feat(PoC): terrors crate usage

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

AGENTS.md

@@ -1,128 +0,0 @@
-# AGENTS.md
-
-This file provides guidance to Codex (Codex.ai/code) when working with code in this repository.
-
-## Project Overview
-
-Arbiter is a **permissioned signing service** for cryptocurrency wallets. It consists of:
-- **`server/`** — Rust gRPC daemon that holds encrypted keys and enforces policies
-- **`useragent/`** — Flutter desktop app (macOS/Windows) with a Rust backend via Rinf
-- **`protobufs/`** — Protocol Buffer definitions shared between server and client
-
-The vault never exposes key material; it only produces signatures when requests satisfy configured policies.
-
-## Toolchain Setup
-
-Tools are managed via [mise](https://mise.jdx.dev/). Install all required tools:
-```sh
-mise install
-```
-
-Key versions: Rust 1.93.0 (with clippy), Flutter 3.38.9-stable, protoc 29.6, diesel_cli 2.3.6 (sqlite).
-
-## Server (Rust workspace at `server/`)
-
-### Crates
-
-| Crate | Purpose |
-|---|---|
-| `arbiter-proto` | Generated gRPC stubs + protobuf types; compiled from `protobufs/*.proto` via `tonic-prost-build` |
-| `arbiter-server` | Main daemon — actors, DB, EVM policy engine, gRPC service implementation |
-| `arbiter-useragent` | Rust client library for the user agent side of the gRPC protocol |
-| `arbiter-client` | Rust client library for SDK clients |
-
-### Common Commands
-
-```sh
-cd server
-
-# Build
-cargo build
-
-# Run the server daemon
-cargo run -p arbiter-server
-
-# Run all tests (preferred over cargo test)
-cargo nextest run
-
-# Run a single test
-cargo nextest run <test_name>
-
-# Lint
-cargo clippy
-
-# Security audit
-cargo audit
-
-# Check unused dependencies
-cargo shear
-
-# Run snapshot tests and update snapshots
-cargo insta review
-```
-
-### Architecture
-
-The server is actor-based using the **kameo** crate. All long-lived state lives in `GlobalActors`:
-
-- **`Bootstrapper`** — Manages the one-time bootstrap token written to `~/.arbiter/bootstrap_token` on first run.
-- **`KeyHolder`** — Holds the encrypted root key and manages the Sealed/Unsealed vault state machine. On unseal, decrypts the root key into a `memsafe` hardened memory cell.
-- **`MessageRouter`** — Coordinates streaming messages between user agents and SDK clients.
-- **`EvmActor`** — Handles EVM transaction policy enforcement and signing.
-
-Per-connection actors live under `actors/user_agent/` and `actors/client/`, each with `auth` (challenge-response authentication) and `session` (post-auth operations) sub-modules.
-
-**Database:** SQLite via `diesel-async` + `bb8` connection pool. Schema managed by embedded Diesel migrations in `crates/arbiter-server/migrations/`. DB file lives at `~/.arbiter/arbiter.sqlite`. Tests use a temp-file DB via `db::create_test_pool()`.
-
-**Cryptography:**
-- Authentication: ed25519 (challenge-response, nonce-tracked per peer)
-- Encryption at rest: XChaCha20-Poly1305 (versioned via `scheme` field for transparent migration on unseal)
-- Password KDF: Argon2
-- Unseal transport: X25519 ephemeral key exchange
-- TLS: self-signed certificate (aws-lc-rs backend), fingerprint distributed via `ArbiterUrl`
-
-**Protocol:** gRPC with Protocol Buffers. The `ArbiterUrl` type encodes host, port, CA cert, and bootstrap token into a single shareable string (printed to console on first run).
-
-### Proto Regeneration
-
-When `.proto` files in `protobufs/` change, rebuild to regenerate:
-```sh
-cd server && cargo build -p arbiter-proto
-```
-
-### Database Migrations
-
-```sh
-# Create a new migration
-diesel migration generate <name> --migration-dir crates/arbiter-server/migrations
-
-# Run migrations manually (server also runs them on startup)
-diesel migration run --migration-dir crates/arbiter-server/migrations
-```
-
-## User Agent (Flutter + Rinf at `useragent/`)
-
-The Flutter app uses [Rinf](https://rinf.cunarist.org) to call Rust code. The Rust logic lives in `useragent/native/hub/` as a separate crate that uses `arbiter-useragent` for the gRPC client.
-
-Communication between Dart and Rust uses typed **signals** defined in `useragent/native/hub/src/signals/`. After modifying signal structs, regenerate Dart bindings:
-
-```sh
-cd useragent && rinf gen
-```
-
-### Common Commands
-
-```sh
-cd useragent
-
-# Run the app (macOS or Windows)
-flutter run
-
-# Regenerate Rust↔Dart signal bindings
-rinf gen
-
-# Analyze Dart code
-flutter analyze
-```
-
-The Rinf Rust entry point is `useragent/native/hub/src/lib.rs`. It spawns actors defined in `useragent/native/hub/src/actors/` which handle Dart↔server communication via signals.

CLAUDE.md

@@ -1,128 +0,0 @@
-# CLAUDE.md
-
-This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
-
-## Project Overview
-
-Arbiter is a **permissioned signing service** for cryptocurrency wallets. It consists of:
-- **`server/`** — Rust gRPC daemon that holds encrypted keys and enforces policies
-- **`useragent/`** — Flutter desktop app (macOS/Windows) with a Rust backend via Rinf
-- **`protobufs/`** — Protocol Buffer definitions shared between server and client
-
-The vault never exposes key material; it only produces signatures when requests satisfy configured policies.
-
-## Toolchain Setup
-
-Tools are managed via [mise](https://mise.jdx.dev/). Install all required tools:
-```sh
-mise install
-```
-
-Key versions: Rust 1.93.0 (with clippy), Flutter 3.38.9-stable, protoc 29.6, diesel_cli 2.3.6 (sqlite).
-
-## Server (Rust workspace at `server/`)
-
-### Crates
-
-| Crate | Purpose |
-|---|---|
-| `arbiter-proto` | Generated gRPC stubs + protobuf types; compiled from `protobufs/*.proto` via `tonic-prost-build` |
-| `arbiter-server` | Main daemon — actors, DB, EVM policy engine, gRPC service implementation |
-| `arbiter-useragent` | Rust client library for the user agent side of the gRPC protocol |
-| `arbiter-client` | Rust client library for SDK clients |
-
-### Common Commands
-
-```sh
-cd server
-
-# Build
-cargo build
-
-# Run the server daemon
-cargo run -p arbiter-server
-
-# Run all tests (preferred over cargo test)
-cargo nextest run
-
-# Run a single test
-cargo nextest run <test_name>
-
-# Lint
-cargo clippy
-
-# Security audit
-cargo audit
-
-# Check unused dependencies
-cargo shear
-
-# Run snapshot tests and update snapshots
-cargo insta review
-```
-
-### Architecture
-
-The server is actor-based using the **kameo** crate. All long-lived state lives in `GlobalActors`:
-
-- **`Bootstrapper`** — Manages the one-time bootstrap token written to `~/.arbiter/bootstrap_token` on first run.
-- **`KeyHolder`** — Holds the encrypted root key and manages the Sealed/Unsealed vault state machine. On unseal, decrypts the root key into a `memsafe` hardened memory cell.
-- **`MessageRouter`** — Coordinates streaming messages between user agents and SDK clients.
-- **`EvmActor`** — Handles EVM transaction policy enforcement and signing.
-
-Per-connection actors live under `actors/user_agent/` and `actors/client/`, each with `auth` (challenge-response authentication) and `session` (post-auth operations) sub-modules.
-
-**Database:** SQLite via `diesel-async` + `bb8` connection pool. Schema managed by embedded Diesel migrations in `crates/arbiter-server/migrations/`. DB file lives at `~/.arbiter/arbiter.sqlite`. Tests use a temp-file DB via `db::create_test_pool()`.
-
-**Cryptography:**
-- Authentication: ed25519 (challenge-response, nonce-tracked per peer)
-- Encryption at rest: XChaCha20-Poly1305 (versioned via `scheme` field for transparent migration on unseal)
-- Password KDF: Argon2
-- Unseal transport: X25519 ephemeral key exchange
-- TLS: self-signed certificate (aws-lc-rs backend), fingerprint distributed via `ArbiterUrl`
-
-**Protocol:** gRPC with Protocol Buffers. The `ArbiterUrl` type encodes host, port, CA cert, and bootstrap token into a single shareable string (printed to console on first run).
-
-### Proto Regeneration
-
-When `.proto` files in `protobufs/` change, rebuild to regenerate:
-```sh
-cd server && cargo build -p arbiter-proto
-```
-
-### Database Migrations
-
-```sh
-# Create a new migration
-diesel migration generate <name> --migration-dir crates/arbiter-server/migrations
-
-# Run migrations manually (server also runs them on startup)
-diesel migration run --migration-dir crates/arbiter-server/migrations
-```
-
-## User Agent (Flutter + Rinf at `useragent/`)
-
-The Flutter app uses [Rinf](https://rinf.cunarist.org) to call Rust code. The Rust logic lives in `useragent/native/hub/` as a separate crate that uses `arbiter-useragent` for the gRPC client.
-
-Communication between Dart and Rust uses typed **signals** defined in `useragent/native/hub/src/signals/`. After modifying signal structs, regenerate Dart bindings:
-
-```sh
-cd useragent && rinf gen
-```
-
-### Common Commands
-
-```sh
-cd useragent
-
-# Run the app (macOS or Windows)
-flutter run
-
-# Regenerate Rust↔Dart signal bindings
-rinf gen
-
-# Analyze Dart code
-flutter analyze
-```
-
-The Rinf Rust entry point is `useragent/native/hub/src/lib.rs`. It spawns actors defined in `useragent/native/hub/src/actors/` which handle Dart↔server communication via signals.

mise.lock

@@ -42,10 +42,6 @@ backend = "cargo:diesel_cli"
 default-features = "false"
 features = "sqlite,sqlite-bundled"
 
-[[tools."cargo:rinf_cli"]]
-version = "8.9.1"
-backend = "cargo:rinf_cli"
-
 [[tools.flutter]]
 version = "3.38.9-stable"
 backend = "asdf:flutter"

mise.toml

@@ -10,11 +10,3 @@ protoc = "29.6"
 "cargo:cargo-shear" = "latest"
 "cargo:cargo-insta" = "1.46.3"
 python = "3.14.3"
-
-[tasks.codegen]
-sources = ['protobufs/*.proto']
-outputs = ['useragent/lib/proto/*']
-run = '''
-dart pub global activate protoc_plugin && \
-protoc --dart_out=grpc:useragent/lib/proto --proto_path=protobufs/ protobufs/*.proto
-'''

protobufs/client.proto

@@ -23,6 +23,7 @@ message ClientRequest {
   oneof payload {
     AuthChallengeRequest auth_challenge_request = 1;
     AuthChallengeSolution auth_challenge_solution = 2;
+    arbiter.evm.EvmSignTransactionRequest evm_sign_transaction = 3;
   }
 }
 

protobufs/user_agent.proto

@@ -12,6 +12,55 @@ enum KeyType {
   KEY_TYPE_RSA = 3;
 }
 
+// --- SDK client management ---
+
+enum SdkClientError {
+  SDK_CLIENT_ERROR_UNSPECIFIED = 0;
+  SDK_CLIENT_ERROR_ALREADY_EXISTS = 1;
+  SDK_CLIENT_ERROR_NOT_FOUND = 2;
+  SDK_CLIENT_ERROR_HAS_RELATED_DATA = 3; // hard-delete blocked by FK (client has grants or transaction logs)
+  SDK_CLIENT_ERROR_INTERNAL = 4;
+}
+
+message SdkClientApproveRequest {
+  bytes pubkey = 1; // 32-byte ed25519 public key
+}
+
+message SdkClientRevokeRequest {
+  int32 client_id = 1;
+}
+
+message SdkClientEntry {
+  int32 id = 1;
+  bytes pubkey = 2;
+  int32 created_at = 3;
+}
+
+message SdkClientList {
+  repeated SdkClientEntry clients = 1;
+}
+
+message SdkClientApproveResponse {
+  oneof result {
+    SdkClientEntry client = 1;
+    SdkClientError error = 2;
+  }
+}
+
+message SdkClientRevokeResponse {
+  oneof result {
+    google.protobuf.Empty ok = 1;
+    SdkClientError error = 2;
+  }
+}
+
+message SdkClientListResponse {
+  oneof result {
+    SdkClientList clients = 1;
+    SdkClientError error = 2;
+  }
+}
+
 message AuthChallengeRequest {
   bytes pubkey = 1;
   optional string bootstrap_token = 2;
@@ -42,12 +91,6 @@ message UnsealEncryptedKey {
   bytes associated_data = 3;
 }
 
-message BootstrapEncryptedKey {
-  bytes nonce = 1;
-  bytes ciphertext = 2;
-  bytes associated_data = 3;
-}
-
 enum UnsealResult {
   UNSEAL_RESULT_UNSPECIFIED = 0;
   UNSEAL_RESULT_SUCCESS = 1;
@@ -55,13 +98,6 @@ enum UnsealResult {
   UNSEAL_RESULT_UNBOOTSTRAPPED = 3;
 }
 
-enum BootstrapResult {
-  BOOTSTRAP_RESULT_UNSPECIFIED = 0;
-  BOOTSTRAP_RESULT_SUCCESS = 1;
-  BOOTSTRAP_RESULT_ALREADY_BOOTSTRAPPED = 2;
-  BOOTSTRAP_RESULT_INVALID_KEY = 3;
-}
-
 enum VaultState {
   VAULT_STATE_UNSPECIFIED = 0;
   VAULT_STATE_UNBOOTSTRAPPED = 1;
@@ -70,16 +106,6 @@ enum VaultState {
   VAULT_STATE_ERROR = 4;
 }
 
-message ClientConnectionRequest {
-  bytes pubkey = 1;
-}
-
-message ClientConnectionResponse {
-  bool approved = 1;
-}
-
-message ClientConnectionCancel {}
-
 message UserAgentRequest {
   oneof payload {
     AuthChallengeRequest auth_challenge_request = 1;
@@ -92,8 +118,10 @@ message UserAgentRequest {
     arbiter.evm.EvmGrantCreateRequest evm_grant_create = 8;
     arbiter.evm.EvmGrantDeleteRequest evm_grant_delete = 9;
     arbiter.evm.EvmGrantListRequest evm_grant_list = 10;
-    ClientConnectionResponse client_connection_response = 11;
+    // field 11 reserved: was client_connection_response (online approval removed)
-    BootstrapEncryptedKey bootstrap_encrypted_key = 12;
+    SdkClientApproveRequest sdk_client_approve = 12;
+    SdkClientRevokeRequest sdk_client_revoke = 13;
+    google.protobuf.Empty sdk_client_list = 14;
   }
 }
 message UserAgentResponse {
@@ -108,8 +136,9 @@ message UserAgentResponse {
     arbiter.evm.EvmGrantCreateResponse evm_grant_create = 8;
     arbiter.evm.EvmGrantDeleteResponse evm_grant_delete = 9;
     arbiter.evm.EvmGrantListResponse evm_grant_list = 10;
-    ClientConnectionRequest client_connection_request = 11;
+    // fields 11, 12 reserved: were client_connection_request, client_connection_cancel (online approval removed)
-    ClientConnectionCancel client_connection_cancel = 12;
+    SdkClientApproveResponse sdk_client_approve = 13;
-    BootstrapResult bootstrap_result = 13;
+    SdkClientRevokeResponse sdk_client_revoke = 14;
+    SdkClientListResponse sdk_client_list = 15;
   }
 }

server/Cargo.lock

@@ -678,6 +678,18 @@ checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
 [[package]]
 name = "arbiter-client"
 version = "0.1.0"
+dependencies = [
+ "alloy",
+ "arbiter-proto",
+ "async-trait",
+ "ed25519-dalek",
+ "http",
+ "rustls-webpki",
+ "thiserror",
+ "tokio",
+ "tokio-stream",
+ "tonic",
+]
 
 [[package]]
 name = "arbiter-proto"
@@ -691,6 +703,7 @@ dependencies = [
  "miette",
  "prost",
  "prost-types",
+ "protoc-bin-vendored",
  "rand 0.10.0",
  "rcgen",
  "rstest",
@@ -727,7 +740,6 @@ dependencies = [
  "memsafe",
  "miette",
  "pem",
- "prost-types",
  "rand 0.10.0",
  "rcgen",
  "restructed",
@@ -749,6 +761,13 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "arbiter-terrors-poc"
+version = "0.1.0"
+dependencies = [
+ "terrors",
+]
+
 [[package]]
 name = "arbiter-tokens-registry"
 version = "0.1.0"
@@ -756,6 +775,30 @@ dependencies = [
  "alloy",
 ]
 
+[[package]]
+name = "arbiter-useragent"
+version = "0.1.0"
+dependencies = [
+ "arbiter-proto",
+ "async-trait",
+ "ed25519-dalek",
+ "http",
+ "k256",
+ "kameo",
+ "rand 0.10.0",
+ "rsa",
+ "rustls-webpki",
+ "sha2 0.10.9",
+ "smlang",
+ "spki",
+ "thiserror",
+ "tokio",
+ "tokio-stream",
+ "tonic",
+ "tracing",
+ "x25519-dalek",
+]
+
 [[package]]
 name = "argon2"
 version = "0.5.3"
@@ -3637,6 +3680,70 @@ dependencies = [
  "prost",
 ]
 
+[[package]]
+name = "protoc-bin-vendored"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1c381df33c98266b5f08186583660090a4ffa0889e76c7e9a5e175f645a67fa"
+dependencies = [
+ "protoc-bin-vendored-linux-aarch_64",
+ "protoc-bin-vendored-linux-ppcle_64",
+ "protoc-bin-vendored-linux-s390_64",
+ "protoc-bin-vendored-linux-x86_32",
+ "protoc-bin-vendored-linux-x86_64",
+ "protoc-bin-vendored-macos-aarch_64",
+ "protoc-bin-vendored-macos-x86_64",
+ "protoc-bin-vendored-win32",
+]
+
+[[package]]
+name = "protoc-bin-vendored-linux-aarch_64"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c350df4d49b5b9e3ca79f7e646fde2377b199e13cfa87320308397e1f37e1a4c"
+
+[[package]]
+name = "protoc-bin-vendored-linux-ppcle_64"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a55a63e6c7244f19b5c6393f025017eb5d793fd5467823a099740a7a4222440c"
+
+[[package]]
+name = "protoc-bin-vendored-linux-s390_64"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1dba5565db4288e935d5330a07c264a4ee8e4a5b4a4e6f4e83fad824cc32f3b0"
+
+[[package]]
+name = "protoc-bin-vendored-linux-x86_32"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8854774b24ee28b7868cd71dccaae8e02a2365e67a4a87a6cd11ee6cdbdf9cf5"
+
+[[package]]
+name = "protoc-bin-vendored-linux-x86_64"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b38b07546580df720fa464ce124c4b03630a6fb83e05c336fea2a241df7e5d78"
+
+[[package]]
+name = "protoc-bin-vendored-macos-aarch_64"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "89278a9926ce312e51f1d999fee8825d324d603213344a9a706daa009f1d8092"
+
+[[package]]
+name = "protoc-bin-vendored-macos-x86_64"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "81745feda7ccfb9471d7a4de888f0652e806d5795b61480605d4943176299756"
+
+[[package]]
+name = "protoc-bin-vendored-win32"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "95067976aca6421a523e491fce939a3e65249bac4b977adee0ee9771568e8aa3"
+
 [[package]]
 name = "pulldown-cmark"
 version = "0.13.1"
@@ -4756,6 +4863,12 @@ dependencies = [
  "windows-sys 0.60.2",
 ]
 
+[[package]]
+name = "terrors"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "987fd8c678ca950df2a18b2c6e9da6ca511d449278fab3565efe0d49c0c07a5d"
+
 [[package]]
 name = "test-log"
 version = "0.2.19"
@@ -4868,9 +4981,9 @@ dependencies = [
 
 [[package]]
 name = "tinyvec"
-version = "1.11.0"
+version = "1.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3e61e67053d25a4e82c844e8424039d9745781b3fc4f32b8d55ed50f5f667ef3"
+checksum = "bfa5fdc3bce6191a1dbc8c02d5c8bffcf557bafa17c124c5264a458f1b0613fa"
 dependencies = [
  "tinyvec_macros",
 ]

server/Cargo.toml

@@ -20,7 +20,7 @@ tokio = { version = "1.49.0", features = ["full"] }
 ed25519-dalek = { version = "3.0.0-pre.6", features = ["rand_core"] }
 chrono = { version = "0.4.43", features = ["serde"] }
 rand = "0.10.0"
-rustls = { version = "0.23.36", features = ["aws-lc-rs"] }
+rustls = "0.23.36"
 smlang = "0.8.0"
 miette = { version = "7.6.0", features = ["fancy", "serde"] }
 thiserror = "2.0.18"

server/crates/arbiter-client/Cargo.toml

@@ -5,4 +5,18 @@ edition = "2024"
 repository = "https://git.markettakers.org/MarketTakers/arbiter"
 license = "Apache-2.0"
 
+[lints]
+workspace = true
+
 [dependencies]
+arbiter-proto.path = "../arbiter-proto"
+alloy.workspace = true
+tonic.workspace = true
+tonic.features = ["tls-aws-lc"]
+tokio.workspace = true
+tokio-stream.workspace = true
+ed25519-dalek.workspace = true
+thiserror.workspace = true
+http = "1.4.0"
+rustls-webpki = { version = "0.103.9", features = ["aws-lc-rs"] }
+async-trait.workspace = true

server/crates/arbiter-client/src/lib.rs

@@ -1,14 +1,272 @@
-pub fn add(left: u64, right: u64) -> u64 {
+use alloy::{
-    left + right
+    consensus::SignableTransaction,
+    network::TxSigner,
+    primitives::{Address, B256, ChainId, Signature},
+    signers::{Error, Result, Signer},
+};
+use arbiter_proto::{
+    format_challenge,
+    proto::{
+        arbiter_service_client::ArbiterServiceClient,
+        client::{
+            AuthChallengeRequest, AuthChallengeSolution, ClientRequest, ClientResponse,
+            client_connect_error, client_request::Payload as ClientRequestPayload,
+            client_response::Payload as ClientResponsePayload,
+        },
+        evm::{
+            EvmSignTransactionRequest, evm_sign_transaction_response::Result as SignResponseResult,
+        },
+    },
+    url::ArbiterUrl,
+};
+use async_trait::async_trait;
+use ed25519_dalek::Signer as _;
+use tokio::sync::{Mutex, mpsc};
+use tokio_stream::wrappers::ReceiverStream;
+use tonic::transport::ClientTlsConfig;
+
+#[derive(Debug, thiserror::Error)]
+pub enum ConnectError {
+    #[error("Could not establish connection")]
+    Connection(#[from] tonic::transport::Error),
+
+    #[error("Invalid server URI")]
+    InvalidUri(#[from] http::uri::InvalidUri),
+
+    #[error("Invalid CA certificate")]
+    InvalidCaCert(#[from] webpki::Error),
+
+    #[error("gRPC error")]
+    Grpc(#[from] tonic::Status),
+
+    #[error("Auth challenge was not returned by server")]
+    MissingAuthChallenge,
+
+    #[error("Client approval denied by User Agent")]
+    ApprovalDenied,
+
+    #[error("No User Agents online to approve client")]
+    NoUserAgentsOnline,
+
+    #[error("Unexpected auth response payload")]
+    UnexpectedAuthResponse,
 }
 
-#[cfg(test)]
+#[derive(Debug, thiserror::Error)]
-mod tests {
+enum ClientSignError {
-    use super::*;
+    #[error("Transport channel closed")]
+    ChannelClosed,
 
-    #[test]
+    #[error("Connection closed by server")]
-    fn it_works() {
+    ConnectionClosed,
-        let result = add(2, 2);
+
-        assert_eq!(result, 4);
+    #[error("Invalid response payload")]
+    InvalidResponse,
+
+    #[error("Remote signing was rejected")]
+    Rejected,
+}
+
+struct ClientTransport {
+    sender: mpsc::Sender<ClientRequest>,
+    receiver: tonic::Streaming<ClientResponse>,
+}
+
+impl ClientTransport {
+    async fn send(&mut self, request: ClientRequest) -> std::result::Result<(), ClientSignError> {
+        self.sender
+            .send(request)
+            .await
+            .map_err(|_| ClientSignError::ChannelClosed)
+    }
+
+    async fn recv(&mut self) -> std::result::Result<ClientResponse, ClientSignError> {
+        match self.receiver.message().await {
+            Ok(Some(resp)) => Ok(resp),
+            Ok(None) => Err(ClientSignError::ConnectionClosed),
+            Err(_) => Err(ClientSignError::ConnectionClosed),
+        }
+    }
+}
+
+pub struct ArbiterSigner {
+    transport: Mutex<ClientTransport>,
+    address: Address,
+    chain_id: Option<ChainId>,
+}
+
+impl ArbiterSigner {
+    pub async fn connect_grpc(
+        url: ArbiterUrl,
+        key: ed25519_dalek::SigningKey,
+        address: Address,
+    ) -> std::result::Result<Self, ConnectError> {
+        let anchor = webpki::anchor_from_trusted_cert(&url.ca_cert)?.to_owned();
+        let tls = ClientTlsConfig::new().trust_anchor(anchor);
+
+        // NOTE: We intentionally keep the same URL construction strategy as the user-agent crate
+        // to avoid behavior drift between the two clients.
+        let channel = tonic::transport::Channel::from_shared(format!("{}:{}", url.host, url.port))?
+            .tls_config(tls)?
+            .connect()
+            .await?;
+
+        let mut client = ArbiterServiceClient::new(channel);
+        let (tx, rx) = mpsc::channel(16);
+        let response_stream = client.client(ReceiverStream::new(rx)).await?.into_inner();
+
+        let mut transport = ClientTransport {
+            sender: tx,
+            receiver: response_stream,
+        };
+
+        authenticate(&mut transport, key).await?;
+
+        Ok(Self {
+            transport: Mutex::new(transport),
+            address,
+            chain_id: None,
+        })
+    }
+
+    async fn sign_transaction_via_arbiter(
+        &self,
+        tx: &mut dyn SignableTransaction<Signature>,
+    ) -> Result<Signature> {
+        if let Some(chain_id) = self.chain_id
+            && !tx.set_chain_id_checked(chain_id)
+        {
+            return Err(Error::TransactionChainIdMismatch {
+                signer: chain_id,
+                tx: tx.chain_id().unwrap(),
+            });
+        }
+
+        let mut rlp_transaction = Vec::new();
+        tx.encode_for_signing(&mut rlp_transaction);
+
+        let request = ClientRequest {
+            payload: Some(ClientRequestPayload::EvmSignTransaction(
+                EvmSignTransactionRequest {
+                    wallet_address: self.address.as_slice().to_vec(),
+                    rlp_transaction,
+                },
+            )),
+        };
+
+        let mut transport = self.transport.lock().await;
+        transport.send(request).await.map_err(Error::other)?;
+        let response = transport.recv().await.map_err(Error::other)?;
+
+        let payload = response
+            .payload
+            .ok_or_else(|| Error::other(ClientSignError::InvalidResponse))?;
+
+        let ClientResponsePayload::EvmSignTransaction(sign_response) = payload else {
+            return Err(Error::other(ClientSignError::InvalidResponse));
+        };
+
+        let Some(result) = sign_response.result else {
+            return Err(Error::other(ClientSignError::InvalidResponse));
+        };
+
+        match result {
+            SignResponseResult::Signature(bytes) => {
+                Signature::try_from(bytes.as_slice()).map_err(Error::other)
+            }
+            SignResponseResult::EvalError(_) | SignResponseResult::Error(_) => {
+                Err(Error::other(ClientSignError::Rejected))
+            }
+        }
+    }
+}
+
+async fn authenticate(
+    transport: &mut ClientTransport,
+    key: ed25519_dalek::SigningKey,
+) -> std::result::Result<(), ConnectError> {
+    transport
+        .send(ClientRequest {
+            payload: Some(ClientRequestPayload::AuthChallengeRequest(
+                AuthChallengeRequest {
+                    pubkey: key.verifying_key().to_bytes().to_vec(),
+                },
+            )),
+        })
+        .await
+        .map_err(|_| ConnectError::UnexpectedAuthResponse)?;
+
+    let response = transport
+        .recv()
+        .await
+        .map_err(|_| ConnectError::MissingAuthChallenge)?;
+
+    let payload = response.payload.ok_or(ConnectError::MissingAuthChallenge)?;
+    match payload {
+        ClientResponsePayload::AuthChallenge(challenge) => {
+            let challenge_payload = format_challenge(challenge.nonce, &challenge.pubkey);
+            let signature = key.sign(&challenge_payload).to_bytes().to_vec();
+
+            transport
+                .send(ClientRequest {
+                    payload: Some(ClientRequestPayload::AuthChallengeSolution(
+                        AuthChallengeSolution { signature },
+                    )),
+                })
+                .await
+                .map_err(|_| ConnectError::UnexpectedAuthResponse)?;
+
+            // Current server flow does not emit `AuthOk` for SDK clients, so we proceed after
+            // sending the solution. If authentication fails, the first business request will return
+            // a `ClientConnectError` or the stream will close.
+            Ok(())
+        }
+        ClientResponsePayload::ClientConnectError(err) => {
+            match client_connect_error::Code::try_from(err.code)
+                .unwrap_or(client_connect_error::Code::Unknown)
+            {
+                client_connect_error::Code::ApprovalDenied => Err(ConnectError::ApprovalDenied),
+                client_connect_error::Code::NoUserAgentsOnline => {
+                    Err(ConnectError::NoUserAgentsOnline)
+                }
+                client_connect_error::Code::Unknown => Err(ConnectError::UnexpectedAuthResponse),
+            }
+        }
+        _ => Err(ConnectError::UnexpectedAuthResponse),
+    }
+}
+
+#[async_trait]
+impl Signer for ArbiterSigner {
+    async fn sign_hash(&self, _hash: &B256) -> Result<Signature> {
+        Err(Error::other(
+            "hash-only signing is not supported for ArbiterSigner; use transaction signing",
+        ))
+    }
+
+    fn address(&self) -> Address {
+        self.address
+    }
+
+    fn chain_id(&self) -> Option<ChainId> {
+        self.chain_id
+    }
+
+    fn set_chain_id(&mut self, chain_id: Option<ChainId>) {
+        self.chain_id = chain_id;
+    }
+}
+
+#[async_trait]
+impl TxSigner<Signature> for ArbiterSigner {
+    fn address(&self) -> Address {
+        self.address
+    }
+
+    async fn sign_transaction(
+        &self,
+        tx: &mut dyn SignableTransaction<Signature>,
+    ) -> Result<Signature> {
+        self.sign_transaction_via_arbiter(tx).await
     }
 }

server/crates/arbiter-proto/Cargo.toml

@@ -24,6 +24,7 @@ async-trait.workspace = true
 
 [build-dependencies]
 tonic-prost-build = "0.14.3"
+protoc-bin-vendored = "3"
 
 [dev-dependencies]
 rstest.workspace = true

server/crates/arbiter-proto/build.rs

@@ -3,6 +3,12 @@ use tonic_prost_build::configure;
 static PROTOBUF_DIR: &str = "../../../protobufs";
 
 fn main() -> Result<(), Box<dyn std::error::Error>> {
+    if std::env::var("PROTOC").is_err() {
+        println!("cargo:warning=PROTOC environment variable not set, using vendored protoc");
+        let protoc = protoc_bin_vendored::protoc_bin_path().unwrap();
+        unsafe { std::env::set_var("PROTOC", protoc) };
+    }
+
     println!("cargo::rerun-if-changed={PROTOBUF_DIR}");
 
     configure()

server/crates/arbiter-proto/src/transport.rs

@@ -1,39 +1,78 @@
-//! Transport-facing abstractions shared by protocol/session code.
+//! Transport-facing abstractions for protocol/session code.
 //!
-//! This module defines a small duplex interface, [`Bi`], that actors and other
+//! This module separates three concerns:
-//! protocol code can depend on without knowing anything about the concrete
+//!
-//! transport underneath.
+//! - protocol/session logic wants a small duplex interface ([`Bi`])
+//! - transport adapters push concrete stream items to an underlying IO layer
+//! - transport boundaries translate between protocol-facing and transport-facing
+//!   item types via direction-specific converters
 //!
 //! [`Bi`] is intentionally minimal and transport-agnostic:
-//! - [`Bi::recv`] yields inbound messages
+//! - [`Bi::recv`] yields inbound protocol messages
-//! - [`Bi::send`] accepts outbound messages
+//! - [`Bi::send`] accepts outbound protocol/domain items
-//!
-//! Transport-specific adapters, including protobuf or gRPC bridges, live in the
-//! crates that own those boundaries rather than in `arbiter-proto`.
 //!
 //! # Generic Ordering Rule
 //!
-//! This module consistently uses `Inbound` first and `Outbound` second in
+//! This module uses a single convention consistently: when a type or trait is
-//! generic parameter lists.
+//! parameterized by protocol message directions, the generic parameters are
+//! declared as `Inbound` first, then `Outbound`.
 //!
 //! For [`Bi`], that means `Bi<Inbound, Outbound>`:
 //! - `recv() -> Option<Inbound>`
 //! - `send(Outbound)`
 //!
-//! [`expect_message`] is a small helper for request/response style flows: it
+//! For adapter types that are parameterized by direction-specific converters,
-//! reads one inbound message from a transport and extracts a typed value from
+//! inbound-related converter parameters are declared before outbound-related
-//! it, failing if the channel closes or the message shape is not what the
+//! converter parameters.
-//! caller expected.
 //!
-//! [`DummyTransport`] is a no-op implementation useful for tests and local
+//! [`RecvConverter`] and [`SendConverter`] are infallible conversion traits used
-//! actor execution where no real stream exists.
+//! by adapters to map between protocol-facing and transport-facing item types.
+//! The traits themselves are not result-aware; adapters decide how transport
+//! errors are handled before (or instead of) conversion.
+//!
+//! [`grpc::GrpcAdapter`] combines:
+//! - a tonic inbound stream
+//! - a Tokio sender for outbound transport items
+//! - a [`RecvConverter`] for the receive path
+//! - a [`SendConverter`] for the send path
+//!
+//! [`DummyTransport`] is a no-op implementation useful for tests and local actor
+//! execution where no real network stream exists.
+//!
+//! # Component Interaction
+//!
+//! ```text
+//! inbound (network -> protocol)
+//! ============================
+//!
+//! tonic::Streaming<RecvTransport>
+//!     -> grpc::GrpcAdapter::recv()
+//!          |
+//!          +--> on `Ok(item)`: RecvConverter::convert(RecvTransport) -> Inbound
+//!          +--> on `Err(status)`: log error and close stream (`None`)
+//!     -> Bi::recv()
+//!     -> protocol/session actor
+//!
+//! outbound (protocol -> network)
+//! ==============================
+//!
+//! protocol/session actor
+//!     -> Bi::send(Outbound)
+//!     -> grpc::GrpcAdapter::send()
+//!          |
+//!          +--> SendConverter::convert(Outbound) -> SendTransport
+//!     -> Tokio mpsc::Sender<SendTransport>
+//!     -> tonic response stream
+//! ```
 //!
 //! # Design Notes
 //!
-//! - [`Bi::send`] returns [`Error`] only for transport delivery failures, such
+//! - `send()` returns [`Error`] only for transport delivery failures (for
-//!   as a closed outbound channel.
+//!   example, when the outbound channel is closed).
-//! - [`Bi::recv`] returns `None` when the underlying transport closes.
+//! - [`grpc::GrpcAdapter`] logs tonic receive errors and treats them as stream
-//! - Message translation is intentionally out of scope for this module.
+//!   closure (`None`).
+//! - When protocol-facing and transport-facing types are identical, use
+//!   [`IdentityRecvConverter`] / [`IdentitySendConverter`].
 
 use std::marker::PhantomData;
 
@@ -75,6 +114,162 @@ pub trait Bi<Inbound, Outbound>: Send + Sync + 'static {
     async fn recv(&mut self) -> Option<Inbound>;
 }
 
+/// Converts transport-facing inbound items into protocol-facing inbound items.
+pub trait RecvConverter: Send + Sync + 'static {
+    type Input;
+    type Output;
+
+    fn convert(&self, item: Self::Input) -> Self::Output;
+}
+
+/// Converts protocol/domain outbound items into transport-facing outbound items.
+pub trait SendConverter: Send + Sync + 'static {
+    type Input;
+    type Output;
+
+    fn convert(&self, item: Self::Input) -> Self::Output;
+}
+
+/// A [`RecvConverter`] that forwards values unchanged.
+pub struct IdentityRecvConverter<T> {
+    _marker: PhantomData<T>,
+}
+
+impl<T> IdentityRecvConverter<T> {
+    pub fn new() -> Self {
+        Self {
+            _marker: PhantomData,
+        }
+    }
+}
+
+impl<T> Default for IdentityRecvConverter<T> {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl<T> RecvConverter for IdentityRecvConverter<T>
+where
+    T: Send + Sync + 'static,
+{
+    type Input = T;
+    type Output = T;
+
+    fn convert(&self, item: Self::Input) -> Self::Output {
+        item
+    }
+}
+
+/// A [`SendConverter`] that forwards values unchanged.
+pub struct IdentitySendConverter<T> {
+    _marker: PhantomData<T>,
+}
+
+impl<T> IdentitySendConverter<T> {
+    pub fn new() -> Self {
+        Self {
+            _marker: PhantomData,
+        }
+    }
+}
+
+impl<T> Default for IdentitySendConverter<T> {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl<T> SendConverter for IdentitySendConverter<T>
+where
+    T: Send + Sync + 'static,
+{
+    type Input = T;
+    type Output = T;
+
+    fn convert(&self, item: Self::Input) -> Self::Output {
+        item
+    }
+}
+
+/// gRPC-specific transport adapters and helpers.
+pub mod grpc {
+    use async_trait::async_trait;
+    use futures::StreamExt;
+    use tokio::sync::mpsc;
+    use tonic::Streaming;
+
+    use super::{Bi, Error, RecvConverter, SendConverter};
+
+    /// [`Bi`] adapter backed by a tonic gRPC bidirectional stream.
+    ///
+    /// Tonic receive errors are logged and treated as stream closure (`None`).
+    /// The receive converter is only invoked for successful inbound transport
+    /// items.
+    pub struct GrpcAdapter<InboundConverter, OutboundConverter>
+    where
+        InboundConverter: RecvConverter,
+        OutboundConverter: SendConverter,
+    {
+        sender: mpsc::Sender<OutboundConverter::Output>,
+        receiver: Streaming<InboundConverter::Input>,
+        inbound_converter: InboundConverter,
+        outbound_converter: OutboundConverter,
+    }
+
+    impl<InboundTransport, Inbound, InboundConverter, OutboundConverter>
+        GrpcAdapter<InboundConverter, OutboundConverter>
+    where
+        InboundConverter: RecvConverter<Input = InboundTransport, Output = Inbound>,
+        OutboundConverter: SendConverter,
+    {
+        pub fn new(
+            sender: mpsc::Sender<OutboundConverter::Output>,
+            receiver: Streaming<InboundTransport>,
+            inbound_converter: InboundConverter,
+            outbound_converter: OutboundConverter,
+        ) -> Self {
+            Self {
+                sender,
+                receiver,
+                inbound_converter,
+                outbound_converter,
+            }
+        }
+    }
+
+    #[async_trait]
+    impl<InboundConverter, OutboundConverter> Bi<InboundConverter::Output, OutboundConverter::Input>
+        for GrpcAdapter<InboundConverter, OutboundConverter>
+    where
+        InboundConverter: RecvConverter,
+        OutboundConverter: SendConverter,
+        OutboundConverter::Input: Send + 'static,
+        OutboundConverter::Output: Send + 'static,
+    {
+        #[tracing::instrument(level = "trace", skip(self, item))]
+        async fn send(&mut self, item: OutboundConverter::Input) -> Result<(), Error> {
+            let outbound = self.outbound_converter.convert(item);
+            self.sender
+                .send(outbound)
+                .await
+                .map_err(|_| Error::ChannelClosed)
+        }
+
+        #[tracing::instrument(level = "trace", skip(self))]
+        async fn recv(&mut self) -> Option<InboundConverter::Output> {
+            match self.receiver.next().await {
+                Some(Ok(item)) => Some(self.inbound_converter.convert(item)),
+                Some(Err(error)) => {
+                    tracing::error!(error = ?error, "grpc transport recv failed; closing stream");
+                    None
+                }
+                None => None,
+            }
+        }
+    }
+}
+
 /// No-op [`Bi`] transport for tests and manual actor usage.
 ///
 /// `send` drops all items and succeeds. [`Bi::recv`] never resolves and therefore

server/crates/arbiter-server/Cargo.toml

@@ -50,7 +50,6 @@ rsa.workspace = true
 sha2.workspace = true
 spki.workspace = true
 alloy.workspace = true
-prost-types.workspace = true
 arbiter-tokens-registry.path = "../arbiter-tokens-registry"
 
