feat(PoC): terrors crate usage

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

AGENTS.md

@@ -1,128 +0,0 @@
-# AGENTS.md
-
-This file provides guidance to Codex (Codex.ai/code) when working with code in this repository.
-
-## Project Overview
-
-Arbiter is a **permissioned signing service** for cryptocurrency wallets. It consists of:
-- **`server/`** — Rust gRPC daemon that holds encrypted keys and enforces policies
-- **`useragent/`** — Flutter desktop app (macOS/Windows) with a Rust backend via Rinf
-- **`protobufs/`** — Protocol Buffer definitions shared between server and client
-
-The vault never exposes key material; it only produces signatures when requests satisfy configured policies.
-
-## Toolchain Setup
-
-Tools are managed via [mise](https://mise.jdx.dev/). Install all required tools:
-```sh
-mise install
-```
-
-Key versions: Rust 1.93.0 (with clippy), Flutter 3.38.9-stable, protoc 29.6, diesel_cli 2.3.6 (sqlite).
-
-## Server (Rust workspace at `server/`)
-
-### Crates
-
-| Crate | Purpose |
-|---|---|
-| `arbiter-proto` | Generated gRPC stubs + protobuf types; compiled from `protobufs/*.proto` via `tonic-prost-build` |
-| `arbiter-server` | Main daemon — actors, DB, EVM policy engine, gRPC service implementation |
-| `arbiter-useragent` | Rust client library for the user agent side of the gRPC protocol |
-| `arbiter-client` | Rust client library for SDK clients |
-
-### Common Commands
-
-```sh
-cd server
-
-# Build
-cargo build
-
-# Run the server daemon
-cargo run -p arbiter-server
-
-# Run all tests (preferred over cargo test)
-cargo nextest run
-
-# Run a single test
-cargo nextest run <test_name>
-
-# Lint
-cargo clippy
-
-# Security audit
-cargo audit
-
-# Check unused dependencies
-cargo shear
-
-# Run snapshot tests and update snapshots
-cargo insta review
-```
-
-### Architecture
-
-The server is actor-based using the **kameo** crate. All long-lived state lives in `GlobalActors`:
-
-- **`Bootstrapper`** — Manages the one-time bootstrap token written to `~/.arbiter/bootstrap_token` on first run.
-- **`KeyHolder`** — Holds the encrypted root key and manages the Sealed/Unsealed vault state machine. On unseal, decrypts the root key into a `memsafe` hardened memory cell.
-- **`MessageRouter`** — Coordinates streaming messages between user agents and SDK clients.
-- **`EvmActor`** — Handles EVM transaction policy enforcement and signing.
-
-Per-connection actors live under `actors/user_agent/` and `actors/client/`, each with `auth` (challenge-response authentication) and `session` (post-auth operations) sub-modules.
-
-**Database:** SQLite via `diesel-async` + `bb8` connection pool. Schema managed by embedded Diesel migrations in `crates/arbiter-server/migrations/`. DB file lives at `~/.arbiter/arbiter.sqlite`. Tests use a temp-file DB via `db::create_test_pool()`.
-
-**Cryptography:**
-- Authentication: ed25519 (challenge-response, nonce-tracked per peer)
-- Encryption at rest: XChaCha20-Poly1305 (versioned via `scheme` field for transparent migration on unseal)
-- Password KDF: Argon2
-- Unseal transport: X25519 ephemeral key exchange
-- TLS: self-signed certificate (aws-lc-rs backend), fingerprint distributed via `ArbiterUrl`
-
-**Protocol:** gRPC with Protocol Buffers. The `ArbiterUrl` type encodes host, port, CA cert, and bootstrap token into a single shareable string (printed to console on first run).
-
-### Proto Regeneration
-
-When `.proto` files in `protobufs/` change, rebuild to regenerate:
-```sh
-cd server && cargo build -p arbiter-proto
-```
-
-### Database Migrations
-
-```sh
-# Create a new migration
-diesel migration generate <name> --migration-dir crates/arbiter-server/migrations
-
-# Run migrations manually (server also runs them on startup)
-diesel migration run --migration-dir crates/arbiter-server/migrations
-```
-
-## User Agent (Flutter + Rinf at `useragent/`)
-
-The Flutter app uses [Rinf](https://rinf.cunarist.org) to call Rust code. The Rust logic lives in `useragent/native/hub/` as a separate crate that uses `arbiter-useragent` for the gRPC client.
-
-Communication between Dart and Rust uses typed **signals** defined in `useragent/native/hub/src/signals/`. After modifying signal structs, regenerate Dart bindings:
-
-```sh
-cd useragent && rinf gen
-```
-
-### Common Commands
-
-```sh
-cd useragent
-
-# Run the app (macOS or Windows)
-flutter run
-
-# Regenerate Rust↔Dart signal bindings
-rinf gen
-
-# Analyze Dart code
-flutter analyze
-```
-
-The Rinf Rust entry point is `useragent/native/hub/src/lib.rs`. It spawns actors defined in `useragent/native/hub/src/actors/` which handle Dart↔server communication via signals.

CLAUDE.md

@@ -1,128 +0,0 @@
-# CLAUDE.md
-
-This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
-
-## Project Overview
-
-Arbiter is a **permissioned signing service** for cryptocurrency wallets. It consists of:
-- **`server/`** — Rust gRPC daemon that holds encrypted keys and enforces policies
-- **`useragent/`** — Flutter desktop app (macOS/Windows) with a Rust backend via Rinf
-- **`protobufs/`** — Protocol Buffer definitions shared between server and client
-
-The vault never exposes key material; it only produces signatures when requests satisfy configured policies.
-
-## Toolchain Setup
-
-Tools are managed via [mise](https://mise.jdx.dev/). Install all required tools:
-```sh
-mise install
-```
-
-Key versions: Rust 1.93.0 (with clippy), Flutter 3.38.9-stable, protoc 29.6, diesel_cli 2.3.6 (sqlite).
-
-## Server (Rust workspace at `server/`)
-
-### Crates
-
-| Crate | Purpose |
-|---|---|
-| `arbiter-proto` | Generated gRPC stubs + protobuf types; compiled from `protobufs/*.proto` via `tonic-prost-build` |
-| `arbiter-server` | Main daemon — actors, DB, EVM policy engine, gRPC service implementation |
-| `arbiter-useragent` | Rust client library for the user agent side of the gRPC protocol |
-| `arbiter-client` | Rust client library for SDK clients |
-
-### Common Commands
-
-```sh
-cd server
-
-# Build
-cargo build
-
-# Run the server daemon
-cargo run -p arbiter-server
-
-# Run all tests (preferred over cargo test)
-cargo nextest run
-
-# Run a single test
-cargo nextest run <test_name>
-
-# Lint
-cargo clippy
-
-# Security audit
-cargo audit
-
-# Check unused dependencies
-cargo shear
-
-# Run snapshot tests and update snapshots
-cargo insta review
-```
-
-### Architecture
-
-The server is actor-based using the **kameo** crate. All long-lived state lives in `GlobalActors`:
-
-- **`Bootstrapper`** — Manages the one-time bootstrap token written to `~/.arbiter/bootstrap_token` on first run.
-- **`KeyHolder`** — Holds the encrypted root key and manages the Sealed/Unsealed vault state machine. On unseal, decrypts the root key into a `memsafe` hardened memory cell.
-- **`MessageRouter`** — Coordinates streaming messages between user agents and SDK clients.
-- **`EvmActor`** — Handles EVM transaction policy enforcement and signing.
-
-Per-connection actors live under `actors/user_agent/` and `actors/client/`, each with `auth` (challenge-response authentication) and `session` (post-auth operations) sub-modules.
-
-**Database:** SQLite via `diesel-async` + `bb8` connection pool. Schema managed by embedded Diesel migrations in `crates/arbiter-server/migrations/`. DB file lives at `~/.arbiter/arbiter.sqlite`. Tests use a temp-file DB via `db::create_test_pool()`.
-
-**Cryptography:**
-- Authentication: ed25519 (challenge-response, nonce-tracked per peer)
-- Encryption at rest: XChaCha20-Poly1305 (versioned via `scheme` field for transparent migration on unseal)
-- Password KDF: Argon2
-- Unseal transport: X25519 ephemeral key exchange
-- TLS: self-signed certificate (aws-lc-rs backend), fingerprint distributed via `ArbiterUrl`
-
-**Protocol:** gRPC with Protocol Buffers. The `ArbiterUrl` type encodes host, port, CA cert, and bootstrap token into a single shareable string (printed to console on first run).
-
-### Proto Regeneration
-
-When `.proto` files in `protobufs/` change, rebuild to regenerate:
-```sh
-cd server && cargo build -p arbiter-proto
-```
-
-### Database Migrations
-
-```sh
-# Create a new migration
-diesel migration generate <name> --migration-dir crates/arbiter-server/migrations
-
-# Run migrations manually (server also runs them on startup)
-diesel migration run --migration-dir crates/arbiter-server/migrations
-```
-
-## User Agent (Flutter + Rinf at `useragent/`)
-
-The Flutter app uses [Rinf](https://rinf.cunarist.org) to call Rust code. The Rust logic lives in `useragent/native/hub/` as a separate crate that uses `arbiter-useragent` for the gRPC client.
-
-Communication between Dart and Rust uses typed **signals** defined in `useragent/native/hub/src/signals/`. After modifying signal structs, regenerate Dart bindings:
-
-```sh
-cd useragent && rinf gen
-```
-
-### Common Commands
-
-```sh
-cd useragent
-
-# Run the app (macOS or Windows)
-flutter run
-
-# Regenerate Rust↔Dart signal bindings
-rinf gen
-
-# Analyze Dart code
-flutter analyze
-```
-
-The Rinf Rust entry point is `useragent/native/hub/src/lib.rs`. It spawns actors defined in `useragent/native/hub/src/actors/` which handle Dart↔server communication via signals.

mise.lock

@@ -1,12 +1,3 @@
-[[tools.ast-grep]]
-version = "0.42.0"
-backend = "aqua:ast-grep/ast-grep"
-"platforms.linux-arm64" = { checksum = "sha256:5c830eae8456569e2f7212434ed9c238f58dca412d76045418ed6d394a755836", url = "https://github.com/ast-grep/ast-grep/releases/download/0.42.0/app-aarch64-unknown-linux-gnu.zip"}
-"platforms.linux-x64" = { checksum = "sha256:e825a05603f0bcc4cd9076c4cc8c9abd6d008b7cd07d9aa3cc323ba4b8606651", url = "https://github.com/ast-grep/ast-grep/releases/download/0.42.0/app-x86_64-unknown-linux-gnu.zip"}
-"platforms.macos-arm64" = { checksum = "sha256:fc300d5293b1c770a5aece03a8a193b92e71e87cec726c28096990691a582620", url = "https://github.com/ast-grep/ast-grep/releases/download/0.42.0/app-aarch64-apple-darwin.zip"}
-"platforms.macos-x64" = { checksum = "sha256:979ffe611327056f4730a1ae71b0209b3b830f58b22c6ed194cda34f55400db2", url = "https://github.com/ast-grep/ast-grep/releases/download/0.42.0/app-x86_64-apple-darwin.zip"}
-"platforms.windows-x64" = { checksum = "sha256:55836fa1b2c65dc7d61615a4d9368622a0d2371a76d28b9a165e5a3ab6ae32a4", url = "https://github.com/ast-grep/ast-grep/releases/download/0.42.0/app-x86_64-pc-windows-msvc.zip"}
-
 [[tools."cargo:cargo-audit"]]
 version = "0.22.1"
 backend = "cargo:cargo-audit"
@@ -51,10 +42,6 @@ backend = "cargo:diesel_cli"
 default-features = "false"
 features = "sqlite,sqlite-bundled"
 
-[[tools."cargo:rinf_cli"]]
-version = "8.9.1"
-backend = "cargo:rinf_cli"
-
 [[tools.flutter]]
 version = "3.38.9-stable"
 backend = "asdf:flutter"

mise.toml

@@ -10,12 +10,3 @@ protoc = "29.6"
 "cargo:cargo-shear" = "latest"
 "cargo:cargo-insta" = "1.46.3"
 python = "3.14.3"
-ast-grep = "0.42.0"
-
-[tasks.codegen]
-sources = ['protobufs/*.proto']
-outputs = ['useragent/lib/proto/*']
-run = '''
-dart pub global activate protoc_plugin && \
-protoc --dart_out=grpc:useragent/lib/proto --proto_path=protobufs/ protobufs/*.proto
-'''

protobufs/client.proto

@@ -23,6 +23,7 @@ message ClientRequest {
   oneof payload {
     AuthChallengeRequest auth_challenge_request = 1;
     AuthChallengeSolution auth_challenge_solution = 2;
+    arbiter.evm.EvmSignTransactionRequest evm_sign_transaction = 3;
   }
 }
 

protobufs/user_agent.proto

@@ -12,6 +12,55 @@ enum KeyType {
   KEY_TYPE_RSA = 3;
 }
 
+// --- SDK client management ---
+
+enum SdkClientError {
+  SDK_CLIENT_ERROR_UNSPECIFIED = 0;
+  SDK_CLIENT_ERROR_ALREADY_EXISTS = 1;
+  SDK_CLIENT_ERROR_NOT_FOUND = 2;
+  SDK_CLIENT_ERROR_HAS_RELATED_DATA = 3; // hard-delete blocked by FK (client has grants or transaction logs)
+  SDK_CLIENT_ERROR_INTERNAL = 4;
+}
+
+message SdkClientApproveRequest {
+  bytes pubkey = 1; // 32-byte ed25519 public key
+}
+
+message SdkClientRevokeRequest {
+  int32 client_id = 1;
+}
+
+message SdkClientEntry {
+  int32 id = 1;
+  bytes pubkey = 2;
+  int32 created_at = 3;
+}
+
+message SdkClientList {
+  repeated SdkClientEntry clients = 1;
+}
+
+message SdkClientApproveResponse {
+  oneof result {
+    SdkClientEntry client = 1;
+    SdkClientError error = 2;
+  }
+}
+
+message SdkClientRevokeResponse {
+  oneof result {
+    google.protobuf.Empty ok = 1;
+    SdkClientError error = 2;
+  }
+}
+
+message SdkClientListResponse {
+  oneof result {
+    SdkClientList clients = 1;
+    SdkClientError error = 2;
+  }
+}
+
 message AuthChallengeRequest {
   bytes pubkey = 1;
   optional string bootstrap_token = 2;
@@ -42,12 +91,6 @@ message UnsealEncryptedKey {
   bytes associated_data = 3;
 }
 
-message BootstrapEncryptedKey {
-  bytes nonce = 1;
-  bytes ciphertext = 2;
-  bytes associated_data = 3;
-}
-
 enum UnsealResult {
   UNSEAL_RESULT_UNSPECIFIED = 0;
   UNSEAL_RESULT_SUCCESS = 1;
@@ -55,13 +98,6 @@ enum UnsealResult {
   UNSEAL_RESULT_UNBOOTSTRAPPED = 3;
 }
 
-enum BootstrapResult {
-  BOOTSTRAP_RESULT_UNSPECIFIED = 0;
-  BOOTSTRAP_RESULT_SUCCESS = 1;
-  BOOTSTRAP_RESULT_ALREADY_BOOTSTRAPPED = 2;
-  BOOTSTRAP_RESULT_INVALID_KEY = 3;
-}
-
 enum VaultState {
   VAULT_STATE_UNSPECIFIED = 0;
   VAULT_STATE_UNBOOTSTRAPPED = 1;
@@ -70,16 +106,6 @@ enum VaultState {
   VAULT_STATE_ERROR = 4;
 }
 
-message ClientConnectionRequest {
-  bytes pubkey = 1;
-}
-
-message ClientConnectionResponse {
-  bool approved = 1;
-}
-
-message ClientConnectionCancel {}
-
 message UserAgentRequest {
   oneof payload {
     AuthChallengeRequest auth_challenge_request = 1;
@@ -92,8 +118,10 @@ message UserAgentRequest {
     arbiter.evm.EvmGrantCreateRequest evm_grant_create = 8;
     arbiter.evm.EvmGrantDeleteRequest evm_grant_delete = 9;
     arbiter.evm.EvmGrantListRequest evm_grant_list = 10;
-    ClientConnectionResponse client_connection_response = 11;
+    // field 11 reserved: was client_connection_response (online approval removed)
-    BootstrapEncryptedKey bootstrap_encrypted_key = 12;
+    SdkClientApproveRequest sdk_client_approve = 12;
+    SdkClientRevokeRequest sdk_client_revoke = 13;
+    google.protobuf.Empty sdk_client_list = 14;
   }
 }
 message UserAgentResponse {
@@ -108,8 +136,9 @@ message UserAgentResponse {
     arbiter.evm.EvmGrantCreateResponse evm_grant_create = 8;
     arbiter.evm.EvmGrantDeleteResponse evm_grant_delete = 9;
     arbiter.evm.EvmGrantListResponse evm_grant_list = 10;
-    ClientConnectionRequest client_connection_request = 11;
+    // fields 11, 12 reserved: were client_connection_request, client_connection_cancel (online approval removed)
-    ClientConnectionCancel client_connection_cancel = 12;
+    SdkClientApproveResponse sdk_client_approve = 13;
-    BootstrapResult bootstrap_result = 13;
+    SdkClientRevokeResponse sdk_client_revoke = 14;
+    SdkClientListResponse sdk_client_list = 15;
   }
 }

server/Cargo.lock

@@ -678,6 +678,18 @@ checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
 [[package]]
 name = "arbiter-client"
 version = "0.1.0"
+dependencies = [
+ "alloy",
+ "arbiter-proto",
+ "async-trait",
+ "ed25519-dalek",
+ "http",
+ "rustls-webpki",
+ "thiserror",
+ "tokio",
+ "tokio-stream",
+ "tonic",
+]
 
 [[package]]
 name = "arbiter-proto"
@@ -691,6 +703,7 @@ dependencies = [
  "miette",
  "prost",
  "prost-types",
+ "protoc-bin-vendored",
  "rand 0.10.0",
  "rcgen",
  "rstest",
@@ -727,7 +740,6 @@ dependencies = [
  "memsafe",
  "miette",
  "pem",
- "prost-types",
  "rand 0.10.0",
  "rcgen",
  "restructed",
@@ -749,6 +761,13 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "arbiter-terrors-poc"
+version = "0.1.0"
+dependencies = [
+ "terrors",
+]
+
 [[package]]
 name = "arbiter-tokens-registry"
 version = "0.1.0"
@@ -756,6 +775,30 @@ dependencies = [
  "alloy",
 ]
 
