From f2c33a5bf43d61280e07ce9e9dbd8d61e8dac844 Mon Sep 17 00:00:00 2001
From: hdbg <httpdebugger@protonmail.com>
Date: Thu, 19 Mar 2026 00:05:55 +0100
Subject: [PATCH] refactor(useragent): using request/response for correct
 multiplexing behaviour

---
 useragent/lib/features/connection/auth.dart   |  19 +-
 .../lib/features/connection/connection.dart   | 112 +++++++--
 useragent/lib/features/connection/evm.dart    |  12 +-
 .../lib/features/connection/evm/grants.dart   |  14 +-
 useragent/lib/features/connection/vault.dart  |  12 +-
 useragent/lib/proto/client.pb.dart            | 218 +++++++-----------
 useragent/lib/proto/client.pbenum.dart        |  72 ++++--
 useragent/lib/proto/client.pbjson.dart        | 154 +++++++------
 useragent/lib/proto/user_agent.pb.dart        | 102 +++-----
 useragent/lib/proto/user_agent.pbenum.dart    |  45 +++-
 useragent/lib/proto/user_agent.pbjson.dart    | 177 +++++++++-----
 useragent/lib/providers/vault_state.dart      |   4 +-
 useragent/lib/providers/vault_state.g.dart    |   2 +-
 13 files changed, 552 insertions(+), 391 deletions(-)

diff --git a/useragent/lib/features/connection/auth.dart b/useragent/lib/features/connection/auth.dart
index 9e432b8..fa95e4e 100644
--- a/useragent/lib/features/connection/auth.dart
+++ b/useragent/lib/features/connection/auth.dart
@@ -30,15 +30,18 @@ Future<Connection> connectAndAuthorize(
         KeyAlgorithm.ed25519 => KeyType.KEY_TYPE_ED25519,
       },
     );
-    await connection.send(UserAgentRequest(authChallengeRequest: req));
+    final response = await connection.request(
+      UserAgentRequest(authChallengeRequest: req),
+    );
     talker.info(
       "Sent auth challenge request with pubkey ${base64Encode(pubkey)}",
     );
-
-    final response = await connection.receive();
     talker.info('Received response from server, checking auth flow...');
 
-    if (response.hasAuthOk()) {
+    if (response.hasAuthResult()) {
+      if (response.authResult != AuthResult.AUTH_RESULT_SUCCESS) {
+        throw Exception('Authentication failed: ${response.authResult}');
+      }
       talker.info('Authentication successful, connection established');
       return connection;
     }
@@ -55,18 +58,20 @@ Future<Connection> connectAndAuthorize(
     );
 
     final signature = await key.sign(challenge);
-    await connection.send(
+    final solutionResponse = await connection.request(
       UserAgentRequest(authChallengeSolution: AuthChallengeSolution(signature: signature)),
     );
 
     talker.info('Sent auth challenge solution, waiting for server response...');
 
-    final solutionResponse = await connection.receive();
-    if (!solutionResponse.hasAuthOk()) {
+    if (!solutionResponse.hasAuthResult()) {
       throw Exception(
         'Expected AuthChallengeSolutionResponse, got ${solutionResponse.whichPayload()}',
       );
     }
+    if (solutionResponse.authResult != AuthResult.AUTH_RESULT_SUCCESS) {
+      throw Exception('Authentication failed: ${solutionResponse.authResult}');
+    }
 
     talker.info('Authentication successful, connection established');
     return connection;
diff --git a/useragent/lib/features/connection/connection.dart b/useragent/lib/features/connection/connection.dart
index 726a8d5..b5d4a38 100644
--- a/useragent/lib/features/connection/connection.dart
+++ b/useragent/lib/features/connection/connection.dart
@@ -5,33 +5,113 @@ import 'package:grpc/grpc.dart';
 import 'package:mtcore/markettakers.dart';
 
 class Connection {
-  final ClientChannel channel;
-  final StreamController<UserAgentRequest> _tx;
-  final StreamIterator<UserAgentResponse> _rx;
-
   Connection({
     required this.channel,
     required StreamController<UserAgentRequest> tx,
     required ResponseStream<UserAgentResponse> rx,
-  }) : _tx = tx,
-       _rx = StreamIterator(rx);
-
-  Future<void> send(UserAgentRequest request) async {
-    talker.debug('Sending request: ${request.toDebugString()}');
-    _tx.add(request);
+  }) : _tx = tx {
+    _rxSubscription = rx.listen(
+      _handleResponse,
+      onError: _handleError,
+      onDone: _handleDone,
+      cancelOnError: true,
+    );
   }
 
-  Future<UserAgentResponse> receive() async {
-    final hasValue = await _rx.moveNext();
-    if (!hasValue) {
-      throw Exception('Connection closed while waiting for server response.');
+  final ClientChannel channel;
+  final StreamController<UserAgentRequest> _tx;
+  final Map<int, Completer<UserAgentResponse>> _pendingRequests = {};
+  final StreamController<UserAgentResponse> _outOfBandMessages =
+      StreamController<UserAgentResponse>.broadcast();
+
+  StreamSubscription<UserAgentResponse>? _rxSubscription;
+  int _nextRequestId = 0;
+
+  Stream<UserAgentResponse> get outOfBandMessages => _outOfBandMessages.stream;
+
+  Future<UserAgentResponse> request(UserAgentRequest message) async {
+    _ensureOpen();
+
+    final requestId = _nextRequestId++;
+    final completer = Completer<UserAgentResponse>();
+    _pendingRequests[requestId] = completer;
+
+    message.id = requestId;
+    talker.debug('Sending request: ${message.toDebugString()}');
+
+    try {
+      _tx.add(message);
+    } catch (error, stackTrace) {
+      _pendingRequests.remove(requestId);
+      completer.completeError(error, stackTrace);
     }
-    talker.debug('Received response: ${_rx.current.toDebugString()}');
-    return _rx.current;
+
+    return completer.future;
   }
 
   Future<void> close() async {
+    final rxSubscription = _rxSubscription;
+    if (rxSubscription == null) {
+      return;
+    }
+
+    _rxSubscription = null;
+    await rxSubscription.cancel();
+    _failPendingRequests(Exception('Connection closed.'));
+    await _outOfBandMessages.close();
     await _tx.close();
     await channel.shutdown();
   }
+
+  void _handleResponse(UserAgentResponse response) {
+    talker.debug('Received response: ${response.toDebugString()}');
+
+    if (response.hasId()) {
+      final completer = _pendingRequests.remove(response.id);
+      if (completer == null) {
+        talker.warning('Received response for unknown request id ${response.id}');
+        return;
+      }
+      completer.complete(response);
+      return;
+    }
+
+    _outOfBandMessages.add(response);
+  }
+
+  void _handleError(Object error, StackTrace stackTrace) {
+    _rxSubscription = null;
+    _failPendingRequests(error, stackTrace);
+    _outOfBandMessages.addError(error, stackTrace);
+  }
+
+  void _handleDone() {
+    if (_rxSubscription == null) {
+      return;
+    }
+
+    _rxSubscription = null;
+    final error = Exception(
+      'Connection closed while waiting for server response.',
+    );
+    _failPendingRequests(error);
+    _outOfBandMessages.close();
+  }
+
+  void _failPendingRequests(Object error, [StackTrace? stackTrace]) {
+    final pendingRequests = _pendingRequests.values.toList(growable: false);
+    _pendingRequests.clear();
+
+    for (final completer in pendingRequests) {
+      if (!completer.isCompleted) {
+        completer.completeError(error, stackTrace);
+      }
+    }
+  }
+
+  void _ensureOpen() {
+    if (_rxSubscription == null) {
+      throw StateError('Connection is closed.');
+    }
+  }
 }
diff --git a/useragent/lib/features/connection/evm.dart b/useragent/lib/features/connection/evm.dart
index 5ceb422..aae5a9d 100644
--- a/useragent/lib/features/connection/evm.dart
+++ b/useragent/lib/features/connection/evm.dart
@@ -4,9 +4,9 @@ import 'package:arbiter/proto/user_agent.pb.dart';
 import 'package:protobuf/well_known_types/google/protobuf/empty.pb.dart';
 
 Future<List<WalletEntry>> listEvmWallets(Connection connection) async {
-  await connection.send(UserAgentRequest(evmWalletList: Empty()));
-
-  final response = await connection.receive();
+  final response = await connection.request(
+    UserAgentRequest(evmWalletList: Empty()),
+  );
   if (!response.hasEvmWalletList()) {
     throw Exception(
       'Expected EVM wallet list response, got ${response.whichPayload()}',
@@ -25,9 +25,9 @@ Future<List<WalletEntry>> listEvmWallets(Connection connection) async {
 }
 
 Future<void> createEvmWallet(Connection connection) async {
-  await connection.send(UserAgentRequest(evmWalletCreate: Empty()));
-
-  final response = await connection.receive();
+  final response = await connection.request(
+    UserAgentRequest(evmWalletCreate: Empty()),
+  );
   if (!response.hasEvmWalletCreate()) {
     throw Exception(
       'Expected EVM wallet create response, got ${response.whichPayload()}',
diff --git a/useragent/lib/features/connection/evm/grants.dart b/useragent/lib/features/connection/evm/grants.dart
index f4bfd6f..08550e3 100644
--- a/useragent/lib/features/connection/evm/grants.dart
+++ b/useragent/lib/features/connection/evm/grants.dart
@@ -13,9 +13,9 @@ Future<List<GrantEntry>> listEvmGrants(
     request.walletId = walletId;
   }
 
-  await connection.send(UserAgentRequest(evmGrantList: request));
-
-  final response = await connection.receive();
+  final response = await connection.request(
+    UserAgentRequest(evmGrantList: request),
+  );
   if (!response.hasEvmGrantList()) {
     throw Exception(
       'Expected EVM grant list response, got ${response.whichPayload()}',
@@ -45,7 +45,7 @@ Future<int> createEvmGrant(
   TransactionRateLimit? rateLimit,
   required SpecificGrant specific,
 }) async {
-  await connection.send(
+  final response = await connection.request(
     UserAgentRequest(
       evmGrantCreate: EvmGrantCreateRequest(
         clientId: clientId,
@@ -62,8 +62,6 @@ Future<int> createEvmGrant(
       ),
     ),
   );
-
-  final response = await connection.receive();
   if (!response.hasEvmGrantCreate()) {
     throw Exception(
       'Expected EVM grant create response, got ${response.whichPayload()}',
@@ -82,11 +80,9 @@ Future<int> createEvmGrant(
 }
 
 Future<void> deleteEvmGrant(Connection connection, int grantId) async {
-  await connection.send(
+  final response = await connection.request(
     UserAgentRequest(evmGrantDelete: EvmGrantDeleteRequest(grantId: grantId)),
   );
-
-  final response = await connection.receive();
   if (!response.hasEvmGrantDelete()) {
     throw Exception(
       'Expected EVM grant delete response, got ${response.whichPayload()}',
diff --git a/useragent/lib/features/connection/vault.dart b/useragent/lib/features/connection/vault.dart
index 92f3048..ae57243 100644
--- a/useragent/lib/features/connection/vault.dart
+++ b/useragent/lib/features/connection/vault.dart
@@ -10,7 +10,7 @@ Future<BootstrapResult> bootstrapVault(
 ) async {
   final encryptedKey = await _encryptVaultKeyMaterial(connection, password);
 