 [dev-dependencies]

server/crates/arbiter-server/migrations/2026-03-15-103112-0000_add_program_client_pubkey_unique/down.sql

@@ -0,0 +1 @@
+DROP INDEX IF EXISTS program_client_public_key_unique;

server/crates/arbiter-server/migrations/2026-03-15-103112-0000_add_program_client_pubkey_unique/up.sql

@@ -0,0 +1,2 @@
+CREATE UNIQUE INDEX program_client_public_key_unique
+    ON program_client (public_key);

server/crates/arbiter-server/src/actors/bootstrap.rs

@@ -3,7 +3,12 @@ use diesel::QueryDsl;
 use diesel_async::RunQueryDsl;
 use kameo::{Actor, messages};
 use miette::Diagnostic;
-use rand::{RngExt, distr::Alphanumeric, make_rng, rngs::StdRng};
+use rand::{
+    RngExt,
+    distr::{Alphanumeric},
+    make_rng,
+    rngs::StdRng,
+};
 use thiserror::Error;
 
 use crate::db::{self, DatabasePool, schema};
@@ -56,6 +61,7 @@ impl Bootstrapper {
 
         drop(conn);
 
+
         let token = if row_count == 0 {
             let token = generate_token().await?;
             Some(token)

server/crates/arbiter-server/src/actors/client/auth.rs

@@ -1,17 +1,20 @@
-use arbiter_proto::{format_challenge, transport::expect_message};
+use arbiter_proto::{
-use diesel::{
+    format_challenge,
-    ExpressionMethods as _, OptionalExtension as _, QueryDsl as _, dsl::insert_into, update,
+    proto::client::{
+        AuthChallenge, AuthChallengeSolution, ClientConnectError, ClientRequest, ClientResponse,
+        client_connect_error::Code as ConnectErrorCode,
+        client_request::Payload as ClientRequestPayload,
+        client_response::Payload as ClientResponsePayload,
+    },
+    transport::expect_message,
 };
+use diesel::{ExpressionMethods as _, OptionalExtension as _, QueryDsl as _, update};
 use diesel_async::RunQueryDsl as _;
 use ed25519_dalek::VerifyingKey;
-use kameo::error::SendError;
 use tracing::error;
 
 use crate::{
-    actors::{
+    actors::client::ClientConnection,
-        client::{ClientConnection, ConnectErrorCode, Request, Response},
-        router::{self, RequestClientApproval},
-    },
     db::{self, schema::program_client},
 };
 
@@ -31,27 +34,20 @@ pub enum Error {
     DatabaseOperationFailed,
     #[error("Invalid challenge solution")]
     InvalidChallengeSolution,
-    #[error("Client approval request failed")]
+    #[error("Client not registered")]
-    ApproveError(#[from] ApproveError),
+    NotRegistered,
     #[error("Internal error")]
     InternalError,
     #[error("Transport error")]
     Transport,
 }
 
-#[derive(thiserror::Error, Debug, Clone, PartialEq, Eq)]
-pub enum ApproveError {
-    #[error("Internal error")]
-    Internal,
-    #[error("Client connection denied by user agents")]
-    Denied,
-    #[error("Upstream error: {0}")]
-    Upstream(router::ApprovalError),
-}
-
 /// Atomically reads and increments the nonce for a known client.
 /// Returns `None` if the pubkey is not registered.
-async fn get_nonce(db: &db::DatabasePool, pubkey: &VerifyingKey) -> Result<Option<i32>, Error> {
+async fn get_nonce(
+    db: &db::DatabasePool,
+    pubkey: &VerifyingKey,
+) -> Result<Option<(i32, i32)>, Error> {
     let pubkey_bytes = pubkey.as_bytes().to_vec();
 
     let mut conn = db.get().await.map_err(|e| {
@@ -62,10 +58,10 @@ async fn get_nonce(db: &db::DatabasePool, pubkey: &VerifyingKey) -> Result<Optio
     conn.exclusive_transaction(|conn| {
         let pubkey_bytes = pubkey_bytes.clone();
         Box::pin(async move {
-            let Some(current_nonce) = program_client::table
+            let Some((client_id, current_nonce)) = program_client::table
                 .filter(program_client::public_key.eq(&pubkey_bytes))
-                .select(program_client::nonce)
+                .select((program_client::id, program_client::nonce))
-                .first::<i32>(conn)
+                .first::<(i32, i32)>(conn)
                 .await
                 .optional()?
             else {
@@ -78,7 +74,7 @@ async fn get_nonce(db: &db::DatabasePool, pubkey: &VerifyingKey) -> Result<Optio
                 .execute(conn)
                 .await?;
 
-            Ok(Some(current_nonce))
+            Ok(Some((client_id, current_nonce)))
         })
     })
     .await
@@ -88,71 +84,20 @@ async fn get_nonce(db: &db::DatabasePool, pubkey: &VerifyingKey) -> Result<Optio
     })
 }
 
-async fn approve_new_client(
-    actors: &crate::actors::GlobalActors,
-    pubkey: VerifyingKey,
-) -> Result<(), Error> {
-    let result = actors
-        .router
-        .ask(RequestClientApproval {
-            client_pubkey: pubkey,
-        })
-        .await;
-
-    match result {
-        Ok(true) => Ok(()),
-        Ok(false) => Err(Error::ApproveError(ApproveError::Denied)),
-        Err(SendError::HandlerError(e)) => {
-            error!(error = ?e, "Approval upstream error");
-            Err(Error::ApproveError(ApproveError::Upstream(e)))
-        }
-        Err(e) => {
-            error!(error = ?e, "Approval request to router failed");
-            Err(Error::ApproveError(ApproveError::Internal))
-        }
-    }
-}
-
-async fn insert_client(db: &db::DatabasePool, pubkey: &VerifyingKey) -> Result<(), Error> {
-    let now = std::time::SystemTime::now()
-        .duration_since(std::time::UNIX_EPOCH)
-        .unwrap_or_default()
-        .as_secs() as i32;
-
-    let mut conn = db.get().await.map_err(|e| {
-        error!(error = ?e, "Database pool error");
-        Error::DatabasePoolUnavailable
-    })?;
-
-    insert_into(program_client::table)
-        .values((
-            program_client::public_key.eq(pubkey.as_bytes().to_vec()),
-            program_client::nonce.eq(1), // pre-incremented; challenge uses 0
-            program_client::created_at.eq(now),
-            program_client::updated_at.eq(now),
-        ))
-        .execute(&mut conn)
-        .await
-        .map_err(|e| {
-            error!(error = ?e, "Failed to insert new client");
-            Error::DatabaseOperationFailed
-        })?;
-
-    Ok(())
-}
-
 async fn challenge_client(
     props: &mut ClientConnection,
     pubkey: VerifyingKey,
     nonce: i32,
 ) -> Result<(), Error> {
-    let challenge_pubkey = pubkey.as_bytes().to_vec();
+    let challenge = AuthChallenge {
+        pubkey: pubkey.as_bytes().to_vec(),
+        nonce,
+    };
 
     props
         .transport
-        .send(Ok(Response::AuthChallenge {
+        .send(Ok(ClientResponse {
-            pubkey: challenge_pubkey.clone(),
+            payload: Some(ClientResponsePayload::AuthChallenge(challenge.clone())),
-            nonce,
         }))
         .await
         .map_err(|e| {
@@ -160,17 +105,20 @@ async fn challenge_client(
             Error::Transport
         })?;
 
-    let signature = expect_message(&mut *props.transport, |req: Request| match req {
+    let AuthChallengeSolution { signature } =
-        Request::AuthChallengeSolution { signature } => Some(signature),
+        expect_message(&mut *props.transport, |req: ClientRequest| {
-        _ => None,
+            match req.payload? {
-    })
+                ClientRequestPayload::AuthChallengeSolution(s) => Some(s),
-    .await
+                _ => None,
-    .map_err(|e| {
+            }
-        error!(error = ?e, "Failed to receive challenge solution");
+        })
-        Error::Transport
+        .await
-    })?;
+        .map_err(|e| {
+            error!(error = ?e, "Failed to receive challenge solution");
+            Error::Transport
+        })?;
 
-    let formatted = format_challenge(nonce, &challenge_pubkey);
+    let formatted = format_challenge(nonce, &challenge.pubkey);
     let sig = signature.as_slice().try_into().map_err(|_| {
         error!("Invalid signature length");
         Error::InvalidChallengeSolution
@@ -186,50 +134,48 @@ async fn challenge_client(
 
 fn connect_error_code(err: &Error) -> ConnectErrorCode {
     match err {
-        Error::ApproveError(ApproveError::Denied) => ConnectErrorCode::ApprovalDenied,
+        Error::NotRegistered => ConnectErrorCode::ApprovalDenied,
-        Error::ApproveError(ApproveError::Upstream(
-            router::ApprovalError::NoUserAgentsConnected,
-        )) => ConnectErrorCode::NoUserAgentsOnline,
         _ => ConnectErrorCode::Unknown,
     }
 }
 
-async fn authenticate(props: &mut ClientConnection) -> Result<VerifyingKey, Error> {
+async fn authenticate(props: &mut ClientConnection) -> Result<(VerifyingKey, i32), Error> {
-    let Some(Request::AuthChallengeRequest {
+    let Some(ClientRequest {
-        pubkey: challenge_pubkey,
+        payload: Some(ClientRequestPayload::AuthChallengeRequest(challenge)),
     }) = props.transport.recv().await
     else {
         return Err(Error::Transport);
     };
 
-    let pubkey_bytes = challenge_pubkey
+    let pubkey_bytes = challenge
+        .pubkey
         .as_array()
         .ok_or(Error::InvalidClientPubkeyLength)?;
     let pubkey =
         VerifyingKey::from_bytes(pubkey_bytes).map_err(|_| Error::InvalidAuthPubkeyEncoding)?;
 
-    let nonce = match get_nonce(&props.db, &pubkey).await? {
+    let (client_id, nonce) = match get_nonce(&props.db, &pubkey).await? {
-        Some(nonce) => nonce,
+        Some((client_id, nonce)) => (client_id, nonce),
-        None => {
+        None => return Err(Error::NotRegistered),
-            approve_new_client(&props.actors, pubkey).await?;
-            insert_client(&props.db, &pubkey).await?;
-            0
-        }
     };
 
     challenge_client(props, pubkey, nonce).await?;
 
-    Ok(pubkey)
+    Ok((pubkey, client_id))
 }
 
 pub async fn authenticate_and_create(mut props: ClientConnection) -> Result<ClientSession, Error> {
     match authenticate(&mut props).await {
-        Ok(_pubkey) => Ok(ClientSession::new(props)),
+        Ok((_pubkey, client_id)) => Ok(ClientSession::new(props, client_id)),
         Err(err) => {
             let code = connect_error_code(&err);
             let _ = props
                 .transport
-                .send(Ok(Response::ClientConnectError { code }))
+                .send(Ok(ClientResponse {
+                    payload: Some(ClientResponsePayload::ClientConnectError(
+                        ClientConnectError { code: code.into() },
+                    )),
+                }))
                 .await;
             Err(err)
         }

server/crates/arbiter-server/src/actors/client/mod.rs

@@ -1,4 +1,7 @@
-use arbiter_proto::transport::Bi;
+use arbiter_proto::{
+    proto::client::{ClientRequest, ClientResponse},
+    transport::Bi,
+};
 use kameo::actor::Spawn;
 use tracing::{error, info};
 
@@ -21,27 +24,7 @@ pub enum ClientError {
     Auth(#[from] auth::Error),
 }
 
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub type Transport = Box<dyn Bi<ClientRequest, Result<ClientResponse, ClientError>> + Send>;
-pub enum ConnectErrorCode {
-    Unknown,
-    ApprovalDenied,
-    NoUserAgentsOnline,
-}
-
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub enum Request {
-    AuthChallengeRequest { pubkey: Vec<u8> },
-    AuthChallengeSolution { signature: Vec<u8> },
-}
-
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub enum Response {
-    AuthChallenge { pubkey: Vec<u8>, nonce: i32 },
-    AuthOk,
-    ClientConnectError { code: ConnectErrorCode },
-}
-
-pub type Transport = Box<dyn Bi<Request, Result<Response, ClientError>> + Send>;
 
 pub struct ClientConnection {
     pub(crate) db: db::DatabasePool,

server/crates/arbiter-server/src/actors/client/session.rs

@@ -1,3 +1,13 @@
+use alloy::{consensus::TxEip1559, primitives::Address, rlp::Decodable};
+use arbiter_proto::proto::{
+    client::{
+        ClientRequest, ClientResponse, client_request::Payload as ClientRequestPayload,
+        client_response::Payload as ClientResponsePayload,
+    },
+    evm::{
+        EvmError, EvmSignTransactionResponse, evm_sign_transaction_response::Result as SignResult,
+    },
+};
 use kameo::Actor;
 use tokio::select;
 use tracing::{error, info};
@@ -5,7 +15,8 @@ use tracing::{error, info};
 use crate::{
     actors::{
         GlobalActors,
-        client::{ClientConnection, ClientError, Request, Response},
+        client::{ClientConnection, ClientError},
+        evm::ClientSignTransaction,
         router::RegisterClient,
     },
     db,
@@ -13,20 +24,64 @@ use crate::{
 
 pub struct ClientSession {
     props: ClientConnection,
+    client_id: i32,
 }
 
 impl ClientSession {
-    pub(crate) fn new(props: ClientConnection) -> Self {
+    pub(crate) fn new(props: ClientConnection, client_id: i32) -> Self {
-        Self { props }
+        Self { props, client_id }
     }
 
-    pub async fn process_transport_inbound(&mut self, req: Request) -> Output {
+    pub async fn process_transport_inbound(&mut self, req: ClientRequest) -> Output {
-        let _ = req;
+        let msg = req.payload.ok_or_else(|| {
-        Err(ClientError::UnexpectedRequestPayload)
+            error!(actor = "client", "Received message with no payload");
+            ClientError::MissingRequestPayload
+        })?;
+
+        match msg {
+            ClientRequestPayload::EvmSignTransaction(sign_req) => {
+                let wallet_address: [u8; 20] = sign_req
+                    .wallet_address
+                    .try_into()
+                    .map_err(|_| ClientError::UnexpectedRequestPayload)?;
+
+                let mut rlp_bytes: &[u8] = &sign_req.rlp_transaction;
+                let tx = TxEip1559::decode(&mut rlp_bytes)
+                    .map_err(|_| ClientError::UnexpectedRequestPayload)?;
+
+                let result = self
+                    .props
+                    .actors
+                    .evm
+                    .ask(ClientSignTransaction {
+                        client_id: self.client_id,
+                        wallet_address: Address::from_slice(&wallet_address),
+                        transaction: tx,
+                    })
+                    .await;
+
+                let response_result = match result {
+                    Ok(signature) => SignResult::Signature(signature.as_bytes().to_vec()),
+                    Err(err) => {
+                        error!(?err, "client sign transaction failed");
+                        SignResult::Error(EvmError::Internal.into())
+                    }
+                };
+
+                Ok(ClientResponse {
+                    payload: Some(ClientResponsePayload::EvmSignTransaction(
+                        EvmSignTransactionResponse {
+                            result: Some(response_result),
+                        },
+                    )),
+                })
+            }
+            _ => Err(ClientError::UnexpectedRequestPayload),
+        }
     }
 }
 
-type Output = Result<Response, ClientError>;
+type Output = Result<ClientResponse, ClientError>;
 
 impl Actor for ClientSession {
     type Args = Self;
@@ -88,6 +143,9 @@ impl ClientSession {
         use arbiter_proto::transport::DummyTransport;
         let transport: super::Transport = Box::new(DummyTransport::new());
         let props = ClientConnection::new(db, transport, actors);
-        Self { props }
+        Self {
+            props,
+            client_id: 0,
+        }
     }
 }

server/crates/arbiter-server/src/actors/evm/mod.rs

@@ -1,7 +1,5 @@
 use alloy::{consensus::TxEip1559, primitives::Address, signers::Signature};
-use diesel::{
+use diesel::{ExpressionMethods, OptionalExtension as _, QueryDsl, SelectableHelper as _, dsl::insert_into};
-    ExpressionMethods, OptionalExtension as _, QueryDsl, SelectableHelper as _, dsl::insert_into,
-};
 use diesel_async::RunQueryDsl;
 use kameo::{Actor, actor::ActorRef, messages};
 use memsafe::MemSafe;
@@ -9,16 +7,13 @@ use rand::{SeedableRng, rng, rngs::StdRng};
 
 use crate::{
     actors::keyholder::{CreateNew, Decrypt, KeyHolder},
-    db::{
+    db::{self, DatabasePool, models::{self, EvmBasicGrant, SqliteTimestamp}, schema},
-        self, DatabasePool,
-        models::{self, EvmBasicGrant, SqliteTimestamp},
-        schema,
-    },
     evm::{
-        self, ListGrantsError, RunKind,
+        self, RunKind,
         policies::{
-            FullGrant, Grant, SharedGrantSettings, SpecificGrant, SpecificMeaning,
+            FullGrant, SharedGrantSettings, SpecificGrant, SpecificMeaning,
-            ether_transfer::EtherTransfer, token_transfers::TokenTransfer,
+            ether_transfer::EtherTransfer,
+            token_transfers::TokenTransfer,
         },
     },
 };
@@ -93,12 +88,7 @@ impl EvmActor {
         // todo: audit
         let rng = StdRng::from_rng(&mut rng());
         let engine = evm::Engine::new(db.clone());
-        Self {
+        Self { keyholder, db, rng, engine }
-            keyholder,
-            db,
-            rng,
-            engine,
-        }
     }
 }
 
@@ -159,24 +149,12 @@ impl EvmActor {
         match grant {
             SpecificGrant::EtherTransfer(settings) => {
                 self.engine
-                    .create_grant::<EtherTransfer>(
+                    .create_grant::<EtherTransfer>(client_id, FullGrant { basic, specific: settings })
-                        client_id,
-                        FullGrant {
-                            basic,
-                            specific: settings,
-                        },
-                    )
                     .await
             }
             SpecificGrant::TokenTransfer(settings) => {
                 self.engine
-                    .create_grant::<TokenTransfer>(
+                    .create_grant::<TokenTransfer>(client_id, FullGrant { basic, specific: settings })
-                        client_id,
-                        FullGrant {
-                            basic,
-                            specific: settings,
-                        },
-                    )
                     .await
             }
         }
@@ -194,12 +172,19 @@ impl EvmActor {
     }
 
     #[message]
-    pub async fn useragent_list_grants(&mut self) -> Result<Vec<Grant<SpecificGrant>>, Error> {
+    pub async fn useragent_list_grants(
-        match self.engine.list_all_grants().await {
+        &mut self,
-            Ok(grants) => Ok(grants),
+        wallet_id: Option<i32>,
-            Err(ListGrantsError::Database(db)) => Err(Error::Database(db)),
+    ) -> Result<Vec<EvmBasicGrant>, Error> {
-            Err(ListGrantsError::Pool(pool)) => Err(Error::DatabasePool(pool)),
+        let mut conn = self.db.get().await?;
+        let mut query = schema::evm_basic_grant::table
+            .select(EvmBasicGrant::as_select())
+            .filter(schema::evm_basic_grant::revoked_at.is_null())
+            .into_boxed();
+        if let Some(wid) = wallet_id {
+            query = query.filter(schema::evm_basic_grant::wallet_id.eq(wid));
         }
+        Ok(query.load(&mut conn).await?)
     }
 
     #[message]
@@ -219,14 +204,8 @@ impl EvmActor {
             .ok_or(SignTransactionError::WalletNotFound)?;
         drop(conn);
 
-        let meaning = self
+        let meaning = self.engine
-            .engine
+            .evaluate_transaction(wallet.id, client_id, transaction.clone(), RunKind::Execution)
-            .evaluate_transaction(
-                wallet.id,
-                client_id,
-                transaction.clone(),
-                RunKind::Execution,
-            )
             .await?;
 
         Ok(meaning)
@@ -251,21 +230,14 @@ impl EvmActor {
 
         let raw_key: MemSafe<Vec<u8>> = self
             .keyholder
-            .ask(Decrypt {
+            .ask(Decrypt { aead_id: wallet.aead_encrypted_id })
-                aead_id: wallet.aead_encrypted_id,
-            })
             .await
             .map_err(|_| SignTransactionError::KeyholderSend)?;
 
         let signer = safe_signer::SafeSigner::from_memsafe(raw_key)?;
 
         self.engine
-            .evaluate_transaction(
+            .evaluate_transaction(wallet.id, client_id, transaction.clone(), RunKind::Execution)
-                wallet.id,
-                client_id,
-                transaction.clone(),
-                RunKind::Execution,
-            )
             .await?;
 
         use alloy::network::TxSignerSync as _;

server/crates/arbiter-server/src/actors/keyholder/mod.rs

@@ -313,7 +313,7 @@ impl KeyHolder {
                 current_nonce: nonce.to_vec(),
                 schema_version: 1,
                 associated_root_key_id: *root_key_history_id,
-                created_at: Utc::now().into(),
+                created_at: Utc::now().into()
             })
             .returning(schema::aead_encrypted::id)
             .get_result(&mut conn)
@@ -346,7 +346,7 @@ impl KeyHolder {
 #[cfg(test)]
 mod tests {
     use diesel::SelectableHelper;
-
+    
     use diesel_async::RunQueryDsl;
     use memsafe::MemSafe;
 

server/crates/arbiter-server/src/actors/router/mod.rs

@@ -1,20 +1,14 @@
 use std::{collections::HashMap, ops::ControlFlow};
 
-use ed25519_dalek::VerifyingKey;
 use kameo::{
     Actor,
     actor::{ActorId, ActorRef},
     messages,
     prelude::{ActorStopReason, Context, WeakActorRef},
-    reply::DelegatedReply,
 };
-use tokio::{sync::watch, task::JoinSet};
+use tracing::info;
-use tracing::{info, warn};
 
-use crate::actors::{
+use crate::actors::{client::session::ClientSession, user_agent::session::UserAgentSession};
-    client::session::ClientSession,
-    user_agent::session::{RequestNewClientApproval, UserAgentSession},
-};
 
 #[derive(Default)]
 pub struct MessageRouter {
@@ -56,73 +50,6 @@ impl Actor for MessageRouter {
     }
 }
 
-#[derive(Debug, thiserror::Error, Clone, PartialEq, Eq, Hash)]
-pub enum ApprovalError {
-    #[error("No user agents connected")]
-    NoUserAgentsConnected,
-}
-
-async fn request_client_approval(
-    user_agents: &[WeakActorRef<UserAgentSession>],
-    client_pubkey: VerifyingKey,
-) -> Result<bool, ApprovalError> {
-    if user_agents.is_empty() {
-        return Err(ApprovalError::NoUserAgentsConnected);
-    }
-
-    let mut pool = JoinSet::new();
-    let (cancel_tx, cancel_rx) = watch::channel(());
-
-    for weak_ref in user_agents {
-        match weak_ref.upgrade() {
-            Some(agent) => {
-                let cancel_rx = cancel_rx.clone();
-                pool.spawn(async move {
-                    agent
-                        .ask(RequestNewClientApproval {
-                            client_pubkey,
-                            cancel_flag: cancel_rx.clone(),
-                        })
-                        .await
-                });
-            }
-            None => {
-                warn!(
-                    id = weak_ref.id().to_string(),
-                    actor = "MessageRouter",
-                    event = "useragent.disconnected_before_approval"
-                );
-            }
-        }
-    }
-
-    while let Some(result) = pool.join_next().await {
-        match result {
-            Ok(Ok(approved)) => {
-                // cancel other pending requests
-                let _ = cancel_tx.send(());
-                return Ok(approved);
-            }
-            Ok(Err(err)) => {
-                warn!(
-                    ?err,
-                    actor = "MessageRouter",
-                    event = "useragent.approval_error"
-                );
-            }
-            Err(err) => {
-                warn!(
-                    ?err,
-                    actor = "MessageRouter",
-                    event = "useragent.approval_task_failed"
-                );
-            }
-        }
-    }
-
-    Err(ApprovalError::NoUserAgentsConnected)
-}
-
 #[messages]
 impl MessageRouter {
     #[message(ctx)]
@@ -146,29 +73,4 @@ impl MessageRouter {
         ctx.actor_ref().link(&actor).await;
         self.clients.insert(actor.id(), actor);
     }
-
-    #[message(ctx)]
-    pub async fn request_client_approval(
-        &mut self,
-        client_pubkey: VerifyingKey,
-        ctx: &mut Context<Self, DelegatedReply<Result<bool, ApprovalError>>>,
-    ) -> DelegatedReply<Result<bool, ApprovalError>> {
-        let (reply, Some(reply_sender)) = ctx.reply_sender() else {
-            panic!("Exptected `request_client_approval` to have callback channel");
-        };
-
-        let weak_refs = self
-            .user_agents
-            .values()
-            .map(|agent| agent.downgrade())
-            .collect::<Vec<_>>();
-
-        // handle in subtask to not to lock the actor
-        tokio::task::spawn(async move {
-            let result = request_client_approval(&weak_refs, client_pubkey).await;
-            reply_sender.send(result);
-        });
-
-        reply
-    }
 }

server/crates/arbiter-server/src/actors/user_agent/auth.rs

@@ -1,9 +1,12 @@
+use arbiter_proto::proto::user_agent::{
+    AuthChallengeRequest, AuthChallengeSolution, KeyType as ProtoKeyType, UserAgentRequest,
+    user_agent_request::Payload as UserAgentRequestPayload,
+};
 use tracing::error;
 
 use crate::actors::user_agent::{
-    Request, UserAgentConnection,
+    UserAgentConnection,
-    auth::state::{AuthContext, AuthStateMachine},
+    auth::state::{AuthContext, AuthPublicKey, AuthStateMachine},
-    AuthPublicKey,
     session::UserAgentSession,
 };
 
@@ -34,20 +37,54 @@ pub enum Error {
 mod state;
 use state::*;
 
-fn parse_auth_event(payload: Request) -> Result<AuthEvents, Error> {
+fn parse_pubkey(key_type: ProtoKeyType, pubkey: Vec<u8>) -> Result<AuthPublicKey, Error> {
+    match key_type {
+        // UNSPECIFIED treated as Ed25519 for backward compatibility
+        ProtoKeyType::Unspecified | ProtoKeyType::Ed25519 => {
+            let pubkey_bytes = pubkey.as_array().ok_or(Error::InvalidClientPubkeyLength)?;
+            let key = ed25519_dalek::VerifyingKey::from_bytes(pubkey_bytes)
+                .map_err(|_| Error::InvalidAuthPubkeyEncoding)?;
+            Ok(AuthPublicKey::Ed25519(key))
+        }
+        ProtoKeyType::EcdsaSecp256k1 => {
+            // Public key is sent as 33-byte SEC1 compressed point
+            let key = k256::ecdsa::VerifyingKey::from_sec1_bytes(&pubkey)
+                .map_err(|_| Error::InvalidAuthPubkeyEncoding)?;
+            Ok(AuthPublicKey::EcdsaSecp256k1(key))
+        }
+        ProtoKeyType::Rsa => {
+            use rsa::pkcs8::DecodePublicKey as _;
+            let key = rsa::RsaPublicKey::from_public_key_der(&pubkey)
+                .map_err(|_| Error::InvalidAuthPubkeyEncoding)?;
+            Ok(AuthPublicKey::Rsa(key))
+        }
+    }
+}
+
+fn parse_auth_event(payload: UserAgentRequestPayload) -> Result<AuthEvents, Error> {
     match payload {
-        Request::AuthChallengeRequest {
+        UserAgentRequestPayload::AuthChallengeRequest(AuthChallengeRequest {
             pubkey,
             bootstrap_token: None,
-        } => Ok(AuthEvents::AuthRequest(ChallengeRequest { pubkey })),
+            key_type,
-        Request::AuthChallengeRequest {
+        }) => {
+            let kt = ProtoKeyType::try_from(key_type).unwrap_or(ProtoKeyType::Unspecified);
+            Ok(AuthEvents::AuthRequest(ChallengeRequest {
+                pubkey: parse_pubkey(kt, pubkey)?,
+            }))
+        }
+        UserAgentRequestPayload::AuthChallengeRequest(AuthChallengeRequest {
             pubkey,
             bootstrap_token: Some(token),
-        } => Ok(AuthEvents::BootstrapAuthRequest(BootstrapAuthRequest {
+            key_type,
-            pubkey,
+        }) => {
-            token,
+            let kt = ProtoKeyType::try_from(key_type).unwrap_or(ProtoKeyType::Unspecified);
-        })),
+            Ok(AuthEvents::BootstrapAuthRequest(BootstrapAuthRequest {
-        Request::AuthChallengeSolution { signature } => {
+                pubkey: parse_pubkey(kt, pubkey)?,
+                token,
+            }))
+        }
+        UserAgentRequestPayload::AuthChallengeSolution(AuthChallengeSolution { signature }) => {
             Ok(AuthEvents::ReceivedSolution(ChallengeSolution {
                 solution: signature,
             }))
@@ -62,7 +99,10 @@ pub async fn authenticate(props: &mut UserAgentConnection) -> Result<AuthPublicK
     loop {
         // `state` holds a mutable reference to `props` so we can't access it directly here
         let transport = state.context_mut().conn.transport.as_mut();
-        let Some(payload) = transport.recv().await else {
+        let Some(UserAgentRequest {
+            payload: Some(payload),
+        }) = transport.recv().await
+        else {
             return Err(Error::Transport);
         };
 

server/crates/arbiter-server/src/actors/user_agent/auth/state.rs

@@ -1,16 +1,52 @@
+use arbiter_proto::proto::user_agent::{
+    AuthChallenge, UserAgentResponse, user_agent_response::Payload as UserAgentResponsePayload,
+};
 use diesel::{ExpressionMethods as _, OptionalExtension as _, QueryDsl, update};
 use diesel_async::RunQueryDsl;
 use tracing::error;
 
 use super::Error;
 use crate::{
-    actors::{
+    actors::{bootstrap::ConsumeToken, user_agent::UserAgentConnection},
-        bootstrap::ConsumeToken,
+    db::{models::KeyType, schema},
-        user_agent::{AuthPublicKey, Response, UserAgentConnection},
-    },
-    db::schema,
 };
 
+/// Abstraction over Ed25519 / ECDSA-secp256k1 / RSA public keys used during the auth handshake.
+#[derive(Clone)]
+pub enum AuthPublicKey {
+    Ed25519(ed25519_dalek::VerifyingKey),
+    /// Compressed SEC1 public key; signature bytes are raw 64-byte (r||s).
+    EcdsaSecp256k1(k256::ecdsa::VerifyingKey),
+    /// RSA-2048+ public key (Windows Hello / KeyCredentialManager); signature bytes are PSS+SHA-256.
+    Rsa(rsa::RsaPublicKey),
+}
+
+impl AuthPublicKey {
+    /// Canonical bytes stored in DB and echoed back in the challenge.
+    /// Ed25519: raw 32 bytes. ECDSA: SEC1 compressed 33 bytes. RSA: DER-encoded SPKI.
+    pub fn to_stored_bytes(&self) -> Vec<u8> {
+        match self {
+            AuthPublicKey::Ed25519(k) => k.to_bytes().to_vec(),
+            // SEC1 compressed (33 bytes) is the natural compact format for secp256k1
+            AuthPublicKey::EcdsaSecp256k1(k) => k.to_encoded_point(true).as_bytes().to_vec(),
+            AuthPublicKey::Rsa(k) => {
+                use rsa::pkcs8::EncodePublicKey as _;
+                k.to_public_key_der()
+                    .expect("rsa SPKI encoding is infallible")
+                    .to_vec()
+            }
+        }
+    }
+
+    pub fn key_type(&self) -> KeyType {
+        match self {
+            AuthPublicKey::Ed25519(_) => KeyType::Ed25519,
+            AuthPublicKey::EcdsaSecp256k1(_) => KeyType::EcdsaSecp256k1,
+            AuthPublicKey::Rsa(_) => KeyType::Rsa,
+        }
+    }
+}
+
 pub struct ChallengeRequest {
     pub pubkey: AuthPublicKey,
 }
@@ -21,7 +57,7 @@ pub struct BootstrapAuthRequest {
 }
 
 pub struct ChallengeContext {
-    pub challenge_nonce: i32,
+    pub challenge: AuthChallenge,
     pub key: AuthPublicKey,
 }
 
@@ -34,8 +70,8 @@ smlang::statemachine!(
     custom_error: true,
     transitions: {
         *Init + AuthRequest(ChallengeRequest) / async prepare_challenge = SentChallenge(ChallengeContext),
-        Init + BootstrapAuthRequest(BootstrapAuthRequest) / async verify_bootstrap_token = AuthOk(AuthPublicKey),
+        Init + BootstrapAuthRequest(BootstrapAuthRequest) [async verify_bootstrap_token] / provide_key_bootstrap = AuthOk(AuthPublicKey),
-        SentChallenge(ChallengeContext) + ReceivedSolution(ChallengeSolution) / async verify_solution = AuthOk(AuthPublicKey),
+        SentChallenge(ChallengeContext) + ReceivedSolution(ChallengeSolution) [async verify_solution] / provide_key = AuthOk(AuthPublicKey),
     }
 );
 
@@ -111,71 +147,12 @@ impl<'a> AuthContext<'a> {
 impl AuthStateMachineContext for AuthContext<'_> {
     type Error = Error;
 
-    async fn prepare_challenge(
-        &mut self,
-        ChallengeRequest { pubkey }: ChallengeRequest,
-    ) -> Result<ChallengeContext, Self::Error> {
-        let stored_bytes = pubkey.to_stored_bytes();
-        let nonce = create_nonce(&self.conn.db, &stored_bytes).await?;
-
-        self.conn
-            .transport
-            .send(Ok(Response::AuthChallenge { nonce }))
-            .await
-            .map_err(|e| {
-                error!(?e, "Failed to send auth challenge");
-                Error::Transport
-            })?;
-
-        Ok(ChallengeContext {
-            challenge_nonce: nonce,
-            key: pubkey,
-        })
-    }
-
-    #[allow(missing_docs)]
-    #[allow(clippy::result_unit_err)]
-    async fn verify_bootstrap_token(
-        &mut self,
-        BootstrapAuthRequest { pubkey, token }: BootstrapAuthRequest,
-    ) -> Result<AuthPublicKey, Self::Error> {
-        let token_ok: bool = self
-            .conn
-            .actors
-            .bootstrapper
-            .ask(ConsumeToken {
-                token: token.clone(),
-            })
-            .await
-            .map_err(|e| {
-                error!(?e, "Failed to consume bootstrap token");
-                Error::BootstrapperActorUnreachable
-            })?;
-
-        if !token_ok {
-            error!("Invalid bootstrap token provided");
-            return Err(Error::InvalidBootstrapToken);
-        }
-
-        register_key(&self.conn.db, &pubkey).await?;
-
-        self.conn
-                .transport
-                .send(Ok(Response::AuthOk))
-                .await
-                .map_err(|_| Error::Transport)?;
-
-        Ok(pubkey)
-    }
-
-    #[allow(missing_docs)]
-    #[allow(clippy::unused_unit)]
     async fn verify_solution(
-        &mut self,
+        &self,
-        ChallengeContext { challenge_nonce, key }: &ChallengeContext,
+        ChallengeContext { challenge, key }: &ChallengeContext,
-        ChallengeSolution { solution }: ChallengeSolution,
+        ChallengeSolution { solution }: &ChallengeSolution,
-    ) -> Result<AuthPublicKey, Self::Error> {
+    ) -> Result<bool, Self::Error> {
-        let formatted = arbiter_proto::format_challenge(*challenge_nonce, &key.to_stored_bytes());
+        let formatted = arbiter_proto::format_challenge(challenge.nonce, &challenge.pubkey);
 
         let valid = match key {
             AuthPublicKey::Ed25519(vk) => {
@@ -204,14 +181,117 @@ impl AuthStateMachineContext for AuthContext<'_> {
             }
         };
 
-        if valid {
+        Ok(valid)
-            self.conn
+    }
-                .transport
+
-                .send(Ok(Response::AuthOk))
+    async fn prepare_challenge(
-                .await
+        &mut self,
-                .map_err(|_| Error::Transport)?;
+        ChallengeRequest { pubkey }: ChallengeRequest,
+    ) -> Result<ChallengeContext, Self::Error> {
+        let stored_bytes = pubkey.to_stored_bytes();
+        let nonce = create_nonce(&self.conn.db, &stored_bytes).await?;
+
+        let challenge = AuthChallenge {
+            pubkey: stored_bytes,
+            nonce,
+        };
+
+        self.conn
+            .transport
+            .send(Ok(UserAgentResponse {
+                payload: Some(UserAgentResponsePayload::AuthChallenge(challenge.clone())),
+            }))
+            .await
+            .map_err(|e| {
+                error!(?e, "Failed to send auth challenge");
+                Error::Transport
+            })?;
+
+        Ok(ChallengeContext {
+            challenge,
+            key: pubkey,
+        })
+    }
+
+    #[allow(missing_docs)]
+    #[allow(clippy::result_unit_err)]
+    async fn verify_bootstrap_token(
+        &self,
+        BootstrapAuthRequest { pubkey, token }: &BootstrapAuthRequest,
+    ) -> Result<bool, Self::Error> {
+        let token_ok: bool = self
+            .conn
+            .actors
+            .bootstrapper
+            .ask(ConsumeToken {
+                token: token.clone(),
+            })
+            .await
+            .map_err(|e| {
+                error!(?e, "Failed to consume bootstrap token");
+                Error::BootstrapperActorUnreachable
+            })?;
+
+        if !token_ok {
+            error!("Invalid bootstrap token provided");
+            return Err(Error::InvalidBootstrapToken);
         }
 
-        Ok(key.clone())
+        register_key(&self.conn.db, pubkey).await?;
+
+        Ok(true)
+    }
+
+    fn provide_key_bootstrap(
+        &mut self,
+        event_data: BootstrapAuthRequest,
+    ) -> Result<AuthPublicKey, Self::Error> {
+        Ok(event_data.pubkey)
+    }
+
+    fn provide_key(
+        &mut self,
+        state_data: &ChallengeContext,
+        _: ChallengeSolution,
+    ) -> Result<AuthPublicKey, Self::Error> {
+        // ChallengeContext.key cannot be taken by value because smlang passes it by ref;
+        // we reconstruct stored bytes and return them wrapped in Ed25519 placeholder.
+        // Session uses only the raw bytes, so we carry them via a Vec<u8>.
+        // IMPORTANT: do NOT simplify this by storing the key type separately — the
+        // `AuthPublicKey` enum IS the source of truth for key bytes and type.
+        //
+        // smlang state-machine trait requires returning an owned value from `provide_key`,
+        // but `state_data` is only available by shared reference here.  We extract the
+        // stored bytes and re-wrap as the correct variant so the caller can call
+        // `to_stored_bytes()` / `key_type()` without losing information.
+        let bytes = state_data.challenge.pubkey.clone();
+        let key_type = state_data.key.key_type();
+        let rebuilt = match key_type {
+            crate::db::models::KeyType::Ed25519 => {
+                let arr: &[u8; 32] = bytes
+                    .as_slice()
+                    .try_into()
+                    .expect("ed25519 pubkey must be 32 bytes in challenge");
+                AuthPublicKey::Ed25519(
+                    ed25519_dalek::VerifyingKey::from_bytes(arr)
+                        .expect("key was already validated in parse_auth_event"),
+                )
+            }
+            crate::db::models::KeyType::EcdsaSecp256k1 => {
+                // bytes are SEC1 compressed (33 bytes produced by to_encoded_point(true))
+                AuthPublicKey::EcdsaSecp256k1(
+                    k256::ecdsa::VerifyingKey::from_sec1_bytes(&bytes)
+                        .expect("ecdsa key was already validated in parse_auth_event"),
+                )
+            }
+            crate::db::models::KeyType::Rsa => {
+                use rsa::pkcs8::DecodePublicKey as _;
+                AuthPublicKey::Rsa(
+                    rsa::RsaPublicKey::from_public_key_der(&bytes)
+                        .expect("rsa key was already validated in parse_auth_event"),
+                )
+            }
+        };
+        Ok(rebuilt)
     }
 }

server/crates/arbiter-server/src/actors/user_agent/mod.rs

@@ -1,16 +1,19 @@
-use alloy::primitives::Address;
+use arbiter_proto::{
-use arbiter_proto::{transport::Bi};
+    proto::user_agent::{UserAgentRequest, UserAgentResponse},
+    transport::Bi,
+};
 use kameo::actor::Spawn as _;
 use tracing::{error, info};
 
 use crate::{
-    actors::{GlobalActors, evm, user_agent::session::UserAgentSession},
+    actors::{GlobalActors, user_agent::session::UserAgentSession},
-    db::{self, models::KeyType}, evm::policies::{Grant, SpecificGrant},
+    db::{self},
-    evm::policies::SharedGrantSettings,
 };
 