+[[package]]
+name = "arbiter-useragent"
+version = "0.1.0"
+dependencies = [
+ "arbiter-proto",
+ "async-trait",
+ "ed25519-dalek",
+ "http",
+ "k256",
+ "kameo",
+ "rand 0.10.0",
+ "rsa",
+ "rustls-webpki",
+ "sha2 0.10.9",
+ "smlang",
+ "spki",
+ "thiserror",
+ "tokio",
+ "tokio-stream",
+ "tonic",
+ "tracing",
+ "x25519-dalek",
+]
+
 [[package]]
 name = "argon2"
 version = "0.5.3"
@@ -3637,6 +3680,70 @@ dependencies = [
  "prost",
 ]
 
+[[package]]
+name = "protoc-bin-vendored"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1c381df33c98266b5f08186583660090a4ffa0889e76c7e9a5e175f645a67fa"
+dependencies = [
+ "protoc-bin-vendored-linux-aarch_64",
+ "protoc-bin-vendored-linux-ppcle_64",
+ "protoc-bin-vendored-linux-s390_64",
+ "protoc-bin-vendored-linux-x86_32",
+ "protoc-bin-vendored-linux-x86_64",
+ "protoc-bin-vendored-macos-aarch_64",
+ "protoc-bin-vendored-macos-x86_64",
+ "protoc-bin-vendored-win32",
+]
+
+[[package]]
+name = "protoc-bin-vendored-linux-aarch_64"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c350df4d49b5b9e3ca79f7e646fde2377b199e13cfa87320308397e1f37e1a4c"
+
+[[package]]
+name = "protoc-bin-vendored-linux-ppcle_64"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a55a63e6c7244f19b5c6393f025017eb5d793fd5467823a099740a7a4222440c"
+
+[[package]]
+name = "protoc-bin-vendored-linux-s390_64"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1dba5565db4288e935d5330a07c264a4ee8e4a5b4a4e6f4e83fad824cc32f3b0"
+
+[[package]]
+name = "protoc-bin-vendored-linux-x86_32"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8854774b24ee28b7868cd71dccaae8e02a2365e67a4a87a6cd11ee6cdbdf9cf5"
+
+[[package]]
+name = "protoc-bin-vendored-linux-x86_64"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b38b07546580df720fa464ce124c4b03630a6fb83e05c336fea2a241df7e5d78"
+
+[[package]]
+name = "protoc-bin-vendored-macos-aarch_64"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "89278a9926ce312e51f1d999fee8825d324d603213344a9a706daa009f1d8092"
+
+[[package]]
+name = "protoc-bin-vendored-macos-x86_64"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "81745feda7ccfb9471d7a4de888f0652e806d5795b61480605d4943176299756"
+
+[[package]]
+name = "protoc-bin-vendored-win32"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "95067976aca6421a523e491fce939a3e65249bac4b977adee0ee9771568e8aa3"
+
 [[package]]
 name = "pulldown-cmark"
 version = "0.13.1"
@@ -4756,6 +4863,12 @@ dependencies = [
  "windows-sys 0.60.2",
 ]
 
+[[package]]
+name = "terrors"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "987fd8c678ca950df2a18b2c6e9da6ca511d449278fab3565efe0d49c0c07a5d"
+
 [[package]]
 name = "test-log"
 version = "0.2.19"
@@ -4868,9 +4981,9 @@ dependencies = [
 
 [[package]]
 name = "tinyvec"
-version = "1.11.0"
+version = "1.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3e61e67053d25a4e82c844e8424039d9745781b3fc4f32b8d55ed50f5f667ef3"
+checksum = "bfa5fdc3bce6191a1dbc8c02d5c8bffcf557bafa17c124c5264a458f1b0613fa"
 dependencies = [
  "tinyvec_macros",
 ]

server/Cargo.toml

@@ -20,7 +20,7 @@ tokio = { version = "1.49.0", features = ["full"] }
 ed25519-dalek = { version = "3.0.0-pre.6", features = ["rand_core"] }
 chrono = { version = "0.4.43", features = ["serde"] }
 rand = "0.10.0"
-rustls = { version = "0.23.36", features = ["aws-lc-rs"] }
+rustls = "0.23.36"
 smlang = "0.8.0"
 miette = { version = "7.6.0", features = ["fancy", "serde"] }
 thiserror = "2.0.18"

server/crates/arbiter-client/Cargo.toml

@@ -5,4 +5,18 @@ edition = "2024"
 repository = "https://git.markettakers.org/MarketTakers/arbiter"
 license = "Apache-2.0"
 
+[lints]
+workspace = true
+
 [dependencies]
+arbiter-proto.path = "../arbiter-proto"
+alloy.workspace = true
+tonic.workspace = true
+tonic.features = ["tls-aws-lc"]
+tokio.workspace = true
+tokio-stream.workspace = true
+ed25519-dalek.workspace = true
+thiserror.workspace = true
+http = "1.4.0"
+rustls-webpki = { version = "0.103.9", features = ["aws-lc-rs"] }
+async-trait.workspace = true

server/crates/arbiter-client/src/lib.rs

@@ -1,14 +1,272 @@
-pub fn add(left: u64, right: u64) -> u64 {
+use alloy::{
-    left + right
+    consensus::SignableTransaction,
+    network::TxSigner,
+    primitives::{Address, B256, ChainId, Signature},
+    signers::{Error, Result, Signer},
+};
+use arbiter_proto::{
+    format_challenge,
+    proto::{
+        arbiter_service_client::ArbiterServiceClient,
+        client::{
+            AuthChallengeRequest, AuthChallengeSolution, ClientRequest, ClientResponse,
+            client_connect_error, client_request::Payload as ClientRequestPayload,
+            client_response::Payload as ClientResponsePayload,
+        },
+        evm::{
+            EvmSignTransactionRequest, evm_sign_transaction_response::Result as SignResponseResult,
+        },
+    },
+    url::ArbiterUrl,
+};
+use async_trait::async_trait;
+use ed25519_dalek::Signer as _;
+use tokio::sync::{Mutex, mpsc};
+use tokio_stream::wrappers::ReceiverStream;
+use tonic::transport::ClientTlsConfig;
+
+#[derive(Debug, thiserror::Error)]
+pub enum ConnectError {
+    #[error("Could not establish connection")]
+    Connection(#[from] tonic::transport::Error),
+
+    #[error("Invalid server URI")]
+    InvalidUri(#[from] http::uri::InvalidUri),
+
+    #[error("Invalid CA certificate")]
+    InvalidCaCert(#[from] webpki::Error),
+
+    #[error("gRPC error")]
+    Grpc(#[from] tonic::Status),
+
+    #[error("Auth challenge was not returned by server")]
+    MissingAuthChallenge,
+
+    #[error("Client approval denied by User Agent")]
+    ApprovalDenied,
+
+    #[error("No User Agents online to approve client")]
+    NoUserAgentsOnline,
+
+    #[error("Unexpected auth response payload")]
+    UnexpectedAuthResponse,
 }
 
-#[cfg(test)]
+#[derive(Debug, thiserror::Error)]
-mod tests {
+enum ClientSignError {
-    use super::*;
+    #[error("Transport channel closed")]
+    ChannelClosed,
 
-    #[test]
+    #[error("Connection closed by server")]
-    fn it_works() {
+    ConnectionClosed,
-        let result = add(2, 2);
+
-        assert_eq!(result, 4);
+    #[error("Invalid response payload")]
+    InvalidResponse,
+
+    #[error("Remote signing was rejected")]
+    Rejected,
+}
+
+struct ClientTransport {
+    sender: mpsc::Sender<ClientRequest>,
+    receiver: tonic::Streaming<ClientResponse>,
+}
+
+impl ClientTransport {
+    async fn send(&mut self, request: ClientRequest) -> std::result::Result<(), ClientSignError> {
+        self.sender
+            .send(request)
+            .await
+            .map_err(|_| ClientSignError::ChannelClosed)
+    }
+
+    async fn recv(&mut self) -> std::result::Result<ClientResponse, ClientSignError> {
+        match self.receiver.message().await {
+            Ok(Some(resp)) => Ok(resp),
+            Ok(None) => Err(ClientSignError::ConnectionClosed),
+            Err(_) => Err(ClientSignError::ConnectionClosed),
+        }
+    }
+}
+
+pub struct ArbiterSigner {
+    transport: Mutex<ClientTransport>,
+    address: Address,
+    chain_id: Option<ChainId>,
+}
+
+impl ArbiterSigner {
+    pub async fn connect_grpc(
+        url: ArbiterUrl,
+        key: ed25519_dalek::SigningKey,
+        address: Address,
+    ) -> std::result::Result<Self, ConnectError> {
+        let anchor = webpki::anchor_from_trusted_cert(&url.ca_cert)?.to_owned();
+        let tls = ClientTlsConfig::new().trust_anchor(anchor);
+
+        // NOTE: We intentionally keep the same URL construction strategy as the user-agent crate
+        // to avoid behavior drift between the two clients.
+        let channel = tonic::transport::Channel::from_shared(format!("{}:{}", url.host, url.port))?
+            .tls_config(tls)?
+            .connect()
+            .await?;
+
+        let mut client = ArbiterServiceClient::new(channel);
+        let (tx, rx) = mpsc::channel(16);
+        let response_stream = client.client(ReceiverStream::new(rx)).await?.into_inner();
+
+        let mut transport = ClientTransport {
+            sender: tx,
+            receiver: response_stream,
+        };
+
+        authenticate(&mut transport, key).await?;
+
+        Ok(Self {
+            transport: Mutex::new(transport),
+            address,
+            chain_id: None,
+        })
+    }
+
+    async fn sign_transaction_via_arbiter(
+        &self,
+        tx: &mut dyn SignableTransaction<Signature>,
+    ) -> Result<Signature> {
+        if let Some(chain_id) = self.chain_id
+            && !tx.set_chain_id_checked(chain_id)
+        {
+            return Err(Error::TransactionChainIdMismatch {
+                signer: chain_id,
+                tx: tx.chain_id().unwrap(),
+            });
+        }
+
+        let mut rlp_transaction = Vec::new();
+        tx.encode_for_signing(&mut rlp_transaction);
+
+        let request = ClientRequest {
+            payload: Some(ClientRequestPayload::EvmSignTransaction(
+                EvmSignTransactionRequest {
+                    wallet_address: self.address.as_slice().to_vec(),
+                    rlp_transaction,
+                },
+            )),
+        };
+
+        let mut transport = self.transport.lock().await;
+        transport.send(request).await.map_err(Error::other)?;
+        let response = transport.recv().await.map_err(Error::other)?;
+
+        let payload = response
+            .payload
+            .ok_or_else(|| Error::other(ClientSignError::InvalidResponse))?;
+
+        let ClientResponsePayload::EvmSignTransaction(sign_response) = payload else {
+            return Err(Error::other(ClientSignError::InvalidResponse));
+        };
+
+        let Some(result) = sign_response.result else {
+            return Err(Error::other(ClientSignError::InvalidResponse));
+        };
+
+        match result {
+            SignResponseResult::Signature(bytes) => {
+                Signature::try_from(bytes.as_slice()).map_err(Error::other)
+            }
+            SignResponseResult::EvalError(_) | SignResponseResult::Error(_) => {
+                Err(Error::other(ClientSignError::Rejected))
+            }
+        }
+    }
+}
+
+async fn authenticate(
+    transport: &mut ClientTransport,
+    key: ed25519_dalek::SigningKey,
+) -> std::result::Result<(), ConnectError> {
+    transport
+        .send(ClientRequest {
+            payload: Some(ClientRequestPayload::AuthChallengeRequest(
+                AuthChallengeRequest {
+                    pubkey: key.verifying_key().to_bytes().to_vec(),
+                },
+            )),
+        })
+        .await
+        .map_err(|_| ConnectError::UnexpectedAuthResponse)?;
+
+    let response = transport
+        .recv()
+        .await
+        .map_err(|_| ConnectError::MissingAuthChallenge)?;
+
+    let payload = response.payload.ok_or(ConnectError::MissingAuthChallenge)?;
+    match payload {
+        ClientResponsePayload::AuthChallenge(challenge) => {
+            let challenge_payload = format_challenge(challenge.nonce, &challenge.pubkey);
+            let signature = key.sign(&challenge_payload).to_bytes().to_vec();
+
+            transport
+                .send(ClientRequest {
+                    payload: Some(ClientRequestPayload::AuthChallengeSolution(
+                        AuthChallengeSolution { signature },
+                    )),
+                })
+                .await
+                .map_err(|_| ConnectError::UnexpectedAuthResponse)?;
+
+            // Current server flow does not emit `AuthOk` for SDK clients, so we proceed after
+            // sending the solution. If authentication fails, the first business request will return
+            // a `ClientConnectError` or the stream will close.
+            Ok(())
+        }
+        ClientResponsePayload::ClientConnectError(err) => {
+            match client_connect_error::Code::try_from(err.code)
+                .unwrap_or(client_connect_error::Code::Unknown)
+            {
+                client_connect_error::Code::ApprovalDenied => Err(ConnectError::ApprovalDenied),
+                client_connect_error::Code::NoUserAgentsOnline => {
+                    Err(ConnectError::NoUserAgentsOnline)
+                }
+                client_connect_error::Code::Unknown => Err(ConnectError::UnexpectedAuthResponse),
+            }
+        }
+        _ => Err(ConnectError::UnexpectedAuthResponse),
+    }
+}
+
+#[async_trait]
+impl Signer for ArbiterSigner {
+    async fn sign_hash(&self, _hash: &B256) -> Result<Signature> {
+        Err(Error::other(
+            "hash-only signing is not supported for ArbiterSigner; use transaction signing",
+        ))
+    }
+
+    fn address(&self) -> Address {
+        self.address
+    }
+
+    fn chain_id(&self) -> Option<ChainId> {
+        self.chain_id
+    }
+
+    fn set_chain_id(&mut self, chain_id: Option<ChainId>) {
+        self.chain_id = chain_id;
+    }
+}
+
+#[async_trait]
+impl TxSigner<Signature> for ArbiterSigner {
+    fn address(&self) -> Address {
+        self.address
+    }
+
+    async fn sign_transaction(
+        &self,
+        tx: &mut dyn SignableTransaction<Signature>,
+    ) -> Result<Signature> {
+        self.sign_transaction_via_arbiter(tx).await
     }
 }

server/crates/arbiter-proto/Cargo.toml

@@ -24,6 +24,7 @@ async-trait.workspace = true
 
 [build-dependencies]
 tonic-prost-build = "0.14.3"
+protoc-bin-vendored = "3"
 
 [dev-dependencies]
 rstest.workspace = true

server/crates/arbiter-proto/build.rs

@@ -3,6 +3,12 @@ use tonic_prost_build::configure;
 static PROTOBUF_DIR: &str = "../../../protobufs";
 
 fn main() -> Result<(), Box<dyn std::error::Error>> {
+    if std::env::var("PROTOC").is_err() {
+        println!("cargo:warning=PROTOC environment variable not set, using vendored protoc");
+        let protoc = protoc_bin_vendored::protoc_bin_path().unwrap();
+        unsafe { std::env::set_var("PROTOC", protoc) };
+    }
+
     println!("cargo::rerun-if-changed={PROTOBUF_DIR}");
 
     configure()

server/crates/arbiter-proto/src/transport.rs

@@ -1,39 +1,78 @@
-//! Transport-facing abstractions shared by protocol/session code.
+//! Transport-facing abstractions for protocol/session code.
 //!
-//! This module defines a small duplex interface, [`Bi`], that actors and other
+//! This module separates three concerns:
-//! protocol code can depend on without knowing anything about the concrete
+//!
-//! transport underneath.
+//! - protocol/session logic wants a small duplex interface ([`Bi`])
+//! - transport adapters push concrete stream items to an underlying IO layer
+//! - transport boundaries translate between protocol-facing and transport-facing
+//!   item types via direction-specific converters
 //!
 //! [`Bi`] is intentionally minimal and transport-agnostic:
-//! - [`Bi::recv`] yields inbound messages
+//! - [`Bi::recv`] yields inbound protocol messages
-//! - [`Bi::send`] accepts outbound messages
+//! - [`Bi::send`] accepts outbound protocol/domain items
-//!
-//! Transport-specific adapters, including protobuf or gRPC bridges, live in the
-//! crates that own those boundaries rather than in `arbiter-proto`.
 //!
 //! # Generic Ordering Rule
 //!
-//! This module consistently uses `Inbound` first and `Outbound` second in
+//! This module uses a single convention consistently: when a type or trait is
-//! generic parameter lists.
+//! parameterized by protocol message directions, the generic parameters are
+//! declared as `Inbound` first, then `Outbound`.
 //!
 //! For [`Bi`], that means `Bi<Inbound, Outbound>`:
 //! - `recv() -> Option<Inbound>`
 //! - `send(Outbound)`
 //!
-//! [`expect_message`] is a small helper for request/response style flows: it
+//! For adapter types that are parameterized by direction-specific converters,
-//! reads one inbound message from a transport and extracts a typed value from
+//! inbound-related converter parameters are declared before outbound-related
-//! it, failing if the channel closes or the message shape is not what the
+//! converter parameters.
-//! caller expected.
 //!
-//! [`DummyTransport`] is a no-op implementation useful for tests and local
+//! [`RecvConverter`] and [`SendConverter`] are infallible conversion traits used
-//! actor execution where no real stream exists.
+//! by adapters to map between protocol-facing and transport-facing item types.
+//! The traits themselves are not result-aware; adapters decide how transport
+//! errors are handled before (or instead of) conversion.
+//!
+//! [`grpc::GrpcAdapter`] combines:
+//! - a tonic inbound stream
+//! - a Tokio sender for outbound transport items
+//! - a [`RecvConverter`] for the receive path
+//! - a [`SendConverter`] for the send path
+//!
+//! [`DummyTransport`] is a no-op implementation useful for tests and local actor
+//! execution where no real network stream exists.
+//!
+//! # Component Interaction
+//!
+//! ```text
+//! inbound (network -> protocol)
+//! ============================
+//!
+//! tonic::Streaming<RecvTransport>
+//!     -> grpc::GrpcAdapter::recv()
+//!          |
+//!          +--> on `Ok(item)`: RecvConverter::convert(RecvTransport) -> Inbound
+//!          +--> on `Err(status)`: log error and close stream (`None`)
+//!     -> Bi::recv()
+//!     -> protocol/session actor
+//!
+//! outbound (protocol -> network)
+//! ==============================
+//!
+//! protocol/session actor
+//!     -> Bi::send(Outbound)
+//!     -> grpc::GrpcAdapter::send()
+//!          |
+//!          +--> SendConverter::convert(Outbound) -> SendTransport
+//!     -> Tokio mpsc::Sender<SendTransport>
+//!     -> tonic response stream
+//! ```
 //!
 //! # Design Notes
 //!
-//! - [`Bi::send`] returns [`Error`] only for transport delivery failures, such
+//! - `send()` returns [`Error`] only for transport delivery failures (for
-//!   as a closed outbound channel.
+//!   example, when the outbound channel is closed).
-//! - [`Bi::recv`] returns `None` when the underlying transport closes.
+//! - [`grpc::GrpcAdapter`] logs tonic receive errors and treats them as stream
-//! - Message translation is intentionally out of scope for this module.
+//!   closure (`None`).
+//! - When protocol-facing and transport-facing types are identical, use
+//!   [`IdentityRecvConverter`] / [`IdentitySendConverter`].
 