-  await connection.send(
+  final response = await connection.request(
     UserAgentRequest(
       bootstrapEncryptedKey: BootstrapEncryptedKey(
         nonce: encryptedKey.nonce,
@@ -19,8 +19,6 @@ Future<BootstrapResult> bootstrapVault(
       ),
     ),
   );
-
-  final response = await connection.receive();
   if (!response.hasBootstrapResult()) {
     throw Exception(
       'Expected bootstrap result, got ${response.whichPayload()}',
@@ -33,7 +31,7 @@ Future<BootstrapResult> bootstrapVault(
 Future<UnsealResult> unsealVault(Connection connection, String password) async {
   final encryptedKey = await _encryptVaultKeyMaterial(connection, password);
 
-  await connection.send(
+  final response = await connection.request(
     UserAgentRequest(
       unsealEncryptedKey: UnsealEncryptedKey(
         nonce: encryptedKey.nonce,
@@ -42,8 +40,6 @@ Future<UnsealResult> unsealVault(Connection connection, String password) async {
       ),
     ),
   );
-
-  final response = await connection.receive();
   if (!response.hasUnsealResult()) {
     throw Exception('Expected unseal result, got ${response.whichPayload()}');
   }
@@ -60,11 +56,9 @@ Future<_EncryptedVaultKey> _encryptVaultKeyMaterial(
   final clientKeyPair = await keyExchange.newKeyPair();
   final clientPublicKey = await clientKeyPair.extractPublicKey();
 
-  await connection.send(
+  final handshakeResponse = await connection.request(
     UserAgentRequest(unsealStart: UnsealStart(clientPubkey: clientPublicKey.bytes)),
   );
-
-  final handshakeResponse = await connection.receive();
   if (!handshakeResponse.hasUnsealStartResponse()) {
     throw Exception(
       'Expected unseal handshake response, got ${handshakeResponse.whichPayload()}',
diff --git a/useragent/lib/proto/client.pb.dart b/useragent/lib/proto/client.pb.dart
index 4a5e8f5..8d0a540 100644
--- a/useragent/lib/proto/client.pb.dart
+++ b/useragent/lib/proto/client.pb.dart
@@ -13,9 +13,10 @@
 import 'dart:core' as $core;
 
 import 'package:protobuf/protobuf.dart' as $pb;
+import 'package:protobuf/well_known_types/google/protobuf/empty.pb.dart' as $0;
 
 import 'client.pbenum.dart';
-import 'evm.pb.dart' as $0;
+import 'evm.pb.dart' as $1;
 
 export 'package:protobuf/protobuf.dart' show GeneratedMessageGenericExtensions;
 
@@ -199,46 +200,10 @@ class AuthChallengeSolution extends $pb.GeneratedMessage {
   void clearSignature() => $_clearField(1);
 }
 
-class AuthOk extends $pb.GeneratedMessage {
-  factory AuthOk() => create();
-
-  AuthOk._();
-
-  factory AuthOk.fromBuffer($core.List<$core.int> data,
-          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
-      create()..mergeFromBuffer(data, registry);
-  factory AuthOk.fromJson($core.String json,
-          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
-      create()..mergeFromJson(json, registry);
-
-  static final $pb.BuilderInfo _i = $pb.BuilderInfo(
-      _omitMessageNames ? '' : 'AuthOk',
-      package: const $pb.PackageName(_omitMessageNames ? '' : 'arbiter.client'),
-      createEmptyInstance: create)
-    ..hasRequiredFields = false;
-
-  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
-  AuthOk clone() => deepCopy();
-  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
-  AuthOk copyWith(void Function(AuthOk) updates) =>
-      super.copyWith((message) => updates(message as AuthOk)) as AuthOk;
-
-  @$core.override
-  $pb.BuilderInfo get info_ => _i;
-
-  @$core.pragma('dart2js:noInline')
-  static AuthOk create() => AuthOk._();
-  @$core.override
-  AuthOk createEmptyInstance() => create();
-  @$core.pragma('dart2js:noInline')
-  static AuthOk getDefault() =>
-      _defaultInstance ??= $pb.GeneratedMessage.$_defaultFor<AuthOk>(create);
-  static AuthOk? _defaultInstance;
-}
-
 enum ClientRequest_Payload {
   authChallengeRequest,
   authChallengeSolution,
+  queryVaultState,
   notSet
 }
 
@@ -246,12 +211,16 @@ class ClientRequest extends $pb.GeneratedMessage {
   factory ClientRequest({
     AuthChallengeRequest? authChallengeRequest,
     AuthChallengeSolution? authChallengeSolution,
+    $0.Empty? queryVaultState,
+    $core.int? requestId,
   }) {
     final result = create();
     if (authChallengeRequest != null)
       result.authChallengeRequest = authChallengeRequest;
     if (authChallengeSolution != null)
       result.authChallengeSolution = authChallengeSolution;
+    if (queryVaultState != null) result.queryVaultState = queryVaultState;
+    if (requestId != null) result.requestId = requestId;
     return result;
   }
 
@@ -268,19 +237,23 @@ class ClientRequest extends $pb.GeneratedMessage {
       _ClientRequest_PayloadByTag = {
     1: ClientRequest_Payload.authChallengeRequest,
     2: ClientRequest_Payload.authChallengeSolution,
+    3: ClientRequest_Payload.queryVaultState,
     0: ClientRequest_Payload.notSet
   };
   static final $pb.BuilderInfo _i = $pb.BuilderInfo(
       _omitMessageNames ? '' : 'ClientRequest',
       package: const $pb.PackageName(_omitMessageNames ? '' : 'arbiter.client'),
       createEmptyInstance: create)
-    ..oo(0, [1, 2])
+    ..oo(0, [1, 2, 3])
     ..aOM<AuthChallengeRequest>(
         1, _omitFieldNames ? '' : 'authChallengeRequest',
         subBuilder: AuthChallengeRequest.create)
     ..aOM<AuthChallengeSolution>(
         2, _omitFieldNames ? '' : 'authChallengeSolution',
         subBuilder: AuthChallengeSolution.create)
+    ..aOM<$0.Empty>(3, _omitFieldNames ? '' : 'queryVaultState',
+        subBuilder: $0.Empty.create)
+    ..aI(4, _omitFieldNames ? '' : 'requestId')
     ..hasRequiredFields = false;
 
   @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
@@ -304,10 +277,12 @@ class ClientRequest extends $pb.GeneratedMessage {
 
   @$pb.TagNumber(1)
   @$pb.TagNumber(2)
+  @$pb.TagNumber(3)
   ClientRequest_Payload whichPayload() =>
       _ClientRequest_PayloadByTag[$_whichOneof(0)]!;
   @$pb.TagNumber(1)
   @$pb.TagNumber(2)
+  @$pb.TagNumber(3)
   void clearPayload() => $_clearField($_whichOneof(0));
 
   @$pb.TagNumber(1)
@@ -332,89 +307,55 @@ class ClientRequest extends $pb.GeneratedMessage {
   void clearAuthChallengeSolution() => $_clearField(2);
   @$pb.TagNumber(2)
   AuthChallengeSolution ensureAuthChallengeSolution() => $_ensure(1);
-}
 
-class ClientConnectError extends $pb.GeneratedMessage {
-  factory ClientConnectError({
-    ClientConnectError_Code? code,
-  }) {
-    final result = create();
-    if (code != null) result.code = code;
-    return result;
-  }
+  @$pb.TagNumber(3)
+  $0.Empty get queryVaultState => $_getN(2);
+  @$pb.TagNumber(3)
+  set queryVaultState($0.Empty value) => $_setField(3, value);
+  @$pb.TagNumber(3)
+  $core.bool hasQueryVaultState() => $_has(2);
+  @$pb.TagNumber(3)
+  void clearQueryVaultState() => $_clearField(3);
+  @$pb.TagNumber(3)
+  $0.Empty ensureQueryVaultState() => $_ensure(2);
 
-  ClientConnectError._();
-
-  factory ClientConnectError.fromBuffer($core.List<$core.int> data,
-          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
-      create()..mergeFromBuffer(data, registry);
-  factory ClientConnectError.fromJson($core.String json,
-          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
-      create()..mergeFromJson(json, registry);
-
-  static final $pb.BuilderInfo _i = $pb.BuilderInfo(
-      _omitMessageNames ? '' : 'ClientConnectError',
-      package: const $pb.PackageName(_omitMessageNames ? '' : 'arbiter.client'),
-      createEmptyInstance: create)
-    ..aE<ClientConnectError_Code>(1, _omitFieldNames ? '' : 'code',
-        enumValues: ClientConnectError_Code.values)
-    ..hasRequiredFields = false;
-
-  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
-  ClientConnectError clone() => deepCopy();
-  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
-  ClientConnectError copyWith(void Function(ClientConnectError) updates) =>
-      super.copyWith((message) => updates(message as ClientConnectError))
-          as ClientConnectError;
-
-  @$core.override
-  $pb.BuilderInfo get info_ => _i;
-
-  @$core.pragma('dart2js:noInline')
-  static ClientConnectError create() => ClientConnectError._();
-  @$core.override
-  ClientConnectError createEmptyInstance() => create();
-  @$core.pragma('dart2js:noInline')
-  static ClientConnectError getDefault() => _defaultInstance ??=
-      $pb.GeneratedMessage.$_defaultFor<ClientConnectError>(create);
-  static ClientConnectError? _defaultInstance;
-
-  @$pb.TagNumber(1)
-  ClientConnectError_Code get code => $_getN(0);
-  @$pb.TagNumber(1)
-  set code(ClientConnectError_Code value) => $_setField(1, value);
-  @$pb.TagNumber(1)
-  $core.bool hasCode() => $_has(0);
-  @$pb.TagNumber(1)
-  void clearCode() => $_clearField(1);
+  @$pb.TagNumber(4)
+  $core.int get requestId => $_getIZ(3);
+  @$pb.TagNumber(4)
+  set requestId($core.int value) => $_setSignedInt32(3, value);
+  @$pb.TagNumber(4)
+  $core.bool hasRequestId() => $_has(3);
+  @$pb.TagNumber(4)
+  void clearRequestId() => $_clearField(4);
 }
 
 enum ClientResponse_Payload {
   authChallenge,
-  authOk,
+  authResult,
   evmSignTransaction,
   evmAnalyzeTransaction,
-  clientConnectError,
+  vaultState,
   notSet
 }
 
 class ClientResponse extends $pb.GeneratedMessage {
   factory ClientResponse({
     AuthChallenge? authChallenge,
-    AuthOk? authOk,
-    $0.EvmSignTransactionResponse? evmSignTransaction,
-    $0.EvmAnalyzeTransactionResponse? evmAnalyzeTransaction,
-    ClientConnectError? clientConnectError,
+    AuthResult? authResult,
+    $1.EvmSignTransactionResponse? evmSignTransaction,
+    $1.EvmAnalyzeTransactionResponse? evmAnalyzeTransaction,
+    VaultState? vaultState,
+    $core.int? requestId,
   }) {
     final result = create();
     if (authChallenge != null) result.authChallenge = authChallenge;
-    if (authOk != null) result.authOk = authOk;
+    if (authResult != null) result.authResult = authResult;
     if (evmSignTransaction != null)
       result.evmSignTransaction = evmSignTransaction;
     if (evmAnalyzeTransaction != null)
       result.evmAnalyzeTransaction = evmAnalyzeTransaction;
-    if (clientConnectError != null)
-      result.clientConnectError = clientConnectError;
+    if (vaultState != null) result.vaultState = vaultState;
+    if (requestId != null) result.requestId = requestId;
     return result;
   }
 
