuration.
+serial_multirequest(_Nodes, 0, _Method, _Path, _Message, _Admissible, _Statuses, _Opts) -> [];
+serial_multirequest([], _, _Method, _Path, _Message, _Admissible, _Statuses, _Opts) -> [];
+serial_multirequest([Node|Nodes], Remaining, Method, Path, Message, Admissible, Statuses, Opts) ->
+    {ErlStatus, Res} = hb_http:request(Method, Node, Path, Message, Opts),
+    case is_admissible(ErlStatus, Res, Admissible, Statuses, Opts) of
+        true ->
+            ?event(http, {admissible_status, {response, Res}}),
+            [
+                {ErlStatus, Res}
+            |
+                serial_multirequest(
+                    Nodes,
+                    Remaining - 1,
+                    Method,
+                    Path,
+                    Message,
+                    Admissible,
+                    Statuses,
+                    Opts
+                )
+            ];
+        false ->
+            ?event(http, {inadmissible_status, {response, Res}}),
+            serial_multirequest(
+                Nodes,
+                Remaining,
+                Method,
+                Path,
+                Message,
+                Admissible,
+                Statuses,
+                Opts
+            )
+    end.
+
+%% @doc Dispatch the same HTTP request to many nodes in parallel.
+parallel_multirequest(Nodes, Responses, StopAfter, Method, Path, Message, Admissible, Statuses, Opts) ->
+    Ref = make_ref(),
+    Parent = self(),
+    Procs =
+        lists:map(
+            fun(Node) ->
+                spawn(
+                    fun() ->
+                        Res = hb_http:request(Method, Node, Path, Message, Opts),
+                        receive no_reply -> stopping
+                        after 0 -> Parent ! {Ref, self(), Res}
+                        end
+                    end
+                )
+            end,
+            Nodes
+        ),
+    parallel_responses([], Procs, Ref, Responses, StopAfter, Admissible, Statuses, Opts).
+
+%% @doc Check if a status is allowed, according to the configuration. Statuses
+%% can be a single integer, a comma-separated list of integers, or the string
+%% `All'.
+admissible_status(_, <<"All">>) -> true;
+admissible_status(_ResponseMsg = #{ <<"status">> := Status }, Statuses) ->
+    admissible_status(Status, Statuses);
+admissible_status(Status, Statuses) when is_integer(Statuses) ->
+    admissible_status(Status, [Statuses]);
+admissible_status(Status, Statuses) when is_binary(Status) ->
+    admissible_status(binary_to_integer(Status), Statuses);
+admissible_status(Status, Statuses) when is_binary(Statuses) ->
+    % Convert the statuses to a list of integers.
+    admissible_status(
+        Status,
+        lists:map(fun binary_to_integer/1, binary:split(Statuses, <<",">>))
+    );
+admissible_status(Status, Statuses) when is_list(Statuses) ->
+    lists:member(Status, Statuses).
+
+%% @doc If an `admissable` message is set for the request, check if the response
+%% adheres to it. Else, return `true'.
+admissible_response(_Response, undefined, _Opts) -> true;
+admissible_response(Response, Msg, Opts) ->
+    Path = hb_maps:get(<<"path">>, Msg, <<"is-admissible">>, Opts),
+    Req = Response#{ <<"path">> => Path },
+    Base = hb_message:without_unless_signed([<<"path">>], Msg, Opts),
+    ?event(debug_multi,
+        {executing_admissible_message, {message, Base}, {req, Req}}
+    ),
+    case hb_ao:resolve(Base, Req, Opts) of
+        {ok, Res} when is_atom(Res) or is_binary(Res) ->
+            ?event(debug_multi, {admissible_result, {result, Res}}),
+            hb_util:atom(Res) == true;
+        {error, Reason} ->
+            ?event(debug_multi, {admissible_error, {reason, Reason}}),
+            false
+    end.
+
+%% @doc Collect the necessary number of responses, and stop workers if
+%% configured to do so.
+parallel_responses(Res, Procs, Ref, 0, false, _Admissible, _Statuses, _Opts) ->
+    lists:foreach(fun(P) -> P ! no_reply end, Procs),
+    empty_inbox(Ref),
+    {ok, Res};
+parallel_responses(Res, Procs, Ref, 0, true, _Admissible, _Statuses, _Opts) ->
+    lists:foreach(fun(P) -> exit(P, kill) end, Procs),
+    empty_inbox(Ref),
+    Res;
+parallel_responses(Res, Procs, Ref, Awaiting, StopAfter, Admissible, Statuses, Opts) ->
+    receive
+        {Ref, Pid, {Status, NewRes}} ->
+            case is_admissible(Status, NewRes, Admissible, Statuses, Opts) of
+                true ->
+                    parallel_responses(
+                        [NewRes | Res],
+                        lists:delete(Pid, Procs),
+                        Ref,
+                        Awaiting - 1,
+                        StopAfter,
+                        Admissible,
+                        Statuses,
+                        Opts
+                );
+            false ->
+                parallel_responses(
+                    Res,
+                    lists:delete(Pid, Procs),
+                    Ref,
+                    Awaiting,
+                    StopAfter,
+                    Admissible,
+                    Statuses,
+                    Opts
+                )
+        end
+end.
+
+%% @doc Empty the inbox of the current process for all messages with the given
+%% reference.
+empty_inbox(Ref) ->
+    receive {Ref, _} -> empty_inbox(Ref) after 0 -> ok end.
\ No newline at end of file
diff --git a/src/hb_http_server.erl b/src/hb_http_server.erl
index 89d4ff01c..9a6c0453d 100644
--- a/src/hb_http_server.erl
+++ b/src/hb_http_server.erl
@@ -10,8 +10,10 @@
 %%% such that changing it on start of the router server allows for
 %%% the execution parameters of all downstream requests to be controlled.
 -module(hb_http_server).
--export([start/0, start/1, allowed_methods/2, init/2, set_opts/1, set_opts/2, get_opts/1]).
--export([start_node/0, start_node/1, set_default_opts/1]).
+-export([start/0, start/1, allowed_methods/2, init/2]).
+-export([set_opts/1, set_opts/2, get_opts/0, get_opts/1]).
+-export([set_default_opts/1, set_proc_server_id/1]).
+-export([start_node/0, start_node/1]).
 -include_lib("eunit/include/eunit.hrl").
 -include("include/hb.hrl").
 
@@ -20,10 +22,8 @@
 %% `Opts' argument to use for all AO-Core resolution requests downstream.
 start() ->
     ?event(http, {start_store, <<"cache-mainnet">>}),
-    Store = hb_opts:get(store, no_store, #{}),
-    hb_store:start(Store),
     Loaded =
-        case hb_opts:load(Loc = hb_opts:get(hb_config_location, <<"config.flat">>, #{})) of
+        case hb_opts:load(Loc = hb_opts:get(hb_config_location, <<"config.flat">>)) of
             {ok, Conf} ->
                 ?event(boot, {loaded_config, Loc, Conf}),
                 Conf;
@@ -32,10 +32,20 @@ start() ->
                 #{}
         end,
     MergedConfig =
-        maps:merge(
-            hb_opts:default_message(),
+        hb_maps:merge(
+            hb_opts:default_message_with_env(),
             Loaded
         ),
+    %% Apply store defaults before starting store
+    StoreOpts = hb_opts:get(store, no_store, MergedConfig),
+    StoreDefaults = hb_opts:get(store_defaults, #{}, MergedConfig),
+    UpdatedStoreOpts = 
+        case StoreOpts of
+            no_store -> no_store;
+            _ when is_list(StoreOpts) -> hb_store_opts:apply(StoreOpts, StoreDefaults);
+            _ -> StoreOpts
+        end,
+    hb_store:start(UpdatedStoreOpts),
     PrivWallet =
         hb:wallet(
             hb_opts:get(
@@ -44,7 +54,45 @@ start() ->
                 Loaded
             )
         ),
-    FormattedConfig = hb_util:debug_fmt(MergedConfig, 2),
+    maybe_greeter(MergedConfig, PrivWallet),
+    start(
+        Loaded#{
+            priv_wallet => PrivWallet,
+            store => UpdatedStoreOpts,
+            port => hb_opts:get(port, 8734, Loaded),
+            cache_writers => [hb_util:human_id(ar_wallet:to_address(PrivWallet))]
+        }
+    ).
+start(Opts) ->
+    application:ensure_all_started([
+        kernel,
+        stdlib,
+        inets,
+        ssl,
+        ranch,
+        cowboy,
+        gun,
+        os_mon
+    ]),
+    hb:init(),
+    BaseOpts = set_default_opts(Opts),
+    {ok, Listener, _Port} = new_server(BaseOpts),
+    {ok, Listener}.
+
+%% @doc Print the greeter message to the console if we are not running tests.
+maybe_greeter(MergedConfig, PrivWallet) ->
+    case hb_features:test() of
+        false ->
+            print_greeter(MergedConfig, PrivWallet);
+        true ->
+            ok
+    end.
+
+%% @doc Print the greeter message to the console. Includes the version, operator
+%% address, URL to access the node, and the wider configuration (including the
+%% keys inherited from the default configuration).
+print_greeter(Config, PrivWallet) ->
+    FormattedConfig = hb_format:term(Config, Config, 2),
     io:format("~n"
         "===========================================================~n"
         "==    ██╗  ██╗██╗   ██╗██████╗ ███████╗██████╗           ==~n"
@@ -75,8 +123,8 @@ start() ->
                     io_lib:format(
                         "http://~s:~p",
                         [
-                            hb_opts:get(host, <<"localhost">>, Loaded),
-                            hb_opts:get(port, 8734, Loaded)
+                            hb_opts:get(host, <<"localhost">>, Config),
+                            hb_opts:get(port, 8734, Config)
                         ]
                     )
                 ),
@@ -85,30 +133,7 @@ start() ->
             hb_util:human_id(ar_wallet:to_address(PrivWallet)),
             FormattedConfig
         ]
-    ),
-    start(
-        Loaded#{
-            priv_wallet => PrivWallet,
-            store => Store,
-            port => hb_opts:get(port, 8734, Loaded),
-            cache_writers => [hb_util:human_id(ar_wallet:to_address(PrivWallet))]
-        }
     ).
-start(Opts) ->
-    application:ensure_all_started([
-        kernel,
-        stdlib,
-        inets,
-        ssl,
-        ranch,
-        cowboy,
-        gun,
-        os_mon
-    ]),
-    hb:init(),
-    BaseOpts = set_default_opts(Opts),
-    {ok, Listener, _Port} = new_server(BaseOpts),
-    {ok, Listener}.
 
 %% @doc Trigger the creation of a new HTTP server node. Accepts a `NodeMsg'
 %% message, which is used to configure the server. This function executed the
@@ -117,8 +142,8 @@ start(Opts) ->
 %% expects the node message to be in the `body' key.
 new_server(RawNodeMsg) ->
     RawNodeMsgWithDefaults =
-        maps:merge(
-            hb_opts:default_message(),
+        hb_maps:merge(
+            hb_opts:default_message_with_env(),
             RawNodeMsg#{ only => local }
         ),
     HookMsg = #{ <<"body">> => RawNodeMsgWithDefaults },
@@ -151,7 +176,7 @@ new_server(RawNodeMsg) ->
         ),
     % Put server ID into node message so it's possible to update current server
     % params
-    NodeMsgWithID = maps:put(http_server, ServerID, NodeMsg),
+    NodeMsgWithID = hb_maps:put(http_server, ServerID, NodeMsg),
     Dispatcher = cowboy_router:compile([{'_', [{'_', ?MODULE, ServerID}]}]),
     ProtoOpts = #{
         env => #{dispatch => Dispatcher, node_msg => NodeMsgWithID},
@@ -214,7 +239,7 @@ new_server(RawNodeMsg) ->
     ),
     {ok, Listener, Port}.
 
-start_http3(ServerID, ProtoOpts, _NodeMsg) ->
+start_http3(ServerID, ProtoOpts, NodeMsg) ->
     ?event(http, {start_http3, ServerID}),
     Parent = self(),
     ServerPID =
@@ -225,34 +250,34 @@ start_http3(ServerID, ProtoOpts, _NodeMsg) ->
                 TransOpts = #{
                     socket_opts => [
                         {certfile, "test/test-tls.pem"},
-                        {keyfile, "test/test-tls.key"}
+                        {keyfile, "test/test-tls.key"},
+                        {port, Port = hb_opts:get(port, 8734, NodeMsg)}
                     ]
                 },
                 ProtoOpts
             ),
-            {ok, {_, GivenPort}} = quicer:sockname(Listener),
             ranch_server:set_new_listener_opts(
                 ServerID,
                 1024,
                 ranch:normalize_opts(
-                    maps:to_list(TransOpts#{ port => GivenPort })
+                    hb_maps:to_list(TransOpts#{ port => Port })
                 ),
                 ProtoOpts,
                 []
             ),
-            ranch_server:set_addr(ServerID, {<<"localhost">>, GivenPort}),
+            ranch_server:set_addr(ServerID, {<<"localhost">>, Port}),
             % Bypass ranch's requirement to have a connection supervisor define
             % to support updating protocol opts.
             % Quicer doesn't use a connection supervisor, so we just spawn one
             % that does nothing.
             ConnSup = spawn(fun() -> http3_conn_sup_loop() end),
             ranch_server:set_connections_sup(ServerID, ConnSup),
-            Parent ! {ok, GivenPort},
+            Parent ! {ok, Port},
             receive stop -> stopped end
         end),
-    receive {ok, GivenPort} -> {ok, GivenPort, ServerPID}
+    receive {ok, Port} -> {ok, Port, ServerPID}
     after 2000 ->
-        {error, {timeout, staring_http3_server, ServerID}}
+        {error, {timeout, starting_http3_server, ServerID}}
     end.
 
 http3_conn_sup_loop() ->
@@ -264,14 +289,30 @@ http3_conn_sup_loop() ->
 
 start_http2(ServerID, ProtoOpts, NodeMsg) ->
     ?event(http, {start_http2, ServerID}),
-    {ok, Listener} = cowboy:start_clear(
+    StartRes = cowboy:start_clear(
         ServerID,
         [
             {port, Port = hb_opts:get(port, 8734, NodeMsg)}
         ],
         ProtoOpts
     ),
-    {ok, Port, Listener}.
+    case StartRes of
+        {ok, Listener} ->
+            ?event(debug_router_info, {http2_started, {listener, Listener}, {port, Port}}),
+            {ok, Port, Listener};
+        {error, {already_started, Listener}} ->
+            ?event(http, {http2_already_started, {listener, Listener}}),
+            ?event(debug_router_info,
+                {restarting,
+                    {id, ServerID},
+                    {node_msg, NodeMsg}
+                }
+            ),
+            cowboy:set_env(ServerID, node_msg, #{}),
+            % {ok, Port, Listener}
+            cowboy:stop_listener(ServerID),
+            start_http2(ServerID, ProtoOpts, NodeMsg)
+    end.
 
 %% @doc Entrypoint for all HTTP requests. Receives the Cowboy request option and
 %% the server ID, which can be used to lookup the node message.
@@ -312,30 +353,47 @@ handle_request(RawReq, Body, ServerID) ->
     StartTime = os:system_time(millisecond),
     Req = RawReq#{ start_time => StartTime },
     NodeMsg = get_opts(#{ http_server => ServerID }),
+    put(server_id, ServerID),
     case {cowboy_req:path(RawReq), cowboy_req:qs(RawReq)} of
         {<<"/">>, <<>>} ->
             % If the request is for the root path, serve a redirect to the default 
             % request of the node.
-            cowboy_req:reply(
+            Req2 = cowboy_req:reply(
                 302,
                 #{
                     <<"location">> =>
                         hb_opts:get(
-                            default_req,
-                            <<"/~hyperbuddy@1.0/index">>,
+                            default_request,
+                            <<"/~hyperbuddy@1.0/dashboard">>,
                             NodeMsg
                         )
                 },
                 RawReq
-            );
+            ),
+            {ok, Req2, no_state};
         _ ->
             % The request is of normal AO-Core form, so we parse it and invoke
             % the meta@1.0 device to handle it.
-            ?event(http, {http_inbound, {cowboy_req, Req}, {body, {string, Body}}}),
+            ?event(http,
+                {
+                    http_inbound,
+                    {cowboy_req, {explicit, Req}, {body, {string, Body}}}
+                }
+            ),
             TracePID = hb_tracer:start_trace(),
             % Parse the HTTP request into HyerBEAM's message format.
+            ReqSingleton =
+                try hb_http:req_to_tabm_singleton(Req, Body, NodeMsg)
+                catch ParseError:ParseDetails:ParseStacktrace ->
+                    {parse_error, ParseError, ParseDetails, ParseStacktrace}
+                end,
             try 
-                ReqSingleton = hb_http:req_to_tabm_singleton(Req, Body, NodeMsg),
+                case ReqSingleton of
+                    {parse_error, PType, PDetails, PStacktrace} ->
+                        erlang:raise(PType, PDetails, PStacktrace);
+                    _ ->
+                        ok
+                end,
                 CommitmentCodec = hb_http:accept_to_codec(ReqSingleton, NodeMsg),
                 ?event(http,
                     {parsed_singleton,
@@ -356,27 +414,47 @@ handle_request(RawReq, Body, ServerID) ->
                 hb_http:reply(Req, ReqSingleton, Res, NodeMsg)
             catch
                 Type:Details:Stacktrace ->
-                    Trace = hb_tracer:get_trace(TracePID),
-                    TraceString = hb_tracer:format_error_trace(Trace),
-                    ?event(
-                        http_error,
-                        {http_error,
-                            {type, Type},
-                            {details, Details},
-                            {stacktrace, Stacktrace}
-                        }
-                    ),
-                    hb_http:reply(
+                    handle_error(
                         Req,
-                        #{},
-                        #{
-                            <<"status">> => 500,
-                            <<"body">> => TraceString
-                        },
+                        ReqSingleton,
+                        Type,
+                        Details,
+                        Stacktrace,
                         NodeMsg
                     )
             end
-end.
+    end.
+
+%% @doc Return a 500 error response to the client.
+handle_error(Req, Singleton, Type, Details, Stacktrace, NodeMsg) ->
+    DetailsStr = hb_util:bin(hb_format:message(Details, NodeMsg, 1)),
+    StacktraceStr = hb_util:bin(hb_format:trace(Stacktrace)),
+    ErrorMsg =
+        #{
+            <<"status">> => 500,
+            <<"type">> => hb_util:bin(hb_format:message(Type)),
+            <<"details">> => DetailsStr,
+            <<"stacktrace">> => StacktraceStr
+        },
+    ErrorBin = hb_format:error(ErrorMsg, NodeMsg),
+    ?event(
+        http_error,
+        {returning_500_error,
+            {string,
+                hb_format:indent_lines(
+                    <<"\n", ErrorBin/binary, "\n">>,
+                    1
+                )
+            }
+        }
+    ),
+    % Remove leading and trailing noise from the stacktrace and details.
+    FormattedErrorMsg =
+        ErrorMsg#{
+            <<"stacktrace">> => hb_util:bin(hb_format:remove_noise(StacktraceStr)),
+            <<"details">> => hb_util:bin(hb_format:remove_noise(DetailsStr))
+        },
+    hb_http:reply(Req, Singleton, FormattedErrorMsg, NodeMsg).
 
 %% @doc Return the list of allowed methods for the HTTP server.
 allowed_methods(Req, State) ->
@@ -398,24 +476,45 @@ set_opts(Opts) ->
             ok = cowboy:set_env(ServerRef, node_msg, Opts)
     end.
 set_opts(Request, Opts) ->
+    PreparedOpts =
+        hb_opts:mimic_default_types(
+            Opts,
+            false,
+            Opts
+        ),
+    PreparedRequest =
+        hb_opts:mimic_default_types(
+            hb_message:uncommitted(Request),
+            false,
+            Opts
+        ),
     MergedOpts =
         maps:merge(
-            Opts,
-            hb_opts:mimic_default_types(
-                hb_message:uncommitted(Request),
-                new_atoms
-            )
+            PreparedOpts,
+            PreparedRequest
         ),
+    ?event(set_opts, {merged_opts, {explicit, MergedOpts}}),
+    History =
+        hb_opts:get(node_history, [], Opts)
+            ++ [ hb_private:reset(maps:without([node_history], PreparedRequest)) ],
     FinalOpts = MergedOpts#{
         http_server => hb_opts:get(http_server, no_server, Opts),
-        node_history => [Request | hb_opts:get(node_history, [], Opts)]
+        node_history => History
     },
     {set_opts(FinalOpts), FinalOpts}.
 
+%% @doc Get the node message for the current process.
+get_opts() ->
+    get_opts(#{ http_server => get(server_id) }).
 get_opts(NodeMsg) ->
     ServerRef = hb_opts:get(http_server, no_server_ref, NodeMsg),
     cowboy:get_env(ServerRef, node_msg, no_node_msg).
 
+%% @doc Initialize the server ID for the current process.
+set_proc_server_id(ServerID) ->
+    put(server_id, ServerID).
+
+%% @doc Apply the default node message to the given opts map.
 set_default_opts(Opts) ->
     % Create a temporary opts map that does not include the defaults.
     TempOpts = Opts#{ only => local },
@@ -436,9 +535,8 @@ set_default_opts(Opts) ->
     Store =
         case hb_opts:get(store, no_store, TempOpts) of
             no_store ->
-                TestDir = <<"cache-TEST/run-fs-", (integer_to_binary(Port))/binary>>,
-                filelib:ensure_dir(binary_to_list(TestDir)),
-                #{ <<"store-module">> => hb_store_fs, <<"prefix">> => TestDir };
+                hb_store:start(Stores = [hb_test_utils:test_store()]),
+                Stores;
             PassedStore -> PassedStore
         end,
     ?event({set_default_opts,
@@ -504,3 +602,60 @@ set_node_opts_test() ->
         }),
     {ok, LiveOpts} = hb_http:get(Node, <<"/~meta@1.0/info">>, #{}),
     ?assert(hb_ao:get(<<"test-success">>, LiveOpts, false, #{})).
+
+%% @doc Test the set_opts/2 function that merges request with options,
+%% manages node history, and updates server state.
+set_opts_test() ->
+    DefaultOpts = hb_opts:default_message_with_env(),
+    start_node(DefaultOpts#{ 
+        priv_wallet => Wallet = ar_wallet:new(), 
+        port => rand:uniform(10000) + 10000 
+    }),
+    Opts = get_opts(#{ 
+        http_server => hb_util:human_id(ar_wallet:to_address(Wallet))
+    }),
+    NodeHistory = hb_opts:get(node_history, [], Opts),
+    ?event(debug_node_history, {node_history_length, length(NodeHistory)}),
+    ?assert(length(NodeHistory) == 0),
+    % Test case 1: Empty node_history case
+    Request1 = #{
+        <<"hello">> => <<"world">>
+    },             
+    {ok, UpdatedOpts1} = set_opts(Request1, Opts),
+    NodeHistory1 = hb_opts:get(node_history, not_found, UpdatedOpts1),
+    Key1 = hb_opts:get(<<"hello">>, not_found, UpdatedOpts1),
+    ?event(debug_node_history, {node_history_length, length(NodeHistory1)}),
+    ?assert(length(NodeHistory1) == 1),
+    ?assert(Key1 == <<"world">>),
+    % Test case 2: Non-empty node_history case
+    Request2 = #{
+        <<"hello2">> => <<"world2">>
+    },
+    {ok, UpdatedOpts2} = set_opts(Request2, UpdatedOpts1),
+    NodeHistory2 = hb_opts:get(node_history, not_found, UpdatedOpts2),
+    Key2 = hb_opts:get(<<"hello2">>, not_found, UpdatedOpts2),
+    ?event(debug_node_history, {node_history_length, length(NodeHistory2)}),
+    ?assert(length(NodeHistory2) == 2),
+    ?assert(Key2 == <<"world2">>),
+    % Test case 3: Non-empty node_history case
+    {ok, UpdatedOpts3} = set_opts(#{}, UpdatedOpts2#{ <<"hello3">> => <<"world3">> }),
+    NodeHistory3 = hb_opts:get(node_history, not_found, UpdatedOpts3),
+    Key3 = hb_opts:get(<<"hello3">>, not_found, UpdatedOpts3),
+    ?event(debug_node_history, {node_history_length, length(NodeHistory3)}),
+    ?assert(length(NodeHistory3) == 3),
+    ?assert(Key3 == <<"world3">>).
+
+restart_server_test() ->
+    % We force HTTP2, overriding the HTTP3 feature, because HTTP3 restarts don't work yet.
+    Wallet = ar_wallet:new(),
+    BaseOpts = #{
+        <<"test-key">> => <<"server-1">>,
+        priv_wallet => Wallet,
+        protocol => http2
+    },
+    _ = start_node(BaseOpts),
+    N2 = start_node(BaseOpts#{ <<"test-key">> => <<"server-2">> }),
+    ?assertEqual(
+        {ok, <<"server-2">>},
+        hb_http:get(N2, <<"/~meta@1.0/info/test-key">>, #{protocol => http2})
+    ).
diff --git a/src/hb_link.erl b/src/hb_link.erl
new file mode 100644
index 000000000..4e2022f1d
--- /dev/null
+++ b/src/hb_link.erl
@@ -0,0 +1,218 @@
+%%% @doc Utility functions for working with links.
+-module(hb_link).
+-export([is_link_key/1, remove_link_specifier/1]).
+-export([normalize/2, normalize/3]).
+-export([decode_all_links/1]).
+-export([format/1, format/2, format/3]).
+-export([format_unresolved/1, format_unresolved/2, format_unresolved/3]).
+-include("include/hb.hrl").
+-include_lib("eunit/include/eunit.hrl").
+
+%% @doc Takes a structured message and ensures that its sub-message links are
+%% normalized to TABM form:
+%% 
+%% - All literal (binary) lazily-loadable values are in-memory.
+%% - All submaps are represented as links, optionally offloading their local 
+%%   values to the cache.
+%% - All other values are left unchanged (including their potential types).
+%% 
+%% The response is a non-recursive, fully loaded message. It may still contain
+%% types, but all submessages are guaranteed to be linkified. This stands in 
+%% contrast to `linkify', which takes a structured message and returns a message
+%% with structured links.
+normalize(Msg, Opts) when is_map(Opts) ->
+    normalize(Msg, hb_opts:get(linkify_mode, offload, Opts), Opts).
+
+normalize(Msg, false, _Opts) ->
+    Msg;
+normalize(Msg, Mode, Opts) when is_map(Msg) ->
+    maps:merge(
+        maps:with([<<"commitments">>, <<"priv">>], Msg),
+            maps:from_list(
+                lists:map(
+                    fun({Key, {link, ID, LinkOpts = #{ <<"type">> := <<"link">> }}}) ->
+                        % The value is a link. Deconstruct it and ensure it is
+                        % normalized (lazy links are made greedy, and both are
+                        % returned in binary TABM form).
+                        NormKey = hb_util:bin(Key),
+                        UnderlyingID =
+                            case maps:get(<<"lazy">>, LinkOpts, false) of
+                                true ->
+                                    case hb_cache:read(ID, Opts) of
+                                        {ok, Underlying} when ?IS_ID(Underlying) ->
+                                            Underlying;
+                                        Err ->
+                                            throw(
+                                                {could_not_read_lazy_link,
+                                                    {key, Key},
+                                                    {lazy_id, ID},
+                                                    {error, Err}
+                                                }
+                                            )
+                                    end;
+                                false ->
+                                    % The ID given is already in 'greedy' form.
+                                    % We embed it in the result unchanged.
+                                    ID
+                            end,
+                        ?event(debug_linkify, {link_normalized, Key, UnderlyingID}),
+                        {<< NormKey/binary, "+link">>, UnderlyingID};
+                    ({Key, V}) when is_map(V) or is_list(V) ->
+                        ?event(debug_linkify, {linkifying_submessage, Key}),
+                        % The value is a submessage that we have in local memory.
+                        % We must offload it such that it is cached, and
+                        % referenced by a link.
+                        % We start by normalizing the child message, generating 
+                        % its IDs by proxy.
+                        NormChild = normalize(V, Mode, Opts),
+                        NormKey = hb_util:bin(Key),
+                        % Generate the ID of the normalized child message.
+                        ID = hb_message:id(NormChild, all, Opts),
+                        % If we are in `offload' mode, we write the message to the
+                        % cache. If we are in `discard' mode, we simply drop the 
+                        % nested message.
+                        case Mode of
+                            discard -> do_nothing;
+                            offload ->
+                                % Write the child to the store to ensure its
+                                % storage and availability.
+                                hb_cache:write(NormChild, Opts)
+                        end,
+                        ?event(debug_linkify, {generated_link, {key, Key}, {id, ID}}),
+                        {<<NormKey/binary, "+link">>, ID};
+                    ({Key, V}) when ?IS_LINK(V) ->
+                        % The link is not a submap. We load it such that it is
+                        % local in-memory. This clause is used when we are
+                        % normalizing a lazily-loaded message.
+                        {Key, hb_cache:ensure_loaded(V, Opts)};
+                    ({Key, V}) ->
+                        % The value is a primitive type. We do not need to do
+                        % anything.
+                        {Key, V}
+                    end,
+                    maps:to_list(maps:without([<<"commitments">>, <<"priv">>], Msg))
+                )
+            )
+    );
+normalize(OtherVal, Mode, Opts) when is_list(OtherVal) ->
+    lists:map(fun(X) -> normalize(X, Mode, Opts) end, OtherVal);
+normalize(OtherVal, _Mode, _Opts) ->
+    OtherVal.
+
+%% @doc Decode links embedded in the headers of a message.
+decode_all_links(Msg) when is_map(Msg) ->
+    maps:from_list(
+        lists:map(
+            fun({Key, MaybeID}) ->
+                case is_link_key(Key) of
+                    true ->
+                        NewKey = binary:part(Key, 0, byte_size(Key) - 5),
+                        {NewKey, 
+                            {
+                                link,
+                                MaybeID,
+                                #{
+                                    <<"type">> => <<"link">>,
+                                    <<"lazy">> => false
+                                }
+                            }
+                        };
+                    _ -> {Key, MaybeID}
+                end
+            end,
+            maps:to_list(Msg)
+        )
+    );
+decode_all_links(List) when is_list(List) ->
+    lists:map(fun(X) -> decode_all_links(X) end, List);
+decode_all_links(OtherVal) ->
+    OtherVal.
+
+%% @doc Determine if a key is an encoded link.
+is_link_key(Key) when byte_size(Key) >= 5 ->
+    binary:part(Key, byte_size(Key) - 5, 5) =:= <<"+link">>;
+is_link_key(_) -> false.
+
+%% @doc Remove any `+link` suffixes from a key.
+remove_link_specifier(Key) ->
+    case is_link_key(Key) of
+        true -> binary:part(Key, 0, byte_size(Key) - 5);
+        false -> Key
+    end.
+
+%% @doc Format a link as a short string suitable for printing. Checks the node
+%% options (optionally) given, to see if it should resolve the link to a value
+%% before printing.
+format(Link) -> format(Link, #{}).
+format(Link, Opts) ->
+    format(Link, Opts, 0).
+format(Link, Opts, Indent) ->
+    case hb_opts:get(debug_resolve_links, false, Opts) of
+        true ->
+            try
+                hb_format:message(
+                    hb_cache:ensure_all_loaded(Link, Opts),
+                    Opts,
+                    Indent
+                )
+            catch
+                _:_ -> << "!UNRESOLVABLE! ", (format_unresolved(Link, Opts))/binary >>
+            end;
+        false -> format_unresolved(Link, Opts, Indent)
+    end.
+
+%% @doc Format a link without resolving it.
+format_unresolved(Link) ->
+    format_unresolved(Link, #{}).
+format_unresolved({link, ID, Opts}, BaseOpts) ->
+    format_unresolved({link, ID, Opts}, BaseOpts, 0).
+format_unresolved({link, ID, Opts}, BaseOpts, Indent) ->
+    hb_util:bin(
+        hb_format:indent(
+            "~s~s: ~s",
+            [
+                case maps:get(<<"lazy">>, Opts, false) of
+                    true -> <<"Lazy link">>;
+                    false -> <<"Link">>
+                end,
+                case maps:get(<<"type">>, Opts, no_type) of
+                    no_type -> <<>>;
+                    Type -> <<" (to ", (hb_util:bin(Type))/binary, ")" >>
+                end,
+                ID
+            ],
+            BaseOpts,
+            Indent
+        )
+    ).
+
+%%% Tests
+
+offload_linked_message_test() ->
+    Opts = #{},
+    Msg = #{
+        <<"immediate-key">> => <<"immediate-value">>,
+        <<"link-key">> => #{
+            <<"immediate-key-2">> => <<"link-value">>,
+            <<"link-key-2">> => #{
+                <<"immediate-key-3">> => <<"link-value-2">>
+            }
+        }
+    },
+    Offloaded = normalize(Msg, offload, Opts),
+    Structured = hb_message:convert(Offloaded, <<"structured@1.0">>, tabm, Opts),
+    ?event(linkify, {test_recvd_linkified, {msg, Structured}}),
+    Loaded = hb_cache:ensure_all_loaded(Structured, Opts),
+    ?event(linkify, {test_recvd_loaded, {msg, Loaded}}),
+    ?assertEqual(Msg, Loaded).
+
+offload_list_test() ->
+    Opts = #{},
+    Msg = #{
+        <<"list-key">> => [1.0, 2.0, 3.0]
+    },
+    TABM = hb_message:convert(Msg, tabm, <<"structured@1.0">>, Opts),
+    Linkified = normalize(TABM, offload, Opts),
+    Msg2 = hb_message:convert(Linkified, <<"structured@1.0">>, tabm, Opts),
+    Res = hb_cache:ensure_all_loaded(Msg2, Opts),
+    ?assertEqual(Msg, Res).
diff --git a/src/hb_maps.erl b/src/hb_maps.erl
new file mode 100644
index 000000000..391e018dc
--- /dev/null
+++ b/src/hb_maps.erl
@@ -0,0 +1,335 @@
+%%% @doc An abstraction for working with maps in HyperBEAM, matching the
+%%% generic `maps' module, but additionally supporting the resolution of
+%%% links as they are encountered. These functions must be used extremely
+%%% carefully. In virtually all circumstances, the `hb_ao:resolve/3' or
+%%% `hb_ao:get/3' functions should be used instead, as they will execute the
+%%% full AO-Core protocol upon requests (normalizing keys, applying the
+%%% appropriate device's functions, as well as resolving links). By using this
+%%% module's functions, you are implicitly making the assumption that the message
+%%% in question is of the `~message@1.0' form, ignoring any other keys that its
+%%% actual device may present. This module is intended for the extremely rare
+%%% circumstances in which the additional overhead of the full AO-Core
+%%% execution cycle is not acceptable, and the data in question is known to
+%%% conform to the `~message@1.0' form.
+%%%
+%%% If you do not understand any/all of the above, you are in the wrong place!
+%%% Utilise the `hb_ao' module and read the documentation therein, saving
+%%% yourself from the inevitable issues that will arise from using this
+%%% module without understanding the full implications. You have been warned.
+-module(hb_maps).
+-export([get/2, get/3, get/4, put/3, put/4, find/2, find/3]).
+-export([is_key/2, is_key/3, keys/1, keys/2, values/1, values/2]).
+-export([map/2, map/3, filter/2, filter/3, filtermap/2, filtermap/3]).
+-export([fold/3, fold/4, take/2, take/3, size/1, size/2]).
+-export([merge/2, merge/3, remove/2, remove/3]).
+-export([with/2, with/3, without/2, without/3, update_with/3, update_with/4]).
+-export([from_list/1, to_list/1, to_list/2]).
+-include_lib("eunit/include/eunit.hrl").
+
+-spec get(Key :: term(), Map :: map()) -> term().
+get(Key, Map) ->
+    get(Key, Map, undefined).
+
+-spec get(Key :: term(), Map :: map(), Default :: term()) -> term().
+get(Key, Map, Default) ->
+    get(Key, Map, Default, #{}).
+
+%% @doc Get a value from a map, resolving links as they are encountered in both
+%% the TABM encoded link format, as well as the structured type.
+-spec get(
+    Key :: term(),
+    Map :: map(),
+    Default :: term(),
+    Opts :: map()
+) -> term().
+get(Key, Map, Default, Opts) ->
+    hb_cache:ensure_loaded(
+        maps:get(
+            Key,
+            hb_cache:ensure_loaded(Map, Opts),
+            Default
+        ),
+        Opts
+    ).
+
+-spec find(Key :: term(), Map :: map()) -> {ok, term()} | error.
+find(Key, Map) ->
+    find(Key, Map, #{}).
+
+-spec find(Key :: term(), Map :: map(), Opts :: map()) -> {ok, term()} | error.
+find(Key, Map, Opts) ->
+    hb_cache:ensure_loaded(maps:find(Key, hb_cache:ensure_loaded(Map, Opts)), Opts).
+
+-spec put(Key :: term(), Value :: term(), Map :: map()) -> map().
+put(Key, Value, Map) ->
+	put(Key, Value, Map, #{}).
+
+-spec put(
+	Key :: term(),
+	Value :: term(),
+	Map :: map(),
+	Opts :: map()
+) -> map().
+put(Key, Value, Map, Opts) ->
+    maps:put(Key, Value, hb_cache:ensure_loaded(Map, Opts)).
+
+-spec is_key(Key :: term(), Map :: map()) -> boolean().
+is_key(Key, Map) ->
+    is_key(Key, Map, #{}).
+
+-spec is_key(Key :: term(), Map :: map(), Opts :: map()) -> boolean().
+is_key(Key, Map, Opts) ->
+    maps:is_key(Key, hb_cache:ensure_loaded(Map, Opts)).
+
+-spec keys(Map :: map()) -> [term()].
+keys(Map) ->
+	keys(Map, #{}).
+
+-spec keys(Map :: map(), Opts :: map()) -> [term()].
+keys(Map, Opts) ->
+    maps:keys(hb_cache:ensure_loaded(Map, Opts)).
+
+-spec values(Map :: map()) -> [term()].
+values(Map) -> values(Map, #{}).
+
+-spec values(Map :: map(), Opts :: map()) -> [term()].
+values(Map, Opts) ->
+    maps:values(hb_cache:ensure_loaded(Map, Opts)).
+
+-spec size(Map :: map()) -> non_neg_integer().
+size(Map) ->
+	size(Map, #{}).
+
+-spec size(Map :: map(), Opts :: map()) -> non_neg_integer().
+size(Map, Opts) ->
+    maps:size(hb_cache:ensure_loaded(Map, Opts)).
+
+-spec map(
+    Fun :: fun((Key :: term(), Value :: term()) -> term()),
+    Map :: map()
+) -> map().
+map(Fun, Map) ->
+    map(Fun, Map, #{}).
+
+-spec map(
+    Fun :: fun((Key :: term(), Value :: term()) -> term()),
+    Map :: map(),
+    Opts :: map()
+) -> map().
+map(Fun, Map, Opts) ->
+    maps:map(
+        fun(K, V) -> Fun(K, hb_cache:ensure_loaded(V, Opts)) end,
+        hb_cache:ensure_loaded(Map, Opts)
+    ).
+
+-spec merge(Map1 :: map(), Map2 :: map()) -> map().
+merge(Map1, Map2) ->
+	merge(Map1, Map2, #{}).
+
+-spec merge(Map1 :: map(), Map2 :: map(), Opts :: map()) -> map().
+merge(Map1, Map2, Opts) ->
+    maps:merge(hb_cache:ensure_loaded(Map1, Opts), hb_cache:ensure_loaded(Map2, Opts)).
+
+-spec remove(Key :: term(), Map :: map()) -> map().
+remove(Key, Map) ->
+	remove(Key, Map, #{}).
+
+-spec remove(Key :: term(), Map :: map(), Opts :: map()) -> map().
+remove(Key, Map, Opts) ->
+    maps:remove(Key, hb_cache:ensure_loaded(Map, Opts)).
+
+-spec with(Keys :: [term()], Map :: map()) -> map().
+with(Keys, Map) ->
+	with(Keys, Map, #{}).
+
+-spec with(Keys :: [term()], Map :: map(), Opts :: map()) -> map().
+with(Keys, Map, Opts) ->
+    maps:with(Keys, hb_cache:ensure_loaded(Map, Opts)).
+
+-spec without(Keys :: [term()], Map :: map()) -> map().
+without(Keys, Map) ->
+	without(Keys, Map, #{}).
+
+-spec without(Keys :: [term()], Map :: map(), Opts :: map()) -> map().
+without(Keys, Map, Opts) ->
+    maps:without(Keys, hb_cache:ensure_loaded(Map, Opts)).
+
+-spec filter(
+    Fun :: fun((Key :: term(), Value :: term()) -> boolean()),
+    Map :: map()
+) -> map().
+filter(Fun, Map) ->
+    filter(Fun, Map, #{}).
+
+-spec filter(
+    Fun :: fun((Key :: term(), Value :: term()) -> boolean()),
+    Map :: map(),
+    Opts :: map()
+) -> map().
+filter(Fun, Map, Opts) ->
+    maps:filtermap(
+        fun(K, V) ->
+            case Fun(K, Loaded = hb_cache:ensure_loaded(V, Opts)) of
+                true -> {true, Loaded};
+                false -> false
+            end
+        end,
+        hb_cache:ensure_loaded(Map, Opts)
+    ).
+
+-spec filtermap(
+    Fun :: fun((Key :: term(), Value :: term()) -> {boolean(), term()}),
+    Map :: map()
+) -> map().
+filtermap(Fun, Map) ->
+    filtermap(Fun, Map, #{}).
+
+-spec filtermap(
+    Fun :: fun((Key :: term(), Value :: term()) -> {boolean(), term()}),
+    Map :: map(),
+    Opts :: map()
+) -> map().
+filtermap(Fun, Map, Opts) ->
+    maps:filtermap(
+        fun(K, V) -> Fun(K, hb_cache:ensure_loaded(V, Opts)) end,
+        hb_cache:ensure_loaded(Map, Opts)
+    ).
+
+-spec fold(
+    Fun :: fun((Key :: term(), Value :: term(), Acc :: term()) -> term()),
+    Acc :: term(),
+    Map :: map()
+) -> term().
+fold(Fun, Acc, Map) ->
+    fold(Fun, Acc, Map, #{}).
+
+-spec fold(
+    Fun :: fun((Key :: term(), Value :: term(), Acc :: term()) -> term()),
+    Acc :: term(),
+    Map :: map(),
+    Opts :: map()
+) -> term().
+fold(Fun, Acc, Map, Opts) ->
+    maps:fold(
+        fun(K, V, CurrAcc) -> Fun(K, hb_cache:ensure_loaded(V, Opts), CurrAcc) end,
+        Acc,
+        hb_cache:ensure_loaded(Map, Opts)
+    ).
+
+-spec take(N :: non_neg_integer(), Map :: map()) -> map().
+take(N, Map) ->
+	take(N, Map, #{}).
+
+-spec take(N :: non_neg_integer(), Map :: map(), Opts :: map()) -> map().
+take(N, Map, Opts) ->
+    maps:take(N, hb_cache:ensure_loaded(Map, Opts)).
+
+-spec update_with(
+    Key :: term(),
+    Fun :: fun((Value :: term()) -> term()),
+    Map :: map()
+) -> map().
+update_with(Key, Fun, Map) ->
+    update_with(Key, Fun, Map, #{}).
+
+-spec update_with(
+    Key :: term(),
+    Fun :: fun((Value :: term()) -> term()),
+    Map :: map(),
+    Opts :: map()
+) -> map().
+update_with(Key, Fun, Map, Opts) ->
+    maps:update_with(Key, Fun, hb_cache:ensure_loaded(Map, Opts), Opts).
+
+-spec from_list(List :: [{Key :: term(), Value :: term()}]) -> map().
+from_list(List) ->
+    maps:from_list(List).
+
+-spec to_list(Map :: map()) -> [{Key :: term(), Value :: term()}].
+to_list(Map) ->
+    to_list(Map, #{}).
+
+-spec to_list(Map :: map(), Opts :: map()) -> [{Key :: term(), Value :: term()}].
+to_list(Map, Opts) ->
+    maps:to_list(hb_cache:ensure_loaded(Map, Opts)).
+
+%%% Tests
+
+get_with_link_test() ->
+    Bin = <<"TEST DATA">>,
+    Opts = #{},
+    {ok, Location} = hb_cache:write(Bin, Opts),
+    Map = #{ 1 => 1, 2 => {link, Location, #{}}, 3 => 3 },
+    ?assertEqual(Bin, get(2, Map)).
+
+map_with_link_test() ->
+    Bin = <<"TEST DATA">>,
+    Opts = #{},
+    {ok, Location} = hb_cache:write(Bin, Opts),
+    Map = #{ 1 => 1, 2 => {link, Location, #{}}, 3 => 3 },
+    ?assertEqual(#{1 => 1, 2 => Bin, 3 => 3}, map(fun(_K, V) -> V end, Map, #{})).
+
+get_with_typed_link_test() ->
+    Bin = <<"123">>,
+    Opts = #{},
+    {ok, Location} = hb_cache:write(Bin, Opts),
+    Map = #{ 1 => 1, 2 => {link, Location, #{ <<"type">> => integer }}, 3 => 3 },
+    ?assertEqual(123, get(2, Map, undefined)).
+
+resolve_on_link_test() ->
+    Msg = #{ <<"test-key">> => <<"test-value">> },
+    Opts = #{},
+    {ok, ID} = hb_cache:write(Msg, Opts),
+    ?assertEqual(
+        {ok, <<"test-value">>},
+        hb_ao:resolve({link, ID, #{}}, <<"test-key">>, #{})
+    ).
+
+filter_with_link_test() ->
+    Bin = <<"TEST DATA">>,
+    Opts = #{},
+    {ok, Location} = hb_cache:write(Bin, Opts),
+    Map = #{ 1 => 1, 2 => {link, Location, #{}}, 3 => 3 },
+    ?assertEqual(#{1 => 1, 3 => 3}, filter(fun(_, V) -> V =/= Bin end, Map)).
+
+filtermap_with_link_test() ->
+    Bin = <<"TEST DATA">>,
+    Opts = #{},
+    {ok, Location} = hb_cache:write(Bin, Opts),
+    Map = #{ 1 => 1, 2 => {link, Location, #{}}, 3 => 3 },
+    ?assertEqual(
+        #{2 => <<"FOUND">>},
+        filtermap(
+            fun(_, <<"TEST DATA">>) -> {true, <<"FOUND">>};
+               (_K, _V) -> false
+            end,
+            Map
+        )
+    ).
+
+fold_with_typed_link_test() ->
+    Bin = <<"123">>,
+    Opts = #{},
+    {ok, Location} = hb_cache:write(Bin, Opts),
+    Map = #{ 1 => 1, 2 => {link, Location, #{ <<"type">> => integer }}, 3 => 3 },
+    ?assertEqual(127, fold(fun(_, V, Acc) -> V + Acc end, 0, Map)).
+
+filter_passively_loads_test() ->
+    Bin = <<"TEST DATA">>,
+    Opts = #{},
+    {ok, Location} = hb_cache:write(Bin, Opts),
+    Map = #{ 1 => 1, 2 => {link, Location, #{}}, 3 => 3 },
+    ?assertEqual(
+        #{1 => 1, 2 => <<"TEST DATA">>, 3 => 3},
+        filter(fun(_, _) -> true end, Map)
+    ).
+
+filtermap_passively_loads_test() ->
+    Bin = <<"TEST DATA">>,
+    Opts = #{},
+    {ok, Location} = hb_cache:write(Bin, Opts),
+    Map = #{ 1 => 1, 2 => {link, Location, #{}}, 3 => 3 },
+    ?assertEqual(
+        #{ 1 => 1, 2 => <<"TEST DATA">>, 3 => 3 },
+        filtermap(fun(_, V) -> {true, V} end, Map)
+    ).
\ No newline at end of file
diff --git a/src/hb_message.erl b/src/hb_message.erl
index 71f6f2052..438852960 100644
--- a/src/hb_message.erl
+++ b/src/hb_message.erl
@@ -44,7 +44,7 @@
 %%% 
 %%% Additionally, this module provides a number of utility functions for
 %%% manipulating messages. For example, `hb_message:sign/2' to sign a message of
-%%% arbitrary type, or `hb_message:format/1' to print an AO-Core/TABM message in
+%%% arbitrary type, or `hb_formatter:format_msg/1' to print an AO-Core/TABM message in
 %%% a human-readable format.
 %%% 
 %%% The `hb_cache' module is responsible for storing and retrieving messages in
@@ -52,21 +52,24 @@
 %%% backend, but each works with simple key-value pairs. Subsequently, the 
 %%% `hb_cache' module uses TABMs as the internal format for storing and 
 %%% retrieving messages.
+%%% 
+%%% Test vectors to ensure the functioning of this module and the codecs that
+%%% interact with it are found in `hb_message_test_vectors.erl'.
 -module(hb_message).
 -export([id/1, id/2, id/3]).
--export([convert/3, convert/4, uncommitted/1, with_only_committers/2]).
--export([verify/1, verify/2, commit/2, commit/3, signers/1, type/1, minimize/1]).
--export([committed/1, committed/2, committed/3]).
--export([commitment/2, commitment/3]).
--export([with_only_committed/1, with_only_committed/2]).
--export([with_commitments/2, without_commitments/2]).
--export([match/2, match/3, find_target/3]).
+-export([convert/3, convert/4, uncommitted/1, uncommitted/2, committed/3]).
+-export([with_only_committers/2, with_only_committers/3, commitment_devices/2]).
+-export([verify/1, verify/2, verify/3, commit/2, commit/3, signers/2, type/1, minimize/1]).
+-export([normalize_commitments/2, is_signed_key/3]).
+-export([commitment/2, commitment/3, commitments/3]).
+-export([with_only_committed/2, without_unless_signed/3]).
+-export([with_commitments/3, without_commitments/3]).
+-export([diff/3, match/2, match/3, match/4, find_target/3]).
 %%% Helpers:
 -export([default_tx_list/0, filter_default_keys/1]).
 %%% Debugging tools:
--export([print/1, format/1, format/2]).
+-export([print/1]).
 -include("include/hb.hrl").
--include_lib("eunit/include/eunit.hrl").
 
 %% @doc Convert a message from one format to another. Taking a message in the
 %% source format, a target format, and a set of opts. If not given, the source
@@ -81,6 +84,12 @@
 %% available. The conversion from a TABM is done by the target codec.
 convert(Msg, TargetFormat, Opts) ->
     convert(Msg, TargetFormat, <<"structured@1.0">>, Opts).
+convert(Msg, TargetFormat, tabm, Opts) ->
+    OldPriv =
+        if is_map(Msg) -> maps:get(<<"priv">>, Msg, #{});
+           true -> #{}
+        end,
+    from_tabm(Msg, TargetFormat, OldPriv, Opts);
 convert(Msg, TargetFormat, SourceFormat, Opts) ->
     OldPriv =
         if is_map(Msg) -> maps:get(<<"priv">>, Msg, #{});
@@ -89,65 +98,134 @@ convert(Msg, TargetFormat, SourceFormat, Opts) ->
     TABM =
         to_tabm(
             case is_map(Msg) of
-                true -> maps:without([<<"priv">>], Msg);
+                true -> hb_maps:without([<<"priv">>], Msg, Opts);
                 false -> Msg
             end,
             SourceFormat,
             Opts
         ),
     case TargetFormat of
-        tabm -> restore_priv(TABM, OldPriv);
+        tabm -> restore_priv(TABM, OldPriv, Opts);
         _ -> from_tabm(TABM, TargetFormat, OldPriv, Opts)
     end.
 
 to_tabm(Msg, SourceFormat, Opts) ->
-    SourceCodecMod = get_codec(SourceFormat, Opts),
-    case SourceCodecMod:from(Msg) of
-        TypicalMsg when is_map(TypicalMsg) ->
+    {SourceCodecMod, Params} = conversion_spec_to_req(SourceFormat, Opts),
+    % We use _from_ here because the codecs are labelled from the perspective
+    % of their own format. `dev_codec_ans104:from/1' will convert _from_
+    % an ANS-104 message _into_ a TABM.
+    case SourceCodecMod:from(Msg, Params, Opts) of
+        {ok, TypicalMsg} when is_map(TypicalMsg) ->
             TypicalMsg;
-        OtherTypeRes -> OtherTypeRes
+        {ok, OtherTypeRes} -> OtherTypeRes
     end.
 
 from_tabm(Msg, TargetFormat, OldPriv, Opts) ->
-    TargetCodecMod = get_codec(TargetFormat, Opts),
-    case TargetCodecMod:to(Msg) of
-        TypicalMsg when is_map(TypicalMsg) ->
-            restore_priv(TypicalMsg, OldPriv);
-        OtherTypeRes -> OtherTypeRes
+    {TargetCodecMod, Params} = conversion_spec_to_req(TargetFormat, Opts),
+    % We use the _to_ function here because each of the codecs we may call in
+    % this step are labelled from the perspective of the target format. For 
+    % example, `dev_codec_httpsig:to/1' will convert _from_ a TABM to an
+    % HTTPSig message.
+    case TargetCodecMod:to(Msg, Params, Opts) of
+        {ok, TypicalMsg} when is_map(TypicalMsg) ->
+            restore_priv(TypicalMsg, OldPriv, Opts);
+        {ok, OtherTypeRes} -> OtherTypeRes
     end.
 
 %% @doc Add the existing `priv' sub-map back to a converted message, honoring
 %% any existing `priv' sub-map that may already be present.
-restore_priv(Msg, EmptyPriv) when map_size(EmptyPriv) == 0 -> Msg;
-restore_priv(Msg, OldPriv) ->
-    MsgPriv = maps:get(<<"priv">>, Msg, #{}),
+restore_priv(Msg, EmptyPriv, _Opts) when map_size(EmptyPriv) == 0 -> Msg;
+restore_priv(Msg, OldPriv, Opts) ->
+    MsgPriv = hb_maps:get(<<"priv">>, Msg, #{}, Opts),
     ?event({restoring_priv, {msg_priv, MsgPriv}, {old_priv, OldPriv}}),
-    NewPriv = hb_util:deep_merge(MsgPriv, OldPriv),
+    NewPriv = hb_util:deep_merge(MsgPriv, OldPriv, Opts),
     ?event({new_priv, NewPriv}),
     Msg#{ <<"priv">> => NewPriv }.
 
+%% @doc Get a codec device and request params from the given conversion request. 
+%% Expects conversion spec to either be a binary codec name, or a map with a
+%% `device' key and other parameters. Additionally honors the `always_bundle'
+%% key in the node message if present.
+conversion_spec_to_req(Spec, Opts) when is_binary(Spec) or (Spec == tabm) ->
+    conversion_spec_to_req(#{ <<"device">> => Spec }, Opts);
+conversion_spec_to_req(Spec, Opts) ->
+    try
+        Device =
+            hb_maps:get(
+                <<"device">>,
+                Spec,
+                no_codec_device_in_conversion_spec,
+                Opts
+            ),
+        {
+            case Device of
+                tabm -> tabm;
+                _ ->
+                    hb_ao_device:message_to_device(
+                        #{
+                            <<"device">> => Device
+                        },
+                        Opts
+                    )
+            end,
+            hb_maps:without([<<"device">>], Spec, Opts)
+        }
+    catch _:_ ->
+        throw({message_codec_not_extractable, Spec})
+    end.
+
 %% @doc Return the ID of a message.
 id(Msg) -> id(Msg, uncommitted).
+id(Msg, Opts) when is_map(Opts) -> id(Msg, uncommitted, Opts);
 id(Msg, Committers) -> id(Msg, Committers, #{}).
 id(Msg, RawCommitters, Opts) ->
-    Committers =
+    CommSpec =
         case RawCommitters of
-            uncommitted -> <<"none">>;
-            unsigned -> <<"none">>;
-            none -> [];
-            all -> <<"all">>;
-            signed -> signers(Msg);
-            List -> List
+            none -> #{ <<"committers">> => <<"none">> };
+            uncommitted -> #{ <<"committers">> => <<"none">> };
+            unsigned -> #{ <<"committers">> => <<"none">> };
+            all -> #{ <<"committers">> => <<"all">> };
+            signed -> #{ <<"committers">> => <<"all">> };
+            List when is_list(List) -> #{ <<"committers">> => List }
         end,
-    ?event({getting_id, {msg, Msg}, {committers, Committers}}),
+    ?event({getting_id, {msg, Msg}, {spec, CommSpec}}),
     {ok, ID} =
-        hb_ao:resolve(
+        dev_message:id(
             Msg,
-            #{ <<"path">> => <<"id">>, <<"committers">> => Committers },
+            CommSpec#{ <<"path">> => <<"id">> },
             Opts
         ),
     hb_util:human_id(ID).
 
+%% @doc Normalize the IDs in a message, ensuring that there is at least one
+%% unsigned ID present. By forcing this work to occur in strategically positioned
+%% places, we avoid the need to recalculate the IDs for every `hb_message:id`
+%% call.
+normalize_commitments(Msg, Opts) when is_map(Msg) ->
+    NormMsg = 
+        maps:map(
+            fun(Key, Val) when Key == <<"commitments">> orelse Key == <<"priv">> ->
+                Val;
+               (_Key, Val) -> normalize_commitments(Val, Opts)
+            end,
+            Msg
+        ),
+    case hb_maps:get(<<"commitments">>, NormMsg, not_found, Opts) of
+        not_found ->
+            {ok, #{ <<"commitments">> := Commitments }} =
+                dev_message:commit(
+                    NormMsg,
+                    #{ <<"type">> => <<"unsigned">> },
+                    Opts
+                ),
+            NormMsg#{ <<"commitments">> => Commitments };
+        _ -> NormMsg
+    end;
+normalize_commitments(Msg, Opts) when is_list(Msg) ->
+    lists:map(fun(X) -> normalize_commitments(X, Opts) end, Msg);
+normalize_commitments(Msg, _Opts) ->
+    Msg.
+
 %% @doc Return a message with only the committed keys. If no commitments are
 %% present, the message is returned unchanged. This means that you need to
 %% check if the message is:
@@ -156,10 +234,9 @@ id(Msg, RawCommitters, Opts) ->
 %% ...before using the output of this function as the 'canonical' message. This
 %% is such that expensive operations like signature verification are not
 %% performed unless necessary.
-with_only_committed(Msg) ->
-    with_only_committed(Msg, #{}).
 with_only_committed(Msg, Opts) when is_map(Msg) ->
-    Comms = maps:get(<<"commitments">>, Msg, not_found),
+    ?event({with_only_committed, {msg, Msg}, {opts, Opts}}),
+    Comms = hb_maps:get(<<"commitments">>, Msg, not_found, Opts),
     case is_map(Msg) andalso Comms /= not_found of
         true ->
             try
@@ -169,15 +246,25 @@ with_only_committed(Msg, Opts) when is_map(Msg) ->
                         #{ <<"commitments">> => <<"all">> },
                         Opts
                     ),
-                % Add the inline-body-key to the committed list if it is not
+                % Add the ao-body-key to the committed list if it is not
                 % already present.
-                ?event({committed_keys, CommittedKeys, {msg, Msg}}),
-                {ok, maps:with(
-                    CommittedKeys ++ [<<"commitments">>],
-                    Msg
-                )}
-            catch _:_:St ->
-                {error, {could_not_normalize, Msg, St}}
+                ?event(debug_bundle, {committed_keys, CommittedKeys, {msg, Msg}}),
+                {ok,
+                    with_links(
+                        [<<"commitments">> | CommittedKeys],
+                        Msg,
+                        Opts
+                    )
+                }
+            catch Class:Reason:St ->
+                {error,
+                    {could_not_normalize,
+                        {class, Class},
+                        {reason, Reason},
+                        {msg, Msg},
+                        {stacktrace, St}
+                    }
+                }
             end;
         false -> {ok, Msg}
     end;
@@ -185,20 +272,52 @@ with_only_committed(Msg, _) ->
     % If the message is not a map, it cannot be signed.
     {ok, Msg}.
 
+%% @doc Filter keys from a map that do not match either the list of keys or
+%% their relative `+link` variants.
+with_links(Keys, Map, Opts) ->
+    hb_maps:with(
+        Keys ++
+            lists:map(
+                fun(Key) ->
+                    <<(hb_link:remove_link_specifier(Key))/binary, "+link">>
+                end,
+                Keys
+            ),
+        Map,
+        Opts
+    ).
+
 %% @doc Return the message with only the specified committers attached.
-with_only_committers(Msg, Committers) when is_map(Msg) ->
+with_only_committers(Msg, Committers) ->
+    with_only_committers(Msg, Committers, #{}).
+with_only_committers(Msg, Committers, Opts) when is_map(Msg) ->
     NewCommitments =
-        maps:filter(
+        hb_maps:filter(
             fun(_, #{ <<"committer">> := Committer }) ->
                 lists:member(Committer, Committers);
                (_, _) -> false
             end,
-            maps:get(<<"commitments">>, Msg, #{})
+            hb_maps:get(<<"commitments">>, Msg, #{}, Opts),
+			Opts
         ),
     Msg#{ <<"commitments">> => NewCommitments };
-with_only_committers(Msg, _Committers) ->
+with_only_committers(Msg, _Committers, _Opts) ->
     throw({unsupported_message_type, Msg}).
 
+%% @doc Determine whether a specific key is part of a message's commitments.
+is_signed_key(Key, Msg, Opts) ->
+    lists:member(Key, hb_message:committed(Msg, all, Opts)).
+
+%% @doc Remove the any of the given keys that are not signed from a message.
+without_unless_signed(Key, Msg, Opts) when not is_list(Key) ->
+    without_unless_signed([Key], Msg, Opts);
+without_unless_signed(Keys, Msg, Opts) ->
+    SignedKeys = hb_message:committed(Msg, all, Opts),
+    maps:without(
+        lists:filter(fun(K) -> not lists:member(K, SignedKeys) end, Keys),
+        Msg
+    ).
+
 %% @doc Sign a message with the given wallet.
 commit(Msg, WalletOrOpts) ->
     commit(
@@ -215,244 +334,95 @@ commit(Msg, WalletOrOpts) ->
     ).
 commit(Msg, Wallet, Format) when not is_map(Wallet) ->
     commit(Msg, #{ priv_wallet => Wallet }, Format);
-commit(Msg, Opts, Format) ->
+commit(Msg, Opts, CodecName) when is_binary(CodecName) ->
+    commit(Msg, Opts, #{ <<"commitment-device">> => CodecName });
+commit(Msg, Opts, Spec) ->
     {ok, Signed} =
         dev_message:commit(
             Msg,
-            #{ <<"commitment-device">> => Format },
+            Spec#{
+                <<"commitment-device">> =>
+                    case hb_maps:get(<<"commitment-device">>, Spec, none, Opts) of
+                        none ->
+                            case hb_maps:get(<<"device">>, Spec, none, Opts) of
+                                none ->
+                                    hb_opts:get(
+                                        commitment_device,
+                                        no_viable_commitment_device,
+                                        Opts
+                                    );
+                                Device -> Device
+                            end;
+                        CommitmentDevice -> CommitmentDevice
+                    end
+            },
             Opts
         ),
     Signed.
 
 %% @doc Return the list of committed keys from a message.
-committed(Msg) -> committed(Msg, all).
-committed(Msg, Committers) -> committed(Msg, Committers, #{}).
 committed(Msg, all, Opts) ->
-    committed(Msg, #{ <<"commitments">> => <<"all">> }, Opts);
+    committed(Msg, #{ <<"committers">> => <<"all">> }, Opts);
+committed(Msg, none, Opts) ->
+    committed(Msg, #{ <<"committers">> => <<"none">> }, Opts);
 committed(Msg, List, Opts) when is_list(List) ->
     committed(Msg, #{ <<"commitments">> => List }, Opts);
 committed(Msg, CommittersMsg, Opts) ->
+    ?event(
+        {committed,
+            {msg, {explicit, Msg}},
+            {committers_msg, {explicit, CommittersMsg}},
+            {opts, Opts}
+        }
+    ),
     {ok, CommittedKeys} = dev_message:committed(Msg, CommittersMsg, Opts),
     CommittedKeys.
 
 %% @doc wrapper function to verify a message.
-verify(Msg) -> verify(Msg, <<"all">>).
-verify(Msg, signers) -> verify(Msg, hb_message:signers(Msg));
+verify(Msg) -> verify(Msg, all).
 verify(Msg, Committers) ->
-    {ok, Res} =
-        dev_message:verify(
-            Msg,
-            #{ <<"committers">> =>
+    verify(Msg, Committers, #{}).
+verify(Msg, all, Opts) ->
+    verify(Msg, <<"all">>, Opts);
+verify(Msg, signers, Opts) ->
+    verify(Msg, hb_message:signers(Msg, Opts), Opts);
+verify(Msg, Committers, Opts) when not is_map(Committers) ->
+    verify(
+        Msg,
+        #{
+            <<"committers">> =>
                 case ?IS_ID(Committers) of
                     true -> [Committers];
                     false -> Committers
                 end
-            },
-            #{}),
+        },
+        Opts
+    );
+verify(Msg, Spec, Opts) ->
+    ?event(verify, {verify, {spec, Spec}}),
+    {ok, Res} =
+        dev_message:verify(
+            Msg,
+            Spec,
+            Opts
+        ),
     Res.
 
 %% @doc Return the unsigned version of a message in AO-Core format.
-uncommitted(Bin) when is_binary(Bin) -> Bin;
-uncommitted(Msg) ->
-    maps:remove(<<"commitments">>, Msg).
+uncommitted(Msg) -> uncommitted(Msg, #{}).
+uncommitted(Bin, _Opts) when is_binary(Bin) -> Bin;
+uncommitted(Msg, Opts) ->
+    hb_maps:remove(<<"commitments">>, Msg, Opts).
 
 %% @doc Return all of the committers on a message that have 'normal', 256 bit, 
 %% addresses.
-signers(Msg) ->
-    lists:filter(fun(Signer) -> ?IS_ID(Signer) end,
-        hb_ao:get(<<"committers">>, Msg, #{})).
-
-%% @doc Get a codec from the options.
-get_codec(TargetFormat, Opts) ->
-    try
-        hb_ao:message_to_device(
-            #{ <<"device">> => TargetFormat },
-            Opts
-        )
-    catch _:_ ->
-        throw({message_codec_not_viable, TargetFormat})
-    end.
+signers(Msg, Opts) ->
+    hb_util:ok(dev_message:committers(Msg, #{}, Opts)).
 
 %% @doc Pretty-print a message.
 print(Msg) -> print(Msg, 0).
 print(Msg, Indent) ->
-    io:format(standard_error, "~s", [lists:flatten(format(Msg, Indent))]).
-
-%% @doc Format a message for printing, optionally taking an indentation level
-%% to start from.
-format(Item) -> format(Item, 0).
-format(Bin, Indent) when is_binary(Bin) ->
-    hb_util:format_indented(
-        hb_util:format_binary(Bin),
-        Indent
-    );
-format(List, Indent) when is_list(List) ->
-    format(lists:map(fun hb_ao:normalize_key/1, List), Indent);
-format(Map, Indent) when is_map(Map) ->
-    % Define helper functions for formatting elements of the map.
-    ValOrUndef =
-        fun(<<"hashpath">>) ->
-            case Map of
-                #{ <<"priv">> := #{ <<"hashpath">> := HashPath } } ->
-                    hb_util:short_id(HashPath);
-                _ ->
-                    undefined
-            end;
-        (Key) ->
-            case dev_message:get(Key, Map) of
-                {ok, Val} ->
-                    case hb_util:short_id(Val) of
-                        undefined -> Val;
-                        ShortID -> ShortID
-                    end;
-                {error, _} -> undefined
-            end
-        end,
-    FilterUndef =
-        fun(List) ->
-            lists:filter(fun({_, undefined}) -> false; (_) -> true end, List)
-        end,
-    % Prepare the metadata row for formatting.
-    % Note: We try to get the IDs _if_ they are *already* in the map. We do not
-    % force calculation of the IDs here because that may cause significant
-    % overhead unless the `debug_ids' option is set.
-    IDMetadata =
-        case hb_opts:get(debug_ids, false, #{}) of
-            false ->
-                [
-                    {<<"#P">>, ValOrUndef(<<"hashpath">>)},
-                    {<<"*U">>, ValOrUndef(<<"unsigned_id">>)},
-                    {<<"*S">>, ValOrUndef(<<"id">>)}
-                ];
-            true ->
-                {ok, UID} = dev_message:id(Map, #{}, #{}),
-                {ok, ID} =
-                    dev_message:id(Map, #{ <<"commitments">> => <<"all">> }, #{}),
-                [
-                    {<<"#P">>, hb_util:short_id(ValOrUndef(<<"hashpath">>))},
-                    {<<"*U">>, hb_util:short_id(UID)}
-                ] ++
-                case ID of
-                    UID -> [];
-                    _ -> [{<<"*S">>, hb_util:short_id(ID)}]
-                end
-        end,
-    CommitterMetadata =
-        case hb_opts:get(debug_committers, true, #{}) of
-            false -> [];
-            true ->
-                case dev_message:committers(Map) of
-                    {ok, []} -> [];
-                    {ok, [Committer]} ->
-                        [{<<"Comm.">>, hb_util:short_id(Committer)}];
-                    {ok, Committers} ->
-                        [
-                            {
-                                <<"Comms.">>,
-                                string:join(
-                                    lists:map(
-                                        fun(X) ->
-                                            [hb_util:short_id(X)]
-                                        end,
-                                        Committers
-                                    ),
-                                    ", "
-                                )
-                            }
-                        ]
-                end
-        end,
-    % Concatenate the present metadata rows.
-    Metadata = FilterUndef(lists:flatten([IDMetadata, CommitterMetadata])),
-    % Format the metadata row.
-    Header =
-        hb_util:format_indented("Message [~s] {",
-            [
-                string:join(
-                    [
-                        io_lib:format("~s: ~s", [Lbl, Val])
-                        || {Lbl, Val} <- Metadata
-                    ],
-                    ", "
-                )
-            ],
-            Indent
-        ),
-    % Put the path and device rows into the output at the _top_ of the map.
-    PriorityKeys = [{<<"path">>, ValOrUndef(<<"path">>)}, {<<"device">>, ValOrUndef(<<"device">>)}],
-    % Add private keys to the output if they are not hidden. Opt takes 3 forms:
-    % 1. `false' -- never show priv
-    % 2. `if_present' -- show priv only if there are keys inside
-    % 2. `always' -- always show priv
-    FooterKeys =
-        case {hb_opts:get(debug_show_priv, false, #{}), maps:get(<<"priv">>, Map, #{})} of
-            {false, _} -> [];
-            {if_present, #{}} -> [];
-            {_, Priv} -> [{<<"!Private!">>, Priv}]
-        end,
-    % Concatenate the path and device rows with the rest of the key values.
-    KeyVals =
-        FilterUndef(PriorityKeys) ++
-        maps:to_list(
-            minimize(Map,
-                case hb_opts:get(debug_metadata, false, #{}) of
-                    false ->
-                        [
-                            <<"commitments">>,
-                            <<"path">>,
-                            <<"device">>
-                        ];
-                    true -> [
-                        <<"path">>,
-                        <<"device">>
-                    ]
-                end
-            )
-        ) ++ FooterKeys,
-    % Format the remaining 'normal' keys and values.
-    Res = lists:map(
-        fun({Key, Val}) ->
-            NormKey = hb_ao:normalize_key(Key, #{ error_strategy => ignore }),
-            KeyStr = 
-                case NormKey of
-                    undefined ->
-                        io_lib:format("~p [!!! INVALID KEY !!!]", [Key]);
-                    _ ->
-                        hb_ao:normalize_key(Key)
-                end,
-            hb_util:format_indented(
-                "~s => ~s~n",
-                [
-                    lists:flatten([KeyStr]),
-                    case Val of
-                        NextMap when is_map(NextMap) ->
-                            hb_util:format_maybe_multiline(NextMap, Indent + 2);
-                        _ when (byte_size(Val) == 32) or (byte_size(Val) == 43) ->
-                            Short = hb_util:short_id(Val),
-                            io_lib:format("~s [*]", [Short]);
-                        _ when byte_size(Val) == 87 ->
-                            io_lib:format("~s [#p]", [hb_util:short_id(Val)]);
-                        Bin when is_binary(Bin) ->
-                            hb_util:format_binary(Bin);
-                        Other ->
-                            io_lib:format("~p", [Other])
-                    end
-                ],
-                Indent + 1
-            )
-        end,
-        KeyVals
-    ),
-    case Res of
-        [] -> lists:flatten(Header ++ " [Empty] }");
-        _ ->
-            lists:flatten(
-                Header ++ ["\n"] ++ Res ++ hb_util:format_indented("}", Indent)
-            )
-    end;
-format(Item, Indent) ->
-    % Whatever we have is not a message map.
-    hb_util:format_indented("[UNEXPECTED VALUE] ~p", [Item], Indent).
+    io:format(standard_error, "~s", [lists:flatten(hb_format:message(Msg, #{}, Indent))]).
 
 %% @doc Return the type of an encoded message.
 type(TX) when is_record(TX, tx) -> tx;
@@ -462,7 +432,7 @@ type(Msg) when is_map(Msg) ->
         fun({_, Value}) -> is_map(Value) end,
         lists:filter(
             fun({Key, _}) -> not hb_private:is_private(Key) end,
-            maps:to_list(Msg)
+            hb_maps:to_list(Msg)
         )
     ),
     case IsDeep of
@@ -475,22 +445,35 @@ type(Msg) when is_map(Msg) ->
 %%      `strict': All keys in both maps be present and match.
 %%      `only_present': Only present keys in both maps must match.
 %%      `primary': Only the primary map's keys must be present.
+%% Returns `true` or `{ErrType, Err}`.
 match(Map1, Map2) ->
     match(Map1, Map2, strict).
 match(Map1, Map2, Mode) ->
-     Keys1 =
-        maps:keys(
-            NormMap1 = minimize(
-                normalize(hb_ao:normalize_keys(Map1)),
-                [<<"content-type">>, <<"body-keys">>, <<"inline-body-key">>]
-            )
+    match(Map1, Map2, Mode, #{}).
+match(Map1, Map2, Mode, Opts) ->
+    try unsafe_match(Map1, Map2, Mode, [], Opts)
+    catch
+        throw:{mismatch, Type, Path, Val1, Val2} ->
+            {mismatch, Type, Path, Val1, Val2};
+        _:Details:St -> {error, {Details, {trace, St}}}
+    end.
+
+%% @doc Match two maps, returning `true' if they match, or throwing an error
+%% if they do not.
+unsafe_match(Map1, Map2, Mode, Path, Opts) ->
+    Keys1 =
+        hb_maps:keys(
+            NormMap1 = hb_util:lower_case_key_map(minimize(
+                normalize(hb_ao:normalize_keys(Map1, Opts), Opts),
+                [<<"content-type">>, <<"ao-body-key">>]
+            ), Opts)
         ),
     Keys2 =
-        maps:keys(
-            NormMap2 = minimize(
-                normalize(hb_ao:normalize_keys(Map2)),
-                [<<"content-type">>, <<"body-keys">>, <<"inline-body-key">>]
-            )
+        hb_maps:keys(
+            NormMap2 = hb_util:lower_case_key_map(minimize(
+                normalize(hb_ao:normalize_keys(Map2, Opts), Opts),
+                [<<"content-type">>, <<"ao-body-key">>]
+            ), Opts)
         ),
     PrimaryKeysPresent =
         (Mode == primary) andalso
@@ -498,31 +481,57 @@ match(Map1, Map2, Mode) ->
                 fun(Key) -> lists:member(Key, Keys1) end,
                 Keys1
             ),
-    ?event({match, {keys1, Keys1}, {keys2, Keys2}, {mode, Mode}, {primary_keys_present, PrimaryKeysPresent}}),
+    ?event(match,
+        {match,
+            {keys1, Keys1},
+            {keys2, Keys2},
+            {mode, Mode},
+            {primary_keys_present, PrimaryKeysPresent},
+            {msg1, Map1},
+            {msg2, Map2}
+        }
+    ),
     case (Keys1 == Keys2) or (Mode == only_present) or PrimaryKeysPresent of
         true ->
             lists:all(
                 fun(Key) ->
-                    Val1 = hb_ao:normalize_keys(maps:get(Key, NormMap1, not_found)),
-                    Val2 = hb_ao:normalize_keys(maps:get(Key, NormMap2, not_found)),
+                    ?event(match, {matching_key, Key}),
+                    Val1 =
+                        hb_ao:normalize_keys(
+                            hb_maps:get(Key, NormMap1, not_found, Opts),
+                            Opts
+                        ),
+                    Val2 =
+                        hb_ao:normalize_keys(
+                            hb_maps:get(Key, NormMap2, not_found, Opts),
+                            Opts
+                        ),
                     BothPresent = (Val1 =/= not_found) and (Val2 =/= not_found),
                     case (not BothPresent) and (Mode == only_present) of
                         true -> true;
                         false ->
                             case is_map(Val1) andalso is_map(Val2) of
-                                true -> match(Val1, Val2);
+                                true ->
+                                    unsafe_match(Val1, Val2, Mode, Path ++ [Key], Opts);
                                 false ->
-                                    case Val1 == Val2 of
-                                        true -> true;
-                                        false ->
-                                            ?event(match,
-                                                {value_mismatch,
-                                                    {key, Key},
-                                                    {val1, Val1},
-                                                    {val2, Val2}
+                                    case {Val1, Val2} of
+                                        {V, V} -> true;
+                                        {V, '_'} when V =/= not_found -> true;
+                                        {'_', V} when V =/= not_found -> true;
+                                        {'_', '_'} -> true;
+                                        _ ->
+                                            throw(
+                                                {mismatch,
+                                                    value,
+                                                    hb_format:short_id(
+                                                        hb_path:to_binary(
+                                                            Path ++ [Key]
+                                                        )
+                                                    ),
+                                                    Val1,
+                                                    Val2
                                                 }
-                                            ),
-                                            false
+                                            )
                                     end
                             end
                     end
@@ -530,28 +539,70 @@ match(Map1, Map2, Mode) ->
                 Keys1
             );
         false ->
-            ?event(match, {keys_mismatch, {keys1, Keys1}, {keys2, Keys2}}),
-            false
+            throw(
+                {mismatch,
+                    keys,
+                    hb_format:short_id(hb_path:to_binary(Path)),
+                    Keys1,
+                    Keys2
+                }
+            )
     end.
 	
 matchable_keys(Map) ->
-    lists:sort(lists:map(fun hb_ao:normalize_key/1, maps:keys(Map))).
+    lists:sort(lists:map(fun hb_ao:normalize_key/1, hb_maps:keys(Map))).
+
+%% @doc Return the numeric differences between two messages, matching deeply
+%% across nested messages. If the values are non-numeric, the new value is 
+%% returned if the values are different. Keys found only in the first message
+%% are dropped, as they have 'changed' to absence.
+diff(Msg1, Msg2, Opts) when is_map(Msg1) andalso is_map(Msg2) ->
+    maps:filtermap(
+        fun(Key, Val2) ->
+            case hb_maps:get(Key, Msg1, not_found, Opts) of
+                Val2 ->
+                    % The key is present in both maps, and the values match.
+                    false;
+                not_found ->
+                    % The key is net-new in Map2.
+                    {true, Val2};
+                Val1 when is_number(Val1) andalso is_number(Val2) ->
+                    % The key is present in both maps, and the values are numbers;
+                    % return the difference.
+                    {true, Val2 - Val1};
+                Val1 when is_map(Val1) andalso is_map(Val2) ->
+                    % The key is present in both maps, and the values are maps;
+                    % return the difference.
+                    {true, diff(Val1, Val2, Opts)};
+                _ ->
+                    % The key is present in both maps, and the values do not 
+                    % match. Return the new value.
+                    {true, Val2}
+            end
+        end,
+        Msg2
+    );
+diff(_Val1, _Val2, _Opts) ->
+    not_found.
 
 %% @doc Filter messages that do not match the 'spec' given. The underlying match
 %% is performed in the `only_present' mode, such that match specifications only
 %% need to specify the keys that must be present.
-with_commitments(Spec, Msg) ->
-    with_commitments(Spec, Msg, #{}).
-with_commitments(Spec, Msg = #{ <<"commitments">> := Commitments }, _Opts) ->
+with_commitments(ID, Msg, Opts) when ?IS_ID(ID) ->
+    with_commitments([ID], Msg, Opts);
+with_commitments(Spec, Msg = #{ <<"commitments">> := Commitments }, Opts) ->
     ?event({with_commitments, {spec, Spec}, {commitments, Commitments}}),
     FilteredCommitments =
-        maps:filter(
-            fun(_, CommMsg) ->
-                Res = match(Spec, CommMsg, primary),
-                ?event({with_commitments, {commitments, CommMsg}, {spec, Spec}, {match, Res}}),
-                Res
+        hb_maps:filter(
+            fun(ID, CommMsg) ->
+                if is_list(Spec) ->
+                    lists:member(ID, Spec);
+                is_map(Spec) ->
+                    match(Spec, CommMsg, primary, Opts) == true
+                end
             end,
-            Commitments
+            Commitments,
+            Opts
         ),
     ?event({with_commitments, {filtered_commitments, FilteredCommitments}}),
     Msg#{ <<"commitments">> => FilteredCommitments };
@@ -560,14 +611,17 @@ with_commitments(_Spec, Msg, _Opts) ->
 
 %% @doc Filter messages that match the 'spec' given. Inverts the `with_commitments/2'
 %% function, such that only messages that do _not_ match the spec are returned.
-without_commitments(Spec, Msg) ->
-    without_commitments(Spec, Msg, #{}).
-without_commitments(Spec, Msg = #{ <<"commitments">> := Commitments }, _Opts) ->
+without_commitments(Spec, Msg = #{ <<"commitments">> := Commitments }, Opts) ->
     ?event({without_commitments, {spec, Spec}, {msg, Msg}, {commitments, Commitments}}),
     FilteredCommitments =
-        maps:without(
-            maps:keys(
-                maps:get(<<"commitments">>, with_commitments(Spec, Msg, #{}), #{})
+        hb_maps:without(
+            hb_maps:keys(
+                hb_maps:get(
+                    <<"commitments">>,
+                    with_commitments(Spec, Msg, Opts),
+                    #{},
+                    Opts
+                )
             ),
             Commitments
         ),
@@ -576,28 +630,30 @@ without_commitments(Spec, Msg = #{ <<"commitments">> := Commitments }, _Opts) ->
 without_commitments(_Spec, Msg, _Opts) ->
     Msg.
 
-%% @doc Extract a commitment from a message given a `committer' ID, or a spec
-%% message to match against. Returns only the first matching commitment, or
-%% `not_found'.
-commitment(Committer, Msg) ->
-    commitment(Committer, Msg, #{}).
-commitment(CommitterID, Msg, Opts) when is_binary(CommitterID) ->
-    commitment(#{ <<"committer">> => CommitterID }, Msg, Opts);
-commitment(Spec, #{ <<"commitments">> := Commitments }, _Opts) ->
-    Matches =
-        maps:filtermap(
-            fun(ID, CommMsg) ->
-                case match(Spec, CommMsg, primary) of
-                    true -> {true, {ID, CommMsg}};
-                    false -> false
-                end
-            end,
-            Commitments
-        ),
-    case maps:values(Matches) of
-        [] -> not_found;
-        [{ID, Commitment}] -> {ok, ID, Commitment};
-        _ ->
+%% @doc Extract a commitment from a message given a `committer' or `commitment'
+%% ID, or a spec message to match against. Returns only the first matching
+%% commitment, or `not_found'.
+commitment(ID, Msg) ->
+    commitment(ID, Msg, #{}).
+commitment(ID, Link, Opts) when ?IS_LINK(Link) ->
+    commitment(ID, hb_cache:ensure_loaded(Link, Opts), Opts);
+commitment(ID, #{ <<"commitments">> := Commitments }, Opts)
+        when is_binary(ID), is_map_key(ID, Commitments) ->
+    hb_maps:get(
+        ID,
+        Commitments,
+        not_found,
+        Opts
+    );
+commitment(Spec, Msg, Opts) ->
+    Matches = commitments(Spec, Msg, Opts),
+    ?event(debug_commitment, {commitment, {spec, Spec}, {matches, Matches}}),
+    if
+        map_size(Matches) == 0 -> not_found;
+        map_size(Matches) == 1 ->
+            CommID = hd(hb_maps:keys(Matches)),
+            {ok, CommID, hb_util:ok(hb_maps:find(CommID, Matches, Opts))};
+        true ->
             ?event(commitment, {multiple_matches, {matches, Matches}}),
             multiple_matches
     end;
@@ -605,6 +661,36 @@ commitment(_Spec, _Msg, _Opts) ->
     % The message has no commitments, so the spec can never match.
     not_found.
 
+%% @doc Return a list of all commitments that match the spec.
+commitments(ID, Link, Opts) when ?IS_LINK(Link) ->
+    commitments(ID, hb_cache:ensure_loaded(Link, Opts), Opts);
+commitments(CommitterID, Msg, Opts) when is_binary(CommitterID) ->
+    commitments(#{ <<"committer">> => CommitterID }, Msg, Opts);
+commitments(Spec, #{ <<"commitments">> := Commitments }, Opts) ->
+    hb_maps:filtermap(
+        fun(_ID, CommMsg) ->
+            case match(Spec, CommMsg, primary, Opts) of
+                true -> {true, CommMsg};
+                _ -> false
+            end
+        end,
+        Commitments,
+        Opts
+    );
+commitments(_Spec, _Msg, _Opts) ->
+    #{}.
+
+%% @doc Return the devices for which there are commitments on a message.
+commitment_devices(#{ <<"commitments">> := Commitments }, Opts) ->
+    lists:map(
+        fun(CommMsg) ->
+            hb_ao:get(<<"commitment-device">>, CommMsg, Opts)
+        end,
+        maps:values(Commitments)
+    );
+commitment_devices(_Msg, _Opts) ->
+    [].
+
 %% @doc Implements a standard pattern in which the target for an operation is
 %% found by looking for a `target' key in the request. If the target is `self',
 %% or not present, the operation is performed on the original message. Otherwise,
@@ -616,13 +702,13 @@ find_target(Self, Req, Opts) ->
         cache_control => [<<"no-cache">>, <<"no-store">>]
     },
     {ok,
-        case hb_ao:get(<<"target">>, Req, <<"self">>, GetOpts) of
+        case hb_maps:get(<<"target">>, Req, <<"self">>, GetOpts) of
             <<"self">> -> Self;
             Key ->
-                hb_ao:get(
+                hb_maps:get(
                     Key,
                     Req,
-                    hb_ao:get(<<"body">>, Req, GetOpts),
+                    hb_maps:get(<<"body">>, Req, GetOpts),
                     GetOpts
                 )
         end
@@ -646,11 +732,11 @@ minimize(Map, ExtraKeys) ->
 
 %% @doc Return a map with only the keys that necessary, without those that can
 %% be regenerated.
-normalize(Map) when is_map(Map) orelse is_list(Map) ->
-    NormalizedMap = hb_ao:normalize_keys(Map),
+normalize(Map, Opts) when is_map(Map) orelse is_list(Map) ->
+    NormalizedMap = hb_ao:normalize_keys(Map, Opts),
     FilteredMap = filter_default_keys(NormalizedMap),
-    maps:with(matchable_keys(FilteredMap), FilteredMap);
-normalize(Other) ->
+    hb_maps:with(matchable_keys(FilteredMap), FilteredMap);
+normalize(Other, _Opts) ->
     Other.
 
 %% @doc Remove keys from a map that have the default values found in the tx
@@ -659,7 +745,7 @@ filter_default_keys(Map) ->
     DefaultsMap = default_tx_message(),
     maps:filter(
         fun(Key, Value) ->
-            case maps:find(hb_ao:normalize_key(Key), DefaultsMap) of
+            case hb_maps:find(hb_ao:normalize_key(Key), DefaultsMap) of
                 {ok, Value} -> false;
                 _ -> true
             end
@@ -669,873 +755,10 @@ filter_default_keys(Map) ->
 
 %% @doc Get the normalized fields and default values of the tx record.
 default_tx_message() ->
-    maps:from_list(default_tx_list()).
+    hb_maps:from_list(default_tx_list()).
 