 use std::marker::PhantomData;
 
@@ -75,6 +114,162 @@ pub trait Bi<Inbound, Outbound>: Send + Sync + 'static {
     async fn recv(&mut self) -> Option<Inbound>;
 }
 
+/// Converts transport-facing inbound items into protocol-facing inbound items.
+pub trait RecvConverter: Send + Sync + 'static {
+    type Input;
+    type Output;
+
+    fn convert(&self, item: Self::Input) -> Self::Output;
+}
+
+/// Converts protocol/domain outbound items into transport-facing outbound items.
+pub trait SendConverter: Send + Sync + 'static {
+    type Input;
+    type Output;
+
+    fn convert(&self, item: Self::Input) -> Self::Output;
+}
+
+/// A [`RecvConverter`] that forwards values unchanged.
+pub struct IdentityRecvConverter<T> {
+    _marker: PhantomData<T>,
+}
+
+impl<T> IdentityRecvConverter<T> {
+    pub fn new() -> Self {
+        Self {
+            _marker: PhantomData,
+        }
+    }
+}
+
+impl<T> Default for IdentityRecvConverter<T> {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl<T> RecvConverter for IdentityRecvConverter<T>
+where
+    T: Send + Sync + 'static,
+{
+    type Input = T;
+    type Output = T;
+
+    fn convert(&self, item: Self::Input) -> Self::Output {
+        item
+    }
+}
+
+/// A [`SendConverter`] that forwards values unchanged.
+pub struct IdentitySendConverter<T> {
+    _marker: PhantomData<T>,
+}
+
+impl<T> IdentitySendConverter<T> {
+    pub fn new() -> Self {
+        Self {
+            _marker: PhantomData,
+        }
+    }
+}
+
+impl<T> Default for IdentitySendConverter<T> {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl<T> SendConverter for IdentitySendConverter<T>
+where
+    T: Send + Sync + 'static,
+{
+    type Input = T;
+    type Output = T;
+
+    fn convert(&self, item: Self::Input) -> Self::Output {
+        item
+    }
+}
+
+/// gRPC-specific transport adapters and helpers.
+pub mod grpc {
+    use async_trait::async_trait;
+    use futures::StreamExt;
+    use tokio::sync::mpsc;
+    use tonic::Streaming;
+
+    use super::{Bi, Error, RecvConverter, SendConverter};
+
+    /// [`Bi`] adapter backed by a tonic gRPC bidirectional stream.
+    ///
+    /// Tonic receive errors are logged and treated as stream closure (`None`).
+    /// The receive converter is only invoked for successful inbound transport
+    /// items.
+    pub struct GrpcAdapter<InboundConverter, OutboundConverter>
+    where
+        InboundConverter: RecvConverter,
+        OutboundConverter: SendConverter,
+    {
+        sender: mpsc::Sender<OutboundConverter::Output>,
+        receiver: Streaming<InboundConverter::Input>,
+        inbound_converter: InboundConverter,
+        outbound_converter: OutboundConverter,
+    }
+
+    impl<InboundTransport, Inbound, InboundConverter, OutboundConverter>
+        GrpcAdapter<InboundConverter, OutboundConverter>
+    where
+        InboundConverter: RecvConverter<Input = InboundTransport, Output = Inbound>,
+        OutboundConverter: SendConverter,
+    {
+        pub fn new(
+            sender: mpsc::Sender<OutboundConverter::Output>,
+            receiver: Streaming<InboundTransport>,
+            inbound_converter: InboundConverter,
+            outbound_converter: OutboundConverter,
+        ) -> Self {
+            Self {
+                sender,
+                receiver,
+                inbound_converter,
+                outbound_converter,
+            }
+        }
+    }
+
+    #[async_trait]
+    impl<InboundConverter, OutboundConverter> Bi<InboundConverter::Output, OutboundConverter::Input>
+        for GrpcAdapter<InboundConverter, OutboundConverter>
+    where
+        InboundConverter: RecvConverter,
+        OutboundConverter: SendConverter,
+        OutboundConverter::Input: Send + 'static,
+        OutboundConverter::Output: Send + 'static,
+    {
+        #[tracing::instrument(level = "trace", skip(self, item))]
+        async fn send(&mut self, item: OutboundConverter::Input) -> Result<(), Error> {
+            let outbound = self.outbound_converter.convert(item);
+            self.sender
+                .send(outbound)
+                .await
+                .map_err(|_| Error::ChannelClosed)
+        }
+
+        #[tracing::instrument(level = "trace", skip(self))]
+        async fn recv(&mut self) -> Option<InboundConverter::Output> {
+            match self.receiver.next().await {
+                Some(Ok(item)) => Some(self.inbound_converter.convert(item)),
+                Some(Err(error)) => {
+                    tracing::error!(error = ?error, "grpc transport recv failed; closing stream");
+                    None
+                }
+                None => None,
+            }
+        }
+    }
+}
+
 /// No-op [`Bi`] transport for tests and manual actor usage.
 ///
 /// `send` drops all items and succeeds. [`Bi::recv`] never resolves and therefore

server/crates/arbiter-server/Cargo.toml

@@ -50,7 +50,6 @@ rsa.workspace = true
 sha2.workspace = true
 spki.workspace = true
 alloy.workspace = true
-prost-types.workspace = true
 arbiter-tokens-registry.path = "../arbiter-tokens-registry"
 
 [dev-dependencies]

server/crates/arbiter-server/migrations/2026-03-15-103112-0000_add_program_client_pubkey_unique/down.sql

@@ -0,0 +1 @@
+DROP INDEX IF EXISTS program_client_public_key_unique;

server/crates/arbiter-server/migrations/2026-03-15-103112-0000_add_program_client_pubkey_unique/up.sql

@@ -0,0 +1,2 @@
+CREATE UNIQUE INDEX program_client_public_key_unique
+    ON program_client (public_key);

server/crates/arbiter-server/src/actors/bootstrap.rs

@@ -3,7 +3,12 @@ use diesel::QueryDsl;
 use diesel_async::RunQueryDsl;
 use kameo::{Actor, messages};
 use miette::Diagnostic;
-use rand::{RngExt, distr::Alphanumeric, make_rng, rngs::StdRng};
+use rand::{
+    RngExt,
+    distr::{Alphanumeric},
+    make_rng,
+    rngs::StdRng,
+};
 use thiserror::Error;
 
 use crate::db::{self, DatabasePool, schema};
@@ -56,6 +61,7 @@ impl Bootstrapper {
 
         drop(conn);
 
+
         let token = if row_count == 0 {
             let token = generate_token().await?;
             Some(token)

server/crates/arbiter-server/src/actors/client/auth.rs

@@ -1,17 +1,20 @@
-use arbiter_proto::{format_challenge, transport::expect_message};
+use arbiter_proto::{
-use diesel::{
+    format_challenge,
-    ExpressionMethods as _, OptionalExtension as _, QueryDsl as _, dsl::insert_into, update,
+    proto::client::{
+        AuthChallenge, AuthChallengeSolution, ClientConnectError, ClientRequest, ClientResponse,
+        client_connect_error::Code as ConnectErrorCode,
+        client_request::Payload as ClientRequestPayload,
+        client_response::Payload as ClientResponsePayload,
+    },
+    transport::expect_message,
 };
+use diesel::{ExpressionMethods as _, OptionalExtension as _, QueryDsl as _, update};
 use diesel_async::RunQueryDsl as _;
 use ed25519_dalek::VerifyingKey;
-use kameo::error::SendError;
 use tracing::error;
 
 use crate::{
-    actors::{
+    actors::client::ClientConnection,
-        client::{ClientConnection, ConnectErrorCode, Request, Response},
-        router::{self, RequestClientApproval},
-    },
     db::{self, schema::program_client},
 };
 
@@ -31,27 +34,20 @@ pub enum Error {
     DatabaseOperationFailed,
     #[error("Invalid challenge solution")]
     InvalidChallengeSolution,
-    #[error("Client approval request failed")]
+    #[error("Client not registered")]
-    ApproveError(#[from] ApproveError),
+    NotRegistered,
     #[error("Internal error")]
     InternalError,
     #[error("Transport error")]
     Transport,
 }
 
-#[derive(thiserror::Error, Debug, Clone, PartialEq, Eq)]
-pub enum ApproveError {
-    #[error("Internal error")]
-    Internal,
-    #[error("Client connection denied by user agents")]
-    Denied,
-    #[error("Upstream error: {0}")]
-    Upstream(router::ApprovalError),
-}
-
 /// Atomically reads and increments the nonce for a known client.
 /// Returns `None` if the pubkey is not registered.
-async fn get_nonce(db: &db::DatabasePool, pubkey: &VerifyingKey) -> Result<Option<i32>, Error> {
+async fn get_nonce(
+    db: &db::DatabasePool,
+    pubkey: &VerifyingKey,
+) -> Result<Option<(i32, i32)>, Error> {
     let pubkey_bytes = pubkey.as_bytes().to_vec();
 
     let mut conn = db.get().await.map_err(|e| {
@@ -62,10 +58,10 @@ async fn get_nonce(db: &db::DatabasePool, pubkey: &VerifyingKey) -> Result<Optio
     conn.exclusive_transaction(|conn| {
         let pubkey_bytes = pubkey_bytes.clone();
         Box::pin(async move {
-            let Some(current_nonce) = program_client::table
+            let Some((client_id, current_nonce)) = program_client::table
                 .filter(program_client::public_key.eq(&pubkey_bytes))
-                .select(program_client::nonce)
+                .select((program_client::id, program_client::nonce))
-                .first::<i32>(conn)
+                .first::<(i32, i32)>(conn)
                 .await
                 .optional()?
             else {
@@ -78,7 +74,7 @@ async fn get_nonce(db: &db::DatabasePool, pubkey: &VerifyingKey) -> Result<Optio
                 .execute(conn)
                 .await?;
 
-            Ok(Some(current_nonce))
+            Ok(Some((client_id, current_nonce)))
         })
     })
     .await
@@ -88,71 +84,20 @@ async fn get_nonce(db: &db::DatabasePool, pubkey: &VerifyingKey) -> Result<Optio
     })
 }
 
-async fn approve_new_client(
-    actors: &crate::actors::GlobalActors,
-    pubkey: VerifyingKey,
-) -> Result<(), Error> {
-    let result = actors
-        .router
-        .ask(RequestClientApproval {
-            client_pubkey: pubkey,
-        })
-        .await;
-
-    match result {
-        Ok(true) => Ok(()),
-        Ok(false) => Err(Error::ApproveError(ApproveError::Denied)),
-        Err(SendError::HandlerError(e)) => {
-            error!(error = ?e, "Approval upstream error");
-            Err(Error::ApproveError(ApproveError::Upstream(e)))
-        }
-        Err(e) => {
-            error!(error = ?e, "Approval request to router failed");
-            Err(Error::ApproveError(ApproveError::Internal))
-        }
-    }
-}
-
-async fn insert_client(db: &db::DatabasePool, pubkey: &VerifyingKey) -> Result<(), Error> {
-    let now = std::time::SystemTime::now()
-        .duration_since(std::time::UNIX_EPOCH)
-        .unwrap_or_default()
-        .as_secs() as i32;
-
-    let mut conn = db.get().await.map_err(|e| {
-        error!(error = ?e, "Database pool error");
-        Error::DatabasePoolUnavailable
-    })?;
-
-    insert_into(program_client::table)
-        .values((
-            program_client::public_key.eq(pubkey.as_bytes().to_vec()),
-            program_client::nonce.eq(1), // pre-incremented; challenge uses 0
-            program_client::created_at.eq(now),
-            program_client::updated_at.eq(now),
-        ))
-        .execute(&mut conn)
-        .await
-        .map_err(|e| {
-            error!(error = ?e, "Failed to insert new client");
-            Error::DatabaseOperationFailed
-        })?;
-
-    Ok(())
-}
-
 async fn challenge_client(
     props: &mut ClientConnection,
     pubkey: VerifyingKey,
     nonce: i32,
 ) -> Result<(), Error> {
-    let challenge_pubkey = pubkey.as_bytes().to_vec();
+    let challenge = AuthChallenge {
+        pubkey: pubkey.as_bytes().to_vec(),
+        nonce,
+    };
 
     props
         .transport
-        .send(Ok(Response::AuthChallenge {
+        .send(Ok(ClientResponse {
-            pubkey: challenge_pubkey.clone(),
+            payload: Some(ClientResponsePayload::AuthChallenge(challenge.clone())),
-            nonce,
         }))
         .await
         .map_err(|e| {
@@ -160,9 +105,12 @@ async fn challenge_client(
             Error::Transport
         })?;
 
-    let signature = expect_message(&mut *props.transport, |req: Request| match req {
+    let AuthChallengeSolution { signature } =
-        Request::AuthChallengeSolution { signature } => Some(signature),
+        expect_message(&mut *props.transport, |req: ClientRequest| {
+            match req.payload? {
+                ClientRequestPayload::AuthChallengeSolution(s) => Some(s),
                 _ => None,
+            }
         })
         .await
         .map_err(|e| {
@@ -170,7 +118,7 @@ async fn challenge_client(
             Error::Transport
         })?;
 
-    let formatted = format_challenge(nonce, &challenge_pubkey);
+    let formatted = format_challenge(nonce, &challenge.pubkey);
     let sig = signature.as_slice().try_into().map_err(|_| {
         error!("Invalid signature length");
         Error::InvalidChallengeSolution
@@ -186,50 +134,48 @@ async fn challenge_client(
 
 fn connect_error_code(err: &Error) -> ConnectErrorCode {
     match err {
-        Error::ApproveError(ApproveError::Denied) => ConnectErrorCode::ApprovalDenied,
+        Error::NotRegistered => ConnectErrorCode::ApprovalDenied,
-        Error::ApproveError(ApproveError::Upstream(
-            router::ApprovalError::NoUserAgentsConnected,
-        )) => ConnectErrorCode::NoUserAgentsOnline,
         _ => ConnectErrorCode::Unknown,
     }
 }
 
-async fn authenticate(props: &mut ClientConnection) -> Result<VerifyingKey, Error> {
+async fn authenticate(props: &mut ClientConnection) -> Result<(VerifyingKey, i32), Error> {
-    let Some(Request::AuthChallengeRequest {
+    let Some(ClientRequest {
-        pubkey: challenge_pubkey,
+        payload: Some(ClientRequestPayload::AuthChallengeRequest(challenge)),
     }) = props.transport.recv().await
     else {
         return Err(Error::Transport);
     };
 
-    let pubkey_bytes = challenge_pubkey
+    let pubkey_bytes = challenge
+        .pubkey
         .as_array()
         .ok_or(Error::InvalidClientPubkeyLength)?;
     let pubkey =
         VerifyingKey::from_bytes(pubkey_bytes).map_err(|_| Error::InvalidAuthPubkeyEncoding)?;
 
-    let nonce = match get_nonce(&props.db, &pubkey).await? {
+    let (client_id, nonce) = match get_nonce(&props.db, &pubkey).await? {
-        Some(nonce) => nonce,
+        Some((client_id, nonce)) => (client_id, nonce),
-        None => {
+        None => return Err(Error::NotRegistered),
-            approve_new_client(&props.actors, pubkey).await?;
-            insert_client(&props.db, &pubkey).await?;
-            0
-        }
     };
 
     challenge_client(props, pubkey, nonce).await?;
 
-    Ok(pubkey)
+    Ok((pubkey, client_id))
 }
 
 pub async fn authenticate_and_create(mut props: ClientConnection) -> Result<ClientSession, Error> {
     match authenticate(&mut props).await {
-        Ok(_pubkey) => Ok(ClientSession::new(props)),
+        Ok((_pubkey, client_id)) => Ok(ClientSession::new(props, client_id)),
         Err(err) => {
             let code = connect_error_code(&err);
             let _ = props
                 .transport
-                .send(Ok(Response::ClientConnectError { code }))
+                .send(Ok(ClientResponse {
+                    payload: Some(ClientResponsePayload::ClientConnectError(
+                        ClientConnectError { code: code.into() },
+                    )),
+                }))
                 .await;
             Err(err)
         }

server/crates/arbiter-server/src/actors/client/mod.rs

@@ -1,4 +1,7 @@
-use arbiter_proto::transport::Bi;
+use arbiter_proto::{
+    proto::client::{ClientRequest, ClientResponse},
+    transport::Bi,
+};
 use kameo::actor::Spawn;
 use tracing::{error, info};
 
@@ -21,27 +24,7 @@ pub enum ClientError {
     Auth(#[from] auth::Error),
 }
 
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub type Transport = Box<dyn Bi<ClientRequest, Result<ClientResponse, ClientError>> + Send>;
-pub enum ConnectErrorCode {
-    Unknown,
-    ApprovalDenied,
-    NoUserAgentsOnline,
-}
-
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub enum Request {
-    AuthChallengeRequest { pubkey: Vec<u8> },
-    AuthChallengeSolution { signature: Vec<u8> },
-}
-
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub enum Response {
-    AuthChallenge { pubkey: Vec<u8>, nonce: i32 },
-    AuthOk,
-    ClientConnectError { code: ConnectErrorCode },
-}
-
-pub type Transport = Box<dyn Bi<Request, Result<Response, ClientError>> + Send>;
 
 pub struct ClientConnection {
     pub(crate) db: db::DatabasePool,

server/crates/arbiter-server/src/actors/client/session.rs

@@ -1,3 +1,13 @@
+use alloy::{consensus::TxEip1559, primitives::Address, rlp::Decodable};
+use arbiter_proto::proto::{
+    client::{
+        ClientRequest, ClientResponse, client_request::Payload as ClientRequestPayload,
+        client_response::Payload as ClientResponsePayload,
+    },
+    evm::{
+        EvmError, EvmSignTransactionResponse, evm_sign_transaction_response::Result as SignResult,
+    },
+};
 use kameo::Actor;
 use tokio::select;
 use tracing::{error, info};
@@ -5,7 +15,8 @@ use tracing::{error, info};
 use crate::{
     actors::{
         GlobalActors,
-        client::{ClientConnection, ClientError, Request, Response},
+        client::{ClientConnection, ClientError},
+        evm::ClientSignTransaction,
         router::RegisterClient,
     },
     db,
@@ -13,20 +24,64 @@ use crate::{
 
 pub struct ClientSession {
     props: ClientConnection,
+    client_id: i32,
 }
 
 impl ClientSession {
-    pub(crate) fn new(props: ClientConnection) -> Self {
+    pub(crate) fn new(props: ClientConnection, client_id: i32) -> Self {
-        Self { props }
+        Self { props, client_id }
     }
 