@@ -430,28 +371,30 @@ class ClientResponse extends $pb.GeneratedMessage {
   static const $core.Map<$core.int, ClientResponse_Payload>
       _ClientResponse_PayloadByTag = {
     1: ClientResponse_Payload.authChallenge,
-    2: ClientResponse_Payload.authOk,
+    2: ClientResponse_Payload.authResult,
     3: ClientResponse_Payload.evmSignTransaction,
     4: ClientResponse_Payload.evmAnalyzeTransaction,
-    5: ClientResponse_Payload.clientConnectError,
+    6: ClientResponse_Payload.vaultState,
     0: ClientResponse_Payload.notSet
   };
   static final $pb.BuilderInfo _i = $pb.BuilderInfo(
       _omitMessageNames ? '' : 'ClientResponse',
       package: const $pb.PackageName(_omitMessageNames ? '' : 'arbiter.client'),
       createEmptyInstance: create)
-    ..oo(0, [1, 2, 3, 4, 5])
+    ..oo(0, [1, 2, 3, 4, 6])
     ..aOM<AuthChallenge>(1, _omitFieldNames ? '' : 'authChallenge',
         subBuilder: AuthChallenge.create)
-    ..aOM<AuthOk>(2, _omitFieldNames ? '' : 'authOk', subBuilder: AuthOk.create)
-    ..aOM<$0.EvmSignTransactionResponse>(
+    ..aE<AuthResult>(2, _omitFieldNames ? '' : 'authResult',
+        enumValues: AuthResult.values)
+    ..aOM<$1.EvmSignTransactionResponse>(
         3, _omitFieldNames ? '' : 'evmSignTransaction',
-        subBuilder: $0.EvmSignTransactionResponse.create)
-    ..aOM<$0.EvmAnalyzeTransactionResponse>(
+        subBuilder: $1.EvmSignTransactionResponse.create)
+    ..aOM<$1.EvmAnalyzeTransactionResponse>(
         4, _omitFieldNames ? '' : 'evmAnalyzeTransaction',
-        subBuilder: $0.EvmAnalyzeTransactionResponse.create)
-    ..aOM<ClientConnectError>(5, _omitFieldNames ? '' : 'clientConnectError',
-        subBuilder: ClientConnectError.create)
+        subBuilder: $1.EvmAnalyzeTransactionResponse.create)
+    ..aE<VaultState>(6, _omitFieldNames ? '' : 'vaultState',
+        enumValues: VaultState.values)
+    ..aI(7, _omitFieldNames ? '' : 'requestId')
     ..hasRequiredFields = false;
 
   @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
@@ -477,14 +420,14 @@ class ClientResponse extends $pb.GeneratedMessage {
   @$pb.TagNumber(2)
   @$pb.TagNumber(3)
   @$pb.TagNumber(4)
-  @$pb.TagNumber(5)
+  @$pb.TagNumber(6)
   ClientResponse_Payload whichPayload() =>
       _ClientResponse_PayloadByTag[$_whichOneof(0)]!;
   @$pb.TagNumber(1)
   @$pb.TagNumber(2)
   @$pb.TagNumber(3)
   @$pb.TagNumber(4)
-  @$pb.TagNumber(5)
+  @$pb.TagNumber(6)
   void clearPayload() => $_clearField($_whichOneof(0));
 
   @$pb.TagNumber(1)
@@ -499,50 +442,55 @@ class ClientResponse extends $pb.GeneratedMessage {
   AuthChallenge ensureAuthChallenge() => $_ensure(0);
 
   @$pb.TagNumber(2)
-  AuthOk get authOk => $_getN(1);
+  AuthResult get authResult => $_getN(1);
   @$pb.TagNumber(2)
-  set authOk(AuthOk value) => $_setField(2, value);
+  set authResult(AuthResult value) => $_setField(2, value);
   @$pb.TagNumber(2)
-  $core.bool hasAuthOk() => $_has(1);
+  $core.bool hasAuthResult() => $_has(1);
   @$pb.TagNumber(2)
-  void clearAuthOk() => $_clearField(2);
-  @$pb.TagNumber(2)
-  AuthOk ensureAuthOk() => $_ensure(1);
+  void clearAuthResult() => $_clearField(2);
 
   @$pb.TagNumber(3)
-  $0.EvmSignTransactionResponse get evmSignTransaction => $_getN(2);
+  $1.EvmSignTransactionResponse get evmSignTransaction => $_getN(2);
   @$pb.TagNumber(3)
-  set evmSignTransaction($0.EvmSignTransactionResponse value) =>
+  set evmSignTransaction($1.EvmSignTransactionResponse value) =>
       $_setField(3, value);
   @$pb.TagNumber(3)
   $core.bool hasEvmSignTransaction() => $_has(2);
   @$pb.TagNumber(3)
   void clearEvmSignTransaction() => $_clearField(3);
   @$pb.TagNumber(3)
-  $0.EvmSignTransactionResponse ensureEvmSignTransaction() => $_ensure(2);
+  $1.EvmSignTransactionResponse ensureEvmSignTransaction() => $_ensure(2);
 
   @$pb.TagNumber(4)
-  $0.EvmAnalyzeTransactionResponse get evmAnalyzeTransaction => $_getN(3);
+  $1.EvmAnalyzeTransactionResponse get evmAnalyzeTransaction => $_getN(3);
   @$pb.TagNumber(4)
-  set evmAnalyzeTransaction($0.EvmAnalyzeTransactionResponse value) =>
+  set evmAnalyzeTransaction($1.EvmAnalyzeTransactionResponse value) =>
       $_setField(4, value);
   @$pb.TagNumber(4)
   $core.bool hasEvmAnalyzeTransaction() => $_has(3);
   @$pb.TagNumber(4)
   void clearEvmAnalyzeTransaction() => $_clearField(4);
   @$pb.TagNumber(4)
-  $0.EvmAnalyzeTransactionResponse ensureEvmAnalyzeTransaction() => $_ensure(3);
+  $1.EvmAnalyzeTransactionResponse ensureEvmAnalyzeTransaction() => $_ensure(3);
 
-  @$pb.TagNumber(5)
-  ClientConnectError get clientConnectError => $_getN(4);
-  @$pb.TagNumber(5)
-  set clientConnectError(ClientConnectError value) => $_setField(5, value);
-  @$pb.TagNumber(5)
-  $core.bool hasClientConnectError() => $_has(4);
-  @$pb.TagNumber(5)
-  void clearClientConnectError() => $_clearField(5);
-  @$pb.TagNumber(5)
-  ClientConnectError ensureClientConnectError() => $_ensure(4);
+  @$pb.TagNumber(6)
+  VaultState get vaultState => $_getN(4);
+  @$pb.TagNumber(6)
+  set vaultState(VaultState value) => $_setField(6, value);
+  @$pb.TagNumber(6)
+  $core.bool hasVaultState() => $_has(4);
+  @$pb.TagNumber(6)
+  void clearVaultState() => $_clearField(6);
+
+  @$pb.TagNumber(7)
+  $core.int get requestId => $_getIZ(5);
+  @$pb.TagNumber(7)
+  set requestId($core.int value) => $_setSignedInt32(5, value);
+  @$pb.TagNumber(7)
+  $core.bool hasRequestId() => $_has(5);
+  @$pb.TagNumber(7)
+  void clearRequestId() => $_clearField(7);
 }
 
 const $core.bool _omitFieldNames =
diff --git a/useragent/lib/proto/client.pbenum.dart b/useragent/lib/proto/client.pbenum.dart
index f5d4b5e..ab30126 100644
--- a/useragent/lib/proto/client.pbenum.dart
+++ b/useragent/lib/proto/client.pbenum.dart
@@ -14,28 +14,66 @@ import 'dart:core' as $core;
 
 import 'package:protobuf/protobuf.dart' as $pb;
 
-class ClientConnectError_Code extends $pb.ProtobufEnum {
-  static const ClientConnectError_Code UNKNOWN =
-      ClientConnectError_Code._(0, _omitEnumNames ? '' : 'UNKNOWN');
-  static const ClientConnectError_Code APPROVAL_DENIED =
-      ClientConnectError_Code._(1, _omitEnumNames ? '' : 'APPROVAL_DENIED');
-  static const ClientConnectError_Code NO_USER_AGENTS_ONLINE =
-      ClientConnectError_Code._(
-          2, _omitEnumNames ? '' : 'NO_USER_AGENTS_ONLINE');
+class AuthResult extends $pb.ProtobufEnum {
+  static const AuthResult AUTH_RESULT_UNSPECIFIED =
+      AuthResult._(0, _omitEnumNames ? '' : 'AUTH_RESULT_UNSPECIFIED');
+  static const AuthResult AUTH_RESULT_SUCCESS =
+      AuthResult._(1, _omitEnumNames ? '' : 'AUTH_RESULT_SUCCESS');
+  static const AuthResult AUTH_RESULT_INVALID_KEY =
+      AuthResult._(2, _omitEnumNames ? '' : 'AUTH_RESULT_INVALID_KEY');
+  static const AuthResult AUTH_RESULT_INVALID_SIGNATURE =
+      AuthResult._(3, _omitEnumNames ? '' : 'AUTH_RESULT_INVALID_SIGNATURE');
+  static const AuthResult AUTH_RESULT_APPROVAL_DENIED =
+      AuthResult._(4, _omitEnumNames ? '' : 'AUTH_RESULT_APPROVAL_DENIED');
+  static const AuthResult AUTH_RESULT_NO_USER_AGENTS_ONLINE = AuthResult._(
+      5, _omitEnumNames ? '' : 'AUTH_RESULT_NO_USER_AGENTS_ONLINE');
+  static const AuthResult AUTH_RESULT_INTERNAL =
+      AuthResult._(6, _omitEnumNames ? '' : 'AUTH_RESULT_INTERNAL');
 
-  static const $core.List<ClientConnectError_Code> values =
-      <ClientConnectError_Code>[
-    UNKNOWN,
-    APPROVAL_DENIED,
-    NO_USER_AGENTS_ONLINE,
+  static const $core.List<AuthResult> values = <AuthResult>[
+    AUTH_RESULT_UNSPECIFIED,
+    AUTH_RESULT_SUCCESS,
+    AUTH_RESULT_INVALID_KEY,
+    AUTH_RESULT_INVALID_SIGNATURE,
+    AUTH_RESULT_APPROVAL_DENIED,
+    AUTH_RESULT_NO_USER_AGENTS_ONLINE,
+    AUTH_RESULT_INTERNAL,
   ];
 
-  static final $core.List<ClientConnectError_Code?> _byValue =
-      $pb.ProtobufEnum.$_initByValueList(values, 2);
-  static ClientConnectError_Code? valueOf($core.int value) =>
+  static final $core.List<AuthResult?> _byValue =
+      $pb.ProtobufEnum.$_initByValueList(values, 6);
+  static AuthResult? valueOf($core.int value) =>
       value < 0 || value >= _byValue.length ? null : _byValue[value];
 