 #[derive(Debug, thiserror::Error, PartialEq)]
 pub enum TransportResponseError {
+    #[error("Expected message with payload")]
+    MissingRequestPayload,
     #[error("Unexpected request payload")]
     UnexpectedRequestPayload,
     #[error("Invalid state for unseal encrypted key")]
@@ -27,120 +30,8 @@ pub enum TransportResponseError {
     ConnectionRegistrationFailed,
 }
 
-/// Abstraction over Ed25519 / ECDSA-secp256k1 / RSA public keys used during the auth handshake.
+pub type Transport =
-#[derive(Clone, Debug)]
+    Box<dyn Bi<UserAgentRequest, Result<UserAgentResponse, TransportResponseError>> + Send>;
-pub enum AuthPublicKey {
-    Ed25519(ed25519_dalek::VerifyingKey),
-    /// Compressed SEC1 public key; signature bytes are raw 64-byte (r||s).
-    EcdsaSecp256k1(k256::ecdsa::VerifyingKey),
-    /// RSA-2048+ public key (Windows Hello / KeyCredentialManager); signature bytes are PSS+SHA-256.
-    Rsa(rsa::RsaPublicKey),
-}
-
-impl AuthPublicKey {
-    /// Canonical bytes stored in DB and echoed back in the challenge.
-    /// Ed25519: raw 32 bytes. ECDSA: SEC1 compressed 33 bytes. RSA: DER-encoded SPKI.
-    pub fn to_stored_bytes(&self) -> Vec<u8> {
-        match self {
-            AuthPublicKey::Ed25519(k) => k.to_bytes().to_vec(),
-            // SEC1 compressed (33 bytes) is the natural compact format for secp256k1
-            AuthPublicKey::EcdsaSecp256k1(k) => k.to_encoded_point(true).as_bytes().to_vec(),
-            AuthPublicKey::Rsa(k) => {
-                use rsa::pkcs8::EncodePublicKey as _;
-                k.to_public_key_der()
-                    .expect("rsa SPKI encoding is infallible")
-                    .to_vec()
-            }
-        }
-    }
-
-    pub fn key_type(&self) -> KeyType {
-        match self {
-            AuthPublicKey::Ed25519(_) => KeyType::Ed25519,
-            AuthPublicKey::EcdsaSecp256k1(_) => KeyType::EcdsaSecp256k1,
-            AuthPublicKey::Rsa(_) => KeyType::Rsa,
-        }
-    }
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum UnsealError {
-    InvalidKey,
-    Unbootstrapped,
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum BootstrapError {
-    AlreadyBootstrapped,
-    InvalidKey,
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum VaultState {
-    Unbootstrapped,
-    Sealed,
-    Unsealed,
-}
-
-#[derive(Debug, Clone)]
-pub enum Request {
-    AuthChallengeRequest {
-        pubkey: AuthPublicKey,
-        bootstrap_token: Option<String>,
-    },
-    AuthChallengeSolution {
-        signature: Vec<u8>,
-    },
-    UnsealStart {
-        client_pubkey: x25519_dalek::PublicKey,
-    },
-    UnsealEncryptedKey {
-        nonce: Vec<u8>,
-        ciphertext: Vec<u8>,
-        associated_data: Vec<u8>,
-    },
-    BootstrapEncryptedKey {
-        nonce: Vec<u8>,
-        ciphertext: Vec<u8>,
-        associated_data: Vec<u8>,
-    },
-    QueryVaultState,
-    EvmWalletCreate,
-    EvmWalletList,
-    ClientConnectionResponse {
-        approved: bool,
-    },
-
-    ListGrants,
-    EvmGrantCreate {
-        client_id: i32,
-        shared: SharedGrantSettings,
-        specific: SpecificGrant,
-    },
-    EvmGrantDelete {
-        grant_id: i32,
-    },
-}
-
-#[derive(Debug)]
-pub enum Response {
-    AuthChallenge { nonce: i32 },
-    AuthOk,
-    UnsealStartResponse { server_pubkey: x25519_dalek::PublicKey },
-    UnsealResult(Result<(), UnsealError>),
-    BootstrapResult(Result<(), BootstrapError>),
-    VaultState(VaultState),
-    ClientConnectionRequest { pubkey: ed25519_dalek::VerifyingKey },
-    ClientConnectionCancel,
-    EvmWalletCreate(Result<(), evm::Error>),
-    EvmWalletList(Vec<Address>),
-
-    ListGrants(Vec<Grant<SpecificGrant>>),
-    EvmGrantCreate(Result<i32, evm::Error>),
-    EvmGrantDelete(Result<(), evm::Error>),
-}
-
-pub type Transport = Box<dyn Bi<Request, Result<Response, TransportResponseError>> + Send>;
 
 pub struct UserAgentConnection {
     db: db::DatabasePool,
@@ -161,7 +52,6 @@ impl UserAgentConnection {
 pub mod auth;
 pub mod session;
 
-#[tracing::instrument(skip(props))]
 pub async fn connect_user_agent(props: UserAgentConnection) {
     match auth::authenticate_and_create(props).await {
         Ok(session) => {

server/crates/arbiter-server/src/actors/user_agent/session.rs

@@ -1,20 +1,38 @@
+use std::{ops::DerefMut, sync::Mutex};
 
-use chacha20poly1305::aead::KeyInit;
+use arbiter_proto::proto::{
-use ed25519_dalek::VerifyingKey;
+    evm as evm_proto,
-use kameo::{Actor, messages, prelude::Context};
-use tokio::{select, sync::watch};
-use tracing::{error, info};
-
-use crate::actors::{
-    router::RegisterUserAgent,
     user_agent::{
-        Request, Response, TransportResponseError,
+        SdkClientApproveRequest, SdkClientApproveResponse, SdkClientEntry,
-        UserAgentConnection,
+        SdkClientError as ProtoSdkClientError, SdkClientList, SdkClientListResponse,
+        SdkClientRevokeRequest, SdkClientRevokeResponse, UnsealEncryptedKey, UnsealResult,
+        UnsealStart, UnsealStartResponse, UserAgentRequest, UserAgentResponse,
+        sdk_client_approve_response, sdk_client_list_response, sdk_client_revoke_response,
+        user_agent_request::Payload as UserAgentRequestPayload,
+        user_agent_response::Payload as UserAgentResponsePayload,
     },
 };
+use chacha20poly1305::{AeadInPlace, XChaCha20Poly1305, XNonce, aead::KeyInit};
+use diesel::{ExpressionMethods as _, QueryDsl as _, dsl::insert_into};
+use diesel_async::RunQueryDsl as _;
+use kameo::{Actor, error::SendError, prelude::Context};
+use memsafe::MemSafe;
+use tokio::select;
+use tracing::{error, info};
+use x25519_dalek::{EphemeralSecret, PublicKey};
+
+use crate::{
+    actors::{
+        evm::{Generate, ListWallets},
+        keyholder::{self, TryUnseal},
+        router::RegisterUserAgent,
+        user_agent::{TransportResponseError, UserAgentConnection},
+    },
+    db::schema::program_client,
+};
 
 mod state;
-use state::{DummyContext, UserAgentEvents, UserAgentStateMachine};
+use state::{DummyContext, UnsealContext, UserAgentEvents, UserAgentStateMachine, UserAgentStates};
 
 // Error for consumption by other actors
 #[derive(Debug, thiserror::Error, PartialEq)]
@@ -31,8 +49,6 @@ pub struct UserAgentSession {
     state: UserAgentStateMachine<DummyContext>,
 }
 
-mod connection;
-
 impl UserAgentSession {
     pub(crate) fn new(props: UserAgentConnection) -> Self {
         Self {
@@ -41,19 +57,31 @@ impl UserAgentSession {
         }
     }
 
-    pub(super) async fn send_msg<Reply: kameo::Reply>(
+    fn transition(&mut self, event: UserAgentEvents) -> Result<(), TransportResponseError> {
+        self.state.process_event(event).map_err(|e| {
+            error!(?e, "State transition failed");
+            TransportResponseError::StateTransitionFailed
+        })?;
+        Ok(())
+    }
+
+    async fn send_msg<Reply: kameo::Reply>(
         &mut self,
-        msg: Response,
+        msg: UserAgentResponsePayload,
         _ctx: &mut Context<Self, Reply>,
     ) -> Result<(), Error> {
-        self.props.transport.send(Ok(msg)).await.map_err(|_| {
+        self.props
-            error!(
+            .transport
-                actor = "useragent",
+            .send(Ok(response(msg)))
-                reason = "channel closed",
+            .await
-                "send.failed"
+            .map_err(|_| {
-            );
+                error!(
-            Error::ConnectionLost
+                    actor = "useragent",
-        })
+                    reason = "channel closed",
+                    "send.failed"
+                );
+                Error::ConnectionLost
+            })
     }
 
     async fn expect_msg<Extractor, Msg, Reply>(
@@ -62,7 +90,7 @@ impl UserAgentSession {
         ctx: &mut Context<Self, Reply>,
     ) -> Result<Msg, Error>
     where
-        Extractor: FnOnce(Request) -> Option<Msg>,
+        Extractor: FnOnce(UserAgentRequestPayload) -> Option<Msg>,
         Reply: kameo::Reply,
     {
         let msg = self.props.transport.recv().await.ok_or_else(|| {
@@ -75,7 +103,7 @@ impl UserAgentSession {
             Error::ConnectionLost
         })?;
 
-        extractor(msg).ok_or_else(|| {
+        msg.payload.and_then(extractor).ok_or_else(|| {
             error!(
                 actor = "useragent",
                 reason = "unexpected message",
@@ -85,60 +113,407 @@ impl UserAgentSession {
             Error::UnexpectedMessage
         })
     }
+}
 
-    fn transition(&mut self, event: UserAgentEvents) -> Result<(), TransportResponseError> {
+impl UserAgentSession {
-        self.state.process_event(event).map_err(|e| {
+    pub async fn process_transport_inbound(&mut self, req: UserAgentRequest) -> Output {
-            error!(?e, "State transition failed");
+        let msg = req.payload.ok_or_else(|| {
-            TransportResponseError::StateTransitionFailed
+            error!(actor = "useragent", "Received message with no payload");
+            TransportResponseError::MissingRequestPayload
         })?;
-        Ok(())
+
+        match msg {
+            UserAgentRequestPayload::UnsealStart(unseal_start) => {
+                self.handle_unseal_request(unseal_start).await
+            }
+            UserAgentRequestPayload::UnsealEncryptedKey(unseal_encrypted_key) => {
+                self.handle_unseal_encrypted_key(unseal_encrypted_key).await
+            }
+            UserAgentRequestPayload::EvmWalletCreate(_) => self.handle_evm_wallet_create().await,
+            UserAgentRequestPayload::EvmWalletList(_) => self.handle_evm_wallet_list().await,
+            UserAgentRequestPayload::SdkClientApprove(req) => {
+                self.handle_sdk_client_approve(req).await
+            }
+            UserAgentRequestPayload::SdkClientRevoke(req) => {
+                self.handle_sdk_client_revoke(req).await
+            }
+            UserAgentRequestPayload::SdkClientList(_) => self.handle_sdk_client_list().await,
+            _ => Err(TransportResponseError::UnexpectedRequestPayload),
+        }
     }
 }
 
-#[messages]
+type Output = Result<UserAgentResponse, TransportResponseError>;
-impl UserAgentSession {
-    // TODO: Think about refactoring it to state-machine based flow, as we already have one
-    #[message(ctx)]
-    pub async fn request_new_client_approval(
-        &mut self,
-        client_pubkey: VerifyingKey,
-        mut cancel_flag: watch::Receiver<()>,
-        ctx: &mut Context<Self, Result<bool, Error>>,
-    ) -> Result<bool, Error> {
-        self.send_msg(
-            Response::ClientConnectionRequest {
-                pubkey: client_pubkey,
-            },
-            ctx,
-        )
-        .await?;
 
-        let extractor = |msg| {
+fn response(payload: UserAgentResponsePayload) -> UserAgentResponse {
-            if let Request::ClientConnectionResponse { approved } = msg {
+    UserAgentResponse {
-                Some(approved)
+        payload: Some(payload),
-            } else {
+    }
-                None
+}
+
+impl UserAgentSession {
+    async fn handle_unseal_request(&mut self, req: UnsealStart) -> Output {
+        let secret = EphemeralSecret::random();
+        let public_key = PublicKey::from(&secret);
+
+        let client_pubkey_bytes: [u8; 32] = req
+            .client_pubkey
+            .try_into()
+            .map_err(|_| TransportResponseError::InvalidClientPubkeyLength)?;
+
+        let client_public_key = PublicKey::from(client_pubkey_bytes);
+
+        self.transition(UserAgentEvents::UnsealRequest(UnsealContext {
+            secret: Mutex::new(Some(secret)),
+            client_public_key,
+        }))?;
+
+        Ok(response(UserAgentResponsePayload::UnsealStartResponse(
+            UnsealStartResponse {
+                server_pubkey: public_key.as_bytes().to_vec(),
+            },
+        )))
+    }
+
+    async fn handle_unseal_encrypted_key(&mut self, req: UnsealEncryptedKey) -> Output {
+        let UserAgentStates::WaitingForUnsealKey(unseal_context) = self.state.state() else {
+            error!("Received unseal encrypted key in invalid state");
+            return Err(TransportResponseError::InvalidStateForUnsealEncryptedKey);
+        };
+        let ephemeral_secret = {
+            let mut secret_lock = unseal_context.secret.lock().unwrap();
+            let secret = secret_lock.take();
+            match secret {
+                Some(secret) => secret,
+                None => {
+                    drop(secret_lock);
+                    error!("Ephemeral secret already taken");
+                    self.transition(UserAgentEvents::ReceivedInvalidKey)?;
+                    return Ok(response(UserAgentResponsePayload::UnsealResult(
+                        UnsealResult::InvalidKey.into(),
+                    )));
+                }
             }
         };
 
-        tokio::select! {
+        let nonce = XNonce::from_slice(&req.nonce);
-            _ = cancel_flag.changed() => {
+
-                info!(actor = "useragent", "client connection approval cancelled");
+        let shared_secret = ephemeral_secret.diffie_hellman(&unseal_context.client_public_key);
-                self.send_msg(
+        let cipher = XChaCha20Poly1305::new(shared_secret.as_bytes().into());
-                    Response::ClientConnectionCancel,
+
-                    ctx,
+        let mut seal_key_buffer = MemSafe::new(req.ciphertext.clone()).unwrap();
-                ).await?;
+
-                Ok(false)
+        let decryption_result = {
+            let mut write_handle = seal_key_buffer.write().unwrap();
+            let write_handle = write_handle.deref_mut();
+            cipher.decrypt_in_place(nonce, &req.associated_data, write_handle)
+        };
+
+        match decryption_result {
+            Ok(_) => {
+                match self
+                    .props
+                    .actors
+                    .key_holder
+                    .ask(TryUnseal {
+                        seal_key_raw: seal_key_buffer,
+                    })
+                    .await
+                {
+                    Ok(_) => {
+                        info!("Successfully unsealed key with client-provided key");
+                        self.transition(UserAgentEvents::ReceivedValidKey)?;
+                        Ok(response(UserAgentResponsePayload::UnsealResult(
+                            UnsealResult::Success.into(),
+                        )))
+                    }
+                    Err(SendError::HandlerError(keyholder::Error::InvalidKey)) => {
+                        self.transition(UserAgentEvents::ReceivedInvalidKey)?;
+                        Ok(response(UserAgentResponsePayload::UnsealResult(
+                            UnsealResult::InvalidKey.into(),
+                        )))
+                    }
+                    Err(SendError::HandlerError(err)) => {
+                        error!(?err, "Keyholder failed to unseal key");
+                        self.transition(UserAgentEvents::ReceivedInvalidKey)?;
+                        Ok(response(UserAgentResponsePayload::UnsealResult(
+                            UnsealResult::InvalidKey.into(),
+                        )))
+                    }
+                    Err(err) => {
+                        error!(?err, "Failed to send unseal request to keyholder");
+                        self.transition(UserAgentEvents::ReceivedInvalidKey)?;
+                        Err(TransportResponseError::KeyHolderActorUnreachable)
+                    }
+                }
             }
-            result = self.expect_msg(extractor, ctx) => {
+            Err(err) => {
-                let result = result?;
+                error!(?err, "Failed to decrypt unseal key");
-                info!(actor = "useragent", "received client connection approval result: approved={}", result);
+                self.transition(UserAgentEvents::ReceivedInvalidKey)?;
-                Ok(result)
+                Ok(response(UserAgentResponsePayload::UnsealResult(
+                    UnsealResult::InvalidKey.into(),
+                )))
             }
         }
     }
 }
 
+impl UserAgentSession {
+    async fn handle_evm_wallet_create(&mut self) -> Output {
+        use evm_proto::wallet_create_response::Result as CreateResult;
+
+        let result = match self.props.actors.evm.ask(Generate {}).await {
+            Ok(address) => CreateResult::Wallet(evm_proto::WalletEntry {
+                address: address.as_slice().to_vec(),
+            }),
+            Err(err) => CreateResult::Error(map_evm_error("wallet create", err).into()),
+        };
+
+        Ok(response(UserAgentResponsePayload::EvmWalletCreate(
+            evm_proto::WalletCreateResponse {
+                result: Some(result),
+            },
+        )))
+    }
+
+    async fn handle_evm_wallet_list(&mut self) -> Output {
+        use evm_proto::wallet_list_response::Result as ListResult;
+
+        let result = match self.props.actors.evm.ask(ListWallets {}).await {
+            Ok(wallets) => ListResult::Wallets(evm_proto::WalletList {
+                wallets: wallets
+                    .into_iter()
+                    .map(|addr| evm_proto::WalletEntry {
+                        address: addr.as_slice().to_vec(),
+                    })
+                    .collect(),
+            }),
+            Err(err) => ListResult::Error(map_evm_error("wallet list", err).into()),
+        };
+
+        Ok(response(UserAgentResponsePayload::EvmWalletList(
+            evm_proto::WalletListResponse {
+                result: Some(result),
+            },
+        )))
+    }
+}
+
+impl UserAgentSession {
+    async fn handle_sdk_client_approve(&mut self, req: SdkClientApproveRequest) -> Output {
+        use sdk_client_approve_response::Result as ApproveResult;
+
+        if req.pubkey.len() != 32 {
+            return Ok(response(UserAgentResponsePayload::SdkClientApprove(
+                SdkClientApproveResponse {
+                    result: Some(ApproveResult::Error(ProtoSdkClientError::Internal.into())),
+                },
+            )));
+        }
+
+        let now = std::time::SystemTime::now()
+            .duration_since(std::time::UNIX_EPOCH)
+            .unwrap_or_default()
+            .as_secs() as i32;
+
+        let mut conn = match self.props.db.get().await {
+            Ok(c) => c,
+            Err(e) => {
+                error!(?e, "Failed to get DB connection for sdk_client_approve");
+                return Ok(response(UserAgentResponsePayload::SdkClientApprove(
+                    SdkClientApproveResponse {
+                        result: Some(ApproveResult::Error(ProtoSdkClientError::Internal.into())),
+                    },
+                )));
+            }
+        };
+
+        let pubkey_bytes = req.pubkey.clone();
+        let insert_result = insert_into(program_client::table)
+            .values((
+                program_client::public_key.eq(&pubkey_bytes),
+                program_client::nonce.eq(1), // pre-incremented; challenge will use nonce=0
+                program_client::created_at.eq(now),
+                program_client::updated_at.eq(now),
+            ))
+            .execute(&mut conn)
+            .await;
+
+        match insert_result {
+            Ok(_) => {
+                match program_client::table
+                    .filter(program_client::public_key.eq(&pubkey_bytes))
+                    .order(program_client::id.desc())
+                    .select((
+                        program_client::id,
+                        program_client::public_key,
+                        program_client::created_at,
+                    ))
+                    .first::<(i32, Vec<u8>, i32)>(&mut conn)
+                    .await
+                {
+                    Ok((id, pubkey, created_at)) => Ok(response(
+                        UserAgentResponsePayload::SdkClientApprove(SdkClientApproveResponse {
+                            result: Some(ApproveResult::Client(SdkClientEntry {
+                                id,
+                                pubkey,
+                                created_at,
+                            })),
+                        }),
+                    )),
+                    Err(e) => {
+                        error!(?e, "Failed to fetch inserted SDK client");
+                        Ok(response(UserAgentResponsePayload::SdkClientApprove(
+                            SdkClientApproveResponse {
+                                result: Some(ApproveResult::Error(
+                                    ProtoSdkClientError::Internal.into(),
+                                )),
+                            },
+                        )))
+                    }
+                }
+            }
+            Err(diesel::result::Error::DatabaseError(
+                diesel::result::DatabaseErrorKind::UniqueViolation,
+                _,
+            )) => Ok(response(UserAgentResponsePayload::SdkClientApprove(
+                SdkClientApproveResponse {
+                    result: Some(ApproveResult::Error(
+                        ProtoSdkClientError::AlreadyExists.into(),
+                    )),
+                },
+            ))),
+            Err(e) => {
+                error!(?e, "Failed to insert SDK client");
+                Ok(response(UserAgentResponsePayload::SdkClientApprove(
+                    SdkClientApproveResponse {
+                        result: Some(ApproveResult::Error(ProtoSdkClientError::Internal.into())),
+                    },
+                )))
+            }
+        }
+    }
+
+    async fn handle_sdk_client_list(&mut self) -> Output {
+        let mut conn = match self.props.db.get().await {
+            Ok(c) => c,
+            Err(e) => {
+                error!(?e, "Failed to get DB connection for sdk_client_list");
+                return Ok(response(UserAgentResponsePayload::SdkClientList(
+                    SdkClientListResponse {
+                        result: Some(sdk_client_list_response::Result::Error(
+                            ProtoSdkClientError::Internal.into(),
+                        )),
+                    },
+                )));
+            }
+        };
+
+        match program_client::table
+            .select((
+                program_client::id,
+                program_client::public_key,
+                program_client::created_at,
+            ))
+            .load::<(i32, Vec<u8>, i32)>(&mut conn)
+            .await
+        {
+            Ok(rows) => Ok(response(UserAgentResponsePayload::SdkClientList(
+                SdkClientListResponse {
+                    result: Some(sdk_client_list_response::Result::Clients(SdkClientList {
+                        clients: rows
+                            .into_iter()
+                            .map(|(id, pubkey, created_at)| SdkClientEntry {
+                                id,
+                                pubkey,
+                                created_at,
+                            })
+                            .collect(),
+                    })),
+                },
+            ))),
+            Err(e) => {
+                error!(?e, "Failed to list SDK clients");
+                Ok(response(UserAgentResponsePayload::SdkClientList(
+                    SdkClientListResponse {
+                        result: Some(sdk_client_list_response::Result::Error(
+                            ProtoSdkClientError::Internal.into(),
+                        )),
+                    },
+                )))
+            }
+        }
+    }
+
+    async fn handle_sdk_client_revoke(&mut self, req: SdkClientRevokeRequest) -> Output {
+        use sdk_client_revoke_response::Result as RevokeResult;
+
+        let mut conn = match self.props.db.get().await {
+            Ok(c) => c,
+            Err(e) => {
+                error!(?e, "Failed to get DB connection for sdk_client_revoke");
+                return Ok(response(UserAgentResponsePayload::SdkClientRevoke(
+                    SdkClientRevokeResponse {
+                        result: Some(RevokeResult::Error(ProtoSdkClientError::Internal.into())),
+                    },
+                )));
+            }
+        };
+
+        match diesel::delete(program_client::table)
+            .filter(program_client::id.eq(req.client_id))
+            .execute(&mut conn)
+            .await
+        {
+            Ok(0) => Ok(response(UserAgentResponsePayload::SdkClientRevoke(
+                SdkClientRevokeResponse {
+                    result: Some(RevokeResult::Error(ProtoSdkClientError::NotFound.into())),
+                },
+            ))),
+            Ok(_) => Ok(response(UserAgentResponsePayload::SdkClientRevoke(
+                SdkClientRevokeResponse {
+                    result: Some(RevokeResult::Ok(())),
+                },
+            ))),
+            Err(diesel::result::Error::DatabaseError(
+                diesel::result::DatabaseErrorKind::ForeignKeyViolation,
+                _,
+            )) => Ok(response(UserAgentResponsePayload::SdkClientRevoke(
+                SdkClientRevokeResponse {
+                    result: Some(RevokeResult::Error(
+                        ProtoSdkClientError::HasRelatedData.into(),
+                    )),
+                },
+            ))),
+            Err(e) => {
+                error!(?e, "Failed to delete SDK client");
+                Ok(response(UserAgentResponsePayload::SdkClientRevoke(
+                    SdkClientRevokeResponse {
+                        result: Some(RevokeResult::Error(ProtoSdkClientError::Internal.into())),
+                    },
+                )))
+            }
+        }
+    }
+}
+
+fn map_evm_error<M>(op: &str, err: SendError<M, crate::actors::evm::Error>) -> evm_proto::EvmError {
+    use crate::actors::{evm::Error as EvmError, keyholder::Error as KhError};
+    match err {
+        SendError::HandlerError(EvmError::Keyholder(KhError::NotBootstrapped)) => {
+            evm_proto::EvmError::VaultSealed
+        }
+        SendError::HandlerError(err) => {
+            error!(?err, "EVM {op} failed");
+            evm_proto::EvmError::Internal
+        }
+        _ => {
+            error!("EVM actor unreachable during {op}");
+            evm_proto::EvmError::Internal
+        }
+    }
+}
+
 impl Actor for UserAgentSession {
     type Args = Self;
 

server/crates/arbiter-server/src/actors/user_agent/session/connection.rs

@@ -1,349 +0,0 @@
-use std::{ops::DerefMut, sync::Mutex};
-
-use chacha20poly1305::{AeadInPlace, XChaCha20Poly1305, XNonce, aead::KeyInit};
-use kameo::error::SendError;
-use memsafe::MemSafe;
-use tracing::{error, info};
-use x25519_dalek::{EphemeralSecret, PublicKey};
-
-use crate::actors::{
-    evm::{Generate, ListWallets, UseragentListGrants},
-    evm::{UseragentCreateGrant, UseragentDeleteGrant},
-    keyholder::{self, Bootstrap, TryUnseal},
-    user_agent::{
-        BootstrapError, Request, Response, TransportResponseError, UnsealError, VaultState,
-        session::{
-            UserAgentSession,
-            state::{UnsealContext, UserAgentEvents, UserAgentStates},
-        },
-    },
-};
-
-impl UserAgentSession {
-    pub async fn process_transport_inbound(&mut self, req: Request) -> Output {
-        match req {
-            Request::UnsealStart { client_pubkey } => {
-                self.handle_unseal_request(client_pubkey).await
-            }
-            Request::UnsealEncryptedKey {
-                nonce,
-                ciphertext,
-                associated_data,
-            } => {
-                self.handle_unseal_encrypted_key(nonce, ciphertext, associated_data)
-                    .await
-            }
-            Request::BootstrapEncryptedKey {
-                nonce,
-                ciphertext,
-                associated_data,
-            } => {
-                self.handle_bootstrap_encrypted_key(nonce, ciphertext, associated_data)
-                    .await
-            }
-            Request::ListGrants => self.handle_grant_list().await,
-            Request::QueryVaultState => self.handle_query_vault_state().await,
-            Request::EvmWalletCreate => self.handle_evm_wallet_create().await,
-            Request::EvmWalletList => self.handle_evm_wallet_list().await,
-            Request::AuthChallengeRequest { .. }
-            | Request::AuthChallengeSolution { .. }
-            | Request::ClientConnectionResponse { .. } => {
-                Err(TransportResponseError::UnexpectedRequestPayload)
-            }
-            Request::EvmGrantCreate {
-                client_id,
-                shared,
-                specific,
-            } => self.handle_grant_create(client_id, shared, specific).await,
-            Request::EvmGrantDelete { grant_id } => self.handle_grant_delete(grant_id).await,
-        }
-    }
-}
-
-type Output = Result<Response, TransportResponseError>;
-
-impl UserAgentSession {
-    fn take_unseal_secret(
-        &mut self,
-    ) -> Result<(EphemeralSecret, PublicKey), TransportResponseError> {
-        let UserAgentStates::WaitingForUnsealKey(unseal_context) = self.state.state() else {
-            error!("Received encrypted key in invalid state");
-            return Err(TransportResponseError::InvalidStateForUnsealEncryptedKey);
-        };
-
-        let ephemeral_secret = {
-            let mut secret_lock = unseal_context.secret.lock().unwrap();
-            let secret = secret_lock.take();
-            match secret {
-                Some(secret) => secret,
-                None => {
-                    drop(secret_lock);
-                    error!("Ephemeral secret already taken");
-                    return Err(TransportResponseError::StateTransitionFailed);
-                }
-            }
-        };
-
-        Ok((ephemeral_secret, unseal_context.client_public_key))
-    }
-
-    fn decrypt_client_key_material(
-        ephemeral_secret: EphemeralSecret,
-        client_public_key: PublicKey,
-        nonce: &[u8],
-        ciphertext: &[u8],
-        associated_data: &[u8],
-    ) -> Result<MemSafe<Vec<u8>>, ()> {
-        let nonce = XNonce::from_slice(nonce);
-
-        let shared_secret = ephemeral_secret.diffie_hellman(&client_public_key);
-        let cipher = XChaCha20Poly1305::new(shared_secret.as_bytes().into());
-
-        let mut key_buffer = MemSafe::new(ciphertext.to_vec()).unwrap();
-
-        let decryption_result = {
-            let mut write_handle = key_buffer.write().unwrap();
-            let write_handle = write_handle.deref_mut();
-            cipher.decrypt_in_place(nonce, associated_data, write_handle)
-        };
-
-        match decryption_result {
-            Ok(_) => Ok(key_buffer),
-            Err(err) => {
-                error!(?err, "Failed to decrypt encrypted key material");
-                Err(())
-            }
-        }
-    }
-
-    async fn handle_unseal_request(&mut self, client_pubkey: x25519_dalek::PublicKey) -> Output {
-        let secret = EphemeralSecret::random();
-        let public_key = PublicKey::from(&secret);
-
-        self.transition(UserAgentEvents::UnsealRequest(UnsealContext {
-            secret: Mutex::new(Some(secret)),
-            client_public_key: client_pubkey,
-        }))?;
-
-        Ok(Response::UnsealStartResponse {
-            server_pubkey: public_key,
-        })
-    }
-
-    async fn handle_unseal_encrypted_key(
-        &mut self,
-        nonce: Vec<u8>,
-        ciphertext: Vec<u8>,
-        associated_data: Vec<u8>,
-    ) -> Output {
-        let (ephemeral_secret, client_public_key) = match self.take_unseal_secret() {
-            Ok(values) => values,
-            Err(TransportResponseError::StateTransitionFailed) => {
-                self.transition(UserAgentEvents::ReceivedInvalidKey)?;
-                return Ok(Response::UnsealResult(Err(UnsealError::InvalidKey)));
-            }
-            Err(err) => return Err(err),
-        };
-
-        let seal_key_buffer = match Self::decrypt_client_key_material(
-            ephemeral_secret,
-            client_public_key,
-            &nonce,
-            &ciphertext,
-            &associated_data,
-        ) {
-            Ok(buffer) => buffer,
-            Err(()) => {
-                self.transition(UserAgentEvents::ReceivedInvalidKey)?;
-                return Ok(Response::UnsealResult(Err(UnsealError::InvalidKey)));
-            }
-        };
-
-        match self
-            .props
-            .actors
-            .key_holder
-            .ask(TryUnseal {
-                seal_key_raw: seal_key_buffer,
-            })
-            .await
-        {
-            Ok(_) => {
-                info!("Successfully unsealed key with client-provided key");
-                self.transition(UserAgentEvents::ReceivedValidKey)?;
-                Ok(Response::UnsealResult(Ok(())))
-            }
-            Err(SendError::HandlerError(keyholder::Error::InvalidKey)) => {
-                self.transition(UserAgentEvents::ReceivedInvalidKey)?;
-                Ok(Response::UnsealResult(Err(UnsealError::InvalidKey)))
-            }
-            Err(SendError::HandlerError(err)) => {
-                error!(?err, "Keyholder failed to unseal key");
-                self.transition(UserAgentEvents::ReceivedInvalidKey)?;
-                Ok(Response::UnsealResult(Err(UnsealError::InvalidKey)))
-            }
-            Err(err) => {
-                error!(?err, "Failed to send unseal request to keyholder");
-                self.transition(UserAgentEvents::ReceivedInvalidKey)?;
-                Err(TransportResponseError::KeyHolderActorUnreachable)
-            }
-        }
-    }
-
-    async fn handle_bootstrap_encrypted_key(
-        &mut self,
-        nonce: Vec<u8>,
-        ciphertext: Vec<u8>,
-        associated_data: Vec<u8>,
-    ) -> Output {
-        let (ephemeral_secret, client_public_key) = match self.take_unseal_secret() {
-            Ok(values) => values,
-            Err(TransportResponseError::StateTransitionFailed) => {
-                self.transition(UserAgentEvents::ReceivedInvalidKey)?;
-                return Ok(Response::BootstrapResult(Err(BootstrapError::InvalidKey)));
-            }
-            Err(err) => return Err(err),
-        };
-
-        let seal_key_buffer = match Self::decrypt_client_key_material(
-            ephemeral_secret,
-            client_public_key,
-            &nonce,
-            &ciphertext,
-            &associated_data,
-        ) {
-            Ok(buffer) => buffer,
-            Err(()) => {
-                self.transition(UserAgentEvents::ReceivedInvalidKey)?;
-                return Ok(Response::BootstrapResult(Err(BootstrapError::InvalidKey)));
-            }
-        };
-
-        match self
-            .props
-            .actors
-            .key_holder
-            .ask(Bootstrap {
-                seal_key_raw: seal_key_buffer,
-            })
-            .await
-        {
-            Ok(_) => {
-                info!("Successfully bootstrapped vault with client-provided key");
-                self.transition(UserAgentEvents::ReceivedValidKey)?;
-                Ok(Response::BootstrapResult(Ok(())))
-            }
-            Err(SendError::HandlerError(keyholder::Error::AlreadyBootstrapped)) => {
-                self.transition(UserAgentEvents::ReceivedInvalidKey)?;
-                Ok(Response::BootstrapResult(Err(
-                    BootstrapError::AlreadyBootstrapped,
-                )))
-            }
-            Err(SendError::HandlerError(err)) => {
-                error!(?err, "Keyholder failed to bootstrap vault");
-                self.transition(UserAgentEvents::ReceivedInvalidKey)?;
-                Ok(Response::BootstrapResult(Err(BootstrapError::InvalidKey)))
-            }
-            Err(err) => {
-                error!(?err, "Failed to send bootstrap request to keyholder");
-                self.transition(UserAgentEvents::ReceivedInvalidKey)?;
-                Err(TransportResponseError::KeyHolderActorUnreachable)
-            }
-        }
-    }
-}
-
-impl UserAgentSession {
-    async fn handle_query_vault_state(&mut self) -> Output {
-        use crate::actors::keyholder::{GetState, StateDiscriminants};
-
-        let vault_state = match self.props.actors.key_holder.ask(GetState {}).await {
-            Ok(StateDiscriminants::Unbootstrapped) => VaultState::Unbootstrapped,
-            Ok(StateDiscriminants::Sealed) => VaultState::Sealed,
-            Ok(StateDiscriminants::Unsealed) => VaultState::Unsealed,
-            Err(err) => {
-                error!(?err, actor = "useragent", "keyholder.query.failed");
-                return Err(TransportResponseError::KeyHolderActorUnreachable);
-            }
-        };
-
-        Ok(Response::VaultState(vault_state))
-    }
-}
-
-impl UserAgentSession {
-    async fn handle_evm_wallet_create(&mut self) -> Output {
-        let result = match self.props.actors.evm.ask(Generate {}).await {
-            Ok(_address) => return Ok(Response::EvmWalletCreate(Ok(()))),
-            Err(SendError::HandlerError(err)) => Err(err),
-            Err(err) => {
-                error!(?err, "EVM actor unreachable during wallet create");
-                return Err(TransportResponseError::KeyHolderActorUnreachable);
-            }
-        };
-        Ok(Response::EvmWalletCreate(result))
-    }
-
-    async fn handle_evm_wallet_list(&mut self) -> Output {
-        match self.props.actors.evm.ask(ListWallets {}).await {
-            Ok(wallets) => Ok(Response::EvmWalletList(wallets)),
-            Err(err) => {
-                error!(?err, "EVM wallet list failed");
-                Err(TransportResponseError::KeyHolderActorUnreachable)
-            }
-        }
-    }
-}
-
-impl UserAgentSession {
-    async fn handle_grant_list(&mut self) -> Output {
-        match self.props.actors.evm.ask(UseragentListGrants {}).await {
-            Ok(grants) => Ok(Response::ListGrants(grants)),
-            Err(err) => {
-                error!(?err, "EVM grant list failed");
-                Err(TransportResponseError::KeyHolderActorUnreachable)
-            }
-        }
-    }
-
-    async fn handle_grant_create(
-        &mut self,
-        client_id: i32,
-        basic: crate::evm::policies::SharedGrantSettings,
-        grant: crate::evm::policies::SpecificGrant,
-    ) -> Output {
-        match self
-            .props
-            .actors
-            .evm
-            .ask(UseragentCreateGrant {
-                client_id,
-                basic,
-                grant,
-            })
-            .await
-        {
-            Ok(grant_id) => Ok(Response::EvmGrantCreate(Ok(grant_id))),
-            Err(err) => {
-                error!(?err, "EVM grant create failed");
-                Err(TransportResponseError::KeyHolderActorUnreachable)
-            }
-        }
-    }
-
-    async fn handle_grant_delete(&mut self, grant_id: i32) -> Output {
-        match self
-            .props
-            .actors
-            .evm
-            .ask(UseragentDeleteGrant { grant_id })
-            .await
-        {
-            Ok(()) => Ok(Response::EvmGrantDelete(Ok(()))),
-            Err(err) => {
-                error!(?err, "EVM grant delete failed");
-                Err(TransportResponseError::KeyHolderActorUnreachable)
-            }
-        }
-    }
-}

server/crates/arbiter-server/src/context/tls.rs

@@ -8,7 +8,7 @@ use rcgen::{
     BasicConstraints, Certificate, CertificateParams, CertifiedIssuer, DistinguishedName, DnType,
     IsCa, Issuer, KeyPair, KeyUsagePurpose,
 };
-use rustls::pki_types::pem::PemObject;
+use rustls::pki_types::{pem::PemObject};
 use thiserror::Error;
 use tonic::transport::CertificateDer;
 
@@ -59,7 +59,10 @@ pub enum InitError {
 pub type PemCert = String;
 
 pub fn encode_cert_to_pem(cert: &CertificateDer) -> PemCert {
-    pem::encode_config(&Pem::new("CERTIFICATE", cert.to_vec()), ENCODE_CONFIG)
+    pem::encode_config(
+        &Pem::new("CERTIFICATE", cert.to_vec()),
+        ENCODE_CONFIG,
+    )
 }
 
 #[allow(unused)]

server/crates/arbiter-server/src/evm/mod.rs

@@ -117,7 +117,9 @@ async fn check_shared_constraints(
     let now = Utc::now();
 
     // Validity window
-    if shared.valid_from.is_some_and(|t| now < t) || shared.valid_until.is_some_and(|t| now > t) {
+    if shared.valid_from.is_some_and(|t| now < t)
+        || shared.valid_until.is_some_and(|t| now > t)
+    {
         violations.push(EvalViolation::InvalidTime);
     }
 
@@ -125,9 +127,9 @@ async fn check_shared_constraints(
     let fee_exceeded = shared
         .max_gas_fee_per_gas
         .is_some_and(|cap| U256::from(context.max_fee_per_gas) > cap);
-    let priority_exceeded = shared
+    let priority_exceeded = shared.max_priority_fee_per_gas.is_some_and(|cap| {
-        .max_priority_fee_per_gas
+        U256::from(context.max_priority_fee_per_gas) > cap
-        .is_some_and(|cap| U256::from(context.max_priority_fee_per_gas) > cap);
+    });
     if fee_exceeded || priority_exceeded {
         violations.push(EvalViolation::GasLimitExceeded {
             max_gas_fee_per_gas: shared.max_gas_fee_per_gas,

server/crates/arbiter-server/src/evm/policies.rs

@@ -66,7 +66,6 @@ pub enum EvalViolation {
 
 pub type DatabaseID = i32;
 
-#[derive(Debug)]
 pub struct Grant<PolicySettings> {
     pub id: DatabaseID,
     pub shared_grant_id: DatabaseID, // ID of the basic grant for shared-logic checks like rate limits and validity periods
@@ -74,6 +73,7 @@ pub struct Grant<PolicySettings> {
     pub settings: PolicySettings,
 }
 