-    pub async fn process_transport_inbound(&mut self, req: Request) -> Output {
+    pub async fn process_transport_inbound(&mut self, req: ClientRequest) -> Output {
-        let _ = req;
+        let msg = req.payload.ok_or_else(|| {
-        Err(ClientError::UnexpectedRequestPayload)
+            error!(actor = "client", "Received message with no payload");
+            ClientError::MissingRequestPayload
+        })?;
+
+        match msg {
+            ClientRequestPayload::EvmSignTransaction(sign_req) => {
+                let wallet_address: [u8; 20] = sign_req
+                    .wallet_address
+                    .try_into()
+                    .map_err(|_| ClientError::UnexpectedRequestPayload)?;
+
+                let mut rlp_bytes: &[u8] = &sign_req.rlp_transaction;
+                let tx = TxEip1559::decode(&mut rlp_bytes)
+                    .map_err(|_| ClientError::UnexpectedRequestPayload)?;
+
+                let result = self
+                    .props
+                    .actors
+                    .evm
+                    .ask(ClientSignTransaction {
+                        client_id: self.client_id,
+                        wallet_address: Address::from_slice(&wallet_address),
+                        transaction: tx,
+                    })
+                    .await;
+
+                let response_result = match result {
+                    Ok(signature) => SignResult::Signature(signature.as_bytes().to_vec()),
+                    Err(err) => {
+                        error!(?err, "client sign transaction failed");
+                        SignResult::Error(EvmError::Internal.into())
+                    }
+                };
+
+                Ok(ClientResponse {
+                    payload: Some(ClientResponsePayload::EvmSignTransaction(
+                        EvmSignTransactionResponse {
+                            result: Some(response_result),
+                        },
+                    )),
+                })
+            }
+            _ => Err(ClientError::UnexpectedRequestPayload),
+        }
     }
 }
 
-type Output = Result<Response, ClientError>;
+type Output = Result<ClientResponse, ClientError>;
 
 impl Actor for ClientSession {
     type Args = Self;
@@ -88,6 +143,9 @@ impl ClientSession {
         use arbiter_proto::transport::DummyTransport;
         let transport: super::Transport = Box::new(DummyTransport::new());
         let props = ClientConnection::new(db, transport, actors);
-        Self { props }
+        Self {
+            props,
+            client_id: 0,
+        }
     }
 }

server/crates/arbiter-server/src/actors/evm/mod.rs

@@ -1,26 +1,21 @@
 use alloy::{consensus::TxEip1559, primitives::Address, signers::Signature};
-use diesel::{
+use diesel::{ExpressionMethods, OptionalExtension as _, QueryDsl, SelectableHelper as _, dsl::insert_into};
-    ExpressionMethods, OptionalExtension as _, QueryDsl, SelectableHelper as _, dsl::insert_into,
-};
 use diesel_async::RunQueryDsl;
 use kameo::{Actor, actor::ActorRef, messages};
+use memsafe::MemSafe;
 use rand::{SeedableRng, rng, rngs::StdRng};
 
 use crate::{
     actors::keyholder::{CreateNew, Decrypt, KeyHolder},
-    db::{
+    db::{self, DatabasePool, models::{self, EvmBasicGrant, SqliteTimestamp}, schema},
-        self, DatabasePool,
-        models::{self, SqliteTimestamp},
-        schema,
-    },
     evm::{
-        self, ListGrantsError, RunKind,
+        self, RunKind,
         policies::{
-            FullGrant, Grant, SharedGrantSettings, SpecificGrant, SpecificMeaning,
+            FullGrant, SharedGrantSettings, SpecificGrant, SpecificMeaning,
-            ether_transfer::EtherTransfer, token_transfers::TokenTransfer,
+            ether_transfer::EtherTransfer,
+            token_transfers::TokenTransfer,
         },
     },
-    safe_cell::{SafeCell, SafeCellHandle as _},
 };
 
 pub use crate::evm::safe_signer;
@@ -93,12 +88,7 @@ impl EvmActor {
         // todo: audit
         let rng = StdRng::from_rng(&mut rng());
         let engine = evm::Engine::new(db.clone());
-        Self {
+        Self { keyholder, db, rng, engine }
-            keyholder,
-            db,
-            rng,
-            engine,
-        }
     }
 }
 
@@ -108,7 +98,11 @@ impl EvmActor {
     pub async fn generate(&mut self) -> Result<Address, Error> {
         let (mut key_cell, address) = safe_signer::generate(&mut self.rng);
 
-        let plaintext = key_cell.read_inline(|reader| SafeCell::new(reader.to_vec()));
+        // Move raw key bytes into a Vec<u8> MemSafe for KeyHolder
+        let plaintext = {
+            let reader = key_cell.read().expect("MemSafe read");
+            MemSafe::new(reader.to_vec()).expect("MemSafe allocation")
+        };
 
         let aead_id: i32 = self
             .keyholder
@@ -155,24 +149,12 @@ impl EvmActor {
         match grant {
             SpecificGrant::EtherTransfer(settings) => {
                 self.engine
-                    .create_grant::<EtherTransfer>(
+                    .create_grant::<EtherTransfer>(client_id, FullGrant { basic, specific: settings })
-                        client_id,
-                        FullGrant {
-                            basic,
-                            specific: settings,
-                        },
-                    )
                     .await
             }
             SpecificGrant::TokenTransfer(settings) => {
                 self.engine
-                    .create_grant::<TokenTransfer>(
+                    .create_grant::<TokenTransfer>(client_id, FullGrant { basic, specific: settings })
-                        client_id,
-                        FullGrant {
-                            basic,
-                            specific: settings,
-                        },
-                    )
                     .await
             }
         }
@@ -190,12 +172,19 @@ impl EvmActor {
     }
 
     #[message]
-    pub async fn useragent_list_grants(&mut self) -> Result<Vec<Grant<SpecificGrant>>, Error> {
+    pub async fn useragent_list_grants(
-        match self.engine.list_all_grants().await {
+        &mut self,
-            Ok(grants) => Ok(grants),
+        wallet_id: Option<i32>,
-            Err(ListGrantsError::Database(db)) => Err(Error::Database(db)),
+    ) -> Result<Vec<EvmBasicGrant>, Error> {
-            Err(ListGrantsError::Pool(pool)) => Err(Error::DatabasePool(pool)),
+        let mut conn = self.db.get().await?;
+        let mut query = schema::evm_basic_grant::table
+            .select(EvmBasicGrant::as_select())
+            .filter(schema::evm_basic_grant::revoked_at.is_null())
+            .into_boxed();
+        if let Some(wid) = wallet_id {
+            query = query.filter(schema::evm_basic_grant::wallet_id.eq(wid));
         }
+        Ok(query.load(&mut conn).await?)
     }
 
     #[message]
@@ -215,14 +204,8 @@ impl EvmActor {
             .ok_or(SignTransactionError::WalletNotFound)?;
         drop(conn);
 
-        let meaning = self
+        let meaning = self.engine
-            .engine
+            .evaluate_transaction(wallet.id, client_id, transaction.clone(), RunKind::Execution)
-            .evaluate_transaction(
-                wallet.id,
-                client_id,
-                transaction.clone(),
-                RunKind::Execution,
-            )
             .await?;
 
         Ok(meaning)
@@ -245,23 +228,16 @@ impl EvmActor {
             .ok_or(SignTransactionError::WalletNotFound)?;
         drop(conn);
 
-        let raw_key: SafeCell<Vec<u8>> = self
+        let raw_key: MemSafe<Vec<u8>> = self
             .keyholder
-            .ask(Decrypt {
+            .ask(Decrypt { aead_id: wallet.aead_encrypted_id })
-                aead_id: wallet.aead_encrypted_id,
-            })
             .await
             .map_err(|_| SignTransactionError::KeyholderSend)?;
 
-        let signer = safe_signer::SafeSigner::from_cell(raw_key)?;
+        let signer = safe_signer::SafeSigner::from_memsafe(raw_key)?;
 
         self.engine
-            .evaluate_transaction(
+            .evaluate_transaction(wallet.id, client_id, transaction.clone(), RunKind::Execution)
-                wallet.id,
-                client_id,
-                transaction.clone(),
-                RunKind::Execution,
-            )
             .await?;
 
         use alloy::network::TxSignerSync as _;

server/crates/arbiter-server/src/actors/keyholder/encryption/v1.rs

@@ -5,13 +5,12 @@ use chacha20poly1305::{
     AeadInPlace, Key, KeyInit as _, XChaCha20Poly1305, XNonce,
     aead::{AeadMut, Error, Payload},
 };
+use memsafe::MemSafe;
 use rand::{
     Rng as _, SeedableRng,
     rngs::{StdRng, SysRng},
 };
 
-use crate::safe_cell::{SafeCell, SafeCellHandle as _};
-
 pub const ROOT_KEY_TAG: &[u8] = "arbiter/seal/v1".as_bytes();
 pub const TAG: &[u8] = "arbiter/private-key/v1".as_bytes();
 
@@ -48,37 +47,40 @@ impl<'a> TryFrom<&'a [u8]> for Nonce {
     }
 }
 
-pub struct KeyCell(pub SafeCell<Key>);
+pub struct KeyCell(pub MemSafe<Key>);
-impl From<SafeCell<Key>> for KeyCell {
+impl From<MemSafe<Key>> for KeyCell {
-    fn from(value: SafeCell<Key>) -> Self {
+    fn from(value: MemSafe<Key>) -> Self {
         Self(value)
     }
 }
-impl TryFrom<SafeCell<Vec<u8>>> for KeyCell {
+impl TryFrom<MemSafe<Vec<u8>>> for KeyCell {
     type Error = ();
 
-    fn try_from(mut value: SafeCell<Vec<u8>>) -> Result<Self, Self::Error> {
+    fn try_from(mut value: MemSafe<Vec<u8>>) -> Result<Self, Self::Error> {
-        let value = value.read();
+        let value = value.read().unwrap();
         if value.len() != size_of::<Key>() {
             return Err(());
         }
-        let cell = SafeCell::new_inline(|cell_write: &mut Key| {
+        let mut cell = MemSafe::new(Key::default()).unwrap();
-            cell_write.copy_from_slice(&value);
+        {
-        });
+            let mut cell_write = cell.write().unwrap();
+            let cell_slice: &mut [u8] = cell_write.as_mut();
+            cell_slice.copy_from_slice(&value);
+        }
         Ok(Self(cell))
     }
 }
 
 impl KeyCell {
     pub fn new_secure_random() -> Self {
-        let key = SafeCell::new_inline(|key_buffer: &mut Key| {
+        let mut key = MemSafe::new(Key::default()).unwrap();
-            #[allow(
+        {
-                clippy::unwrap_used,
+            let mut key_buffer = key.write().unwrap();
-                reason = "Rng failure is unrecoverable and should panic"
+            let key_buffer: &mut [u8] = key_buffer.as_mut();
-            )]
+
             let mut rng = StdRng::try_from_rng(&mut SysRng).unwrap();
             rng.fill_bytes(key_buffer);
-        });
+        }
 
         key.into()
     }
@@ -89,7 +91,7 @@ impl KeyCell {
         associated_data: &[u8],
         mut buffer: impl AsMut<Vec<u8>>,
     ) -> Result<(), Error> {
-        let key_reader = self.0.read();
+        let key_reader = self.0.read().unwrap();
         let key_ref = key_reader.deref();
         let cipher = XChaCha20Poly1305::new(key_ref);
         let nonce = XNonce::from_slice(nonce.0.as_ref());
@@ -100,13 +102,13 @@ impl KeyCell {
         &mut self,
         nonce: &Nonce,
         associated_data: &[u8],
-        buffer: &mut SafeCell<Vec<u8>>,
+        buffer: &mut MemSafe<Vec<u8>>,
     ) -> Result<(), Error> {
-        let key_reader = self.0.read();
+        let key_reader = self.0.read().unwrap();
         let key_ref = key_reader.deref();
         let cipher = XChaCha20Poly1305::new(key_ref);
         let nonce = XNonce::from_slice(nonce.0.as_ref());
-        let mut buffer = buffer.write();
+        let mut buffer = buffer.write().unwrap();
         let buffer: &mut Vec<u8> = buffer.as_mut();
         cipher.decrypt_in_place(nonce, associated_data, buffer)
     }
@@ -117,7 +119,7 @@ impl KeyCell {
         associated_data: &[u8],
         plaintext: impl AsRef<[u8]>,
     ) -> Result<Vec<u8>, Error> {
-        let key_reader = self.0.read();
+        let key_reader = self.0.read().unwrap();
         let key_ref = key_reader.deref();
         let mut cipher = XChaCha20Poly1305::new(key_ref);
         let nonce = XNonce::from_slice(nonce.0.as_ref());
@@ -137,10 +139,6 @@ pub type Salt = [u8; ArgonSalt::RECOMMENDED_LENGTH];
 
 pub fn generate_salt() -> Salt {
     let mut salt = Salt::default();
-    #[allow(
-        clippy::unwrap_used,
-        reason = "Rng failure is unrecoverable and should panic"
-    )]
     let mut rng = StdRng::try_from_rng(&mut SysRng).unwrap();
     rng.fill_bytes(&mut salt);
     salt
@@ -148,23 +146,19 @@ pub fn generate_salt() -> Salt {
 
 /// User password might be of different length, have not enough entropy, etc...
 /// Derive a fixed-length key from the password using Argon2id, which is designed for password hashing and key derivation.
-pub fn derive_seal_key(mut password: SafeCell<Vec<u8>>, salt: &Salt) -> KeyCell {
+pub fn derive_seal_key(mut password: MemSafe<Vec<u8>>, salt: &Salt) -> KeyCell {
-    #[allow(clippy::unwrap_used)]
     let params = argon2::Params::new(262_144, 3, 4, None).unwrap();
     let hasher = Argon2::new(Algorithm::Argon2id, argon2::Version::V0x13, params);
-    let mut key = SafeCell::new(Key::default());
+    let mut key = MemSafe::new(Key::default()).unwrap();
-    password.read_inline(|password_source| {
+    {
-        let mut key_buffer = key.write();
+        let password_source = password.read().unwrap();
+        let mut key_buffer = key.write().unwrap();
         let key_buffer: &mut [u8] = key_buffer.as_mut();
 
-        #[allow(
-            clippy::unwrap_used,
-            reason = "Better fail completely than return a weak key"
-        )]
         hasher
             .hash_password_into(password_source.deref(), salt, key_buffer)
             .unwrap();
-    });
+    }
 
     key.into()
 }
@@ -172,20 +166,20 @@ pub fn derive_seal_key(mut password: SafeCell<Vec<u8>>, salt: &Salt) -> KeyCell
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::safe_cell::SafeCell;
+    use memsafe::MemSafe;
 
     #[test]
     pub fn derive_seal_key_deterministic() {
         static PASSWORD: &[u8] = b"password";
-        let password = SafeCell::new(PASSWORD.to_vec());
+        let password = MemSafe::new(PASSWORD.to_vec()).unwrap();
-        let password2 = SafeCell::new(PASSWORD.to_vec());
+        let password2 = MemSafe::new(PASSWORD.to_vec()).unwrap();
         let salt = generate_salt();
 
         let mut key1 = derive_seal_key(password, &salt);
         let mut key2 = derive_seal_key(password2, &salt);
 
-        let key1_reader = key1.0.read();
+        let key1_reader = key1.0.read().unwrap();
-        let key2_reader = key2.0.read();
+        let key2_reader = key2.0.read().unwrap();
 
         assert_eq!(key1_reader.deref(), key2_reader.deref());
     }
@@ -193,11 +187,11 @@ mod tests {
     #[test]
     pub fn successful_derive() {
         static PASSWORD: &[u8] = b"password";
-        let password = SafeCell::new(PASSWORD.to_vec());
+        let password = MemSafe::new(PASSWORD.to_vec()).unwrap();
         let salt = generate_salt();
 
         let mut key = derive_seal_key(password, &salt);
-        let key_reader = key.0.read();
+        let key_reader = key.0.read().unwrap();
         let key_ref = key_reader.deref();
 
         assert_ne!(key_ref.as_slice(), &[0u8; 32][..]);
@@ -206,7 +200,7 @@ mod tests {
     #[test]
     pub fn encrypt_decrypt() {
         static PASSWORD: &[u8] = b"password";
-        let password = SafeCell::new(PASSWORD.to_vec());
+        let password = MemSafe::new(PASSWORD.to_vec()).unwrap();
         let salt = generate_salt();
 
         let mut key = derive_seal_key(password, &salt);
@@ -218,12 +212,12 @@ mod tests {
             .unwrap();
         assert_ne!(buffer, b"secret data");
 
-        let mut buffer = SafeCell::new(buffer);
+        let mut buffer = MemSafe::new(buffer).unwrap();
 
         key.decrypt_in_place(&nonce, associated_data, &mut buffer)
             .unwrap();
 
-        let buffer = buffer.read();
+        let buffer = buffer.read().unwrap();
         assert_eq!(*buffer, b"secret data");
     }
 

server/crates/arbiter-server/src/actors/keyholder/mod.rs

@@ -5,17 +5,14 @@ use diesel::{
 };
 use diesel_async::{AsyncConnection, RunQueryDsl};
 use kameo::{Actor, Reply, messages};
+use memsafe::MemSafe;
 use strum::{EnumDiscriminants, IntoDiscriminant};
 use tracing::{error, info};
 
-use crate::safe_cell::SafeCell;
+use crate::db::{
-use crate::{
-    db::{
     self,
     models::{self, RootKeyHistory},
     schema::{self},
-    },
-    safe_cell::SafeCellHandle as _,
 };
 use encryption::v1::{self, KeyCell, Nonce};
 
@@ -139,7 +136,7 @@ impl KeyHolder {
     }
 
     #[message]
-    pub async fn bootstrap(&mut self, seal_key_raw: SafeCell<Vec<u8>>) -> Result<(), Error> {
+    pub async fn bootstrap(&mut self, seal_key_raw: MemSafe<Vec<u8>>) -> Result<(), Error> {
         if !matches!(self.state, State::Unbootstrapped) {
             return Err(Error::AlreadyBootstrapped);
         }
@@ -151,15 +148,16 @@ impl KeyHolder {
         let root_key_nonce = v1::Nonce::default();
         let data_encryption_nonce = v1::Nonce::default();
 
-        let root_key_ciphertext: Vec<u8> = root_key.0.read_inline(|reader| {
+        let root_key_ciphertext: Vec<u8> = {
-            let root_key_reader = reader.as_slice();
+            let root_key_reader = root_key.0.read().unwrap();
+            let root_key_reader = root_key_reader.as_slice();
             seal_key
                 .encrypt(&root_key_nonce, v1::ROOT_KEY_TAG, root_key_reader)
                 .map_err(|err| {
                     error!(?err, "Fatal bootstrap error");
                     Error::Encryption(err)
-                })
+                })?
-        })?;
+        };
 
         let mut conn = self.db.get().await?;
 