-  const ClientConnectError_Code._(super.value, super.name);
+  const AuthResult._(super.value, super.name);
+}
+
+class VaultState extends $pb.ProtobufEnum {
+  static const VaultState VAULT_STATE_UNSPECIFIED =
+      VaultState._(0, _omitEnumNames ? '' : 'VAULT_STATE_UNSPECIFIED');
+  static const VaultState VAULT_STATE_UNBOOTSTRAPPED =
+      VaultState._(1, _omitEnumNames ? '' : 'VAULT_STATE_UNBOOTSTRAPPED');
+  static const VaultState VAULT_STATE_SEALED =
+      VaultState._(2, _omitEnumNames ? '' : 'VAULT_STATE_SEALED');
+  static const VaultState VAULT_STATE_UNSEALED =
+      VaultState._(3, _omitEnumNames ? '' : 'VAULT_STATE_UNSEALED');
+  static const VaultState VAULT_STATE_ERROR =
+      VaultState._(4, _omitEnumNames ? '' : 'VAULT_STATE_ERROR');
+
+  static const $core.List<VaultState> values = <VaultState>[
+    VAULT_STATE_UNSPECIFIED,
+    VAULT_STATE_UNBOOTSTRAPPED,
+    VAULT_STATE_SEALED,
+    VAULT_STATE_UNSEALED,
+    VAULT_STATE_ERROR,
+  ];
+
+  static final $core.List<VaultState?> _byValue =
+      $pb.ProtobufEnum.$_initByValueList(values, 4);
+  static VaultState? valueOf($core.int value) =>
+      value < 0 || value >= _byValue.length ? null : _byValue[value];
+
+  const VaultState._(super.value, super.name);
 }
 
 const $core.bool _omitEnumNames =
diff --git a/useragent/lib/proto/client.pbjson.dart b/useragent/lib/proto/client.pbjson.dart
index d005846..97f914d 100644
--- a/useragent/lib/proto/client.pbjson.dart
+++ b/useragent/lib/proto/client.pbjson.dart
@@ -15,6 +15,46 @@ import 'dart:convert' as $convert;
 import 'dart:core' as $core;
 import 'dart:typed_data' as $typed_data;
 
+@$core.Deprecated('Use authResultDescriptor instead')
+const AuthResult$json = {
+  '1': 'AuthResult',
+  '2': [
+    {'1': 'AUTH_RESULT_UNSPECIFIED', '2': 0},
+    {'1': 'AUTH_RESULT_SUCCESS', '2': 1},
+    {'1': 'AUTH_RESULT_INVALID_KEY', '2': 2},
+    {'1': 'AUTH_RESULT_INVALID_SIGNATURE', '2': 3},
+    {'1': 'AUTH_RESULT_APPROVAL_DENIED', '2': 4},
+    {'1': 'AUTH_RESULT_NO_USER_AGENTS_ONLINE', '2': 5},
+    {'1': 'AUTH_RESULT_INTERNAL', '2': 6},
+  ],
+};
+
+/// Descriptor for `AuthResult`. Decode as a `google.protobuf.EnumDescriptorProto`.
+final $typed_data.Uint8List authResultDescriptor = $convert.base64Decode(
+    'CgpBdXRoUmVzdWx0EhsKF0FVVEhfUkVTVUxUX1VOU1BFQ0lGSUVEEAASFwoTQVVUSF9SRVNVTF'
+    'RfU1VDQ0VTUxABEhsKF0FVVEhfUkVTVUxUX0lOVkFMSURfS0VZEAISIQodQVVUSF9SRVNVTFRf'
+    'SU5WQUxJRF9TSUdOQVRVUkUQAxIfChtBVVRIX1JFU1VMVF9BUFBST1ZBTF9ERU5JRUQQBBIlCi'
+    'FBVVRIX1JFU1VMVF9OT19VU0VSX0FHRU5UU19PTkxJTkUQBRIYChRBVVRIX1JFU1VMVF9JTlRF'
+    'Uk5BTBAG');
+
+@$core.Deprecated('Use vaultStateDescriptor instead')
+const VaultState$json = {
+  '1': 'VaultState',
+  '2': [
+    {'1': 'VAULT_STATE_UNSPECIFIED', '2': 0},
+    {'1': 'VAULT_STATE_UNBOOTSTRAPPED', '2': 1},
+    {'1': 'VAULT_STATE_SEALED', '2': 2},
+    {'1': 'VAULT_STATE_UNSEALED', '2': 3},
+    {'1': 'VAULT_STATE_ERROR', '2': 4},
+  ],
+};
+
+/// Descriptor for `VaultState`. Decode as a `google.protobuf.EnumDescriptorProto`.
+final $typed_data.Uint8List vaultStateDescriptor = $convert.base64Decode(
+    'CgpWYXVsdFN0YXRlEhsKF1ZBVUxUX1NUQVRFX1VOU1BFQ0lGSUVEEAASHgoaVkFVTFRfU1RBVE'
+    'VfVU5CT09UU1RSQVBQRUQQARIWChJWQVVMVF9TVEFURV9TRUFMRUQQAhIYChRWQVVMVF9TVEFU'
+    'RV9VTlNFQUxFRBADEhUKEVZBVUxUX1NUQVRFX0VSUk9SEAQ=');
+
 @$core.Deprecated('Use authChallengeRequestDescriptor instead')
 const AuthChallengeRequest$json = {
   '1': 'AuthChallengeRequest',
@@ -54,19 +94,11 @@ const AuthChallengeSolution$json = {
 final $typed_data.Uint8List authChallengeSolutionDescriptor = $convert.base64Decode(
     'ChVBdXRoQ2hhbGxlbmdlU29sdXRpb24SHAoJc2lnbmF0dXJlGAEgASgMUglzaWduYXR1cmU=');
 
-@$core.Deprecated('Use authOkDescriptor instead')
-const AuthOk$json = {
-  '1': 'AuthOk',
-};
-
-/// Descriptor for `AuthOk`. Decode as a `google.protobuf.DescriptorProto`.
-final $typed_data.Uint8List authOkDescriptor =
-    $convert.base64Decode('CgZBdXRoT2s=');
-
 @$core.Deprecated('Use clientRequestDescriptor instead')
 const ClientRequest$json = {
   '1': 'ClientRequest',
   '2': [
+    {'1': 'request_id', '3': 4, '4': 1, '5': 5, '10': 'requestId'},
     {
       '1': 'auth_challenge_request',
       '3': 1,
@@ -85,6 +117,15 @@ const ClientRequest$json = {
       '9': 0,
       '10': 'authChallengeSolution'
     },
+    {
+      '1': 'query_vault_state',
+      '3': 3,
+      '4': 1,
+      '5': 11,
+      '6': '.google.protobuf.Empty',
+      '9': 0,
+      '10': 'queryVaultState'
+    },
   ],
   '8': [
     {'1': 'payload'},
@@ -93,47 +134,26 @@ const ClientRequest$json = {
 
 /// Descriptor for `ClientRequest`. Decode as a `google.protobuf.DescriptorProto`.
 final $typed_data.Uint8List clientRequestDescriptor = $convert.base64Decode(
-    'Cg1DbGllbnRSZXF1ZXN0ElwKFmF1dGhfY2hhbGxlbmdlX3JlcXVlc3QYASABKAsyJC5hcmJpdG'
-    'VyLmNsaWVudC5BdXRoQ2hhbGxlbmdlUmVxdWVzdEgAUhRhdXRoQ2hhbGxlbmdlUmVxdWVzdBJf'
-    'ChdhdXRoX2NoYWxsZW5nZV9zb2x1dGlvbhgCIAEoCzIlLmFyYml0ZXIuY2xpZW50LkF1dGhDaG'
-    'FsbGVuZ2VTb2x1dGlvbkgAUhVhdXRoQ2hhbGxlbmdlU29sdXRpb25CCQoHcGF5bG9hZA==');
-
-@$core.Deprecated('Use clientConnectErrorDescriptor instead')
-const ClientConnectError$json = {
-  '1': 'ClientConnectError',
-  '2': [
-    {
-      '1': 'code',
-      '3': 1,
-      '4': 1,
-      '5': 14,
-      '6': '.arbiter.client.ClientConnectError.Code',
-      '10': 'code'
-    },
-  ],
-  '4': [ClientConnectError_Code$json],
-};
-
-@$core.Deprecated('Use clientConnectErrorDescriptor instead')
-const ClientConnectError_Code$json = {
-  '1': 'Code',
-  '2': [
-    {'1': 'UNKNOWN', '2': 0},
-    {'1': 'APPROVAL_DENIED', '2': 1},
-    {'1': 'NO_USER_AGENTS_ONLINE', '2': 2},
-  ],
-};
-
-/// Descriptor for `ClientConnectError`. Decode as a `google.protobuf.DescriptorProto`.
-final $typed_data.Uint8List clientConnectErrorDescriptor = $convert.base64Decode(
-    'ChJDbGllbnRDb25uZWN0RXJyb3ISOwoEY29kZRgBIAEoDjInLmFyYml0ZXIuY2xpZW50LkNsaW'
-    'VudENvbm5lY3RFcnJvci5Db2RlUgRjb2RlIkMKBENvZGUSCwoHVU5LTk9XThAAEhMKD0FQUFJP'
-    'VkFMX0RFTklFRBABEhkKFU5PX1VTRVJfQUdFTlRTX09OTElORRAC');
+    'Cg1DbGllbnRSZXF1ZXN0Eh0KCnJlcXVlc3RfaWQYBCABKAVSCXJlcXVlc3RJZBJcChZhdXRoX2'
+    'NoYWxsZW5nZV9yZXF1ZXN0GAEgASgLMiQuYXJiaXRlci5jbGllbnQuQXV0aENoYWxsZW5nZVJl'
+    'cXVlc3RIAFIUYXV0aENoYWxsZW5nZVJlcXVlc3QSXwoXYXV0aF9jaGFsbGVuZ2Vfc29sdXRpb2'
+    '4YAiABKAsyJS5hcmJpdGVyLmNsaWVudC5BdXRoQ2hhbGxlbmdlU29sdXRpb25IAFIVYXV0aENo'
+    'YWxsZW5nZVNvbHV0aW9uEkQKEXF1ZXJ5X3ZhdWx0X3N0YXRlGAMgASgLMhYuZ29vZ2xlLnByb3'
+    'RvYnVmLkVtcHR5SABSD3F1ZXJ5VmF1bHRTdGF0ZUIJCgdwYXlsb2Fk');
 
 @$core.Deprecated('Use clientResponseDescriptor instead')
 const ClientResponse$json = {
   '1': 'ClientResponse',
   '2': [
+    {
+      '1': 'request_id',
+      '3': 7,
+      '4': 1,
+      '5': 5,
+      '9': 1,
+      '10': 'requestId',
+      '17': true
+    },
     {
       '1': 'auth_challenge',
       '3': 1,
@@ -144,22 +164,13 @@ const ClientResponse$json = {
       '10': 'authChallenge'
     },
     {
-      '1': 'auth_ok',
+      '1': 'auth_result',
       '3': 2,
       '4': 1,
-      '5': 11,
-      '6': '.arbiter.client.AuthOk',
+      '5': 14,
+      '6': '.arbiter.client.AuthResult',
       '9': 0,
-      '10': 'authOk'
-    },
-    {
-      '1': 'client_connect_error',
-      '3': 5,
-      '4': 1,
-      '5': 11,
-      '6': '.arbiter.client.ClientConnectError',
-      '9': 0,
-      '10': 'clientConnectError'
+      '10': 'authResult'
     },
     {
       '1': 'evm_sign_transaction',
@@ -179,19 +190,30 @@ const ClientResponse$json = {
       '9': 0,
       '10': 'evmAnalyzeTransaction'
     },
+    {
+      '1': 'vault_state',
+      '3': 6,
+      '4': 1,
+      '5': 14,
+      '6': '.arbiter.client.VaultState',
+      '9': 0,
+      '10': 'vaultState'
+    },
   ],
   '8': [
     {'1': 'payload'},
+    {'1': '_request_id'},
   ],
 };
 