 %% @doc Get the ordered list of fields as AO-Core keys and default values of
 %% the tx record.
 default_tx_list() ->
     Keys = lists:map(fun hb_ao:normalize_key/1, record_info(fields, tx)),
-    lists:zip(Keys, tl(tuple_to_list(#tx{}))).
-
-%%% Tests
-
-%% @doc Test that the filter_default_keys/1 function removes TX fields
-%% that have the default values found in the tx record, but not those that
-%% have been set by the user.
-default_keys_removed_test() ->
-    TX = #tx { unsigned_id = << 1:256 >>, last_tx = << 2:256 >> },
-    TXMap = #{
-        <<"unsigned_id">> => TX#tx.unsigned_id,
-        <<"last_tx">> => TX#tx.last_tx,
-        <<"owner">> => TX#tx.owner,
-        <<"target">> => TX#tx.target,
-        <<"data">> => TX#tx.data
-    },
-    FilteredMap = filter_default_keys(TXMap),
-    ?assertEqual(<< 1:256 >>, maps:get(<<"unsigned_id">>, FilteredMap)),
-    ?assertEqual(<< 2:256 >>, maps:get(<<"last_tx">>, FilteredMap, not_found)),
-    ?assertEqual(not_found, maps:get(<<"owner">>, FilteredMap, not_found)),
-    ?assertEqual(not_found, maps:get(<<"target">>, FilteredMap, not_found)).
-
-minimization_test() ->
-    Msg = #{
-        <<"unsigned_id">> => << 1:256 >>,
-        <<"id">> => << 2:256 >>
-    },
-    MinimizedMsg = minimize(Msg),
-    ?event({minimized, MinimizedMsg}),
-    ?assertEqual(1, maps:size(MinimizedMsg)).
-
-match_modes_test() ->
-    Msg1 = #{ <<"a">> => 1, <<"b">> => 2 },
-    Msg2 = #{ <<"a">> => 1 },
-    Msg3 = #{ <<"a">> => 1, <<"b">> => 2, <<"c">> => 3 },
-    ?assert(match(Msg1, Msg2, only_present)),
-    ?assert(not match(Msg2, Msg1, strict)),
-    ?assert(match(Msg1, Msg3, primary)),
-    ?assert(not match(Msg3, Msg1, primary)).
-
-basic_map_codec_test(Codec) ->
-    Msg = #{ <<"normal_key">> => <<"NORMAL_VALUE">> },
-    Encoded = convert(Msg, Codec, <<"structured@1.0">>, #{}),
-    ?event({encoded, Encoded}),
-    Decoded = convert(Encoded, <<"structured@1.0">>, Codec, #{}),
-    ?event({decoded, Decoded}),
-    ?assert(hb_message:match(Msg, Decoded)).
-
-set_body_codec_test(Codec) ->
-    Msg = #{ <<"body">> => <<"NORMAL_VALUE">>, <<"test-key">> => <<"Test-Value">> },
-    Encoded = convert(Msg, Codec, <<"structured@1.0">>, #{}),
-    Decoded = convert(Encoded, <<"structured@1.0">>, Codec, #{}),
-    ?assert(hb_message:match(Msg, Decoded)).
-
-%% @doc Test that we can convert a message into a tx record and back.
-single_layer_message_to_encoding_test(Codec) ->
-    Msg = #{
-        <<"last_tx">> => << 2:256 >>,
-        <<"owner">> => << 3:4096 >>,
-        <<"target">> => << 4:256 >>,
-        <<"data">> => <<"DATA">>,
-        <<"special-key">> => <<"SPECIAL_VALUE">>
-    },
-    Encoded = convert(Msg, Codec, <<"structured@1.0">>, #{}),
-    Decoded = convert(Encoded, <<"structured@1.0">>, Codec, #{}),
-    ?assert(hb_message:match(Msg, Decoded)).
-
-signed_only_committed_data_field_test(Codec) ->
-    Msg = commit(#{ <<"data">> => <<"DATA">> }, hb:wallet(), Codec),
-    ?event({signed_msg, Msg}),
-    {ok, OnlyCommitted} = with_only_committed(Msg),
-    ?event({only_committed, OnlyCommitted}),
-    ?assert(verify(OnlyCommitted)).
-
-signed_nested_data_key_test(Codec) ->
-    Msg = #{
-        <<"layer">> => <<"outer">>,
-        <<"body">> =>
-            commit(
-                #{
-                    <<"layer">> => <<"inner">>,
-                    <<"data">> => <<"DATA">>
-                },
-                #{ priv_wallet => hb:wallet() },
-                Codec
-            )
-    },
-    Encoded = convert(Msg, Codec, #{}),
-    Decoded = convert(Encoded, <<"structured@1.0">>, Codec, #{}),
-    ?assert(hb_message:match(Msg, Decoded)).
-
-% %% @doc Test that different key encodings are converted to their corresponding
-% %% TX fields.
-% key_encodings_to_tx_test() ->
-%     Msg = #{
-%         <<"last_tx">> => << 2:256 >>,
-%         <<"owner">> => << 3:4096 >>,
-%         <<"target">> => << 4:256 >>
-%     },
-%     TX = message_to_tx(Msg),
-%     ?event({key_encodings_to_tx, {msg, Msg}, {tx, TX}}),
-%     ?assertEqual(maps:get(<<"last_tx">>, Msg), TX#tx.last_tx),
-%     ?assertEqual(maps:get(<<"owner">>, Msg), TX#tx.owner),
-%     ?assertEqual(maps:get(<<"target">>, Msg), TX#tx.target).
-
-%% @doc Test that the message matching function works.
-match_test(Codec) ->
-    Msg = #{ <<"a">> => 1, <<"b">> => 2 },
-    Encoded = convert(Msg, Codec, #{}),
-    Decoded = convert(Encoded, <<"structured@1.0">>, Codec, #{}),
-    ?assert(match(Msg, Decoded)).
-
-binary_to_binary_test(<<"flat@1.0">>) -> ok;
-binary_to_binary_test(Codec) ->
-    % Serialization must be able to turn a raw binary into a TX, then turn
-    % that TX back into a binary and have the result match the original.
-    Bin = <<"THIS IS A BINARY, NOT A NORMAL MESSAGE">>,
-    Encoded = convert(Bin, Codec, #{}),
-    Decoded = convert(Encoded, <<"structured@1.0">>, Codec, #{}),
-    ?assertEqual(Bin, Decoded).
-
-%% @doc Structured field parsing tests.
-structured_field_atom_parsing_test(Codec) ->
-    Msg = #{ highly_unusual_http_header => highly_unusual_value },
-    Encoded = convert(Msg, Codec, #{}),
-    Decoded = convert(Encoded, <<"structured@1.0">>, Codec, #{}),
-    ?assert(match(Msg, Decoded)).
-
-structured_field_decimal_parsing_test(Codec) ->
-    Msg = #{ integer_field => 1234567890 },
-    Encoded = convert(Msg, Codec, #{}),
-    Decoded = convert(Encoded, <<"structured@1.0">>, Codec, #{}),
-    ?assert(match(Msg, Decoded)).
-
-%% @doc Test that the data field is correctly managed when we have multiple
-%% uses for it (the 'data' key itself, as well as keys that cannot fit in
-%% tags).
-message_with_large_keys_test(Codec) ->
-    Msg = #{
-        <<"normal_key">> => <<"normal_value">>,
-        <<"large_key">> => << 0:((1 + 1024) * 8) >>,
-        <<"another_large_key">> => << 0:((1 + 1024) * 8) >>,
-        <<"another_normal_key">> => <<"another_normal_value">>
-    },
-    Encoded = convert(Msg, Codec, #{}),
-    Decoded = convert(Encoded, <<"structured@1.0">>, Codec, #{}),
-    ?assert(match(Msg, Decoded)).
-
-%% @doc Check that large keys and data fields are correctly handled together.
-nested_message_with_large_keys_and_content_test(Codec) ->
-    MainBodyKey =
-        case Codec of
-            <<"ans104@1.0">> -> <<"data">>;
-            _ -> <<"body">>
-        end,
-    Msg = #{
-        <<"normal_key">> => <<"normal_value">>,
-        <<"large_key">> => << 0:(1024 * 16) >>,
-        <<"another_large_key">> => << 0:(1024 * 16) >>,
-        <<"another_normal_key">> => <<"another_normal_value">>,
-        MainBodyKey => <<"Hey from the data field!">>
-    },
-    Encoded = convert(Msg, Codec, #{}),
-    Decoded = convert(Encoded, <<"structured@1.0">>, Codec, #{}),
-    ?event({matching, {input, Msg}, {output, Decoded}}),
-    ?assert(match(Msg, Decoded)).
-
-simple_nested_message_test(Codec) ->
-    Msg = #{
-        <<"a">> => <<"1">>,
-        <<"nested">> => #{ <<"b">> => <<"1">> },
-        <<"c">> => <<"3">>
-    },
-    Encoded = convert(Msg, Codec, #{}),
-    Decoded = convert(Encoded, <<"structured@1.0">>, Codec, #{}),
-    ?event({matching, {input, Msg}, {output, Decoded}}),
-    ?assert(
-        match(
-            Msg,
-            Decoded
-        )
-    ).
-
-nested_empty_map_test(Codec) ->
-    Msg = #{ <<"body">> => #{ <<"empty-map-test">> => #{}}},
-    Encoded = convert(Msg, Codec, #{}),
-    ?event({encoded, Encoded}),
-    Decoded = convert(Encoded, <<"structured@1.0">>, Codec, #{}),
-    ?event({decoded, Decoded}),
-    ?assert(match(Msg, Decoded)).
-
-%% @doc Test that the data field is correctly managed when we have multiple
-%% uses for it (the 'data' key itself, as well as keys that cannot fit in
-%% tags).
-nested_message_with_large_content_test(Codec) ->
-    MainBodyKey =
-        case Codec of
-            <<"ans104@1.0">> -> <<"data">>;
-            _ -> <<"body">>
-        end,
-    Msg = #{
-        <<"depth">> => <<"outer">>,
-        MainBodyKey => #{
-            <<"map_item">> =>
-                #{
-                    <<"depth">> => <<"inner">>,
-                    <<"large_data_inner">> => << 0:((1 + 1024) * 8) >>
-                },
-            <<"large_data_outer">> => << 0:((1 + 1024) * 8) >>
-        }
-    },
-    Encoded = convert(Msg, Codec, #{}),
-    ?event({encoded, Encoded}),
-    Decoded = convert(Encoded, <<"structured@1.0">>, Codec, #{}),
-    ?event({decoded, Decoded}),
-    ?assert(match(Msg, Decoded)).
-
-%% @doc Test that we can convert a 3 layer nested message into a tx record and back.
-deeply_nested_message_with_content_test(Codec) ->
-    MainBodyKey =
-        case Codec of
-            <<"ans104@1.0">> -> <<"data">>;
-            _ -> <<"body">>
-        end,
-    Msg = #{
-        <<"depth">> => <<"outer">>,
-        MainBodyKey => #{
-            <<"map_item">> =>
-                #{
-                    <<"depth">> => <<"inner">>,
-                    MainBodyKey => #{
-                        <<"depth">> => <<"innermost">>,
-                        MainBodyKey => <<"DATA">>
-                    }
-                }
-        }
-    },
-    Encoded = convert(Msg, Codec, #{}),
-    Decoded = convert(Encoded, <<"structured@1.0">>, Codec, #{}),
-    ?assert(match(Msg, Decoded)).
-
-deeply_nested_message_with_only_content(Codec) ->
-    MainBodyKey =
-        case Codec of
-            <<"ans104@1.0">> -> <<"data">>;
-            _ -> <<"body">>
-        end,
-    Msg = #{
-        <<"depth1">> => <<"outer">>,
-        MainBodyKey => #{
-            MainBodyKey => #{
-                MainBodyKey => <<"depth2-body">>
-            }
-        }
-    },
-    Encoded = convert(Msg, Codec, #{}),
-    ?event({encoded, Encoded}),
-    Decoded = convert(Encoded, <<"structured@1.0">>, Codec, #{}),
-    ?event({decoded, Decoded}),
-    ?assert(match(Msg, Decoded)).
-
-nested_structured_fields_test(Codec) ->
-    NestedMsg = #{ <<"a">> => #{ <<"b">> => 1 } },
-    Encoded = convert(NestedMsg, Codec, #{}),
-    Decoded = convert(Encoded, <<"structured@1.0">>, Codec, #{}),
-    ?assert(match(NestedMsg, Decoded)).
-
-nested_message_with_large_keys_test(Codec) ->
-    Msg = #{
-        <<"a">> => <<"1">>,
-        <<"long_data">> => << 0:((1 + 1024) * 8) >>,
-        <<"nested">> => #{ <<"b">> => <<"1">> },
-        <<"c">> => <<"3">>
-    },
-    Encoded = convert(Msg, Codec, #{}),
-    Decoded = convert(Encoded, <<"structured@1.0">>, Codec, #{}),
-    ?assert(match(Msg, Decoded)).
-
-signed_message_encode_decode_verify_test(Codec) ->
-    Msg = #{
-        <<"test-data">> => <<"TEST DATA">>,
-        <<"test-key">> => <<"TEST VALUE">>
-    },
-    {ok, SignedMsg} =
-        dev_message:commit(
-            Msg,
-            #{ <<"commitment-device">> => Codec },
-            #{ priv_wallet => hb:wallet() }
-        ),
-    ?event({signed_msg, SignedMsg}),
-    ?assertEqual(true, verify(SignedMsg)),
-    ?event({verified, SignedMsg}),
-    Encoded = convert(SignedMsg, Codec, #{}),
-    ?event({msg_encoded_as_codec, Encoded}),
-    Decoded = convert(Encoded, <<"structured@1.0">>, Codec, #{}),
-    ?event({decoded, Decoded}),
-    ?assertEqual(true, verify(Decoded)),
-    ?assert(match(SignedMsg, Decoded)).
-
-complex_signed_message_test(Codec) ->
-    Msg = #{
-        <<"data">> => <<"TEST_DATA">>,
-        <<"deep_data">> => #{
-            <<"data">> => <<"DEEP_DATA">>,
-            <<"complex_key">> => 1337,
-            <<"list">> => [1,2,3]
-        }
-    },
-    {ok, SignedMsg} =
-        dev_message:commit(
-            Msg,
-            #{ <<"commitment-device">> => Codec },
-            #{ priv_wallet => hb:wallet() }
-        ),
-    Encoded = convert(SignedMsg, Codec, #{}),
-    ?event({encoded, Encoded}),
-    Decoded = convert(Encoded, <<"structured@1.0">>, Codec, #{}),
-    ?event({decoded, Decoded}),
-    ?assertEqual(true, verify(Decoded)),
-    ?assert(match(SignedMsg, Decoded)).
-
-% multisignature_test(Codec) ->
-%     Wallet1 = ar_wallet:new(),
-%     Wallet2 = ar_wallet:new(),
-%     Msg = #{
-%         <<"data">> => <<"TEST_DATA">>,
-%         <<"test_key">> => <<"TEST_VALUE">>
-%     },
-%     {ok, SignedMsg} =
-%         dev_message:commit(
-%             Msg,
-%             #{ <<"commitment-device">> => Codec },
-%             #{ priv_wallet => Wallet1 }
-%         ),
-%     ?event({signed_msg, SignedMsg}),
-%     {ok, MsgSignedTwice} =
-%         dev_message:commit(
-%             SignedMsg,
-%             #{ <<"commitment-device">> => Codec },
-%             #{ priv_wallet => Wallet2 }
-%         ),
-%     ?event({signed_msg_twice, MsgSignedTwice}),
-%     ?assert(verify(MsgSignedTwice)),
-%     {ok, Committers} = dev_message:committers(MsgSignedTwice),
-%     ?event({committers, Committers}),
-%     ?assert(lists:member(hb_util:human_id(ar_wallet:to_address(Wallet1)), Committers)),
-%     ?assert(lists:member(hb_util:human_id(ar_wallet:to_address(Wallet2)), Committers)).
-
-deep_multisignature_test() ->
-    % Only the `httpsig@1.0' codec supports multisignatures.
-    Codec = <<"httpsig@1.0">>,
-    Wallet1 = ar_wallet:new(),
-    Wallet2 = ar_wallet:new(),
-    Msg = #{
-        <<"data">> => <<"TEST_DATA">>,
-        <<"test_key">> => <<"TEST_VALUE">>,
-        <<"body">> => #{
-            <<"nested_key">> => <<"NESTED_VALUE">>
-        }
-    },
-    {ok, SignedMsg} =
-        dev_message:commit(
-            Msg,
-            #{ <<"commitment-device">> => Codec },
-            #{ priv_wallet => Wallet1 }
-        ),
-    ?event({signed_msg, SignedMsg}),
-    {ok, MsgSignedTwice} =
-        dev_message:commit(
-            SignedMsg,
-            #{ <<"commitment-device">> => Codec },
-            #{ priv_wallet => Wallet2 }
-        ),
-    ?event({signed_msg_twice, MsgSignedTwice}),
-    ?assert(verify(MsgSignedTwice)),
-    Committers = hb_message:signers(MsgSignedTwice),
-    ?event({committers, Committers}),
-    ?assert(lists:member(hb_util:human_id(ar_wallet:to_address(Wallet1)), Committers)),
-    ?assert(lists:member(hb_util:human_id(ar_wallet:to_address(Wallet2)), Committers)).
-
-tabm_ao_ids_equal_test(Codec) ->
-    Msg = #{
-        <<"data">> => <<"TEST_DATA">>,
-        <<"deep_data">> => #{
-            <<"data">> => <<"DEEP_DATA">>,
-            <<"complex_key">> => 1337,
-            <<"list">> => [1,2,3]
-        }
-    },
-    Encoded = convert(Msg, Codec, #{}),
-    ?event({encoded, Encoded}),
-    Decoded = convert(Encoded, <<"structured@1.0">>, Codec, #{}),
-    ?event({decoded, Decoded}),
-    ?assertEqual(
-        dev_message:id(Msg, #{ <<"committers">> => <<"none">>}, #{}),
-        dev_message:id(Decoded, #{ <<"committers">> => <<"none">>}, #{})
-    ).
-
-signed_deep_message_test(Codec) ->
-    Msg = #{
-        <<"test_key">> => <<"TEST_VALUE">>,
-        <<"body">> => #{
-            <<"nested_key">> =>
-                #{
-                    <<"body">> => <<"NESTED_DATA">>,
-                    <<"nested_key">> => <<"NESTED_VALUE">>
-                },
-            <<"nested_key2">> => <<"NESTED_VALUE2">>
-        }
-    },
-    EncDec = convert(convert(Msg, Codec, #{}), <<"structured@1.0">>, Codec, #{}),
-    ?event({enc_dec, EncDec}),
-    {ok, SignedMsg} =
-        dev_message:commit(
-            EncDec,
-            #{ <<"commitment-device">> => Codec },
-            #{ priv_wallet => hb:wallet() }
-        ),
-    ?event({signed_msg, SignedMsg}),
-    {ok, Res} = dev_message:verify(SignedMsg, #{ <<"committers">> => <<"all">>}, #{}),
-    ?event({verify_res, Res}),
-    ?assertEqual(true, verify(SignedMsg)),
-    ?event({verified, SignedMsg}),
-    Encoded = convert(SignedMsg, Codec, #{}),
-    ?event({encoded, Encoded}),
-    Decoded = convert(Encoded, <<"structured@1.0">>, Codec, #{}),
-    ?event({decoded, Decoded}),
-    {ok, DecodedRes} = dev_message:verify(Decoded, #{ <<"committers">> => <<"all">>}, #{}),
-    ?event({verify_decoded_res, DecodedRes}),
-    ?assert(
-        match(
-            SignedMsg,
-            Decoded
-        )
-    ).
-
-signed_list_test(Codec) ->
-    Msg = #{ <<"key-with-list">> => [1.0, 2.0, 3.0] },
-    Signed = commit(Msg, hb:wallet(), Codec),
-    ?assert(verify(Signed)),
-    Encoded = convert(Signed, Codec, #{}),
-    ?event({encoded, Encoded}),
-    Decoded = convert(Encoded, <<"structured@1.0">>, Codec, #{}),
-    ?event({decoded, Decoded}),
-    ?assert(verify(Decoded)),
-    ?assert(match(Signed, Decoded)).
-
-unsigned_id_test(Codec) ->
-    Msg = #{ <<"data">> => <<"TEST_DATA">> },
-    Encoded = convert(Msg, Codec, #{}),
-    Decoded = convert(Encoded, <<"structured@1.0">>, Codec, #{}),
-    ?assertEqual(
-        dev_message:id(Decoded, #{ <<"committers">> => <<"none">>}, #{}),
-        dev_message:id(Msg, #{ <<"committers">> => <<"none">>}, #{})
-    ).
-
-% signed_id_test_disabled() ->
-%     TX = #tx {
-%         data = <<"TEST_DATA">>,
-%         tags = [{<<"TEST_KEY">>, <<"TEST_VALUE">>}]
-%     },
-%     SignedTX = ar_bundles:sign_item(TX, hb:wallet()),
-%     ?assert(ar_bundles:verify_item(SignedTX)),
-%     SignedMsg = hb_codec_tx:from(SignedTX),
-%     ?assertEqual(
-%         hb_util:encode(ar_bundles:id(SignedTX, signed)),
-%         hb_util:id(SignedMsg, signed)
-%     ).
-
-message_with_simple_embedded_list_test(Codec) ->
-    Msg = #{ <<"a">> => [<<"1">>, <<"2">>, <<"3">>] },
-    Encoded = convert(Msg, Codec, #{}),
-    Decoded = convert(Encoded, <<"structured@1.0">>, Codec, #{}),
-    ?assert(match(Msg, Decoded)).
-
-empty_string_in_tag_test(Codec) ->
-    Msg =
-        #{
-            dev =>
-                #{
-                    <<"stderr">> => <<"">>,
-                    <<"stdin">> => <<"b">>,
-                    <<"stdout">> => <<"c">>
-                }
-        },
-    Encoded = convert(Msg, Codec, #{}),
-    Decoded = convert(Encoded, <<"structured@1.0">>, Codec, #{}),
-    ?assert(match(Msg, Decoded)).
-
-hashpath_sign_verify_test(Codec) ->
-    Msg =
-        #{
-            <<"test_key">> => <<"TEST_VALUE">>,
-            <<"body">> => #{
-                <<"nested_key">> =>
-                    #{
-                        <<"body">> => <<"NESTED_DATA">>,
-                        <<"nested_key">> => <<"NESTED_VALUE">>
-                    },
-                <<"nested_key2">> => <<"NESTED_VALUE2">>
-            },
-            <<"priv">> => #{
-                <<"hashpath">> =>
-                    hb_path:hashpath(
-                        hb_util:human_id(crypto:strong_rand_bytes(32)),
-                        hb_util:human_id(crypto:strong_rand_bytes(32)),
-                        fun hb_crypto:sha256_chain/2,
-                        #{}
-                    )
-            }
-        },
-    ?event({msg, {explicit, Msg}}),
-    SignedMsg = commit(Msg, hb:wallet(), Codec),
-    ?event({signed_msg, {explicit, SignedMsg}}),
-    {ok, Res} = dev_message:verify(SignedMsg, #{ <<"committers">> => <<"all">>}, #{}),
-    ?event({verify_res, {explicit, Res}}),
-    ?assert(verify(SignedMsg)),
-    ?event({verified, {explicit, SignedMsg}}),
-    Encoded = convert(SignedMsg, Codec, #{}),
-    ?event({encoded, Encoded}),
-    Decoded = convert(Encoded, <<"structured@1.0">>, Codec, #{}),
-    ?event({decoded, Decoded}),
-    ?assert(verify(Decoded)),
-    ?assert(
-        match(
-            SignedMsg,
-            Decoded
-        )
-    ).
-
-signed_message_with_derived_components_test(Codec) ->
-    Msg = #{
-        <<"path">> => <<"/test">>,
-        <<"authority">> => <<"example.com">>,
-        <<"scheme">> => <<"https">>,
-        <<"method">> => <<"GET">>,
-        <<"target-uri">> => <<"/test">>,
-        <<"request-target">> => <<"/test">>,
-        <<"status">> => <<"200">>,
-        <<"reason-phrase">> => <<"OK">>,
-        <<"body">> => <<"TEST_DATA">>,
-        <<"content-digest">> => <<"TEST_DIGEST">>,
-        <<"normal">> => <<"hello">>
-    },
-    {ok, SignedMsg} =
-        dev_message:commit(
-            Msg,
-            #{ <<"commitment-device">> => Codec },
-            #{ priv_wallet => hb:wallet() }
-        ),
-    ?event({signed_msg, SignedMsg}),
-    ?assert(verify(SignedMsg)),
-    Encoded = convert(SignedMsg, Codec, #{}),
-    ?event({encoded, Encoded}),
-    Decoded = convert(Encoded, <<"structured@1.0">>, Codec, #{}),
-    ?event({decoded, Decoded}),
-    ?assert(verify(Decoded)),
-    ?assert(match(SignedMsg, Decoded)).
-
-committed_keys_test(Codec) ->
-    Msg = #{ <<"a">> => 1, <<"b">> => 2, <<"c">> => 3 },
-    Signed = commit(Msg, hb:wallet(), Codec),
-    CommittedKeys = committed(Signed),
-    ?event({committed_keys, CommittedKeys}),
-    ?assert(verify(Signed)),
-    ?assert(lists:member(<<"a">>, CommittedKeys)),
-    ?assert(lists:member(<<"b">>, CommittedKeys)),
-    ?assert(lists:member(<<"c">>, CommittedKeys)),
-    MsgToFilter = Signed#{ <<"bad-key">> => <<"BAD VALUE">> },
-    ?assert(not lists:member(<<"bad-key">>, committed(MsgToFilter))).
-
-committed_empty_keys_test(Codec) ->
-    Msg = #{
-        <<"very">> => <<>>,
-        <<"exciting">> => #{},
-        <<"values">> => [],
-        <<"non-empty">> => <<"TEST">>
-    },
-    Signed = commit(Msg, hb:wallet(), Codec),
-    ?assert(verify(Signed)),
-    CommittedKeys = committed(Signed),
-    ?event({committed_keys, CommittedKeys}),
-    ?assert(lists:member(<<"very">>, CommittedKeys)),
-    ?assert(lists:member(<<"exciting">>, CommittedKeys)),
-    ?assert(lists:member(<<"values">>, CommittedKeys)),
-    ?assert(lists:member(<<"non-empty">>, CommittedKeys)).
-
-deeply_nested_committed_keys_test() ->
-    Msg = #{
-        <<"a">> => 1,
-        <<"b">> => #{ <<"c">> => #{ <<"d">> => <<0:((1 + 1024) * 1024)>> } },
-        <<"e">> => <<0:((1 + 1024) * 1024)>>
-    },
-    Signed = commit(Msg, hb:wallet()),
-    {ok, WithOnlyCommitted} = with_only_committed(Signed),
-    ?event({with_only_committed, WithOnlyCommitted}),
-    ?assert(
-        match(
-            Msg,
-            maps:without([<<"commitments">>], WithOnlyCommitted)
-        )
-    ).
-
-signed_with_inner_signed_message_test(Codec) ->
-    Wallet = hb:wallet(),
-    Msg = commit(#{
-        <<"a">> => 1,
-        <<"inner">> =>
-            maps:merge(
-                commit(
-                    #{
-                        <<"c">> => <<"abc">>,
-                        <<"e">> => 5
-                    },
-                    Wallet,
-                    Codec
-                ),
-                % Uncommitted keys that should be ripped out of the inner message
-                % by `with_only_committed'. These should still be present in the
-                % `with_only_committed' outer message. For now, only `httpsig@1.0'
-                % supports stripping non-committed keys.
-                case Codec of
-                    <<"httpsig@1.0">> ->
-                        #{
-                            <<"f">> => 6,
-                            <<"g">> => 7
-                        };
-                    _ -> #{}
-                end
-            )
-    }, Wallet, Codec),
-    ?event({initial_msg, Msg}),
-    % 1. Verify the outer message without changes.
-    ?assert(verify(Msg)),
-    {ok, CommittedInner} = with_only_committed(maps:get(<<"inner">>, Msg)),
-    ?event({committed_inner, CommittedInner}),
-    ?event({inner_committers, hb_message:signers(CommittedInner)}),
-    % 2. Verify the inner message without changes.
-    ?assert(verify(CommittedInner, signers)),
-    % 3. Convert the message to the format and back.
-    Encoded = convert(Msg, Codec, #{}),
-    ?event({encoded, Encoded}),
-    %?event({encoded_body, {string, maps:get(<<"body">>, Encoded)}}, #{}),
-    Decoded = convert(Encoded, <<"structured@1.0">>, Codec, #{}),
-    ?event({decoded, Decoded}),
-    % 4. Verify the outer message after decode.
-    ?assert(match(Msg, Decoded)),
-    ?assert(verify(Decoded)),
-    % 5. Verify the inner message from the converted message, applying
-    % `with_only_committed' first.
-    InnerDecoded = maps:get(<<"inner">>, Decoded),
-    ?event({inner_decoded, InnerDecoded}),
-    % Applying `with_only_committed' should verify the inner message.
-    {ok, CommittedInnerOnly} = with_only_committed(InnerDecoded),
-    ?event({committed_inner_only, CommittedInnerOnly}),
-    ?assert(verify(CommittedInnerOnly, signers)).
-
-large_body_committed_keys_test(Codec) ->
-    case Codec of
-        <<"httpsig@1.0">> ->
-            Msg = #{
-                <<"a">> => 1,
-                <<"b">> => 2,
-                <<"c">> => #{ <<"d">> => << 1:((1 + 1024) * 1024) >> }
-            },
-            Encoded = convert(Msg, Codec, #{}),
-            ?event({encoded, Encoded}),
-            Decoded = convert(Encoded, <<"structured@1.0">>, Codec, #{}),
-            ?event({decoded, Decoded}),
-            Signed = commit(Decoded, hb:wallet(), Codec),
-            ?event({signed, Signed}),
-            CommittedKeys = committed(Signed),
-            ?assert(lists:member(<<"a">>, CommittedKeys)),
-            ?assert(lists:member(<<"b">>, CommittedKeys)),
-            ?assert(lists:member(<<"c">>, CommittedKeys)),
-            MsgToFilter = Signed#{ <<"bad-key">> => <<"BAD VALUE">> },
-            ?assert(not lists:member(<<"bad-key">>, committed(MsgToFilter)));
-        _ ->
-            skip
-    end.
-
-sign_node_message_test(Codec) ->
-    Msg = hb_message:commit(hb_opts:default_message(), hb:wallet(), Codec),
-    ?event({committed, Msg}),
-    ?assert(verify(Msg)),
-    Encoded = convert(Msg, Codec, #{}),
-    ?event({encoded, Encoded}),
-    Decoded = convert(Encoded, <<"structured@1.0">>, Codec, #{}),
-    ?event({decoded, Decoded}),
-    ?assert(match(Msg, Decoded)),
-    ?assert(verify(Decoded)).
-
-nested_body_list_test(Codec) ->
-    Msg = #{
-        <<"body">> =>
-            [
-                #{
-                    <<"test-key">> =>
-                        <<"TEST VALUE #", (integer_to_binary(X))/binary>>
-                }
-            ||
-                X <- lists:seq(1, 3)
-            ]
-    },
-    Encoded = convert(Msg, Codec, #{}),
-    ?event(encoded, {encoded, Encoded}),
-    Decoded = convert(Encoded, <<"structured@1.0">>, Codec, #{}),
-    ?event({decoded, Decoded}),
-    ?assert(match(Msg, Decoded)).
-
-recursive_nested_list_test(Codec) ->
-    % This test is to ensure that the codec can handle arbitrarily deep nested
-    % lists.
-    Msg = #{
-        <<"body">> =>
-            [
-                [
-                    [
-                        <<
-                            "TEST VALUE #",
-                            (integer_to_binary(X))/binary,
-                            "-",
-                            (integer_to_binary(Y))/binary,
-                            "-",
-                            (integer_to_binary(Z))/binary
-                        >>
-                    ||
-                        Z <- lists:seq(1, 3)
-                    ]
-                ||
-                    Y <- lists:seq(1, 3)
-                ]
-            ||
-                X <- lists:seq(1, 3)
-            ]
-    },
-    Encoded = convert(Msg, Codec, #{}),
-    ?event(encoded, {encoded, Encoded}),
-    Decoded = convert(Encoded, <<"structured@1.0">>, Codec, #{}),
-    ?event({decoded, Decoded}),
-    ?assert(match(Msg, Decoded)).
-
-priv_survives_conversion_test(<<"ans104@1.0">>) -> skip;
-priv_survives_conversion_test(<<"json@1.0">>) -> skip;
-priv_survives_conversion_test(Codec) ->
-    Msg = #{
-        <<"data">> => <<"TEST_DATA">>,
-        <<"priv">> => #{ <<"test_key">> => <<"TEST_VALUE">> }
-    },
-    Encoded = convert(Msg, Codec, #{}),
-    ?event({encoded, Encoded}),
-    Decoded = convert(Encoded, <<"structured@1.0">>, Codec, #{}),
-    ?event({decoded, Decoded}),
-    ?assert(match(Msg, Decoded)),
-    ?assertMatch(
-        #{ <<"test_key">> := <<"TEST_VALUE">> },
-        maps:get(<<"priv">>, Decoded, #{})
-    ).
-
-encode_balance_table(Size, Codec) ->
-    Msg =
-        #{
-            hb_util:encode(crypto:strong_rand_bytes(32)) =>
-                rand:uniform(1_000_000_000_000_000)
-        ||
-            _ <- lists:seq(1, Size)
-        },
-    Encoded = convert(Msg, Codec, #{}),
-    ?event(debug, {encoded, {explicit, Encoded}}),
-    Decoded = convert(Encoded, <<"structured@1.0">>, Codec, #{}),
-    ?event(debug, {decoded, Decoded}),
-    ?assert(match(Msg, Decoded)).
-
-encode_small_balance_table_test(Codec) ->
-    encode_balance_table(5, Codec).
-
-encode_large_balance_table_test(Codec) ->
-    encode_balance_table(1000, Codec).
-
-%%% Test helpers
-
-test_codecs() ->
-    [
-        <<"structured@1.0">>,
-        <<"httpsig@1.0">>,
-        <<"flat@1.0">>,
-        <<"ans104@1.0">>,
-        <<"json@1.0">>
-    ].
-
-generate_test_suite(Suite) ->
-    lists:map(
-        fun(CodecName) ->
-            {foreach,
-                fun() -> ok end,
-                fun(_) -> ok end,
-                [
-                    {
-                        << CodecName/binary, ": ", (list_to_binary(Desc))/binary >>,
-                        fun() -> Test(CodecName) end
-                    }
-                ||
-                    {Desc, Test} <- Suite
-                ]
-            }
-        end,
-        test_codecs()
-    ).
-
-message_suite_test_() ->
-    generate_test_suite([
-        {"basic map codec test", fun basic_map_codec_test/1},
-        {"set body codec test", fun set_body_codec_test/1},
-        {"match test", fun match_test/1},
-        {"single layer message to encoding test",
-            fun single_layer_message_to_encoding_test/1},
-        {"TABM AO-Core ids equal test", fun tabm_ao_ids_equal_test/1},
-        {"message with large keys test", fun message_with_large_keys_test/1},
-        {"nested message with large keys and content test",
-            fun nested_message_with_large_keys_and_content_test/1},
-        {"simple nested message test", fun simple_nested_message_test/1},
-        {"nested empty map test", fun nested_empty_map_test/1},
-        {"nested message with large content test",
-            fun nested_message_with_large_content_test/1},
-        {"deeply nested message with content test",
-            fun deeply_nested_message_with_content_test/1},
-        {"deeply nested message with only content test",
-            fun deeply_nested_message_with_only_content/1},
-        {"structured field atom parsing test",
-            fun structured_field_atom_parsing_test/1},
-        {"structured field decimal parsing test",
-            fun structured_field_decimal_parsing_test/1},
-        {"binary to binary test", fun binary_to_binary_test/1},
-        {"nested structured fields test", fun nested_structured_fields_test/1},
-        {"nested message with large keys test",
-            fun nested_message_with_large_keys_test/1},
-        {"message with simple embedded list test",
-            fun message_with_simple_embedded_list_test/1},
-        {"empty string in tag test", fun empty_string_in_tag_test/1},
-        {"signed item to message and back test",
-            fun signed_message_encode_decode_verify_test/1},
-        {"signed deep serialize and deserialize test",
-            fun signed_deep_message_test/1},
-        {"nested data key test", fun signed_nested_data_key_test/1},
-        {"signed only committed data field test", fun signed_only_committed_data_field_test/1},
-        {"unsigned id test", fun unsigned_id_test/1},
-        {"complex signed message test", fun complex_signed_message_test/1},
-        {"signed message with hashpath test", fun hashpath_sign_verify_test/1},
-        {"message with derived components test", fun signed_message_with_derived_components_test/1},
-        {"committed keys test", fun committed_keys_test/1},
-        {"committed empty keys test", fun committed_empty_keys_test/1},
-        {"large body committed keys test", fun large_body_committed_keys_test/1},
-        {"signed list http response test", fun signed_list_test/1},
-        {"signed with inner signed test", fun signed_with_inner_signed_message_test/1},
-        {"priv survives conversion test", fun priv_survives_conversion_test/1},
-        {"sign node message test", fun sign_node_message_test/1},
-        {"nested list test", fun nested_body_list_test/1},
-        {"recursive nested list test", fun recursive_nested_list_test/1},
-        {"encode small balance table test", fun encode_small_balance_table_test/1},
-        {"encode large balance table test", fun encode_large_balance_table_test/1}
-    ]).
-
-run_test() ->
-    encode_balance_table(1000, <<"httpsig@1.0">>).
\ No newline at end of file
+    lists:zip(Keys, tl(tuple_to_list(#tx{}))).
\ No newline at end of file
diff --git a/src/hb_message_test_vectors.erl b/src/hb_message_test_vectors.erl
new file mode 100644
index 000000000..4cab747d9
--- /dev/null
+++ b/src/hb_message_test_vectors.erl
@@ -0,0 +1,1604 @@
+%%% @doc A battery of test vectors for message codecs, implementing the 
+%%% `message@1.0' encoding and commitment APIs. Additionally, this module 
+%%% houses tests that ensure the general functioning of the `hb_message' API.
+-module(hb_message_test_vectors).
+-include_lib("eunit/include/eunit.hrl").
+-include("include/hb.hrl").
+
+%% @doc Test invocation function, making it easier to run a specific test.
+%% Disable/enable as needed.
+run_test() ->
+    hb:init(),
+    nested_structured_fields_test(
+        #{ <<"device">> => <<"json@1.0">>, <<"bundle">> => true },
+        test_opts(normal)
+    ).
+
+%% @doc Return a list of codecs to test. Disable these as necessary if you need
+%% to test the functionality of a single codec, etc.
+test_codecs() ->
+    [
+        <<"structured@1.0">>,
+        <<"httpsig@1.0">>,
+        #{ <<"device">> => <<"httpsig@1.0">>, <<"bundle">> => true },
+        <<"flat@1.0">>,
+        <<"ans104@1.0">>,
+        #{ <<"device">> => <<"ans104@1.0">>, <<"bundle">> => true },
+        <<"json@1.0">>,
+        #{ <<"device">> => <<"json@1.0">>, <<"bundle">> => true }
+    ].
+
+%% @doc Return a set of options for testing, taking the codec name as an
+%% argument. We do not presently use the codec name in the test, but we may
+%% wish to do so in the future.
+suite_test_opts() ->
+    [
+        #{
+            name => normal,
+            desc => <<"Default opts">>,
+            opts => test_opts(normal)
+        }
+    ].
+suite_test_opts(OptsName) ->
+    [ O || O = #{ name := OName } <- suite_test_opts(), OName == OptsName ].
+
+test_opts(normal) ->
+    #{
+        store => hb_test_utils:test_store(),
+        priv_wallet => hb:wallet()
+    }.
+ 
+test_suite() ->
+    [
+        % Basic operations
+        {<<"Binary to binary">>,
+            fun binary_to_binary_test/2},
+        {<<"Match">>,
+            fun match_test/2},
+        {<<"Basic message encoding and decoding">>,
+            fun basic_message_codec_test/2},
+        {<<"Priv survives conversion">>,
+            fun priv_survives_conversion_test/2},
+        {<<"Message with body">>,
+            fun set_body_codec_test/2},
+        {<<"Message with large keys">>,
+            fun message_with_large_keys_test/2},
+        {<<"Structured field atom parsing">>,
+            fun structured_field_atom_parsing_test/2},
+        {<<"Structured field decimal parsing">>,
+            fun structured_field_decimal_parsing_test/2},
+        {<<"Unsigned id">>,
+            fun unsigned_id_test/2},
+        % Nested structures
+        {<<"Simple nested message">>,
+            fun simple_nested_message_test/2},
+        {<<"Message with simple embedded list">>,
+            fun message_with_simple_embedded_list_test/2},
+        {<<"Nested empty map">>,
+            fun nested_empty_map_test/2},
+        {<<"Empty body">>,
+            fun empty_body_test/2},
+        {<<"Nested structured fields">>,
+            fun nested_structured_fields_test/2},
+        {<<"Single layer message to encoding">>,
+            fun single_layer_message_to_encoding_test/2},
+        {<<"Nested body list">>,
+            fun nested_body_list_test/2},
+        {<<"Empty string in nested tag">>,
+            fun empty_string_in_nested_tag_test/2},
+        {<<"Deep typed message ID">>,
+            fun deep_typed_message_id_test/2},
+        {<<"Encode small balance table">>,
+            fun encode_small_balance_table_test/2},
+        {<<"Encode large balance table">>,
+            fun encode_large_balance_table_test/2},
+        {<<"Normalize commitments">>,
+            fun normalize_commitments_test/2},
+        % Signed messages
+        {<<"Signed message to message and back">>,
+            fun signed_message_encode_decode_verify_test/2},
+        {<<"Specific order signed message">>,
+            fun specific_order_signed_message_test/2},
+        {<<"Specific order deeply nested signed message">>,
+            fun specific_order_deeply_nested_signed_message_test/2},
+        {<<"Signed only committed data field">>,
+            fun signed_only_committed_data_field_test/2},
+        {<<"Signed simple nested message">>,
+            fun simple_signed_nested_message_test/2},
+        {<<"Signed nested message">>,
+            fun signed_nested_message_with_child_test/2},
+        {<<"Committed keys">>,
+            fun committed_keys_test/2},
+        {<<"Committed empty keys">>,
+            fun committed_empty_keys_test/2},
+        {<<"Signed list HTTP response">>,
+            fun signed_list_test/2},
+        {<<"Sign node message">>,
+            fun sign_node_message_test/2},
+        {<<"Complex signed message">>,
+            fun complex_signed_message_test/2},
+        {<<"Nested message with large keys">>,
+            fun nested_message_with_large_keys_test/2},
+        {<<"Signed nested complex signed message">>,
+            fun verify_nested_complex_signed_test/2},
+        % Complex structures
+        {<<"Nested message with large keys and content">>,
+            fun nested_message_with_large_keys_and_content_test/2},
+        {<<"Nested message with large content">>,
+            fun nested_message_with_large_content_test/2},
+        {<<"Deeply nested message with content">>,
+            fun deeply_nested_message_with_content_test/2},
+        {<<"Deeply nested message with only content">>,
+            fun deeply_nested_message_with_only_content/2},
+        {<<"Signed deep serialize and deserialize">>,
+            fun signed_deep_message_test/2},
+        {<<"Signed nested data key">>,
+            fun signed_nested_data_key_test/2},
+        {<<"Signed message with hashpath">>,
+            fun hashpath_sign_verify_test/2},
+        {<<"Message with derived components">>,
+            fun signed_message_with_derived_components_test/2},
+        {<<"Large body committed keys">>,
+            fun large_body_committed_keys_test/2},
+        {<<"Signed with inner signed">>,
+            fun signed_with_inner_signed_message_test/2},
+        {<<"Recursive nested list">>,
+            fun recursive_nested_list_test/2},
+        {<<"Sign links">>,
+            fun sign_links_test/2},
+        {<<"ID of linked message">>,
+            fun id_of_linked_message_test/2},
+        {<<"Sign deep message from lazy cache read">>,
+            fun sign_deep_message_from_lazy_cache_read_test/2},
+        {<<"ID of deep message and link message match">>,
+            fun id_of_deep_message_and_link_message_match_test/2},
+        {<<"Signed non-bundle is bundlable">>,
+            fun signed_non_bundle_is_bundlable_test/2},
+        {<<"Bundled ordering">>,
+            fun bundled_ordering_test/2},
+        {<<"Codec round-trip conversion is idempotent">>,
+            fun codec_roundtrip_conversion_is_idempotent_test/2},
+        {<<"Bundled and unbundled IDs differ">>,
+            fun bundled_and_unbundled_ids_differ_test/2},
+        {<<"Tabm conversion is idempotent">>,
+            fun tabm_conversion_is_idempotent_test/2}
+    ].
+
+%% @doc Organizes a test battery for the `hb_message' module and its codecs.
+suite_test_() ->
+    hb_test_utils:suite_with_opts(
+        codec_test_suite(
+            test_codecs(),
+            normal
+        ),
+        suite_test_opts(normal)
+    ).
+
+%% @doc Run the test suite for a set of codecs, using the given options type.
+%% Unlike normal `hb_test_utils:suite_with_opts/2' users, this suite generator
+%% creates a new options message for each individual test, such that stores 
+%% are completely isolated from each other.
+codec_test_suite(Codecs, OptsType) ->
+    lists:flatmap(
+        fun(CodecName) ->
+            lists:map(fun({Desc, Test}) ->
+                TestName =
+                    binary_to_list(
+                        << (suite_name(CodecName))/binary, ": ", Desc/binary >>
+                    ),
+                TestSpecificOpts = test_opts(OptsType),
+                {
+                    Desc,
+                    TestName,
+                    fun(_SuiteOpts) -> Test(CodecName, TestSpecificOpts) end
+                }
+            end, test_suite())
+        end,
+        Codecs
+    ).
+
+%% @doc Create a name for a suite from a codec spec.
+suite_name(CodecSpec) when is_binary(CodecSpec) -> CodecSpec;
+suite_name(CodecSpec) when is_map(CodecSpec) ->
+    CodecName = maps:get(<<"device">>, CodecSpec, <<"[! NO CODEC !]">>),
+    case maps:get(<<"bundle">>, CodecSpec, false) of
+        false -> CodecName;
+        true -> << CodecName/binary, " (bundle)">>
+    end.
+
+%%% Codec-specific/misc. tests
+
+%% @doc Tests a message transforming function to ensure that it is idempotent.
+%% Runs the conversion a total of 3 times, ensuring that the result remains
+%% unchanged. This function takes transformation functions that result in
+%% `{ok, Res}`-form messages, as well as bare message results.
+is_idempotent(Func, Msg, Opts) ->
+    Run = fun(M) -> case Func(M) of {ok, Res} -> Res; Res -> Res end end,
+    After1 = Run(Msg),
+    After2 = Run(After1),
+    After3 = Run(After2),
+    MatchRes1 = hb_message:match(After1, After2, strict, Opts),
+    MatchRes2 = hb_message:match(After2, After3, strict, Opts),
+    ?event({is_idempotent, {match_res1, MatchRes1}, {match_res2, MatchRes2}}),
+    MatchRes1 andalso MatchRes2.
+
+%% @doc Ensure that converting a message to/from TABM multiple times repeatedly 
+%% does not alter the message's contents.
+tabm_conversion_is_idempotent_test(_Codec, Opts) ->
+    From = fun(M) -> hb_message:convert(M, <<"structured@1.0">>, tabm, Opts) end,
+    To = fun(M) -> hb_message:convert(M, tabm, <<"structured@1.0">>, Opts) end,
+    SimpleMsg = #{ <<"a">> => <<"x">>, <<"b">> => <<"y">>, <<"c">> => <<"z">> },
+    ComplexMsg =
+        #{
+            <<"path">> => <<"schedule">>,
+            <<"method">> => <<"POST">>,
+            <<"body">> =>
+                    Signed = hb_message:commit(
+                        #{
+                            <<"type">> => <<"Message">>,
+                            <<"function">> => <<"fac">>,
+                            <<"parameters">> => #{
+                                <<"a">> => 1
+                            },
+                            <<"content-type">> => <<"application/html">>,
+                            <<"body">> =>
+                                <<
+                                    """
+                                    <html>
+                                    <h1>Hello, multiline message</h1>
+                                    </html>
+                                    """
+                                >>
+                        },
+                        Opts,
+                        <<"structured@1.0">>
+                    )
+            },
+    ?assert(is_idempotent(From, SimpleMsg, Opts)),
+    ?assert(is_idempotent(From, Signed, Opts)),
+    ?assert(is_idempotent(From, ComplexMsg, Opts)),
+    ?assert(is_idempotent(To, SimpleMsg, Opts)),
+    ?assert(is_idempotent(To, Signed, Opts)),
+    ?assert(is_idempotent(To, ComplexMsg, Opts)).
+
+%% @doc Ensure that converting a message to a codec, then back to TABM multiple
+%% times results in the same message being returned. This test differs from its
+%% TABM form, as it shuttles (`to-from-to-...`), while the TABM test repeatedly
+%% encodes in a single direction (`to->to->...`).
+codec_roundtrip_conversion_is_idempotent_test(Codec, Opts) ->
+    Roundtrip =
+        fun(M) ->
+            hb_message:convert(
+                hb_message:convert(M, Codec, <<"structured@1.0">>, Opts),
+                <<"structured@1.0">>,
+                Codec,
+                Opts
+            )
+        end,
+    SimpleMsg = #{ <<"a">> => <<"x">>, <<"b">> => <<"y">>, <<"c">> => <<"z">> },
+    ComplexMsg =
+        #{
+            <<"path">> => <<"schedule">>,
+            <<"method">> => <<"POST">>,
+            <<"body">> =>
+                    Signed = hb_message:commit(
+                        #{
+                            <<"type">> => <<"Message">>,
+                            <<"function">> => <<"fac">>,
+                            <<"parameters">> => #{
+                                <<"a">> => 1
+                            },
+                            <<"content-type">> => <<"application/html">>,
+                            <<"body">> =>
+                                <<
+                                    """
+                                    <html>
+                                    <h1>Hello, multiline message</h1>
+                                    </html>
+                                    """
+                                >>
+                        },
+                        Opts,
+                        Codec
+                    )
+            },
+    ?assert(is_idempotent(Roundtrip, SimpleMsg, Opts)),
+    ?assert(is_idempotent(Roundtrip, Signed, Opts)),
+    ?assert(is_idempotent(Roundtrip, ComplexMsg, Opts)).
+
+%% @doc Test that the filter_default_keys/1 function removes TX fields
+%% that have the default values found in the tx record, but not those that
+%% have been set by the user.
+default_keys_removed_test() ->
+    TX = #tx { unsigned_id = << 1:256 >>, anchor = << 2:256 >> },
+    TXMap = #{
+        <<"unsigned_id">> => TX#tx.unsigned_id,
+        <<"anchor">> => TX#tx.anchor,
+        <<"owner">> => TX#tx.owner,
+        <<"target">> => TX#tx.target,
+        <<"data">> => TX#tx.data
+    },
+    FilteredMap = hb_message:filter_default_keys(TXMap),
+    ?assertEqual(<< 1:256 >>, hb_maps:get(<<"unsigned_id">>, FilteredMap)),
+    ?assertEqual(<< 2:256 >>, hb_maps:get(<<"anchor">>, FilteredMap, not_found)),
+    ?assertEqual(not_found, hb_maps:get(<<"owner">>, FilteredMap, not_found)),
+    ?assertEqual(not_found, hb_maps:get(<<"target">>, FilteredMap, not_found)).
+
+minimization_test() ->
+    Msg = #{
+        <<"unsigned_id">> => << 1:256 >>,
+        <<"id">> => << 2:256 >>
+    },
+    MinimizedMsg = hb_message:minimize(Msg),
+    ?event({minimized, MinimizedMsg}),
+    ?assertEqual(1, hb_maps:size(MinimizedMsg)).
+
+match_modes_test() ->
+    Msg1 = #{ <<"a">> => 1, <<"b">> => 2 },
+    Msg2 = #{ <<"a">> => 1 },
+    Msg3 = #{ <<"a">> => 1, <<"b">> => 2, <<"c">> => 3 },
+    ?assert(hb_message:match(Msg1, Msg2, only_present)),
+    ?assert(hb_message:match(Msg2, Msg1, strict) =/= true),
+    ?assert(hb_message:match(Msg1, Msg3, primary)),
+    ?assert(hb_message:match(Msg3, Msg1, primary) =/= true).
+
+basic_message_codec_test(Codec, Opts) ->
+    Msg = #{ <<"normal_key">> => <<"NORMAL_VALUE">> },
+    Encoded = hb_message:convert(Msg, Codec, <<"structured@1.0">>, Opts),
+    ?event({encoded, Encoded}),
+    Decoded = hb_message:convert(Encoded, <<"structured@1.0">>, Codec, Opts),
+    ?event({decoded, Decoded}),
+    ?assert(hb_message:match(Msg, Decoded, strict, Opts)).
+
+set_body_codec_test(Codec, Opts) ->
+    Msg = #{ <<"body">> => <<"NORMAL_VALUE">>, <<"test-key">> => <<"Test-Value">> },
+    Encoded = hb_message:convert(Msg, Codec, <<"structured@1.0">>, Opts),
+    Decoded = hb_message:convert(Encoded, <<"structured@1.0">>, Codec, Opts),
+    ?assert(hb_message:match(Msg, Decoded, strict, Opts)).
+
+%% @doc Test that we can convert a message into a tx record and back.
+single_layer_message_to_encoding_test(Codec, Opts) ->
+    Msg = #{
+        <<"anchor">> => << 2:256 >>,
+        <<"target">> => << 4:256 >>,
+        <<"data">> => <<"DATA">>,
+        <<"special-key">> => <<"SPECIAL_VALUE">>
+    },
+    Encoded = hb_message:convert(Msg, Codec, <<"structured@1.0">>, Opts),
+    ?event({encoded, Encoded}),
+    Decoded = hb_message:convert(Encoded, <<"structured@1.0">>, Codec, Opts),
+    ?event({decoded, Decoded}),
+    ?event({matching, {input, Msg}, {output, Decoded}}),
+    MatchRes = hb_message:match(Msg, Decoded, strict, Opts),
+    ?event({match_result, MatchRes}),
+    ?assert(MatchRes).
+
+signed_only_committed_data_field_test(Codec, Opts) ->
+    Msg = hb_message:commit(#{ <<"data">> => <<"DATA">> }, Opts, Codec),
+    ?event({signed_msg, Msg}),
+    {ok, OnlyCommitted} = hb_message:with_only_committed(Msg, Opts),
+    ?event({only_committed, OnlyCommitted}),
+    Encoded = hb_message:convert(OnlyCommitted, Codec, <<"structured@1.0">>, Opts),
+    ?event({encoded, Encoded}),
+    Decoded = hb_message:convert(Encoded, <<"structured@1.0">>, Codec, Opts),
+    ?event({decoded, Decoded}),
+    MatchRes = hb_message:match(Msg, OnlyCommitted, strict, Opts),
+    ?event({match_result, MatchRes}),
+    ?assert(MatchRes),
+    ?assert(hb_message:verify(OnlyCommitted, all, Opts)).
+
+signed_nested_data_key_test(Codec, Opts) ->
+    Msg = 
+        #{
+            <<"outer-data">> => <<"outer">>,
+            <<"body">> =>
+                #{
+                    <<"inner-data">> => <<"inner">>,
+                    <<"data">> => <<"DATA">>
+                }
+        },
+    Signed = hb_message:commit(Msg, Opts, Codec),
+    ?event({signed, Signed}),
+    Encoded = hb_message:convert(Signed, Codec, <<"structured@1.0">>, Opts),
+    ?event({encoded, Encoded}),
+    Decoded = hb_message:convert(Encoded, <<"structured@1.0">>, Codec, Opts),
+    ?event({decoded, Decoded}),
+    LoadedMsg = hb_cache:ensure_all_loaded(Decoded, Opts),
+    ?event({matching, {input, Msg}, {output, LoadedMsg}}),
+    ?assert(hb_message:match(Msg, LoadedMsg, primary, Opts)).
+
+% %% @doc Test that different key encodings are converted to their corresponding
+% %% TX fields.
+% key_encodings_to_tx_test() ->
+%     Msg = #{
+%         <<"last_tx">> => << 2:256 >>,
+%         <<"owner">> => << 3:4096 >>,
+%         <<"target">> => << 4:256 >>
+%     },
+%     TX = message_to_tx(Msg),
+%     ?event({key_encodings_to_tx, {msg, Msg}, {tx, TX}}),
+%     ?assertEqual(hb_maps:get(<<"last_tx">>, Msg), TX#tx.last_tx),
+%     ?assertEqual(hb_maps:get(<<"owner">>, Msg), TX#tx.owner),
+%     ?assertEqual(hb_maps:get(<<"target">>, Msg), TX#tx.target).
+
+%% @doc Test that the message matching function works.
+match_test(Codec, Opts) ->
+    Msg = #{ <<"a">> => 1, <<"b">> => 2 },
+    Encoded = hb_message:convert(Msg, Codec, <<"structured@1.0">>, Opts),
+    ?event({encoded, Encoded}),
+    Decoded = hb_message:convert(Encoded, <<"structured@1.0">>, Codec, Opts),
+    ?event({decoded, Decoded}),
+    ?assert(hb_message:match(Msg, Decoded, strict, Opts)).
+
+binary_to_binary_test(Codec, Opts) ->
+    % Serialization must be able to turn a raw binary into a TX, then turn
+    % that TX back into a binary and have the result match the original.
+    Bin = <<"THIS IS A BINARY, NOT A NORMAL MESSAGE">>,
+    Encoded = hb_message:convert(Bin, Codec, <<"structured@1.0">>, Opts),
+    Decoded = hb_message:convert(Encoded, <<"structured@1.0">>, Codec, Opts),
+    ?assertEqual(Bin, Decoded).
+
+%% @doc Structured field parsing tests.
+structured_field_atom_parsing_test(Codec, Opts) ->
+    Msg = #{ highly_unusual_http_header => highly_unusual_value },
+    Encoded = hb_message:convert(Msg, Codec, <<"structured@1.0">>, Opts),
+    Decoded = hb_message:convert(Encoded, <<"structured@1.0">>, Codec, Opts),
+    ?assert(hb_message:match(Msg, Decoded, strict, Opts)).
+
+structured_field_decimal_parsing_test(Codec, Opts) ->
+    Msg = #{ integer_field => 1234567890 },
+    Encoded = hb_message:convert(Msg, Codec, <<"structured@1.0">>, Opts),
+    Decoded = hb_message:convert(Encoded, <<"structured@1.0">>, Codec, Opts),
+    ?assert(hb_message:match(Msg, Decoded, strict, Opts)).
+
+%% @doc Test that the data field is correctly managed when we have multiple
+%% uses for it (the 'data' key itself, as well as keys that cannot fit in
+%% tags).
+message_with_large_keys_test(Codec, Opts) ->
+    Msg = #{
+        <<"normal_key">> => <<"normal_value">>,
+        <<"large_key">> => << 0:((1 + 1024) * 8) >>,
+        <<"another_large_key">> => << 0:((1 + 1024) * 8) >>,
+        <<"another_normal_key">> => <<"another_normal_value">>
+    },
+    Encoded = hb_message:convert(Msg, Codec, <<"structured@1.0">>, Opts),
+    Decoded = hb_message:convert(Encoded, <<"structured@1.0">>, Codec, Opts),
+    ?assert(hb_message:match(Msg, Decoded, strict, Opts)).
+
+%% @doc Check that a nested signed message with an embedded typed list can 
+%% be further nested and signed. We then encode and decode the message. This
+%% tests a large portion of the complex type encodings that HyperBEAM uses
+%% together.
+verify_nested_complex_signed_test(Codec, Opts) ->
+    Msg =
+        hb_message:commit(#{
+            <<"path">> => <<"schedule">>,
+            <<"method">> => <<"POST">>,
+            <<"body">> =>
+                    Inner = hb_message:commit(
+                        #{
+                            <<"type">> => <<"Message">>,
+                            <<"function">> => <<"fac">>,
+                            <<"parameters">> => #{
+                                <<"a">> => 1
+                            },
+                            <<"content-type">> => <<"application/html">>,
+                            <<"body">> =>
+                                <<
+                                    """
+                                    <html>
+                                    <h1>Hello, multiline message</h1>
+                                    </html>
+                                    """
+                                >>
+                        },
+                        Opts,
+                        Codec
+                    )
+            },
+            Opts,
+            Codec
+        ),
+    ?event({signed, Msg}),
+    ?event({inner, Inner}),
+    % Ensure that the messages verify prior to conversion.
+    LoadedInitialInner = hb_cache:ensure_all_loaded(Inner, Opts),
+    ?assert(hb_message:verify(Inner, all, Opts)),
+    ?assert(hb_message:verify(LoadedInitialInner, all, Opts)),
+    % % Test encoding and decoding.
+    Encoded = hb_message:convert(Msg, Codec, <<"structured@1.0">>, Opts),
+    ?event({encoded, Encoded}),
+    Decoded = hb_message:convert(Encoded, <<"structured@1.0">>, Codec, Opts),
+    ?event({decoded, Decoded}),
+    LoadedMsg = hb_cache:ensure_all_loaded(Decoded, Opts),
+    ?event({loaded, LoadedMsg}),
+    % % Ensure that the decoded message matches.
+    MatchRes = hb_message:match(Msg, Decoded, strict, Opts),
+    ?event({match_result, MatchRes}),
+    ?assert(MatchRes),
+    ?assert(hb_message:verify(Decoded, all, Opts)),
+    % % Ensure that both of the messages can be verified (and retreived).
+    FoundInner = hb_maps:get(<<"body">>, Msg, not_found, Opts),
+    LoadedFoundInner = hb_cache:ensure_all_loaded(FoundInner, Opts),
+    % Verify that the fully loaded version of the inner message, and the one
+    % gained by applying `hb_maps:get` match and verify.
+    ?assert(hb_message:match(Inner, FoundInner, primary, Opts)),
+    ?assert(hb_message:match(FoundInner, LoadedFoundInner, primary, Opts)),
+    ?assert(hb_message:verify(Inner, all, Opts)),
+    ?assert(hb_message:verify(LoadedFoundInner, all, Opts)),
+    ?assert(hb_message:verify(FoundInner, all, Opts)).
+
+%% @doc Check that large keys and data fields are correctly handled together.
+nested_message_with_large_keys_and_content_test(Codec, Opts) ->
+    MainBodyKey =
+        case Codec of
+            <<"ans104@1.0">> -> <<"data">>;
+            _ -> <<"body">>
+        end,
+    Msg = #{
+        <<"normal_key">> => <<"normal_value">>,
+        <<"large_key">> => << 0:(1024 * 16) >>,
+        <<"another_large_key">> => << 0:(1024 * 16) >>,
+        <<"another_normal_key">> => <<"another_normal_value">>,
+        MainBodyKey => <<"Hey from the data field!">>
+    },
+    Encoded = hb_message:convert(Msg, Codec, <<"structured@1.0">>, Opts),
+    Decoded = hb_message:convert(Encoded, <<"structured@1.0">>, Codec, Opts),
+    ?event({matching, {input, Msg}, {output, Decoded}}),
+    ?assert(hb_message:match(Msg, Decoded, strict, Opts)).
+
+simple_nested_message_test(Codec, Opts) ->
+    Msg = #{
+        <<"a">> => <<"1">>,
+        <<"nested">> => #{ <<"b">> => <<"1">> },
+        <<"c">> => <<"3">>
+    },
+    Encoded = hb_message:convert(Msg, Codec, <<"structured@1.0">>, Opts),
+    ?event({encoded, Encoded}),
+    Decoded = hb_message:convert(Encoded, <<"structured@1.0">>, Codec, Opts),
+    ?event({matching, {input, Msg}, {output, Decoded}}),
+    ?assert(hb_message:match(Msg, Decoded, strict, Opts)).
+
+simple_signed_nested_message_test(Codec, Opts) ->
+    Msg =
+        hb_message:commit(
+            #{
+                <<"a">> => <<"1">>,
+                <<"nested">> => #{ <<"b">> => <<"1">> },
+                <<"c">> => <<"3">>
+            },
+            Opts,
+            Codec
+        ),
+    ?assert(hb_message:verify(Msg, all, Opts)),
+    Encoded = hb_message:convert(Msg, Codec, <<"structured@1.0">>, Opts),
+    ?event({encoded, Encoded}),
+    Decoded = hb_message:convert(Encoded, <<"structured@1.0">>, Codec, Opts),
+    ?event({matching, {input, Msg}, {output, Decoded}}),
+    MatchRes = hb_message:match(Msg, Decoded, primary, Opts),
+    ?event({match_result, MatchRes}),
+    ?assert(MatchRes),
+    ?assert(hb_message:verify(Decoded, all, Opts)).
+
+signed_nested_message_with_child_test(Codec, Opts) ->
+    Msg = #{
+        <<"outer-a">> => <<"1">>,
+        <<"nested">> =>
+            hb_message:commit(
+                #{ <<"inner-b">> => <<"1">>, <<"inner-list">> => [1, 2, 3] },
+                Opts,
+                Codec
+            ),
+        <<"outer-c">> => <<"3">>
+    },
+    hb_cache:write(Msg, Opts),
+    Encoded = hb_message:convert(Msg, Codec, <<"structured@1.0">>, Opts),
+    ?event({encoded, Encoded}),
+    Decoded = hb_message:convert(Encoded, <<"structured@1.0">>, Codec, Opts),
+    ?event({matching, {input, Msg}, {output, Decoded}}),
+    MatchRes = hb_message:match(Msg, Decoded, primary, Opts),
+    ?event({match_result, MatchRes}),
+    ?assert(MatchRes),
+    ?assert(hb_message:verify(Decoded, all, Opts)).
+
+nested_empty_map_test(Codec, Opts) ->
+    Msg = #{ <<"body">> => #{ <<"empty-map-test">> => #{}}},
+    Encoded = hb_message:convert(Msg, Codec, <<"structured@1.0">>, Opts),
+    Decoded = hb_message:convert(Encoded, <<"structured@1.0">>, Codec, Opts),
+    ?event({matching, {input, Msg}, {output, Decoded}}),
+    MatchRes = hb_message:match(Msg, Decoded, strict, Opts),
+    ?event({match_result, MatchRes}),
+    ?assert(MatchRes).
+
+empty_body_test(Codec, Opts) ->
+    Msg = #{ <<"body">> => <<>> },
+    Signed = hb_message:commit(Msg, Opts, Codec),
+    Encoded = hb_message:convert(Signed, Codec, <<"structured@1.0">>, Opts),
+    Decoded = hb_message:convert(Encoded, <<"structured@1.0">>, Codec, Opts),
+    ?event({matching, {input, Msg}, {output, Decoded}}),
+    MatchRes = hb_message:match(Signed, Decoded, strict, Opts),
+    ?event({match_result, MatchRes}),
+    ?assert(MatchRes).
+
+%% @doc Test that the data field is correctly managed when we have multiple
+%% uses for it (the 'data' key itself, as well as keys that cannot fit in
+%% tags).
+nested_message_with_large_content_test(Codec, Opts) ->
+    MainBodyKey =
+        case Codec of
+            <<"ans104@1.0">> -> <<"data">>;
+            _ -> <<"body">>
+        end,
+    Msg = #{
+        <<"depth">> => <<"outer">>,
+        MainBodyKey => #{
+            <<"map_item">> =>
+                #{
+                    <<"depth">> => <<"inner">>,
+                    <<"large_data_inner">> => << 0:((1 + 1024) * 8) >>
+                },
+            <<"large_data_outer">> => << 0:((1 + 1024) * 8) >>
+        }
+    },
+    Encoded = hb_message:convert(Msg, Codec, <<"structured@1.0">>, Opts),
+    Decoded = hb_message:convert(Encoded, <<"structured@1.0">>, Codec, Opts),
+    ?event({matching, {input, Msg}, {output, Decoded}}),
+    ?assert(hb_message:match(Msg, Decoded, strict, Opts)).
+
+%% @doc Test that we can convert a 3 layer nested message into a tx record and back.
+deeply_nested_message_with_content_test(Codec, Opts) ->
+    MainBodyKey =
+        case Codec of
+            <<"ans104@1.0">> -> <<"data">>;
+            _ -> <<"body">>
+        end,
+    Msg = #{
+        <<"depth">> => <<"outer">>,
+        MainBodyKey => #{
+            <<"map_item">> =>
+                #{
+                    <<"depth">> => <<"inner">>,
+                    MainBodyKey => #{
+                        <<"depth">> => <<"innermost">>,
+                        MainBodyKey => <<"DATA">>
+                    }
+                }
+        }
+    },
+    Encoded = hb_message:convert(Msg, Codec, <<"structured@1.0">>, Opts),
+    Decoded = hb_message:convert(Encoded, <<"structured@1.0">>, Codec, Opts),
+    ?event({matching, {input, Msg}, {output, Decoded}}),
+    ?assert(hb_message:match(Msg, Decoded, strict, Opts)).
+
+deeply_nested_message_with_only_content(Codec, Opts) ->
+    MainBodyKey =
+        case Codec of
+            <<"ans104@1.0">> -> <<"data">>;
+            _ -> <<"body">>
+        end,
+    Msg = #{
+        <<"depth1">> => <<"outer">>,
+        MainBodyKey => #{
+            MainBodyKey => #{
+                MainBodyKey => <<"depth2-body">>
+            }
+        }
+    },
+    Encoded = hb_message:convert(Msg, Codec, <<"structured@1.0">>, Opts),
+    Decoded = hb_message:convert(Encoded, <<"structured@1.0">>, Codec, Opts),
+    ?event({matching, {input, Msg}, {output, Decoded}}),
+    ?assert(hb_message:match(Msg, Decoded, strict, Opts)).
+
+nested_structured_fields_test(Codec, Opts) ->
+    NestedMsg = #{ <<"a">> => #{ <<"b">> => 1 } },
+    Encoded = hb_message:convert(NestedMsg, Codec, <<"structured@1.0">>, Opts),
+    Decoded = hb_message:convert(Encoded, <<"structured@1.0">>, Codec, Opts),
+    ?event({matching, {input, NestedMsg}, {output, Decoded}}),
+    ?assert(hb_message:match(NestedMsg, Decoded, strict, Opts)).
+
+nested_message_with_large_keys_test(Codec, Opts) ->
+    Msg = #{
+        <<"a">> => <<"1">>,
+        <<"long_data">> => << 0:((1 + 1024) * 8) >>,
+        <<"nested">> => #{ <<"b">> => <<"1">> },
+        <<"c">> => <<"3">>
+    },
+    Encoded = hb_message:convert(Msg, Codec, <<"structured@1.0">>, Opts),
+    Decoded = hb_message:convert(Encoded, <<"structured@1.0">>, Codec, Opts),
+    ?event({matching, {input, Msg}, {output, Decoded}}),
+    ?assert(hb_message:match(Msg, Decoded, strict, Opts)).
+
+signed_message_encode_decode_verify_test(Codec, Opts) ->
+    Msg = #{
+        <<"test-1">> => <<"TEST VALUE 1">>,
+        <<"test-2">> => <<"TEST VALUE 2">>,
+        <<"test-3">> => <<"TEST VALUE 3">>,
+        <<"test-4">> => <<"TEST VALUE 4">>,
+        <<"test-5">> => <<"TEST VALUE 5">>
+    },
+    SignedMsg =
+        hb_message:commit(
+            Msg,
+            Opts,
+            Codec
+        ),
+    ?event({signed_msg, SignedMsg}),
+    ?assertEqual(true, hb_message:verify(SignedMsg, all, Opts)),
+    Encoded = hb_message:convert(SignedMsg, Codec, <<"structured@1.0">>, Opts),
+    ?event({msg_encoded_as_codec, Encoded}),
+    Decoded = hb_message:convert(Encoded, <<"structured@1.0">>, Codec, Opts),
+    ?event({decoded, Decoded}),
+    ?assertEqual(true, hb_message:verify(Decoded, all, Opts)),
+    ?event({matching, {input, SignedMsg}, {encoded, Encoded}, {decoded, Decoded}}),
+    ?event({http, {string, dev_codec_httpsig_conv:encode_http_msg(SignedMsg, Opts)}}),
+    MatchRes = hb_message:match(SignedMsg, Decoded, strict, Opts),
+    ?event({match_result, MatchRes}),
+    ?assert(MatchRes).
+
+specific_order_signed_message_test(RawCodec, Opts) ->
+    Msg = #{
+        <<"key-1">> => <<"DATA-1">>,
+        <<"key-2">> => <<"DATA-2">>,
+        <<"key-3">> => <<"DATA-3">>
+    },
+    Codec =
+        if is_map(RawCodec) -> RawCodec;
+        true -> #{ <<"device">> => RawCodec }
+        end,
+    SignedMsg =
+        hb_message:commit(
+            Msg,
+            Opts,
+            Codec#{ <<"committed">> => [<<"key-3">>, <<"key-1">>, <<"key-2">>] }
+        ),
+    ?event({signed_msg, SignedMsg}),
+    ?event({http, {string, dev_codec_httpsig_conv:encode_http_msg(SignedMsg, Opts)}}),
+    ?assert(hb_message:verify(SignedMsg, all, Opts)).
+
+specific_order_deeply_nested_signed_message_test(RawCodec, Opts) ->
+    Msg = #{
+        <<"key-1">> => <<"DATA-1">>,
+        <<"key-2">> => #{ <<"body">> => [1,2] },
+        <<"key-3">> => <<"DATA-3">>,
+        <<"key-4">> => #{ <<"body">> => [1,2,3,4] },
+        <<"key-5">> => <<"DATA-5">>
+    },
+    Codec =
+        if is_map(RawCodec) -> RawCodec;
+        true -> #{ <<"device">> => RawCodec }
+        end,
+    SignedMsg =
+        hb_message:commit(
+            Msg,
+            Opts,
+            Codec#{
+                <<"committed">> =>
+                    [
+                        <<"key-3">>,
+                        <<"key-5">>,
+                        <<"key-1">>,
+                        <<"key-2">>,
+                        <<"key-4">>
+                    ]
+            }
+        ),
+    ?event({signed_msg, SignedMsg}),
+    ?assert(hb_message:verify(SignedMsg, all, Opts)).
+
+complex_signed_message_test(Codec, Opts) ->
+    Msg = #{
+        <<"data">> => <<"TEST DATA">>,
+        <<"deep-data">> => #{
+            <<"data">> => <<"DEEP DATA">>,
+            <<"complex-key">> => 1337,
+            <<"list">> => [1,2,3]
+        }
+    },
+    SignedMsg =
+        hb_message:commit(
+            Msg,
+            Opts,
+            Codec
+        ),
+    Encoded = hb_message:convert(SignedMsg, Codec, <<"structured@1.0">>, Opts),
+    ?event({encoded, Encoded}),
+    Decoded = hb_message:convert(Encoded, <<"structured@1.0">>, Codec, Opts),
+    ?event({decoded, Decoded}),
+    ?assertEqual(true, hb_message:verify(Decoded, all, Opts)),
+    ?event({matching, {input, SignedMsg}, {output, Decoded}}),
+    MatchRes = hb_message:match(SignedMsg, Decoded, strict, Opts),
+    ?event({match_result, MatchRes}),
+    ?assert(MatchRes).
+
+% multisignature_test(Codec) ->
+%     Wallet1 = ar_wallet:new(),
+%     Wallet2 = ar_wallet:new(),
+%     Msg = #{
+%         <<"data">> => <<"TEST_DATA">>,
+%         <<"test_key">> => <<"TEST_VALUE">>
+%     },
+%     {ok, SignedMsg} =
+%         dev_message:commit(
+%             Msg,
+%             #{ <<"commitment-device">> => Codec },
+%             #{ priv_wallet => Wallet1 }
+%         ),
+%     ?event({signed_msg, SignedMsg}),
+%     {ok, MsgSignedTwice} =
+%         dev_message:commit(
+%             SignedMsg,
+%             #{ <<"commitment-device">> => Codec },
+%             #{ priv_wallet => Wallet2 }
+%         ),
+%     ?event({signed_msg_twice, MsgSignedTwice}),
+%     ?assert(verify(MsgSignedTwice)),
+%     {ok, Committers} = dev_message:committers(MsgSignedTwice),
+%     ?event({committers, Committers}),
+%     ?assert(lists:member(hb_util:human_id(ar_wallet:to_address(Wallet1)), Committers)),
+%     ?assert(lists:member(hb_util:human_id(ar_wallet:to_address(Wallet2)), Committers)).
+
+deep_multisignature_test() ->
+    % Only the `httpsig@1.0' codec supports multisignatures.
+    Opts = test_opts(normal),
+    Codec = <<"httpsig@1.0">>,
+    Wallet1 = ar_wallet:new(),
+    Wallet2 = ar_wallet:new(),
+    Msg = #{
+        <<"data">> => <<"TEST_DATA">>,
+        <<"test-key">> => <<"TEST_VALUE">>,
+        <<"body">> => #{
+            <<"nested-key">> => <<"NESTED_VALUE">>
+        }
+    },
+    SignedMsg =
+        hb_message:commit(
+            Msg,
+            Opts#{ priv_wallet => Wallet1 },
+            Codec
+        ),
+    ?event({signed_msg, SignedMsg}),
+    MsgSignedTwice =
+        hb_message:commit(
+            SignedMsg,
+            Opts#{ priv_wallet => Wallet2 },
+            Codec
+        ),
+    ?event({signed_msg_twice, MsgSignedTwice}),
+    ?assert(hb_message:verify(MsgSignedTwice, all, Opts)),
+    Committers = hb_message:signers(MsgSignedTwice, Opts),
+    ?event({committers, Committers}),
+    ?assert(lists:member(hb_util:human_id(ar_wallet:to_address(Wallet1)), Committers)),
+    ?assert(lists:member(hb_util:human_id(ar_wallet:to_address(Wallet2)), Committers)).
+
+deep_typed_message_id_test(Codec, Opts) ->
+    Msg = #{
+        <<"data">> => <<"TEST DATA">>,
+        <<"deep-data">> => #{
+            <<"data">> => <<"DEEP DATA">>,
+            <<"complex-key">> => 1337,
+            <<"list">> => [1,2,3]
+        }
+    },
+    InitID = hb_message:id(Msg, none, Opts),
+    ?event({init_id, InitID}),
+    Encoded = hb_message:convert(Msg, Codec, <<"structured@1.0">>, Opts),
+    Decoded = hb_message:convert(Encoded, <<"structured@1.0">>, Codec, Opts),
+    DecodedID = hb_message:id(Decoded, none, Opts),
+    ?event({decoded_id, DecodedID}),
+    ?event({stages, {init, Msg}, {encoded, Encoded}, {decoded, Decoded}}),
+    ?assertEqual(
+        InitID,
+        DecodedID
+    ).
+
+signed_deep_message_test(Codec, Opts) ->
+    Msg = #{
+        <<"test-key">> => <<"TEST_VALUE">>,
+        <<"body">> => #{
+            <<"nested-1">> =>
+                #{
+                    <<"body">> => <<"NESTED BODY">>,
+                    <<"nested-2">> => <<"NESTED-2">>
+                },
+            <<"nested-3">> => <<"NESTED-3">>
+        }
+    },
+    EncDec =
+        hb_message:convert(
+            hb_message:convert(Msg, Codec, <<"structured@1.0">>, Opts),
+            <<"structured@1.0">>,
+            Codec,
+            Opts
+        ),
+    ?event({enc_dec, EncDec}),
+    SignedMsg =
+        hb_message:commit(
+            EncDec,
+            Opts,
+            Codec
+        ),
+    ?event({signed_msg, SignedMsg}),
+    {ok, Res} = dev_message:verify(SignedMsg, #{ <<"committers">> => <<"all">>}, Opts),
+    ?event({verify_res, Res}),
+    ?assertEqual(true, hb_message:verify(SignedMsg, all, Opts)),
+    ?event({verified, SignedMsg}),
+    Encoded = hb_message:convert(SignedMsg, Codec, <<"structured@1.0">>, Opts),
+    ?event({encoded, Encoded}),
+    Decoded = hb_message:convert(Encoded, <<"structured@1.0">>, Codec, Opts),
+    ?event({decoded, Decoded}),
+    {ok, DecodedRes} =
+        dev_message:verify(
+            Decoded,
+            #{ <<"committers">> => <<"all">>},
+            Opts
+        ),
+    ?event({verify_decoded_res, DecodedRes}),
+    MatchRes = hb_message:match(SignedMsg, Decoded, strict, Opts),
+    ?event({match_result, MatchRes}),
+    ?assert(MatchRes).
+
+signed_list_test(Codec, Opts) ->
+    Msg = #{ <<"key-with-list">> => [1.0, 2.0, 3.0] },
+    Signed = hb_message:commit(Msg, Opts, Codec),
+    ?assert(hb_message:verify(Signed, all, Opts)),
+    Encoded = hb_message:convert(Signed, Codec, <<"structured@1.0">>, Opts),
+    ?event({encoded, Encoded}),
+    Decoded = hb_message:convert(Encoded, <<"structured@1.0">>, Codec, Opts),
+    ?event({decoded, Decoded}),
+    ?assert(hb_message:verify(Decoded, all, Opts)),
+    ?assert(hb_message:match(Signed, Decoded, strict, Opts)).
+
+unsigned_id_test(Codec, Opts) ->
+    Msg = #{ <<"data">> => <<"TEST_DATA">> },
+    Encoded = hb_message:convert(Msg, Codec, <<"structured@1.0">>, Opts),
+    Decoded = hb_message:convert(Encoded, <<"structured@1.0">>, Codec, Opts),
+    ?assertEqual(
+        dev_message:id(Decoded, #{ <<"committers">> => <<"none">>}, Opts),
+        dev_message:id(Msg, #{ <<"committers">> => <<"none">>}, Opts)
+    ).
+
+% signed_id_test_disabled() ->
+%     TX = #tx {
+%         data = <<"TEST_DATA">>,
+%         tags = [{<<"TEST_KEY">>, <<"TEST_VALUE">>}]
+%     },
+%     SignedTX = ar_bundles:sign_item(TX, hb:wallet()),
+%     ?assert(ar_bundles:verify_item(SignedTX)),
+%     SignedMsg = hb_codec_tx:from(SignedTX),
+%     ?assertEqual(
+%         hb_util:encode(ar_bundles:id(SignedTX, signed)),
+%         hb_util:id(SignedMsg, signed)
+%     ).
+
+message_with_simple_embedded_list_test(Codec, Opts) ->
+    Msg = #{ <<"list">> => [<<"value-1">>, <<"value-2">>, <<"value-3">>] },
+    Encoded = hb_message:convert(Msg, Codec, <<"structured@1.0">>, Opts),
+    Decoded = hb_message:convert(Encoded, <<"structured@1.0">>, Codec, Opts),
+    ?assert(hb_message:match(Msg, Decoded, strict, Opts)).
+
+empty_string_in_nested_tag_test(Codec, Opts) ->
+    Msg =
+        #{
+            <<"dev">> =>
+                #{
+                    <<"stderr">> => <<"aa">>,
+                    <<"stdin">> => <<"b">>,
+                    <<"stdout">> => <<"c">>
+                }
+        },
+    Encoded = hb_message:convert(Msg, Codec, <<"structured@1.0">>, Opts),
+    Decoded = hb_message:convert(Encoded, <<"structured@1.0">>, Codec, Opts),
+    ?assert(hb_message:match(Msg, Decoded, strict, Opts)).
+
+hashpath_sign_verify_test(Codec, Opts) ->
+    Msg =
+        #{
+            <<"test_key">> => <<"TEST_VALUE">>,
+            <<"body">> => #{
+                <<"nested_key">> =>
+                    #{
+                        <<"body">> => <<"NESTED_DATA">>,
+                        <<"nested_key">> => <<"NESTED_VALUE">>
+                    },
+                <<"nested_key2">> => <<"NESTED_VALUE2">>
+            },
+            <<"priv">> => #{
+                <<"hashpath">> =>
+                    hb_path:hashpath(
+                        hb_util:human_id(crypto:strong_rand_bytes(32)),
+                        hb_util:human_id(crypto:strong_rand_bytes(32)),
+                        fun hb_crypto:sha256_chain/2,
+                        #{}
+                    )
+            }
+        },
+    ?event({msg, {explicit, Msg}}),
+    SignedMsg = hb_message:commit(Msg, Opts, Codec),
+    ?event({signed_msg, {explicit, SignedMsg}}),
+    {ok, Res} = dev_message:verify(SignedMsg, #{ <<"committers">> => <<"all">>}, Opts),
+    ?event({verify_res, {explicit, Res}}),
+    ?assert(hb_message:verify(SignedMsg, all, Opts)),
+    ?event({verified, {explicit, SignedMsg}}),
+    Encoded = hb_message:convert(SignedMsg, Codec, <<"structured@1.0">>, Opts),
+    ?event({encoded, Encoded}),
+    Decoded = hb_message:convert(Encoded, <<"structured@1.0">>, Codec, Opts),
+    ?event({decoded, Decoded}),
+    ?assert(hb_message:verify(Decoded, all, Opts)),
+    ?assert(
+        hb_message:match(
+            SignedMsg,
+            Decoded,
+            strict,
+            Opts
+        )
+    ).
+
+normalize_commitments_test(Codec, Opts) ->
+    Msg = #{
+        <<"a">> => #{
+            <<"b">> => #{
+                <<"c">> => 1,
+                <<"d">> => #{
+                    <<"e">> => 2
+                },
+                <<"f">> => 3
+            },
+            <<"g">> => 4
+        },
+        <<"h">> => 5
+    },
+    NormMsg = hb_message:normalize_commitments(Msg, Opts),
+    ?event({norm_msg, NormMsg}),
+    ?assert(hb_message:verify(NormMsg, all, Opts)),
+    ?assert(maps:is_key(<<"commitments">>, NormMsg)),
+    ?assert(maps:is_key(<<"commitments">>, maps:get(<<"a">>, NormMsg))),
+    ?assert(
+        maps:is_key(
+            <<"commitments">>,
+            maps:get(<<"b">>, maps:get(<<"a">>, NormMsg))
+        )
+    ).
+
+signed_message_with_derived_components_test(Codec, Opts) ->
+    Msg = #{
+        <<"path">> => <<"/test">>,
+        <<"authority">> => <<"example.com">>,
+        <<"scheme">> => <<"https">>,
+        <<"method">> => <<"GET">>,
+        <<"target-uri">> => <<"/test">>,
+        <<"request-target">> => <<"/test">>,
+        <<"status">> => <<"200">>,
+        <<"reason-phrase">> => <<"OK">>,
+        <<"body">> => <<"TEST_DATA">>,
+        <<"content-digest">> => <<"TEST_DIGEST">>,
+        <<"normal">> => <<"hello">>
+    },
+    SignedMsg =
+        hb_message:commit(
+            Msg,
+            Opts,
+            Codec
+        ),
+    ?event({signed_msg, SignedMsg}),
+    ?assert(hb_message:verify(SignedMsg, all, Opts)),
+    Encoded = hb_message:convert(SignedMsg, Codec, <<"structured@1.0">>, Opts),
+    ?event({encoded, Encoded}),
+    Decoded = hb_message:convert(Encoded, <<"structured@1.0">>, Codec, Opts),
+    ?event({decoded, Decoded}),
+    ?assert(hb_message:verify(Decoded, all, Opts)),
+    ?assert(
+        hb_message:match(
+            SignedMsg,
+            Decoded,
+            strict,
+            Opts
+        )
+    ).
+
+committed_keys_test(Codec, Opts) ->
+    Msg = #{ <<"a">> => 1, <<"b">> => 2, <<"c">> => 3 },
+    Signed = hb_message:commit(Msg, Opts, Codec),
+    CommittedKeys = hb_message:committed(Signed, all, Opts),
+    ?event({committed_keys, CommittedKeys}),
+    ?assert(hb_message:verify(Signed, all, Opts)),
+    ?assert(lists:member(<<"a">>, CommittedKeys)),
+    ?assert(lists:member(<<"b">>, CommittedKeys)),
+    ?assert(lists:member(<<"c">>, CommittedKeys)),
+    MsgToFilter = Signed#{ <<"bad-key">> => <<"BAD VALUE">> },
+    ?assert(
+        not lists:member(
+            <<"bad-key">>,
+            hb_message:committed(MsgToFilter, all, Opts)
+        )
+    ).
+
+committed_empty_keys_test(Codec, Opts) ->
+    Msg = #{
+        <<"very">> => <<>>,
+        <<"exciting">> => #{},
+        <<"values">> => [],
+        <<"non-empty">> => <<"TEST">>
+    },
+    Signed = hb_message:commit(Msg, Opts, Codec),
+    ?assert(hb_message:verify(Signed, all, Opts)),
+    CommittedKeys = hb_message:committed(Signed, all, Opts),
+    ?event({committed_keys, CommittedKeys}),
+    ?event({signed, Signed}),
+    ?assert(lists:member(<<"very">>, CommittedKeys)),
+    ?assert(lists:member(<<"exciting">>, CommittedKeys)),
+    ?assert(lists:member(<<"values">>, CommittedKeys)),
+    ?assert(lists:member(<<"non-empty">>, CommittedKeys)).
+
+deeply_nested_committed_keys_test() ->
+    Opts = (test_opts(normal))#{
+        store => [
+            #{
+                <<"store-module">> => hb_store_fs,
+                <<"name">> => <<"cache-TEST">>
+            }
+        ]
+    },
+    Msg = #{
+        <<"a">> => 1,
+        <<"b">> => #{ <<"c">> => #{ <<"d">> => <<0:((1 + 1024) * 1024)>> } },
+        <<"e">> => <<0:((1 + 1024) * 1024)>>
+    },
+    Signed = hb_message:commit(Msg, Opts, <<"httpsig@1.0">>),
+    {ok, WithOnlyCommitted} = hb_message:with_only_committed(Signed, Opts),
+    Committed = hb_message:committed(Signed, all, Opts),
+    ToCompare = hb_maps:without([<<"commitments">>], WithOnlyCommitted),
+    ?event(
+        {msgs,
+            {base, Msg},
+            {signed, Signed},
+            {committed, Committed},
+            {with_only_committed, WithOnlyCommitted},
+            {to_compare, ToCompare}
+        }
+    ),
+    ?assert(
+        hb_message:match(
+            Msg,
+            ToCompare,
+            strict,
+            Opts
+        )
+    ).
+
+signed_with_inner_signed_message_test(Codec, Opts) ->
+    Msg =
+        hb_message:commit(
+            #{
+                <<"a">> => 1,
+                <<"inner">> =>
+                    hb_maps:merge(
+                        InnerSigned =
+                            hb_message:commit(
+                                #{
+                                    <<"c">> => <<"abc">>,
+                                    <<"e">> => 5
+                                    %<<"body">> => <<"inner-body">>
+                                    % <<"inner-2">> => #{
+                                    %     <<"body">> => <<"inner-2-body">>
+                                    % }
+                                },
+                                Opts,
+                                Codec
+                            ),
+                        % Uncommitted keys that should be ripped out of the inner
+                        % message by `with_only_committed'. These should still be
+                        % present in the `with_only_committed' outer message. 
+                        % For now, only `httpsig@1.0' supports stripping
+                        % non-committed keys.
+                        case Codec of
+                            <<"httpsig@1.0">> ->
+                                #{ <<"f">> => 6, <<"g">> => 7};
+                            #{ <<"device">> := <<"httpsig@1.0">> } ->
+                                #{ <<"f">> => 6, <<"g">> => 7};
+                            _ -> #{}
+                        end
+                    )
+            },
+            Opts,
+            Codec
+        ),
+    ?event({initial_msg, Msg}),
+    % 1. Verify the outer message without changes.
+    ?assert(hb_message:verify(Msg, all, Opts)),
+    % 2. Convert the message to the format and back.
+    Encoded = hb_message:convert(Msg, Codec, Opts),
+    ?event({encoded, Encoded}),
+    %?event({encoded_body, {string, hb_maps:get(<<"body">>, Encoded)}}, #{}),
+    Decoded = hb_message:convert(Encoded, <<"structured@1.0">>, Codec, Opts),
+    ?event({decoded, Decoded}),
+	{ok, InnerFromDecoded} =
+        hb_message:with_only_committed(
+            hb_maps:get(<<"inner">>, Decoded, not_found, Opts),
+            Opts
+        ),
+    ?event({verify_inner, {original, InnerSigned}, {from_decoded, InnerFromDecoded}}),
+    % 3. Verify the outer message after decode.
+    MatchRes =
+        hb_message:match(
+            InnerSigned,
+            InnerFromDecoded,
+            primary,
+            Opts
+        ),
+    ?event({match_result, MatchRes}),
+    ?assert(MatchRes),
+    ?assert(hb_message:verify(InnerFromDecoded, all, Opts)),
+    ?assert(hb_message:verify(Decoded, all, Opts)),
+    % 4. If the message is not a bundle, verify the inner message from the
+    % converted message, applying `with_only_committed` first.
+    Inner = hb_maps:get(<<"inner">>, Msg, not_found, Opts),
+    {ok, CommittedInner} =
+        hb_message:with_only_committed(
+            Inner,
+            Opts
+        ),
+    ?event({committed_inner, CommittedInner}),
+    ?event({inner_committers, hb_message:signers(CommittedInner, Opts)}),
+    ?assert(hb_message:verify(CommittedInner, signers, Opts)),
+    InnerDecoded = hb_maps:get(<<"inner">>, Decoded, not_found, Opts),
+    ?event({inner_decoded, InnerDecoded}),
+    % Applying `with_only_committed' should verify the inner message.
+    {ok, CommittedInnerOnly} =
+        hb_message:with_only_committed(
+            InnerDecoded,
+            Opts
+        ),
+    ?assert(hb_message:verify(CommittedInnerOnly, signers, Opts)).
+
+large_body_committed_keys_test(Codec, Opts) ->
+    case Codec of
+        <<"httpsig@1.0">> ->
+            Msg = #{
+                <<"a">> => 1,
+                <<"b">> => 2,
+                <<"c">> => #{ <<"d">> => << 1:((1 + 1024) * 1024) >> }
+            },
+            Encoded = hb_message:convert(Msg, Codec, <<"structured@1.0">>, Opts),
+            ?event({encoded, Encoded}),
+            Decoded = hb_message:convert(Encoded, <<"structured@1.0">>, Codec, Opts),
+            ?event({decoded, Decoded}),
+            Signed = hb_message:commit(Decoded, Opts, Codec),
+            ?event({signed, Signed}),
+            CommittedKeys = hb_message:committed(Signed, all, Opts),
+            ?assert(lists:member(<<"a">>, CommittedKeys)),
+            ?assert(lists:member(<<"b">>, CommittedKeys)),
+            ?assert(lists:member(<<"c">>, CommittedKeys)),
+            MsgToFilter = Signed#{ <<"bad-key">> => <<"BAD VALUE">> },
+            ?assert(
+                not lists:member(
+                    <<"bad-key">>,
+                    hb_message:committed(MsgToFilter, all, Opts)
+                )
+            );
+        _ ->
+            skip
+    end.
+
+sign_node_message_test(Codec, Opts) ->
+    Msg = hb_message:commit(hb_opts:default_message_with_env(), Opts, Codec),
+    ?event({committed, Msg}),
+    ?assert(hb_message:verify(Msg, all, Opts)),
+    Encoded = hb_message:convert(Msg, Codec, <<"structured@1.0">>, Opts),
+    ?event({encoded, Encoded}),
+    Decoded = hb_message:convert(Encoded, <<"structured@1.0">>, Codec, Opts),
+    ?event({final, Decoded}),
+    MatchRes = hb_message:match(Msg, Decoded, strict, Opts),
+    ?event({match_result, MatchRes}),
+    ?assert(MatchRes),
+    ?assert(hb_message:verify(Decoded, all, Opts)).
+
+nested_body_list_test(Codec, Opts) ->
+    Msg = #{
+        <<"body">> =>
+            [
+                #{
+                    <<"test-key">> =>
+                        <<"TEST VALUE #", (integer_to_binary(X))/binary>>
+                }
+            ||
+                X <- lists:seq(1, 3)
+            ]
+    },
+    Encoded = hb_message:convert(Msg, Codec, <<"structured@1.0">>, Opts),
+    ?event(encoded, {encoded, Encoded}),
+    Decoded = hb_message:convert(Encoded, <<"structured@1.0">>, Codec, Opts),
+    ?event({decoded, Decoded}),
+    ?assert(hb_message:match(Msg, Decoded, strict, Opts)).
+
+recursive_nested_list_test(Codec, Opts) ->
+    % This test is to ensure that the codec can handle arbitrarily deep nested
+    % lists.
+    Msg = #{
+        <<"body">> =>
+            [
+                [
+                    [
+                        <<
+                            "TEST VALUE #",
+                            (integer_to_binary(X))/binary,
+                            "-",
+                            (integer_to_binary(Y))/binary,
+                            "-",
+                            (integer_to_binary(Z))/binary
+                        >>
+                    ||
+                        Z <- lists:seq(1, 3)
+                    ]
+                ||
+                    Y <- lists:seq(1, 3)
+                ]
+            ||
+                X <- lists:seq(1, 3)
+            ]
+    },
+    Encoded = hb_message:convert(Msg, Codec, <<"structured@1.0">>, Opts),
+    ?event(encoded, {encoded, Encoded}),
+    Decoded = hb_message:convert(Encoded, <<"structured@1.0">>, Codec, Opts),
+    ?event({decoded, Decoded}),
+    ?assert(hb_message:match(Msg, Decoded, strict, Opts)).
+
+priv_survives_conversion_test(<<"ans104@1.0">>, _Opts) -> skip;
+priv_survives_conversion_test(<<"json@1.0">>, _Opts) -> skip;
+priv_survives_conversion_test(#{ <<"device">> := <<"ans104@1.0">> }, _Opts) ->
+    skip;
+priv_survives_conversion_test(#{ <<"device">> := <<"json@1.0">> }, _Opts) ->
+    skip;
+priv_survives_conversion_test(Codec, Opts) ->
+    Msg = #{
+        <<"data">> => <<"TEST_DATA">>,
+        <<"priv">> => #{ <<"test_key">> => <<"TEST_VALUE">> }
+    },
+    Encoded = hb_message:convert(Msg, Codec, <<"structured@1.0">>, Opts),
+    ?event({encoded, Encoded}),
+    Decoded = hb_message:convert(Encoded, <<"structured@1.0">>, Codec, Opts),
+    ?event({decoded, Decoded}),
+    ?assert(hb_message:match(Msg, Decoded, strict, Opts)),
+    ?assertMatch(
+        #{ <<"test_key">> := <<"TEST_VALUE">> },
+        maps:get(<<"priv">>, Decoded)
+    ).
+
+encode_balance_table(Size, Codec, Opts) ->
+    Msg =
+        #{
+            hb_util:encode(crypto:strong_rand_bytes(32)) =>
+                rand:uniform(1_000_000_000_000_000)
+        ||
+            _ <- lists:seq(1, Size)
+        },
+    Encoded = hb_message:convert(Msg, Codec, <<"structured@1.0">>, Opts),
+    ?event({encoded, {explicit, Encoded}}),
+    Decoded =
+        hb_message:uncommitted(
+            hb_message:convert(Encoded, <<"structured@1.0">>, Codec, Opts),
+            Opts
+        ),
+    ?event({decoded, {explicit, Decoded}}),
+    ?assert(hb_message:match(Msg, Decoded, if_present, Opts)).
+
+encode_small_balance_table_test(Codec, Opts) ->
+    encode_balance_table(5, Codec, Opts).
+
+encode_large_balance_table_test(<<"ans104@1.0">>, _Opts) ->
+    skip;
+encode_large_balance_table_test(#{ <<"device">> := <<"ans104@1.0">> }, _Opts) ->
+    skip;
+encode_large_balance_table_test(Codec, Opts) ->
+    encode_balance_table(1000, Codec, Opts).
+
+sign_links_test(#{ <<"bundle">> := true }, _Opts) ->
+    skip;
+sign_links_test(Codec, Opts) ->
+    % Make a message with definitively non-accessible lazy-loadable links. Sign
+    % it, ensuring that we can produce signatures and IDs without having the 
+    % data directly in memory.
+    Msg = #{
+        <<"immediate-key">> => <<"immediate-value">>,
+        <<"submap+link">> => hb_util:human_id(crypto:strong_rand_bytes(32))
+    },
+    Signed = hb_message:commit(Msg, Opts, Codec),
+    ?event({signed, Signed}),
+    ?assert(hb_message:verify(Signed, all, Opts)).
+
+bundled_and_unbundled_ids_differ_test(Codec = #{ <<"bundle">> := true }, Opts) ->
+    SignatureType =
+        case maps:get(<<"device">>, Codec, undefined) of
+            <<"ans104@1.0">> -> <<"rsa-pss-sha256">>;
+            _ -> <<"hmac-sha256">>
+        end,
+    Msg = #{
+        <<"immediate-key">> => <<"immediate-value">>,
+        <<"nested">> => #{
+            <<"immediate-key-2">> => <<"immediate-value-2">>
+        }
+    },
+    SignedNoBundle =
+        hb_message:commit(
+            Msg,
+            Opts,
+            maps:without([<<"bundle">>], Codec)
+        ),
+    SignedBundled = hb_message:commit(Msg, Opts, Codec),
+    ?event({signed_no_bundle, SignedNoBundle}),
+    ?event({signed_bundled, SignedBundled}),
+    {ok, UnbundledID, _} =
+        hb_message:commitment(
+            #{ <<"type">> => SignatureType },
+            SignedNoBundle,
+            Opts
+        ),
+    {ok, BundledID, _} =
+        hb_message:commitment(
+            #{ <<"type">> => SignatureType },
+            SignedBundled,
+            Opts
+        ),
+    ?event({unbundled_id, UnbundledID}),
+    ?event({bundled_id, BundledID}),
+    ?assertNotEqual(UnbundledID, BundledID);
+bundled_and_unbundled_ids_differ_test(_Codec, _Opts) ->
+    skip.
+
+id_of_linked_message_test(#{ <<"bundle">> := true }, _Opts) ->
+    skip;
+id_of_linked_message_test(Codec, Opts) ->
+    Msg = #{
+        <<"immediate-key">> => <<"immediate-value">>,
+        <<"link-key">> =>
+            {link, hb_util:human_id(crypto:strong_rand_bytes(32)), #{
+                <<"type">> => <<"link">>,
+                <<"lazy">> => false
+            }}
+    },
+    UnsignedID = hb_message:id(Msg, Opts),
+    ?event({id, UnsignedID}),
+    EncMsg = hb_message:convert(Msg, Codec, <<"structured@1.0">>, Opts),
+    DecMsg = hb_message:convert(EncMsg, <<"structured@1.0">>, Codec, Opts),
+    UnsignedID2 = hb_message:id(DecMsg, Opts),
+    ?assertEqual(UnsignedID, UnsignedID2).
+
+sign_deep_message_from_lazy_cache_read_test(#{ <<"bundle">> := true }, _Opts) ->
+    skip;
+sign_deep_message_from_lazy_cache_read_test(Codec, Opts) ->
+    Msg = #{
+        <<"immediate-key">> => <<"immediate-value">>,
+        <<"link-key">> => #{
+            <<"immediate-key-2">> => <<"link-value">>,
+            <<"link-key-2">> => #{
+                <<"immediate-key-3">> => <<"link-value-2">>
+            }
+        }
+    },
+    % Write the message to the store to ensure that we get lazy-loadable links.
+    {ok, Path} = hb_cache:write(Msg, Opts),
+    {ok, ReadMsg} = hb_cache:read(Path, Opts),
+    ?event({read, ReadMsg}),
+    Signed = hb_message:commit(ReadMsg, Opts, Codec),
+    ?event({signed, Signed}),
+    ?assert(
+        lists:all(
+            fun({_K, Value}) -> not is_map(Value) end,
+            maps:to_list(maps:without([<<"commitments">>, <<"priv">>], Signed))
+        )
+    ),
+    ?assert(hb_message:verify(Signed, all, Opts)).
+
+id_of_deep_message_and_link_message_match_test(_Codec, Opts) ->
+    Msg = #{
+        <<"immediate-key">> => <<"immediate-value">>,
+        <<"link-key">> => #{
+            <<"immediate-key-2">> => <<"immediate-value-2">>,
+            <<"link-key-2">> => #{
+                <<"immediate-key-3">> => <<"immediate-value-3">>
+            }
+        }
+    },
+    Linkified = hb_link:normalize(Msg, offload, Opts),
+    ?event(linkify, {test_recvd_linkified, {msg, Linkified}}),
+    BaseID = hb_message:id(Msg, Opts),
+    ?event(linkify, {test_recvd_nonlink_id, {id, BaseID}}),
+    LinkID = hb_message:id(Linkified, Opts),
+    ?event(linkify, {test_recvd_link_id, {id, LinkID}}),
+    ?assertEqual(BaseID, LinkID).
+
+signed_non_bundle_is_bundlable_test(
+        Codec = #{ <<"device">> := <<"httpsig@1.0">>, <<"bundle">> := true },
+        Opts) ->
+    Msg =
+        hb_message:commit(
+            #{
+                <<"target">> => hb_util:human_id(crypto:strong_rand_bytes(32)),
+                <<"type">> => <<"Message">>,
+                <<"function">> => <<"fac">>,
+                <<"parameters">> => [5.0]
+            },
+            Opts,
+            maps:get(<<"device">>, Codec)
+        ),
+    Encoded =
+       hb_message:convert(
+            Msg,
+            Codec,
+            <<"structured@1.0">>,
+            Opts
+        ),
+    Decoded =
+        hb_message:convert(
+            Encoded,
+            <<"structured@1.0">>,
+            maps:get(<<"device">>, Codec),
+            Opts
+        ),
+    ?assert(hb_message:match(Msg, Decoded, strict, Opts)),
+    ?assert(hb_message:verify(Decoded, all, Opts));
+signed_non_bundle_is_bundlable_test(_Codec, _Opts) ->
+    skip.
+
+%% Ensure that we can write a message with multiple commitments to the store,
+%% then read back all of the written commitments by loading the message's 
+%% unsigned ID.
+find_multiple_commitments_test_disabled() ->
+    Opts = test_opts(normal),
+    Store = hb_opts:get(store, no_store, Opts),
+    hb_store:reset(Store),
+    Msg = #{
+        <<"a">> => 1,
+        <<"b">> => 2,
+        <<"c">> => 3
+    },
+    Sig1 = hb_message:commit(Msg, Opts#{ priv_wallet => ar_wallet:new() }),
+    {ok, _} = hb_cache:write(Sig1, Opts),
+    Sig2 = hb_message:commit(Msg, Opts#{ priv_wallet => ar_wallet:new() }),
+    {ok, _} = hb_cache:write(Sig2, Opts),
+    {ok, ReadMsg} = hb_cache:read(hb_message:id(Msg, none, Opts), Opts),
+    LoadedCommitments = hb_cache:ensure_all_loaded(ReadMsg, Opts),
+    ?event(debug_commitments, {read, LoadedCommitments}),
+    ok.
+
+%% @doc Ensure that a httpsig@1.0 message which is bundled and requests an 
+%% invalid ordering of keys is normalized to a valid ordering.
+bundled_ordering_test(Codec = #{ <<"bundle">> := true }, Opts) ->
+    % Opts = (test_opts(normal))#{
+    %     store => [
+    %         #{ <<"store-module">> => hb_store_fs, <<"name">> => <<"cache-TEST">> }
+    %     ]
+    % },
+    Msg =
+        hb_message:commit(
+            #{
+                <<"a">> => <<"1">>,
+                <<"b">> => <<"2">>,
+                <<"b-2">> => #{ <<"nested">> => #{ <<"n">> => <<"2">> } },
+                <<"c">> => <<"3">>,
+                <<"c-2">> => #{ <<"nested">> => #{ <<"n">> => <<"3">> } },
+                <<"d">> => <<"4">>
+            },
+            Opts,
+            Codec#{
+                <<"committed">> => [
+                    <<"a">>,
+                    <<"b">>,
+                    <<"b-2">>,
+                    <<"c">>,
+                    <<"c-2">>,
+                    <<"d">>
+                ]
+            }
+        ),
+    ?event({committed, Msg}),
+    Encoded = hb_message:convert(Msg, Codec, <<"structured@1.0">>, Opts),
+    ?event({encoded, Encoded}),
+    ?event({http, {string, dev_codec_httpsig_conv:encode_http_msg(Msg, Opts)}}),
+    Decoded = hb_message:convert(Encoded, <<"structured@1.0">>, Codec, Opts),
+    ?event({matching, {input, Msg}, {output, Decoded}}),
+    MatchRes = hb_message:match(Msg, Decoded, primary, Opts),
+    ?event({match_result, MatchRes}),
+    ?assert(MatchRes),
+    ?assert(hb_message:verify(Decoded, all, Opts));
+bundled_ordering_test(_Codec, _Opts) ->
+    skip.
\ No newline at end of file
diff --git a/src/hb_name.erl b/src/hb_name.erl
index e1de55c37..e85c05162 100644
--- a/src/hb_name.erl
+++ b/src/hb_name.erl
@@ -1,4 +1,4 @@
-%%% @doc An abstraction for name registration/deregistration in Hyperbeam.
+%%% @doc An abstraction for name registration/deregistration in HyperBEAM.
 %%% Its motivation is to provide a way to register names that are not necessarily
 %%% atoms, but can be any term (for example: hashpaths or `process@1.0' IDs).
 %%% An important characteristic of these functions is that they are atomic:
diff --git a/src/hb_opts.erl b/src/hb_opts.erl
index b6df90802..99b0c4f70 100644
--- a/src/hb_opts.erl
+++ b/src/hb_opts.erl
@@ -13,11 +13,91 @@
 %%% deterministic behavior impossible, the caller should fail the execution 
 %%% with a refusal to execute.
 -module(hb_opts).
--export([get/1, get/2, get/3, load/1, load_bin/1]).
--export([default_message/0, mimic_default_types/2, validate_node_history/1, validate_node_history/3]).
+-export([get/1, get/2, get/3, as/2, identities/1, load/1, load/2, load_bin/2]).
+-export([default_message/0, default_message_with_env/0, mimic_default_types/3]).
+-export([ensure_node_history/2]).
 -export([check_required_opts/2]).
 -include("include/hb.hrl").
 
+%%% Environment variables that can be used to override the default message.
+-ifdef(TEST).
+-define(DEFAULT_PRINT_OPTS, [error, http_error]).
+-else.
+-define(DEFAULT_PRINT_OPTS,
+    [error, http_error, http_short, compute_short, push_short, copycat_short]
+).
+-endif.
+
+-ifdef(AO_PROFILING).
+-define(DEFAULT_TRACE_TYPE, ao).
+-else.
+-define(DEFAULT_TRACE_TYPE, erlang).
+-endif.
+
+-define(DEFAULT_PRIMARY_STORE, #{
+    <<"name">> => <<"cache-mainnet/lmdb">>,
+    <<"store-module">> => hb_store_lmdb
+}).
+-define(ENV_KEYS,
+    #{
+        priv_key_location => {"HB_KEY", "hyperbeam-key.json"},
+        hb_config_location => {"HB_CONFIG", "config.flat"},
+        port => {"HB_PORT", fun erlang:list_to_integer/1, "8734"},
+        mode => {"HB_MODE", fun list_to_existing_atom/1},
+        debug_print =>
+            {"HB_PRINT",
+                fun
+                    ({preparsed, Parsed}) -> Parsed;
+                    (Str) when Str == "1" -> true;
+                    (Str) when Str == "true" -> true;
+                    (Str) ->
+                        lists:map(
+                            fun(Topic) -> list_to_atom(Topic) end,
+                            string:tokens(Str, ",")
+                        )
+                end,
+                {preparsed, ?DEFAULT_PRINT_OPTS}
+            },
+        lua_scripts => {"LUA_SCRIPTS", "scripts"},
+        lua_tests => {"LUA_TESTS", fun dev_lua_test:parse_spec/1, tests},
+        default_index =>
+            {
+                "HB_INDEX",
+                fun("ui") ->
+                    #{
+                        <<"device">> => <<"hyperbuddy@1.0">>
+                    };
+                   ("text") ->
+                    #{
+                        <<"device">> => <<"hyperbuddy@1.0">>,
+                        <<"path">> => <<"format">>
+                    };
+                   (Str) ->
+                    case string:tokens(Str, "/") of
+                        [Device, Path] ->
+                            #{ <<"device">> => Device, <<"path">> => Path };
+                        [Device] ->
+                            #{ <<"device">> => Device }
+                    end
+                end,
+                "ui"
+            }
+    }
+).
+
+%% @doc Return the default message with all environment variables set.
+default_message_with_env() ->
+    maps:fold(
+        fun(Key, _Spec, NodeMsg) ->
+            case global_get(Key, undefined, #{}) of
+                undefined -> NodeMsg;
+                Value -> NodeMsg#{ Key => Value }
+            end
+        end,
+        default_message(),
+        ?ENV_KEYS
+    ).
+
 %% @doc The default configuration options of the hyperbeam node.
 default_message() ->
     #{
@@ -37,7 +117,6 @@ default_message() ->
         %% Options: aggressive, lazy
         compute_mode => lazy,
         %% Choice of remote nodes for tasks that are not local to hyperbeam.
-        host => <<"localhost">>,
         gateway => <<"https://arweave.net">>,
         bundler_ans104 => <<"https://up.arweave.net:443">>,
         %% Location of the wallet keyfile on disk that this node will use.
@@ -49,10 +128,14 @@ default_message() ->
         %% Preloaded devices for the node to use. These names override
         %% resolution of devices via ID to the default implementations.
         preloaded_devices => [
+            #{<<"name">> => <<"arweave@2.9-pre">>, <<"module">> => dev_arweave},
+            #{<<"name">> => <<"apply@1.0">>, <<"module">> => dev_apply},
+            #{<<"name">> => <<"auth-hook@1.0">>, <<"module">> => dev_auth_hook},
             #{<<"name">> => <<"ans104@1.0">>, <<"module">> => dev_codec_ans104},
             #{<<"name">> => <<"compute@1.0">>, <<"module">> => dev_cu},
             #{<<"name">> => <<"cache@1.0">>, <<"module">> => dev_cache},
             #{<<"name">> => <<"cacheviz@1.0">>, <<"module">> => dev_cacheviz},
+            #{<<"name">> => <<"cookie@1.0">>, <<"module">> => dev_codec_cookie},
             #{<<"name">> => <<"cron@1.0">>, <<"module">> => dev_cron},
             #{<<"name">> => <<"dedup@1.0">>, <<"module">> => dev_dedup},
             #{<<"name">> => <<"delegated-compute@1.0">>, <<"module">> => dev_delegated_compute},
@@ -61,7 +144,10 @@ default_message() ->
             #{<<"name">> => <<"genesis-wasm@1.0">>, <<"module">> => dev_genesis_wasm},
             #{<<"name">> => <<"greenzone@1.0">>, <<"module">> => dev_green_zone},
             #{<<"name">> => <<"httpsig@1.0">>, <<"module">> => dev_codec_httpsig},
+            #{<<"name">> => <<"http-auth@1.0">>, <<"module">> => dev_codec_http_auth},
+            #{<<"name">> => <<"hook@1.0">>, <<"module">> => dev_hook},
             #{<<"name">> => <<"hyperbuddy@1.0">>, <<"module">> => dev_hyperbuddy},
+            #{<<"name">> => <<"copycat@1.0">>, <<"module">> => dev_copycat},
             #{<<"name">> => <<"json@1.0">>, <<"module">> => dev_codec_json},
             #{<<"name">> => <<"json-iface@1.0">>, <<"module">> => dev_json_iface},
             #{<<"name">> => <<"local-name@1.0">>, <<"module">> => dev_local_name},
@@ -78,7 +164,9 @@ default_message() ->
             #{<<"name">> => <<"patch@1.0">>, <<"module">> => dev_patch},
             #{<<"name">> => <<"poda@1.0">>, <<"module">> => dev_poda},
             #{<<"name">> => <<"process@1.0">>, <<"module">> => dev_process},
+            #{<<"name">> => <<"profile@1.0">>, <<"module">> => dev_profile},
             #{<<"name">> => <<"push@1.0">>, <<"module">> => dev_push},
+            #{<<"name">> => <<"query@1.0">>, <<"module">> => dev_query},
             #{<<"name">> => <<"relay@1.0">>, <<"module">> => dev_relay},
             #{<<"name">> => <<"router@1.0">>, <<"module">> => dev_router},
             #{<<"name">> => <<"scheduler@1.0">>, <<"module">> => dev_scheduler},
@@ -87,9 +175,12 @@ default_message() ->
             #{<<"name">> => <<"stack@1.0">>, <<"module">> => dev_stack},
             #{<<"name">> => <<"structured@1.0">>, <<"module">> => dev_codec_structured},
             #{<<"name">> => <<"test-device@1.0">>, <<"module">> => dev_test},
+            #{<<"name">> => <<"trie@1.0">>, <<"module">> => dev_trie},
             #{<<"name">> => <<"volume@1.0">>, <<"module">> => dev_volume},
+            #{<<"name">> => <<"secret@1.0">>, <<"module">> => dev_secret},
             #{<<"name">> => <<"wasi@1.0">>, <<"module">> => dev_wasi},
-            #{<<"name">> => <<"wasm-64@1.0">>, <<"module">> => dev_wasm}
+            #{<<"name">> => <<"wasm-64@1.0">>, <<"module">> => dev_wasm},
+            #{<<"name">> => <<"whois@1.0">>, <<"module">> => dev_whois}
         ],
         %% Default execution cache control options
         cache_control => [<<"no-cache">>, <<"no-store">>],
@@ -109,7 +200,7 @@ default_message() ->
         %% HTTP request options
         http_connect_timeout => 5000,
         http_keepalive => 120000,
-        http_request_send_timeout => 60000,
+        http_request_send_timeout => 300_000,
         port => 8734,
         wasm_allow_aot => false,
         %% Options for the relay device
@@ -118,33 +209,61 @@ default_message() ->
         commitment_device => <<"httpsig@1.0">>,
         %% Dev options
         mode => debug,
+        profiling => true,
         % Every modification to `Opts' called directly by the node operator
         % should be recorded here.
         node_history => [],
         debug_stack_depth => 40,
+        debug_print => false,
         debug_print_map_line_threshold => 30,
         debug_print_binary_max => 60,
         debug_print_indent => 2,
-        debug_print => false,
-        stack_print_prefixes => ["hb", "dev", "ar"],
-        debug_print_trace => short, % `short' | `false'. Has performance impact.
-        short_trace_len => 5,
+        stack_print_prefixes => ["hb", "dev", "ar", "maps"],
+        debug_print_trace => short, % `short` | `false`. Has performance impact.
+        debug_trace_type => ?DEFAULT_TRACE_TYPE,
+        short_trace_len => 20,
         debug_metadata => true,
         debug_ids => true,
-        debug_committers => false,
-        debug_show_priv => false,
-        snp_trusted => [],
+        debug_committers => true,
+        debug_show_priv => if_present,
+        debug_resolve_links => true,
+        debug_print_fail_mode => long,
+		trusted => #{},
+        snp_enforced_keys => [
+            firmware, kernel, 
+            initrd, append,
+            vmm_type, guest_features
+        ],
         routes => [
             #{
                 % Routes for the genesis-wasm device to use a local CU, if requested.
                 <<"template">> => <<"/result/.*">>,
                 <<"node">> => #{ <<"prefix">> => <<"http://localhost:6363">> }
             },
+            #{
+                % Routes for the genesis-wasm device to use a local CU, if requested.
+                <<"template">> => <<"/snapshot/.*">>,
+                <<"node">> => #{ <<"prefix">> => <<"http://localhost:6363">> }
+            },
+            #{
+                % Routes for the genesis-wasm device to use a local CU, if requested.
+                <<"template">> => <<"/dry-run.*">>,
+                <<"node">> => #{ <<"prefix">> => <<"http://localhost:6363">> }
+            },
+            #{
+                % Routes for the genesis-wasm device to use a local CU, if requested.
+                <<"template">> => <<"/state.*">>,
+                <<"node">> => #{ <<"prefix">> => <<"http://localhost:6363">> }
+            },
             #{
                 % Routes for GraphQL requests to use a remote GraphQL API.
                 <<"template">> => <<"/graphql">>,
                 <<"nodes">> =>
                     [
+                        #{
+                            <<"prefix">> => <<"https://ao-search-gateway.goldsky.com">>,
+                            <<"opts">> => #{ http_client => httpc, protocol => http2 }
+                        },
                         #{
                             <<"prefix">> => <<"https://arweave-search.goldsky.com">>,
                             <<"opts">> => #{ http_client => httpc, protocol => http2 }
@@ -155,6 +274,16 @@ default_message() ->
                         }
                     ]
             },
+            #{
+                % Routes for Arweave transaction requests to use a remote gateway.
+                <<"template">> => <<"/arweave">>,
+                <<"node">> =>
+                    #{
+                        <<"match">> => <<"^/arweave">>,
+                        <<"with">> => <<"https://arweave.net">>,
+                        <<"opts">> => #{ http_client => httpc, protocol => http2 }
+                    }
+            },
             #{
                 % Routes for raw data requests to use a remote gateway.
                 <<"template">> => <<"/raw">>,
@@ -167,9 +296,10 @@ default_message() ->
         ],
         store =>
             [
+                ?DEFAULT_PRIMARY_STORE,
                 #{
                     <<"store-module">> => hb_store_fs,
-                    <<"prefix">> => <<"cache-mainnet">>
+                    <<"name">> => <<"cache-mainnet">>
                 },
                 #{
                     <<"store-module">> => hb_store_gateway,
@@ -179,25 +309,21 @@ default_message() ->
                             <<"value">> => <<"ao">>
                         }
                     ],
-                    <<"store">> => 
-                     [
-                        #{
-                            <<"store-module">> => hb_store_fs,
-                            <<"prefix">> => <<"cache-mainnet">>
-                         }
-                     ]
+                    <<"local-store">> => [?DEFAULT_PRIMARY_STORE]
                 },
                 #{
                     <<"store-module">> => hb_store_gateway,
-                    <<"store">> =>
-                        [
-                            #{
-                                <<"store-module">> => hb_store_fs,
-                                <<"prefix">> => <<"cache-mainnet">>
-                            }
-                        ]
+                    <<"local-store">> => [?DEFAULT_PRIMARY_STORE]
+                }
+            ],
+        priv_store =>
+            [
+                #{
+                    <<"store-module">> => hb_store_fs,
+                    <<"name">> => <<"cache-priv">>
                 }
             ],
+        %default_index => #{ <<"device">> => <<"hyperbuddy@1.0">> },
         % Should we use the latest cached state of a process when computing?
         process_now_from_cache => false,
         % Should we trust the GraphQL API when converting to ANS-104? Some GQL
@@ -212,7 +338,30 @@ default_message() ->
         % Should the node store all signed messages?
         store_all_signed => true,
         % Should the node use persistent processes?
-        process_workers => false
+        process_workers => false,
+        % Options for the router device
+        router_opts => #{
+            routes => []
+        },
+        on => #{
+            <<"request">> => #{
+                <<"device">> => <<"auth-hook@1.0">>,
+                <<"path">> => <<"request">>,
+                <<"when">> => #{
+                    <<"keys">> => [<<"authorization">>, <<"!">>]
+                },
+                <<"secret-provider">> =>
+                    #{
+                        <<"device">> => <<"http-auth@1.0">>,
+                        <<"access-control">> =>
+                            #{ <<"device">> => <<"http-auth@1.0">> }
+                    }
+            }
+        },
+        genesis_wasm_import_authorities =>
+            [
+                <<"WjnS-s03HWsDSdMnyTdzB1eHZB2QheUWP_FVRVYxkXk">>
+            ]
         % Should the node track and expose prometheus metrics?
         % We do not set this explicitly, so that the hb_features:test() value
         % can be used to determine if we should expose metrics instead,
@@ -232,94 +381,87 @@ get(Key) -> ?MODULE:get(Key, undefined).
 get(Key, Default) -> ?MODULE:get(Key, Default, #{}).
 get(Key, Default, Opts) when is_binary(Key) ->
     try binary_to_existing_atom(Key, utf8) of
-        AtomKey -> get(AtomKey, Default, Opts)
+        AtomKey -> do_get(AtomKey, Default, Opts)
     catch
-        error:badarg -> Default
+        error:badarg -> do_get(Key, Default, Opts)
     end;
-get(Key, Default, Opts = #{ <<"only">> := Only }) ->
-    get(Key, Default, maps:remove(<<"only">>, Opts#{ only => Only }));
-get(Key, Default, Opts = #{ <<"prefer">> := Prefer }) ->
-    get(Key, Default, maps:remove(<<"prefer">>, Opts#{ prefer => Prefer }));
-get(Key, Default, Opts = #{ only := local }) ->
+get(Key, Default, Opts) ->
+    do_get(Key, Default, Opts).
+do_get(Key, Default, Opts = #{ <<"only">> := Only }) ->
+    do_get(Key, Default, maps:remove(<<"only">>, Opts#{ only => Only }));
+do_get(Key, Default, Opts = #{ <<"prefer">> := Prefer }) ->
+    do_get(Key, Default, maps:remove(<<"prefer">>, Opts#{ prefer => Prefer }));
+do_get(Key, Default, Opts = #{ only := local }) ->
     case maps:find(Key, Opts) of
         {ok, Value} -> Value;
         error -> 
             Default
     end;
-get(Key, Default, #{ only := global }) ->
-    case global_get(Key, hb_opts_not_found) of
+do_get(Key, Default, Opts = #{ only := global }) ->
+    case global_get(Key, hb_opts_not_found, Opts) of
         hb_opts_not_found -> Default;
         Value -> Value
     end;
-get(Key, Default, Opts = #{ prefer := global }) ->
-    case ?MODULE:get(Key, hb_opts_not_found, #{ only => global }) of
-        hb_opts_not_found -> ?MODULE:get(Key, Default, Opts#{ only => local });
+do_get(Key, Default, Opts = #{ prefer := global }) ->
+    case do_get(Key, hb_opts_not_found, #{ only => global }) of
+        hb_opts_not_found -> do_get(Key, Default, Opts#{ only => local });
         Value -> Value
     end;
-get(Key, Default, Opts = #{ prefer := local }) ->
-    case ?MODULE:get(Key, hb_opts_not_found, Opts#{ only => local }) of
+do_get(Key, Default, Opts = #{ prefer := local }) ->
+    case do_get(Key, hb_opts_not_found, Opts#{ only => local }) of
         hb_opts_not_found ->
-            ?MODULE:get(Key, Default, Opts#{ only => global });
+            do_get(Key, Default, Opts#{ only => global });
         Value -> Value
     end;
-get(Key, Default, Opts) ->
+do_get(Key, Default, Opts) ->
     % No preference was set in Opts, so we default to local.
-    ?MODULE:get(Key, Default, Opts#{ prefer => local }).
-
--ifdef(TEST).
--define(DEFAULT_PRINT_OPTS, "error,http_error").
--else.
--define(DEFAULT_PRINT_OPTS, "error,http_error,http_short,compute_short,push_short").
--endif.
+    do_get(Key, Default, Opts#{ prefer => local }).
 
--define(ENV_KEYS,
-    #{
-        priv_key_location => {"HB_KEY", "hyperbeam-key.json"},
-        hb_config_location => {"HB_CONFIG", "config.flat"},
-        port => {"HB_PORT", fun erlang:list_to_integer/1, "8734"},
-        mode => {"HB_MODE", fun list_to_existing_atom/1},
-        debug_print =>
-            {"HB_PRINT",
-                fun
-                    (Str) when Str == "1" -> true;
-                    (Str) when Str == "true" -> true;
-                    (Str) ->
-                        lists:map(fun hb_util:bin/1, string:tokens(Str, ","))
+%% @doc Get an environment variable or configuration key. Depending on whether
+%% the value is derived from an environment variable, we may be able to cache
+%% the result in the process dictionary.
+global_get(Key, Default, Opts) ->
+    case erlang:get({processed_env, Key}) of
+        {cached, Value} -> Value;
+        undefined ->
+            % Thee value is not cached, so we need to process it.
+            {IsCachable, Value} =
+                case maps:get(Key, ?ENV_KEYS, Default) of
+                    Default -> {false, config_lookup(Key, Default, Opts)};
+                    {EnvKey, ValParser, DefaultValue} when is_function(ValParser) ->
+                        {true, ValParser(
+                            cached_os_env(
+                                EnvKey,
+                                normalize_default(DefaultValue)
+                            )
+                        )};
+                    {EnvKey, ValParser} when is_function(ValParser) ->
+                        case cached_os_env(EnvKey, not_found) of
+                            not_found -> {false, config_lookup(Key, Default, Opts)};
+                            V -> {true, ValParser(V)}
+                        end;
+                    {EnvKey, DefaultValue} ->
+                        {true, cached_os_env(EnvKey, DefaultValue)}
                 end,
-                ?DEFAULT_PRINT_OPTS
-            },
-        lua_scripts => {"LUA_SCRIPTS", "scripts"},
-        lua_tests => {"LUA_TESTS", fun dev_lua_test:parse_spec/1, tests}
-    }
-).
-
-%% @doc Get an environment variable or configuration key.
-global_get(Key, Default) ->
-    case maps:get(Key, ?ENV_KEYS, Default) of
-        Default -> config_lookup(Key, Default);
-        {EnvKey, ValParser, DefaultValue} when is_function(ValParser) ->
-            ValParser(cached_os_env(EnvKey, normalize_default(DefaultValue)));
-        {EnvKey, ValParser} when is_function(ValParser) ->
-            case cached_os_env(EnvKey, not_found) of
-                not_found -> config_lookup(Key, Default);
-                Value -> ValParser(Value)
-            end;
-        {EnvKey, DefaultValue} ->
-            cached_os_env(EnvKey, DefaultValue)
+            % Cache the result if it is immutable and return.
+            if IsCachable -> erlang:put({processed_env, Key}, {cached, Value});
+            true -> ok
+            end,
+            Value
     end.
 
 %% @doc Cache the result of os:getenv/1 in the process dictionary, as it never
 %% changes during the lifetime of a node.
 cached_os_env(Key, DefaultValue) ->
     case erlang:get({os_env, Key}) of
+        {cached, false} -> DefaultValue;
+        {cached, Value} -> Value;
         undefined ->
-            case os:getenv(Key) of
-                false -> DefaultValue;
-                Value ->
-                    erlang:put({os_env, Key}, Value),
-                    Value
-            end;
-        Value -> Value
+            % The process dictionary returns `undefined' for a key that is not
+            % set, so we need to check the environment and store the result.
+            erlang:put({os_env, Key}, {cached, os:getenv(Key)}),
+            % We recurse to follow the normal path.
+            cached_os_env(Key, DefaultValue)
     end.
 
 %% @doc Get an option from environment variables, optionally consulting the
@@ -334,31 +476,86 @@ normalize_default(Default) -> Default.
 %% @doc An abstraction for looking up configuration variables. In the future,
 %% this is the function that we will want to change to support a more dynamic
 %% configuration system.
-config_lookup(Key, Default) -> maps:get(Key, default_message(), Default).
+config_lookup(Key, Default, _Opts) -> maps:get(Key, default_message(), Default).
 
 %% @doc Parse a `flat@1.0' encoded file into a map, matching the types of the 
 %% keys to those in the default message.
-load(Path) ->
+load(Path) -> load(Path, #{}).
+load(Path, Opts) ->
+    {ok, Device} = path_to_device(Path),
     case file:read_file(Path) of
         {ok, Bin} ->
-            load_bin(Bin);
+            load_bin(Device, Bin, Opts);
         _ -> {error, not_found}
     end.
-load_bin(Bin) ->
-    try dev_codec_flat:deserialize(Bin) of
-        {ok, Map} -> {ok, mimic_default_types(Map, new_atoms)}
+
+%% @doc Convert a path to a device from its file extension. If no extension is
+%% provided, we default to `flat@1.0'.
+path_to_device(Path) ->
+    case binary:split(hb_util:bin(Path), <<".">>, []) of
+        [_, Extension] ->
+            ?event(debug_node_msg,
+                {path_to_device,
+                    {path, Path},
+                    {extension, Extension}
+                }
+            ),
+            extension_to_device(Extension);
+        _ -> {ok, <<"flat@1.0">>}
+    end.
+
+%% @doc Convert a file extension to a device name.
+extension_to_device(Ext) ->
+    extension_to_device(Ext, maps:get(preloaded_devices, default_message())).
+extension_to_device(_, []) -> {error, not_found};
+extension_to_device(Ext, [#{ <<"name">> := Name }|Rest]) ->
+    case binary:match(Name, Ext) of
+        nomatch -> extension_to_device(Ext, Rest);
+        {0, _} -> {ok, Name}
+    end.
+
+%% @doc Parse a given binary with a device (defaulting to `flat@1.0') into a
+%% node message. Types are converted to match those in the default message, if
+%% applicable.
+load_bin(Bin, Opts) ->
+    load_bin(<<"flat@1.0">>, Bin, Opts).
+load_bin(<<"flat@1.0">>, Bin, Opts) ->
+    % Trim trailing whitespace from each line in the file.
+    Ls =
+        lists:map(
+            fun(Line) -> string:trim(Line, trailing) end,
+            binary:split(Bin, <<"\n">>, [global])
+        ),
+    try dev_codec_flat:deserialize(iolist_to_binary(lists:join(<<"\n">>, Ls))) of
+        {ok, Map} ->
+            {ok, mimic_default_types(Map, new_atoms, Opts)}
     catch
         error:B -> {error, B}
+    end;
+load_bin(Device, Bin, Opts) ->
+    try
+        {
+            ok,
+            mimic_default_types(
+                hb_cache:ensure_all_loaded(
+                    hb_message:convert(Bin, <<"structured@1.0">>, Device, Opts),
+                    Opts
+                ),
+                new_atoms,
+                Opts
+            )
+        }
+    catch error:B -> {error, B}
     end.
 