+
 pub trait Policy: Sized {
     type Settings: Send + Sync + 'static + Into<SpecificGrant>;
     type Meaning: Display + std::fmt::Debug + Send + Sync + 'static + Into<SpecificMeaning>;
@@ -146,7 +146,6 @@ pub struct VolumeRateLimit {
 #[derive(Clone, Debug, PartialEq, Eq, Hash)]
 pub struct SharedGrantSettings {
     pub wallet_id: i32,
-    pub client_id: i32,
     pub chain: ChainId,
 
     pub valid_from: Option<DateTime<Utc>>,
@@ -162,7 +161,6 @@ impl SharedGrantSettings {
     fn try_from_model(model: EvmBasicGrant) -> QueryResult<Self> {
         Ok(Self {
             wallet_id: model.wallet_id,
-            client_id: model.client_id,
             chain: model.chain_id as u64, // safe because chain_id is stored as i32 but is guaranteed to be a valid ChainId by the API when creating grants
             valid_from: model.valid_from.map(Into::into),
             valid_until: model.valid_until.map(Into::into),
@@ -200,7 +198,6 @@ impl SharedGrantSettings {
     }
 }
 
-#[derive(Debug, Clone)]
 pub enum SpecificGrant {
     EtherTransfer(ether_transfer::Settings),
     TokenTransfer(token_transfers::Settings),

server/crates/arbiter-server/src/evm/policies/ether_transfer/mod.rs

@@ -51,10 +51,9 @@ impl From<Meaning> for SpecificMeaning {
 }
 
 // A grant for ether transfers, which can be scoped to specific target addresses and volume limits
-#[derive(Debug, Clone)]
 pub struct Settings {
-    pub target: Vec<Address>,
+    target: Vec<Address>,
-    pub limit: VolumeRateLimit,
+    limit: VolumeRateLimit,
 }
 
 impl From<Settings> for SpecificGrant {

server/crates/arbiter-server/src/evm/policies/ether_transfer/tests.rs

@@ -9,7 +9,9 @@ use crate::db::{
     schema::{evm_basic_grant, evm_transaction_log},
 };
 use crate::evm::{
-    policies::{EvalContext, EvalViolation, Grant, Policy, SharedGrantSettings, VolumeRateLimit},
+    policies::{
+        EvalContext, EvalViolation, Grant, Policy, SharedGrantSettings, VolumeRateLimit,
+    },
     utils,
 };
 
@@ -74,7 +76,6 @@ fn shared() -> SharedGrantSettings {
         max_gas_fee_per_gas: None,
         max_priority_fee_per_gas: None,
         rate_limit: None,
-        client_id: CLIENT_ID,
     }
 }
 

server/crates/arbiter-server/src/evm/policies/token_transfers/mod.rs

@@ -58,11 +58,10 @@ impl From<Meaning> for SpecificMeaning {
 }
 
 // A grant for token transfers, which can be scoped to specific target addresses and volume limits
-#[derive(Debug, Clone)]
 pub struct Settings {
-    pub token_contract: Address,
+    token_contract: Address,
-    pub target: Option<Address>,
+    target: Option<Address>,
-    pub volume_limits: Vec<VolumeRateLimit>,
+    volume_limits: Vec<VolumeRateLimit>,
 }
 impl From<Settings> for SpecificGrant {
     fn from(val: Settings) -> SpecificGrant {

server/crates/arbiter-server/src/evm/policies/token_transfers/tests.rs

@@ -93,7 +93,6 @@ fn shared() -> SharedGrantSettings {
         max_gas_fee_per_gas: None,
         max_priority_fee_per_gas: None,
         rate_limit: None,
-        client_id: CLIENT_ID,
     }
 }
 
@@ -141,18 +140,10 @@ async fn evaluate_rejects_nonzero_eth_value() {
     let mut context = ctx(DAI, calldata);
     context.value = U256::from(1u64); // ETH attached to an ERC-20 call
 
-    let m = TokenTransfer::analyze(&EvalContext {
+    let m = TokenTransfer::analyze(&EvalContext { value: U256::ZERO, ..context.clone() })
-        value: U256::ZERO,
-        ..context.clone()
-    })
-    .unwrap();
-    let v = TokenTransfer::evaluate(&context, &m, &grant, &mut *conn)
-        .await
         .unwrap();
-    assert!(
+    let v = TokenTransfer::evaluate(&context, &m, &grant, &mut *conn).await.unwrap();
-        v.iter()
+    assert!(v.iter().any(|e| matches!(e, EvalViolation::InvalidTransactionType)));
-            .any(|e| matches!(e, EvalViolation::InvalidTransactionType))
-    );
 }
 
 #[tokio::test]
@@ -169,9 +160,7 @@ async fn evaluate_passes_any_recipient_when_no_restriction() {
     let calldata = transfer_calldata(RECIPIENT, U256::from(100u64));
     let context = ctx(DAI, calldata);
     let m = TokenTransfer::analyze(&context).unwrap();
-    let v = TokenTransfer::evaluate(&context, &m, &grant, &mut *conn)
+    let v = TokenTransfer::evaluate(&context, &m, &grant, &mut *conn).await.unwrap();
-        .await
-        .unwrap();
     assert!(v.is_empty());
 }
 
@@ -189,9 +178,7 @@ async fn evaluate_passes_matching_restricted_recipient() {
     let calldata = transfer_calldata(RECIPIENT, U256::from(100u64));
     let context = ctx(DAI, calldata);
     let m = TokenTransfer::analyze(&context).unwrap();
-    let v = TokenTransfer::evaluate(&context, &m, &grant, &mut *conn)
+    let v = TokenTransfer::evaluate(&context, &m, &grant, &mut *conn).await.unwrap();
-        .await
-        .unwrap();
     assert!(v.is_empty());
 }
 
@@ -209,13 +196,8 @@ async fn evaluate_rejects_wrong_restricted_recipient() {
     let calldata = transfer_calldata(OTHER, U256::from(100u64));
     let context = ctx(DAI, calldata);
     let m = TokenTransfer::analyze(&context).unwrap();
-    let v = TokenTransfer::evaluate(&context, &m, &grant, &mut *conn)
+    let v = TokenTransfer::evaluate(&context, &m, &grant, &mut *conn).await.unwrap();
-        .await
+    assert!(v.iter().any(|e| matches!(e, EvalViolation::InvalidTarget { .. })));
-        .unwrap();
-    assert!(
-        v.iter()
-            .any(|e| matches!(e, EvalViolation::InvalidTarget { .. }))
-    );
 }
 
 #[tokio::test]
@@ -225,9 +207,7 @@ async fn evaluate_passes_volume_within_limit() {
 
     let basic = insert_basic(&mut conn, false).await;
     let settings = make_settings(None, Some(1_000));
-    let grant_id = TokenTransfer::create_grant(&basic, &settings, &mut *conn)
+    let grant_id = TokenTransfer::create_grant(&basic, &settings, &mut *conn).await.unwrap();
-        .await
-        .unwrap();
 
     // Record a past transfer of 500 (within 1000 limit)
     use crate::db::{models::NewEvmTokenTransferLog, schema::evm_token_transfer_log};
@@ -244,22 +224,12 @@ async fn evaluate_passes_volume_within_limit() {
         .await
         .unwrap();
 
-    let grant = Grant {
+    let grant = Grant { id: grant_id, shared_grant_id: basic.id, shared: shared(), settings };
-        id: grant_id,
-        shared_grant_id: basic.id,
-        shared: shared(),
-        settings,
-    };
     let calldata = transfer_calldata(RECIPIENT, U256::from(100u64));
     let context = ctx(DAI, calldata);
     let m = TokenTransfer::analyze(&context).unwrap();
-    let v = TokenTransfer::evaluate(&context, &m, &grant, &mut *conn)
+    let v = TokenTransfer::evaluate(&context, &m, &grant, &mut *conn).await.unwrap();
-        .await
+    assert!(!v.iter().any(|e| matches!(e, EvalViolation::VolumetricLimitExceeded)));
-        .unwrap();
-    assert!(
-        !v.iter()
-            .any(|e| matches!(e, EvalViolation::VolumetricLimitExceeded))
-    );
 }
 
 #[tokio::test]
@@ -269,9 +239,7 @@ async fn evaluate_rejects_volume_over_limit() {
 
     let basic = insert_basic(&mut conn, false).await;
     let settings = make_settings(None, Some(1_000));
-    let grant_id = TokenTransfer::create_grant(&basic, &settings, &mut *conn)
+    let grant_id = TokenTransfer::create_grant(&basic, &settings, &mut *conn).await.unwrap();
-        .await
-        .unwrap();
 
     use crate::db::{models::NewEvmTokenTransferLog, schema::evm_token_transfer_log};
     insert_into(evm_token_transfer_log::table)
@@ -287,22 +255,12 @@ async fn evaluate_rejects_volume_over_limit() {
         .await
         .unwrap();
 
-    let grant = Grant {
+    let grant = Grant { id: grant_id, shared_grant_id: basic.id, shared: shared(), settings };
-        id: grant_id,
-        shared_grant_id: basic.id,
-        shared: shared(),
-        settings,
-    };
     let calldata = transfer_calldata(RECIPIENT, U256::from(100u64));
     let context = ctx(DAI, calldata);
     let m = TokenTransfer::analyze(&context).unwrap();
-    let v = TokenTransfer::evaluate(&context, &m, &grant, &mut *conn)
+    let v = TokenTransfer::evaluate(&context, &m, &grant, &mut *conn).await.unwrap();
-        .await
+    assert!(v.iter().any(|e| matches!(e, EvalViolation::VolumetricLimitExceeded)));
-        .unwrap();
-    assert!(
-        v.iter()
-            .any(|e| matches!(e, EvalViolation::VolumetricLimitExceeded))
-    );
 }
 
 #[tokio::test]
@@ -319,13 +277,8 @@ async fn evaluate_no_volume_limits_always_passes() {
     let calldata = transfer_calldata(RECIPIENT, U256::from(u64::MAX));
     let context = ctx(DAI, calldata);
     let m = TokenTransfer::analyze(&context).unwrap();
-    let v = TokenTransfer::evaluate(&context, &m, &grant, &mut *conn)
+    let v = TokenTransfer::evaluate(&context, &m, &grant, &mut *conn).await.unwrap();
-        .await
+    assert!(!v.iter().any(|e| matches!(e, EvalViolation::VolumetricLimitExceeded)));
-        .unwrap();
-    assert!(
-        !v.iter()
-            .any(|e| matches!(e, EvalViolation::VolumetricLimitExceeded))
-    );
 }
 
 // ── try_find_grant ───────────────────────────────────────────────────────
@@ -337,9 +290,7 @@ async fn try_find_grant_roundtrip() {
 
     let basic = insert_basic(&mut conn, false).await;
     let settings = make_settings(Some(RECIPIENT), Some(5_000));
-    TokenTransfer::create_grant(&basic, &settings, &mut *conn)
+    TokenTransfer::create_grant(&basic, &settings, &mut *conn).await.unwrap();
-        .await
-        .unwrap();
 
     let calldata = transfer_calldata(RECIPIENT, U256::from(100u64));
     let found = TokenTransfer::try_find_grant(&ctx(DAI, calldata), &mut *conn)
@@ -361,9 +312,7 @@ async fn try_find_grant_revoked_returns_none() {
 
     let basic = insert_basic(&mut conn, true).await;
     let settings = make_settings(None, None);
-    TokenTransfer::create_grant(&basic, &settings, &mut *conn)
+    TokenTransfer::create_grant(&basic, &settings, &mut *conn).await.unwrap();
-        .await
-        .unwrap();
 
     let calldata = transfer_calldata(RECIPIENT, U256::from(1u64));
     let found = TokenTransfer::try_find_grant(&ctx(DAI, calldata), &mut *conn)
@@ -379,9 +328,7 @@ async fn try_find_grant_unknown_token_returns_none() {
 
     let basic = insert_basic(&mut conn, false).await;
     let settings = make_settings(None, None);
-    TokenTransfer::create_grant(&basic, &settings, &mut *conn)
+    TokenTransfer::create_grant(&basic, &settings, &mut *conn).await.unwrap();
-        .await
-        .unwrap();
 
     // Query with a different token contract
     let calldata = transfer_calldata(RECIPIENT, U256::from(1u64));
@@ -408,13 +355,9 @@ async fn find_all_grants_excludes_revoked() {
 
     let settings = make_settings(None, Some(1_000));
     let active = insert_basic(&mut conn, false).await;
-    TokenTransfer::create_grant(&active, &settings, &mut *conn)
+    TokenTransfer::create_grant(&active, &settings, &mut *conn).await.unwrap();
-        .await
-        .unwrap();
     let revoked = insert_basic(&mut conn, true).await;
-    TokenTransfer::create_grant(&revoked, &settings, &mut *conn)
+    TokenTransfer::create_grant(&revoked, &settings, &mut *conn).await.unwrap();
-        .await
-        .unwrap();
 
     let all = TokenTransfer::find_all_grants(&mut *conn).await.unwrap();
     assert_eq!(all.len(), 1);
@@ -427,17 +370,12 @@ async fn find_all_grants_loads_volume_limits() {
 
     let basic = insert_basic(&mut conn, false).await;
     let settings = make_settings(None, Some(9_999));
-    TokenTransfer::create_grant(&basic, &settings, &mut *conn)
+    TokenTransfer::create_grant(&basic, &settings, &mut *conn).await.unwrap();
-        .await
-        .unwrap();
 
     let all = TokenTransfer::find_all_grants(&mut *conn).await.unwrap();
     assert_eq!(all.len(), 1);
     assert_eq!(all[0].settings.volume_limits.len(), 1);
-    assert_eq!(
+    assert_eq!(all[0].settings.volume_limits[0].max_volume, U256::from(9_999u64));
-        all[0].settings.volume_limits[0].max_volume,
-        U256::from(9_999u64)
-    );
 }
 
 #[tokio::test]
@@ -450,13 +388,9 @@ async fn find_all_grants_multiple_grants_batch_loaded() {
         .await
         .unwrap();
     let b2 = insert_basic(&mut conn, false).await;
-    TokenTransfer::create_grant(
+    TokenTransfer::create_grant(&b2, &make_settings(Some(RECIPIENT), Some(2_000)), &mut *conn)
-        &b2,
+        .await
-        &make_settings(Some(RECIPIENT), Some(2_000)),
+        .unwrap();
-        &mut *conn,
-    )
-    .await
-    .unwrap();
 
     let all = TokenTransfer::find_all_grants(&mut *conn).await.unwrap();
     assert_eq!(all.len(), 2);

server/crates/arbiter-server/src/evm/safe_signer.rs

@@ -3,11 +3,11 @@ use std::sync::Mutex;
 use alloy::{
     consensus::SignableTransaction,
     network::{TxSigner, TxSignerSync},
-    primitives::{Address, B256, ChainId, Signature},
+    primitives::{Address, ChainId, Signature, B256},
     signers::{Error, Result, Signer, SignerSync, utils::secret_key_to_address},
 };
 use async_trait::async_trait;
-use k256::ecdsa::{self, RecoveryId, SigningKey, signature::hazmat::PrehashSigner};
+use k256::ecdsa::{self, signature::hazmat::PrehashSigner, RecoveryId, SigningKey};
 use memsafe::MemSafe;
 
 /// An Ethereum signer that stores its secp256k1 secret key inside a
@@ -90,7 +90,10 @@ impl SafeSigner {
         Ok(sig.into())
     }
 
-    fn sign_tx_inner(&self, tx: &mut dyn SignableTransaction<Signature>) -> Result<Signature> {
+    fn sign_tx_inner(
+        &self,
+        tx: &mut dyn SignableTransaction<Signature>,
+    ) -> Result<Signature> {
         if let Some(chain_id) = self.chain_id
             && !tx.set_chain_id_checked(chain_id)
         {
@@ -99,8 +102,7 @@ impl SafeSigner {
                 tx: tx.chain_id().unwrap(),
             });
         }
-        self.sign_hash_inner(&tx.signature_hash())
+        self.sign_hash_inner(&tx.signature_hash()).map_err(Error::other)
-            .map_err(Error::other)
     }
 }
 

server/crates/arbiter-server/src/grpc/client.rs

@@ -1,137 +0,0 @@
-use arbiter_proto::{
-    proto::client::{
-        AuthChallenge as ProtoAuthChallenge,
-        AuthChallengeRequest as ProtoAuthChallengeRequest,
-        AuthChallengeSolution as ProtoAuthChallengeSolution, AuthOk as ProtoAuthOk,
-        ClientConnectError, ClientRequest, ClientResponse,
-        client_connect_error::Code as ProtoClientConnectErrorCode,
-        client_request::Payload as ClientRequestPayload,
-        client_response::Payload as ClientResponsePayload,
-    },
-    transport::{Bi, Error as TransportError},
-};
-use async_trait::async_trait;
-use futures::StreamExt as _;
-use tokio::sync::mpsc;
-use tonic::{Status, Streaming};
-
-use crate::actors::client::{
-    self, ClientError, ConnectErrorCode, Request as DomainRequest, Response as DomainResponse,
-};
-
-pub struct GrpcTransport {
-    sender: mpsc::Sender<Result<ClientResponse, Status>>,
-    receiver: Streaming<ClientRequest>,
-}
-
-impl GrpcTransport {
-    pub fn new(
-        sender: mpsc::Sender<Result<ClientResponse, Status>>,
-        receiver: Streaming<ClientRequest>,
-    ) -> Self {
-        Self { sender, receiver }
-    }
-
-    fn request_to_domain(request: ClientRequest) -> Result<DomainRequest, Status> {
-        match request.payload {
-            Some(ClientRequestPayload::AuthChallengeRequest(ProtoAuthChallengeRequest {
-                pubkey,
-            })) => Ok(DomainRequest::AuthChallengeRequest { pubkey }),
-            Some(ClientRequestPayload::AuthChallengeSolution(
-                ProtoAuthChallengeSolution { signature },
-            )) => Ok(DomainRequest::AuthChallengeSolution { signature }),
-            None => Err(Status::invalid_argument("Missing client request payload")),
-        }
-    }
-
-    fn response_to_proto(response: DomainResponse) -> ClientResponse {
-        let payload = match response {
-            DomainResponse::AuthChallenge { pubkey, nonce } => {
-                ClientResponsePayload::AuthChallenge(ProtoAuthChallenge { pubkey, nonce })
-            }
-            DomainResponse::AuthOk => ClientResponsePayload::AuthOk(ProtoAuthOk {}),
-            DomainResponse::ClientConnectError { code } => {
-                ClientResponsePayload::ClientConnectError(ClientConnectError {
-                    code: match code {
-                        ConnectErrorCode::Unknown => ProtoClientConnectErrorCode::Unknown,
-                        ConnectErrorCode::ApprovalDenied => {
-                            ProtoClientConnectErrorCode::ApprovalDenied
-                        }
-                        ConnectErrorCode::NoUserAgentsOnline => {
-                            ProtoClientConnectErrorCode::NoUserAgentsOnline
-                        }
-                    }
-                    .into(),
-                })
-            }
-        };
-
-        ClientResponse {
-            payload: Some(payload),
-        }
-    }
-
-    fn error_to_status(value: ClientError) -> Status {
-        match value {
-            ClientError::MissingRequestPayload | ClientError::UnexpectedRequestPayload => {
-                Status::invalid_argument("Expected message with payload")
-            }
-            ClientError::StateTransitionFailed => Status::internal("State machine error"),
-            ClientError::Auth(ref err) => auth_error_status(err),
-            ClientError::ConnectionRegistrationFailed => {
-                Status::internal("Connection registration failed")
-            }
-        }
-    }
-}
-
-#[async_trait]
-impl Bi<DomainRequest, Result<DomainResponse, ClientError>> for GrpcTransport {
-    async fn send(&mut self, item: Result<DomainResponse, ClientError>) -> Result<(), TransportError> {
-        let outbound = match item {
-            Ok(message) => Ok(Self::response_to_proto(message)),
-            Err(err) => Err(Self::error_to_status(err)),
-        };
-
-        self.sender
-            .send(outbound)
-            .await
-            .map_err(|_| TransportError::ChannelClosed)
-    }
-
-    async fn recv(&mut self) -> Option<DomainRequest> {
-        match self.receiver.next().await {
-            Some(Ok(item)) => match Self::request_to_domain(item) {
-                Ok(request) => Some(request),
-                Err(status) => {
-                    let _ = self.sender.send(Err(status)).await;
-                    None
-                }
-            },
-            Some(Err(error)) => {
-                tracing::error!(error = ?error, "grpc client recv failed; closing stream");
-                None
-            }
-            None => None,
-        }
-    }
-}
-
-fn auth_error_status(value: &client::auth::Error) -> Status {
-    use client::auth::Error;
-
-    match value {
-        Error::UnexpectedMessagePayload | Error::InvalidClientPubkeyLength => {
-            Status::invalid_argument(value.to_string())
-        }
-        Error::InvalidAuthPubkeyEncoding => {
-            Status::invalid_argument("Failed to convert pubkey to VerifyingKey")
-        }
-        Error::InvalidChallengeSolution => Status::unauthenticated(value.to_string()),
-        Error::ApproveError(_) => Status::permission_denied(value.to_string()),
-        Error::Transport => Status::internal("Transport error"),
-        Error::DatabasePoolUnavailable => Status::internal("Database pool error"),
-        Error::DatabaseOperationFailed => Status::internal("Database error"),
-        Error::InternalError => Status::internal("Internal error"),
-    }
-}

server/crates/arbiter-server/src/grpc/mod.rs

@@ -1,65 +0,0 @@
-
-use arbiter_proto::proto::{
-    client::{ClientRequest, ClientResponse},
-    user_agent::{UserAgentRequest, UserAgentResponse},
-};
-use tokio::sync::mpsc;
-use tokio_stream::wrappers::ReceiverStream;
-use tonic::{Request, Response, Status, async_trait};
-use tracing::info;
-
-use crate::{
-    DEFAULT_CHANNEL_SIZE,
-    actors::{client::{ClientConnection, connect_client}, user_agent::{UserAgentConnection, connect_user_agent}},
-};
-
-pub mod client;
-pub mod user_agent;
-
-#[async_trait]
-impl arbiter_proto::proto::arbiter_service_server::ArbiterService for super::Server {
-    type UserAgentStream = ReceiverStream<Result<UserAgentResponse, Status>>;
-    type ClientStream = ReceiverStream<Result<ClientResponse, Status>>;
-
-    #[tracing::instrument(level = "debug", skip(self))]
-    async fn client(
-        &self,
-        request: Request<tonic::Streaming<ClientRequest>>,
-    ) -> Result<Response<Self::ClientStream>, Status> {
-        let req_stream = request.into_inner();
-        let (tx, rx) = mpsc::channel(DEFAULT_CHANNEL_SIZE);
-
-        let transport = client::GrpcTransport::new(tx, req_stream);
-        let props = ClientConnection::new(
-            self.context.db.clone(),
-            Box::new(transport),
-            self.context.actors.clone(),
-        );
-        tokio::spawn(connect_client(props));
-
-        info!(event = "connection established", "grpc.client");
-
-        Ok(Response::new(ReceiverStream::new(rx)))
-    }
-
-    #[tracing::instrument(level = "debug", skip(self))]
-    async fn user_agent(
-        &self,
-        request: Request<tonic::Streaming<UserAgentRequest>>,
-    ) -> Result<Response<Self::UserAgentStream>, Status> {
-        let req_stream = request.into_inner();
-        let (tx, rx) = mpsc::channel(DEFAULT_CHANNEL_SIZE);
-
-        let transport = user_agent::GrpcTransport::new(tx, req_stream);
-        let props = UserAgentConnection::new(
-            self.context.db.clone(),
-            self.context.actors.clone(),
-            Box::new(transport),
-        );
-        tokio::spawn(connect_user_agent(props));
-
-        info!(event = "connection established", "grpc.user_agent");
-
-        Ok(Response::new(ReceiverStream::new(rx)))
-    }
-}

server/crates/arbiter-server/src/grpc/user_agent.rs

@@ -1,511 +0,0 @@
-use arbiter_proto::{
-    proto::{
-        self,
-        evm::{
-            EtherTransferSettings as ProtoEtherTransferSettings, EvmError as ProtoEvmError,
-            EvmGrantCreateRequest, EvmGrantCreateResponse, EvmGrantDeleteRequest,
-            EvmGrantDeleteResponse, EvmGrantList, EvmGrantListResponse, GrantEntry,
-            SharedSettings as ProtoSharedSettings, SpecificGrant as ProtoSpecificGrant,
-            SpecificGrant as ProtoGrantSpecificGrant,
-            TokenTransferSettings as ProtoTokenTransferSettings,
-            VolumeRateLimit as ProtoVolumeRateLimit, WalletCreateResponse, WalletEntry, WalletList,
-            WalletListResponse, evm_grant_create_response::Result as EvmGrantCreateResult,
-            evm_grant_delete_response::Result as EvmGrantDeleteResult,
-            evm_grant_list_response::Result as EvmGrantListResult,
-            specific_grant::Grant as ProtoSpecificGrantType,
-            wallet_create_response::Result as WalletCreateResult,
-            wallet_list_response::Result as WalletListResult,
-        },
-        user_agent::{
-            AuthChallenge as ProtoAuthChallenge, AuthChallengeRequest as ProtoAuthChallengeRequest,
-            AuthChallengeSolution as ProtoAuthChallengeSolution, AuthOk as ProtoAuthOk,
-            BootstrapEncryptedKey as ProtoBootstrapEncryptedKey,
-            BootstrapResult as ProtoBootstrapResult, ClientConnectionCancel,
-            ClientConnectionRequest, ClientConnectionResponse, KeyType as ProtoKeyType,
-            UnsealEncryptedKey as ProtoUnsealEncryptedKey, UnsealResult as ProtoUnsealResult,
-            UnsealStart, UnsealStartResponse, UserAgentRequest, UserAgentResponse,
-            VaultState as ProtoVaultState, user_agent_request::Payload as UserAgentRequestPayload,
-            user_agent_response::Payload as UserAgentResponsePayload,
-        },
-    },
-    transport::{Bi, Error as TransportError},
-};
-use async_trait::async_trait;
-use futures::StreamExt as _;
-use prost_types::Timestamp;
-use tokio::sync::mpsc;
-use tonic::{Status, Streaming};
-
-use crate::{
-    actors::user_agent::{
-        self, AuthPublicKey, BootstrapError, Request as DomainRequest, Response as DomainResponse,
-        TransportResponseError, UnsealError, VaultState,
-    },
-    evm::{
-        self,
-        policies::{Grant, SpecificGrant},
-        policies::{
-            SharedGrantSettings, TransactionRateLimit, VolumeRateLimit, ether_transfer,
-            token_transfers,
-        },
-    },
-};
-use alloy::primitives::{Address, U256};
-use chrono::{DateTime, TimeZone, Utc};
-
-pub struct GrpcTransport {
-    sender: mpsc::Sender<Result<UserAgentResponse, Status>>,
-    receiver: Streaming<UserAgentRequest>,
-}
-
-impl GrpcTransport {
-    pub fn new(
-        sender: mpsc::Sender<Result<UserAgentResponse, Status>>,
-        receiver: Streaming<UserAgentRequest>,
-    ) -> Self {
-        Self { sender, receiver }
-    }
-
-    fn request_to_domain(request: UserAgentRequest) -> Result<DomainRequest, Status> {
-        match request.payload {
-            Some(UserAgentRequestPayload::AuthChallengeRequest(ProtoAuthChallengeRequest {
-                pubkey,
-                bootstrap_token,
-                key_type,
-            })) => Ok(DomainRequest::AuthChallengeRequest {
-                pubkey: parse_auth_pubkey(key_type, pubkey)?,
-                bootstrap_token,
-            }),
-            Some(UserAgentRequestPayload::AuthChallengeSolution(ProtoAuthChallengeSolution {
-                signature,
-            })) => Ok(DomainRequest::AuthChallengeSolution { signature }),
-            Some(UserAgentRequestPayload::UnsealStart(UnsealStart { client_pubkey })) => {
-                let client_pubkey: [u8; 32] = client_pubkey
-                    .as_slice()
-                    .try_into()
-                    .map_err(|_| Status::invalid_argument("client_pubkey must be 32 bytes"))?;
-                Ok(DomainRequest::UnsealStart {
-                    client_pubkey: x25519_dalek::PublicKey::from(client_pubkey),
-                })
-            }
-            Some(UserAgentRequestPayload::UnsealEncryptedKey(ProtoUnsealEncryptedKey {
-                nonce,
-                ciphertext,
-                associated_data,
-            })) => Ok(DomainRequest::UnsealEncryptedKey {
-                nonce,
-                ciphertext,
-                associated_data,
-            }),
-            Some(UserAgentRequestPayload::BootstrapEncryptedKey(ProtoBootstrapEncryptedKey {
-                nonce,
-                ciphertext,
-                associated_data,
-            })) => Ok(DomainRequest::BootstrapEncryptedKey {
-                nonce,
-                ciphertext,
-                associated_data,
-            }),
-            Some(UserAgentRequestPayload::QueryVaultState(_)) => Ok(DomainRequest::QueryVaultState),
-            Some(UserAgentRequestPayload::EvmWalletCreate(_)) => Ok(DomainRequest::EvmWalletCreate),
-            Some(UserAgentRequestPayload::EvmWalletList(_)) => Ok(DomainRequest::EvmWalletList),
-            Some(UserAgentRequestPayload::ClientConnectionResponse(ClientConnectionResponse {
-                approved,
-            })) => Ok(DomainRequest::ClientConnectionResponse { approved }),
-
-            Some(UserAgentRequestPayload::EvmGrantList(_)) => Ok(DomainRequest::ListGrants),
-            Some(UserAgentRequestPayload::EvmGrantCreate(EvmGrantCreateRequest {
-                client_id,
-                shared,
-                specific,
-            })) => {
-                let shared = parse_shared_settings(client_id, shared)?;
-                let specific = parse_specific_grant(specific)?;
-                Ok(DomainRequest::EvmGrantCreate {
-                    client_id,
-                    shared,
-                    specific,
-                })
-            }
-            Some(UserAgentRequestPayload::EvmGrantDelete(EvmGrantDeleteRequest { grant_id })) => {
-                Ok(DomainRequest::EvmGrantDelete { grant_id })
-            }
-            None => Err(Status::invalid_argument(
-                "Missing user-agent request payload",
-            )),
-        }
-    }
-
-    fn response_to_proto(response: DomainResponse) -> UserAgentResponse {
-        let payload = match response {
-            DomainResponse::AuthChallenge { nonce } => {
-                UserAgentResponsePayload::AuthChallenge(ProtoAuthChallenge {
-                    pubkey: Vec::new(),
-                    nonce,
-                })
-            }
-            DomainResponse::AuthOk => UserAgentResponsePayload::AuthOk(ProtoAuthOk {}),
-            DomainResponse::UnsealStartResponse { server_pubkey } => {
-                UserAgentResponsePayload::UnsealStartResponse(UnsealStartResponse {
-                    server_pubkey: server_pubkey.as_bytes().to_vec(),
-                })
-            }
-            DomainResponse::UnsealResult(result) => UserAgentResponsePayload::UnsealResult(
-                match result {
-                    Ok(()) => ProtoUnsealResult::Success,
-                    Err(UnsealError::InvalidKey) => ProtoUnsealResult::InvalidKey,
-                    Err(UnsealError::Unbootstrapped) => ProtoUnsealResult::Unbootstrapped,
-                }
-                .into(),
-            ),
-            DomainResponse::BootstrapResult(result) => UserAgentResponsePayload::BootstrapResult(
-                match result {
-                    Ok(()) => ProtoBootstrapResult::Success,
-                    Err(BootstrapError::AlreadyBootstrapped) => {
-                        ProtoBootstrapResult::AlreadyBootstrapped
-                    }
-                    Err(BootstrapError::InvalidKey) => ProtoBootstrapResult::InvalidKey,
-                }
-                .into(),
-            ),
-            DomainResponse::VaultState(state) => UserAgentResponsePayload::VaultState(
-                match state {
-                    VaultState::Unbootstrapped => ProtoVaultState::Unbootstrapped,
-                    VaultState::Sealed => ProtoVaultState::Sealed,
-                    VaultState::Unsealed => ProtoVaultState::Unsealed,
-                }
-                .into(),
-            ),
-            DomainResponse::ClientConnectionRequest { pubkey } => {
-                UserAgentResponsePayload::ClientConnectionRequest(ClientConnectionRequest {
-                    pubkey: pubkey.to_bytes().to_vec(),
-                })
-            }
-            DomainResponse::ClientConnectionCancel => {
-                UserAgentResponsePayload::ClientConnectionCancel(ClientConnectionCancel {})
-            }
-            DomainResponse::EvmWalletCreate(result) => {
-                UserAgentResponsePayload::EvmWalletCreate(WalletCreateResponse {
-                    result: Some(match result {
-                        Ok(()) => WalletCreateResult::Wallet(WalletEntry {
-                            address: Vec::new(),
-                        }),
-                        Err(_) => WalletCreateResult::Error(ProtoEvmError::Internal.into()),
-                    }),
-                })
-            }
-            DomainResponse::EvmWalletList(wallets) => {
-                UserAgentResponsePayload::EvmWalletList(WalletListResponse {
-                    result: Some(WalletListResult::Wallets(WalletList {
-                        wallets: wallets
-                            .into_iter()
-                            .map(|addr| WalletEntry {
-                                address: addr.as_slice().to_vec(),
-                            })
-                            .collect(),
-                    })),
-                })
-            }
-            DomainResponse::ListGrants(grants) => {
-                UserAgentResponsePayload::EvmGrantList(EvmGrantListResponse {
-                    result: Some(EvmGrantListResult::Grants(EvmGrantList {
-                        grants: grants.into_iter().map(grant_to_proto).collect(),
-                    })),
-                })
-            }
-            DomainResponse::EvmGrantCreate(result) => {
-                UserAgentResponsePayload::EvmGrantCreate(EvmGrantCreateResponse {
-                    result: Some(match result {
-                        Ok(grant_id) => EvmGrantCreateResult::GrantId(grant_id),
-                        Err(_) => EvmGrantCreateResult::Error(ProtoEvmError::Internal.into()),
-                    }),
-                })
-            }
-            DomainResponse::EvmGrantDelete(result) => {
-                UserAgentResponsePayload::EvmGrantDelete(EvmGrantDeleteResponse {
-                    result: Some(match result {
-                        Ok(()) => EvmGrantDeleteResult::Ok(()),
-                        Err(_) => EvmGrantDeleteResult::Error(ProtoEvmError::Internal.into()),
-                    }),
-                })
-            }
-        };
-
-        UserAgentResponse {
-            payload: Some(payload),
-        }
-    }
-
-    fn error_to_status(value: TransportResponseError) -> Status {
-        match value {
-            TransportResponseError::UnexpectedRequestPayload => {
-                Status::invalid_argument("Expected message with payload")
-            }
-            TransportResponseError::InvalidStateForUnsealEncryptedKey => {
-                Status::failed_precondition("Invalid state for unseal encrypted key")
-            }
-            TransportResponseError::InvalidClientPubkeyLength => {
-                Status::invalid_argument("client_pubkey must be 32 bytes")
-            }
-            TransportResponseError::StateTransitionFailed => {
-                Status::internal("State machine error")
-            }
-            TransportResponseError::KeyHolderActorUnreachable => {
-                Status::internal("Vault is not available")
-            }
-            TransportResponseError::Auth(ref err) => auth_error_status(err),
-            TransportResponseError::ConnectionRegistrationFailed => {
-                Status::internal("Failed registering connection")
-            }
-        }
-    }
-}
-
-#[async_trait]
-impl Bi<DomainRequest, Result<DomainResponse, TransportResponseError>> for GrpcTransport {
-    async fn send(
-        &mut self,
-        item: Result<DomainResponse, TransportResponseError>,
-    ) -> Result<(), TransportError> {
-        let outbound = match item {
-            Ok(message) => Ok(Self::response_to_proto(message)),
-            Err(err) => Err(Self::error_to_status(err)),
-        };
-
-        self.sender
-            .send(outbound)
-            .await
-            .map_err(|_| TransportError::ChannelClosed)
-    }
-
-    async fn recv(&mut self) -> Option<DomainRequest> {
-        match self.receiver.next().await {
-            Some(Ok(item)) => match Self::request_to_domain(item) {
-                Ok(request) => Some(request),
-                Err(status) => {
-                    let _ = self.sender.send(Err(status)).await;
-                    None
-                }
-            },
-            Some(Err(error)) => {
-                tracing::error!(error = ?error, "grpc user-agent recv failed; closing stream");
-                None
-            }
-            None => None,
-        }
-    }
-}
-
-fn grant_to_proto(grant: Grant<SpecificGrant>) -> proto::evm::GrantEntry {
-    GrantEntry {
-        id: grant.id,
-        specific: Some(match grant.settings {
-            SpecificGrant::EtherTransfer(settings) => ProtoSpecificGrant {
-                grant: Some(ProtoSpecificGrantType::EtherTransfer(
-                    ProtoEtherTransferSettings {
-                        targets: settings
-                            .target
-                            .into_iter()
-                            .map(|addr| addr.as_slice().to_vec())
-                            .collect(),
-                        limit: Some(proto::evm::VolumeRateLimit {
-                            max_volume: settings.limit.max_volume.to_be_bytes_vec(),
-                            window_secs: settings.limit.window.num_seconds(),
-                        }),
-                    },
-                )),
-            },
-            SpecificGrant::TokenTransfer(settings) => ProtoSpecificGrant {
-                grant: Some(ProtoSpecificGrantType::TokenTransfer(
-                    ProtoTokenTransferSettings {
-                        token_contract: settings.token_contract.as_slice().to_vec(),
-                        target: settings.target.map(|addr| addr.as_slice().to_vec()),
-                        volume_limits: settings
-                            .volume_limits
-                            .into_iter()
-                            .map(|vrl| proto::evm::VolumeRateLimit {
-                                max_volume: vrl.max_volume.to_be_bytes_vec(),
-                                window_secs: vrl.window.num_seconds(),
-                            })
-                            .collect(),
-                    },
-                )),
-            },
-        }),
-        client_id: grant.shared.client_id,
-        shared: Some(proto::evm::SharedSettings {
-            wallet_id: grant.shared.wallet_id,
-            chain_id: grant.shared.chain,
-            valid_from: grant.shared.valid_from.map(|dt| Timestamp {
-                seconds: dt.timestamp(),
-                nanos: 0,
-            }),
-            valid_until: grant.shared.valid_until.map(|dt| Timestamp {
-                seconds: dt.timestamp(),
-                nanos: 0,
-            }),
-            max_gas_fee_per_gas: grant
-                .shared
-                .max_gas_fee_per_gas
-                .map(|fee| fee.to_be_bytes_vec()),
-            max_priority_fee_per_gas: grant
-                .shared
-                .max_priority_fee_per_gas
-                .map(|fee| fee.to_be_bytes_vec()),
-            rate_limit: grant
-                .shared
-                .rate_limit
-                .map(|limit| proto::evm::TransactionRateLimit {
-                    count: limit.count,
-                    window_secs: limit.window.num_seconds(),
-                }),
-        }),
-    }
-}
-
-fn parse_volume_rate_limit(vrl: ProtoVolumeRateLimit) -> Result<VolumeRateLimit, Status> {
-    Ok(VolumeRateLimit {
-        max_volume: U256::from_be_slice(&vrl.max_volume),
-        window: chrono::Duration::seconds(vrl.window_secs),
-    })
-}
-
-fn parse_shared_settings(
-    client_id: i32,
-    proto: Option<ProtoSharedSettings>,
-) -> Result<SharedGrantSettings, Status> {
-    let s = proto.ok_or_else(|| Status::invalid_argument("missing shared settings"))?;
-    let parse_u256 = |b: Vec<u8>| -> Result<U256, Status> {
-        if b.is_empty() {
-            Err(Status::invalid_argument("U256 bytes must not be empty"))
-        } else {
-            Ok(U256::from_be_slice(&b))
-        }
-    };
-    let parse_ts = |ts: prost_types::Timestamp| -> Result<DateTime<Utc>, Status> {
-        Utc.timestamp_opt(ts.seconds, ts.nanos as u32)
-            .single()
-            .ok_or_else(|| Status::invalid_argument("invalid timestamp"))
-    };
-    Ok(SharedGrantSettings {
-        wallet_id: s.wallet_id,
-        client_id,
-        chain: s.chain_id,
-        valid_from: s.valid_from.map(parse_ts).transpose()?,
-        valid_until: s.valid_until.map(parse_ts).transpose()?,
-        max_gas_fee_per_gas: s.max_gas_fee_per_gas.map(parse_u256).transpose()?,
-        max_priority_fee_per_gas: s.max_priority_fee_per_gas.map(parse_u256).transpose()?,
-        rate_limit: s.rate_limit.map(|rl| TransactionRateLimit {
-            count: rl.count,
-            window: chrono::Duration::seconds(rl.window_secs),
-        }),
-    })
-}
-
-fn parse_specific_grant(proto: Option<proto::evm::SpecificGrant>) -> Result<SpecificGrant, Status> {
-    use proto::evm::specific_grant::Grant as ProtoGrant;
-    let g = proto
-        .and_then(|sg| sg.grant)
-        .ok_or_else(|| Status::invalid_argument("missing specific grant"))?;
-    match g {
-        ProtoGrant::EtherTransfer(s) => {
-            let limit = parse_volume_rate_limit(
-                s.limit
-                    .ok_or_else(|| Status::invalid_argument("missing ether transfer limit"))?,
-            )?;
-            let target = s
-                .targets
-                .into_iter()
-                .map(|b| {
-                    if b.len() == 20 {
-                        Ok(Address::from_slice(&b))
-                    } else {
-                        Err(Status::invalid_argument(
-                            "ether transfer target must be 20 bytes",
-                        ))
-                    }
-                })
-                .collect::<Result<Vec<_>, _>>()?;
-            Ok(SpecificGrant::EtherTransfer(ether_transfer::Settings {
-                target,
-                limit,
-            }))
-        }
-        ProtoGrant::TokenTransfer(s) => {
-            if s.token_contract.len() != 20 {
-                return Err(Status::invalid_argument("token_contract must be 20 bytes"));
-            }
-            let target = s
-                .target
-                .map(|b| {
-                    if b.len() == 20 {
-                        Ok(Address::from_slice(&b))
-                    } else {
-                        Err(Status::invalid_argument(
-                            "token transfer target must be 20 bytes",
-                        ))
-                    }
-                })
-                .transpose()?;
-            let volume_limits = s
-                .volume_limits
-                .into_iter()
-                .map(parse_volume_rate_limit)
-                .collect::<Result<Vec<_>, _>>()?;
-            Ok(SpecificGrant::TokenTransfer(token_transfers::Settings {
-                token_contract: Address::from_slice(&s.token_contract),
-                target,
-                volume_limits,
-            }))
-        }
-    }
-}
-
-fn parse_auth_pubkey(key_type: i32, pubkey: Vec<u8>) -> Result<AuthPublicKey, Status> {
-    match ProtoKeyType::try_from(key_type).unwrap_or(ProtoKeyType::Unspecified) {
-        ProtoKeyType::Unspecified | ProtoKeyType::Ed25519 => {
-            let bytes: [u8; 32] = pubkey
-                .as_slice()
-                .try_into()
-                .map_err(|_| Status::invalid_argument("invalid Ed25519 public key length"))?;
-            let key = ed25519_dalek::VerifyingKey::from_bytes(&bytes)
-                .map_err(|_| Status::invalid_argument("invalid Ed25519 public key encoding"))?;
-            Ok(AuthPublicKey::Ed25519(key))
-        }
-        ProtoKeyType::EcdsaSecp256k1 => {
-            let key = k256::ecdsa::VerifyingKey::from_sec1_bytes(&pubkey)
-                .map_err(|_| Status::invalid_argument("invalid secp256k1 public key encoding"))?;
-            Ok(AuthPublicKey::EcdsaSecp256k1(key))
-        }
-        ProtoKeyType::Rsa => {
-            use rsa::pkcs8::DecodePublicKey as _;
-
-            let key = rsa::RsaPublicKey::from_public_key_der(&pubkey)
-                .map_err(|_| Status::invalid_argument("invalid RSA public key encoding"))?;
-            Ok(AuthPublicKey::Rsa(key))
-        }
-    }
-}
-
-fn auth_error_status(value: &user_agent::auth::Error) -> Status {
-    use user_agent::auth::Error;
-
-    match value {
-        Error::UnexpectedMessagePayload | Error::InvalidClientPubkeyLength => {
-            Status::invalid_argument(value.to_string())
-        }
-        Error::InvalidAuthPubkeyEncoding => {
-            Status::invalid_argument("Failed to convert pubkey to VerifyingKey")
-        }
-        Error::PublicKeyNotRegistered | Error::InvalidChallengeSolution => {
-            Status::unauthenticated(value.to_string())
-        }
-        Error::InvalidBootstrapToken => Status::invalid_argument("Invalid bootstrap token"),
-        Error::Transport => Status::internal("Transport error"),
-        Error::BootstrapperActorUnreachable => {
-            Status::internal("Bootstrap token consumption failed")
-        }
-        Error::DatabasePoolUnavailable => Status::internal("Database pool error"),
-        Error::DatabaseOperationFailed => Status::internal("Database error"),
-    }
-}

server/crates/arbiter-server/src/lib.rs

@@ -1,20 +1,137 @@
 #![forbid(unsafe_code)]
-#![deny(
+use arbiter_proto::{
-    clippy::unwrap_used,
+    proto::{
-    clippy::expect_used,
+        client::{ClientRequest, ClientResponse},
-    clippy::panic
+        user_agent::{UserAgentRequest, UserAgentResponse},
-)]
+    },
+    transport::{IdentityRecvConverter, SendConverter, grpc},
+};
+use async_trait::async_trait;
+use tokio_stream::wrappers::ReceiverStream;
 