@@ -201,7 +199,7 @@ impl KeyHolder {
     }
 
     #[message]
-    pub async fn try_unseal(&mut self, seal_key_raw: SafeCell<Vec<u8>>) -> Result<(), Error> {
+    pub async fn try_unseal(&mut self, seal_key_raw: MemSafe<Vec<u8>>) -> Result<(), Error> {
         let State::Sealed {
             root_key_history_id,
         } = &self.state
@@ -227,7 +225,7 @@ impl KeyHolder {
         })?;
         let mut seal_key = v1::derive_seal_key(seal_key_raw, &salt);
 
-        let mut root_key = SafeCell::new(current_key.ciphertext.clone());
+        let mut root_key = MemSafe::new(current_key.ciphertext.clone()).unwrap();
 
         let nonce = v1::Nonce::try_from(current_key.root_key_encryption_nonce.as_slice()).map_err(
             |_| {
@@ -258,7 +256,7 @@ impl KeyHolder {
 
     // Decrypts the `aead_encrypted` entry with the given ID and returns the plaintext
     #[message]
-    pub async fn decrypt(&mut self, aead_id: i32) -> Result<SafeCell<Vec<u8>>, Error> {
+    pub async fn decrypt(&mut self, aead_id: i32) -> Result<MemSafe<Vec<u8>>, Error> {
         let State::Unsealed { root_key, .. } = &mut self.state else {
             return Err(Error::NotBootstrapped);
         };
@@ -281,14 +279,14 @@ impl KeyHolder {
             );
             Error::BrokenDatabase
         })?;
-        let mut output = SafeCell::new(row.ciphertext);
+        let mut output = MemSafe::new(row.ciphertext).unwrap();
         root_key.decrypt_in_place(&nonce, v1::TAG, &mut output)?;
         Ok(output)
     }
 
     // Creates new `aead_encrypted` entry in the database and returns it's ID
     #[message]
-    pub async fn create_new(&mut self, mut plaintext: SafeCell<Vec<u8>>) -> Result<i32, Error> {
+    pub async fn create_new(&mut self, mut plaintext: MemSafe<Vec<u8>>) -> Result<i32, Error> {
         let State::Unsealed {
             root_key,
             root_key_history_id,
@@ -301,7 +299,7 @@ impl KeyHolder {
         // Borrow checker note: &mut borrow a few lines above is disjoint from this field
         let nonce = Self::get_new_nonce(&self.db, *root_key_history_id).await?;
 
-        let mut ciphertext_buffer = plaintext.write();
+        let mut ciphertext_buffer = plaintext.write().unwrap();
         let ciphertext_buffer: &mut Vec<u8> = ciphertext_buffer.as_mut();
         root_key.encrypt_in_place(&nonce, v1::TAG, &mut *ciphertext_buffer)?;
 
@@ -315,7 +313,7 @@ impl KeyHolder {
                 current_nonce: nonce.to_vec(),
                 schema_version: 1,
                 associated_root_key_id: *root_key_history_id,
-                created_at: Utc::now().into(),
+                created_at: Utc::now().into()
             })
             .returning(schema::aead_encrypted::id)
             .get_result(&mut conn)
@@ -350,17 +348,15 @@ mod tests {
     use diesel::SelectableHelper;
     
     use diesel_async::RunQueryDsl;
+    use memsafe::MemSafe;
 
-    use crate::{
+    use crate::db::{self};
-        db::{self},
-        safe_cell::SafeCell,
-    };
 
     use super::*;
 
     async fn bootstrapped_actor(db: &db::DatabasePool) -> KeyHolder {
         let mut actor = KeyHolder::new(db.clone()).await.unwrap();
-        let seal_key = SafeCell::new(b"test-seal-key".to_vec());
+        let seal_key = MemSafe::new(b"test-seal-key".to_vec()).unwrap();
         actor.bootstrap(seal_key).await.unwrap();
         actor
     }
@@ -395,7 +391,7 @@ mod tests {
         assert_eq!(root_row.data_encryption_nonce, n2.to_vec());
 
         let id = actor
-            .create_new(SafeCell::new(b"post-interleave".to_vec()))
+            .create_new(MemSafe::new(b"post-interleave".to_vec()).unwrap())
             .await
             .unwrap();
         let row: models::AeadEncrypted = schema::aead_encrypted::table

server/crates/arbiter-server/src/actors/router/mod.rs

@@ -1,20 +1,14 @@
 use std::{collections::HashMap, ops::ControlFlow};
 
-use ed25519_dalek::VerifyingKey;
 use kameo::{
     Actor,
     actor::{ActorId, ActorRef},
     messages,
     prelude::{ActorStopReason, Context, WeakActorRef},
-    reply::DelegatedReply,
 };
-use tokio::{sync::watch, task::JoinSet};
+use tracing::info;
-use tracing::{info, warn};
 
-use crate::actors::{
+use crate::actors::{client::session::ClientSession, user_agent::session::UserAgentSession};
-    client::session::ClientSession,
-    user_agent::session::{RequestNewClientApproval, UserAgentSession},
-};
 
 #[derive(Default)]
 pub struct MessageRouter {
@@ -56,73 +50,6 @@ impl Actor for MessageRouter {
     }
 }
 
-#[derive(Debug, thiserror::Error, Clone, PartialEq, Eq, Hash)]
-pub enum ApprovalError {
-    #[error("No user agents connected")]
-    NoUserAgentsConnected,
-}
-
-async fn request_client_approval(
-    user_agents: &[WeakActorRef<UserAgentSession>],
-    client_pubkey: VerifyingKey,
-) -> Result<bool, ApprovalError> {
-    if user_agents.is_empty() {
-        return Err(ApprovalError::NoUserAgentsConnected);
-    }
-
-    let mut pool = JoinSet::new();
-    let (cancel_tx, cancel_rx) = watch::channel(());
-
-    for weak_ref in user_agents {
-        match weak_ref.upgrade() {
-            Some(agent) => {
-                let cancel_rx = cancel_rx.clone();
-                pool.spawn(async move {
-                    agent
-                        .ask(RequestNewClientApproval {
-                            client_pubkey,
-                            cancel_flag: cancel_rx.clone(),
-                        })
-                        .await
-                });
-            }
-            None => {
-                warn!(
-                    id = weak_ref.id().to_string(),
-                    actor = "MessageRouter",
-                    event = "useragent.disconnected_before_approval"
-                );
-            }
-        }
-    }
-
-    while let Some(result) = pool.join_next().await {
-        match result {
-            Ok(Ok(approved)) => {
-                // cancel other pending requests
-                let _ = cancel_tx.send(());
-                return Ok(approved);
-            }
-            Ok(Err(err)) => {
-                warn!(
-                    ?err,
-                    actor = "MessageRouter",
-                    event = "useragent.approval_error"
-                );
-            }
-            Err(err) => {
-                warn!(
-                    ?err,
-                    actor = "MessageRouter",
-                    event = "useragent.approval_task_failed"
-                );
-            }
-        }
-    }
-
-    Err(ApprovalError::NoUserAgentsConnected)
-}
-
 #[messages]
 impl MessageRouter {
     #[message(ctx)]
@@ -146,29 +73,4 @@ impl MessageRouter {
         ctx.actor_ref().link(&actor).await;
         self.clients.insert(actor.id(), actor);
     }
-
-    #[message(ctx)]
-    pub async fn request_client_approval(
-        &mut self,
-        client_pubkey: VerifyingKey,
-        ctx: &mut Context<Self, DelegatedReply<Result<bool, ApprovalError>>>,
-    ) -> DelegatedReply<Result<bool, ApprovalError>> {
-        let (reply, Some(reply_sender)) = ctx.reply_sender() else {
-            unreachable!("Expected `request_client_approval` to have callback channel");
-        };
-
-        let weak_refs = self
-            .user_agents
-            .values()
-            .map(|agent| agent.downgrade())
-            .collect::<Vec<_>>();
-
-        // handle in subtask to not to lock the actor
-        tokio::task::spawn(async move {
-            let result = request_client_approval(&weak_refs, client_pubkey).await;
-            reply_sender.send(result);
-        });
-
-        reply
-    }
 }

server/crates/arbiter-server/src/actors/user_agent/auth.rs

@@ -1,9 +1,12 @@
+use arbiter_proto::proto::user_agent::{
+    AuthChallengeRequest, AuthChallengeSolution, KeyType as ProtoKeyType, UserAgentRequest,
+    user_agent_request::Payload as UserAgentRequestPayload,
+};
 use tracing::error;
 
 use crate::actors::user_agent::{
-    Request, UserAgentConnection,
+    UserAgentConnection,
-    auth::state::{AuthContext, AuthStateMachine},
+    auth::state::{AuthContext, AuthPublicKey, AuthStateMachine},
-    AuthPublicKey,
     session::UserAgentSession,
 };
 
@@ -34,20 +37,54 @@ pub enum Error {
 mod state;
 use state::*;
 
-fn parse_auth_event(payload: Request) -> Result<AuthEvents, Error> {
+fn parse_pubkey(key_type: ProtoKeyType, pubkey: Vec<u8>) -> Result<AuthPublicKey, Error> {
+    match key_type {
+        // UNSPECIFIED treated as Ed25519 for backward compatibility
+        ProtoKeyType::Unspecified | ProtoKeyType::Ed25519 => {
+            let pubkey_bytes = pubkey.as_array().ok_or(Error::InvalidClientPubkeyLength)?;
+            let key = ed25519_dalek::VerifyingKey::from_bytes(pubkey_bytes)
+                .map_err(|_| Error::InvalidAuthPubkeyEncoding)?;
+            Ok(AuthPublicKey::Ed25519(key))
+        }
+        ProtoKeyType::EcdsaSecp256k1 => {
+            // Public key is sent as 33-byte SEC1 compressed point
+            let key = k256::ecdsa::VerifyingKey::from_sec1_bytes(&pubkey)
+                .map_err(|_| Error::InvalidAuthPubkeyEncoding)?;
+            Ok(AuthPublicKey::EcdsaSecp256k1(key))
+        }
+        ProtoKeyType::Rsa => {
+            use rsa::pkcs8::DecodePublicKey as _;
+            let key = rsa::RsaPublicKey::from_public_key_der(&pubkey)
+                .map_err(|_| Error::InvalidAuthPubkeyEncoding)?;
+            Ok(AuthPublicKey::Rsa(key))
+        }
+    }
+}
+
+fn parse_auth_event(payload: UserAgentRequestPayload) -> Result<AuthEvents, Error> {
     match payload {
-        Request::AuthChallengeRequest {
+        UserAgentRequestPayload::AuthChallengeRequest(AuthChallengeRequest {
             pubkey,
             bootstrap_token: None,
-        } => Ok(AuthEvents::AuthRequest(ChallengeRequest { pubkey })),
+            key_type,
-        Request::AuthChallengeRequest {
+        }) => {
+            let kt = ProtoKeyType::try_from(key_type).unwrap_or(ProtoKeyType::Unspecified);
+            Ok(AuthEvents::AuthRequest(ChallengeRequest {
+                pubkey: parse_pubkey(kt, pubkey)?,
+            }))
+        }
+        UserAgentRequestPayload::AuthChallengeRequest(AuthChallengeRequest {
             pubkey,
             bootstrap_token: Some(token),
-        } => Ok(AuthEvents::BootstrapAuthRequest(BootstrapAuthRequest {
+            key_type,
-            pubkey,
+        }) => {
+            let kt = ProtoKeyType::try_from(key_type).unwrap_or(ProtoKeyType::Unspecified);
+            Ok(AuthEvents::BootstrapAuthRequest(BootstrapAuthRequest {
+                pubkey: parse_pubkey(kt, pubkey)?,
                 token,
-        })),
+            }))
-        Request::AuthChallengeSolution { signature } => {
+        }
+        UserAgentRequestPayload::AuthChallengeSolution(AuthChallengeSolution { signature }) => {
             Ok(AuthEvents::ReceivedSolution(ChallengeSolution {
                 solution: signature,
             }))
@@ -62,7 +99,10 @@ pub async fn authenticate(props: &mut UserAgentConnection) -> Result<AuthPublicK
     loop {
         // `state` holds a mutable reference to `props` so we can't access it directly here
         let transport = state.context_mut().conn.transport.as_mut();
-        let Some(payload) = transport.recv().await else {
+        let Some(UserAgentRequest {
+            payload: Some(payload),
+        }) = transport.recv().await
+        else {
             return Err(Error::Transport);
         };
 

server/crates/arbiter-server/src/actors/user_agent/auth/state.rs

@@ -1,16 +1,52 @@
+use arbiter_proto::proto::user_agent::{
+    AuthChallenge, UserAgentResponse, user_agent_response::Payload as UserAgentResponsePayload,
+};
 use diesel::{ExpressionMethods as _, OptionalExtension as _, QueryDsl, update};
 use diesel_async::RunQueryDsl;
 use tracing::error;
 
 use super::Error;
 use crate::{
-    actors::{
+    actors::{bootstrap::ConsumeToken, user_agent::UserAgentConnection},
-        bootstrap::ConsumeToken,
+    db::{models::KeyType, schema},
-        user_agent::{AuthPublicKey, Response, UserAgentConnection},
-    },
-    db::schema,
 };
 
+/// Abstraction over Ed25519 / ECDSA-secp256k1 / RSA public keys used during the auth handshake.
+#[derive(Clone)]
+pub enum AuthPublicKey {
+    Ed25519(ed25519_dalek::VerifyingKey),
+    /// Compressed SEC1 public key; signature bytes are raw 64-byte (r||s).
+    EcdsaSecp256k1(k256::ecdsa::VerifyingKey),
+    /// RSA-2048+ public key (Windows Hello / KeyCredentialManager); signature bytes are PSS+SHA-256.
+    Rsa(rsa::RsaPublicKey),
+}
+
+impl AuthPublicKey {
+    /// Canonical bytes stored in DB and echoed back in the challenge.
+    /// Ed25519: raw 32 bytes. ECDSA: SEC1 compressed 33 bytes. RSA: DER-encoded SPKI.
+    pub fn to_stored_bytes(&self) -> Vec<u8> {
+        match self {
+            AuthPublicKey::Ed25519(k) => k.to_bytes().to_vec(),
+            // SEC1 compressed (33 bytes) is the natural compact format for secp256k1
+            AuthPublicKey::EcdsaSecp256k1(k) => k.to_encoded_point(true).as_bytes().to_vec(),
+            AuthPublicKey::Rsa(k) => {
+                use rsa::pkcs8::EncodePublicKey as _;
+                k.to_public_key_der()
+                    .expect("rsa SPKI encoding is infallible")
+                    .to_vec()
+            }
+        }
+    }
+
+    pub fn key_type(&self) -> KeyType {
+        match self {
+            AuthPublicKey::Ed25519(_) => KeyType::Ed25519,
+            AuthPublicKey::EcdsaSecp256k1(_) => KeyType::EcdsaSecp256k1,
+            AuthPublicKey::Rsa(_) => KeyType::Rsa,
+        }
+    }
+}
+
 pub struct ChallengeRequest {
     pub pubkey: AuthPublicKey,
 }
@@ -21,7 +57,7 @@ pub struct BootstrapAuthRequest {
 }
 
 pub struct ChallengeContext {
-    pub challenge_nonce: i32,
+    pub challenge: AuthChallenge,
     pub key: AuthPublicKey,
 }
 
@@ -34,8 +70,8 @@ smlang::statemachine!(
     custom_error: true,
     transitions: {
         *Init + AuthRequest(ChallengeRequest) / async prepare_challenge = SentChallenge(ChallengeContext),
-        Init + BootstrapAuthRequest(BootstrapAuthRequest) / async verify_bootstrap_token = AuthOk(AuthPublicKey),
+        Init + BootstrapAuthRequest(BootstrapAuthRequest) [async verify_bootstrap_token] / provide_key_bootstrap = AuthOk(AuthPublicKey),
-        SentChallenge(ChallengeContext) + ReceivedSolution(ChallengeSolution) / async verify_solution = AuthOk(AuthPublicKey),
+        SentChallenge(ChallengeContext) + ReceivedSolution(ChallengeSolution) [async verify_solution] / provide_key = AuthOk(AuthPublicKey),
     }
 );
 
@@ -111,71 +147,12 @@ impl<'a> AuthContext<'a> {
 impl AuthStateMachineContext for AuthContext<'_> {
     type Error = Error;
 
-    async fn prepare_challenge(
-        &mut self,
-        ChallengeRequest { pubkey }: ChallengeRequest,
-    ) -> Result<ChallengeContext, Self::Error> {
-        let stored_bytes = pubkey.to_stored_bytes();
-        let nonce = create_nonce(&self.conn.db, &stored_bytes).await?;
-
-        self.conn
-            .transport
-            .send(Ok(Response::AuthChallenge { nonce }))
-            .await
-            .map_err(|e| {
-                error!(?e, "Failed to send auth challenge");
-                Error::Transport
-            })?;
-
-        Ok(ChallengeContext {
-            challenge_nonce: nonce,
-            key: pubkey,
-        })
-    }
-
-    #[allow(missing_docs)]
-    #[allow(clippy::result_unit_err)]
-    async fn verify_bootstrap_token(
-        &mut self,
-        BootstrapAuthRequest { pubkey, token }: BootstrapAuthRequest,
-    ) -> Result<AuthPublicKey, Self::Error> {
-        let token_ok: bool = self
-            .conn
-            .actors
-            .bootstrapper
-            .ask(ConsumeToken {
-                token: token.clone(),
-            })
-            .await
-            .map_err(|e| {
-                error!(?e, "Failed to consume bootstrap token");
-                Error::BootstrapperActorUnreachable
-            })?;
-
-        if !token_ok {
-            error!("Invalid bootstrap token provided");
-            return Err(Error::InvalidBootstrapToken);
-        }
-
-        register_key(&self.conn.db, &pubkey).await?;
-
-        self.conn
-                .transport
-                .send(Ok(Response::AuthOk))
-                .await
-                .map_err(|_| Error::Transport)?;
-
-        Ok(pubkey)
-    }
-
-    #[allow(missing_docs)]
-    #[allow(clippy::unused_unit)]
     async fn verify_solution(
-        &mut self,
+        &self,
-        ChallengeContext { challenge_nonce, key }: &ChallengeContext,
+        ChallengeContext { challenge, key }: &ChallengeContext,
-        ChallengeSolution { solution }: ChallengeSolution,
+        ChallengeSolution { solution }: &ChallengeSolution,
-    ) -> Result<AuthPublicKey, Self::Error> {
+    ) -> Result<bool, Self::Error> {
-        let formatted = arbiter_proto::format_challenge(*challenge_nonce, &key.to_stored_bytes());
+        let formatted = arbiter_proto::format_challenge(challenge.nonce, &challenge.pubkey);
 
         let valid = match key {
             AuthPublicKey::Ed25519(vk) => {
@@ -204,14 +181,117 @@ impl AuthStateMachineContext for AuthContext<'_> {
             }
         };
 