 %% @doc Mimic the types of the default message for a given map.
-mimic_default_types(Map, Mode) ->
-    Default = default_message(),
-    maps:from_list(lists:map(
+mimic_default_types(Map, Mode, Opts) ->
+    Default = default_message_with_env(),
+    hb_maps:from_list(lists:map(
         fun({Key, Value}) ->
             NewKey = try hb_util:key_to_atom(Key, Mode) catch _:_ -> Key end,
             NewValue = 
-                case maps:get(NewKey, Default, not_found) of
+                case hb_maps:get(NewKey, Default, not_found, Opts) of
                     not_found -> Value;
                     DefaultValue when is_atom(DefaultValue) ->
                         hb_util:atom(Value);
@@ -372,43 +569,69 @@ mimic_default_types(Map, Mode) ->
                 end,
             {NewKey, NewValue}
         end,
-        maps:to_list(Map)
+        hb_maps:to_list(Map, Opts)
     )).
-    
-%% @doc Validate that the node_history length is within an acceptable range.
-%% @param Opts The options map containing node_history
-%% @param MinLength The minimum acceptable length of node_history
-%% @param MaxLength The maximum acceptable length of node_history
-%% @returns `{ok, Length}' if `MinLength =< Length =< MaxLength',
-%% or `{error, Reason}' if the length is outside the range.
-validate_node_history(Opts) ->
-    validate_node_history(Opts, 1, 1).
-validate_node_history(Opts, MinLength, MaxLength) ->
-    Length = length(hb_opts:get(node_history, [], Opts)),
-    if
-        Length >= MinLength, Length =< MaxLength -> 
-            {ok, Length};
-        Length < MinLength -> 
-            {
-                error,
-                <<
-                    "Node history too short. Expected at least ",
-                    (integer_to_binary(MinLength))/binary,
-                    " entries, got ",
-                    (integer_to_binary(Length))/binary,
-                    "."
-                >>
-            };
-        true -> 
-            {
-                error,
-                <<
-                    "Node history too long. Expected at most ",
-                    (integer_to_binary(MaxLength))/binary,
-                    " entries, got ",
-                    (integer_to_binary(Length))/binary,
-                    "."
-                >>
+
+%% @doc Find a given identity from the `identities' map, and return the options
+%% merged with the sub-options for that identity.
+as(Identity, Opts) ->
+    case identities(Opts) of
+        #{ Identity := SubOpts } ->
+            ?event({found_identity_sub_opts_are, SubOpts}),
+            {ok, maps:merge(Opts, mimic_default_types(SubOpts, new_atoms, Opts))};
+        _ ->
+            {error, not_found}
+    end.
+
+%% @doc Find all known IDs and their sub-options from the `priv_ids' map. Allows
+%% the identities to be named, or based on addresses. The results are normalized
+%% such that the map returned by this function contains both mechanisms for 
+%% finding an identity and its sub-options. Additionally, sub-options are also
+%% normalized such that the `address' property is present and accurate for all
+%% given identities.
+identities(Opts) ->
+    identities(hb:wallet(), Opts).
+identities(Default, Opts) ->
+    Named = ?MODULE:get(identities, #{}, Opts),
+    % Generate an address-based map of identities.
+    Addresses =
+        maps:from_list(lists:filtermap(
+            fun({_Name, SubOpts}) ->
+                case maps:find(priv_wallet, SubOpts) of
+                    {ok, Wallet} ->
+                        Addr = hb_util:human_id(ar_wallet:to_address(Wallet)),
+                        {true, {Addr, SubOpts}};
+                    error -> false
+                end
+            end,
+            maps:to_list(Named)
+        )),
+    % Merge the named and address-based maps. Normalize each result to ensure
+    % that the `address' property is present and accurate.
+    Identities =
+        maps:map(
+            fun(_NameOrID, SubOpts) ->
+                case maps:find(priv_wallet, SubOpts) of
+                    {ok, Wallet} ->
+                        SubOpts#{ <<"address">> => hb_util:human_id(Wallet) };
+                    error -> SubOpts
+                end
+            end,
+            maps:merge(Named, Addresses)
+        ),
+    ?event({identities_without_default, Identities}),
+    % Add a default identity if one is not already present.
+    DefaultWallet = ?MODULE:get(priv_wallet, Default, Opts),
+    case maps:find(DefaultID = hb_util:human_id(DefaultWallet), Identities) of
+        {ok, _} -> Identities;
+        error ->
+            Identities#{
+                DefaultID => #{
+                    priv_wallet => DefaultWallet
+                },
+                <<"default">> => #{
+                    priv_wallet => DefaultWallet
+                }
             }
     end.
 
@@ -444,6 +667,72 @@ check_required_opts(KeyValuePairs, Opts) ->
             {error, ErrorMsg}
     end.
 
+%% @doc Ensures all items in a node history meet required configuration options.
+%%
+%% This function verifies that the first item (complete opts) contains all required
+%% configuration options and that their values match the expected format. Then it
+%% validates that subsequent history items (which represent differences) never
+%% modify any of the required keys from the first item.
+%%
+%% Validation is performed in two steps:
+%% 1. Checks that the first item has all required keys and valid values
+%% 2. Verifies that subsequent items don't modify any required keys from the first item
+%%
+%% @param Opts The complete options map (will become first item in history)
+%% @param RequiredOpts A map of options that must be present and unchanging
+%% @returns {ok, <<"valid">>} when validation passes
+%% @returns {error, <<"missing_keys">>} when required keys are missing from first item
+%% @returns {error, <<"invalid_values">>} when first item values don't match requirements
+%% @returns {error, <<"modified_required_key">>} when history items modify required keys
+%% @returns {error, <<"validation_failed">>} when other validation errors occur
+-spec ensure_node_history(NodeHistory :: list() | term(), RequiredOpts :: map()) -> 
+    {ok, binary()} | {error, binary()}.
+ensure_node_history(Opts, RequiredOpts) ->
+    ?event(validate_history_items, {required_opts, RequiredOpts}),
+    maybe
+        % Get the node history from the options
+        NodeHistory = hb_opts:get(node_history, [], Opts),
+        % Add the Opts to the node history to validate all items
+        NodeHistoryWithOpts = [ Opts | NodeHistory ],
+        % Normalize required options
+        NormalizedRequiredOpts ?= hb_ao:normalize_keys(RequiredOpts),
+        % Normalize all node history items once
+        NormalizedNodeHistory ?= lists:map(
+            fun(Item) -> 
+                hb_ao:normalize_keys(Item)
+            end,
+            NodeHistoryWithOpts
+        ),
+        % Get the first item (complete opts) and remaining items (differences)
+        [FirstItem | RemainingItems] = NormalizedNodeHistory,
+        % Step 2: Validate first item values match requirements
+        FirstItemValuesMatch = hb_message:match(NormalizedRequiredOpts, FirstItem, primary),
+        true ?= (FirstItemValuesMatch == true) orelse {error, values_invalid},
+        % Step 3: Check that remaining items don't modify required keys
+        NoRequiredKeysModified = lists:all(
+            fun(HistoryItem) ->
+                % For each required key, if it exists in this history item,
+                % it must match the value from the first item
+                hb_message:match(RequiredOpts, HistoryItem, only_present)
+            end,
+            RemainingItems
+        ),
+        true ?= NoRequiredKeysModified orelse {error, required_key_modified},
+        % If we've made it this far, everything is valid
+        ?event({validate_node_history_items, all_items_valid}),
+        {ok, valid}
+    else
+        {error, values_invalid} ->
+            ?event({validate_node_history_items, validation_failed, invalid_values}),
+            {error, invalid_values};
+        {error, required_key_modified} ->
+            ?event({validate_node_history_items, validation_failed, required_key_modified}),
+            {error, modified_required_key};
+        _ ->
+            ?event({validate_node_history_items, validation_failed, unknown}),
+            {error, validation_failed}
+    end.
+
 %%% Tests
 
 -ifdef(TEST).
@@ -478,37 +767,167 @@ global_preference_test() ->
         ?MODULE:get(mode, undefined, Global#{ mode => incorrect })),
     ?assertNotEqual(undefined, ?MODULE:get(mode, undefined, Global)).
 
-load_test() ->
+load_flat_test() ->
     % File contents:
     % port: 1234
     % host: https://ao.computer
     % await-inprogress: false
-    {ok, Conf} = load("test/config.flat"),
+    {ok, Conf} = load("test/config.flat", #{}),
     ?event({loaded, {explicit, Conf}}),
     % Ensure we convert types as expected.
-    ?assertEqual(1234, maps:get(port, Conf)),
+    ?assertEqual(1234, hb_maps:get(port, Conf)),
     % A binary
-    ?assertEqual(<<"https://ao.computer">>, maps:get(host, Conf)),
+    ?assertEqual(<<"https://ao.computer">>, hb_maps:get(host, Conf)),
     % An atom, where the key contained a header-key `-' rather than a `_'.
-    ?assertEqual(false, maps:get(await_inprogress, Conf)).
+    ?assertEqual(false, hb_maps:get(await_inprogress, Conf)).
+
+load_json_test() ->
+    {ok, Conf} = load("test/config.json", #{}),
+    ?event(debug_node_msg, {loaded, Conf}),
+    ?assertEqual(1234, hb_maps:get(port, Conf)),
+    ?assertEqual(9001, hb_maps:get(example, Conf)),
+    % A binary
+    ?assertEqual(<<"https://ao.computer">>, hb_maps:get(host, Conf)),
+    % An atom, where the key contained a header-key `-' rather than a `_'.
+    ?assertEqual(false, hb_maps:get(await_inprogress, Conf)),
+    % Ensure that a store with `ao-types' is loaded correctly.
+    ?assertMatch(
+        [#{ <<"store-module">> := hb_store_fs }|_],
+        hb_maps:get(store, Conf)
+    ).
+
+as_identity_test() ->
+    DefaultWallet = ar_wallet:new(),
+    TestWallet1 = ar_wallet:new(),
+    TestWallet2 = ar_wallet:new(),
+    TestID2 = hb_util:human_id(TestWallet2),
+    Opts = #{
+        test_key => 0,
+        priv_wallet => DefaultWallet,
+        identities => #{
+            <<"testname-1">> => #{
+                priv_wallet => TestWallet1,
+                test_key => 1
+            },
+            TestID2 => #{
+                priv_wallet => TestWallet2,
+                test_key => 2
+            }
+        }
+    },
+    ?event({base_opts, Opts}),
+    Identities = identities(Opts),
+    ?event({identities, Identities}),
+    % The number of identities should be 5: `default`, its ID, `testname-1`,
+    % and its ID, and just the ID of `TestWallet2`.
+    ?assertEqual(5, maps:size(Identities)),
+    % The wallets for each of the names should be the same as the wallets we
+    % provided. We also check that the settings are applied correctly.
+    ?assertMatch(
+        {ok, #{ priv_wallet := DefaultWallet, test_key := 0 }},
+        as(<<"default">>, Opts)
+    ),
+    ?assertMatch(
+        {ok, #{ priv_wallet := DefaultWallet, test_key := 0 }},
+        as(hb_util:human_id(DefaultWallet), Opts)
+    ),
+    ?assertMatch(
+        {ok, #{ priv_wallet := TestWallet1, test_key := 1 }},
+        as(<<"testname-1">>, Opts)
+    ),
+    ?assertMatch(
+        {ok, #{ priv_wallet := TestWallet1, test_key := 1 }},
+        as(hb_util:human_id(TestWallet1), Opts)
+    ),
+    ?assertMatch(
+        {ok, #{ priv_wallet := TestWallet2, test_key := 2 }},
+        as(TestID2, Opts)
+    ).
+    
+ensure_node_history_test() ->
+    % Define some test data
+    RequiredOpts = #{
+        key1 => 
+            #{
+                <<"type">> => <<"string">>,
+                <<"value">> => <<"value1">>
+            },
+        key2 => <<"value2">>
+    },
+    % Test case: All items have required options
+    ValidOpts =
+    #{
+        <<"key1">> => 
+            #{
+                <<"type">> => <<"string">>,
+                <<"value">> => <<"value1">>
+            }, 
+        <<"key2">> => <<"value2">>, 
+        <<"extra">> => <<"value">>,
+        node_history => [
+            #{
+                <<"key1">> => 
+                    #{
+                        <<"type">> => <<"string">>,
+                        <<"value">> => <<"value1">>
+                    }, 
+                <<"key2">> => <<"value2">>, 
+                <<"extra">> => <<"value">>
+            },
+            #{
+                <<"key1">> => 
+                    #{
+                        <<"type">> => <<"string">>,
+                        <<"value">> => <<"value1">>
+                    }, 
+                <<"key2">> => <<"value2">>
+            }
+        ]
+    },
+    ?assertEqual({ok, valid}, ensure_node_history(ValidOpts, RequiredOpts)),
+    ?event({valid_items, ValidOpts}),
+    % Test Missing items
+    MissingItems = 
+    #{
+        <<"key1">> => 
+            #{
+                <<"type">> => <<"string">>,
+                <<"value">> => <<"value1">>
+            }, 
+        node_history => [
+            #{
+                <<"key1">> => 
+                    #{
+                        <<"type">> => <<"string">>,
+                        <<"value">> => <<"value1">>
+                    }
+                % missing key2
 
-validate_node_history_test() ->
-    % Test default values (min=1, max=1)
-    ?assertEqual({ok, 1}, validate_node_history(#{node_history => [entry1]})),
-    ?assertEqual({error, <<"Node history too short. Expected at least 1 entries, got 0.">>}, 
-                 validate_node_history(#{})),
-    ?assertEqual({error, <<"Node history too long. Expected at most 1 entries, got 2.">>}, 
-                 validate_node_history(#{node_history => [entry1, entry2]})),
-    % Test with custom range
-    ?assertEqual({ok, 0}, validate_node_history(#{}, 0, 2)),
-    ?assertEqual({ok, 1}, validate_node_history(#{node_history => [entry1]}, 0, 2)),
-    ?assertEqual({ok, 2}, validate_node_history(#{node_history => [entry1, entry2]}, 0, 2)),
-    % Test range validations
-    ?assertEqual({error, <<"Node history too short. Expected at least 2 entries, got 1.">>}, 
-                 validate_node_history(#{node_history => [entry1]}, 2, 4)),
-    ?assertEqual({error, <<"Node history too long. Expected at most 2 entries, got 3.">>}, 
-                 validate_node_history(#{node_history => [entry1, entry2, entry3]}, 1, 2)),
-    % Test edge cases
-    ?assertEqual({ok, 3}, validate_node_history(#{node_history => [entry1, entry2, entry3]}, 3, 3)),
-    ?assertEqual({ok, 0}, validate_node_history(#{}, 0, 0)).
--endif.
\ No newline at end of file
+            }
+        ]
+    },
+    ?assertEqual({error, invalid_values}, ensure_node_history(MissingItems, RequiredOpts)),
+    ?event({missing_items, MissingItems}),
+    % Test Invalid items
+    InvalidItems =
+        #{
+            <<"key1">> => 
+                #{
+                    <<"type">> => <<"string">>,
+                    <<"value">> => <<"value">>
+                }, 
+            <<"key2">> => <<"value2">>,
+            node_history =>
+                [
+                    #{
+                        <<"key1">> => 
+                            #{
+                                <<"type">> => <<"string">>,
+                                <<"value">> => <<"value2">>
+                            },
+                        <<"key2">> => <<"value3">>
+                    }
+                ]
+        },
+    ?assertEqual({error, invalid_values}, ensure_node_history(InvalidItems, RequiredOpts)).
+-endif.
diff --git a/src/hb_path.erl b/src/hb_path.erl
index e90758c0c..f2788842f 100644
--- a/src/hb_path.erl
+++ b/src/hb_path.erl
@@ -29,11 +29,14 @@
 %%% message. When Msg2's are applied to a Msg1, the resulting Msg3's HashPath
 %%% will be generated according to Msg1's algorithm choice.
 -module(hb_path).
--export([hashpath/2, hashpath/3, hashpath/4, hashpath_alg/1]).
--export([hd/2, tl/2, push_request/2, queue_request/2, pop_request/2]).
--export([priv_remaining/2, priv_store_remaining/2]).
+-export([hashpath/2, hashpath/3, hashpath/4, hashpath_alg/2]).
+-export([hd/2, tl/2]).
+-export([push_request/2, push_request/3]).
+-export([queue_request/2, queue_request/3]).
+-export([pop_request/2]).
+-export([priv_remaining/2, priv_store_remaining/2, priv_store_remaining/3]).
 -export([verify_hashpath/2]).
--export([term_to_path_parts/1, term_to_path_parts/2, from_message/2]).
+-export([term_to_path_parts/1, term_to_path_parts/2, from_message/3]).
 -export([matches/2, to_binary/1, regex_matches/2, normalize/1]).
 -include("include/hb.hrl").
 -include_lib("eunit/include/eunit.hrl").
@@ -71,15 +74,17 @@ tl(Path, Opts) when is_list(Path) ->
 %% @doc Return the `Remaining-Path' of a message, from its hidden `AO-Core'
 %% key. Does not use the `get' or set `hb_private' functions, such that it
 %% can be safely used inside the main AO-Core resolve function.
-priv_remaining(Msg, _Opts) ->
+priv_remaining(Msg, Opts) ->
     Priv = hb_private:from_message(Msg),
-    AOCore = maps:get(<<"ao-core">>, Priv, #{}),
-    maps:get(<<"remaining">>, AOCore, undefined).
+    AOCore = hb_maps:get(<<"ao-core">>, Priv, #{}, Opts),
+    hb_maps:get(<<"remaining">>, AOCore, undefined, Opts).
 
 %% @doc Store the remaining path of a message in its hidden `AO-Core' key.
 priv_store_remaining(Msg, RemainingPath) ->
+    priv_store_remaining(Msg, RemainingPath, #{}).
+priv_store_remaining(Msg, RemainingPath, Opts) ->
     Priv = hb_private:from_message(Msg),
-    AOCore = maps:get(<<"ao-core">>, Priv, #{}),
+    AOCore = hb_maps:get(<<"ao-core">>, Priv, #{}, Opts),
     Msg#{
         <<"priv">> =>
             Priv#{
@@ -95,7 +100,7 @@ hashpath(Bin, _Opts) when is_binary(Bin) ->
     % Default hashpath for a binary message is its SHA2-256 hash.
     hb_util:human_id(hb_crypto:sha256(Bin));
 hashpath(RawMsg1, Opts) ->
-    Msg1 = hb_ao:normalize_keys(RawMsg1),
+    Msg1 = hb_ao:normalize_keys(RawMsg1, Opts),
     case hb_private:from_message(Msg1) of
         #{ <<"hashpath">> := HP } -> HP;
         _ ->
@@ -112,18 +117,26 @@ hashpath(RawMsg1, Opts) ->
                     )
                 )
             catch
-                _A:_B:_ST -> throw({badarg, {unsupported_type, Msg1}, _ST})
+                A:B:ST ->
+                    throw(
+                        {badarg,
+                            {unsupported_type, Msg1},
+                            {error, A},
+                            {details, B},
+                            {stacktrace, ST}
+                        }
+                    )
             end
     end.
 hashpath(Msg1, Msg2, Opts) when is_map(Msg1) ->
     Msg1Hashpath = hashpath(Msg1, Opts),
-    HashpathAlg = hashpath_alg(Msg1),
+    HashpathAlg = hashpath_alg(Msg1, Opts),
     hashpath(Msg1Hashpath, Msg2, HashpathAlg, Opts);
 hashpath(Msg1, Msg2, Opts) ->
     throw({hashpath_not_viable, Msg1, Msg2, Opts}).
 hashpath(Msg1, Msg2, HashpathAlg, Opts) when is_map(Msg2) ->
-    Msg2WithoutMeta = maps:without(?AO_CORE_KEYS, Msg2),
-    ReqPath = from_message(request, Msg2),
+    Msg2WithoutMeta = hb_maps:without(?AO_CORE_KEYS, Msg2, Opts),
+    ReqPath = from_message(request, Msg2, Opts),
     case {map_size(Msg2WithoutMeta), ReqPath} of
         {0, _} when ReqPath =/= undefined ->
             hashpath(Msg1, to_binary(hd(ReqPath)), HashpathAlg, Opts);
@@ -136,10 +149,10 @@ hashpath(Msg1, Msg2, HashpathAlg, Opts) when is_map(Msg2) ->
                 ),
             hashpath(Msg1, hb_util:human_id(Msg2ID), HashpathAlg, Opts)
     end;
-hashpath(Msg1Hashpath, HumanMsg2ID, HashpathAlg, _Opts) ->
+hashpath(Msg1Hashpath, HumanMsg2ID, HashpathAlg, Opts) ->
     ?event({hashpath, {msg1hp, {explicit, Msg1Hashpath}}, {msg2id, {explicit, HumanMsg2ID}}}),
     HP = 
-        case term_to_path_parts(Msg1Hashpath) of
+        case term_to_path_parts(Msg1Hashpath, Opts) of
             [_] ->
                 << Msg1Hashpath/binary, "/", HumanMsg2ID/binary >>;
             [Prev1, Prev2] ->
@@ -163,8 +176,8 @@ hashpath(Msg1Hashpath, HumanMsg2ID, HashpathAlg, _Opts) ->
 %%% @doc Get the hashpath function for a message from its HashPath-Alg.
 %%% If no hashpath algorithm is specified, the protocol defaults to
 %%% `sha-256-chain'.
-hashpath_alg(Msg) ->
-    case dev_message:get(<<"hashpath-alg">>, Msg) of
+hashpath_alg(Msg, Opts) ->
+    case dev_message:get(<<"hashpath-alg">>, Msg, Opts) of
         {ok, <<"sha-256-chain">>} ->
             fun hb_crypto:sha256_chain/2;
         {ok, <<"accumulate-256">>} ->
@@ -175,19 +188,21 @@ hashpath_alg(Msg) ->
 
 %%% @doc Add a message to the head (next to execute) of a request path.
 push_request(Msg, Path) ->
-    maps:put(<<"path">>, term_to_path_parts(Path) ++ from_message(request, Msg), Msg).
+    push_request(Msg, Path, #{}).
+push_request(Msg, Path, Opts) ->
+    hb_maps:put(<<"path">>, term_to_path_parts(Path, Opts) ++ from_message(request, Msg, Opts), Msg, Opts).
 
 %%% @doc Pop the next element from a request path or path list.
 pop_request(undefined, _Opts) -> undefined;
 pop_request(Msg, Opts) when is_map(Msg) ->
     %?event({popping_request, {msg, Msg}, {opts, Opts}}),
-    case pop_request(from_message(request, Msg), Opts) of
+    case pop_request(from_message(request, Msg, Opts), Opts) of
         undefined -> undefined;
         {undefined, _} -> undefined;
         {Head, []} -> {Head, undefined};
         {Head, Rest} ->
             ?event({popped_request, Head, Rest}),
-            {Head, maps:put(<<"path">>, Rest, Msg)}
+            {Head, hb_maps:put(<<"path">>, Rest, Msg, Opts)}
     end;
 pop_request([], _Opts) -> undefined;
 pop_request([Head|Rest], _Opts) ->
@@ -195,15 +210,17 @@ pop_request([Head|Rest], _Opts) ->
 
 %%% @doc Queue a message at the back of a request path. `path' is the only
 %%% key that we cannot use dev_message's `set/3' function for (as it expects
-%%% the compute path to be there), so we use `maps:put/3' instead.
+%%% the compute path to be there), so we use `hb_maps:put/3' instead.
 queue_request(Msg, Path) ->
-    maps:put(<<"path">>, from_message(request, Msg) ++ term_to_path_parts(Path), Msg).
+    queue_request(Msg, Path, #{}).
+queue_request(Msg, Path, Opts) ->
+    hb_maps:put(<<"path">>, from_message(request, Msg, Opts) ++ term_to_path_parts(Path), Msg, Opts).
 	
 %%% @doc Verify the HashPath of a message, given a list of messages that
 %%% represent its history.
 verify_hashpath([Msg1, Msg2, Msg3|Rest], Opts) ->
     CorrectHashpath = hashpath(Msg1, Msg2, Opts),
-    FromMsg3 = from_message(hashpath, Msg3),
+    FromMsg3 = from_message(hashpath, Msg3, Opts),
     CorrectHashpath == FromMsg3 andalso
         case Rest of
             [] -> true;
@@ -216,16 +233,20 @@ verify_hashpath([Msg1, Msg2, Msg3|Rest], Opts) ->
 %% viable hashpath and path in its Erlang map at all times, unless the message
 %% is directly from a user (in which case paths and hashpaths will not have 
 %% been assigned yet).
-from_message(hashpath, Msg) -> hashpath(Msg, #{});
-from_message(request, #{ path := Path }) -> term_to_path_parts(Path);
-from_message(request, #{ <<"path">> := Path }) -> term_to_path_parts(Path);
-from_message(request, #{ <<"Path">> := Path }) -> term_to_path_parts(Path);
-from_message(request, _) -> undefined.
+from_message(Type, Link, Opts) when ?IS_LINK(Link) ->
+    from_message(Type, hb_cache:ensure_loaded(Link, Opts), Opts);
+from_message(hashpath, Msg, Opts) -> hashpath(Msg, Opts);
+from_message(request, #{ path := Path }, Opts) -> term_to_path_parts(Path, Opts);
+from_message(request, #{ <<"path">> := Path }, Opts) -> term_to_path_parts(Path, Opts);
+from_message(request, #{ <<"Path">> := Path }, Opts) -> term_to_path_parts(Path, Opts);
+from_message(request, _, _Opts) -> undefined.
 
 %% @doc Convert a term into an executable path. Supports binaries, lists, and
 %% atoms. Notably, it does not support strings as lists of characters.
 term_to_path_parts(Path) ->
     term_to_path_parts(Path, #{ error_strategy => throw }).
+term_to_path_parts(Link, Opts) when ?IS_LINK(Link) ->
+    term_to_path_parts(hb_cache:ensure_loaded(Link, Opts), Opts);
 term_to_path_parts([], _Opts) -> undefined;
 term_to_path_parts(<<>>, _Opts) -> undefined;
 term_to_path_parts(<<"/">>, _Opts) -> [];
@@ -291,7 +312,11 @@ matches(Key1, Key2) ->
 %% @doc Check if two keys match using regex.
 regex_matches(Path1, Path2) ->
     NormP1 = normalize(hb_ao:normalize_key(Path1)),
-    NormP2 = normalize(hb_ao:normalize_key(Path2)),
+    NormP2 =
+        case hb_ao:normalize_key(Path2) of
+            Normalized = <<"^", _/binary>> -> Normalized;
+            Normalized -> normalize(Normalized)
+        end,
     try re:run(NormP1, NormP2) =/= nomatch
     catch _A:_B:_C -> false
     end.
@@ -354,7 +379,7 @@ hd_test() ->
     ?assertEqual(undefined, hd(#{ <<"path">> => undefined }, #{})).
 
 tl_test() ->
-    ?assertMatch([<<"b">>, <<"c">>], maps:get(<<"path">>, tl(#{ <<"path">> => [<<"a">>, <<"b">>, <<"c">>] }, #{}))),
+    ?assertMatch([<<"b">>, <<"c">>], hb_maps:get(<<"path">>, tl(#{ <<"path">> => [<<"a">>, <<"b">>, <<"c">>] }, #{}))),
     ?assertEqual(undefined, tl(#{ <<"path">> => [] }, #{})),
     ?assertEqual(undefined, tl(#{ <<"path">> => <<"a">> }, #{})),
     ?assertEqual(undefined, tl(#{ <<"path">> => undefined }, #{})),
diff --git a/src/hb_persistent.erl b/src/hb_persistent.erl
index 80c4a2fbb..551ab3e66 100644
--- a/src/hb_persistent.erl
+++ b/src/hb_persistent.erl
@@ -24,19 +24,19 @@ start() -> hb_name:start().
 start_monitor() ->
     start_monitor(global).
 start_monitor(Group) ->
+	start_monitor(Group, #{}).
+start_monitor(Group, Opts) ->
     start(),
     ?event({worker_monitor, {start_monitor, Group, hb_name:all()}}),
-    spawn(fun() -> do_monitor(Group) end).
+    spawn(fun() -> do_monitor(Group, #{}, Opts) end).
 
 stop_monitor(PID) ->
     PID ! stop.
 
-do_monitor(Group) ->
-    do_monitor(Group, #{}).
-do_monitor(Group, Last) ->
+do_monitor(Group, Last, Opts) ->
     Groups = lists:map(fun({Name, _}) -> Name end, hb_name:all()),
     New =
-        maps:from_list(
+        hb_maps:from_list(
             lists:map(
                 fun(G) ->
                     Pid = hb_name:lookup(G),
@@ -69,31 +69,33 @@ do_monitor(Group, Last) ->
             )
         ),
     Delta =
-        maps:filter(
+        hb_maps:filter(
             fun(G, NewState) ->
-                case maps:get(G, Last, []) of
+                case hb_maps:get(G, Last, []) of
                     NewState -> false;
                     _ -> true
                 end
             end,
-            New
+            New,
+			Opts
         ),
-    case maps:size(Delta) of
+    case hb_maps:size(Delta, Opts) of
         0 -> ok;
         Deltas ->
             io:format(standard_error, "== Sitrep ==> ~p named processes. ~p changes. ~n",
-                [maps:size(New), Deltas]),
-            maps:map(
+                [hb_maps:size(New, Opts), Deltas]),
+            hb_maps:map(
                 fun(G, #{pid := P, messages := Msgs}) ->
                     io:format(standard_error, "[~p: ~p] #M: ~p~n", [G, P, Msgs])
                 end,
-                Delta
+                Delta,
+				Opts
             ),
             io:format(standard_error, "~n", [])
     end,
     timer:sleep(1000),
     receive stop -> stopped
-    after 0 -> do_monitor(Group, New)
+    after 0 -> do_monitor(Group, New, Opts)
     end.
 
 %% @doc Register the process to lead an execution if none is found, otherwise
@@ -139,10 +141,15 @@ find_execution(Groupname, _Opts) ->
 %% `group' function if it is found in the `info', otherwise uses the default.
 group(Msg1, Msg2, Opts) ->
     Grouper =
-        maps:get(grouper, hb_ao:info(Msg1, Opts), fun default_grouper/3),
+        hb_maps:get(
+            grouper,
+            hb_ao_device:info(Msg1, Opts),
+            fun default_grouper/3,
+            Opts
+        ),
     apply(
         Grouper,
-        hb_ao:truncate_args(Grouper, [Msg1, Msg2, Opts])
+        hb_ao_device:truncate_args(Grouper, [Msg1, Msg2, Opts])
     ).
 
 %% @doc Register for performing an AO-Core resolution.
@@ -164,10 +171,11 @@ unregister_groupname(Groupname, _Opts) ->
 await(Worker, Msg1, Msg2, Opts) ->
     % Get the device's await function, if it exists.
     AwaitFun =
-        maps:get(
+        hb_maps:get(
             await,
-            hb_ao:info(Msg1, Opts),
-            fun default_await/5
+            hb_ao_device:info(Msg1, Opts),
+            fun default_await/5,
+			Opts
         ),
     % Calculate the compute path that we will wait upon resolution of.
     % Register with the process.
@@ -266,10 +274,11 @@ start_worker(GroupName, Msg, Opts) ->
             % If the device's info contains a `worker' function we
             % use that instead of the default implementation.
             WorkerFun =
-                maps:get(
+                hb_maps:get(
                     worker,
-                    hb_ao:info(Msg, Opts),
-                    Def = fun default_worker/3
+                    hb_ao_device:info(Msg, Opts),
+                    Def = fun default_worker/3,
+					Opts
                 ),
             ?event(worker,
                 {new_worker,
@@ -285,16 +294,17 @@ start_worker(GroupName, Msg, Opts) ->
             register_groupname(GroupName, Opts),
             apply(
                 WorkerFun,
-                hb_ao:truncate_args(
+                hb_ao_device:truncate_args(
                     WorkerFun,
                     [
                         GroupName,
                         Msg,
-                        maps:merge(Opts, #{
+                        hb_maps:merge(Opts, #{
                             is_worker => true,
                             spawn_worker => false,
                             allow_infinite => true
-                        })
+                        },
+						Opts)
                     ]
                 )
             )
@@ -318,7 +328,7 @@ default_worker(GroupName, Msg1, Opts) ->
                 hb_ao:resolve(
                     Msg1,
                     Msg2,
-                    maps:merge(ListenerOpts, Opts)
+                    hb_maps:merge(ListenerOpts, Opts, Opts)
                 ),
             send_response(Listener, GroupName, Msg2, Res),
             notify(GroupName, Msg2, Res, Opts),
@@ -365,8 +375,8 @@ default_grouper(Msg1, Msg2, Opts) ->
         true ->
             erlang:phash2(
                 {
-                    maps:without([<<"priv">>], Msg1),
-                    maps:without([<<"priv">>], Msg2)
+                    hb_maps:without([<<"priv">>], Msg1, Opts),
+                    hb_maps:without([<<"priv">>], Msg2, Opts)
                 }
             );
         _ -> ungrouped_exec
@@ -388,7 +398,7 @@ test_device(Base) ->
     #{
         info =>
             fun() ->
-                maps:merge(
+                hb_maps:merge(
                     #{
                         grouper =>
                             fun(M1, _M2, _Opts) ->
diff --git a/src/hb_private.erl b/src/hb_private.erl
index a598de5d9..636611507 100644
--- a/src/hb_private.erl
+++ b/src/hb_private.erl
@@ -13,10 +13,10 @@
 %%% 
 %%% See `hb_ao' for more information about the AO-Core protocol
 %%% and private elements of messages.
-
 -module(hb_private).
+-export([opts/1]).
 -export([from_message/1, reset/1, is_private/1]).
--export([get/3, get/4, set/4, set/3, set_priv/2]).
+-export([get/3, get/4, set/4, set/3, set_priv/2, merge/3]).
 -include_lib("eunit/include/eunit.hrl").
 -include("include/hb.hrl").
 
@@ -35,35 +35,48 @@ from_message(_NonMapMessage) -> #{}.
 get(Key, Msg, Opts) ->
     get(Key, Msg, not_found, Opts).
 get(InputPath, Msg, Default, Opts) ->
-    Path = hb_path:term_to_path_parts(remove_private_specifier(InputPath)),
-    ?event({get_private, {in, InputPath}, {out, Path}}),
     % Resolve the path against the private element of the message.
-    Resolve =
-        hb_ao:resolve(
+    Resolved =
+        hb_util:deep_get(
+            remove_private_specifier(InputPath, Opts),
             from_message(Msg),
-            #{ <<"path">> => Path },
-            priv_ao_opts(Opts)
+            opts(Opts)
         ),
-    case Resolve of
-        {error, _} -> Default;
-        {ok, Value} -> Value
+    case Resolved of
+        not_found -> Default;
+        Value -> Value
     end.
 
 %% @doc Helper function for setting a key in the private element of a message.
 set(Msg, InputPath, Value, Opts) ->
-    Path = remove_private_specifier(InputPath),
+    Path = remove_private_specifier(InputPath, Opts),
     Priv = from_message(Msg),
-    ?event({set_private, {in, InputPath}, {out, Path}, {value, Value}, {opts, Opts}}),
-    NewPriv = hb_ao:set(Priv, Path, Value, priv_ao_opts(Opts)),
+    ?event({set_private, {in, Path}, {out, Path}, {value, Value}, {opts, Opts}}),
+    NewPriv = hb_util:deep_set(Path, Value, Priv, opts(Opts)),
     ?event({set_private_res, {out, NewPriv}}),
     set_priv(Msg, NewPriv).
 set(Msg, PrivMap, Opts) ->
     CurrentPriv = from_message(Msg),
     ?event({set_private, {in, PrivMap}, {opts, Opts}}),
-    NewPriv = hb_ao:set(CurrentPriv, PrivMap, priv_ao_opts(Opts)),
+    NewPriv = hb_util:deep_merge(CurrentPriv, PrivMap, opts(Opts)),
     ?event({set_private_res, {out, NewPriv}}),
     set_priv(Msg, NewPriv).
 
+%% @doc Merge the private elements of two messages into one. The keys in the
+%% second message will override the keys in the first message. The base keys
+%% from the first message will be preserved, but the keys in the second message
+%% will be lost.
+merge(Msg1, Msg2, Opts) ->
+    % Merge the private elements of the two messages.
+    Merged =
+        hb_util:deep_merge(
+            from_message(Msg1),
+            from_message(Msg2),
+            opts(Opts)
+        ),
+    % Set the merged private element on the first message.
+    set_priv(Msg1, Merged).
+
 %% @doc Helper function for setting the complete private element of a message.
 set_priv(Msg, PrivMap)
         when map_size(PrivMap) =:= 0 andalso not is_map_key(<<"priv">>, Msg) ->
@@ -73,37 +86,82 @@ set_priv(Msg, PrivMap) ->
 
 %% @doc Check if a key is private.
 is_private(Key) ->
-	case hb_ao:normalize_key(Key) of
+	try hb_util:bin(Key) of
 		<<"priv", _/binary>> -> true;
 		_ -> false
+    catch _:_ -> false
 	end.
 
 %% @doc Remove the first key from the path if it is a private specifier.
-remove_private_specifier(InputPath) ->
-    case is_private(hd(Path = hb_path:term_to_path_parts(InputPath))) of
+remove_private_specifier(InputPath, Opts) ->
+    case is_private(hd(Path = hb_path:term_to_path_parts(InputPath, Opts))) of
         true -> tl(Path);
         false -> Path
     end.
 
 %% @doc The opts map that should be used when resolving paths against the
-%% private element of a message.
-priv_ao_opts(Opts) ->
-    Opts#{ hashpath => ignore, cache_control => [<<"no-cache">>, <<"no-store">>] }.
+%% private element of a message. We add the `priv_store' option if set, such that
+%% evaluations are not inadvertently persisted in public storage but this module
+%% can still access data from the normal stores. This mechanism requires that
+%% the priv_store is writable. We also ensure that no cache entries are
+%% generated from downstream AO-Core resolutions.
+opts(Opts) ->
+    PrivStore =
+        case hb_opts:get(priv_store, undefined, Opts) of
+            undefined -> [];
+            PrivateStores when is_list(PrivateStores) -> PrivateStores;
+            PrivateStore -> [PrivateStore]
+        end,
+    BaseStore =
+        case hb_opts:get(store, [], Opts) of
+            SingleStore when is_map(SingleStore) -> [SingleStore];
+            Stores when is_list(Stores) -> Stores
+        end,
+    NormStore = PrivStore ++ BaseStore,
+    Opts#{
+        hashpath => ignore,
+        cache_control => [<<"no-cache">>, <<"no-store">>],
+        store => NormStore
+    }.
 
-%% @doc Unset all of the private keys in a message.
-reset(Msg) ->
-    maps:without(
-        lists:filter(fun is_private/1, maps:keys(Msg)),
-        Msg
-    ).
+%% @doc Unset all of the private keys in a message or deep Erlang term.
+%% This function operates on all types of data, such that it can be used on
+%% non-message terms to ensure that `priv` elements can _never_ pass through.
+reset(Msg) when is_map(Msg) ->
+    maps:map(
+        fun(_Key, Val) -> reset(Val) end,
+        maps:without(
+            lists:filter(fun is_private/1, maps:keys(Msg)),
+            Msg
+        )
+    );
+reset(List) when is_list(List) ->
+    % Check if any of the terms in the list are private specifiers, return an
+    % empty list if so.
+    case lists:any(fun is_private/1, List) of
+        true -> [];
+        false ->
+            % The list itself is safe. Check each of the children.
+            lists:map(fun reset/1, List)
+    end;
+reset(Tuple) when is_tuple(Tuple) ->
+    list_to_tuple(reset(tuple_to_list(Tuple)));
+reset(NonMapMessage) ->
+    NonMapMessage.
 
 %%% Tests
 
 set_private_test() ->
-    ?assertEqual(#{<<"a">> => 1, <<"priv">> => #{<<"b">> => 2}}, set(#{<<"a">> => 1}, <<"b">>, 2, #{})),
+    ?assertEqual(
+        #{<<"a">> => 1, <<"priv">> => #{<<"b">> => 2}},
+        set(#{<<"a">> => 1}, <<"b">>, 2, #{})
+    ),
     Res = set(#{<<"a">> => 1}, <<"a">>, 1, #{}),
     ?assertEqual(#{<<"a">> => 1, <<"priv">> => #{<<"a">> => 1}}, Res),
-    ?assertEqual(#{<<"a">> => 1, <<"priv">> => #{<<"a">> => 1}}, set(Res, a, 1, #{})).
+    ?assertEqual(
+        #{<<"a">> => 1, <<"priv">> => #{<<"a">> => 1}},
+        set(Res, <<"a">>, 1, #{})
+    ).
 
 get_private_key_test() ->
     M1 = #{<<"a">> => 1, <<"priv">> => #{<<"b">> => 2}},
@@ -112,3 +170,48 @@ get_private_key_test() ->
     ?assertEqual(2, get(<<"b">>, M1, #{})),
     {error, _} = hb_ao:resolve(M1, <<"priv/a">>, #{}),
     {error, _} = hb_ao:resolve(M1, <<"priv">>, #{}).
+
+get_deep_key_test() ->
+    M1 = #{<<"a">> => 1, <<"priv">> => #{<<"b">> => #{<<"c">> => 3}}},
+    ?assertEqual(3, get(<<"b/c">>, M1, #{})).
+
+priv_opts_store_read_link_test() ->
+    % Write a message to the public store.
+    PublicStore = [hb_test_utils:test_store(hb_store_lmdb)],
+    timer:sleep(1),
+    OnlyPrivStore = [hb_test_utils:test_store(hb_store_fs)],
+    ok = hb_store:write(PublicStore, <<"key">>, <<"test-message">>),
+    {ok, <<"test-message">>} = hb_store:read(PublicStore, <<"key">>),
+    % Make a link to the key in the public store.
+    ok = hb_store:make_link(PublicStore, <<"key">>, <<"link">>),
+    {ok, <<"test-message">>} = hb_store:read(PublicStore, <<"link">>),
+    % Read the link from the private store. First as a simple store read, then
+    % as a link.
+    Opts = #{ store => PublicStore, priv_store => OnlyPrivStore },
+    PrivOpts = #{ store := PrivStore } = opts(Opts),
+    {ok, <<"test-message">>} = hb_store:read(PrivStore, <<"link">>),
+    Loaded =
+        hb_cache:ensure_loaded(
+            {link, <<"link">>, #{ <<"type">> => <<"link">>, <<"lazy">> => false }},
+            PrivOpts
+        ),
+    ?assertEqual(<<"test-message">>, Loaded).
+
+priv_opts_cache_read_message_test() ->
+    hb:init(),
+    PublicStore = [hb_test_utils:test_store(hb_store_lmdb)],
+    OnlyPrivStore = [hb_test_utils:test_store(hb_store_fs)],
+    Opts = #{ store => PublicStore, priv_store => OnlyPrivStore },
+    PrivOpts = opts(Opts),
+    % Use the `~scheduler@1.0' and `~process@1.0' infrastructure to write a
+    % complex message into the public store.
+    Msg = hb_cache:ensure_all_loaded(dev_process:test_aos_process(Opts), Opts),
+    {ok, ID} = hb_cache:write(Msg, Opts),
+    % Ensure we can read the message using the public store.
+    {ok, PubMsg} = hb_cache:read(ID, Opts),
+    PubMsgLoaded = hb_cache:ensure_all_loaded(PubMsg, Opts),
+    ?assertEqual(Msg, PubMsgLoaded),
+    % Read the message using the private store.
+    {ok, PrivMsg} = hb_cache:read(ID, PrivOpts),
+    PrivMsgLoaded = hb_cache:ensure_all_loaded(PrivMsg, PrivOpts),
+    ?assertEqual(Msg, PrivMsgLoaded).
\ No newline at end of file
diff --git a/src/hb_router.erl b/src/hb_router.erl
index c48558cdd..022ded9a3 100644
--- a/src/hb_router.erl
+++ b/src/hb_router.erl
@@ -8,9 +8,10 @@
 
 find(Type, ID) ->
     find(Type, ID, '_').
-
-find(Type, _ID, Address) ->
-    case maps:get(Type, hb_opts:get(nodes), undefined) of
+find(Type, ID, Address) ->
+	find(Type, ID, Address, #{}).
+find(Type, _ID, Address, Opts) ->
+    case hb_maps:get(Type, hb_opts:get(nodes), undefined, Opts) of
         #{ Address := Node } -> {ok, Node};
         undefined -> {error, service_type_not_found}
     end.
\ No newline at end of file
diff --git a/src/hb_singleton.erl b/src/hb_singleton.erl
index 3b824a25a..eb7eefd2e 100644
--- a/src/hb_singleton.erl
+++ b/src/hb_singleton.erl
@@ -14,6 +14,7 @@
 %%%     Part: (Key + Resolution), Device?, #{ K => V}?
 %%%         - Part => #{ path => Part }
 %%%         - `Part&Key=Value => #{ path => Part, Key => Value }'
+%%%         - `Part=Value&... => #{ path => Part, Part => Value, ... }'
 %%%         - `Part&Key => #{ path => Part, Key => true }'
 %%%         - `Part&k1=v1&k2=v2 => #{ path => Part, k1 => `<<"v1">>', k2 => `<<"v2">>' }'
 %%%         - `Part~Device => {as, Device, #{ path => Part }}'
@@ -27,12 +28,12 @@
 %%%     Key:
 %%%         - key: `<<"value">>' => #{ key => `<<"value">>', ... } for all messages
 %%%         - n.key: `<<"value">>' => #{ key => `<<"value">>', ... } for Nth message
-%%%         - key+Int: 1 => #{ key => 1, ... }
-%%%         - key+Res: /nested/path => #{ key => (resolve /nested/path), ... }
-%%%         - N.Key+Res=(/a/b/c) => #{ Key => (resolve /a/b/c), ... }
+%%%         - key+int: 1 => #{ key => 1, ... }
+%%%         - key+res: /nested/path => #{ key => (resolve /nested/path), ... }
+%%%         - N.Key+res=(/a/b/c) => #{ Key => (resolve /a/b/c), ... }
 %%% </pre>
 -module(hb_singleton).
--export([from/1, to/1]).
+-export([from/2, from_path/1, to/1]).
 -include("include/hb.hrl").
 -include_lib("eunit/include/eunit.hrl").
 -define(MAX_SEGMENT_LENGTH, 512).
@@ -52,30 +53,28 @@ to(Messages) ->
                 % Special case when AO-Core message is ID
                 (Message, {Acc, Index, ScopedModifications}) when ?IS_ID(Message) ->
                     {append_path(Message, Acc), Index + 1, ScopedModifications};
-
                 % Special case when AO-Core message contains resolve command
                 ({resolve, SubMessages0}, {Acc, Index, ScopedModifications}) ->
-                    SubMessages1 = maps:get(<<"path">>, to(SubMessages0)),
+                    SubMessages1 = hb_maps:get(<<"path">>, to(SubMessages0)),
                     <<"/", SubMessages2/binary>> = SubMessages1,
                     SubMessages = <<"(", SubMessages2/binary, ")">>,
                     {append_path(SubMessages, Acc), Index + 1, ScopedModifications};
-
                 % Regular case when message is a map
                 (Message, {Acc, Index, ScopedModifications}) ->
                     {NewMessage, NewScopedModifications} =
-                        maps:fold(
+                        hb_maps:fold(
                             fun
                                 (<<"path">>, PathPart, {AccIn, Scoped}) ->
                                     {append_path(PathPart, AccIn), Scoped};
                                 % Specifically ignore method field from scope modifications
                                 (<<"method">>, Value, {AccIn, Scoped}) ->
-                                    {maps:put(<<"method">>, Value, AccIn), Scoped};
+                                    {hb_maps:put(<<"method">>, Value, AccIn), Scoped};
                                 (Key, {resolve, SubMessages}, {AccIn, Scoped}) ->
                                     NewKey = <<Key/binary, "+resolve">>,
-                                    NewSubMessages = maps:get(<<"path">>, to(SubMessages)),
+                                    NewSubMessages = hb_maps:get(<<"path">>, to(SubMessages)),
                                     {
-                                        maps:put(NewKey, NewSubMessages, AccIn),
-                                        maps:update_with(
+                                        hb_maps:put(NewKey, NewSubMessages, AccIn),
+                                        hb_maps:update_with(
                                             NewKey,
                                             fun(Indexes) -> [Index | Indexes] end,
                                             [Index],
@@ -84,8 +83,8 @@ to(Messages) ->
                                     };
                                 (Key, Value, {AccIn, Scoped}) ->
                                     {
-                                        maps:put(Key, Value, AccIn),
-                                        maps:update_with(
+                                        hb_maps:put(Key, Value, AccIn),
+                                        hb_maps:update_with(
                                             Key,
                                             fun(Indexes) -> [Index | Indexes] end,
                                             [Index],
@@ -95,19 +94,18 @@ to(Messages) ->
                             end,
                             {Acc, ScopedModifications},
                             Message),
-
                         {NewMessage, Index + 1, NewScopedModifications}
 
             end,
             {#{}, 0, #{}},
             Messages),
     MessageWithTypeAndScopes =
-        maps:fold(
+        hb_maps:fold(
             fun
                 % For the case when a given Key appeared only once in scopes
                 (Key, [SingleIndexScope], AccIn) ->
                     Index = integer_to_binary(SingleIndexScope),
-                    {Value, NewAccIn} = maps:take(Key, AccIn),
+                    {Value, NewAccIn} = hb_maps:take(Key, AccIn),
                     {NewKey, NewValue} =
                         case type(Value) of
                             integer ->
@@ -116,7 +114,7 @@ to(Messages) ->
                                 {K, V};
                             _ -> {<<Index/binary, ".", Key/binary>>, Value}
                         end,
-                    maps:put(NewKey, NewValue, NewAccIn);
+                    hb_maps:put(NewKey, NewValue, NewAccIn);
                 (_Key, _Value, AccIn) -> AccIn
             end,
             TABMMessage,
@@ -124,9 +122,9 @@ to(Messages) ->
     MessageWithTypeAndScopes.
 
 append_path(PathPart, #{<<"path">> := Path} = Message) ->
-    maps:put(<<"path">>, <<Path/binary, "/", PathPart/binary>>, Message);
+    hb_maps:put(<<"path">>, <<Path/binary, "/", PathPart/binary>>, Message);
 append_path(PathPart, Message) ->
-    maps:put(<<"path">>, <<"/", PathPart/binary>>, Message).
+    hb_maps:put(<<"path">>, <<"/", PathPart/binary>>, Message).
 
 type(Value) when is_binary(Value) -> binary;
 type(Value) when is_integer(Value) -> integer;
@@ -134,52 +132,62 @@ type(_Value) -> unknown.
 
 %% @doc Normalize a singleton TABM message into a list of executable AO-Core
 %% messages.
-from(Path) when is_binary(Path) ->
-    from(#{ <<"path">> => Path });
-from(RawMsg) ->
-    RawPath = maps:get(<<"path">>, RawMsg, <<>>),
+from(RawMsg, Opts) when is_binary(RawMsg) ->
+    from(#{ <<"path">> => RawMsg }, Opts);
+from(RawMsg, Opts) ->
+    RawPath = hb_maps:get(<<"path">>, RawMsg, <<>>),
     ?event(parsing, {raw_path, RawPath}),
-    {ok, Path, Query} = parse_full_path(RawPath),
+    {ok, Path, Query} = from_path(RawPath),
     ?event(parsing, {parsed_path, Path, Query}),
-    MsgWithoutBasePath = maps:merge(
-        maps:remove(<<"path">>, RawMsg),
-        Query
-    ),
+    MsgWithoutBasePath =
+        hb_maps:merge(
+            hb_maps:remove(<<"path">>, RawMsg),
+            Query
+        ),
     % 2. Decode, split, and sanitize path segments. Each yields one step message.
-    RawMsgs = lists:flatten(lists:map(fun path_messages/1, Path)),
+    RawMsgs =
+        lists:flatten(
+            lists:map(
+                fun(Msg) -> path_messages(Msg, Opts) end,
+                Path
+            )
+        ),
     ?event(parsing, {raw_messages, RawMsgs}),
     Msgs = normalize_base(RawMsgs),
     ?event(parsing, {normalized_messages, Msgs}),
     % 3. Type keys and values
-    Typed = apply_types(MsgWithoutBasePath),
+    Typed = apply_types(MsgWithoutBasePath, Opts),
     ?event(parsing, {typed_messages, Typed}),
     % 4. Group keys by N-scope and global scope
     ScopedModifications = group_scoped(Typed, Msgs),
     ?event(parsing, {scoped_modifications, ScopedModifications}),
     % 5. Generate the list of messages (plus-notation, device, typed keys).
-    Result = build_messages(Msgs, ScopedModifications),
+    Result = build_messages(Msgs, ScopedModifications, Opts),
     ?event(parsing, {result, Result}),
     Result.
 
 %% @doc Parse the relative reference into path, query, and fragment.
-parse_full_path(RelativeRef) ->
-    {Path, QueryMap} =
-        case part([$?], RelativeRef) of
-            {$?, Base, Query} ->
-                {Base, parse_inlined_keys(Query, #{})};
-            {no_match, Base, <<>>} -> {Base, #{}}
+from_path(RelativeRef) ->
+    %?event(parsing, {raw_relative_ref, RawRelativeRef}),
+    %RelativeRef = hb_escape:decode(RawRelativeRef),
+    Decoded = decode_string(RelativeRef),
+    ?event(parsing, {parsed_relative_ref, Decoded}),
+    {Path, QKVList} =
+        case hb_util:split_depth_string_aware_single("?", Decoded) of
+            {_Sep, P, QStr} -> {P, cowboy_req:parse_qs(#{ qs => QStr })};
+            {no_match, P, <<>>} -> {P, []}
         end,
     {
         ok,
-        lists:map(fun(Part) -> decode_string(Part) end, path_parts($/, Path)),
-        QueryMap
+        path_parts($/, Path),
+        hb_maps:from_list(QKVList)
     }.
 
 %% @doc Step 2: Decode, split and sanitize the path. Split by `/' but avoid
 %% subpath components, such that their own path parts are not dissociated from
 %% their parent path.
-path_messages(RawBin) when is_binary(RawBin) ->
-    lists:map(fun parse_part/1, path_parts([$/], decode_string(RawBin))).
+path_messages(Bin, Opts) when is_binary(Bin) ->
+    lists:map(fun(Part) -> parse_part(Part, Opts) end, path_parts([$/], Bin)).
 
 %% @doc Normalize the base path.
 normalize_base([]) -> [];
@@ -202,13 +210,13 @@ path_parts(Sep, PathBin) when is_binary(PathBin) ->
         end,
         all_path_parts(Sep, PathBin)
     ),
+    ?event({path_parts, Res}),
     Res.
 
 %% @doc Extract all of the parts from the binary, given (a list of) separators.
 all_path_parts(_Sep, <<>>) -> [];
 all_path_parts(Sep, Bin) ->
-    {_MatchedSep, Part, Rest} = part(Sep, Bin),
-    [Part | all_path_parts(Sep, Rest)].
+    hb_util:split_depth_string_aware(Sep, Bin).
 
 %% @doc Extract the characters from the binary until a separator is found.
 %% The first argument of the function is an explicit separator character, or
@@ -217,51 +225,39 @@ all_path_parts(Sep, Bin) ->
 part(Sep, Bin) when not is_list(Sep) ->
     part([Sep], Bin);
 part(Seps, Bin) ->
-    part(Seps, Bin, 0, <<>>).
-part(_Seps, <<>>, _Depth, CurrAcc) -> {no_match, CurrAcc, <<>>};
-part(Seps, << $\(, Rest/binary>>, Depth, CurrAcc) ->
-    %% Increase depth
-    part(Seps, Rest, Depth + 1, << CurrAcc/binary, "(" >>);
-part(Seps, << $\), Rest/binary>>, Depth, CurrAcc) when Depth > 0 ->
-    %% Decrease depth
-    part(Seps, Rest, Depth - 1, << CurrAcc/binary, ")">>);
-part(Seps, <<C:8/integer, Rest/binary>>, Depth, CurrAcc) ->
-    case Depth == 0 andalso lists:member(C, Seps) of
-        true -> {C, CurrAcc, Rest};
-        false ->
-            part(Seps, Rest, Depth, << CurrAcc/binary, C:8/integer >>)
-    end.
+    hb_util:split_depth_string_aware_single(Seps, Bin).
 
 %% @doc Step 3: Apply types to values and remove specifiers.
-apply_types(Msg) ->
-    maps:fold(
+apply_types(Msg, Opts) ->
+    hb_maps:fold(
         fun(Key, Val, Acc) ->
-            {_, K, V} = maybe_typed(Key, Val),
-            maps:put(K, V, Acc)
+            {_, K, V} = maybe_typed(Key, Val, Opts),
+            hb_maps:put(K, V, Acc, Opts)
         end,
         #{},
-        Msg
+        Msg,
+        Opts
     ).
 
 %% @doc Step 4: Group headers/query by N-scope.
 %% `N.Key' => applies to Nth step. Otherwise => `global'
 group_scoped(Map, Msgs) ->
     {NScope, Global} =
-        maps:fold(
+        hb_maps:fold(
             fun(KeyBin, Val, {Ns, Gs}) ->
                 case parse_scope(KeyBin) of
                     {OkN, RealKey} when OkN > 0 ->
-                        Curr = maps:get(OkN, Ns, #{}),
-                        Ns2 = maps:put(OkN, maps:put(RealKey, Val, Curr), Ns),
+                        Curr = hb_maps:get(OkN, Ns, #{}),
+                        Ns2 = hb_maps:put(OkN, hb_maps:put(RealKey, Val, Curr), Ns),
                         {Ns2, Gs};
-                    global -> {Ns, maps:put(KeyBin, Val, Gs)}
+                    global -> {Ns, hb_maps:put(KeyBin, Val, Gs)}
                 end
           end,
           {#{}, #{}},
           Map
         ),
     [
-        maps:merge(Global, maps:get(N, NScope, #{}))
+        hb_maps:merge(Global, hb_maps:get(N, NScope, #{}))
     ||
         N <- lists:seq(1, length(Msgs))
     ].
@@ -278,29 +274,57 @@ parse_scope(KeyBin) ->
     end.
 
 %% @doc Step 5: Merge the base message with the scoped messages.
-build_messages(Msgs, ScopedModifications) ->
-    build(1, Msgs, ScopedModifications).
-build(_, [], _ScopedKeys) -> [];
-build(I, [{as, DevID, Msg = #{ <<"path">> := <<"">> }}|Rest], ScopedKeys) ->
-    ScopedKey = lists:nth(I, ScopedKeys),
-    StepMsg =
-        hb_message:convert(
-            Merged = maps:merge(Msg, ScopedKey),
-            <<"structured@1.0">>,
-            #{ topic => ao_internal }
-        ),
-    ?event({merged, {dev, DevID}, {input, Msg}, {merged, Merged}, {output, StepMsg}}),
-    [{as, DevID, StepMsg} | build(I + 1, Rest, ScopedKeys)];
-build(I, [Msg|Rest], ScopedKeys) when not is_map(Msg) ->
-    [Msg | build(I + 1, Rest, ScopedKeys)];
-build(I, [Msg | Rest], ScopedKeys) ->
-    StepMsg =
-        hb_message:convert(
-            maps:merge(Msg, lists:nth(I, ScopedKeys)),
-            <<"structured@1.0">>,
-            #{ topic => ao_internal }
-        ),
-    [StepMsg | build(I + 1, Rest, ScopedKeys)].
+build_messages(Msgs, ScopedModifications, Opts) ->
+    do_build(1, Msgs, ScopedModifications, Opts).
+
+do_build(_, [], _, _) -> [];
+do_build(I, [{as, DevID, RawMsg} | Rest], ScopedKeys, Opts) when is_map(RawMsg) ->
+    % We are processing an `as' message. If the path is empty, we need to
+    % remove it from the message and the additional message, such that AO-Core
+    % returns only the message with the device specifier changed. If the message
+    % does have a path, AO-Core will subresolve it.
+    RawAdditional = lists:nth(I, ScopedKeys),
+    {Msg, Additional} =
+        case hb_maps:get(<<"path">>, RawMsg, <<"">>, Opts) of
+            ID when ?IS_ID(ID) ->
+                % When we have an ID, we do not merge the globally scoped elements.
+                {
+                    RawMsg,
+                    #{}
+                };
+            <<"">> ->
+                % When we have an empty path, we remove the path from both
+                % messages. AO-Core will then simply set the device specifier
+                % and not execute a subresolve.
+                {
+                    hb_ao:set(RawMsg, <<"path">>, unset, Opts),
+                    hb_ao:set(RawAdditional, <<"path">>, unset, Opts)
+                };
+            _BasePath ->
+                % When we have a non-empty path, we merge the messages in
+                % totality. The path-part's path will be subresolved.
+                {RawMsg, RawAdditional}
+        end,
+    Merged = hb_maps:merge(Additional, Msg, Opts),
+    StepMsg = hb_message:convert(
+        Merged, 
+        <<"structured@1.0">>, 
+        Opts#{ topic => ao_internal }
+    ),
+    ?event(parsing, {build_messages, {base, Msg}, {additional, Additional}}),
+    [{as, DevID, StepMsg} | do_build(I + 1, Rest, ScopedKeys, Opts)];
+do_build(I, [Msg | Rest], ScopedKeys, Opts) when not is_map(Msg) ->
+    [Msg | do_build(I + 1, Rest, ScopedKeys, Opts)];
+do_build(I, [Msg | Rest], ScopedKeys, Opts) ->
+    Additional = lists:nth(I, ScopedKeys),
+    Merged = hb_maps:merge(Additional, Msg, Opts),
+    StepMsg = hb_message:convert(
+        Merged, 
+        <<"structured@1.0">>, 
+        Opts#{ topic => ao_internal }
+    ),
+    ?event(parsing, {build_messages, {base, Msg}, {additional, Additional}}),
+    [StepMsg | do_build(I + 1, Rest, ScopedKeys, Opts)].
 
 %% @doc Parse a path part into a message or an ID.
 %% Applies the syntax rules outlined in the module doc, in the following order:
@@ -308,18 +332,19 @@ build(I, [Msg | Rest], ScopedKeys) ->
 %% 2. Part subpath resolutions
 %% 3. Inlined key-value pairs
 %% 4. Device specifier
-parse_part(ID) when ?IS_ID(ID) -> ID;
-parse_part(Part) ->
-    case maybe_subpath(Part) of
+parse_part(ID, _Opts) when ?IS_ID(ID) -> ID;
+parse_part(Part, Opts) ->
+    case maybe_subpath(Part, Opts) of
         {resolve, Subpath} -> {resolve, Subpath};
         Part ->
-            case part([$&, $~, $+], Part) of
+            case part([$&, $~, $+, $ , $=], Part) of
                 {no_match, PartKey, <<>>} ->
                     #{ <<"path">> => PartKey };
                 {Sep, PartKey, PartModBin} ->
                     parse_part_mods(
                         << Sep:8/integer, PartModBin/binary >>,
-                        #{ <<"path">> => PartKey }
+                        #{ <<"path">> => PartKey },
+						Opts
                     )
             end
     end.
@@ -327,42 +352,44 @@ parse_part(Part) ->
 %% @doc Parse part modifiers:
 %% 1. `~Device' => `{as, Device, Msg}'
 %% 2. `&K=V' => `Msg#{ K => V }'
-parse_part_mods([], Msg) -> Msg;
-parse_part_mods(<<>>, Msg) -> Msg;
-parse_part_mods(<<"~", PartMods/binary>>, Msg) ->
+parse_part_mods([], Msg, _Opts) -> Msg;
+parse_part_mods(<<>>, Msg, _Opts) -> Msg;
+parse_part_mods(<<"~", PartMods/binary>>, Msg, Opts) ->
     % Get the string until the end of the device specifier or end of string.
     {_, DeviceBin, InlinedMsgBin} = part([$&], PartMods),
     % Calculate the inlined keys
-    MsgWithInlines = parse_part_mods(<<"&", InlinedMsgBin/binary >>, Msg),
+    MsgWithInlines = parse_part_mods(<<"&", InlinedMsgBin/binary >>, Msg, Opts),
     % Apply the device specifier
-    {as, maybe_subpath(DeviceBin), MsgWithInlines};
-parse_part_mods(<< "&", InlinedMsgBin/binary >>, Msg) ->
-    parse_inlined_keys(InlinedMsgBin, Msg).
-
-%% @doc Parse inlined key-value pairs from a path segment. Each key-value pair
-%% is separated by `&' and is of the form `K=V'.
-parse_inlined_keys(InlinedMsgBin, Msg) ->
+    {as, maybe_subpath(DeviceBin, Opts), MsgWithInlines};
+parse_part_mods(<< "&", InlinedMsgBin/binary >>, Msg, Opts) ->
     InlinedKeys = path_parts($&, InlinedMsgBin),
     MsgWithInlined =
         lists:foldl(
             fun(InlinedKey, Acc) ->
-                {Key, Val} = parse_inlined_key_val(InlinedKey),
+                {Key, Val} = parse_inlined_key_val(InlinedKey, Opts),
                 ?event({inlined_key, {explicit, Key}, {explicit, Val}}),
-                Acc#{ Key => Val }
+                hb_maps:put(Key, Val, Acc)
             end,
             Msg,
             InlinedKeys
         ),
-    MsgWithInlined.
+    MsgWithInlined;
+parse_part_mods(<<$=, InlinedMsgBin/binary>>, M = #{ <<"path">> := Path }, Opts)
+        when map_size(M) =:= 1, is_binary(Path) ->
+    parse_part_mods(<< "&", Path/binary, "=", InlinedMsgBin/binary >>, M, Opts);
+parse_part_mods(<<$+, InlinedMsgBin/binary>>, M = #{ <<"path">> := Path }, Opts)
+        when map_size(M) =:= 1, is_binary(InlinedMsgBin) ->
+    parse_part_mods(<< "&", Path/binary, "+", InlinedMsgBin/binary >>, M, Opts).
 
 %% @doc Extrapolate the inlined key-value pair from a path segment. If the
 %% key has a value, it may provide a type (as with typical keys), but if a
 %% value is not provided, it is assumed to be a boolean `true'.
-parse_inlined_key_val(Bin) ->
+parse_inlined_key_val(Bin, Opts) ->
     case part([$=, $&], Bin) of
         {no_match, K, <<>>} -> {K, true};
-        {$=, K, V} ->
-            {_, Key, Val} = maybe_typed(K, maybe_subpath(V)),
+        {$=, K, RawV} ->
+            V = hb_util:unquote(RawV),
+            {_, Key, Val} = maybe_typed(K, maybe_subpath(V, Opts), Opts),
             {Key, Val}
     end.
 
@@ -375,20 +402,23 @@ decode_string(B) ->
 
 %% @doc Check if the string is a subpath, returning it in parsed form,
 %% or the original string with a specifier.
-maybe_subpath(Str) when byte_size(Str) >= 2 ->
+maybe_subpath(Str, Opts) when byte_size(Str) >= 2 ->
     case {binary:first(Str), binary:last(Str)} of
         {$(, $)} ->
             Inside = binary:part(Str, 1, byte_size(Str) - 2),
-            {resolve, from(#{ <<"path">> => Inside })};
+            {resolve, from(#{ <<"path">> => Inside }, Opts)};
         _ -> Str
     end;
-maybe_subpath(Other) -> Other.
+maybe_subpath(Other, _Opts) -> Other.
 
 %% @doc Parse a key's type (applying it to the value) and device name if present.
-maybe_typed(Key, Value) ->
-    case part($+, Key) of
+%% We allow ` ` characters as type indicators because some URL-string encoders
+%% (e.g. Chrome) will encode `+` characters in a form that query-string parsers
+%% interpret as ` ' characters.
+maybe_typed(Key, Value, Opts) ->
+    case part([$+, $ ], Key) of
         {no_match, OnlyKey, <<>>} -> {untyped, OnlyKey, Value};
-        {$+, OnlyKey, Type} ->
+        {_, OnlyKey, Type} ->
             case {Type, Value} of
                 {<<"resolve">>, Subpath} ->
                     % If the value needs to be resolved before it is converted,
@@ -397,10 +427,11 @@ maybe_typed(Key, Value) ->
                     % `/a/b&k+Int=(/x/y/z) => /a/b&k=(/x/y/z/body&Type=Int+Codec)'
                     {typed,
                         OnlyKey,
-                        {resolve, from(#{ <<"path">> => Subpath })}
+                        {resolve, from(#{ <<"path">> => Subpath }, Opts)}
                     };
-                {_T, Bin} when is_binary(Bin) ->
-                    {typed, OnlyKey, dev_codec_structured:decode_value(Type, Bin)}
+                {_T, RawValue} when is_binary(RawValue) ->
+                    Decoded = hb_escape:decode_quotes(RawValue),
+                    {typed, OnlyKey, dev_codec_structured:decode_value(Type, Decoded)}
             end
     end.
 
@@ -425,20 +456,20 @@ parse_explicit_message_test() ->
             #{ <<"a">> => <<"b">>},
             #{ <<"path">> => <<"a">>, <<"a">> => <<"b">> }
         ],
-        from(Singleton1)
+        from(Singleton1, #{})
     ),
     DummyID = hb_util:human_id(crypto:strong_rand_bytes(32)),
     Singleton2 = #{
         <<"path">> => <<"/", DummyID/binary, "/a">>
     },
-    ?assertEqual([DummyID, #{ <<"path">> => <<"a">> }], from(Singleton2)),
+    ?assertEqual([DummyID, #{ <<"path">> => <<"a">> }], from(Singleton2, #{})),
     Singleton3 = #{
         <<"path">> => <<"/", DummyID/binary, "/a">>,
         <<"a">> => <<"b">>
     },
     ?assertEqual(
         [DummyID, #{ <<"path">> => <<"a">>, <<"a">> => <<"b">> }],
-        from(Singleton3)
+        from(Singleton3, #{})
     ).
 
 %%% `to/1' function tests
@@ -463,7 +494,7 @@ simple_to_test() ->
     ],
     Expected = #{<<"path">> => <<"/a">>, <<"test-key">> => <<"test-value">>},
     ?assertEqual(Expected, to(Messages)),
-    ?assertEqual(Messages, from(to(Messages))).
+    ?assertEqual(Messages, from(to(Messages), #{})).
 
 multiple_messages_to_test() ->
     Messages =
@@ -478,7 +509,7 @@ multiple_messages_to_test() ->
         <<"test-key">> => <<"test-value">>
     },
     ?assertEqual(Expected, to(Messages)),
-    ?assertEqual(Messages, from(to(Messages))).
+    ?assertEqual(Messages, from(to(Messages), #{})).
 
 basic_hashpath_to_test() ->
     Messages = [
@@ -490,7 +521,7 @@ basic_hashpath_to_test() ->
         <<"method">> => <<"GET">>
     },
     ?assertEqual(Expected, to(Messages)),
-    ?assertEqual(Messages, from(to(Messages))).
+    ?assertEqual(Messages, from(to(Messages), #{})).
 
 scoped_key_to_test() ->
     Messages = [
@@ -501,7 +532,7 @@ scoped_key_to_test() ->
     ],
     Expected = #{<<"2.test-key">> => <<"test-value">>, <<"path">> => <<"/a/b/c">>},
     ?assertEqual(Expected, to(Messages)),
-    ?assertEqual(Messages, from(to(Messages))).
+    ?assertEqual(Messages, from(to(Messages), #{})).
 
 typed_key_to_test() ->
     Messages =
@@ -513,7 +544,7 @@ typed_key_to_test() ->
         ],
     Expected = #{<<"2.test-key+integer">> => <<"123">>, <<"path">> => <<"/a/b/c">>},
     ?assertEqual(Expected, to(Messages)),
-    ?assertEqual(Messages, from(to(Messages))).
+    ?assertEqual(Messages, from(to(Messages), #{})).
 
 subpath_in_key_to_test() ->
     Messages = [
@@ -535,7 +566,7 @@ subpath_in_key_to_test() ->
     ],
     Expected = #{<<"2.test-key+resolve">> => <<"/x/y/z">>, <<"path">> => <<"/a/b/c">>},
     ?assertEqual(Expected, to(Messages)),
-    ?assertEqual(Messages, from(to(Messages))).
+    ?assertEqual(Messages, from(to(Messages), #{})).
 
 subpath_in_path_to_test() ->
     Messages = [
@@ -555,7 +586,7 @@ subpath_in_path_to_test() ->
         <<"path">> => <<"/a/(x/y/z)/z">>
     },
     ?assertEqual(Expected, to(Messages)),
-    ?assertEqual(Messages, from(to(Messages))).
+    ?assertEqual(Messages, from(to(Messages), #{})).
 
 inlined_keys_to_test() ->
     Messages =
@@ -579,7 +610,7 @@ inlined_keys_to_test() ->
     % NOTE: The implementation above does not convert the given list of messages
     % into the original format, however it assures that the `to/1' and `from/1'
     % operations are idempotent.
-    ?assertEqual(Messages, from(to(Messages))).
+    ?assertEqual(Messages, from(to(Messages), #{})).
 
 multiple_inlined_keys_to_test() ->
     Messages = [
@@ -595,7 +626,7 @@ multiple_inlined_keys_to_test() ->
     % NOTE: The implementation above does not convert the given list of messages
     % into the original format, however it assures that the `to/1' and `from/1'
     % operations are idempotent.
-    ?assertEqual(Messages, from(to(Messages))).
+    ?assertEqual(Messages, from(to(Messages), #{})).
 
 subpath_in_inlined_to_test() ->
     Messages = [
@@ -612,7 +643,7 @@ subpath_in_inlined_to_test() ->
     % NOTE: The implementation above does not convert the given list of messages
     % into the original format, however it assures that the `to/1' and `from/1'
     % operations are idempotent.
-    ?assertEqual(Messages, from(to(Messages))).
+    ?assertEqual(Messages, from(to(Messages), #{})).
 
 %%% `from/1' function tests
 single_message_test() ->
@@ -621,10 +652,10 @@ single_message_test() ->
         <<"path">> => <<"/a">>,
         <<"test-key">> => <<"test-value">>
     },
-    Msgs = from(Req),
+    Msgs = from(Req, #{}),
     ?assertEqual(2, length(Msgs)),
     ?assert(is_map(hd(Msgs))),
-    ?assertEqual(<<"test-value">>, maps:get(<<"test-key">>, hd(Msgs))).
+    ?assertEqual(<<"test-value">>, hb_maps:get(<<"test-key">>, hd(Msgs))).
 
 basic_hashpath_test() ->
     Hashpath = hb_util:human_id(crypto:strong_rand_bytes(32)),
@@ -633,25 +664,25 @@ basic_hashpath_test() ->
         <<"path">> => Path,
         <<"method">> => <<"GET">>
     },
-    Msgs = from(Req),
+    Msgs = from(Req, #{}),
     ?assertEqual(2, length(Msgs)),
     [Base, Msg2] = Msgs,
     ?assertEqual(Base, Hashpath),
-    ?assertEqual(<<"GET">>, maps:get(<<"method">>, Msg2)),
-    ?assertEqual(<<"some-other">>, maps:get(<<"path">>, Msg2)).
+    ?assertEqual(<<"GET">>, hb_maps:get(<<"method">>, Msg2)),
+    ?assertEqual(<<"some-other">>, hb_maps:get(<<"path">>, Msg2)).
 
 multiple_messages_test() ->
     Req = #{
         <<"path">> => <<"/a/b/c">>,
         <<"test-key">> => <<"test-value">>
     },
-    Msgs = from(Req),
+    Msgs = from(Req, #{}),
     ?assertEqual(4, length(Msgs)),
     [_Base, Msg1, Msg2, Msg3] = Msgs,
     ?assert(lists:all(fun is_map/1, Msgs)),
-    ?assertEqual(<<"test-value">>, maps:get(<<"test-key">>, Msg1)),
-    ?assertEqual(<<"test-value">>, maps:get(<<"test-key">>, Msg2)),
-    ?assertEqual(<<"test-value">>, maps:get(<<"test-key">>, Msg3)).
+    ?assertEqual(<<"test-value">>, hb_maps:get(<<"test-key">>, Msg1)),
+    ?assertEqual(<<"test-value">>, hb_maps:get(<<"test-key">>, Msg2)),
+    ?assertEqual(<<"test-value">>, hb_maps:get(<<"test-key">>, Msg3)).
 
 %%% Advanced key syntax tests
 
@@ -660,34 +691,34 @@ scoped_key_test() ->
         <<"path">> => <<"/a/b/c">>,
         <<"2.test-key">> => <<"test-value">>
     },
-    Msgs = from(Req),
+    Msgs = from(Req, #{}),
     ?assertEqual(4, length(Msgs)),
     [_, Msg1, Msg2, Msg3] = Msgs,
-    ?assertEqual(not_found, maps:get(<<"test-key">>, Msg1, not_found)),
-    ?assertEqual(<<"test-value">>, maps:get(<<"test-key">>, Msg2, not_found)),
-    ?assertEqual(not_found, maps:get(<<"test-key">>, Msg3, not_found)).
+    ?assertEqual(not_found, hb_maps:get(<<"test-key">>, Msg1, not_found)),
+    ?assertEqual(<<"test-value">>, hb_maps:get(<<"test-key">>, Msg2, not_found)),
+    ?assertEqual(not_found, hb_maps:get(<<"test-key">>, Msg3, not_found)).
 
 typed_key_test() ->
     Req = #{
         <<"path">> => <<"/a/b/c">>,
         <<"2.test-key+integer">> => <<"123">>
     },
-    Msgs = from(Req),
+    Msgs = from(Req, #{}),
     ?assertEqual(4, length(Msgs)),
     [_, Msg1, Msg2, Msg3] = Msgs,
-    ?assertEqual(not_found, maps:get(<<"test-key">>, Msg1, not_found)),
-    ?assertEqual(123, maps:get(<<"test-key">>, Msg2, not_found)),
-    ?assertEqual(not_found, maps:get(<<"test-key">>, Msg3, not_found)).
+    ?assertEqual(not_found, hb_maps:get(<<"test-key">>, Msg1, not_found)),
+    ?assertEqual(123, hb_maps:get(<<"test-key">>, Msg2, not_found)),
+    ?assertEqual(not_found, hb_maps:get(<<"test-key">>, Msg3, not_found)).
 
 subpath_in_key_test() ->
     Req = #{
         <<"path">> => <<"/a/b/c">>,
         <<"2.test-key+resolve">> => <<"/x/y/z">>
     },
-    Msgs = from(Req),
+    Msgs = from(Req, #{}),
     ?assertEqual(4, length(Msgs)),
     [_, Msg1, Msg2, Msg3] = Msgs,
-    ?assertEqual(not_found, maps:get(<<"test-key">>, Msg1, not_found)),
+    ?assertEqual(not_found, hb_maps:get(<<"test-key">>, Msg1, not_found)),
     ?assertEqual(
         {resolve,
             [
@@ -697,9 +728,9 @@ subpath_in_key_test() ->
                 #{ <<"path">> => <<"z">> }
             ]
         },
-        maps:get(<<"test-key">>, Msg2, not_found)
+        hb_maps:get(<<"test-key">>, Msg2, not_found)
     ),
-    ?assertEqual(not_found, maps:get(<<"test-key">>, Msg3, not_found)).
+    ?assertEqual(not_found, hb_maps:get(<<"test-key">>, Msg3, not_found)).
 
 %%% Advanced path syntax tests
 
@@ -707,10 +738,10 @@ subpath_in_path_test() ->
     Req = #{
         <<"path">> => <<"/a/(x/y/z)/z">>
     },
-    Msgs = from(Req),
+    Msgs = from(Req, #{}),
     ?assertEqual(4, length(Msgs)),
     [_, Msg1, Msg2, Msg3] = Msgs,
-    ?assertEqual(<<"a">>, maps:get(<<"path">>, Msg1)),
+    ?assertEqual(<<"a">>, hb_maps:get(<<"path">>, Msg1)),
     ?assertEqual(
         {resolve,
             [
@@ -722,20 +753,64 @@ subpath_in_path_test() ->
         },
         Msg2
     ),
-    ?assertEqual(<<"z">>, maps:get(<<"path">>, Msg3)).
+    ?assertEqual(<<"z">>, hb_maps:get(<<"path">>, Msg3)).
 
 inlined_keys_test() ->
     Req = #{
         <<"method">> => <<"POST">>,
         <<"path">> => <<"/a/b&k1=v1/c&k2=v2">>
     },
-    Msgs = from(Req),
+    Msgs = from(Req, #{}),
+    ?assertEqual(4, length(Msgs)),
+    [_, Msg1, Msg2, Msg3] = Msgs,
+    ?assertEqual(<<"v1">>, hb_maps:get(<<"k1">>, Msg2)),
+    ?assertEqual(<<"v2">>, hb_maps:get(<<"k2">>, Msg3)),
+    ?assertEqual(not_found, hb_maps:get(<<"k1">>, Msg1, not_found)),
+    ?assertEqual(not_found, hb_maps:get(<<"k2">>, Msg2, not_found)).
+
+inlined_quoted_key_test() ->
+    Req = #{
+        <<"method">> => <<"POST">>,
+        <<"path">> => <<"/a/b&k1=\"v/1\"/c&k2=v2">>
+    },
+    Msgs = from(Req, #{}),
     ?assertEqual(4, length(Msgs)),
     [_, Msg1, Msg2, Msg3] = Msgs,
-    ?assertEqual(<<"v1">>, maps:get(<<"k1">>, Msg2)),
-    ?assertEqual(<<"v2">>, maps:get(<<"k2">>, Msg3)),
-    ?assertEqual(not_found, maps:get(<<"k1">>, Msg1, not_found)),
-    ?assertEqual(not_found, maps:get(<<"k2">>, Msg2, not_found)).
+    ?assertEqual(<<"v/1">>, hb_maps:get(<<"k1">>, Msg2)),
+    ?assertEqual(<<"v2">>, hb_maps:get(<<"k2">>, Msg3)),
+    ?assertEqual(not_found, hb_maps:get(<<"k1">>, Msg1, not_found)),
+    ?assertEqual(not_found, hb_maps:get(<<"k2">>, Msg2, not_found)),
+    ReqB = #{
+        <<"method">> => <<"POST">>,
+        <<"path">> => <<"/~profile@1.0/eval=%22~meta@1.0/info%22">>
+    },
+    MsgsB = from(ReqB, #{}),
+    [_, Msg2b] = MsgsB,
+    ?assertEqual(<<"~meta@1.0/info">>, hb_maps:get(<<"eval">>, Msg2b)).
+
+inlined_assumed_key_test() ->
+    Req = #{
+        <<"method">> => <<"POST">>,
+        <<"path">> => <<"/a/b=4/c&k2=v2">>
+    },
+    Msgs = from(Req, #{}),
+    ?assertEqual(4, length(Msgs)),
+    [_, Msg1, Msg2, Msg3] = Msgs,
+    ?event({parsed, Msgs}),
+    ?assertEqual(<<"4">>, hb_maps:get(<<"b">>, Msg2)),
+    ?assertEqual(not_found, hb_maps:get(<<"b">>, Msg1, not_found)),
+    ?assertEqual(not_found, hb_maps:get(<<"b">>, Msg3, not_found)),
+    ReqB = #{
+        <<"method">> => <<"POST">>,
+        <<"path">> => <<"/a/b+integer=4/c&k2=v2">>
+    },
+    MsgsB = from(ReqB, #{}),
+    [_, Msg1b, Msg2b, Msg3b] = MsgsB,
+    ?event({parsed, MsgsB}),
+    ?assertEqual(4, hb_maps:get(<<"b">>, Msg2b)),
+    ?assertEqual(not_found, hb_maps:get(<<"b">>, Msg1b, not_found)),
+    ?assertEqual(not_found, hb_maps:get(<<"b">>, Msg3b, not_found)).
+
 
 multiple_inlined_keys_test() ->
     Path = <<"/a/b&k1=v1&k2=v2">>,
@@ -743,27 +818,27 @@ multiple_inlined_keys_test() ->
         <<"method">> => <<"POST">>,
         <<"path">> => Path
     },
-    Msgs = from(Req),
+    Msgs = from(Req, #{}),
     ?assertEqual(3, length(Msgs)),
     [_, Msg1, Msg2] = Msgs,
-    ?assertEqual(not_found, maps:get(<<"k1">>, Msg1, not_found)),
-    ?assertEqual(not_found, maps:get(<<"k2">>, Msg1, not_found)),
-    ?assertEqual(<<"v1">>, maps:get(<<"k1">>, Msg2, not_found)),
-    ?assertEqual(<<"v2">>, maps:get(<<"k2">>, Msg2, not_found)).
+    ?assertEqual(not_found, hb_maps:get(<<"k1">>, Msg1, not_found)),
+    ?assertEqual(not_found, hb_maps:get(<<"k2">>, Msg1, not_found)),
+    ?assertEqual(<<"v1">>, hb_maps:get(<<"k1">>, Msg2, not_found)),
+    ?assertEqual(<<"v2">>, hb_maps:get(<<"k2">>, Msg2, not_found)).
 
 subpath_in_inlined_test() ->
     Path = <<"/part1/part2&test=1&b=(/x/y)/part3">>,
     Req = #{
         <<"path">> => Path
     },
-    Msgs = from(Req),
+    Msgs = from(Req, #{}),
     ?assertEqual(4, length(Msgs)),
     [_, First, Second, Third] = Msgs,
-    ?assertEqual(<<"part1">>, maps:get(<<"path">>, First)),
-    ?assertEqual(<<"part3">>, maps:get(<<"path">>, Third)),
+    ?assertEqual(<<"part1">>, hb_maps:get(<<"path">>, First)),
+    ?assertEqual(<<"part3">>, hb_maps:get(<<"path">>, Third)),
     ?assertEqual(
         {resolve, [#{}, #{ <<"path">> => <<"x">> }, #{ <<"path">> => <<"y">> }] },
-        maps:get(<<"b">>, Second)
+        hb_maps:get(<<"b">>, Second)
     ).
 
 path_parts_test() ->
diff --git a/src/hb_store.erl b/src/hb_store.erl
index 88046aa0b..89c5daa3d 100644
--- a/src/hb_store.erl
+++ b/src/hb_store.erl
@@ -1,36 +1,171 @@
+%%% @doc A simple abstraction layer for AO key value store operations.
+%%% 
+%%% This interface allows us to swap out the underlying store implementation(s)
+%%% as desired, without changing the API that `hb_cache` employs. Additionally,
+%%% it enables node operators to customize their configuration to maximize
+%%% performance, data availability, and other factors.
+%%% 
+%%% Stores can be represented in a node's configuration as either a single 
+%%% message, or a (`structured@1.0') list of store messages. If a list of stores
+%%% is provided, the node will cycle through each until a viable store is found
+%%% to execute the given function.
+%%% 
+%%% A valid store must implement a _subset_ of the following functions:
+%%% ```
+%%%     start/1:      Initialize the store.
+%%%     stop/1:       Stop any processes (etc.) that manage the store.
+%%%     reset/1:      Restore the store to its original, empty state.
+%%%     scope/0:      A tag describing the 'scope' of a stores search: `in_memory',
+%%%                   `local', `remote', `arweave', etc. Used in order to allow
+%%%                   node operators to prioritize their stores for search.
+%%%     make_group/2: Create a new group of keys in the store with the given ID.
+%%%     make_link/3:  Create a link (implying one key should redirect to another)
+%%%                   from `existing` to `new` (in that order).
+%%%     type/2:       Return whether the value found at the given key is a
+%%%                   `composite' (group) type, or a `simple' direct binary.
+%%%     read/2:       Read the data at the given location, returning a binary
+%%%                   if it is a `simple' value, or a message if it is a complex
+%%%                   term.
+%%%     write/3:      Write the given `key` with the associated `value` (in that
+%%%                   order) to the store.
+%%%     list/2:       For `composite' type keys, return a list of its child keys.
+%%%     path/2:       Optionally transform a list of path parts into the store's
+%%%                   canonical form.
+%%% '''
+%%% Each function takes a `store' message first, containing an arbitrary set
+%%% of its necessary configuration keys, as well as the `store-module' key which
+%%% refers to the Erlang module that implements the store.
+%%% 
+%%% All functions must return `ok` or `{ok, Result}`, as appropriate. Other 
+%%% results will lead to the store manager (this module) iterating to the next
+%%% store message given by the user. If none of the given store messages are 
+%%% able to execute a requested service, the store manager will return 
+%%% `not_found`.
+
 -module(hb_store).
 -export([behavior_info/1]).
 -export([start/1, stop/1, reset/1]).
 -export([filter/2, scope/2, sort/2]).
--export([type/2, read/2, write/3, list/2]).
+-export([type/2, read/2, write/3, list/2, match/2]).
 -export([path/1, path/2, add_path/2, add_path/3, join/1]).
 -export([make_group/2, make_link/3, resolve/2]).
+-export([find/1]).
 -export([generate_test_suite/1, generate_test_suite/2, test_stores/0]).
 -include("include/hb.hrl").
 -include_lib("eunit/include/eunit.hrl").
 
-%%% A simple abstraction layer for AO key value store operations.
-%%% This interface allows us to swap out the underlying store
-%%% implementation(s) as desired.
-%%% 
-%%% It takes a list of modules and their options, and calls the appropriate
-%%% function on the first module that succeeds. If all modules fail, it returns
-%%% {error, no_viable_store}.
+%% @doc The number of write and read operations to perform in the benchmark.
+-define(STORE_BENCH_WRITE_OPS, 100_000).
+-define(STORE_BENCH_READ_OPS, 100_000).
+-define(STORE_BENCH_LIST_KEYS, 100_000).
+-define(STORE_BENCH_LIST_GROUP_SIZE, 10).
+-define(STORE_BENCH_LIST_OPS, 20_000).
+-define(BENCH_MSG_WRITE_OPS, 250).
+-define(BENCH_MSG_READ_OPS, 250).
+-define(BENCH_MSG_DATA_SIZE, 1024).
 
 behavior_info(callbacks) ->
     [
         {start, 1}, {stop, 1}, {reset, 1}, {make_group, 2}, {make_link, 3},
         {type, 2}, {read, 2}, {write, 3},
-        {list, 2}, {path, 2}, {add_path, 3}
+        {list, 2}, {match, 2}, {path, 2}, {add_path, 3}
     ].
 
 -define(DEFAULT_SCOPE, local).
+-define(DEFAULT_RETRIES, 1).
+
+%% @doc Store access policies to function names.
+-define(STORE_ACCESS_POLICIES, #{
+    <<"read">> => [read, resolve, list, type, path, add_path, join],
+    <<"write">> => [write, make_link, make_group, reset, path, add_path, join],
+    <<"admin">> => [start, stop, reset]
+}).
+
+%%% Store named terms registry functions.
+
+%% @doc Set the instance options for a given store module and name combination.
+set(StoreOpts, InstanceTerm) ->
+    Mod = maps:get(<<"store-module">>, StoreOpts),
+    set(
+        Mod,
+        maps:get(<<"name">>, StoreOpts, Mod),
+        InstanceTerm
+    ).
+set(StoreMod, Name, undefined) ->
+    StoreRef = {store, StoreMod, Name},
+    erlang:erase(StoreRef),
+    persistent_term:erase(StoreRef);
+set(StoreMod, Name, InstanceTerm) ->
+    StoreRef = {store, StoreMod, Name},
+    put(StoreRef, InstanceTerm),
+    persistent_term:put(StoreRef, InstanceTerm),
+    ok.
+
+%% @doc Find or spawn a store instance by its store opts.
+-ifdef(STORE_EVENTS).
+find(StoreOpts) ->
+    {Time, Result} = timer:tc(fun() -> do_find(StoreOpts) end),
+    hb_event:increment(<<"store_duration">>, <<"find">>, #{}, Time),
+    hb_event:increment(<<"store">>, <<"find">>, #{}, 1),
+    Result.
+-else.
+find(StoreOpts) ->
+    do_find(StoreOpts).
+-endif.
+
+do_find(StoreOpts = #{ <<"store-module">> := Mod }) ->
+    Name = maps:get(<<"name">>, StoreOpts, Mod),
+    LookupName = {store, Mod, Name},
+    case get(LookupName) of
+        undefined ->
+            try persistent_term:get(LookupName) of
+                Instance1 ->
+                    EnsuredInstance = ensure_instance_alive(StoreOpts, Instance1),
+                    put(LookupName, EnsuredInstance),
+                    EnsuredInstance
+            catch
+                error:badarg -> spawn_instance(StoreOpts)
+            end;
+        InstanceMessage ->
+            ensure_instance_alive(StoreOpts, InstanceMessage)
+    end.
+
+%% @doc Create a new instance of a store and return its term.
+spawn_instance(StoreOpts = #{ <<"store-module">> := Mod }) ->
+    Name = maps:get(<<"name">>, StoreOpts, Mod),
+    try Mod:start(StoreOpts) of
+        ok -> ok;
+        {ok, InstanceMessage} ->
+            set(Mod, Name, InstanceMessage),
+            InstanceMessage;
+        {error, Reason} ->
+            ?event(error, {store_start_failed, {Mod, Name, Reason}}),
+            throw({store_start_failed, {Mod, Name, Reason}})
+    catch error:undef ->
+        ok
+    end.
+
+%% @doc Handle a found instance message. If it contains a PID, we check if it
+%% is alive. If it does not, we return it as is.
+ensure_instance_alive(StoreOpts, InstanceMessage = #{ <<"pid">> := Pid }) ->
+    case is_process_alive(Pid) of
+        true -> InstanceMessage;
+        false -> spawn_instance(StoreOpts)
+    end;
+ensure_instance_alive(_, InstanceMessage) ->
+    InstanceMessage.
 
 %%% Library wrapper implementations.
 
-start(Modules) -> call_all(Modules, start, []).
+%% @doc Ensure that a store, or list of stores, have all been started.
+start(StoreOpts) when not is_list(StoreOpts) -> start([StoreOpts]);
+start([]) -> ok;
+start([StoreOpts | Rest]) ->
+    find(StoreOpts),
+    start(Rest).
 
-stop(Modules) -> call_function(Modules, stop, []).
+stop(Modules) ->
+    call_function(Modules, stop, []).
 
 %% @doc Takes a store object and a filter function or match spec, returning a
 %% new store object with only the modules that match the filter. The filter
@@ -51,12 +186,25 @@ filter(Modules, Filter) ->
 %% @doc Limit the store scope to only a specific (set of) option(s).
 %% Takes either an Opts message or store, and either a single scope or a list
 %% of scopes.
-scope(Scope, Opts) when is_map(Opts) ->
+scope(Opts, Scope) when is_map(Opts) ->
     case hb_opts:get(store, no_viable_store, Opts) of
         no_viable_store -> Opts;
-        Store -> Opts#{ store => scope(Scope, Store) }
+        Store when is_list(Store) ->
+            % Store is already a list, apply scope normally
+            Opts#{ store => scope(Store, Scope) };
+        Store when is_map(Store) ->
+            % Check if Store already has a nested 'store' key
+            case maps:find(store, Store) of
+                {ok, _NestedStores} ->
+                    % Already has nested structure, return as-is
+                    Opts;
+                error ->
+                    % Single store map, wrap in list before scoping
+                    % This ensures consistent behavior
+                    Opts#{ store => scope([Store], Scope) }
+            end
     end;
-scope(Scope, Store) ->
+scope(Store, Scope) ->
     filter(
         Store,
         fun(StoreScope, _) ->
@@ -69,7 +217,7 @@ scope(Scope, Store) ->
 %% default scope (local).
 get_store_scope(Store) ->
     case call_function(Store, scope, []) of
-        no_viable_store -> ?DEFAULT_SCOPE;
+        not_found -> ?DEFAULT_SCOPE;
         Scope -> Scope
     end.
 
@@ -81,7 +229,7 @@ get_store_scope(Store) ->
 sort(Stores, PreferenceOrder) when is_list(PreferenceOrder) ->
     sort(
         Stores,
-        maps:from_list(
+        hb_maps:from_list(
             [
                 {Scope, -Index}
             ||
@@ -96,8 +244,8 @@ sort(Stores, PreferenceOrder) when is_list(PreferenceOrder) ->
 sort(Stores, ScoreMap) ->
     lists:sort(
         fun(Store1, Store2) ->
-            maps:get(get_store_scope(Store1), ScoreMap, 0) >
-                maps:get(get_store_scope(Store2), ScoreMap, 0)
+            hb_maps:get(get_store_scope(Store1), ScoreMap, 0) >
+                hb_maps:get(get_store_scope(Store2), ScoreMap, 0)
         end,
         Stores
     ).
@@ -139,7 +287,7 @@ path(_, Path) -> path(Path).
 add_path(Path1, Path2) -> Path1 ++ Path2.
 add_path(Store, Path1, Path2) ->
     case call_function(Store, add_path, [Path1, Path2]) of
-        no_viable_store -> add_path(Path1, Path2);
+        not_found -> add_path(Path1, Path2);
         Result -> Result
     end.
 
@@ -151,33 +299,119 @@ resolve(Modules, Path) -> call_function(Modules, resolve, [Path]).
 %% structures, so this is likely to be very slow for most stores.
 list(Modules, Path) -> call_function(Modules, list, [Path]).
 
+%% @doc Match a series of keys and values against the store. Returns 
+%% `{ok, Matches}' if the match is successful, or `not_found' if there are no
+%% messages in the store that feature all of the given key-value pairs. `Matches'
+%% is given as a list of IDs.
+match(Modules, Match) -> call_function(Modules, match, [Match]).
+
 %% @doc Call a function on the first store module that succeeds. Returns its
-%% result, or no_viable_store if none of the stores succeed.
-call_function(X, _Function, _Args) when not is_list(X) ->
-    call_function([X], _Function, _Args);
-call_function([], _Function, _Args) ->
-    no_viable_store;
-call_function([Store = #{<<"store-module">> := Mod} | Rest], Function, Args) ->
-    ?event({calling, Mod, Function, Args}),
-    try apply(Mod, Function, [Store | Args]) of
+%% result, or `not_found` if none of the stores succeed. If `TIME_CALLS` is set,
+%% this function will also time the call and increment the appropriate event
+%% counter.
+-ifdef(STORE_EVENTS).
+call_function(X, Function, Args) ->
+    {Time, Result} = timer:tc(fun() -> do_call_function(X, Function, Args) end),
+    ?event(store_events,
+        {store_call,
+            {function, Function},
+            {args, Args},
+            {primary_store,
+                case X of
+                    [PrimaryStore | _] -> PrimaryStore;
+                    _ -> X
+                end
+            },
+            {time, Time},
+            {result, Result}
+        }
+    ),
+    hb_event:increment(<<"store_duration">>, hb_util:bin(Function), #{}, Time),
+    hb_event:increment(<<"store">>, hb_util:bin(Function), #{}, 1),
+    Result.
+-else.
+call_function(X, Function, Args) ->
+    do_call_function(X, Function, Args).
+-endif.
+do_call_function(X, _Function, _Args) when not is_list(X) ->
+    do_call_function([X], _Function, _Args);
+do_call_function([], _Function, _Args) ->
+    not_found;
+do_call_function([Store = #{<<"access">> := Access} | Rest], Function, Args) ->
+    % If the store has an access controls, check if the function is allowed from
+    % the stated policies.
+    IsAdmissible =
+        lists:any(
+            fun(Group) ->
+                lists:any(
+                    fun(F) -> F == Function end,
+                    maps:get(Group, ?STORE_ACCESS_POLICIES, [])
+                )
+            end,
+            Access
+        ),
+    case IsAdmissible of
+        true ->
+            do_call_function(
+                [maps:remove(<<"access">>, Store) | Rest],
+                Function,
+                Args
+            );
+        false ->
+            do_call_function(Rest, Function, Args)
+    end;
+do_call_function([Store = #{<<"store-module">> := Mod} | Rest], Function, Args) ->
+    % Attempt to apply the function. If it fails, try the next store.
+    try apply_store_function(Mod, Store, Function, Args) of
         not_found ->
-            call_function(Rest, Function, Args);
+            do_call_function(Rest, Function, Args);
         Result ->
             Result
-    catch
-        Class:Reason:Stacktrace ->
-            ?event(warning, {store_call_failed, {Class, Reason, Stacktrace}}),
-            call_function(Rest, Function, Args)
+    catch _:_:_ -> do_call_function(Rest, Function, Args)
+    end.
+
+%% @doc Apply a store function, checking if the store returns a retry request or
+%% errors. If it does, attempt to start the store again and retry, up to the
+%% given maximum number of times.
+apply_store_function(Mod, Store, Function, Args) ->
+    MaxAttempts = maps:get(<<"max-retries">>, Store, ?DEFAULT_RETRIES) + 1,
+    apply_store_function(Mod, Store, Function, Args, MaxAttempts).
+apply_store_function(_Mod, _Store, _Function, _Args, 0) ->
+    % Too many attempts have already failed. Bail.
+    not_found;
+apply_store_function(Mod, Store, Function, Args, AttemptsRemaining) ->
+    try apply(Mod, Function, [Store | Args]) of
+        retry -> retry(Mod, Store, Function, Args, AttemptsRemaining);
+        Other -> Other
+    catch Class:Reason:Stacktrace ->
+        ?event(store_error,
+            {store_call_failed_retrying,
+                {store, Store},
+                {function, Function},
+                {args, Args},
+                {class, Class},
+                {reason, Reason},
+                {stacktrace, {trace, Stacktrace}}
+            }
+        ),
+        retry(Mod, Store, Function, Args, AttemptsRemaining)
     end.
 
+%% @doc Stop and start the store, then retry.
+retry(Mod, Store, Function, Args, AttemptsRemaining) ->
+    % Attempt to stop the store and start it again, then retry.
+    try Mod:stop(Store) catch _:_ -> ignore_errors end,
+    set(Store, undefined),
+    start(Store),
+    apply_store_function(Mod, Store, Function, Args, AttemptsRemaining - 1).
+
 %% @doc Call a function on all modules in the store.
 call_all(X, _Function, _Args) when not is_list(X) ->
     call_all([X], _Function, _Args);
 call_all([], _Function, _Args) ->
     ok;
 call_all([Store = #{<<"store-module">> := Mod} | Rest], Function, Args) ->
-    try
-        apply(Mod, Function, [Store | Args])
+    try apply_store_function(Mod, Function, Store, Args)
     catch
         Class:Reason:Stacktrace ->
             ?event(warning, {store_call_failed, {Class, Reason, Stacktrace}}),
@@ -187,42 +421,65 @@ call_all([Store = #{<<"store-module">> := Mod} | Rest], Function, Args) ->
 
 %%% Test helpers
 
--ifdef(ENABLE_ROCKSDB).
+%% @doc Return a list of stores for testing. Additional individual functions are
+%% used to generate store options for those whose drivers are not built by 
+%% default into all HyperBEAM distributions.
 test_stores() ->
     [
-        #{
-            <<"store-module">> => hb_store_rocksdb,
-            <<"prefix">> => <<"cache-TEST/rocksdb">>
+        (hb_test_utils:test_store(hb_store_fs))#{
+            <<"benchmark-scale">> => 0.001
         },
-        #{
-            <<"store-module">> => hb_store_fs,
-            <<"prefix">> => <<"cache-TEST/fs">>
+        (hb_test_utils:test_store(hb_store_lmdb))#{
+            <<"benchmark-scale">> => 0.5
+        },
+        (hb_test_utils:test_store(hb_store_lru))#{
+            <<"persistent-store">> => [
+                #{
+                    <<"store-module">> => hb_store_fs,
+                    <<"name">> => <<"cache-TEST/lru">>
+                }
+            ]
         }
-    ].
--else.
-test_stores() ->
+    ] ++ rocks_stores().
+
+-ifdef(ENABLE_ROCKSDB).
+rocks_stores() ->
     [
         #{
-            <<"store-module">> => hb_store_fs,
-            <<"prefix">> => <<"cache-TEST/fs">>
+            <<"store-module">> => hb_store_rocksdb,
+            <<"name">> => <<"cache-TEST/rocksdb">>
         }
     ].
+-else.
+rocks_stores() -> [].
 -endif.
 
 generate_test_suite(Suite) ->
     generate_test_suite(Suite, test_stores()).
 generate_test_suite(Suite, Stores) ->
+    hb:init(),
     lists:map(
-        fun(Store = #{ <<"store-module">> := Mod }) ->
+        fun(Store = #{<<"store-module">> := Mod}) ->
             {foreach,
-				fun() -> hb_store:start(Store), hb_store:reset(Store) end,
-				fun(_) -> hb_store:reset(Store) end,
+                fun() ->
+                    hb_store:start(Store)
+                end,
+                fun(_) ->
+                    hb_store:reset(Store)
+                    % hb_store:stop(Store)
+                end,
                 [
-                    {atom_to_list(Mod) ++ ": " ++ Desc,
-                        fun() -> 
-                            TestResult = Test(Store),
-                            TestResult
-                        end}
+                    {
+                        atom_to_list(Mod) ++ ": " ++ Desc,
+                        {
+                            timeout,
+                            60,
+                            fun() ->
+                                TestResult = Test(Store),
+                                TestResult
+                            end
+                        }
+                    }
                 ||
                     {Desc, Test} <- Suite
                 ]
@@ -234,31 +491,550 @@ generate_test_suite(Suite, Stores) ->
 %%% Tests
 
 %% @doc Test path resolution dynamics.
-simple_path_resolution_test(Opts) ->
-    Store = hb_opts:get(store, no_viable_store, Opts),
+simple_path_resolution_test(Store) ->
     ok = hb_store:write(Store, <<"test-file">>, <<"test-data">>),
     hb_store:make_link(Store, <<"test-file">>, <<"test-link">>),
     ?assertEqual({ok, <<"test-data">>}, hb_store:read(Store, <<"test-link">>)).
 
 %% @doc Ensure that we can resolve links recursively.
-resursive_path_resolution_test(Opts) ->
-    Store = hb_opts:get(store, no_viable_store, Opts),
+resursive_path_resolution_test(Store) ->
     hb_store:write(Store, <<"test-file">>, <<"test-data">>),
     hb_store:make_link(Store, <<"test-file">>, <<"test-link">>),
     hb_store:make_link(Store, <<"test-link">>, <<"test-link2">>),
     ?assertEqual({ok, <<"test-data">>}, hb_store:read(Store, <<"test-link2">>)).
 