-use crate::context::ServerContext;
+use tokio::sync::mpsc;
+use tonic::{Request, Response, Status};
+use tracing::info;
+
+use crate::{
+    actors::{
+        client::{self, ClientConnection as ClientConnectionProps, ClientError, connect_client},
+        user_agent::{self, TransportResponseError, UserAgentConnection, connect_user_agent},
+    },
+    context::ServerContext,
+};
 
 pub mod actors;
 pub mod context;
 pub mod db;
 pub mod evm;
-pub mod grpc;
 
 const DEFAULT_CHANNEL_SIZE: usize = 1000;
 
+struct UserAgentGrpcSender;
+
+impl SendConverter for UserAgentGrpcSender {
+    type Input = Result<UserAgentResponse, TransportResponseError>;
+    type Output = Result<UserAgentResponse, Status>;
+
+    fn convert(&self, item: Self::Input) -> Self::Output {
+        match item {
+            Ok(message) => Ok(message),
+            Err(err) => Err(user_agent_error_status(err)),
+        }
+    }
+}
+
+struct ClientGrpcSender;
+
+impl SendConverter for ClientGrpcSender {
+    type Input = Result<ClientResponse, ClientError>;
+    type Output = Result<ClientResponse, Status>;
+
+    fn convert(&self, item: Self::Input) -> Self::Output {
+        match item {
+            Ok(message) => Ok(message),
+            Err(err) => Err(client_error_status(err)),
+        }
+    }
+}
+
+fn client_error_status(value: ClientError) -> Status {
+    match value {
+        ClientError::MissingRequestPayload | ClientError::UnexpectedRequestPayload => {
+            Status::invalid_argument("Expected message with payload")
+        }
+        ClientError::StateTransitionFailed => Status::internal("State machine error"),
+        ClientError::Auth(ref err) => client_auth_error_status(err),
+        ClientError::ConnectionRegistrationFailed => {
+            Status::internal("Connection registration failed")
+        }
+    }
+}
+
+fn client_auth_error_status(value: &client::auth::Error) -> Status {
+    use client::auth::Error;
+    match value {
+        Error::UnexpectedMessagePayload | Error::InvalidClientPubkeyLength => {
+            Status::invalid_argument(value.to_string())
+        }
+        Error::InvalidAuthPubkeyEncoding => {
+            Status::invalid_argument("Failed to convert pubkey to VerifyingKey")
+        }
+        Error::InvalidChallengeSolution => Status::unauthenticated(value.to_string()),
+        Error::NotRegistered => Status::permission_denied(value.to_string()),
+        Error::Transport => Status::internal("Transport error"),
+        Error::DatabasePoolUnavailable => Status::internal("Database pool error"),
+        Error::DatabaseOperationFailed => Status::internal("Database error"),
+        Error::InternalError => Status::internal("Internal error"),
+    }
+}
+
+fn user_agent_error_status(value: TransportResponseError) -> Status {
+    match value {
+        TransportResponseError::MissingRequestPayload
+        | TransportResponseError::UnexpectedRequestPayload => {
+            Status::invalid_argument("Expected message with payload")
+        }
+        TransportResponseError::InvalidStateForUnsealEncryptedKey => {
+            Status::failed_precondition("Invalid state for unseal encrypted key")
+        }
+        TransportResponseError::InvalidClientPubkeyLength => {
+            Status::invalid_argument("client_pubkey must be 32 bytes")
+        }
+        TransportResponseError::StateTransitionFailed => Status::internal("State machine error"),
+        TransportResponseError::KeyHolderActorUnreachable => {
+            Status::internal("Vault is not available")
+        }
+        TransportResponseError::Auth(ref err) => auth_error_status(err),
+        TransportResponseError::ConnectionRegistrationFailed => {
+            Status::internal("Failed registering connection")
+        }
+    }
+}
+
+fn auth_error_status(value: &user_agent::auth::Error) -> Status {
+    use user_agent::auth::Error;
+    match value {
+        Error::UnexpectedMessagePayload | Error::InvalidClientPubkeyLength => {
+            Status::invalid_argument(value.to_string())
+        }
+        Error::InvalidAuthPubkeyEncoding => {
+            Status::invalid_argument("Failed to convert pubkey to VerifyingKey")
+        }
+        Error::PublicKeyNotRegistered | Error::InvalidChallengeSolution => {
+            Status::unauthenticated(value.to_string())
+        }
+        Error::InvalidBootstrapToken => Status::invalid_argument("Invalid bootstrap token"),
+        Error::Transport => Status::internal("Transport error"),
+        Error::BootstrapperActorUnreachable => {
+            Status::internal("Bootstrap token consumption failed")
+        }
+        Error::DatabasePoolUnavailable => Status::internal("Database pool error"),
+        Error::DatabaseOperationFailed => Status::internal("Database error"),
+    }
+}
+
 pub struct Server {
     context: ServerContext,
 }
@@ -25,4 +142,60 @@ impl Server {
     }
 }
 
+#[async_trait]
+impl arbiter_proto::proto::arbiter_service_server::ArbiterService for Server {
+    type UserAgentStream = ReceiverStream<Result<UserAgentResponse, Status>>;
+    type ClientStream = ReceiverStream<Result<ClientResponse, Status>>;
 
+    #[tracing::instrument(level = "debug", skip(self))]
+    async fn client(
+        &self,
+        request: Request<tonic::Streaming<ClientRequest>>,
+    ) -> Result<Response<Self::ClientStream>, Status> {
+        let req_stream = request.into_inner();
+        let (tx, rx) = mpsc::channel(DEFAULT_CHANNEL_SIZE);
+
+        let transport = grpc::GrpcAdapter::new(
+            tx,
+            req_stream,
+            IdentityRecvConverter::<ClientRequest>::new(),
+            ClientGrpcSender,
+        );
+        let props = ClientConnectionProps::new(
+            self.context.db.clone(),
+            Box::new(transport),
+            self.context.actors.clone(),
+        );
+        tokio::spawn(connect_client(props));
+
+        info!(event = "connection established", "grpc.client");
+
+        Ok(Response::new(ReceiverStream::new(rx)))
+    }
+
+    #[tracing::instrument(level = "debug", skip(self))]
+    async fn user_agent(
+        &self,
+        request: Request<tonic::Streaming<UserAgentRequest>>,
+    ) -> Result<Response<Self::UserAgentStream>, Status> {
+        let req_stream = request.into_inner();
+        let (tx, rx) = mpsc::channel(DEFAULT_CHANNEL_SIZE);
+
+        let transport = grpc::GrpcAdapter::new(
+            tx,
+            req_stream,
+            IdentityRecvConverter::<UserAgentRequest>::new(),
+            UserAgentGrpcSender,
+        );
+        let props = UserAgentConnection::new(
+            self.context.db.clone(),
+            self.context.actors.clone(),
+            Box::new(transport),
+        );
+        tokio::spawn(connect_user_agent(props));
+
+        info!(event = "connection established", "grpc.user_agent");
+
+        Ok(Response::new(ReceiverStream::new(rx)))
+    }
+}

server/crates/arbiter-server/src/main.rs

@@ -3,7 +3,6 @@ use std::net::SocketAddr;
 use arbiter_proto::{proto::arbiter_service_server::ArbiterServiceServer, url::ArbiterUrl};
 use arbiter_server::{Server, actors::bootstrap::GetToken, context::ServerContext, db};
 use miette::miette;
-use rustls::crypto::aws_lc_rs;
 use tonic::transport::{Identity, ServerTlsConfig};
 use tracing::info;
 
@@ -11,8 +10,6 @@ const PORT: u16 = 50051;
 
 #[tokio::main]
 async fn main() -> miette::Result<()> {
-    aws_lc_rs::default_provider().install_default().unwrap();
-
     tracing_subscriber::fmt()
         .with_env_filter(
             tracing_subscriber::EnvFilter::try_from_default_env()

server/crates/arbiter-server/tests/client/auth.rs

@@ -1,7 +1,20 @@
+use alloy::{
+    consensus::TxEip1559,
+    primitives::{Address, Bytes, TxKind, U256},
+    rlp::Encodable,
+};
+use arbiter_proto::proto::{
+    client::{
+        AuthChallengeRequest, AuthChallengeSolution, ClientRequest,
+        client_request::Payload as ClientRequestPayload,
+        client_response::Payload as ClientResponsePayload,
+    },
+    evm::EvmSignTransactionRequest,
+};
 use arbiter_proto::transport::Bi;
 use arbiter_server::actors::GlobalActors;
 use arbiter_server::{
-    actors::client::{ClientConnection, Request, Response, connect_client},
+    actors::client::{ClientConnection, connect_client},
     db::{self, schema},
 };
 use diesel::{ExpressionMethods as _, insert_into};
@@ -24,8 +37,12 @@ pub async fn test_unregistered_pubkey_rejected() {
     let pubkey_bytes = new_key.verifying_key().to_bytes().to_vec();
 
     test_transport
-        .send(Request::AuthChallengeRequest {
+        .send(ClientRequest {
-            pubkey: pubkey_bytes,
+            payload: Some(ClientRequestPayload::AuthChallengeRequest(
+                AuthChallengeRequest {
+                    pubkey: pubkey_bytes,
+                },
+            )),
         })
         .await
         .unwrap();
@@ -59,8 +76,12 @@ pub async fn test_challenge_auth() {
 
     // Send challenge request
     test_transport
-        .send(Request::AuthChallengeRequest {
+        .send(ClientRequest {
-            pubkey: pubkey_bytes,
+            payload: Some(ClientRequestPayload::AuthChallengeRequest(
+                AuthChallengeRequest {
+                    pubkey: pubkey_bytes,
+                },
+            )),
         })
         .await
         .unwrap();
@@ -71,20 +92,24 @@ pub async fn test_challenge_auth() {
         .await
         .expect("should receive challenge");
     let challenge = match response {
-        Ok(resp) => match resp {
+        Ok(resp) => match resp.payload {
-            Response::AuthChallenge { pubkey, nonce } => (pubkey, nonce),
+            Some(ClientResponsePayload::AuthChallenge(c)) => c,
             other => panic!("Expected AuthChallenge, got {other:?}"),
         },
         Err(err) => panic!("Expected Ok response, got Err({err:?})"),
     };
 
     // Sign the challenge and send solution
-    let formatted_challenge = arbiter_proto::format_challenge(challenge.1, &challenge.0);
+    let formatted_challenge = arbiter_proto::format_challenge(challenge.nonce, &challenge.pubkey);
     let signature = new_key.sign(&formatted_challenge);
 
     test_transport
-        .send(Request::AuthChallengeSolution {
+        .send(ClientRequest {
-            signature: signature.to_bytes().to_vec(),
+            payload: Some(ClientRequestPayload::AuthChallengeSolution(
+                AuthChallengeSolution {
+                    signature: signature.to_bytes().to_vec(),
+                },
+            )),
         })
         .await
         .unwrap();
@@ -92,3 +117,106 @@ pub async fn test_challenge_auth() {
     // Auth completes, session spawned
     task.await.unwrap();
 }
+
+#[tokio::test]
+#[test_log::test]
+pub async fn test_evm_sign_request_payload_is_handled() {
+    let db = db::create_test_pool().await;
+
+    let new_key = ed25519_dalek::SigningKey::generate(&mut rand::rng());
+    let pubkey_bytes = new_key.verifying_key().to_bytes().to_vec();
+
+    {
+        let mut conn = db.get().await.unwrap();
+        insert_into(schema::program_client::table)
+            .values(schema::program_client::public_key.eq(pubkey_bytes.clone()))
+            .execute(&mut conn)
+            .await
+            .unwrap();
+    }
+
+    let (server_transport, mut test_transport) = ChannelTransport::new();
+    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+
+    let props = ClientConnection::new(db.clone(), Box::new(server_transport), actors);
+    let task = tokio::spawn(connect_client(props));
+
+    test_transport
+        .send(ClientRequest {
+            payload: Some(ClientRequestPayload::AuthChallengeRequest(
+                AuthChallengeRequest {
+                    pubkey: pubkey_bytes,
+                },
+            )),
+        })
+        .await
+        .unwrap();
+
+    let response = test_transport
+        .recv()
+        .await
+        .expect("should receive challenge");
+    let challenge = match response {
+        Ok(resp) => match resp.payload {
+            Some(ClientResponsePayload::AuthChallenge(c)) => c,
+            other => panic!("Expected AuthChallenge, got {other:?}"),
+        },
+        Err(err) => panic!("Expected Ok response, got Err({err:?})"),
+    };
+
+    let formatted_challenge = arbiter_proto::format_challenge(challenge.nonce, &challenge.pubkey);
+    let signature = new_key.sign(&formatted_challenge);
+
+    test_transport
+        .send(ClientRequest {
+            payload: Some(ClientRequestPayload::AuthChallengeSolution(
+                AuthChallengeSolution {
+                    signature: signature.to_bytes().to_vec(),
+                },
+            )),
+        })
+        .await
+        .unwrap();
+
+    task.await.unwrap();
+
+    let tx = TxEip1559 {
+        chain_id: 1,
+        nonce: 0,
+        gas_limit: 21_000,
+        max_fee_per_gas: 1,
+        max_priority_fee_per_gas: 1,
+        to: TxKind::Call(Address::from_slice(&[0x11; 20])),
+        value: U256::ZERO,
+        input: Bytes::new(),
+        access_list: Default::default(),
+    };
+
+    let mut rlp_transaction = Vec::new();
+    tx.encode(&mut rlp_transaction);
+
+    test_transport
+        .send(ClientRequest {
+            payload: Some(ClientRequestPayload::EvmSignTransaction(
+                EvmSignTransactionRequest {
+                    wallet_address: [0x22; 20].to_vec(),
+                    rlp_transaction,
+                },
+            )),
+        })
+        .await
+        .unwrap();
+
+    let response = test_transport
+        .recv()
+        .await
+        .expect("should receive sign response");
+
+    match response {
+        Ok(resp) => match resp.payload {
+            Some(ClientResponsePayload::EvmSignTransaction(_)) => {}
+            other => panic!("Expected EvmSignTransaction response, got {other:?}"),
+        },
+        Err(err) => panic!("Expected Ok response, got Err({err:?})"),
+    }
+}

server/crates/arbiter-server/tests/user_agent.rs

@@ -2,5 +2,7 @@ mod common;
 
 #[path = "user_agent/auth.rs"]
 mod auth;
+#[path = "user_agent/sdk_client.rs"]
+mod sdk_client;
 #[path = "user_agent/unseal.rs"]
 mod unseal;

server/crates/arbiter-server/tests/user_agent/auth.rs

@@ -1,9 +1,14 @@
+use arbiter_proto::proto::user_agent::{
+    AuthChallengeRequest, AuthChallengeSolution, KeyType as ProtoKeyType, UserAgentRequest,
+    user_agent_request::Payload as UserAgentRequestPayload,
+    user_agent_response::Payload as UserAgentResponsePayload,
+};
 use arbiter_proto::transport::Bi;
 use arbiter_server::{
     actors::{
         GlobalActors,
         bootstrap::GetToken,
-        user_agent::{AuthPublicKey, Request, Response, UserAgentConnection, connect_user_agent},
+        user_agent::{UserAgentConnection, connect_user_agent},
     },
     db::{self, schema},
 };
@@ -25,10 +30,17 @@ pub async fn test_bootstrap_token_auth() {
     let task = tokio::spawn(connect_user_agent(props));
 
     let new_key = ed25519_dalek::SigningKey::generate(&mut rand::rng());
+    let pubkey_bytes = new_key.verifying_key().to_bytes().to_vec();
+
     test_transport
-        .send(Request::AuthChallengeRequest {
+        .send(UserAgentRequest {
-            pubkey: AuthPublicKey::Ed25519(new_key.verifying_key()),
+            payload: Some(UserAgentRequestPayload::AuthChallengeRequest(
-            bootstrap_token: Some(token),
+                AuthChallengeRequest {
+                    pubkey: pubkey_bytes,
+                    bootstrap_token: Some(token),
+                    key_type: ProtoKeyType::Ed25519.into(),
+                },
+            )),
         })
         .await
         .unwrap();
@@ -55,10 +67,17 @@ pub async fn test_bootstrap_invalid_token_auth() {
     let task = tokio::spawn(connect_user_agent(props));
 
     let new_key = ed25519_dalek::SigningKey::generate(&mut rand::rng());
+    let pubkey_bytes = new_key.verifying_key().to_bytes().to_vec();
+
     test_transport
-        .send(Request::AuthChallengeRequest {
+        .send(UserAgentRequest {
-            pubkey: AuthPublicKey::Ed25519(new_key.verifying_key()),
+            payload: Some(UserAgentRequestPayload::AuthChallengeRequest(
-            bootstrap_token: Some("invalid_token".to_string()),
+                AuthChallengeRequest {
+                    pubkey: pubkey_bytes,
+                    bootstrap_token: Some("invalid_token".to_string()),
+                    key_type: ProtoKeyType::Ed25519.into(),
+                },
+            )),
         })
         .await
         .unwrap();
@@ -104,9 +123,14 @@ pub async fn test_challenge_auth() {
 
     // Send challenge request
     test_transport
-        .send(Request::AuthChallengeRequest {
+        .send(UserAgentRequest {
-            pubkey: AuthPublicKey::Ed25519(new_key.verifying_key()),
+            payload: Some(UserAgentRequestPayload::AuthChallengeRequest(
-            bootstrap_token: None,
+                AuthChallengeRequest {
+                    pubkey: pubkey_bytes,
+                    bootstrap_token: None,
+                    key_type: ProtoKeyType::Ed25519.into(),
+                },
+            )),
         })
         .await
         .unwrap();
@@ -117,19 +141,24 @@ pub async fn test_challenge_auth() {
         .await
         .expect("should receive challenge");
     let challenge = match response {
-        Ok(resp) => match resp {
+        Ok(resp) => match resp.payload {
-            Response::AuthChallenge { nonce } => nonce,
+            Some(UserAgentResponsePayload::AuthChallenge(c)) => c,
             other => panic!("Expected AuthChallenge, got {other:?}"),
         },
         Err(err) => panic!("Expected Ok response, got Err({err:?})"),
     };
 
-    let formatted_challenge = arbiter_proto::format_challenge(challenge, &pubkey_bytes);
+    // Sign the challenge and send solution
+    let formatted_challenge = arbiter_proto::format_challenge(challenge.nonce, &challenge.pubkey);
     let signature = new_key.sign(&formatted_challenge);
 
     test_transport
-        .send(Request::AuthChallengeSolution {
+        .send(UserAgentRequest {
-            signature: signature.to_bytes().to_vec(),
+            payload: Some(UserAgentRequestPayload::AuthChallengeSolution(
+                AuthChallengeSolution {
+                    signature: signature.to_bytes().to_vec(),
+                },
+            )),
         })
         .await
         .unwrap();

server/crates/arbiter-server/tests/user_agent/sdk_client.rs

@@ -0,0 +1,270 @@
+use arbiter_proto::proto::user_agent::{
+    SdkClientApproveRequest, SdkClientError as ProtoSdkClientError, SdkClientRevokeRequest,
+    UserAgentRequest, sdk_client_approve_response, sdk_client_list_response,
+    sdk_client_revoke_response, user_agent_request::Payload as UserAgentRequestPayload,
+    user_agent_response::Payload as UserAgentResponsePayload,
+};
+use arbiter_server::{
+    actors::{GlobalActors, user_agent::session::UserAgentSession},
+    db,
+};
+
+/// Shared helper: create a session and register a client pubkey via sdk_client_approve.
+async fn make_session(db: &db::DatabasePool) -> UserAgentSession {
+    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+    UserAgentSession::new_test(db.clone(), actors)
+}
+
+#[tokio::test]
+#[test_log::test]
+async fn test_sdk_client_approve_registers_client() {
+    let db = db::create_test_pool().await;
+    let mut session = make_session(&db).await;
+
+    let pubkey = [0x42u8; 32];
+
+    let response = session
+        .process_transport_inbound(UserAgentRequest {
+            payload: Some(UserAgentRequestPayload::SdkClientApprove(
+                SdkClientApproveRequest {
+                    pubkey: pubkey.to_vec(),
+                },
+            )),
+        })
+        .await
+        .expect("handler should succeed");
+
+    let entry = match response.payload.unwrap() {
+        UserAgentResponsePayload::SdkClientApprove(resp) => match resp.result.unwrap() {
+            sdk_client_approve_response::Result::Client(e) => e,
+            sdk_client_approve_response::Result::Error(e) => {
+                panic!("Expected Client, got error {:?}", e)
+            }
+        },
+        other => panic!("Expected SdkClientApprove, got {other:?}"),
+    };
+
+    assert_eq!(entry.pubkey, pubkey.to_vec());
+    assert!(entry.id > 0);
+}
+
+#[tokio::test]
+#[test_log::test]
+async fn test_sdk_client_approve_duplicate_returns_already_exists() {
+    let db = db::create_test_pool().await;
+    let mut session = make_session(&db).await;
+
+    let pubkey = [0x11u8; 32];
+    let req = UserAgentRequest {
+        payload: Some(UserAgentRequestPayload::SdkClientApprove(
+            SdkClientApproveRequest {
+                pubkey: pubkey.to_vec(),
+            },
+        )),
+    };
+
+    session
+        .process_transport_inbound(req.clone())
+        .await
+        .unwrap();
+
+    let response = session
+        .process_transport_inbound(req)
+        .await
+        .expect("second insert should not panic");
+
+    match response.payload.unwrap() {
+        UserAgentResponsePayload::SdkClientApprove(resp) => match resp.result.unwrap() {
+            sdk_client_approve_response::Result::Error(code) => {
+                assert_eq!(code, ProtoSdkClientError::AlreadyExists as i32);
+            }
+            sdk_client_approve_response::Result::Client(_) => {
+                panic!("Expected AlreadyExists error for duplicate pubkey")
+            }
+        },
+        other => panic!("Expected SdkClientApprove, got {other:?}"),
+    }
+}
+
+#[tokio::test]
+#[test_log::test]
+async fn test_sdk_client_list_shows_registered_clients() {
+    let db = db::create_test_pool().await;
+    let mut session = make_session(&db).await;
+
+    let pubkey_a = [0x0Au8; 32];
+    let pubkey_b = [0x0Bu8; 32];
+
+    for pubkey in [pubkey_a, pubkey_b] {
+        session
+            .process_transport_inbound(UserAgentRequest {
+                payload: Some(UserAgentRequestPayload::SdkClientApprove(
+                    SdkClientApproveRequest {
+                        pubkey: pubkey.to_vec(),
+                    },
+                )),
+            })
+            .await
+            .unwrap();
+    }
+
+    let response = session
+        .process_transport_inbound(UserAgentRequest {
+            payload: Some(UserAgentRequestPayload::SdkClientList(())),
+        })
+        .await
+        .expect("list should succeed");
+
+    let clients = match response.payload.unwrap() {
+        UserAgentResponsePayload::SdkClientList(resp) => match resp.result.unwrap() {
+            sdk_client_list_response::Result::Clients(list) => list.clients,
+            sdk_client_list_response::Result::Error(e) => {
+                panic!("Expected Clients, got error {:?}", e)
+            }
+        },
+        other => panic!("Expected SdkClientList, got {other:?}"),
+    };
+
+    assert_eq!(clients.len(), 2);
+    let pubkeys: Vec<Vec<u8>> = clients.into_iter().map(|e| e.pubkey).collect();
+    assert!(pubkeys.contains(&pubkey_a.to_vec()));
+    assert!(pubkeys.contains(&pubkey_b.to_vec()));
+}
+
+#[tokio::test]
+#[test_log::test]
+async fn test_sdk_client_revoke_removes_client() {
+    let db = db::create_test_pool().await;
+    let mut session = make_session(&db).await;
+
+    let pubkey = [0xBBu8; 32];
+
+    // Register a client and get its id
+    let approve_response = session
+        .process_transport_inbound(UserAgentRequest {
+            payload: Some(UserAgentRequestPayload::SdkClientApprove(
+                SdkClientApproveRequest {
+                    pubkey: pubkey.to_vec(),
+                },
+            )),
+        })
+        .await
+        .unwrap();
+
+    let client_id = match approve_response.payload.unwrap() {
+        UserAgentResponsePayload::SdkClientApprove(resp) => match resp.result.unwrap() {
+            sdk_client_approve_response::Result::Client(e) => e.id,
+            sdk_client_approve_response::Result::Error(e) => panic!("approve failed: {:?}", e),
+        },
+        other => panic!("{other:?}"),
+    };
+
+    // Revoke the client
+    let revoke_response = session
+        .process_transport_inbound(UserAgentRequest {
+            payload: Some(UserAgentRequestPayload::SdkClientRevoke(
+                SdkClientRevokeRequest { client_id },
+            )),
+        })
+        .await
+        .expect("revoke should succeed");
+
+    match revoke_response.payload.unwrap() {
+        UserAgentResponsePayload::SdkClientRevoke(resp) => match resp.result.unwrap() {
+            sdk_client_revoke_response::Result::Ok(_) => {}
+            sdk_client_revoke_response::Result::Error(e) => {
+                panic!("Expected Ok, got error {:?}", e)
+            }
+        },
+        other => panic!("Expected SdkClientRevoke, got {other:?}"),
+    }
+
+    // List should now be empty
+    let list_response = session
+        .process_transport_inbound(UserAgentRequest {
+            payload: Some(UserAgentRequestPayload::SdkClientList(())),
+        })
+        .await
+        .unwrap();
+
+    let clients = match list_response.payload.unwrap() {
+        UserAgentResponsePayload::SdkClientList(resp) => match resp.result.unwrap() {
+            sdk_client_list_response::Result::Clients(list) => list.clients,
+            sdk_client_list_response::Result::Error(e) => panic!("list error: {:?}", e),
+        },
+        other => panic!("{other:?}"),
+    };
+    assert!(clients.is_empty(), "client should be removed after revoke");
+}
+
+#[tokio::test]
+#[test_log::test]
+async fn test_sdk_client_revoke_not_found_returns_error() {
+    let db = db::create_test_pool().await;
+    let mut session = make_session(&db).await;
+
+    let response = session
+        .process_transport_inbound(UserAgentRequest {
+            payload: Some(UserAgentRequestPayload::SdkClientRevoke(
+                SdkClientRevokeRequest { client_id: 9999 },
+            )),
+        })
+        .await
+        .unwrap();
+
+    match response.payload.unwrap() {
+        UserAgentResponsePayload::SdkClientRevoke(resp) => match resp.result.unwrap() {
+            sdk_client_revoke_response::Result::Error(code) => {
+                assert_eq!(code, ProtoSdkClientError::NotFound as i32);
+            }
+            sdk_client_revoke_response::Result::Ok(_) => {
+                panic!("Expected NotFound error for missing client_id")
+            }
+        },
+        other => panic!("Expected SdkClientRevoke, got {other:?}"),
+    }
+}
+
+#[tokio::test]
+#[test_log::test]
+async fn test_sdk_client_approve_rejected_client_cannot_auth() {
+    // Verify the core flow: only pre-approved clients can authenticate
+    use arbiter_proto::proto::client::{
+        AuthChallengeRequest, ClientRequest, client_request::Payload as ClientRequestPayload,
+        client_response::Payload as ClientResponsePayload,
+    };
+    use arbiter_proto::transport::Bi as _;
+    use arbiter_server::actors::client::{ClientConnection, connect_client};
+
+    let db = db::create_test_pool().await;
+    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+
+    let new_key = ed25519_dalek::SigningKey::generate(&mut rand::rng());
+    let pubkey_bytes = new_key.verifying_key().to_bytes().to_vec();
+
+    let (server_transport, mut test_transport) = super::common::ChannelTransport::<_, _>::new();
+    let props = ClientConnection::new(db.clone(), Box::new(server_transport), actors.clone());
+    let task = tokio::spawn(connect_client(props));
+
+    test_transport
+        .send(ClientRequest {
+            payload: Some(ClientRequestPayload::AuthChallengeRequest(
+                AuthChallengeRequest {
+                    pubkey: pubkey_bytes.clone(),
+                },
+            )),
+        })
+        .await
+        .unwrap();
+
+    let response = test_transport.recv().await.unwrap().unwrap();
+    assert!(
+        matches!(
+            response.payload.unwrap(),
+            ClientResponsePayload::ClientConnectError(_)
+        ),
+        "unregistered client should be rejected"
+    );
+
+    task.await.unwrap();
+}

server/crates/arbiter-server/tests/user_agent/unseal.rs

@@ -1,8 +1,13 @@
+use arbiter_proto::proto::user_agent::{
+    UnsealEncryptedKey, UnsealResult, UnsealStart, UserAgentRequest,
+    user_agent_request::Payload as UserAgentRequestPayload,
+    user_agent_response::Payload as UserAgentResponsePayload,
+};
 use arbiter_server::{
     actors::{
         GlobalActors,
         keyholder::{Bootstrap, Seal},
-        user_agent::{Request, Response, UnsealError, session::UserAgentSession},
+        user_agent::session::UserAgentSession,
     },
     db,
 };
@@ -10,7 +15,9 @@ use chacha20poly1305::{AeadInPlace, XChaCha20Poly1305, XNonce, aead::KeyInit};
 use memsafe::MemSafe;
 use x25519_dalek::{EphemeralSecret, PublicKey};
 
-async fn setup_sealed_user_agent(seal_key: &[u8]) -> (db::DatabasePool, UserAgentSession) {
+async fn setup_sealed_user_agent(
+    seal_key: &[u8],
+) -> (db::DatabasePool, UserAgentSession) {
     let db = db::create_test_pool().await;
     let actors = GlobalActors::spawn(db.clone()).await.unwrap();
 
@@ -28,23 +35,29 @@ async fn setup_sealed_user_agent(seal_key: &[u8]) -> (db::DatabasePool, UserAgen
     (db, session)
 }
 
-async fn client_dh_encrypt(user_agent: &mut UserAgentSession, key_to_send: &[u8]) -> Request {
+async fn client_dh_encrypt(
+    user_agent: &mut UserAgentSession,
+    key_to_send: &[u8],
+) -> UnsealEncryptedKey {
     let client_secret = EphemeralSecret::random();
     let client_public = PublicKey::from(&client_secret);
 
     let response = user_agent
-        .process_transport_inbound(Request::UnsealStart {
+        .process_transport_inbound(UserAgentRequest {
-            client_pubkey: client_public,
+            payload: Some(UserAgentRequestPayload::UnsealStart(UnsealStart {
+                client_pubkey: client_public.as_bytes().to_vec(),
+            })),
         })
         .await
         .unwrap();
 
-    let server_pubkey = match response {
+    let server_pubkey = match response.payload.unwrap() {
-        Response::UnsealStartResponse { server_pubkey } => server_pubkey,
+        UserAgentResponsePayload::UnsealStartResponse(resp) => resp.server_pubkey,
         other => panic!("Expected UnsealStartResponse, got {other:?}"),
     };
+    let server_public = PublicKey::from(<[u8; 32]>::try_from(server_pubkey.as_slice()).unwrap());
 
-    let shared_secret = client_secret.diffie_hellman(&server_pubkey);
+    let shared_secret = client_secret.diffie_hellman(&server_public);
     let cipher = XChaCha20Poly1305::new(shared_secret.as_bytes().into());
     let nonce = XNonce::from([0u8; 24]);
     let associated_data = b"unseal";
@@ -53,13 +66,19 @@ async fn client_dh_encrypt(user_agent: &mut UserAgentSession, key_to_send: &[u8]
         .encrypt_in_place(&nonce, associated_data, &mut ciphertext)
         .unwrap();
 
-    Request::UnsealEncryptedKey {
+    UnsealEncryptedKey {
         nonce: nonce.to_vec(),
         ciphertext,
         associated_data: associated_data.to_vec(),
     }
 }
 
+fn unseal_key_request(req: UnsealEncryptedKey) -> UserAgentRequest {
+    UserAgentRequest {
+        payload: Some(UserAgentRequestPayload::UnsealEncryptedKey(req)),
+    }
+}
+
 #[tokio::test]
 #[test_log::test]
 pub async fn test_unseal_success() {
@@ -69,11 +88,14 @@ pub async fn test_unseal_success() {
     let encrypted_key = client_dh_encrypt(&mut user_agent, seal_key).await;
 
     let response = user_agent
-        .process_transport_inbound(encrypted_key)
+        .process_transport_inbound(unseal_key_request(encrypted_key))
         .await
         .unwrap();
 
-    assert!(matches!(response, Response::UnsealResult(Ok(()))));
+    assert_eq!(
+        response.payload.unwrap(),
+        UserAgentResponsePayload::UnsealResult(UnsealResult::Success.into()),
+    );
 }
 
 #[tokio::test]
@@ -84,14 +106,14 @@ pub async fn test_unseal_wrong_seal_key() {
     let encrypted_key = client_dh_encrypt(&mut user_agent, b"wrong-key").await;
 
     let response = user_agent
-        .process_transport_inbound(encrypted_key)
+        .process_transport_inbound(unseal_key_request(encrypted_key))
         .await
         .unwrap();
 
-    assert!(matches!(
+    assert_eq!(
-        response,
+        response.payload.unwrap(),
-        Response::UnsealResult(Err(UnsealError::InvalidKey))
+        UserAgentResponsePayload::UnsealResult(UnsealResult::InvalidKey.into()),
-    ));
+    );
 }
 
 #[tokio::test]
@@ -103,25 +125,27 @@ pub async fn test_unseal_corrupted_ciphertext() {
     let client_public = PublicKey::from(&client_secret);
 
     user_agent
-        .process_transport_inbound(Request::UnsealStart {
+        .process_transport_inbound(UserAgentRequest {
-            client_pubkey: client_public,
+            payload: Some(UserAgentRequestPayload::UnsealStart(UnsealStart {
+                client_pubkey: client_public.as_bytes().to_vec(),
+            })),
         })
         .await
         .unwrap();
 
     let response = user_agent
-        .process_transport_inbound(Request::UnsealEncryptedKey {
+        .process_transport_inbound(unseal_key_request(UnsealEncryptedKey {
             nonce: vec![0u8; 24],
             ciphertext: vec![0u8; 32],
             associated_data: vec![],
-        })
+        }))
         .await
         .unwrap();
 
-    assert!(matches!(
+    assert_eq!(
-        response,
+        response.payload.unwrap(),
-        Response::UnsealResult(Err(UnsealError::InvalidKey))
+        UserAgentResponsePayload::UnsealResult(UnsealResult::InvalidKey.into()),
-    ));
+    );
 }
 
 #[tokio::test]
@@ -134,24 +158,27 @@ pub async fn test_unseal_retry_after_invalid_key() {
         let encrypted_key = client_dh_encrypt(&mut user_agent, b"wrong-key").await;
 
         let response = user_agent
-            .process_transport_inbound(encrypted_key)
+            .process_transport_inbound(unseal_key_request(encrypted_key))
             .await
             .unwrap();
 
-        assert!(matches!(
+        assert_eq!(
-            response,
+            response.payload.unwrap(),
-            Response::UnsealResult(Err(UnsealError::InvalidKey))
+            UserAgentResponsePayload::UnsealResult(UnsealResult::InvalidKey.into()),
-        ));
+        );
     }
 
     {
         let encrypted_key = client_dh_encrypt(&mut user_agent, seal_key).await;
 
         let response = user_agent
-            .process_transport_inbound(encrypted_key)
+            .process_transport_inbound(unseal_key_request(encrypted_key))
             .await
             .unwrap();
 