 /// Descriptor for `ClientResponse`. Decode as a `google.protobuf.DescriptorProto`.
 final $typed_data.Uint8List clientResponseDescriptor = $convert.base64Decode(
-    'Cg5DbGllbnRSZXNwb25zZRJGCg5hdXRoX2NoYWxsZW5nZRgBIAEoCzIdLmFyYml0ZXIuY2xpZW'
-    '50LkF1dGhDaGFsbGVuZ2VIAFINYXV0aENoYWxsZW5nZRIxCgdhdXRoX29rGAIgASgLMhYuYXJi'
-    'aXRlci5jbGllbnQuQXV0aE9rSABSBmF1dGhPaxJWChRjbGllbnRfY29ubmVjdF9lcnJvchgFIA'
-    'EoCzIiLmFyYml0ZXIuY2xpZW50LkNsaWVudENvbm5lY3RFcnJvckgAUhJjbGllbnRDb25uZWN0'
-    'RXJyb3ISWwoUZXZtX3NpZ25fdHJhbnNhY3Rpb24YAyABKAsyJy5hcmJpdGVyLmV2bS5Fdm1TaW'
-    'duVHJhbnNhY3Rpb25SZXNwb25zZUgAUhJldm1TaWduVHJhbnNhY3Rpb24SZAoXZXZtX2FuYWx5'
-    'emVfdHJhbnNhY3Rpb24YBCABKAsyKi5hcmJpdGVyLmV2bS5Fdm1BbmFseXplVHJhbnNhY3Rpb2'
-    '5SZXNwb25zZUgAUhVldm1BbmFseXplVHJhbnNhY3Rpb25CCQoHcGF5bG9hZA==');
+    'Cg5DbGllbnRSZXNwb25zZRIiCgpyZXF1ZXN0X2lkGAcgASgFSAFSCXJlcXVlc3RJZIgBARJGCg'
+    '5hdXRoX2NoYWxsZW5nZRgBIAEoCzIdLmFyYml0ZXIuY2xpZW50LkF1dGhDaGFsbGVuZ2VIAFIN'
+    'YXV0aENoYWxsZW5nZRI9CgthdXRoX3Jlc3VsdBgCIAEoDjIaLmFyYml0ZXIuY2xpZW50LkF1dG'
+    'hSZXN1bHRIAFIKYXV0aFJlc3VsdBJbChRldm1fc2lnbl90cmFuc2FjdGlvbhgDIAEoCzInLmFy'
+    'Yml0ZXIuZXZtLkV2bVNpZ25UcmFuc2FjdGlvblJlc3BvbnNlSABSEmV2bVNpZ25UcmFuc2FjdG'
+    'lvbhJkChdldm1fYW5hbHl6ZV90cmFuc2FjdGlvbhgEIAEoCzIqLmFyYml0ZXIuZXZtLkV2bUFu'
+    'YWx5emVUcmFuc2FjdGlvblJlc3BvbnNlSABSFWV2bUFuYWx5emVUcmFuc2FjdGlvbhI9Cgt2YX'
+    'VsdF9zdGF0ZRgGIAEoDjIaLmFyYml0ZXIuY2xpZW50LlZhdWx0U3RhdGVIAFIKdmF1bHRTdGF0'
+    'ZUIJCgdwYXlsb2FkQg0KC19yZXF1ZXN0X2lk');
diff --git a/useragent/lib/proto/user_agent.pb.dart b/useragent/lib/proto/user_agent.pb.dart
index e7e96a1..3b85474 100644
--- a/useragent/lib/proto/user_agent.pb.dart
+++ b/useragent/lib/proto/user_agent.pb.dart
@@ -105,11 +105,9 @@ class AuthChallengeRequest extends $pb.GeneratedMessage {
 
 class AuthChallenge extends $pb.GeneratedMessage {
   factory AuthChallenge({
-    $core.List<$core.int>? pubkey,
     $core.int? nonce,
   }) {
     final result = create();
-    if (pubkey != null) result.pubkey = pubkey;
     if (nonce != null) result.nonce = nonce;
     return result;
   }
@@ -128,8 +126,6 @@ class AuthChallenge extends $pb.GeneratedMessage {
       package:
           const $pb.PackageName(_omitMessageNames ? '' : 'arbiter.user_agent'),
       createEmptyInstance: create)
-    ..a<$core.List<$core.int>>(
-        1, _omitFieldNames ? '' : 'pubkey', $pb.PbFieldType.OY)
     ..aI(2, _omitFieldNames ? '' : 'nonce')
     ..hasRequiredFields = false;
 
@@ -152,21 +148,12 @@ class AuthChallenge extends $pb.GeneratedMessage {
       $pb.GeneratedMessage.$_defaultFor<AuthChallenge>(create);
   static AuthChallenge? _defaultInstance;
 
-  @$pb.TagNumber(1)
-  $core.List<$core.int> get pubkey => $_getN(0);
-  @$pb.TagNumber(1)
-  set pubkey($core.List<$core.int> value) => $_setBytes(0, value);
-  @$pb.TagNumber(1)
-  $core.bool hasPubkey() => $_has(0);
-  @$pb.TagNumber(1)
-  void clearPubkey() => $_clearField(1);
-
   @$pb.TagNumber(2)
-  $core.int get nonce => $_getIZ(1);
+  $core.int get nonce => $_getIZ(0);
   @$pb.TagNumber(2)
-  set nonce($core.int value) => $_setSignedInt32(1, value);
+  set nonce($core.int value) => $_setSignedInt32(0, value);
   @$pb.TagNumber(2)
-  $core.bool hasNonce() => $_has(1);
+  $core.bool hasNonce() => $_has(0);
   @$pb.TagNumber(2)
   void clearNonce() => $_clearField(2);
 }
@@ -228,44 +215,6 @@ class AuthChallengeSolution extends $pb.GeneratedMessage {
   void clearSignature() => $_clearField(1);
 }
 
-class AuthOk extends $pb.GeneratedMessage {
-  factory AuthOk() => create();
-
-  AuthOk._();
-
-  factory AuthOk.fromBuffer($core.List<$core.int> data,
-          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
-      create()..mergeFromBuffer(data, registry);
-  factory AuthOk.fromJson($core.String json,
-          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
-      create()..mergeFromJson(json, registry);
-
-  static final $pb.BuilderInfo _i = $pb.BuilderInfo(
-      _omitMessageNames ? '' : 'AuthOk',
-      package:
-          const $pb.PackageName(_omitMessageNames ? '' : 'arbiter.user_agent'),
-      createEmptyInstance: create)
-    ..hasRequiredFields = false;
-
-  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
-  AuthOk clone() => deepCopy();
-  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
-  AuthOk copyWith(void Function(AuthOk) updates) =>
-      super.copyWith((message) => updates(message as AuthOk)) as AuthOk;
-
-  @$core.override
-  $pb.BuilderInfo get info_ => _i;
-
-  @$core.pragma('dart2js:noInline')
-  static AuthOk create() => AuthOk._();
-  @$core.override
-  AuthOk createEmptyInstance() => create();
-  @$core.pragma('dart2js:noInline')
-  static AuthOk getDefault() =>
-      _defaultInstance ??= $pb.GeneratedMessage.$_defaultFor<AuthOk>(create);
-  static AuthOk? _defaultInstance;
-}
-
 class UnsealStart extends $pb.GeneratedMessage {
   factory UnsealStart({
     $core.List<$core.int>? clientPubkey,
@@ -726,6 +675,7 @@ class UserAgentRequest extends $pb.GeneratedMessage {
     $1.EvmGrantListRequest? evmGrantList,
     ClientConnectionResponse? clientConnectionResponse,
     BootstrapEncryptedKey? bootstrapEncryptedKey,
+    $core.int? id,
   }) {
     final result = create();
     if (authChallengeRequest != null)
@@ -745,6 +695,7 @@ class UserAgentRequest extends $pb.GeneratedMessage {
       result.clientConnectionResponse = clientConnectionResponse;
     if (bootstrapEncryptedKey != null)
       result.bootstrapEncryptedKey = bootstrapEncryptedKey;
+    if (id != null) result.id = id;
     return result;
   }
 
@@ -807,6 +758,7 @@ class UserAgentRequest extends $pb.GeneratedMessage {
     ..aOM<BootstrapEncryptedKey>(
         12, _omitFieldNames ? '' : 'bootstrapEncryptedKey',
         subBuilder: BootstrapEncryptedKey.create)
+    ..aI(14, _omitFieldNames ? '' : 'id')
     ..hasRequiredFields = false;
 
   @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
@@ -990,11 +942,20 @@ class UserAgentRequest extends $pb.GeneratedMessage {
   void clearBootstrapEncryptedKey() => $_clearField(12);
   @$pb.TagNumber(12)
   BootstrapEncryptedKey ensureBootstrapEncryptedKey() => $_ensure(11);
+
+  @$pb.TagNumber(14)
+  $core.int get id => $_getIZ(12);
+  @$pb.TagNumber(14)
+  set id($core.int value) => $_setSignedInt32(12, value);
+  @$pb.TagNumber(14)
+  $core.bool hasId() => $_has(12);
+  @$pb.TagNumber(14)
+  void clearId() => $_clearField(14);
 }
 
 enum UserAgentResponse_Payload {
   authChallenge,
-  authOk,
+  authResult,
   unsealStartResponse,
   unsealResult,
   vaultState,
@@ -1012,7 +973,7 @@ enum UserAgentResponse_Payload {
 class UserAgentResponse extends $pb.GeneratedMessage {
   factory UserAgentResponse({
     AuthChallenge? authChallenge,
-    AuthOk? authOk,
+    AuthResult? authResult,
     UnsealStartResponse? unsealStartResponse,
     UnsealResult? unsealResult,
     VaultState? vaultState,
@@ -1024,10 +985,11 @@ class UserAgentResponse extends $pb.GeneratedMessage {
     ClientConnectionRequest? clientConnectionRequest,
     ClientConnectionCancel? clientConnectionCancel,
     BootstrapResult? bootstrapResult,
+    $core.int? id,
   }) {
     final result = create();
     if (authChallenge != null) result.authChallenge = authChallenge;
-    if (authOk != null) result.authOk = authOk;
+    if (authResult != null) result.authResult = authResult;
     if (unsealStartResponse != null)
       result.unsealStartResponse = unsealStartResponse;
     if (unsealResult != null) result.unsealResult = unsealResult;
@@ -1042,6 +1004,7 @@ class UserAgentResponse extends $pb.GeneratedMessage {
     if (clientConnectionCancel != null)
       result.clientConnectionCancel = clientConnectionCancel;
     if (bootstrapResult != null) result.bootstrapResult = bootstrapResult;
+    if (id != null) result.id = id;
     return result;
   }
 