 %% @doc Ensure that we can resolve links through a directory.
-hierarchical_path_resolution_test(Opts) ->
-    Store = Opts,
+hierarchical_path_resolution_test(Store) ->
     hb_store:make_group(Store, <<"test-dir1">>),
     hb_store:write(Store, [<<"test-dir1">>, <<"test-file">>], <<"test-data">>),
     hb_store:make_link(Store, [<<"test-dir1">>], <<"test-link">>),
-    ?assertEqual({ok, <<"test-data">>}, hb_store:read(Store, [<<"test-link">>, <<"test-file">>])).
+    ?assertEqual(
+        {ok, <<"test-data">>},
+        hb_store:read(Store, [<<"test-link">>, <<"test-file">>])
+    ).
 
 store_suite_test_() ->
-    hb_store:generate_test_suite([
+    generate_test_suite([
         {"simple path resolution", fun simple_path_resolution_test/1},
         {"resursive path resolution", fun resursive_path_resolution_test/1},
         {"hierarchical path resolution", fun hierarchical_path_resolution_test/1}
-    ]).
\ No newline at end of file
+    ]).
+
+benchmark_suite_test_() ->
+    generate_test_suite([
+        {"benchmark key read write", fun benchmark_key_read_write/1},
+        {"benchmark list", fun benchmark_list/1},
+        {"benchmark message read write", fun benchmark_message_read_write/1}
+    ]).
+
+%% @doc Benchmark a store. By default, we write 10,000 keys and read 10,000
+%% keys. This can be altered by setting the `STORE_BENCH_WRITE_OPS' and
+%% `STORE_BENCH_READ_OPS' macros. If the `benchmark-scale' key is set in the
+%% store message, we use it to scale the number of operations for only that
+%% store. This allows slower stores to be tested with fewer operations.
+benchmark_key_read_write(Store = #{ <<"benchmark-scale">> := Scale }) ->
+    benchmark_key_read_write(
+        Store,
+        erlang:ceil(Scale * ?STORE_BENCH_WRITE_OPS), 
+        erlang:ceil(Scale * ?STORE_BENCH_READ_OPS)
+    );
+benchmark_key_read_write(Store) ->
+    benchmark_key_read_write(Store, ?STORE_BENCH_WRITE_OPS, ?STORE_BENCH_READ_OPS).
+benchmark_key_read_write(Store, WriteOps, ReadOps) ->
+    start(Store),
+    timer:sleep(100),
+    ?event(
+        {benchmarking,
+            {store, Store},
+            {write_ops, WriteOps},
+            {read_ops, ReadOps}
+        }
+    ),
+    % Generate random data to write and the keys to read ahead of time.
+    RandomData = hb_util:human_id(crypto:strong_rand_bytes(32)),
+    Keys =
+        lists:map(
+            fun(N) ->
+                << "key-", (integer_to_binary(N))/binary >>
+            end,
+            lists:seq(1, ReadOps)
+        ),
+    {WriteTime, ok} =
+        timer:tc(
+            fun() ->
+                lists:foreach(
+                    fun(Key) -> ok = write(Store, Key, RandomData) end,
+                    Keys
+                )
+            end
+        ),
+    % Calculate write rate.
+    WriteRate = erlang:round(WriteOps / (WriteTime / 1000000)),
+    hb_format:eunit_print(
+        "Wrote ~s records in ~p ms (~s records/s)",
+        [
+            hb_util:human_int(WriteOps),
+            WriteTime/1000,
+            hb_util:human_int(WriteRate)
+        ]
+    ),
+    % Generate keys to read ahead of time.
+    ReadKeys =
+        lists:map(
+            fun(_) ->
+                << "key-", (integer_to_binary(rand:uniform(ReadOps)))/binary >>
+            end,
+            lists:seq(1, ReadOps)
+        ),
+    % Time random reads.
+    {ReadTime, NotFoundCount} =
+        timer:tc(
+            fun() ->
+                lists:foldl(
+                    fun(Key, Count) -> 
+                        case read(Store, Key) of
+                            {ok, _} -> Count;
+                            _ -> Count + 1
+                        end
+                    end,
+                    0,
+                    ReadKeys
+                )
+            end
+        ),
+    % Calculate read rate.
+    ReadRate = erlang:round(ReadOps / (ReadTime / 1000000)),
+    hb_format:eunit_print(
+        "Read ~s records in ~p ms (~s records/s)",
+        [
+            hb_util:human_int(ReadOps),
+            ReadTime/1000,
+            hb_util:human_int(ReadRate)
+        ]
+    ),
+    ?assertEqual(0, NotFoundCount, "Written keys not found in store.").
+
+benchmark_list(Store = #{ <<"benchmark-scale">> := Scale }) ->
+    benchmark_list(
+        Store,
+        erlang:ceil(Scale * ?STORE_BENCH_LIST_KEYS),
+        erlang:ceil(Scale * ?STORE_BENCH_LIST_OPS),
+        erlang:ceil(Scale * ?STORE_BENCH_LIST_GROUP_SIZE)
+    );
+benchmark_list(Store) ->
+    benchmark_list(
+        Store,
+        ?STORE_BENCH_LIST_KEYS,
+        ?STORE_BENCH_LIST_OPS,
+        ?STORE_BENCH_LIST_GROUP_SIZE
+    ).
+benchmark_list(Store, WriteOps, ListOps, GroupSize) ->
+    start(Store),
+    timer:sleep(100),
+    ?event(
+        {benchmarking,
+            {store, Store},
+            {keys, hb_util:human_int(WriteOps)},
+            {groups, hb_util:human_int(WriteOps div GroupSize)},
+            {lists, hb_util:human_int(ListOps)}
+        }
+    ),
+    % Generate a random message to write and the keys to read ahead of time.
+    Groups =
+        lists:map(
+            fun(_) ->
+                GroupID = hb_util:human_id(crypto:strong_rand_bytes(32)),
+                {
+                    GroupID,
+                    lists:map(
+                        fun(M) ->
+                            {
+                                <<"key-", (integer_to_binary(M))/binary >>,
+                                <<"value-", (integer_to_binary(M))/binary >>
+                            }
+                        end,
+                        lists:seq(1, GroupSize)
+                    )
+                }
+            end,
+            lists:seq(1, GroupCount = WriteOps div GroupSize)
+        ),
+    hb_format:eunit_print(
+        "Generated ~s groups of ~s keys",
+        [
+            hb_util:human_int(GroupCount),
+            hb_util:human_int(GroupSize)
+        ]
+    ),
+    {WriteTime, _} =
+        timer:tc(
+            fun() ->
+                lists:map(
+                    fun({GroupID, KeyPairs}) ->
+                        ok = make_group(Store, GroupID),
+                        lists:foreach(
+                            fun({Key, Value}) ->
+                                ok =
+                                    write(
+                                        Store,
+                                        <<GroupID/binary, "/", Key/binary >>,
+                                        Value
+                                    )
+                            end,
+                            KeyPairs
+                        )
+                    end,
+                    Groups
+                ),
+                % Perform one list operation to ensure that the write queue is
+                % flushed.
+                {LastGroupID, _} = lists:last(Groups),
+                list(Store, LastGroupID)
+            end
+        ),
+    % Print the results. Our write time is in microseconds, so we normalize it
+    % to seconds.
+    hb_test_utils:benchmark_print(
+        <<"Wrote and flushed">>,
+        <<"keys">>,
+        WriteOps,
+        WriteTime / 1_000_000
+    ),
+    % Generate groups to read ahead of time.
+    ReadGroups =
+        lists:map(
+            fun(_) ->
+                lists:nth(rand:uniform(GroupCount), Groups)
+            end,
+            lists:seq(1, ListOps)
+        ),
+    % Time random reads.
+    {ReadTime, NotFoundCount} =
+        timer:tc(
+            fun() ->
+                lists:foldl(
+                    fun({GroupID, GroupKeyValues}, Count) ->
+                        ExpectedKeys =
+                            [ KeyInGroup || {KeyInGroup, _} <- GroupKeyValues ],
+                        case list(Store, GroupID) of
+                            {ok, ListedKeys} ->
+                                Res =
+                                    lists:all(
+                                        fun({KeyInGroup, _ExpectedValue}) ->
+                                            lists:member(KeyInGroup, ListedKeys)
+                                        end,
+                                        GroupKeyValues
+                                    ),
+                                case Res of
+                                    true -> Count;
+                                    _ ->
+                                        ?event(
+                                            {list_group_not_found,
+                                                {group, GroupID},
+                                                {received_keys, ListedKeys},
+                                                {expected_keys, ExpectedKeys}
+                                            }
+                                        ),
+                                        Count + 1
+                                end;
+                            _ ->
+                                ?event(
+                                    {list_group_not_found,
+                                        {group, GroupID},
+                                        {expected_keys, ExpectedKeys}
+                                    }
+                                ),
+                                Count + 1
+                        end
+                    end,
+                    0,
+                    ReadGroups
+                )
+            end
+        ),
+    % Print the results.
+    hb_test_utils:benchmark_print(
+        <<"Listed">>,
+        <<"groups">>,
+        ListOps,
+        ReadTime / 1_000_000
+    ),
+    ?assertEqual(0, NotFoundCount, "Groups listed in correctly.").
+
+benchmark_message_read_write(Store = #{ <<"benchmark-scale">> := Scale }) ->
+    benchmark_message_read_write(
+        Store,
+        erlang:ceil(Scale * ?BENCH_MSG_WRITE_OPS),
+        erlang:ceil(Scale * ?BENCH_MSG_READ_OPS)
+    );
+benchmark_message_read_write(Store) ->
+    benchmark_message_read_write(Store, ?BENCH_MSG_WRITE_OPS, ?BENCH_MSG_READ_OPS).
+benchmark_message_read_write(Store, WriteOps, ReadOps) ->
+    start(Store),
+    Opts = #{ store => Store, priv_wallet => hb:wallet() },
+    TestDataSize = ?BENCH_MSG_DATA_SIZE * 8, % in _bits_
+    timer:sleep(100),
+    ?event(
+        {benchmarking,
+            {store, Store},
+            {write_ops, WriteOps},
+            {read_ops, ReadOps}
+        }
+    ),
+    % Generate a random message to write and the keys to read ahead of time.
+    Msgs =
+        lists:map(
+            fun(N) ->
+                #{
+                    <<"process">> => hb_util:human_id(crypto:strong_rand_bytes(32)),
+                    <<"slot">> => N,
+                    <<"message">> =>
+                        hb_message:commit(
+                            #{
+                                <<"body">> => <<"test", 0:TestDataSize, N:32>>
+                            },
+                            Opts
+                        )
+                }
+            end,
+            lists:seq(1, WriteOps)
+        ),
+    hb_format:eunit_print(
+        "Generated ~s messages (size ~s bits)",
+        [
+            hb_util:human_int(WriteOps),
+            hb_util:human_int(TestDataSize)
+        ]
+    ),
+    {WriteTime, MsgPairs} =
+        timer:tc(
+            fun() ->
+                lists:map(
+                    fun(Msg) ->
+                        {hb_util:ok(hb_cache:write(Msg, Opts)), Msg}
+                    end,
+                    Msgs
+                )
+            end
+        ),
+    % Print the results. Our write time is in microseconds, so we normalize it
+    % to seconds.
+    hb_test_utils:benchmark_print(
+        <<"Wrote">>,
+        <<"messages">>,
+        WriteOps,
+        WriteTime / 1_000_000
+    ),
+    % Generate keys to read ahead of time.
+    ReadKeys =
+        lists:map(
+            fun(_) ->
+                lists:nth(rand:uniform(length(MsgPairs)), MsgPairs)
+            end,
+            lists:seq(1, ReadOps)
+        ),
+    % Time random reads.
+    {ReadTime, NotFoundCount} =
+        timer:tc(
+            fun() ->
+                lists:foldl(
+                    fun({MsgID, Msg}, Count) -> 
+                        case hb_cache:read(MsgID, Opts) of
+                            {ok, Msg1} ->
+                                case hb_cache:ensure_all_loaded(Msg1, Opts) of
+                                    Msg -> Count;
+                                    _ -> Count + 1
+                                end;
+                            _ -> Count + 1
+                        end
+                    end,
+                    0,
+                    ReadKeys
+                )
+            end
+        ),
+    % Print the results.
+    hb_test_utils:benchmark_print(
+        <<"Read">>,
+        <<"messages">>,
+        ReadOps,
+        ReadTime / 1_000_000
+    ),
+    ?assertEqual(0, NotFoundCount, "Written keys not found in store.").
+
+%%% Access Control Tests
+
+%% @doc Test that read-only stores allow read operations but block write operations
+read_only_access_test() ->
+    TestStore = hb_test_utils:test_store(hb_store_fs, <<"access-read-only">>),
+    ReadOnlyStore = TestStore#{<<"access">> => [<<"read">>]},
+    WriteStore = hb_test_utils:test_store(hb_store_fs, <<"access-write">>),
+    StoreList = [ReadOnlyStore, WriteStore],
+    TestKey = <<"test-key">>,
+    TestValue = <<"test-value">>,
+    start(StoreList),
+    ?event(testing, {read_only_test_started}),
+    WriteResponse = write(StoreList, TestKey, TestValue),
+    ?assertEqual(ok, WriteResponse),
+    ?event(testing, {write_used_fallback_store, WriteResponse}),
+    ReadResponse = read(StoreList, TestKey),
+    ?assertEqual({ok, TestValue}, ReadResponse),
+    ?event(testing, {read_succeeded, ReadResponse}),
+    ReadOnlyStoreState = read([ReadOnlyStore], TestKey),
+    WriteStoreState = read([WriteStore], TestKey),
+    ?event(testing, {
+        store_state, {read_only, ReadOnlyStoreState},{ write, WriteStoreState}
+    }),
+    ?assertEqual(not_found, ReadOnlyStoreState),
+    ?assertEqual({ok, TestValue}, WriteStoreState).
+
+%% @doc Test that write-only stores allow write operations but block read operations  
+write_only_access_test() ->
+    WriteOnlyStore =
+        (hb_test_utils:test_store(hb_store_fs, <<"access-write-only">>))#{
+            <<"access">> => [<<"write">>]
+        },
+    ReadStore = hb_test_utils:test_store(hb_store_fs, <<"access-read-fallback">>),
+    StoreList = [WriteOnlyStore, ReadStore],
+    TestKey = <<"write-test-key">>,
+    TestValue = <<"write-test-value">>,
+    start(StoreList),
+    ?event(testing, {write_only_test_started}),
+    ?assertEqual(ok, write(StoreList, TestKey, TestValue)),
+    ?event(testing, {write_succeeded_on_write_only}),
+    ReadStoreState = read(StoreList, TestKey),
+    ?assertEqual(not_found, ReadStoreState),
+    ?event(testing, {read_skipped_write_only_store, ReadStoreState}),
+    WriteOnlyStoreNoAccess = maps:remove(<<"access">>, WriteOnlyStore),
+    ReadStoreNoAccess = read([WriteOnlyStoreNoAccess], TestKey),
+    ?event(testing, {store, ReadStoreNoAccess}),
+    ?assertEqual({ok, TestValue}, ReadStoreNoAccess).
+
+%% @doc Test admin-only stores for start/stop/reset operations
+admin_only_access_test() ->
+    AdminOnlyStore =
+        (hb_test_utils:test_store(hb_store_fs, <<"access-admin-only">>))#{
+            <<"access">> => [<<"admin">>, <<"read">>, <<"write">>]
+        },
+    StoreList = [AdminOnlyStore],
+    TestKey = <<"admin-test-key">>,
+    TestValue = <<"admin-test-value">>,
+    start(StoreList),
+    ?assertEqual(ok, write(StoreList, TestKey, TestValue)),
+    ?assertEqual({ok, TestValue}, read(StoreList, TestKey)),
+    reset(StoreList),
+    ?assertEqual(ok, start(StoreList)),
+    ?assertEqual(not_found, read(StoreList, TestKey)).
+
+%% @doc Test multiple access permissions
+multi_access_permissions_test() ->
+    ReadWriteStore =
+        (hb_test_utils:test_store(hb_store_fs, <<"access-read-write">>))#{
+            <<"access">> => [<<"read">>, <<"write">>]
+        },
+    AdminStore =
+        (hb_test_utils:test_store(hb_store_fs, <<"access-admin-fallback">>))#{
+            <<"access">> => [<<"admin">>]
+        },
+    StoreList = [ReadWriteStore, AdminStore],
+    TestKey = <<"multi-access-key">>,
+    TestValue = <<"multi-access-value">>,
+    start(StoreList),
+    ?event(testing, {multi_access_test_started}),
+    ?assertEqual(ok, write(StoreList, TestKey, TestValue)),
+    ?event(testing, {write_succeeded_on_read_write_store}),
+    ?assertEqual({ok, TestValue}, read(StoreList, TestKey)),
+    ?event(testing, {read_succeeded_on_read_write_store}),
+    reset(StoreList),
+    ?assertEqual(ok, start(StoreList)),
+    ?assertEqual(not_found, read(StoreList, TestKey)).
+
+%% @doc Test access control with a list of stores.
+store_access_list_test() ->
+    % Chain: Read-only -> Write-only -> Unrestricted
+    ReadOnlyStore =
+        (hb_test_utils:test_store(hb_store_fs, <<"chain-read-only">>))#{
+            <<"access">> => [<<"read">>]
+        },
+    WriteOnlyStore =
+        (hb_test_utils:test_store(hb_store_fs, <<"chain-write-only">>))#{
+            <<"access">> => [<<"write">>]
+        },
+    UnrestrictedStore =
+        hb_test_utils:test_store(hb_store_fs, <<"chain-unrestricted">>),
+    StoreChain = [ReadOnlyStore, WriteOnlyStore, UnrestrictedStore],
+    TestKey = <<"chain-test-key">>,
+    TestValue = <<"chain-test-value">>,
+    start(StoreChain),
+    ?event(testing, {fallback_chain_test_started, length(StoreChain)}),
+    ?assertEqual(ok, write(StoreChain, TestKey, TestValue)),
+    ?event(testing, {write_used_second_store_in_chain}),
+    ?assertEqual(not_found, read(StoreChain, TestKey)),
+    ?event(testing, {read_fell_through_entire_chain}),
+    WriteOnlyNoAccess = maps:remove(<<"access">>, WriteOnlyStore),
+    ?assertEqual({ok, TestValue}, read([WriteOnlyNoAccess], TestKey)).
+
+%% @doc Test invalid access permissions are ignored
+invalid_access_permissions_test() ->
+    InvalidAccessStore =
+        (hb_test_utils:test_store(hb_store_fs, <<"access-invalid">>))#{
+            <<"access">> => [<<"invalid-policy">>, <<"nonexistent-policy">>]
+        },
+    FallbackStore = hb_test_utils:test_store(hb_store_fs, <<"access-fallback">>),
+    StoreList = [InvalidAccessStore, FallbackStore],
+    TestKey = <<"invalid-access-key">>,
+    TestValue = <<"invalid-access-value">>,
+    start(StoreList),
+    ?event(testing, {invalid_access_test_started}),
+    ?assertEqual(ok, write(StoreList, TestKey, TestValue)),
+    ?event(testing, {write_used_fallback_store}),
+    ?assertEqual({ok, TestValue}, read(StoreList, TestKey)),
+    ?event(testing, {read_used_fallback_store}),
+    InvalidStoreNoAccess = maps:remove(<<"access">>, InvalidAccessStore),
+    start([InvalidStoreNoAccess]),
+    ?assertEqual(not_found, read([InvalidStoreNoAccess], TestKey)).
+
+%% @doc Test list operations with access control
+list_access_control_test() ->
+    ReadOnlyStore =
+        (hb_test_utils:test_store(hb_store_fs, <<"list-read-only">>))#{
+            <<"access">> => [<<"read">>]
+        },
+    WriteStore = hb_test_utils:test_store(hb_store_fs, <<"list-write">>),
+    StoreList = [ReadOnlyStore, WriteStore],
+    ListGroup = <<"list-test-group">>,
+    TestKey = <<"list-test-key">>,
+    TestValue = <<"list-test-value">>,
+    start(StoreList),
+    ?event(testing, {list_access_test_started}),
+    GroupResult = make_group(StoreList, ListGroup),
+    ?assertEqual(ok, GroupResult),
+    ?event(testing, {group_created, GroupResult}),
+    WriteResponse = write(StoreList, [ListGroup, TestKey], TestValue),
+    ?assertEqual(ok, WriteResponse),
+    ListResult = list(StoreList, ListGroup),
+    ListValue = read(StoreList, [ListGroup, TestKey]),
+    ?event(testing, {list_result, ListResult, ListValue}),
+    ?assertEqual({ok,[TestKey]}, ListResult),
+    ?assertEqual({ok,TestValue}, ListValue).
+
+%% @doc Test make_link operations with write access
+make_link_access_test() ->
+    WriteOnlyStore =
+        (hb_test_utils:test_store(hb_store_fs, <<"link-write-only">>))#{
+            <<"access">> => [<<"write">>,<<"read">>]
+        },
+    FallbackStore = hb_test_utils:test_store(hb_store_fs, <<"link-fallback">>),
+    StoreList = [WriteOnlyStore, FallbackStore],
+    SourceKey = <<"link-source">>,
+    TargetKey = <<"link-target">>,
+    TestValue = <<"link-test-value">>,
+    start(StoreList),
+    ?event(testing, {make_link_access_test_started}),
+    ?assertEqual(ok, write(StoreList, TargetKey, TestValue)),
+    LinkResult = make_link(StoreList, TargetKey, SourceKey),
+    ?event(testing, {make_link_result, LinkResult}),
+    ReadResult = read(StoreList, SourceKey),
+    ?event(testing, {read_linked_value, ReadResult}),
+    ?assertEqual({ok, TestValue}, ReadResult),
+    ?assertEqual(ok, LinkResult).
\ No newline at end of file
diff --git a/src/hb_store_fs.erl b/src/hb_store_fs.erl
index 45251d0ba..ac2bf8849 100644
--- a/src/hb_store_fs.erl
+++ b/src/hb_store_fs.erl
@@ -1,29 +1,45 @@
+%%% @doc A key-value store implementation, following the `hb_store' behavior 
+%%% and interface. This implementation utilizes the node's local file system as
+%%% its storage mechanism, offering an alternative to other store's that require
+%%% the compilation of additional libraries in order to function.
+%%% 
+%%% As this store implementation operates using Erlang's native `file' and 
+%%% `filelib' mechanisms, it largely inherits its performance characteristics 
+%%% from those of the underlying OS/filesystem drivers. Certain filesystems can
+%%% be quite performant for the types of workload that HyperBEAM AO-Core execution
+%%% requires (many reads and writes to explicit keys, few directory 'listing' or
+%%% search operations), awhile others perform suboptimally.
+%%% 
+%%% Additionally, thisstore implementation offers the ability for simple 
+%%% integration of HyperBEAM with other non-volatile storage media: `hb_store_fs'
+%%% will interact with any service that implements the host operating system's
+%%% native filesystem API. By mounting devices via `FUSE' (etc), HyperBEAM is
+%%% able to interact with a large number of existing storage systems (for example,
+%%% S3-compatible cloud storage APIs, etc).
 -module(hb_store_fs).
 -behavior(hb_store).
--export([start/1, stop/1, reset/1, scope/1]).
+-export([start/1, stop/1, reset/1, scope/0, scope/1]).
 -export([type/2, read/2, write/3, list/2]).
 -export([make_group/2, make_link/3, resolve/2]).
 -include_lib("kernel/include/file.hrl").
 -include("include/hb.hrl").
 
-%%% A key-value store abstraction, such that the underlying implementation
-%%% can be swapped out easily. The default implementation is a file-based
-%%% store.
-
 %% @doc Initialize the file system store with the given data directory.
-start(#{ <<"prefix">> := DataDir }) ->
+start(#{ <<"name">> := DataDir }) ->
     ok = filelib:ensure_dir(DataDir).
 
 %% @doc Stop the file system store. Currently a no-op.
-stop(#{ <<"prefix">> := _DataDir }) ->
+stop(#{ <<"name">> := _DataDir }) ->
     ok.
 
 %% @doc The file-based store is always local, for now. In the future, we may
 %% want to allow that an FS store is shared across a cluster and thus remote.
-scope(_) -> local.
+scope() -> local.
+scope(#{ <<"scope">> := Scope }) -> Scope;
+scope(_) -> scope().
 
 %% @doc Reset the store by completely removing its directory and recreating it.
-reset(#{ <<"prefix">> := DataDir }) ->
+reset(#{ <<"name">> := DataDir }) ->
     % Use pattern that completely removes directory then recreates it
     os:cmd(binary_to_list(<< "rm -Rf ", DataDir/binary >>)),
     ?event({reset_store, {path, DataDir}}).
@@ -55,7 +71,10 @@ write(Opts, PathComponents, Value) ->
 
 %% @doc List contents of a directory in the store.
 list(Opts, Path) ->
-    file:list_dir(add_prefix(Opts, Path)).
+    case file:list_dir(add_prefix(Opts, Path)) of
+        {ok, Files} -> {ok, lists:map(fun hb_util:bin/1, Files)};
+        {error, _} -> not_found
+    end.
 
 %% @doc Replace links in a path successively, returning the final path.
 %% Each element of the path is resolved in turn, with the result of each
@@ -68,7 +87,7 @@ list(Opts, Path) ->
 %%
 %% will resolve "a/b/c" to "Correct data".
 resolve(Opts, RawPath) ->
-    Res = resolve(Opts, "", hb_path:term_to_path_parts(hb_store:join(RawPath))),
+    Res = resolve(Opts, "", hb_path:term_to_path_parts(hb_store:join(RawPath), Opts)),
     ?event({resolved, RawPath, Res}),
     Res.
 resolve(_, CurrPath, []) ->
@@ -86,6 +105,8 @@ resolve(Opts, CurrPath, [Next|Rest]) ->
         {ok, RawLink} ->
             Link = remove_prefix(Opts, RawLink),
             resolve(Opts, Link, Rest);
+        {error, enoent} ->
+            not_found;
         _ ->
             resolve(Opts, PathPart, Rest)
     end.
@@ -108,7 +129,7 @@ type(Path) ->
     end.
 
 %% @doc Create a directory (group) in the store.
-make_group(Opts = #{ <<"prefix">> := _DataDir }, Path) ->
+make_group(Opts = #{ <<"name">> := _DataDir }, Path) ->
     P = add_prefix(Opts, Path),
     ?event({making_group, P}),
     % We need to ensure that the parent directory exists, so that we can
@@ -126,13 +147,23 @@ make_link(Opts, Existing, New) ->
 		add_prefix(Opts, Existing),
 		P2 = add_prefix(Opts, New)}),
     filelib:ensure_dir(P2),
-    file:make_symlink(
-        add_prefix(Opts, Existing),
-        add_prefix(Opts, New)
-    ).
+    case file:make_symlink(add_prefix(Opts, Existing), N = add_prefix(Opts, New)) of
+        ok -> ok;
+        {error, eexist} ->
+            file:delete(N),
+            R = file:make_symlink(add_prefix(Opts, Existing), N),
+            ?event(debug_fs,
+                {symlink_recreated,
+                    {existing, Existing},
+                    {new, New},
+                    {result, R}
+                }
+            ),
+            R
+    end.
 
 %% @doc Add the directory prefix to a path.
-add_prefix(#{ <<"prefix">> := Prefix }, Path) ->
+add_prefix(#{ <<"name">> := Prefix }, Path) ->
 	?event({add_prefix, Prefix, Path}),
     % Check if the prefix is an absolute path
     IsAbsolute = is_binary(Prefix) andalso binary:first(Prefix) =:= $/ orelse
@@ -159,5 +190,5 @@ add_prefix(#{ <<"prefix">> := Prefix }, Path) ->
     end.
 
 %% @doc Remove the directory prefix from a path.
-remove_prefix(#{ <<"prefix">> := Prefix }, Path) ->
+remove_prefix(#{ <<"name">> := Prefix }, Path) ->
     hb_util:remove_common(Path, Prefix).
\ No newline at end of file
diff --git a/src/hb_store_gateway.erl b/src/hb_store_gateway.erl
index 5495470c0..41ff2c3d5 100644
--- a/src/hb_store_gateway.erl
+++ b/src/hb_store_gateway.erl
@@ -10,23 +10,29 @@ scope(_) -> remote.
 resolve(_, Key) -> Key.
 
 list(StoreOpts, Key) ->
+    ?event(store_gateway, executing_list),
     case read(StoreOpts, Key) of
         not_found -> not_found;
-        {ok, Message} -> {ok, maps:keys(Message)}
+        {ok, Message} -> {ok, hb_maps:keys(Message, StoreOpts)}
     end.
 
 %% @doc Get the type of the data at the given key. We potentially cache the
 %% result, so that we don't have to read the data from the GraphQL route
 %% multiple times.
 type(StoreOpts, Key) ->
-    ?event({type, StoreOpts, Key}),
+    ?event(store_gateway, executing_type),
     case read(StoreOpts, Key) of
         not_found -> not_found;
         {ok, Data} ->
-            ?event({type, hb_private:reset(hb_message:uncommitted(Data))}),
+            ?event({type, hb_private:reset(hb_message:uncommitted(Data, StoreOpts))}),
             IsFlat = lists:all(
                 fun({_, Value}) -> not is_map(Value) end,
-                maps:to_list(hb_private:reset(hb_message:uncommitted(Data)))
+                hb_maps:to_list(
+                    hb_private:reset(
+                        hb_message:uncommitted(Data, StoreOpts)
+                    ),
+                    StoreOpts
+                )
             ),
             if
                 IsFlat -> simple;
@@ -36,45 +42,79 @@ type(StoreOpts, Key) ->
 
 %% @doc Read the data at the given key from the GraphQL route. Will only attempt
 %% to read the data if the key is an ID.
-read(StoreOpts, Key) ->
-    case hb_path:term_to_path_parts(Key) of
-        [ID] when ?IS_ID(ID) ->
-            ?event({read, StoreOpts, Key}),
-            case hb_gateway_client:read(Key, StoreOpts) of
-                {error, _} -> not_found;
+read(BaseStoreOpts, Key) ->
+    StoreOpts = opts(BaseStoreOpts),
+    case hb_path:term_to_path_parts(Key, StoreOpts) of
+        [ID|Rest] when ?IS_ID(ID) ->
+            ?event({gateway_read, {opts, StoreOpts}, {id, ID}, {subpath, Rest}}),
+            case hb_gateway_client:read(ID, StoreOpts) of
+                {error, _} ->
+                    ?event({read_not_found, {key, ID}}),
+                    not_found;
                 {ok, Message} ->
-                    ?event(remote_read, {got_message_from_gateway, Message}),
-                    maybe_cache(StoreOpts, Message),
-                    {ok, Message}
+                    ?event({read_found, {key, ID}}),
+                    try hb_store_remote_node:maybe_cache(StoreOpts, Message)
+                    catch _:_ -> ignored end,
+                    case Rest of
+                        [] -> {ok, Message};
+                        _ ->
+                            case hb_util:deep_get(Rest, Message, StoreOpts) of
+                                not_found -> not_found;
+                                Value -> {ok, Value}
+                            end
+                    end
             end;
         _ ->
             ?event({ignoring_non_id, Key}),
             not_found
     end.
 
-%% @doc Cache the data if the cache is enabled. The `store' option may either
-%% be `false' to disable local caching, or a store definition to use as the
-%% cache.
-maybe_cache(StoreOpts, Data) ->
-    ?event({maybe_cache, StoreOpts, Data}),
-    % Check for store in both the direct map and the legacy opts map
-    Store = case maps:get(<<"store">>, StoreOpts, not_found) of
-        not_found -> 
-            % Check in legacy opts format
-            NestedOpts = maps:get(<<"opts">>, StoreOpts, #{}),
-            hb_opts:get(store, false, NestedOpts);
-        FoundStore -> 
-            FoundStore
-    end,
-    case Store of
-        false -> do_nothing;
-        Store ->
-            ?event({writing_message_to_local_cache, Data}),
-            case hb_cache:write(Data, #{ store => Store}) of
-                {ok, _} -> Data;
-                {error, Err} ->
-                    ?event(warning, {error_writing_to_local_gateway_cache, Err}),
-                    Data
+%% @doc Normalize the routes in the given `Opts`.
+opts(Opts) ->
+    case hb_maps:find(<<"node">>, Opts) of
+        error -> Opts;
+        {ok, Node} ->
+            case hb_maps:get(<<"node-type">>, Opts, <<"arweave">>, Opts) of
+                <<"arweave">> ->
+                    Opts#{
+                        routes => [
+                            #{
+                                % Routes for GraphQL requests to use the remote
+                                % server's GraphQL API.
+                                <<"template">> => <<"/graphql">>,
+                                <<"nodes">> => [#{ <<"prefix">> => Node }]
+                            },
+                            #{
+                                <<"template">> => <<"/raw">>,
+                                <<"nodes">> => [#{ <<"prefix">> => Node }]
+                            }
+                        ]
+                    };
+                <<"ao">> ->
+                    Opts#{
+                        routes => [
+                            #{
+                                <<"template">> => <<"/graphql">>,
+                                <<"nodes">> =>
+                                    [
+                                        #{
+                                            <<"prefix">> =>
+                                                <<Node/binary, "/~query@1.0">>
+                                        }
+                                    ]
+                            },
+                            #{
+                                <<"template">> => <<"/raw">>,
+                                <<"nodes">> =>
+                                [
+                                    #{
+                                        <<"match">> => <<"^/raw">>,
+                                        <<"with">> => Node
+                                    }
+                                ]
+                            }
+                        ]
+                    }
             end
     end.
 
@@ -82,13 +122,14 @@ maybe_cache(StoreOpts, Data) ->
 
 %% @doc Store is accessible via the default options.
 graphql_as_store_test_() ->
+    hb_http_server:start_node(#{}),
 	{timeout, 10, fun() ->
 		hb_http_server:start_node(#{}),
 		?assertMatch(
-			{ok, #{ <<"type">> := <<"Assignment">> }},
+			{ok, #{ <<"app-name">> := <<"aos">> }},
 			hb_store:read(
-				[#{ <<"store-module">> => hb_store_gateway, <<"opts">> => #{} }],
-				<<"0Tb9mULcx8MjYVgXleWMVvqo1_jaw_P6AO_CJMTj0XE">>
+				[#{ <<"store-module">> => hb_store_gateway }],
+				<<"BOogk_XAI3bvNWnxNxwxmvOfglZt17o4MOVAdPNZ_ew">>
 			)
 		)
 	end}.
@@ -96,31 +137,45 @@ graphql_as_store_test_() ->
 %% @doc Stored messages are accessible via `hb_cache' accesses.
 graphql_from_cache_test() ->
     hb_http_server:start_node(#{}),
-    Opts = #{ store => [#{ <<"store-module">> => hb_store_gateway, <<"opts">> => #{} }] },
+    Opts =
+        #{
+            store =>
+                [
+                    #{
+                        <<"store-module">> => hb_store_gateway
+                    }
+                ]
+        },
     ?assertMatch(
-        {ok, #{ <<"type">> := <<"Assignment">> }},
+        {ok, #{ <<"app-name">> := <<"aos">> }},
         hb_cache:read(
-            <<"0Tb9mULcx8MjYVgXleWMVvqo1_jaw_P6AO_CJMTj0XE">>,
+            <<"BOogk_XAI3bvNWnxNxwxmvOfglZt17o4MOVAdPNZ_ew">>,
             Opts
         )
     ).
 
 manual_local_cache_test() ->
     hb_http_server:start_node(#{}),
-    Local = #{ <<"store-module">> => hb_store_fs, <<"prefix">> => <<"cache-TEST">> },
+    Local = #{
+        <<"store-module">> => hb_store_fs,
+        <<"name">> => <<"cache-TEST/gw-local-cache">>
+    },
     hb_store:reset(Local),
-    Gateway = #{ <<"store-module">> => hb_store_gateway, <<"store">> => false },
+    Gateway = #{
+        <<"store-module">> => hb_store_gateway,
+        <<"local-store">> => Local
+    },
     {ok, FromRemote} =
         hb_cache:read(
-            <<"0Tb9mULcx8MjYVgXleWMVvqo1_jaw_P6AO_CJMTj0XE">>,
-            #{ store => Gateway }
+            <<"BOogk_XAI3bvNWnxNxwxmvOfglZt17o4MOVAdPNZ_ew">>,
+            #{ store => [Gateway] }
         ),
     ?event({writing_recvd_to_local, FromRemote}),
-    {ok, _} = hb_cache:write(FromRemote, #{ store => Local }),
+    {ok, _} = hb_cache:write(FromRemote, #{ store => [Local] }),
     {ok, Read} =
         hb_cache:read(
-            <<"0Tb9mULcx8MjYVgXleWMVvqo1_jaw_P6AO_CJMTj0XE">>,
-            #{ store => Local }
+            <<"BOogk_XAI3bvNWnxNxwxmvOfglZt17o4MOVAdPNZ_ew">>,
+            #{ store => [Local] }
         ),
     ?event({read_from_local, Read}),
     ?assert(hb_message:match(Read, FromRemote)).
@@ -128,23 +183,27 @@ manual_local_cache_test() ->
 %% @doc Ensure that saving to the gateway store works.
 cache_read_message_test() ->
     hb_http_server:start_node(#{}),
-    Local = #{ <<"store-module">> => hb_store_fs, <<"prefix">> => <<"cache-TEST">> },
+    Local = #{
+        <<"store-module">> => hb_store_fs,
+        <<"name">> => <<"cache-TEST/1">>
+    },
     hb_store:reset(Local),
-    WriteOpts = #{ store =>
-        [
-            #{ <<"store-module">> => hb_store_gateway,
-                <<"store">> => [Local]
-            }
-        ]
+    WriteOpts = #{
+        store =>
+            [
+                #{ <<"store-module">> => hb_store_gateway,
+                    <<"local-store">> => [Local]
+                }
+            ]
     },
     {ok, Written} =
         hb_cache:read(
-            <<"0Tb9mULcx8MjYVgXleWMVvqo1_jaw_P6AO_CJMTj0XE">>,
+            <<"BOogk_XAI3bvNWnxNxwxmvOfglZt17o4MOVAdPNZ_ew">>,
             WriteOpts
         ),
     {ok, Read} =
         hb_cache:read(
-            <<"0Tb9mULcx8MjYVgXleWMVvqo1_jaw_P6AO_CJMTj0XE">>,
+            <<"BOogk_XAI3bvNWnxNxwxmvOfglZt17o4MOVAdPNZ_ew">>,
             #{ store => [Local] }
         ),
     ?assert(hb_message:match(Read, Written)).
@@ -168,7 +227,7 @@ specific_route_test() ->
     ?assertMatch(
         not_found,
         hb_cache:read(
-            <<"0Tb9mULcx8MjYVgXleWMVvqo1_jaw_P6AO_CJMTj0XE">>,
+            <<"BOogk_XAI3bvNWnxNxwxmvOfglZt17o4MOVAdPNZ_ew">>,
             Opts
         )
     ).
@@ -180,8 +239,11 @@ external_http_access_test() ->
             cache_control => <<"cache">>,
             store =>
                 [
-                    #{ <<"store-module">> => hb_store_fs, <<"prefix">> => <<"cache-TEST">> },
-                    #{ <<"store-module">> => hb_store_gateway, <<"store">> => false }
+                    #{
+                        <<"store-module">> => hb_store_fs,
+                        <<"name">> => <<"cache-TEST">>
+                    },
+                    #{ <<"store-module">> => hb_store_gateway }
                 ]
         }
     ),
@@ -195,46 +257,46 @@ external_http_access_test() ->
     ).
 
 %% Ensure that we can get data from the gateway and execute upon it.
-resolve_on_gateway_test_() ->
-    {timeout, 10, fun() ->
-        TestProc = <<"p45HPD-ENkLS7Ykqrx6p_DYGbmeHDeeF8LJ09N2K53g">>,
-        EmptyStore = #{
-            <<"store-module">> => hb_store_fs,
-            <<"prefix">> => <<"cache-TEST">>
-        },
-        hb_store:reset(EmptyStore),
-        hb_http_server:start_node(#{}),
-        Opts = #{
-            store =>
-                [
-                    #{
-                        <<"store-module">> => hb_store_gateway,
-                        <<"store">> => false
-                    },
-                    EmptyStore
-                ],
-            cache_control => <<"cache">>
-        },
-        ?assertMatch(
-            {ok, #{ <<"type">> := <<"Process">> }},
-            hb_cache:read(TestProc, Opts)
-        ),
-        % TestProc is an AO Legacynet process: No device tag, so we start by resolving
-        % only an explicit key.
-        ?assertMatch(
-            {ok, <<"Process">>},
-            hb_ao:resolve(TestProc, <<"type">>, Opts)
-        ),
-        % Next, we resolve the schedule key on the message, as a `process@1.0'
-        % message.
-        {ok, X} =
-            hb_ao:resolve(
-                {as, <<"process@1.0">>, TestProc},
-                <<"schedule">>,
-                Opts
-            ),
-        ?assertMatch(#{ <<"assignments">> := _ }, X)
-    end}.
+% resolve_on_gateway_test_() ->
+%     {timeout, 10, fun() ->
+%         TestProc = <<"p45HPD-ENkLS7Ykqrx6p_DYGbmeHDeeF8LJ09N2K53g">>,
+%         EmptyStore = #{
+%             <<"store-module">> => hb_store_fs,
+%             <<"name">> => <<"cache-TEST">>
+%         },
+%         hb_store:reset(EmptyStore),
+%         hb_http_server:start_node(#{}),
+%         Opts = #{
+%             store =>
+%                 [
+%                     #{
+%                         <<"store-module">> => hb_store_gateway,
+%                         <<"store">> => false
+%                     },
+%                     EmptyStore
+%                 ],
+%             cache_control => <<"cache">>
+%         },
+%         ?assertMatch(
+%             {ok, #{ <<"type">> := <<"Process">> }},
+%             hb_cache:read(TestProc, Opts)
+%         ),
+%         % TestProc is an AO Legacynet process: No device tag, so we start by resolving
+%         % only an explicit key.
+%         ?assertMatch(
+%             {ok, <<"Process">>},
+%             hb_ao:resolve(TestProc, <<"type">>, Opts)
+%         ),
+%         % Next, we resolve the schedule key on the message, as a `process@1.0'
+%         % message.
+%         {ok, X} =
+%             hb_ao:resolve(
+%                 {as, <<"process@1.0">>, TestProc},
+%                 <<"schedule">>,
+%                 Opts
+%             ),
+%         ?assertMatch(#{ <<"assignments">> := _ }, X)
+%     end}.
 
 %% @doc Test to verify store opts is being set for Data-Protocol ao
 store_opts_test() ->
@@ -244,11 +306,12 @@ store_opts_test() ->
             [
                 #{
                     <<"store-module">> => hb_store_fs,
-                    <<"prefix">> => <<"cache-TEST">>
+                    <<"name">> => <<"cache-TEST">>
                 },
-                #{ <<"store-module">> => hb_store_gateway, 
-                        <<"store">> => false,
-                        <<"subindex">> => [
+                #{
+                    <<"store-module">> => hb_store_gateway, 
+                    <<"local-store">> => false,
+                    <<"subindex">> => [
                         #{
                             <<"name">> => <<"Data-Protocol">>,
                             <<"value">> => <<"ao">>
@@ -265,4 +328,76 @@ store_opts_test() ->
             #{}
         ),
     ?event(debug_gateway, {res, Res}),
-    ?assertEqual(<<"Hello World">>,hb_ao:get(<<"data">>, Res)).
\ No newline at end of file
+    ?assertEqual(<<"Hello World">>, hb_ao:get(<<"data">>, Res)).
+
+%% @doc Test that items retreived from the gateway store are verifiable.
+verifiability_test() ->
+    hb_http_server:start_node(#{}),
+    {ok, Message} =
+        hb_cache:read(
+            <<"BOogk_XAI3bvNWnxNxwxmvOfglZt17o4MOVAdPNZ_ew">>,
+            #{
+                store =>
+                    [
+                        #{
+                            <<"store-module">> => hb_store_gateway
+                        }
+                    ]
+            }
+        ),
+    % Ensure that the message is verifiable after being converted to 
+    % httpsig@1.0 and back to structured@1.0.
+    HTTPSig =
+        hb_message:convert(
+            Message,
+            <<"httpsig@1.0">>,
+            <<"structured@1.0">>,
+            #{}
+        ),
+    ?assert(hb_message:verify(HTTPSig)),
+    Structured =
+        hb_message:convert(
+            HTTPSig,
+            <<"structured@1.0">>,
+            <<"httpsig@1.0">>,
+            #{}
+        ),
+    ?event({verifying, {structured, Structured}, {original, Message}}),
+    ?assert(hb_message:verify(Structured)).
+
+%% @doc Test that another HyperBEAM node offering the `~query@1.0' device can
+%% be used as a store.
+remote_hyperbeam_node_ans104_test() ->
+    ServerOpts =
+        #{
+            priv_wallet => ar_wallet:new(),
+            store => hb_test_utils:test_store()
+        },
+    Server = hb_http_server:start_node(ServerOpts),
+    Msg =
+        hb_message:commit(
+            #{
+                <<"hello">> => <<"world">>
+            },
+            ServerOpts,
+            #{ <<"commitment-device">> => <<"ans104@1.0">> }
+        ),
+    {ok, ID} = hb_cache:write(Msg, ServerOpts),
+    {ok, ReadMsg} = hb_cache:read(ID, ServerOpts),
+    ?assert(hb_message:verify(ReadMsg)),
+    LocalStore = hb_test_utils:test_store(),
+    ClientOpts =
+        #{
+            store =>
+                [
+                    #{
+                        <<"store-module">> => hb_store_gateway,
+                        <<"node">> => Server,
+                        <<"node-type">> => <<"ao">>,
+                        <<"local-store">> => [LocalStore]
+                    }
+                ]
+        },
+    {ok, Msg2} = hb_cache:read(ID, ClientOpts),
+    ?assert(hb_message:verify(Msg2)),
+    ?assert(hb_message:match(Msg, Msg2)).
\ No newline at end of file
diff --git a/src/hb_store_lmdb.erl b/src/hb_store_lmdb.erl
new file mode 100644
index 000000000..dd3101bed
--- /dev/null
+++ b/src/hb_store_lmdb.erl
@@ -0,0 +1,1086 @@
+%% @doc An LMDB (Lightning Memory Database) implementation of the HyperBeam store interface.
+%%
+%% This module provides a persistent key-value store backend using LMDB, which is a
+%% high-performance embedded transactional database. The implementation follows a
+%% singleton pattern where each database environment gets its own dedicated server
+%% process to manage transactions and coordinate writes.
+%%
+%% Key features include:
+%% <ul>
+%%   <li>Asynchronous writes with batched transactions for performance</li>
+%%   <li>Automatic link resolution for creating symbolic references between keys</li>
+%%   <li>Group support for organizing hierarchical data structures</li>
+%%   <li>Prefix-based key listing for directory-like navigation</li>
+%%   <li>Process-local caching of database handles for efficiency</li>
+%% </ul>
+%%
+%% The module implements a dual-flush strategy: writes are accumulated in memory
+%% and flushed either after an idle timeout or when explicitly requested during
+%% read operations that encounter cache misses.
+-module(hb_store_lmdb).
+
+%% Public API exports
+-export([start/1, stop/1, scope/0, scope/1, reset/1]).
+-export([read/2, write/3, list/2, match/2]).
+-export([make_group/2, make_link/3, type/2]).
+-export([path/2, add_path/3, resolve/2]).
+
+%% Test framework and project includes
+-include_lib("eunit/include/eunit.hrl").
+-include("include/hb.hrl").
+
+%% Configuration constants with reasonable defaults
+-define(DEFAULT_SIZE, 16 * 1024 * 1024 * 1024). % 16GB default database size
+-define(CONNECT_TIMEOUT, 6000).                 % Timeout for server communication
+-define(DEFAULT_IDLE_FLUSH_TIME, 5).            % Idle server time before auto-flush
+-define(DEFAULT_MAX_FLUSH_TIME, 50).            % Maximum time between flushes
+-define(MAX_REDIRECTS, 1000).                   % Only resolve 1000 links to data
+-define(MAX_PENDING_WRITES, 400).               % Force flush after x pending
+-define(FOLD_YIELD_INTERVAL, 100).              % Yield every x keys
+
+%% @doc Start the LMDB storage system for a given database configuration.
+%%
+%% This function initializes or connects to an existing LMDB database instance.
+%% It uses a singleton pattern, so multiple calls with the same configuration
+%% will return the same server process. The server process manages the LMDB
+%% environment and coordinates all database operations.
+%%
+%% The StoreOpts map must contain a "prefix" key specifying the
+%% database directory path. Also the required configuration includes "capacity"
+%% for the maximum database size and flush timing parameters.
+%%
+%% @param StoreOpts A map containing database configuration options
+%% @returns {ok, ServerPid} on success, {error, Reason} on failure
+start(Opts = #{ <<"name">> := DataDir }) ->
+    % Ensure the directory exists before opening LMDB environment
+    DataDirPath = hb_util:list(DataDir),
+    ok = filelib:ensure_dir(filename:join(DataDirPath, "dummy")),
+    % Create the LMDB environment with specified size limit
+    {ok, Env} =
+        elmdb:env_open(
+            DataDirPath,
+            [
+                {map_size, maps:get(<<"capacity">>, Opts, ?DEFAULT_SIZE)},
+                no_mem_init, no_sync
+            ]
+        ),
+    {ok, DBInstance} = elmdb:db_open(Env, [create]),
+    % Store both environment and DB instance in persistent_term for later cleanup
+    StoreKey = {lmdb, ?MODULE, DataDir},
+    persistent_term:put(StoreKey, {Env, DBInstance, DataDir}),
+    {ok, #{ <<"env">> => Env, <<"db">> => DBInstance }};
+start(_) ->
+    {error, {badarg, <<"StoreOpts must be a map">>}}.
+
+%% @doc Determine whether a key represents a simple value or composite group.
+%%
+%% This function reads the value associated with a key and examines its content
+%% to classify the entry type. Keys storing the literal binary "group" are
+%% considered composite (directory-like) entries, while all other values are
+%% treated as simple key-value pairs.
+%%
+%% This classification is used by higher-level HyperBeam components to understand
+%% the structure of stored data and provide appropriate navigation interfaces.
+%%
+%% @param Opts Database configuration map
+%% @param Key The key to examine
+%% @returns 'composite' for group entries, 'simple' for regular values
+-spec type(map(), binary()) -> composite | simple | not_found.
+type(Opts, Key) ->
+    case read_direct(Opts, Key) of
+        {ok, Value} ->
+            case is_link(Value) of
+                {true, Link} ->
+                    % This is a link, check the target's type
+                    type(Opts, Link);
+                false ->
+                    case Value of
+                        <<"group">> -> 
+                            composite;
+                        _ -> 
+                            simple
+                    end
+            end;
+        not_found -> not_found
+    end.
+
+%% @doc Write a key-value pair to the database asynchronously.
+%%
+%% This function sends a write request to the database server process and returns
+%% immediately without waiting for the write to be committed to disk. The server
+%% accumulates writes in a transaction that is periodically flushed based on
+%% timing constraints or explicit flush requests.
+%%
+%% The asynchronous nature provides better performance for write-heavy workloads
+%% while the batching strategy ensures data consistency and reduces I/O overhead.
+%% However, recent writes may not be immediately visible to readers until the
+%% next flush occurs.
+%%
+%% @param Opts Database configuration map
+%% @param Path Binary path to write
+%% @param Value Binary value to store
+%% @returns 'ok' immediately (write happens asynchronously)
+-spec write(map(), binary() | list(), binary()) -> ok.
+write(Opts, PathParts, Value) when is_list(PathParts) ->
+    % Convert to binary
+    PathBin = to_path(PathParts),
+    write(Opts, PathBin, Value);
+write(Opts, Path, Value) ->
+    #{ <<"db">> := DBInstance } = find_env(Opts),
+    ?event({elmdb_write, {db, DBInstance}, {path, Path}, {value, Value}}),
+    case elmdb:put(DBInstance, Path, Value) of
+        ok -> ok;
+        {error, Type, Description} ->
+            ?event(
+                error,
+                {lmdb_error,
+                    {type, Type},
+                    {description, Description}
+                }
+            ),
+            retry
+    end.
+
+%% @doc Read a value from the database by key, with automatic link resolution.
+%%
+%% This function attempts to read a value directly from the committed database.
+%% If the key is not found, it triggers a flush operation to ensure any pending
+%% writes are committed before retrying the read.
+%%
+%% The function automatically handles link resolution: if a stored value begins
+%% with the "link:" prefix, it extracts the target key and recursively reads
+%% from that location instead. This creates a symbolic link mechanism that
+%% allows multiple keys to reference the same underlying data.
+%%
+%% When given a list of path segments, the function first attempts a direct read
+%% for optimal performance. Only if the direct read fails does it perform link
+%% resolution at each level of the path except the final segment, allowing path
+%% traversal through symbolic links to work transparently.
+%%
+%% Link resolution is transparent to the caller and can chain through multiple
+%% levels of indirection, though care should be taken to avoid circular references.
+%%
+%% @param Opts Database configuration map  
+%% @param Path Binary key or list of path segments to read
+%% @returns {ok, Value} on success, {error, Reason} on failure
+-spec read(map(), binary() | list()) -> {ok, binary()} | {error, term()}.
+read(Opts, PathParts) when is_list(PathParts) ->
+    read(Opts, to_path(PathParts));
+read(Opts, Path) ->
+    % Try direct read first (fast path for non-link paths)
+    case read_with_links(Opts, Path) of
+        {ok, Value} -> 
+            {ok, Value};
+        not_found ->
+            try
+                PathParts = binary:split(Path, <<"/">>, [global]),
+                case resolve_path_links(Opts, PathParts) of
+                    {ok, ResolvedPathParts} ->
+                        ResolvedPathBin = to_path(ResolvedPathParts),
+                        read_with_links(Opts, ResolvedPathBin);
+                    {error, _} ->
+                        not_found
+                end
+            catch
+                Class:Reason:Stacktrace ->
+                    ?event(error,
+                        {
+                            resolve_path_links_failed, 
+                            {class, Class},
+                            {reason, Reason},
+                            {stacktrace, Stacktrace},
+                            {path, Path}
+                        }
+                    ),
+                    % If link resolution fails, return not_found
+                    not_found
+            end
+    end.
+
+%% @doc Helper function to check if a value is a link and extract the target.
+is_link(Value) ->
+    LinkPrefixSize = byte_size(<<"link:">>),
+    case byte_size(Value) > LinkPrefixSize andalso
+        binary:part(Value, 0, LinkPrefixSize) =:= <<"link:">> of
+        true -> 
+            Link =
+                binary:part(
+                    Value,
+                    LinkPrefixSize,
+                    byte_size(Value) - LinkPrefixSize
+                ),
+            {true, Link};
+        false ->
+            false
+    end.
+
+%% @doc Helper function to convert to a path
+to_path(PathParts) ->
+    hb_util:bin(lists:join(<<"/">>, PathParts)).
+
+%% @doc Unified read function that handles LMDB reads with fallback to the 
+%% in-process pending writes, if necessary.
+%% 
+%% Returns {ok, Value} or not_found.
+read_direct(Opts, Path) ->
+    #{ <<"db">> := DBInstance } = find_env(Opts),
+    case elmdb:get(DBInstance, Path) of
+        {ok, Value} -> {ok, Value};
+        {error, not_found} -> not_found;  % Normalize error format
+        not_found -> not_found  % Handle both old and new format
+    end.
+
+%% @doc Read a value directly from the database with link resolution.
+%% This is the internal implementation that handles actual database reads.
+read_with_links(Opts, Path) ->
+    case read_direct(Opts, Path) of
+        {ok, Value} ->
+            % Check if this value is actually a link to another key
+            case is_link(Value) of
+                {true, Link} -> 
+                   % Extract the target key and recursively resolve the link
+                   read_with_links(Opts, Link);
+                false ->
+                    % Check if this is a group marker - groups should not be
+                    % readable as simple values
+                    case Value of
+                        <<"group">> -> not_found;
+                        _ -> {ok, Value}
+                    end
+            end;
+        not_found ->
+            not_found
+    end.
+
+%% @doc Resolve links in a path, checking each segment except the last.
+%% Returns the resolved path where any intermediate links have been followed.
+resolve_path_links(Opts, Path) ->
+    resolve_path_links(Opts, Path, 0).
+
+%% Internal helper with depth limit to prevent infinite loops
+resolve_path_links(_Opts, _Path, Depth) when Depth > ?MAX_REDIRECTS ->
+    % Prevent infinite loops with depth limit
+    {error, too_many_redirects};
+resolve_path_links(_Opts, [LastSegment], _Depth) ->
+    % Base case: only one segment left, no link resolution needed
+    {ok, [LastSegment]};
+resolve_path_links(Opts, Path, Depth) ->
+    resolve_path_links_acc(Opts, Path, [], Depth).
+
+%% Internal helper that accumulates the resolved path
+resolve_path_links_acc(_Opts, [], AccPath, _Depth) ->
+    % No more segments to process
+    {ok, lists:reverse(AccPath)};
+resolve_path_links_acc(_, FullPath = [<<"data">>|_], [], _Depth) ->
+    {ok, FullPath};
+resolve_path_links_acc(Opts, [Head | Tail], AccPath, Depth) ->
+    % Build the accumulated path so far
+    CurrentPath = lists:reverse([Head | AccPath]),
+    CurrentPathBin = to_path(CurrentPath),
+    % Check if the accumulated path (not just the segment) is a link
+    case read_direct(Opts, CurrentPathBin) of
+        {ok, Value} ->
+            case is_link(Value) of
+                {true, Link} ->
+                    % The accumulated path is a link! Resolve it
+                    LinkSegments = binary:split(Link, <<"/">>, [global]),
+                    % Replace the accumulated path with the link target and
+                    % continue with remaining segments
+                    NewPath = LinkSegments ++ Tail,
+                    resolve_path_links(Opts, NewPath, Depth + 1);
+                false ->
+                    % Not a link, continue accumulating
+                    resolve_path_links_acc(Opts, Tail, [Head | AccPath], Depth)
+            end;
+        not_found ->
+            % Path doesn't exist as a complete link, continue accumulating
+            resolve_path_links_acc(Opts, Tail, [Head | AccPath], Depth)
+    end.
+
+%% @doc Return the scope of this storage backend.
+%%
+%% The LMDB implementation is always local-only and does not support distributed
+%% operations. This function exists to satisfy the HyperBeam store interface
+%% contract and inform the system about the storage backend's capabilities.
+%%
+%% @returns 'local' always
+-spec scope() -> local.
+scope() -> local.
+
+%% @doc Return the scope of this storage backend (ignores parameters).
+%%
+%% This is an alternate form of scope/0 that ignores any parameters passed to it.
+%% The LMDB backend is always local regardless of configuration.
+%%
+%% @param _Opts Ignored parameter
+%% @returns 'local' always  
+-spec scope(term()) -> local.
+scope(_) -> scope().
+
+%% @doc List all keys that start with a given prefix.
+%%
+%% This function provides directory-like navigation by finding all keys that
+%% begin with the specified path prefix. It uses the native elmdb:list/2 function
+%% to efficiently scan through the database and collect matching keys.
+%%
+%% The implementation returns only the immediate children of the given path,
+%% not the full paths. For example, listing "colors/" will return ["red", "blue"]
+%% not ["colors/red", "colors/blue"].
+%%
+%% If the Path points to a link, the function resolves the link and lists
+%% the contents of the target directory instead.
+%%
+%% This is particularly useful for implementing hierarchical data organization
+%% and providing tree-like navigation interfaces in applications.
+%%
+%% @param StoreOpts Database configuration map
+%% @param Path Binary prefix to search for
+%% @returns {ok, [Key]} list of matching keys, {error, Reason} on failure
+-spec list(map(), binary()) -> {ok, [binary()]} | {error, term()}.
+list(Opts, Path) ->
+    % Check if Path is a link and resolve it if necessary
+    ResolvedPath =
+        case read_direct(Opts, Path) of
+            {ok, Value} ->
+                case is_link(Value) of
+                    {true, Link} ->
+                        Link;
+                    false ->
+                        % Not a link; use original path
+                        Path
+                end;
+            not_found ->
+                Path
+        end,
+    % Ensure path ends with / for elmdb:list API
+    SearchPath = 
+        case ResolvedPath of
+            <<>> -> <<>>;      % Root path
+            <<"/">> -> <<>>;   % Root path variant
+            _ -> 
+                case binary:last(ResolvedPath) of
+                    $/ -> ResolvedPath;
+                    _ -> <<ResolvedPath/binary, "/">>
+                end
+        end,
+    % Use native elmdb:list function
+    #{ <<"db">> := DBInstance } = find_env(Opts),
+    case elmdb:list(DBInstance, SearchPath) of
+        {ok, Children} -> {ok, Children};
+        {error, not_found} -> {ok, []};  % Normalize new error format
+        not_found -> {ok, []}  % Handle both old and new format
+    end.
+
+%% @doc Match a series of keys and values against the database. Returns 
+%% `{ok, Matches}' if the match is successful, or `not_found' if there are no
+%% messages in the store that feature all of the given key-value pairs. `Matches'
+%% is given as a list of IDs.
+match(Opts, MatchMap) when is_map(MatchMap) ->
+    match(Opts, maps:to_list(MatchMap));
+match(Opts, MatchKVs) ->
+    #{ <<"db">> := DBInstance } = find_env(Opts),
+    WithPrefixes =
+        lists:map(
+            fun({Key, Path}) ->
+                {Key, <<"link:", Path/binary>>}
+            end,
+            MatchKVs
+        ),
+    ?event({elmdb_match, MatchKVs}),
+    case elmdb:match(DBInstance, WithPrefixes) of
+        {ok, Matches} ->
+            ?event({elmdb_matched, Matches}),
+            {ok, Matches};
+        {error, not_found} -> not_found;
+        not_found -> not_found
+    end.
+
+
+%% @doc Create a group entry that can contain other keys hierarchically.
+%%
+%% Groups in the HyperBeam system represent composite entries that can contain
+%% child elements, similar to directories in a filesystem. This function creates
+%% a group by storing the special value "group" at the specified key.
+%%
+%% The group mechanism allows applications to organize data hierarchically and
+%% provides semantic meaning that can be used by navigation and visualization
+%% tools to present appropriate user interfaces.
+%%
+%% Groups can be identified later using the type/2 function, which will return
+%% 'composite' for group entries versus 'simple' for regular key-value pairs.
+%%
+%% @param Opts Database configuration map
+%% @param GroupName Binary name for the group
+%% @returns Result of the write operation
+-spec make_group(map(), binary()) -> ok | {error, term()}.
+make_group(Opts, GroupName) when is_map(Opts), is_binary(GroupName) ->
+    write(Opts, GroupName, <<"group">>);
+make_group(_,_) ->
+    {error, {badarg, <<"StoreOps must be map and GroupName must be a binary">>}}.
+
+%% @doc Ensure all parent groups exist for a given path.
+%%
+%% This function creates the necessary parent groups for a path, similar to
+%% how filesystem stores use ensure_dir. For example, if the path is
+%% "a/b/c/file", it will ensure groups "a", "a/b", and "a/b/c" exist.
+%%
+%% @param Opts Database configuration map
+%% @param Path The path whose parents should exist
+%% @returns ok
+-spec ensure_parent_groups(map(), binary()) -> ok.
+ensure_parent_groups(Opts, Path) ->
+    PathParts = binary:split(Path, <<"/">>, [global]),
+    case PathParts of
+        [_] -> 
+            % Single segment, no parents to create
+            ok;
+        _ ->
+            % Multiple segments, create parent groups
+            ParentParts = lists:droplast(PathParts),
+            create_parent_groups(Opts, [], ParentParts)
+    end.
+
+%% @doc Helper function to recursively create parent groups.
+create_parent_groups(_Opts, _Current, []) ->
+    ok;
+create_parent_groups(Opts, Current, [Next | Rest]) ->
+    NewCurrent = Current ++ [Next],
+    GroupPath = to_path(NewCurrent),
+    % Only create group if it doesn't already exist.
+    case read_direct(Opts, GroupPath) of
+        not_found ->
+            make_group(Opts, GroupPath);
+        {ok, _} ->
+            % Already exists, skip
+            ok
+    end,
+    create_parent_groups(Opts, NewCurrent, Rest).
+
+%% @doc Create a symbolic link from a new key to an existing key.
+%%
+%% This function implements a symbolic link mechanism by storing a special
+%% "link:" prefixed value at the new key location. When the new key is read,
+%% the system will automatically resolve the link and return the value from
+%% the target key instead.
+%%
+%% Links provide a way to create aliases, shortcuts, or alternative access
+%% paths to the same underlying data without duplicating storage. They can
+%% be chained together to create complex reference structures, though care
+%% should be taken to avoid circular references.
+%%
+%% The link resolution happens transparently during read operations, making
+%% links invisible to most application code while providing powerful
+%% organizational capabilities.
+%%
+%% @param StoreOpts Database configuration map
+%% @param Existing The key that already exists and contains the target value
+%% @param New The new key that should link to the existing key
+%% @returns Result of the write operation
+-spec make_link(map(), binary() | list(), binary()) -> ok.
+make_link(Opts, Existing, New) when is_list(Existing) ->
+    ExistingBin = to_path(Existing),
+    make_link(Opts, ExistingBin, New);
+make_link(Opts, Existing, New) ->
+   ExistingBin = hb_util:bin(Existing),
+   % Ensure parent groups exist for the new link path (like filesystem ensure_dir)
+   ensure_parent_groups(Opts, New),
+   write(Opts, New, <<"link:", ExistingBin/binary>>). 
+
+%% @doc Transform a path into the store's canonical form.
+%% For LMDB, paths are simply joined with "/" separators.
+path(_Opts, PathParts) when is_list(PathParts) ->
+    to_path(PathParts);
+path(_Opts, Path) when is_binary(Path) ->
+    Path.
+
+%% @doc Add two path components together.
+%% For LMDB, this concatenates the path lists.
+add_path(_Opts, Path1, Path2) when is_list(Path1), is_list(Path2) ->
+    Path1 ++ Path2;
+add_path(Opts, Path1, Path2) when is_binary(Path1), is_binary(Path2) ->
+    % Convert binaries to lists, concatenate, then convert back
+    Parts1 = binary:split(Path1, <<"/">>, [global]),
+    Parts2 = binary:split(Path2, <<"/">>, [global]),
+    path(Opts, Parts1 ++ Parts2);
+add_path(Opts, Path1, Path2) when is_list(Path1), is_binary(Path2) ->
+    Parts2 = binary:split(Path2, <<"/">>, [global]),
+    path(Opts, Path1 ++ Parts2);
+add_path(Opts, Path1, Path2) when is_binary(Path1), is_list(Path2) ->
+    Parts1 = binary:split(Path1, <<"/">>, [global]),
+    path(Opts, Parts1 ++ Path2).
+
+%% @doc Resolve a path by following any symbolic links.
+%%
+%% For LMDB, we handle links through our own "link:" prefix mechanism.
+%% This function resolves link chains in paths, similar to filesystem symlink resolution.
+%% It's used by the cache to resolve paths before type checking and reading.
+%%
+%% @param StoreOpts Database configuration map
+%% @param Path The path to resolve (binary or list)
+%% @returns The resolved path as a binary
+-spec resolve(map(), binary() | list()) -> binary().
+resolve(Opts, Path) when is_binary(Path) ->
+    resolve(Opts, binary:split(Path, <<"/">>, [global]));
+resolve(Opts, PathParts) when is_list(PathParts) ->
+    % Handle list paths by resolving directly and converting to binary
+    case resolve_path_links(Opts, PathParts) of
+        {ok, ResolvedParts} ->
+            to_path(ResolvedParts);
+        {error, _} ->
+            % If resolution fails, return original path as binary
+            to_path(PathParts)
+    end;
+resolve(_,_) -> not_found.
+
+%% @doc Retrieve or create the LMDB environment handle for a database.
+find_env(Opts) -> hb_store:find(Opts).
+
+%% Shutdown LMDB environment and cleanup resources
+stop(#{ <<"store-module">> := ?MODULE, <<"name">> := DataDir }) ->
+    StoreKey = {lmdb, ?MODULE, DataDir},
+    close_environment(StoreKey, DataDir);
+stop(_InvalidStoreOpts) ->
+    ok.
+
+%% Close environment using persistent_term lookup with fallback
+close_environment(StoreKey, DataDir) ->
+    case safe_get_persistent_term(StoreKey) of
+        {ok, {Env, DBInstance}} ->
+            close_and_cleanup(Env, DBInstance, StoreKey, DataDir);
+        not_found ->
+            ?event({lmdb_stop_not_found_in_persistent_term, DataDir}),
+            safe_close_by_name(DataDir)
+    end,
+    ok.
+
+%% Get environment and DB instance from persistent_term without exceptions
+safe_get_persistent_term(Key) ->
+    case persistent_term:get(Key, undefined) of
+        {Env, DBInstance, _DataDir} -> {ok, {Env, DBInstance}};
+        {Env, _DataDir} -> {ok, {Env, undefined}};  % Backwards compatibility
+        _ -> not_found
+    end.
+
+%% Close DB instance and environment, then cleanup persistent_term entry
+close_and_cleanup(Env, DBInstance, StoreKey, DataDir) ->
+    % Close DB instance first if it exists
+    DBCloseResult = safe_close_db(DBInstance),
+    ?event({db_close_result, DBCloseResult}),
+    % Then close the environment
+    EnvCloseResult = safe_close_env(Env),
+    persistent_term:erase(StoreKey),
+    case EnvCloseResult of
+        ok -> ?event({lmdb_stop_success, DataDir});
+        {error, Reason} -> ?event({lmdb_stop_error, Reason})
+    end.
+
+%% Close DB instance with error capture
+safe_close_db(undefined) ->
+    ok;  % No DB instance to close
+safe_close_db(DBInstance) ->
+    try
+        elmdb:db_close(DBInstance)
+    catch
+        error:Reason -> {error, Reason}
+    end.
+
+%% Close environment handle with error capture
+safe_close_env(Env) ->
+    try
+        elmdb:env_close(Env)
+    catch
+        error:Reason -> {error, Reason}
+    end.
+
+%% Fallback close by name with error suppression
+safe_close_by_name(DataDir) ->
+    try
+        elmdb:env_close_by_name(binary_to_list(DataDir))
+    catch
+        error:_ -> ok
+    end.
+
+%% @doc Completely delete the database directory and all its contents.
+%%
+%% This is a destructive operation that removes all data from the specified
+%% database. It first performs a graceful shutdown to ensure data consistency,
+%% then uses the system shell to recursively delete the entire database
+%% directory structure.
+%%
+%% This function is primarily intended for testing and development scenarios
+%% where you need to start with a completely clean database state. It should
+%% be used with extreme caution in production environments.
+%%
+%% @param StoreOpts Database configuration map containing the directory prefix
+%% @returns 'ok' when deletion is complete
+reset(Opts) ->
+    case maps:get(<<"name">>, Opts, undefined) of
+        undefined ->
+            % No prefix specified, nothing to reset
+            ok;
+        DataDir ->
+            % Stop the store and remove the database.
+            % stop(Opts),
+            os:cmd(binary_to_list(<< "rm -Rf ", DataDir/binary >>)),
+            ok
+    end.
+
+%% @doc Test suite demonstrating basic store operations.
+%%
+%% The following functions implement unit tests using EUnit to verify that
+%% the LMDB store implementation correctly handles various scenarios including
+%% basic read/write operations, hierarchical listing, group creation, link
+%% resolution, and type detection.
+
+%% @doc Basic store test - verifies fundamental read/write functionality.
+%%
+%% This test creates a temporary database, writes a key-value pair, reads it
+%% back to verify correctness, and cleans up by stopping the database. It
+%% serves as a sanity check that the basic storage mechanism is working.
+basic_test() ->
+    StoreOpts = #{
+        <<"store-module">> => ?MODULE,
+        <<"name">> => <<"/tmp/store-1">>
+    },
+    reset(StoreOpts),
+    Res = write(StoreOpts, <<"Hello">>, <<"World2">>),
+    ?assertEqual(ok, Res),
+    {ok, Value} = read(StoreOpts, <<"Hello">>),
+    ?assertEqual(Value, <<"World2">>),
+    ok = stop(StoreOpts).
+
+%% @doc List test - verifies prefix-based key listing functionality.
+%%
+%% This test creates several keys with hierarchical names and verifies that
+%% the list operation correctly returns only keys matching a specific prefix.
+%% It demonstrates the directory-like navigation capabilities of the store.
+list_test() ->
+    StoreOpts = #{
+        <<"store-module">> => ?MODULE,
+        <<"name">> => <<"/tmp/store-2">>,
+        <<"capacity">> => ?DEFAULT_SIZE
+    },
+    reset(StoreOpts),
+    ?assertEqual(list(StoreOpts, <<"colors">>), {ok, []}),
+    % Create immediate children under colors/
+    write(StoreOpts, <<"colors/red">>, <<"1">>),
+    write(StoreOpts, <<"colors/blue">>, <<"2">>),
+    write(StoreOpts, <<"colors/green">>, <<"3">>),
+    % Create nested directories under colors/ - these should show up as immediate children
+    write(StoreOpts, <<"colors/multi/foo">>, <<"4">>),
+    write(StoreOpts, <<"colors/multi/bar">>, <<"5">>),
+    write(StoreOpts, <<"colors/primary/red">>, <<"6">>),
+    write(StoreOpts, <<"colors/primary/blue">>, <<"7">>),
+    write(StoreOpts, <<"colors/nested/deep/value">>, <<"8">>),
+    % Create other top-level directories
+    write(StoreOpts, <<"foo/bar">>, <<"baz">>),
+    write(StoreOpts, <<"beep/boop">>, <<"bam">>),
+    read(StoreOpts, <<"colors">>), 
+    % Test listing colors/ - should return immediate children only
+    {ok, ListResult} = list(StoreOpts, <<"colors">>),
+    ?event({list_result, ListResult}),
+    % Expected: red, blue, green (files) + multi, primary, nested (directories)
+    % Should NOT include deeply nested items like foo, bar, deep, value
+    ExpectedChildren = [<<"blue">>, <<"green">>, <<"multi">>, <<"nested">>, <<"primary">>, <<"red">>],
+    ?assert(lists:all(fun(Key) -> lists:member(Key, ExpectedChildren) end, ListResult)),
+    % Test listing a nested directory - should only show immediate children
+    {ok, NestedListResult} = list(StoreOpts, <<"colors/multi">>),
+    ?event({nested_list_result, NestedListResult}),
+    ExpectedNestedChildren = [<<"bar">>, <<"foo">>],
+    ?assert(lists:all(fun(Key) -> lists:member(Key, ExpectedNestedChildren) end, NestedListResult)),
+    % Test listing a deeper nested directory
+    {ok, DeepListResult} = list(StoreOpts, <<"colors/nested">>),
+    ?event({deep_list_result, DeepListResult}),
+    ExpectedDeepChildren = [<<"deep">>],
+    ?assert(lists:all(fun(Key) -> lists:member(Key, ExpectedDeepChildren) end, DeepListResult)),
+    ok = stop(StoreOpts).
+
+%% @doc Group test - verifies group creation and type detection.
+%%
+%% This test creates a group entry and verifies that it is correctly identified 
+%% as a composite type and cannot be read directly (like filesystem directories).
+group_test() ->
+    StoreOpts = #{
+        <<"store-module">> => ?MODULE,
+        <<"name">> => <<"/tmp/store3">>,
+        <<"capacity">> => ?DEFAULT_SIZE
+    },
+    reset(StoreOpts),
+    make_group(StoreOpts, <<"colors">>),
+    % Groups should be detected as composite types
+    ?assertEqual(composite, type(StoreOpts, <<"colors">>)),
+    % Groups should not be readable directly (like directories in filesystem)
+    ?assertEqual(not_found, read(StoreOpts, <<"colors">>)).
+
+%% @doc Link test - verifies symbolic link creation and resolution.
+%%
+%% This test creates a regular key-value pair, creates a link pointing to it,
+%% and verifies that reading from the link location returns the original value.
+%% This demonstrates the transparent link resolution mechanism.
+link_test() ->
+    StoreOpts = #{
+        <<"store-module">> => ?MODULE,
+        <<"name">> => <<"/tmp/store3">>,
+        <<"capacity">> => ?DEFAULT_SIZE
+    },
+    reset(StoreOpts),
+    write(StoreOpts, <<"foo/bar/baz">>, <<"Bam">>),
+    make_link(StoreOpts, <<"foo/bar/baz">>, <<"foo/beep/baz">>),
+    {ok, Result} = read(StoreOpts, <<"foo/beep/baz">>),
+    ?event({ result, Result}),
+    ?assertEqual(<<"Bam">>, Result).
+
+link_fragment_test() ->
+    StoreOpts = #{
+        <<"store-module">> => ?MODULE,
+        <<"name">> => <<"/tmp/store3">>,
+        <<"capacity">> => ?DEFAULT_SIZE
+    },
+    reset(StoreOpts),
+    write(StoreOpts, [<<"data">>, <<"bar">>, <<"baz">>], <<"Bam">>),
+    make_link(StoreOpts, [<<"data">>, <<"bar">>], <<"my-link">>),
+    {ok, Result} = read(StoreOpts, [<<"my-link">>, <<"baz">>]),
+    ?event({ result, Result}),
+    ?assertEqual(<<"Bam">>, Result).
+
+%% @doc Type test - verifies type detection for both simple and composite entries.
+%%
+%% This test creates both a group (composite) entry and a regular (simple) entry,
+%% then verifies that the type detection function correctly identifies each one.
+%% This demonstrates the semantic classification system used by the store.
+type_test() ->
+    StoreOpts = #{
+        <<"store-module">> => ?MODULE,
+        <<"name">> => <<"/tmp/store-6">>,
+        <<"capacity">> => ?DEFAULT_SIZE
+    },
+    reset(StoreOpts),
+    make_group(StoreOpts, <<"assets">>),
+    Type = type(StoreOpts, <<"assets">>),
+    ?event({type, Type}),
+    ?assertEqual(composite, Type),
+    write(StoreOpts, <<"assets/1">>, <<"bam">>),
+    Type2 = type(StoreOpts, <<"assets/1">>),
+    ?event({type2, Type2}),
+    ?assertEqual(simple, Type2).
+
+%% @doc Link key list test - verifies symbolic link creation using structured key paths.
+%%
+%% This test demonstrates the store's ability to handle complex key structures
+%% represented as lists of binary segments, and verifies that symbolic links
+%% work correctly when the target key is specified as a list rather than a
+%% flat binary string.
+%%
+%% The test creates a hierarchical key structure using a list format (which
+%% presumably gets converted to a path-like binary internally), creates a
+%% symbolic link pointing to that structured key, and verifies that link
+%% resolution works transparently to return the original value.
+%%
+%% This is particularly important for applications that organize data in
+%% hierarchical structures where keys represent nested paths or categories,
+%% and need to create shortcuts or aliases to deeply nested data.
+link_key_list_test() ->
+    StoreOpts = #{
+        <<"store-module">> => ?MODULE,
+        <<"name">> => <<"/tmp/store-7">>,
+        <<"capacity">> => ?DEFAULT_SIZE
+    },
+    reset(StoreOpts),
+    write(StoreOpts, [ <<"parent">>, <<"key">> ], <<"value">>),
+    make_link(StoreOpts, [ <<"parent">>, <<"key">> ], <<"my-link">>),
+    {ok, Result} = read(StoreOpts, <<"my-link">>),
+    ?event({result, Result}),
+    ?assertEqual(<<"value">>, Result).
+
+%% @doc Path traversal link test - verifies link resolution during path traversal.
+%%
+%% This test verifies that when reading a path as a list, intermediate path
+%% segments that are links get resolved correctly. For example, if "link" 
+%% is a symbolic link to "group", then reading ["link", "key"] should 
+%% resolve to reading ["group", "key"].
+%%
+%% This functionality enables transparent redirection at the directory level,
+%% allowing reorganization of hierarchical data without breaking existing
+%% access patterns.
+path_traversal_link_test() ->
+    StoreOpts = #{
+        <<"store-module">> => ?MODULE,
+        <<"name">> => <<"/tmp/store-8">>,
+        <<"capacity">> => ?DEFAULT_SIZE
+    },
+    reset(StoreOpts),
+    % Create the actual data at group/key
+    write(StoreOpts, [<<"group">>, <<"key">>], <<"target-value">>),
+    % Create a link from "link" to "group"
+    make_link(StoreOpts, <<"group">>, <<"link">>),
+    % Reading via the link path should resolve to the target value
+    {ok, Result} = read(StoreOpts, [<<"link">>, <<"key">>]),
+    ?event({path_traversal_result, Result}),
+    ?assertEqual(<<"target-value">>, Result),
+    ok = stop(StoreOpts).
+
+%% @doc Test that matches the exact hb_store hierarchical test pattern
+exact_hb_store_test() ->
+    StoreOpts = #{
+        <<"store-module">> => ?MODULE,
+        <<"name">> => <<"/tmp/store-exact">>,
+        <<"capacity">> => ?DEFAULT_SIZE
+    },
+    % Follow exact same pattern as hb_store test
+    ?event(step1_make_group),
+    make_group(StoreOpts, <<"test-dir1">>),
+    ?event(step2_write_file),
+    write(StoreOpts, [<<"test-dir1">>, <<"test-file">>], <<"test-data">>),
+    ?event(step3_make_link),
+    make_link(StoreOpts, [<<"test-dir1">>], <<"test-link">>),
+    % Debug: test that the link behaves like the target (groups are unreadable)
+    ?event(step4_check_link),
+    LinkResult = read(StoreOpts, <<"test-link">>),
+    ?event({link_result, LinkResult}),
+    % Since test-dir1 is a group and groups are unreadable, the link should also be unreadable
+    ?assertEqual(not_found, LinkResult),
+    % Debug: test intermediate steps
+    ?event(step5_test_direct_read),
+    DirectResult = read(StoreOpts, <<"test-dir1/test-file">>),
+    ?event({direct_result, DirectResult}),
+    % This should work: reading via the link path  
+    ?event(step6_test_link_read),
+    Result = read(StoreOpts, [<<"test-link">>, <<"test-file">>]),
+    ?event({final_result, Result}),
+    ?assertEqual({ok, <<"test-data">>}, Result),
+    ok = stop(StoreOpts).
+
+%% @doc Test cache-style usage through hb_store interface
+cache_style_test() ->
+    hb:init(),
+    StoreOpts = #{
+        <<"store-module">> => ?MODULE,
+        <<"name">> => <<"/tmp/store-cache-style">>,
+        <<"capacity">> => ?DEFAULT_SIZE
+    },
+    reset(StoreOpts),
+    % Start the store
+    hb_store:start(StoreOpts),
+    % Test writing through hb_store interface  
+    ok = hb_store:write(StoreOpts, <<"test-key">>, <<"test-value">>),
+    % Test reading through hb_store interface
+    Result = hb_store:read(StoreOpts, <<"test-key">>),
+    ?event({cache_style_read_result, Result}),
+    ?assertEqual({ok, <<"test-value">>}, Result),
+    hb_store:stop(StoreOpts).
+
+%% @doc Test nested map storage with cache-like linking behavior
+%%
+%% This test demonstrates how to store a nested map structure where:
+%% 1. Each value is stored at data/{hash_of_value} 
+%% 2. Links are created to compose the values back into the original map structure
+%% 3. Reading the composed structure reconstructs the original nested map
+nested_map_cache_test() ->
+    StoreOpts = #{
+        <<"store-module">> => ?MODULE,
+        <<"name">> => <<"/tmp/store-nested-cache">>,
+        <<"capacity">> => ?DEFAULT_SIZE
+    },
+    % Clean up any previous test data
+    reset(StoreOpts),
+    % Original nested map structure
+    OriginalMap = #{
+        <<"target">> => <<"Foo">>,
+        <<"commitments">> => #{
+            <<"key1">> => #{
+              <<"alg">> => <<"rsa-pss-512">>,
+              <<"committer">> => <<"unique-id">>
+            },
+            <<"key2">> => #{
+              <<"alg">> => <<"hmac">>,
+              <<"commiter">> => <<"unique-id-2">>              
+            }
+        },
+        <<"other-key">> => #{
+            <<"other-key-key">> => <<"other-key-value">>
+        }
+    },
+    ?event({original_map, OriginalMap}),
+    % Step 1: Store each leaf value at data/{hash}
+    TargetValue = <<"Foo">>,
+    TargetHash = base64:encode(crypto:hash(sha256, TargetValue)),
+    write(StoreOpts, <<"data/", TargetHash/binary>>, TargetValue),
+    AlgValue1 = <<"rsa-pss-512">>,
+    AlgHash1 = base64:encode(crypto:hash(sha256, AlgValue1)),
+    write(StoreOpts, <<"data/", AlgHash1/binary>>, AlgValue1),
+    CommitterValue1 = <<"unique-id">>,
+    CommitterHash1 = base64:encode(crypto:hash(sha256, CommitterValue1)),
+    write(StoreOpts, <<"data/", CommitterHash1/binary>>, CommitterValue1),
+    AlgValue2 = <<"hmac">>,
+    AlgHash2 = base64:encode(crypto:hash(sha256, AlgValue2)),
+    write(StoreOpts, <<"data/", AlgHash2/binary>>, AlgValue2),
+    CommitterValue2 = <<"unique-id-2">>,
+    CommitterHash2 = base64:encode(crypto:hash(sha256, CommitterValue2)),
+    write(StoreOpts, <<"data/", CommitterHash2/binary>>, CommitterValue2),
+    OtherKeyValue = <<"other-key-value">>,
+    OtherKeyHash = base64:encode(crypto:hash(sha256, OtherKeyValue)),
+    write(StoreOpts, <<"data/", OtherKeyHash/binary>>, OtherKeyValue),
+    % Step 2: Create the nested structure with groups and links
+    % Create the root group
+    make_group(StoreOpts, <<"root">>),
+    % Create links for the root level keys
+    make_link(StoreOpts, <<"data/", TargetHash/binary>>, <<"root/target">>),
+    % Create the commitments subgroup
+    make_group(StoreOpts, <<"root/commitments">>),
+    % Create the key1 subgroup within commitments
+    make_group(StoreOpts, <<"root/commitments/key1">>),
+    make_link(StoreOpts, <<"data/", AlgHash1/binary>>, <<"root/commitments/key1/alg">>),
+    make_link(StoreOpts, <<"data/", CommitterHash1/binary>>, <<"root/commitments/key1/committer">>),
+    % Create the key2 subgroup within commitments
+    make_group(StoreOpts, <<"root/commitments/key2">>),
+    make_link(StoreOpts, <<"data/", AlgHash2/binary>>, <<"root/commitments/key2/alg">>),
+    make_link(StoreOpts, <<"data/", CommitterHash2/binary>>, <<"root/commitments/key2/commiter">>),
+    % Create the other-key subgroup
+    make_group(StoreOpts, <<"root/other-key">>),
+    make_link(StoreOpts, <<"data/", OtherKeyHash/binary>>, <<"root/other-key/other-key-key">>),
+    % Step 3: Test reading the structure back
+    % Verify the root is a composite
+    ?assertEqual(composite, type(StoreOpts, <<"root">>)),
+    % List the root contents
+    {ok, RootKeys} = list(StoreOpts, <<"root">>),
+    ?event({root_keys, RootKeys}),
+    ExpectedRootKeys = [<<"commitments">>, <<"other-key">>, <<"target">>],
+    ?assert(lists:all(fun(Key) -> lists:member(Key, ExpectedRootKeys) end, RootKeys)),
+    % Read the target directly
+    {ok, TargetValueRead} = read(StoreOpts, <<"root/target">>),
+    ?assertEqual(<<"Foo">>, TargetValueRead),
+    % Verify commitments is a composite
+    ?assertEqual(composite, type(StoreOpts, <<"root/commitments">>)),
+    % Verify other-key is a composite  
+    ?assertEqual(composite, type(StoreOpts, <<"root/other-key">>)),
+    % Step 4: Test programmatic reconstruction of the nested map
+    ReconstructedMap = reconstruct_map(StoreOpts, <<"root">>),
+    ?event({reconstructed_map, ReconstructedMap}),
+    % Verify the reconstructed map matches the original structure
+    ?assert(hb_message:match(OriginalMap, ReconstructedMap)),
+    stop(StoreOpts).
+
+%% Helper function to recursively reconstruct a map from the store
+reconstruct_map(StoreOpts, Path) ->
+    case type(StoreOpts, Path) of
+        composite ->
+            % This is a group, reconstruct it as a map
+            {ok, ImmediateChildren} = list(StoreOpts, Path),
+            % The list function now correctly returns only immediate children
+            ?event({path, Path, immediate_children, ImmediateChildren}),
+            maps:from_list([
+                {Key, reconstruct_map(StoreOpts, <<Path/binary, "/", Key/binary>>)}
+                || Key <- ImmediateChildren
+            ]);
+        simple ->
+            % This is a simple value, read it directly
+            {ok, Value} = read(StoreOpts, Path),
+            Value;
+        not_found ->
+            % Path doesn't exist
+            undefined
+    end.
+
+%% @doc Debug test to understand cache linking behavior
+cache_debug_test() ->
+    StoreOpts = #{
+        <<"store-module">> => ?MODULE,
+        <<"name">> => <<"/tmp/cache-debug">>,
+        <<"capacity">> => ?DEFAULT_SIZE
+    },
+    reset(StoreOpts),
+    % Simulate what the cache does:
+    % 1. Create a group for message ID
+    MessageID = <<"test_message_123">>,
+    make_group(StoreOpts, MessageID),
+    % 2. Store a value at data/hash
+    Value = <<"test_value">>,
+    ValueHash = base64:encode(crypto:hash(sha256, Value)),
+    DataPath = <<"data/", ValueHash/binary>>,
+    write(StoreOpts, DataPath, Value),
+    % 3. Calculate a key hashpath (simplified version)
+    KeyHashPath = <<MessageID/binary, "/", "key_hash_abc">>,
+    % 4. Create link from data path to key hash path
+    make_link(StoreOpts, DataPath, KeyHashPath),
+    % 5. Test what the cache would see:
+    ?event(debug_cache_test, {step, check_message_type}),
+    MsgType = type(StoreOpts, MessageID),
+    ?event(debug_cache_test, {message_type, MsgType}),
+    ?event(debug_cache_test, {step, list_message_contents}),
+    {ok, Subkeys} = list(StoreOpts, MessageID),
+    ?event(debug_cache_test, {message_subkeys, Subkeys}),
+    ?event(debug_cache_test, {step, read_key_hashpath}),
+    KeyHashResult = read(StoreOpts, KeyHashPath),
+    ?event(debug_cache_test, {key_hash_read_result, KeyHashResult}),
+    % 6. Test with path as list (what cache does):
+    ?event(debug_cache_test, {step, read_path_as_list}),
+    PathAsList = [MessageID, <<"key_hash_abc">>],
+    PathAsListResult = read(StoreOpts, PathAsList),
+    ?event(debug_cache_test, {path_as_list_result, PathAsListResult}),
+    stop(StoreOpts).
+
+%% @doc Isolated test focusing on the exact cache issue
+isolated_type_debug_test() ->
+    StoreOpts = #{
+        <<"store-module">> => ?MODULE,
+        <<"name">> => <<"/tmp/isolated-debug">>,
+        <<"capacity">> => ?DEFAULT_SIZE
+    },
+    reset(StoreOpts),
+    % Create the exact scenario from user's description:
+    % 1. A message ID with nested structure
+    MessageID = <<"message123">>,
+    make_group(StoreOpts, MessageID),
+    % 2. Create nested groups for "commitments" and "other-test-key"
+    CommitmentsPath = <<MessageID/binary, "/commitments">>,
+    OtherKeyPath = <<MessageID/binary, "/other-test-key">>,
+    ?event(isolated_debug, {creating_nested_groups, CommitmentsPath, OtherKeyPath}),
+    make_group(StoreOpts, CommitmentsPath),
+    make_group(StoreOpts, OtherKeyPath),
+    % 3. Add some actual data within those groups
+    write(StoreOpts, <<CommitmentsPath/binary, "/sig1">>, <<"signature_data_1">>),
+    write(StoreOpts, <<OtherKeyPath/binary, "/sub_value">>, <<"nested_value">>),
+    % 4. Test type detection on the nested paths
+    ?event(isolated_debug, {testing_main_message_type}),
+    MainType = type(StoreOpts, MessageID),
+    ?event(isolated_debug, {main_message_type, MainType}),
+    ?event(isolated_debug, {testing_commitments_type}),
+    CommitmentsType = type(StoreOpts, CommitmentsPath),
+    ?event(isolated_debug, {commitments_type, CommitmentsType}),
+    ?event(isolated_debug, {testing_other_key_type}),
+    OtherKeyType = type(StoreOpts, OtherKeyPath),
+    ?event(isolated_debug, {other_key_type, OtherKeyType}),
+    % 5. Test what happens when reading these nested paths
+    ?event(isolated_debug, {reading_commitments_directly}),
+    CommitmentsResult = read(StoreOpts, CommitmentsPath),
+    ?event(isolated_debug, {commitments_read_result, CommitmentsResult}),
+    ?event(isolated_debug, {reading_other_key_directly}),
+    OtherKeyResult = read(StoreOpts, OtherKeyPath),
+    ?event(isolated_debug, {other_key_read_result, OtherKeyResult}),
+    stop(StoreOpts).
+
+%% @doc Test that list function resolves links correctly
+list_with_link_test() ->
+    StoreOpts = #{
+        <<"store-module">> => ?MODULE,
+        <<"name">> => <<"/tmp/store-list-link">>,
+        <<"capacity">> => ?DEFAULT_SIZE
+    },
+    reset(StoreOpts),
+    % Create a group with some children
+    make_group(StoreOpts, <<"real-group">>),
+    write(StoreOpts, <<"real-group/child1">>, <<"value1">>),
+    write(StoreOpts, <<"real-group/child2">>, <<"value2">>),
+    write(StoreOpts, <<"real-group/child3">>, <<"value3">>),
+    % Create a link to the group
+    make_link(StoreOpts, <<"real-group">>, <<"link-to-group">>),
+    % List the real group to verify expected children
+    {ok, RealGroupChildren} = list(StoreOpts, <<"real-group">>),
+    ?event({real_group_children, RealGroupChildren}),
+    ExpectedChildren = [<<"child1">>, <<"child2">>, <<"child3">>],
+    ?assertEqual(ExpectedChildren, lists:sort(RealGroupChildren)),
+    % List via the link - should return the same children
+    {ok, LinkChildren} = list(StoreOpts, <<"link-to-group">>),
+    ?event({link_children, LinkChildren}),
+    ?assertEqual(ExpectedChildren, lists:sort(LinkChildren)),
+    stop(StoreOpts).
\ No newline at end of file
diff --git a/src/hb_store_lru.erl b/src/hb_store_lru.erl
new file mode 100644
index 000000000..d68aaa8f7
--- /dev/null
+++ b/src/hb_store_lru.erl
@@ -0,0 +1,854 @@
+%%% @doc An in-memory store implementation, following the `hb_store` behavior
+%%% and interface. This implementation uses a least-recently-used cache first,
+%%% and offloads evicted data to a specified non-volatile store over time.
+%%%
+%%% This cache is registered under `{in_memory, HTTPServerID}`, in `hb_name`
+%%% so that all processes that are executing using the HTTP server’s Opts
+%%% can find it quickly.
+%%%
+%%% The least-recently-used strategy (first is the most recent used, last is the
+%%% least recently used) is implemented by keeping track of the order and bytes
+%%%  on ets tables:
+%%% - A cache table containing all the entries along with the value size and
+%%%   key index.
+%%% - A cache indexing table containing all the index pointing to the keys. The
+%%%   IDs are then sorted to ease the eviction policy.
+%%% - A cache statistics table containing all the information about the cache
+%%%   size, capacity, and indexing.
+-module(hb_store_lru).
+-export([start/1, stop/1, reset/1, scope/1]).
+-export([write/3, read/2, list/2, type/2, make_link/3, make_group/2, resolve/2]).
+-include_lib("eunit/include/eunit.hrl").
+-include("include/hb.hrl").
+
+%%% @doc The default capacity is used when no capacity is provided in the store
+%%% options.
+-define(DEFAULT_LRU_CAPACITY, 4_000_000_000).
+
+%% @doc Maximum number of retries when fetching cache entries that aren't
+%% immediately found due to timing issues in concurrent operations.
+-define(RETRY_THRESHOLD, 2).
+
+%% @doc Start the LRU cache.
+start(StoreOpts = #{ <<"name">> := Name }) ->
+    ?event(cache_lru, {starting_lru_server, Name}),
+    From = self(),
+    spawn(
+        fun() ->
+            State = init(From, StoreOpts),
+            server_loop(State, StoreOpts)
+        end
+    ),
+    receive
+        {ok, InstanceMessage} -> {ok, InstanceMessage}
+    end.
+
+%% @doc Create the `ets' tables for the LRU cache:
+%% - The cache of data itself (public, with read concurrency enabled)
+%% - A set for the LRU's stats.
+%% - An ordered set for the cache's index.
+init(From, StoreOpts) ->
+    % Start the persistent store.
+    case hb_maps:get(<<"persistent-store">>, StoreOpts, no_store) of
+        no_store -> ok;
+        Store -> hb_store:start(Store)
+    end,
+    % Create LRU tables
+    CacheTable = ets:new(hb_cache_lru, [
+        set,
+        protected,
+        {read_concurrency, true}
+    ]),
+    CacheStatsTable = ets:new(hb_cache_lru_stats, [set]),
+    CacheIndexTable = ets:new(hb_cache_lru_index, [ordered_set]),
+    From ! {ok, #{ <<"pid">> => self(), <<"cache-table">> => CacheTable }},
+    #{
+        cache_table => CacheTable,
+        stats_table => CacheStatsTable,
+        index_table => CacheIndexTable
+    }.
+
+%% @doc Stop the LRU in memory by offloading the keys in the ETS tables
+%% before exiting the process.
+stop(Opts) ->
+    ?event(cache_lru, {stopping_lru_server, Opts}),
+    #{ <<"pid">> := CacheServer } = hb_store:find(Opts),
+    CacheServer ! {stop, self(), Ref = make_ref()},
+    receive
+        {ok, Ref} -> ok
+    end.
+
+%% @doc The LRU store is always local, for now.
+scope(_) -> local.
+
+%% @doc Reset the store by completely cleaning the ETS tables and
+%% delegate the reset to the underlying offloading store.
+reset(Opts) ->
+    #{ <<"pid">> := CacheServer } = hb_store:find(Opts),
+    CacheServer ! {reset, self(), Ref = make_ref()},
+    receive
+        {ok, Ref} ->
+            ?event({reset_store, {in_memory, CacheServer}}),
+            case get_persistent_store(Opts) of
+                no_store ->
+                    ok;
+                Store ->
+                    hb_store:reset(Store)
+            end
+    end.
+
+server_loop(State =
+                #{cache_table := CacheTable,
+                  stats_table := StatsTable,
+                  index_table := IndexTable},
+            Opts) ->
+    receive
+        {sync, From} ->
+            From ! {ok, self()},
+            server_loop(State, Opts);
+        {get_cache_table, From} ->
+            From ! CacheTable;
+        {put, Key, Value, From, Ref} ->
+            put_cache_entry(State, Key, Value, Opts),
+            ?event(debug_lru, {put, {key, Key}, {value, Value}}),
+            From ! {ok, Ref};
+        {link, Existing, New, From, Ref} ->
+            link_cache_entry(State, Existing, New, Opts),
+            From ! {ok, Ref};
+        {make_group, Key, From, Ref} ->
+            ?event(debug_lru, {make_group, Key}),
+            ensure_dir(State, Key),
+            From ! {ok, Ref};
+        {update_recent, Key, Entry, From, Ref} ->
+            update_recently_used(State, Key, Entry),
+            From ! {ok, Ref};
+        {reset, From, Ref} ->
+            ets:delete_all_objects(CacheTable),
+            ets:delete_all_objects(StatsTable),
+            ets:delete_all_objects(IndexTable),
+            From ! {ok, Ref};
+        {stop, From, Ref} ->
+            evict_all_entries(State, Opts),
+            From ! {ok, Ref},
+            exit(self(), ok)
+    end,
+    server_loop(State, Opts).
+
+%% @doc Force the caller to wait until the server has fully processed all 
+%% messages in its mailbox, up to the initiation of the call.
+sync(Server) ->
+    Server ! {sync, self()},
+    receive
+        {ok, Server} -> ok
+    end.
+
+%% @doc Write an entry in the cache.
+%%
+%% After writing, the LRU is updated by moving the key in the most-recently-used
+%% key to cycle and re-prioritize cache entry.
+write(Opts, RawKey, Value) ->
+    Key = hb_store:join(RawKey),
+    #{ <<"pid">> := CacheServer } = hb_store:find(Opts),
+    CacheServer ! {put, Key, Value, self(), Ref = make_ref()},
+    receive
+        {ok, Ref} -> ok
+    end.
+
+%% @doc Retrieve value in the cache from the given key.
+%% Because the cache uses LRU, the key is moved on the most recent used key to
+%% cycle and re-prioritize cache entry.
+read(Opts, RawKey) ->
+    #{ <<"pid">> := Server } = hb_store:find(Opts),
+    Key = resolve(Opts, RawKey),
+    case fetch_cache_with_retry(Opts, Key) of
+        nil ->
+            case get_persistent_store(Opts) of
+                no_store ->
+                    not_found;
+                PersistentStore ->
+                    % FIXME: It might happens some links can be in LRU while data on 
+                    % the permanent store and resolve doesn't produce the same key.
+                    ResolvedKey = case RawKey == Key of
+                      true ->
+                        hb_store:resolve(PersistentStore, RawKey);
+                      false ->
+                        Key
+                    end,
+                    hb_store:read(PersistentStore, ResolvedKey)
+            end;
+        {raw, Entry = #{value := Value}} ->
+            Server ! {update_recent, Key, Entry, self(), Ref = make_ref()},
+            receive
+                {ok, Ref} -> {ok, Value}
+            end;
+        {link, Link} ->
+            ?event({link_found, RawKey, Link}),
+            read(Opts, Link);
+        Unexpected ->
+            ?event({unexpected_result, {unexpected, Unexpected}}),
+            not_found
+    end.
+
+resolve(Opts, Key) ->
+    Res = resolve(Opts, "", hb_path:term_to_path_parts(hb_store:join(Key), Opts)),
+    ?event({resolved, Key, Res}),
+    Res.
+
+resolve(_, CurrPath, []) ->
+    hb_store:join(CurrPath);
+resolve(Opts, CurrPath, [Next|Rest]) ->
+    PathPart = hb_store:join([CurrPath, Next]),
+    ?event(
+        {resolving,
+            {accumulated_path, CurrPath},
+            {next_segment, Next},
+            {generated_partial_path_to_test, PathPart}
+        }
+    ),
+    case fetch_cache_with_retry(Opts, PathPart) of
+        {link, Link} ->
+            resolve(Opts, Link, Rest);
+        _ ->
+            resolve(Opts, PathPart, Rest)
+    end.
+
+%% @doc Make a link from a key to another in the store.
+make_link(_, Link, Link) ->
+    ok;
+make_link(Opts, RawExisting, New) ->
+    #{ <<"pid">> := Server } = hb_store:find(Opts),
+    ExistingKeyBin = convert_if_list(RawExisting),
+    NewKeyBin = convert_if_list(New),
+    case fetch_cache_with_retry(Opts, ExistingKeyBin) of
+        nil ->
+            case get_persistent_store(Opts) of
+                no_store ->
+                    not_found;
+                Store ->
+                    hb_store:make_link(Store, ExistingKeyBin, NewKeyBin)
+            end;
+        _ ->
+            Server ! {link, ExistingKeyBin, NewKeyBin, self(), Ref = make_ref()},
+            receive
+                {ok, Ref} ->
+                    ok
+            end
+    end.
+
+%% @doc List all the keys registered.
+list(Opts, Path) ->
+    PersistentKeys =
+        case get_persistent_store(Opts) of
+            no_store ->
+                not_found;
+            Store ->
+                ResolvedPath = hb_store:resolve(Store, Path),
+                case hb_store:list(Store, ResolvedPath) of
+                    {ok, Keys} -> Keys;
+                    not_found -> not_found
+                end
+        end,
+    case {ets_keys(Opts, Path), PersistentKeys} of
+        {not_found, not_found} ->
+            not_found;
+        {InMemoryKeys, not_found} ->
+            {ok, InMemoryKeys};
+        {not_found, PersistentKeys} ->
+            {ok, PersistentKeys};
+        {InMemoryKeys, PersistentKeys} ->
+            {ok, hb_util:unique(InMemoryKeys ++ PersistentKeys)}
+    end.
+
+%% @doc List all of the keys in the store for a given path, supporting a special
+%% case for the root.
+ets_keys(Opts, <<"">>) -> ets_keys(Opts, <<"/">>);
+ets_keys(Opts, <<"/">>) ->
+    #{ <<"cache-table">> := Table } = hb_store:find(Opts),
+    table_keys(Table, undefined);
+ets_keys(Opts, Path) ->
+    case fetch_cache_with_retry(Opts, Path) of
+        {group, Set} ->
+            sets:to_list(Set);
+        {link, Link} ->
+            list(Opts, Link);
+        {raw, #{value := Value}} when is_map(Value) ->
+            maps:keys(Value);
+        {raw, #{value := Value}} when is_list(Value) ->
+            Value;
+        nil ->
+            not_found
+    end.
+
+%% @doc Determine the type of a key in the store.
+type(Opts, Key) ->
+    case fetch_cache_with_retry(Opts, Key) of
+        nil ->
+            case get_persistent_store(Opts) of
+                no_store ->
+                    not_found;
+                Store ->
+                    ResolvedKey = hb_store:resolve(Store, Key),
+                    hb_store:type(Store, ResolvedKey)
+            end;
+        {raw, _} ->
+            simple;
+        {link, NewKey} ->
+            type(Opts, NewKey);
+        {group, _Item} ->
+            composite
+    end.
+
+%% @doc Create a directory inside the store.
+make_group(Opts, Key) ->
+    #{ <<"pid">> := Server } = hb_store:find(Opts),
+    Server ! {make_group, Key, self(), Ref = make_ref()},
+    receive
+        {ok, Ref} ->
+            ok
+    end.
+
+table_keys(TableName) ->
+    table_keys(TableName, undefined).
+
+table_keys(TableName, Prefix) ->
+    FirstKey = ets:first(TableName),
+    table_keys(TableName, FirstKey, Prefix, []).
+
+table_keys(_TableName, '$end_of_table', _Prefix, Acc) ->
+    Acc;
+table_keys(TableName, CurrentKey, Prefix, Acc) ->
+    NextKey = ets:next(TableName, CurrentKey),
+    case Prefix of
+        undefined ->
+            table_keys(TableName, NextKey, Prefix, [CurrentKey | Acc]);
+        _ ->
+            PrefixParts = hb_path:term_to_path_parts(Prefix),
+            Key = hb_path:term_to_path_parts(CurrentKey),
+            case lists:prefix(PrefixParts, Key) of
+                true ->
+                    Extracted = lists:nthtail(length(PrefixParts), Key),
+                    table_keys(
+                        TableName,
+                        NextKey,
+                        Prefix,
+                        [hb_path:to_binary(Extracted) | Acc]
+                    );
+                false ->
+                    table_keys(TableName, NextKey, Prefix, Acc)
+            end
+    end.
+
+get_cache_entry(#{cache_table := Table}, Key) ->
+    get_cache_entry(Table, Key);
+get_cache_entry(Table, Key) ->
+    case ets:lookup(Table, Key) of
+        [] ->
+            nil;
+        [{_, Entry}] ->
+            Entry
+    end.
+
+fetch_cache_with_retry(Opts, Key) ->
+    fetch_cache_with_retry(Opts, Key, 1).
+
+fetch_cache_with_retry(Opts, Key, Retries) ->
+    #{<<"cache-table">> := Table, <<"pid">> := Server} = hb_store:find(Opts),
+    case get_cache_entry(Table, Key) of
+        nil ->
+            case Retries < ?RETRY_THRESHOLD of
+                true ->
+                    sync(Server),
+                    fetch_cache_with_retry(Opts, Key, Retries + 1);
+                false ->
+                    nil
+            end;
+        Entry ->
+            Entry
+    end.
+
+put_cache_entry(State, Key, Value, Opts) ->
+    ValueSize = erlang:external_size(Value),
+    CacheSize = cache_size(State),
+    ?event(cache_lru, {putting_entry, {size, ValueSize}, {opts, Opts}, {cache_size, CacheSize}}),
+    Capacity = hb_maps:get(<<"capacity">>, Opts, ?DEFAULT_LRU_CAPACITY),
+    case get_cache_entry(State, Key) of
+        nil ->
+            % For new entries, we check if the size will the fit the full
+            % capacity (even by evicting keys).
+            FitInCache = ValueSize =< Capacity,
+            case FitInCache of
+                false ->
+                    case get_persistent_store(Opts) of
+                        no_store -> 
+                            skip;
+                        _ ->
+                            Group = handle_group(State, Key, Opts#{mode => offload}),
+                            offload_to_store(Key, Value, [], Group, Opts)
+                        end;
+                true ->
+                    ?event(cache_lru, {assign_entry, Key, Value}),
+                    Group = handle_group(State, Key, Opts),
+                    assign_new_entry(
+                        State,
+                        Key,
+                        Value,
+                        ValueSize,
+                        Capacity,
+                        Group,
+                        Opts
+                    )
+            end;
+        Entry ->
+            ?event(cache_lru, {replace_entry, Key, Value}),
+            replace_entry(State, Key, Value, ValueSize, Entry)
+    end.
+
+handle_group(State, Key, Opts) ->
+    case filename:dirname(hb_store:join(Key)) of
+        <<".">> -> undefined ;
+        BaseDir ->
+            case maps:get(mode, Opts, undefined) of
+                offload ->
+                    Store = get_persistent_store(Opts),
+                    ?event(cache_lru, {create_group, BaseDir}),
+                    hb_store:make_group(Store, BaseDir),
+                    BaseDir;
+              undefined -> 
+                    ensure_dir(State, BaseDir),
+                    {group, Entry} = get_cache_entry(State, BaseDir),
+                    BaseName = filename:basename(Key),
+                    NewGroup = append_key_to_group(BaseName, Entry),
+                    add_cache_entry(State, BaseDir, {group, NewGroup}),
+                    BaseDir
+            end
+    end.
+ensure_dir(State, Path) ->
+    PathParts = hb_path:term_to_path_parts(Path),
+    [First | Rest] = PathParts,
+    Result = ensure_dir(State, First, Rest),
+    Result.
+
+ensure_dir(State, CurrentPath, []) ->
+    maybe_create_dir(State, CurrentPath, nil);
+ensure_dir(State, CurrentPath, [Next]) ->
+    maybe_create_dir(State, CurrentPath, Next),
+    ensure_dir(State, hb_store:join([CurrentPath, Next]), []);
+ensure_dir(State, CurrentPath, [Next | Rest]) ->
+    maybe_create_dir(State, CurrentPath, Next),
+    ensure_dir(State, hb_store:join([CurrentPath, Next]), Rest).
+
+maybe_create_dir(State, DirPath, Value) ->
+    CurrentValueSet =
+        case get_cache_entry(State, DirPath) of
+            nil ->
+                sets:new();
+            {group, CurrentValue} ->
+                CurrentValue
+        end,
+    NewValueSet =
+        case Value of
+            nil ->
+                CurrentValueSet;
+            _ ->
+                sets:add_element(Value, CurrentValueSet)
+        end,
+    ?event(cache_lru, {create_group, DirPath, sets:to_list(NewValueSet)}),
+    add_cache_entry(State, DirPath, {group, NewValueSet}).
+
+append_key_to_group(Key, Group) ->
+    BaseName = filename:basename(Key),
+    sets:add_element(BaseName, Group).
+
+assign_new_entry(State, Key, Value, ValueSize, Capacity, Group, Opts) ->
+    case cache_size(State) + ValueSize >= Capacity of
+        true ->
+            ?event(cache_lru, eviction_required),
+            evict_oldest_entry(State, ValueSize, Opts);
+        false ->
+            ok
+    end,
+    ID = get_index_id(State),
+    add_cache_index(State, ID, Key),
+    add_cache_entry(
+        State,
+        Key,
+        {raw,
+            #{
+                value => Value,
+                id => ID,
+                size => ValueSize,
+                group => Group
+            }
+        }
+    ),
+    increase_cache_size(State, ValueSize).
+
+cache_size(#{stats_table := Table}) ->
+    case ets:lookup(Table, size) of
+        [{_, Size}] ->
+            Size;
+        _ ->
+            0
+    end.
+
+get_index_id(#{stats_table := StatsTable}) ->
+    ets:update_counter(StatsTable, id, {2, 1}, {0, 0}).
+
+add_cache_entry(#{cache_table := Table}, Key, Value) ->
+    ets:insert(Table, {Key, Value}).
+
+add_cache_index(#{index_table := Table}, ID, Key) ->
+    ets:insert(Table, {ID, Key}).
+
+link_cache_entry(State = #{cache_table := Table}, Existing, New, Opts) ->	
+    ?event(cache_lru, {link, Existing, New}),
+    % Remove the link from the previous linked entry
+    clean_old_link(Table, New),
+    _ = handle_group(State, New, Opts),
+    ets:insert(Table, {New, {link, Existing}}),
+    % Add links to the linked entry
+    case ets:lookup(Table, Existing) of
+        [{_, {raw, Entry}}] ->
+            NewLinks =
+                case Entry of
+                    #{links := ExistingLinks} ->
+                        [New | ExistingLinks];
+                    _ ->
+                        [New]
+                end,
+            ets:insert(Table, {Existing, {raw, Entry#{links => NewLinks}}});
+        _ ->
+            ignore
+    end.
+
+% @doc Remove the link association for the the old linked data to the given key
+clean_old_link(Table, Link) ->
+    case ets:lookup(Table, Link) of
+        [{_, {link, PreviousEntry}}] ->
+            ?event(cache_lru, {removing_previous_link,
+                {link, Link},
+                {previous_entry, PreviousEntry}
+            }),
+            case ets:lookup(Table, PreviousEntry) of
+                [{_, {raw, OldEntry}}] ->
+                    Links = sets:from_list(maps:get(links, OldEntry, [])),
+                    UpdatedLinks = sets:del_element(Link, Links),
+                    UpdatedEntry = maps:put(
+                        links,
+                        sets:to_list(UpdatedLinks),
+                        OldEntry
+                    ),
+                    ets:insert(Table, {PreviousEntry, {raw, UpdatedEntry}});
+                _ ->
+                    skip
+            end;
+        _ -> skip
+    end.
+
+increase_cache_size(#{stats_table := StatsTable}, ValueSize) ->
+    ets:update_counter(StatsTable, size, {2, ValueSize}, {0, 0}).
+
+evict_oldest_entry(State, ValueSize, Opts) ->
+    evict_oldest_entry(State, ValueSize, 0, Opts).
+
+evict_oldest_entry(_State, ValueSize, FreeSize, _Opts) when FreeSize >= ValueSize ->
+    ok;
+evict_oldest_entry(State, ValueSize, FreeSize, Opts) ->
+    case cache_tail_key(State) of
+        nil ->
+            ok;
+        TailKey ->
+            Entry = #{
+                size := ReclaimedSize,
+                id := ID,
+                value := TailValue,
+                group := Group
+            } = case get_cache_entry(State, TailKey) of
+                nil ->
+                    % Raises a runtime error as this represents
+                    % a non-recoverable error. This would signifies a
+                    % inconsistency between the index and the cache table.
+                    erlang:error(cache_entry_not_found, [TailKey]);
+                {raw, RawEntry} ->
+                    RawEntry
+            end,
+            ?event(cache_lru, {evict, TailKey, claiming_size, ReclaimedSize}),
+            delete_cache_index(State, ID),
+            delete_cache_entry(State, TailKey),
+            decrease_cache_size(State, ReclaimedSize),
+            Links = maps:get(links, Entry, []),
+            case Group of
+                undefined ->
+                    ignore;
+                _ ->
+                    {group, GroupSet} = get_cache_entry(State, Group),
+                    BaseName = filename:basename(TailKey),
+                    UpdatedGroupSet = sets:del_element(BaseName, GroupSet),
+                    case sets:size(UpdatedGroupSet) of
+                        0 ->
+                            delete_cache_entry(State, Group);
+                        _ ->
+                            add_cache_entry(
+                                State,
+                                Group,
+                                {group, UpdatedGroupSet}
+                            )
+                    end
+            end,
+            offload_to_store(TailKey, TailValue, Links, Group, Opts),
+            evict_oldest_entry(
+                State,
+                ValueSize,
+                FreeSize + ReclaimedSize,
+                Opts
+            )
+    end.
+
+evict_all_entries(#{cache_table := Table}, Opts) ->
+    lists:foreach(
+        fun(Key) ->
+            [{_, {raw, Entry}}] = ets:lookup(Table, Key),
+            #{ value := Value, group := Group } = Entry,
+            Links = maps:get(links, Entry, []),
+            offload_to_store(Key, Value, Links, Group, Opts)
+        end,
+        table_keys(Table)
+    ).
+
+offload_to_store(TailKey, TailValue, Links, Group, Opts) ->
+    ?event(lru_offload, {offloading_to_store, Opts}),
+    FoundStore = get_persistent_store(Opts),
+    ?event(lru_offload, {found_store, FoundStore}),
+    case FoundStore of
+        no_store ->
+            ok;
+        Store ->
+            case Group of
+                undefined ->
+                    ignore;
+                _ ->
+                    hb_store:make_group(Store, Group)
+            end,
+            case hb_store:write(Store, TailKey, TailValue) of
+                ok ->
+                    lists:foreach(
+                        fun(Link) ->
+                            ResolvedPath = resolve(Opts, Link),
+                            hb_store:make_link(Store, ResolvedPath, Link)
+                        end,
+                        Links
+                    ),
+                    ?event(cache_lru, {offloaded_key, TailKey}),
+                    ok;
+                Err ->
+                    ?event(warning, {error_offloading_to_local_cache, Err}),
+                    {error, Err}
+            end
+    end.
+
+cache_tail_key(#{index_table := Table}) ->
+    case ets:first(Table) of
+        '$end_of_table' ->
+            nil;
+        FirstID ->
+            [{_, Key}] = ets:lookup(Table, FirstID),
+            Key
+    end.
+
+delete_cache_index(#{index_table := IndexTable}, ID) ->
+    ets:delete(IndexTable, ID).
+
+delete_cache_entry(#{cache_table := Table}, Key) ->
+    ets:delete(Table, Key),
+    ?event(cache_lru, {deleted, Key}).
+
+decrease_cache_size(#{stats_table := Table}, Size) ->
+    ets:update_counter(Table, size, {2, -Size, 0, 0}).
+
+replace_entry(State, Key, Value, ValueSize, {raw, OldEntry = #{ value := OldValue}}) when Value =/= OldValue ->
+    % Update entry and move the keys in the front of the cache 
+    % as the most used Key
+    ?event(debug_lru, {replace_entry, 
+        {key, Key},
+        {value, Value},
+        {explicit, OldEntry}
+    }),
+    #{size := PreviousSize} = OldEntry,
+    NewEntry = OldEntry#{value := Value, size := ValueSize},
+    add_cache_entry(State, Key, {raw, NewEntry}),
+    update_recently_used(State, Key, NewEntry),
+    update_cache_size(State, PreviousSize, ValueSize);
+replace_entry(_State, _Key, _Value, _ValueSize, {raw, _}) -> ok;
+replace_entry(_State, _Key, _Value, _ValueSize, {Type, _}) ->
+    % Link or group should be handle directly with `make_link` or `make_group`
+    % This aim of this function is to be used along with direct data insertion.
+    throw({error, can_only_replace_raw_entry, {type, Type}}).
+update_recently_used(State, Key, Entry) ->
+    % Acquire a new ID
+    NewID = get_index_id(State),
+    % Update the entry's ID
+    add_cache_entry(State, Key, {raw, Entry#{id := NewID}}),
+    #{id := PreviousID} = Entry,
+    % Delete previous ID to priorize the new NewID
+    delete_cache_index(State, PreviousID),
+    add_cache_index(State, NewID, Key).
+
+update_cache_size(#{stats_table := Table}, PreviousSize, NewSize) ->
+    ets:update_counter(Table, size, [{2, -PreviousSize}, {2, NewSize}]).
+
+get_persistent_store(Opts) ->
+    hb_maps:get(
+        <<"persistent-store">>,
+        Opts,
+        no_store
+    ).
+
+convert_if_list(Value) when is_list(Value) ->
+    join(Value);  % Perform the conversion if it's a list
+convert_if_list(Value) ->
+    Value.
+
+join(Key) when is_list(Key) ->
+    KeyList = hb_store:join(Key),
+    maybe_convert_to_binary(KeyList);
+join(Key) when is_binary(Key) -> Key.
+
+maybe_convert_to_binary(Value) when is_list(Value) ->
+    list_to_binary(Value);
+maybe_convert_to_binary(Value) when is_binary(Value) ->
+    Value.
+
+%%% Tests
+
+%% @doc Generate a set of options for testing. The default is to use an `fs`
+%% store as the persistent backing.
+test_opts(PersistentStore) ->
+    test_opts(PersistentStore, 1000000).
+test_opts(PersistentStore, Capacity) ->
+    % Set the server ID to a random address.
+    BaseStore = #{
+        <<"name">> => hb_util:human_id(crypto:strong_rand_bytes(32)),
+        <<"capacity">> => Capacity,
+        <<"store-module">> => hb_store_lru
+    },
+    case PersistentStore of
+        no_store ->
+            BaseStore#{ <<"persistent-store">> => no_store };
+        default ->
+            DefaultStore = [
+                #{
+                    <<"store-module">> => hb_store_fs,
+                    <<"name">> => <<"cache-TEST/lru">>
+                }
+            ],
+            hb_store:reset(DefaultStore),
+            BaseStore#{ <<"persistent-store">> => DefaultStore };
+        _ ->
+            hb_store:reset(PersistentStore),
+            BaseStore#{ <<"persistent-store">> => PersistentStore }
+    end.
+
+unknown_value_test() ->
+    ?assertEqual(not_found, read(test_opts(default), <<"key1">>)).
+
+cache_term_test() ->
+    StoreOpts = test_opts(default),
+    write(StoreOpts, <<"key1">>, <<"Hello">>),
+    ?assertEqual({ok, <<"Hello">>}, read(StoreOpts, <<"key1">>)).
+
+evict_oldest_items_test() ->
+    StoreOpts = test_opts(no_store, 500),
+    Binary = crypto:strong_rand_bytes(200),
+    write(StoreOpts, <<"key1">>, Binary),
+    write(StoreOpts, <<"key2">>, Binary),
+    read(StoreOpts, <<"key1">>),
+    write(StoreOpts, <<"key3">>, Binary),
+    ?assertEqual({ok, Binary}, read(StoreOpts, <<"key1">>)),
+    ?assertEqual(not_found, read(StoreOpts, <<"key2">>)).
+
+evict_items_with_insufficient_space_test() ->
+    StoreOpts = test_opts(no_store, 500),
+    Binary = crypto:strong_rand_bytes(200),
+    write(StoreOpts, <<"key1">>, Binary),
+    write(StoreOpts, <<"key2">>, Binary),
+    write(StoreOpts, <<"key3">>, crypto:strong_rand_bytes(400)),
+    ?assertEqual(not_found, read(StoreOpts, <<"key1">>)),
+    ?assertEqual(not_found, read(StoreOpts, <<"key2">>)).
+
+evict_but_able_to_read_from_fs_store_test() ->
+    StoreOpts = test_opts(default, 500),
+    Binary = crypto:strong_rand_bytes(200),
+    write(StoreOpts, <<"key1">>, Binary),
+    write(StoreOpts, <<"key2">>, Binary),
+    read(StoreOpts, <<"key1">>),
+    write(StoreOpts, <<"key3">>, Binary),
+    ?assertEqual({ok, Binary}, read(StoreOpts, <<"key1">>)),
+    ?assertEqual({ok, Binary}, read(StoreOpts, <<"key2">>)),
+    % Directly offloads if the data is more than the LRU capacity
+    write(StoreOpts, <<"sub/key">>, crypto:strong_rand_bytes(600)),
+    ?assertMatch({ok, _}, read(StoreOpts, <<"sub/key">>)).
+
+stop_test() ->
+    StoreOpts = test_opts(default, 500),
+    Binary = crypto:strong_rand_bytes(200),
+    write(StoreOpts, <<"key1">>, Binary),
+    write(StoreOpts, <<"key2">>, Binary),
+    #{ <<"pid">> := ServerPID } = hb_store:find(StoreOpts),
+    ok = stop(StoreOpts),
+    ?assertEqual(false, is_process_alive(ServerPID)),
+    PersistentStore = hb_maps:get(<<"persistent-store">>, StoreOpts),
+    ?assertEqual({ok, Binary}, hb_store:read(PersistentStore, <<"key1">>)),
+    ?assertEqual({ok, Binary}, hb_store:read(PersistentStore, <<"key2">>)).
+
+reset_test() ->
+    StoreOpts = test_opts(default),
+    write(StoreOpts, <<"key1">>, <<"Hello">>),
+    write(StoreOpts, <<"key2">>, <<"Hi">>),
+    reset(StoreOpts),
+    ?assertEqual(not_found, read(StoreOpts, <<"key1">>)),
+    #{ <<"cache-table">> := Table } = hb_store:find(StoreOpts),
+    ?assertEqual([], ets:tab2list(Table)).
+
+list_test() ->
+    StoreOpts = test_opts(default, 500),
+    Binary = crypto:strong_rand_bytes(200),
+    make_group(StoreOpts, <<"sub">>),
+    write(StoreOpts, <<"hello">>, <<"world">>),
+    write(StoreOpts, <<"sub/key1">>, Binary),
+    write(StoreOpts, <<"sub/key2">>, Binary),
+    {ok, Keys1} = list(StoreOpts, <<"sub">>),
+    ?assertEqual([<<"key1">>, <<"key2">>], lists:sort(Keys1)),
+    write(StoreOpts, <<"sub/key3">>, Binary),
+    {ok, Keys2} = list(StoreOpts, <<"sub">>),
+    ?assertEqual(
+        [<<"key1">>, <<"key2">>, <<"key3">>],
+        lists:sort(Keys2)
+    ),
+    write(StoreOpts, <<"sub/inner/key1">>, Binary),
+    {ok, Keys3} = list(StoreOpts, <<"sub">>),
+    ?assertEqual([<<"inner">>, <<"key1">>, <<"key2">>, <<"key3">>],
+                 lists:sort(Keys3)),
+    write(StoreOpts, <<"complex">>, #{<<"a">> => 10, <<"b">> => Binary}),
+    ?assertEqual({ok, [<<"a">>, <<"b">>]}, list(StoreOpts, <<"complex">>)).
+
+type_test() ->
+    StoreOpts = test_opts(default, 500),
+    Binary = crypto:strong_rand_bytes(200),
+    write(StoreOpts, <<"key1">>, Binary),
+    ?assertEqual(simple, type(StoreOpts, <<"key1">>)),
+    write(StoreOpts, <<"sub/key1">>, Binary),
+    ?assertEqual(composite, type(StoreOpts, <<"sub">>)),
+    make_link(StoreOpts, <<"key1">>, <<"keylink">>),
+    ?assertEqual(simple, type(StoreOpts, <<"keylink">>)).
+
+replace_link_test() ->
+    StoreOpts = test_opts(default),
+    write(StoreOpts, <<"key1">>, <<"Hello">>),
+    make_link(StoreOpts, <<"key1">>, <<"keylink">>),
+    ?assertEqual({ok, <<"Hello">>}, read(StoreOpts, <<"keylink">>)),
+    write(StoreOpts, <<"key2">>, <<"Hello2">>),
+    make_link(StoreOpts, <<"key2">>, <<"keylink">>),
+    ?assertEqual({ok, <<"Hello2">>}, read(StoreOpts, <<"keylink">>)),
+    #{ <<"cache-table">> := Table } = hb_store:find(StoreOpts),
+    {raw, #{links := Links }}= get_cache_entry(Table, <<"key1">>),
+    ?assertEqual([], Links).
\ No newline at end of file
diff --git a/src/hb_store_opts.erl b/src/hb_store_opts.erl
new file mode 100644
index 000000000..fdb3c2b5c
--- /dev/null
+++ b/src/hb_store_opts.erl
@@ -0,0 +1,262 @@
+%%% @doc A module responsible for applying default configuration to store options.
+%%%
+%%% This module takes store options and store defaults and returns a new list
+%%% of stores with default properties applied based on the store-module type.
+%%% Supports recursive application to nested store configurations.
+-module(hb_store_opts).
+-export([apply/2]).
+-compile({no_auto_import,[apply/2]}).
+-include_lib("eunit/include/eunit.hrl").
+-include("include/hb.hrl").
+
+%% @doc Apply store defaults to store options.
+%% Takes StoreOpts (list of store configuration maps) and Defaults (map of defaults)
+%% and returns a new list with defaults applied where appropriate.
+
+apply(StoreOpts, Defaults) when is_list(StoreOpts), is_map(Defaults) ->
+    lists:map(
+        fun(StoreOpt) ->
+            apply_defaults_to_store(StoreOpt, Defaults)
+        end,
+        StoreOpts
+    ).
+
+%% @doc Apply defaults to a single store configuration.
+apply_defaults_to_store(StoreOpt, Defaults) when is_map(StoreOpt), is_map(Defaults) ->
+    UpdatedStore = apply_defaults_by_module_type(StoreOpt, Defaults),
+    apply_defaults_to_substores(UpdatedStore, Defaults).
+
+%% @doc Apply defaults based on store-module.
+apply_defaults_by_module_type(StoreOpt, Defaults) ->
+    case maps:get(<<"store-module">>, StoreOpt, undefined) of
+        hb_store_lmdb ->
+            apply_type_defaults(StoreOpt, <<"lmdb">>, Defaults);
+        hb_store_fs ->
+            apply_type_defaults(StoreOpt, <<"fs">>, Defaults);
+        hb_store_rocksdb ->
+            apply_type_defaults(StoreOpt, <<"rocksdb">>, Defaults);
+        hb_store_gateway ->
+            apply_type_defaults(StoreOpt, <<"gateway">>, Defaults);
+        _ ->
+            StoreOpt
+    end.
+
+%% @doc Apply type-specific defaults to a store.
+apply_type_defaults(StoreOpt, TypeKey, Defaults) ->
+    case maps:get(TypeKey, Defaults, #{}) of
+        TypeDefaults when is_map(TypeDefaults) ->
+            maps:merge(TypeDefaults, StoreOpt);
+        _ ->
+            StoreOpt
+    end.
+
+%% @doc Apply defaults to sub-stores recursively.
+apply_defaults_to_substores(StoreOpt, Defaults) ->
+    case maps:get(<<"store">>, StoreOpt, undefined) of
+        SubStores when is_list(SubStores) ->
+            UpdatedSubStores = 
+                lists:map(
+                    fun(SubStore) ->
+                        apply_defaults_to_store(SubStore, Defaults)
+                    end,
+                    SubStores
+                ),
+            maps:put(<<"store">>, UpdatedSubStores, StoreOpt);
+        _ ->
+            StoreOpt
+    end.
+
+%% EUnit tests
+
+basic_apply_test() ->
+    StoreOpts = 
+        [
+            #{
+                <<"name">> => <<"cache-mainnet/lmdb">>,
+                <<"store-module">> => hb_store_lmdb
+            }
+        ],
+    Defaults = 
+        #{
+            <<"lmdb">> => #{
+                <<"capacity">> => 1073741824
+            }
+        },
+    Expected = 
+        [
+            #{
+                <<"name">> => <<"cache-mainnet/lmdb">>,
+                <<"store-module">> => hb_store_lmdb,
+                <<"capacity">> => 1073741824
+            }
+        ],
+    Result = apply(StoreOpts, Defaults),
+    ?assertEqual(Expected, Result).
+
+empty_defaults_test() ->
+    StoreOpts = 
+        [
+            #{
+                <<"name">> => <<"cache-mainnet/lmdb">>,
+                <<"store-module">> => hb_store_lmdb
+            }
+        ],
+    Defaults = #{},
+    Expected = 
+        [
+            #{
+                <<"name">> => <<"cache-mainnet/lmdb">>,
+                <<"store-module">> => hb_store_lmdb
+            }
+        ],
+    Result = apply(StoreOpts, Defaults),
+    ?assertEqual(Expected, Result).
+
+empty_store_opts_test() ->
+    StoreOpts = [],
+    Defaults = 
+        #{
+            <<"lmdb">> => #{
+                <<"capacity">> => 1073741824
+            }
+        },
+    Expected = [],
+    Result = apply(StoreOpts, Defaults),
+    ?assertEqual(Expected, Result).
+
+nested_stores_test() ->
+    StoreOpts = 
+        [
+            #{
+                <<"store-module">> => hb_store_gateway,
+                <<"store">> => [
+                    #{
+                        <<"name">> => <<"cache-mainnet/lmdb">>,
+                        <<"store-module">> => hb_store_lmdb
+                    }
+                ]
+            }
+        ],
+    Defaults = 
+        #{
+            <<"lmdb">> => #{
+                <<"capacity">> => 1073741824
+            }
+        },
+    Expected = 
+        [
+            #{
+                <<"store-module">> => hb_store_gateway,
+                <<"store">> => [
+                    #{
+                        <<"name">> => <<"cache-mainnet/lmdb">>,
+                        <<"store-module">> => hb_store_lmdb,
+                        <<"capacity">> => 1073741824
+                    }
+                ]
+            }
+        ],
+    Result = apply(StoreOpts, Defaults),
+    ?assertEqual(Expected, Result).
+
+%% @doc Integration test to verify that capacity is properly set for hb_store_lmdb
+%% This test verifies that the capacity value is correctly applied and accessible
+%% to the hb_store_lmdb module before environment creation.
+lmdb_capacity_integration_test() ->
+    CustomCapacity = 5000,
+    StoreOpts = 
+        [
+            #{
+                <<"name">> => <<"test-lmdb">>,
+                <<"store-module">> => hb_store_lmdb
+            }
+        ],
+    Defaults = 
+        #{
+            <<"lmdb">> => #{
+                <<"capacity">> => CustomCapacity
+            }
+        },
+    [UpdatedStoreOpt] = apply(StoreOpts, Defaults),
+    ?assertEqual(CustomCapacity, maps:get(<<"capacity">>, UpdatedStoreOpt)),
+    ?assertEqual(<<"test-lmdb">>, maps:get(<<"name">>, UpdatedStoreOpt)),
+    ?assertEqual(hb_store_lmdb, maps:get(<<"store-module">>, UpdatedStoreOpt)),
+    ?assertNotEqual(16 * 1024 * 1024 * 1024, maps:get(<<"capacity">>, UpdatedStoreOpt)),
+    MultipleStoreOpts = 
+        [
+            #{
+                <<"name">> => <<"test-lmdb-1">>,
+                <<"store-module">> => hb_store_lmdb
+            },
+            #{
+                <<"name">> => <<"test-lmdb-2">>,
+                <<"store-module">> => hb_store_lmdb
+            },
+            #{
+                <<"name">> => <<"test-fs">>,
+                <<"store-module">> => hb_store_fs
+            }
+        ],
+    UpdatedMultipleStoreOpts = apply(MultipleStoreOpts, Defaults),
+    [LmdbStore1, LmdbStore2, FsStore] = UpdatedMultipleStoreOpts,
+    ?assertEqual(CustomCapacity, maps:get(<<"capacity">>, LmdbStore1)),
+    ?assertEqual(CustomCapacity, maps:get(<<"capacity">>, LmdbStore2)),
+    ?assertEqual(false, maps:is_key(<<"capacity">>, FsStore)),
+    ?event({integration_test_passed, {lmdb_capacity, CustomCapacity}, {note, "correctly applied to store options"}}).
+
+%% @doc Full integration test simulating the hb_http_server flow
+%% This test verifies that the complete flow from config loading to store defaults
+%% application works correctly, simulating what happens in hb_http_server:start/0
+full_integration_flow_test() ->
+    LoadedConfig = #{
+        <<"store_defaults">> => #{
+            <<"lmdb">> => #{
+                <<"capacity">> => 5000
+            }
+        }
+    },
+    DefaultStoreOpts = [
+        #{
+            <<"name">> => <<"cache-mainnet/lmdb">>,
+            <<"store-module">> => hb_store_lmdb
+        },
+        #{
+            <<"store-module">> => hb_store_fs,
+            <<"name">> => <<"cache-mainnet">>
+        },
+        #{
+            <<"store-module">> => hb_store_gateway,
+            <<"subindex">> => [
+                #{
+                    <<"name">> => <<"Data-Protocol">>,
+                    <<"value">> => <<"ao">>
+                }
+            ],
+            <<"store">> => [
+                #{
+                    <<"store-module">> => hb_store_lmdb,
+                    <<"name">> => <<"cache-mainnet/lmdb">>
+                }
+            ]
+        }
+    ],
+    MergedConfig = maps:merge(
+        #{<<"store">> => DefaultStoreOpts},
+        LoadedConfig
+    ),
+    StoreOpts = maps:get(<<"store">>, MergedConfig),
+    StoreDefaults = maps:get(<<"store_defaults">>, MergedConfig, #{}),
+    UpdatedStoreOpts = apply(StoreOpts, StoreDefaults),
+    [LmdbStore, FsStore, GatewayStore] = UpdatedStoreOpts,
+    ?assertEqual(5000, maps:get(<<"capacity">>, LmdbStore)),
+    ?assertEqual(<<"cache-mainnet/lmdb">>, maps:get(<<"name">>, LmdbStore)),
+    ?assertEqual(hb_store_lmdb, maps:get(<<"store-module">>, LmdbStore)),
+    ?assertEqual(false, maps:is_key(<<"capacity">>, FsStore)),
+    ?assertEqual(hb_store_fs, maps:get(<<"store-module">>, FsStore)),
+    ?assertEqual(hb_store_gateway, maps:get(<<"store-module">>, GatewayStore)),
+    NestedStores = maps:get(<<"store">>, GatewayStore),
+    [NestedLmdbStore] = NestedStores,
+    ?assertEqual(5000, maps:get(<<"capacity">>, NestedLmdbStore)),
+    ?assertEqual(hb_store_lmdb, maps:get(<<"store-module">>, NestedLmdbStore)),
+    ?assertEqual(3, length(UpdatedStoreOpts)),
+    ?event({full_integration_test_passed, store_defaults_correctly_applied_through_complete_flow}).
\ No newline at end of file
diff --git a/src/hb_store_remote_node.erl b/src/hb_store_remote_node.erl
index f23a97e4a..e5b5b1cf9 100644
--- a/src/hb_store_remote_node.erl
+++ b/src/hb_store_remote_node.erl
@@ -5,6 +5,8 @@
 %%% to upload it to an Arweave bundler to ensure persistence, too.
 -module(hb_store_remote_node).
 -export([scope/1, type/2, read/2, write/3, make_link/3, resolve/2]).
+%%% Public utilities.
+-export([maybe_cache/2, maybe_cache/3]).
 -include("include/hb.hrl").
 -include_lib("eunit/include/eunit.hrl").
 
