diff --git a/GNUmakefile b/GNUmakefile
index 91548fda..f367effb 100644
--- a/GNUmakefile
+++ b/GNUmakefile
@@ -10,27 +10,25 @@ tap_device=tap0
 check-kvm:
 	$(if $(wildcard /dev/kvm),,$(error KVM support not enabled))
 
-# todo: just opam install . --deps-only?
+pins:
+	#opam pin --no-action --yes "git+https://github.com/robur-coop/mcrunch.git#682ed63c03e3be5664f96c469a260e1d9e9df011"
+	opam pin --no-action --yes "git+https://github.com/mirage/Zarith.git#zarith-1.14"
+	opam pin --no-action --yes "git+https://github.com/robur-coop/vif.git#8c6ac3fb97cb9a31bf6ad8ec63c942336dcfd03e"
+	opam pin --no-action --yes "git+https://github.com/robur-coop/mfat.git#5b1204d914e853f0139c6d2776511f530b753550"
+	opam pin --no-action --yes "git+https://github.com/swrup/mirage-mtime.git#6a6bb4dd25624a3c43e6417dcdf73f3c689946a7"
+	opam pin --no-action --yes add caqti "git+https://github.com/swrup/ocaml-caqti.git#186650581efd9d247ced982cdefd74256905e3b0"
+	opam pin --no-action --yes add caqti-miou "git+https://github.com/swrup/ocaml-caqti.git#186650581efd9d247ced982cdefd74256905e3b0"
+	opam pin --no-action --yes add caqti-mnet "git+https://github.com/swrup/ocaml-caqti.git#186650581efd9d247ced982cdefd74256905e3b0"
+	opam pin --no-action --yes add caqti-driver-pgx "git+https://github.com/swrup/ocaml-caqti.git#186650581efd9d247ced982cdefd74256905e3b0"
+
 installs:
-	opam install --yes dune utop merlin ocp-browser ocamlformat
 	# opam install --yes mcrunch
+	opam install --yes dune utop merlin ocp-browser ocamlformat
 	opam install --yes crunch
 	opam install --yes sqlite3 # needed for caqti even if not used
 	opam install --yes caqti-driver-pgx
 	opam install --yes $(vendor_list)
 
-pins:
-	opam pin --no-action --yes "git+https://github.com/robur-coop/mcrunch.git#682ed63c03e3be5664f96c469a260e1d9e9df011"
-	opam pin --no-action --yes "git+https://github.com/mirage/Zarith.git#zarith-1.14"
-	opam pin --no-action --yes "git+https://github.com/swrup/mirage-mtime.git#6a6bb4dd25624a3c43e6417dcdf73f3c689946a7"
-	opam pin --no-action --yes "git+https://github.com/robur-coop/vif.git#8c6ac3fb97cb9a31bf6ad8ec63c942336dcfd03e"
-	opam pin --no-action --yes add caqti "git+https://github.com/swrup/ocaml-caqti.git#7838c29ffa9095d32b95affee26b22ef2ad302fd"
-	opam pin --no-action --yes add caqti-miou "git+https://github.com/swrup/ocaml-caqti.git#7838c29ffa9095d32b95affee26b22ef2ad302fd"
-	opam pin --no-action --yes add caqti-mnet "git+https://github.com/swrup/ocaml-caqti.git#7838c29ffa9095d32b95affee26b22ef2ad302fd"
-	opam pin --no-action --yes add caqti-driver-pgx "git+https://github.com/swrup/ocaml-caqti.git#7838c29ffa9095d32b95affee26b22ef2ad302fd"
-	opam pin --no-action --yes "git+https://github.com/robur-coop/mfat.git#5b1204d914e853f0139c6d2776511f530b753550"
-
-
 .PHONY: vendors
 vendors:
 	@mkdir -p vendors
@@ -43,19 +41,19 @@ clean:
 	rm -rf _build/
 	rm -rf vendors/
 
-# todo: don't erase already existing
+assets:
+	@cp default/assets ./
+
 secmod.fat:
 	@mkdir -p assets
 	mfat make --sectors=2048 $(secmod_fat)
 