@@ -1057,7 +1020,7 @@ class UserAgentResponse extends $pb.GeneratedMessage {
   static const $core.Map<$core.int, UserAgentResponse_Payload>
       _UserAgentResponse_PayloadByTag = {
     1: UserAgentResponse_Payload.authChallenge,
-    2: UserAgentResponse_Payload.authOk,
+    2: UserAgentResponse_Payload.authResult,
     3: UserAgentResponse_Payload.unsealStartResponse,
     4: UserAgentResponse_Payload.unsealResult,
     5: UserAgentResponse_Payload.vaultState,
@@ -1079,7 +1042,8 @@ class UserAgentResponse extends $pb.GeneratedMessage {
     ..oo(0, [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13])
     ..aOM<AuthChallenge>(1, _omitFieldNames ? '' : 'authChallenge',
         subBuilder: AuthChallenge.create)
-    ..aOM<AuthOk>(2, _omitFieldNames ? '' : 'authOk', subBuilder: AuthOk.create)
+    ..aE<AuthResult>(2, _omitFieldNames ? '' : 'authResult',
+        enumValues: AuthResult.values)
     ..aOM<UnsealStartResponse>(3, _omitFieldNames ? '' : 'unsealStartResponse',
         subBuilder: UnsealStartResponse.create)
     ..aE<UnsealResult>(4, _omitFieldNames ? '' : 'unsealResult',
@@ -1104,6 +1068,7 @@ class UserAgentResponse extends $pb.GeneratedMessage {
         subBuilder: ClientConnectionCancel.create)
     ..aE<BootstrapResult>(13, _omitFieldNames ? '' : 'bootstrapResult',
         enumValues: BootstrapResult.values)
+    ..aI(14, _omitFieldNames ? '' : 'id')
     ..hasRequiredFields = false;
 
   @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
@@ -1167,15 +1132,13 @@ class UserAgentResponse extends $pb.GeneratedMessage {
   AuthChallenge ensureAuthChallenge() => $_ensure(0);
 
   @$pb.TagNumber(2)
-  AuthOk get authOk => $_getN(1);
+  AuthResult get authResult => $_getN(1);
   @$pb.TagNumber(2)
-  set authOk(AuthOk value) => $_setField(2, value);
+  set authResult(AuthResult value) => $_setField(2, value);
   @$pb.TagNumber(2)
-  $core.bool hasAuthOk() => $_has(1);
+  $core.bool hasAuthResult() => $_has(1);
   @$pb.TagNumber(2)
-  void clearAuthOk() => $_clearField(2);
-  @$pb.TagNumber(2)
-  AuthOk ensureAuthOk() => $_ensure(1);
+  void clearAuthResult() => $_clearField(2);
 
   @$pb.TagNumber(3)
   UnsealStartResponse get unsealStartResponse => $_getN(2);
@@ -1293,6 +1256,15 @@ class UserAgentResponse extends $pb.GeneratedMessage {
   $core.bool hasBootstrapResult() => $_has(12);
   @$pb.TagNumber(13)
   void clearBootstrapResult() => $_clearField(13);
+
+  @$pb.TagNumber(14)
+  $core.int get id => $_getIZ(13);
+  @$pb.TagNumber(14)
+  set id($core.int value) => $_setSignedInt32(13, value);
+  @$pb.TagNumber(14)
+  $core.bool hasId() => $_has(13);
+  @$pb.TagNumber(14)
+  void clearId() => $_clearField(14);
 }
 
 const $core.bool _omitFieldNames =
diff --git a/useragent/lib/proto/user_agent.pbenum.dart b/useragent/lib/proto/user_agent.pbenum.dart
index 41b6c7e..66ff3be 100644
--- a/useragent/lib/proto/user_agent.pbenum.dart
+++ b/useragent/lib/proto/user_agent.pbenum.dart
@@ -39,6 +39,40 @@ class KeyType extends $pb.ProtobufEnum {
   const KeyType._(super.value, super.name);
 }
 
+class AuthResult extends $pb.ProtobufEnum {
+  static const AuthResult AUTH_RESULT_UNSPECIFIED =
+      AuthResult._(0, _omitEnumNames ? '' : 'AUTH_RESULT_UNSPECIFIED');
+  static const AuthResult AUTH_RESULT_SUCCESS =
+      AuthResult._(1, _omitEnumNames ? '' : 'AUTH_RESULT_SUCCESS');
+  static const AuthResult AUTH_RESULT_INVALID_KEY =
+      AuthResult._(2, _omitEnumNames ? '' : 'AUTH_RESULT_INVALID_KEY');
+  static const AuthResult AUTH_RESULT_INVALID_SIGNATURE =
+      AuthResult._(3, _omitEnumNames ? '' : 'AUTH_RESULT_INVALID_SIGNATURE');
+  static const AuthResult AUTH_RESULT_BOOTSTRAP_REQUIRED =
+      AuthResult._(4, _omitEnumNames ? '' : 'AUTH_RESULT_BOOTSTRAP_REQUIRED');
+  static const AuthResult AUTH_RESULT_TOKEN_INVALID =
+      AuthResult._(5, _omitEnumNames ? '' : 'AUTH_RESULT_TOKEN_INVALID');
+  static const AuthResult AUTH_RESULT_INTERNAL =
+      AuthResult._(6, _omitEnumNames ? '' : 'AUTH_RESULT_INTERNAL');
+
+  static const $core.List<AuthResult> values = <AuthResult>[
+    AUTH_RESULT_UNSPECIFIED,
+    AUTH_RESULT_SUCCESS,
+    AUTH_RESULT_INVALID_KEY,
+    AUTH_RESULT_INVALID_SIGNATURE,
+    AUTH_RESULT_BOOTSTRAP_REQUIRED,
+    AUTH_RESULT_TOKEN_INVALID,
+    AUTH_RESULT_INTERNAL,
+  ];
+
+  static final $core.List<AuthResult?> _byValue =
+      $pb.ProtobufEnum.$_initByValueList(values, 6);
+  static AuthResult? valueOf($core.int value) =>
+      value < 0 || value >= _byValue.length ? null : _byValue[value];
+
+  const AuthResult._(super.value, super.name);
+}
+
 class UnsealResult extends $pb.ProtobufEnum {
   static const UnsealResult UNSEAL_RESULT_UNSPECIFIED =
       UnsealResult._(0, _omitEnumNames ? '' : 'UNSEAL_RESULT_UNSPECIFIED');
@@ -65,14 +99,15 @@ class UnsealResult extends $pb.ProtobufEnum {
 }
 
 class BootstrapResult extends $pb.ProtobufEnum {
-  static const BootstrapResult BOOTSTRAP_RESULT_UNSPECIFIED =
-      BootstrapResult._(0, _omitEnumNames ? '' : 'BOOTSTRAP_RESULT_UNSPECIFIED');
+  static const BootstrapResult BOOTSTRAP_RESULT_UNSPECIFIED = BootstrapResult._(
+      0, _omitEnumNames ? '' : 'BOOTSTRAP_RESULT_UNSPECIFIED');
   static const BootstrapResult BOOTSTRAP_RESULT_SUCCESS =
       BootstrapResult._(1, _omitEnumNames ? '' : 'BOOTSTRAP_RESULT_SUCCESS');
   static const BootstrapResult BOOTSTRAP_RESULT_ALREADY_BOOTSTRAPPED =
-      BootstrapResult._(2, _omitEnumNames ? '' : 'BOOTSTRAP_RESULT_ALREADY_BOOTSTRAPPED');
-  static const BootstrapResult BOOTSTRAP_RESULT_INVALID_KEY =
-      BootstrapResult._(3, _omitEnumNames ? '' : 'BOOTSTRAP_RESULT_INVALID_KEY');
+      BootstrapResult._(
+          2, _omitEnumNames ? '' : 'BOOTSTRAP_RESULT_ALREADY_BOOTSTRAPPED');
+  static const BootstrapResult BOOTSTRAP_RESULT_INVALID_KEY = BootstrapResult._(
+      3, _omitEnumNames ? '' : 'BOOTSTRAP_RESULT_INVALID_KEY');
 
   static const $core.List<BootstrapResult> values = <BootstrapResult>[
     BOOTSTRAP_RESULT_UNSPECIFIED,
diff --git a/useragent/lib/proto/user_agent.pbjson.dart b/useragent/lib/proto/user_agent.pbjson.dart
index e9a48c6..b74a873 100644
--- a/useragent/lib/proto/user_agent.pbjson.dart
+++ b/useragent/lib/proto/user_agent.pbjson.dart
@@ -31,6 +31,28 @@ final $typed_data.Uint8List keyTypeDescriptor = $convert.base64Decode(
     'CgdLZXlUeXBlEhgKFEtFWV9UWVBFX1VOU1BFQ0lGSUVEEAASFAoQS0VZX1RZUEVfRUQyNTUxOR'
     'ABEhwKGEtFWV9UWVBFX0VDRFNBX1NFQ1AyNTZLMRACEhAKDEtFWV9UWVBFX1JTQRAD');
 
+@$core.Deprecated('Use authResultDescriptor instead')
+const AuthResult$json = {
+  '1': 'AuthResult',
+  '2': [
+    {'1': 'AUTH_RESULT_UNSPECIFIED', '2': 0},
+    {'1': 'AUTH_RESULT_SUCCESS', '2': 1},
+    {'1': 'AUTH_RESULT_INVALID_KEY', '2': 2},
+    {'1': 'AUTH_RESULT_INVALID_SIGNATURE', '2': 3},
+    {'1': 'AUTH_RESULT_BOOTSTRAP_REQUIRED', '2': 4},
+    {'1': 'AUTH_RESULT_TOKEN_INVALID', '2': 5},
+    {'1': 'AUTH_RESULT_INTERNAL', '2': 6},
+  ],
+};
+
+/// Descriptor for `AuthResult`. Decode as a `google.protobuf.EnumDescriptorProto`.
+final $typed_data.Uint8List authResultDescriptor = $convert.base64Decode(
+    'CgpBdXRoUmVzdWx0EhsKF0FVVEhfUkVTVUxUX1VOU1BFQ0lGSUVEEAASFwoTQVVUSF9SRVNVTF'
+    'RfU1VDQ0VTUxABEhsKF0FVVEhfUkVTVUxUX0lOVkFMSURfS0VZEAISIQodQVVUSF9SRVNVTFRf'
+    'SU5WQUxJRF9TSUdOQVRVUkUQAxIiCh5BVVRIX1JFU1VMVF9CT09UU1RSQVBfUkVRVUlSRUQQBB'
+    'IdChlBVVRIX1JFU1VMVF9UT0tFTl9JTlZBTElEEAUSGAoUQVVUSF9SRVNVTFRfSU5URVJOQUwQ'
+    'Bg==');
+
 @$core.Deprecated('Use unsealResultDescriptor instead')
 const UnsealResult$json = {
   '1': 'UnsealResult',
@@ -48,6 +70,23 @@ final $typed_data.Uint8List unsealResultDescriptor = $convert.base64Decode(
     '9SRVNVTFRfU1VDQ0VTUxABEh0KGVVOU0VBTF9SRVNVTFRfSU5WQUxJRF9LRVkQAhIgChxVTlNF'
     'QUxfUkVTVUxUX1VOQk9PVFNUUkFQUEVEEAM=');
 