@@ -12,10 +14,9 @@
 %%
 %% For the remote store, the scope is always `remote'.
 %%
-%% @param Arg An arbitrary parameter (ignored).
+%% @param StoreOpts A message with the store options (ignored).
 %% @returns remote.
-scope(Arg) ->
-    ?event({remote_scope, {arg, Arg}}),
+scope(_StoreOpts) ->
     remote.
 
 %% @doc Resolve a key path in the remote store.
@@ -52,17 +53,69 @@ type(Opts = #{ <<"node">> := Node }, Key) ->
 %% @param Key The key to read.
 %% @returns {ok, Msg} on success or not_found if the key is missing.
 read(Opts = #{ <<"node">> := Node }, Key) ->
-    ?event({remote_read, {node, Node}, {key, Key}}),
-    case hb_http:get(Node, #{ <<"path">> => <<"/~cache@1.0/read">>, <<"target">> => Key }, Opts) of
+    ?event(store_remote_node, {executing_read, {node, Node}, {key, Key}}),
+    HTTPRes =
+        hb_http:get(
+            Node,
+            #{ <<"path">> => <<"/~cache@1.0/read">>, <<"target">> => Key },
+            Opts
+        ),
+    case HTTPRes of
         {ok, Res} ->
-            {ok, Msg} = hb_message:with_only_committed(Res),
-            ?event({read, {result, Msg}}),
+            % returning the whole response to get the test-key
+            {ok, Msg} = hb_message:with_only_committed(Res, Opts),
+            ?event(store_remote_node, {read_found, {result, Msg, response, Res}}),
+            maybe_cache(Opts, Msg, [Key]),
             {ok, Msg};
         {error, _Err} ->
-            ?event({read, {result, not_found}}),
+            ?event(store_remote_node, {read_not_found, {key, Key}}),
             not_found
     end.
 
+%% @doc Cache the data if the cache is enabled. The `local-store' option may
+%% either be `false' or a store definition to use as the local cache. Additional
+%% paths may be provided that should be linked to the data.
+maybe_cache(StoreOpts, Data) ->
+    maybe_cache(StoreOpts, Data, []).
+maybe_cache(StoreOpts, Data, Links) ->
+    ?event({maybe_cache, StoreOpts, Data}),
+    % Check if the local store is in our store options.
+    case hb_maps:get(<<"local-store">>, StoreOpts, false, StoreOpts) of
+        false ->
+            skipped;
+        Store ->
+            case hb_cache:write(Data, #{ store => Store }) of
+                {ok, RootPath} ->
+                    % Remove the base path from the links.
+                    LinksWithoutRootPath =
+                        lists:filter(
+                            fun(Link) -> Link /= RootPath end,
+                            Links
+                        ),
+                    ?event(store_remote_node, cached_received),
+                    LinkResults =
+                        lists:filter(
+                            fun(Link) ->
+                                hb_store:make_link(Store, RootPath, Link) == false
+                            end,
+                            LinksWithoutRootPath
+                        ),
+                    ?event(store_remote_node,
+                        {linked_cached,
+                            {failed_links, LinkResults}
+                        }
+                    ),
+                    case LinkResults of
+                        [] -> ok;
+                        _ -> {failed_links, LinkResults}
+                    end;
+                {error, Err} ->
+                    ?event(store_remote_node, error_on_local_cache_write),
+                    ?event(warning, {error_caching_remote_node_data, Err}),
+                    {error, Err}
+            end
+    end.
+
 %% @doc Write a key to the remote node.
 %%
 %% Constructs an HTTP POST write request. If a wallet is provided,
@@ -85,7 +138,7 @@ write(Opts = #{ <<"node">> := Node }, Key, Value) ->
     case hb_http:post(Node, SignedMsg, Opts) of
         {ok, Response} ->
             Status = hb_ao:get(<<"status">>, Response, 0, #{}),
-            ?event({write, {response, Response}}),
+            ?event(store_remote_node, {write_completed, {response, Response}}),
             case Status of
                 200 -> ok;
                 _ -> {error, {unexpected_status, Status}}
@@ -114,13 +167,13 @@ make_link(Opts = #{ <<"node">> := Node }, Source, Destination) ->
     case hb_http:post(Node, SignedMsg, Opts) of
         {ok, Response} ->
             Status = hb_ao:get(<<"status">>, Response, 0, #{}),
-            ?event({make_remote_link, {response, Response}}),
+            ?event(store_remote_node, {make_link_completed, {response, Response}}),
             case Status of
                 200 -> ok;
                 _ -> {error, {unexpected_status, Status}}
             end;
         {error, Err} ->
-            ?event({make_remote_link, {error, Err}}),
+            ?event(store_remote_node, {make_link_error, {error, Err}}),
             {error, Err}
     end.
 
@@ -134,7 +187,7 @@ read_test() ->
     rand:seed(default),
     LocalStore = #{ 
 		<<"store-module">> => hb_store_fs,
-		<<"prefix">> => <<"cache-mainnet">>
+		<<"name">> => <<"cache-mainnet">>
 	},
     hb_store:reset(LocalStore),
     M = #{ <<"test-key">> => Rand = rand:uniform(1337) },
@@ -155,4 +208,4 @@ read_test() ->
 		#{ <<"store-module">> => hb_store_remote_node, <<"node">> => Node }
 	],
     {ok, RetrievedMsg} = hb_cache:read(ID, #{ store => RemoteStore }),
-    ?assertMatch(#{ <<"test-key">> := Rand }, RetrievedMsg).
+    ?assertMatch(#{ <<"test-key">> := Rand }, hb_cache:ensure_all_loaded(RetrievedMsg)).
\ No newline at end of file
diff --git a/src/hb_store_rocksdb.erl b/src/hb_store_rocksdb.erl
index 0f733a33e..e461a38c6 100644
--- a/src/hb_store_rocksdb.erl
+++ b/src/hb_store_rocksdb.erl
@@ -32,7 +32,7 @@ enabled() -> false.
 
 -ifdef(ENABLE_ROCKSDB).
 %% @doc Start the RocksDB store.
-start_link(#{ <<"store-module">> := hb_store_rocksdb, <<"prefix">> := Dir}) ->
+start_link(#{ <<"store-module">> := hb_store_rocksdb, <<"name">> := Dir}) ->
     ?event(rocksdb, {starting, Dir}),
     application:ensure_all_started(rocksdb),
     gen_server:start_link({local, ?MODULE}, ?MODULE, Dir, []);
@@ -57,7 +57,7 @@ start_link(_Opts) -> ignore.
 
 -endif.
 
-start(Opts = #{ <<"store-module">> := hb_store_rocksdb, <<"prefix">> := _Dir}) ->
+start(Opts = #{ <<"store-module">> := hb_store_rocksdb, <<"name">> := _Dir}) ->
     start_link(Opts);
 start(Opts) ->
     start_link(Opts).
@@ -178,7 +178,7 @@ type(Opts, RawKey) ->
     Opts :: any(),
     Key :: binary(),
     Result :: ok | {error, already_added}.
-make_group(#{ <<"prefix">> := _DataDir }, Key) ->
+make_group(#{ <<"name">> := _DataDir }, Key) ->
     gen_server:call(?MODULE, {make_group, Key}, ?TIMEOUT);
 make_group(_Opts, Key) ->
     gen_server:call(?MODULE, {make_group, Key}, ?TIMEOUT).
@@ -402,7 +402,7 @@ get_or_start_server() ->
     % Store = lists:keyfind(hb_store_rocksdb2, 1, hb_store:test_stores()),
     Opts = #{
         <<"store-module">> => hb_store_rocksdb,
-        <<"prefix">> => <<"cache-TEST/rocksdb">>
+        <<"name">> => <<"cache-TEST/rocksdb">>
     },
     case start_link(Opts) of
         {ok, Pid} ->
diff --git a/src/hb_structured_fields.erl b/src/hb_structured_fields.erl
index fb1f607c1..7fc202639 100644
--- a/src/hb_structured_fields.erl
+++ b/src/hb_structured_fields.erl
@@ -18,6 +18,7 @@
 %%% Boolean: boolean()
 -module(hb_structured_fields).
 -export([parse_dictionary/1, parse_item/1, parse_list/1, parse_bare_item/1]).
+-export([parse_binary/1]).
 -export([dictionary/1, item/1, list/1, bare_item/1, from_bare_item/1]).
 -export([to_dictionary/1, to_list/1, to_item/1, to_item/2]).
 -include_lib("eunit/include/eunit.hrl").
@@ -152,7 +153,12 @@ from_bare_item(BareItem) ->
                 )
             );
         {string, S} -> S;
-        {token, T} -> binary_to_existing_atom(T);
+        {token, T} ->
+            try binary_to_existing_atom(T) of
+                Atom -> Atom
+            catch
+                error:badarg -> T
+            end;
         {binary, B} -> B
     end.
 
@@ -165,7 +171,8 @@ key_to_binary(Key) -> iolist_to_binary(Key).
 parse_dictionary(<<>>) ->
     [];
 parse_dictionary(<<C, R/bits>>) when ?IS_ALPHA(C)
-        or ?IS_DIGIT(C) or (C =:= $*) or (C =:= $%) or (C =:= $_) or (C =:= $-) ->
+        or ?IS_DIGIT(C) or (C =:= $*) or (C =:= $%) or (C =:= $_) or (C =:= $-) 
+        or (C =:= $.) ->
     parse_dict_key(R, [], <<C>>).
 
 parse_dict_key(<<$=, $(, R0/bits>>, Acc, K) ->
@@ -366,6 +373,8 @@ parse_token(R, Acc) ->
     {{token, Acc}, R}.
 
 %% @doc Parse a byte sequence binary.
+parse_binary(Bin) when is_binary(Bin) ->
+    parse_binary(Bin, <<>>).
 parse_binary(<<$:, R/bits>>, Acc) ->
     {{binary, base64:decode(Acc)}, R};
 parse_binary(<<C, R/bits>>, Acc) when ?IS_ALPHANUM(C) or (C =:= $+) or (C =:= $/) or (C =:= $=) ->
@@ -377,20 +386,20 @@ parse_struct_hd_test_() ->
     lists:flatten([
         begin
             {ok, JSON} = file:read_file(File),
-            Tests = jsx:decode(JSON, [return_maps]),
+            Tests = json:decode(JSON),
             [
                 {iolist_to_binary(io_lib:format("~s: ~s", [filename:basename(File), Name])), fun() ->
                     %% The implementation is strict. We fail whenever we can.
-                    CanFail = maps:get(<<"can_fail">>, Test, false),
-                    MustFail = maps:get(<<"must_fail">>, Test, false),
+                    CanFail = hb_maps:get(<<"can_fail">>, Test, false),
+                    MustFail = hb_maps:get(<<"must_fail">>, Test, false),
                     io:format(
                         "must fail ~p~nexpected json ~0p~n",
-                        [MustFail, maps:get(<<"expected">>, Test, undefined)]
+                        [MustFail, hb_maps:get(<<"expected">>, Test, undefined)]
                     ),
                     Expected =
                         case MustFail of
                             true -> undefined;
-                            false -> expected_to_term(maps:get(<<"expected">>, Test))
+                            false -> expected_to_term(hb_maps:get(<<"expected">>, Test))
                         end,
                     io:format("expected term: ~0p", [Expected]),
                     Raw = raw_to_binary(Raw0),
@@ -638,41 +647,11 @@ params(Params) ->
             {Key, true} -> [$;, Key];
             {Key, Value} -> [$;, Key, $=, bare_item(Value)]
         end
-    || Param <- Params
+    ||
+        Param <- Params
     ].
 
--ifdef(TEST).
-struct_hd_identity_test_() ->
-    Files = filelib:wildcard("deps/structured-header-tests/*.json"),
-    lists:flatten([
-        begin
-            {ok, JSON} = file:read_file(File),
-            Tests = jsx:decode(JSON, [return_maps]),
-            [
-                {iolist_to_binary(io_lib:format("~s: ~s", [filename:basename(File), Name])), fun() ->
-                    io:format("expected json ~0p~n", [Expected0]),
-                    Expected = expected_to_term(Expected0),
-                    io:format("expected term: ~0p", [Expected]),
-                    case HeaderType of
-                        <<"dictionary">> ->
-                            Expected = parse_dictionary(iolist_to_binary(dictionary(Expected)));
-                        <<"item">> ->
-                            Expected = parse_item(iolist_to_binary(item(Expected)));
-                        <<"list">> ->
-                            Expected = parse_list(iolist_to_binary(list(Expected)))
-                    end
-                end}
-            || #{
-                    <<"name">> := Name,
-                    <<"header_type">> := HeaderType,
-                    %% We only run tests that must not fail.
-                    <<"expected">> := Expected0
-                } <- Tests
-            ]
-        end
-    || File <- Files
-    ]).
--endif.
+%%% Tests
 
 to_dictionary_test() ->
     {ok, SfDictionary} = to_dictionary(#{
@@ -696,7 +675,12 @@ to_dictionary_test() ->
         lists:keyfind(<<"fizz">>, 1, SfDictionary)    
     ),
     ?assertEqual(
-        {<<"item-with">>, {item, {string,<<"params">>}, [{<<"first">>, {token,<<"param">>}}, {<<"another">>, true}]}},
+        {<<"item-with">>,
+            {item,
+                {string,<<"params">>},
+                [{<<"first">>, {token,<<"param">>}}, {<<"another">>, true}]
+            }
+        },
         lists:keyfind(<<"item-with">>, 1, SfDictionary)    
     ),
     ?assertEqual(
@@ -716,15 +700,37 @@ to_dictionary_test() ->
         lists:keyfind(<<"empty">>, 1, SfDictionary)
     ),
     ?assertEqual(
-        {<<"inner">>, {list, [{item, {string, <<"a">>}, []}, {item, {token, <<"b">>}, []}, {item, true, []}, {item, 3, []}], []}},
+        {
+            <<"inner">>,
+            {
+                list,
+                [
+                    {item, {string, <<"a">>}, []},
+                    {item, {token, <<"b">>}, []},
+                    {item, true, []},
+                    {item, 3, []}
+                ],
+                []
+            }
+        },
         lists:keyfind(<<"inner">>, 1, SfDictionary)
     ),
     ?assertEqual(
-        {<<"inner_with_params">>, {list , [{item, 1, []}, {item, 2, []}], [{<<"first">>, {token, <<"param">>}}]}},
+        {<<"inner_with_params">>,
+            {list,
+                [{item, 1, []}, {item, 2, []}],
+                [{<<"first">>, {token, <<"param">>}}]
+            }
+        },
         lists:keyfind(<<"inner_with_params">>, 1, SfDictionary)
     ),
     ?assertEqual(
-       {<<"inner_inner_params">>, {list, [{item, 1, [{<<"heres">>, {string, <<"one">>}}]}, {item, 2, []}], []}},
+       {<<"inner_inner_params">>,
+            {list,
+                [{item, 1, [{<<"heres">>, {string, <<"one">>}}]}, {item, 2, []}],
+                []
+            }
+        },
         lists:keyfind(<<"inner_inner_params">>, 1, SfDictionary)
     ),
     dictionary(SfDictionary).
@@ -752,13 +758,22 @@ to_item_test() ->
 
 to_list_test() ->
     ?assertEqual(
-        to_list([1,2,<<"three">>, [4, <<"five">>], {list, [6, <<"seven">>], [{first, param}]}]),
+        to_list(
+            [1, 2, <<"three">>, [4, <<"five">>],
+                {list, [6, <<"seven">>],
+                    [{<<"first">>, {token, <<"param">>}}]
+                }
+            ]
+        ),
         {ok, [
             {item, 1, []},
             {item, 2, []},
             {item, {string, <<"three">>}, []},
             {list, [{ item, 4, []}, {item, {string, <<"five">>}, []}], []},
-            {list, [{ item, 6, []}, {item, {string, <<"seven">>}, []}], [{<<"first">>, {token, <<"param">>}}]}
+            {list,
+                [{ item, 6, []}, {item, {string, <<"seven">>}, []}],
+                [{<<"first">>, {token, <<"param">>}}]
+            }
         ]}
     ),
     ok.
diff --git a/src/hb_test_utils.erl b/src/hb_test_utils.erl
index 1148ae365..4b360a02b 100644
--- a/src/hb_test_utils.erl
+++ b/src/hb_test_utils.erl
@@ -1,9 +1,36 @@
-%%% @doc Simple utilities for testing HyperBEAM.
+%%% @doc Simple utilities for testing HyperBEAM. Includes functions for 
+%%% generating isolated (fresh) test stores, running suites of tests with
+%%% differing options, as well as executing and reporting benchmarks.
 -module(hb_test_utils).
--export([suite_with_opts/2, run/4]).
+-export([suite_with_opts/2, run/4, assert_throws/4]).
+-export([test_store/0, test_store/1, test_store/2]).
+-export([benchmark/1, benchmark/2, benchmark/3, benchmark_iterations/2]).
+-export([benchmark_print/2, benchmark_print/3, benchmark_print/4]).
+-export([compare_events/3, compare_events/4, compare_events/5]).
 -include("include/hb.hrl").
 -include_lib("eunit/include/eunit.hrl").
 
+%%% The number of seconds to run a benchmark for when no time is specified.
+-define(DEFAULT_BENCHMARK_TIME, 1).
+
+%% @doc Generate a new, unique test store as an isolated context for an execution.
+test_store() ->
+    test_store(maps:get(<<"store-module">>, hd(hb_opts:get(store)))).
+test_store(Mod) ->
+    test_store(Mod, <<"default">>).
+test_store(Mod, Tag) ->
+    TestDir =
+        <<
+            "cache-TEST/run-",
+            Tag/binary, "-",
+            (integer_to_binary(erlang:system_time(millisecond)))/binary
+        >>,
+    % Wait a tiny interval to ensure that any further tests will get their own
+    % directory.
+    timer:sleep(1),
+    filelib:ensure_dir(binary_to_list(TestDir)),
+    #{ <<"store-module">> => Mod, <<"name">> => TestDir }.
+
 %% @doc Run each test in a suite with each set of options. Start and reset
 %% the store(s) for each test. Expects suites to be a list of tuples with
 %% the test name, description, and test function.
@@ -14,20 +41,30 @@ suite_with_opts(Suite, OptsList) ->
     lists:filtermap(
         fun(OptSpec = #{ name := _Name, opts := Opts, desc := ODesc}) ->
             Store = hb_opts:get(store, hb_opts:get(store), Opts),
-            Skip = maps:get(skip, OptSpec, []),
+            Skip = hb_maps:get(skip, OptSpec, [], Opts),
             case satisfies_requirements(OptSpec) of
                 true ->
                     {true, {foreach,
                         fun() ->
                             ?event({starting, Store}),
+                            % Create and set a random server ID for the test
+                            % process.
+                            hb_http_server:set_proc_server_id(
+                                hb_util:human_id(crypto:strong_rand_bytes(32))
+                            ),
+                            hb_store:reset(Store),
                             hb_store:start(Store)
                         end,
                         fun(_) ->
-                            %hb_store:reset(Store)
+                            hb_store:reset(Store),
                             ok
                         end,
                         [
-                            {ODesc ++ ": " ++ TestDesc, fun() -> Test(Opts) end}
+                            {
+                                hb_util:list(ODesc)
+                                    ++ ": "
+                                    ++ hb_util:list(TestDesc),
+                                fun() -> Test(Opts) end}
                         ||
                             {TestAtom, TestDesc, Test} <- Suite, 
                                 not lists:member(TestAtom, Skip)
@@ -43,7 +80,7 @@ suite_with_opts(Suite, OptsList) ->
 %% Requirements is a list of atoms, each corresponding to a module that must
 %% return true if it exposes an `enabled/0' function.
 satisfies_requirements(Requirements) when is_map(Requirements) ->
-    satisfies_requirements(maps:get(requires, Requirements, []));
+    satisfies_requirements(hb_maps:get(requires, Requirements, []));
 satisfies_requirements(Requirements) ->
     lists:all(
         fun(Req) ->
@@ -63,11 +100,157 @@ satisfies_requirements(Requirements) ->
         Requirements
     ).
 
+%% @doc Find the options from a list of options by name.
+opts_from_list(OptsName, OptsList) ->
+    hd([ O || #{ name := OName, opts := O } <- OptsList, OName == OptsName ]).
+
 %% Run a single test with a given set of options.
 run(Name, OptsName, Suite, OptsList) ->
     {_, _, Test} = lists:keyfind(Name, 1, Suite),
-    [Opts|_] =
-        [ O || #{ name := OName, opts := O } <- OptsList,
-            OName == OptsName
-        ],
-    Test(Opts).
\ No newline at end of file
+    Test(opts_from_list(OptsName, OptsList)).
+
+%% @doc Compares the events generated by executing a test/function with two 
+%% different sets of options.
+compare_events(Fun, Opts1, Opts2) ->
+    hb_store:reset(hb_opts:get(store, hb_opts:get(store), Opts1)),
+    hb_store:write(
+        hb_opts:get(store, hb_opts:get(store), Opts1),
+        <<"test">>,
+        <<"test">>
+    ),
+    {EventsSample1, _Res2} = hb_event:diff(
+        fun() ->
+            Fun(Opts1)
+        end
+    ),
+    hb_store:reset(hb_opts:get(store, hb_opts:get(store), Opts1)),
+    hb_store:reset(hb_opts:get(store, hb_opts:get(store), Opts2)),
+    {EventsSample2, _Res} = hb_event:diff(
+        fun() ->
+            Fun(Opts2)
+        end
+    ),
+    hb_store:reset(hb_opts:get(store, hb_opts:get(store), Opts2)),
+    EventsDiff = hb_message:diff(EventsSample1, EventsSample2, #{}),
+    ?event(
+        debug_perf,
+        {events,
+            {sample1, EventsSample1},
+            {sample2, EventsSample2},
+            {events_diff, EventsDiff}
+        }
+    ),
+    EventsDiff.
+compare_events(Fun, OptsName1, OptsName2, OptsList) ->
+    compare_events(
+        Fun,
+        opts_from_list(OptsName1, OptsList),
+        opts_from_list(OptsName2, OptsList)
+    ).
+compare_events(Name, OptsName1, OptsName2, Suite, OptsList) ->
+    {_, _, Test} = lists:keyfind(Name, 1, Suite),
+    compare_events(
+        Test,
+        opts_from_list(OptsName1, OptsList),
+        opts_from_list(OptsName2, OptsList)
+    ).
+
+%% @doc Assert that a function throws an expected exception. Needed to work around some
+%% limitations in ?assertException (e.g. no way to attach an error message to the failure)
+assert_throws(Fun, Args, ExpectedException, Label) ->
+    Error = try 
+        apply(Fun, Args),
+        failed_to_throw
+    catch
+        error:ExpectedException -> expected_exception;
+        ExpectedException -> expected_exception;
+        error:Other -> {wrong_exception, Other};
+        Other -> {wrong_exception, Other}
+    end,
+    ?assertEqual(expected_exception, Error, Label).
+
+%% @doc Run a function as many times as possible in a given amount of time.
+benchmark(Fun) ->
+    benchmark(Fun, ?DEFAULT_BENCHMARK_TIME).
+benchmark(Fun, TLen) ->
+    T0 = erlang:system_time(millisecond),
+    hb_util:until(
+        fun() -> erlang:system_time(millisecond) - T0 > (TLen * 1000) end,
+        Fun,
+        0
+    ).
+
+%% @doc Return the amount of time required to execute N iterations of a function
+%% as a fraction of a second.
+benchmark_iterations(Fun, N) ->
+    {Time, _} = timer:tc(
+        fun() ->
+            lists:foreach(
+                fun(I) -> Fun(I) end,
+                lists:seq(1, N)
+            )
+        end
+    ),
+    Time / 1_000_000.
+
+%% @doc Run multiple instances of a function in parallel for a given amount of time.
+benchmark(Fun, TLen, Procs) ->
+    Parent = self(),
+    receive _ -> worker_synchronized end,
+    StartWorker =
+        fun(_) ->
+            Ref = make_ref(),
+            spawn_link(fun() ->
+                Count = benchmark(Fun, TLen),
+                Parent ! {work_complete, Ref, Count}
+            end),
+            Ref
+        end,
+    CollectRes =
+        fun(R) ->
+            receive
+                {work_complete, R, Count} ->
+                    %?event(benchmark, {work_complete, R, Count}),
+                    Count
+            end
+        end,
+    Refs = lists:map(StartWorker, lists:seq(1, Procs)),
+    lists:sum(lists:map(CollectRes, Refs)).
+
+%% @doc Print benchmark results in a human-readable format that EUnit writes to
+%% the console. Takes a `verb` as a string and an `iterations` count (returned
+%% by the benchmark function), as well as optionally a `noun` to refer to the
+%% objects in the benchmark, and a `time` in seconds. If `time' is not
+%% provided, it defaults to the value of `?DEFAULT_BENCHMARK_TIME'.
+benchmark_print(Verb, Iterations) ->
+    benchmark_print(Verb, Iterations, ?DEFAULT_BENCHMARK_TIME).
+benchmark_print(Verb, Iterations, Time) when is_integer(Iterations) ->
+    hb_format:eunit_print(
+        "~s ~s in ~s (~s/s)",
+        [
+            Verb,
+            hb_util:human_int(Iterations),
+            format_time(Time),
+            hb_util:human_int(Iterations / Time)
+        ]
+    );
+benchmark_print(Verb, Noun, Iterations) ->
+    benchmark_print(Verb, Noun, Iterations, ?DEFAULT_BENCHMARK_TIME).
+benchmark_print(Verb, Noun, Iterations, Time) ->
+    hb_format:eunit_print(
+        "~s ~s ~s in ~s (~s ~s/s)",
+        [
+            Verb,
+            hb_util:human_int(Iterations),
+            Noun,
+            format_time(Time),
+            hb_util:human_int(Iterations / Time),
+            Noun
+        ]
+    ).
+
+%% @doc Format a time in human-readable format. Takes arguments in seconds.
+format_time(Time) when is_integer(Time) ->
+    hb_util:human_int(Time) ++ "s";
+format_time(Time) ->
+    hb_util:human_int(Time * 1000) ++ "ms".
\ No newline at end of file
diff --git a/src/hb_util.erl b/src/hb_util.erl
index 98cab7cf5..e3485ab1e 100644
--- a/src/hb_util.erl
+++ b/src/hb_util.erl
@@ -1,26 +1,33 @@
 %% @doc A collection of utility functions for building with HyperBEAM.
 -module(hb_util).
--export([int/1, float/1, atom/1, bin/1, list/1]).
--export([id/1, id/2, native_id/1, human_id/1, short_id/1, human_int/1, to_hex/1]).
--export([key_to_atom/2]).
+-export([int/1, float/1, atom/1, bin/1, list/1, map/1]).
+-export([ceil_int/2, floor_int/2]).
+-export([id/1, id/2, native_id/1, human_id/1, human_int/1, to_hex/1]).
+-export([key_to_atom/1, key_to_atom/2, binary_to_strings/1]).
 -export([encode/1, decode/1, safe_encode/1, safe_decode/1]).
 -export([find_value/2, find_value/3]).
--export([deep_merge/2, number/1, list_to_numbered_map/1]).
--export([is_ordered_list/1, message_to_ordered_list/1, message_to_ordered_list/2]).
--export([is_string_list/1, to_sorted_list/1, to_sorted_keys/1]).
+-export([deep_merge/3, deep_set/4, deep_get/3, deep_get/4]).
+-export([number/1, list_to_numbered_message/1]).
+-export([find_target_path/2, template_matches/3]).
+-export([is_ordered_list/2, message_to_ordered_list/1, message_to_ordered_list/2]).
+-export([numbered_keys_to_list/2]).
+-export([is_string_list/1, list_replace/3, list_without/2, list_with/2]).
+-export([to_sorted_list/1, to_sorted_list/2, to_sorted_keys/1, to_sorted_keys/2]).
 -export([hd/1, hd/2, hd/3]).
 -export([remove_common/2, to_lower/1]).
 -export([maybe_throw/2]).
--export([format_indented/2, format_indented/3, format_binary/1]).
--export([format_maybe_multiline/2, remove_trailing_noise/2]).
--export([debug_print/4, debug_fmt/1, debug_fmt/2, eunit_print/2]).
--export([print_trace/4, trace_macro_helper/5, print_trace_short/4]).
--export([format_trace/1, format_trace_short/1]).
 -export([is_hb_module/1, is_hb_module/2, all_hb_modules/0]).
 -export([ok/1, ok/2, until/1, until/2, until/3]).
 -export([count/2, mean/1, stddev/1, variance/1, weighted_random/1]).
+-export([unique/1]).
+-export([split_depth_string_aware/2, split_depth_string_aware_single/2]).
+-export([unquote/1, split_escaped_single/2]).
+-export([check_size/2, check_value/2, check_type/2, ok_or_throw/3]).
+-export([all_atoms/0, binary_is_atom/1]).
+-export([lower_case_key_map/2]).
 -include("include/hb.hrl").
 
+
 %%% Simple type coercion functions, useful for quickly turning inputs from the
 %%% HTTP API into the correct types for the HyperBEAM runtime, if they are not
 %%% annotated by the user.
@@ -63,12 +70,29 @@ bin(Value) when is_list(Value) ->
 bin(Value) when is_binary(Value) ->
     Value.
 
-%% @doc Coerce a value to a list.
+%% @doc Coerce a value to a string list.
 list(Value) when is_binary(Value) ->
     binary_to_list(Value);
 list(Value) when is_list(Value) -> Value;
 list(Value) when is_atom(Value) -> atom_to_list(Value).
 
+%% @doc Ensure that a value is a map. Only supports maps and lists of key-value
+%% pairs.
+map(Value) when is_list(Value) ->
+    maps:from_list(Value);
+map(Value) when is_map(Value) ->
+    Value.
+
+%% @doc: rounds IntValue up to the nearest multiple of Nearest.
+%% Rounds up even if IntValue is already a multiple of Nearest.
+ceil_int(IntValue, Nearest) ->
+	IntValue - (IntValue rem Nearest) + Nearest.
+
+%% @doc: rounds IntValue down to the nearest multiple of Nearest.
+%% Doesn't change IntValue if it's already a multiple of Nearest.
+floor_int(IntValue, Nearest) ->
+	IntValue - (IntValue rem Nearest).
+
 %% @doc Unwrap a tuple of the form `{ok, Value}', or throw/return, depending on
 %% the value of the `error_strategy' option.
 ok(Value) -> ok(Value, #{}).
@@ -90,7 +114,7 @@ until(Condition, Count) ->
 until(Condition, Fun, Count) ->
     case Condition() of
         false ->
-            case apply(Fun, hb_ao:truncate_args(Fun, [Count])) of
+            case apply(Fun, hb_ao_device:truncate_args(Fun, [Count])) of
                 {count, AddToCount} ->
                     until(Condition, Fun, Count + AddToCount);
                 _ ->
@@ -123,21 +147,28 @@ is_string_list(MaybeString) ->
 
 %% @doc Given a map or KVList, return a deterministically sorted list of its
 %% key-value pairs.
-to_sorted_list(Msg) when is_map(Msg) ->
-    to_sorted_list(maps:to_list(Msg));
-to_sorted_list(Msg) when is_list(Msg) ->
-    lists:sort(fun({Key1, _}, {Key2, _}) -> Key1 < Key2 end, Msg).
+to_sorted_list(Msg) ->
+    to_sorted_list(Msg, #{}).
+to_sorted_list(Msg, Opts) when is_map(Msg) ->
+	to_sorted_list(hb_maps:to_list(Msg, Opts), Opts);
+to_sorted_list(Msg = [{_Key, _} | _], _Opts) when is_list(Msg) ->
+	lists:sort(fun({Key1, _}, {Key2, _}) -> Key1 < Key2 end, Msg);
+to_sorted_list(Msg, _Opts) when is_list(Msg) ->
+	lists:sort(fun(Key1, Key2) -> Key1 < Key2 end, Msg).
 
 %% @doc Given a map or KVList, return a deterministically ordered list of its keys.
-to_sorted_keys(Msg) when is_map(Msg) ->
-    to_sorted_keys(maps:keys(Msg));
-to_sorted_keys(Msg) when is_list(Msg) ->
+to_sorted_keys(Msg) ->
+	to_sorted_keys(Msg, #{}).
+to_sorted_keys(Msg, Opts) when is_map(Msg) ->
+    to_sorted_keys(hb_maps:keys(Msg, Opts), Opts);
+to_sorted_keys(Msg, _Opts) when is_list(Msg) ->
     lists:sort(fun(Key1, Key2) -> Key1 < Key2 end, Msg).
 
 %% @doc Convert keys in a map to atoms, lowering `-' to `_'.
+key_to_atom(Key) -> key_to_atom(Key, existing).
 key_to_atom(Key, _Mode) when is_atom(Key) -> Key;
 key_to_atom(Key, Mode) ->
-    WithoutDashes = binary:replace(Key, <<"-">>, <<"_">>, [global]),
+    WithoutDashes = to_lower(binary:replace(Key, <<"-">>, <<"_">>, [global])),
     case Mode of
         new_atoms -> binary_to_atom(WithoutDashes, utf8);
         _ -> binary_to_existing_atom(WithoutDashes, utf8)
@@ -150,7 +181,9 @@ native_id(Bin) when is_binary(Bin) andalso byte_size(Bin) == 43 ->
 native_id(Bin) when is_binary(Bin) andalso byte_size(Bin) == 32 ->
     Bin;
 native_id(Bin) when is_binary(Bin) andalso byte_size(Bin) == 42 ->
-    Bin.
+    Bin;
+native_id(Wallet = {_Priv, _Pub}) ->
+    native_id(ar_wallet:to_address(Wallet)).
 
 %% @doc Convert a native binary ID to a human readable ID. If the ID is already
 %% a human readable ID, it is returned as is. If it is an ethereum address, it
@@ -160,40 +193,19 @@ human_id(Bin) when is_binary(Bin) andalso byte_size(Bin) == 32 ->
 human_id(Bin) when is_binary(Bin) andalso byte_size(Bin) == 43 ->
     Bin;
 human_id(Bin) when is_binary(Bin) andalso byte_size(Bin) == 42 ->
-    Bin.
+    Bin;
+human_id(Wallet = {_Priv, _Pub}) ->
+    human_id(ar_wallet:to_address(Wallet)).
 
-%% @doc Return a short ID for the different types of IDs used in AO-Core.
-short_id(Bin) when is_binary(Bin) andalso byte_size(Bin) == 32 ->
-    short_id(human_id(Bin));
-short_id(Bin) when is_binary(Bin) andalso byte_size(Bin) == 43 ->
-    << FirstTag:5/binary, _:33/binary, LastTag:5/binary >> = Bin,
-    << FirstTag/binary, "..", LastTag/binary >>;
-short_id(Bin) when byte_size(Bin) > 43 andalso byte_size(Bin) < 100 ->
-    case binary:split(Bin, <<"/">>, [trim_all, global]) of
-        [First, Second] when byte_size(Second) == 43 ->
-            FirstEnc = short_id(First),
-            SecondEnc = short_id(Second),
-            << FirstEnc/binary, "/", SecondEnc/binary >>;
-        [First, Key] ->
-            FirstEnc = short_id(First),
-            << FirstEnc/binary, "/", Key/binary >>;
-        _ ->
-            Bin
-    end;
-short_id(<< "/", SingleElemHashpath/binary >>) ->
-    Enc = short_id(SingleElemHashpath),
-    if is_binary(Enc) -> << "/", Enc/binary >>;
-    true -> undefined
-    end;
-short_id(Key) when byte_size(Key) < 43 -> Key;
-short_id(_) -> undefined.
-
-%% @doc Determine whether a binary is human-readable.
-is_human_binary(Bin) when is_binary(Bin) ->
-    case unicode:characters_to_binary(Bin) of
-        {error, _, _} -> false;
-        _ -> true
-    end.
+
+%% @doc Add `,' characters to a number every 3 digits to make it human readable.
+human_int(Float) when is_float(Float) ->
+    human_int(erlang:round(Float));
+human_int(Int) ->
+    lists:reverse(add_commas(lists:reverse(integer_to_list(Int)))).
+
+add_commas([A,B,C,Z|Rest]) -> [A,B,C,$,|add_commas([Z|Rest])];
+add_commas(List) -> List.
 
 %% @doc Encode a binary to URL safe base64 binary string.
 encode(Bin) ->
@@ -217,8 +229,7 @@ safe_decode(E) ->
         D = decode(E),
         {ok, D}
     catch
-        _:_ ->
-        {error, invalid}
+        _:_ -> {error, invalid}
     end.
 
 %% @doc Convert a binary to a hex string. Do not use this for anything other than
@@ -232,23 +243,82 @@ to_hex(Bin) when is_binary(Bin) ->
     ).
 
 %% @doc Deep merge two maps, recursively merging nested maps.
-deep_merge(Map1, Map2) when is_map(Map1), is_map(Map2) ->
-    maps:fold(
+deep_merge(Map1, Map2, Opts) when is_map(Map1), is_map(Map2) ->
+    hb_maps:fold(
         fun(Key, Value2, AccMap) ->
-            case maps:find(Key, AccMap) of
-                {ok, Value1} when is_map(Value1), is_map(Value2) ->
+            case deep_get(Key, AccMap, Opts) of
+                Value1 when is_map(Value1), is_map(Value2) ->
                     % Both values are maps, recursively merge them
-                    AccMap#{Key => deep_merge(Value1, Value2)};
+                    deep_set(Key, deep_merge(Value1, Value2, Opts), AccMap, Opts);
                 _ ->
                     % Either the key doesn't exist in Map1 or at least one of 
                     % the values isn't a map. Simply use the value from Map2
-                    AccMap#{ Key => Value2 }
+                    deep_set(Key, Value2, AccMap, Opts)
             end
         end,
         Map1,
-        Map2
+        Map2,
+		Opts
     ).
 
+%% @doc Set a deep value in a message by its path, _assuming all messages are
+%% `device: message@1.0`_.
+deep_set(_Path, undefined, Msg, _Opts) -> Msg;
+deep_set(Path, Value, Msg, Opts) when not is_list(Path) ->
+    deep_set(hb_path:term_to_path_parts(Path, Opts), Value, Msg, Opts);
+deep_set([Key], unset, Msg, Opts) ->
+    hb_maps:remove(Key, Msg, Opts);
+deep_set([Key], Value, Msg, Opts) ->
+    case hb_maps:get(Key, Msg, not_found, Opts) of
+        ExistingMap when is_map(ExistingMap) andalso is_map(Value) ->
+            % If both are maps, merge them
+            Msg#{ Key => hb_maps:merge(ExistingMap, Value, Opts) };
+        _ ->
+            Msg#{ Key => Value }
+    end;
+deep_set([Key|Rest], Value, Map, Opts) ->
+    SubMap = hb_maps:get(Key, Map, #{}, Opts),
+    hb_maps:put(Key, deep_set(Rest, Value, SubMap, Opts), Map, Opts).
+
+%% @doc Get a deep value from a message.
+deep_get(Path, Msg, Opts) -> deep_get(Path, Msg, not_found, Opts).
+deep_get(Path, Msg, Default, Opts) when not is_list(Path) ->
+    deep_get(hb_path:term_to_path_parts(Path, Opts), Msg, Default, Opts);
+deep_get([Key], Msg, Default, Opts) ->
+    case hb_maps:find(Key, Msg, Opts) of
+        {ok, Value} -> Value;
+        error -> Default
+    end;
+deep_get([Key|Rest], Msg, Default, Opts) ->
+    case hb_maps:find(Key, Msg, Opts) of
+        {ok, DeepMsg} when is_map(DeepMsg) ->
+            deep_get(Rest, DeepMsg, Default, Opts);
+        error -> Default
+    end.
+
+%% @doc Find the target path to route for a request message.
+find_target_path(Msg, Opts) ->
+    case hb_ao:get(<<"route-path">>, Msg, not_found, Opts) of
+        not_found ->
+            ?event({find_target_path, {msg, Msg}, not_found}),
+            hb_ao:get(<<"path">>, Msg, no_path, Opts);
+        RoutePath -> RoutePath
+    end.
+
+%% @doc Check if a message matches a given template.
+%% Templates can be either:
+%% - A map: Uses structural matching against the message
+%% - A binary regex: Matches against the message's target path
+%% Returns true/false for map templates, or regex match result for binary templates.
+template_matches(ToMatch, Template, _Opts) when is_map(Template) ->
+    case hb_message:match(Template, ToMatch, primary) of
+        {mismatch, value, _Key, _Val1, _Val2} -> false;
+        Match -> Match
+    end;
+template_matches(ToMatch, Regex, Opts) when is_binary(Regex) ->
+    MsgPath = find_target_path(ToMatch, Opts),
+    hb_path:regex_matches(MsgPath, Regex).
+
 %% @doc Label a list of elements with a number.
 number(List) ->
     lists:map(
@@ -257,27 +327,72 @@ number(List) ->
     ).
 
 %% @doc Convert a list of elements to a map with numbered keys.
-list_to_numbered_map(List) ->
-    maps:from_list(number(List)).
+list_to_numbered_message(Msg) when is_map(Msg) ->
+    case is_ordered_list(Msg, #{}) of
+        true -> Msg;
+        false ->
+            throw({cannot_convert_to_numbered_message, Msg})
+    end;
+list_to_numbered_message(List) ->
+    hb_maps:from_list(number(List)).
 
 %% @doc Determine if the message given is an ordered list, starting from 1.
-is_ordered_list(Msg) when is_list(Msg) -> true;
-is_ordered_list(Msg) ->
-    is_ordered_list(1, hb_ao:normalize_keys(Msg)).
-is_ordered_list(_, Msg) when map_size(Msg) == 0 -> true;
-is_ordered_list(N, Msg) ->
+is_ordered_list(Msg, _Opts) when is_list(Msg) -> true;
+is_ordered_list(Msg, Opts) ->
+    is_ordered_list(1, hb_ao:normalize_keys(Msg, Opts), Opts).
+is_ordered_list(_, Msg, _Opts) when map_size(Msg) == 0 -> true;
+is_ordered_list(N, Msg, _Opts) ->
     case maps:get(NormKey = hb_ao:normalize_key(N), Msg, not_found) of
         not_found -> false;
         _ ->
             is_ordered_list(
                 N + 1,
-                maps:without([NormKey], Msg)
+                maps:without([NormKey], Msg),
+				_Opts
             )
     end.
 
+%% @doc Replace a key in a list with a new value.
+list_replace(List, Key, Value) ->
+    lists:foldr(
+        fun(Elem, Acc) ->
+            case Elem of
+                Key when is_list(Value) -> Value ++ Acc;
+                Key -> [Value | Acc];
+                _ -> [Elem | Acc]
+            end
+        end,
+        [],
+        List
+    ).
+
+%% @doc Take a list and return a list of unique elements. The function is
+%% order-preserving.
+unique(List) ->
+    Unique =
+        lists:foldl(
+            fun(Item, Acc) ->
+                case lists:member(Item, Acc) of
+                    true -> Acc;
+                    false -> [Item | Acc]
+                end
+            end,
+            [],
+            List
+        ),
+    lists:reverse(Unique).
+
+%% @doc Returns the intersection of two lists, with stable ordering.
+list_with(List1, List2) ->
+    lists:filter(fun(Item) -> lists:member(Item, List2) end, List1).
+
+%% @doc Remove all occurrences of all items in the first list from the second list.
+list_without(List1, List2) ->
+    lists:filter(fun(Item) -> not lists:member(Item, List1) end, List2).
+
 %% @doc Take a message with numbered keys and convert it to a list of tuples
-%% with the associated key as an integer and a value. Optionally, it takes a
-%% standard map of HyperBEAM runtime options.
+%% with the associated key as an integer. Optionally, it takes a standard
+%% message of HyperBEAM runtime options.
 message_to_ordered_list(Message) ->
     message_to_ordered_list(Message, #{}).
 message_to_ordered_list(Message, _Opts) when ?IS_EMPTY_MESSAGE(Message) ->
@@ -285,14 +400,26 @@ message_to_ordered_list(Message, _Opts) when ?IS_EMPTY_MESSAGE(Message) ->
 message_to_ordered_list(List, _Opts) when is_list(List) ->
     List;
 message_to_ordered_list(Message, Opts) ->
-    Keys = hb_ao:keys(Message, Opts),
-    IntKeys = lists:sort(lists:map(fun int/1, Keys)),
-    message_to_ordered_list(Message, IntKeys, erlang:hd(IntKeys), Opts).
+    NormMessage = hb_ao:normalize_keys(Message, Opts),
+    Keys = hb_maps:keys(NormMessage, Opts) -- [<<"priv">>, <<"commitments">>],
+    SortedKeys =
+        lists:map(
+            fun hb_ao:normalize_key/1,
+            lists:sort(lists:map(fun int/1, Keys))
+        ),
+    message_to_ordered_list(NormMessage, SortedKeys, erlang:hd(SortedKeys), Opts).
 message_to_ordered_list(_Message, [], _Key, _Opts) ->
     [];
 message_to_ordered_list(Message, [Key|Keys], Key, Opts) ->
-    case hb_ao:get(Key, Message, Opts#{ hashpath => ignore }) of
-        undefined -> throw({missing_key, Key, {remaining_keys, Keys}});
+    case hb_maps:get(Key, Message, undefined, Opts#{ hashpath => ignore }) of
+        undefined ->
+            throw(
+                {missing_key,
+                    {key, Key},
+                    {remaining_keys, Keys},
+                    {message, Message}
+                }
+            );
         Value ->
             [
                 Value
@@ -300,13 +427,30 @@ message_to_ordered_list(Message, [Key|Keys], Key, Opts) ->
                 message_to_ordered_list(
                     Message,
                     Keys,
-                    Key + 1,
+                    hb_ao:normalize_key(int(Key) + 1),
                     Opts
                 )
             ]
     end;
-message_to_ordered_list(_Message, [Key|_Keys], ExpectedKey, _Opts) ->
-    throw({missing_key, {expected, ExpectedKey, {next, Key}}}).
+message_to_ordered_list(Message, [Key|_Keys], ExpectedKey, _Opts) ->
+    throw({missing_key, {expected, ExpectedKey, {next, Key}, {message, Message}}}).
+
+%% @doc Convert a message with numbered keys and others to a sorted list with only
+%% the numbered values.
+numbered_keys_to_list(Message, Opts) ->
+    OnlyNumbered =
+        hb_maps:filter(
+            fun(Key, _Value) ->
+                try int(hb_ao:normalize_key(Key)) of
+                    IntKey when is_integer(IntKey) -> true;
+                    _ -> false
+                catch _:_ -> false
+                end
+            end,
+            Message,
+            Opts
+        ),
+    message_to_ordered_list(OnlyNumbered, Opts).
 
 %% @doc Get the first element (the lowest integer key >= 1) of a numbered map.
 %% Optionally, it takes a specifier of whether to return the key or the value,
@@ -333,13 +477,14 @@ hd(Message, [Key|Rest], Index, ReturnType, Opts) ->
 %% @doc Find the value associated with a key in parsed a JSON structure list.
 find_value(Key, List) ->
     find_value(Key, List, undefined).
-
-find_value(Key, Map, Default) when is_map(Map) ->
-    case maps:find(Key, Map) of
+find_value(Key, Map, Default) ->
+	find_value(Key, Map, Default, #{}).
+find_value(Key, Map, Default, Opts) when is_map(Map) ->
+    case hb_maps:find(Key, Map, Opts) of
         {ok, Value} -> Value;
         error -> Default
     end;
-find_value(Key, List, Default) ->
+find_value(Key, List, Default, _Opts) ->
     case lists:keyfind(Key, 1, List) of
         {Key, Val} -> Val;
         false -> Default
@@ -367,283 +512,15 @@ maybe_throw(Val, Opts) ->
         _ -> Val
     end.
 
-%% @doc Print a message to the standard error stream, prefixed by the amount
-%% of time that has elapsed since the last call to this function.
-debug_print(X, Mod, Func, LineNum) ->
-    Now = erlang:system_time(millisecond),
-    Last = erlang:put(last_debug_print, Now),
-    TSDiff = case Last of undefined -> 0; _ -> Now - Last end,
-    io:format(standard_error, "=== HB DEBUG ===[~pms in ~p @ ~s]==>~n~s~n",
-        [
-            TSDiff, self(),
-            format_debug_trace(Mod, Func, LineNum),
-            debug_fmt(X, 0)
-        ]),
-    X.
-
-%% @doc Generate the appropriate level of trace for a given call.
-format_debug_trace(Mod, Func, Line) ->
-    case hb_opts:get(debug_print_trace, false, #{}) of
-        short ->
-            format_trace_short(get_trace());
-        false ->
-            io_lib:format("~p:~w ~p", [Mod, Line, Func])
-    end.
-
-%% @doc Convert a term to a string for debugging print purposes.
-debug_fmt(X) -> debug_fmt(X, 0).
-debug_fmt(X, Indent) ->
-    try do_debug_fmt(X, Indent)
-    catch A:B:C ->
-        eunit_print(
-            "~p:~p:~p",
-            [A, B, C]
-        ),
-        case hb_opts:get(mode, prod) of
-            prod ->
-                format_indented("[!PRINT FAIL!]", Indent);
-            _ ->
-                format_indented(
-                    "[PRINT FAIL:] ~80p~n===== PRINT ERROR WAS ~p:~p =====~n~p",
-                    [X, A, B, format_trace(C, hb_opts:get(stack_print_prefixes, [], #{}))],
-                    Indent
-                )
-        end
-    end.
-
-do_debug_fmt(Wallet = {{rsa, _PublicExpnt}, _Priv, _Pub}, Indent) ->
-    format_address(Wallet, Indent);
-do_debug_fmt({_, Wallet = {{rsa, _PublicExpnt}, _Priv, _Pub}}, Indent) ->
-    format_address(Wallet, Indent);
-do_debug_fmt({explicit, X}, Indent) ->
-    format_indented("[Explicit:] ~p", [X], Indent);
-do_debug_fmt({string, X}, Indent) ->
-    format_indented("~s", [X], Indent);
-do_debug_fmt({as, undefined, Msg}, Indent) ->
-    "\n" ++ format_indented("Subresolve => ", [], Indent) ++
-        format_maybe_multiline(Msg, Indent + 1);
-do_debug_fmt({as, DevID, Msg}, Indent) ->
-    "\n" ++ format_indented("Subresolve as ~s => ", [DevID], Indent) ++
-        format_maybe_multiline(Msg, Indent + 1);
-do_debug_fmt({X, Y}, Indent) when is_atom(X) and is_atom(Y) ->
-    format_indented("~p: ~p", [X, Y], Indent);
-do_debug_fmt({X, Y}, Indent) when is_record(Y, tx) ->
-    format_indented("~p: [TX item]~n~s",
-        [X, ar_bundles:format(Y, Indent + 1)],
-        Indent
-    );
-do_debug_fmt({X, Y}, Indent) when is_map(Y) ->
-    Formatted = format_maybe_multiline(Y, Indent + 1),
-    HasNewline = lists:member($\n, Formatted),
-    format_indented(
-        case is_binary(X) of
-            true -> "~s";
-            false -> "~p"
-        end ++ "~s",
-        [
-            X,
-            case HasNewline of
-                true -> " ==>" ++ Formatted;
-                false -> ": " ++ Formatted
-            end
-        ],
-        Indent
-    );
-do_debug_fmt({X, Y}, Indent) ->
-    format_indented("~s: ~s", [debug_fmt(X, Indent), debug_fmt(Y, Indent)], Indent);
-do_debug_fmt(Map, Indent) when is_map(Map) ->
-    format_maybe_multiline(Map, Indent);
-do_debug_fmt(Tuple, Indent) when is_tuple(Tuple) ->
-    format_tuple(Tuple, Indent);
-do_debug_fmt(X, Indent) when is_binary(X) ->
-    format_indented("~s", [format_binary(X)], Indent);
-do_debug_fmt(Str = [X | _], Indent) when is_integer(X) andalso X >= 32 andalso X < 127 ->
-    format_indented("~s", [Str], Indent);
-do_debug_fmt([], Indent) ->
-    format_indented("[]", [], Indent);
-do_debug_fmt(MsgList, Indent) when is_list(MsgList) ->
-    "\n" ++
-        format_indented("List [~w] {~n", [length(MsgList)], Indent+1) ++
-        lists:map(
-            fun({N, Msg}) ->
-                format_indented("~w => ~n~s~n",
-                    [N, debug_fmt(Msg, Indent + 3)],
-                    Indent + 2
-                )
-            end,
-            lists:zip(lists:seq(1, length(MsgList)), MsgList)
-        ) ++
-        format_indented("}", [], Indent+1);
-do_debug_fmt(X, Indent) ->
-    format_indented("~80p", [X], Indent).
-
-%% @doc If the user attempts to print a wallet, format it as an address.
-format_address(Wallet, Indent) ->
-    format_indented(human_id(ar_wallet:to_address(Wallet)), Indent).
-
-%% @doc Helper function to format tuples with arity greater than 2.
-format_tuple(Tuple, Indent) ->
-    to_lines(lists:map(
-        fun(Elem) ->
-            debug_fmt(Elem, Indent)
-        end,
-        tuple_to_list(Tuple)
-    )).
-
-to_lines(Elems) ->
-    remove_trailing_noise(do_to_lines(Elems)).
-do_to_lines([]) -> [];
-do_to_lines(In =[RawElem | Rest]) ->
-    Elem = lists:flatten(RawElem),
-    case lists:member($\n, Elem) of
-        true -> lists:flatten(lists:join("\n", In));
-        false -> Elem ++ ", " ++ do_to_lines(Rest)
-    end.
-
-remove_trailing_noise(Str) ->
-    remove_trailing_noise(Str, " \n,").
-remove_trailing_noise(Str, Noise) ->
-    case lists:member(lists:last(Str), Noise) of
-        true ->
-            remove_trailing_noise(lists:droplast(Str), Noise);
-        false -> Str
-    end.
-
-%% @doc Format a string with an indentation level.
-format_indented(Str, Indent) -> format_indented(Str, "", Indent).
-format_indented(RawStr, Fmt, Ind) ->
-    IndentSpaces = hb_opts:get(debug_print_indent),
-    lists:droplast(
-        lists:flatten(
-            io_lib:format(
-                [$\s || _ <- lists:seq(1, Ind * IndentSpaces)] ++
-                    lists:flatten(RawStr) ++ "\n",
-                Fmt
-            )
-        )
-    ).
-
-%% @doc Format a binary as a short string suitable for printing.
-format_binary(Bin) ->
-    case short_id(Bin) of
-        undefined ->
-            MaxBinPrint = hb_opts:get(debug_print_binary_max),
-            Printable =
-                binary:part(
-                    Bin,
-                    0,
-                    case byte_size(Bin) of
-                        X when X < MaxBinPrint -> X;
-                        _ -> MaxBinPrint
-                    end
-                ),
-            PrintSegment =
-                case is_human_binary(Printable) of
-                    true -> Printable;
-                    false -> encode(Printable)
-                end,
-            lists:flatten(
-                [
-                    "\"",
-                    [PrintSegment],
-                    case Printable == Bin of
-                        true -> "\"";
-                        false ->
-                            io_lib:format("...\" <~s bytes>", [human_int(byte_size(Bin))])
-                    end
-                ]
-            );
-        ShortID ->
-            lists:flatten(io_lib:format("~s", [ShortID]))
-    end.
-
-%% @doc Add `,' characters to a number every 3 digits to make it human readable.
-human_int(Int) ->
-    lists:reverse(add_commas(lists:reverse(integer_to_list(Int)))).
-
-add_commas([A,B,C,Z|Rest]) -> [A,B,C,$,|add_commas([Z|Rest])];
-add_commas(List) -> List.
-
-%% @doc Format a map as either a single line or a multi-line string depending
-%% on the value of the `debug_print_map_line_threshold' runtime option.
-format_maybe_multiline(X, Indent) ->
-    MaxLen = hb_opts:get(debug_print_map_line_threshold),
-    SimpleFmt = io_lib:format("~p", [X]),
-    case lists:flatlength(SimpleFmt) of
-        Len when Len > MaxLen ->
-            "\n" ++ lists:flatten(hb_message:format(X, Indent));
-        _ -> SimpleFmt
-    end.
-
-%% @doc Format and print an indented string to standard error.
-eunit_print(FmtStr, FmtArgs) ->
-    io:format(
-        standard_error,
-        "~n~s ",
-        [hb_util:format_indented(FmtStr ++ "...", FmtArgs, 4)]
-    ).
-
-%% @doc Print the trace of the current stack, up to the first non-hyperbeam
-%% module. Prints each stack frame on a new line, until it finds a frame that
-%% does not start with a prefix in the `stack_print_prefixes' hb_opts.
-%% Optionally, you may call this function with a custom label and caller info,
-%% which will be used instead of the default.
-print_trace(Stack, CallMod, CallFunc, CallLine) ->
-    print_trace(Stack, "HB TRACE",
-        lists:flatten(io_lib:format("[~s:~w ~p]",
-            [CallMod, CallLine, CallFunc])
-    )).
-
-print_trace(Stack, Label, CallerInfo) ->
-    io:format(standard_error, "=== ~s ===~s==>~n~s",
-        [
-            Label, CallerInfo,
-            lists:flatten(format_trace(Stack))
-        ]).
-
-%% @doc Format a stack trace as a list of strings, one for each stack frame.
-%% Each stack frame is formatted if it matches the `stack_print_prefixes'
-%% option. At the first frame that does not match a prefix in the
-%% `stack_print_prefixes' option, the rest of the stack is not formatted.
-format_trace(Stack) ->
-    format_trace(Stack, hb_opts:get(stack_print_prefixes, [], #{})).
-format_trace([], _) -> [];
-format_trace([Item|Rest], Prefixes) ->
-    case element(1, Item) of
-        Atom when is_atom(Atom) ->
-            case is_hb_module(Atom, Prefixes) of
-                true ->
-                    [
-                        format_trace(Item, Prefixes) |
-                        format_trace(Rest, Prefixes)
-                    ];
-                false -> []
-            end;
-        _ -> []
-    end;
-format_trace({Func, ArityOrTerm, Extras}, Prefixes) ->
-    format_trace({no_module, Func, ArityOrTerm, Extras}, Prefixes);
-format_trace({Mod, Func, ArityOrTerm, Extras}, _Prefixes) ->
-    ExtraMap = maps:from_list(Extras),
-    format_indented(
-        "~p:~p/~p [~s]~n",
-        [
-            Mod, Func, ArityOrTerm,
-            case maps:get(line, ExtraMap, undefined) of
-                undefined -> "No details";
-                Line ->
-                    maps:get(file, ExtraMap)
-                        ++ ":" ++ integer_to_list(Line)
-            end
-        ],
-        1
-    ).
-
 %% @doc Is the given module part of HyperBEAM?
 is_hb_module(Atom) ->
     is_hb_module(Atom, hb_opts:get(stack_print_prefixes, [], #{})).
 is_hb_module(Atom, Prefixes) when is_atom(Atom) ->
     is_hb_module(atom_to_list(Atom), Prefixes);
+is_hb_module("hb_event" ++ _, _) ->
+    % Explicitly exclude hb_event from the stack trace, as it is always included,
+    % creating noise in the output.
+    false;
 is_hb_module(Str, Prefixes) ->
     case string:tokens(Str, "_") of
         [Pre|_] ->
@@ -656,67 +533,6 @@ is_hb_module(Str, Prefixes) ->
 all_hb_modules() ->
     lists:filter(fun(Module) -> is_hb_module(Module) end, erlang:loaded()).
 
-%% @doc Print a trace to the standard error stream.
-print_trace_short(Trace, Mod, Func, Line) ->
-    io:format(standard_error, "=== [ HB SHORT TRACE ~p:~w ~p ] ==> ~s~n",
-        [
-            Mod, Line, Func,
-            format_trace_short(Trace)
-        ]
-    ).
-
-%% @doc Format a trace to a short string.
-format_trace_short(Trace) -> 
-    lists:join(
-        " / ",
-        lists:reverse(format_trace_short(
-            hb_opts:get(short_trace_len, 3, #{}),
-            false,
-            Trace,
-            hb_opts:get(stack_print_prefixes, [], #{})
-        ))
-    ).
-format_trace_short(_Max, _Latch, [], _Prefixes) -> [];
-format_trace_short(0, _Latch, _Trace, _Prefixes) -> [];
-format_trace_short(Max, Latch, [Item|Rest], Prefixes) ->
-    Formatted = format_trace_short(Max, Latch, Item, Prefixes),
-    case {Latch, is_hb_module(Formatted, Prefixes)} of
-        {false, true} ->
-            [Formatted | format_trace_short(Max - 1, true, Rest, Prefixes)];
-        {false, false} ->
-            format_trace_short(Max, false, Rest, Prefixes);
-        {true, true} ->
-            [Formatted | format_trace_short(Max - 1, true, Rest, Prefixes)];
-        {true, false} -> []
-    end;
-format_trace_short(Max, Latch, {Func, ArityOrTerm, Extras}, Prefixes) ->
-    format_trace_short(
-        Max, Latch, {no_module, Func, ArityOrTerm, Extras}, Prefixes
-    );
-format_trace_short(_, _Latch, {Mod, _, _, [{file, _}, {line, Line}|_]}, _) ->
-    lists:flatten(io_lib:format("~p:~p", [Mod, Line]));
-format_trace_short(_, _Latch, {Mod, Func, _ArityOrTerm, _Extras}, _Prefixes) ->
-    lists:flatten(io_lib:format("~p:~p", [Mod, Func])).
-
-%% @doc Utility function to help macro `?trace/0' remove the first frame of the
-%% stack trace.
-trace_macro_helper(Fun, {_, {_, Stack}}, Mod, Func, Line) ->
-    Fun(Stack, Mod, Func, Line).
-
-%% @doc Get the trace of the current process.
-get_trace() ->
-    case catch error(debugging_print) of
-        {_, {_, Stack}} ->
-            normalize_trace(Stack);
-        _ -> []
-    end.
-
-%% @doc Remove all calls from this module from the top of a trace.
-normalize_trace([]) -> [];
-normalize_trace([{Mod, _, _, _}|Rest]) when Mod == ?MODULE ->
-    normalize_trace(Rest);
-normalize_trace(Trace) -> Trace.
-
 %%% Statistics
 
 count(Item, List) ->
@@ -743,9 +559,170 @@ weighted_random(List) ->
     Shuffled = shuffle(Normalized),
     pick_weighted(Shuffled, rand:uniform()).
 
+%% @doc Pick a random element from a list, weighted by the values in the list.
 pick_weighted([], _) ->
     error(empty_list);
 pick_weighted([{Item, Weight}|_Rest], Remaining) when Remaining < Weight ->
     Item;
 pick_weighted([{_Item, Weight}|Rest], Remaining) ->
-    pick_weighted(Rest, Remaining - Weight).
\ No newline at end of file
+    pick_weighted(Rest, Remaining - Weight).
+
+%% @doc Serialize the given list of addresses to a binary, using the structured
+%% fields format.
+strings_to_binary(List) when is_list(List) ->
+    try
+        iolist_to_binary(
+            hb_structured_fields:list(
+                [
+                    {item, {string, hb_util:human_id(Addr)}, []}
+                ||
+                    Addr <- List
+                ]
+            )
+        )
+    catch
+        _:_ ->
+            error({cannot_parse_list, List})
+    end.
+
+%% @doc Parse a list from a binary. First attempts to parse the binary as a
+%% structured-fields list, and if that fails, it attempts to parse the list as
+%% a comma-separated value, stripping quotes and whitespace.
+binary_to_strings(List) when is_list(List) ->
+    % If the argument is already a list, return it.
+    List;
+binary_to_strings(Bin) when is_binary(Bin) ->
+    try 
+        Res = lists:map(
+            fun({item, {string, Item}, []}) ->
+                Item
+            end,
+            hb_structured_fields:parse_list(Bin)
+        ),
+        Res
+    catch
+        _:_ ->
+        try
+            lists:map(
+                fun unquote/1,
+                split_depth_string_aware(<<",">>, Bin)
+            )
+        catch
+            _:_ ->
+                error({cannot_parse_list, Bin})
+        end
+    end.
+
+%% @doc Unquote a binary string.
+unquote(<<"\"", Inner/binary>>) ->
+    case binary:last(Inner) of
+        $" -> binary:part(Inner, 0, byte_size(Inner) - 1);
+        _ -> Inner
+    end;
+unquote(Bin) -> Bin.
+
+%% @doc Extract all of the parts from the binary, given (a list of) separators.
+split_depth_string_aware(_Sep, <<>>) -> [];
+split_depth_string_aware(Sep, Bin) ->
+    {_MatchedSep, Part, Rest} = split_depth_string_aware_single(Sep, Bin),
+    [Part | split_depth_string_aware(Sep, Rest)].
+
+%% @doc Parse a binary, extracting a part until a separator is found, while
+%% honoring nesting characters.
+split_depth_string_aware_single(Sep, Bin) when not is_list(Sep) ->
+    split_depth_string_aware_single([Sep], Bin);
+split_depth_string_aware_single(Seps, Bin) ->
+    split_depth_string_aware_single(Seps, Bin, 0, <<>>).
+split_depth_string_aware_single(_Seps, <<>>, _Depth, CurrAcc) ->
+    {no_match, CurrAcc, <<>>};
+split_depth_string_aware_single(Seps, << $\", Rest/binary>>, Depth, CurrAcc) ->
+    {QuotedStr, AfterStr} = split_escaped_single($\", Rest),
+    split_depth_string_aware_single(
+        Seps,
+        AfterStr,
+        Depth,
+        << CurrAcc/binary, "\"", QuotedStr/binary, "\"">>
+    );
+split_depth_string_aware_single(Seps, << $\(, Rest/binary>>, Depth, CurrAcc) ->
+    %% Increase depth
+    split_depth_string_aware_single(Seps, Rest, Depth + 1, << CurrAcc/binary, "(" >>);
+split_depth_string_aware_single(Seps, << $\), Rest/binary>>, Depth, Acc) when Depth > 0 ->
+    %% Decrease depth
+    split_depth_string_aware_single(Seps, Rest, Depth - 1, << Acc/binary, ")">>);
+split_depth_string_aware_single(Seps, <<C:8/integer, Rest/binary>>, Depth, CurrAcc) ->
+    case Depth == 0 andalso lists:member(C, Seps) of
+        true -> {C, CurrAcc, Rest};
+        false ->
+            split_depth_string_aware_single(
+                Seps,
+                Rest,
+                Depth,
+                << CurrAcc/binary, C:8/integer >>
+            )
+    end.
+
+%% @doc Read a binary until a separator is found without a preceding backslash.
+split_escaped_single(Sep, Bin) ->
+    split_escaped_single(Sep, Bin, []).
+split_escaped_single(_Sep, <<>>, Acc) ->
+    {hb_util:bin(lists:reverse(Acc)), <<>>};
+split_escaped_single(Sep, <<"\\", Char:8/integer, Rest/binary>>, Acc) ->
+    split_escaped_single(Sep, Rest, [Char, $\\ | Acc]);
+split_escaped_single(Sep, <<Sep:8/integer, Rest/binary>>, Acc) ->
+    {hb_util:bin(lists:reverse(Acc)), Rest};
+split_escaped_single(Sep, <<C:8/integer, Rest/binary>>, Acc) ->
+    split_escaped_single(Sep, Rest, [C | Acc]).
+
+%% @doc Force that a binary is either empty or the given number of bytes.
+check_size(Bin, {range, Start, End}) ->
+    check_type(Bin, binary)
+        andalso byte_size(Bin) >= Start
+        andalso byte_size(Bin) =< End;
+check_size(Bin, Sizes) ->
+    check_type(Bin, binary)
+        andalso lists:member(byte_size(Bin), Sizes).
+
+check_value(Value, ExpectedValues) ->
+    lists:member(Value, ExpectedValues).
+
+%% @doc Ensure that a value is of the given type.
+check_type(Value, binary) -> is_binary(Value);
+check_type(Value, integer) -> is_integer(Value);
+check_type(Value, list) -> is_list(Value);
+check_type(Value, map) -> is_map(Value);
+check_type(Value, tx) -> is_record(Value, tx);
+check_type(Value, message) ->
+    is_record(Value, tx) or is_map(Value) or is_list(Value);
+check_type(_Value, _) -> false.
+
+%% @doc Throw an error if the given value is not ok.
+ok_or_throw(_, true, _) -> true;
+ok_or_throw(_TX, false, Error) ->
+    throw(Error).
+
+%% @doc List the loaded atoms in the Erlang VM.
+all_atoms() -> all_atoms(0).
+all_atoms(N) ->
+    case atom_from_int(N) of
+        not_found -> [];
+        A -> [A | all_atoms(N+1)]
+    end.
+
+%% @doc Find the atom with the given integer reference.
+atom_from_int(Int) ->
+    case catch binary_to_term(<<131,75,Int:24>>) of
+        A -> A;
+        _ -> not_found
+    end.
+
+%% @doc Check if a given binary is already an atom.
+binary_is_atom(X) ->
+    lists:member(X, lists:map(fun hb_util:bin/1, all_atoms())).
+
+lower_case_key_map(Map, Opts) ->
+    hb_maps:fold(fun
+        (K, V, Acc) when is_map(V) ->
+            maps:put(hb_util:to_lower(K), lower_case_key_map(V, Opts), Acc);
+        (K, V, Acc) ->
+            maps:put(hb_util:to_lower(K), V, Acc)
+    end, #{}, Map, Opts).
\ No newline at end of file
diff --git a/src/hb_volume.erl b/src/hb_volume.erl
index d4e1a3171..182217334 100644
--- a/src/hb_volume.erl
+++ b/src/hb_volume.erl
@@ -7,6 +7,7 @@ for partitioning, formatting, mounting, and managing encrypted volumes.
 -export([format_disk/2, mount_disk/4, change_node_store/2]).
 -export([check_for_device/1]).
 -include("include/hb.hrl").
+-include_lib("eunit/include/eunit.hrl").
 
 -doc """
 List available partitions in the system.
@@ -15,28 +16,27 @@ List available partitions in the system.
 """.
 -spec list_partitions() -> {ok, map()} | {error, binary()}.
 list_partitions() ->
-    ?event(disk, {list_partitions, start}),
-    
+    ?event(debug_volume, {list_partitions, entry, starting}),    
     % Get the partition information using fdisk -l
+    ?event(debug_volume, {list_partitions, executing_fdisk, command}),
     case os:cmd("sudo fdisk -l") of
         [] ->
             % Empty output indicates an error
             Reason = <<"Failed to list partitions: no output">>,
-            ?event(disk, {list_partitions, error, Reason}),
+            ?event(debug_volume, {list_partitions, fdisk_error, no_output}),
             {error, Reason};
         Output ->
-            ?event(disk, {list_partitions, complete}),
-            
+            ?event(debug_volume, {list_partitions, fdisk_success, parsing}),
+
             % Split output into lines
             Lines = string:split(Output, "\n", all),
-            
+
             % Process the output to group information by disk
             {_, DiskData} = lists:foldl(
                 fun process_disk_line/2,
                 {undefined, []},
                 Lines
             ),
-            
             % Process each disk's data to extract all information
             DiskObjects = lists:filtermap(
                 fun(DiskEntry) ->
@@ -47,8 +47,12 @@ list_partitions() ->
                 end,
                 DiskData
             ),
-            
             % Return the partition information
+            ?event(debug_volume, 
+                {list_partitions, success, 
+                   {disk_count, length(DiskObjects)}
+                }
+            ),
             {ok, #{
                 <<"status">> => 200,
                 <<"content-type">> => <<"application/json">>,
@@ -57,7 +61,6 @@ list_partitions() ->
     end.
 
 %%% Helper functions for list_partitions
-
 % Process a line of fdisk output to group by disk
 process_disk_line(Line, {CurrentDisk, Acc}) ->
     % Match for a new disk entry
@@ -88,7 +91,6 @@ process_disk_line(Line, {CurrentDisk, Acc}) ->
 parse_disk_info(Device, Lines) ->
     % Initialize with device ID
     DiskInfo = #{<<"device">> => Device},
-    
     % Process each line to extract information
     lists:foldl(
         fun parse_disk_line/2,
@@ -169,60 +171,100 @@ parse_io_size_line(Line, Info) ->
 Create a partition on a disk device.
 @param Device The path to the device, e.g. "/dev/sdb".
 @param PartType The partition type to create, defaults to "ext4".
-@returns {ok, Map} on success where Map includes status and partition information,
-         or {error, Reason} if the operation fails.
+@returns {ok, Map} on success where Map includes status and partition 
+         information, or {error, Reason} if the operation fails.
 """.
 -spec create_partition(Device :: binary(), PartType :: binary()) ->
     {ok, map()} | {error, binary()}.
 create_partition(undefined, _PartType) ->
+    ?event(debug_volume, {create_partition, error, device_undefined}),
     {error, <<"Device path not specified">>};
 create_partition(Device, PartType) ->
-    ?event(disk, {create_partition, start}),
-    ?event(disk, {create_partition, device, Device}),
-    ?event(disk, {create_partition, part_type, PartType}),
-    
+    ?event(debug_volume, 
+        {create_partition, entry, 
+           {device, Device, part_type, PartType}
+        }
+    ),
     % Create a GPT partition table
     DeviceStr = binary_to_list(Device),
     MklabelCmd = "sudo parted " ++ DeviceStr ++ " mklabel gpt",
-    MklabelResult = os:cmd(MklabelCmd),
-    
-    % Check if creating the partition table succeeded
-    case string:find(MklabelResult, "Error") of
-        nomatch ->
+    ?event(debug_volume, 
+        {create_partition, creating_gpt_label, 
+            {device, Device}
+        }
+    ),
+    ?event(debug_volume, 
+        {create_partition, executing_mklabel, 
+            {command, MklabelCmd}
+        }
+    ),
+    case safe_exec(MklabelCmd) of
+        {ok, Result} ->
+            ?event(debug_volume, 
+                {create_partition, gpt_label_success, 
+                    {result, Result}
+                }
+            ),
             create_actual_partition(Device, PartType);
-        _ ->
-            ?event(disk, {create_partition, error, list_to_binary(MklabelResult)}),
-            {error, list_to_binary(MklabelResult)}
+        {error, ErrorMsg} ->
+            ?event(debug_volume, 
+                {create_partition, gpt_label_error, 
+                    {error, ErrorMsg}
+                }
+            ),
+            {error, ErrorMsg}
     end.
 
 % Create the actual partition after making the GPT label
 create_actual_partition(Device, PartType) ->
+    ?event(debug_volume, 
+        {create_actual_partition, entry, 
+           {device, Device, part_type, PartType}
+        }
+    ),
     DeviceStr = binary_to_list(Device),
     PartTypeStr = binary_to_list(PartType),
-    
     % Build the parted command to create the partition
-    MkpartCmd = "sudo parted -a optimal " ++ DeviceStr ++ 
-               " mkpart primary " ++ PartTypeStr ++ " 0% 100%",
-    MkpartResult = os:cmd(MkpartCmd),
-    
-    % Check if creating the partition succeeded
-    case string:find(MkpartResult, "Error") of
-        nomatch ->
+    MkpartCmd = 
+        "sudo parted -a optimal " ++ DeviceStr ++ 
+        " mkpart primary " ++ PartTypeStr ++ " 0% 100%",
+    ?event(debug_volume, 
+        {create_actual_partition, executing_mkpart, 
+           {command, MkpartCmd}
+        }
+    ),
+    case safe_exec(MkpartCmd) of
+        {ok, Result} ->
+            ?event(debug_volume, 
+                {create_actual_partition, mkpart_success, 
+                   {result, Result}
+                }
+            ),
             get_partition_info(Device);
-        _ ->
-            ?event(disk, {create_partition, error, list_to_binary(MkpartResult)}),
-            {error, list_to_binary(MkpartResult)}
+        {error, ErrorMsg} ->
+            ?event(debug_volume, 
+                {create_actual_partition, mkpart_error, 
+                    {error, ErrorMsg}
+                }
+            ),
+            {error, ErrorMsg}
     end.
 
 % Get the partition information after creating a partition
 get_partition_info(Device) ->
+    ?event(debug_volume, {get_partition_info, entry, {device, Device}}),
     DeviceStr = binary_to_list(Device),
-    
     % Print partition information
     PrintCmd = "sudo parted " ++ DeviceStr ++ " print",
+    ?event(debug_volume, 
+        {get_partition_info, executing_print, {command, PrintCmd}}
+    ),
     PartitionInfo = os:cmd(PrintCmd),
-    
-    ?event(disk, {create_partition, complete}),
+    ?event(debug_volume, 
+        {get_partition_info, success, partition_created, 
+            {result, PartitionInfo}
+        }
+    ),
     {ok, #{
         <<"status">> => 200,
         <<"message">> => <<"Partition created successfully.">>,
@@ -234,46 +276,55 @@ get_partition_info(Device) ->
 Format a disk or partition with LUKS encryption.
 @param Partition The path to the partition, e.g. "/dev/sdc1".
 @param EncKey The encryption key to use for LUKS.
-@returns {ok, Map} on success where Map includes the status and confirmation message,
-         or {error, Reason} if the operation fails.
+@returns {ok, Map} on success where Map includes the status and 
+    confirmation message, or {error, Reason} if the operation fails.
 """.
 -spec format_disk(Partition :: binary(), EncKey :: binary()) ->
     {ok, map()} | {error, binary()}.
 format_disk(undefined, _EncKey) ->
+    ?event(debug_volume, {format_disk, error, partition_undefined}),
     {error, <<"Partition path not specified">>};
 format_disk(_Partition, undefined) ->
+    ?event(debug_volume, {format_disk, error, key_undefined}),
     {error, <<"Encryption key not specified">>};
 format_disk(Partition, EncKey) ->
-    ?event(disk, {format, start}),
-    ?event(disk, {format, partition, Partition}),
-    
-    % Ensure tmp directory exists
-    os:cmd("sudo mkdir -p /root/tmp"),
-    KeyFile = "/root/tmp/luks_key_" ++ os:getpid(),
-    file:write_file(KeyFile, EncKey, [raw]),
-    
-    % Format with LUKS
+    ?event(debug_volume, 
+        {format_disk, entry, 
+            {
+                partition, Partition, 
+                key_present, true
+            }
+        }
+    ),
     PartitionStr = binary_to_list(Partition),
-    FormatCmd = "sudo cryptsetup luksFormat --batch-mode --key-file " ++ 
-                KeyFile ++ " " ++ PartitionStr,
-    FormatResult = os:cmd(FormatCmd),
-    
-    % Remove the temporary key file 
-    os:cmd("sudo shred -u " ++ KeyFile),
-    
-    % Check if the command succeeded
-    case string:find(FormatResult, "failed") of
-        nomatch ->
-            ?event(disk, {format, complete}),
-            {ok, #{
-                <<"status">> => 200,
-                <<"message">> => 
-                    <<"Partition formatted with LUKS encryption successfully.">>
-            }};
-        _ ->
-            ?event(disk, {format, error, list_to_binary(FormatResult)}),
-            {error, list_to_binary(FormatResult)}
-    end.
+    ?event(debug_volume, {format_disk, creating_secure_key_file, starting}),
+    with_secure_key_file(EncKey, fun(KeyFile) ->
+        FormatCmd = 
+            "sudo cryptsetup luksFormat --batch-mode " ++
+            "--key-file " ++ KeyFile ++ " " ++ PartitionStr,
+        ?event(debug_volume, 
+            {format_disk, executing_luks_format, {command, FormatCmd}}
+        ),
+        case safe_exec(FormatCmd, ["failed"]) of
+            {ok, Result} ->
+                ?event(debug_volume, 
+                    {format_disk, luks_format_success, completed, 
+                        {result, Result}
+                    }
+                ),
+                {ok, #{
+                    <<"status">> => 200,
+                    <<"message">> => 
+                        <<"Partition formatted with LUKS encryption "
+                          "successfully.">>
+                }};
+            {error, ErrorMsg} ->
+                ?event(debug_volume, 
+                    {format_disk, luks_format_error, ErrorMsg}
+                ),
+                {error, ErrorMsg}
+        end
+    end).
 
 -doc """
 Mount a LUKS-encrypted disk.
@@ -281,8 +332,8 @@ Mount a LUKS-encrypted disk.
 @param EncKey The encryption key for LUKS.
 @param MountPoint The directory where the disk should be mounted.
 @param VolumeName The name to use for the decrypted LUKS volume.
-@returns {ok, Map} on success where Map includes the status and confirmation message,
-         or {error, Reason} if the operation fails.
+@returns {ok, Map} on success where Map includes the status and 
+         confirmation message, or {error, Reason} if the operation fails.
 """.
 -spec mount_disk(
     Partition :: binary(),
@@ -291,71 +342,135 @@ Mount a LUKS-encrypted disk.
     VolumeName :: binary()
 ) -> {ok, map()} | {error, binary()}.
 mount_disk(undefined, _EncKey, _MountPoint, _VolumeName) ->
+    ?event(debug_volume, {mount_disk, error, partition_undefined}),
     {error, <<"Partition path not specified">>};
 mount_disk(_Partition, undefined, _MountPoint, _VolumeName) ->
+    ?event(debug_volume, {mount_disk, error, key_undefined}),
     {error, <<"Encryption key not specified">>};
 mount_disk(_Partition, _EncKey, undefined, _VolumeName) ->
+    ?event(debug_volume, {mount_disk, error, mount_point_undefined}),
     {error, <<"Mount point not specified">>};
 mount_disk(Partition, EncKey, MountPoint, VolumeName) ->
-    ?event(disk, {mount, start}),
-    ?event(disk, {mount, partition, Partition}),
-    ?event(disk, {mount, mount_point, MountPoint}),
-    ?event(disk, {mount, volume_name, VolumeName}),
-    
-    % Ensure tmp directory exists
-    os:cmd("sudo mkdir -p /root/tmp"),
-    KeyFile = "/root/tmp/luks_key_" ++ os:getpid(),
-    file:write_file(KeyFile, EncKey, [raw]),
-    
-    % Open the LUKS volume
+    ?event(debug_volume, 
+        {mount_disk, entry, 
+            {
+                partition, Partition,
+                mount_point, MountPoint, 
+                volume_name, VolumeName}
+        }
+    ),
     PartitionStr = binary_to_list(Partition),
     VolumeNameStr = binary_to_list(VolumeName),
-    OpenCmd = "sudo cryptsetup luksOpen --key-file " ++ KeyFile ++ " " ++ 
-               PartitionStr ++ " " ++ VolumeNameStr,
-    OpenResult = os:cmd(OpenCmd),
-    
-    % Remove the temporary key file
-    os:cmd("sudo shred -u " ++ KeyFile),
-    
-    % Check if opening the LUKS volume succeeded
-    case string:find(OpenResult, "failed") of
-        nomatch ->
-            mount_opened_volume(Partition, MountPoint, VolumeName);
-        _ ->
-            ?event(disk, {mount, error, list_to_binary(OpenResult)}),
-            {error, list_to_binary(OpenResult)}
-    end.
+    ?event(debug_volume, {mount_disk, opening_luks_volume, starting}),
+    with_secure_key_file(EncKey, fun(KeyFile) ->
+        OpenCmd = 
+            "sudo cryptsetup luksOpen --key-file " ++ KeyFile ++ 
+            " " ++ PartitionStr ++ " " ++ VolumeNameStr,
+        ?event(debug_volume, {mount_disk, executing_luks_open, {command, OpenCmd}}),
+        case safe_exec(OpenCmd, ["failed"]) of
+            {ok, Result} ->
+                ?event(debug_volume, 
+                    {mount_disk, luks_open_success, proceeding_to_mount, 
+                        {result, Result}
+                    }
+                ),
+                mount_opened_volume(Partition, MountPoint, VolumeName);
+            {error, ErrorMsg} ->
+                ?event(debug_volume, {mount_disk, luks_open_error, ErrorMsg}),
+                {error, ErrorMsg}
+        end
+    end).
 
 % Mount an already opened LUKS volume
 mount_opened_volume(Partition, MountPoint, VolumeName) ->
+    ?event(debug_volume, 
+        {mount_opened_volume, entry, 
+            {
+                partition, Partition, 
+                mount_point, MountPoint, 
+                volume_name, VolumeName
+            }
+        }
+    ),
     % Create mount point if it doesn't exist
     MountPointStr = binary_to_list(MountPoint),
+    ?event(debug_volume, 
+        {mount_opened_volume, creating_mount_point, MountPoint}
+    ),
     os:cmd("sudo mkdir -p " ++ MountPointStr),
-    
-    % Mount the unlocked LUKS volume
+    % Check if filesystem exists on the opened LUKS volume
     VolumeNameStr = binary_to_list(VolumeName),
-    MountCmd = "sudo mount /dev/mapper/" ++ VolumeNameStr ++ " " ++ 
-                MountPointStr,
-    MountResult = os:cmd(MountCmd),
-    
-    % Check if mounting succeeded
-    case string:find(MountResult, "failed") of
+    DeviceMapperPath = "/dev/mapper/" ++ VolumeNameStr,
+    % Check filesystem type
+    FSCheckCmd = "sudo blkid " ++ DeviceMapperPath,
+    ?event(debug_volume, 
+        {mount_opened_volume, checking_filesystem, {command, FSCheckCmd}}
+    ),
+    FSCheckResult = os:cmd(FSCheckCmd),
+    ?event(debug_volume, 
+        {mount_opened_volume, filesystem_check_result, FSCheckResult}
+    ),
+    % Create filesystem if none exists
+    case string:find(FSCheckResult, "TYPE=") of
         nomatch ->
-            create_mount_info(Partition, MountPoint, VolumeName);
+            % No filesystem found, create ext4
+            ?event(debug_volume, 
+                {mount_opened_volume, creating_filesystem, ext4}
+            ),
+            MkfsCmd = "sudo mkfs.ext4 -F " ++ DeviceMapperPath,
+            ?event(debug_volume, 
+                {mount_opened_volume, executing_mkfs, {command, MkfsCmd}}
+            ),
+            MkfsResult = os:cmd(MkfsCmd),
+            ?event(debug_volume, 
+                {mount_opened_volume, mkfs_result, MkfsResult}
+            );
         _ ->
+            ?event(debug_volume, 
+                {mount_opened_volume, filesystem_exists, skipping_creation}
+            )
+    end,
+    % Mount the unlocked LUKS volume
+    MountCmd = "sudo mount " ++ DeviceMapperPath ++ " " ++ MountPointStr,
+    ?event(debug_volume, 
+        {mount_opened_volume, executing_mount, 
+           {command, MountCmd}
+        }
+    ),
+    case safe_exec(MountCmd, ["failed"]) of
+        {ok, Result} ->
+            ?event(debug_volume, 
+                {mount_opened_volume, mount_success, 
+                   creating_info, {result, Result}
+                }
+            ),
+            create_mount_info(Partition, MountPoint, VolumeName);
+        {error, ErrorMsg} ->
+            ?event(debug_volume, 
+                {mount_opened_volume, mount_error, 
+                   {error, ErrorMsg, closing_luks}
+                }
+            ),
             % Close the LUKS volume if mounting failed
-            VolumeNameStr = binary_to_list(VolumeName),
             os:cmd("sudo cryptsetup luksClose " ++ VolumeNameStr),
-            ?event(disk, {mount, error, list_to_binary(MountResult)}),
-            {error, list_to_binary(MountResult)}
+            {error, ErrorMsg}
     end.
 
 % Create mount info response
 create_mount_info(Partition, MountPoint, VolumeName) ->
-    ?event(disk, {mount, complete}),
+    ?event(debug_volume, 
+        {create_mount_info, success, 
+            {
+                partition, Partition, 
+                mount_point, MountPoint, 
+                volume_name, VolumeName
+            }
+        }
+    ),
     {ok, #{
         <<"status">> => 200,
-        <<"message">> => <<"Encrypted partition mounted successfully.">>,
+        <<"message">> => 
+            <<"Encrypted partition mounted successfully.">>,
         <<"mount_point">> => MountPoint,
         <<"mount_info">> => #{
             partition => Partition,
@@ -368,59 +483,192 @@ create_mount_info(Partition, MountPoint, VolumeName) ->
 Change the node's data store location to the mounted encrypted disk.
 @param StorePath The new path for the store directory.
 @param CurrentStore The current store configuration.
-@returns {ok, Map} on success where Map includes the status and confirmation message,
-         or {error, Reason} if the operation fails.
+@returns {ok, Map} on success where Map includes the status and 
+         confirmation message, or {error, Reason} if the operation fails.
 """.
--spec change_node_store(StorePath :: binary(), CurrentStore :: list()) ->
+-spec change_node_store(StorePath :: binary(), 
+                        CurrentStore :: list()) ->
     {ok, map()} | {error, binary()}.
 change_node_store(undefined, _CurrentStore) ->
+    ?event(debug_volume, {change_node_store, error, store_path_undefined}),
     {error, <<"Store path not specified">>};
 change_node_store(StorePath, CurrentStore) ->
-    ?event(disk, {change_store, start}),
-    ?event(disk, {change_store, store_path, StorePath}),
-    
+    ?event(debug_volume, 
+        {change_node_store, entry, 
+           {store_path, StorePath, current_store, CurrentStore}
+        }
+    ),
     % Create the store directory if it doesn't exist
     StorePathStr = binary_to_list(StorePath),
+    ?event(debug_volume, {change_node_store, creating_directory, StorePath}),
     os:cmd("sudo mkdir -p " ++ StorePathStr),
-    
     % Update the store configuration with the new path
+    ?event(debug_volume, 
+        {change_node_store, updating_config, 
+           {current_store, CurrentStore}
+        }
+    ),
     NewStore = update_store_config(CurrentStore, StorePath),
-    
     % Return the result
-    ?event(disk, {change_store, complete}),
+    ?event(debug_volume,
+        {change_node_store, success, {new_store_config, NewStore}}
+    ),
     {ok, #{
         <<"status">> => 200,
-        <<"message">> => <<"Node store updated to use encrypted disk.">>,
+        <<"message">> => 
+            <<"Node store updated to use encrypted disk.">>,
         <<"store_path">> => StorePath,
         <<"store">> => NewStore
     }}.
 