-        if valid {
+        Ok(valid)
-            self.conn
-                .transport
-                .send(Ok(Response::AuthOk))
-                .await
-                .map_err(|_| Error::Transport)?;
     }
 
-        Ok(key.clone())
+    async fn prepare_challenge(
+        &mut self,
+        ChallengeRequest { pubkey }: ChallengeRequest,
+    ) -> Result<ChallengeContext, Self::Error> {
+        let stored_bytes = pubkey.to_stored_bytes();
+        let nonce = create_nonce(&self.conn.db, &stored_bytes).await?;
+
+        let challenge = AuthChallenge {
+            pubkey: stored_bytes,
+            nonce,
+        };
+
+        self.conn
+            .transport
+            .send(Ok(UserAgentResponse {
+                payload: Some(UserAgentResponsePayload::AuthChallenge(challenge.clone())),
+            }))
+            .await
+            .map_err(|e| {
+                error!(?e, "Failed to send auth challenge");
+                Error::Transport
+            })?;
+
+        Ok(ChallengeContext {
+            challenge,
+            key: pubkey,
+        })
+    }
+
+    #[allow(missing_docs)]
+    #[allow(clippy::result_unit_err)]
+    async fn verify_bootstrap_token(
+        &self,
+        BootstrapAuthRequest { pubkey, token }: &BootstrapAuthRequest,
+    ) -> Result<bool, Self::Error> {
+        let token_ok: bool = self
+            .conn
+            .actors
+            .bootstrapper
+            .ask(ConsumeToken {
+                token: token.clone(),
+            })
+            .await
+            .map_err(|e| {
+                error!(?e, "Failed to consume bootstrap token");
+                Error::BootstrapperActorUnreachable
+            })?;
+
+        if !token_ok {
+            error!("Invalid bootstrap token provided");
+            return Err(Error::InvalidBootstrapToken);
+        }
+
+        register_key(&self.conn.db, pubkey).await?;
+
+        Ok(true)
+    }
+
+    fn provide_key_bootstrap(
+        &mut self,
+        event_data: BootstrapAuthRequest,
+    ) -> Result<AuthPublicKey, Self::Error> {
+        Ok(event_data.pubkey)
+    }
+
+    fn provide_key(
+        &mut self,
+        state_data: &ChallengeContext,
+        _: ChallengeSolution,
+    ) -> Result<AuthPublicKey, Self::Error> {
+        // ChallengeContext.key cannot be taken by value because smlang passes it by ref;
+        // we reconstruct stored bytes and return them wrapped in Ed25519 placeholder.
+        // Session uses only the raw bytes, so we carry them via a Vec<u8>.
+        // IMPORTANT: do NOT simplify this by storing the key type separately — the
+        // `AuthPublicKey` enum IS the source of truth for key bytes and type.
+        //
+        // smlang state-machine trait requires returning an owned value from `provide_key`,
+        // but `state_data` is only available by shared reference here.  We extract the
+        // stored bytes and re-wrap as the correct variant so the caller can call
+        // `to_stored_bytes()` / `key_type()` without losing information.
+        let bytes = state_data.challenge.pubkey.clone();
+        let key_type = state_data.key.key_type();
+        let rebuilt = match key_type {
+            crate::db::models::KeyType::Ed25519 => {
+                let arr: &[u8; 32] = bytes
+                    .as_slice()
+                    .try_into()
+                    .expect("ed25519 pubkey must be 32 bytes in challenge");
+                AuthPublicKey::Ed25519(
+                    ed25519_dalek::VerifyingKey::from_bytes(arr)
+                        .expect("key was already validated in parse_auth_event"),
+                )
+            }
+            crate::db::models::KeyType::EcdsaSecp256k1 => {
+                // bytes are SEC1 compressed (33 bytes produced by to_encoded_point(true))
+                AuthPublicKey::EcdsaSecp256k1(
+                    k256::ecdsa::VerifyingKey::from_sec1_bytes(&bytes)
+                        .expect("ecdsa key was already validated in parse_auth_event"),
+                )
+            }
+            crate::db::models::KeyType::Rsa => {
+                use rsa::pkcs8::DecodePublicKey as _;
+                AuthPublicKey::Rsa(
+                    rsa::RsaPublicKey::from_public_key_der(&bytes)
+                        .expect("rsa key was already validated in parse_auth_event"),
+                )
+            }
+        };
+        Ok(rebuilt)
     }
 }

server/crates/arbiter-server/src/actors/user_agent/mod.rs

@@ -1,17 +1,19 @@
-use alloy::primitives::Address;
+use arbiter_proto::{
-use arbiter_proto::transport::Bi;
+    proto::user_agent::{UserAgentRequest, UserAgentResponse},
+    transport::Bi,
+};
 use kameo::actor::Spawn as _;
 use tracing::{error, info};
 
 use crate::{
-    actors::{GlobalActors, evm, user_agent::session::UserAgentSession},
+    actors::{GlobalActors, user_agent::session::UserAgentSession},
-    db::{self, models::KeyType},
+    db::{self},
-    evm::policies::SharedGrantSettings,
-    evm::policies::{Grant, SpecificGrant},
 };
 
 #[derive(Debug, thiserror::Error, PartialEq)]
 pub enum TransportResponseError {
+    #[error("Expected message with payload")]
+    MissingRequestPayload,
     #[error("Unexpected request payload")]
     UnexpectedRequestPayload,
     #[error("Invalid state for unseal encrypted key")]
@@ -28,127 +30,8 @@ pub enum TransportResponseError {
     ConnectionRegistrationFailed,
 }
 
-/// Abstraction over Ed25519 / ECDSA-secp256k1 / RSA public keys used during the auth handshake.
+pub type Transport =
-#[derive(Clone, Debug)]
+    Box<dyn Bi<UserAgentRequest, Result<UserAgentResponse, TransportResponseError>> + Send>;
-pub enum AuthPublicKey {
-    Ed25519(ed25519_dalek::VerifyingKey),
-    /// Compressed SEC1 public key; signature bytes are raw 64-byte (r||s).
-    EcdsaSecp256k1(k256::ecdsa::VerifyingKey),
-    /// RSA-2048+ public key (Windows Hello / KeyCredentialManager); signature bytes are PSS+SHA-256.
-    Rsa(rsa::RsaPublicKey),
-}
-
-impl AuthPublicKey {
-    /// Canonical bytes stored in DB and echoed back in the challenge.
-    /// Ed25519: raw 32 bytes. ECDSA: SEC1 compressed 33 bytes. RSA: DER-encoded SPKI.
-    pub fn to_stored_bytes(&self) -> Vec<u8> {
-        match self {
-            AuthPublicKey::Ed25519(k) => k.to_bytes().to_vec(),
-            // SEC1 compressed (33 bytes) is the natural compact format for secp256k1
-            AuthPublicKey::EcdsaSecp256k1(k) => k.to_encoded_point(true).as_bytes().to_vec(),
-            AuthPublicKey::Rsa(k) => {
-                use rsa::pkcs8::EncodePublicKey as _;
-                #[allow(clippy::expect_used)]
-                k.to_public_key_der()
-                    .expect("rsa SPKI encoding is infallible")
-                    .to_vec()
-            }
-        }
-    }
-
-    pub fn key_type(&self) -> KeyType {
-        match self {
-            AuthPublicKey::Ed25519(_) => KeyType::Ed25519,
-            AuthPublicKey::EcdsaSecp256k1(_) => KeyType::EcdsaSecp256k1,
-            AuthPublicKey::Rsa(_) => KeyType::Rsa,
-        }
-    }
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum UnsealError {
-    InvalidKey,
-    Unbootstrapped,
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum BootstrapError {
-    AlreadyBootstrapped,
-    InvalidKey,
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum VaultState {
-    Unbootstrapped,
-    Sealed,
-    Unsealed,
-}
-
-#[derive(Debug, Clone)]
-pub enum Request {
-    AuthChallengeRequest {
-        pubkey: AuthPublicKey,
-        bootstrap_token: Option<String>,
-    },
-    AuthChallengeSolution {
-        signature: Vec<u8>,
-    },
-    UnsealStart {
-        client_pubkey: x25519_dalek::PublicKey,
-    },
-    UnsealEncryptedKey {
-        nonce: Vec<u8>,
-        ciphertext: Vec<u8>,
-        associated_data: Vec<u8>,
-    },
-    BootstrapEncryptedKey {
-        nonce: Vec<u8>,
-        ciphertext: Vec<u8>,
-        associated_data: Vec<u8>,
-    },
-    QueryVaultState,
-    EvmWalletCreate,
-    EvmWalletList,
-    ClientConnectionResponse {
-        approved: bool,
-    },
-
-    ListGrants,
-    EvmGrantCreate {
-        client_id: i32,
-        shared: SharedGrantSettings,
-        specific: SpecificGrant,
-    },
-    EvmGrantDelete {
-        grant_id: i32,
-    },
-}
-
-#[derive(Debug)]
-pub enum Response {
-    AuthChallenge {
-        nonce: i32,
-    },
-    AuthOk,
-    UnsealStartResponse {
-        server_pubkey: x25519_dalek::PublicKey,
-    },
-    UnsealResult(Result<(), UnsealError>),
-    BootstrapResult(Result<(), BootstrapError>),
-    VaultState(VaultState),
-    ClientConnectionRequest {
-        pubkey: ed25519_dalek::VerifyingKey,
-    },
-    ClientConnectionCancel,
-    EvmWalletCreate(Result<(), evm::Error>),
-    EvmWalletList(Vec<Address>),
-
-    ListGrants(Vec<Grant<SpecificGrant>>),
-    EvmGrantCreate(Result<i32, evm::Error>),
-    EvmGrantDelete(Result<(), evm::Error>),
-}
-
-pub type Transport = Box<dyn Bi<Request, Result<Response, TransportResponseError>> + Send>;
 
 pub struct UserAgentConnection {
     db: db::DatabasePool,
@@ -169,7 +52,6 @@ impl UserAgentConnection {
 pub mod auth;
 pub mod session;
 
-#[tracing::instrument(skip(props))]
 pub async fn connect_user_agent(props: UserAgentConnection) {
     match auth::authenticate_and_create(props).await {
         Ok(session) => {

server/crates/arbiter-server/src/actors/user_agent/session.rs

@@ -1,18 +1,38 @@
-use ed25519_dalek::VerifyingKey;
+use std::{ops::DerefMut, sync::Mutex};
-use kameo::{Actor, messages, prelude::Context};
-use tokio::{select, sync::watch};
-use tracing::{error, info};
 
-use crate::actors::{
+use arbiter_proto::proto::{
-    router::RegisterUserAgent,
+    evm as evm_proto,
     user_agent::{
-        Request, Response, TransportResponseError,
+        SdkClientApproveRequest, SdkClientApproveResponse, SdkClientEntry,
-        UserAgentConnection,
+        SdkClientError as ProtoSdkClientError, SdkClientList, SdkClientListResponse,
+        SdkClientRevokeRequest, SdkClientRevokeResponse, UnsealEncryptedKey, UnsealResult,
+        UnsealStart, UnsealStartResponse, UserAgentRequest, UserAgentResponse,
+        sdk_client_approve_response, sdk_client_list_response, sdk_client_revoke_response,
+        user_agent_request::Payload as UserAgentRequestPayload,
+        user_agent_response::Payload as UserAgentResponsePayload,
     },
 };
+use chacha20poly1305::{AeadInPlace, XChaCha20Poly1305, XNonce, aead::KeyInit};
+use diesel::{ExpressionMethods as _, QueryDsl as _, dsl::insert_into};
+use diesel_async::RunQueryDsl as _;
+use kameo::{Actor, error::SendError, prelude::Context};
+use memsafe::MemSafe;
+use tokio::select;
+use tracing::{error, info};
+use x25519_dalek::{EphemeralSecret, PublicKey};
+
+use crate::{
+    actors::{
+        evm::{Generate, ListWallets},
+        keyholder::{self, TryUnseal},
+        router::RegisterUserAgent,
+        user_agent::{TransportResponseError, UserAgentConnection},
+    },
+    db::schema::program_client,
+};
 
 mod state;
-use state::{DummyContext, UserAgentEvents, UserAgentStateMachine};
+use state::{DummyContext, UnsealContext, UserAgentEvents, UserAgentStateMachine, UserAgentStates};
 
 // Error for consumption by other actors
 #[derive(Debug, thiserror::Error, PartialEq)]
@@ -29,8 +49,6 @@ pub struct UserAgentSession {
     state: UserAgentStateMachine<DummyContext>,
 }
 
-mod connection;
-
 impl UserAgentSession {
     pub(crate) fn new(props: UserAgentConnection) -> Self {
         Self {
@@ -39,12 +57,24 @@ impl UserAgentSession {
         }
     }
 
-    pub(super) async fn send_msg<Reply: kameo::Reply>(
+    fn transition(&mut self, event: UserAgentEvents) -> Result<(), TransportResponseError> {
+        self.state.process_event(event).map_err(|e| {
+            error!(?e, "State transition failed");
+            TransportResponseError::StateTransitionFailed
+        })?;
+        Ok(())
+    }
+
+    async fn send_msg<Reply: kameo::Reply>(
         &mut self,
-        msg: Response,
+        msg: UserAgentResponsePayload,
         _ctx: &mut Context<Self, Reply>,
     ) -> Result<(), Error> {
-        self.props.transport.send(Ok(msg)).await.map_err(|_| {
+        self.props
+            .transport
+            .send(Ok(response(msg)))
+            .await
+            .map_err(|_| {
                 error!(
                     actor = "useragent",
                     reason = "channel closed",
@@ -60,7 +90,7 @@ impl UserAgentSession {
         ctx: &mut Context<Self, Reply>,
     ) -> Result<Msg, Error>
     where
-        Extractor: FnOnce(Request) -> Option<Msg>,
+        Extractor: FnOnce(UserAgentRequestPayload) -> Option<Msg>,
         Reply: kameo::Reply,
     {
         let msg = self.props.transport.recv().await.ok_or_else(|| {
@@ -73,7 +103,7 @@ impl UserAgentSession {
             Error::ConnectionLost
         })?;
 
-        extractor(msg).ok_or_else(|| {
+        msg.payload.and_then(extractor).ok_or_else(|| {
             error!(
                 actor = "useragent",
                 reason = "unexpected message",
@@ -83,56 +113,403 @@ impl UserAgentSession {
             Error::UnexpectedMessage
         })
     }
-
-    fn transition(&mut self, event: UserAgentEvents) -> Result<(), TransportResponseError> {
-        self.state.process_event(event).map_err(|e| {
-            error!(?e, "State transition failed");
-            TransportResponseError::StateTransitionFailed
-        })?;
-        Ok(())
-    }
 }
 
-#[messages]
 impl UserAgentSession {
-    // TODO: Think about refactoring it to state-machine based flow, as we already have one
+    pub async fn process_transport_inbound(&mut self, req: UserAgentRequest) -> Output {
-    #[message(ctx)]
+        let msg = req.payload.ok_or_else(|| {
-    pub async fn request_new_client_approval(
+            error!(actor = "useragent", "Received message with no payload");
-        &mut self,
+            TransportResponseError::MissingRequestPayload
-        client_pubkey: VerifyingKey,
+        })?;
-        mut cancel_flag: watch::Receiver<()>,
-        ctx: &mut Context<Self, Result<bool, Error>>,
-    ) -> Result<bool, Error> {
-        self.send_msg(
-            Response::ClientConnectionRequest {
-                pubkey: client_pubkey,
-            },
-            ctx,
-        )
-        .await?;
 
-        let extractor = |msg| {
+        match msg {
-            if let Request::ClientConnectionResponse { approved } = msg {
+            UserAgentRequestPayload::UnsealStart(unseal_start) => {
-                Some(approved)
+                self.handle_unseal_request(unseal_start).await
-            } else {
+            }
-                None
+            UserAgentRequestPayload::UnsealEncryptedKey(unseal_encrypted_key) => {
+                self.handle_unseal_encrypted_key(unseal_encrypted_key).await
+            }
+            UserAgentRequestPayload::EvmWalletCreate(_) => self.handle_evm_wallet_create().await,
+            UserAgentRequestPayload::EvmWalletList(_) => self.handle_evm_wallet_list().await,
+            UserAgentRequestPayload::SdkClientApprove(req) => {
+                self.handle_sdk_client_approve(req).await
+            }
+            UserAgentRequestPayload::SdkClientRevoke(req) => {
+                self.handle_sdk_client_revoke(req).await
+            }
+            UserAgentRequestPayload::SdkClientList(_) => self.handle_sdk_client_list().await,
+            _ => Err(TransportResponseError::UnexpectedRequestPayload),
+        }
+    }
+}
+
+type Output = Result<UserAgentResponse, TransportResponseError>;
+
+fn response(payload: UserAgentResponsePayload) -> UserAgentResponse {
+    UserAgentResponse {
+        payload: Some(payload),
+    }
+}
+
+impl UserAgentSession {
+    async fn handle_unseal_request(&mut self, req: UnsealStart) -> Output {
+        let secret = EphemeralSecret::random();
+        let public_key = PublicKey::from(&secret);
+
+        let client_pubkey_bytes: [u8; 32] = req
+            .client_pubkey
+            .try_into()
+            .map_err(|_| TransportResponseError::InvalidClientPubkeyLength)?;
+
+        let client_public_key = PublicKey::from(client_pubkey_bytes);
+
+        self.transition(UserAgentEvents::UnsealRequest(UnsealContext {
+            secret: Mutex::new(Some(secret)),
+            client_public_key,
+        }))?;
+
+        Ok(response(UserAgentResponsePayload::UnsealStartResponse(
+            UnsealStartResponse {
+                server_pubkey: public_key.as_bytes().to_vec(),
+            },
+        )))
+    }
+
+    async fn handle_unseal_encrypted_key(&mut self, req: UnsealEncryptedKey) -> Output {
+        let UserAgentStates::WaitingForUnsealKey(unseal_context) = self.state.state() else {
+            error!("Received unseal encrypted key in invalid state");
+            return Err(TransportResponseError::InvalidStateForUnsealEncryptedKey);
+        };
+        let ephemeral_secret = {
+            let mut secret_lock = unseal_context.secret.lock().unwrap();
+            let secret = secret_lock.take();
+            match secret {
+                Some(secret) => secret,
+                None => {
+                    drop(secret_lock);
+                    error!("Ephemeral secret already taken");
+                    self.transition(UserAgentEvents::ReceivedInvalidKey)?;
+                    return Ok(response(UserAgentResponsePayload::UnsealResult(
+                        UnsealResult::InvalidKey.into(),
+                    )));
+                }
             }
         };
 