+@$core.Deprecated('Use bootstrapResultDescriptor instead')
+const BootstrapResult$json = {
+  '1': 'BootstrapResult',
+  '2': [
+    {'1': 'BOOTSTRAP_RESULT_UNSPECIFIED', '2': 0},
+    {'1': 'BOOTSTRAP_RESULT_SUCCESS', '2': 1},
+    {'1': 'BOOTSTRAP_RESULT_ALREADY_BOOTSTRAPPED', '2': 2},
+    {'1': 'BOOTSTRAP_RESULT_INVALID_KEY', '2': 3},
+  ],
+};
+
+/// Descriptor for `BootstrapResult`. Decode as a `google.protobuf.EnumDescriptorProto`.
+final $typed_data.Uint8List bootstrapResultDescriptor = $convert.base64Decode(
+    'Cg9Cb290c3RyYXBSZXN1bHQSIAocQk9PVFNUUkFQX1JFU1VMVF9VTlNQRUNJRklFRBAAEhwKGE'
+    'JPT1RTVFJBUF9SRVNVTFRfU1VDQ0VTUxABEikKJUJPT1RTVFJBUF9SRVNVTFRfQUxSRUFEWV9C'
+    'T09UU1RSQVBQRUQQAhIgChxCT09UU1RSQVBfUkVTVUxUX0lOVkFMSURfS0VZEAM=');
+
 @$core.Deprecated('Use vaultStateDescriptor instead')
 const VaultState$json = {
   '1': 'VaultState',
@@ -105,15 +144,16 @@ final $typed_data.Uint8List authChallengeRequestDescriptor = $convert.base64Deco
 const AuthChallenge$json = {
   '1': 'AuthChallenge',
   '2': [
-    {'1': 'pubkey', '3': 1, '4': 1, '5': 12, '10': 'pubkey'},
     {'1': 'nonce', '3': 2, '4': 1, '5': 5, '10': 'nonce'},
   ],
+  '9': [
+    {'1': 1, '2': 2},
+  ],
 };
 
 /// Descriptor for `AuthChallenge`. Decode as a `google.protobuf.DescriptorProto`.
 final $typed_data.Uint8List authChallengeDescriptor = $convert.base64Decode(
-    'Cg1BdXRoQ2hhbGxlbmdlEhYKBnB1YmtleRgBIAEoDFIGcHVia2V5EhQKBW5vbmNlGAIgASgFUg'
-    'Vub25jZQ==');
+    'Cg1BdXRoQ2hhbGxlbmdlEhQKBW5vbmNlGAIgASgFUgVub25jZUoECAEQAg==');
 
 @$core.Deprecated('Use authChallengeSolutionDescriptor instead')
 const AuthChallengeSolution$json = {
@@ -127,15 +167,6 @@ const AuthChallengeSolution$json = {
 final $typed_data.Uint8List authChallengeSolutionDescriptor = $convert.base64Decode(
     'ChVBdXRoQ2hhbGxlbmdlU29sdXRpb24SHAoJc2lnbmF0dXJlGAEgASgMUglzaWduYXR1cmU=');
 
-@$core.Deprecated('Use authOkDescriptor instead')
-const AuthOk$json = {
-  '1': 'AuthOk',
-};
-
-/// Descriptor for `AuthOk`. Decode as a `google.protobuf.DescriptorProto`.
-final $typed_data.Uint8List authOkDescriptor =
-    $convert.base64Decode('CgZBdXRoT2s=');
-
 @$core.Deprecated('Use unsealStartDescriptor instead')
 const UnsealStart$json = {
   '1': 'UnsealStart',
@@ -177,6 +208,22 @@ final $typed_data.Uint8List unsealEncryptedKeyDescriptor = $convert.base64Decode
     'QYAiABKAxSCmNpcGhlcnRleHQSJwoPYXNzb2NpYXRlZF9kYXRhGAMgASgMUg5hc3NvY2lhdGVk'
     'RGF0YQ==');
 
+@$core.Deprecated('Use bootstrapEncryptedKeyDescriptor instead')
+const BootstrapEncryptedKey$json = {
+  '1': 'BootstrapEncryptedKey',
+  '2': [
+    {'1': 'nonce', '3': 1, '4': 1, '5': 12, '10': 'nonce'},
+    {'1': 'ciphertext', '3': 2, '4': 1, '5': 12, '10': 'ciphertext'},
+    {'1': 'associated_data', '3': 3, '4': 1, '5': 12, '10': 'associatedData'},
+  ],
+};
+
+/// Descriptor for `BootstrapEncryptedKey`. Decode as a `google.protobuf.DescriptorProto`.
+final $typed_data.Uint8List bootstrapEncryptedKeyDescriptor = $convert.base64Decode(
+    'ChVCb290c3RyYXBFbmNyeXB0ZWRLZXkSFAoFbm9uY2UYASABKAxSBW5vbmNlEh4KCmNpcGhlcn'
+    'RleHQYAiABKAxSCmNpcGhlcnRleHQSJwoPYXNzb2NpYXRlZF9kYXRhGAMgASgMUg5hc3NvY2lh'
+    'dGVkRGF0YQ==');
+
 @$core.Deprecated('Use clientConnectionRequestDescriptor instead')
 const ClientConnectionRequest$json = {
   '1': 'ClientConnectionRequest',
@@ -216,6 +263,7 @@ final $typed_data.Uint8List clientConnectionCancelDescriptor =
 const UserAgentRequest$json = {
   '1': 'UserAgentRequest',
   '2': [
+    {'1': 'id', '3': 14, '4': 1, '5': 5, '10': 'id'},
     {
       '1': 'auth_challenge_request',
       '3': 1,
@@ -315,6 +363,15 @@ const UserAgentRequest$json = {
       '9': 0,
       '10': 'clientConnectionResponse'
     },
+    {
+      '1': 'bootstrap_encrypted_key',
+      '3': 12,
+      '4': 1,
+      '5': 11,
+      '6': '.arbiter.user_agent.BootstrapEncryptedKey',
+      '9': 0,
+      '10': 'bootstrapEncryptedKey'
+    },
   ],
   '8': [
     {'1': 'payload'},
@@ -323,28 +380,32 @@ const UserAgentRequest$json = {
 
 /// Descriptor for `UserAgentRequest`. Decode as a `google.protobuf.DescriptorProto`.
 final $typed_data.Uint8List userAgentRequestDescriptor = $convert.base64Decode(
-    'ChBVc2VyQWdlbnRSZXF1ZXN0EmAKFmF1dGhfY2hhbGxlbmdlX3JlcXVlc3QYASABKAsyKC5hcm'
-    'JpdGVyLnVzZXJfYWdlbnQuQXV0aENoYWxsZW5nZVJlcXVlc3RIAFIUYXV0aENoYWxsZW5nZVJl'
-    'cXVlc3QSYwoXYXV0aF9jaGFsbGVuZ2Vfc29sdXRpb24YAiABKAsyKS5hcmJpdGVyLnVzZXJfYW'
-    'dlbnQuQXV0aENoYWxsZW5nZVNvbHV0aW9uSABSFWF1dGhDaGFsbGVuZ2VTb2x1dGlvbhJECgx1'
-    'bnNlYWxfc3RhcnQYAyABKAsyHy5hcmJpdGVyLnVzZXJfYWdlbnQuVW5zZWFsU3RhcnRIAFILdW'
-    '5zZWFsU3RhcnQSWgoUdW5zZWFsX2VuY3J5cHRlZF9rZXkYBCABKAsyJi5hcmJpdGVyLnVzZXJf'
-    'YWdlbnQuVW5zZWFsRW5jcnlwdGVkS2V5SABSEnVuc2VhbEVuY3J5cHRlZEtleRJEChFxdWVyeV'
-    '92YXVsdF9zdGF0ZRgFIAEoCzIWLmdvb2dsZS5wcm90b2J1Zi5FbXB0eUgAUg9xdWVyeVZhdWx0'
-    'U3RhdGUSRAoRZXZtX3dhbGxldF9jcmVhdGUYBiABKAsyFi5nb29nbGUucHJvdG9idWYuRW1wdH'
-    'lIAFIPZXZtV2FsbGV0Q3JlYXRlEkAKD2V2bV93YWxsZXRfbGlzdBgHIAEoCzIWLmdvb2dsZS5w'
-    'cm90b2J1Zi5FbXB0eUgAUg1ldm1XYWxsZXRMaXN0Ek4KEGV2bV9ncmFudF9jcmVhdGUYCCABKA'
-    'syIi5hcmJpdGVyLmV2bS5Fdm1HcmFudENyZWF0ZVJlcXVlc3RIAFIOZXZtR3JhbnRDcmVhdGUS'
-    'TgoQZXZtX2dyYW50X2RlbGV0ZRgJIAEoCzIiLmFyYml0ZXIuZXZtLkV2bUdyYW50RGVsZXRlUm'
-    'VxdWVzdEgAUg5ldm1HcmFudERlbGV0ZRJICg5ldm1fZ3JhbnRfbGlzdBgKIAEoCzIgLmFyYml0'
-    'ZXIuZXZtLkV2bUdyYW50TGlzdFJlcXVlc3RIAFIMZXZtR3JhbnRMaXN0EmwKGmNsaWVudF9jb2'
-    '5uZWN0aW9uX3Jlc3BvbnNlGAsgASgLMiwuYXJiaXRlci51c2VyX2FnZW50LkNsaWVudENvbm5l'
-    'Y3Rpb25SZXNwb25zZUgAUhhjbGllbnRDb25uZWN0aW9uUmVzcG9uc2VCCQoHcGF5bG9hZA==');
+    'ChBVc2VyQWdlbnRSZXF1ZXN0Eg4KAmlkGA4gASgFUgJpZBJgChZhdXRoX2NoYWxsZW5nZV9yZX'
+    'F1ZXN0GAEgASgLMiguYXJiaXRlci51c2VyX2FnZW50LkF1dGhDaGFsbGVuZ2VSZXF1ZXN0SABS'
+    'FGF1dGhDaGFsbGVuZ2VSZXF1ZXN0EmMKF2F1dGhfY2hhbGxlbmdlX3NvbHV0aW9uGAIgASgLMi'
+    'kuYXJiaXRlci51c2VyX2FnZW50LkF1dGhDaGFsbGVuZ2VTb2x1dGlvbkgAUhVhdXRoQ2hhbGxl'
+    'bmdlU29sdXRpb24SRAoMdW5zZWFsX3N0YXJ0GAMgASgLMh8uYXJiaXRlci51c2VyX2FnZW50Ll'
+    'Vuc2VhbFN0YXJ0SABSC3Vuc2VhbFN0YXJ0EloKFHVuc2VhbF9lbmNyeXB0ZWRfa2V5GAQgASgL'
+    'MiYuYXJiaXRlci51c2VyX2FnZW50LlVuc2VhbEVuY3J5cHRlZEtleUgAUhJ1bnNlYWxFbmNyeX'
+    'B0ZWRLZXkSRAoRcXVlcnlfdmF1bHRfc3RhdGUYBSABKAsyFi5nb29nbGUucHJvdG9idWYuRW1w'
+    'dHlIAFIPcXVlcnlWYXVsdFN0YXRlEkQKEWV2bV93YWxsZXRfY3JlYXRlGAYgASgLMhYuZ29vZ2'
+    'xlLnByb3RvYnVmLkVtcHR5SABSD2V2bVdhbGxldENyZWF0ZRJACg9ldm1fd2FsbGV0X2xpc3QY'
+    'ByABKAsyFi5nb29nbGUucHJvdG9idWYuRW1wdHlIAFINZXZtV2FsbGV0TGlzdBJOChBldm1fZ3'
+    'JhbnRfY3JlYXRlGAggASgLMiIuYXJiaXRlci5ldm0uRXZtR3JhbnRDcmVhdGVSZXF1ZXN0SABS'
+    'DmV2bUdyYW50Q3JlYXRlEk4KEGV2bV9ncmFudF9kZWxldGUYCSABKAsyIi5hcmJpdGVyLmV2bS'
+    '5Fdm1HcmFudERlbGV0ZVJlcXVlc3RIAFIOZXZtR3JhbnREZWxldGUSSAoOZXZtX2dyYW50X2xp'
+    'c3QYCiABKAsyIC5hcmJpdGVyLmV2bS5Fdm1HcmFudExpc3RSZXF1ZXN0SABSDGV2bUdyYW50TG'
+    'lzdBJsChpjbGllbnRfY29ubmVjdGlvbl9yZXNwb25zZRgLIAEoCzIsLmFyYml0ZXIudXNlcl9h'
+    'Z2VudC5DbGllbnRDb25uZWN0aW9uUmVzcG9uc2VIAFIYY2xpZW50Q29ubmVjdGlvblJlc3Bvbn'
+    'NlEmMKF2Jvb3RzdHJhcF9lbmNyeXB0ZWRfa2V5GAwgASgLMikuYXJiaXRlci51c2VyX2FnZW50'
+    'LkJvb3RzdHJhcEVuY3J5cHRlZEtleUgAUhVib290c3RyYXBFbmNyeXB0ZWRLZXlCCQoHcGF5bG'
+    '9hZA==');
 