 %%% Helper functions
+%% Execute system command with error checking
+safe_exec(Command) ->
+    safe_exec(Command, ["Error", "failed", "bad", "error"]).
+
+safe_exec(Command, ErrorKeywords) ->
+    Result = os:cmd(Command),
+    case check_command_errors(Result, ErrorKeywords) of
+        ok -> {ok, Result};
+        error -> {error, list_to_binary(Result)}
+    end.
+
+%% Check if command result contains error indicators
+check_command_errors(Result, Keywords) ->
+    case lists:any(fun(Keyword) -> 
+        string:find(Result, Keyword) =/= nomatch 
+    end, Keywords) of
+        true -> error;
+        false -> ok
+    end.
+
+%% Secure key file management with automatic cleanup
+with_secure_key_file(EncKey, Fun) ->
+    ?event(debug_volume, {with_secure_key_file, entry, creating_temp_file}),
+    os:cmd("sudo mkdir -p /root/tmp"),
+    % Get process ID and create filename
+    PID = os:getpid(),
+    ?event(debug_volume, {with_secure_key_file, process_id, PID}),
+    KeyFile = "/root/tmp/luks_key_" ++ PID,
+    ?event(debug_volume, {with_secure_key_file, key_file_path, KeyFile}),
+    % Check if directory was created successfully
+    DirCheck = os:cmd("ls -la /root/tmp/"),
+    ?event(debug_volume, {with_secure_key_file, directory_check, DirCheck}),
+    try
+        % Convert EncKey to binary using hb_util
+        BinaryEncKey = case EncKey of
+            % Handle RSA wallet tuples - extract private key or use hash
+            {{rsa, _}, PrivKey, _PubKey} when is_binary(PrivKey) ->
+                % Use first 32 bytes of private key for AES-256
+                case byte_size(PrivKey) of
+                    Size when Size >= 32 ->
+                        binary:part(PrivKey, 0, 32);
+                    _ ->
+                        % If private key is too short, hash it to get 32 bytes
+                        crypto:hash(sha256, PrivKey)
+                end;
+            % Handle other complex terms
+            _ when not is_binary(EncKey) andalso not is_list(EncKey) ->
+                try
+                    hb_util:bin(EncKey)
+                catch
+                    _:_ ->
+                        % Fallback to term_to_binary and hash to get consistent
+                        % key size
+                        crypto:hash(sha256, term_to_binary(EncKey))
+                end;
+            % Simple cases handled by hb_util:bin
+            _ ->
+                hb_util:bin(EncKey)
+        end,
+        WriteResult = file:write_file(KeyFile, BinaryEncKey, [raw]),
+        ?event(debug_volume, 
+            {with_secure_key_file, write_result, WriteResult}
+        ),
+        % Check if file was created
+        FileExists = filelib:is_regular(KeyFile),
+        ?event(debug_volume, 
+            {with_secure_key_file, file_exists_check, FileExists}
+        ),
+        % If file exists, get its info
+        case FileExists of
+            true ->
+                FileInfo = file:read_file_info(KeyFile),
+                ?event(debug_volume, 
+                    {with_secure_key_file, file_info, FileInfo}
+                );
+            false ->
+                ?event(debug_volume, 
+                    {with_secure_key_file, file_not_found, KeyFile}
+                )
+        end,
+        % Execute function with key file path
+        ?event(debug_volume, 
+            {with_secure_key_file, executing_function, with_key_file}
+        ),
+        Result = Fun(KeyFile),
+        % Always clean up the key file
+        ?event(debug_volume, 
+            {with_secure_key_file, cleanup, shredding_key_file}
+        ),
+        os:cmd("sudo shred -u " ++ KeyFile),
+        ?event(debug_volume, {with_secure_key_file, success, completed}),
+        Result
+    catch
+        Class:Reason:Stacktrace ->
+            ?event(debug_volume, 
+                {with_secure_key_file, exception, 
+                   {class, Class, reason, Reason, cleanup, starting}
+                }
+            ),
+            % Ensure cleanup even if function fails
+            os:cmd("sudo shred -u " ++ KeyFile),
+            ?event(debug_volume, 
+                {with_secure_key_file, exception_cleanup, completed}
+            ),
+            erlang:raise(Class, Reason, Stacktrace)
+    end.
 
 % Update the store configuration with a new base path
--spec update_store_config(StoreConfig :: term(), NewPath :: binary()) -> term().
+-spec update_store_config(StoreConfig :: term(), 
+    NewPath :: binary()) -> term().
 update_store_config(StoreConfig, NewPath) when is_list(StoreConfig) ->
     % For a list, update each element
     [update_store_config(Item, NewPath) || Item <- StoreConfig];
-update_store_config(#{<<"store-module">> := Module} = StoreConfig, NewPath) 
-  when is_map(StoreConfig) ->
+update_store_config(
+    #{<<"store-module">> := Module} = StoreConfig, 
+    NewPath
+) when is_map(StoreConfig) ->
     % Handle various store module types differently
     case Module of
         hb_store_fs ->
-            % For filesystem store, replace prefix with the new path
-            StoreConfig#{<<"prefix">> => NewPath};
+            % For filesystem store, prefix the existing path with the new path
+            ExistingPath = maps:get(<<"name">>, StoreConfig, <<"">>),
+            NewName = <<NewPath/binary, "/", ExistingPath/binary>>,
+            ?event(debug_volume, {fs, StoreConfig, NewPath, NewName}),
+            StoreConfig#{<<"name">> => NewName};
+        hb_store_lmdb ->
+            ExistingPath = maps:get(<<"name">>, StoreConfig, <<"">>),
+            NewName = <<NewPath/binary, "/", ExistingPath/binary>>,
+            ?event(debug_volume, {migrate_start, ExistingPath, NewName}),
+            safe_stop_lmdb_store(StoreConfig),
+            ?event(debug_volume, {using_existing_store, NewName}),
+            FinalConfig = StoreConfig#{<<"name">> => NewName},
+            safe_start_lmdb_store(FinalConfig),
+            FinalConfig;
         hb_store_rocksdb ->
-            % For RocksDB store, replace prefix with the new path
-            StoreConfig#{<<"prefix">> => NewPath};
+            StoreConfig;
         hb_store_gateway ->
-            % For gateway store, recursively update nested store configurations
+            % For gateway store, recursively update nested store configs
             NestedStore = maps:get(<<"store">>, StoreConfig, []),
             StoreConfig#{
                 <<"store">> => update_store_config(NestedStore, NewPath)
             };
         _ ->
             % For any other store type, update the prefix
-            StoreConfig#{<<"prefix">> => NewPath}
+            % StoreConfig#{<<"name">> => NewPath}
+            ?event(debug_volume, {other, StoreConfig, NewPath}),
+            StoreConfig
     end;
 update_store_config({Type, _OldPath, Opts}, NewPath) ->
     % For tuple format with options
@@ -432,6 +680,22 @@ update_store_config(StoreConfig, _NewPath) ->
     % Return unchanged for any other format
     StoreConfig.
 
+%% Safely stop LMDB store with error handling
+safe_stop_lmdb_store(StoreConfig) ->
+    ?event(debug_volume, {stopping_current_store, StoreConfig}),
+    try 
+        hb_store_lmdb:stop(StoreConfig)
+    catch 
+        error:StopReason ->
+            ?event(debug_volume, {stop_error, StopReason})
+    end.
+
+%% Safely start LMDB store
+safe_start_lmdb_store(StoreConfig) ->
+    NewName = maps:get(<<"name">>, StoreConfig),
+    ?event(debug_volume, {starting_new_store, NewName}),
+    hb_store_lmdb:start(StoreConfig).
+
 -doc """
 Check if a device exists on the system.
 @param Device The path to the device to check (binary).
@@ -439,7 +703,151 @@ Check if a device exists on the system.
 """.
 -spec check_for_device(Device :: binary()) -> boolean().
 check_for_device(Device) ->
-    Command = io_lib:format("ls -l ~s 2>/dev/null || echo 'not_found'", [binary_to_list(Device)]),
-	?event(disk, {check_for_device, command, Command}),
+    ?event(debug_volume, {check_for_device, entry, {device, Device}}),
+    Command = 
+        io_lib:format(
+            "ls -l ~s 2>/dev/null || echo 'not_found'", 
+            [binary_to_list(Device)]
+        ),
+    ?event(debug_volume, {check_for_device, executing_command, ls_check}),
     Result = os:cmd(Command),
-    string:find(Result, "not_found") =:= nomatch. 
\ No newline at end of file
+    DeviceExists = string:find(Result, "not_found") =:= nomatch,
+    ?event(debug_volume, 
+        {check_for_device, result, 
+           {device, Device, exists, DeviceExists}
+        }
+    ),
+    DeviceExists.
+
+%%% Unit Tests
+%% Test helper function error checking
+check_command_errors_test() ->
+    % Test successful case - no errors
+    ?assertEqual(
+        ok, 
+        check_command_errors(
+            "Success: operation completed", 
+            ["Error", "failed"]
+        )
+    ),
+    % Test error detection
+    ?assertEqual(
+        error, 
+        check_command_errors(
+            "Error: something went wrong", 
+            ["Error", "failed"]
+        )
+    ),
+    ?assertEqual(
+        error,
+        check_command_errors(
+            "Operation failed", 
+            ["Error", "failed"]
+        )
+    ),
+    % Test case sensitivity
+    ?assertEqual(
+        ok, 
+        check_command_errors(
+            "error (lowercase)", 
+            ["Error", "failed"]
+        )
+    ),
+    % Test multiple keywords
+    ?assertEqual(
+        error, 
+        check_command_errors(
+            "Command failed with Error", 
+            ["Error", "failed"]
+        )
+    ).
+
+%% Test store configuration updates for different types
+update_store_config_test() ->
+    % Test filesystem store
+    FSStore = #{
+        <<"store-module">> => hb_store_fs,
+        <<"name">> => <<"cache">>
+    },
+    NewPath = <<"/encrypted/mount">>,
+    Updated = update_store_config(FSStore, NewPath),
+    Expected = FSStore#{<<"name">> => <<"/encrypted/mount/cache">>},
+    ?assertEqual(Expected, Updated),
+    % Test list of stores
+    StoreList = [FSStore, #{<<"store-module">> => hb_store_gateway}],
+    UpdatedList = update_store_config(StoreList, NewPath),
+    ?assertEqual(2, length(UpdatedList)),
+    % Test tuple format
+    TupleStore = {fs, <<"old_path">>, []},
+    UpdatedTuple = update_store_config(TupleStore, NewPath),
+    ?assertEqual({fs, NewPath, []}, UpdatedTuple).
+
+%% Test secure key file management
+with_secure_key_file_test() ->
+    TestKey = <<"test_encryption_key_123">>,
+    % Create a safe test version that doesn't use /root/tmp
+    TestWithSecureKeyFile = fun(EncKey, Fun) ->
+        % Use /tmp instead of /root/tmp for testing
+        TmpDir = "/tmp",
+        KeyFile = TmpDir ++ "/test_luks_key_" ++ os:getpid(),
+        try
+            % Write key to temporary file
+            file:write_file(KeyFile, EncKey, [raw]),
+            % Execute function with key file path
+            Result = Fun(KeyFile),
+            % Clean up the key file
+            file:delete(KeyFile),
+            Result
+        catch
+            Class:Reason:Stacktrace ->
+                % Ensure cleanup even if function fails
+                file:delete(KeyFile),
+                erlang:raise(Class, Reason, Stacktrace)
+        end
+    end,
+    % Test successful execution
+    Result = TestWithSecureKeyFile(TestKey, fun(KeyFile) ->
+        % Verify key file was created and contains the key
+        ?assert(filelib:is_regular(KeyFile)),
+        {ok, FileContent} = file:read_file(KeyFile),
+        ?assertEqual(TestKey, FileContent),
+        {ok, <<"success">>}
+    end),
+    ?assertEqual({ok, <<"success">>}, Result),
+    % Test exception handling and cleanup
+    TestException = fun() ->
+        TestWithSecureKeyFile(TestKey, fun(KeyFile) ->
+            ?assert(filelib:is_regular(KeyFile)),
+            error(test_error)
+        end)
+    end,
+    ?assertError(test_error, TestException()).
+
+%% Test device checking with mocked commands
+check_for_device_test() ->
+    % This test would need mocking of os:cmd to be fully testable
+    % For now, test with /dev/null which should always exist
+    ?assertEqual(true, check_for_device(<<"/dev/null">>)),
+    % Test non-existent device
+    ?assertEqual(
+        false, 
+        check_for_device(<<"/dev/nonexistent_device_123">>)
+    ).
+
+%% Test safe command execution with mocked results
+safe_exec_mock_test() ->
+    % We can't easily mock os:cmd, but we can test the error checking logic
+    % This is covered by check_command_errors_test above
+    % Test with default error keywords
+    TestResult1 = 
+        check_command_errors(
+            "Operation completed successfully", 
+            ["Error", "failed"]
+        ),
+    ?assertEqual(ok, TestResult1),
+    TestResult2 = 
+        check_command_errors(
+            "Error: disk not found", 
+            ["Error", "failed"]
+        ),
+    ?assertEqual(error, TestResult2). 
\ No newline at end of file
diff --git a/src/html/cacheviz@1.0/graph.html b/src/html/cacheviz@1.0/graph.html
new file mode 100644
index 000000000..908ed48ba
--- /dev/null
+++ b/src/html/cacheviz@1.0/graph.html
@@ -0,0 +1,321 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>HyperBEAM Cache Graph</title>
+    <link rel="icon" type="image/png" href="https://arweave.net/oTMNDjwfn-Mv0bJZPGmMpDPPYWqINH6lQeTVc92bwjA" />
+    <style>
+        body, html {
+            margin: 0;
+            padding: 0;
+            overflow: hidden;
+            width: 100%;
+            height: 100%;
+            font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;
+            background-color: #f9f9f9;
+            color: #333;
+        }
+        
+        /* Header bar */
+        .header-bar {
+            position: fixed;
+            top: 0;
+            left: 0;
+            right: 0;
+            height: 50px;
+            background-color: white;
+            border-bottom: 1px solid #e0e0e0;
+            display: flex;
+            align-items: center;
+            padding: 0 16px;
+            box-shadow: 0 1px 3px rgba(0,0,0,0.1);
+            z-index: 100;
+            width: 100%;
+            box-sizing: border-box;
+        }
+        
+        /* Logo area */
+        .logo-area {
+            display: flex;
+            align-items: center;
+            margin-right: 24px;
+            font-weight: 500;
+            font-size: 16px;
+            white-space: nowrap;
+        }
+        
+        /* Controls container */
+        .controls-container {
+            display: flex;
+            align-items: center;
+            gap: 16px;
+            margin-right: 24px;
+            white-space: nowrap;
+        }
+        
+        /* Button with icon */
+        .icon-button {
+            background: none;
+            border: none;
+            color: #555;
+            padding: 8px;
+            cursor: pointer;
+            border-radius: 4px;
+            display: flex;
+            align-items: center;
+            justify-content: center;
+            transition: background-color 0.2s;
+            margin: 0;
+        }
+        
+        .icon-button:hover {
+            background-color: #f0f0f0;
+            color: #333;
+        }
+        
+        .icon-button.active {
+            background-color: #e6f2ff;
+            color: #0066cc;
+        }
+        
+        .icon-button i {
+            font-size: 16px;
+        }
+        
+        /* Search container */
+        .search-container {
+            flex: 1;
+            position: relative;
+            margin: 0px 24px 0px 0px;
+        }
+        
+        .search-container input[type="text"] {
+            width: 100%;
+            padding: 8px 12px;
+            border: 1px solid #e0e0e0;
+            border-radius: 4px;
+            font-size: 13px;
+            box-sizing: border-box;
+            margin: 0;
+        }
+        
+        .search-container input[type="text"]:focus {
+            outline: none;
+            border-color: #4D90FE;
+            box-shadow: 0 0 0 2px rgba(77, 144, 254, 0.2);
+        }
+        
+        /* Stats display */
+        .stats-display {
+            display: flex;
+            align-items: center;
+            gap: 16px;
+            margin-left: auto;
+            white-space: nowrap;
+        }
+        
+        .stat-item {
+            display: flex;
+            align-items: center;
+            gap: 8px;
+            font-size: 13px;
+        }
+        
+        .stat-value {
+            font-weight: 600;
+        }
+        
+        .legend-color {
+            width: 12px;
+            height: 12px;
+            border-radius: 2px;
+            margin-right: 4px;
+        }
+        
+        .legend-simple {
+            background-color: #6495ED;
+        }
+        
+        .legend-composite {
+            background-color: #F08080;
+        }
+        
+        .autocomplete-list {
+            position: absolute;
+            top: 100%;
+            left: 0;
+            right: 0;
+            max-height: 300px;
+            overflow-y: auto;
+            border: 1px solid #e0e0e0;
+            border-radius: 0 0 4px 4px;
+            background: white;
+            box-shadow: 0 2px 4px rgba(0,0,0,0.1);
+            z-index: 101;
+            margin-top: 2px;
+        }
+        
+        .autocomplete-item {
+            padding: 8px 12px;
+            border-bottom: 1px solid #f0f0f0;
+            font-size: 13px;
+            cursor: pointer;
+        }
+        
+        .autocomplete-item:hover,
+        .autocomplete-item.selected {
+            background-color: #f5f5f5;
+        }
+        
+        /* Main content */
+        .main-content {
+            height: 100vh;
+            padding-top: 50px; /* Same as header height */
+            box-sizing: border-box;
+        }
+        
+        #graph-container {
+            width: 100%;
+            height: 100%;
+        }
+        
+        /* Loading indicator */
+        #loading {
+            position: absolute;
+            top: 50%;
+            left: 50%;
+            transform: translate(-50%, -50%);
+            background: white;
+            padding: 15px 20px;
+            border-radius: 4px;
+            box-shadow: 0 2px 8px rgba(0,0,0,0.1);
+            font-size: 14px;
+            display: none;
+        }
+        
+        /* Node info panel */
+        .node-info-panel {
+            position: absolute;
+            bottom: 20px;
+            right: 20px;
+            background-color: white;
+            border: 1px solid #e0e0e0;
+            border-radius: 4px;
+            padding: 12px;
+            max-width: 420px;
+            box-shadow: 0 2px 4px rgba(0,0,0,0.1);
+            font-size: 13px;
+        }
+        
+        .node-info-panel h3 {
+            margin: 0 0 8px 0;
+            font-size: 14px;
+            font-weight: 500;
+        }
+        
+        .node-info-panel p {
+            margin: 4px 0;
+        }
+        
+        /* FPS Counter */
+        #fps-counter {
+            position: absolute;
+            bottom: 10px;
+            left: 10px;
+            background-color: rgba(0, 0, 0, 0.6);
+            color: white;
+            padding: 5px 10px;
+            border-radius: 4px;
+            font-size: 12px;
+            font-family: monospace;
+            z-index: 100;
+        }
+    </style>
+    <!-- Font Awesome for icons -->
+    <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.4/css/all.min.css" />
+</head>
+<body>
+    <!-- Header bar -->
+    <div class="header-bar">
+        <div class="logo-area">
+            <span>HyperBEAM Cache Graph</span>
+        </div>
+        
+        <div class="controls-container">
+            <button id="toggle-labels-btn" class="icon-button" title="Toggle Labels">
+                <i class="fas fa-tags"></i>
+            </button>
+            <button id="reset-btn" class="icon-button" title="Reset View">
+                <i class="fas fa-sync-alt"></i>
+            </button>
+            <button id="toggle-debug-btn" class="icon-button" title="Toggle Debug View">
+                <i class="fas fa-bug"></i>
+            </button>
+            <button id="load-all-btn" class="icon-button" title="Load All Nodes">
+                <i class="fas fa-project-diagram"></i>
+            </button>
+        </div>
+        
+        <!-- Search container -->
+        <div class="search-container">
+            <input type="text" id="search-input" placeholder="Search nodes...">
+        </div>
+        
+        <!-- Stats display -->
+        <div class="stats-display">
+            <div class="stat-item">
+                <span class="stat-label">Nodes:</span>
+                <span class="stat-value" id="node-count">0</span>
+            </div>
+            <div class="stat-item">
+                <span class="stat-label">Links:</span>
+                <span class="stat-value" id="link-count">0</span>
+            </div>
+            <div class="stat-item legend-item">
+                <div class="legend-color legend-simple"></div>
+                <span>Simple</span>
+            </div>
+            <div class="stat-item legend-item">
+                <div class="legend-color legend-composite"></div>
+                <span>Composite</span>
+            </div>
+        </div>
+    </div>
+
+    <div class="main-content">
+        <div id="graph-container"></div>
+        <div id="loading">Loading graph data...</div>
+        <div id="fps-counter">FPS: 0</div>
+        
+        <!-- Debug UI elements (hidden by default) -->
+        <div id="debug-info-panel" style="display: none; position: absolute; bottom: 120px; left: 10px; width: 200px; background-color: rgba(0,0,0,0.7); color: #fff; padding: 8px; border-radius: 4px; font-size: 12px; font-family: monospace; z-index: 1000; pointer-events: none;">
+            <div style="font-weight: bold; margin-bottom: 5px; color: #4CAF50;">Debug Info</div>
+            <div>Nodes: <span id="debug-nodes" style="float: right">0/0</span></div>
+            <div>Links: <span id="debug-links" style="float: right">0</span></div>
+            <div>Grid cells: <span id="debug-cells" style="float: right">0</span></div>
+            <div>Objects in grid: <span id="debug-objects" style="float: right">0</span></div>
+            <div>Avg per cell: <span id="debug-avg-per-cell" style="float: right">0</span></div>
+            <div style="margin-top: 8px; border-top: 1px solid #555; padding-top: 5px;">Camera Position:</div>
+            <div>X: <span id="debug-camera-x" style="float: right">0</span></div>
+            <div>Y: <span id="debug-camera-y" style="float: right">0</span></div>
+            <div>Z: <span id="debug-camera-z" style="float: right">0</span></div>
+            <div style="margin-top: 5px; font-size: 10px; color: #aaa;">Press 1-3 to toggle visualizations</div>
+        </div>
+        
+        <div id="debug-frame-graph" style="display: none; position: absolute; bottom: 60px; left: 10px; width: 200px; height: 50px; background-color: rgba(0,0,0,0.5); border: 1px solid #444; padding: 2px;">
+            <canvas id="debug-frame-canvas" width="196" height="46"></canvas>
+            <div id="debug-fps-label" style="position: absolute; top: 2px; right: 5px; color: #fff; font-size: 10px;">0 FPS</div>
+        </div>
+    </div>
+
+    <!-- Third-party libraries -->
+    <script src="https://cdn.jsdelivr.net/npm/three@0.132.2/build/three.min.js"></script>
+    <script src="https://cdn.jsdelivr.net/npm/three@0.132.2/examples/js/controls/OrbitControls.js"></script>
+    <script src="https://cdn.jsdelivr.net/npm/three-spritetext@1.6.5/dist/three-spritetext.min.js"></script>
+    <script src="https://d3js.org/d3.v7.min.js"></script>
+    
+    <!-- Custom scripts -->
+    <script src="/~cacheviz@1.0/js"></script>
+</body>
+</html> 
\ No newline at end of file
diff --git a/src/html/cacheviz@1.0/graph.js b/src/html/cacheviz@1.0/graph.js
new file mode 100644
index 000000000..3d438f27d
--- /dev/null
+++ b/src/html/cacheviz@1.0/graph.js
@@ -0,0 +1,3767 @@
+/**
+ * HyperBEAM Cache Graph Renderer - Modular Version
+ * A 2D force-directed graph visualization for the HyperBEAM cache system
+ */
+
+/**
+ * Utility function to create a circular texture for node rendering
+ * @param {number} size - Size of the texture in pixels
+ * @param {number|string} color - Color of the circle (hex)
+ * @param {boolean} border - Whether to add a border
+ * @param {number|string} borderColor - Color of the border (hex)
+ * @returns {THREE.Texture} The generated texture
+ */
+function createCircleTexture(size = 64, color = 0xffffff, border = false, borderColor = 0x000000) {
+    // Create a canvas element
+    const canvas = document.createElement('canvas');
+    canvas.width = size;
+    canvas.height = size;
+    const context = canvas.getContext('2d');
+    
+    // Clear canvas with transparent background
+    context.clearRect(0, 0, size, size);
+    
+    // Convert color to string format if it's a number
+    const fillColor = typeof color === 'number' ? '#' + color.toString(16).padStart(6, '0') : color;
+    const strokeColor = typeof borderColor === 'number' ? '#' + borderColor.toString(16).padStart(6, '0') : borderColor;
+    
+    // Draw a circle
+    const radius = size / 2 - 2;
+    context.beginPath();
+    context.arc(size / 2, size / 2, radius, 0, 2 * Math.PI, false);
+    context.fillStyle = fillColor;
+    context.fill();
+    
+    // Add border if requested
+    if (border) {
+        context.lineWidth = 1;
+        context.strokeStyle = strokeColor;
+        context.stroke();
+    }
+    
+    // Create a texture from the canvas
+    const texture = new THREE.CanvasTexture(canvas);
+    texture.needsUpdate = true;
+    
+    return texture;
+}
+
+/**
+ * ThemeManager - Handles configuration and visual styling
+ */
+class ThemeManager {
+    constructor() {
+        this.config = {
+            // Node styling
+            nodeSize: {
+                simple: 6,
+                composite: 8
+            },
+            // Color scheme
+            colors: {
+                background: 0xf9f9f9,
+                simpleNode: 0x6495ED,     // Light blue
+                compositeNode: 0xF08080,  // Light coral
+                highlight: 0xFFA500,      // Orange for highlighting
+                selectedNode: 0xFF5500,   // Orange-red for selected node
+                neighborNode: 0x4CAF50,   // Green for neighbor nodes
+                link: 0xcccccc,           // Light gray for links
+                activeLink: 0x333333,     // Dark gray for active links
+                hover: 0xfafa33           // Warm orange/yellow for hover
+            },
+            // Display options
+            showLabels: true,
+            physicsEnabled: true,
+            // Physics settings
+            defaultDistance: 150,
+            highConnectionThreshold: 10,
+            // Camera settings
+            zoomLevel: {
+                default: 1.0,
+                focused: 2.5
+            },
+            // Z-positions for layering
+            zPos: {
+                line: 0,
+                node: 5, 
+                label: 10
+            }
+        };
+    }
+    
+    /**
+     * Get the color for a node based on its type and state
+     * @param {string} nodeType - The type of node ('simple' or 'composite')
+     * @param {string} state - The state of the node ('default', 'selected', 'neighbor', 'hover')
+     * @returns {number} The color as a hex number
+     */
+    getNodeColor(nodeType, state = 'default') {
+        switch(state) {
+            case 'selected':
+                return this.config.colors.selectedNode;
+            case 'neighbor':
+                return this.config.colors.neighborNode;
+            case 'hover':
+                return this.config.colors.hover;
+            default:
+                return nodeType === 'simple' ? 
+                    this.config.colors.simpleNode : 
+                    this.config.colors.compositeNode;
+        }
+    }
+    
+    /**
+     * Get the color for a link based on its state
+     * @param {string} state - The state of the link ('default' or 'active')
+     * @returns {number} The color as a hex number
+     */
+    getLinkColor(state = 'default') {
+        return state === 'active' ? 
+            this.config.colors.activeLink : 
+            this.config.colors.link;
+    }
+    
+    /**
+     * Get the size for a node based on its type
+     * @param {string} nodeType - The type of node ('simple' or 'composite')
+     * @returns {number} The node size
+     */
+    getNodeSize(nodeType) {
+        return nodeType === 'simple' ? 
+            this.config.nodeSize.simple : 
+            this.config.nodeSize.composite;
+    }
+    
+    /**
+     * Toggle label visibility
+     * @returns {boolean} The new label visibility state
+     */
+    toggleLabels() {
+        this.config.showLabels = !this.config.showLabels;
+        return this.config.showLabels;
+    }
+    
+    /**
+     * Toggle physics simulation
+     * @returns {boolean} The new physics enabled state
+     */
+    togglePhysics() {
+        this.config.physicsEnabled = !this.config.physicsEnabled;
+        return this.config.physicsEnabled;
+    }
+}
+
+/**
+ * SceneManager - Handles Three.js scene, camera, and rendering
+ */
+class SceneManager {
+    constructor(container, themeManager) {
+        this.container = container;
+        this.themeManager = themeManager;
+        
+        // Three.js components
+        this.scene = null;
+        this.camera = null;
+        this.renderer = null;
+        this.controls = null;
+        this.raycaster = new THREE.Raycaster();
+        this.mouse = new THREE.Vector2();
+        
+        // Performance optimization
+        this.frustum = new THREE.Frustum();
+        this.projScreenMatrix = new THREE.Matrix4();
+        this.tmpVector = new THREE.Vector3();
+        this.enableFrustumCulling = true;
+        this.frustumCullingDistance = 1250; // Beyond this distance, apply visibility culling
+        
+        // Initialize the scene
+        this.initScene();
+    }
+    
+    /**
+     * Initialize the Three.js scene and renderer
+     */
+    initScene() {
+        const width = this.container.clientWidth;
+        const height = this.container.clientHeight;
+        
+        // Create scene with background color
+        this.scene = new THREE.Scene();
+        this.scene.background = new THREE.Color(this.themeManager.config.colors.background);
+        
+        // Create perspective camera with large clipping plane to prevent culling
+        const aspectRatio = width / height;
+        this.camera = new THREE.PerspectiveCamera(
+            40,  // Narrower field of view for less distortion
+            aspectRatio,
+            0.1,
+            15000  // Increased far clipping plane
+        );
+        this.camera.position.z = 1000;
+        
+        // Create renderer
+        this.renderer = new THREE.WebGLRenderer({ 
+            antialias: true,
+            alpha: true
+        });
+        this.renderer.setSize(width, height);
+        this.renderer.setClearColor(this.themeManager.config.colors.background, 1);
+        this.renderer.sortObjects = true; // Enable sorting for proper z-ordering
+        this.container.appendChild(this.renderer.domElement);
+        
+        // Configure raycaster for better point detection
+        this.raycaster = new THREE.Raycaster();
+        this.raycaster.params.Points.threshold = 10; // Increase threshold for easier point selection
+        
+        // Add orbit controls limited to 2D movement with perspective camera
+        this.controls = new THREE.OrbitControls(this.camera, this.renderer.domElement);
+        this.controls.enableDamping = true;
+        this.controls.dampingFactor = 0.1;
+        this.controls.enableRotate = false; // Disable 3D rotation
+        this.controls.screenSpacePanning = true;
+        
+        // Set zoom limits - constrain camera between 750 and 15000 on z-axis
+        this.controls.minDistance = 750;
+        this.controls.maxDistance = 15000;
+        
+        // Handle window resize
+        window.addEventListener('resize', () => this.onWindowResize());
+    }
+    
+    /**
+     * Handle window resize events
+     */
+    onWindowResize() {
+        const width = this.container.clientWidth;
+        const height = this.container.clientHeight;
+        
+        // Update perspective camera aspect ratio
+        this.camera.aspect = width / height;
+        this.camera.updateProjectionMatrix();
+        
+        // Update renderer
+        this.renderer.setSize(width, height);
+    }
+    
+    /**
+     * Reset the camera view
+     */
+    resetView() {
+        // Reset camera position for perspective camera
+        this.camera.position.set(0, 0, 1000);
+        this.controls.target.set(0, 0, 0);
+        this.camera.updateProjectionMatrix();
+        this.controls.update();
+    }
+    
+    /**
+     * Focus camera on a specific position with smooth animation
+     * @param {THREE.Vector3} position - The position to focus on
+     */
+    focusCamera(position) {
+        const duration = 500; // milliseconds
+        const startTime = Date.now();
+        
+        // Save starting values
+        const startPosition = this.camera.position.clone();
+        const startTarget = this.controls.target.clone();
+        
+        // Define a fixed Z-offset for viewing the target
+        const zOffset = 600;
+        
+        // Animation function
+        const animateCamera = () => {
+            const elapsed = Date.now() - startTime;
+            const progress = Math.min(elapsed / duration, 1);
+            
+            // Ease function - ease out cubic
+            const easeProgress = 1 - Math.pow(1 - progress, 3);
+            
+            // Only update the target x and y position, keeping rotation consistent
+            this.controls.target.x = startTarget.x + (position.x - startTarget.x) * easeProgress;
+            this.controls.target.y = startTarget.y + (position.y - startTarget.y) * easeProgress;
+            // Keep z at the same value to maintain default camera angle
+            
+            // Move camera x and y to match target
+            this.camera.position.x = startPosition.x + (position.x - startPosition.x) * easeProgress;
+            this.camera.position.y = startPosition.y + (position.y - startPosition.y) * easeProgress;
+            
+            // Adjust Z with fixed offset
+            const targetZ = position.z + zOffset;
+            this.camera.position.z = startPosition.z + (targetZ - startPosition.z) * easeProgress;
+            
+            this.camera.updateProjectionMatrix();
+            this.controls.update();
+            
+            if (progress < 1) {
+                requestAnimationFrame(animateCamera);
+            }
+        };
+        
+        animateCamera();
+    }
+    
+    /**
+     * Update the mouse position for raycasting
+     * @param {MouseEvent} event - The mouse event
+     */
+    updateMousePosition(event) {
+        const rect = this.renderer.domElement.getBoundingClientRect();
+        this.mouse.x = ((event.clientX - rect.left) / rect.width) * 2 - 1;
+        this.mouse.y = -((event.clientY - rect.top) / rect.height) * 2 + 1;
+    }
+    
+    /**
+     * Get objects intersecting with the current mouse position
+     * @returns {Array} Array of intersected objects
+     */
+    getIntersectedObjects() {
+        this.raycaster.setFromCamera(this.mouse, this.camera);
+        return this.raycaster.intersectObjects(this.scene.children, true);
+    }
+    
+    /**
+     * Update the scene (called in animation loop)
+     */
+    update() {
+        // Update controls
+        if (this.controls) {
+            this.controls.update();
+            
+            // Enforce camera z-position limits
+            if (this.camera.position.z < 750) {
+                this.camera.position.z = 750;
+            } else if (this.camera.position.z > 15000) {
+                this.camera.position.z = 15000;
+            }
+        }
+        
+        // Apply frustum culling for distant objects
+        if (this.enableFrustumCulling) {
+            this.updateFrustumCulling();
+        }
+        
+        // Render the scene
+        this.renderer.render(this.scene, this.camera);
+    }
+    
+    /**
+     * Update frustum and apply visibility culling for better performance
+     */
+    updateFrustumCulling() {
+        // Update the frustum
+        this.projScreenMatrix.multiplyMatrices(
+            this.camera.projectionMatrix, 
+            this.camera.matrixWorldInverse
+        );
+        this.frustum.setFromProjectionMatrix(this.projScreenMatrix);
+        
+        // If we have a reference to the controller, access the dataManager
+        if (this.graphController && this.graphController.dataManager) {
+            const dataManager = this.graphController.dataManager;
+            
+            // Process all nodes
+            dataManager.graphObjects.nodes.forEach(node => {
+                if (!node.object) return;
+                
+                // Get distance from camera
+                this.tmpVector.copy(node.object.position);
+                const distance = this.tmpVector.distanceTo(this.camera.position);
+                
+                // If the node is beyond our threshold, check if it's in the frustum
+                if (distance > this.frustumCullingDistance) {
+                    // Check if the node is in the frustum
+                    const isVisible = this.frustum.containsPoint(node.object.position);
+                    
+                    // Only update visibility if necessary to avoid unnecessary matrix updates
+                    if (node.object.visible !== isVisible) {
+                        node.object.visible = isVisible;
+                        
+                        // Also update label visibility if it exists
+                        if (node.labelObject) {
+                            node.labelObject.visible = isVisible && this.themeManager.config.showLabels;
+                        }
+                    }
+                } else if (!node.object.visible) {
+                    // If node is within threshold distance but not visible, make visible
+                    node.object.visible = true;
+                    if (node.labelObject) {
+                        node.labelObject.visible = this.themeManager.config.showLabels;
+                    }
+                }
+            });
+            
+            // Optional: Process links for better culling
+            // Only show links if both endpoints are visible
+            dataManager.graphObjects.links.forEach(link => {
+                if (!link.line) return;
+                
+                const sourceNode = dataManager.graphObjects.nodes.get(link.sourceId);
+                const targetNode = dataManager.graphObjects.nodes.get(link.targetId);
+                
+                if (sourceNode && targetNode && sourceNode.object && targetNode.object) {
+                    const sourceDist = sourceNode.object.position.distanceTo(this.camera.position);
+                    const targetDist = targetNode.object.position.distanceTo(this.camera.position);
+                    
+                    // If both nodes are distant, check if they're visible
+                    if (sourceDist > this.frustumCullingDistance && targetDist > this.frustumCullingDistance) {
+                        const sourceVisible = sourceNode.object.visible;
+                        const targetVisible = targetNode.object.visible;
+                        
+                        // Only show link if both endpoints are visible
+                        link.line.visible = sourceVisible && targetVisible;
+                        
+                        // Update label visibility if needed
+                        if (link.labelObject) {
+                            link.labelObject.visible = sourceVisible && targetVisible && 
+                                this.themeManager.config.showLabels &&
+                                dataManager.activeLinks.has(`${link.sourceId}-${link.targetId}`);
+                        }
+                    } else if (!link.line.visible) {
+                        // If at least one endpoint is close, show the link
+                        link.line.visible = true;
+                    }
+                }
+            });
+        }
+    }
+    
+    /**
+     * Add an object to the scene
+     * @param {THREE.Object3D} object - The object to add
+     */
+    addToScene(object) {
+        this.scene.add(object);
+    }
+    
+    /**
+     * Remove an object from the scene
+     * @param {THREE.Object3D} object - The object to remove
+     */
+    removeFromScene(object) {
+        this.scene.remove(object);
+    }
+}
+
+/**
+ * DataManager - Handles graph data loading and processing
+ */
+class DataManager {
+    constructor() {
+        // Graph data
+        this.graphData = { nodes: [], links: [] };
+        this.graphObjects = { nodes: new Map(), links: new Map() };
+        
+        // State tracking
+        this.selectedNode = null;
+        this.neighborNodes = new Set();
+        this.activeLinks = new Set();
+        this.hoveredNode = null;
+    }
+    
+    /**
+     * Load graph data from the server
+     * @returns {Promise} Promise that resolves when data is loaded
+     */
+    loadData() {
+        return new Promise((resolve, reject) => {
+            let url = window.location;
+            console.log(url);
+            const params = window.location.search;
+            console.log('params', params);
+            fetch('~cacheviz@1.0/json' + params)
+                .then(response => {
+                    if (!response.ok) {
+                        throw new Error(`HTTP error ${response.status}`);
+                    }
+                    return response.json();
+                })
+                .then(data => {
+                    // Clear existing data
+                    this.clearData();
+                    
+                    // Validate data
+                    if (!this.validateData(data)) {
+                        reject(new Error('Invalid data format'));
+                        return;
+                    }
+                    
+                    this.graphData = data;
+                    resolve(data);
+                })
+                .catch(error => {
+                    console.error('Error loading graph data:', error);
+                    reject(error);
+                });
+        });
+    }
+    
+    /**
+     * Validate the graph data structure
+     * @param {Object} data - The data to validate
+     * @returns {boolean} Whether the data is valid
+     */
+    validateData(data) {
+        // Check if we have valid data
+        if (!data || !data.nodes || !data.links || 
+            !Array.isArray(data.nodes) || !Array.isArray(data.links)) {
+            return false;
+        }
+        
+        // Check if we have any nodes
+        if (data.nodes.length === 0) {
+            return false;
+        }
+        
+        return true;
+    }
+    
+    /**
+     * Clear all graph data
+     */
+    clearData() {
+        this.graphData = { nodes: [], links: [] };
+        this.graphObjects.nodes.clear();
+        this.graphObjects.links.clear();
+        
+        // Reset state
+        this.selectedNode = null;
+        this.hoveredNode = null;
+        this.neighborNodes.clear();
+        this.activeLinks.clear();
+    }
+    
+    /**
+     * Determine node type based on ID pattern
+     * @param {string} nodeId - The node ID
+     * @returns {string} The node type ('simple' or 'composite')
+     */
+    determineNodeType(nodeId) {
+        const pathParts = nodeId.split('/').filter(p => p.length > 0);
+        return (pathParts.length <= 1 && !nodeId.endsWith('/')) ? 'simple' : 'composite';
+    }
+    
+    /**
+     * Search for nodes matching a term
+     * @param {string} searchTerm - The term to search for
+     * @returns {Array} Array of matching node IDs
+     */
+    searchNodes(searchTerm) {
+        if (!searchTerm) return [];
+        
+        const searchLower = searchTerm.toLowerCase();
+        
+        // Find matching nodes
+        return this.graphData.nodes
+            .filter(node => 
+                (node.id && node.id.toLowerCase().includes(searchLower)) ||
+                (node.label && node.label.toLowerCase().includes(searchLower))
+            )
+            .map(node => node.id);
+    }
+    
+    /**
+     * Get nodes connected to a starting node up to a specified depth
+     * @param {string} startNodeId - The ID of the starting node
+     * @param {number} maxDepth - Maximum depth/distance to traverse
+     * @returns {Object} Object containing connected nodes and links
+     */
+    getConnectedSubgraph(startNodeId, maxDepth = 1) {
+        const connectedNodes = new Map();
+        const connectedLinks = new Set();
+        const queue = [{id: startNodeId, depth: 0}];
+        const visited = new Set([startNodeId]);
+        
+        // First make sure we have the start node
+        const startNode = this.graphData.nodes.find(n => n.id === startNodeId);
+        if (!startNode) return {nodes: [], links: []};
+        
+        connectedNodes.set(startNodeId, startNode);
+        
+        // BFS to find connected nodes up to maxDepth
+        while (queue.length > 0) {
+            const {id, depth} = queue.shift();
+            
+            if (depth >= maxDepth) continue;
+            
+            // Find all links connected to this node
+            this.graphData.links.forEach(link => {
+                const sourceId = typeof link.source === 'object' ? link.source.id : link.source;
+                const targetId = typeof link.target === 'object' ? link.target.id : link.target;
+                
+                if (sourceId === id || targetId === id) {
+                    const linkId = `${sourceId}-${targetId}`;
+                    
+                    // If we've already processed this link, skip it
+                    if (connectedLinks.has(linkId)) return;
+                    
+                    connectedLinks.add(linkId);
+                    
+                    // Get the ID of the node on the other end of the link
+                    const otherId = sourceId === id ? targetId : sourceId;
+                    
+                    // If we haven't visited this node yet, add it to the queue
+                    if (!visited.has(otherId)) {
+                        visited.add(otherId);
+                        const otherNode = this.graphData.nodes.find(n => n.id === otherId);
+                        if (otherNode) {
+                            connectedNodes.set(otherId, otherNode);
+                            queue.push({id: otherId, depth: depth + 1});
+                        }
+                    }
+                }
+            });
+        }
+        
+        return {
+            nodes: Array.from(connectedNodes.values()),
+            links: this.graphData.links.filter(link => {
+                const sourceId = typeof link.source === 'object' ? link.source.id : link.source;
+                const targetId = typeof link.target === 'object' ? link.target.id : link.target;
+                return connectedNodes.has(sourceId) && connectedNodes.has(targetId);
+            })
+        };
+    }
+    
+    /**
+     * Store a node object reference
+     * @param {string} nodeId - The node ID
+     * @param {Object} nodeData - The node data
+     */
+    storeNodeObject(nodeId, nodeData) {
+        this.graphObjects.nodes.set(nodeId, nodeData);
+    }
+    
+    /**
+     * Store a link object reference
+     * @param {string} linkId - The link ID (format: "sourceId-targetId")
+     * @param {Object} linkData - The link data
+     */
+    storeLinkObject(linkId, linkData) {
+        this.graphObjects.links.set(linkId, linkData);
+    }
+    
+    /**
+     * Get links connected to a node
+     * @param {string} nodeId - The node ID
+     * @returns {Array} Array of connected links
+     */
+    getConnectedLinks(nodeId) {
+        return this.graphData.links.filter(link => {
+            const sourceId = typeof link.source === 'object' ? link.source.id : link.source;
+            const targetId = typeof link.target === 'object' ? link.target.id : link.target;
+            return sourceId === nodeId || targetId === nodeId;
+        });
+    }
+    
+    /**
+     * Track selected node
+     * @param {string} nodeId - The selected node ID
+     */
+    setSelectedNode(nodeId) {
+        this.selectedNode = nodeId;
+        
+        // Find and track connected nodes and links
+        if (nodeId) {
+            // Clear previous
+            this.neighborNodes.clear();
+            this.activeLinks.clear();
+            
+            // Find connected links
+            this.graphData.links.forEach(link => {
+                const sourceId = typeof link.source === 'object' ? link.source.id : link.source;
+                const targetId = typeof link.target === 'object' ? link.target.id : link.target;
+                
+                if (sourceId === nodeId || targetId === nodeId) {
+                    // This is a connected link
+                    const otherNodeId = sourceId === nodeId ? targetId : sourceId;
+                    this.neighborNodes.add(otherNodeId);
+                    
+                    // Track active link
+                    const linkKey = `${sourceId}-${targetId}`;
+                    this.activeLinks.add(linkKey);
+                }
+            });
+        }
+    }
+    
+    /**
+     * Clear selected node
+     */
+    clearSelectedNode() {
+        this.selectedNode = null;
+        this.neighborNodes.clear();
+        this.activeLinks.clear();
+    }
+    
+    /**
+     * Track hovered node
+     * @param {string} nodeId - The hovered node ID
+     */
+    setHoveredNode(nodeId) {
+        this.hoveredNode = nodeId;
+    }
+    
+    /**
+     * Clear hovered node
+     */
+    clearHoveredNode() {
+        this.hoveredNode = null;
+    }
+}
+
+/**
+ * GraphObjectManager - Creates and manages visual objects for nodes and links
+ */
+class GraphObjectManager {
+    constructor(sceneManager, dataManager, themeManager) {
+        this.sceneManager = sceneManager;
+        this.dataManager = dataManager;
+        this.themeManager = themeManager;
+    }
+    
+    /**
+     * Create a visual node object
+     * @param {Object} node - The node data
+     * @returns {Object} The created node object with visual elements
+     */
+    createNodeObject(node) {
+        // Determine node type if not set
+        if (!node.type) {
+            node.type = this.dataManager.determineNodeType(node.id);
+        }
+        
+        // Add to NodeCloud for efficient rendering
+        if (this.graphController && this.graphController.nodeCloud) {
+            // Add to node cloud
+            const nodeIndex = this.graphController.nodeCloud.addNode(node);
+            
+            // Create a virtual object for compatibility
+            // This is needed because other code expects a THREE.Object3D
+            const virtualObject = {
+                position: new THREE.Vector3(node.x || 0, node.y || 0, this.themeManager.config.zPos.node),
+                visible: true,
+                userData: { id: node.id, type: node.type, label: node.label }
+            };
+            
+            // Store virtual object reference
+            node.object = virtualObject;
+            node.nodeCloudIndex = nodeIndex;
+        }
+        
+        // Create label if enabled
+        let labelObject = null;
+        if (this.themeManager.config.showLabels) {
+            labelObject = this.createLabel(node);
+        }
+        
+        // Store label reference
+        node.labelObject = labelObject;
+        
+        // Store in dataManager
+        this.dataManager.storeNodeObject(node.id, node);
+        
+        // Add to spatial grid if simulation manager is available
+        if (this.graphController && this.graphController.simulationManager) {
+            this.graphController.simulationManager.addNodeToSpatialGrid(node);
+        }
+        
+        return node;
+    }
+    
+    /**
+     * Create a visual link object
+     * @param {Object} link - The link data
+     * @returns {Object} The created link object with visual elements
+     */
+    createLinkObject(link) {
+        // Get node IDs
+        const sourceId = typeof link.source === 'object' ? link.source.id : link.source;
+        const targetId = typeof link.target === 'object' ? link.target.id : link.target;
+        
+        // Get node objects
+        const sourceNode = this.dataManager.graphObjects.nodes.get(sourceId);
+        const targetNode = this.dataManager.graphObjects.nodes.get(targetId);
+        
+        if (!sourceNode || !targetNode) {
+            return null;
+        }
+        
+        // Create line geometry
+        const points = [
+            new THREE.Vector3(sourceNode.x, sourceNode.y, this.themeManager.config.zPos.line),
+            new THREE.Vector3(targetNode.x, targetNode.y, this.themeManager.config.zPos.line)
+        ];
+        
+        // Create material and line
+        const material = new THREE.LineDashedMaterial({
+            color: this.themeManager.getLinkColor(),
+            dashSize: 2.5,
+            gapSize: 1.5,
+            transparent: true,
+            opacity: 0.6,
+            linewidth: 1,
+            depthWrite: false
+        });
+        
+        const geometry = new THREE.BufferGeometry().setFromPoints(points);
+        const line = new THREE.Line(geometry, material);
+        
+        // Important: Disable frustum culling to ensure lines are always visible
+        line.frustumCulled = false;
+        line.renderOrder = 0; // Ensure lines render before nodes
+        
+        this.sceneManager.addToScene(line);
+        
+        // Store connection info
+        link.sourceId = sourceId;
+        link.targetId = targetId;
+        link.line = line;
+        
+        // Create label if needed
+        let labelObject = null;
+        if (this.themeManager.config.showLabels && link.label) {
+            labelObject = this.createLinkLabel(link, sourceNode, targetNode);
+        }
+        
+        link.labelObject = labelObject;
+        
+        // Store reference
+        const linkId = `${sourceId}-${targetId}`;
+        this.dataManager.storeLinkObject(linkId, link);
+        
+        return link;
+    }
+    
+    /**
+     * Truncate text and add ellipsis in the middle
+     * @param {string} text - The text to truncate
+     * @returns {string} Truncated text with ellipsis
+     */
+    truncateWithEllipsis(text) {
+        // Show only if longer than 15 characters (6 + 3 + 6)
+        if (!text || text.length <= 15) {
+            return text;
+        }
+        
+        // Take exactly 6 chars from start and 6 from end
+        return text.substring(0, 6) + '...' + text.substring(text.length - 6);
+    }
+    
+    /**
+     * Create a label for a node
+     * @param {Object} node - The node data
+     * @returns {Object} The created label object
+     */
+    createLabel(node) {
+        // Get display text and truncate it if needed
+        const displayText = this.truncateWithEllipsis(node.label || node.id);
+        const label = new SpriteText(displayText);
+        
+        // Improved text rendering settings
+        label.fontFace = 'Arial, Helvetica, sans-serif';
+        label.fontSize = 32;
+        label.fontWeight = '600';
+        label.strokeWidth = 0; // No stroke for sharper text
+        label.color = '#000000';
+        label.backgroundColor = 'rgba(255,255,255,0.95)';
+        label.padding = 3;
+        label.textHeight = 5; // Increased for better resolution with larger text
+        label.borderWidth = 0; // No border for sharper edges
+        
+        // Position above node with pixel-perfect positioning
+		const offset_val = 100;	
+        const isSimple = node.type === 'simple';
+        const offset = isSimple ? 
+            this.themeManager.config.nodeSize.simple + offset_val : 
+            this.themeManager.config.nodeSize.composite + offset_val;
+        
+        // Round to whole pixels to avoid subpixel rendering
+        const x = Math.round(node.x || 0);
+        const y = Math.round((node.y || 0) + offset);
+        const z = this.themeManager.config.zPos.label;
+        
+        label.position.set(x, y, z);
+        label.renderOrder = 20;
+        
+        this.sceneManager.addToScene(label);
+        
+        return label;
+    }
+    
+    /**
+     * Create a label for a link
+     * @param {Object} link - The link data
+     * @param {Object} sourceNode - The source node
+     * @param {Object} targetNode - The target node
+     * @returns {Object} The created label object
+     */
+    createLinkLabel(link, sourceNode, targetNode) {
+        const midPoint = new THREE.Vector3(
+            (sourceNode.x + targetNode.x) / 2,
+            (sourceNode.y + targetNode.y) / 2,
+            this.themeManager.config.zPos.label
+        );
+
+		let label_text = link.label;
+		if (link.label.length == 43) {
+			label_text = this.truncateWithEllipsis(link.label);
+		}
+
+        const label = new SpriteText(label_text);
+        
+        // Improved text rendering settings
+        label.fontFace = 'Arial, Helvetica, sans-serif';
+        label.fontSize = 32;
+        label.fontWeight = '600';
+        label.strokeWidth = 0; // No stroke for sharper text
+        label.color = '#000000';
+        label.backgroundColor = 'rgba(255,255,255,0.95)';
+        label.padding = 3;
+        label.textHeight = 4; // Better resolution for link labels
+        label.borderWidth = 0; // No border for sharper edges
+        
+        // Round to whole pixels to avoid subpixel rendering
+        midPoint.x = Math.round(midPoint.x);
+        midPoint.y = Math.round(midPoint.y);
+        
+        label.position.copy(midPoint);
+        label.renderOrder = 20;
+        
+        // Hide link labels by default - only show when node is selected
+        label.visible = false;
+        
+        this.sceneManager.addToScene(label);
+        
+        return label;
+    }
+    
+    /**
+     * Update the position of a node object
+     * @param {Object} node - The node object to update
+     */
+    updateNodePosition(node) {
+        if (!node) return;
+        
+        if (this.graphController && this.graphController.nodeCloud) {
+            // Update position in the NodeCloud
+            this.graphController.nodeCloud.updateNodePosition(node.id, node.x || 0, node.y || 0);
+            
+            // Also update the virtual object for compatibility
+            if (node.object && node.object.position) {
+                node.object.position.x = node.x || 0;
+                node.object.position.y = node.y || 0;
+            }
+        }
+        
+        // Update label position if it exists
+        if (node.labelObject) {
+            const offset_val = 6; // Same value as in createLabel
+            const isSimple = node.type === 'simple';
+            const offset = isSimple ? 
+                this.themeManager.config.nodeSize.simple + offset_val : 
+                this.themeManager.config.nodeSize.composite + offset_val;
+                
+            node.labelObject.position.x = node.x || 0;
+            node.labelObject.position.y = (node.y || 0) + offset;
+        }
+    }
+    
+    /**
+     * Update the position of a link object
+     * @param {Object} link - The link object to update
+     */
+    updateLinkPosition(link) {
+        if (!link.line) return;
+        
+        const sourceId = link.sourceId || (typeof link.source === 'object' ? link.source.id : link.source);
+        const targetId = link.targetId || (typeof link.target === 'object' ? link.target.id : link.target);
+        
+        const sourceNode = this.dataManager.graphObjects.nodes.get(sourceId);
+        const targetNode = this.dataManager.graphObjects.nodes.get(targetId);
+        
+        if (sourceNode && targetNode) {
+            // Update the link line geometry
+            const points = [
+                new THREE.Vector3(sourceNode.x || 0, sourceNode.y || 0, this.themeManager.config.zPos.line),
+                new THREE.Vector3(targetNode.x || 0, targetNode.y || 0, this.themeManager.config.zPos.line)
+            ];
+            
+            // Update the line geometry
+            link.line.geometry.setFromPoints(points);
+            
+            // Ensure frustum culling remains disabled after updates
+            link.line.frustumCulled = false;
+            
+            // Update the link label position if it exists
+            if (link.labelObject) {
+                const midPoint = new THREE.Vector3(
+                    (sourceNode.x + targetNode.x) / 2,
+                    (sourceNode.y + targetNode.y) / 2,
+                    this.themeManager.config.zPos.label
+                );
+                link.labelObject.position.copy(midPoint);
+            }
+        }
+    }
+    
+    /**
+     * Update node colors based on selection and hover state
+     * @param {string} nodeId - The ID of the node to update
+     */
+    updateNodeColors(nodeId) {
+        const node = this.dataManager.graphObjects.nodes.get(nodeId);
+        if (!node) return;
+        
+        let state = 'default';
+        
+        // Determine state based on selection and hover
+        if (nodeId === this.dataManager.selectedNode) {
+            state = 'selected';
+        } else if (this.dataManager.neighborNodes.has(nodeId)) {
+            state = 'neighbor';
+        } else if (nodeId === this.dataManager.hoveredNode) {
+            state = 'hover';
+        }
+        
+        if (this.graphController && this.graphController.nodeCloud) {
+            // Update the color in the node cloud
+            this.graphController.nodeCloud.updateNodeColor(nodeId, node.type, state);
+        }
+    }
+    
+    /**
+     * Update link colors based on selection state
+     * @param {string} linkId - The ID of the link to update (format: "sourceId-targetId")
+     */
+    updateLinkColors(linkId) {
+        const link = this.dataManager.graphObjects.links.get(linkId);
+        if (!link || !link.line) return;
+        
+        // Determine if this is an active link
+        const isActive = this.dataManager.activeLinks.has(linkId);
+        
+        // Set color and opacity based on active state
+        link.line.material.color.set(this.themeManager.getLinkColor(isActive ? 'active' : 'default'));
+        link.line.material.opacity = isActive ? 1.0 : 0.6;
+    }
+    
+    /**
+     * Remove a node and its visual elements from the scene
+     * @param {string} nodeId - The ID of the node to remove
+     */
+    removeNode(nodeId) {
+        const node = this.dataManager.graphObjects.nodes.get(nodeId);
+        if (!node) return;
+        
+        // Remove from NodeCloud if available
+        if (this.graphController && this.graphController.nodeCloud) {
+            this.graphController.nodeCloud.removeNode(nodeId);
+        }
+        
+        // Remove label from scene
+        if (node.labelObject) {
+            this.sceneManager.removeFromScene(node.labelObject);
+        }
+        
+        // Remove from data manager
+        this.dataManager.graphObjects.nodes.delete(nodeId);
+    }
+    
+    /**
+     * Remove a link and its visual elements from the scene
+     * @param {string} linkId - The ID of the link to remove
+     */
+    removeLink(linkId) {
+        const link = this.dataManager.graphObjects.links.get(linkId);
+        if (!link) return;
+        
+        // Remove line from scene
+        if (link.line) {
+            this.sceneManager.removeFromScene(link.line);
+        }
+        
+        // Remove label from scene
+        if (link.labelObject) {
+            this.sceneManager.removeFromScene(link.labelObject);
+        }
+        
+        // Remove from data manager
+        this.dataManager.graphObjects.links.delete(linkId);
+    }
+    
+    /**
+     * Clear all visible nodes and links from the scene
+     */
+    clearVisibleObjects() {
+        // Clear NodeCloud if available
+        if (this.graphController && this.graphController.nodeCloud) {
+            this.graphController.nodeCloud.clear();
+        }
+        
+        // Remove label objects from the scene
+        this.dataManager.graphObjects.nodes.forEach((node, id) => {
+            if (node.labelObject) {
+                this.sceneManager.removeFromScene(node.labelObject);
+            }
+        });
+        
+        this.dataManager.graphObjects.links.forEach((link, id) => {
+            if (link.line) this.sceneManager.removeFromScene(link.line);
+            if (link.labelObject) this.sceneManager.removeFromScene(link.labelObject);
+        });
+        
+        // Clear references in data manager
+        this.dataManager.graphObjects.nodes.clear();
+        this.dataManager.graphObjects.links.clear();
+    }
+    
+    /**
+     * Toggle visibility of all labels
+     * @returns {boolean} The new label visibility state
+     */
+    toggleLabels() {
+        const showLabels = this.themeManager.toggleLabels();
+        
+        // Update node labels
+        this.dataManager.graphObjects.nodes.forEach((node, id) => {
+            if (node.labelObject) {
+                node.labelObject.visible = showLabels;
+            } else if (showLabels) {
+                // Create label if it doesn't exist yet
+                node.labelObject = this.createLabel(node);
+            }
+        });
+        
+        // Update link labels - only show for active links connected to selected node
+        this.dataManager.graphObjects.links.forEach((link, id) => {
+            if (link.labelObject) {
+                // Only show if labels are enabled AND this is an active link
+                const isActive = this.dataManager.activeLinks.has(id);
+                link.labelObject.visible = showLabels && isActive;
+            } else if (showLabels && link.label) {
+                // Create label if it doesn't exist yet
+                const sourceNode = this.dataManager.graphObjects.nodes.get(link.sourceId);
+                const targetNode = this.dataManager.graphObjects.nodes.get(link.targetId);
+                
+                if (sourceNode && targetNode) {
+                    link.labelObject = this.createLinkLabel(link, sourceNode, targetNode);
+                    // Only show if this is an active link
+                    link.labelObject.visible = this.dataManager.activeLinks.has(id);
+                }
+            }
+        });
+        
+        return showLabels;
+    }
+}
+
+/**
+ * SpatialGrid - Simple spatial partitioning for efficient queries
+ */
+class SpatialGrid {
+    constructor(cellSize = 200) {
+        this.cellSize = cellSize;
+        this.grid = new Map();
+        this.objects = new Set();
+    }
+    
+    /**
+     * Get the cell key for a position
+     * @param {THREE.Vector3} position - The position to get the cell for
+     * @returns {string} The cell key
+     */
+    getCellKey(position) {
+        const x = Math.floor(position.x / this.cellSize);
+        const y = Math.floor(position.y / this.cellSize);
+        const z = Math.floor(position.z / this.cellSize);
+        return `${x},${y},${z}`;
+    }
+    
+    /**
+     * Add an object to the grid
+     * @param {Object} object - The object to add
+     */
+    addObject(object) {
+        if (!object.object || !object.object.position) return;
+        
+        const position = object.object.position;
+        const cellKey = this.getCellKey(position);
+        
+        // Create cell if it doesn't exist
+        if (!this.grid.has(cellKey)) {
+            this.grid.set(cellKey, new Set());
+        }
+        
+        // Add to cell
+        this.grid.get(cellKey).add(object);
+        this.objects.add(object);
+    }
+    
+    /**
+     * Remove an object from the grid
+     * @param {Object} object - The object to remove
+     */
+    removeObject(object) {
+        if (!object.object || !object.object.position) return;
+        
+        // Remove from all cells (in case it moved)
+        this.grid.forEach(cell => {
+            cell.delete(object);
+        });
+        
+        this.objects.delete(object);
+        
+        // Clean up empty cells
+        this.grid.forEach((cell, key) => {
+            if (cell.size === 0) {
+                this.grid.delete(key);
+            }
+        });
+    }
+    
+    /**
+     * Find objects within a radius of a position
+     * @param {THREE.Vector3} position - The center position
+     * @param {number} radius - The radius to search within
+     * @returns {Array} Array of objects within the radius
+     */
+    findNearbyObjects(position, radius) {
+        // Calculate the cell range to check
+        const cellRadius = Math.ceil(radius / this.cellSize);
+        const centerX = Math.floor(position.x / this.cellSize);
+        const centerY = Math.floor(position.y / this.cellSize);
+        const centerZ = Math.floor(position.z / this.cellSize);
+        
+        const result = [];
+        const radiusSquared = radius * radius;
+        
+        // Check each cell in the range
+        for (let x = centerX - cellRadius; x <= centerX + cellRadius; x++) {
+            for (let y = centerY - cellRadius; y <= centerY + cellRadius; y++) {
+                for (let z = centerZ - cellRadius; z <= centerZ + cellRadius; z++) {
+                    const cellKey = `${x},${y},${z}`;
+                    const cell = this.grid.get(cellKey);
+                    
+                    if (cell) {
+                        // Check each object in the cell
+                        cell.forEach(object => {
+                            if (object.object && object.object.position) {
+                                const distSquared = position.distanceToSquared(object.object.position);
+                                if (distSquared <= radiusSquared) {
+                                    result.push(object);
+                                }
+                            }
+                        });
+                    }
+                }
+            }
+        }
+        
+        return result;
+    }
+    
+    /**
+     * Clear all objects from the grid
+     */
+    clear() {
+        this.grid.clear();
+        this.objects.clear();
+    }
+    
+    /**
+     * Get the total number of objects in the grid
+     * @returns {number} The number of objects
+     */
+    size() {
+        return this.objects.size;
+    }
+}
+
+/**
+ * NodeCloud - Manages efficient point cloud rendering for graph nodes
+ */
+class NodeCloud {
+    constructor(scene, themeManager) {
+        this.scene = scene;
+        this.sceneManager = null; // Will be set by the EventManager
+        this.themeManager = themeManager;
+        
+        // Capacity tracking
+        this.maxNodes = 1000; // Initial capacity
+        this.nodeCount = 0;
+        
+        // Node tracking
+        this.nodeIndices = new Map(); // Maps node IDs to their index in the arrays
+        this.nodeTypes = new Map();   // Maps node IDs to their types
+        this.positions = null;
+        this.colors = null;
+        this.sizes = null;
+        
+        // Selection tracking
+        this.selectedIndices = new Set();
+        this.neighborIndices = new Set();
+        this.hoverIndex = -1;
+        
+        // Create base texture for all nodes
+        this.baseTexture = createCircleTexture(64, 0xffffff);
+        
+        // Initialize geometry and point cloud
+        this.initialize();
+    }
+    
+    /**
+     * Initialize buffers and point cloud with initial capacity
+     */
+    initialize() {
+        // Create buffer attributes with initial capacity
+        this.positions = new Float32Array(this.maxNodes * 3);
+        this.colors = new Float32Array(this.maxNodes * 3);
+        this.sizes = new Float32Array(this.maxNodes);
+        
+        // Create buffer geometry
+        this.geometry = new THREE.BufferGeometry();
+        this.geometry.setAttribute('position', new THREE.BufferAttribute(this.positions, 3));
+        this.geometry.setAttribute('color', new THREE.BufferAttribute(this.colors, 3));
+        this.geometry.setAttribute('size', new THREE.BufferAttribute(this.sizes, 1));
+        
+        // Set draw range to only render active nodes
+        this.geometry.setDrawRange(0, 0);
+        
+        // Create point material
+        this.material = new THREE.ShaderMaterial({
+            uniforms: {
+                pointTexture: { value: this.baseTexture }
+            },
+            vertexShader: `
+                precision highp float;
+                attribute float size;
+                attribute vec3 color;
+                varying vec3 vColor;
+                
+                void main() {
+                    vColor = color;
+                    vec4 mvPosition = modelViewMatrix * vec4(position, 1.0);
+                    gl_PointSize = size * (1200.0 / -mvPosition.z);
+                    gl_Position = projectionMatrix * mvPosition;
+                }
+            `,
+            fragmentShader: `
+                precision highp float;
+                uniform sampler2D pointTexture;
+                varying vec3 vColor;
+                
+                void main() {
+                    vec4 texColor = texture2D(pointTexture, gl_PointCoord);
+                    if (texColor.a < 0.5) discard;
+                    gl_FragColor = vec4(vColor, 1.0) * texColor;
+                }
+            `,
+            transparent: true,
+            depthWrite: false,
+            blending: THREE.NormalBlending
+        });
+        
+        // Create points
+        this.points = new THREE.Points(this.geometry, this.material);
+        this.points.frustumCulled = false; // Disable frustum culling
+        this.points.renderOrder = 10;
+        
+        // Add to scene
+        this.scene.add(this.points);
+    }
+    
+    /**
+     * Resize buffers if needed
+     */
+    ensureCapacity(requiredNodes) {
+        if (requiredNodes <= this.maxNodes) return;
+        
+        // Calculate new capacity (1.5x required or 2x current, whichever is larger)
+        const newCapacity = Math.max(Math.ceil(requiredNodes * 1.5), this.maxNodes * 2);
+        
+        // Create new arrays
+        const newPositions = new Float32Array(newCapacity * 3);
+        const newColors = new Float32Array(newCapacity * 3);
+        const newSizes = new Float32Array(newCapacity);
+        
+        // Copy existing data
+        newPositions.set(this.positions);
+        newColors.set(this.colors);
+        newSizes.set(this.sizes);
+        
+        // Update references
+        this.positions = newPositions;
+        this.colors = newColors;
+        this.sizes = newSizes;
+        this.maxNodes = newCapacity;
+        
+        // Update buffer attributes
+        this.geometry.setAttribute('position', new THREE.BufferAttribute(this.positions, 3));
+        this.geometry.setAttribute('color', new THREE.BufferAttribute(this.colors, 3));
+        this.geometry.setAttribute('size', new THREE.BufferAttribute(this.sizes, 1));
+    }
+    
+    /**
+     * Add a node to the point cloud
+     * @param {Object} node - Node data with position and type
+     * @returns {number} Index of the node in the point cloud
+     */
+    addNode(node) {
+        // Get node ID
+        const nodeId = node.id;
+        
+        // Check if this node is already in the cloud
+        if (this.nodeIndices.has(nodeId)) {
+            return this.nodeIndices.get(nodeId);
+        }
+        
+        // Ensure we have enough capacity
+        this.ensureCapacity(this.nodeCount + 1);
+        
+        // Add to the end of the arrays
+        const index = this.nodeCount;
+        const i3 = index * 3;
+        
+        // Set position
+        this.positions[i3] = node.x || 0;
+        this.positions[i3 + 1] = node.y || 0;
+        this.positions[i3 + 2] = this.themeManager.config.zPos.node;
+        
+        // Store node type for later reference
+        this.nodeTypes.set(nodeId, node.type || 'simple');
+        
+        // Set color based on node type
+        const color = new THREE.Color(this.themeManager.getNodeColor(node.type));
+        this.colors[i3] = color.r;
+        this.colors[i3 + 1] = color.g;
+        this.colors[i3 + 2] = color.b;
+        
+        // Set size based on node type - use larger sizes to make selection easier
+        const baseSize = this.themeManager.getNodeSize(node.type);
+        this.sizes[index] = baseSize * 4; // Increase size to improve interaction
+        
+        // Track this node
+        this.nodeIndices.set(nodeId, index);
+        this.nodeCount++;
+        
+        // Update draw range
+        this.geometry.setDrawRange(0, this.nodeCount);
+        
+        // Mark attributes as needing update
+        this.geometry.attributes.position.needsUpdate = true;
+        this.geometry.attributes.color.needsUpdate = true;
+        this.geometry.attributes.size.needsUpdate = true;
+        
+        return index;
+    }
+    
+    /**
+     * Update a node's position
+     * @param {string} nodeId - ID of the node to update
+     * @param {number} x - New X position
+     * @param {number} y - New Y position
+     */
+    updateNodePosition(nodeId, x, y) {
+        if (!this.nodeIndices.has(nodeId)) return;
+        
+        const index = this.nodeIndices.get(nodeId);
+        const i3 = index * 3;
+        
+        this.positions[i3] = x;
+        this.positions[i3 + 1] = y;
+        
+        // Mark position attribute as needing update
+        this.geometry.attributes.position.needsUpdate = true;
+    }
+    
+    /**
+     * Update a node's color based on state
+     * @param {string} nodeId - ID of the node to update
+     * @param {string} nodeType - Type of the node
+     * @param {string} state - State of the node (default, selected, neighbor, hover)
+     */
+    updateNodeColor(nodeId, nodeType, state = 'default') {
+        if (!this.nodeIndices.has(nodeId)) return;
+        
+        // Store node type if provided
+        if (nodeType) {
+            this.nodeTypes.set(nodeId, nodeType);
+        } else {
+            // Use stored type if available
+            nodeType = this.nodeTypes.get(nodeId) || 'simple';
+        }
+        
+        const index = this.nodeIndices.get(nodeId);
+        const i3 = index * 3;
+        
+        // Get color for this node state
+        const color = new THREE.Color(this.themeManager.getNodeColor(nodeType, state));
+        
+        // Update color in buffer
+        this.colors[i3] = color.r;
+        this.colors[i3 + 1] = color.g;
+        this.colors[i3 + 2] = color.b;
+        
+        // Mark colors attribute as needing update
+        this.geometry.attributes.color.needsUpdate = true;
+    }
+    
+    /**
+     * Update colors for all nodes based on selection state
+     * @param {string} selectedId - ID of the selected node
+     * @param {Set<string>} neighborIds - Set of neighbor node IDs
+     * @param {string} hoveredId - ID of the hovered node
+     */
+    updateColors(selectedId, neighborIds, hoveredId) {
+        // Reset tracking sets
+        this.selectedIndices.clear();
+        this.neighborIndices.clear();
+        this.hoverIndex = -1;
+        
+        // Track indices for faster updates
+        if (selectedId && this.nodeIndices.has(selectedId)) {
+            this.selectedIndices.add(this.nodeIndices.get(selectedId));
+        }
+        
+        neighborIds.forEach(id => {
+            if (this.nodeIndices.has(id)) {
+                this.neighborIndices.add(this.nodeIndices.get(id));
+            }
+        });
+        
+        if (hoveredId && this.nodeIndices.has(hoveredId)) {
+            this.hoverIndex = this.nodeIndices.get(hoveredId);
+        }
+        
+        // Update all node colors based on state
+        for (const [nodeId, index] of this.nodeIndices.entries()) {
+            const i3 = index * 3;
+            let state = 'default';
+            
+            // Determine state based on selection and hover
+            if (index === this.hoverIndex) {
+                state = 'hover';
+            } else if (this.selectedIndices.has(index)) {
+                state = 'selected';
+            } else if (this.neighborIndices.has(index)) {
+                state = 'neighbor';
+            }
+            
+            // Get node type from our stored map
+            const nodeType = this.nodeTypes.get(nodeId) || 'simple';
+            
+            // Get color for this state
+            const color = new THREE.Color(this.themeManager.getNodeColor(nodeType, state));
+            
+            // Update color
+            this.colors[i3] = color.r;
+            this.colors[i3 + 1] = color.g;
+            this.colors[i3 + 2] = color.b;
+        }
+        
+        // Mark attributes as needing update
+        this.geometry.attributes.color.needsUpdate = true;
+    }
+    
+    /**
+     * Find the closest node to a mouse position
+     * @param {THREE.Raycaster} raycaster - The raycaster
+     * @param {number} threshold - Maximum distance to consider a hit (in screen space)
+     * @returns {string|null} ID of the closest node or null if none found
+     */
+    findClosestNode(raycaster, threshold = 0.05) {
+        if (this.nodeCount === 0 || !this.positions) return null;
+        
+        // Get the camera from the scene manager or from the global controller
+        let camera = null;
+        let mousePosition = null;
+        
+        if (this.sceneManager) {
+            camera = this.sceneManager.camera;
+            mousePosition = this.sceneManager.mouse; // This is the normalized mouse position
+        } else if (window.lastGraphController && window.lastGraphController.sceneManager) {
+            camera = window.lastGraphController.sceneManager.camera;
+            mousePosition = window.lastGraphController.sceneManager.mouse;
+        }
+        
+        // If we can't get a camera or mouse position, we can't continue
+        if (!camera || !mousePosition) return null;
+        
+        // Find the closest node based on screen space distance
+        let closestDistance = Infinity;
+        let closestNodeId = null;
+        
+        // Check each node
+        for (const [nodeId, index] of this.nodeIndices.entries()) {
+            const i3 = index * 3;
+            
+            // Get node position
+            const nodePos = new THREE.Vector3(
+                this.positions[i3],
+                this.positions[i3 + 1],
+                this.positions[i3 + 2]
+            );
+            
+            // Project to screen space
+            const screenPos = nodePos.clone().project(camera);
+            
+            // Calculate 2D distance in screen space between mouse and node
+            const dx = screenPos.x - mousePosition.x;
+            const dy = screenPos.y - mousePosition.y;
+            const distance = Math.sqrt(dx * dx + dy * dy);
+            
+            // Get node size and adjust threshold based on size
+            const nodeSize = this.sizes[index];
+            const adjustedThreshold = threshold * (1 + (nodeSize / 10));
+            
+            // If this node is closer than the current closest and within threshold, update
+            if (distance < closestDistance && distance < adjustedThreshold) {
+                closestDistance = distance;
+                closestNodeId = nodeId;
+            }
+        }
+        
+        return closestNodeId;
+    }
+    
+    /**
+     * Remove a node from the point cloud
+     * @param {string} nodeId - ID of the node to remove
+     */
+    removeNode(nodeId) {
+        if (!this.nodeIndices.has(nodeId)) return;
+        
+        const indexToRemove = this.nodeIndices.get(nodeId);
+        
+        // Only perform complex removal if not the last node
+        if (indexToRemove !== this.nodeCount - 1) {
+            // Move the last node to this position
+            const lastIndex = this.nodeCount - 1;
+            const lastI3 = lastIndex * 3;
+            const removeI3 = indexToRemove * 3;
+            
+            // Copy position
+            this.positions[removeI3] = this.positions[lastI3];
+            this.positions[removeI3 + 1] = this.positions[lastI3 + 1];
+            this.positions[removeI3 + 2] = this.positions[lastI3 + 2];
+            
+            // Copy color
+            this.colors[removeI3] = this.colors[lastI3];
+            this.colors[removeI3 + 1] = this.colors[lastI3 + 1];
+            this.colors[removeI3 + 2] = this.colors[lastI3 + 2];
+            
+            // Copy size
+            this.sizes[indexToRemove] = this.sizes[lastIndex];
+            
+            // Find which node was at the last position
+            let lastNodeId = null;
+            for (const [id, index] of this.nodeIndices.entries()) {
+                if (index === lastIndex) {
+                    lastNodeId = id;
+                    break;
+                }
+            }
+            
+            // Update the moved node's index
+            if (lastNodeId) {
+                this.nodeIndices.set(lastNodeId, indexToRemove);
+            }
+        }
+        
+        // Remove the node from tracking
+        this.nodeIndices.delete(nodeId);
+        this.nodeCount--;
+        
+        // Update draw range
+        this.geometry.setDrawRange(0, this.nodeCount);
+        
+        // Mark attributes as needing update
+        this.geometry.attributes.position.needsUpdate = true;
+        this.geometry.attributes.color.needsUpdate = true;
+        this.geometry.attributes.size.needsUpdate = true;
+    }
+    
+    /**
+     * Clear all nodes from the point cloud
+     */
+    clear() {
+        this.nodeIndices.clear();
+        this.nodeTypes.clear();
+        this.nodeCount = 0;
+        this.geometry.setDrawRange(0, 0);
+        
+        // Reset state tracking
+        this.selectedIndices.clear();
+        this.neighborIndices.clear();
+        this.hoverIndex = -1;
+    }
+    
+    /**
+     * Update all positions from the node objects
+     * @param {Map} nodes - Map of nodes with current positions
+     */
+    updateAllPositions(nodes) {
+        // Update all node positions from data
+        for (const [nodeId, node] of nodes.entries()) {
+            if (this.nodeIndices.has(nodeId) && node.x !== undefined && node.y !== undefined) {
+                const index = this.nodeIndices.get(nodeId);
+                const i3 = index * 3;
+                
+                this.positions[i3] = node.x;
+                this.positions[i3 + 1] = node.y;
+            }
+        }
+        
+        // Mark position attribute as needing update
+        this.geometry.attributes.position.needsUpdate = true;
+    }
+}
+
+/**
+ * SimulationManager - Manages the D3 force-directed simulation
+ */
+class SimulationManager {
+    constructor(dataManager, graphObjectManager, themeManager) {
+        this.dataManager = dataManager;
+        this.graphObjectManager = graphObjectManager;
+        this.themeManager = themeManager;
+        
+        this.simulation = null;
+        this.isRunning = false;
+        
+        // Initialize spatial partitioning
+        this.spatialGrid = null;
+        this.useSpatialIndex = true;
+        this.gridUpdateInterval = 30; // Update grid every 30 frames
+        this.gridUpdateCounter = 0;
+        this.gridCellSize = 200; // Size of each grid cell
+        
+        // Initialize the simulation
+        this.initSimulation();
+        this.initSpatialIndex();
+    }
+    
+    /**
+     * Initialize D3 force simulation
+     */
+    initSimulation() {
+        // Calculate connection counts for better distribution
+        const connectionCounts = this.calculateConnectionCounts();
+        
+        // Link distance based on connection count
+        const linkDistance = link => {
+            const sourceId = typeof link.source === 'object' ? link.source.id : link.source;
+            const targetId = typeof link.target === 'object' ? link.target.id : link.target;
+            
+            const sourceConnections = connectionCounts.get(sourceId) || 0;
+            const targetConnections = connectionCounts.get(targetId) || 0;
+            
+            // Scale distance based on connection count
+            const baseDistance = this.themeManager.config.defaultDistance;
+            const connectionFactor = Math.max(sourceConnections, targetConnections);
+            
+            return baseDistance * (1 + Math.log(1 + connectionFactor * 0.2));
+        };
+        
+        // Collision radius based on connection count
+        const collisionRadius = node => {
+            const connections = connectionCounts.get(node.id) || 0;
+            const baseRadius = 15;
+            
+            // Increase collision radius for highly connected nodes
+            if (connections > this.themeManager.config.highConnectionThreshold) {
+                return baseRadius * (1 + Math.log(connections) * 0.1);
+            }
+            return baseRadius;
+        };
+        
+        // For monitoring simulation progress
+        this.tickCounter = 0;
+        this.lastLogTime = 0;
+        
+        // Create the simulation with all forces
+        this.simulation = d3.forceSimulation()
+            .force('link', d3.forceLink().id(d => d.id).distance(linkDistance))
+            .force('charge', d3.forceManyBody().strength(-15))
+            .force('center', d3.forceCenter(0, 0))
+            .force('collision', d3.forceCollide().radius(collisionRadius))
+            .force('x', d3.forceX().strength(0.001))
+            .force('y', d3.forceY().strength(0.005))
+            .on('tick', () => {
+                this.tickCounter++;
+                this.onSimulationTick();
+                this.monitorSimulationProgress();
+            })
+            .on('end', () => {
+                console.log('Simulation reached equilibrium!');
+                console.log('Final alpha:', this.simulation.alpha());
+                console.log('Alpha min:', this.simulation.alphaMin());
+                console.log('Alpha decay:', this.simulation.alphaDecay());
+                console.log('Node count:', this.simulation.nodes().length);
+                console.log('Total ticks:', this.tickCounter);
+                this.isRunning = false;
+            });
+        
+        // Adjust alpha settings for longer simulation time
+        // Reduce decay rate (default is ~0.0228 which is 1% cooling per tick)
+        this.simulation.alphaDecay(0.0228);  // Slower decay (about 0.5% cooling per tick)
+        
+        // Lower minimum alpha threshold (default is 0.001)
+        this.simulation.alphaMin(0.001);  // Lower threshold for stopping
+        
+        // Reduce velocity decay for more momentum (default is 0.4)
+        this.simulation.velocityDecay(0.1);
+    }
+    
+    /**
+     * Calculate connection counts for each node
+     * @returns {Map} Map of node IDs to connection counts
+     */
+    calculateConnectionCounts() {
+        const connectionCounts = new Map();
+        
+        // Count connections for each node
+        this.dataManager.graphData.links.forEach(link => {
+            const sourceId = typeof link.source === 'object' ? link.source.id : link.source;
+            const targetId = typeof link.target === 'object' ? link.target.id : link.target;
+            
+            connectionCounts.set(sourceId, (connectionCounts.get(sourceId) || 0) + 1);
+            connectionCounts.set(targetId, (connectionCounts.get(targetId) || 0) + 1);
+        });
+        
+        return connectionCounts;
+    }
+    
+    /**
+     * Update the simulation with current nodes and links
+     * @param {boolean} restart - Whether to restart the simulation
+     */
+    updateSimulation(restart = true) {
+        if (!this.simulation) return;
+        
+        // Get visible nodes and links from data manager
+        const visibleNodes = Array.from(this.dataManager.graphObjects.nodes.values());
+        const visibleLinks = Array.from(this.dataManager.graphObjects.links.values());
+        
+        console.log(`Updating simulation with ${visibleNodes.length} nodes and ${visibleLinks.length} links`);
+        
+        // Update nodes and links in the simulation
+        this.simulation.nodes(visibleNodes);
+        this.simulation.force('link').links(visibleLinks);
+        
+        // Restart simulation if needed
+        if (restart && this.themeManager.config.physicsEnabled) {
+            // Reset tick counter and timing
+            this.tickCounter = 0;
+            this.lastLogTime = Date.now();
+            
+            // Set a higher alpha to ensure thorough exploration of layout space
+            const startingAlpha = 1.0;
+            console.log(`Starting simulation with alpha=${startingAlpha}, alphaMin=${this.simulation.alphaMin()}, alphaDecay=${this.simulation.alphaDecay()}`);
+            this.simulation.alpha(startingAlpha).restart();
+            this.isRunning = true;
+        } else {
+            console.log("Simulation not restarted (either restart=false or physics is disabled)");
+            this.simulation.alpha(0);
+            this.isRunning = false;
+        }
+    }
+    
+    /**
+     * Toggle physics simulation on/off
+     * @returns {boolean} The new physics state
+     */
+    togglePhysics() {
+        const physicsEnabled = this.themeManager.togglePhysics();
+        
+        console.log(`Physics simulation ${physicsEnabled ? 'enabled' : 'disabled'}`);
+        
+        // Use updateSimulation to properly handle the physics state
+        this.updateSimulation(physicsEnabled);
+        
+        return physicsEnabled;
+    }
+    
+    /**
+     * Handle force simulation tick events
+     * Updates the positions of nodes and links in the visualization
+     */
+    onSimulationTick() {
+        this.updatePositions();
+        
+        // Update spatial grid periodically
+        if (this.useSpatialIndex) {
+            this.updateSpatialGrid();
+        }
+    }
+    
+    /**
+     * Update positions of all nodes and links
+     */
+    updatePositions() {
+        // Check if we have a NodeCloud available
+        if (this.graphController && this.graphController.nodeCloud) {
+            // Bulk update the NodeCloud for better performance
+            this.graphController.nodeCloud.updateAllPositions(this.dataManager.graphObjects.nodes);
+            
+            // Update virtual objects for compatibility with other systems
+            this.dataManager.graphObjects.nodes.forEach(node => {
+                if (node.object && node.object.position) {
+                    node.object.position.x = node.x || 0;
+                    node.object.position.y = node.y || 0;
+                }
+                
+                // Update labels separately
+                if (node.labelObject) {
+                    this.graphObjectManager.updateNodePosition(node);
+                }
+            });
+        }
+        
+        // Update the position of links in the scene
+        this.dataManager.graphObjects.links.forEach((link) => {
+            this.graphObjectManager.updateLinkPosition(link);
+        });
+    }
+    
+    /**
+     * Monitor simulation progress with periodic logging
+     */
+    monitorSimulationProgress() {
+        // Only log every 100 ticks to avoid spamming the console
+        if (this.tickCounter % 100 === 0) {
+            const now = Date.now();
+            const timeSinceLastLog = now - this.lastLogTime;
+            this.lastLogTime = now;
+            
+            // Only print if we're still running
+            if (this.isRunning) {
+                const currentAlpha = this.simulation.alpha();
+                console.log(`Simulation progress: tick=${this.tickCounter}, alpha=${currentAlpha.toFixed(6)}, ticks/second=${(100 / (timeSinceLastLog / 1000)).toFixed(1)}`);
+            }
+        }
+    }
+    
+    /**
+     * Initialize spatial index using a simple grid system
+     */
+    initSpatialIndex() {
+        this.spatialGrid = new SpatialGrid(this.gridCellSize);
+    }
+    
+    /**
+     * Add a node to the spatial grid
+     * @param {Object} node - The node to add
+     */
+    addNodeToSpatialGrid(node) {
+        if (!this.useSpatialIndex || !this.spatialGrid || !node.object) return;
+        
+        // Add node to the grid
+        this.spatialGrid.addObject(node);
+    }
+    
+    /**
+     * Update the spatial grid with current node positions
+     */
+    updateSpatialGrid() {
+        if (!this.useSpatialIndex || !this.spatialGrid) return;
+        
+        // Only update periodically for performance
+        this.gridUpdateCounter++;
+        if (this.gridUpdateCounter < this.gridUpdateInterval) return;
+        this.gridUpdateCounter = 0;
+        
+        // Rebuild the grid
+        this.spatialGrid.clear();
+        
+        // Add all current nodes to the grid
+        this.dataManager.graphObjects.nodes.forEach(node => {
+            if (node.object) {
+                this.spatialGrid.addObject(node);
+            }
+        });
+    }
+    
+    /**
+     * Get nodes within a specific radius of a position
+     * @param {THREE.Vector3} position - The center position
+     * @param {number} radius - The radius to search within
+     * @returns {Array} Array of nodes within the radius
+     */
+    getNodesInRadius(position, radius) {
+        // Use spatial grid for more efficient spatial query
+        return this.spatialGrid.findNearbyObjects(position, radius);
+    }
+}
+
+/**
+ * UIManager - Handles UI elements and user interaction
+ */
+class UIManager {
+    constructor(container, dataManager, graphController) {
+        this.container = container;
+        this.dataManager = dataManager;
+        this.graphController = graphController;
+        
+        // DOM elements
+        this.nodeCountEl = document.getElementById('node-count');
+        this.linkCountEl = document.getElementById('link-count');
+        this.loadingEl = document.getElementById('loading');
+        this.searchInput = document.getElementById('search-input');
+        this.initialMessageEl = null;
+        this.nodeInfoPanel = null;
+        
+        // Search state
+        this.previousSearchValue = '';
+        this.isUpdatingAutocomplete = false;
+        
+        // Autocomplete state
+        this.autocompleteList = null;
+        this.autocompleteSuggestions = [];
+        this.autocompleteSelectedIndex = -1;
+        
+        // Initialize UI elements
+        this.createAutocompleteUI();
+        this.createNodeInfoPanel();
+        this.setupEventListeners();
+    }
+    
+    /**
+     * Set up event listeners for UI controls
+     */
+    setupEventListeners() {
+        // Button event listeners
+        const labelsBtn = document.getElementById('toggle-labels-btn');
+        if (labelsBtn) {
+            // Set initial state based on ThemeManager config
+            // The initial state should be true by default
+            labelsBtn.classList.add('active');
+            
+            // Add click handler
+            labelsBtn.addEventListener('click', () => {
+                const showLabels = this.graphController.toggleLabels();
+                // Toggle active class based on the returned state
+                labelsBtn.classList.toggle('active', showLabels);
+            });
+        }
+
+        document.getElementById('reset-btn')?.addEventListener('click', () => {
+            this.graphController.resetView();
+            this.hideAutocomplete();
+            this.previousSearchValue = '';
+            this.searchInput.value = '';
+        });
+        
+        // Add click handler for the Load All Nodes button
+        document.getElementById('load-all-btn')?.addEventListener('click', () => {
+            this.graphController.loadAllNodes();
+        });
+        
+        // Set up search input with debounced handling
+        if (this.searchInput) {
+            let searchTimeout = null;
+            
+            // Input event for search text changes
+            this.searchInput.addEventListener('input', (e) => {
+                if (this.isUpdatingAutocomplete) return;
+                
+                const currentValue = e.target.value.trim();
+                if (currentValue === this.previousSearchValue) return;
+                
+                this.previousSearchValue = currentValue;
+                clearTimeout(searchTimeout);
+                
+                if (currentValue.length > 0) {
+                    this.isUpdatingAutocomplete = true;
+                    searchTimeout = setTimeout(() => {
+                        this.updateAutocompleteSuggestions(currentValue);
+                        this.isUpdatingAutocomplete = false;
+                    }, 250);
+                } else {
+                    this.hideAutocomplete();
+                }
+            });
+            
+            // Keyboard navigation in autocomplete dropdown
+            this.searchInput.addEventListener('keydown', (e) => {
+                if (['ArrowUp', 'ArrowDown', 'Enter', 'Escape'].includes(e.key)) {
+                    this.handleAutocompleteKeydown(e);
+                }
+            });
+            
+            // Focus handler to show autocomplete
+            this.searchInput.addEventListener('focus', () => {
+                if (this.isUpdatingAutocomplete) return;
+                
+                const currentValue = this.searchInput.value.trim();
+                if (currentValue.length > 0) {
+                    this.previousSearchValue = currentValue;
+                    this.isUpdatingAutocomplete = true;
+                    this.updateAutocompleteSuggestions(currentValue);
+                    this.isUpdatingAutocomplete = false;
+                }
+            });
+        }
+        
+        // Hide autocomplete when clicking outside
+        document.addEventListener('click', (e) => {
+            if (this.autocompleteList && e.target !== this.searchInput && !this.autocompleteList.contains(e.target)) {
+                this.hideAutocomplete();
+            }
+        });
+    }
+    
+    /**
+     * Create the autocomplete UI elements
+     */
+    createAutocompleteUI() {
+        if (!this.searchInput) return;
+        
+        // Create autocomplete container if it doesn't exist
+        if (!this.autocompleteList) {
+            this.autocompleteList = document.createElement('div');
+            this.autocompleteList.className = 'autocomplete-items';
+            this.autocompleteList.style.display = 'none';
+            this.autocompleteList.style.position = 'absolute';
+            this.autocompleteList.style.zIndex = '999';
+            this.autocompleteList.style.maxHeight = '300px';
+            this.autocompleteList.style.overflowY = 'auto';
+            this.autocompleteList.style.width = '100%';
+            this.autocompleteList.style.background = '#fff';
+            this.autocompleteList.style.border = '1px solid #ddd';
+            this.autocompleteList.style.borderRadius = '0 0 4px 4px';
+            this.autocompleteList.style.boxShadow = '0 2px 4px rgba(0,0,0,0.2)';
+            
+            // Append to parent container
+            const searchContainer = this.searchInput.parentNode;
+            searchContainer.appendChild(this.autocompleteList);
+        }
+    }
+    
+    /**
+     * Update autocomplete suggestions based on search term
+     * @param {string} searchTerm - The current search term
+     */
+    updateAutocompleteSuggestions(searchTerm) {
+        if (!this.autocompleteList || !searchTerm) {
+            this.hideAutocomplete();
+            return;
+        }
+        
+        // Clear previous suggestions
+        this.autocompleteList.innerHTML = '';
+        this.autocompleteSuggestions = [];
+        this.autocompleteSelectedIndex = -1;
+        
+        const maxSuggestions = 10;
+        const searchLower = searchTerm.toLowerCase();
+        
+        // Get all nodes that match the search term
+        const matchingNodes = this.dataManager.graphData.nodes
+            .filter(node => (
+                (node.id && node.id.toLowerCase().includes(searchLower)) ||
+                (node.label && node.label.toLowerCase().includes(searchLower))
+            ))
+            .sort((a, b) => {
+                // Prioritize exact matches and matches at the beginning
+                const aId = a.id.toLowerCase();
+                const bId = b.id.toLowerCase();
+                const aLabel = (a.label || '').toLowerCase();
+                const bLabel = (b.label || '').toLowerCase();
+                
+                // Check for exact matches first
+                if (aId === searchLower || aLabel === searchLower) return -1;
+                if (bId === searchLower || bLabel === searchLower) return 1;
+                
+                // Then check for starting with search term
+                if (aId.startsWith(searchLower) || aLabel.startsWith(searchLower)) return -1;
+                if (bId.startsWith(searchLower) || bLabel.startsWith(searchLower)) return 1;
+                
+                // Fallback to alphabetical
+                return aId.localeCompare(bId);
+            })
+            .slice(0, maxSuggestions);
+        
+        if (matchingNodes.length === 0) {
+            this.hideAutocomplete();
+            return;
+        }
+        
+        // Save suggestions for keyboard navigation
+        this.autocompleteSuggestions = matchingNodes;
+        
+        // Create suggestion items
+        matchingNodes.forEach((node, index) => {
+            const item = document.createElement('div');
+            item.className = 'autocomplete-item';
+            item.style.padding = '8px 12px';
+            item.style.cursor = 'pointer';
+            item.style.borderBottom = '1px solid #f4f4f4';
+            
+            // Highlight matching parts
+            const displayText = node.label || node.id;
+            const parts = displayText.split(new RegExp(`(${searchTerm})`, 'i'));
+            
+            parts.forEach(part => {
+                const span = document.createElement('span');
+                span.textContent = part;
+                if (part.toLowerCase() === searchTerm.toLowerCase()) {
+                    span.style.fontWeight = 'bold';
+                    span.style.backgroundColor = 'rgba(66, 133, 244, 0.1)';
+                }
+                item.appendChild(span);
+            });
+            
+            // Add node type indicator
+            const typeIndicator = document.createElement('span');
+            typeIndicator.style.marginLeft = '8px';
+            typeIndicator.style.padding = '2px 6px';
+            typeIndicator.style.borderRadius = '10px';
+            typeIndicator.style.fontSize = '0.8em';
+            
+            // Different styling for different node types
+            if (node.type === 'simple') {
+                typeIndicator.textContent = 'item';
+                typeIndicator.style.backgroundColor = 'rgba(100, 149, 237, 0.2)';
+                typeIndicator.style.color = 'rgb(50, 90, 160)';
+            } else {
+                typeIndicator.textContent = 'collection';
+                typeIndicator.style.backgroundColor = 'rgba(240, 128, 128, 0.2)';
+                typeIndicator.style.color = 'rgb(180, 70, 70)';
+            }
+            
+            item.appendChild(typeIndicator);
+            
+            // Add hover effect
+            item.addEventListener('mouseover', () => {
+                this.autocompleteSelectedIndex = index;
+                this.highlightSelectedSuggestion();
+            });
+            
+            // Add click handler
+            item.addEventListener('click', () => {
+                this.searchInput.value = node.id;
+                this.hideAutocomplete();
+                this.graphController.searchNodes(node.id);
+            });
+            
+            this.autocompleteList.appendChild(item);
+        });
+        
+        // Show the autocomplete list
+        this.autocompleteList.style.display = 'block';
+    }
+    
+    /**
+     * Handle keyboard navigation in autocomplete list
+     * @param {KeyboardEvent} event - The keyboard event
+     */
+    handleAutocompleteKeydown(event) {
+        // If no suggestions or hidden, do nothing special except for Enter
+        if (this.autocompleteSuggestions.length === 0 || 
+            this.autocompleteList.style.display === 'none') {
+            if (event.key === 'Enter') {
+                const searchTerm = this.searchInput.value.trim();
+                if (searchTerm) {
+                    this.graphController.searchNodes(searchTerm);
+                    this.hideAutocomplete();
+                }
+            }
+            return;
+        }
+        
+        switch (event.key) {
+            case 'ArrowDown':
+                // Move selection down
+                event.preventDefault();
+                this.autocompleteSelectedIndex = Math.min(
+                    this.autocompleteSelectedIndex + 1,
+                    this.autocompleteSuggestions.length - 1
+                );
+                this.highlightSelectedSuggestion();
+                break;
+                
+            case 'ArrowUp':
+                // Move selection up
+                event.preventDefault();
+                this.autocompleteSelectedIndex = Math.max(this.autocompleteSelectedIndex - 1, -1);
+                this.highlightSelectedSuggestion();
+                break;
+                
+            case 'Enter':
+                // Select current suggestion or search with current text
+                event.preventDefault();
+                if (this.autocompleteSelectedIndex >= 0) {
+                    const selectedNode = this.autocompleteSuggestions[this.autocompleteSelectedIndex];
+                    this.searchInput.value = selectedNode.id;
+                    this.graphController.searchNodes(selectedNode.id);
+                } else {
+                    const searchTerm = this.searchInput.value.trim();
+                    if (searchTerm) {
+                        this.graphController.searchNodes(searchTerm);
+                    }
+                }
+                this.hideAutocomplete();
+                break;
+                
+            case 'Escape':
+                // Hide autocomplete
+                event.preventDefault();
+                this.hideAutocomplete();
+                break;
+        }
+    }
+    
+    /**
+     * Highlight the currently selected suggestion item
+     */
+    highlightSelectedSuggestion() {
+        // Remove highlight from all items
+        const items = this.autocompleteList.querySelectorAll('.autocomplete-item');
+        items.forEach(item => {
+            item.style.backgroundColor = '';
+        });
+        
+        // Highlight selected item if any
+        if (this.autocompleteSelectedIndex >= 0 && this.autocompleteSelectedIndex < items.length) {
+            const selectedItem = items[this.autocompleteSelectedIndex];
+            selectedItem.style.backgroundColor = 'rgba(66, 133, 244, 0.1)';
+            
+            // Scroll into view if needed
+            if (selectedItem.offsetTop < this.autocompleteList.scrollTop) {
+                this.autocompleteList.scrollTop = selectedItem.offsetTop;
+            } else if (selectedItem.offsetTop + selectedItem.offsetHeight > 
+                       this.autocompleteList.scrollTop + this.autocompleteList.offsetHeight) {
+                this.autocompleteList.scrollTop = 
+                    selectedItem.offsetTop + selectedItem.offsetHeight - this.autocompleteList.offsetHeight;
+            }
+        }
+    }
+    
+    /**
+     * Hide the autocomplete list
+     */
+    hideAutocomplete() {
+        if (this.autocompleteList) {
+            this.autocompleteList.style.display = 'none';
+            this.autocompleteSelectedIndex = -1;
+        }
+    }
+    
+    /**
+     * Show or hide the loading indicator
+     * @param {boolean} show - Whether to show or hide the loading indicator
+     */
+    showLoading(show) {
+        if (this.loadingEl) {
+            this.loadingEl.style.display = show ? 'block' : 'none';
+        }
+    }
+    
+    /**
+     * Show an initial message in the graph area
+     * @param {string} message - The message to display
+     */
+    showInitialMessage(message) {
+        // Create or update the message element
+        if (!this.initialMessageEl) {
+            this.initialMessageEl = document.createElement('div');
+            this.initialMessageEl.style.position = 'absolute';
+            this.initialMessageEl.style.top = '50%';
+            this.initialMessageEl.style.left = '50%';
+            this.initialMessageEl.style.transform = 'translate(-50%, -50%)';
+            this.initialMessageEl.style.background = 'rgba(0, 0, 0, 0.7)';
+            this.initialMessageEl.style.color = '#ffffff';
+            this.initialMessageEl.style.padding = '20px';
+            this.initialMessageEl.style.borderRadius = '8px';
+            this.initialMessageEl.style.maxWidth = '80%';
+            this.initialMessageEl.style.textAlign = 'center';
+            this.initialMessageEl.style.fontSize = '18px';
+            this.container.appendChild(this.initialMessageEl);
+        }
+        
+        this.initialMessageEl.textContent = message;
+        this.initialMessageEl.style.display = 'block';
+    }
+    
+    /**
+     * Hide the initial message
+     */
+    hideInitialMessage() {
+        if (this.initialMessageEl) {
+            this.initialMessageEl.style.display = 'none';
+        }
+    }
+    
+    /**
+     * Show error message
+     * @param {string} message - The error message to display
+     */
+    showError(message) {
+        console.error(message);
+        this.showInitialMessage(message);
+    }
+    
+    /**
+     * Update statistics display
+     */
+    updateStats() {
+        if (this.nodeCountEl) {
+            this.nodeCountEl.textContent = this.dataManager.graphData.nodes.length;
+        }
+        if (this.linkCountEl) {
+            this.linkCountEl.textContent = this.dataManager.graphData.links.length;
+        }
+    }
+    
+    /**
+     * Create the node info panel
+     */
+    createNodeInfoPanel() {
+        if (!this.nodeInfoPanel) {
+            this.nodeInfoPanel = document.createElement('div');
+            this.nodeInfoPanel.className = 'node-info-panel';
+            this.nodeInfoPanel.style.display = 'none';
+            this.container.appendChild(this.nodeInfoPanel);
+        }
+    }
+    
+    /**
+     * Show node information in the info panel
+     * @param {string} nodeId - The ID of the node to display info for
+     */
+    showNodeInfo(nodeId) {
+        if (!this.nodeInfoPanel) this.createNodeInfoPanel();
+        
+        const node = this.dataManager.graphObjects.nodes.get(nodeId);
+        if (!node) return;
+        
+        // Store the current node ID for the Get Data button
+        this.currentNodeId = nodeId;
+        
+        // Get the node's connections
+        const connectedLinks = this.dataManager.getConnectedLinks(nodeId);
+        const connectionCount = connectedLinks.length;
+        
+        // Get any additional properties
+        const nodeType = node.type || 'Unknown';
+        const nodeLabel = node.label || nodeId;
+        
+        // Build HTML content
+        let html = `
+            <h3>${nodeLabel}</h3>
+            <p><strong>ID:</strong> ${this.truncateWithEllipsis(nodeId)}</p>
+            <p><strong>Type:</strong> ${nodeType}</p>
+            <p><strong>Connections:</strong> ${connectionCount}</p>
+        `;
+        
+        // Only show the Get Data button for composite nodes where the ID doesn't start with "data/"
+        if (nodeType === 'composite' && !nodeId.startsWith('data/')) {
+            html += `
+                <button id="get-node-data" class="node-data-btn" style="
+                    background-color: #4D90FE;
+                    color: white;
+                    border: none;
+                    padding: 6px 12px;
+                    margin: 10px 0;
+                    border-radius: 4px;
+                    cursor: pointer;
+                    font-size: 13px;
+                    display: flex;
+                    align-items: center;
+                    justify-content: center;
+                    width: 100%;
+                ">
+                    <i class="fas fa-download" style="margin-right: 6px;"></i> 
+                    Get Node Data
+                </button>
+                <div id="node-data-result" style="display: none; margin-top: 10px; max-height: 200px; overflow-y: auto;"></div>
+            `;
+        }
+        
+        // Add any other properties that exist
+        if (node.data) {
+            html += `<p><strong>Data:</strong> ${JSON.stringify(node.data)}</p>`;
+        }
+        
+        // Add information about connected nodes
+        if (connectionCount > 0) {
+            html += `<p><strong>Connected Nodes:</strong></p>`;
+            html += `<div class="connected-nodes-list" style="max-height: 400px; overflow-y: auto; margin-top: 8px;">`;
+            
+            // Get info about connected nodes
+            const connectedNodes = new Map(); // Use Map to avoid duplicates
+            
+            connectedLinks.forEach(link => {
+                const sourceId = typeof link.source === 'object' ? link.source.id : link.source;
+                const targetId = typeof link.target === 'object' ? link.target.id : link.target;
+                
+                // Get the ID of the connected node (not the current node)
+                const connectedNodeId = sourceId === nodeId ? targetId : sourceId;
+                
+                // Store relationship type if available
+                const relationship = link.label || '';
+                
+                // Get the connected node
+                const connectedNode = this.dataManager.graphObjects.nodes.get(connectedNodeId);
+                if (connectedNode && !connectedNodes.has(connectedNodeId)) {
+                    connectedNodes.set(connectedNodeId, {
+                        node: connectedNode,
+                        relationship: relationship
+                    });
+                }
+            });
+            
+            // Display connected nodes (limited to avoid overwhelming the panel)
+            const maxNodesToShow = 50;
+            let nodeCount = 0;
+            
+            connectedNodes.forEach((data, connectedNodeId) => {
+                if (nodeCount < maxNodesToShow) {
+                    const connectedNode = data.node;
+                    const relationship = data.relationship;
+                    
+                    const truncatedId = this.truncateWithEllipsis(connectedNodeId);
+                    const nodeLabel = connectedNode.label || truncatedId;
+                    const nodeType = connectedNode.type || 'Unknown';
+                    
+                    html += `<div class="connected-node-item" data-node-id="${connectedNodeId}" 
+                            style="margin-bottom: 8px; padding: 5px 10px; border-left: 3px solid #eee; 
+                            cursor: pointer; border-radius: 2px;
+                            transition: background-color 0.2s;">`;
+                    html += `<strong>${nodeLabel}</strong>`;
+                    html += `<div style="color: #666; font-size: 0.9em;">${nodeType}</div>`;
+                    
+                    if (relationship) {
+                        html += `<div style="font-style: italic; font-size: 0.85em; margin-top: 2px; color: #888;">
+                            Relationship: ${relationship}</div>`;
+                    }
+                    
+                    html += `</div>`;
+                    
+                    nodeCount++;
+                }
+            });
+            
+            // If there are more nodes than we're showing
+            if (connectedNodes.size > maxNodesToShow) {
+                html += `<div style="font-style: italic; margin-top: 5px;">...and ${connectedNodes.size - maxNodesToShow} more</div>`;
+            }
+            
+            html += `</div>`;
+        }
+        
+        // Set content and show panel
+        this.nodeInfoPanel.innerHTML = html;
+        this.nodeInfoPanel.style.display = 'block';
+        
+        // Add event listener for the Get Data button
+        const getDataBtn = document.getElementById('get-node-data');
+        if (getDataBtn) {
+            getDataBtn.addEventListener('click', () => this.fetchNodeData(nodeId));
+        }
+        
+        // Add event listeners to connected node items
+        const nodeItems = this.nodeInfoPanel.querySelectorAll('.connected-node-item');
+        nodeItems.forEach(item => {
+            // Hover effect
+            item.addEventListener('mouseover', () => {
+                item.style.backgroundColor = '#f5f5f5';
+                item.style.borderLeftColor = '#4D90FE';
+            });
+            
+            item.addEventListener('mouseout', () => {
+                item.style.backgroundColor = '';
+                item.style.borderLeftColor = '#eee';
+            });
+            
+            // Click to select the node
+            item.addEventListener('click', () => {
+                const clickedNodeId = item.getAttribute('data-node-id');
+                if (clickedNodeId && this.graphController.eventManager) {
+                    this.graphController.eventManager.selectNode(clickedNodeId);
+                    this.graphController.eventManager.focusOnNode(clickedNodeId);
+                }
+            });
+        });
+    }
+    
+    /**
+     * Fetch data for a specific node from the server
+     * @param {string} nodeId - The ID of the node to fetch data for
+     */
+    fetchNodeData(nodeId) {
+        // Get the result container
+        const resultContainer = document.getElementById('node-data-result');
+        if (!resultContainer) return;
+        
+        // Show loading indicator
+        resultContainer.style.display = 'block';
+        resultContainer.innerHTML = `
+            <div style="display: flex; align-items: center; justify-content: center; padding: 20px;">
+                <div style="border: 3px solid #f3f3f3; border-top: 3px solid #3498db; 
+                    border-radius: 50%; width: 20px; height: 20px; animation: spin 1s linear infinite;"></div>
+                <div style="margin-left: 10px;">Loading data...</div>
+            </div>
+            <style>
+                @keyframes spin {
+                    0% { transform: rotate(0deg); }
+                    100% { transform: rotate(360deg); }
+                }
+            </style>
+        `;
+        
+        // Construct the URL for the data endpoint
+        const url = `/${nodeId}`;
+        
+        // Fetch the data
+        fetch(url)
+            .then(response => {
+                if (!response.ok) {
+                    throw new Error(`HTTP error ${response.status}`);
+                }
+                return response.text(); // Using text() instead of json() to handle any type of response
+            })
+            .then(data => {
+                // Try to parse as JSON if possible
+                try {
+                    const jsonData = JSON.parse(data);
+                    this.displayNodeData(jsonData, resultContainer);
+                } catch (e) {
+                    // If not JSON, display as text
+                    this.displayNodeData(data, resultContainer, false);
+                }
+            })
+            .catch(error => {
+                // Show error message
+                resultContainer.innerHTML = `
+                    <div style="color: #e74c3c; padding: 10px; border-left: 3px solid #e74c3c;">
+                        Error loading data: ${error.message}
+                    </div>
+                `;
+            });
+    }
+    
+    /**
+     * Display node data in the result container
+     * @param {Object|string} data - The data to display
+     * @param {HTMLElement} container - The container to display the data in
+     * @param {boolean} isJson - Whether the data is JSON
+     */
+    displayNodeData(data, container, isJson = true) {
+        if (isJson) {
+            // Format JSON for display
+            const formattedJson = JSON.stringify(data, null, 2);
+            container.innerHTML = `
+                <div style="padding: 10px; background-color: #f9f9f9; border-radius: 4px; font-family: monospace; white-space: pre; overflow-x: auto;">
+                    ${formattedJson.replace(/</g, '&lt;').replace(/>/g, '&gt;')}
+                </div>
+            `;
+        } else {
+            // Display as text
+            container.innerHTML = `
+                <div style="padding: 10px; background-color: #f9f9f9; border-radius: 4px; white-space: pre-wrap; overflow-x: auto; font-family: monospace;">
+                    ${data.toString().replace(/</g, '&lt;').replace(/>/g, '&gt;')}
+                </div>
+            `;
+        }
+    }
+
+    /**
+     * Hide the node info panel
+     */
+    hideNodeInfo() {
+        if (this.nodeInfoPanel) {
+            this.nodeInfoPanel.style.display = 'none';
+        }
+    }
+
+    /**
+     * Truncate text and add ellipsis in the middle
+     * @param {string} text - The text to truncate
+     * @returns {string} Truncated text with ellipsis
+     */
+    truncateWithEllipsis(text) {
+        // Show only if longer than 15 characters (6 + 3 + 6)
+        if (!text || text.length <= 15) {
+            return text;
+        }
+        
+        // Take exactly 6 chars from start and 6 from end
+        return text.substring(0, 6) + '...' + text.substring(text.length - 6);
+    }
+}
+
+/**
+ * EventManager - Handles user interaction events
+ */
+class EventManager {
+    constructor(sceneManager, dataManager, graphObjectManager) {
+        this.sceneManager = sceneManager;
+        this.dataManager = dataManager;
+        this.graphObjectManager = graphObjectManager;
+        
+        // Set up event listeners
+        this.setupEventListeners();
+    }
+    
+    /**
+     * Set up graph-specific interaction handlers
+     */
+    setupEventListeners() {
+        const renderer = this.sceneManager.renderer;
+        if (!renderer || !renderer.domElement) return;
+        
+        // Add click event listener for node selection
+        renderer.domElement.addEventListener('click', this.onMouseClick.bind(this));
+        
+        // Add double-click event listener for camera focus
+        renderer.domElement.addEventListener('dblclick', this.onDoubleClick.bind(this));
+        
+        // Add hover event listeners
+        renderer.domElement.addEventListener('mousemove', this.onMouseMove.bind(this));
+    }
+    
+    /**
+     * Handle mouse click events for node selection
+     * @param {MouseEvent} event - The mouse event
+     */
+    onMouseClick(event) {
+        // Calculate mouse position and find intersections
+        this.sceneManager.updateMousePosition(event);
+        
+        // Set the scene manager on the NodeCloud for camera access
+        this.graphController.nodeCloud.sceneManager = this.sceneManager;
+        
+        const nodeId = this.graphController.nodeCloud.findClosestNode(
+            this.sceneManager.raycaster, 
+            0.08  // Screen space threshold for clicks (0-1 normalized coordinates)
+        );
+        
+        if (nodeId) {
+            // We clicked on a node
+            this.selectNode(nodeId);
+        } else {
+            // Clicked on empty space - deselect
+            this.deselectNode();
+        }
+    }
+    
+    /**
+     * Handle double-click events for focusing on nodes
+     * @param {MouseEvent} event - The mouse event
+     */
+    onDoubleClick(event) {
+        // Calculate mouse position and find intersections
+        this.sceneManager.updateMousePosition(event);
+        
+        // Set the scene manager on the NodeCloud for camera access
+        this.graphController.nodeCloud.sceneManager = this.sceneManager;
+        
+        const nodeId = this.graphController.nodeCloud.findClosestNode(
+            this.sceneManager.raycaster, 
+            0.08  // Screen space threshold for double-clicks (0-1 normalized coordinates)
+        );
+        
+        if (nodeId) {
+            // Double-clicked on a node - focus camera on this node
+            this.focusOnNode(nodeId);
+        }
+    }
+    
+    /**
+     * Handle mouse movement for hover effects
+     * @param {MouseEvent} event - The mouse event
+     */
+    onMouseMove(event) {
+        // Calculate mouse position
+        this.sceneManager.updateMousePosition(event);
+        
+        // Set the scene manager on the NodeCloud for camera access
+        this.graphController.nodeCloud.sceneManager = this.sceneManager;
+        
+        const nodeId = this.graphController.nodeCloud.findClosestNode(
+            this.sceneManager.raycaster, 
+            0.04  // Screen space threshold for hover (0-1 normalized coordinates)
+        );
+        
+        if (nodeId) {
+            // Hovering over a node
+            this.hoverNode(nodeId);
+        } else {
+            // Not hovering over any node
+            this.unhoverNode();
+        }
+    }
+    
+    /**
+     * Select a node and highlight it and its connections
+     * @param {string} nodeId - The ID of the node to select
+     */
+    selectNode(nodeId) {
+        if (this.dataManager.selectedNode === nodeId) return;
+        
+        // Set selection in data manager
+        this.dataManager.setSelectedNode(nodeId);
+        
+        // Update colors in bulk
+        this.graphController.nodeCloud.updateColors(
+            nodeId,
+            this.dataManager.neighborNodes,
+            this.dataManager.hoveredNode
+        );
+        
+        // Update link colors
+        this.updateLinkColors();
+        
+        // First, hide all link labels
+        this.dataManager.graphObjects.links.forEach((link, id) => {
+            if (link.labelObject) {
+                link.labelObject.visible = false;
+            }
+        });
+        
+        // Then show labels for active links
+        this.dataManager.activeLinks.forEach(linkId => {
+            const link = this.dataManager.graphObjects.links.get(linkId);
+            if (link && link.labelObject) {
+                link.labelObject.visible = true;
+            }
+        });
+        
+        // Show node info panel
+        const graphController = this.sceneManager.graphController || 
+            (this.graphObjectManager && this.graphObjectManager.graphController);
+            
+        if (graphController && graphController.uiManager) {
+            graphController.uiManager.showNodeInfo(nodeId);
+        }
+    }
+    
+    /**
+     * Deselect the currently selected node
+     */
+    deselectNode() {
+        if (!this.dataManager.selectedNode) return;
+        
+        // Hide all link labels before clearing selection
+        this.dataManager.activeLinks.forEach(linkId => {
+            const link = this.dataManager.graphObjects.links.get(linkId);
+            if (link && link.labelObject) {
+                link.labelObject.visible = false;
+            }
+        });
+        
+        // Clear selection in data manager
+        this.dataManager.clearSelectedNode();
+        
+        // Update colors in bulk
+        this.graphController.nodeCloud.updateColors(
+            null,  // No selected node
+            new Set(),  // No neighbor nodes
+            this.dataManager.hoveredNode  // Keep hover state
+        );
+        
+        // Update link colors
+        this.updateLinkColors();
+        
+        // Hide node info panel
+        const graphController = this.sceneManager.graphController || 
+            (this.graphObjectManager && this.graphObjectManager.graphController);
+            
+        if (graphController && graphController.uiManager) {
+            graphController.uiManager.hideNodeInfo();
+        }
+    }
+    
+    /**
+     * Focus the camera on a specific node
+     * @param {string} nodeId - The ID of the node to focus on
+     */
+    focusOnNode(nodeId) {
+        const node = this.dataManager.graphObjects.nodes.get(nodeId);
+        if (!node || !node.object) return;
+        
+        const position = node.object.position.clone();
+        this.sceneManager.focusCamera(position);
+    }
+    
+    /**
+     * Apply hover effect to a node
+     * @param {string} nodeId - The ID of the node to hover
+     */
+    hoverNode(nodeId) {
+        // If already hovering over this node, do nothing
+        if (this.dataManager.hoveredNode === nodeId) return;
+        
+        // Set hover in data manager
+        this.dataManager.setHoveredNode(nodeId);
+        
+        // Update colors in bulk
+        this.graphController.nodeCloud.updateColors(
+            this.dataManager.selectedNode,
+            this.dataManager.neighborNodes,
+            nodeId
+        );
+        
+        // Change cursor to pointer
+        this.sceneManager.renderer.domElement.style.cursor = 'pointer';
+    }
+    
+    /**
+     * Remove hover effect from the currently hovered node
+     */
+    unhoverNode() {
+        if (!this.dataManager.hoveredNode) return;
+        
+        // Get the node ID before clearing
+        const nodeId = this.dataManager.hoveredNode;
+        
+        // Clear hover in data manager
+        this.dataManager.clearHoveredNode();
+        
+        // Update colors in bulk
+        this.graphController.nodeCloud.updateColors(
+            this.dataManager.selectedNode,
+            this.dataManager.neighborNodes,
+            null  // No hover
+        );
+        
+        // Reset cursor
+        this.sceneManager.renderer.domElement.style.cursor = 'auto';
+    }
+    
+    /**
+     * Update the colors of all visible nodes based on selection state
+     */
+    updateNodeColors() {
+        this.dataManager.graphObjects.nodes.forEach((node, id) => {
+            this.graphObjectManager.updateNodeColors(id);
+        });
+    }
+    
+    /**
+     * Update the colors of all visible links based on selection state
+     */
+    updateLinkColors() {
+        this.dataManager.graphObjects.links.forEach((link, id) => {
+            this.graphObjectManager.updateLinkColors(id);
+        });
+    }
+}
+
+/**
+ * DebugVisualizer - Generic visualization for debugging graph components
+ */
+class DebugVisualizer {
+    constructor(sceneManager, graphController) {
+        this.sceneManager = sceneManager;
+        this.graphController = graphController;
+        this.debugObjects = [];
+        this.enabled = false;
+        this.lastUpdateTime = 0;
+        this.updateInterval = 1000; // Update debug visuals every second
+        this.activeVisualizations = {
+            grid: true,
+            performance: true,
+            nodes: true
+        };
+        this.stats = {};
+    }
+    
+    /**
+     * Toggle debug visualization
+     * @param {boolean} enabled - Whether to enable or disable visualization
+     */
+    toggle(enabled) {
+        this.enabled = enabled;
+        
+        // Show or hide debug UI elements
+        const debugPanel = document.getElementById('debug-info-panel');
+        const frameGraph = document.getElementById('debug-frame-graph');
+        
+        if (debugPanel) {
+            debugPanel.style.display = enabled ? 'block' : 'none';
+        }
+        
+        if (frameGraph) {
+            frameGraph.style.display = enabled ? 'block' : 'none';
+        }
+        
+        if (enabled) {
+            // Initialize frame history if needed
+            if (!this.frameHistory) {
+                const canvas = document.getElementById('debug-frame-canvas');
+                if (canvas) {
+                    this.frameHistory = new Array(canvas.width).fill(0);
+                }
+            }
+            
+            this.createDebugVisualization();
+        } else {
+            this.clearDebugVisualization();
+        }
+    }
+    
+    /**
+     * Toggle specific visualization types
+     * @param {string} type - Visualization type to toggle
+     */
+    toggleVisualization(type) {
+        if (this.activeVisualizations.hasOwnProperty(type)) {
+            this.activeVisualizations[type] = !this.activeVisualizations[type];
+            if (this.enabled) {
+                this.createDebugVisualization();
+            }
+        }
+    }
+    
+    /**
+     * Create visual representation of debug data
+     */
+    createDebugVisualization() {
+        this.clearDebugVisualization();
+        
+        // Collect debug stats
+        this.collectStats();
+        
+        // Create visualizations based on active settings
+        if (this.activeVisualizations.grid) {
+            this.createSpatialGridVisualization();
+        }
+        
+        if (this.activeVisualizations.nodes) {
+            this.createNodeStatsVisualization();
+        }
+        
+        if (this.activeVisualizations.performance) {
+            this.createPerformanceVisualization();
+        }
+        
+        // Create debug panel with statistics
+        this.createDebugPanel();
+        
+        this.lastUpdateTime = performance.now();
+    }
+    
+    /**
+     * Collect statistics for debug display
+     */
+    collectStats() {
+        // Clear previous stats
+        this.stats = {
+            fps: this.graphController.fps || 0,
+            nodeCount: 0,
+            visibleNodeCount: 0,
+            linkCount: 0,
+            gridStats: {
+                cells: 0,
+                objects: 0,
+                avgPerCell: 0
+            },
+            cameraPosition: {
+                x: 0,
+                y: 0,
+                z: 0
+            },
+            performanceMode: this.graphController.performanceMode
+        };
+        
+        // Collect node and link stats
+        if (this.graphController.dataManager) {
+            const dataManager = this.graphController.dataManager;
+            
+            this.stats.nodeCount = dataManager.graphData.nodes.length;
+            this.stats.visibleNodeCount = dataManager.graphObjects.nodes.size;
+            this.stats.linkCount = dataManager.graphObjects.links.size;
+        }
+        
+        // Collect grid stats
+        if (this.graphController.simulationManager && 
+            this.graphController.simulationManager.spatialGrid) {
+            
+            const grid = this.graphController.simulationManager.spatialGrid;
+            this.stats.gridStats.cells = grid.grid.size;
+            this.stats.gridStats.objects = grid.objects.size;
+            
+            if (grid.grid.size > 0 && grid.objects.size > 0) {
+                this.stats.gridStats.avgPerCell = 
+                    (grid.objects.size / grid.grid.size).toFixed(1);
+            }
+        }
+        
+        // Collect camera position
+        if (this.graphController.sceneManager && this.graphController.sceneManager.camera) {
+            const camera = this.graphController.sceneManager.camera;
+            this.stats.cameraPosition.x = camera.position.x.toFixed(1);
+            this.stats.cameraPosition.y = camera.position.y.toFixed(1);
+            this.stats.cameraPosition.z = camera.position.z.toFixed(1);
+        }
+    }
+    
+    /**
+     * Create spatial grid visualization
+     */
+    createSpatialGridVisualization() {
+        const spatialGrid = this.graphController.simulationManager?.spatialGrid;
+        if (!spatialGrid) return;
+        
+        // Create wireframe boxes for each cell in the grid
+        spatialGrid.grid.forEach((cell, key) => {
+            const [x, y, z] = key.split(',').map(Number);
+            const cellSize = spatialGrid.cellSize;
+            
+            // Create box geometry for the cell
+            const geometry = new THREE.BoxGeometry(cellSize, cellSize, cellSize);
+            const material = new THREE.MeshBasicMaterial({
+                color: 0x00ff00,
+                wireframe: true,
+                transparent: true,
+                opacity: 0.05 + (0.05 * Math.min(cell.size, 10)) // Brighter for more populated cells
+            });
+            
+            const box = new THREE.Mesh(geometry, material);
+            box.position.set(
+                (x + 0.5) * cellSize,
+                (y + 0.5) * cellSize,
+                (z + 0.5) * cellSize
+            );
+            
+            this.sceneManager.addToScene(box);
+            this.debugObjects.push(box);
+            
+            // Add text label showing object count in cell
+            if (cell.size > 0) {
+                const text = new SpriteText(`${cell.size}`, 12);
+                text.color = '#ffff00';
+                text.backgroundColor = 'rgba(0,0,0,0.5)';
+                text.padding = 2;
+                text.position.copy(box.position);
+                this.sceneManager.addToScene(text);
+                this.debugObjects.push(text);
+            }
+        });
+    }
+    
+    /**
+     * Create node statistics visualization
+     */
+    createNodeStatsVisualization() {
+        // Highlight nodes with different colors based on properties
+        const nodeManager = this.graphController.dataManager;
+        const nodeCloud = this.graphController.nodeCloud;
+        
+        if (!nodeManager || !nodeCloud || !nodeCloud.colors) return;
+        
+        // Store original colors to restore later
+        this.originalColors = new Float32Array(nodeCloud.colors.length);
+        this.originalColors.set(nodeCloud.colors); // Make a copy of all colors
+        
+        // Iterate through nodes and update colors in the buffer
+        nodeManager.graphObjects.nodes.forEach((node, id) => {
+            if (nodeCloud.nodeIndices.has(id)) {
+                // Get the node's index in the color buffer
+                const index = nodeCloud.nodeIndices.get(id);
+                const i3 = index * 3;
+                
+                // Get connection count
+                const connectedLinks = nodeManager.getConnectedLinks(id);
+                const connectionCount = connectedLinks.length;
+                
+                // Set color based on connection count
+                let color;
+                if (connectionCount > 10) {
+                    color = new THREE.Color(0xff0000); // Red for highly connected
+                } else if (connectionCount > 5) {
+                    color = new THREE.Color(0xff8800); // Orange for medium
+                } else if (connectionCount > 2) {
+                    color = new THREE.Color(0xffff00); // Yellow for low
+                } else {
+                    color = new THREE.Color(0x00ffff); // Cyan for minimal
+                }
+                
+                // Update the color buffer directly
+                nodeCloud.colors[i3] = color.r;
+                nodeCloud.colors[i3 + 1] = color.g;
+                nodeCloud.colors[i3 + 2] = color.b;
+            }
+        });
+        
+        // Mark the color buffer as needing update
+        if (nodeCloud.geometry && nodeCloud.geometry.attributes.color) {
+            nodeCloud.geometry.attributes.color.needsUpdate = true;
+        }
+    }
+    
+    /**
+     * Create performance metrics visualization
+     */
+    createPerformanceVisualization() {
+        // Update frame history and redraw
+        this.updateFrameGraph();
+    }
+    
+    /**
+     * Update the frame rate graph
+     */
+    updateFrameGraph() {
+        const canvas = document.getElementById('debug-frame-canvas');
+        const fpsLabel = document.getElementById('debug-fps-label');
+        
+        if (!canvas || !fpsLabel) return;
+        
+        // Update FPS label
+        fpsLabel.textContent = `${this.stats.fps} FPS`;
+        
+        // Add current FPS to history
+        if (!this.frameHistory) {
+            this.frameHistory = new Array(canvas.width).fill(0);
+        }
+        
+        this.frameHistory.push(this.stats.fps);
+        this.frameHistory.shift();
+        
+        // Draw frame history
+        const ctx = canvas.getContext('2d');
+        const width = canvas.width;
+        const height = canvas.height;
+        
+        // Clear canvas
+        ctx.clearRect(0, 0, width, height);
+        
+        // Calculate scale - find max FPS in history for scaling
+        const maxFPS = Math.max(60, ...this.frameHistory);
+        const scale = height / maxFPS;
+        
+        // Draw background grid
+        ctx.strokeStyle = '#333';
+        ctx.lineWidth = 0.5;
+        
+        // Draw horizontal grid lines at 15, 30, 45, 60 FPS
+        [15, 30, 45, 60].forEach(fps => {
+            const y = height - (fps * scale);
+            if (y >= 0 && y <= height) {
+                ctx.beginPath();
+                ctx.moveTo(0, y);
+                ctx.lineTo(width, y);
+                ctx.stroke();
+            }
+        });
+        
+        // Draw FPS graph
+        ctx.strokeStyle = '#4CAF50';
+        ctx.lineWidth = 1.5;
+        ctx.beginPath();
+        
+        // Start at bottom-left corner with 0 FPS
+        ctx.moveTo(0, height);
+        
+        // Draw lines for each frame sample
+        this.frameHistory.forEach((fps, x) => {
+            const y = height - (fps * scale);
+            ctx.lineTo(x, y);
+        });
+        
+        // Finish at bottom-right corner
+        ctx.lineTo(width - 1, height);
+        ctx.closePath();
+        
+        // Fill gradient
+        const gradient = ctx.createLinearGradient(0, 0, 0, height);
+        gradient.addColorStop(0, 'rgba(76, 175, 80, 0.7)');
+        gradient.addColorStop(1, 'rgba(76, 175, 80, 0.1)');
+        ctx.fillStyle = gradient;
+        ctx.fill();
+        
+        // Stroke the line on top of the fill
+        ctx.strokeStyle = '#4CAF50';
+        ctx.lineWidth = 1.5;
+        ctx.beginPath();
+        
+        this.frameHistory.forEach((fps, x) => {
+            const y = height - (fps * scale);
+            if (x === 0) {
+                ctx.moveTo(x, y);
+            } else {
+                ctx.lineTo(x, y);
+            }
+        });
+        
+        ctx.stroke();
+    }
+    
+    /**
+     * Create debug panel with statistics
+     */
+    createDebugPanel() {
+        // Update debug panel content using the existing HTML element
+        document.getElementById('debug-nodes').textContent = `${this.stats.visibleNodeCount}/${this.stats.nodeCount}`;
+        document.getElementById('debug-links').textContent = `${this.stats.linkCount}`;
+        document.getElementById('debug-cells').textContent = `${this.stats.gridStats.cells}`;
+        document.getElementById('debug-objects').textContent = `${this.stats.gridStats.objects}`;
+        document.getElementById('debug-avg-per-cell').textContent = `${this.stats.gridStats.avgPerCell}`;
+        
+        // Update camera position
+        document.getElementById('debug-camera-x').textContent = `${this.stats.cameraPosition.x}`;
+        document.getElementById('debug-camera-y').textContent = `${this.stats.cameraPosition.y}`;
+        document.getElementById('debug-camera-z').textContent = `${this.stats.cameraPosition.z}`;
+    }
+    
+    /**
+     * Remove all debug visualization objects
+     */
+    clearDebugVisualization() {
+        // Remove all debug visualization objects from scene
+        this.debugObjects.forEach(obj => {
+            this.sceneManager.removeFromScene(obj);
+        });
+        this.debugObjects = [];
+        
+        // Restore original node colors
+        if (this.originalColors && this.graphController.nodeCloud) {
+            const nodeCloud = this.graphController.nodeCloud;
+            
+            // Copy the original colors back to the nodeCloud color buffer
+            if (nodeCloud.colors && this.originalColors.length === nodeCloud.colors.length) {
+                nodeCloud.colors.set(this.originalColors);
+                
+                // Mark the color buffer as needing update
+                if (nodeCloud.geometry && nodeCloud.geometry.attributes.color) {
+                    nodeCloud.geometry.attributes.color.needsUpdate = true;
+                }
+            }
+            
+            this.originalColors = null;
+        }
+    }
+    
+    /**
+     * Update debug visualization
+     */
+    update() {
+        if (!this.enabled) return;
+        
+        // Update stats more frequently than full visualization refresh
+        this.collectStats();
+        
+        // Update FPS graph and info panel more frequently
+        if (this.activeVisualizations.performance && document.getElementById('debug-frame-canvas')) {
+            this.updateFrameGraph();
+        }
+        
+        // Update info panel if it exists
+        if (document.getElementById('debug-info-panel')) {
+            this.createDebugPanel(); // Updates panel content
+        }
+        
+        // Only update full visualization periodically to avoid performance impact
+        const now = performance.now();
+        if (now - this.lastUpdateTime < this.updateInterval) return;
+        
+        // Recreate visualization
+        this.createDebugVisualization();
+    }
+    
+    /**
+     * Handle keyboard shortcuts for debugging
+     * @param {KeyboardEvent} event - Keyboard event
+     */
+    handleKeyPress(event) {
+        if (!this.enabled) return;
+        
+        switch (event.key) {
+            case '1':
+                this.toggleVisualization('grid');
+                break;
+            case '2':
+                this.toggleVisualization('nodes');
+                break;
+            case '3':
+                this.toggleVisualization('performance');
+                break;
+        }
+    }
+}
+
+/**
+ * Main controller class that coordinates all graph components
+ */
+class GraphController {
+    constructor(containerId) {
+        // DOM container reference
+        this.container = document.getElementById(containerId);
+        
+        // Initialize component managers
+        this.themeManager = new ThemeManager();
+        this.sceneManager = new SceneManager(this.container, this.themeManager);
+        this.sceneManager.graphController = this; // Add reference to this controller
+        
+        this.dataManager = new DataManager();
+        this.graphObjectManager = new GraphObjectManager(this.sceneManager, this.dataManager, this.themeManager);
+        this.graphObjectManager.graphController = this; // Add reference to this controller
+        
+        // Create the node cloud for efficient node rendering
+        this.nodeCloud = new NodeCloud(this.sceneManager.scene, this.themeManager);
+        
+        this.simulationManager = new SimulationManager(this.dataManager, this.graphObjectManager, this.themeManager);
+        this.simulationManager.graphController = this; // Add reference to this controller
+        
+        this.uiManager = new UIManager(this.container, this.dataManager, this);
+        this.eventManager = new EventManager(this.sceneManager, this.dataManager, this.graphObjectManager);
+        this.eventManager.graphController = this; // Add reference to this controller
+        
+        // Performance and debug settings
+        this.performanceMode = true; // Always on
+        this.debugMode = false;
+        
+        // Initialize generic debugger
+        this.debugger = new DebugVisualizer(this.sceneManager, this);
+        
+        // Initialize FPS counter
+        this.fpsCounter = document.getElementById('fps-counter');
+        this.frameCount = 0;
+        this.lastTime = performance.now();
+        this.fps = 0;
+        this.fpsUpdateInterval = 500; // Update FPS display every 500ms
+        
+        // Set up UI button handlers
+        this.setupButtonHandlers();
+        
+        // Setup keyboard listeners for debug controls
+        document.addEventListener('keydown', this.handleKeyPress.bind(this));
+        
+        // Store a global reference for convenience (used by NodeCloud)
+        window.lastGraphController = this;
+        
+        // Load data
+        this.loadGraphData();
+        
+        // Always enable performance optimizations
+        this.enablePerformanceMode();
+        
+        // Start animation loop
+        this.animate();
+    }
+    
+    /**
+     * Set up handlers for UI buttons
+     */
+    setupButtonHandlers() {
+        // Debug mode button
+        const debugBtn = document.getElementById('toggle-debug-btn');
+        if (debugBtn) {
+            debugBtn.addEventListener('click', () => {
+                this.toggleDebugMode();
+                debugBtn.classList.toggle('active', this.debugMode);
+            });
+        }
+    }
+    
+    /**
+     * Enable performance optimizations
+     */
+    enablePerformanceMode() {
+        // Enable spatial grid and frustum culling
+        if (this.simulationManager) {
+            this.simulationManager.useSpatialIndex = true;
+        }
+        if (this.sceneManager) {
+            this.sceneManager.enableFrustumCulling = true;
+        }
+    }
+    
+    /**
+     * Handle keyboard shortcuts
+     * @param {KeyboardEvent} event - Keyboard event
+     */
+    handleKeyPress(event) {
+        // Pass to debugger if debug mode is on
+        if (this.debugMode && this.debugger) {
+            this.debugger.handleKeyPress(event);
+        }
+    }
+    
+    /**
+     * Toggle debug visualization mode
+     */
+    toggleDebugMode() {
+        this.debugMode = !this.debugMode;
+        
+        if (this.debugger) {
+            this.debugger.toggle(this.debugMode);
+        }
+        
+        return this.debugMode;
+    }
+    
+    /**
+     * Animation loop
+     */
+    animate() {
+        requestAnimationFrame(() => this.animate());
+        
+        // Update FPS calculation
+        this.frameCount++;
+        const currentTime = performance.now();
+        const elapsed = currentTime - this.lastTime;
+        
+        // Update FPS counter every interval
+        if (elapsed > this.fpsUpdateInterval) {
+            this.fps = Math.round((this.frameCount * 1000) / elapsed);
+            this.fpsCounter.textContent = `FPS: ${this.fps}`;
+            
+            // Reset counters
+            this.frameCount = 0;
+            this.lastTime = currentTime;
+        }
+        
+        // Update debug visualization if enabled
+        if (this.debugMode && this.debugger) {
+            this.debugger.update();
+        }
+        
+        // Update scene
+        this.sceneManager.update();
+    }
+    
+    /**
+     * Load graph data from the server
+     */
+    loadGraphData() {
+		this.clearDisplay();
+        // Show loading indicator
+        this.uiManager.showLoading(true);
+        
+        // Load data via the data manager
+        this.dataManager.loadData()
+            .then(data => {
+                // Initialize the force simulation with loaded data
+                this.simulationManager.updateSimulation(false);
+                
+                // Update statistics
+                this.uiManager.updateStats();
+                
+                // Show initial message
+                this.uiManager.showInitialMessage("Enter a search term to display nodes");
+                
+                // Hide loading indicator
+                this.uiManager.showLoading(false);
+                
+                // Render all nodes
+                this.loadAllNodes();
+
+
+                console.log(data);
+                let id = data?.links[0]?.source.id;
+                if(id) {
+                    this.eventManager.selectNode(id);
+                    this.eventManager.focusOnNode(id);
+                }
+                console.log(id);
+            })
+            .catch(error => {
+                // Show error message
+                this.uiManager.showError('Failed to load graph data: ' + error.message);
+                this.uiManager.showLoading(false);
+            });
+    }
+    
+    /**
+     * Search for nodes by term and display them
+     * @param {string} searchTerm - The term to search for
+     */
+    searchNodes(searchTerm) {
+        // Clear current display
+        this.clearDisplay();
+        
+        // Hide the initial message
+        this.uiManager.hideInitialMessage();
+        
+        if (!searchTerm) return;
+        
+        // Find matching nodes
+        const matchingNodeIds = this.dataManager.searchNodes(searchTerm);
+        
+        // If no nodes found, show a message
+        if (matchingNodeIds.length === 0) {
+            console.log(`No nodes found matching "${searchTerm}"`);
+            this.uiManager.showInitialMessage(`No nodes found matching "${searchTerm}"`);
+            return;
+        }
+        
+        console.log(`Found ${matchingNodeIds.length} nodes matching "${searchTerm}"`);
+        
+        // Show loading indicator during simulation
+        this.uiManager.showLoading(true);
+        
+        // Add each matching node and its connections with depth of 10
+        const addedNodes = new Set();
+        
+        matchingNodeIds.forEach(nodeId => {
+            // Use getConnectedSubgraph to get nodes and links up to depth 10
+            const { nodes, links } = this.dataManager.getConnectedSubgraph(nodeId, 10);
+            
+            // Add all nodes to the scene
+            nodes.forEach(node => {
+                if (!this.dataManager.graphObjects.nodes.has(node.id)) {
+                    this.graphObjectManager.createNodeObject(node);
+                    addedNodes.add(node.id);
+                }
+            });
+            
+            // Add all links to the scene
+            links.forEach(link => {
+                const sourceId = typeof link.source === 'object' ? link.source.id : link.source;
+                const targetId = typeof link.target === 'object' ? link.target.id : link.target;
+                const linkId = `${sourceId}-${targetId}`;
+                
+                if (!this.dataManager.graphObjects.links.has(linkId)) {
+                    this.graphObjectManager.createLinkObject(link);
+                }
+            });
+        });
+        
+        // Update simulation and restart it properly
+        this.simulationManager.updateSimulation(true);
+        
+        // Center the view on the found nodes
+        this.centerOnNodes(Array.from(addedNodes));
+        
+        // Hide loading indicator when view is centered
+        this.uiManager.showLoading(false);
+    }
+    
+    /**
+     * Clear the current display
+     */
+    clearDisplay() {
+        this.graphObjectManager.clearVisibleObjects();
+    }
+    
+    /**
+     * Center the view on a set of nodes
+     * @param {Array} nodeIds - Array of node IDs to center on
+     */
+    centerOnNodes(nodeIds) {
+        if (!nodeIds || nodeIds.length === 0) return;
+        
+        // Calculate the center position of the specified nodes
+        let center = { x: 0, y: 0, z: 0 };
+        let count = 0;
+        
+        nodeIds.forEach(nodeId => {
+            const nodeData = this.dataManager.graphObjects.nodes.get(nodeId);
+            if (nodeData && nodeData.object) {
+                center.x += nodeData.object.position.x;
+                center.y += nodeData.object.position.y;
+                center.z += nodeData.object.position.z;
+                count++;
+            }
+        });
+        
+        if (count === 0) return;
+        
+        center.x /= count;
+        center.y /= count;
+        center.z /= count;
+        
+        // Set the camera target for perspective camera
+        this.sceneManager.controls.target.set(center.x, center.y, 0);
+        
+        // Position the perspective camera
+        const distance = 1000;
+        this.sceneManager.camera.position.set(
+            center.x, 
+            center.y, 
+            distance
+        );
+        
+        // Update the camera and controls
+        this.sceneManager.camera.updateProjectionMatrix();
+        this.sceneManager.controls.update();
+    }
+    
+    /**
+     * Toggle label visibility
+     */
+    toggleLabels() {
+        const showLabels = this.graphObjectManager.toggleLabels();
+        return showLabels;
+    }
+    
+    /**
+     * Toggle physics simulation
+     */
+    togglePhysics() {
+        this.simulationManager.togglePhysics();
+    }
+    
+    /**
+     * Reset the view
+     */
+    resetView() {
+        // Clear current display
+        this.clearDisplay();
+        
+        // Reset camera
+        this.sceneManager.resetView();
+        
+        // Show initial message
+        this.uiManager.showInitialMessage("Enter a search term to display nodes");
+    }
+    
+    /**
+     * Load all nodes in the graph
+     */
+    loadAllNodes() {
+        // Clear current display
+        this.clearDisplay();
+        
+        // Hide the initial message
+        this.uiManager.hideInitialMessage();
+        
+        // Show loading indicator
+        this.uiManager.showLoading(true);
+        
+        console.log(`Loading all ${this.dataManager.graphData.nodes.length} nodes`);
+        
+        // Store all added node IDs
+        const addedNodes = new Set();
+        
+        // Add all nodes to the scene
+        this.dataManager.graphData.nodes.forEach(node => {
+            if (!this.dataManager.graphObjects.nodes.has(node.id)) {
+                this.graphObjectManager.createNodeObject(node);
+                addedNodes.add(node.id);
+            }
+        });
+        
+        // Add all links between the visible nodes
+        this.dataManager.graphData.links.forEach(link => {
+            const sourceId = typeof link.source === 'object' ? link.source.id : link.source;
+            const targetId = typeof link.target === 'object' ? link.target.id : link.target;
+            const linkId = `${sourceId}-${targetId}`;
+            
+            // Only add links between nodes that are visible
+            if (addedNodes.has(sourceId) && addedNodes.has(targetId) && 
+                !this.dataManager.graphObjects.links.has(linkId)) {
+                this.graphObjectManager.createLinkObject(link);
+            }
+        });
+        
+        // Update simulation and restart it
+        this.simulationManager.updateSimulation(true);
+        
+        // Center the view on all nodes
+        this.centerOnNodes(Array.from(addedNodes));
+        
+        // Hide loading indicator
+        this.uiManager.showLoading(false);
+    }
+}
+
+// Initialize the application when the page loads
+document.addEventListener('DOMContentLoaded', () => {
+    new GraphController('graph-container');
+}); 
\ No newline at end of file
diff --git a/src/html/hyperbuddy@1.0/404.html b/src/html/hyperbuddy@1.0/404.html
new file mode 100644
index 000000000..1005d1329
--- /dev/null
+++ b/src/html/hyperbuddy@1.0/404.html
@@ -0,0 +1,306 @@
+<html>
+  <head>
+    <title>404 - Page not found.</title>
+    <link
+      href="https://fonts.googleapis.com/css2?family=DM+Sans:ital,opsz,wght@0,9..40,100..1000;1,9..40,100..1000&display=swap"
+      rel="stylesheet"
+    />
+    <link
+      href="https://fonts.googleapis.com/css2?family=DM+Sans:ital,opsz,wght@0,9..40,100..1000;1,9..40,100..1000&family=Roboto+Mono:ital,wght@0,100..700;1,100..700&display=swap"
+      rel="stylesheet"
+    />
+    <style>
+      p {
+        margin: 0;
+        margin-top: 38px;
+        text-align: left;
+      }
+      body {
+        font-family: "DM Sans", Sans-Serif;
+        background: #ffffff;
+      }
+      .background-hash {
+        font-family: "Roboto Mono", monospace;
+        opacity: 0;
+        position: absolute;
+        color: rgba(180, 180, 180, 0.4);
+        font-weight: 300;
+        user-select: none;
+      }
+
+      #header {
+        display: flex;
+        top: 0;
+        right: 0;
+        gap: 8px;
+        padding: 24px;
+        align-items: center;
+        justify-content: space-between;
+      }
+
+      #header img {
+        height: 16px;
+      }
+
+      #header span {
+        font-family: "Roboto Mono", monospace;
+        font-size: 12px;
+        color: rgb(151, 151, 151);
+      }
+
+      #main-text {
+        font-weight: 300;
+        text-align: center;
+        position: absolute;
+        bottom: 50vh;
+        left: 20vw;
+        right: 20vw;
+      }
+      #main {
+        width: fit-content;
+        font-size: 2.5rem;
+        color: #000000;
+      }
+
+      #number {
+        display: flex;
+        align-items: center;
+        width: fit-content;
+        font-size: 5rem;
+        color: #000000;
+        font-weight: 200;
+        gap: 24px;
+      }
+      #sub {
+        display: flex;
+        font-size: 1.15rem;
+        color: rgb(143, 143, 143);
+        width: fit-content;
+      }
+
+      .dot-container {
+        display: flex;
+        transform: translateY(-5px);
+        width: fit-content;
+        margin-left: 10px;
+      }
+
+      .dot {
+        opacity: 0;
+        animation: dotsBlink 1.5s infinite;
+        font-weight: 500;
+        font-size: 1.4em;
+        margin-right: 4px;
+      }
+
+      .dot:nth-child(1) {
+        animation-delay: 0s;
+      }
+
+      .dot:nth-child(2) {
+        animation-delay: 0.3s;
+      }
+
+      .dot:nth-child(3) {
+        animation-delay: 0.6s;
+      }
+
+      @keyframes dotsBlink {
+        0% {
+          opacity: 0;
+        }
+        20% {
+          opacity: 1;
+        }
+        100% {
+          opacity: 0;
+        }
+      }
+    </style>
+  </head>
+  <body>
+    <div id="header">
+      <a href="/">
+                <div class="logo">
+                    <img
+                        src="https://arweave.net/Ggr1cz-jbiDS2gAVFHxkoKzmNQQD4WcMTfipWyuEmgY"
+                        alt="hyperbeam-logo"
+                    />
+                </div>
+        </a>
+      <span id="version">version: 1230ubn1</span>
+    </div>
+    <div id="main-display">
+      <div id="main-text">
+        <p id="number">404.</p>
+        <p id="main">Page cannot be found.</p>
+        <p id="sub">
+          This hashpath cannot be resolved on this node, yet<span
+            class="dot-container"
+          >
+            <span class="dot">.</span><span class="dot">.</span
+            ><span class="dot">.</span>
+          </span>
+        </p>
+      </div>
+    </div>
+
+    <script>
+      document.addEventListener("DOMContentLoaded", function () {
+        var number_of_elements = 5;
+        var document_body = document.getElementsByTagName("body")[0];
+
+        for (i = 0; i < number_of_elements; i++) {
+          var div = document.createElement("div");
+          div.setAttribute("class", "background-hash");
+          document.body.appendChild(div);
+          start_animation(div);
+        }
+      });
+
+      function animate_hash(element, finalText) {
+        return new Promise((resolve) => {
+          let index = 0;
+
+          function typeNextChar() {
+            if (index >= finalText.length) {
+              resolve();
+              return;
+            }
+
+            element.innerHTML += finalText[index];
+            index++;
+
+            setTimeout(typeNextChar, 40); // Typing speed per character (adjust as needed)
+          }
+
+          element.innerHTML = ""; // Clear element before starting
+          typeNextChar();
+        });
+      }
+
+      function start_animation(element) {
+        var body = document.getElementsByTagName("body")[0];
+        var width = body.getBoundingClientRect().width;
+        var height = body.getBoundingClientRect().height;
+
+        var text = generate_hash();
+        var maxsize = 16;
+        var minsize = 8;
+        var size = Math.random() * parseInt(maxsize) + parseInt(minsize);
+        element.style.fontSize = size + "px";
+        var content_width = element.getBoundingClientRect().width;
+        var content_height = element.getBoundingClientRect().height;
+
+        var xpos = (Math.random() * (width - content_width * 1.2)).toFixed();
+        var ypos = (Math.random() * (height - content_height * 1.2)).toFixed();
+        var time = (Math.random() * 10000 + 1500).toFixed();
+
+        element.style.left = xpos + "px";
+        element.style.top = ypos + "px";
+
+        animate_hash(element, text)
+          .then(() => fade_in(element, time))
+          .then(() => fade_out(element, time))
+          .then(() => start_animation(element));
+      }
+
+      /**
+       * Fades an element in over a given window of time.
+       * @param {Object} [element] - The DOM element in which the transition applies to.
+       * @param {int} [time] - The amount of time for the transition to occur over in ms.
+       */
+      function fade_in(element, time) {
+        return new Promise((resolve) => {
+          var time_per_increment = time / 100;
+
+          var fade_in = setInterval(function () {
+            if (!element.style.opacity) {
+              element.style.opacity = 0.4;
+            }
+
+            let currentOpacity = parseFloat(element.style.opacity);
+            if (currentOpacity >= 0.95) {
+              clearInterval(fade_in);
+              element.style.opacity = 1;
+              element.style.filter = `blur(0px)`;
+              resolve();
+            } else {
+              currentOpacity += 0.05;
+              element.style.opacity = currentOpacity;
+              let blurAmount = (1 - currentOpacity) * 4; // 4px max blur when fully transparent
+              element.style.filter = `blur(${blurAmount}px)`;
+            }
+          }, time_per_increment);
+        });
+      }
+
+      /**
+       * Fades an element out over a given window of time.
+       * @param {Object} [element] - The DOM element in which the transition applies to.
+       * @param {int} [time] - The amount of time for the transition to occur over in ms.
+       */
+      function fade_out(element, time) {
+        return new Promise((resolve) => {
+          var time_per_increment = time / 100;
+
+          var fade_out = setInterval(function () {
+            if (!element.style.opacity) {
+              element.style.opacity = 1;
+            }
+
+            let currentOpacity = parseFloat(element.style.opacity);
+            if (currentOpacity <= 0.05) {
+              clearInterval(fade_out);
+              element.style.opacity = 0;
+              element.style.filter = `blur(4px)`; // max blur again when fully hidden
+              resolve();
+            } else {
+              currentOpacity -= 0.05;
+              element.style.opacity = currentOpacity;
+              let blurAmount = (1 - currentOpacity) * 4;
+              element.style.filter = `blur(${blurAmount}px)`;
+            }
+          }, time_per_increment);
+        });
+      }
+
+      /**
+       * Generates a fake hash string.
+       */
+      function generate_hash() {
+        var array = new Uint8Array(32);
+        window.crypto.getRandomValues(array);
+        var string = String.fromCharCode.apply(null, new Uint8Array(array));
+
+        return base64_url_encode(string);
+      }
+
+      /**
+       * Encodes the input in base64 encoding.
+       * @param {(string|buffer)} [raw_data] - A raw string or buffer of bytes.
+       * @return {string} - Base64 encoded equivalent of the raw_data.
+       */
+      function base64_encode(raw_data) {
+        var encoded_data = btoa(raw_data);
+
+        return encoded_data;
+      }
+
+      /**
+       * Encodes the input in base64url encoding.
+       * @param {(string|buffer)} [raw_data] - A raw string or buffer of bytes.
+       * @return {string} - Base64url encoded equivalent of the raw_data.
+       */
+      function base64_url_encode(raw_data) {
+        var encoded_data = base64_encode(raw_data);
+        var safe_encoded = encoded_data
+          .replace(/\+/g, "-")
+          .replace(/\//g, "_")
+          .replace(/\=/g, "");
+
+        return safe_encoded;
+      }
+    </script>
+  </body>
+</html>
diff --git a/src/html/hyperbuddy@1.0/500.html b/src/html/hyperbuddy@1.0/500.html
new file mode 100644
index 000000000..3b9e3fabf
--- /dev/null
+++ b/src/html/hyperbuddy@1.0/500.html
@@ -0,0 +1,311 @@
+<html>
+  <head>
+    <title>500 - Oops.</title>
+    <link
+      href="https://fonts.googleapis.com/css2?family=DM+Sans:ital,opsz,wght@0,9..40,100..1000;1,9..40,100..1000&display=swap"
+      rel="stylesheet"
+    />
+    <link
+      href="https://fonts.googleapis.com/css2?family=DM+Sans:ital,opsz,wght@0,9..40,100..1000;1,9..40,100..1000&family=Roboto+Mono:ital,wght@0,100..700;1,100..700&display=swap"
+      rel="stylesheet"
+    />
+    <style>
+      p {
+        margin: 0;
+        margin-top: 38px;
+        text-align: left;
+      }
+      body {
+        font-family: "DM Sans", Sans-Serif;
+        background: #ffffff;
+      }
+      .background-hash {
+        font-family: "Roboto Mono", monospace;
+        opacity: 0;
+        position: absolute;
+        color: rgba(180, 180, 180, 0.4);
+        font-weight: 300;
+        user-select: none;
+      }
+
+      #header {
+        display: flex;
+        top: 0;
+        right: 0;
+        gap: 8px;
+        padding: 24px;
+        align-items: center;
+        justify-content: space-between;
+      }
+
+      #header img {
+        height: 16px;
+      }
+
+      #header span {
+        font-family: "Roboto Mono", monospace;
+        font-size: 12px;
+        color: rgb(151, 151, 151);
+      }
+
+      #main-text {
+        font-weight: 300;
+        text-align: center;
+        position: absolute;
+        left: 20vw;
+        right: 20vw;
+      }
+      #main {
+        width: fit-content;
+        font-size: 2.5rem;
+        color: #000000;
+      }
+
+      #number {
+        display: flex;
+        align-items: center;
+        width: fit-content;
+        font-size: 4.5rem;
+        color: #000000;
+        font-weight: 200;
+        gap: 24px;
+      }
+      #sub {
+        font-size: 1rem;
+        color: rgb(145, 145, 145);
+        width: fit-content;
+        display: flex;
+        align-items: center;
+      }
+
+      #icon {
+        margin-right: 12px;
+      }
+
+      #pop-icon {
+        margin-right: 7px;
+        margin-left: -4px;
+      }
+
+      .dot-container {
+        display: flex;
+        transform: translateY(-5px);
+        width: fit-content;
+        margin-right: 9px;
+      }
+
+      .dot {
+        opacity: 0;
+        animation: dotsBlink 1.5s infinite;
+        font-weight: 500;
+        font-size: 1.4em;
+        margin-right: 4px;
+      }
+
+      .dot:nth-child(1) {
+        animation-delay: 0s;
+      }
+
+      .dot:nth-child(2) {
+        animation-delay: 0.3s;
+      }
+
+      .dot:nth-child(3) {
+        animation-delay: 0.6s;
+      }
+
+      @keyframes dotsBlink {
+        0% {
+          opacity: 0;
+        }
+        20% {
+          opacity: 1;
+        }
+        100% {
+          opacity: 0;
+        }
+      }
+      #error-text {
+        text-align: left;
+      }
+    </style>
+  </head>
+  <body>
+    <div id="header">
+      <a href="/">
+                <div class="logo">
+                    <img
+                        src="https://arweave.net/Ggr1cz-jbiDS2gAVFHxkoKzmNQQD4WcMTfipWyuEmgY"
+                        alt="hyperbeam-logo"
+                    />
+                </div>
+        </a>
+      <span id="version">version: 1230ubn1</span>
+    </div>
+    <div id="main-display">
+      <div id="main-text">
+        <p id="number">500.</p>
+        <p id="main">Oops, your hashpath couldn't be resolved right now.</p>
+        <p id="error"><pre id="error-text">{{error}}</pre></p>
+      </div>
+    </div>
+
+    <script>
+      document.addEventListener("DOMContentLoaded", function () {
+        var number_of_elements = 5;
+        var document_body = document.getElementsByTagName("body")[0];
+
+        for (i = 0; i < number_of_elements; i++) {
+          var div = document.createElement("div");
+          div.setAttribute("class", "background-hash");
+          document.body.appendChild(div);
+          start_animation(div);
+        }
+      });
+
+      function animate_hash(element, finalText) {
+        return new Promise((resolve) => {
+          let index = 0;
+
+          function typeNextChar() {
+            if (index >= finalText.length) {
+              resolve();
+              return;
+            }
+
+            element.innerHTML += finalText[index];
+            index++;
+
+            setTimeout(typeNextChar, 40); // Typing speed per character (adjust as needed)
+          }
+
+          element.innerHTML = ""; // Clear element before starting
+          typeNextChar();
+        });
+      }
+
+      function start_animation(element) {
+        var body = document.getElementsByTagName("body")[0];
+        var width = body.getBoundingClientRect().width;
+        var height = body.getBoundingClientRect().height;
+
+        var text = generate_hash();
+        var maxsize = 16;
+        var minsize = 8;
+        var size = Math.random() * parseInt(maxsize) + parseInt(minsize);
+        element.style.fontSize = size + "px";
+        var content_width = element.getBoundingClientRect().width;
+        var content_height = element.getBoundingClientRect().height;
+
+        var xpos = (Math.random() * (width - content_width * 1.2)).toFixed();
+        var ypos = (Math.random() * (height - content_height * 1.2)).toFixed();
+        var time = (Math.random() * 10000 + 1500).toFixed();
+
+        element.style.left = xpos + "px";
+        element.style.top = ypos + "px";
+
+        animate_hash(element, text)
+          .then(() => fade_in(element, time))
+          .then(() => fade_out(element, time))
+          .then(() => start_animation(element));
+      }
+
+      /**
+       * Fades an element in over a given window of time.
+       * @param {Object} [element] - The DOM element in which the transition applies to.
+       * @param {int} [time] - The amount of time for the transition to occur over in ms.
+       */
+      function fade_in(element, time) {
+        return new Promise((resolve) => {
+          var time_per_increment = time / 100;
+
+          var fade_in = setInterval(function () {
+            if (!element.style.opacity) {
+              element.style.opacity = 0.4;
+            }
+
+            let currentOpacity = parseFloat(element.style.opacity);
+            if (currentOpacity >= 0.95) {
+              clearInterval(fade_in);
+              element.style.opacity = 1;
+              element.style.filter = `blur(0px)`;
+              resolve();
+            } else {
+              currentOpacity += 0.05;
+              element.style.opacity = currentOpacity;
+              let blurAmount = (1 - currentOpacity) * 4; // 4px max blur when fully transparent
+              element.style.filter = `blur(${blurAmount}px)`;
+            }
+          }, time_per_increment);
+        });
+      }
+
+      /**
+       * Fades an element out over a given window of time.
+       * @param {Object} [element] - The DOM element in which the transition applies to.
+       * @param {int} [time] - The amount of time for the transition to occur over in ms.
+       */
+      function fade_out(element, time) {
+        return new Promise((resolve) => {
+          var time_per_increment = time / 100;
+
+          var fade_out = setInterval(function () {
+            if (!element.style.opacity) {
+              element.style.opacity = 1;
+            }
+
+            let currentOpacity = parseFloat(element.style.opacity);
+            if (currentOpacity <= 0.05) {
+              clearInterval(fade_out);
+              element.style.opacity = 0;
+              element.style.filter = `blur(4px)`; // max blur again when fully hidden
+              resolve();
+            } else {
+              currentOpacity -= 0.05;
+              element.style.opacity = currentOpacity;
+              let blurAmount = (1 - currentOpacity) * 4;
+              element.style.filter = `blur(${blurAmount}px)`;
+            }
+          }, time_per_increment);
+        });
+      }
+
+      /**
+       * Generates a fake hash string.
+       */
+      function generate_hash() {
+        var array = new Uint8Array(32);
+        window.crypto.getRandomValues(array);
+        var string = String.fromCharCode.apply(null, new Uint8Array(array));
+
+        return base64_url_encode(string);
+      }
+
+      /**
+       * Encodes the input in base64 encoding.
+       * @param {(string|buffer)} [raw_data] - A raw string or buffer of bytes.
+       * @return {string} - Base64 encoded equivalent of the raw_data.
+       */
+      function base64_encode(raw_data) {
+        var encoded_data = btoa(raw_data);
+
+        return encoded_data;
+      }
+
+      /**
+       * Encodes the input in base64url encoding.
+       * @param {(string|buffer)} [raw_data] - A raw string or buffer of bytes.
+       * @return {string} - Base64url encoded equivalent of the raw_data.
+       */
+      function base64_url_encode(raw_data) {
+        var encoded_data = base64_encode(raw_data);
+        var safe_encoded = encoded_data
+          .replace(/\+/g, "-")
+          .replace(/\//g, "_")
+          .replace(/\=/g, "");
+
+        return safe_encoded;
+      }
+    </script>
+  </body>
+</html>
diff --git a/src/html/hyperbuddy@1.0/dashboard.html b/src/html/hyperbuddy@1.0/dashboard.html
new file mode 100755
index 000000000..639371183
--- /dev/null
+++ b/src/html/hyperbuddy@1.0/dashboard.html
@@ -0,0 +1,179 @@
+<!DOCTYPE html>
+<html lang="en">
+    <head>
+        <meta charset="UTF-8" />
+        <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+        <link
+            rel="icon"
+            type="image/png"
+            href="https://arweave.net/rBcLwnVU2fWNEKUW8PY0TzEAPuCHMj2Vp6z6CedHJf0"
+        />
+        <link
+            href="https://fonts.googleapis.com/css2?family=Open+Sans:ital,wght@0,300..800;1,300..800&display=swap"
+            rel="stylesheet"
+        />
+        <link rel="stylesheet" href="styles.css" />
+        <title>HyperBEAM</title>
+    </head>
+
+    <body>
+        <header>
+            <div class="header-inner">
+                <div class="logo">
+                    <img
+                        src="https://arweave.net/Ggr1cz-jbiDS2gAVFHxkoKzmNQQD4WcMTfipWyuEmgY"
+                        alt="hyperbeam-logo"
+                    />
+                </div>
+                <div class="subheader-value">
+                    <p>Operator:</p>
+                    <button id="operator-action" disabled="true">
+                        Loading...
+                    </button>
+                </div>
+            </div>
+        </header>
+        <div class="view-wrapper">
+            <div class="section-groups">
+                <div class="bg-video">
+                    <video
+                        src="https://arweave.net/tJd9JJa8ap5dHHvRAAPOE4Gh6VAY4h8KpBY1gzrtVWo"
+                        alt="bg-hyperbeam-video"
+                        autoplay
+                        loop
+                        muted
+                        playsinline
+                    ></video>
+                </div>
+                <div class="section-group">
+                    <div class="section">
+                        <h4 class="key-metric-header section-header">Uptime</h4>
+                        <div class="key-metric-wrapper">
+                            <h2 id="uptime-value" class="key-metric-value">
+                                -
+                            </h2>
+                            <span class="key-metric-label">Seconds</span>
+                        </div>
+                    </div>
+                    <div class="section">
+                        <h4 class="key-metric-header section-header">
+                            AO-Core Executions
+                        </h4>
+                        <div class="key-metric-wrapper">
+                            <h2 id="executions-value" class="key-metric-value">
+                                -
+                            </h2>
+                            <span class="key-metric-label">Executions</span>
+                        </div>
+                    </div>
+                    <div class="section">
+                        <h4 class="key-metric-header section-header">
+                            System Load
+                        </h4>
+                        <div class="key-metric-wrapper">
+                            <h2 id="system-value" class="key-metric-value">
+                                -
+                            </h2>
+                            <span class="key-metric-label">CPU Average</span>
+                        </div>
+                    </div>
+                </div>
+                <div class="section-group">
+                    <div class="section">
+                        <h4 class="key-metric-header section-header">
+                            Read Requests Handled
+                        </h4>
+                        <div class="key-metric-wrapper">
+                            <h2 id="read-value" class="key-metric-value">-</h2>
+                            <span class="key-metric-label">Requests</span>
+                        </div>
+                    </div>
+                    <div class="section">
+                        <h4 class="key-metric-header section-header">
+                            Write Requests Handled
+                        </h4>
+                        <div class="key-metric-wrapper">
+                            <h2 id="write-value" class="key-metric-value">-</h2>
+                            <span class="key-metric-label">Requests</span>
+                        </div>
+                    </div>
+                </div>
+            </div>
+
+            <div class="tabs-wrapper">
+                <div class="tabs">
+                    <button
+                        class="tab-button dashboard-tab-button active"
+                        data-tab="devices-tab"
+                    >
+                        Devices
+                    </button>
+                    <button
+                        class="tab-button dashboard-tab-button"
+                        data-tab="metrics-tab"
+                    >
+                        Metrics
+                    </button>
+                     <button
+                        class="tab-button dashboard-tab-button"
+                        data-tab="ledger-tab"
+                    >
+                        Ledger
+                    </button>
+                    <button
+                        class="tab-button dashboard-tab-button"
+                        data-tab="console-tab"
+                    >
+                        Console
+                    </button>
+                    <button
+                        class="tab-button cache-tab-button"
+                        data-tab="cache-tab"
+                    >
+                        Cacheviz
+                    </button>
+                </div>
+
+                <div id="devices-tab" class="tab-content active">
+                    <div id="info-section-lines" class="device-cards-container">
+                        <div class="loading-info-line">
+                            <p>Loading...</p>
+                        </div>
+                    </div>
+                </div>
+
+                <div id="metrics-tab" class="tab-content">
+                    <div id="metrics-section"></div>
+                </div>
+                
+                <div id="ledger-tab" class="tab-content">
+                    <div id="ledger-section"></div>
+                </div>
+
+                <div id="console-tab" class="tab-content">
+                    <div id="console-section"></div>
+                </div>
+
+                <div id="cache-tab" class="tab-content">
+                    <div id="cache-section"></div>
+                </div>
+            </div>
+        </div>
+        <footer>
+            <div class="footer-inner">
+                <div class="subheader">
+                    <div class="subheader-value">
+                        <p>Status:</p>
+                        <div class="subheader-indicator-wrapper">
+                            <div class="subheader-indicator"></div>
+                            <p>Live</p>
+                        </div>
+                    </div>
+                </div>
+            </div>
+        </footer>
+
+        <!-- Load modular JavaScript files -->
+        <script type="module" src="dashboard.js"></script>
+    </body>
+</html>
diff --git a/src/html/hyperbuddy@1.0/dashboard.js b/src/html/hyperbuddy@1.0/dashboard.js
new file mode 100644
index 000000000..350a7db04
--- /dev/null
+++ b/src/html/hyperbuddy@1.0/dashboard.js
@@ -0,0 +1,69 @@
+import { showTab, copyToClipboard, initTabListeners, SimpleJsonViewer } from '/~hyperbuddy@1.0/utils.js';
+import { fetchInfo, addConsole, addGraph } from '/~hyperbuddy@1.0/devices.js';
+import { startFetchingMetrics } from '/~hyperbuddy@1.0/metrics.js';
+
+/**
+ * Fetch and display ledger data
+ */
+async function loadLedger() {
+  const ledgerSection = document.getElementById('ledger-section');
+  
+  try {
+    ledgerSection.innerHTML = '<div class="loading-info-line"><p>Loading ledger data...</p></div>';
+    
+    const response = await fetch(`${window.location.origin}/ledger~node-process@1.0/now/balance/serialize~json@1.0`);
+    const data = await response.json();
+    
+    ledgerSection.innerHTML = '';
+    
+    const viewer = new SimpleJsonViewer({
+      container: ledgerSection,
+      data: data,
+      theme: 'dark',
+      expand: true
+    });
+    
+  } catch (error) {
+    // Remove the ledger tab button and content if the request fails
+    const ledgerTabButton = document.querySelector('.tab-button[data-tab="ledger-tab"]');
+    const ledgerTabContent = document.getElementById('ledger-tab');
+    
+    if (ledgerTabButton) {
+      ledgerTabButton.remove();
+    }
+    if (ledgerTabContent) {
+      ledgerTabContent.remove();
+    }
+    
+    console.error('Failed to load ledger data:', error);
+  }
+}
+
+/**
+ * Initialize the application
+ */
+function init() {
+  // Set up global event handlers
+  window.copyToClipboard = copyToClipboard;
+  
+  // Initialize tab switching
+  initTabListeners();
+  
+  // Fetch initial data
+  fetchInfo();
+  
+  // Start fetching metrics periodically
+  startFetchingMetrics();
+  
+  // Add console iframe
+  addConsole();
+  
+  // Add graph iframe
+  addGraph();
+  
+  // Load ledger data
+  loadLedger();
+}
+
+// Initialize when DOM is fully loaded
+document.addEventListener('DOMContentLoaded', init); 
\ No newline at end of file
diff --git a/src/html/hyperbuddy@1.0/devices.js b/src/html/hyperbuddy@1.0/devices.js
index 715fc1931..a844af4d2 100644
--- a/src/html/hyperbuddy@1.0/devices.js
+++ b/src/html/hyperbuddy@1.0/devices.js
@@ -1,4 +1,4 @@
-import { get, formatDisplayAmount, copyToClipboard } from '/~hyperbuddy@1.0/utils.js';
+import { get, copyToClipboard } from '/~hyperbuddy@1.0/utils.js';
 