-        tokio::select! {
+        let nonce = XNonce::from_slice(&req.nonce);
-            _ = cancel_flag.changed() => {
+
-                info!(actor = "useragent", "client connection approval cancelled");
+        let shared_secret = ephemeral_secret.diffie_hellman(&unseal_context.client_public_key);
-                self.send_msg(
+        let cipher = XChaCha20Poly1305::new(shared_secret.as_bytes().into());
-                    Response::ClientConnectionCancel,
+
-                    ctx,
+        let mut seal_key_buffer = MemSafe::new(req.ciphertext.clone()).unwrap();
-                ).await?;
+
-                Ok(false)
+        let decryption_result = {
+            let mut write_handle = seal_key_buffer.write().unwrap();
+            let write_handle = write_handle.deref_mut();
+            cipher.decrypt_in_place(nonce, &req.associated_data, write_handle)
+        };
+
+        match decryption_result {
+            Ok(_) => {
+                match self
+                    .props
+                    .actors
+                    .key_holder
+                    .ask(TryUnseal {
+                        seal_key_raw: seal_key_buffer,
+                    })
+                    .await
+                {
+                    Ok(_) => {
+                        info!("Successfully unsealed key with client-provided key");
+                        self.transition(UserAgentEvents::ReceivedValidKey)?;
+                        Ok(response(UserAgentResponsePayload::UnsealResult(
+                            UnsealResult::Success.into(),
+                        )))
                     }
-            result = self.expect_msg(extractor, ctx) => {
+                    Err(SendError::HandlerError(keyholder::Error::InvalidKey)) => {
-                let result = result?;
+                        self.transition(UserAgentEvents::ReceivedInvalidKey)?;
-                info!(actor = "useragent", "received client connection approval result: approved={}", result);
+                        Ok(response(UserAgentResponsePayload::UnsealResult(
-                Ok(result)
+                            UnsealResult::InvalidKey.into(),
+                        )))
                     }
+                    Err(SendError::HandlerError(err)) => {
+                        error!(?err, "Keyholder failed to unseal key");
+                        self.transition(UserAgentEvents::ReceivedInvalidKey)?;
+                        Ok(response(UserAgentResponsePayload::UnsealResult(
+                            UnsealResult::InvalidKey.into(),
+                        )))
+                    }
+                    Err(err) => {
+                        error!(?err, "Failed to send unseal request to keyholder");
+                        self.transition(UserAgentEvents::ReceivedInvalidKey)?;
+                        Err(TransportResponseError::KeyHolderActorUnreachable)
+                    }
+                }
+            }
+            Err(err) => {
+                error!(?err, "Failed to decrypt unseal key");
+                self.transition(UserAgentEvents::ReceivedInvalidKey)?;
+                Ok(response(UserAgentResponsePayload::UnsealResult(
+                    UnsealResult::InvalidKey.into(),
+                )))
+            }
+        }
+    }
+}
+
+impl UserAgentSession {
+    async fn handle_evm_wallet_create(&mut self) -> Output {
+        use evm_proto::wallet_create_response::Result as CreateResult;
+
+        let result = match self.props.actors.evm.ask(Generate {}).await {
+            Ok(address) => CreateResult::Wallet(evm_proto::WalletEntry {
+                address: address.as_slice().to_vec(),
+            }),
+            Err(err) => CreateResult::Error(map_evm_error("wallet create", err).into()),
+        };
+
+        Ok(response(UserAgentResponsePayload::EvmWalletCreate(
+            evm_proto::WalletCreateResponse {
+                result: Some(result),
+            },
+        )))
+    }
+
+    async fn handle_evm_wallet_list(&mut self) -> Output {
+        use evm_proto::wallet_list_response::Result as ListResult;
+
+        let result = match self.props.actors.evm.ask(ListWallets {}).await {
+            Ok(wallets) => ListResult::Wallets(evm_proto::WalletList {
+                wallets: wallets
+                    .into_iter()
+                    .map(|addr| evm_proto::WalletEntry {
+                        address: addr.as_slice().to_vec(),
+                    })
+                    .collect(),
+            }),
+            Err(err) => ListResult::Error(map_evm_error("wallet list", err).into()),
+        };
+
+        Ok(response(UserAgentResponsePayload::EvmWalletList(
+            evm_proto::WalletListResponse {
+                result: Some(result),
+            },
+        )))
+    }
+}
+
+impl UserAgentSession {
+    async fn handle_sdk_client_approve(&mut self, req: SdkClientApproveRequest) -> Output {
+        use sdk_client_approve_response::Result as ApproveResult;
+
+        if req.pubkey.len() != 32 {
+            return Ok(response(UserAgentResponsePayload::SdkClientApprove(
+                SdkClientApproveResponse {
+                    result: Some(ApproveResult::Error(ProtoSdkClientError::Internal.into())),
+                },
+            )));
+        }
+
+        let now = std::time::SystemTime::now()
+            .duration_since(std::time::UNIX_EPOCH)
+            .unwrap_or_default()
+            .as_secs() as i32;
+
+        let mut conn = match self.props.db.get().await {
+            Ok(c) => c,
+            Err(e) => {
+                error!(?e, "Failed to get DB connection for sdk_client_approve");
+                return Ok(response(UserAgentResponsePayload::SdkClientApprove(
+                    SdkClientApproveResponse {
+                        result: Some(ApproveResult::Error(ProtoSdkClientError::Internal.into())),
+                    },
+                )));
+            }
+        };
+
+        let pubkey_bytes = req.pubkey.clone();
+        let insert_result = insert_into(program_client::table)
+            .values((
+                program_client::public_key.eq(&pubkey_bytes),
+                program_client::nonce.eq(1), // pre-incremented; challenge will use nonce=0
+                program_client::created_at.eq(now),
+                program_client::updated_at.eq(now),
+            ))
+            .execute(&mut conn)
+            .await;
+
+        match insert_result {
+            Ok(_) => {
+                match program_client::table
+                    .filter(program_client::public_key.eq(&pubkey_bytes))
+                    .order(program_client::id.desc())
+                    .select((
+                        program_client::id,
+                        program_client::public_key,
+                        program_client::created_at,
+                    ))
+                    .first::<(i32, Vec<u8>, i32)>(&mut conn)
+                    .await
+                {
+                    Ok((id, pubkey, created_at)) => Ok(response(
+                        UserAgentResponsePayload::SdkClientApprove(SdkClientApproveResponse {
+                            result: Some(ApproveResult::Client(SdkClientEntry {
+                                id,
+                                pubkey,
+                                created_at,
+                            })),
+                        }),
+                    )),
+                    Err(e) => {
+                        error!(?e, "Failed to fetch inserted SDK client");
+                        Ok(response(UserAgentResponsePayload::SdkClientApprove(
+                            SdkClientApproveResponse {
+                                result: Some(ApproveResult::Error(
+                                    ProtoSdkClientError::Internal.into(),
+                                )),
+                            },
+                        )))
+                    }
+                }
+            }
+            Err(diesel::result::Error::DatabaseError(
+                diesel::result::DatabaseErrorKind::UniqueViolation,
+                _,
+            )) => Ok(response(UserAgentResponsePayload::SdkClientApprove(
+                SdkClientApproveResponse {
+                    result: Some(ApproveResult::Error(
+                        ProtoSdkClientError::AlreadyExists.into(),
+                    )),
+                },
+            ))),
+            Err(e) => {
+                error!(?e, "Failed to insert SDK client");
+                Ok(response(UserAgentResponsePayload::SdkClientApprove(
+                    SdkClientApproveResponse {
+                        result: Some(ApproveResult::Error(ProtoSdkClientError::Internal.into())),
+                    },
+                )))
+            }
+        }
+    }
+
+    async fn handle_sdk_client_list(&mut self) -> Output {
+        let mut conn = match self.props.db.get().await {
+            Ok(c) => c,
+            Err(e) => {
+                error!(?e, "Failed to get DB connection for sdk_client_list");
+                return Ok(response(UserAgentResponsePayload::SdkClientList(
+                    SdkClientListResponse {
+                        result: Some(sdk_client_list_response::Result::Error(
+                            ProtoSdkClientError::Internal.into(),
+                        )),
+                    },
+                )));
+            }
+        };
+
+        match program_client::table
+            .select((
+                program_client::id,
+                program_client::public_key,
+                program_client::created_at,
+            ))
+            .load::<(i32, Vec<u8>, i32)>(&mut conn)
+            .await
+        {
+            Ok(rows) => Ok(response(UserAgentResponsePayload::SdkClientList(
+                SdkClientListResponse {
+                    result: Some(sdk_client_list_response::Result::Clients(SdkClientList {
+                        clients: rows
+                            .into_iter()
+                            .map(|(id, pubkey, created_at)| SdkClientEntry {
+                                id,
+                                pubkey,
+                                created_at,
+                            })
+                            .collect(),
+                    })),
+                },
+            ))),
+            Err(e) => {
+                error!(?e, "Failed to list SDK clients");
+                Ok(response(UserAgentResponsePayload::SdkClientList(
+                    SdkClientListResponse {
+                        result: Some(sdk_client_list_response::Result::Error(
+                            ProtoSdkClientError::Internal.into(),
+                        )),
+                    },
+                )))
+            }
+        }
+    }
+
+    async fn handle_sdk_client_revoke(&mut self, req: SdkClientRevokeRequest) -> Output {
+        use sdk_client_revoke_response::Result as RevokeResult;
+
+        let mut conn = match self.props.db.get().await {
+            Ok(c) => c,
+            Err(e) => {
+                error!(?e, "Failed to get DB connection for sdk_client_revoke");
+                return Ok(response(UserAgentResponsePayload::SdkClientRevoke(
+                    SdkClientRevokeResponse {
+                        result: Some(RevokeResult::Error(ProtoSdkClientError::Internal.into())),
+                    },
+                )));
+            }
+        };
+
+        match diesel::delete(program_client::table)
+            .filter(program_client::id.eq(req.client_id))
+            .execute(&mut conn)
+            .await
+        {
+            Ok(0) => Ok(response(UserAgentResponsePayload::SdkClientRevoke(
+                SdkClientRevokeResponse {
+                    result: Some(RevokeResult::Error(ProtoSdkClientError::NotFound.into())),
+                },
+            ))),
+            Ok(_) => Ok(response(UserAgentResponsePayload::SdkClientRevoke(
+                SdkClientRevokeResponse {
+                    result: Some(RevokeResult::Ok(())),
+                },
+            ))),
+            Err(diesel::result::Error::DatabaseError(
+                diesel::result::DatabaseErrorKind::ForeignKeyViolation,
+                _,
+            )) => Ok(response(UserAgentResponsePayload::SdkClientRevoke(
+                SdkClientRevokeResponse {
+                    result: Some(RevokeResult::Error(
+                        ProtoSdkClientError::HasRelatedData.into(),
+                    )),
+                },
+            ))),
+            Err(e) => {
+                error!(?e, "Failed to delete SDK client");
+                Ok(response(UserAgentResponsePayload::SdkClientRevoke(
+                    SdkClientRevokeResponse {
+                        result: Some(RevokeResult::Error(ProtoSdkClientError::Internal.into())),
+                    },
+                )))
+            }
+        }
+    }
+}
+
+fn map_evm_error<M>(op: &str, err: SendError<M, crate::actors::evm::Error>) -> evm_proto::EvmError {
+    use crate::actors::{evm::Error as EvmError, keyholder::Error as KhError};
+    match err {
+        SendError::HandlerError(EvmError::Keyholder(KhError::NotBootstrapped)) => {
+            evm_proto::EvmError::VaultSealed
+        }
+        SendError::HandlerError(err) => {
+            error!(?err, "EVM {op} failed");
+            evm_proto::EvmError::Internal
+        }
+        _ => {
+            error!("EVM actor unreachable during {op}");
+            evm_proto::EvmError::Internal
         }
     }
 }

server/crates/arbiter-server/src/actors/user_agent/session/connection.rs

@@ -1,355 +0,0 @@
-use std::sync::Mutex;
-
-use chacha20poly1305::{AeadInPlace, XChaCha20Poly1305, XNonce, aead::KeyInit};
-use kameo::error::SendError;
-use tracing::{error, info};
-use x25519_dalek::{EphemeralSecret, PublicKey};
-
-use crate::safe_cell::SafeCell;
-use crate::{
-    actors::{
-        evm::{
-            Generate, ListWallets, UseragentCreateGrant, UseragentDeleteGrant, UseragentListGrants,
-        },
-        keyholder::{self, Bootstrap, TryUnseal},
-        user_agent::{
-            BootstrapError, Request, Response, TransportResponseError, UnsealError, VaultState,
-            session::{
-                UserAgentSession,
-                state::{UnsealContext, UserAgentEvents, UserAgentStates},
-            },
-        },
-    },
-    safe_cell::SafeCellHandle as _,
-};
-
-impl UserAgentSession {
-    pub async fn process_transport_inbound(&mut self, req: Request) -> Output {
-        match req {
-            Request::UnsealStart { client_pubkey } => {
-                self.handle_unseal_request(client_pubkey).await
-            }
-            Request::UnsealEncryptedKey {
-                nonce,
-                ciphertext,
-                associated_data,
-            } => {
-                self.handle_unseal_encrypted_key(nonce, ciphertext, associated_data)
-                    .await
-            }
-            Request::BootstrapEncryptedKey {
-                nonce,
-                ciphertext,
-                associated_data,
-            } => {
-                self.handle_bootstrap_encrypted_key(nonce, ciphertext, associated_data)
-                    .await
-            }
-            Request::ListGrants => self.handle_grant_list().await,
-            Request::QueryVaultState => self.handle_query_vault_state().await,
-            Request::EvmWalletCreate => self.handle_evm_wallet_create().await,
-            Request::EvmWalletList => self.handle_evm_wallet_list().await,
-            Request::AuthChallengeRequest { .. }
-            | Request::AuthChallengeSolution { .. }
-            | Request::ClientConnectionResponse { .. } => {
-                Err(TransportResponseError::UnexpectedRequestPayload)
-            }
-            Request::EvmGrantCreate {
-                client_id,
-                shared,
-                specific,
-            } => self.handle_grant_create(client_id, shared, specific).await,
-            Request::EvmGrantDelete { grant_id } => self.handle_grant_delete(grant_id).await,
-        }
-    }
-}
-
-type Output = Result<Response, TransportResponseError>;
-
-impl UserAgentSession {
-    fn take_unseal_secret(
-        &mut self,
-    ) -> Result<(EphemeralSecret, PublicKey), TransportResponseError> {
-        let UserAgentStates::WaitingForUnsealKey(unseal_context) = self.state.state() else {
-            error!("Received encrypted key in invalid state");
-            return Err(TransportResponseError::InvalidStateForUnsealEncryptedKey);
-        };
-
-        let ephemeral_secret = {
-            #[allow(
-                clippy::unwrap_used,
-                reason = "Mutex poison is unrecoverable and should panic"
-            )]
-            let mut secret_lock = unseal_context.secret.lock().unwrap();
-            let secret = secret_lock.take();
-            match secret {
-                Some(secret) => secret,
-                None => {
-                    drop(secret_lock);
-                    error!("Ephemeral secret already taken");
-                    return Err(TransportResponseError::StateTransitionFailed);
-                }
-            }
-        };
-
-        Ok((ephemeral_secret, unseal_context.client_public_key))
-    }
-
-    fn decrypt_client_key_material(
-        ephemeral_secret: EphemeralSecret,
-        client_public_key: PublicKey,
-        nonce: &[u8],
-        ciphertext: &[u8],
-        associated_data: &[u8],
-    ) -> Result<SafeCell<Vec<u8>>, ()> {
-        let nonce = XNonce::from_slice(nonce);
-
-        let shared_secret = ephemeral_secret.diffie_hellman(&client_public_key);
-        let cipher = XChaCha20Poly1305::new(shared_secret.as_bytes().into());
-
-        let mut key_buffer = SafeCell::new(ciphertext.to_vec());
-
-        let decryption_result = key_buffer.write_inline(|write_handle| {
-            cipher.decrypt_in_place(nonce, associated_data, write_handle)
-        });
-
-        match decryption_result {
-            Ok(_) => Ok(key_buffer),
-            Err(err) => {
-                error!(?err, "Failed to decrypt encrypted key material");
-                Err(())
-            }
-        }
-    }
-
-    async fn handle_unseal_request(&mut self, client_pubkey: x25519_dalek::PublicKey) -> Output {
-        let secret = EphemeralSecret::random();
-        let public_key = PublicKey::from(&secret);
-
-        self.transition(UserAgentEvents::UnsealRequest(UnsealContext {
-            secret: Mutex::new(Some(secret)),
-            client_public_key: client_pubkey,
-        }))?;
-
-        Ok(Response::UnsealStartResponse {
-            server_pubkey: public_key,
-        })
-    }
-
-    async fn handle_unseal_encrypted_key(
-        &mut self,
-        nonce: Vec<u8>,
-        ciphertext: Vec<u8>,
-        associated_data: Vec<u8>,
-    ) -> Output {
-        let (ephemeral_secret, client_public_key) = match self.take_unseal_secret() {
-            Ok(values) => values,
-            Err(TransportResponseError::StateTransitionFailed) => {
-                self.transition(UserAgentEvents::ReceivedInvalidKey)?;
-                return Ok(Response::UnsealResult(Err(UnsealError::InvalidKey)));
-            }
-            Err(err) => return Err(err),
-        };
-
-        let seal_key_buffer = match Self::decrypt_client_key_material(
-            ephemeral_secret,
-            client_public_key,
-            &nonce,
-            &ciphertext,
-            &associated_data,
-        ) {
-            Ok(buffer) => buffer,
-            Err(()) => {
-                self.transition(UserAgentEvents::ReceivedInvalidKey)?;
-                return Ok(Response::UnsealResult(Err(UnsealError::InvalidKey)));
-            }
-        };
-
-        match self
-            .props
-            .actors
-            .key_holder
-            .ask(TryUnseal {
-                seal_key_raw: seal_key_buffer,
-            })
-            .await
-        {
-            Ok(_) => {
-                info!("Successfully unsealed key with client-provided key");
-                self.transition(UserAgentEvents::ReceivedValidKey)?;
-                Ok(Response::UnsealResult(Ok(())))
-            }
-            Err(SendError::HandlerError(keyholder::Error::InvalidKey)) => {
-                self.transition(UserAgentEvents::ReceivedInvalidKey)?;
-                Ok(Response::UnsealResult(Err(UnsealError::InvalidKey)))
-            }
-            Err(SendError::HandlerError(err)) => {
-                error!(?err, "Keyholder failed to unseal key");
-                self.transition(UserAgentEvents::ReceivedInvalidKey)?;
-                Ok(Response::UnsealResult(Err(UnsealError::InvalidKey)))
-            }
-            Err(err) => {
-                error!(?err, "Failed to send unseal request to keyholder");
-                self.transition(UserAgentEvents::ReceivedInvalidKey)?;
-                Err(TransportResponseError::KeyHolderActorUnreachable)
-            }
-        }
-    }
-
-    async fn handle_bootstrap_encrypted_key(
-        &mut self,
-        nonce: Vec<u8>,
-        ciphertext: Vec<u8>,
-        associated_data: Vec<u8>,
-    ) -> Output {
-        let (ephemeral_secret, client_public_key) = match self.take_unseal_secret() {
-            Ok(values) => values,
-            Err(TransportResponseError::StateTransitionFailed) => {
-                self.transition(UserAgentEvents::ReceivedInvalidKey)?;
-                return Ok(Response::BootstrapResult(Err(BootstrapError::InvalidKey)));
-            }
-            Err(err) => return Err(err),
-        };
-
-        let seal_key_buffer = match Self::decrypt_client_key_material(
-            ephemeral_secret,
-            client_public_key,
-            &nonce,
-            &ciphertext,
-            &associated_data,
-        ) {
-            Ok(buffer) => buffer,
-            Err(()) => {
-                self.transition(UserAgentEvents::ReceivedInvalidKey)?;
-                return Ok(Response::BootstrapResult(Err(BootstrapError::InvalidKey)));
-            }
-        };
-
-        match self
-            .props
-            .actors
-            .key_holder
-            .ask(Bootstrap {
-                seal_key_raw: seal_key_buffer,
-            })
-            .await
-        {
-            Ok(_) => {
-                info!("Successfully bootstrapped vault with client-provided key");
-                self.transition(UserAgentEvents::ReceivedValidKey)?;
-                Ok(Response::BootstrapResult(Ok(())))
-            }
-            Err(SendError::HandlerError(keyholder::Error::AlreadyBootstrapped)) => {
-                self.transition(UserAgentEvents::ReceivedInvalidKey)?;
-                Ok(Response::BootstrapResult(Err(
-                    BootstrapError::AlreadyBootstrapped,
-                )))
-            }
-            Err(SendError::HandlerError(err)) => {
-                error!(?err, "Keyholder failed to bootstrap vault");
-                self.transition(UserAgentEvents::ReceivedInvalidKey)?;
-                Ok(Response::BootstrapResult(Err(BootstrapError::InvalidKey)))
-            }
-            Err(err) => {
-                error!(?err, "Failed to send bootstrap request to keyholder");
-                self.transition(UserAgentEvents::ReceivedInvalidKey)?;
-                Err(TransportResponseError::KeyHolderActorUnreachable)
-            }
-        }
-    }
-}
-
-impl UserAgentSession {
-    async fn handle_query_vault_state(&mut self) -> Output {
-        use crate::actors::keyholder::{GetState, StateDiscriminants};
-
-        let vault_state = match self.props.actors.key_holder.ask(GetState {}).await {
-            Ok(StateDiscriminants::Unbootstrapped) => VaultState::Unbootstrapped,
-            Ok(StateDiscriminants::Sealed) => VaultState::Sealed,
-            Ok(StateDiscriminants::Unsealed) => VaultState::Unsealed,
-            Err(err) => {
-                error!(?err, actor = "useragent", "keyholder.query.failed");
-                return Err(TransportResponseError::KeyHolderActorUnreachable);
-            }
-        };
-
-        Ok(Response::VaultState(vault_state))
-    }
-}
-
-impl UserAgentSession {
-    async fn handle_evm_wallet_create(&mut self) -> Output {
-        let result = match self.props.actors.evm.ask(Generate {}).await {
-            Ok(_address) => return Ok(Response::EvmWalletCreate(Ok(()))),
-            Err(SendError::HandlerError(err)) => Err(err),
-            Err(err) => {
-                error!(?err, "EVM actor unreachable during wallet create");
-                return Err(TransportResponseError::KeyHolderActorUnreachable);
-            }
-        };
-        Ok(Response::EvmWalletCreate(result))
-    }
-
-    async fn handle_evm_wallet_list(&mut self) -> Output {
-        match self.props.actors.evm.ask(ListWallets {}).await {
-            Ok(wallets) => Ok(Response::EvmWalletList(wallets)),
-            Err(err) => {
-                error!(?err, "EVM wallet list failed");
-                Err(TransportResponseError::KeyHolderActorUnreachable)
-            }
-        }
-    }
-}
-
-impl UserAgentSession {
-    async fn handle_grant_list(&mut self) -> Output {
-        match self.props.actors.evm.ask(UseragentListGrants {}).await {
-            Ok(grants) => Ok(Response::ListGrants(grants)),
-            Err(err) => {
-                error!(?err, "EVM grant list failed");
-                Err(TransportResponseError::KeyHolderActorUnreachable)
-            }
-        }
-    }
-
-    async fn handle_grant_create(
-        &mut self,
-        client_id: i32,
-        basic: crate::evm::policies::SharedGrantSettings,
-        grant: crate::evm::policies::SpecificGrant,
-    ) -> Output {
-        match self
-            .props
-            .actors
-            .evm
-            .ask(UseragentCreateGrant {
-                client_id,
-                basic,
-                grant,
-            })
-            .await
-        {
-            Ok(grant_id) => Ok(Response::EvmGrantCreate(Ok(grant_id))),
-            Err(err) => {
-                error!(?err, "EVM grant create failed");
-                Err(TransportResponseError::KeyHolderActorUnreachable)
-            }
-        }
-    }
-
-    async fn handle_grant_delete(&mut self, grant_id: i32) -> Output {
-        match self
-            .props
-            .actors
-            .evm
-            .ask(UseragentDeleteGrant { grant_id })
-            .await
-        {
-            Ok(()) => Ok(Response::EvmGrantDelete(Ok(()))),
-            Err(err) => {
-                error!(?err, "EVM grant delete failed");
-                Err(TransportResponseError::KeyHolderActorUnreachable)
-            }
-        }
-    }
-}