-assets:
-	cp default/assets ./
-
 manifest:
-	dune exec src/mte.exe > src/manifest.json
+	@dune exec src/mte.exe > src/manifest.json
 
 build:
-	dune build --workspace dune-workspace.solo5 src/mte.exe
+	@dune build @all
+	@dune build --workspace dune-workspace.solo5 src/mte.exe
 
 run: build
-	solo5-hvt --block:storage=$(secmod_fat) --net:service=$(tap_device) -- ./_build/solo5/src/mte.exe --solo5:quiet
+	@solo5-hvt --block:storage=$(secmod_fat) --net:service=$(tap_device) -- ./_build/solo5/src/mte.exe
diff --git a/dune-project b/dune-project
index eb3e0b72..75e32c5d 100644
--- a/dune-project
+++ b/dune-project
@@ -1,2 +1,4 @@
 (lang dune 3.20)
 (name mte)
+
+; (implicit_transitive_deps false)
diff --git a/src/dune b/src/dune
index 641708ae..b3e32408 100644
--- a/src/dune
+++ b/src/dune
@@ -36,9 +36,7 @@
   caqti-miou
   caqti-mnet
   caqti-driver-pgx
-  pgx
-  ;
-  )
+  pgx)
  (foreign_stubs
   (language c)
   (names manifest)))
@@ -64,21 +62,28 @@
   signatures
   api)
  (libraries
-  b32
+  (re_export b32)
   ;
+  angstrom
   fmt
   logs
   logs.fmt
+  fpath
+  cohttp
   bin
   caqti
   jsont
   jsont.bytesrw
   digestif
   kdf.hkdf
+  zarith
+  eqaf
   mirage-crypto-ec
   mirage-crypto-pk
-  fpath
-  cohttp))
+  ptime
+  uri
+  ;
+  ))
 
 (library ; crockford base32
  (name b32)
diff --git a/test/dune b/test/dune
index cfea041f..94ac0caa 100644
--- a/test/dune
+++ b/test/dune
@@ -7,7 +7,7 @@
  (public_name mte-validate)
  (name validate)
  (modules validate)
- (libraries mte bos cmdliner))
+ (libraries mte cmdliner bos fmt fpath))
 
 (cram
  (deps
diff --git a/test/management.sh b/test/management.sh
index f32fd370..046ed9f8 100755
--- a/test/management.sh
+++ b/test/management.sh
@@ -12,53 +12,53 @@ zero_kudos="KUDOS:0.0"
 
 # TODO launch mte.exe and kill it a then end with its PID
 
-offline_tool() {
-   dune exec offline -- "$@" > /dev/null
+mte-offline-tool() {
+   dune exec mte-offline-tool -- "$@" > /dev/null
 }
 
-offline_tool download --output $a --url $url"/management/keys"
-offline_tool sign \
+mte-offline-tool download --output $a --url $url"/management/keys"
+mte-offline-tool sign \
 --master_key $master_key \
 --input $a \
 --output $b
-offline_tool upload --input $b --url $url"/management/keys"
+mte-offline-tool upload --input $b --url $url"/management/keys"
 echo "[OK] /management/keys"
 
-offline_tool download --output $a --url $url"/keys"
+mte-offline-tool download --output $a --url $url"/keys"
 rsa_pub=$(jq -r '.denominations[0].denoms[0].rsa_pub' $a)
-h_denom=$(dune exec offline -- compute-denomination-hash $rsa_pub)
-offline_tool revoke-denom \
+h_denom=$(dune exec mte-offline-tool -- compute-denomination-hash $rsa_pub)
+mte-offline-tool revoke-denom \
 --master_key $master_key \
 --output $b \
 $h_denom
-offline_tool upload --input $b --url $url"/management/denominations/"$h_denom"/revoke"
+mte-offline-tool upload --input $b --url $url"/management/denominations/"$h_denom"/revoke"
 echo "[OK] /management/denominations/\$H_DENOM/revoke"
 
 pub=$(jq -r '.signkeys[0].key' $a)
-offline_tool revoke-signkey \
+mte-offline-tool revoke-signkey \
 --master_key $master_key \
 --output $b \
 $pub
-offline_tool upload --input $b --url $url"/management/signkeys/"$pub"/revoke"
+mte-offline-tool upload --input $b --url $url"/management/signkeys/"$pub"/revoke"
 echo "[OK] /management/signkeys/\$EXCHANGE_PUB/revoke"
 
-offline_tool enable-auditor \
+mte-offline-tool enable-auditor \
 --master_key $master_key \
 --output $b \
 --auditor_url "auditor.example.com" \
 --auditor_name "auditor example" \
 --auditor_pub $auditor_pub
-offline_tool upload --input $b --url $url"/management/auditors"
+mte-offline-tool upload --input $b --url $url"/management/auditors"
 echo "[OK] /management/auditors"
 