 // Set up global message handler for console communications
 window.addEventListener('message', (event) => {
@@ -70,66 +70,68 @@ function parseInfo(text) {
 function renderInfoGroups(groups, devicesStr) {
   const devices = JSON.parse(devicesStr);
   const container = document.getElementById("info-section-lines");
-  
-  // Clear previous content
-  container.innerHTML = "";
-  
-  // Make sure it has the right class
-  container.className = "device-cards-container";
-  
-  for (const [key, device] of Object.entries(devices)) {
-    if(key == "device") continue;
-    const [name, variant] = device.name.split("@");
-    
-    // Create a card for each device
-    const card = document.createElement("div");
-    card.classList.add("device-card");
-    
-    // Create device name element
-    const deviceName = document.createElement("div");
-    deviceName.classList.add("device-name");
-    deviceName.textContent = name;
-    
-    // Create variant element with color based on version number
-    const deviceVariant = document.createElement("div");
-    deviceVariant.classList.add("device-variant");
-    
-    // Add color class based on version number
-    const versionNum = parseFloat(variant);
-    if (versionNum >= 1.0) {
-      deviceVariant.classList.add("device-variant-high");
-    } else if (versionNum >= 0.5) {
-      deviceVariant.classList.add("device-variant-medium");
-    } else {
-      deviceVariant.classList.add("device-variant-low");
+
+  if (container) {
+
+    // Clear previous content
+    container.innerHTML = "";
+
+    // Make sure it has the right class
+    container.className = "device-cards-container";
+
+    for (const [key, device] of Object.entries(devices)) {
+      if (key == "device") continue;
+      const [name, variant] = device.name.split("@");
+
+      // Create a card for each device
+      const card = document.createElement("div");
+      card.classList.add("device-card");
+
+      // Create device name element
+      const deviceName = document.createElement("div");
+      deviceName.classList.add("device-name");
+      deviceName.textContent = name;
+
+      // Create variant element with color based on version number
+      const deviceVariant = document.createElement("div");
+      deviceVariant.classList.add("device-variant");
+
+      // Add color class based on version number
+      const versionNum = parseFloat(variant);
+      if (versionNum >= 1.0) {
+        deviceVariant.classList.add("device-variant-high");
+      } else if (versionNum >= 0.5) {
+        deviceVariant.classList.add("device-variant-medium");
+      } else {
+        deviceVariant.classList.add("device-variant-low");
+      }
+
+      deviceVariant.textContent = variant;
+
+      // Add elements to card
+      card.appendChild(deviceName);
+      card.appendChild(deviceVariant);
+
+      // Add card to container
+      container.appendChild(card);
     }
-    
-    deviceVariant.textContent = variant;
-    
-    // Add elements to card
-    card.appendChild(deviceName);
-    card.appendChild(deviceVariant);
-    
-    // Add card to container
-    container.appendChild(card);
   }
 }
 
-/**
- * Fetch info data from the server
- */
 async function fetchInfo() {
   try {
     const operatorAddress = await get("/~meta@1.0/info/address");
     const operatorAction = document.getElementById("operator-action");
-    operatorAction.innerHTML = formatAddress(operatorAddress);
-    operatorAction.value = operatorAddress;
-    operatorAction.disabled = false;
-    
-    // Add click handler for the operator button
-    operatorAction.addEventListener("click", function() {
-      copyToClipboard(this);
-    });
+
+    if (operatorAction) {
+      operatorAction.innerHTML = formatAddress(operatorAddress);
+      operatorAction.value = operatorAddress;
+      operatorAction.disabled = false;
+
+      operatorAction.addEventListener("click", function () {
+        copyToClipboard(this);
+      });
+    }
 
     const info = await get("/~meta@1.0/info");
     const deviceInfo =
@@ -165,6 +167,17 @@ function addConsole() {
   container.appendChild(consoleContainer);
 }
 
+function addGraph() {
+  const container = document.getElementById("cache-section");
+  const cacheContainer = document.createElement("iframe");
+  cacheContainer.style.width = "100%";
+  cacheContainer.style.minHeight = "500px";
+  cacheContainer.style.border = "none";
+  cacheContainer.src = "/~hyperbuddy@1.0/graph";
+  cacheContainer.id = "cache-iframe";
+  container.appendChild(cacheContainer);
+}
+
 /**
  * Expand the console to take over the entire screen
  */
@@ -173,7 +186,7 @@ function expandConsole() {
   if (!consoleIframe) {
     return;
   }
-  
+
   // Save original position and size
   if (!consoleIframe.dataset.originalStyles) {
     consoleIframe.dataset.originalStyles = JSON.stringify({
@@ -186,7 +199,7 @@ function expandConsole() {
       zIndex: consoleIframe.style.zIndex
     });
   }
-  
+
   // Apply fullscreen styles directly to the iframe
   consoleIframe.style.position = "fixed";
   consoleIframe.style.top = "0";
@@ -195,7 +208,7 @@ function expandConsole() {
   consoleIframe.style.height = "100%";
   consoleIframe.style.minHeight = "100%";
   consoleIframe.style.zIndex = "9999";
-  
+
   // Notify the iframe that it's now expanded
   setTimeout(() => {
     if (consoleIframe.contentWindow) {
@@ -211,11 +224,11 @@ function expandConsole() {
  */
 function exitExpandedConsole() {
   const consoleIframe = document.getElementById("console-iframe");
-  
+
   if (!consoleIframe) {
     return;
   }
-  
+
   // Restore original position and size
   if (consoleIframe.dataset.originalStyles) {
     const originalStyles = JSON.parse(consoleIframe.dataset.originalStyles);
@@ -236,7 +249,7 @@ function exitExpandedConsole() {
     consoleIframe.style.minHeight = "500px";
     consoleIframe.style.zIndex = "";
   }
-  
+
   // Notify the iframe that it's now in normal mode
   setTimeout(() => {
     if (consoleIframe.contentWindow) {
@@ -253,6 +266,7 @@ export {
   renderInfoGroups,
   fetchInfo,
   addConsole,
+  addGraph,
   expandConsole,
   exitExpandedConsole
 }; 
\ No newline at end of file
diff --git a/src/html/hyperbuddy@1.0/index.html b/src/html/hyperbuddy@1.0/index.html
old mode 100755
new mode 100644
index 7f2ccf4d8..8afc56419
--- a/src/html/hyperbuddy@1.0/index.html
+++ b/src/html/hyperbuddy@1.0/index.html
@@ -1,145 +1,575 @@
 <!DOCTYPE html>
 <html lang="en">
+    <head>
+        <meta charset="UTF-8" />
+        <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+        <link
+            rel="icon"
+            type="image/png"
+            href="https://arweave.net/rBcLwnVU2fWNEKUW8PY0TzEAPuCHMj2Vp6z6CedHJf0"
+        />
+        <link
+            href="https://fonts.googleapis.com/css2?family=Open+Sans:ital,wght@0,300..800;1,300..800&display=swap"
+            rel="stylesheet"
+        />
+        <link rel="stylesheet" href="/~hyperbuddy@1.0/styles.css" />
 
-<head>
-	<meta charset="UTF-8" />
-	<meta name="viewport" content="width=device-width, initial-scale=1.0" />
-	<link rel="icon" type="image/png" href="https://arweave.net/oTMNDjwfn-Mv0bJZPGmMpDPPYWqINH6lQeTVc92bwjA" />
-	<link href="https://fonts.googleapis.com/css2?family=Open+Sans:ital,wght@0,300..800;1,300..800&display=swap"
-		rel="stylesheet" />
-	<link rel="stylesheet" href="styles.css" />
-	<title>HyperBEAM</title>
-</head>
-
-<body>
-
-
-	<div class="header">
-		<a class="graph-link" href="/~hyperbuddy@1.0/graph" target="_blank">
-			Cache Visualizer
-		</a>
-		<div class="header-inner">
-			<div class="header-hyperbeam-chain">
-				<video autoplay muted loop playsinline width="500">
-					<source src="https://arweave.net/kvebTQY2E5J7Zx-SSnsbwxIqS0-BxII9Bb0bQc__Rmg" type="video/mp4" />
-				</video>
-			</div>
-			<div class="header-main">
-				<div class="header-left">
-					<div class="video-container">
-						<video autoplay muted loop playsinline width="500" class="light-video">
-							<source src="https://arweave.net/ewmiCoSJpWpNv02F7AW5ZCp4meyaJxZHbOD4WEsuDFY"
-								type="video/mp4" />
-							Your browser does not support the video tag.
-						</video>
-					</div>
-				</div>
-			</div>
-			<div class="subheader">
-				<div class="subheader-value">
-					<p>Status:</p>
-					<div class="subheader-indicator-wrapper">
-						<div class="subheader-indicator"></div>
-						<p>Live</p>
-					</div>
-				</div>
-				<div class="subheader-value">
-					<p>Operator:</p>
-					<button id="operator-action" disabled="true">
-						Loading...
-					</button>
-				</div>
-			</div>
-		</div>
-	</div>
-
-	<div class="section-groups">
-		<div class="section-group">
-			<div class="section">
-				<h4 class="key-metric-header section-header">Uptime</h4>
-				<div class="key-metric-wrapper">
-					<h2 id="uptime-value" class="key-metric-value">-</h2>
-					<span class="key-metric-label">Seconds</span>
-				</div>
-			</div>
-			<div class="section">
-				<h4 class="key-metric-header section-header">
-					AO-Core Executions
-				</h4>
-				<div class="key-metric-wrapper">
-					<h2 id="executions-value" class="key-metric-value">
-						-
-					</h2>
-					<span class="key-metric-label">Executions</span>
-				</div>
-			</div>
-			<div class="section">
-				<h4 class="key-metric-header section-header">
-					System Load
-				</h4>
-				<div class="key-metric-wrapper">
-					<h2 id="system-value" class="key-metric-value">-</h2>
-					<span class="key-metric-label">CPU Average</span>
-				</div>
-			</div>
-		</div>
-		<div class="section-group">
-			<div class="section">
-				<h4 class="key-metric-header section-header">
-					Read Requests Handled
-				</h4>
-				<div class="key-metric-wrapper">
-					<h2 id="read-value" class="key-metric-value">-</h2>
-					<span class="key-metric-label">Requests</span>
-				</div>
-			</div>
-			<div class="section">
-				<h4 class="key-metric-header section-header">
-					Write Requests Handled
-				</h4>
-				<div class="key-metric-wrapper">
-					<h2 id="write-value" class="key-metric-value">-</h2>
-					<span class="key-metric-label">Requests</span>
-				</div>
-			</div>
-		</div>
-	</div>
-
-
-
-	<div class="tabs-wrapper">
-		<div class="tabs">
-			<button class="tab-button active" data-tab="devices-tab">
-				Devices
-			</button>
-			<button class="tab-button" data-tab="metrics-tab">
-				Metrics
-			</button>
-			<button class="tab-button" data-tab="console-tab">
-				Console
-			</button>
-		</div>
-
-		<div id="devices-tab" class="tab-content active">
-			<div id="info-section-lines" class="device-cards-container">
-				<div class="info-line">
-					<p>Loading...</p>
-				</div>
-			</div>
-		</div>
-
-		<div id="metrics-tab" class="tab-content">
-			<div id="metrics-section"></div>
-		</div>
-
-		<div id="console-tab" class="tab-content">
-			<div id="console-section"></div>
-		</div>
-
-	</div>
-
-	<!-- Load modular JavaScript files -->
-	<script type="module" src="main.js"></script>
-</body>
-
-</html>
\ No newline at end of file
+        <title>HyperBEAM</title>
+    </head>
+    <body>
+        <header>
+            <div class="header-inner">
+                <a href="/">
+                    <div class="logo">
+                        <img
+                            src="https://arweave.net/Ggr1cz-jbiDS2gAVFHxkoKzmNQQD4WcMTfipWyuEmgY"
+                            alt="hyperbeam-logo"
+                        />
+                    </div>
+                </a>
+                <div class="subheader-value">
+                    <p>Operator:</p>
+                    <button id="operator-action" disabled="true">
+                        Loading...
+                    </button>
+                </div>
+            </div>
+        </header>
+        <div class="view-wrapper">
+            <div class="explorer-view-flex">
+                <div class="bg-video">
+                    <video
+                        src="https://arweave.net/tJd9JJa8ap5dHHvRAAPOE4Gh6VAY4h8KpBY1gzrtVWo"
+                        alt="bg-hyperbeam-video"
+                        autoplay
+                        loop
+                        muted
+                        playsinline
+                    ></video>
+                </div>
+                <div class="explorers-wrapper">
+                    <div class="explorer-view">
+                        <div class="signature-wrapper border-wrapper-primary">
+                            <div class="signature-line">
+                                <span>Signature</span>
+                                <p>...</p>
+                            </div>
+                            <div class="signature-line">
+                                <span>Signer</span>
+                                <p>...</p>
+                            </div>
+                        </div>
+                        <div class="explorer-wrapper">
+                            <div class="explorer-header">
+                                <svg
+                                    xmlns="http://www.w3.org/2000/svg"
+                                    width="20"
+                                    height="20"
+                                    fill="#000"
+                                    viewBox="0 0 256 256"
+                                >
+                                    <path
+                                        d="M120,176h-8v-4a28,28,0,0,0-56,0v4H48a8,8,0,0,0-8,8v40a8,8,0,0,0,8,8h72a8,8,0,0,0,8-8V184A8,8,0,0,0,120,176Zm-48-4a12,12,0,0,1,24,0v4H72Zm40,44H56V192h56ZM213.66,82.34l-56-56A8,8,0,0,0,152,24H56A16,16,0,0,0,40,40v88a8,8,0,0,0,16,0V40h88V88a8,8,0,0,0,8,8h48V216H160a8,8,0,0,0,0,16h40a16,16,0,0,0,16-16V88A8,8,0,0,0,213.66,82.34ZM160,51.31,188.69,80H160Z"
+                                    ></path>
+                                </svg>
+                                <p>Response</p>
+                            </div>
+                            <div
+                                id="signed-headers-explorer"
+                                class="explorer"
+                            ></div>
+                            <div class="explorer-footer">
+                                <p id="headers-explorer-footer-value">
+                                    (0) Headers
+                                </p>
+                            </div>
+                        </div>
+                        <div class="explorer-wrapper">
+                            <div class="explorer-header">
+                                <svg
+                                    xmlns="http://www.w3.org/2000/svg"
+                                    width="20"
+                                    height="20"
+                                    fill="#000"
+                                    viewBox="0 0 256 256"
+                                >
+                                    <path
+                                        d="M232,80a55.67,55.67,0,0,1-16.4,39.6l-30.07,30.06a8,8,0,0,1-11.31-11.32l30.07-30.06a40,40,0,1,0-56.57-56.56L117.66,81.77a8,8,0,0,1-11.32-11.32L136.4,40.4A56,56,0,0,1,232,80Zm-93.66,94.22-30.06,30.06a40,40,0,1,1-56.56-56.57l30.05-30.05a8,8,0,0,0-11.32-11.32L40.4,136.4a56,56,0,0,0,79.2,79.2l30.06-30.07a8,8,0,0,0-11.32-11.31Z"
+                                    ></path>
+                                </svg>
+                                <p>Links</p>
+                            </div>
+                            <div id="links-explorer" class="explorer"></div>
+                            <div class="explorer-footer">
+                                <p id="links-explorer-footer-value">
+                                    (0) Links
+                                </p>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+                <div class="visual-wrapper">
+                    <div class="tabs-wrapper">
+                        <div class="tabs">
+                            <button
+                                class="tab-button hyperstate-tab-button active"
+                                data-id="cacheviz@1.0/index"
+                                data-tab="cacheviz-tab"
+                            >
+                                Cacheviz
+                            </button>
+                            <button
+                                class="tab-button hyperstate-tab-button"
+                                data-id="hyperbuddy@1.0/format"
+                                data-tab="hyperbuddy-tab"
+                            >
+                                Hyperbuddy
+                            </button>
+                        </div>
+                    </div>
+                    <div class="visual-body"></div>
+                </div>
+            </div>
+        </div>
+        <footer>
+            <div class="footer-inner">
+                <div class="subheader">
+                    <div class="subheader-value">
+                        <p>Status:</p>
+                        <div class="subheader-indicator-wrapper">
+                            <div class="subheader-indicator"></div>
+                            <p>Live</p>
+                        </div>
+                    </div>
+                </div>
+            </div>
+        </footer>
+
+        <script>
+            function parseHeaders(input) {
+                const out = {};
+                input
+                    .split("\n")
+                    .map((l) => l.trim())
+                    .filter((l) => l && l.includes(":"))
+                    .forEach((line) => {
+                        const idx = line.indexOf(":");
+                        const key = line.slice(0, idx).trim();
+                        const val = line.slice(idx + 1).trim();
+                        out[key] = { data: val };
+                        if (key.includes("+link")) out[key].isLink = true;
+                    });
+                return out;
+            }
+
+            /**
+             * Parse a Signature-Input header value into structured entries.
+             * @param {string} inputHeader – the raw Signature-Input header *value* (no “Signature-Input:” prefix)
+             */
+            function parseSignatureInput(inputHeader) {
+                return inputHeader.split(/\s*,\s*/).map((entry) => {
+                    // Label is everything before the first '='
+                    const eq = entry.indexOf("=");
+                    const label = entry.slice(0, eq).trim();
+
+                    // Fields are inside the first "(...)"
+                    const parenMatch = entry.match(/=\(\s*([^)]+)\s*\)/);
+                    const fields = parenMatch
+                        ? Array.from(
+                              parenMatch[1].matchAll(/"([^"]+)"/g),
+                              (m) => m[1]
+                          )
+                        : [];
+
+                    // Pull out any ;key="value" pairs
+                    const paramRegex = /;\s*([^=;\s]+)\s*=\s*"([^"]*)"/g;
+                    const params = {};
+                    let m;
+                    while ((m = paramRegex.exec(entry)) !== null) {
+                        params[m[1]] = m[2];
+                    }
+
+                    return {
+                        label,
+                        fields,
+                        alg: params.alg || "",
+                        keyid: params.keyid || "",
+                        ...(params.tag ? { tag: params.tag } : {}),
+                    };
+                });
+            }
+
+            function joinHeaders(headers) {
+                return Array.from(headers.entries())
+                    .map(([name, value]) => `${name}: ${value}`)
+                    .join("\n");
+            }
+
+            /**
+             * Given your parsed headers object (from parseHeaders) and the raw
+             * Signature-Input header value, return a new object containing
+             * only those headers which were covered by the signature-input.
+             */
+            function filterSignedHeaders(parsedHeaders, signatureInputValue) {
+                const sigInputs = parseSignatureInput(signatureInputValue);
+
+                // Collect all the field names covered
+                const covered = new Set(
+                    sigInputs.flatMap((si) =>
+                        si.fields.map((f) => f.toLowerCase())
+                    )
+                );
+
+                // Filter parsedHeaders keys by membership in covered
+                return Object.fromEntries(
+                    Object.entries(parsedHeaders).filter(([headerName]) =>
+                        covered.has(headerName.toLowerCase())
+                    )
+                );
+            }
+
+            /**
+             * @param {string} sigInputRaw
+             * @returns {Promise<string>} the derived “address” of the first non-HMAC signer
+             */
+            async function getSignerAddress(sigInputRaw) {
+                const entries = parseSignatureInput(sigInputRaw);
+                if (!entries.length) return "Unknown";
+
+                // Pick the first entry whose alg isn’t hmac-sha256 (i.e. the real pubkey)
+                const realEntry =
+                    entries.find(
+                        (e) => e.alg.toLowerCase() !== "hmac-sha256"
+                    ) || entries[0];
+                const rawKeyId = realEntry.keyid;
+
+                // Now decode it to bytes (base64url → Uint8Array)
+                const pubKeyBytes = base64UrlToUint8Array(rawKeyId);
+
+                // sha-256 the public key bytes
+                const hash = await crypto.subtle.digest("SHA-256", pubKeyBytes);
+                const hashArr = new Uint8Array(hash);
+
+                // base64url-encode the hash to get your “address”
+                const address = btoa(String.fromCharCode(...hashArr))
+                    .replace(/\+/g, "-")
+                    .replace(/\//g, "_")
+                    .replace(/=+$/, "");
+
+                return address;
+            }
+
+            /** Decode base64url string → Uint8Array */
+            function base64UrlToUint8Array(b64url) {
+                let b64 = b64url.replace(/-/g, "+").replace(/_/g, "/");
+                // Pad to multiple of 4
+                while (b64.length % 4) b64 += "=";
+                const bin = atob(b64);
+                const arr = new Uint8Array(bin.length);
+                for (let i = 0; i < bin.length; i++) {
+                    arr[i] = bin.charCodeAt(i);
+                }
+                return arr;
+            }
+
+            async function renderExplorer(container, parsed, depth = 0) {
+                const body = document.createElement("div");
+                body.className = "explorer-body";
+
+                Object.entries(parsed).forEach(
+                    ([headerKey, { data, isLink }], idx, arr) => {
+                        const wrapper = document.createElement("div");
+                        wrapper.className = "explorer-body-row-wrapper";
+
+                        const row = document.createElement("div");
+                        row.className = "explorer-body-row";
+                        row.style.paddingLeft = `${depth * 20 + 15}px`;
+
+                        let arrow, nestedBody;
+                        if (isLink) {
+                            row.classList.add("explorer-action");
+
+                            arrow = document.createElement("span");
+                            arrow.className = "explorer-body-row-indicator";
+                            row.appendChild(arrow);
+
+                            wrapper._loaded = false;
+                            wrapper._isOpen = false;
+
+                            row.addEventListener("click", async () => {
+                                if (!wrapper._loaded) {
+                                    wrapper._loaded = true;
+                                    try {
+                                        const res = await fetch(
+                                            `${window.location.origin}/${data}`
+                                        );
+                                        const raw = joinHeaders(
+                                            res.headers
+                                        ).trim();
+                                        
+                                        const parsed = parseHeaders(raw);
+
+                                        // Get the signature-input header string
+                                        const sigInputRaw =
+                                            parsed["signature-input"]?.data;
+
+                                        // Only render headers that have been signed
+                                        const toRender = sigInputRaw
+                                            ? filterSignedHeaders(
+                                                  parsed,
+                                                  sigInputRaw
+                                              )
+                                            : {};
+
+                                        await renderExplorer(
+                                            nestedBody,
+                                            toRender,
+                                            depth + 1
+                                        );
+                                    } catch (e) {
+                                        console.error("Fetch failed:", e);
+                                    }
+                                    wrapper._isOpen = true;
+                                    nestedBody.style.display = "flex";
+                                    row.classList.add("explorer-body-row-open");
+                                    arrow.classList.add(
+                                        "explorer-body-row-indicator-open"
+                                    );
+                                } else {
+                                    wrapper._isOpen = !wrapper._isOpen;
+                                    if (wrapper._isOpen) {
+                                        nestedBody.style.display = "flex";
+                                        row.classList.add(
+                                            "explorer-body-row-open"
+                                        );
+                                        arrow.classList.add(
+                                            "explorer-body-row-indicator-open"
+                                        );
+                                    } else {
+                                        nestedBody.style.display = "none";
+                                        row.classList.remove(
+                                            "explorer-body-row-open"
+                                        );
+                                        arrow.classList.remove(
+                                            "explorer-body-row-indicator-open"
+                                        );
+                                    }
+                                }
+                            });
+                        }
+
+                        const keySpan = document.createElement("span");
+                        keySpan.textContent = headerKey + ":";
+                        row.appendChild(keySpan);
+
+                        const value = document.createElement("p");
+                        if (isLink)
+                            value.classList.add("explorer-body-link-value");
+                        value.textContent = data;
+                        row.appendChild(value);
+
+                        wrapper.appendChild(row);
+
+                        nestedBody = document.createElement("div");
+                        nestedBody.className = "explorer-body";
+                        nestedBody.style.display = "none";
+                        wrapper.appendChild(nestedBody);
+
+                        body.appendChild(wrapper);
+                    }
+                );
+
+                container.appendChild(body);
+            }
+
+            function renderSignature(signature, signer) {
+                const wrapper = document.querySelector(".signature-wrapper");
+
+                while (wrapper.firstChild) {
+                    wrapper.removeChild(wrapper.firstChild);
+                }
+
+                const signatureLine = document.createElement("div");
+                signatureLine.classList.add("signature-line");
+
+                const signatureKey = document.createElement("span");
+                signatureKey.innerText = "Signature";
+                signatureLine.appendChild(signatureKey);
+
+                const signatureValue = document.createElement("p");
+                signatureValue.innerText = signature;
+                signatureValue.classList.add("signature-value", "copy-hover");
+                signatureLine.appendChild(signatureValue);
+
+                const signerLine = document.createElement("div");
+                signerLine.classList.add("signature-line");
+
+                const signerKey = document.createElement("span");
+                signerKey.innerText = "Signer";
+                signerLine.appendChild(signerKey);
+
+                const signerValue = document.createElement("p");
+                signerValue.innerText = signer;
+                signerValue.classList.add("signer-value", "copy-hover");
+                signerLine.appendChild(signerValue);
+
+                wrapper.appendChild(signatureLine);
+                wrapper.appendChild(signerLine);
+
+                // Add class or ID here for copy tooltip
+                enableTooltipAndCopy(".signature-value");
+                enableTooltipAndCopy(".signer-value");
+                enableTooltipAndCopy(".message-value");
+                enableTooltipAndCopy("#operator-action");
+            }
+
+            function enableTooltipAndCopy(selector) {
+                const el = document.querySelector(selector);
+                if (!el) return;
+
+                // Create tooltip
+                const tooltip = document.createElement("div");
+                tooltip.className = "custom-tooltip";
+                tooltip.style.position = "absolute";
+                tooltip.style.backgroundColor = "#333";
+                tooltip.style.color = "#fff";
+                tooltip.style.padding = "5px 10px";
+                tooltip.style.borderRadius = "4px";
+                tooltip.style.fontSize = "12px";
+                tooltip.style.whiteSpace = "nowrap";
+                tooltip.style.display = "none";
+                tooltip.style.zIndex = "9999";
+                tooltip.style.pointerEvents = "none";
+                document.body.appendChild(tooltip);
+
+                el.style.cursor = "pointer";
+
+                el.addEventListener("mouseenter", (e) => {
+                    tooltip.textContent = "Click to copy";
+                    tooltip.style.display = "block";
+                });
+
+                el.addEventListener("mousemove", (e) => {
+                    const tooltipRect = tooltip.getBoundingClientRect();
+                    tooltip.style.left = `${
+                        e.clientX - tooltipRect.width / 2
+                    }px`;
+                    tooltip.style.top = `${
+                        e.clientY - tooltipRect.height - 10
+                    }px`;
+                });
+
+                el.addEventListener("mouseleave", () => {
+                    tooltip.style.display = "none";
+                });
+
+                el.addEventListener("click", async () => {
+                    try {
+                        await navigator.clipboard.writeText(el.innerText);
+                        tooltip.textContent = "Copied!";
+                        setTimeout(() => {
+                            tooltip.style.display = "none";
+                        }, 1000);
+                    } catch (err) {
+                        console.error("Copy failed", err);
+                    }
+                });
+            }
+
+            async function renderInitialMessage() {
+                const res = await fetch(window.location.href);
+                const raw = joinHeaders(res.headers).trim();
+                const parsed = parseHeaders(raw);
+
+                const signature = res.headers.get("signature");
+                if (signature) {
+                    const signatureInput =
+                        parsed["signature-input"]?.data ?? "";
+
+                    const signer = signatureInput
+                        ? await getSignerAddress(signatureInput)
+                        : "Unknown";
+
+                    renderSignature(signature, signer);
+                }
+
+                // Get the signature-input header string
+                const sigInputRaw = parsed["signature-input"]?.data;
+
+                // Only render headers that have been signed
+                const toRender = sigInputRaw
+                    ? filterSignedHeaders(parsed, sigInputRaw)
+                    : {};
+
+                renderExplorer(
+                    document.getElementById("signed-headers-explorer"),
+                    toRender,
+                    0
+                );
+
+                document.getElementById(
+                    "headers-explorer-footer-value"
+                ).innerText = `(${Object.keys(toRender).length}) Headers`;
+
+                let links = {};
+                for (const key of Object.keys(parsed)) {
+                    if (key.includes("+link")) {
+                        links[key] = parsed[key];
+                    }
+                }
+
+                if (Object.keys(links).length > 0) {
+                    renderExplorer(
+                        document.getElementById("links-explorer"),
+                        links,
+                        0
+                    );
+
+                    document.getElementById(
+                        "links-explorer-footer-value"
+                    ).innerText = `(${Object.keys(links).length}) Links`;
+                }
+            }
+
+            document.addEventListener("DOMContentLoaded", () => {
+                const container = document.querySelector(".visual-body");
+                const tabs = document.querySelectorAll(".tab-button");
+
+                const makeIframe = (device) => {
+                    const iframe = document.createElement("iframe");
+                    iframe.src = `${window.location.href}/~${device}`;
+                    iframe.id = "preview-frame";
+                    iframe.style.width = "100%";
+                    iframe.style.height = "100%";
+                    return iframe;
+                };
+
+                const initial = document.querySelector(".tab-button.active");
+                if (initial)
+                    container.appendChild(makeIframe(initial.dataset.id));
+
+                tabs.forEach((tab) => {
+                    tab.addEventListener("click", () => {
+                        document
+                            .querySelectorAll(".tab-button.active")
+                            .forEach((t) => t.classList.remove("active"));
+                        tab.classList.add("active");
+
+                        const old = document.getElementById("preview-frame");
+                        if (old) old.remove();
+
+                        container.appendChild(makeIframe(tab.dataset.id));
+                    });
+                });
+            });
+
+            renderInitialMessage();
+        </script>
+
+        <script type="module">
+            import { fetchInfo } from "/~hyperbuddy@1.0/devices.js";
+
+            fetchInfo();
+        </script>
+    </body>
+</html>
diff --git a/src/html/hyperbuddy@1.0/main.js b/src/html/hyperbuddy@1.0/main.js
deleted file mode 100644
index 2c19a1ade..000000000
--- a/src/html/hyperbuddy@1.0/main.js
+++ /dev/null
@@ -1,26 +0,0 @@
-import { showTab, copyToClipboard, initTabListeners } from '/~hyperbuddy@1.0/utils.js';
-import { fetchInfo, addConsole } from '/~hyperbuddy@1.0/devices.js';
-import { startFetchingMetrics } from '/~hyperbuddy@1.0/metrics.js';
-
-/**
- * Initialize the application
- */
-function init() {
-  // Set up global event handlers
-  window.copyToClipboard = copyToClipboard;
-  
-  // Initialize tab switching
-  initTabListeners();
-  
-  // Fetch initial data
-  fetchInfo();
-  
-  // Start fetching metrics periodically
-  startFetchingMetrics();
-  
-  // Add console iframe
-  addConsole();
-}
-
-// Initialize when DOM is fully loaded
-document.addEventListener('DOMContentLoaded', init); 
\ No newline at end of file
diff --git a/src/html/hyperbuddy@1.0/metrics.js b/src/html/hyperbuddy@1.0/metrics.js
index 771bf7b80..55dfa886f 100644
--- a/src/html/hyperbuddy@1.0/metrics.js
+++ b/src/html/hyperbuddy@1.0/metrics.js
@@ -1,5 +1,5 @@
 // Import the required functions from utils.js
-import { get, formatDisplayAmount } from '/~hyperbuddy@1.0/utils.js';
+import { get, formatDisplayAmount } from "/~hyperbuddy@1.0/utils.js";
 
 /**
  * Parse metrics data from Prometheus format
@@ -56,12 +56,15 @@ function parseMetrics(text) {
             document.getElementById("uptime-value").innerHTML =
               formatDisplayAmount(data);
             startUpdatingUptime();
-          }
-          else if (label === `system_load`) {
-            document.getElementById("system-value").innerHTML = formatDisplayAmount(data);
-          }
-          else if (currentMetric.name === 'event' && label.includes('topic="ao_result",event="ao_result"')) {
-            document.getElementById("executions-value").innerHTML = formatDisplayAmount(data);
+          } else if (label === `system_load`) {
+            document.getElementById("system-value").innerHTML =
+              formatDisplayAmount(data);
+          } else if (
+            currentMetric.name === "event" &&
+            label.includes('topic="ao_result",event="ao_result"')
+          ) {
+            document.getElementById("executions-value").innerHTML =
+              formatDisplayAmount(data);
           }
 
           currentMetric.values.push({ label, data });
@@ -74,18 +77,22 @@ function parseMetrics(text) {
     const spawnedProcesse = groups.counter.find(
       (item) => item.name === "cowboy_spawned_processes_total"
     );
-    
+
     if (spawnedProcesse?.values) {
-      const readsHandled = spawnedProcesse.values.find(
-        (value) =>
-          value.label.includes('method="GET",reason="normal",status_class="success"')
-      )?.data || 0;
-      
-      const writesHandled = spawnedProcesse.values.find(
-        (value) =>
-          value.label.includes('method="POST",reason="normal",status_class="success"')
-      )?.data || 0;
-      
+      const readsHandled =
+        spawnedProcesse.values.find((value) =>
+          value.label.includes(
+            'method="GET",reason="normal",status_class="success"'
+          )
+        )?.data || 0;
+
+      const writesHandled =
+        spawnedProcesse.values.find((value) =>
+          value.label.includes(
+            'method="POST",reason="normal",status_class="success"'
+          )
+        )?.data || 0;
+
       document.getElementById("read-value").innerHTML =
         formatDisplayAmount(readsHandled);
       document.getElementById("write-value").innerHTML =
@@ -102,71 +109,106 @@ function parseMetrics(text) {
  */
 function renderMetricGroups(groups) {
   // Save the currently active category or default to "AO Events"
-  let activeCategory = localStorage.getItem('activeMetricsCategory') || "AO Events";
-  
+  let activeCategory =
+    localStorage.getItem("activeMetricsCategory") || "AO Events";
+
   const container = document.getElementById("metrics-section");
   container.innerHTML = "";
-  
+
   // Create category sections to organize metrics
   const categories = {
     "AO Events": ["event"],
-    "System Stats": ["process_uptime_seconds", "system_load", "outbound_connections"],
-    "HTTP & Requests": ["cowboy_requests_total", "cowboy_protocol_upgrades_total", "cowboy_spawned_processes_total", "cowboy_errors_total", "cowboy_early_errors_total", "cowboy_request_duration_seconds", "http_request_duration_seconds", "cowboy_receive_body_duration_seconds"],
-    "Memory": ["erlang_vm_memory_atom_bytes_total", "erlang_vm_memory_bytes_total", "erlang_vm_memory_dets_tables", "erlang_vm_memory_ets_tables", "erlang_vm_memory_processes_bytes_total", "erlang_vm_memory_system_bytes_total"],
-    "Network Stats": ["http_client_uploaded_bytes_total", "http_client_downloaded_bytes_total", "gun_requests_total"],
-    "Telemetry": ["telemetry_scrape_size_bytes", "telemetry_scrape_duration_seconds", "telemetry_scrape_encoded_size_bytes"],
-    "VM Stats": ["erlang_vm_msacc_aux_seconds_total", "erlang_vm_msacc_check_io_seconds_total", "erlang_vm_msacc_emulator_seconds_total", "erlang_vm_msacc_gc_seconds_total", "erlang_vm_msacc_other_seconds_total"]
+    "System Stats": [
+      "process_uptime_seconds",
+      "system_load",
+      "outbound_connections",
+    ],
+    "HTTP & Requests": [
+      "cowboy_requests_total",
+      "cowboy_protocol_upgrades_total",
+      "cowboy_spawned_processes_total",
+      "cowboy_errors_total",
+      "cowboy_early_errors_total",
+      "cowboy_request_duration_seconds",
+      "http_request_duration_seconds",
+      "cowboy_receive_body_duration_seconds",
+    ],
+    Memory: [
+      "erlang_vm_memory_atom_bytes_total",
+      "erlang_vm_memory_bytes_total",
+      "erlang_vm_memory_dets_tables",
+      "erlang_vm_memory_ets_tables",
+      "erlang_vm_memory_processes_bytes_total",
+      "erlang_vm_memory_system_bytes_total",
+    ],
+    "Network Stats": [
+      "http_client_uploaded_bytes_total",
+      "http_client_downloaded_bytes_total",
+      "gun_requests_total",
+    ],
+    Telemetry: [
+      "telemetry_scrape_size_bytes",
+      "telemetry_scrape_duration_seconds",
+      "telemetry_scrape_encoded_size_bytes",
+    ],
+    "VM Stats": [
+      "erlang_vm_msacc_aux_seconds_total",
+      "erlang_vm_msacc_check_io_seconds_total",
+      "erlang_vm_msacc_emulator_seconds_total",
+      "erlang_vm_msacc_gc_seconds_total",
+      "erlang_vm_msacc_other_seconds_total",
+    ],
   };
-  
+
   // Build an index to quickly find metrics
   const metricsIndex = {};
   for (const type in groups) {
-    groups[type].forEach(metric => {
+    groups[type].forEach((metric) => {
       metricsIndex[metric.name] = { metric, type };
     });
   }
-  
+
   // Create the metrics navbar
   const navbar = document.createElement("div");
   navbar.classList.add("metrics-navbar");
-  
+
   // Create content container to hold the metrics content
   const metricsContent = document.createElement("div");
   metricsContent.classList.add("metrics-content");
-  
+
   // Create and add all category sections first (hidden initially)
   const categoryContainers = {};
-  
+
   // Function to show the selected category
   const showCategory = (categoryName) => {
     // Hide all categories
-    Object.values(categoryContainers).forEach(container => {
+    Object.values(categoryContainers).forEach((container) => {
       container.style.display = "none";
     });
-    
+
     // Show selected category
     if (categoryContainers[categoryName]) {
       categoryContainers[categoryName].style.display = "block";
     }
-    
+
     // Update active tab in navbar
-    document.querySelectorAll('.metrics-nav-item').forEach(item => {
+    document.querySelectorAll(".metrics-nav-item").forEach((item) => {
       if (item.textContent === categoryName) {
-        item.classList.add('active');
+        item.classList.add("active");
       } else {
-        item.classList.remove('active');
+        item.classList.remove("active");
       }
     });
-    
+
     // Save active category to localStorage
-    localStorage.setItem('activeMetricsCategory', categoryName);
+    localStorage.setItem("activeMetricsCategory", categoryName);
     activeCategory = categoryName;
   };
-  
+
   // Create "Other Metrics" category for uncategorized metrics
   const otherMetrics = [];
   for (const type in groups) {
-    groups[type].forEach(metric => {
+    groups[type].forEach((metric) => {
       let isCategorized = false;
       for (const metricNames of Object.values(categories)) {
         if (metricNames.includes(metric.name)) {
@@ -179,34 +221,35 @@ function renderMetricGroups(groups) {
       }
     });
   }
-  
+
   if (otherMetrics.length > 0) {
     categories["Other Metrics"] = [];
   }
-  
+
   // Create navbar items
   for (const categoryName in categories) {
     // Create navbar item
     const navItem = document.createElement("div");
     navItem.classList.add("metrics-nav-item");
     navItem.textContent = categoryName;
-    
+
     if (categoryName === activeCategory) {
-      navItem.classList.add('active');
+      navItem.classList.add("active");
     }
-    
-    navItem.addEventListener('click', () => {
+
+    navItem.addEventListener("click", () => {
       showCategory(categoryName);
     });
-    
+
     navbar.appendChild(navItem);
-    
+
     // Create section container for this category
     const categoryContainer = document.createElement("div");
     categoryContainer.classList.add("metrics-category");
-    categoryContainer.style.display = categoryName === activeCategory ? "block" : "none";
+    categoryContainer.style.display =
+      categoryName === activeCategory ? "block" : "none";
     categoryContainers[categoryName] = categoryContainer;
-    
+
     // Build the category's content
     if (categoryName === "Other Metrics") {
       otherMetrics.forEach(({ metric, type }) => {
@@ -217,14 +260,14 @@ function renderMetricGroups(groups) {
       let hasMetrics = false;
       for (const metricName of categories[categoryName]) {
         if (!metricsIndex[metricName]) continue;
-        
+
         hasMetrics = true;
         const { metric, type } = metricsIndex[metricName];
-        
+
         const metricContainer = createMetricDisplay(metric, type, categoryName);
         categoryContainer.appendChild(metricContainer);
       }
-      
+
       if (!hasMetrics) {
         const noDataMsg = document.createElement("div");
         noDataMsg.textContent = "No data available for this category";
@@ -233,34 +276,37 @@ function renderMetricGroups(groups) {
         categoryContainer.appendChild(noDataMsg);
       }
     }
-    
+
     metricsContent.appendChild(categoryContainer);
   }
-  
+
   // Add navbar and content to container
   container.appendChild(navbar);
   container.appendChild(metricsContent);
-  
+
   // Helper function to create metric display
   function createMetricDisplay(metric, type, categoryName) {
     const metricContainer = document.createElement("div");
     metricContainer.classList.add("metric-container");
-    
+
     // Skip the metric header for the AO Events section
     if (!(categoryName === "AO Events" && metric.name === "event")) {
       const subheader = document.createElement("div");
       subheader.classList.add("metrics-section-lines-header");
       subheader.classList.add("section-lines-header");
-      
+
       const metricTitle = document.createElement("p");
       metricTitle.textContent = metric.name + " (" + type + ")";
       subheader.appendChild(metricTitle);
-      
+
       metricContainer.appendChild(subheader);
     }
-    
+
     // Add help text if available
-    if (metric.help && !(categoryName === "AO Events" && metric.name === "event")) {
+    if (
+      metric.help &&
+      !(categoryName === "AO Events" && metric.name === "event")
+    ) {
       const helpDiv = document.createElement("div");
       helpDiv.classList.add("section-line");
       helpDiv.style.fontStyle = "italic";
@@ -269,15 +315,15 @@ function renderMetricGroups(groups) {
       helpDiv.textContent = metric.help;
       metricContainer.appendChild(helpDiv);
     }
-    
+
     const metricBody = document.createElement("div");
     metricBody.classList.add("section-lines");
-    
+
     // Special handling for event metrics - group by topic
     if (metric.name === "event") {
       const eventsByTopic = {};
-      
-      metric.values.forEach(value => {
+
+      metric.values.forEach((value) => {
         const match = value.label.match(/topic="([^"]+)"/);
         if (match) {
           const topic = match[1];
@@ -287,27 +333,27 @@ function renderMetricGroups(groups) {
           eventsByTopic[topic].push(value);
         }
       });
-      
+
       for (const [topic, events] of Object.entries(eventsByTopic)) {
         const topicHeader = document.createElement("div");
         topicHeader.classList.add("section-line");
         topicHeader.style.fontWeight = "bold";
         topicHeader.textContent = `Topic: ${topic}`;
         metricBody.appendChild(topicHeader);
-        
-        events.forEach(event => {
+
+        events.forEach((event) => {
           const eventMatch = event.label.match(/event="([^"]+)"/);
           if (eventMatch) {
             const eventLine = document.createElement("div");
             eventLine.classList.add("section-line");
-            
+
             const eventName = document.createElement("p");
             eventName.textContent = eventMatch[1];
             eventName.style.paddingLeft = "20px";
-            
+
             const eventValue = document.createElement("p");
             eventValue.textContent = formatDisplayAmount(event.data);
-            
+
             eventLine.appendChild(eventName);
             eventLine.appendChild(eventValue);
             metricBody.appendChild(eventLine);
@@ -319,37 +365,44 @@ function renderMetricGroups(groups) {
       const sortedValues = [...metric.values].sort((a, b) => {
         return a.label.localeCompare(b.label);
       });
-      
+
       // Handle histogram metrics - group by method
-      if (metric.name.includes('duration_seconds') && metric.name.includes('bucket')) {
+      if (
+        metric.name.includes("duration_seconds") &&
+        metric.name.includes("bucket")
+      ) {
         const valuesByMethod = {};
-        
-        sortedValues.forEach(value => {
+
+        sortedValues.forEach((value) => {
           const methodMatch = value.label.match(/method="([^"]+)"/);
-          const method = methodMatch ? methodMatch[1] : 'unknown';
-          
+          const method = methodMatch ? methodMatch[1] : "unknown";
+
           if (!valuesByMethod[method]) {
             valuesByMethod[method] = [];
           }
           valuesByMethod[method].push(value);
         });
-        
+
         for (const method in valuesByMethod) {
           const methodHeader = document.createElement("div");
           methodHeader.classList.add("section-line");
           methodHeader.style.fontWeight = "bold";
           methodHeader.textContent = `Method: ${method}`;
           metricBody.appendChild(methodHeader);
-          
+
           // Only show summary stats for histograms to avoid clutter
-          const count = valuesByMethod[method].find(v => v.label.includes('count'))?.data || 0;
-          const sum = valuesByMethod[method].find(v => v.label.includes('sum'))?.data || 0;
+          const count =
+            valuesByMethod[method].find((v) => v.label.includes("count"))
+              ?.data || 0;
+          const sum =
+            valuesByMethod[method].find((v) => v.label.includes("sum"))?.data ||
+            0;
           const avg = count > 0 ? sum / count : 0;
-          
+
           const statsLine = document.createElement("div");
           statsLine.classList.add("section-line");
           statsLine.style.paddingLeft = "20px";
-          
+
           statsLine.innerHTML = `
             <p>Count: ${formatDisplayAmount(count)}</p>
             <p>Sum: ${formatDisplayAmount(sum)}</p>
@@ -359,23 +412,24 @@ function renderMetricGroups(groups) {
         }
       } else {
         // Group HTTP metrics by method if they contain method in their labels
-        if (categoryName === "HTTP & Requests" && 
-            (metric.name.includes('cowboy') || metric.name.includes('http')) && 
-            sortedValues.some(v => v.label.includes('method='))) {
-          
+        if (
+          categoryName === "HTTP & Requests" &&
+          (metric.name.includes("cowboy") || metric.name.includes("http")) &&
+          sortedValues.some((v) => v.label.includes("method="))
+        ) {
           // Group values by HTTP method
           const valuesByMethod = {};
-          
-          sortedValues.forEach(value => {
+
+          sortedValues.forEach((value) => {
             const methodMatch = value.label.match(/method="([^"]+)"/);
-            const method = methodMatch ? methodMatch[1] : 'unknown';
-            
+            const method = methodMatch ? methodMatch[1] : "unknown";
+
             if (!valuesByMethod[method]) {
               valuesByMethod[method] = [];
             }
             valuesByMethod[method].push(value);
           });
-          
+
           // Display metrics grouped by method
           for (const [method, values] of Object.entries(valuesByMethod)) {
             const methodHeader = document.createElement("div");
@@ -384,36 +438,39 @@ function renderMetricGroups(groups) {
             methodHeader.style.backgroundColor = "#f0f0f0";
             methodHeader.textContent = `Method: ${method}`;
             metricBody.appendChild(methodHeader);
-            
-            values.forEach(valueMap => {
+
+            values.forEach((valueMap) => {
               const metricLine = document.createElement("div");
               metricLine.classList.add("section-line");
               metricLine.style.paddingLeft = "20px";
-              
+
               const labelEl = document.createElement("p");
               // Extract just the reason and status for cleaner display
               let displayLabel = "(default)";
-              
+
               const reasonMatch = valueMap.label.match(/reason="([^"]+)"/);
-              const statusMatch = valueMap.label.match(/status_class="([^"]+)"/);
+              const statusMatch = valueMap.label.match(
+                /status_class="([^"]+)"/
+              );
               const errorMatch = valueMap.label.match(/error="([^"]+)"/);
-              
+
               if (reasonMatch || statusMatch) {
                 displayLabel = [];
                 if (reasonMatch) displayLabel.push(`reason: ${reasonMatch[1]}`);
                 if (statusMatch) displayLabel.push(`status: ${statusMatch[1]}`);
                 if (errorMatch) displayLabel.push(`error: ${errorMatch[1]}`);
-                displayLabel = displayLabel.join(', ');
+                displayLabel = displayLabel.join(", ");
               } else {
-                displayLabel = valueMap.label.replace(/method="[^"]+",\s*/, '');
-                displayLabel = displayLabel === metric.name ? "(default)" : displayLabel;
+                displayLabel = valueMap.label.replace(/method="[^"]+",\s*/, "");
+                displayLabel =
+                  displayLabel === metric.name ? "(default)" : displayLabel;
               }
-              
+
               labelEl.textContent = displayLabel;
-              
+
               const valueEl = document.createElement("p");
               valueEl.textContent = formatDisplayAmount(valueMap.data);
-              
+
               metricLine.appendChild(labelEl);
               metricLine.appendChild(valueEl);
               metricBody.appendChild(metricLine);
@@ -422,9 +479,11 @@ function renderMetricGroups(groups) {
         } else {
           // Limit number of displayed values if too many
           const maxValues = 15;
-          const valuesToShow = sortedValues.length > maxValues ? 
-            sortedValues.slice(0, maxValues) : sortedValues;
-          
+          const valuesToShow =
+            sortedValues.length > maxValues
+              ? sortedValues.slice(0, maxValues)
+              : sortedValues;
+
           if (sortedValues.length > maxValues) {
             const noticeDiv = document.createElement("div");
             noticeDiv.classList.add("section-line");
@@ -432,21 +491,23 @@ function renderMetricGroups(groups) {
             noticeDiv.textContent = `Showing ${maxValues} of ${sortedValues.length} values`;
             metricBody.appendChild(noticeDiv);
           }
-          
+
           // Default rendering for non-HTTP metrics or metrics without method labels
-          valuesToShow.forEach(valueMap => {
+          valuesToShow.forEach((valueMap) => {
             const metricLine = document.createElement("div");
             metricLine.classList.add("section-line");
-            
+
             const labelEl = document.createElement("p");
             // For better readability, format complex labels
-            const displayLabel = valueMap.label === metric.name ? 
-              "(default)" : valueMap.label.replace(/,/g, ', ');
+            const displayLabel =
+              valueMap.label === metric.name
+                ? "(default)"
+                : valueMap.label.replace(/,/g, ", ");
             labelEl.textContent = displayLabel;
-            
+
             const valueEl = document.createElement("p");
             valueEl.textContent = formatDisplayAmount(valueMap.data);
-            
+
             metricLine.appendChild(labelEl);
             metricLine.appendChild(valueEl);
             metricBody.appendChild(metricLine);
@@ -464,7 +525,7 @@ function renderMetricGroups(groups) {
       metricLine.appendChild(metricValueData);
       metricBody.appendChild(metricLine);
     }
-    
+
     metricContainer.appendChild(metricBody);
     return metricContainer;
   }
@@ -498,9 +559,7 @@ function startUpdatingUptime() {
     const elapsedSeconds = (Date.now() - startTime) / 1000;
     const currentUptime = initialUptime + elapsedSeconds;
 
-    uptimeElement.innerHTML = formatDisplayAmount(
-      currentUptime.toFixed(2)
-    );
+    uptimeElement.innerHTML = formatDisplayAmount(currentUptime.toFixed(2));
     requestAnimationFrame(updateUptime);
   }
 
@@ -512,10 +571,10 @@ function startUpdatingUptime() {
  */
 async function startFetchingMetrics() {
   await fetchMetrics();
-  
+
   // Initialize metrics display
-  if (!localStorage.getItem('activeMetricsCategory')) {
-    localStorage.setItem('activeMetricsCategory', 'AO Events');
+  if (!localStorage.getItem("activeMetricsCategory")) {
+    localStorage.setItem("activeMetricsCategory", "AO Events");
   }
 
   setInterval(fetchMetrics, 50000);
@@ -527,5 +586,5 @@ export {
   renderMetricGroups,
   fetchMetrics,
   startUpdatingUptime,
-  startFetchingMetrics
-}; 
\ No newline at end of file
+  startFetchingMetrics,
+};
diff --git a/src/html/hyperbuddy@1.0/styles.css b/src/html/hyperbuddy@1.0/styles.css
index 042523c89..737560607 100644
--- a/src/html/hyperbuddy@1.0/styles.css
+++ b/src/html/hyperbuddy@1.0/styles.css
@@ -1,37 +1,59 @@
 :root {
-	--bg-color: #ffffff;
-	--border-color: #d3d3d3;
-	--section-bg-color-primary: #f8faf8;
+	--bg-color: #fcfcfc;
+	--section-bg-color-primary: #fff;
 	--section-bg-color-alt1: #ffffff;
+	--section-bg-color-alt2: #ffffffbf;
+	--section-bg-color-alt3: #ffffffee;
+	--section-bg-color-accent: #f8faf8f5;
+	--border-color: #eaeaea;
+	--active-action-bg: #EDEDED;
 	--text-color-primary: #000000;
-	--text-color-alt1: #b6b9b5;
-	--link-color: #1a73e8;
-	--link-hover-color: #0c47a1;
-	--active-action-bg: #f8f8f8;
-	--indicator-color: #27d735;
-	--indicator-color-active: #23be30;
-	--card-bg-color: #ffffff;
-	--card-border-color: #e0e0e0;
-	--card-shadow: 0 2px 5px rgba(0, 0, 0, 0.1);
-	--card-hover-shadow: 0 4px 2px rgba(0, 0, 0, 0.1);
-	--icon-bg-colors: #4285F4, #EA4335, #FBBC05, #34A853, #673AB7, #FF9800, #03A9F4, #E91E63;
+	--text-color-alt1: #646464;
+	--text-color-light: #FFFFFF;
+	--accent-color: #e9ffc5;
+	--link-color: #1A73E8;
+	--link-hover-color: #0C47A1;
+	--pulse-color: #17a923;
+	--pulse-color-active: #17a923;
+    --indicator-color: #f17100;
+	--indicator-color-active: #f17100;
+	--border-radius: 7.5px;
+}
+
+@keyframes rotateInfinite {
+	from {
+		transform: rotate(0deg);
+	}
+
+	to {
+		transform: rotate(360deg);
+	}
+}
+
+@keyframes pulse {
+	0%,
+	100% {
+		background: var(--pulse-color);
+		transform: scale(1);
+	}
+
+	50% {
+		background: var(--pulse-color-active);
+		transform: scale(1.15);
+	}
 }
 