-        assert!(matches!(response, Response::UnsealResult(Ok(()))));
+        assert_eq!(
+            response.payload.unwrap(),
+            UserAgentResponsePayload::UnsealResult(UnsealResult::Success.into()),
+        );
     }
 }

server/crates/arbiter-terrors-poc/Cargo.toml

@@ -0,0 +1,7 @@
+[package]
+name = "arbiter-terrors-poc"
+version = "0.1.0"
+edition = "2024"
+
+[dependencies]
+terrors = "0.3"

server/crates/arbiter-terrors-poc/src/auth.rs

@@ -0,0 +1,139 @@
+use crate::errors::{InternalError1, InternalError2, InvalidSignature, NotRegistered};
+use terrors::OneOf;
+
+use crate::errors::ProtoError;
+
+// Each sub-call's error type already implements DrainInto<ProtoError>, so we convert
+// directly to ProtoError without broaden — no turbofish needed anywhere.
+//
+// Call chain:
+//   load_config()  → OneOf<(InternalError2,)>          → ProtoError::from
+//   get_nonce()    → OneOf<(InternalError1, InternalError2)> → ProtoError::from
+//   verify_sig()   → OneOf<(InvalidSignature,)>         → ProtoError::from
+pub fn process_request(id: u32, sig: &str) -> Result<String, ProtoError> {
+    if id == 0 {
+        return Err(ProtoError::NotRegistered);
+    }
+
+    let config = load_config(id).map_err(ProtoError::from)?;
+    let nonce = crate::db::get_nonce(id).map_err(ProtoError::from)?;
+    verify_signature(nonce, sig).map_err(ProtoError::from)?;
+
+    Ok(format!("config={config} nonce={nonce} sig={sig}"))
+}
+
+// Simulates loading a config value.
+// id=97 triggers InternalError2 ("config read failed").
+fn load_config(id: u32) -> Result<String, OneOf<(InternalError2,)>> {
+    if id == 97 {
+        return Err(OneOf::new(InternalError2("config read failed".to_owned())));
+    }
+    Ok(format!("cfg-{id}"))
+}
+
+pub fn verify_signature(_nonce: u32, sig: &str) -> Result<(), OneOf<(InvalidSignature,)>> {
+    if sig != "ok" {
+        return Err(OneOf::new(InvalidSignature));
+    }
+    Ok(())
+}
+
+type AuthError = OneOf<(
+    NotRegistered,
+    InvalidSignature,
+    InternalError1,
+    InternalError2,
+)>;
+
+pub fn authenticate(id: u32, sig: &str) -> Result<u32, AuthError> {
+    if id == 0 {
+        return Err(OneOf::new(NotRegistered));
+    }
+
+    // Return type AuthError lets the compiler infer the broaden target.
+    let nonce = crate::db::get_nonce(id).map_err(OneOf::broaden)?;
+    verify_signature(nonce, sig).map_err(OneOf::broaden)?;
+
+    Ok(nonce)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn verify_signature_ok() {
+        assert!(verify_signature(42, "ok").is_ok());
+    }
+
+    #[test]
+    fn verify_signature_bad() {
+        let err = verify_signature(42, "bad").unwrap_err();
+        assert!(err.narrow::<crate::errors::InvalidSignature, _>().is_ok());
+    }
+
+    #[test]
+    fn authenticate_success() {
+        assert_eq!(authenticate(1, "ok").unwrap(), 42);
+    }
+
+    #[test]
+    fn authenticate_not_registered() {
+        let err = authenticate(0, "ok").unwrap_err();
+        assert!(err.narrow::<crate::errors::NotRegistered, _>().is_ok());
+    }
+
+    #[test]
+    fn authenticate_invalid_signature() {
+        let err = authenticate(1, "bad").unwrap_err();
+        assert!(err.narrow::<crate::errors::InvalidSignature, _>().is_ok());
+    }
+
+    #[test]
+    fn authenticate_internal_error1() {
+        let err = authenticate(99, "ok").unwrap_err();
+        assert!(err.narrow::<crate::errors::InternalError1, _>().is_ok());
+    }
+
+    #[test]
+    fn authenticate_internal_error2() {
+        let err = authenticate(98, "ok").unwrap_err();
+        assert!(err.narrow::<crate::errors::InternalError2, _>().is_ok());
+    }
+
+    #[test]
+    fn process_request_success() {
+        let result = process_request(1, "ok").unwrap();
+        assert!(result.contains("nonce=42"));
+    }
+
+    #[test]
+    fn process_request_not_registered() {
+        let err = process_request(0, "ok").unwrap_err();
+        assert!(matches!(err, crate::errors::ProtoError::NotRegistered));
+    }
+
+    #[test]
+    fn process_request_invalid_signature() {
+        let err = process_request(1, "bad").unwrap_err();
+        assert!(matches!(err, crate::errors::ProtoError::InvalidSignature));
+    }
+
+    #[test]
+    fn process_request_internal_from_config() {
+        // id=97 → load_config returns InternalError2
+        let err = process_request(97, "ok").unwrap_err();
+        assert!(
+            matches!(err, crate::errors::ProtoError::Internal(ref msg) if msg == "config read failed")
+        );
+    }
+
+    #[test]
+    fn process_request_internal_from_db() {
+        // id=99 → get_nonce returns InternalError1
+        let err = process_request(99, "ok").unwrap_err();
+        assert!(
+            matches!(err, crate::errors::ProtoError::Internal(ref msg) if msg == "db pool unavailable")
+        );
+    }
+}

server/crates/arbiter-terrors-poc/src/db.rs

@@ -0,0 +1,38 @@
+use crate::errors::{InternalError1, InternalError2};
+use terrors::OneOf;
+
+// Simulates fetching a nonce from a database.
+// id=99 → InternalError1 (pool unavailable)
+// id=98 → InternalError2 (query timeout)
+pub fn get_nonce(id: u32) -> Result<u32, OneOf<(InternalError1, InternalError2)>> {
+    match id {
+        99 => Err(OneOf::new(InternalError1("db pool unavailable".to_owned()))),
+        98 => Err(OneOf::new(InternalError2("query timeout".to_owned()))),
+        _ => Ok(42),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn get_nonce_returns_nonce_for_valid_id() {
+        assert_eq!(get_nonce(1).unwrap(), 42);
+    }
+
+    #[test]
+    fn get_nonce_returns_internal_error1_for_sentinel() {
+        let err = get_nonce(99).unwrap_err();
+        let internal = err.narrow::<crate::errors::InternalError1, _>().unwrap();
+        assert_eq!(internal.0, "db pool unavailable");
+    }
+
+    #[test]
+    fn get_nonce_returns_internal_error2_for_sentinel() {
+        let err = get_nonce(98).unwrap_err();
+        let e = err.narrow::<crate::errors::InternalError1, _>().unwrap_err();
+        let internal = e.take::<crate::errors::InternalError2>();
+        assert_eq!(internal.0, "query timeout");
+    }
+}

server/crates/arbiter-terrors-poc/src/errors.rs

@@ -0,0 +1,130 @@
+use terrors::OneOf;
+
+// Wire boundary type — what would go into a proto response
+#[derive(Debug)]
+pub enum ProtoError {
+    NotRegistered,
+    InvalidSignature,
+    Internal(String), // Or Box<dyn Error>, who cares?
+}
+
+// Internal terrors types
+#[derive(Debug)]
+pub struct NotRegistered;
+#[derive(Debug)]
+pub struct InvalidSignature;
+#[derive(Debug)]
+pub struct InternalError1(pub String);
+#[derive(Debug)]
+pub struct InternalError2(pub String);
+
+// Errors can be scattered across the codebase as long as they implement Into<ProtoError>
+impl From<NotRegistered> for ProtoError {
+    fn from(_: NotRegistered) -> Self {
+        ProtoError::NotRegistered
+    }
+}
+
+impl From<InvalidSignature> for ProtoError {
+    fn from(_: InvalidSignature) -> Self {
+        ProtoError::InvalidSignature
+    }
+}
+
+impl From<InternalError1> for ProtoError {
+    fn from(e: InternalError1) -> Self {
+        ProtoError::Internal(e.0)
+    }
+}
+impl From<InternalError2> for ProtoError {
+    fn from(e: InternalError2) -> Self {
+        ProtoError::Internal(e.0)
+    }
+}
+
+/// Private helper trait for converting from OneOf<T...> where each T can be converted
+/// into the target type `O` by recursively narrowing until a match is found.
+/// 
+/// IDK why this isn't already in terrors.
+trait DrainInto<O>: terrors::TypeSet + Sized {
+    fn drain(e: OneOf<Self>) -> O;
+}
+
+macro_rules! impl_drain_into {
+    ($head:ident) => {
+        impl<$head, O> DrainInto<O> for ($head,)
+        where
+            $head: Into<O> + 'static,
+        {
+            fn drain(e: OneOf<($head,)>) -> O {
+                e.take().into()
+            }
+        }
+    };
+    ($head:ident, $($tail:ident),+) => {
+        impl<$head, $($tail),+, O> DrainInto<O> for ($head, $($tail),+)
+        where
+            $head: Into<O> + 'static,
+            ($($tail,)+): DrainInto<O>,
+        {
+            fn drain(e: OneOf<($head, $($tail),+)>) -> O {
+                match e.narrow::<$head, _>() {
+                    Ok(h) => h.into(),
+                    Err(rest) => <($($tail,)+)>::drain(rest),
+                }
+            }
+        }
+        impl_drain_into!($($tail),+);
+    };
+}
+
+// Generates impls for all tuple sizes from 1 up to 7 (restricted by terrors internal impl).
+// Each invocation produces one impl then recurses on the tail.
+impl_drain_into!(A, B, C, D, E, F, G, H, I);
+
+// Blanket From impl: body delegates to the recursive drain.
+impl<E: DrainInto<ProtoError>> From<OneOf<E>> for ProtoError {
+    fn from(e: OneOf<E>) -> Self {
+        E::drain(e)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn not_registered_converts_to_proto() {
+        let e: ProtoError = NotRegistered.into();
+        assert!(matches!(e, ProtoError::NotRegistered));
+    }
+
+    #[test]
+    fn invalid_signature_converts_to_proto() {
+        let e: ProtoError = InvalidSignature.into();
+        assert!(matches!(e, ProtoError::InvalidSignature));
+    }
+
+    #[test]
+    fn internal_converts_to_proto() {
+        let e: ProtoError = InternalError1("boom".into()).into();
+        assert!(matches!(e, ProtoError::Internal(msg) if msg == "boom"));
+    }
+
+    #[test]
+    fn one_of_remainder_converts_to_proto_invalid_signature() {
+        use terrors::OneOf;
+        let e: OneOf<(InvalidSignature, InternalError1)> = OneOf::new(InvalidSignature);
+        let proto = ProtoError::from(e);
+        assert!(matches!(proto, ProtoError::InvalidSignature));
+    }
+
+    #[test]
+    fn one_of_remainder_converts_to_proto_internal() {
+        use terrors::OneOf;
+        let e: OneOf<(InvalidSignature, InternalError1)> =
+            OneOf::new(InternalError1("db fail".into()));
+        let proto = ProtoError::from(e);
+        assert!(matches!(proto, ProtoError::Internal(msg) if msg == "db fail"));
+    }
+}

server/crates/arbiter-terrors-poc/src/main.rs

@@ -0,0 +1,43 @@
+mod auth;
+mod db;
+mod errors;
+
+use errors::ProtoError;
+
+fn run(id: u32, sig: &str) {
+    print!("authenticate(id={id}, sig={sig:?}) => ");
+    match auth::authenticate(id, sig) {
+        Ok(nonce) => println!("Ok(nonce={nonce})"),
+        Err(e) => match e.narrow::<errors::NotRegistered, _>() {
+            Ok(_) => println!("Err(NotRegistered) — handled locally"),
+            Err(remaining) => {
+                let proto = ProtoError::from(remaining);
+                println!("Err(ProtoError::{proto:?}) — forwarded to wire");
+            }
+        },
+    }
+}
+
+fn run_process(id: u32, sig: &str) {
+    print!("process_request(id={id}, sig={sig:?}) => ");
+    match auth::process_request(id, sig) {
+        Ok(s) => println!("Ok({s})"),
+        Err(e) => println!("Err(ProtoError::{e:?})"),
+    }
+}
+
+fn main() {
+    println!("=== authenticate ===");
+    run(0, "ok");   // NotRegistered
+    run(1, "bad");  // InvalidSignature
+    run(99, "ok");  // InternalError1
+    run(98, "ok");  // InternalError2
+    run(1, "ok");   // success
+
+    println!("\n=== process_request (Try chain) ===");
+    run_process(0, "ok");   // NotRegistered (guard, no I/O)
+    run_process(97, "ok");  // InternalError2 from load_config
+    run_process(99, "ok");  // InternalError1 from get_nonce
+    run_process(1, "bad");  // InvalidSignature from verify_signature
+    run_process(1, "ok");   // success
+}

server/crates/arbiter-useragent/Cargo.toml

@@ -0,0 +1,29 @@
+[package]
+name = "arbiter-useragent"
+version = "0.1.0"
+edition = "2024"
+license = "Apache-2.0"
+
+[lints]
+workspace = true
+
+[dependencies]
+arbiter-proto.path = "../arbiter-proto"
+kameo.workspace = true
+tokio = {workspace = true, features = ["net"]}
+tonic.workspace = true
+tonic.features = ["tls-aws-lc"]
+tracing.workspace = true
+ed25519-dalek.workspace = true
+smlang.workspace = true
+x25519-dalek.workspace = true
+k256.workspace = true
+rsa.workspace = true
+sha2.workspace = true
+spki.workspace = true
+rand.workspace = true
+thiserror.workspace = true
+tokio-stream.workspace = true
+http = "1.4.0"
+rustls-webpki = { version = "0.103.9", features = ["aws-lc-rs"] }
+async-trait.workspace = true

server/crates/arbiter-useragent/src/grpc.rs

@@ -0,0 +1,70 @@
+use arbiter_proto::{
+    proto::{
+        arbiter_service_client::ArbiterServiceClient,
+        user_agent::{UserAgentRequest, UserAgentResponse},
+    },
+    transport::{IdentityRecvConverter, IdentitySendConverter, grpc},
+    url::ArbiterUrl,
+};
+use kameo::actor::{ActorRef, Spawn};
+
+use tokio::sync::mpsc;
+use tokio_stream::wrappers::ReceiverStream;
+
+use tonic::transport::ClientTlsConfig;
+
+use super::{SigningKeyEnum, UserAgentActor};
+
+#[derive(Debug, thiserror::Error)]
+pub enum ConnectError {
+    #[error("Could establish connection")]
+    Connection(#[from] tonic::transport::Error),
+
+    #[error("Invalid server URI")]
+    InvalidUri(#[from] http::uri::InvalidUri),
+
+    #[error("Invalid CA certificate")]
+    InvalidCaCert(#[from] webpki::Error),
+
+    #[error("gRPC error")]
+    Grpc(#[from] tonic::Status),
+}
+
+pub type UserAgentGrpc = ActorRef<
+    UserAgentActor<
+        grpc::GrpcAdapter<
+            IdentityRecvConverter<UserAgentResponse>,
+            IdentitySendConverter<UserAgentRequest>,
+        >,
+    >,
+>;
+pub async fn connect_grpc(
+    url: ArbiterUrl,
+    key: SigningKeyEnum,
+) -> Result<UserAgentGrpc, ConnectError> {
+    let bootstrap_token = url.bootstrap_token.clone();
+    let anchor = webpki::anchor_from_trusted_cert(&url.ca_cert)?.to_owned();
+    let tls = ClientTlsConfig::new().trust_anchor(anchor);
+
+    // TODO: if `host` is localhost, we need to verify server's process authenticity
+    let channel = tonic::transport::Channel::from_shared(format!("{}:{}", url.host, url.port))?
+        .tls_config(tls)?
+        .connect()
+        .await?;
+
+    let mut client = ArbiterServiceClient::new(channel);
+    let (tx, rx) = mpsc::channel(16);
+    let bistream = client.user_agent(ReceiverStream::new(rx)).await?;
+    let bistream = bistream.into_inner();
+
+    let adapter = grpc::GrpcAdapter::new(
+        tx,
+        bistream,
+        IdentityRecvConverter::new(),
+        IdentitySendConverter::new(),
+    );
+
+    let actor = UserAgentActor::spawn(UserAgentActor::new(key, bootstrap_token, adapter));
+
+    Ok(actor)
+}

server/crates/arbiter-useragent/src/lib.rs

@@ -0,0 +1,257 @@
+use arbiter_proto::{
+    format_challenge,
+    proto::user_agent::{
+        AuthChallengeRequest, AuthChallengeSolution, AuthOk, KeyType as ProtoKeyType,
+        UserAgentRequest, UserAgentResponse,
+        user_agent_request::Payload as UserAgentRequestPayload,
+        user_agent_response::Payload as UserAgentResponsePayload,
+    },
+    transport::Bi,
+};
+use kameo::{Actor, actor::ActorRef};
+use smlang::statemachine;
+use tokio::select;
+use tracing::{error, info};
+
+/// Signing key variants supported by the user-agent auth protocol.
+pub enum SigningKeyEnum {
+    Ed25519(ed25519_dalek::SigningKey),
+    /// secp256k1 ECDSA; public key is sent as SEC1 compressed 33 bytes; signature is raw 64-byte (r||s).
+    EcdsaSecp256k1(k256::ecdsa::SigningKey),
+    /// RSA for Windows Hello (KeyCredentialManager); public key is DER SPKI; signature is PSS+SHA-256.
+    Rsa(rsa::RsaPrivateKey),
+}
+
+impl SigningKeyEnum {
+    /// Returns the canonical public key bytes to include in `AuthChallengeRequest.pubkey`.
+    pub fn pubkey_bytes(&self) -> Vec<u8> {
+        match self {
+            SigningKeyEnum::Ed25519(k) => k.verifying_key().to_bytes().to_vec(),
+            // 33-byte SEC1 compressed point — compact and natively supported by secp256k1 tooling
+            SigningKeyEnum::EcdsaSecp256k1(k) => {
+                k.verifying_key().to_encoded_point(true).as_bytes().to_vec()
+            }
+            SigningKeyEnum::Rsa(k) => {
+                use rsa::pkcs8::EncodePublicKey as _;
+                k.to_public_key()
+                    .to_public_key_der()
+                    .expect("rsa SPKI encoding is infallible")
+                    .to_vec()
+            }
+        }
+    }
+
+    /// Returns the proto `KeyType` discriminant to send in `AuthChallengeRequest.key_type`.
+    pub fn proto_key_type(&self) -> ProtoKeyType {
+        match self {
+            SigningKeyEnum::Ed25519(_) => ProtoKeyType::Ed25519,
+            SigningKeyEnum::EcdsaSecp256k1(_) => ProtoKeyType::EcdsaSecp256k1,
+            SigningKeyEnum::Rsa(_) => ProtoKeyType::Rsa,
+        }
+    }
+
+    /// Signs `msg` and returns raw signature bytes matching the server-side verification.
+    pub fn sign(&self, msg: &[u8]) -> Vec<u8> {
+        match self {
+            SigningKeyEnum::Ed25519(k) => {
+                use ed25519_dalek::Signer as _;
+                k.sign(msg).to_bytes().to_vec()
+            }
+            SigningKeyEnum::EcdsaSecp256k1(k) => {
+                use k256::ecdsa::signature::Signer as _;
+                let sig: k256::ecdsa::Signature = k.sign(msg);
+                sig.to_bytes().to_vec()
+            }
+            SigningKeyEnum::Rsa(k) => {
+                use rsa::signature::RandomizedSigner as _;
+                let signing_key = rsa::pss::BlindedSigningKey::<sha2::Sha256>::new(k.clone());
+                // Use rand_core OsRng from the rsa crate's re-exported rand_core (0.6.x),
+                // which is the version rsa's signature API expects.
+                let sig = signing_key.sign_with_rng(&mut rsa::rand_core::OsRng, msg);
+                use rsa::signature::SignatureEncoding as _;
+                sig.to_vec()
+            }
+        }
+    }
+}
+
+statemachine! {
+    name: UserAgent,
+    custom_error: false,
+    transitions: {
+        *Init + SentAuthChallengeRequest = WaitingForServerAuth,
+        WaitingForServerAuth + ReceivedAuthChallenge = WaitingForAuthOk,
+        WaitingForServerAuth + ReceivedAuthOk = Authenticated,
+        WaitingForAuthOk + ReceivedAuthOk = Authenticated,
+    }
+}
+
+pub struct DummyContext;
+impl UserAgentStateMachineContext for DummyContext {}
+
+#[derive(Debug, thiserror::Error)]
+pub enum InboundError {
+    #[error("Invalid user agent response")]
+    InvalidResponse,
+    #[error("Expected response payload")]
+    MissingResponsePayload,
+    #[error("Unexpected response payload")]
+    UnexpectedResponsePayload,
+    #[error("Invalid state for auth challenge")]
+    InvalidStateForAuthChallenge,
+    #[error("Invalid state for auth ok")]
+    InvalidStateForAuthOk,
+    #[error("State machine error")]
+    StateTransitionFailed,
+    #[error("Transport send failed")]
+    TransportSendFailed,
+}
+
+pub struct UserAgentActor<Transport>
+where
+    Transport: Bi<UserAgentResponse, UserAgentRequest>,
+{
+    key: SigningKeyEnum,
+    bootstrap_token: Option<String>,
+    state: UserAgentStateMachine<DummyContext>,
+    transport: Transport,
+}
+
+impl<Transport> UserAgentActor<Transport>
+where
+    Transport: Bi<UserAgentResponse, UserAgentRequest>,
+{
+    pub fn new(key: SigningKeyEnum, bootstrap_token: Option<String>, transport: Transport) -> Self {
+        Self {
+            key,
+            bootstrap_token,
+            state: UserAgentStateMachine::new(DummyContext),
+            transport,
+        }
+    }
+
+    fn transition(&mut self, event: UserAgentEvents) -> Result<(), InboundError> {
+        self.state.process_event(event).map_err(|e| {
+            error!(?e, "useragent state transition failed");
+            InboundError::StateTransitionFailed
+        })?;
+        Ok(())
+    }
+
+    async fn send_auth_challenge_request(&mut self) -> Result<(), InboundError> {
+        let req = AuthChallengeRequest {
+            pubkey: self.key.pubkey_bytes(),
+            bootstrap_token: self.bootstrap_token.take(),
+            key_type: self.key.proto_key_type().into(),
+        };
+
+        self.transition(UserAgentEvents::SentAuthChallengeRequest)?;
+
+        self.transport
+            .send(UserAgentRequest {
+                payload: Some(UserAgentRequestPayload::AuthChallengeRequest(req)),
+            })
+            .await
+            .map_err(|_| InboundError::TransportSendFailed)?;
+
+        info!(actor = "useragent", "auth.request.sent");
+        Ok(())
+    }
+
+    async fn handle_auth_challenge(
+        &mut self,
+        challenge: arbiter_proto::proto::user_agent::AuthChallenge,
+    ) -> Result<(), InboundError> {
+        self.transition(UserAgentEvents::ReceivedAuthChallenge)?;
+
+        let formatted = format_challenge(challenge.nonce, &challenge.pubkey);
+        let signature_bytes = self.key.sign(&formatted);
+        let solution = AuthChallengeSolution {
+            signature: signature_bytes,
+        };
+
+        self.transport
+            .send(UserAgentRequest {
+                payload: Some(UserAgentRequestPayload::AuthChallengeSolution(solution)),
+            })
+            .await
+            .map_err(|_| InboundError::TransportSendFailed)?;
+
+        info!(actor = "useragent", "auth.solution.sent");
+        Ok(())
+    }
+
+    fn handle_auth_ok(&mut self, _ok: AuthOk) -> Result<(), InboundError> {
+        self.transition(UserAgentEvents::ReceivedAuthOk)?;
+        info!(actor = "useragent", "auth.ok");
+        Ok(())
+    }
+
+    pub async fn process_inbound_transport(
+        &mut self,
+        inbound: UserAgentResponse,
+    ) -> Result<(), InboundError> {
+        let payload = inbound
+            .payload
+            .ok_or(InboundError::MissingResponsePayload)?;
+
+        match payload {
+            UserAgentResponsePayload::AuthChallenge(challenge) => {
+                self.handle_auth_challenge(challenge).await
+            }
+            UserAgentResponsePayload::AuthOk(ok) => self.handle_auth_ok(ok),
+            _ => Err(InboundError::UnexpectedResponsePayload),
+        }
+    }
+}
+
+impl<Transport> Actor for UserAgentActor<Transport>
+where
+    Transport: Bi<UserAgentResponse, UserAgentRequest>,
+{
+    type Args = Self;
+
+    type Error = ();
+
+    async fn on_start(
+        mut args: Self::Args,
+        _actor_ref: ActorRef<Self>,
+    ) -> Result<Self, Self::Error> {
+        if let Err(err) = args.send_auth_challenge_request().await {
+            error!(?err, actor = "useragent", "auth.start.failed");
+            return Err(());
+        }
+        Ok(args)
+    }
+
+    async fn next(
+        &mut self,
+        _actor_ref: kameo::prelude::WeakActorRef<Self>,
+        mailbox_rx: &mut kameo::prelude::MailboxReceiver<Self>,
+    ) -> Option<kameo::mailbox::Signal<Self>> {
+        loop {
+            select! {
+                signal = mailbox_rx.recv() => {
+                    return signal;
+                }
+                inbound = self.transport.recv() => {
+                    match inbound {
+                        Some(inbound) => {
+                            if let Err(err) = self.process_inbound_transport(inbound).await {
+                                error!(?err, actor = "useragent", "transport.inbound.failed");
+                                return Some(kameo::mailbox::Signal::Stop);
+                            }
+                        }
+                        None => {
+                            info!(actor = "useragent", "transport.closed");
+                            return Some(kameo::mailbox::Signal::Stop);
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
+
+mod grpc;
+pub use grpc::{ConnectError, connect_grpc};

server/crates/arbiter-useragent/tests/auth.rs

@@ -0,0 +1,146 @@
+use arbiter_proto::{
+    format_challenge,
+    proto::user_agent::{
+        AuthChallenge, AuthOk, UserAgentRequest, UserAgentResponse,
+        user_agent_request::Payload as UserAgentRequestPayload,
+        user_agent_response::Payload as UserAgentResponsePayload,
+    },
+    transport::Bi,
+};
+use arbiter_useragent::{SigningKeyEnum, UserAgentActor};
+use async_trait::async_trait;
+use ed25519_dalek::SigningKey;
+use kameo::actor::Spawn;
+use tokio::sync::mpsc;
+use tokio::time::{Duration, timeout};
+
+struct TestTransport {
+    inbound_rx: mpsc::Receiver<UserAgentResponse>,
+    outbound_tx: mpsc::Sender<UserAgentRequest>,
+}
+
+#[async_trait]
+impl Bi<UserAgentResponse, UserAgentRequest> for TestTransport {
+    async fn send(
+        &mut self,
+        item: UserAgentRequest,
+    ) -> Result<(), arbiter_proto::transport::Error> {
+        self.outbound_tx
+            .send(item)
+            .await
+            .map_err(|_| arbiter_proto::transport::Error::ChannelClosed)
+    }
+
+    async fn recv(&mut self) -> Option<UserAgentResponse> {
+        self.inbound_rx.recv().await
+    }
+}
+
+fn make_transport() -> (
+    TestTransport,
+    mpsc::Sender<UserAgentResponse>,
+    mpsc::Receiver<UserAgentRequest>,
+) {
+    let (inbound_tx, inbound_rx) = mpsc::channel(8);
+    let (outbound_tx, outbound_rx) = mpsc::channel(8);
+    (
+        TestTransport {
+            inbound_rx,
+            outbound_tx,
+        },
+        inbound_tx,
+        outbound_rx,
+    )
+}
+
+fn test_key() -> SigningKeyEnum {
+    SigningKeyEnum::Ed25519(SigningKey::from_bytes(&[7u8; 32]))
+}
+
+#[tokio::test]
+async fn sends_auth_request_on_start_with_bootstrap_token() {
+    let key = test_key();
+    let pubkey = key.pubkey_bytes();
+    let bootstrap_token = Some("bootstrap-123".to_string());
+    let (transport, inbound_tx, mut outbound_rx) = make_transport();
+
+    let actor = UserAgentActor::spawn(UserAgentActor::new(key, bootstrap_token.clone(), transport));
+
+    let outbound = timeout(Duration::from_secs(1), outbound_rx.recv())
+        .await
+        .expect("timed out waiting for auth request")
+        .expect("channel closed before auth request");
+
+    let UserAgentRequest {
+        payload: Some(UserAgentRequestPayload::AuthChallengeRequest(req)),
+    } = outbound
+    else {
+        panic!("expected auth challenge request");
+    };
+
+    assert_eq!(req.pubkey, pubkey);
+    assert_eq!(req.bootstrap_token, bootstrap_token);
+
+    drop(inbound_tx);
+    drop(actor);
+}
+
+#[tokio::test]
+async fn challenge_flow_sends_solution_from_transport_inbound() {
+    let key = test_key();
+    let pubkey_bytes = key.pubkey_bytes();
+    let (transport, inbound_tx, mut outbound_rx) = make_transport();
+
+    let actor = UserAgentActor::spawn(UserAgentActor::new(key, None, transport));
+
+    let _initial_auth_request = timeout(Duration::from_secs(1), outbound_rx.recv())
+        .await
+        .expect("timed out waiting for initial auth request")
+        .expect("missing initial auth request");
+
+    let challenge = AuthChallenge {
+        pubkey: pubkey_bytes.clone(),
+        nonce: 42,
+    };
+    inbound_tx
+        .send(UserAgentResponse {
+            payload: Some(UserAgentResponsePayload::AuthChallenge(challenge.clone())),
+        })
+        .await
+        .unwrap();
+
+    let outbound = timeout(Duration::from_secs(1), outbound_rx.recv())
+        .await
+        .expect("timed out waiting for challenge solution")
+        .expect("missing challenge solution");
+
+    let UserAgentRequest {
+        payload: Some(UserAgentRequestPayload::AuthChallengeSolution(solution)),
+    } = outbound
+    else {
+        panic!("expected auth challenge solution");
+    };
+
+    // Verify the signature using the Ed25519 verifying key
+    let formatted = format_challenge(challenge.nonce, &challenge.pubkey);
+    let raw_key = SigningKey::from_bytes(&[7u8; 32]);
+    let sig: ed25519_dalek::Signature = solution
+        .signature
+        .as_slice()
+        .try_into()
+        .expect("signature bytes length");
+    raw_key
+        .verifying_key()
+        .verify_strict(&formatted, &sig)
+        .expect("solution signature should verify");
+
+    inbound_tx
+        .send(UserAgentResponse {
+            payload: Some(UserAgentResponsePayload::AuthOk(AuthOk {})),
+        })
+        .await
+        .unwrap();
+
+    drop(inbound_tx);
+    drop(actor);
+}

useragent/.dart_tool/extension_discovery/README.md

@@ -0,0 +1,31 @@
+Extension Discovery Cache
+=========================
+
+This folder is used by `package:extension_discovery` to cache lists of
+packages that contains extensions for other packages.
+
+DO NOT USE THIS FOLDER
+----------------------
+
+ * Do not read (or rely) the contents of this folder.
+ * Do write to this folder.
+
+If you're interested in the lists of extensions stored in this folder use the
+API offered by package `extension_discovery` to get this information.
+
+If this package doesn't work for your use-case, then don't try to read the
+contents of this folder. It may change, and will not remain stable.
+
+Use package `extension_discovery`
+---------------------------------
+
+If you want to access information from this folder.
+
+Feel free to delete this folder
+-------------------------------
+
+Files in this folder act as a cache, and the cache is discarded if the files
+are older than the modification time of `.dart_tool/package_config.json`.
+
+Hence, it should never be necessary to clear this cache manually, if you find a
+need to do please file a bug.

useragent/.dart_tool/extension_discovery/vs_code.json

@@ -0,0 +1 @@
+{"version":2,"entries":[{"package":"arbiter","rootUri":"../","packageUri":"lib/"}]}

useragent/.dart_tool/package_config.json

@@ -0,0 +1,172 @@
+{
+  "configVersion": 2,
+  "packages": [
+    {
+      "name": "async",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/async-2.13.0",
+      "packageUri": "lib/",
+      "languageVersion": "3.4"
+    },
+    {
+      "name": "boolean_selector",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/boolean_selector-2.1.2",
+      "packageUri": "lib/",
+      "languageVersion": "3.1"
+    },
+    {
+      "name": "characters",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/characters-1.4.0",
+      "packageUri": "lib/",
+      "languageVersion": "3.4"
+    },
+    {
+      "name": "clock",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/clock-1.1.2",
+      "packageUri": "lib/",
+      "languageVersion": "3.4"
+    },
+    {
+      "name": "collection",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/collection-1.19.1",
+      "packageUri": "lib/",
+      "languageVersion": "3.4"
+    },
+    {
+      "name": "fake_async",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/fake_async-1.3.3",
+      "packageUri": "lib/",
+      "languageVersion": "3.3"
+    },
+    {
+      "name": "flutter",
+      "rootUri": "file:///Users/kaska/.local/share/mise/installs/flutter/3.38.9-stable/packages/flutter",
+      "packageUri": "lib/",
+      "languageVersion": "3.8"
+    },
+    {
+      "name": "flutter_lints",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/flutter_lints-6.0.0",
+      "packageUri": "lib/",
+      "languageVersion": "3.8"
+    },
+    {
+      "name": "flutter_test",
+      "rootUri": "file:///Users/kaska/.local/share/mise/installs/flutter/3.38.9-stable/packages/flutter_test",
+      "packageUri": "lib/",
+      "languageVersion": "3.8"
+    },
+    {
+      "name": "leak_tracker",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/leak_tracker-11.0.2",
+      "packageUri": "lib/",
+      "languageVersion": "3.2"
+    },
+    {
+      "name": "leak_tracker_flutter_testing",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/leak_tracker_flutter_testing-3.0.10",
+      "packageUri": "lib/",
+      "languageVersion": "3.2"
+    },
+    {
+      "name": "leak_tracker_testing",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/leak_tracker_testing-3.0.2",
+      "packageUri": "lib/",
+      "languageVersion": "3.2"
+    },
+    {
+      "name": "lints",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/lints-6.1.0",
+      "packageUri": "lib/",
+      "languageVersion": "3.8"
+    },
+    {
+      "name": "matcher",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/matcher-0.12.17",
+      "packageUri": "lib/",
+      "languageVersion": "3.4"
+    },
+    {
+      "name": "material_color_utilities",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/material_color_utilities-0.11.1",
+      "packageUri": "lib/",
+      "languageVersion": "2.17"
+    },
+    {
+      "name": "meta",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/meta-1.17.0",
+      "packageUri": "lib/",
+      "languageVersion": "3.5"
+    },
+    {
+      "name": "path",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/path-1.9.1",
+      "packageUri": "lib/",
+      "languageVersion": "3.4"
+    },
+    {
+      "name": "sky_engine",
+      "rootUri": "file:///Users/kaska/.local/share/mise/installs/flutter/3.38.9-stable/bin/cache/pkg/sky_engine",
+      "packageUri": "lib/",
+      "languageVersion": "3.8"
+    },
+    {
+      "name": "source_span",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/source_span-1.10.2",
+      "packageUri": "lib/",
+      "languageVersion": "3.1"
+    },
+    {
+      "name": "stack_trace",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/stack_trace-1.12.1",
+      "packageUri": "lib/",
+      "languageVersion": "3.4"
+    },
+    {
+      "name": "stream_channel",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/stream_channel-2.1.4",
+      "packageUri": "lib/",
+      "languageVersion": "3.3"
+    },
+    {
+      "name": "string_scanner",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/string_scanner-1.4.1",
+      "packageUri": "lib/",
+      "languageVersion": "3.1"
+    },
+    {
+      "name": "term_glyph",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/term_glyph-1.2.2",
+      "packageUri": "lib/",
+      "languageVersion": "3.1"
+    },
+    {
+      "name": "test_api",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/test_api-0.7.7",
+      "packageUri": "lib/",
+      "languageVersion": "3.5"
+    },
+    {
+      "name": "vector_math",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/vector_math-2.2.0",
+      "packageUri": "lib/",
+      "languageVersion": "3.1"
+    },
+    {
+      "name": "vm_service",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/vm_service-15.0.2",
+      "packageUri": "lib/",
+      "languageVersion": "3.5"
+    },
+    {
+      "name": "arbiter",
+      "rootUri": "../",
+      "packageUri": "lib/",
+      "languageVersion": "3.10"
+    }
+  ],
+  "generator": "pub",
+  "generatorVersion": "3.10.8",
+  "flutterRoot": "file:///Users/kaska/.local/share/mise/installs/flutter/3.38.9-stable",
+  "flutterVersion": "3.38.9",
+  "pubCache": "file:///Users/kaska/.pub-cache"
+}

useragent/.dart_tool/package_graph.json

@@ -0,0 +1,224 @@
+{
+  "roots": [
+    "arbiter"
+  ],
+  "packages": [
+    {
+      "name": "arbiter",
+      "version": "0.1.0",
+      "dependencies": [
+        "flutter"
+      ],
+      "devDependencies": [
+        "flutter_lints",
+        "flutter_test"
+      ]
+    },
+    {
+      "name": "flutter_lints",
+      "version": "6.0.0",
+      "dependencies": [
+        "lints"
+      ]
+    },
+    {
+      "name": "flutter_test",
+      "version": "0.0.0",
+      "dependencies": [
+        "clock",
+        "collection",
+        "fake_async",
+        "flutter",
+        "leak_tracker_flutter_testing",
+        "matcher",
+        "meta",
+        "path",
+        "stack_trace",
+        "stream_channel",
+        "test_api",
+        "vector_math"
+      ]
+    },
+    {
+      "name": "flutter",
+      "version": "0.0.0",
+      "dependencies": [
+        "characters",
+        "collection",
+        "material_color_utilities",
+        "meta",
+        "sky_engine",
+        "vector_math"
+      ]
+    },
+    {
+      "name": "lints",
+      "version": "6.1.0",
+      "dependencies": []
+    },
+    {
+      "name": "stream_channel",
+      "version": "2.1.4",
+      "dependencies": [
+        "async"
+      ]
+    },
+    {
+      "name": "meta",
+      "version": "1.17.0",
+      "dependencies": []
+    },
+    {
+      "name": "collection",
+      "version": "1.19.1",
+      "dependencies": []
+    },
+    {
+      "name": "leak_tracker_flutter_testing",
+      "version": "3.0.10",
+      "dependencies": [
+        "flutter",
+        "leak_tracker",
+        "leak_tracker_testing",
+        "matcher",
+        "meta"
+      ]
+    },
+    {
+      "name": "vector_math",
+      "version": "2.2.0",
+      "dependencies": []
+    },
+    {
+      "name": "stack_trace",
+      "version": "1.12.1",
+      "dependencies": [
+        "path"
+      ]
+    },
+    {
+      "name": "clock",
+      "version": "1.1.2",
+      "dependencies": []
+    },
+    {
+      "name": "fake_async",
+      "version": "1.3.3",
+      "dependencies": [
+        "clock",
+        "collection"
+      ]
+    },
+    {
+      "name": "path",
+      "version": "1.9.1",
+      "dependencies": []
+    },
+    {
+      "name": "matcher",
+      "version": "0.12.17",
+      "dependencies": [
+        "async",
+        "meta",
+        "stack_trace",
+        "term_glyph",
+        "test_api"
+      ]
+    },
+    {
+      "name": "test_api",
+      "version": "0.7.7",
+      "dependencies": [
+        "async",
+        "boolean_selector",
+        "collection",
+        "meta",
+        "source_span",
+        "stack_trace",
+        "stream_channel",
+        "string_scanner",
+        "term_glyph"
+      ]
+    },
+    {
+      "name": "sky_engine",
+      "version": "0.0.0",
+      "dependencies": []
+    },
+    {
+      "name": "material_color_utilities",
+      "version": "0.11.1",
+      "dependencies": [
+        "collection"
+      ]
+    },
+    {
+      "name": "characters",
+      "version": "1.4.0",
+      "dependencies": []
+    },
+    {
+      "name": "async",
+      "version": "2.13.0",
+      "dependencies": [
+        "collection",
+        "meta"
+      ]
+    },
+    {
+      "name": "leak_tracker_testing",
+      "version": "3.0.2",
+      "dependencies": [
+        "leak_tracker",
+        "matcher",
+        "meta"
+      ]
+    },
+    {
+      "name": "leak_tracker",
+      "version": "11.0.2",
+      "dependencies": [
+        "clock",
+        "collection",
+        "meta",
+        "path",
+        "vm_service"
+      ]
+    },
+    {
+      "name": "term_glyph",
+      "version": "1.2.2",
+      "dependencies": []
+    },
+    {
+      "name": "string_scanner",
+      "version": "1.4.1",
+      "dependencies": [
+        "source_span"
+      ]
+    },
+    {
+      "name": "source_span",
+      "version": "1.10.2",
+      "dependencies": [
+        "collection",
+        "path",
+        "term_glyph"
+      ]
+    },
+    {
+      "name": "boolean_selector",
+      "version": "2.1.2",
+      "dependencies": [
+        "source_span",
+        "string_scanner"
+      ]
+    },
+    {
+      "name": "vm_service",
+      "version": "15.0.2",
+      "dependencies": []
+    }
+  ],
+  "configVersion": 1
+}

useragent/.dart_tool/version

@@ -0,0 +1 @@
+3.38.9

useragent/README.md

@@ -1,4 +1,4 @@
-# useragent
+# app
 
 A new Flutter project.
 