-offline_tool disable-auditor \
+mte-offline-tool disable-auditor \
 --master_key $master_key \
 --output $b \
 --auditor_pub $auditor_pub
-offline_tool upload --input $b --url $url"/management/auditors/"$auditor_pub"/disable"
+mte-offline-tool upload --input $b --url $url"/management/auditors/"$auditor_pub"/disable"
 echo "[OK] /management/auditors/\$AUDITOR_PUB/disable"
 
-offline_tool wire-fee \
+mte-offline-tool wire-fee \
 --master_key $master_key \
 --output $b \
 --wire_method "x-taler-bank" \
@@ -66,10 +66,10 @@ offline_tool wire-fee \
 --fee_end 99999999 \
 --closing_fee $zero_kudos \
 --wire_fee $zero_kudos
-offline_tool upload --input $b --url $url"/management/wire-fee"
+mte-offline-tool upload --input $b --url $url"/management/wire-fee"
 echo "[OK] /management/wire-fee"
 
-offline_tool global-fees \
+mte-offline-tool global-fees \
 --master_key $master_key \
 --output $b \
 --start_date 0 \
@@ -80,28 +80,28 @@ offline_tool global-fees \
 --history_expiration 9999999 \
 --purse_account_limit 1 \
 --purse_timeout 9999999
-offline_tool upload --input $b --url $url"/management/global-fees"
+mte-offline-tool upload --input $b --url $url"/management/global-fees"
 echo "[OK] /management/global-fees"
 
-offline_tool enable-wire \
+mte-offline-tool enable-wire \
 --master_key $master_key \
 --output $b \
 --payto_uri "" \
 --bank_label "" \
 --priority 4
-offline_tool upload --input $b --url $url"/management/wire"
+mte-offline-tool upload --input $b --url $url"/management/wire"
 echo "[OK] /management/wire"
 
-offline_tool disable-wire \
+mte-offline-tool disable-wire \
 --master_key $master_key \
 --output $b \
 --payto_uri ""
-offline_tool upload --input $b --url $url"/management/wire/disable"
+mte-offline-tool upload --input $b --url $url"/management/wire/disable"
 echo "[OK] /management/wire/disable"
 
 # wtid (after base32 decode) must be 32bytes
 wtid="000G40R40M30E209185GR38E1W8124GK2GAHC5RR34D1P70X3RFG"
-offline_tool drain \
+mte-offline-tool drain \
 --master_key $master_key \
 --output $b \
 --debit_account_section "" \
@@ -109,12 +109,12 @@ offline_tool drain \
 --wtid $wtid \
 --date 0 \
 --amount $zero_kudos
-offline_tool upload --input $b --url $url"/management/drain"
+mte-offline-tool upload --input $b --url $url"/management/drain"
 echo "[OK] /management/drain"
 
 demo_keys="test/keys.demo.taler.net.v31_0_9.json"
-dune exec test/validate_response.exe -- keys --input $demo_keys
+mte-validate keys $demo_keys
 echo "[OK] exchange.demo.taler.net/keys validation"
-offline_tool download --output $a --url $url"/keys"
-dune exec test/validate_response.exe -- keys --input $a
+mte-offline-tool download --output $a --url $url"/keys"
+mte-validate keys $a
 echo "[OK] /keys validation"
diff --git a/tools/dune b/tools/dune
index 0a60a05b..571459d6 100644
--- a/tools/dune
+++ b/tools/dune
@@ -2,13 +2,23 @@
  (public_name mte-offline-tool)
  (name offline)
  (modules offline offline_impl)
- (libraries mte mtime mtime.clock mirage-crypto-rng.unix cmdliner bos fmt))
+ (libraries
+  mte
+  mtime
+  mtime.clock
+  mirage-crypto-rng.unix
+  mirage-crypto-ec
+  mirage-crypto-pk
+  cmdliner
+  bos
+  fmt
+  fpath))
 
 (executable
  (public_name gen_registry_files)
  (name gen_registry_files)
  (modules gen_registry_files)
- (libraries recfile_parser cmdliner bos fmt))
+ (libraries recfile_parser cmdliner bos fmt fpath))
 
 (library
  (name recfile_parser)