 * {
-	box-sizing: border-box;
+    box-sizing: border-box;
 }
 
 body {
+	padding: 0;
+	margin: 0;
 	font-family: system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI",
 		Roboto, Oxygen, Ubuntu, Cantarell, "Open Sans", "Helvetica Neue",
 		sans-serif;
 	font-family: "Open Sans", sans-serif;
-	display: flex;
-	flex-direction: column;
-	gap: 40px;
-	padding: 40px;
-	max-width: 1460px;
-	margin: 0 auto;
 	background: var(--bg-color);
 	color: var(--text-color-primary);
 }
@@ -46,159 +68,141 @@ p,
 ul,
 li,
 span {
-	margin: 0;
-	color: var(--text-color-primary);
+    margin: 0;
+    color: var(--text-color-primary);
 }
 
 button {
-	appearance: none;
-	outline: none;
-	border: none;
-	background: none;
-	padding: 0;
-	margin: 0;
-	transition: all 100ms;
-	font-family: system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI",
-		Roboto, Oxygen, Ubuntu, Cantarell, "Open Sans", "Helvetica Neue",
-		sans-serif;
-	font-family: "Open Sans", sans-serif;
+    appearance: none;
+    outline: none;
+    border: none;
+    background: none;
+    padding: 0;
+    margin: 0;
+    transition: all 100ms;
+    font-family: system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI",
+        Roboto, Oxygen, Ubuntu, Cantarell, "Open Sans", "Helvetica Neue",
+        sans-serif;
+    font-family: "Open Sans", sans-serif;
 }
 
 h1 {
-	font-size: clamp(24px, 2.75vw, 32px);
-	font-weight: 600;
-	letter-spacing: 0.5px;
-	color: var(--text-color-primary);
+    font-size: clamp(24px, 2.75vw, 32px);
+    font-weight: 600;
+    letter-spacing: 0.5px;
+    color: var(--text-color-primary);
 }
 
 ul {
-	list-style: none;
-	padding: 0;
+    list-style: none;
+    padding: 0;
 }
 
 a {
-	text-decoration: none;
-	color: var(--link-color);
-	font-size: 14px;
+    text-decoration: none;
+    color: var(--link-color);
+    font-size: 14px;
 }
 
 a:hover {
-	text-decoration: underline;
-	text-decoration-thickness: 1.5px;
-	color: var(--link-hover-color);
+    text-decoration: underline;
+    text-decoration-thickness: 1.5px;
+    color: var(--link-hover-color);
 }
 
-/* Add styles for collapsible sections */
 .collapsible-header {
-	cursor: pointer;
-	display: flex;
-	align-items: center;
-	justify-content: space-between;
+    cursor: pointer;
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
 }
 
 .collapsible-header:hover {
-	background-color: var(--section-bg-color-alt1);
+    background-color: var(--section-bg-color-alt1);
 }
 
 .collapsible-header .header-text {
-	flex: 1;
+    flex: 1;
 }
 
 .collapse-icon {
-	font-size: 20px;
-	margin-right: 8px;
-	transition: transform 0.3s ease;
+    font-size: 20px;
+    margin-right: 8px;
+    transition: transform 0.3s ease;
 }
 
 .collapsed .collapse-icon {
-	transform: rotate(-90deg);
+    transform: rotate(-90deg);
 }
 
 .collapsible-content {
-	max-height: 2000px;
-	overflow: hidden;
-	transition: max-height 0.5s ease-in-out;
+    max-height: 2000px;
+    overflow: hidden;
+    transition: max-height 0.5s ease-in-out;
 }
 
 .collapsed .collapsible-content {
-	max-height: 0;
+    max-height: 0;
 }
 
 .video-container {
 	display: flex;
 	align-items: center;
-	height: 175px;
+	height: 190px;
 }
 
-.header-hyperbeam-chain {
-	position: absolute;
-	right: 0;
-	z-index: 1;
-	opacity: 30%;
-}
-
-@keyframes rotateInfinite {
-	from {
-		transform: rotate(0deg);
-	}
+header {
+	position: fixed;
+	top: 0;
+	background-color: var(--section-bg-color-alt1);
+	width: 100%;
+	border-bottom: 1px solid var(--border-color);
+	box-shadow: 0px 2px 2px 0px rgba(0, 0, 0, 0.03);
 
-	to {
-		transform: rotate(360deg);
-	}
+	z-index: 20;
 }
 
-.header {
-	position: relative;
+footer {
+	position: fixed;
+	bottom: 0;
+	background-color: var(--section-bg-color-alt1);
+	width: 100%;
+	border-top: 1px solid var(--border-color);
+	z-index: 20;
 }
 
-.header-inner {
+.footer-inner {
 	width: 100%;
-	position: relative;
 	display: flex;
-	align-items: center;
+	align-items: flex-end;
 	justify-content: space-between;
 	overflow: hidden;
-	flex-wrap: wrap;
 	gap: 10px;
-	padding: 0px 40px 0px 0px;
-	border: 1px solid var(--border-color);
-	border-radius: 5px;
-}
-
-.header-logo {
-	height: 100%;
-	position: absolute;
-	left: -64.5px;
+	padding: 8px 24px;
 }
 
-.header-main {
+.header-inner {
+	width: 100%;
+	max-width: 2000px;
+	padding: 15px 40px;
+	margin: 0 auto;
 	display: flex;
-	flex-direction: column;
-	gap: 7.5px;
-	overflow: hidden;
+	align-items: center;
+	justify-content: space-between;
 }
 
-.header-left {
+.logo {
 	display: flex;
 	align-items: center;
-	margin-left: -100px;
-	z-index: 2;
+	height: 25px;
 }
 
-@media (max-width: 765px) {
-	.header-left {
-		flex-direction: column;
-		align-items: start;
-	}
-}
-
-.header-left svg {
-	width: 100%;
-	height: auto;
-	display: block;
+.logo p {
+	font-size: clamp(0.65rem, 1.75vw, 0.7rem);
+	color: var(--text-color-alt1)
 }
 
-.header-logo img {
+.logo img {
 	height: 100%;
 }
 
@@ -206,39 +210,37 @@ a:hover {
 	display: flex;
 	flex-direction: column;
 	gap: 15px;
-	align-items: flex-end;
-	justify-content: flex-end;
-	margin-right: 80px;
+	align-items: flex-start;
 	z-index: 2;
 }
 
 .subheader-value {
-	display: flex;
-	align-items: center;
-	gap: 7.5px;
+    display: flex;
+    align-items: center;
+    gap: 7.5px;
 }
 
 .subheader-value p {
-	font-size: clamp(0.7rem, 1.75vw, 0.85rem);
+	font-size: clamp(0.65rem, 1.75vw, 0.75rem);
 	font-weight: 400;
 	color: var(--text-color-alt1);
 }
 
 .subheader-indicator-wrapper {
-	display: flex;
-	align-items: center;
-	gap: 7.5px;
+    display: flex;
+    align-items: center;
+    gap: 7.5px;
 }
 
 .subheader-indicator-wrapper p {
-	color: var(--text-color-primary);
-	font-weight: 600;
+    color: var(--text-color-primary);
+    font-weight: 600;
 }
 
 .subheader-indicator {
-	height: 13.5px;
-	width: 13.5px;
-	background: var(--indicator-color);
+	height: 8px;
+	width: 8px;
+	background: var(--pulse-color);
 	border-radius: 50%;
 	animation: pulse 1.075s infinite;
 }
@@ -246,7 +248,7 @@ a:hover {
 .subheader-value button {
 	letter-spacing: 0.5px;
 	padding: 0;
-	font-size: clamp(0.7rem, 1.5vw, 0.85rem);
+	font-size: clamp(0.7rem, 1.5vw, 0.75rem);
 	font-weight: 600;
 	color: var(--text-color-primary);
 	text-decoration: underline;
@@ -254,87 +256,91 @@ a:hover {
 }
 
 .subheader-value button:hover {
-	cursor: pointer;
-	color: var(--text-color-alt1);
+    cursor: pointer;
+    color: var(--text-color-alt1);
 }
 
 .subheader-value button:disabled {
-	cursor: default;
-	color: var(--text-color-alt1);
+    cursor: default;
+    color: var(--text-color-alt1);
 }
 
 .section-groups {
+	position: relative;
 	width: 100%;
 	display: flex;
 	flex-direction: column;
 	gap: 20px;
 }
 
+.section-group,
+.tabs-wrapper {
+	z-index: 10;
+}
+
 .section-group {
-	width: 100%;
-	display: flex;
-	flex-wrap: wrap;
-	gap: 20px;
+    width: 100%;
+    display: flex;
+    flex-wrap: wrap;
+    gap: 20px;
 }
 
 .section {
 	height: fit-content;
 	flex: 1;
-	/* border: 1px solid var(--border-color); */
-	border-radius: 5px;
-	background: var(--section-bg-color-primary);
-	border: 1px solid var(--border-color)
+	border-radius: var(--border-radius);
+	background: var(--section-bg-color-alt3);
+	border: 1px solid var(--border-color);
+	box-shadow: 0px 4px 4px 0px rgba(0, 0, 0, 0.02);
+	gap: 48px;
+	padding: 12px;
 }
 
 .section-header {
-	font-size: clamp(0.7rem, 1.75vw, 0.85rem);
-	font-weight: 500;
-	padding: 15px;
-	border-bottom: 1px solid var(--border-color);
-	color: var(--text-color-primary);
+    font-size: clamp(0.7rem, 1.75vw, 0.85rem);
+    font-weight: 500;
+    padding: 15px;
+    border-bottom: 1px solid var(--border-color);
+    color: var(--text-color-primary);
 }
 
 .key-metric-wrapper {
-	display: flex;
-	flex-direction: column;
-	gap: 7.5px;
-	padding: 5px 15px 15px 15px;
+    display: flex;
+    flex-direction: column;
+    gap: 7.5px;
+    padding: 5px 15px 15px 15px;
 }
 
 .key-metric-header {
-	border-bottom: none;
+    border-bottom: none;
 }
 
 .key-metric-value {
-	font-size: clamp(1.0rem, 2.75vw, 1.8rem);
+	font-size: clamp(1rem, 2.75vw, 1.8rem);
 	font-weight: 400;
-	color: var(--indicator-color);
+
 }
 
 .key-metric-label {
-	font-size: clamp(0.6rem, 1.5vw, 0.75rem);
-	font-weight: 400;
-	color: var(--text-color-alt1);
-	text-transform: uppercase;
+    font-size: clamp(0.6rem, 1.5vw, 0.75rem);
+    font-weight: 400;
+    color: var(--text-color-alt1);
+    text-transform: uppercase;
 }
 
 .metrics-section-header {
-	border-bottom: none;
+    border-bottom: none;
 }
 
 .section-lines-header {
-	height: 35px;
-	width: 100%;
-	display: flex;
-	align-items: center;
-	justify-content: space-between;
-	padding: 0 15px;
-	border-bottom: 1px solid var(--border-color);
-	background: var(--section-bg-color-alt1);
-}
-
-.metrics-section-lines-header {
-	/* border-top: 1px solid var(--border-color); */
+    height: 35px;
+    width: 100%;
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    padding: 0 15px;
+    border-bottom: 1px solid var(--border-color);
+    background: var(--section-bg-color-alt1);
 }
 
 .section-lines-header p {
@@ -342,46 +348,51 @@ a:hover {
 	font-weight: 500;
 	color: var(--text-color-alt1);
 	max-width: 100%;
-	transparent-space: nowrap;
 	overflow: hidden;
 	text-overflow: ellipsis;
 }
 
 .section-lines {
-	width: 100%;
-	display: flex;
-	flex-direction: column;
+    width: 100%;
+    display: flex;
+    flex-direction: column;
 }
 
 .section-line {
-	height: 35px;
-	width: 100%;
-	display: flex;
-	align-items: center;
-	justify-content: space-between;
-	padding: 0 15px;
-	border-bottom: 1px solid var(--border-color);
+    height: 35px;
+    width: 100%;
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    padding: 0 15px;
+    border-bottom: 1px solid var(--border-color);
+	font-size: 14px;
 }
 
 .info-line:nth-child(even) {
-	background: var(--section-bg-color-primary);
+    background: var(--section-bg-color-primary);
 }
 
 .info-line:nth-child(odd) {
-	background: var(--bg-color);
+    background: var(--bg-color);
+}
+
+.loading-info-line p {
+    font-size: 14px;
+    font-weight: 500;
+	padding: 0 10px 10px 5px;
 }
 
 .section-line:last-child {
 	border-bottom: none;
-	border-bottom-left-radius: 5px;
-	border-bottom-right-radius: 5px;
+	border-bottom-left-radius: var(--border-radius);
+	border-bottom-right-radius: var(--border-radius);
 }
 
 .section-line p {
 	font-size: clamp(13px, 1.75vw, 14px);
 	font-weight: 500;
 	max-width: 60%;
-	transparent-space: nowrap;
 	overflow: hidden;
 	text-overflow: ellipsis;
 }
@@ -390,18 +401,63 @@ a:hover {
 	width: 100%;
 	display: flex;
 	flex-direction: column;
-
 }
 
 #console-section {
-	padding: 10px 20px 10px 10px;
-	border: 0.5px solid var(--border-color);
+	border-right: 1px solid var(--border-color);
+	border-left: 1px solid var(--border-color);
+	border-bottom: 1px solid var(--border-color);
+	border-bottom-right-radius: var(--border-radius);
+	border-bottom-left-radius: var(--border-radius);
+}
+
+#ledger-section {
+    padding: 15px 30px;
+    background: var(--section-bg-color-primary);
+	border-right: 1px solid var(--border-color);
+	border-left: 1px solid var(--border-color);
+	border-bottom: 1px solid var(--border-color);
+	border-bottom-right-radius: var(--border-radius);
+	border-bottom-left-radius: var(--border-radius);
+}
+
+.json-type-label {
+    font-size: clamp(13px, 1.75vw, 14px);
+	font-weight: 500;
+    color: var(--text-color-primary);
+    display: block;
+    margin: 0 0 5px 0;
+}
+
+.json-key {
+    font-size: clamp(13px, 1.75vw, 14px);
+	font-weight: 500;
+    color: var(--text-color-alt1);
+}
+
+.json-separator {
+    font-size: clamp(13px, 1.75vw, 14px);
+	font-weight: 500;
+    color: var(--text-color-alt1);
+}
+
+.json-string {
+    font-size: clamp(13px, 1.75vw, 14px);
+	font-weight: 600;
+    color: var(--text-color-primary);
+}
+
+.json-number {
+    font-size: clamp(13px, 1.75vw, 14px);
+	font-weight: 600;
+    color: var(--text-color-primary);
 }
 
 .tabs-wrapper {
 	display: flex;
 	flex-direction: column;
-	border-radius: 5px;
+	border-radius: var(--border-radius);
+	box-shadow: 0px 4px 4px 0px rgba(0, 0, 0, 0.02);
 }
 
 .tabs {
@@ -409,88 +465,63 @@ a:hover {
 	display: flex;
 	gap: 10px;
 	padding: 10px 10px 5px 10px;
-	border-left: 1px solid var(--border-color);
-	border-right: 1px solid var(--border-color);
-	border-top: 1px solid var(--border-color);
 	background: var(--section-bg-color-alt1);
-	border-top-right-radius: 5px;
-	border-top-left-radius: 5px;
+	border: 1px solid var(--border-color);
+	border-top-right-radius: var(--border-radius);
+	border-top-left-radius: var(--border-radius);
 }
 
 .tab-button {
-	font-size: clamp(0.75rem, 1.75vw, 0.9rem);
-	font-weight: 500;
-	color: var(--text-color-alt1);
-	cursor: pointer;
-	position: relative;
-	padding: 10px 20px 10px 20px;
+    font-size: clamp(0.75rem, 1.75vw, 0.9rem);
+    font-weight: 500;
+    color: var(--text-color-alt1);
+    cursor: pointer;
+    position: relative;
+    padding: 10px 20px 10px 20px;
 }
 
 .tab-button.active {
-	color: var(--text-color-primary);
+    color: var(--text-color-primary);
 }
 
 .tab-button.active::after {
 	width: 100%;
 	content: "";
 	background: var(--indicator-color);
-	height: 2px;
+	height: 2.5px;
 	display: block;
 	position: absolute;
 	bottom: -6px;
 	left: 0;
 }
 
-.tab-button:hover {
-	color: var(--text-color-primary);
+.hyperstate-tab-button.active::after {
+	background: var(--indicator-color);
 }
 
-.tab-content {
-	display: none;
+.dashboard-tab-button.active::after {
+	background: var(--indicator-color-active);
 }
 
-.tab-content.active {
-	display: block;
+.tab-button:hover {
+    color: var(--text-color-primary);
 }
 
-@keyframes pulse {
-
-	0%,
-	100% {
-		background: var(--indicator-color);
-		transform: scale(1);
-	}
-
-	50% {
-		background: var(--indicator-color-active);
-		transform: scale(1.15);
-	}
+.tab-content {
+    display: none;
 }
 
+.tab-content.active {
+    display: block;
+}
 
 @media (max-width: 1024px) {
-	.header-hyperbeam-chain {
-		width: 300px;
-		margin-top: -50px;
-	}
-
 	.header-inner {
-		position: relative;
-		flex-direction: column;
-		align-items: flex-start;
-		gap: 40px;
-		overflow: hidden;
-		padding: 30px;
+		padding: 15px 10px !important;
 	}
-
-	.subheader {
-		align-items: flex-start;
-		z-index: 2;
-	}
-
-	.subheader-value {
-		flex-direction: column;
-		align-items: flex-start;
+	
+    .view-wrapper {
+		padding: 55px 10px 80px 10px !important;;
 	}
 
 	.section-group {
@@ -499,47 +530,15 @@ a:hover {
 
 	.tab-content .device-cards-container {
 		grid-template-columns: repeat(1, 1fr);
-
-	}
-
-	/* 
-  .section-line {
-	height: fit-content;
-	flex-direction: column;
-	align-items: flex-start;
-	gap: 10px;
-	padding: 15px;
-  } */
-}
-
-@media (max-width: 800px) {
-	.header-inner {
-		padding: 20px;
-	}
-
-	.header-left .light-video {
-		width: 400px;
-	}
-
-	.header-left {
-		margin-left: -70px;
 	}
 
-
-}
-
-
-@media (max-width: 500px) {
-	.header-inner {
-		padding: 20px;
+	.section-group {
+		flex-direction: column;
 	}
 
-	.header-left .light-video {
-		width: 300px;
-	}
+	.tab-content .device-cards-container {
+		grid-template-columns: repeat(1, 1fr);
 
-	.header-left {
-		margin-left: -50px;
 	}
 }
 
@@ -547,143 +546,476 @@ a:hover {
 .device-cards-container {
 	display: grid;
 	grid-template-columns: repeat(2, 1fr);
-	/* 2 columns */
 	gap: 10px;
 	padding: 20px 10px 10px 10px;
-	border: 1px solid var(--border-color);
-	border-radius: 0px 0px 5px 5px;
+	border-right: 1px solid var(--border-color);
+	border-left: 1px solid var(--border-color);
+	border-bottom: 1px solid var(--border-color);
+	border-radius: 0px 0px var(--border-radius) var(--border-radius);
 }
 
 .device-card {
 	background: var(--section-bg-color-alt1);
 	display: flex;
-	border-radius: 5px;
+	border-radius: var(--border-radius);
 	flex-direction: row;
 	justify-content: space-between;
 	align-items: center;
 	margin-bottom: 5px;
-	border: 0.5px solid var(--border-color);
+	border: 1px solid var(--border-color);
 	padding: 10px;
 	width: 100%;
 }
 
 .device-name {
-	font-size: clamp(0.6rem, 1.75vw, 0.9rem);
-	font-weight: 500;
-	color: var(--text-color-primary);
-	white-space: nowrap;
-	overflow: hidden;
-	text-overflow: ellipsis;
-	margin-right: 10px;
+    font-size: clamp(0.6rem, 1.75vw, 0.9rem);
+    font-weight: 500;
+    color: var(--text-color-primary);
+    white-space: nowrap;
+    overflow: hidden;
+    text-overflow: ellipsis;
+    margin-right: 10px;
 }
 
 .device-variant {
-	font-size: clamp(0.8rem, 2.25vw, 0.9rem);
-	font-weight: 600;
-	white-space: nowrap;
+    font-size: clamp(0.8rem, 2.25vw, 0.9rem);
+    font-weight: 600;
+    white-space: nowrap;
 }
 
 .device-variant-high {
-	font-size: clamp(10px, 1.75vw, 15px);
-	color: var(--indicator-color);
+    font-size: clamp(10px, 1.75vw, 15px);
+    color: var(--indicator-color);
 }
 
 .device-variant-medium {
 	color: #ff9800;
-	/* Orange */
 }
 
 .device-variant-low {
 	color: #f44336;
-	/* Red */
 }
 
 .device-label {
-	font-size: clamp(12px, 1.5vw, 13px);
-	font-weight: 400;
-	color: var(--text-color-alt1);
-	text-transform: uppercase;
-	padding: 0 8px 8px 8px;
+    font-size: clamp(12px, 1.5vw, 13px);
+    font-weight: 400;
+    color: var(--text-color-alt1);
+    text-transform: uppercase;
+    padding: 0 8px 8px 8px;
 }
 
 #metrics-tab {
-	padding: 20px;
 	border: 1px solid (var(--border-color));
 }
 
-/* Metrics navbar styles */
 .metrics-navbar {
 	display: flex;
-	flex-wrap: wrap;
-	gap: 5px;
-	padding: 10px 10px 0;
+	overflow-x: auto;
 }
 
 .metrics-nav-item {
+	flex: 1;
 	padding: 10px 15px;
 	cursor: pointer;
-	border-radius: 5px 5px 0 0;
-	transition: background-color 0.2s;
 	background-color: var(--section-bg-color-alt2);
-	border: 1px solid var(--border-color);
-	border-bottom: none;
-	margin-bottom: -1px;
-	user-select: none;
+	border-left: 1px solid var(--border-color);
+	font-size: 14px;
+    white-space: nowrap;
+}
+
+.metrics-nav-item:last-child {
+	border-right: 1px solid var(--border-color);
 }
 
 .metrics-nav-item:hover {
-	background-color: var(--section-bg-color);
+	background: var(--active-action-bg);
 }
 
 .metrics-nav-item.active {
-	background-color: var(--bg-color-alt);
-	color: var(--text-color);
+	background: var(--active-action-bg);
+	color: var(--text-color-primary);
 	position: relative;
 	font-weight: 600;
 }
 
 .metrics-content {
-	background-color: var(--bg-color);
+    background-color: var(--bg-color);
+}
+
+.metrics-footer {
+	padding: 17.5px;
+	background-color: var(--section-bg-color-alt1);
+	border: 1px solid var(--border-color);
+	border-radius: 0 0 var(--border-radius) var(--border-radius);
+}
+
+.metrics-footer span {
+	color: var(--text-color-alt1);
+	font-size: 13px;
 }
 
 .metrics-category {
-	padding: 0;
-	background-color: var(--bg-color);
+    padding: 0;
+    background-color: var(--bg-color);
 }
 
 .metric-container {
-	margin-bottom: 20px;
-	border: 1px solid var(--border-color);
+	border-top: 1px solid var(--border-color);
+	border-left: 1px solid var(--border-color);
+	border-right: 1px solid var(--border-color);
 }
 
-/* Update existing metrics styles to work with the new layout */
 .section-lines-header {
 	border-bottom: 1px solid var(--border-color);
-	/* border-radius: 5px 5px 0 0; */
 }
 
-/* Graph visualization styles */
-.graph-link {
-	position: absolute;
-	z-index: 100;
-	top: -18px;
-	right: -18px;
+.init-loading-wrapper {
+	padding: 0 10px 7.5px 10px;
+}
+
+.init-loading-wrapper p {
+	color: var(--text-color-primary);
+	font-weight: 600;
+	font-size: 14px;
+}
+
+.border-wrapper-primary {
 	background: var(--section-bg-color-primary);
-	border-radius: 5px;
-	border: 0.5px solid var(--border-color);
-	height: 36px;
-	padding: 0px 12px;
-	font-size: clamp(0.6rem, 1.75vw, 0.9rem);
-    font-weight: 500;
-    color: var(--text-color-primary);
+	border: 1px solid var(--border-color);
+	border-radius: var(--border-radius);
+}
+
+.view-wrapper {
+	width: 100%;
+	max-width: 2000px;
+	padding: 55px 40px 80px 40px;
+	margin: 33.5px auto 0 auto;
+	display: flex;
+	flex-direction: column;
+	gap: 25px;
+}
+
+.explorer-view {
+	width: 100%;
+	display: flex;
+	flex-direction: column;
+	gap: 25px;
+}
+
+.explorer-view-flex {
+	position: relative;
+	width: 100%;
+	display: flex;
+	gap: 25px;
+}
+
+.bg-video {
+	position: absolute;
+	top: -240px;
+	left: -240px;
+
+	z-index: 5;
+}
+
+.signature-wrapper,
+.explorer-wrapper {
+	box-shadow: 0px 4px 4px 0px rgba(0, 0, 0, 0.04);
+	border-radius: var(--border-radius);
+
+}
+
+.signature-wrapper {
+	width: 100%;
+	display: flex;
+	flex-direction: column;
+	gap: 20px;
+	padding: 20px;
+}
+
+.signature-line {
 	display: flex;
 	align-items: center;
-	justify-content: center;
+	justify-content: space-between;
+	gap: 7.5px;
 }
 
-.graph-link:hover {
+.signature-line p {
+	font-size: 14px;
+	font-weight: 600;
+	color: var(--text-color-primary);
+	white-space: nowrap;
+	max-width: 50%;
+	overflow: hidden;
+	text-overflow: ellipsis;
+}
+
+.signature-line span {
+	font-size: 14px;
+	font-weight: 500;
+	color: var(--text-color-alt1);
+}
+
+.message-id-wrapper {
+	width: 100%;
+	display: flex;
+	padding: 0px 20px;
+	justify-content: end;
+	gap: 7.5px;
+	align-items: center;
+	z-index: 10;
+}
+
+.message-id-wrapper p {
+	font-size: 14px;
+	font-weight: 600;
+	color: var(--text-color-primary);
+	white-space: nowrap;
+	max-width: 50%;
+	overflow: hidden;
+	text-overflow: ellipsis;
+}
+
+.message-id-wrapper span {
+	font-size: 14px;
+	font-weight: 500;
+	color: var(--text-color-alt1);
+}
+
+.explorers-wrapper {
+	width: 45%;
+	display: flex;
+	flex-direction: column;
+	gap: 25px;
+	z-index: 10;
+}
+
+.explorer-wrapper {
+	width: 100%;
+}
+
+.visual-wrapper {
+	min-height: calc(600px + 56px);
+	width: 60%;
+	z-index: 10;
+}
+
+.visual-body {
+	min-height: calc(600px + 56px);
+	width: 100%;
+	background: var(--bg-color);
+}
+
+.visual-body iframe {
+	min-height: calc(600px + 56px);
+	width: 100%;
+	border: none;
+	border-bottom: 1px solid var(--border-color);
+	border-left: 1px solid var(--border-color);
+	border-right: 1px solid var(--border-color);
+	border-bottom-left-radius: var(--border-radius);
+	border-bottom-right-radius: var(--border-radius);
+}
+
+.explorer-header {
+	display: flex;
+	align-items: center;
+	gap: 6px;
+	width: 100%;
+	overflow: auto;
+	padding: 20px;
+	background: var(--section-bg-color-alt1);
+	border-top: 1px solid var(--border-color);
+	border-left: 1px solid var(--border-color);
+	border-right: 1px solid var(--border-color);
+	border-top-left-radius: var(--border-radius);
+	border-top-right-radius: var(--border-radius);
+}
+
+.explorer-footer {
+	width: 100%;
+	overflow: auto;
+	padding: 10px 15px;
 	background: var(--section-bg-color-alt1);
-	color: var(--indicator-color-active);
-	text-decoration: none;
+	border-bottom: 1px solid var(--border-color);
+	border-left: 1px solid var(--border-color);
+	border-right: 1px solid var(--border-color);
+	border-bottom-left-radius: var(--border-radius);
+	border-bottom-right-radius: var(--border-radius);
+}
+
+.explorer-header p {
+	font-weight: 600;
+	font-size: 15px;
+	color: var(--text-color-primary);
+}
 
+.explorer-footer p {
+	font-weight: 500;
+	font-size: 13px;
+	color: var(--text-color-alt1);
 }
+
+.explorer {
+	max-height: 450px;
+	width: 100%;
+	overflow: auto;
+	border-top: 1px solid var(--border-color);
+	border-left: 1px solid var(--border-color);
+	border-right: 1px solid var(--border-color);
+}
+
+.explorer-body {
+	width: 100%;
+	display: flex;
+	flex-direction: column;
+}
+
+.explorer-body-row-wrapper {
+	display: flex;
+	flex-direction: column;
+}
+
+.explorer-body-row {
+	height: 55px;
+	display: flex;
+	align-items: center;
+	gap: 7.5px;
+	background: var(--bg-color);
+	border-bottom: 1px solid var(--border-color);
+}
+
+.explorer-body-row-wrapper:nth-child(odd) .explorer-body-row {
+	background: var(--bg-color);
+}
+
+.explorer-body-row-wrapper:nth-child(even) .explorer-body-row {
+	background: var(--section-bg-color-alt1);
+}
+
+#explorer-body-row-loader {
+	padding: 0 15px;
+}
+
+.explorer-body-row-open {
+	background: var(--active-action-bg) !important;
+}
+
+.explorer-body-row-indicator {
+	transition: all 100ms;
+}
+
+.explorer-body-row-indicator::before {
+	content: "›";
+	font-size: 24px;
+	color: var(--indicator-color);
+	display: flex;
+	margin: -1.5px 2.5px 0 0;
+}
+
+.explorer-body-row-indicator-open {
+	transform: rotate(90deg);
+	margin: 5px 2.5px 0 0;
+}
+
+.explorer-body-row span {
+	font-size: 13px;
+	font-weight: 500;
+	color: var(--text-color-alt1);
+	white-space: nowrap;
+}
+
+.explorer-body-row p {
+	max-width: 80%;
+	font-size: 13px;
+	font-weight: 600;
+	color: var(--text-color-primary);
+	white-space: nowrap;
+	text-overflow: ellipsis;
+	display: block;
+	overflow: hidden;
+}
+
+.explorer-body-row-flag {
+	padding: 0.5px 7.5px;
+	background: var(--indicator-color);
+	border-radius: var(--border-radius);
+}
+
+.status-indicator {
+	padding: 0.5px 7.5px !important;
+	color: var(--text-color-light) !important;
+	font-size: 12px !important;
+	font-weight: 500 !important;
+	background: var(--pulse-color) !important;
+	border-radius: var(--border-radius) !important;
+}
+
+#metrics-tab {
+    border-bottom: 1px solid var(--border-color);
+	border-bottom-left-radius: var(--border-radius);
+	border-bottom-right-radius: var(--border-radius);
+    overflow: hidden;
+}
+
+#cache-section {
+    border-bottom: 1px solid var(--border-color);
+	border-left: 1px solid var(--border-color);
+	border-right: 1px solid var(--border-color);
+	border-bottom-left-radius: var(--border-radius);
+	border-bottom-right-radius: var(--border-radius);
+}
+
+.explorer-body-row-flag span {
+	color: var(--text-color-light);
+	font-size: 12px;
+	font-weight: 500;
+}
+
+.explorer-body-link-value {
+	text-decoration: underline;
+	text-decoration-color: var(--indicator-color);
+	text-decoration-thickness: 2px;
+}
+
+.tx-address {
+	text-decoration: underline !important;
+	text-decoration-color: var(--indicator-color) !important;
+	text-decoration-thickness: 1px !important;
+}
+
+.explorer-action {
+	width: 100%;
+}
+
+.explorer-action:hover {
+	cursor: pointer;
+	background: var(--active-action-bg) !important;
+}
+
+/* Graph visualization styles */
+.graph-link {
+	font-size: clamp(0.65rem, 1.75vw, 0.75rem);
+	color: var(--indicator-color-active)
+}
+
+.graph-link:hover {
+	opacity: 75%;
+
+}
+
+.copy-hover {
+	transition: opacity 0.1s ease;
+	cursor: pointer;
+
+}
+
+.copy-hover:hover {
+	opacity: 0.6;
+
+}
+
+.custom-tooltip {
+	transition: opacity 0.2s ease;
+	opacity: 0.95;
+	pointer-events: none;
+}
\ No newline at end of file
diff --git a/src/html/hyperbuddy@1.0/utils.js b/src/html/hyperbuddy@1.0/utils.js
index 02fee8c69..af9e35859 100644
--- a/src/html/hyperbuddy@1.0/utils.js
+++ b/src/html/hyperbuddy@1.0/utils.js
@@ -1,7 +1,7 @@
 /**
  * Base route for all API calls
  */
-const BASE_ROUTE = window.location.href;
+const BASE_ROUTE = window.location.origin;
 
 /**
  * Format an address for display, shortening it if needed
@@ -12,9 +12,7 @@ const BASE_ROUTE = window.location.href;
 function formatAddress(address, wrap) {
   if (!address) return "";
   const formattedAddress =
-    address.substring(0, 6) +
-    "..." +
-    address.substring(36, address.length);
+    address.substring(0, 6) + "..." + address.substring(36, address.length);
   return wrap ? `(${formattedAddress})` : formattedAddress;
 }
 
@@ -73,6 +71,55 @@ function copyToClipboard(button) {
     .catch((err) => console.error("Error copying text: ", err));
 }
 
+function enableTooltipAndCopy(selector) {
+  const el = document.querySelector(selector);
+  if (!el) return;
+
+  // Create tooltip
+  const tooltip = document.createElement("div");
+  tooltip.className = "custom-tooltip";
+  tooltip.style.position = "absolute";
+  tooltip.style.backgroundColor = "#333";
+  tooltip.style.color = "#fff";
+  tooltip.style.padding = "5px 10px";
+  tooltip.style.borderRadius = "4px";
+  tooltip.style.fontSize = "12px";
+  tooltip.style.whiteSpace = "nowrap";
+  tooltip.style.display = "none";
+  tooltip.style.zIndex = "9999";
+  tooltip.style.pointerEvents = "none";
+  document.body.appendChild(tooltip);
+
+  el.style.cursor = "pointer";
+
+  el.addEventListener("mouseenter", (e) => {
+    tooltip.textContent = "Click to copy";
+    tooltip.style.display = "block";
+  });
+
+  el.addEventListener("mousemove", (e) => {
+    const tooltipRect = tooltip.getBoundingClientRect();
+    tooltip.style.left = `${e.clientX - tooltipRect.width / 2}px`;
+    tooltip.style.top = `${e.clientY - tooltipRect.height - 10}px`;
+  });
+
+  el.addEventListener("mouseleave", () => {
+    tooltip.style.display = "none";
+  });
+
+  el.addEventListener("click", async () => {
+    try {
+      await navigator.clipboard.writeText(el.innerText);
+      tooltip.textContent = "Copied!";
+      setTimeout(() => {
+        tooltip.style.display = "none";
+      }, 1000);
+    } catch (err) {
+      console.error("Copy failed", err);
+    }
+  });
+}
+
 /**
  * Show a specific tab content and update tab button styles
  * @param {string} tabId - The ID of the tab to show
@@ -82,24 +129,26 @@ function showTab(tabId) {
   document.querySelectorAll(".tab-content").forEach((content) => {
     content.classList.remove("active");
   });
-  
+
   // Deactivate all tab buttons
   document.querySelectorAll(".tab-button").forEach((button) => {
     button.classList.remove("active");
   });
-  
+
   // Show the selected tab content
   document.getElementById(tabId).classList.add("active");
-  
+
   // Activate the matching tab button
-  document.querySelector(`.tab-button[data-tab="${tabId}"]`).classList.add("active");
+  document
+    .querySelector(`.tab-button[data-tab="${tabId}"]`)
+    .classList.add("active");
 }
 
 /**
  * Initialize tab event listeners
  */
 function initTabListeners() {
-  document.querySelectorAll(".tab-button").forEach(button => {
+  document.querySelectorAll(".tab-button").forEach((button) => {
     button.addEventListener("click", () => {
       const tabId = button.getAttribute("data-tab");
       showTab(tabId);
@@ -111,217 +160,229 @@ function initTabListeners() {
  * SimpleJsonViewer - A lightweight JSON visualization library
  */
 class SimpleJsonViewer {
-    /**
-     * Create a new JSON viewer
-     * @param {Object} options - Configuration options
-     * @param {HTMLElement} options.container - DOM element to render in
-     * @param {string|Object} options.data - JSON string or object to display
-     * @param {string} [options.theme="light"] - Display theme (light/dark)
-     * @param {boolean} [options.expand=false] - Expand all nodes by default
-     */
-    constructor(options) {
-        this.options = Object.assign({
-            theme: 'light',
-            container: null,
-            data: '{}',
-            expand: false
-        }, options);
-        
-        if (!this.options.container) {
-            throw new Error('Container: DOM element is required');
-        }
-        
-        this.render();
-    }
-    
-    /**
-     * Render the JSON viewer
-     */
-    render() {
-        const container = this.options.container;
-        container.innerHTML = '';
-        container.className = `json-viewer ${this.options.theme}`;
-        
-        let data;
-        try {
-            if (typeof this.options.data === 'string') {
-                data = JSON.parse(this.options.data);
-            } else {
-                data = this.options.data;
-            }
-        } catch (e) {
-            container.innerHTML = `<div class="json-error">Invalid JSON: ${e.message}</div>`;
-            return;
-        }
-        
-        const rootElement = this.createNode(data, null, 0);
-        container.appendChild(rootElement);
-    }
-    
-    /**
-     * Create a DOM node for a JSON value
-     * @param {*} value - The value to display
-     * @param {string|null} key - The property key (or null for root/array elements)
-     * @param {number} level - Nesting level
-     * @returns {HTMLElement} The created DOM element
-     */
-    createNode(value, key, level) {
-        const item = document.createElement('div');
-        item.className = 'json-item';
-        item.style.marginLeft = level === 0 ? '0' : '20px';
-        
-        const valueType = this.getType(value);
-        
-        // For objects and arrays, create expandable sections
-        if (valueType === 'object' || valueType === 'array') {
-            // Create the item label part
-            const itemHead = document.createElement('div');
-            const toggle = document.createElement('span');
-            toggle.className = `json-toggle ${this.options.expand ? 'expanded' : ''}`;
-            itemHead.appendChild(toggle);
-            
-            // Add the key part if this isn't the root
-            if (key !== null) {
-                const keyEl = document.createElement('span');
-                keyEl.className = 'json-key';
-                keyEl.textContent = key;
-                itemHead.appendChild(keyEl);
-                
-                const separator = document.createElement('span');
-                separator.className = 'json-separator';
-                separator.textContent = ' : ';
-                itemHead.appendChild(separator);
-            }
-            
-            // Add type label (object/array) with count
-            const typeLabel = document.createElement('span');
-            typeLabel.className = 'json-type-label';
-            const count = valueType === 'object' ? Object.keys(value).length : value.length;
-            typeLabel.textContent = `${valueType} {${count}}`;
-            itemHead.appendChild(typeLabel);
-            
-            // Add the full item to the parent
-            item.appendChild(itemHead);
-            
-            // Create the container for child items
-            const container = document.createElement('div');
-            container.className = `json-container ${this.options.expand ? '' : 'collapsed'}`;
-            
-            // For objects
-            if (valueType === 'object') {
-                const keys = Object.keys(value);
-                keys.forEach(objKey => {
-                    const childNode = this.createNode(value[objKey], objKey, level + 1);
-                    container.appendChild(childNode);
-                });
-            } 
-            // For arrays
-            else if (valueType === 'array') {
-                value.forEach((arrItem, index) => {
-                    const childNode = this.createNode(arrItem, index.toString(), level + 1);
-                    container.appendChild(childNode);
-                });
-            }
-            
-            // Add the container (no closing bracket/brace element)
-            item.appendChild(container);
-            
-            // Add click handler
-            toggle.addEventListener('click', () => {
-                toggle.classList.toggle('expanded');
-                container.classList.toggle('collapsed');
-            });
-        } 
-        // For primitive values, just show the key-value pair
-        else {
-            // Create the row with key and value
-            if (key !== null) {
-                const keyEl = document.createElement('span');
-                keyEl.className = 'json-key';
-                keyEl.textContent = key;
-                item.appendChild(keyEl);
-                
-                const separator = document.createElement('span');
-                separator.className = 'json-separator';
-                separator.textContent = ' : ';
-                item.appendChild(separator);
-            }
-            
-            // Add the value with appropriate styling
-            const valueEl = document.createElement('span');
-            valueEl.className = `json-${valueType}`;
-            
-            if (valueType === 'string') {
-                valueEl.textContent = `"${this.escapeString(value)}"`;
-            } else {
-                valueEl.textContent = String(value);
-            }
-            
-            item.appendChild(valueEl);
-        }
-        
-        return item;
-    }
-    
-    /**
-     * Get the type of a value
-     * @param {*} value - The value to check
-     * @returns {string} The type name
-     */
-    getType(value) {
-        if (value === null) return 'null';
-        if (Array.isArray(value)) return 'array';
-        if (typeof value === 'object') return 'object';
-        if (typeof value === 'string') return 'string';
-        if (typeof value === 'number') return 'number';
-        if (typeof value === 'boolean') return 'boolean';
-        return 'unknown';
-    }
-    
-    /**
-     * Escape a string for display
-     * @param {string} str - The string to escape
-     * @returns {string} The escaped string
-     */
-    escapeString(str) {
-        return str
-            .replace(/\\/g, '\\\\')
-            .replace(/"/g, '\\"')
-            .replace(/\n/g, '\\n')
-            .replace(/\r/g, '\\r')
-            .replace(/\t/g, '\\t');
+  /**
+   * Create a new JSON viewer
+   * @param {Object} options - Configuration options
+   * @param {HTMLElement} options.container - DOM element to render in
+   * @param {string|Object} options.data - JSON string or object to display
+   * @param {string} [options.theme="light"] - Display theme (light/dark)
+   * @param {boolean} [options.expand=false] - Expand all nodes by default
+   */
+  constructor(options) {
+    this.options = Object.assign(
+      {
+        theme: "light",
+        container: null,
+        data: "{}",
+        expand: false,
+      },
+      options
+    );
+
+    if (!this.options.container) {
+      throw new Error("Container: DOM element is required");
     }
-    
-    /**
-     * Update the theme
-     * @param {string} theme - The theme to use ('light' or 'dark')
-     */
-    setTheme(theme) {
-        this.options.container.className = `json-viewer ${theme}`;
-        this.options.theme = theme;
+
+    this.render();
+  }
+
+  /**
+   * Render the JSON viewer
+   */
+  render() {
+    const container = this.options.container;
+    container.innerHTML = "";
+    container.className = `json-viewer ${this.options.theme}`;
+
+    let data;
+    try {
+      if (typeof this.options.data === "string") {
+        data = JSON.parse(this.options.data);
+      } else {
+        data = this.options.data;
+      }
+    } catch (e) {
+      container.innerHTML = `<div class="json-error">Invalid JSON: ${e.message}</div>`;
+      return;
     }
-    
-    /**
-     * Expand all nodes
-     */
-    expandAll() {
-        const toggles = this.options.container.querySelectorAll('.json-toggle');
-        const containers = this.options.container.querySelectorAll('.json-container');
-        
-        toggles.forEach(toggle => toggle.classList.add('expanded'));
-        containers.forEach(container => container.classList.remove('collapsed'));
+
+    const rootElement = this.createNode(data, null, 0);
+    container.appendChild(rootElement);
+  }
+
+  /**
+   * Create a DOM node for a JSON value
+   * @param {*} value - The value to display
+   * @param {string|null} key - The property key (or null for root/array elements)
+   * @param {number} level - Nesting level
+   * @returns {HTMLElement} The created DOM element
+   */
+  createNode(value, key, level) {
+    const item = document.createElement("div");
+    item.className = "json-item";
+    item.style.marginLeft = level === 0 ? "0" : "20px";
+
+    const valueType = this.getType(value);
+
+    // For objects and arrays, create expandable sections
+    if (valueType === "object" || valueType === "array") {
+      // Create the item label part
+      const itemHead = document.createElement("div");
+      const toggle = document.createElement("span");
+      toggle.className = `json-toggle ${this.options.expand ? "expanded" : ""}`;
+      itemHead.appendChild(toggle);
+
+      // Add the key part if this isn't the root
+      if (key !== null) {
+        const keyEl = document.createElement("span");
+        keyEl.className = "json-key";
+        keyEl.textContent = key;
+        itemHead.appendChild(keyEl);
+
+        const separator = document.createElement("span");
+        separator.className = "json-separator";
+        separator.textContent = " : ";
+        itemHead.appendChild(separator);
+      }
+
+      // Add type label (object/array) with count
+      const typeLabel = document.createElement("span");
+      typeLabel.className = "json-type-label";
+      const count =
+        valueType === "object" ? Object.keys(value).length : value.length;
+      typeLabel.textContent = `${valueType} {${count}}`;
+      itemHead.appendChild(typeLabel);
+
+      // Add the full item to the parent
+      item.appendChild(itemHead);
+
+      // Create the container for child items
+      const container = document.createElement("div");
+      container.className = `json-container ${
+        this.options.expand ? "" : "collapsed"
+      }`;
+
+      // For objects
+      if (valueType === "object") {
+        const keys = Object.keys(value);
+        keys.forEach((objKey) => {
+          const childNode = this.createNode(value[objKey], objKey, level + 1);
+          container.appendChild(childNode);
+        });
+      }
+      // For arrays
+      else if (valueType === "array") {
+        value.forEach((arrItem, index) => {
+          const childNode = this.createNode(
+            arrItem,
+            index.toString(),
+            level + 1
+          );
+          container.appendChild(childNode);
+        });
+      }
+
+      // Add the container (no closing bracket/brace element)
+      item.appendChild(container);
+
+      // Add click handler
+      toggle.addEventListener("click", () => {
+        toggle.classList.toggle("expanded");
+        container.classList.toggle("collapsed");
+      });
     }
-    
-    /**
-     * Collapse all nodes
-     */
-    collapseAll() {
-        const toggles = this.options.container.querySelectorAll('.json-toggle');
-        const containers = this.options.container.querySelectorAll('.json-container');
-        
-        toggles.forEach(toggle => toggle.classList.remove('expanded'));
-        containers.forEach(container => container.classList.add('collapsed'));
+    // For primitive values, just show the key-value pair
+    else {
+      // Create the row with key and value
+      if (key !== null) {
+        const keyEl = document.createElement("span");
+        keyEl.className = "json-key";
+        keyEl.textContent = key;
+        item.appendChild(keyEl);
+
+        const separator = document.createElement("span");
+        separator.className = "json-separator";
+        separator.textContent = " : ";
+        item.appendChild(separator);
+      }
+
+      // Add the value with appropriate styling
+      const valueEl = document.createElement("span");
+      valueEl.className = `json-${valueType}`;
+
+      if (valueType === "string") {
+        valueEl.textContent = `"${this.escapeString(value)}"`;
+      } else {
+        valueEl.textContent = String(value);
+      }
+
+      item.appendChild(valueEl);
     }
+
+    return item;
+  }
+
+  /**
+   * Get the type of a value
+   * @param {*} value - The value to check
+   * @returns {string} The type name
+   */
+  getType(value) {
+    if (value === null) return "null";
+    if (Array.isArray(value)) return "array";
+    if (typeof value === "object") return "object";
+    if (typeof value === "string") return "string";
+    if (typeof value === "number") return "number";
+    if (typeof value === "boolean") return "boolean";
+    return "unknown";
+  }
+
+  /**
+   * Escape a string for display
+   * @param {string} str - The string to escape
+   * @returns {string} The escaped string
+   */
+  escapeString(str) {
+    return str
+      .replace(/\\/g, "\\\\")
+      .replace(/"/g, '\\"')
+      .replace(/\n/g, "\\n")
+      .replace(/\r/g, "\\r")
+      .replace(/\t/g, "\\t");
+  }
+
+  /**
+   * Update the theme
+   * @param {string} theme - The theme to use ('light' or 'dark')
+   */
+  setTheme(theme) {
+    this.options.container.className = `json-viewer ${theme}`;
+    this.options.theme = theme;
+  }
+
+  /**
+   * Expand all nodes
+   */
+  expandAll() {
+    const toggles = this.options.container.querySelectorAll(".json-toggle");
+    const containers =
+      this.options.container.querySelectorAll(".json-container");
+
+    toggles.forEach((toggle) => toggle.classList.add("expanded"));
+    containers.forEach((container) => container.classList.remove("collapsed"));
+  }
+
+  /**
+   * Collapse all nodes
+   */
+  collapseAll() {
+    const toggles = this.options.container.querySelectorAll(".json-toggle");
+    const containers =
+      this.options.container.querySelectorAll(".json-container");
+
+    toggles.forEach((toggle) => toggle.classList.remove("expanded"));
+    containers.forEach((container) => container.classList.add("collapsed"));
+  }
 }
 
 // Export functions for use in other modules
@@ -333,5 +394,6 @@ export {
   copyToClipboard,
   showTab,
   initTabListeners,
-  SimpleJsonViewer
-}; 
\ No newline at end of file
+  SimpleJsonViewer,
+  enableTooltipAndCopy,
+};
diff --git a/src/include/ar.hrl b/src/include/ar.hrl
index 0a6c29c77..655928791 100644
--- a/src/include/ar.hrl
+++ b/src/include/ar.hrl
@@ -2,6 +2,8 @@
 -define(DEFAULT_ID, << 0:256 >>).
 -define(DEFAULT_OWNER, << 0:4096 >>).
 -define(DEFAULT_DATA, <<>>).
+-define(DEFAULT_LAST_TX, <<>>).
+-define(DEFAULT_TARGET, <<>>).
 
 -define(MAX_TAG_NAME_SIZE, 3072).
 -define(MAX_TAG_VALUE_SIZE, 3072).
@@ -15,13 +17,13 @@
     %% Either the identifier of the previous transaction from
     %% the same wallet or the identifier of one of the
     %% last ?MAX_TX_ANCHOR_DEPTH blocks.
-    last_tx = <<>>,
+    anchor = ?DEFAULT_LAST_TX,
     %% The public key the transaction is signed with.
     owner =	?DEFAULT_OWNER,
     %% A list of arbitrary key-value pairs. Keys and values are binaries.
     tags = [],
     %% The address of the recipient, if any. The SHA2-256 hash of the public key.
-    target = <<>>,
+    target = ?DEFAULT_TARGET,
     %% The amount of Winstons to send to the recipient, if any.
     quantity = 0,
     %% The data to upload, if any. For v2 transactions, the field is optional - a fee
diff --git a/src/include/hb.hrl b/src/include/hb.hrl
index bbf86686d..69ab91229 100644
--- a/src/include/hb.hrl
+++ b/src/include/hb.hrl
@@ -1,12 +1,14 @@
 -include("include/ar.hrl").
 
--define(HYPERBEAM_VERSION, 0.8).
+-define(HYPERBEAM_VERSION, 0.9).
 
 %% @doc Macro for checking if a message is empty, ignoring its hashpath.
 -define(IS_EMPTY_MESSAGE(Msg), (map_size(Msg) == 0) orelse (map_size(Msg) == 1 andalso (is_map_key(priv, Msg) orelse is_map_key(<<"priv">>, Msg)))).
 %% @doc Macro usable in guards that validates whether a term is a
 %% human-readable ID encoding.
 -define(IS_ID(X), (is_binary(X) andalso (byte_size(X) == 42 orelse byte_size(X) == 43 orelse byte_size(X) == 32))).
+%% @doc Macro for checking a term is a link.
+-define(IS_LINK(X), (is_tuple(X) andalso element(1, X) == link)).
 %% @doc List of special keys that are used in the AO-Core protocol.
 -define(AO_CORE_KEYS, [<<"path">>, <<"hashpath">>, <<"priv">>]).
 %% @doc Keys that can be regenerated losslessly.
@@ -28,7 +30,7 @@
 -define(event(Topic, X), hb_event:log(Topic, X, ?MODULE, ?FUNCTION_NAME, ?LINE)).
 -define(event(Topic, X, Opts), hb_event:log(maps:get(topic, Opts, Topic), X, ?MODULE, ?FUNCTION_NAME, ?LINE, Opts)).
 -define(debug_wait(T), hb:debug_wait(T, ?MODULE, ?FUNCTION_NAME, ?LINE)).
--define(debug_print(X), hb_util:debug_print(X, ?MODULE, ?FUNCTION_NAME, ?LINE)).
+-define(debug_print(X), hb_format:print(X, ?MODULE, ?FUNCTION_NAME, ?LINE)).
 -define(no_prod(X), hb:no_prod(X, ?MODULE, ?LINE)).
 
 %%% Macro shortcuts for debugging.
@@ -40,7 +42,8 @@
 -define(p(X), hb_event:log(X, ?MODULE, ?FUNCTION_NAME, ?LINE)).
 %% @doc Print the trace of the current stack, up to the first non-hyperbeam
 %% module.
--define(trace(), hb_util:trace_macro_helper(fun hb_util:print_trace/4, catch error(test), ?MODULE, ?FUNCTION_NAME, ?LINE)).
--define(trace_short(), hb_util:trace_macro_helper(fun hb_util:print_trace_short/4, catch error(test), ?MODULE, ?FUNCTION_NAME, ?LINE)).
+-define(trace(), hb_format:trace_macro_helper(fun hb_format:print_trace/4, catch error(test), ?MODULE, ?FUNCTION_NAME, ?LINE)).
+-define(trace_short(), hb_format:trace_macro_helper(fun hb_format:print_trace_short/4, catch error(test), ?MODULE, ?FUNCTION_NAME, ?LINE)).
 %% @doc Draw a horizontal line in the logs.
 -define(hr(), io:format(standard_error, "--------------------------------------------------------------------------------~n", [])).
+-define(hr(Str), io:format(standard_error, iolist_to_binary(["---------------------------------------- ", Str, " ----------------------------------------~n"]), [])).
diff --git a/test/admissible-report.eterm b/test/admissible-report.eterm
index 03fce5ada..64ffbaedc 100644
--- a/test/admissible-report.eterm
+++ b/test/admissible-report.eterm
@@ -35,7 +35,7 @@
 				}]
 		},
 	<<"nonce">> =>
-		<<"+q/bZCJGupSiZvjNg+KoD0bjx53pqnay/5Ojvo0597t+kqD7iwdTjAzQ35bcHZXitlIkgX0e3NnLV3thQJdRRA==">>,
+		<<"-q_bZCJGupSiZvjNg-KoD0bjx53pqnay_5Ojvo0597uwXbjdkxgcnt621T0zh93SeA0lGDsu1JEZUfZLZPKycw">>,
 	<<"report">> =>
 		<<"{\"version\":2,\"guest_svn\":0,\"policy\":196608,\"family_id\":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],\"image_id\":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],\"vmpl\":1,\"sig_algo\":1,\"current_tcb\":{\"bootloader\":4,\"tee\":0,\"_reserved\":[0,0,0,0],\"snp\":22,\"microcode\":213},\"plat_info\":3,\"_author_key_en\":0,\"_reserved_0\":0,\"report_data\":[250,175,219,100,34,70,186,148,162,102,248,205,131,226,168,15,70,227,199,157,233,170,118,178,255,147,163,190,141,57,247,187,181,160,210,21,56,188,91,240,50,131,40,188,234,18,130,134,180,231,217,163,72,45,87,74,139,105,40,115,207,229,115,46],\"measurement\":[135,166,103,101,166,120,21,18,52,110,203,71,81,17,101,194,107,109,163,231,41,151,61,151,16,160,197,103,199,74,166,87,130,58,240,193,98,213,22,248,67,0,84,255,163,46,194,73],\"host_data\":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],\"id_key_digest\":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],\"author_key_digest\":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],\"report_id\":[241,10,197,48,71,124,10,164,25,84,217,143,57,33,170,252,188,35,183,1,18,3,169,47,254,196,204,111,197,155,181,36],\"report_id_ma\":[255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255],\"reported_tcb\":{\"bootloader\":4,\"tee\":0,\"_reserved\":[0,0,0,0],\"snp\":22,\"microcode\":213},\"_reserved_1\":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],\"chip_id\":[6,154,118,21,12,115,53,47,251,19,195,100,155,12,239,102,116,131,103,189,106,202,153,3,114,175,16,182,24,166,229,214,231,126,164,15,129,52,233,142,196,43,43,8,89,238,118,246,21,144,209,16,165,197,134,105,214,250,155,148,50,78,87,203],\"committed_tcb\":{\"bootloader\":4,\"tee\":0,\"_reserved\":[0,0,0,0],\"snp\":22,\"microcode\":213},\"current_build\":20,\"current_minor\":55,\"current_major\":1,\"_reserved_2\":0,\"committed_build\":20,\"committed_minor\":55,\"committed_major\":1,\"_reserved_3\":0,\"launch_tcb\":{\"bootloader\":4,\"tee\":0,\"_reserved\":[0,0,0,0],\"snp\":22,\"microcode\":213},\"_reserved_4\":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],\"signature\":{\"r\":[136,143,81,241,242,123,84,48,177,36,241,167,35,181,109,42,134,193,44,88,162,240,140,195,117,252,151,27,83,156,188,69,14,114,21,107,105,163,12,20,128,144,61,65,233,31,205,111,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],\"s\":[64,250,227,155,71,182,238,179,71,128,109,219,182,33,119,151,202,50,123,211,22,167,104,241,222,221,82,34,138,148,86,254,190,174,191,86,202,194,207,91,110,250,3,196,127,105,133,135,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],\"_reserved\":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]}}">>
 }.
\ No newline at end of file
diff --git a/test/admissible-report.json b/test/admissible-report.json
new file mode 100644
index 000000000..9ccc4a3d1
--- /dev/null
+++ b/test/admissible-report.json
@@ -0,0 +1 @@
+{"version":2,"guest_svn":0,"policy":196608,"family_id":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"image_id":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"vmpl":1,"sig_algo":1,"current_tcb":{"bootloader":4,"tee":0,"_reserved":[0,0,0,0],"snp":22,"microcode":213},"plat_info":3,"_author_key_en":0,"_reserved_0":0,"report_data":[250,175,219,100,34,70,186,148,162,102,248,205,131,226,168,15,70,227,199,157,233,170,118,178,255,147,163,190,141,57,247,187,181,160,210,21,56,188,91,240,50,131,40,188,234,18,130,134,180,231,217,163,72,45,87,74,139,105,40,115,207,229,115,46],"measurement":[135,166,103,101,166,120,21,18,52,110,203,71,81,17,101,194,107,109,163,231,41,151,61,151,16,160,197,103,199,74,166,87,130,58,240,193,98,213,22,248,67,0,84,255,163,46,194,73],"host_data":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"id_key_digest":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"author_key_digest":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"report_id":[241,10,197,48,71,124,10,164,25,84,217,143,57,33,170,252,188,35,183,1,18,3,169,47,254,196,204,111,197,155,181,36],"report_id_ma":[255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255],"reported_tcb":{"bootloader":4,"tee":0,"_reserved":[0,0,0,0],"snp":22,"microcode":213},"_reserved_1":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"chip_id":[6,154,118,21,12,115,53,47,251,19,195,100,155,12,239,102,116,131,103,189,106,202,153,3,114,175,16,182,24,166,229,214,231,126,164,15,129,52,233,142,196,43,43,8,89,238,118,246,21,144,209,16,165,197,134,105,214,250,155,148,50,78,87,203],"committed_tcb":{"bootloader":4,"tee":0,"_reserved":[0,0,0,0],"snp":22,"microcode":213},"current_build":20,"current_minor":55,"current_major":1,"_reserved_2":0,"committed_build":20,"committed_minor":55,"committed_major":1,"_reserved_3":0,"launch_tcb":{"bootloader":4,"tee":0,"_reserved":[0,0,0,0],"snp":22,"microcode":213},"_reserved_4":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"signature":{"r":[136,143,81,241,242,123,84,48,177,36,241,167,35,181,109,42,134,193,44,88,162,240,140,195,117,252,151,27,83,156,188,69,14,114,21,107,105,163,12,20,128,144,61,65,233,31,205,111,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"s":[64,250,227,155,71,182,238,179,71,128,109,219,182,33,119,151,202,50,123,211,22,167,104,241,222,221,82,34,138,148,86,254,190,174,191,86,202,194,207,91,110,250,3,196,127,105,133,135,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"_reserved":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]}}
\ No newline at end of file
diff --git a/test/config.json b/test/config.json
new file mode 100644
index 000000000..0be064746
--- /dev/null
+++ b/test/config.json
@@ -0,0 +1,13 @@
+{
+    "port": 1234,
+    "example": 9001,
+    "host": "https://ao.computer",
+    "await_inprogress": false,
+    "store": [
+        {
+            "store-module": "hb_store_fs",
+            "name": "cache-TEST/json-test-store",
+            "ao-types": "store-module=\"atom\""
+        }
+    ]
+}
\ No newline at end of file
diff --git a/test/hyper-aos.lua b/test/hyper-aos.lua
index b177e04b4..9fee87e21 100644
--- a/test/hyper-aos.lua
+++ b/test/hyper-aos.lua
@@ -1901,9 +1901,9 @@ local function getId(m)
   local id = ""
   utils.map(function (k)
     local c = m.commitments[k]
-    if c.alg == "rsa-pss-sha512" then
+    if c.type == "rsa-pss-sha512" then
       id = k
-    elseif c.alg == "signed" and c['commitment-device'] == "ans104" then
+    elseif c.type == "signed" and c['commitment-device'] == "ans104" then
       id = k
     end
   end, utils.keys(m.commitments)
@@ -1912,22 +1912,21 @@ local function getId(m)
 end
 
 function ao.init(env)
-  if ao.id == "" then ao.id = getId(env.process) end
+  if _G.ao.id == "" then _G.ao.id = getId(env.process) end
 
   -- if ao._module == "" then
   --   ao._module = env.Module.Id
   -- end
   -- TODO: need to deal with assignables
-  if #ao.authorities < 1 then
+  if # _G.ao.authorities < 1 then
       if type(env.process.authority) == 'string' then
-        ao.authorities = { env.process.authority }
+        _G.ao.authorities = { env.process.authority }
       else
-        ao.authorities = env.process.authority
+        _G.ao.authorities = env.process.authority
       end
   end
-
-  ao.outbox = {Output = {}, Messages = {}, Spawns = {}, Assignments = {}}
-  ao.env = env
+  _G.ao.outbox = {Output = {}, Messages = {}, Spawns = {}, Assignments = {}}
+  _G.ao.env = env
 
 end
 
@@ -2290,13 +2289,13 @@ local function getOwner(m)
 
   utils.map(function (k)
     local c = m.commitments[k]
-    if c.alg == "rsa-pss-sha512" then
-      id = c.committer
+    if c.type == "rsa-pss-sha512" then
+        id = c.committer
     elseif c.alg == "signed" and c['commitment-device'] == "ans104" then
-      id = c.committer
+        id = c.committer
     end
-  end, utils.keys(m.commitments)
-  )
+end, utils.keys(m.commitments)
+)
   return id
 end
 
@@ -2348,19 +2347,20 @@ function state.isTrusted(req)
     return true
   end
   local _trusted = false
-
+  
   if req.body['from-process'] then
     _trusted = utils.includes(
-      req.body['from-process'],
-      ao.authorities
+        req.body['from-process'],
+        ao.authorities
     )
-  end
+end
 
-  if not _trusted then
+if not _trusted then
     _trusted = utils.includes(
-      getOwner(req.body), ao.authorities
+        getOwner(req.body), ao.authorities
     )
-  end
+end
+
   return _trusted
 end
 
@@ -2435,7 +2435,6 @@ function process.handle(req, base)
       }
     })
   end
-
   req.reply = function (_reply)
     local _from = state.getFrom(req)
     _reply.target = _reply.target and _reply.target or _from
@@ -2447,12 +2446,12 @@ function process.handle(req, base)
 
   -- state.checkSlot(msg, ao)
   Handlers.add("_eval", function (_req)
-    local function getMsgFrom(m)
+    local function getOwnerFrom(m)
       local from = ""
       Utils.map(
         function (k)
           local c = m.commitments[k]
-          if c.alg == "rsa-pss-sha512" then
+          if c.type == "rsa-pss-sha512" then
             from = c.committer
           end
         end,
@@ -2460,7 +2459,7 @@ function process.handle(req, base)
       )
       return from
     end
-    return _req.body.action == "Eval" and Owner == getMsgFrom(_req.body)
+    return _req.body.action == "Eval" and Owner == getOwnerFrom(_req.body)
   end, eval(ao))
 
   Handlers.add("_default",
diff --git a/test/large-message.eterm b/test/large-message.eterm
index 557ad0857..a13b94c01 100644
--- a/test/large-message.eterm
+++ b/test/large-message.eterm
@@ -1,25 +1,64 @@
-#{
-              <<"address">> =>
-                  <<"XgN1kN-ZyAWtYvdUlPEM3EIIi-budUx81mjcHQ1mSNU">>,
-              <<"append">> =>
+#{<<"address">> => <<"XgN1kN-ZyAWtYvdUlPEM3EIIi-budUx81mjcHQ1mSNU">>,
+  <<"append">> =>
+      <<"aaf13c9ed2e821ea8c82fcc7981c73a14dc2d01c855f09262d42090fa0424422">>,
+  <<"commitments">> =>
+      #{<<"6nWXloEFP1kqslsOCKCLxWvzr5GVJvvWlQAO0Uwv7MM">> =>
+            #{<<"commitment-device">> => <<"httpsig@1.0">>,
+              <<"committed">> =>
+                  #{<<"1">> => <<"address">>,<<"10">> => <<"public-key">>,
+                    <<"11">> => <<"report">>,<<"12">> => <<"vcpu_type">>,
+                    <<"13">> => <<"vcpus">>,<<"14">> => <<"vmm_type">>,
+                    <<"2">> => <<"ao-types">>,<<"3">> => <<"append">>,
+                    <<"4">> => <<"firmware">>,<<"5">> => <<"guest_features">>,
+                    <<"6">> => <<"initrd">>,<<"7">> => <<"kernel">>,
+                    <<"8">> => <<"node-message">>,<<"9">> => <<"nonce">>},
+              <<"keyid">> => <<"YW8">>,
+              <<"signature">> =>
+                  <<"6nWXloEFP1kqslsOCKCLxWvzr5GVJvvWlQAO0Uwv7MM">>,
+              <<"type">> => <<"hmac-sha256">>},
+        <<"uHPsVJP_v7B46__xiMPluCZf_6IXjsMfsUTHHC46uz4">> =>
+            #{<<"commitment-device">> => <<"httpsig@1.0">>,
+              <<"committed">> =>
+                  #{<<"1">> => <<"address">>,<<"10">> => <<"public-key">>,
+                    <<"11">> => <<"report">>,<<"12">> => <<"vcpu_type">>,
+                    <<"13">> => <<"vcpus">>,<<"14">> => <<"vmm_type">>,
+                    <<"2">> => <<"ao-types">>,<<"3">> => <<"append">>,
+                    <<"4">> => <<"firmware">>,<<"5">> => <<"guest_features">>,
+                    <<"6">> => <<"initrd">>,<<"7">> => <<"kernel">>,
+                    <<"8">> => <<"node-message">>,<<"9">> => <<"nonce">>},
+              <<"committer">> =>
+                  <<"ggltHF0Cnv9ylH3vM1p7amR2vXLMoPLQIUQmAEwLP-k">>,
+              <<"keyid">> =>
+                  <<"rh3EGHNtQyto38UnoKwbnEkw3TqlR5b18n_uVySFBdI-t0O7lcrRM0MrL8l09YHb9ZAG5A-cB3ExZpdDCnnCGcvxFesdnapzWhYkPpXZKvgVk7NyZdRFWUJXoSaw3n5fajGShjAiOkiEzDEwHKozZnqJl-DRuuHVGcw4Q1VMk1CtzJJBCrZeNTG1crWynHa-3AfCEQ6Ou8AMs8a7ibHP57Jcmhe8xfVO4MtEvTtuMejAAjLaLIPWtzhct3rJIZmpSvwG7fAfWafqPuAx_hVjLWFv41wwhH1yA_bCU_x61n41Lqg06prUCNPBf8Ypz1EUIqKipV0O69UGHylOvA3cbpLFV6QyF1w8icae3vcKHPmQ-Fni0xD3PXZCCaiBHng4FianlIfms6IB7jXLr4dZ4utq-32wRR2anksxz6tyZ_RFWN8Tb7-qPXb5X0ESsAxAshh4vfYWRYdaMeO79I4IN2vB6EFhRHO_Jo5U-E3KDm2vyABly5x9Aw2gBUEhmEdM0T-fUZx_30UoqcqRYlAKCzpIQ4_irckldfZMGRoIlWxQP2qRTUCrOxR8rtSLWUKQTyOW9GcI0pV04q7lxRRCpZK-B76GKU8ZQnDqQerdvsFro66LXGXOESk1HN2isCV_Pwik9G1SFKftHWzDzrRlRrDWcoyoqzEMjE0wj7ttjJE">>,
+              <<"signature">> =>
+                  <<"YG9aPmui8jvXL_SZz97oyj1HV596j4dKe9gaHQYkqEqwJhgG2_apue9V7_adypNeFlHiQTTU-BgNV1SNSAsSqYXXBPAQCh1Yw8BQ3NhPPhFr-as7tiwrJBwsZUe7QoHZWyBdNOLIY-E7w4QWOszRNZRnmKNWEPutyvP9a_5fxz7c8Z7zIkYvfwZUa9OZwOw4uAoUjSZ8fmv4F6bFdElrkdWpADwsATFFZiaFy4v-qdRpCKwegWAKdu2ClMEY973YoR47zoAcPqX3vX0nlzvZ9EKLVlytPanFM29yTgnDy1LokUq7hxC4I0PEz3dhubVFWhdisKConKbFCJqDX7YoaS3hu6EpeknP9Ru1TqiWSFMKe9IMQppzP7FtQOb6JKE8mvPwPbWp1WPTr9V4_qooUvUcNKPXapIJc5gWaF59aiyN9jNRjKL1XLBhCFf59BDf072oOdI52UVjCRcE58X-5HL1u7m79BWzIeGXCE6KIlqYWuGV3VIt7hE8E4lWiTEBKy8FAoScx7n5JDE1K0x8AYBff7ipzKAHZMo8vOzZYNRl5f9tNJRurKnK0CU-85TNsORCVuDgOuMAWi9MmsduicGYvINOnXSXhht1y4L-AiQExIHVVBf5kGpJi0FV-FNKhwH3Vihgx24lZ2f9HuPZUt8vmjQwoEgCZT0PYTvHi3w">>,
+              <<"type">> => <<"rsa-pss-sha512">>}},
+  <<"firmware">> =>
+      <<"b8c5d4082d5738db6b0fb0294174992738645df70c44cdecf7fad3a62244b788e7e408c582ee48a74b289f3acec78510">>,
+  <<"guest_features">> => 1,
+  <<"initrd">> =>
+      <<"da6dffff50373e1d393bf92cb9b552198b1930068176a046dda4e23bb725b3bb">>,
+  <<"kernel">> =>
+      <<"69d0cd7d13858e4fcef6bc7797aebd258730f215bc5642c4ad8e4b893cc67576">>,
+  <<"node-message">> =>
+      #{<<"debug_metadata">> => true,
+        <<"gateway">> => <<"https://arweave.net">>,
+        <<"process_now_from_cache">> => false,
+        <<"debug_print_map_line_threshold">> => 30,<<"http_client">> => gun,
+        <<"http_keepalive">> => 120000,<<"short_trace_len">> => 5,
+        <<"debug_print_trace">> => short,
+        <<"date">> => <<"Fri, 18 Apr 2025 19:01:31 GMT">>,
+        <<"scheduler_location_ttl">> => 604800000,
+        <<"access_control_allow_origin">> => <<"*">>,
+        <<"compute_mode">> => lazy,<<"preload_devices">> => [],
+        <<"hb_config_location">> => <<"config.flat">>,
+        <<"process_workers">> => false,
+        <<"access_control_allow_methods">> =>
+            <<"GET, POST, PUT, DELETE, OPTIONS">>,
+        <<"initialized">> => permanent,<<"only">> => local,
+        <<"trusted">> =>
+            #{<<"append">> =>
                   <<"aaf13c9ed2e821ea8c82fcc7981c73a14dc2d01c855f09262d42090fa0424422">>,
-              <<"commitments">> =>
-                  #{<<"88VMQLqJxIwAT5PThjsKMTSVU56jEExem5hwQPbxcqc">> =>
-                        #{<<"alg">> => <<"hmac-sha256">>,
-                          <<"commitment-device">> => <<"httpsig@1.0">>,
-                          <<"signature">> =>
-                              <<"http-sig-037590df99c805ad=:N6AyqYlF04sxNcv+PZedgHW8TrL+9XqsQxQyDWDWywTDF6qeMR5IdokYGwqHRF1O5ygMvD7kqrlTCSJZSfwBiraOPaR3ewASGEn9v0D/ytRApN2rVMVrSVdWXM48L/YAwwYQj1AJ1B6l11GwB7tJQdnK5CjFWZg95KKsOf4cP8pUsNIeJMoOF8y4mcUVu9ncxz5xmCzNVAoLlCZC7LhOpAoQmejPWYlOURdao5bCLAHNgp0MwVVAIMbC7e0dryzIwkPKJ6b9dpdQQ8M3WKLw95BB4dBXCe4I6S8iUL6VhL9sSy9B0vZTax30ndgvh0f/QkObUwp3K41j5TEYhxLXMMgs/aEWzNawZzfeCLICuDd6XxQG0F2QS3UMOgtnZKoWfX2YBq7CS8lkaVrANkh5g2MFMlgJMEnyVFegsREUg8qqO0I6oLbECJsOfWUAe12pv3scMhF9ofi8TJpHuRUKdxhzOA9IWzLS6GO+wkNEQ3IAKCGdZUUci+ntoY5Hm1/R7lSoiEQSOWl41Mx6ZVSWNhZRbdqDOXhYTpTP6NU8Ql2st0vF0uefC5Zljd9cs9wk0D44XTSIZxLQao60j1CX0lLxW03Dh3eHD490/7T7/HVhayJF/Vx5u7evJCdReTNCxhyDCSnV5RKx6++6zX0B/VdxoTWyMO2XA5qG9v5Bs7o=:">>,
-                          <<"signature-input">> =>
-                              <<"http-sig-037590df99c805ad=(\"address\" \"ao-types\" \"append\" \"content-digest\" \"content-type\" \"firmware\" \"guest_features\" \"initrd\" \"kernel\" \"nonce\" \"public-key\" \"report\" \"vcpu_type\" \"vcpus\" \"vmm_type\");alg=\"rsa-pss-sha512\";keyid=\"o987RvpWhYgDA9rte9WJmVnws2z6YX_khhBrQOBCOyxQG5lj3i7aJIXfEwV-X3GPWRSMQ_7inIi4Fw7ocUDIXp4EWhiCSU4JTywxzbwcgRzH42bTk8AsEm7uQrIWqCYbinQ92Qsn3qnW4jhcpa1wPASRlv3vYAQIu6eXKuloXpIjx8rFOLTzTje9NFVWmjypP9oShtjI8Y7VdEjjl5ILMqu5ZfwlIsssbx9J6jDvN9nMCj8-j1YyKh-Uq3aJKeYxeytSSYvGU4mHrG3j2HYooct9LXOwTh89sXsc7gCvSafpI8j7ZFGRrP28FhRhCjzYhiCT88efsWxAjkv1C1JYf5jJLtLFfEl-Y39jpGPXnIaofeMJ9X2X_Xfx86KOKSqoOU-DmFKfPdt4JjqaafI1_Asvxp60enS1BdvgfLr34K8gq6Yyos47FrzhqCW_BWOF77vgp-w5PV-tcs2uO1oKpUghy1eaTeeNdKHjlQj9huOjv7kOMBGfOWtZDW1sO9ChYB3DDTT3AAwo6bVjj0iiiwWGbzWecwT9OPLetRCymVPEFvTQWXK6-1Qu3WNoYqFtC_pFqHo-owxaHS37ySTfB1A04C5a6m3TEP9hLWde52C5frMdfchYuy5pqoNqMb3sznGRQhOwmcWxb3unq9tytAYNmEpQhzZ-sHapTs1Y080\"">>},
-                    <<"oRjdfP_V-aFCZgdDGmHhgijR4Y95nxbHJ_FwUgVYXQs">> =>
-                        #{<<"alg">> => <<"rsa-pss-sha512">>,
-                          <<"commitment-device">> => <<"httpsig@1.0">>,
-                          <<"committer">> =>
-                              <<"XgN1kN-ZyAWtYvdUlPEM3EIIi-budUx81mjcHQ1mSNU">>,
-                          <<"signature">> =>
-                              <<"http-sig-037590df99c805ad=:N6AyqYlF04sxNcv+PZedgHW8TrL+9XqsQxQyDWDWywTDF6qeMR5IdokYGwqHRF1O5ygMvD7kqrlTCSJZSfwBiraOPaR3ewASGEn9v0D/ytRApN2rVMVrSVdWXM48L/YAwwYQj1AJ1B6l11GwB7tJQdnK5CjFWZg95KKsOf4cP8pUsNIeJMoOF8y4mcUVu9ncxz5xmCzNVAoLlCZC7LhOpAoQmejPWYlOURdao5bCLAHNgp0MwVVAIMbC7e0dryzIwkPKJ6b9dpdQQ8M3WKLw95BB4dBXCe4I6S8iUL6VhL9sSy9B0vZTax30ndgvh0f/QkObUwp3K41j5TEYhxLXMMgs/aEWzNawZzfeCLICuDd6XxQG0F2QS3UMOgtnZKoWfX2YBq7CS8lkaVrANkh5g2MFMlgJMEnyVFegsREUg8qqO0I6oLbECJsOfWUAe12pv3scMhF9ofi8TJpHuRUKdxhzOA9IWzLS6GO+wkNEQ3IAKCGdZUUci+ntoY5Hm1/R7lSoiEQSOWl41Mx6ZVSWNhZRbdqDOXhYTpTP6NU8Ql2st0vF0uefC5Zljd9cs9wk0D44XTSIZxLQao60j1CX0lLxW03Dh3eHD490/7T7/HVhayJF/Vx5u7evJCdReTNCxhyDCSnV5RKx6++6zX0B/VdxoTWyMO2XA5qG9v5Bs7o=:">>,
-                          <<"signature-input">> =>
-                              <<"http-sig-037590df99c805ad=(\"address\" \"ao-types\" \"append\" \"content-digest\" \"content-type\" \"firmware\" \"guest_features\" \"initrd\" \"kernel\" \"nonce\" \"public-key\" \"report\" \"vcpu_type\" \"vcpus\" \"vmm_type\");alg=\"rsa-pss-sha512\";keyid=\"o987RvpWhYgDA9rte9WJmVnws2z6YX_khhBrQOBCOyxQG5lj3i7aJIXfEwV-X3GPWRSMQ_7inIi4Fw7ocUDIXp4EWhiCSU4JTywxzbwcgRzH42bTk8AsEm7uQrIWqCYbinQ92Qsn3qnW4jhcpa1wPASRlv3vYAQIu6eXKuloXpIjx8rFOLTzTje9NFVWmjypP9oShtjI8Y7VdEjjl5ILMqu5ZfwlIsssbx9J6jDvN9nMCj8-j1YyKh-Uq3aJKeYxeytSSYvGU4mHrG3j2HYooct9LXOwTh89sXsc7gCvSafpI8j7ZFGRrP28FhRhCjzYhiCT88efsWxAjkv1C1JYf5jJLtLFfEl-Y39jpGPXnIaofeMJ9X2X_Xfx86KOKSqoOU-DmFKfPdt4JjqaafI1_Asvxp60enS1BdvgfLr34K8gq6Yyos47FrzhqCW_BWOF77vgp-w5PV-tcs2uO1oKpUghy1eaTeeNdKHjlQj9huOjv7kOMBGfOWtZDW1sO9ChYB3DDTT3AAwo6bVjj0iiiwWGbzWecwT9OPLetRCymVPEFvTQWXK6-1Qu3WNoYqFtC_pFqHo-owxaHS37ySTfB1A04C5a6m3TEP9hLWde52C5frMdfchYuy5pqoNqMb3sznGRQhOwmcWxb3unq9tytAYNmEpQhzZ-sHapTs1Y080\"">>}},
               <<"firmware">> =>
                   <<"b8c5d4082d5738db6b0fb0294174992738645df70c44cdecf7fad3a62244b788e7e408c582ee48a74b289f3acec78510">>,
               <<"guest_features">> => 1,
@@ -27,192 +66,129 @@
                   <<"da6dffff50373e1d393bf92cb9b552198b1930068176a046dda4e23bb725b3bb">>,
               <<"kernel">> =>
                   <<"69d0cd7d13858e4fcef6bc7797aebd258730f215bc5642c4ad8e4b893cc67576">>,
-              <<"node-message">> =>
-                  #{<<"debug_metadata">> => true,
-                    <<"gateway">> => <<"https://arweave.net">>,
-                    <<"process_now_from_cache">> => false,
-                    <<"debug_print_map_line_threshold">> => 30,
-                    <<"http_client">> => gun,<<"http_keepalive">> => 120000,
-                    <<"short_trace_len">> => 5,
-                    <<"debug_print_trace">> => short,
-                    <<"date">> => <<"Fri, 18 Apr 2025 19:01:31 GMT">>,
-                    <<"scheduler_location_ttl">> => 604800000,
-                    <<"access_control_allow_origin">> => <<"*">>,
-                    <<"compute_mode">> => lazy,<<"preload_devices">> => [],
-                    <<"hb_config_location">> => <<"config.flat">>,
-                    <<"process_workers">> => false,
-                    <<"access_control_allow_methods">> =>
-                        <<"GET, POST, PUT, DELETE, OPTIONS">>,
-                    <<"initialized">> => permanent,<<"only">> => local,
-                    <<"trusted">> =>
-                        #{<<"append">> =>
-                              <<"aaf13c9ed2e821ea8c82fcc7981c73a14dc2d01c855f09262d42090fa0424422">>,
-                          <<"firmware">> =>
-                              <<"b8c5d4082d5738db6b0fb0294174992738645df70c44cdecf7fad3a62244b788e7e408c582ee48a74b289f3acec78510">>,
-                          <<"guest_features">> => 1,
-                          <<"initrd">> =>
-                              <<"da6dffff50373e1d393bf92cb9b552198b1930068176a046dda4e23bb725b3bb">>,
-                          <<"kernel">> =>
-                              <<"69d0cd7d13858e4fcef6bc7797aebd258730f215bc5642c4ad8e4b893cc67576">>,
-                          <<"vcpu_type">> => 5,<<"vcpus">> => 1,
-                          <<"vmm_type">> => 1},
-                    <<"snp_hashes">> =>
-                        #{<<"append">> =>
-                              <<"aaf13c9ed2e821ea8c82fcc7981c73a14dc2d01c855f09262d42090fa0424422">>,
-                          <<"firmware">> =>
-                              <<"b8c5d4082d5738db6b0fb0294174992738645df70c44cdecf7fad3a62244b788e7e408c582ee48a74b289f3acec78510">>,
-                          <<"guest_features">> => 1,
-                          <<"initrd">> =>
-                              <<"da6dffff50373e1d393bf92cb9b552198b1930068176a046dda4e23bb725b3bb">>,
-                          <<"kernel">> =>
-                              <<"69d0cd7d13858e4fcef6bc7797aebd258730f215bc5642c4ad8e4b893cc67576">>,
-                          <<"vcpu_type">> => 5,<<"vcpus">> => 1,
-                          <<"vmm_type">> => 1},
-                    <<"cache_lookup_hueristics">> => false,
-                    <<"address">> =>
-                        <<"XgN1kN-ZyAWtYvdUlPEM3EIIi-budUx81mjcHQ1mSNU">>,
-                    <<"store">> =>
-                        [#{<<"prefix">> => <<"cache-mainnet">>,
-                           <<"store-module">> => hb_store_fs},
-                         #{<<"store">> =>
-                               [#{<<"prefix">> => <<"cache-mainnet">>,
-                                  <<"store-module">> => hb_store_fs}],
-                           <<"store-module">> => hb_store_gateway}],
-                    <<"postprocessor">> => undefined,
-                    <<"debug_show_priv">> => false,
-                    <<"routes">> =>
-                        [#{<<"node">> =>
-                               #{<<"prefix">> => <<"http://localhost:6363">>},
-                           <<"template">> => <<"/result/.*">>},
-                         #{<<"nodes">> =>
-                               [#{<<"opts">> =>
-                                      #{<<"http_client">> => httpc,
-                                        <<"protocol">> => http2},
-                                  <<"prefix">> =>
-                                      <<"https://arweave-search.goldsky.com">>},
-                                #{<<"opts">> =>
-                                      #{<<"http_client">> => gun,
-                                        <<"protocol">> => http2},
-                                  <<"prefix">> => <<"https://arweave.net">>}],
-                           <<"template">> => <<"/graphql">>},
-                         #{<<"node">> =>
-                               #{<<"opts">> =>
-                                     #{<<"http_client">> => gun,
-                                       <<"protocol">> => http2},
-                                 <<"prefix">> => <<"https://arweave.net">>},
-                           <<"template">> => <<"/raw">>}],
-                    <<"debug_print">> => false,
-                    <<"bundler_ans104">> => <<"https://up.arweave.net:443">>,
-                    <<"client_error_strategy">> => throw,
-                    <<"http_request_send_timeout">> => 60000,
-                    <<"http_extra_opts">> =>
-                        #{<<"cache_control">> => [<<"always">>],
-                          <<"force_message">> => true},
-                    <<"force_signed">> => true,
-                    <<"server">> => <<"nginx/1.18.0 (Ubuntu)">>,
-                    <<"access_remote_cache_for_client">> => false,
-                    <<"await_inprogress">> => named,
-                    <<"content_type">> =>
-                        <<"multipart/form-data; boundary=\"5zd5yKhUfgSnCzBVlt29-Vs4rQQeUBGuVqNJubt07jI\"">>,
-                    <<"http_connect_timeout">> => 5000,<<"status">> => 200,
-                    <<"body_keys">> =>
-                        <<"\"routes\", \"routes\", \"routes\", \"routes\", \"routes\", \"routes\", \"routes\", \"routes\", \"routes\", \"routes\"">>,
-                    <<"stack_print_prefixes">> => ["hb","dev","ar"],
-                    <<"scheduling_mode">> => disabled,
-                    <<"http_server">> =>
-                        <<"XgN1kN-ZyAWtYvdUlPEM3EIIi-budUx81mjcHQ1mSNU">>,
-                    <<"debug_print_binary_max">> => 60,
-                    <<"debug_ids">> => false,<<"relay_http_client">> => httpc,
-                    <<"debug_stack_depth">> => 40,
-                    <<"preloaded_devices">> =>
-                        [#{<<"module">> => dev_codec_ans104,
-                           <<"name">> => <<"ans104@1.0">>},
-                         #{<<"module">> => dev_cu,
-                           <<"name">> => <<"compute@1.0">>},
-                         #{<<"module">> => dev_cache,
-                           <<"name">> => <<"cache@1.0">>},
-                         #{<<"module">> => dev_cacheviz,
-                           <<"name">> => <<"cacheviz@1.0">>},
-                         #{<<"module">> => dev_cron,
-                           <<"name">> => <<"cron@1.0">>},
-                         #{<<"module">> => dev_dedup,
-                           <<"name">> => <<"dedup@1.0">>},
-                         #{<<"module">> => dev_delegated_compute,
-                           <<"name">> => <<"delegated-compute@1.0">>},
-                         #{<<"module">> => dev_faff,
-                           <<"name">> => <<"faff@1.0">>},
-                         #{<<"module">> => dev_codec_flat,
-                           <<"name">> => <<"flat@1.0">>},
-                         #{<<"module">> => dev_genesis_wasm,
-                           <<"name">> => <<"genesis-wasm@1.0">>},
-                         #{<<"module">> => dev_green_zone,
-                           <<"name">> => <<"greenzone@1.0">>},
-                         #{<<"module">> => dev_codec_httpsig,
-                           <<"name">> => <<"httpsig@1.0">>},
-                         #{<<"module">> => dev_hyperbuddy,
-                           <<"name">> => <<"hyperbuddy@1.0">>},
-                         #{<<"module">> => dev_codec_json,
-                           <<"name">> => <<"json@1.0">>},
-                         #{<<"module">> => dev_json_iface,
-                           <<"name">> => <<"json-iface@1.0">>},
-                         #{<<"module">> => dev_lookup,
-                           <<"name">> => <<"lookup@1.0">>},
-                         #{<<"module">> => dev_lua,
-                           <<"name">> => <<"lua@5.3a">>},
-                         #{<<"module">> => dev_message,
-                           <<"name">> => <<"message@1.0">>},
-                         #{<<"module">> => dev_meta,
-                           <<"name">> => <<"meta@1.0">>},
-                         #{<<"module">> => dev_monitor,
-                           <<"name">> => <<"monitor@1.0">>},
-                         #{<<"module">> => dev_multipass,
-                           <<"name">> => <<"multipass@1.0">>},
-                         #{<<"module">> => dev_p4,<<"name">> => <<"p4@1.0">>},
-                         #{<<"module">> => dev_patch,
-                           <<"name">> => <<"patch@1.0">>},
-                         #{<<"module">> => dev_poda,
-                           <<"name">> => <<"poda@1.0">>},
-                         #{<<"module">> => dev_process,
-                           <<"name">> => <<"process@1.0">>},
-                         #{<<"module">> => dev_push,
-                           <<"name">> => <<"push@1.0">>},
-                         #{<<"module">> => dev_relay,
-                           <<"name">> => <<"relay@1.0">>},
-                         #{<<"module">> => dev_router,
-                           <<"name">> => <<"router@1.0">>},
-                         #{<<"module">> => dev_scheduler,
-                           <<"name">> => <<"scheduler@1.0">>},
-                         #{<<"module">> => dev_simple_pay,
-                           <<"name">> => <<"simple-pay@1.0">>},
-                         #{<<"module">> => dev_snp,
-                           <<"name">> => <<"snp@1.0">>},
-                         #{<<"module">> => dev_stack,
-                           <<"name">> => <<"stack@1.0">>},
-                         #{<<"module">> => dev_codec_structured,
-                           <<"name">> => <<"structured@1.0">>},
-                         #{<<"module">> => dev_test,
-                           <<"name">> => <<"test-device@1.0">>},
-                         #{<<"module">> => dev_wasi,
-                           <<"name">> => <<"wasi@1.0">>},
-                         #{<<"module">> => dev_wasm,
-                           <<"name">> => <<"wasm-64@1.0">>}],
-                    <<"cache_writers">> =>
-                        [<<"XgN1kN-ZyAWtYvdUlPEM3EIIi-budUx81mjcHQ1mSNU">>],
-                    <<"wasm_allow_aot">> => false,
-                    <<"store_all_signed">> => true,
-                    <<"ans104_trust_gql">> => true,
-                    <<"commitment_device">> => <<"httpsig@1.0">>,
-                    <<"preprocessor">> => undefined,
-                    <<"debug_committers">> => false,<<"port">> => 10000,
-                    <<"load_remote_devices">> => false,
-                    <<"node_history">> => [],<<"mode">> => debug,
-                    <<"trusted_device_signers">> => [],
-                    <<"debug_print_indent">> => 2,
-                    <<"host">> => <<"localhost">>},
-              <<"nonce">> =>
-                  <<"XgN1kN-ZyAWtYvdUlPEM3EIIi-budUx81mjcHQ1mSNU4bfGIgeSRG0fgGtFEdPTXAcI6szcsMPvbZmwMWraKxA">>,
-              <<"public-key">> =>
-                  <<"g2gCaAJ3A3JzYWIAAQABbQAAAgCj3ztG+laFiAMD2u171YmZWfCzbPphf+SGEGtA4EI7LFAbmWPeLtokhd8TBX5fcY9ZFIxD/uKciLgXDuhxQMhengRaGIJJTglPLDHNvByBHMfjZtOTwCwSbu5CshaoJhuKdD3ZCyfeqdbiOFylrXA8BJGW/e9gBAi7p5cq6WhekiPHysU4tPNON700VVaaPKk/2hKG2MjxjtV0SOOXkgsyq7ll/CUiyyxvH0nqMO832cwKPz6PVjIqH5Srdokp5jF7K1JJi8ZTiYesbePYdiihy30tc7BOHz2xexzuAK9Jp+kjyPtkUZGs/bwWFGEKPNiGIJPzx5+xbECOS/ULUlh/mMku0sV8SX5jf2OkY9echqh94wn1fZf9d/Hzoo4pKqg5T4OYUp8923gmOppp8jX8Cy/GnrR6dLUF2+B8uvfgryCrpjKizjsWvOGoJb8FY4Xvu+Cn7Dk9X61yza47WgqlSCHLV5pN5410oeOVCP2G46O/uQ4wEZ85a1kNbWw70KFgHcMNNPcADCjptWOPSKKLBYZvNZ5zBP048t61ELKZU8QW9NBZcrr7VC7dY2hioW0L+kWoej6jDFodLfvJJN8HUDTgLlrqbdMQ/2EtZ17nYLl+sx19yFi7Lmmqg2oxvezOcZFCE7CZxbFve6er23K0Bg2YSlCHNn6wdqlOzVjTzQ==">>,
-              <<"report">> =>
-                  <<"{\"version\":2,\"guest_svn\":0,\"policy\":196608,\"family_id\":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],\"image_id\":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],\"vmpl\":1,\"sig_algo\":1,\"current_tcb\":{\"bootloader\":4,\"tee\":0,\"_reserved\":[0,0,0,0],\"snp\":22,\"microcode\":213},\"plat_info\":3,\"_author_key_en\":0,\"_reserved_0\":0,\"report_data\":[94,3,117,144,223,153,200,5,173,98,247,84,148,241,12,220,66,8,139,230,238,117,76,124,214,104,220,29,13,102,72,213,56,109,241,136,129,228,145,27,71,224,26,209,68,116,244,215,1,194,58,179,55,44,48,251,219,102,108,12,90,182,138,196],\"measurement\":[57,145,156,83,216,77,75,73,242,17,131,95,71,138,47,87,91,44,72,35,26,227,241,105,23,212,36,168,251,224,172,31,33,175,179,197,217,106,227,52,65,65,10,56,83,147,108,11],\"host_data\":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],\"id_key_digest\":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],\"author_key_digest\":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],\"report_id\":[76,118,205,58,46,223,75,32,141,9,113,137,69,229,230,102,49,239,64,145,130,106,21,147,154,141,222,210,40,40,121,150],\"report_id_ma\":[255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255],\"reported_tcb\":{\"bootloader\":4,\"tee\":0,\"_reserved\":[0,0,0,0],\"snp\":22,\"microcode\":213},\"_reserved_1\":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],\"chip_id\":[6,154,118,21,12,115,53,47,251,19,195,100,155,12,239,102,116,131,103,189,106,202,153,3,114,175,16,182,24,166,229,214,231,126,164,15,129,52,233,142,196,43,43,8,89,238,118,246,21,144,209,16,165,197,134,105,214,250,155,148,50,78,87,203],\"committed_tcb\":{\"bootloader\":4,\"tee\":0,\"_reserved\":[0,0,0,0],\"snp\":22,\"microcode\":213},\"current_build\":20,\"current_minor\":55,\"current_major\":1,\"_reserved_2\":0,\"committed_build\":20,\"committed_minor\":55,\"committed_major\":1,\"_reserved_3\":0,\"launch_tcb\":{\"bootloader\":4,\"tee\":0,\"_reserved\":[0,0,0,0],\"snp\":22,\"microcode\":213},\"_reserved_4\":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],\"signature\":{\"r\":[208,7,136,60,224,138,74,102,17,217,164,154,114,117,150,30,151,247,93,90,52,122,13,58,58,169,124,13,168,74,187,144,221,165,218,93,104,175,212,214,248,23,142,13,132,232,208,5,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],\"s\":[67,238,106,198,241,37,137,212,124,29,212,20,95,170,10,247,160,213,57,13,223,123,32,246,242,28,76,121,72,170,113,199,14,128,130,162,198,59,138,105,227,27,136,207,243,245,201,196,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],\"_reserved\":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]}}">>,
-              <<"vcpu_type">> => 5,<<"vcpus">> => 1,<<"vmm_type">> => 1}.
\ No newline at end of file
+              <<"vcpu_type">> => 5,<<"vcpus">> => 1,<<"vmm_type">> => 1},
+        <<"snp_hashes">> =>
+            #{<<"append">> =>
+                  <<"aaf13c9ed2e821ea8c82fcc7981c73a14dc2d01c855f09262d42090fa0424422">>,
+              <<"firmware">> =>
+                  <<"b8c5d4082d5738db6b0fb0294174992738645df70c44cdecf7fad3a62244b788e7e408c582ee48a74b289f3acec78510">>,
+              <<"guest_features">> => 1,
+              <<"initrd">> =>
+                  <<"da6dffff50373e1d393bf92cb9b552198b1930068176a046dda4e23bb725b3bb">>,
+              <<"kernel">> =>
+                  <<"69d0cd7d13858e4fcef6bc7797aebd258730f215bc5642c4ad8e4b893cc67576">>,
+              <<"vcpu_type">> => 5,<<"vcpus">> => 1,<<"vmm_type">> => 1},
+        <<"cache_lookup_hueristics">> => false,
+        <<"address">> => <<"XgN1kN-ZyAWtYvdUlPEM3EIIi-budUx81mjcHQ1mSNU">>,
+        <<"store">> =>
+            [#{<<"prefix">> => <<"cache-mainnet">>,
+               <<"store-module">> => hb_store_fs},
+             #{<<"store">> =>
+                   [#{<<"prefix">> => <<"cache-mainnet">>,
+                      <<"store-module">> => hb_store_fs}],
+               <<"store-module">> => hb_store_gateway}],
+        <<"postprocessor">> => undefined,<<"debug_show_priv">> => false,
+        <<"routes">> =>
+            [#{<<"node">> => #{<<"prefix">> => <<"http://localhost:6363">>},
+               <<"template">> => <<"/result/.*">>},
+             #{<<"nodes">> =>
+                   [#{<<"opts">> =>
+                          #{<<"http_client">> => httpc,
+                            <<"protocol">> => http2},
+                      <<"prefix">> =>
+                          <<"https://arweave-search.goldsky.com">>},
+                    #{<<"opts">> =>
+                          #{<<"http_client">> => gun,<<"protocol">> => http2},
+                      <<"prefix">> => <<"https://arweave.net">>}],
+               <<"template">> => <<"/graphql">>},
+             #{<<"node">> =>
+                   #{<<"opts">> =>
+                         #{<<"http_client">> => gun,<<"protocol">> => http2},
+                     <<"prefix">> => <<"https://arweave.net">>},
+               <<"template">> => <<"/raw">>}],
+        <<"debug_print">> => false,
+        <<"bundler_ans104">> => <<"https://up.arweave.net:443">>,
+        <<"client_error_strategy">> => throw,
+        <<"http_request_send_timeout">> => 60000,
+        <<"http_extra_opts">> =>
+            #{<<"cache_control">> => [<<"always">>],
+              <<"force_message">> => true},
+        <<"force_signed">> => true,
+        <<"server">> => <<"nginx/1.18.0 (Ubuntu)">>,
+        <<"access_remote_cache_for_client">> => false,
+        <<"await_inprogress">> => named,
+        <<"content_type">> =>
+            <<"multipart/form-data; boundary=\"5zd5yKhUfgSnCzBVlt29-Vs4rQQeUBGuVqNJubt07jI\"">>,
+        <<"http_connect_timeout">> => 5000,<<"status">> => 200,
+        <<"body_keys">> =>
+            <<"\"routes\", \"routes\", \"routes\", \"routes\", \"routes\", \"routes\", \"routes\", \"routes\", \"routes\", \"routes\"">>,
+        <<"stack_print_prefixes">> => ["hb","dev","ar"],
+        <<"scheduling_mode">> => disabled,
+        <<"http_server">> => <<"XgN1kN-ZyAWtYvdUlPEM3EIIi-budUx81mjcHQ1mSNU">>,
+        <<"debug_print_binary_max">> => 60,<<"debug_ids">> => false,
+        <<"relay_http_client">> => httpc,<<"debug_stack_depth">> => 40,
+        <<"preloaded_devices">> =>
+            [#{<<"module">> => dev_codec_ans104,
+               <<"name">> => <<"ans104@1.0">>},
+             #{<<"module">> => dev_cu,<<"name">> => <<"compute@1.0">>},
+             #{<<"module">> => dev_cache,<<"name">> => <<"cache@1.0">>},
+             #{<<"module">> => dev_cacheviz,<<"name">> => <<"cacheviz@1.0">>},
+             #{<<"module">> => dev_cron,<<"name">> => <<"cron@1.0">>},
+             #{<<"module">> => dev_dedup,<<"name">> => <<"dedup@1.0">>},
+             #{<<"module">> => dev_delegated_compute,
+               <<"name">> => <<"delegated-compute@1.0">>},
+             #{<<"module">> => dev_faff,<<"name">> => <<"faff@1.0">>},
+             #{<<"module">> => dev_codec_flat,<<"name">> => <<"flat@1.0">>},
+             #{<<"module">> => dev_genesis_wasm,
+               <<"name">> => <<"genesis-wasm@1.0">>},
+             #{<<"module">> => dev_green_zone,
+               <<"name">> => <<"greenzone@1.0">>},
+             #{<<"module">> => dev_codec_httpsig,
+               <<"name">> => <<"httpsig@1.0">>},
+             #{<<"module">> => dev_hyperbuddy,
+               <<"name">> => <<"hyperbuddy@1.0">>},
+             #{<<"module">> => dev_codec_json,<<"name">> => <<"json@1.0">>},
+             #{<<"module">> => dev_json_iface,
+               <<"name">> => <<"json-iface@1.0">>},
+             #{<<"module">> => dev_lookup,<<"name">> => <<"lookup@1.0">>},
+             #{<<"module">> => dev_lua,<<"name">> => <<"lua@5.3a">>},
+             #{<<"module">> => dev_message,<<"name">> => <<"message@1.0">>},
+             #{<<"module">> => dev_meta,<<"name">> => <<"meta@1.0">>},
+             #{<<"module">> => dev_monitor,<<"name">> => <<"monitor@1.0">>},
+             #{<<"module">> => dev_multipass,
+               <<"name">> => <<"multipass@1.0">>},
+             #{<<"module">> => dev_p4,<<"name">> => <<"p4@1.0">>},
+             #{<<"module">> => dev_patch,<<"name">> => <<"patch@1.0">>},
+             #{<<"module">> => dev_poda,<<"name">> => <<"poda@1.0">>},
+             #{<<"module">> => dev_process,<<"name">> => <<"process@1.0">>},
+             #{<<"module">> => dev_push,<<"name">> => <<"push@1.0">>},
+             #{<<"module">> => dev_relay,<<"name">> => <<"relay@1.0">>},
+             #{<<"module">> => dev_router,<<"name">> => <<"router@1.0">>},
+             #{<<"module">> => dev_scheduler,
+               <<"name">> => <<"scheduler@1.0">>},
+             #{<<"module">> => dev_simple_pay,
+               <<"name">> => <<"simple-pay@1.0">>},
+             #{<<"module">> => dev_snp,<<"name">> => <<"snp@1.0">>},
+             #{<<"module">> => dev_stack,<<"name">> => <<"stack@1.0">>},
+             #{<<"module">> => dev_codec_structured,
+               <<"name">> => <<"structured@1.0">>},
+             #{<<"module">> => dev_test,<<"name">> => <<"test-device@1.0">>},
+             #{<<"module">> => dev_wasi,<<"name">> => <<"wasi@1.0">>},
+             #{<<"module">> => dev_wasm,<<"name">> => <<"wasm-64@1.0">>}],
+        <<"cache_writers">> =>
+            [<<"XgN1kN-ZyAWtYvdUlPEM3EIIi-budUx81mjcHQ1mSNU">>],
+        <<"wasm_allow_aot">> => false,<<"store_all_signed">> => true,
+        <<"ans104_trust_gql">> => true,
+        <<"commitment_device">> => <<"httpsig@1.0">>,
+        <<"preprocessor">> => undefined,<<"debug_committers">> => false,
+        <<"port">> => 10000,<<"load_remote_devices">> => false,
+        <<"node_history">> => [],<<"mode">> => debug,
+        <<"trusted_device_signers">> => [],<<"debug_print_indent">> => 2,
+        <<"host">> => <<"localhost">>},
+  <<"nonce">> =>
+      <<"XgN1kN-ZyAWtYvdUlPEM3EIIi-budUx81mjcHQ1mSNU4bfGIgeSRG0fgGtFEdPTXAcI6szcsMPvbZmwMWraKxA">>,
+  <<"public-key">> =>
+      <<"g2gCaAJ3A3JzYWIAAQABbQAAAgCj3ztG+laFiAMD2u171YmZWfCzbPphf+SGEGtA4EI7LFAbmWPeLtokhd8TBX5fcY9ZFIxD/uKciLgXDuhxQMhengRaGIJJTglPLDHNvByBHMfjZtOTwCwSbu5CshaoJhuKdD3ZCyfeqdbiOFylrXA8BJGW/e9gBAi7p5cq6WhekiPHysU4tPNON700VVaaPKk/2hKG2MjxjtV0SOOXkgsyq7ll/CUiyyxvH0nqMO832cwKPz6PVjIqH5Srdokp5jF7K1JJi8ZTiYesbePYdiihy30tc7BOHz2xexzuAK9Jp+kjyPtkUZGs/bwWFGEKPNiGIJPzx5+xbECOS/ULUlh/mMku0sV8SX5jf2OkY9echqh94wn1fZf9d/Hzoo4pKqg5T4OYUp8923gmOppp8jX8Cy/GnrR6dLUF2+B8uvfgryCrpjKizjsWvOGoJb8FY4Xvu+Cn7Dk9X61yza47WgqlSCHLV5pN5410oeOVCP2G46O/uQ4wEZ85a1kNbWw70KFgHcMNNPcADCjptWOPSKKLBYZvNZ5zBP048t61ELKZU8QW9NBZcrr7VC7dY2hioW0L+kWoej6jDFodLfvJJN8HUDTgLlrqbdMQ/2EtZ17nYLl+sx19yFi7Lmmqg2oxvezOcZFCE7CZxbFve6er23K0Bg2YSlCHNn6wdqlOzVjTzQ==">>,
+  <<"report">> =>
+      <<"{\"version\":2,\"guest_svn\":0,\"policy\":196608,\"family_id\":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],\"image_id\":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],\"vmpl\":1,\"sig_algo\":1,\"current_tcb\":{\"bootloader\":4,\"tee\":0,\"_reserved\":[0,0,0,0],\"snp\":22,\"microcode\":213},\"plat_info\":3,\"_author_key_en\":0,\"_reserved_0\":0,\"report_data\":[94,3,117,144,223,153,200,5,173,98,247,84,148,241,12,220,66,8,139,230,238,117,76,124,214,104,220,29,13,102,72,213,56,109,241,136,129,228,145,27,71,224,26,209,68,116,244,215,1,194,58,179,55,44,48,251,219,102,108,12,90,182,138,196],\"measurement\":[57,145,156,83,216,77,75,73,242,17,131,95,71,138,47,87,91,44,72,35,26,227,241,105,23,212,36,168,251,224,172,31,33,175,179,197,217,106,227,52,65,65,10,56,83,147,108,11],\"host_data\":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],\"id_key_digest\":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],\"author_key_digest\":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],\"report_id\":[76,118,205,58,46,223,75,32,141,9,113,137,69,229,230,102,49,239,64,145,130,106,21,147,154,141,222,210,40,40,121,150],\"report_id_ma\":[255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255],\"reported_tcb\":{\"bootloader\":4,\"tee\":0,\"_reserved\":[0,0,0,0],\"snp\":22,\"microcode\":213},\"_reserved_1\":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],\"chip_id\":[6,154,118,21,12,115,53,47,251,19,195,100,155,12,239,102,116,131,103,189,106,202,153,3,114,175,16,182,24,166,229,214,231,126,164,15,129,52,233,142,196,43,43,8,89,238,118,246,21,144,209,16,165,197,134,105,214,250,155,148,50,78,87,203],\"committed_tcb\":{\"bootloader\":4,\"tee\":0,\"_reserved\":[0,0,0,0],\"snp\":22,\"microcode\":213},\"current_build\":20,\"current_minor\":55,\"current_major\":1,\"_reserved_2\":0,\"committed_build\":20,\"committed_minor\":55,\"committed_major\":1,\"_reserved_3\":0,\"launch_tcb\":{\"bootloader\":4,\"tee\":0,\"_reserved\":[0,0,0,0],\"snp\":22,\"microcode\":213},\"_reserved_4\":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],\"signature\":{\"r\":[208,7,136,60,224,138,74,102,17,217,164,154,114,117,150,30,151,247,93,90,52,122,13,58,58,169,124,13,168,74,187,144,221,165,218,93,104,175,212,214,248,23,142,13,132,232,208,5,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],\"s\":[67,238,106,198,241,37,137,212,124,29,212,20,95,170,10,247,160,213,57,13,223,123,32,246,242,28,76,121,72,170,113,199,14,128,130,162,198,59,138,105,227,27,136,207,243,245,201,196,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],\"_reserved\":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]}}">>,
+  <<"vcpu_type">> => 5,<<"vcpus">> => 1,<<"vmm_type">> => 1}.
\ No newline at end of file
diff --git a/test/test.lua b/test/test.lua
index 8614a3341..01c29e43f 100644
--- a/test/test.lua
+++ b/test/test.lua
@@ -98,11 +98,11 @@ function sandboxed_fail()
     return os.getenv("PWD")
 end
 
---- @function route_provider
+--- @function provider
 --- @tparam table base
 --- @tparam table request
 --- @return table a static set of routes for testing purposes.
-function route_provider(base, req, opts)
+function provider(base, req, opts)
     return {
         {
             node = base.node
@@ -149,4 +149,10 @@ function compute_routes(base, req, opts)
         }
     end
     return base
+end
+
+function inc(base, req, opts)
+    base.count = base.count or 0
+    base.count = base.count + 1
+    return base
 end
\ No newline at end of file