useragent/android/.gitignore

@@ -1,14 +0,0 @@
-gradle-wrapper.jar
-/.gradle
-/captures/
-/gradlew
-/gradlew.bat
-/local.properties
-GeneratedPluginRegistrant.java
-.cxx/
-
-# Remember to never publicly share your keystore.
-# See https://flutter.dev/to/reference-keystore
-key.properties
-**/*.keystore
-**/*.jks

useragent/android/app/build.gradle.kts

@@ -1,44 +0,0 @@
-plugins {
-    id("com.android.application")
-    id("kotlin-android")
-    // The Flutter Gradle Plugin must be applied after the Android and Kotlin Gradle plugins.
-    id("dev.flutter.flutter-gradle-plugin")
-}
-
-android {
-    namespace = "com.example.useragent"
-    compileSdk = flutter.compileSdkVersion
-    ndkVersion = flutter.ndkVersion
-
-    compileOptions {
-        sourceCompatibility = JavaVersion.VERSION_17
-        targetCompatibility = JavaVersion.VERSION_17
-    }
-
-    kotlinOptions {
-        jvmTarget = JavaVersion.VERSION_17.toString()
-    }
-
-    defaultConfig {
-        // TODO: Specify your own unique Application ID (https://developer.android.com/studio/build/application-id.html).
-        applicationId = "com.example.useragent"
-        // You can update the following values to match your application needs.
-        // For more information, see: https://flutter.dev/to/review-gradle-config.
-        minSdk = flutter.minSdkVersion
-        targetSdk = flutter.targetSdkVersion
-        versionCode = flutter.versionCode
-        versionName = flutter.versionName
-    }
-
-    buildTypes {
-        release {
-            // TODO: Add your own signing config for the release build.
-            // Signing with the debug keys for now, so `flutter run --release` works.
-            signingConfig = signingConfigs.getByName("debug")
-        }
-    }
-}
-
-flutter {
-    source = "../.."
-}

useragent/android/app/src/debug/AndroidManifest.xml

@@ -1,7 +0,0 @@
-<manifest xmlns:android="http://schemas.android.com/apk/res/android">
-    <!-- The INTERNET permission is required for development. Specifically,
-         the Flutter tool needs it to communicate with the running application
-         to allow setting breakpoints, to provide hot reload, etc.
-    -->
-    <uses-permission android:name="android.permission.INTERNET"/>
-</manifest>

useragent/android/app/src/main/AndroidManifest.xml

@@ -1,45 +0,0 @@
-<manifest xmlns:android="http://schemas.android.com/apk/res/android">
-    <application
-        android:label="useragent"
-        android:name="${applicationName}"
-        android:icon="@mipmap/ic_launcher">
-        <activity
-            android:name=".MainActivity"
-            android:exported="true"
-            android:launchMode="singleTop"
-            android:taskAffinity=""
-            android:theme="@style/LaunchTheme"
-            android:configChanges="orientation|keyboardHidden|keyboard|screenSize|smallestScreenSize|locale|layoutDirection|fontScale|screenLayout|density|uiMode"
-            android:hardwareAccelerated="true"
-            android:windowSoftInputMode="adjustResize">
-            <!-- Specifies an Android theme to apply to this Activity as soon as
-                 the Android process has started. This theme is visible to the user
-                 while the Flutter UI initializes. After that, this theme continues
-                 to determine the Window background behind the Flutter UI. -->
-            <meta-data
-              android:name="io.flutter.embedding.android.NormalTheme"
-              android:resource="@style/NormalTheme"
-              />
-            <intent-filter>
-                <action android:name="android.intent.action.MAIN"/>
-                <category android:name="android.intent.category.LAUNCHER"/>
-            </intent-filter>
-        </activity>
-        <!-- Don't delete the meta-data below.
-             This is used by the Flutter tool to generate GeneratedPluginRegistrant.java -->
-        <meta-data
-            android:name="flutterEmbedding"
-            android:value="2" />
-    </application>
-    <!-- Required to query activities that can process text, see:
-         https://developer.android.com/training/package-visibility and
-         https://developer.android.com/reference/android/content/Intent#ACTION_PROCESS_TEXT.
-
-         In particular, this is used by the Flutter engine in io.flutter.plugin.text.ProcessTextPlugin. -->
-    <queries>
-        <intent>
-            <action android:name="android.intent.action.PROCESS_TEXT"/>
-            <data android:mimeType="text/plain"/>
-        </intent>
-    </queries>
-</manifest>

useragent/android/app/src/main/kotlin/com/example/useragent/MainActivity.kt

@@ -1,5 +0,0 @@
-package com.example.useragent
-
-import io.flutter.embedding.android.FlutterActivity
-
-class MainActivity : FlutterActivity()

useragent/android/app/src/main/res/drawable-v21/launch_background.xml

@@ -1,12 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!-- Modify this file to customize your launch splash screen -->
-<layer-list xmlns:android="http://schemas.android.com/apk/res/android">
-    <item android:drawable="?android:colorBackground" />
-
-    <!-- You can insert your own image assets here -->
-    <!-- <item>
-        <bitmap
-            android:gravity="center"
-            android:src="@mipmap/launch_image" />
-    </item> -->
-</layer-list>

useragent/android/app/src/main/res/drawable/launch_background.xml

@@ -1,12 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!-- Modify this file to customize your launch splash screen -->
-<layer-list xmlns:android="http://schemas.android.com/apk/res/android">
-    <item android:drawable="@android:color/white" />
-
-    <!-- You can insert your own image assets here -->
-    <!-- <item>
-        <bitmap
-            android:gravity="center"
-            android:src="@mipmap/launch_image" />
-    </item> -->
-</layer-list>

useragent/android/app/src/main/res/values-night/styles.xml

@@ -1,18 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<resources>
-    <!-- Theme applied to the Android Window while the process is starting when the OS's Dark Mode setting is on -->
-    <style name="LaunchTheme" parent="@android:style/Theme.Black.NoTitleBar">
-        <!-- Show a splash screen on the activity. Automatically removed when
-             the Flutter engine draws its first frame -->
-        <item name="android:windowBackground">@drawable/launch_background</item>
-    </style>
-    <!-- Theme applied to the Android Window as soon as the process has started.
-         This theme determines the color of the Android Window while your
-         Flutter UI initializes, as well as behind your Flutter UI while its
-         running.
-
-         This Theme is only used starting with V2 of Flutter's Android embedding. -->
-    <style name="NormalTheme" parent="@android:style/Theme.Black.NoTitleBar">
-        <item name="android:windowBackground">?android:colorBackground</item>
-    </style>
-</resources>

useragent/android/app/src/main/res/values/styles.xml

@@ -1,18 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<resources>
-    <!-- Theme applied to the Android Window while the process is starting when the OS's Dark Mode setting is off -->
-    <style name="LaunchTheme" parent="@android:style/Theme.Light.NoTitleBar">
-        <!-- Show a splash screen on the activity. Automatically removed when
-             the Flutter engine draws its first frame -->
-        <item name="android:windowBackground">@drawable/launch_background</item>
-    </style>
-    <!-- Theme applied to the Android Window as soon as the process has started.
-         This theme determines the color of the Android Window while your
-         Flutter UI initializes, as well as behind your Flutter UI while its
-         running.
-
-         This Theme is only used starting with V2 of Flutter's Android embedding. -->
-    <style name="NormalTheme" parent="@android:style/Theme.Light.NoTitleBar">
-        <item name="android:windowBackground">?android:colorBackground</item>
-    </style>
-</resources>

useragent/android/app/src/profile/AndroidManifest.xml

@@ -1,7 +0,0 @@
-<manifest xmlns:android="http://schemas.android.com/apk/res/android">
-    <!-- The INTERNET permission is required for development. Specifically,
-         the Flutter tool needs it to communicate with the running application
-         to allow setting breakpoints, to provide hot reload, etc.
-    -->
-    <uses-permission android:name="android.permission.INTERNET"/>
-</manifest>

useragent/android/build.gradle.kts

@@ -1,24 +0,0 @@
-allprojects {
-    repositories {
-        google()
-        mavenCentral()
-    }
-}
-
-val newBuildDir: Directory =
-    rootProject.layout.buildDirectory
-        .dir("../../build")
-        .get()
-rootProject.layout.buildDirectory.value(newBuildDir)
-
-subprojects {
-    val newSubprojectBuildDir: Directory = newBuildDir.dir(project.name)
-    project.layout.buildDirectory.value(newSubprojectBuildDir)
-}
-subprojects {
-    project.evaluationDependsOn(":app")
-}
-
-tasks.register<Delete>("clean") {
-    delete(rootProject.layout.buildDirectory)
-}

useragent/android/gradle.properties

@@ -1,2 +0,0 @@
-org.gradle.jvmargs=-Xmx8G -XX:MaxMetaspaceSize=4G -XX:ReservedCodeCacheSize=512m -XX:+HeapDumpOnOutOfMemoryError
-android.useAndroidX=true

useragent/android/gradle/wrapper/gradle-wrapper.properties

@@ -1,5 +0,0 @@
-distributionBase=GRADLE_USER_HOME
-distributionPath=wrapper/dists
-zipStoreBase=GRADLE_USER_HOME
-zipStorePath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.14-all.zip

useragent/android/settings.gradle.kts

@@ -1,26 +0,0 @@
-pluginManagement {
-    val flutterSdkPath =
-        run {
-            val properties = java.util.Properties()
-            file("local.properties").inputStream().use { properties.load(it) }
-            val flutterSdkPath = properties.getProperty("flutter.sdk")
-            require(flutterSdkPath != null) { "flutter.sdk not set in local.properties" }
-            flutterSdkPath
-        }
-
-    includeBuild("$flutterSdkPath/packages/flutter_tools/gradle")
-
-    repositories {
-        google()
-        mavenCentral()
-        gradlePluginPortal()
-    }
-}
-
-plugins {
-    id("dev.flutter.flutter-plugin-loader") version "1.0.0"
-    id("com.android.application") version "8.11.1" apply false
-    id("org.jetbrains.kotlin.android") version "2.2.20" apply false
-}
-
-include(":app")

useragent/lib/features/connection/arbiter_url.dart

@@ -1,56 +0,0 @@
-import 'dart:convert';
-
-class ArbiterUrl {
-  const ArbiterUrl({
-    required this.host,
-    required this.port,
-    required this.caCert,
-    this.bootstrapToken,
-  });
-
-  final String host;
-  final int port;
-  final List<int> caCert;
-  final String? bootstrapToken;
-
-  static const _scheme = 'arbiter';
-  static const _certQueryKey = 'cert';
-  static const _bootstrapTokenQueryKey = 'bootstrap_token';
-
-  static ArbiterUrl parse(String value) {
-    final uri = Uri.tryParse(value);
-    if (uri == null || uri.scheme != _scheme) {
-      throw const FormatException("Invalid URL scheme, expected 'arbiter://'");
-    }
-
-    if (uri.host.isEmpty) {
-      throw const FormatException('Missing host in URL');
-    }
-
-    if (!uri.hasPort) {
-      throw const FormatException('Missing port in URL');
-    }
-
-    final cert = uri.queryParameters[_certQueryKey];
-    if (cert == null || cert.isEmpty) {
-      throw const FormatException("Missing 'cert' query parameter in URL");
-    }
-
-    final decodedCert = _decodeCert(cert);
-
-    return ArbiterUrl(
-      host: uri.host,
-      port: uri.port,
-      caCert: decodedCert,
-      bootstrapToken: uri.queryParameters[_bootstrapTokenQueryKey],
-    );
-  }
-
-  static List<int> _decodeCert(String cert) {
-    try {
-      return base64Url.decode(base64Url.normalize(cert));
-    } on FormatException catch (error) {
-      throw FormatException("Invalid base64 in 'cert' query parameter: ${error.message}");
-    }
-  }
-}

useragent/lib/features/connection/auth.dart

@@ -1,103 +0,0 @@
-import 'dart:async';
-import 'dart:convert';
-
-import 'package:arbiter/features/connection/connection.dart';
-import 'package:arbiter/features/connection/server_info_storage.dart';
-import 'package:arbiter/features/identity/pk_manager.dart';
-import 'package:arbiter/proto/arbiter.pbgrpc.dart';
-import 'package:arbiter/proto/user_agent.pb.dart';
-import 'package:grpc/grpc.dart';
-import 'package:mtcore/markettakers.dart';
-
-Future<Connection> connectAndAuthorize(
-  StoredServerInfo serverInfo,
-  KeyHandle key, {
-  String? bootstrapToken,
-}) async {
-  try {
-    final connection = await _connect(serverInfo);
-    talker.info(
-      'Connected to server at ${serverInfo.address}:${serverInfo.port}',
-    );
-    final pubkey = await key.getPublicKey();
-
-    final req = AuthChallengeRequest(
-      pubkey: pubkey,
-      bootstrapToken: bootstrapToken,
-      keyType: switch (key.alg) {
-        KeyAlgorithm.rsa => KeyType.KEY_TYPE_RSA,
-        KeyAlgorithm.ecdsa => KeyType.KEY_TYPE_ECDSA_SECP256K1,
-        KeyAlgorithm.ed25519 => KeyType.KEY_TYPE_ED25519,
-      },
-    );
-    await connection.send(UserAgentRequest(authChallengeRequest: req));
-    talker.info(
-      "Sent auth challenge request with pubkey ${base64Encode(pubkey)}",
-    );
-
-    final response = await connection.receive();
-    talker.info('Received response from server, checking auth flow...');
-
-    if (response.hasAuthOk()) {
-      talker.info('Authentication successful, connection established');
-      return connection;
-    }
-
-    if (!response.hasAuthChallenge()) {
-      throw Exception(
-        'Expected AuthChallengeResponse, got ${response.whichPayload()}',
-      );
-    }
-
-    final challenge = _formatChallenge(response.authChallenge, pubkey);
-    talker.info(
-      'Received auth challenge, signing with key ${base64Encode(pubkey)}',
-    );
-
-    final signature = await key.sign(challenge);
-    await connection.send(
-      UserAgentRequest(authChallengeSolution: AuthChallengeSolution(signature: signature)),
-    );
-
-    talker.info('Sent auth challenge solution, waiting for server response...');
-
-    final solutionResponse = await connection.receive();
-    if (!solutionResponse.hasAuthOk()) {
-      throw Exception(
-        'Expected AuthChallengeSolutionResponse, got ${solutionResponse.whichPayload()}',
-      );
-    }
-
-    talker.info('Authentication successful, connection established');
-    return connection;
-  } catch (e) {
-    throw Exception('Failed to connect to server: $e');
-  }
-}
-
-Future<Connection> _connect(StoredServerInfo serverInfo) async {
-  final channel = ClientChannel(
-    serverInfo.address,
-    port: serverInfo.port,
-    options: ChannelOptions(
-      connectTimeout: const Duration(seconds: 10),
-      credentials: ChannelCredentials.secure(
-        onBadCertificate: (cert, host) {
-          return true;
-        },
-      ),
-    ),
-  );
-
-  final client = ArbiterServiceClient(channel);
-  final tx = StreamController<UserAgentRequest>();
-  final rx = client.userAgent(tx.stream);
-
-  return Connection(channel: channel, tx: tx, rx: rx);
-}
-
-List<int> _formatChallenge(AuthChallenge challenge, List<int> pubkey) {
-  final encodedPubkey = base64Encode(pubkey);
-  final payload = "${challenge.nonce}:$encodedPubkey";
-  return utf8.encode(payload);
-}

useragent/lib/features/connection/connection.dart

@@ -1,37 +0,0 @@
-import 'dart:async';
-
-import 'package:arbiter/proto/user_agent.pb.dart';
-import 'package:grpc/grpc.dart';
-import 'package:mtcore/markettakers.dart';
-
-class Connection {
-  final ClientChannel channel;
-  final StreamController<UserAgentRequest> _tx;
-  final StreamIterator<UserAgentResponse> _rx;
-
-  Connection({
-    required this.channel,
-    required StreamController<UserAgentRequest> tx,
-    required ResponseStream<UserAgentResponse> rx,
-  }) : _tx = tx,
-       _rx = StreamIterator(rx);
-
-  Future<void> send(UserAgentRequest request) async {
-    talker.debug('Sending request: ${request.toDebugString()}');
-    _tx.add(request);
-  }
-
-  Future<UserAgentResponse> receive() async {
-    final hasValue = await _rx.moveNext();
-    if (!hasValue) {
-      throw Exception('Connection closed while waiting for server response.');
-    }
-    talker.debug('Received response: ${_rx.current.toDebugString()}');
-    return _rx.current;
-  }
-
-  Future<void> close() async {
-    await _tx.close();
-    await channel.shutdown();
-  }
-}

useragent/lib/features/connection/evm.dart

@@ -1,56 +0,0 @@
-import 'package:arbiter/features/connection/connection.dart';
-import 'package:arbiter/proto/evm.pb.dart';
-import 'package:arbiter/proto/user_agent.pb.dart';
-import 'package:protobuf/well_known_types/google/protobuf/empty.pb.dart';
-
-Future<List<WalletEntry>> listEvmWallets(Connection connection) async {
-  await connection.send(UserAgentRequest(evmWalletList: Empty()));
-
-  final response = await connection.receive();
-  if (!response.hasEvmWalletList()) {
-    throw Exception(
-      'Expected EVM wallet list response, got ${response.whichPayload()}',
-    );
-  }
-
-  final result = response.evmWalletList;
-  switch (result.whichResult()) {
-    case WalletListResponse_Result.wallets:
-      return result.wallets.wallets.toList(growable: false);
-    case WalletListResponse_Result.error:
-      throw Exception(_describeEvmError(result.error));
-    case WalletListResponse_Result.notSet:
-      throw Exception('EVM wallet list response was empty.');
-  }
-}
-
-Future<void> createEvmWallet(Connection connection) async {
-  await connection.send(UserAgentRequest(evmWalletCreate: Empty()));
-
-  final response = await connection.receive();
-  if (!response.hasEvmWalletCreate()) {
-    throw Exception(
-      'Expected EVM wallet create response, got ${response.whichPayload()}',
-    );
-  }
-
-  final result = response.evmWalletCreate;
-  switch (result.whichResult()) {
-    case WalletCreateResponse_Result.wallet:
-      return;
-    case WalletCreateResponse_Result.error:
-      throw Exception(_describeEvmError(result.error));
-    case WalletCreateResponse_Result.notSet:
-      throw Exception('Wallet creation returned no result.');
-  }
-}
-
-String _describeEvmError(EvmError error) {
-  return switch (error) {
-    EvmError.EVM_ERROR_VAULT_SEALED =>
-      'The vault is sealed. Unseal it before using EVM wallets.',
-    EvmError.EVM_ERROR_INTERNAL || EvmError.EVM_ERROR_UNSPECIFIED =>
-      'The server failed to process the EVM request.',
-    _ => 'The server failed to process the EVM request.',
-  };
-}

useragent/lib/features/connection/evm/grants.dart

@@ -1,122 +0,0 @@
-import 'package:arbiter/features/connection/connection.dart';
-import 'package:arbiter/proto/evm.pb.dart';
-import 'package:arbiter/proto/user_agent.pb.dart';
-import 'package:fixnum/fixnum.dart';
-import 'package:protobuf/well_known_types/google/protobuf/timestamp.pb.dart';
-
-Future<List<GrantEntry>> listEvmGrants(
-  Connection connection, {
-  int? walletId,
-}) async {
-  final request = EvmGrantListRequest();
-  if (walletId != null) {
-    request.walletId = walletId;
-  }
-
-  await connection.send(UserAgentRequest(evmGrantList: request));
-
-  final response = await connection.receive();
-  if (!response.hasEvmGrantList()) {
-    throw Exception(
-      'Expected EVM grant list response, got ${response.whichPayload()}',
-    );
-  }
-
-  final result = response.evmGrantList;
-  switch (result.whichResult()) {
-    case EvmGrantListResponse_Result.grants:
-      return result.grants.grants.toList(growable: false);
-    case EvmGrantListResponse_Result.error:
-      throw Exception(_describeGrantError(result.error));
-    case EvmGrantListResponse_Result.notSet:
-      throw Exception('EVM grant list response was empty.');
-  }
-}
-
-Future<int> createEvmGrant(
-  Connection connection, {
-  required int clientId,
-  required int walletId,
-  required Int64 chainId,
-  DateTime? validFrom,
-  DateTime? validUntil,
-  List<int>? maxGasFeePerGas,
-  List<int>? maxPriorityFeePerGas,
-  TransactionRateLimit? rateLimit,
-  required SpecificGrant specific,
-}) async {
-  await connection.send(
-    UserAgentRequest(
-      evmGrantCreate: EvmGrantCreateRequest(
-        clientId: clientId,
-        shared: SharedSettings(
-          walletId: walletId,
-          chainId: chainId,
-          validFrom: validFrom == null ? null : _toTimestamp(validFrom),
-          validUntil: validUntil == null ? null : _toTimestamp(validUntil),
-          maxGasFeePerGas: maxGasFeePerGas,
-          maxPriorityFeePerGas: maxPriorityFeePerGas,
-          rateLimit: rateLimit,
-        ),
-        specific: specific,
-      ),
-    ),
-  );
-
-  final response = await connection.receive();
-  if (!response.hasEvmGrantCreate()) {
-    throw Exception(
-      'Expected EVM grant create response, got ${response.whichPayload()}',
-    );
-  }
-
-  final result = response.evmGrantCreate;
-  switch (result.whichResult()) {
-    case EvmGrantCreateResponse_Result.grantId:
-      return result.grantId;
-    case EvmGrantCreateResponse_Result.error:
-      throw Exception(_describeGrantError(result.error));
-    case EvmGrantCreateResponse_Result.notSet:
-      throw Exception('Grant creation returned no result.');
-  }
-}
-
-Future<void> deleteEvmGrant(Connection connection, int grantId) async {
-  await connection.send(
-    UserAgentRequest(evmGrantDelete: EvmGrantDeleteRequest(grantId: grantId)),
-  );
-
-  final response = await connection.receive();
-  if (!response.hasEvmGrantDelete()) {
-    throw Exception(
-      'Expected EVM grant delete response, got ${response.whichPayload()}',
-    );
-  }
-
-  final result = response.evmGrantDelete;
-  switch (result.whichResult()) {
-    case EvmGrantDeleteResponse_Result.ok:
-      return;
-    case EvmGrantDeleteResponse_Result.error:
-      throw Exception(_describeGrantError(result.error));
-    case EvmGrantDeleteResponse_Result.notSet:
-      throw Exception('Grant revoke returned no result.');
-  }
-}
-
-Timestamp _toTimestamp(DateTime value) {
-  final utc = value.toUtc();
-  return Timestamp()
-    ..seconds = Int64(utc.millisecondsSinceEpoch ~/ 1000)
-    ..nanos = (utc.microsecondsSinceEpoch % 1000000) * 1000;
-}
-
-String _describeGrantError(EvmError error) {
-  return switch (error) {
-    EvmError.EVM_ERROR_VAULT_SEALED =>
-      'The vault is sealed. Unseal it before using EVM grants.',
-    EvmError.EVM_ERROR_INTERNAL || EvmError.EVM_ERROR_UNSPECIFIED =>
-      'The server failed to process the EVM grant request.',
-    _ => 'The server failed to process the EVM grant request.',
-  };
-}

useragent/lib/features/connection/server_info_storage.dart

@@ -1,62 +0,0 @@
-import 'dart:convert';
-
-import 'package:flutter_secure_storage/flutter_secure_storage.dart';
-import 'package:json_annotation/json_annotation.dart';
-
-part 'server_info_storage.g.dart';
-
-@JsonSerializable()
-class StoredServerInfo {
-  const StoredServerInfo({
-    required this.address,
-    required this.port,
-    required this.caCertFingerprint,
-  });
-
-  final String address;
-  final int port;
-  final String caCertFingerprint;
-
-  factory StoredServerInfo.fromJson(Map<String, dynamic> json) => _$StoredServerInfoFromJson(json);
-  Map<String, dynamic> toJson() => _$StoredServerInfoToJson(this);
-  
-}
-
-abstract class ServerInfoStorage {
-  Future<StoredServerInfo?> load();
-  Future<void> save(StoredServerInfo serverInfo);
-  Future<void> clear();
-}
-
-class SecureServerInfoStorage implements ServerInfoStorage {
-  static const _storageKey = 'server_info';
-
-  const SecureServerInfoStorage();
-
-  static const _storage = FlutterSecureStorage();
-
-  @override
-  Future<StoredServerInfo?> load() async {
-    return null;
-    final rawValue = await _storage.read(key: _storageKey);
-    if (rawValue == null) {
-      return null;
-    }
-
-    final decoded = jsonDecode(rawValue) as Map<String, dynamic>;
-    return StoredServerInfo.fromJson(decoded);
-  }
-
-  @override
-  Future<void> save(StoredServerInfo serverInfo) {
-    return _storage.write(
-      key: _storageKey,
-      value: jsonEncode(serverInfo.toJson()),
-    );
-  }
-
-  @override
-  Future<void> clear() {
-    return _storage.delete(key: _storageKey);
-  }
-}

useragent/lib/features/connection/server_info_storage.g.dart

@@ -1,21 +0,0 @@
-// GENERATED CODE - DO NOT MODIFY BY HAND
-
-part of 'server_info_storage.dart';
-
-// **************************************************************************
-// JsonSerializableGenerator
-// **************************************************************************
-
-StoredServerInfo _$StoredServerInfoFromJson(Map<String, dynamic> json) =>
-    StoredServerInfo(
-      address: json['address'] as String,
-      port: (json['port'] as num).toInt(),
-      caCertFingerprint: json['caCertFingerprint'] as String,
-    );
-
-Map<String, dynamic> _$StoredServerInfoToJson(StoredServerInfo instance) =>
-    <String, dynamic>{
-      'address': instance.address,
-      'port': instance.port,
-      'caCertFingerprint': instance.caCertFingerprint,
-    };

useragent/lib/features/connection/vault.dart

@@ -1,107 +0,0 @@
-import 'package:arbiter/features/connection/connection.dart';
-import 'package:arbiter/proto/user_agent.pb.dart';
-import 'package:cryptography/cryptography.dart';
-
-const _vaultKeyAssociatedData = 'arbiter.vault.password';
-
-Future<BootstrapResult> bootstrapVault(
-  Connection connection,
-  String password,
-) async {
-  final encryptedKey = await _encryptVaultKeyMaterial(connection, password);
-
-  await connection.send(
-    UserAgentRequest(
-      bootstrapEncryptedKey: BootstrapEncryptedKey(
-        nonce: encryptedKey.nonce,
-        ciphertext: encryptedKey.ciphertext,
-        associatedData: encryptedKey.associatedData,
-      ),
-    ),
-  );
-
-  final response = await connection.receive();
-  if (!response.hasBootstrapResult()) {
-    throw Exception(
-      'Expected bootstrap result, got ${response.whichPayload()}',
-    );
-  }
-
-  return response.bootstrapResult;
-}
-
-Future<UnsealResult> unsealVault(Connection connection, String password) async {
-  final encryptedKey = await _encryptVaultKeyMaterial(connection, password);
-
-  await connection.send(
-    UserAgentRequest(
-      unsealEncryptedKey: UnsealEncryptedKey(
-        nonce: encryptedKey.nonce,
-        ciphertext: encryptedKey.ciphertext,
-        associatedData: encryptedKey.associatedData,
-      ),
-    ),
-  );
-
-  final response = await connection.receive();
-  if (!response.hasUnsealResult()) {
-    throw Exception('Expected unseal result, got ${response.whichPayload()}');
-  }
-
-  return response.unsealResult;
-}
-
-Future<_EncryptedVaultKey> _encryptVaultKeyMaterial(
-  Connection connection,
-  String password,
-) async {
-  final keyExchange = X25519();
-  final cipher = Xchacha20.poly1305Aead();
-  final clientKeyPair = await keyExchange.newKeyPair();
-  final clientPublicKey = await clientKeyPair.extractPublicKey();
-
-  await connection.send(
-    UserAgentRequest(unsealStart: UnsealStart(clientPubkey: clientPublicKey.bytes)),
-  );
-
-  final handshakeResponse = await connection.receive();
-  if (!handshakeResponse.hasUnsealStartResponse()) {
-    throw Exception(
-      'Expected unseal handshake response, got ${handshakeResponse.whichPayload()}',
-    );
-  }
-
-  final serverPublicKey = SimplePublicKey(
-    handshakeResponse.unsealStartResponse.serverPubkey,
-    type: KeyPairType.x25519,
-  );
-  final sharedSecret = await keyExchange.sharedSecretKey(
-    keyPair: clientKeyPair,
-    remotePublicKey: serverPublicKey,
-  );
-
-  final secretBox = await cipher.encrypt(
-    password.codeUnits,
-    secretKey: sharedSecret,
-    nonce: cipher.newNonce(),
-    aad: _vaultKeyAssociatedData.codeUnits,
-  );
-
-  return _EncryptedVaultKey(
-    nonce: secretBox.nonce,
-    ciphertext: [...secretBox.cipherText, ...secretBox.mac.bytes],
-    associatedData: _vaultKeyAssociatedData.codeUnits,
-  );
-}
-
-class _EncryptedVaultKey {
-  const _EncryptedVaultKey({
-    required this.nonce,
-    required this.ciphertext,
-    required this.associatedData,
-  });
-
-  final List<int> nonce;
-  final List<int> ciphertext;
-  final List<int> associatedData;
-}

useragent/lib/features/identity/pk_manager.dart

@@ -1,16 +0,0 @@
-enum KeyAlgorithm {
-  rsa, ecdsa, ed25519
-}
-
-// The API to handle without storing the private key in memory. 
-//The implementation will use platform-specific secure storage and signing capabilities.
-abstract class KeyHandle {
-  KeyAlgorithm get alg;
-  Future<List<int>> sign(List<int> data);
-  Future<List<int>> getPublicKey();
-}
-
-abstract class KeyManager {
-  Future<KeyHandle?> get();
-  Future<KeyHandle> create();
-}

useragent/lib/features/identity/simple_ed25519.dart

@@ -1,93 +0,0 @@
-import 'dart:convert';
-
-import 'package:cryptography/cryptography.dart';
-import 'package:flutter_secure_storage/flutter_secure_storage.dart';
-import 'package:arbiter/features/identity/pk_manager.dart';
-
-final storage = FlutterSecureStorage(
-  aOptions: AndroidOptions.biometric(
-    enforceBiometrics: true,
-    biometricPromptTitle: 'Authentication Required',
-  ),
-  mOptions: MacOsOptions(
-    accessibility: KeychainAccessibility.unlocked_this_device,
-    label: "Arbiter",
-    description: "Confirm your identity to access vault",
-    synchronizable: false,
-    accessControlFlags: [
-      AccessControlFlag.userPresence,
-    ],
-    usesDataProtectionKeychain: true,
-  ),
-);
-
-final processor = Ed25519();
-
-class SimpleEd25519 extends KeyHandle {
-  final SimpleKeyPair _keyPair;
-
-  SimpleEd25519({required SimpleKeyPair keyPair}) : _keyPair = keyPair;
-
-  @override
-  KeyAlgorithm get alg => KeyAlgorithm.ed25519;
-
-  @override
-  Future<List<int>> getPublicKey() async {
-    final publicKey = await _keyPair.extractPublicKey();
-    return publicKey.bytes;
-  }
-
-  @override
-  Future<List<int>> sign(List<int> data) async {
-    final signature = await processor.sign(data, keyPair: _keyPair);
-    return signature.bytes;
-  }
-}
-
-class SimpleEd25519Manager extends KeyManager {
-  static const _storageKey = "ed25519_identity";
-  static const _storagePublicKey = "ed25519_public_key";
-
-  @override
-  Future<KeyHandle> create() async {
-    final storedKey = await get();
-    if (storedKey != null) {
-      return storedKey;
-    }
-
-    final newKey = await processor.newKeyPair();
-    final rawKey = await newKey.extract();
-
-    final keyData = base64Encode(rawKey.bytes);
-    await storage.write(key: _storageKey, value: keyData);
-
-    final publicKeyData = base64Encode(rawKey.publicKey.bytes);
-    await storage.write(key: _storagePublicKey, value: publicKeyData);
-
-    return SimpleEd25519(keyPair: newKey);
-  }
-
-  @override
-  Future<KeyHandle?> get() async {
-    final storedKeyPair = await storage.read(key: _storageKey);
-    if (storedKeyPair == null) {
-      return null;
-    }
-
-    final publicKeyData = await storage.read(key: _storagePublicKey);
-    final publicKeyRaw = base64Decode(publicKeyData!);
-    final publicKey = SimplePublicKey(
-      publicKeyRaw,
-      type: processor.keyPairType,
-    );
-
-    final keyBytes = base64Decode(storedKeyPair);
-    final keypair = SimpleKeyPairData(
-      keyBytes,
-      publicKey: publicKey,
-      type: processor.keyPairType,
-    );
-
-    return SimpleEd25519(keyPair: keypair);
-  }
-}

useragent/lib/main.dart

@@ -1,35 +1,122 @@
-import 'package:arbiter/router.dart';
+import 'package:flutter/material.dart';
-import 'package:flutter/material.dart' hide Router;
-import 'package:hooks_riverpod/hooks_riverpod.dart';
-import 'package:sizer/sizer.dart';
 
 void main() {
-  WidgetsFlutterBinding.ensureInitialized();
+  runApp(const MyApp());
-  runApp(const ProviderScope(child: App()));
 }
 
-class App extends StatefulWidget {
+class MyApp extends StatelessWidget {
-  const App({super.key});
+  const MyApp({super.key});
 
+  // This widget is the root of your application.
   @override
-  State<App> createState() => _AppState();
+  Widget build(BuildContext context) {
+    return MaterialApp(
+      title: 'Flutter Demo',
+      theme: ThemeData(
+        // This is the theme of your application.
+        //
+        // TRY THIS: Try running your application with "flutter run". You'll see
+        // the application has a purple toolbar. Then, without quitting the app,
+        // try changing the seedColor in the colorScheme below to Colors.green
+        // and then invoke "hot reload" (save your changes or press the "hot
+        // reload" button in a Flutter-supported IDE, or press "r" if you used
+        // the command line to start the app).
+        //
+        // Notice that the counter didn't reset back to zero; the application
+        // state is not lost during the reload. To reset the state, use hot
+        // restart instead.
+        //
+        // This works for code too, not just values: Most code changes can be
+        // tested with just a hot reload.
+        colorScheme: .fromSeed(seedColor: Colors.deepPurple),
+      ),
+      home: const MyHomePage(title: 'Flutter Demo Home Page'),
+    );
+  }
 }
 
-class _AppState extends State<App> {
+class MyHomePage extends StatefulWidget {
-  late final Router _router;
+  const MyHomePage({super.key, required this.title});
+
+  // This widget is the home page of your application. It is stateful, meaning
+  // that it has a State object (defined below) that contains fields that affect
+  // how it looks.
+
+  // This class is the configuration for the state. It holds the values (in this
+  // case the title) provided by the parent (in this case the App widget) and
+  // used by the build method of the State. Fields in a Widget subclass are
+  // always marked "final".
+
+  final String title;
 
   @override
-  void initState() {
+  State<MyHomePage> createState() => _MyHomePageState();
-    super.initState();
+}
-    _router = Router();
+
+class _MyHomePageState extends State<MyHomePage> {
+  int _counter = 0;
+
+  void _incrementCounter() {
+    setState(() {
+      // This call to setState tells the Flutter framework that something has
+      // changed in this State, which causes it to rerun the build method below
+      // so that the display can reflect the updated values. If we changed
+      // _counter without calling setState(), then the build method would not be
+      // called again, and so nothing would appear to happen.
+      _counter++;
+    });
   }
 
   @override
   Widget build(BuildContext context) {
-    return Sizer(
+    // This method is rerun every time setState is called, for instance as done
-      builder: (context, orientation, deviceType) {
+    // by the _incrementCounter method above.
-        return MaterialApp.router(routerConfig: _router.config());
+    //
-      },
+    // The Flutter framework has been optimized to make rerunning build methods
+    // fast, so that you can just rebuild anything that needs updating rather
+    // than having to individually change instances of widgets.
+    return Scaffold(
+      appBar: AppBar(
+        // TRY THIS: Try changing the color here to a specific color (to
+        // Colors.amber, perhaps?) and trigger a hot reload to see the AppBar
+        // change color while the other colors stay the same.
+        backgroundColor: Theme.of(context).colorScheme.inversePrimary,
+        // Here we take the value from the MyHomePage object that was created by
+        // the App.build method, and use it to set our appbar title.
+        title: Text(widget.title),
+      ),
+      body: Center(
+        // Center is a layout widget. It takes a single child and positions it
+        // in the middle of the parent.
+        child: Column(
+          // Column is also a layout widget. It takes a list of children and
+          // arranges them vertically. By default, it sizes itself to fit its
+          // children horizontally, and tries to be as tall as its parent.
+          //
+          // Column has various properties to control how it sizes itself and
+          // how it positions its children. Here we use mainAxisAlignment to
+          // center the children vertically; the main axis here is the vertical
+          // axis because Columns are vertical (the cross axis would be
+          // horizontal).
+          //
+          // TRY THIS: Invoke "debug painting" (choose the "Toggle Debug Paint"
+          // action in the IDE, or press "p" in the console), to see the
+          // wireframe for each widget.
+          mainAxisAlignment: .center,
+          children: [
+            const Text('You have pushed the button this many times:'),
+            Text(
+              '$_counter',
+              style: Theme.of(context).textTheme.headlineMedium,
+            ),
+          ],
+        ),
+      ),
+      floatingActionButton: FloatingActionButton(
+        onPressed: _incrementCounter,
+        tooltip: 'Increment',
+        child: const Icon(Icons.add),
+      ),
     );
   }
 }

useragent/lib/proto/arbiter.pb.dart

@@ -1,88 +0,0 @@
-// This is a generated file - do not edit.
-//
-// Generated from arbiter.proto.
-
-// @dart = 3.3
-
-// ignore_for_file: annotate_overrides, camel_case_types, comment_references
-// ignore_for_file: constant_identifier_names
-// ignore_for_file: curly_braces_in_flow_control_structures
-// ignore_for_file: deprecated_member_use_from_same_package, library_prefixes
-// ignore_for_file: non_constant_identifier_names, prefer_relative_imports
-
-import 'dart:core' as $core;
-
-import 'package:protobuf/protobuf.dart' as $pb;
-
-export 'package:protobuf/protobuf.dart' show GeneratedMessageGenericExtensions;
-
-class ServerInfo extends $pb.GeneratedMessage {
-  factory ServerInfo({
-    $core.String? version,
-    $core.List<$core.int>? certPublicKey,
-  }) {
-    final result = create();
-    if (version != null) result.version = version;
-    if (certPublicKey != null) result.certPublicKey = certPublicKey;
-    return result;
-  }
-
-  ServerInfo._();
-
-  factory ServerInfo.fromBuffer($core.List<$core.int> data,
-          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
-      create()..mergeFromBuffer(data, registry);
-  factory ServerInfo.fromJson($core.String json,
-          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
-      create()..mergeFromJson(json, registry);
-
-  static final $pb.BuilderInfo _i = $pb.BuilderInfo(
-      _omitMessageNames ? '' : 'ServerInfo',
-      package: const $pb.PackageName(_omitMessageNames ? '' : 'arbiter'),
-      createEmptyInstance: create)
-    ..aOS(1, _omitFieldNames ? '' : 'version')
-    ..a<$core.List<$core.int>>(
-        2, _omitFieldNames ? '' : 'certPublicKey', $pb.PbFieldType.OY)
-    ..hasRequiredFields = false;
-
-  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
-  ServerInfo clone() => deepCopy();
-  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
-  ServerInfo copyWith(void Function(ServerInfo) updates) =>
-      super.copyWith((message) => updates(message as ServerInfo)) as ServerInfo;
-
-  @$core.override
-  $pb.BuilderInfo get info_ => _i;
-
-  @$core.pragma('dart2js:noInline')
-  static ServerInfo create() => ServerInfo._();
-  @$core.override
-  ServerInfo createEmptyInstance() => create();
-  @$core.pragma('dart2js:noInline')
-  static ServerInfo getDefault() => _defaultInstance ??=
-      $pb.GeneratedMessage.$_defaultFor<ServerInfo>(create);
-  static ServerInfo? _defaultInstance;
-
-  @$pb.TagNumber(1)
-  $core.String get version => $_getSZ(0);
-  @$pb.TagNumber(1)
-  set version($core.String value) => $_setString(0, value);
-  @$pb.TagNumber(1)
-  $core.bool hasVersion() => $_has(0);
-  @$pb.TagNumber(1)
-  void clearVersion() => $_clearField(1);
-
-  @$pb.TagNumber(2)
-  $core.List<$core.int> get certPublicKey => $_getN(1);
-  @$pb.TagNumber(2)
-  set certPublicKey($core.List<$core.int> value) => $_setBytes(1, value);
-  @$pb.TagNumber(2)
-  $core.bool hasCertPublicKey() => $_has(1);
-  @$pb.TagNumber(2)
-  void clearCertPublicKey() => $_clearField(2);
-}
-
-const $core.bool _omitFieldNames =
-    $core.bool.fromEnvironment('protobuf.omit_field_names');
-const $core.bool _omitMessageNames =
-    $core.bool.fromEnvironment('protobuf.omit_message_names');

useragent/lib/proto/arbiter.pbenum.dart

@@ -1,11 +0,0 @@
-// This is a generated file - do not edit.
-//
-// Generated from arbiter.proto.
-
-// @dart = 3.3
-
-// ignore_for_file: annotate_overrides, camel_case_types, comment_references
-// ignore_for_file: constant_identifier_names
-// ignore_for_file: curly_braces_in_flow_control_structures
-// ignore_for_file: deprecated_member_use_from_same_package, library_prefixes
-// ignore_for_file: non_constant_identifier_names, prefer_relative_imports