 @$core.Deprecated('Use userAgentResponseDescriptor instead')
 const UserAgentResponse$json = {
   '1': 'UserAgentResponse',
   '2': [
+    {'1': 'id', '3': 14, '4': 1, '5': 5, '9': 1, '10': 'id', '17': true},
     {
       '1': 'auth_challenge',
       '3': 1,
@@ -355,13 +416,13 @@ const UserAgentResponse$json = {
       '10': 'authChallenge'
     },
     {
-      '1': 'auth_ok',
+      '1': 'auth_result',
       '3': 2,
       '4': 1,
-      '5': 11,
-      '6': '.arbiter.user_agent.AuthOk',
+      '5': 14,
+      '6': '.arbiter.user_agent.AuthResult',
       '9': 0,
-      '10': 'authOk'
+      '10': 'authResult'
     },
     {
       '1': 'unseal_start_response',
@@ -453,30 +514,42 @@ const UserAgentResponse$json = {
       '9': 0,
       '10': 'clientConnectionCancel'
     },
+    {
+      '1': 'bootstrap_result',
+      '3': 13,
+      '4': 1,
+      '5': 14,
+      '6': '.arbiter.user_agent.BootstrapResult',
+      '9': 0,
+      '10': 'bootstrapResult'
+    },
   ],
   '8': [
     {'1': 'payload'},
+    {'1': '_id'},
   ],
 };
 
 /// Descriptor for `UserAgentResponse`. Decode as a `google.protobuf.DescriptorProto`.
 final $typed_data.Uint8List userAgentResponseDescriptor = $convert.base64Decode(
-    'ChFVc2VyQWdlbnRSZXNwb25zZRJKCg5hdXRoX2NoYWxsZW5nZRgBIAEoCzIhLmFyYml0ZXIudX'
-    'Nlcl9hZ2VudC5BdXRoQ2hhbGxlbmdlSABSDWF1dGhDaGFsbGVuZ2USNQoHYXV0aF9vaxgCIAEo'
-    'CzIaLmFyYml0ZXIudXNlcl9hZ2VudC5BdXRoT2tIAFIGYXV0aE9rEl0KFXVuc2VhbF9zdGFydF'
-    '9yZXNwb25zZRgDIAEoCzInLmFyYml0ZXIudXNlcl9hZ2VudC5VbnNlYWxTdGFydFJlc3BvbnNl'
-    'SABSE3Vuc2VhbFN0YXJ0UmVzcG9uc2USRwoNdW5zZWFsX3Jlc3VsdBgEIAEoDjIgLmFyYml0ZX'
-    'IudXNlcl9hZ2VudC5VbnNlYWxSZXN1bHRIAFIMdW5zZWFsUmVzdWx0EkEKC3ZhdWx0X3N0YXRl'
-    'GAUgASgOMh4uYXJiaXRlci51c2VyX2FnZW50LlZhdWx0U3RhdGVIAFIKdmF1bHRTdGF0ZRJPCh'
-    'Fldm1fd2FsbGV0X2NyZWF0ZRgGIAEoCzIhLmFyYml0ZXIuZXZtLldhbGxldENyZWF0ZVJlc3Bv'
-    'bnNlSABSD2V2bVdhbGxldENyZWF0ZRJJCg9ldm1fd2FsbGV0X2xpc3QYByABKAsyHy5hcmJpdG'
-    'VyLmV2bS5XYWxsZXRMaXN0UmVzcG9uc2VIAFINZXZtV2FsbGV0TGlzdBJPChBldm1fZ3JhbnRf'
-    'Y3JlYXRlGAggASgLMiMuYXJiaXRlci5ldm0uRXZtR3JhbnRDcmVhdGVSZXNwb25zZUgAUg5ldm'
-    '1HcmFudENyZWF0ZRJPChBldm1fZ3JhbnRfZGVsZXRlGAkgASgLMiMuYXJiaXRlci5ldm0uRXZt'
-    'R3JhbnREZWxldGVSZXNwb25zZUgAUg5ldm1HcmFudERlbGV0ZRJJCg5ldm1fZ3JhbnRfbGlzdB'
-    'gKIAEoCzIhLmFyYml0ZXIuZXZtLkV2bUdyYW50TGlzdFJlc3BvbnNlSABSDGV2bUdyYW50TGlz'
-    'dBJpChljbGllbnRfY29ubmVjdGlvbl9yZXF1ZXN0GAsgASgLMisuYXJiaXRlci51c2VyX2FnZW'
-    '50LkNsaWVudENvbm5lY3Rpb25SZXF1ZXN0SABSF2NsaWVudENvbm5lY3Rpb25SZXF1ZXN0EmYK'
-    'GGNsaWVudF9jb25uZWN0aW9uX2NhbmNlbBgMIAEoCzIqLmFyYml0ZXIudXNlcl9hZ2VudC5DbG'
-    'llbnRDb25uZWN0aW9uQ2FuY2VsSABSFmNsaWVudENvbm5lY3Rpb25DYW5jZWxCCQoHcGF5bG9h'
-    'ZA==');
+    'ChFVc2VyQWdlbnRSZXNwb25zZRITCgJpZBgOIAEoBUgBUgJpZIgBARJKCg5hdXRoX2NoYWxsZW'
+    '5nZRgBIAEoCzIhLmFyYml0ZXIudXNlcl9hZ2VudC5BdXRoQ2hhbGxlbmdlSABSDWF1dGhDaGFs'
+    'bGVuZ2USQQoLYXV0aF9yZXN1bHQYAiABKA4yHi5hcmJpdGVyLnVzZXJfYWdlbnQuQXV0aFJlc3'
+    'VsdEgAUgphdXRoUmVzdWx0El0KFXVuc2VhbF9zdGFydF9yZXNwb25zZRgDIAEoCzInLmFyYml0'
+    'ZXIudXNlcl9hZ2VudC5VbnNlYWxTdGFydFJlc3BvbnNlSABSE3Vuc2VhbFN0YXJ0UmVzcG9uc2'
+    'USRwoNdW5zZWFsX3Jlc3VsdBgEIAEoDjIgLmFyYml0ZXIudXNlcl9hZ2VudC5VbnNlYWxSZXN1'
+    'bHRIAFIMdW5zZWFsUmVzdWx0EkEKC3ZhdWx0X3N0YXRlGAUgASgOMh4uYXJiaXRlci51c2VyX2'
+    'FnZW50LlZhdWx0U3RhdGVIAFIKdmF1bHRTdGF0ZRJPChFldm1fd2FsbGV0X2NyZWF0ZRgGIAEo'
+    'CzIhLmFyYml0ZXIuZXZtLldhbGxldENyZWF0ZVJlc3BvbnNlSABSD2V2bVdhbGxldENyZWF0ZR'
+    'JJCg9ldm1fd2FsbGV0X2xpc3QYByABKAsyHy5hcmJpdGVyLmV2bS5XYWxsZXRMaXN0UmVzcG9u'
+    'c2VIAFINZXZtV2FsbGV0TGlzdBJPChBldm1fZ3JhbnRfY3JlYXRlGAggASgLMiMuYXJiaXRlci'
+    '5ldm0uRXZtR3JhbnRDcmVhdGVSZXNwb25zZUgAUg5ldm1HcmFudENyZWF0ZRJPChBldm1fZ3Jh'
+    'bnRfZGVsZXRlGAkgASgLMiMuYXJiaXRlci5ldm0uRXZtR3JhbnREZWxldGVSZXNwb25zZUgAUg'
+    '5ldm1HcmFudERlbGV0ZRJJCg5ldm1fZ3JhbnRfbGlzdBgKIAEoCzIhLmFyYml0ZXIuZXZtLkV2'
+    'bUdyYW50TGlzdFJlc3BvbnNlSABSDGV2bUdyYW50TGlzdBJpChljbGllbnRfY29ubmVjdGlvbl'
+    '9yZXF1ZXN0GAsgASgLMisuYXJiaXRlci51c2VyX2FnZW50LkNsaWVudENvbm5lY3Rpb25SZXF1'
+    'ZXN0SABSF2NsaWVudENvbm5lY3Rpb25SZXF1ZXN0EmYKGGNsaWVudF9jb25uZWN0aW9uX2Nhbm'
+    'NlbBgMIAEoCzIqLmFyYml0ZXIudXNlcl9hZ2VudC5DbGllbnRDb25uZWN0aW9uQ2FuY2VsSABS'
+    'FmNsaWVudENvbm5lY3Rpb25DYW5jZWwSUAoQYm9vdHN0cmFwX3Jlc3VsdBgNIAEoDjIjLmFyYm'
+    'l0ZXIudXNlcl9hZ2VudC5Cb290c3RyYXBSZXN1bHRIAFIPYm9vdHN0cmFwUmVzdWx0QgkKB3Bh'
+    'eWxvYWRCBQoDX2lk');
diff --git a/useragent/lib/providers/vault_state.dart b/useragent/lib/providers/vault_state.dart
index de02c5e..edb189e 100644
--- a/useragent/lib/providers/vault_state.dart
+++ b/useragent/lib/providers/vault_state.dart
@@ -13,9 +13,7 @@ Future<VaultState?> vaultState(Ref ref) async {
     return null;
   }
 
-  await conn.send(UserAgentRequest(queryVaultState: Empty()));
-
-  final resp = await conn.receive();
+  final resp = await conn.request(UserAgentRequest(queryVaultState: Empty()));
   if (resp.whichPayload() != UserAgentResponse_Payload.vaultState) {
     talker.warning('Expected vault state response, got ${resp.whichPayload()}');
     return null;
diff --git a/useragent/lib/providers/vault_state.g.dart b/useragent/lib/providers/vault_state.g.dart
index aa4f953..7d0bd98 100644
--- a/useragent/lib/providers/vault_state.g.dart
+++ b/useragent/lib/providers/vault_state.g.dart
@@ -46,4 +46,4 @@ final class VaultStateProvider
   }
 }
 
-String _$vaultStateHash() => r'1fd975a9661de1f62beef9eb1c7c439f377a8b88';
+String _$vaultStateHash() => r'97085e49bc3a296e36fa6c04a8f4c9abafac0835';