useragent/lib/proto/arbiter.pbgrpc.dart

@@ -1,90 +0,0 @@
-// This is a generated file - do not edit.
-//
-// Generated from arbiter.proto.
-
-// @dart = 3.3
-
-// ignore_for_file: annotate_overrides, camel_case_types, comment_references
-// ignore_for_file: constant_identifier_names
-// ignore_for_file: curly_braces_in_flow_control_structures
-// ignore_for_file: deprecated_member_use_from_same_package, library_prefixes
-// ignore_for_file: non_constant_identifier_names, prefer_relative_imports
-
-import 'dart:async' as $async;
-import 'dart:core' as $core;
-
-import 'package:grpc/service_api.dart' as $grpc;
-import 'package:protobuf/protobuf.dart' as $pb;
-
-import 'client.pb.dart' as $0;
-import 'user_agent.pb.dart' as $1;
-
-export 'arbiter.pb.dart';
-
-@$pb.GrpcServiceName('arbiter.ArbiterService')
-class ArbiterServiceClient extends $grpc.Client {
-  /// The hostname for this service.
-  static const $core.String defaultHost = '';
-
-  /// OAuth scopes needed for the client.
-  static const $core.List<$core.String> oauthScopes = [
-    '',
-  ];
-
-  ArbiterServiceClient(super.channel, {super.options, super.interceptors});
-
-  $grpc.ResponseStream<$0.ClientResponse> client(
-    $async.Stream<$0.ClientRequest> request, {
-    $grpc.CallOptions? options,
-  }) {
-    return $createStreamingCall(_$client, request, options: options);
-  }
-
-  $grpc.ResponseStream<$1.UserAgentResponse> userAgent(
-    $async.Stream<$1.UserAgentRequest> request, {
-    $grpc.CallOptions? options,
-  }) {
-    return $createStreamingCall(_$userAgent, request, options: options);
-  }
-
-  // method descriptors
-
-  static final _$client =
-      $grpc.ClientMethod<$0.ClientRequest, $0.ClientResponse>(
-          '/arbiter.ArbiterService/Client',
-          ($0.ClientRequest value) => value.writeToBuffer(),
-          $0.ClientResponse.fromBuffer);
-  static final _$userAgent =
-      $grpc.ClientMethod<$1.UserAgentRequest, $1.UserAgentResponse>(
-          '/arbiter.ArbiterService/UserAgent',
-          ($1.UserAgentRequest value) => value.writeToBuffer(),
-          $1.UserAgentResponse.fromBuffer);
-}
-
-@$pb.GrpcServiceName('arbiter.ArbiterService')
-abstract class ArbiterServiceBase extends $grpc.Service {
-  $core.String get $name => 'arbiter.ArbiterService';
-
-  ArbiterServiceBase() {
-    $addMethod($grpc.ServiceMethod<$0.ClientRequest, $0.ClientResponse>(
-        'Client',
-        client,
-        true,
-        true,
-        ($core.List<$core.int> value) => $0.ClientRequest.fromBuffer(value),
-        ($0.ClientResponse value) => value.writeToBuffer()));
-    $addMethod($grpc.ServiceMethod<$1.UserAgentRequest, $1.UserAgentResponse>(
-        'UserAgent',
-        userAgent,
-        true,
-        true,
-        ($core.List<$core.int> value) => $1.UserAgentRequest.fromBuffer(value),
-        ($1.UserAgentResponse value) => value.writeToBuffer()));
-  }
-
-  $async.Stream<$0.ClientResponse> client(
-      $grpc.ServiceCall call, $async.Stream<$0.ClientRequest> request);
-
-  $async.Stream<$1.UserAgentResponse> userAgent(
-      $grpc.ServiceCall call, $async.Stream<$1.UserAgentRequest> request);
-}

useragent/lib/proto/arbiter.pbjson.dart

@@ -1,30 +0,0 @@
-// This is a generated file - do not edit.
-//
-// Generated from arbiter.proto.
-
-// @dart = 3.3
-
-// ignore_for_file: annotate_overrides, camel_case_types, comment_references
-// ignore_for_file: constant_identifier_names
-// ignore_for_file: curly_braces_in_flow_control_structures
-// ignore_for_file: deprecated_member_use_from_same_package, library_prefixes
-// ignore_for_file: non_constant_identifier_names, prefer_relative_imports
-// ignore_for_file: unused_import
-
-import 'dart:convert' as $convert;
-import 'dart:core' as $core;
-import 'dart:typed_data' as $typed_data;
-
-@$core.Deprecated('Use serverInfoDescriptor instead')
-const ServerInfo$json = {
-  '1': 'ServerInfo',
-  '2': [
-    {'1': 'version', '3': 1, '4': 1, '5': 9, '10': 'version'},
-    {'1': 'cert_public_key', '3': 2, '4': 1, '5': 12, '10': 'certPublicKey'},
-  ],
-};
-
-/// Descriptor for `ServerInfo`. Decode as a `google.protobuf.DescriptorProto`.
-final $typed_data.Uint8List serverInfoDescriptor = $convert.base64Decode(
-    'CgpTZXJ2ZXJJbmZvEhgKB3ZlcnNpb24YASABKAlSB3ZlcnNpb24SJgoPY2VydF9wdWJsaWNfa2'
-    'V5GAIgASgMUg1jZXJ0UHVibGljS2V5');

useragent/lib/proto/client.pb.dart

@@ -1,551 +0,0 @@
-// This is a generated file - do not edit.
-//
-// Generated from client.proto.
-
-// @dart = 3.3
-
-// ignore_for_file: annotate_overrides, camel_case_types, comment_references
-// ignore_for_file: constant_identifier_names
-// ignore_for_file: curly_braces_in_flow_control_structures
-// ignore_for_file: deprecated_member_use_from_same_package, library_prefixes
-// ignore_for_file: non_constant_identifier_names, prefer_relative_imports
-
-import 'dart:core' as $core;
-
-import 'package:protobuf/protobuf.dart' as $pb;
-
-import 'client.pbenum.dart';
-import 'evm.pb.dart' as $0;
-
-export 'package:protobuf/protobuf.dart' show GeneratedMessageGenericExtensions;
-
-export 'client.pbenum.dart';
-
-class AuthChallengeRequest extends $pb.GeneratedMessage {
-  factory AuthChallengeRequest({
-    $core.List<$core.int>? pubkey,
-  }) {
-    final result = create();
-    if (pubkey != null) result.pubkey = pubkey;
-    return result;
-  }
-
-  AuthChallengeRequest._();
-
-  factory AuthChallengeRequest.fromBuffer($core.List<$core.int> data,
-          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
-      create()..mergeFromBuffer(data, registry);
-  factory AuthChallengeRequest.fromJson($core.String json,
-          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
-      create()..mergeFromJson(json, registry);
-
-  static final $pb.BuilderInfo _i = $pb.BuilderInfo(
-      _omitMessageNames ? '' : 'AuthChallengeRequest',
-      package: const $pb.PackageName(_omitMessageNames ? '' : 'arbiter.client'),
-      createEmptyInstance: create)
-    ..a<$core.List<$core.int>>(
-        1, _omitFieldNames ? '' : 'pubkey', $pb.PbFieldType.OY)
-    ..hasRequiredFields = false;
-
-  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
-  AuthChallengeRequest clone() => deepCopy();
-  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
-  AuthChallengeRequest copyWith(void Function(AuthChallengeRequest) updates) =>
-      super.copyWith((message) => updates(message as AuthChallengeRequest))
-          as AuthChallengeRequest;
-
-  @$core.override
-  $pb.BuilderInfo get info_ => _i;
-
-  @$core.pragma('dart2js:noInline')
-  static AuthChallengeRequest create() => AuthChallengeRequest._();
-  @$core.override
-  AuthChallengeRequest createEmptyInstance() => create();
-  @$core.pragma('dart2js:noInline')
-  static AuthChallengeRequest getDefault() => _defaultInstance ??=
-      $pb.GeneratedMessage.$_defaultFor<AuthChallengeRequest>(create);
-  static AuthChallengeRequest? _defaultInstance;
-
-  @$pb.TagNumber(1)
-  $core.List<$core.int> get pubkey => $_getN(0);
-  @$pb.TagNumber(1)
-  set pubkey($core.List<$core.int> value) => $_setBytes(0, value);
-  @$pb.TagNumber(1)
-  $core.bool hasPubkey() => $_has(0);
-  @$pb.TagNumber(1)
-  void clearPubkey() => $_clearField(1);
-}
-
-class AuthChallenge extends $pb.GeneratedMessage {
-  factory AuthChallenge({
-    $core.List<$core.int>? pubkey,
-    $core.int? nonce,
-  }) {
-    final result = create();
-    if (pubkey != null) result.pubkey = pubkey;
-    if (nonce != null) result.nonce = nonce;
-    return result;
-  }
-
-  AuthChallenge._();
-
-  factory AuthChallenge.fromBuffer($core.List<$core.int> data,
-          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
-      create()..mergeFromBuffer(data, registry);
-  factory AuthChallenge.fromJson($core.String json,
-          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
-      create()..mergeFromJson(json, registry);
-
-  static final $pb.BuilderInfo _i = $pb.BuilderInfo(
-      _omitMessageNames ? '' : 'AuthChallenge',
-      package: const $pb.PackageName(_omitMessageNames ? '' : 'arbiter.client'),
-      createEmptyInstance: create)
-    ..a<$core.List<$core.int>>(
-        1, _omitFieldNames ? '' : 'pubkey', $pb.PbFieldType.OY)
-    ..aI(2, _omitFieldNames ? '' : 'nonce')
-    ..hasRequiredFields = false;
-
-  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
-  AuthChallenge clone() => deepCopy();
-  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
-  AuthChallenge copyWith(void Function(AuthChallenge) updates) =>
-      super.copyWith((message) => updates(message as AuthChallenge))
-          as AuthChallenge;
-
-  @$core.override
-  $pb.BuilderInfo get info_ => _i;
-
-  @$core.pragma('dart2js:noInline')
-  static AuthChallenge create() => AuthChallenge._();
-  @$core.override
-  AuthChallenge createEmptyInstance() => create();
-  @$core.pragma('dart2js:noInline')
-  static AuthChallenge getDefault() => _defaultInstance ??=
-      $pb.GeneratedMessage.$_defaultFor<AuthChallenge>(create);
-  static AuthChallenge? _defaultInstance;
-
-  @$pb.TagNumber(1)
-  $core.List<$core.int> get pubkey => $_getN(0);
-  @$pb.TagNumber(1)
-  set pubkey($core.List<$core.int> value) => $_setBytes(0, value);
-  @$pb.TagNumber(1)
-  $core.bool hasPubkey() => $_has(0);
-  @$pb.TagNumber(1)
-  void clearPubkey() => $_clearField(1);
-
-  @$pb.TagNumber(2)
-  $core.int get nonce => $_getIZ(1);
-  @$pb.TagNumber(2)
-  set nonce($core.int value) => $_setSignedInt32(1, value);
-  @$pb.TagNumber(2)
-  $core.bool hasNonce() => $_has(1);
-  @$pb.TagNumber(2)
-  void clearNonce() => $_clearField(2);
-}
-
-class AuthChallengeSolution extends $pb.GeneratedMessage {
-  factory AuthChallengeSolution({
-    $core.List<$core.int>? signature,
-  }) {
-    final result = create();
-    if (signature != null) result.signature = signature;
-    return result;
-  }
-
-  AuthChallengeSolution._();
-
-  factory AuthChallengeSolution.fromBuffer($core.List<$core.int> data,
-          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
-      create()..mergeFromBuffer(data, registry);
-  factory AuthChallengeSolution.fromJson($core.String json,
-          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
-      create()..mergeFromJson(json, registry);
-
-  static final $pb.BuilderInfo _i = $pb.BuilderInfo(
-      _omitMessageNames ? '' : 'AuthChallengeSolution',
-      package: const $pb.PackageName(_omitMessageNames ? '' : 'arbiter.client'),
-      createEmptyInstance: create)
-    ..a<$core.List<$core.int>>(
-        1, _omitFieldNames ? '' : 'signature', $pb.PbFieldType.OY)
-    ..hasRequiredFields = false;
-
-  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
-  AuthChallengeSolution clone() => deepCopy();
-  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
-  AuthChallengeSolution copyWith(
-          void Function(AuthChallengeSolution) updates) =>
-      super.copyWith((message) => updates(message as AuthChallengeSolution))
-          as AuthChallengeSolution;
-
-  @$core.override
-  $pb.BuilderInfo get info_ => _i;
-
-  @$core.pragma('dart2js:noInline')
-  static AuthChallengeSolution create() => AuthChallengeSolution._();
-  @$core.override
-  AuthChallengeSolution createEmptyInstance() => create();
-  @$core.pragma('dart2js:noInline')
-  static AuthChallengeSolution getDefault() => _defaultInstance ??=
-      $pb.GeneratedMessage.$_defaultFor<AuthChallengeSolution>(create);
-  static AuthChallengeSolution? _defaultInstance;
-
-  @$pb.TagNumber(1)
-  $core.List<$core.int> get signature => $_getN(0);
-  @$pb.TagNumber(1)
-  set signature($core.List<$core.int> value) => $_setBytes(0, value);
-  @$pb.TagNumber(1)
-  $core.bool hasSignature() => $_has(0);
-  @$pb.TagNumber(1)
-  void clearSignature() => $_clearField(1);
-}
-
-class AuthOk extends $pb.GeneratedMessage {
-  factory AuthOk() => create();
-
-  AuthOk._();
-
-  factory AuthOk.fromBuffer($core.List<$core.int> data,
-          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
-      create()..mergeFromBuffer(data, registry);
-  factory AuthOk.fromJson($core.String json,
-          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
-      create()..mergeFromJson(json, registry);
-
-  static final $pb.BuilderInfo _i = $pb.BuilderInfo(
-      _omitMessageNames ? '' : 'AuthOk',
-      package: const $pb.PackageName(_omitMessageNames ? '' : 'arbiter.client'),
-      createEmptyInstance: create)
-    ..hasRequiredFields = false;
-
-  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
-  AuthOk clone() => deepCopy();
-  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
-  AuthOk copyWith(void Function(AuthOk) updates) =>
-      super.copyWith((message) => updates(message as AuthOk)) as AuthOk;
-
-  @$core.override
-  $pb.BuilderInfo get info_ => _i;
-
-  @$core.pragma('dart2js:noInline')
-  static AuthOk create() => AuthOk._();
-  @$core.override
-  AuthOk createEmptyInstance() => create();
-  @$core.pragma('dart2js:noInline')
-  static AuthOk getDefault() =>
-      _defaultInstance ??= $pb.GeneratedMessage.$_defaultFor<AuthOk>(create);
-  static AuthOk? _defaultInstance;
-}
-
-enum ClientRequest_Payload {
-  authChallengeRequest,
-  authChallengeSolution,
-  notSet
-}
-
-class ClientRequest extends $pb.GeneratedMessage {
-  factory ClientRequest({
-    AuthChallengeRequest? authChallengeRequest,
-    AuthChallengeSolution? authChallengeSolution,
-  }) {
-    final result = create();
-    if (authChallengeRequest != null)
-      result.authChallengeRequest = authChallengeRequest;
-    if (authChallengeSolution != null)
-      result.authChallengeSolution = authChallengeSolution;
-    return result;
-  }
-
-  ClientRequest._();
-
-  factory ClientRequest.fromBuffer($core.List<$core.int> data,
-          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
-      create()..mergeFromBuffer(data, registry);
-  factory ClientRequest.fromJson($core.String json,
-          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
-      create()..mergeFromJson(json, registry);
-
-  static const $core.Map<$core.int, ClientRequest_Payload>
-      _ClientRequest_PayloadByTag = {
-    1: ClientRequest_Payload.authChallengeRequest,
-    2: ClientRequest_Payload.authChallengeSolution,
-    0: ClientRequest_Payload.notSet
-  };
-  static final $pb.BuilderInfo _i = $pb.BuilderInfo(
-      _omitMessageNames ? '' : 'ClientRequest',
-      package: const $pb.PackageName(_omitMessageNames ? '' : 'arbiter.client'),
-      createEmptyInstance: create)
-    ..oo(0, [1, 2])
-    ..aOM<AuthChallengeRequest>(
-        1, _omitFieldNames ? '' : 'authChallengeRequest',
-        subBuilder: AuthChallengeRequest.create)
-    ..aOM<AuthChallengeSolution>(
-        2, _omitFieldNames ? '' : 'authChallengeSolution',
-        subBuilder: AuthChallengeSolution.create)
-    ..hasRequiredFields = false;
-
-  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
-  ClientRequest clone() => deepCopy();
-  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
-  ClientRequest copyWith(void Function(ClientRequest) updates) =>
-      super.copyWith((message) => updates(message as ClientRequest))
-          as ClientRequest;
-
-  @$core.override
-  $pb.BuilderInfo get info_ => _i;
-
-  @$core.pragma('dart2js:noInline')
-  static ClientRequest create() => ClientRequest._();
-  @$core.override
-  ClientRequest createEmptyInstance() => create();
-  @$core.pragma('dart2js:noInline')
-  static ClientRequest getDefault() => _defaultInstance ??=
-      $pb.GeneratedMessage.$_defaultFor<ClientRequest>(create);
-  static ClientRequest? _defaultInstance;
-
-  @$pb.TagNumber(1)
-  @$pb.TagNumber(2)
-  ClientRequest_Payload whichPayload() =>
-      _ClientRequest_PayloadByTag[$_whichOneof(0)]!;
-  @$pb.TagNumber(1)
-  @$pb.TagNumber(2)
-  void clearPayload() => $_clearField($_whichOneof(0));
-
-  @$pb.TagNumber(1)
-  AuthChallengeRequest get authChallengeRequest => $_getN(0);
-  @$pb.TagNumber(1)
-  set authChallengeRequest(AuthChallengeRequest value) => $_setField(1, value);
-  @$pb.TagNumber(1)
-  $core.bool hasAuthChallengeRequest() => $_has(0);
-  @$pb.TagNumber(1)
-  void clearAuthChallengeRequest() => $_clearField(1);
-  @$pb.TagNumber(1)
-  AuthChallengeRequest ensureAuthChallengeRequest() => $_ensure(0);
-
-  @$pb.TagNumber(2)
-  AuthChallengeSolution get authChallengeSolution => $_getN(1);
-  @$pb.TagNumber(2)
-  set authChallengeSolution(AuthChallengeSolution value) =>
-      $_setField(2, value);
-  @$pb.TagNumber(2)
-  $core.bool hasAuthChallengeSolution() => $_has(1);
-  @$pb.TagNumber(2)
-  void clearAuthChallengeSolution() => $_clearField(2);
-  @$pb.TagNumber(2)
-  AuthChallengeSolution ensureAuthChallengeSolution() => $_ensure(1);
-}
-
-class ClientConnectError extends $pb.GeneratedMessage {
-  factory ClientConnectError({
-    ClientConnectError_Code? code,
-  }) {
-    final result = create();
-    if (code != null) result.code = code;
-    return result;
-  }
-
-  ClientConnectError._();
-
-  factory ClientConnectError.fromBuffer($core.List<$core.int> data,
-          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
-      create()..mergeFromBuffer(data, registry);
-  factory ClientConnectError.fromJson($core.String json,
-          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
-      create()..mergeFromJson(json, registry);
-
-  static final $pb.BuilderInfo _i = $pb.BuilderInfo(
-      _omitMessageNames ? '' : 'ClientConnectError',
-      package: const $pb.PackageName(_omitMessageNames ? '' : 'arbiter.client'),
-      createEmptyInstance: create)
-    ..aE<ClientConnectError_Code>(1, _omitFieldNames ? '' : 'code',
-        enumValues: ClientConnectError_Code.values)
-    ..hasRequiredFields = false;
-
-  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
-  ClientConnectError clone() => deepCopy();
-  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
-  ClientConnectError copyWith(void Function(ClientConnectError) updates) =>
-      super.copyWith((message) => updates(message as ClientConnectError))
-          as ClientConnectError;
-
-  @$core.override
-  $pb.BuilderInfo get info_ => _i;
-
-  @$core.pragma('dart2js:noInline')
-  static ClientConnectError create() => ClientConnectError._();
-  @$core.override
-  ClientConnectError createEmptyInstance() => create();
-  @$core.pragma('dart2js:noInline')
-  static ClientConnectError getDefault() => _defaultInstance ??=
-      $pb.GeneratedMessage.$_defaultFor<ClientConnectError>(create);
-  static ClientConnectError? _defaultInstance;
-
-  @$pb.TagNumber(1)
-  ClientConnectError_Code get code => $_getN(0);
-  @$pb.TagNumber(1)
-  set code(ClientConnectError_Code value) => $_setField(1, value);
-  @$pb.TagNumber(1)
-  $core.bool hasCode() => $_has(0);
-  @$pb.TagNumber(1)
-  void clearCode() => $_clearField(1);
-}
-
-enum ClientResponse_Payload {
-  authChallenge,
-  authOk,
-  evmSignTransaction,
-  evmAnalyzeTransaction,
-  clientConnectError,
-  notSet
-}
-
-class ClientResponse extends $pb.GeneratedMessage {
-  factory ClientResponse({
-    AuthChallenge? authChallenge,
-    AuthOk? authOk,
-    $0.EvmSignTransactionResponse? evmSignTransaction,
-    $0.EvmAnalyzeTransactionResponse? evmAnalyzeTransaction,
-    ClientConnectError? clientConnectError,
-  }) {
-    final result = create();
-    if (authChallenge != null) result.authChallenge = authChallenge;
-    if (authOk != null) result.authOk = authOk;
-    if (evmSignTransaction != null)
-      result.evmSignTransaction = evmSignTransaction;
-    if (evmAnalyzeTransaction != null)
-      result.evmAnalyzeTransaction = evmAnalyzeTransaction;
-    if (clientConnectError != null)
-      result.clientConnectError = clientConnectError;
-    return result;
-  }
-
-  ClientResponse._();
-
-  factory ClientResponse.fromBuffer($core.List<$core.int> data,
-          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
-      create()..mergeFromBuffer(data, registry);
-  factory ClientResponse.fromJson($core.String json,
-          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
-      create()..mergeFromJson(json, registry);
-
-  static const $core.Map<$core.int, ClientResponse_Payload>
-      _ClientResponse_PayloadByTag = {
-    1: ClientResponse_Payload.authChallenge,
-    2: ClientResponse_Payload.authOk,
-    3: ClientResponse_Payload.evmSignTransaction,
-    4: ClientResponse_Payload.evmAnalyzeTransaction,
-    5: ClientResponse_Payload.clientConnectError,
-    0: ClientResponse_Payload.notSet
-  };
-  static final $pb.BuilderInfo _i = $pb.BuilderInfo(
-      _omitMessageNames ? '' : 'ClientResponse',
-      package: const $pb.PackageName(_omitMessageNames ? '' : 'arbiter.client'),
-      createEmptyInstance: create)
-    ..oo(0, [1, 2, 3, 4, 5])
-    ..aOM<AuthChallenge>(1, _omitFieldNames ? '' : 'authChallenge',
-        subBuilder: AuthChallenge.create)
-    ..aOM<AuthOk>(2, _omitFieldNames ? '' : 'authOk', subBuilder: AuthOk.create)
-    ..aOM<$0.EvmSignTransactionResponse>(
-        3, _omitFieldNames ? '' : 'evmSignTransaction',
-        subBuilder: $0.EvmSignTransactionResponse.create)
-    ..aOM<$0.EvmAnalyzeTransactionResponse>(
-        4, _omitFieldNames ? '' : 'evmAnalyzeTransaction',
-        subBuilder: $0.EvmAnalyzeTransactionResponse.create)
-    ..aOM<ClientConnectError>(5, _omitFieldNames ? '' : 'clientConnectError',
-        subBuilder: ClientConnectError.create)
-    ..hasRequiredFields = false;
-
-  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
-  ClientResponse clone() => deepCopy();
-  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
-  ClientResponse copyWith(void Function(ClientResponse) updates) =>
-      super.copyWith((message) => updates(message as ClientResponse))
-          as ClientResponse;
-
-  @$core.override
-  $pb.BuilderInfo get info_ => _i;
-
-  @$core.pragma('dart2js:noInline')
-  static ClientResponse create() => ClientResponse._();
-  @$core.override
-  ClientResponse createEmptyInstance() => create();
-  @$core.pragma('dart2js:noInline')
-  static ClientResponse getDefault() => _defaultInstance ??=
-      $pb.GeneratedMessage.$_defaultFor<ClientResponse>(create);
-  static ClientResponse? _defaultInstance;
-
-  @$pb.TagNumber(1)
-  @$pb.TagNumber(2)
-  @$pb.TagNumber(3)
-  @$pb.TagNumber(4)
-  @$pb.TagNumber(5)
-  ClientResponse_Payload whichPayload() =>
-      _ClientResponse_PayloadByTag[$_whichOneof(0)]!;
-  @$pb.TagNumber(1)
-  @$pb.TagNumber(2)
-  @$pb.TagNumber(3)
-  @$pb.TagNumber(4)
-  @$pb.TagNumber(5)
-  void clearPayload() => $_clearField($_whichOneof(0));
-
-  @$pb.TagNumber(1)
-  AuthChallenge get authChallenge => $_getN(0);
-  @$pb.TagNumber(1)
-  set authChallenge(AuthChallenge value) => $_setField(1, value);
-  @$pb.TagNumber(1)
-  $core.bool hasAuthChallenge() => $_has(0);
-  @$pb.TagNumber(1)
-  void clearAuthChallenge() => $_clearField(1);
-  @$pb.TagNumber(1)
-  AuthChallenge ensureAuthChallenge() => $_ensure(0);
-
-  @$pb.TagNumber(2)
-  AuthOk get authOk => $_getN(1);
-  @$pb.TagNumber(2)
-  set authOk(AuthOk value) => $_setField(2, value);
-  @$pb.TagNumber(2)
-  $core.bool hasAuthOk() => $_has(1);
-  @$pb.TagNumber(2)
-  void clearAuthOk() => $_clearField(2);
-  @$pb.TagNumber(2)
-  AuthOk ensureAuthOk() => $_ensure(1);
-
-  @$pb.TagNumber(3)
-  $0.EvmSignTransactionResponse get evmSignTransaction => $_getN(2);
-  @$pb.TagNumber(3)
-  set evmSignTransaction($0.EvmSignTransactionResponse value) =>
-      $_setField(3, value);
-  @$pb.TagNumber(3)
-  $core.bool hasEvmSignTransaction() => $_has(2);
-  @$pb.TagNumber(3)
-  void clearEvmSignTransaction() => $_clearField(3);
-  @$pb.TagNumber(3)
-  $0.EvmSignTransactionResponse ensureEvmSignTransaction() => $_ensure(2);
-
-  @$pb.TagNumber(4)
-  $0.EvmAnalyzeTransactionResponse get evmAnalyzeTransaction => $_getN(3);
-  @$pb.TagNumber(4)
-  set evmAnalyzeTransaction($0.EvmAnalyzeTransactionResponse value) =>
-      $_setField(4, value);
-  @$pb.TagNumber(4)
-  $core.bool hasEvmAnalyzeTransaction() => $_has(3);
-  @$pb.TagNumber(4)
-  void clearEvmAnalyzeTransaction() => $_clearField(4);
-  @$pb.TagNumber(4)
-  $0.EvmAnalyzeTransactionResponse ensureEvmAnalyzeTransaction() => $_ensure(3);
-
-  @$pb.TagNumber(5)
-  ClientConnectError get clientConnectError => $_getN(4);
-  @$pb.TagNumber(5)
-  set clientConnectError(ClientConnectError value) => $_setField(5, value);
-  @$pb.TagNumber(5)
-  $core.bool hasClientConnectError() => $_has(4);
-  @$pb.TagNumber(5)
-  void clearClientConnectError() => $_clearField(5);
-  @$pb.TagNumber(5)
-  ClientConnectError ensureClientConnectError() => $_ensure(4);
-}
-
-const $core.bool _omitFieldNames =
-    $core.bool.fromEnvironment('protobuf.omit_field_names');
-const $core.bool _omitMessageNames =
-    $core.bool.fromEnvironment('protobuf.omit_message_names');

useragent/lib/proto/client.pbenum.dart

@@ -1,42 +0,0 @@
-// This is a generated file - do not edit.
-//
-// Generated from client.proto.
-
-// @dart = 3.3
-
-// ignore_for_file: annotate_overrides, camel_case_types, comment_references
-// ignore_for_file: constant_identifier_names
-// ignore_for_file: curly_braces_in_flow_control_structures
-// ignore_for_file: deprecated_member_use_from_same_package, library_prefixes
-// ignore_for_file: non_constant_identifier_names, prefer_relative_imports
-
-import 'dart:core' as $core;
-
-import 'package:protobuf/protobuf.dart' as $pb;
-
-class ClientConnectError_Code extends $pb.ProtobufEnum {
-  static const ClientConnectError_Code UNKNOWN =
-      ClientConnectError_Code._(0, _omitEnumNames ? '' : 'UNKNOWN');
-  static const ClientConnectError_Code APPROVAL_DENIED =
-      ClientConnectError_Code._(1, _omitEnumNames ? '' : 'APPROVAL_DENIED');
-  static const ClientConnectError_Code NO_USER_AGENTS_ONLINE =
-      ClientConnectError_Code._(
-          2, _omitEnumNames ? '' : 'NO_USER_AGENTS_ONLINE');
-
-  static const $core.List<ClientConnectError_Code> values =
-      <ClientConnectError_Code>[
-    UNKNOWN,
-    APPROVAL_DENIED,
-    NO_USER_AGENTS_ONLINE,
-  ];
-
-  static final $core.List<ClientConnectError_Code?> _byValue =
-      $pb.ProtobufEnum.$_initByValueList(values, 2);
-  static ClientConnectError_Code? valueOf($core.int value) =>
-      value < 0 || value >= _byValue.length ? null : _byValue[value];
-
-  const ClientConnectError_Code._(super.value, super.name);
-}
-
-const $core.bool _omitEnumNames =
-    $core.bool.fromEnvironment('protobuf.omit_enum_names');

useragent/lib/proto/client.pbjson.dart

@@ -1,197 +0,0 @@
-// This is a generated file - do not edit.
-//
-// Generated from client.proto.
-
-// @dart = 3.3
-
-// ignore_for_file: annotate_overrides, camel_case_types, comment_references
-// ignore_for_file: constant_identifier_names
-// ignore_for_file: curly_braces_in_flow_control_structures
-// ignore_for_file: deprecated_member_use_from_same_package, library_prefixes
-// ignore_for_file: non_constant_identifier_names, prefer_relative_imports
-// ignore_for_file: unused_import
-
-import 'dart:convert' as $convert;
-import 'dart:core' as $core;
-import 'dart:typed_data' as $typed_data;
-
-@$core.Deprecated('Use authChallengeRequestDescriptor instead')
-const AuthChallengeRequest$json = {
-  '1': 'AuthChallengeRequest',
-  '2': [
-    {'1': 'pubkey', '3': 1, '4': 1, '5': 12, '10': 'pubkey'},
-  ],
-};
-
-/// Descriptor for `AuthChallengeRequest`. Decode as a `google.protobuf.DescriptorProto`.
-final $typed_data.Uint8List authChallengeRequestDescriptor =
-    $convert.base64Decode(
-        'ChRBdXRoQ2hhbGxlbmdlUmVxdWVzdBIWCgZwdWJrZXkYASABKAxSBnB1YmtleQ==');
-
-@$core.Deprecated('Use authChallengeDescriptor instead')
-const AuthChallenge$json = {
-  '1': 'AuthChallenge',
-  '2': [
-    {'1': 'pubkey', '3': 1, '4': 1, '5': 12, '10': 'pubkey'},
-    {'1': 'nonce', '3': 2, '4': 1, '5': 5, '10': 'nonce'},
-  ],
-};
-
-/// Descriptor for `AuthChallenge`. Decode as a `google.protobuf.DescriptorProto`.
-final $typed_data.Uint8List authChallengeDescriptor = $convert.base64Decode(
-    'Cg1BdXRoQ2hhbGxlbmdlEhYKBnB1YmtleRgBIAEoDFIGcHVia2V5EhQKBW5vbmNlGAIgASgFUg'
-    'Vub25jZQ==');
-
-@$core.Deprecated('Use authChallengeSolutionDescriptor instead')
-const AuthChallengeSolution$json = {
-  '1': 'AuthChallengeSolution',
-  '2': [
-    {'1': 'signature', '3': 1, '4': 1, '5': 12, '10': 'signature'},
-  ],
-};
-
-/// Descriptor for `AuthChallengeSolution`. Decode as a `google.protobuf.DescriptorProto`.
-final $typed_data.Uint8List authChallengeSolutionDescriptor = $convert.base64Decode(
-    'ChVBdXRoQ2hhbGxlbmdlU29sdXRpb24SHAoJc2lnbmF0dXJlGAEgASgMUglzaWduYXR1cmU=');
-
-@$core.Deprecated('Use authOkDescriptor instead')
-const AuthOk$json = {
-  '1': 'AuthOk',
-};
-
-/// Descriptor for `AuthOk`. Decode as a `google.protobuf.DescriptorProto`.
-final $typed_data.Uint8List authOkDescriptor =
-    $convert.base64Decode('CgZBdXRoT2s=');
-
-@$core.Deprecated('Use clientRequestDescriptor instead')
-const ClientRequest$json = {
-  '1': 'ClientRequest',
-  '2': [
-    {
-      '1': 'auth_challenge_request',
-      '3': 1,
-      '4': 1,
-      '5': 11,
-      '6': '.arbiter.client.AuthChallengeRequest',
-      '9': 0,
-      '10': 'authChallengeRequest'
-    },
-    {
-      '1': 'auth_challenge_solution',
-      '3': 2,
-      '4': 1,
-      '5': 11,
-      '6': '.arbiter.client.AuthChallengeSolution',
-      '9': 0,
-      '10': 'authChallengeSolution'
-    },
-  ],
-  '8': [
-    {'1': 'payload'},
-  ],
-};
-
-/// Descriptor for `ClientRequest`. Decode as a `google.protobuf.DescriptorProto`.
-final $typed_data.Uint8List clientRequestDescriptor = $convert.base64Decode(
-    'Cg1DbGllbnRSZXF1ZXN0ElwKFmF1dGhfY2hhbGxlbmdlX3JlcXVlc3QYASABKAsyJC5hcmJpdG'
-    'VyLmNsaWVudC5BdXRoQ2hhbGxlbmdlUmVxdWVzdEgAUhRhdXRoQ2hhbGxlbmdlUmVxdWVzdBJf'
-    'ChdhdXRoX2NoYWxsZW5nZV9zb2x1dGlvbhgCIAEoCzIlLmFyYml0ZXIuY2xpZW50LkF1dGhDaG'
-    'FsbGVuZ2VTb2x1dGlvbkgAUhVhdXRoQ2hhbGxlbmdlU29sdXRpb25CCQoHcGF5bG9hZA==');
-
-@$core.Deprecated('Use clientConnectErrorDescriptor instead')
-const ClientConnectError$json = {
-  '1': 'ClientConnectError',
-  '2': [
-    {
-      '1': 'code',
-      '3': 1,
-      '4': 1,
-      '5': 14,
-      '6': '.arbiter.client.ClientConnectError.Code',
-      '10': 'code'
-    },
-  ],
-  '4': [ClientConnectError_Code$json],
-};
-
-@$core.Deprecated('Use clientConnectErrorDescriptor instead')
-const ClientConnectError_Code$json = {
-  '1': 'Code',
-  '2': [
-    {'1': 'UNKNOWN', '2': 0},
-    {'1': 'APPROVAL_DENIED', '2': 1},
-    {'1': 'NO_USER_AGENTS_ONLINE', '2': 2},
-  ],
-};
-
-/// Descriptor for `ClientConnectError`. Decode as a `google.protobuf.DescriptorProto`.
-final $typed_data.Uint8List clientConnectErrorDescriptor = $convert.base64Decode(
-    'ChJDbGllbnRDb25uZWN0RXJyb3ISOwoEY29kZRgBIAEoDjInLmFyYml0ZXIuY2xpZW50LkNsaW'
-    'VudENvbm5lY3RFcnJvci5Db2RlUgRjb2RlIkMKBENvZGUSCwoHVU5LTk9XThAAEhMKD0FQUFJP'
-    'VkFMX0RFTklFRBABEhkKFU5PX1VTRVJfQUdFTlRTX09OTElORRAC');
-
-@$core.Deprecated('Use clientResponseDescriptor instead')
-const ClientResponse$json = {
-  '1': 'ClientResponse',
-  '2': [
-    {
-      '1': 'auth_challenge',
-      '3': 1,
-      '4': 1,
-      '5': 11,
-      '6': '.arbiter.client.AuthChallenge',
-      '9': 0,
-      '10': 'authChallenge'
-    },
-    {
-      '1': 'auth_ok',
-      '3': 2,
-      '4': 1,
-      '5': 11,
-      '6': '.arbiter.client.AuthOk',
-      '9': 0,
-      '10': 'authOk'
-    },
-    {
-      '1': 'client_connect_error',
-      '3': 5,
-      '4': 1,
-      '5': 11,
-      '6': '.arbiter.client.ClientConnectError',
-      '9': 0,
-      '10': 'clientConnectError'
-    },
-    {
-      '1': 'evm_sign_transaction',
-      '3': 3,
-      '4': 1,
-      '5': 11,
-      '6': '.arbiter.evm.EvmSignTransactionResponse',
-      '9': 0,
-      '10': 'evmSignTransaction'
-    },
-    {
-      '1': 'evm_analyze_transaction',
-      '3': 4,
-      '4': 1,
-      '5': 11,
-      '6': '.arbiter.evm.EvmAnalyzeTransactionResponse',
-      '9': 0,
-      '10': 'evmAnalyzeTransaction'
-    },
-  ],
-  '8': [
-    {'1': 'payload'},
-  ],
-};
-
-/// Descriptor for `ClientResponse`. Decode as a `google.protobuf.DescriptorProto`.
-final $typed_data.Uint8List clientResponseDescriptor = $convert.base64Decode(
-    'Cg5DbGllbnRSZXNwb25zZRJGCg5hdXRoX2NoYWxsZW5nZRgBIAEoCzIdLmFyYml0ZXIuY2xpZW'
-    '50LkF1dGhDaGFsbGVuZ2VIAFINYXV0aENoYWxsZW5nZRIxCgdhdXRoX29rGAIgASgLMhYuYXJi'
-    'aXRlci5jbGllbnQuQXV0aE9rSABSBmF1dGhPaxJWChRjbGllbnRfY29ubmVjdF9lcnJvchgFIA'
-    'EoCzIiLmFyYml0ZXIuY2xpZW50LkNsaWVudENvbm5lY3RFcnJvckgAUhJjbGllbnRDb25uZWN0'
-    'RXJyb3ISWwoUZXZtX3NpZ25fdHJhbnNhY3Rpb24YAyABKAsyJy5hcmJpdGVyLmV2bS5Fdm1TaW'
-    'duVHJhbnNhY3Rpb25SZXNwb25zZUgAUhJldm1TaWduVHJhbnNhY3Rpb24SZAoXZXZtX2FuYWx5'
-    'emVfdHJhbnNhY3Rpb24YBCABKAsyKi5hcmJpdGVyLmV2bS5Fdm1BbmFseXplVHJhbnNhY3Rpb2'
-    '5SZXNwb25zZUgAUhVldm1BbmFseXplVHJhbnNhY3Rpb25CCQoHcGF5bG9hZA==');

useragent/lib/proto/evm.pbenum.dart

@@ -1,40 +0,0 @@
-// This is a generated file - do not edit.
-//
-// Generated from evm.proto.
-
-// @dart = 3.3
-
-// ignore_for_file: annotate_overrides, camel_case_types, comment_references
-// ignore_for_file: constant_identifier_names
-// ignore_for_file: curly_braces_in_flow_control_structures
-// ignore_for_file: deprecated_member_use_from_same_package, library_prefixes
-// ignore_for_file: non_constant_identifier_names, prefer_relative_imports
-
-import 'dart:core' as $core;
-
-import 'package:protobuf/protobuf.dart' as $pb;
-
-class EvmError extends $pb.ProtobufEnum {
-  static const EvmError EVM_ERROR_UNSPECIFIED =
-      EvmError._(0, _omitEnumNames ? '' : 'EVM_ERROR_UNSPECIFIED');
-  static const EvmError EVM_ERROR_VAULT_SEALED =
-      EvmError._(1, _omitEnumNames ? '' : 'EVM_ERROR_VAULT_SEALED');
-  static const EvmError EVM_ERROR_INTERNAL =
-      EvmError._(2, _omitEnumNames ? '' : 'EVM_ERROR_INTERNAL');
-
-  static const $core.List<EvmError> values = <EvmError>[
-    EVM_ERROR_UNSPECIFIED,
-    EVM_ERROR_VAULT_SEALED,
-    EVM_ERROR_INTERNAL,
-  ];
-
-  static final $core.List<EvmError?> _byValue =
-      $pb.ProtobufEnum.$_initByValueList(values, 2);
-  static EvmError? valueOf($core.int value) =>
-      value < 0 || value >= _byValue.length ? null : _byValue[value];
-
-  const EvmError._(super.value, super.name);
-}
-
-const $core.bool _omitEnumNames =
-    $core.bool.fromEnvironment('protobuf.omit_enum_names');