server/crates/arbiter-server/src/context/tls.rs

@@ -8,7 +8,7 @@ use rcgen::{
     BasicConstraints, Certificate, CertificateParams, CertifiedIssuer, DistinguishedName, DnType,
     IsCa, Issuer, KeyPair, KeyUsagePurpose,
 };
-use rustls::pki_types::pem::PemObject;
+use rustls::pki_types::{pem::PemObject};
 use thiserror::Error;
 use tonic::transport::CertificateDer;
 
@@ -59,7 +59,10 @@ pub enum InitError {
 pub type PemCert = String;
 
 pub fn encode_cert_to_pem(cert: &CertificateDer) -> PemCert {
-    pem::encode_config(&Pem::new("CERTIFICATE", cert.to_vec()), ENCODE_CONFIG)
+    pem::encode_config(
+        &Pem::new("CERTIFICATE", cert.to_vec()),
+        ENCODE_CONFIG,
+    )
 }
 
 #[allow(unused)]
@@ -91,10 +94,6 @@ impl TlsCa {
 
         let cert_key_pem = certified_issuer.key().serialize_pem();
 
-        #[allow(
-            clippy::unwrap_used,
-            reason = "Broken cert couldn't bootstrap server anyway"
-        )]
         let issuer = Issuer::from_ca_cert_pem(
             &certified_issuer.pem(),
             KeyPair::from_pem(cert_key_pem.as_ref()).unwrap(),

server/crates/arbiter-server/src/db/mod.rs

@@ -92,7 +92,6 @@ fn initialize_database(url: &str) -> Result<(), DatabaseSetupError> {
 #[tracing::instrument(level = "info")]
 pub async fn create_pool(url: Option<&str>) -> Result<DatabasePool, DatabaseSetupError> {
     let database_url = url.map(String::from).unwrap_or(
-        #[allow(clippy::expect_used)]
         database_path()?
             .to_str()
             .expect("database path is not valid UTF-8")
@@ -136,13 +135,11 @@ pub async fn create_test_pool() -> DatabasePool {
     let tempfile_name = Alphanumeric.sample_string(&mut rand::rng(), 16);
 
     let file = std::env::temp_dir().join(tempfile_name);
-    #[allow(clippy::expect_used)]
     let url = file
         .to_str()
         .expect("temp file path is not valid UTF-8")
         .to_string();
 
-    #[allow(clippy::expect_used)]
     create_pool(Some(&url))
         .await
         .expect("Failed to create test database pool")

server/crates/arbiter-server/src/evm/mod.rs

@@ -117,7 +117,9 @@ async fn check_shared_constraints(
     let now = Utc::now();
 
     // Validity window
-    if shared.valid_from.is_some_and(|t| now < t) || shared.valid_until.is_some_and(|t| now > t) {
+    if shared.valid_from.is_some_and(|t| now < t)
+        || shared.valid_until.is_some_and(|t| now > t)
+    {
         violations.push(EvalViolation::InvalidTime);
     }
 
@@ -125,9 +127,9 @@ async fn check_shared_constraints(
     let fee_exceeded = shared
         .max_gas_fee_per_gas
         .is_some_and(|cap| U256::from(context.max_fee_per_gas) > cap);
-    let priority_exceeded = shared
+    let priority_exceeded = shared.max_priority_fee_per_gas.is_some_and(|cap| {
-        .max_priority_fee_per_gas
+        U256::from(context.max_priority_fee_per_gas) > cap
-        .is_some_and(|cap| U256::from(context.max_priority_fee_per_gas) > cap);
+    });
     if fee_exceeded || priority_exceeded {
         violations.push(EvalViolation::GasLimitExceeded {
             max_gas_fee_per_gas: shared.max_gas_fee_per_gas,

server/crates/arbiter-server/src/evm/policies.rs

@@ -66,7 +66,6 @@ pub enum EvalViolation {
 
 pub type DatabaseID = i32;
 
-#[derive(Debug)]
 pub struct Grant<PolicySettings> {
     pub id: DatabaseID,
     pub shared_grant_id: DatabaseID, // ID of the basic grant for shared-logic checks like rate limits and validity periods
@@ -74,6 +73,7 @@ pub struct Grant<PolicySettings> {
     pub settings: PolicySettings,
 }
 
+
 pub trait Policy: Sized {
     type Settings: Send + Sync + 'static + Into<SpecificGrant>;
     type Meaning: Display + std::fmt::Debug + Send + Sync + 'static + Into<SpecificMeaning>;
@@ -146,7 +146,6 @@ pub struct VolumeRateLimit {
 #[derive(Clone, Debug, PartialEq, Eq, Hash)]
 pub struct SharedGrantSettings {
     pub wallet_id: i32,
-    pub client_id: i32,
     pub chain: ChainId,
 
     pub valid_from: Option<DateTime<Utc>>,
@@ -162,7 +161,6 @@ impl SharedGrantSettings {
     fn try_from_model(model: EvmBasicGrant) -> QueryResult<Self> {
         Ok(Self {
             wallet_id: model.wallet_id,
-            client_id: model.client_id,
             chain: model.chain_id as u64, // safe because chain_id is stored as i32 but is guaranteed to be a valid ChainId by the API when creating grants
             valid_from: model.valid_from.map(Into::into),
             valid_until: model.valid_until.map(Into::into),
@@ -200,7 +198,6 @@ impl SharedGrantSettings {
     }
 }
 
-#[derive(Debug, Clone)]
 pub enum SpecificGrant {
     EtherTransfer(ether_transfer::Settings),
     TokenTransfer(token_transfers::Settings),

server/crates/arbiter-server/src/evm/policies/ether_transfer/mod.rs

@@ -51,10 +51,9 @@ impl From<Meaning> for SpecificMeaning {
 }
 
 // A grant for ether transfers, which can be scoped to specific target addresses and volume limits
-#[derive(Debug, Clone)]
 pub struct Settings {
-    pub target: Vec<Address>,
+    target: Vec<Address>,
-    pub limit: VolumeRateLimit,
+    limit: VolumeRateLimit,
 }
 
 impl From<Settings> for SpecificGrant {

server/crates/arbiter-server/src/evm/policies/ether_transfer/tests.rs

@@ -9,7 +9,9 @@ use crate::db::{
     schema::{evm_basic_grant, evm_transaction_log},
 };
 use crate::evm::{
-    policies::{EvalContext, EvalViolation, Grant, Policy, SharedGrantSettings, VolumeRateLimit},
+    policies::{
+        EvalContext, EvalViolation, Grant, Policy, SharedGrantSettings, VolumeRateLimit,
+    },
     utils,
 };
 
@@ -74,7 +76,6 @@ fn shared() -> SharedGrantSettings {
         max_gas_fee_per_gas: None,
         max_priority_fee_per_gas: None,
         rate_limit: None,
-        client_id: CLIENT_ID,
     }
 }
 

server/crates/arbiter-server/src/evm/policies/token_transfers/mod.rs

@@ -58,11 +58,10 @@ impl From<Meaning> for SpecificMeaning {
 }
 
 // A grant for token transfers, which can be scoped to specific target addresses and volume limits
-#[derive(Debug, Clone)]
 pub struct Settings {
-    pub token_contract: Address,
+    token_contract: Address,
-    pub target: Option<Address>,
+    target: Option<Address>,
-    pub volume_limits: Vec<VolumeRateLimit>,
+    volume_limits: Vec<VolumeRateLimit>,
 }
 impl From<Settings> for SpecificGrant {
     fn from(val: Settings) -> SpecificGrant {

server/crates/arbiter-server/src/evm/policies/token_transfers/tests.rs

@@ -93,7 +93,6 @@ fn shared() -> SharedGrantSettings {
         max_gas_fee_per_gas: None,
         max_priority_fee_per_gas: None,
         rate_limit: None,
-        client_id: CLIENT_ID,
     }
 }
 
@@ -141,18 +140,10 @@ async fn evaluate_rejects_nonzero_eth_value() {
     let mut context = ctx(DAI, calldata);
     context.value = U256::from(1u64); // ETH attached to an ERC-20 call
 
-    let m = TokenTransfer::analyze(&EvalContext {
+    let m = TokenTransfer::analyze(&EvalContext { value: U256::ZERO, ..context.clone() })
-        value: U256::ZERO,
-        ..context.clone()
-    })
         .unwrap();
-    let v = TokenTransfer::evaluate(&context, &m, &grant, &mut *conn)
+    let v = TokenTransfer::evaluate(&context, &m, &grant, &mut *conn).await.unwrap();
-        .await
+    assert!(v.iter().any(|e| matches!(e, EvalViolation::InvalidTransactionType)));
-        .unwrap();
-    assert!(
-        v.iter()
-            .any(|e| matches!(e, EvalViolation::InvalidTransactionType))
-    );
 }
 
 #[tokio::test]
@@ -169,9 +160,7 @@ async fn evaluate_passes_any_recipient_when_no_restriction() {
     let calldata = transfer_calldata(RECIPIENT, U256::from(100u64));
     let context = ctx(DAI, calldata);
     let m = TokenTransfer::analyze(&context).unwrap();
-    let v = TokenTransfer::evaluate(&context, &m, &grant, &mut *conn)
+    let v = TokenTransfer::evaluate(&context, &m, &grant, &mut *conn).await.unwrap();
-        .await
-        .unwrap();
     assert!(v.is_empty());
 }
 
@@ -189,9 +178,7 @@ async fn evaluate_passes_matching_restricted_recipient() {
     let calldata = transfer_calldata(RECIPIENT, U256::from(100u64));
     let context = ctx(DAI, calldata);
     let m = TokenTransfer::analyze(&context).unwrap();
-    let v = TokenTransfer::evaluate(&context, &m, &grant, &mut *conn)
+    let v = TokenTransfer::evaluate(&context, &m, &grant, &mut *conn).await.unwrap();
-        .await
-        .unwrap();
     assert!(v.is_empty());
 }
 
@@ -209,13 +196,8 @@ async fn evaluate_rejects_wrong_restricted_recipient() {
     let calldata = transfer_calldata(OTHER, U256::from(100u64));
     let context = ctx(DAI, calldata);
     let m = TokenTransfer::analyze(&context).unwrap();
-    let v = TokenTransfer::evaluate(&context, &m, &grant, &mut *conn)
+    let v = TokenTransfer::evaluate(&context, &m, &grant, &mut *conn).await.unwrap();
-        .await
+    assert!(v.iter().any(|e| matches!(e, EvalViolation::InvalidTarget { .. })));
-        .unwrap();
-    assert!(
-        v.iter()
-            .any(|e| matches!(e, EvalViolation::InvalidTarget { .. }))
-    );
 }
 
 #[tokio::test]
@@ -225,9 +207,7 @@ async fn evaluate_passes_volume_within_limit() {
 
     let basic = insert_basic(&mut conn, false).await;
     let settings = make_settings(None, Some(1_000));
-    let grant_id = TokenTransfer::create_grant(&basic, &settings, &mut *conn)
+    let grant_id = TokenTransfer::create_grant(&basic, &settings, &mut *conn).await.unwrap();
-        .await
-        .unwrap();
 
     // Record a past transfer of 500 (within 1000 limit)
     use crate::db::{models::NewEvmTokenTransferLog, schema::evm_token_transfer_log};
@@ -244,22 +224,12 @@ async fn evaluate_passes_volume_within_limit() {
         .await
         .unwrap();
 
-    let grant = Grant {
+    let grant = Grant { id: grant_id, shared_grant_id: basic.id, shared: shared(), settings };
-        id: grant_id,
-        shared_grant_id: basic.id,
-        shared: shared(),
-        settings,
-    };
     let calldata = transfer_calldata(RECIPIENT, U256::from(100u64));
     let context = ctx(DAI, calldata);
     let m = TokenTransfer::analyze(&context).unwrap();
-    let v = TokenTransfer::evaluate(&context, &m, &grant, &mut *conn)
+    let v = TokenTransfer::evaluate(&context, &m, &grant, &mut *conn).await.unwrap();
-        .await
+    assert!(!v.iter().any(|e| matches!(e, EvalViolation::VolumetricLimitExceeded)));
-        .unwrap();
-    assert!(
-        !v.iter()
-            .any(|e| matches!(e, EvalViolation::VolumetricLimitExceeded))
-    );
 }
 
 #[tokio::test]
@@ -269,9 +239,7 @@ async fn evaluate_rejects_volume_over_limit() {
 
     let basic = insert_basic(&mut conn, false).await;
     let settings = make_settings(None, Some(1_000));
-    let grant_id = TokenTransfer::create_grant(&basic, &settings, &mut *conn)
+    let grant_id = TokenTransfer::create_grant(&basic, &settings, &mut *conn).await.unwrap();
-        .await
-        .unwrap();
 
     use crate::db::{models::NewEvmTokenTransferLog, schema::evm_token_transfer_log};
     insert_into(evm_token_transfer_log::table)
@@ -287,22 +255,12 @@ async fn evaluate_rejects_volume_over_limit() {
         .await
         .unwrap();
 
-    let grant = Grant {
+    let grant = Grant { id: grant_id, shared_grant_id: basic.id, shared: shared(), settings };
-        id: grant_id,
-        shared_grant_id: basic.id,
-        shared: shared(),
-        settings,
-    };
     let calldata = transfer_calldata(RECIPIENT, U256::from(100u64));
     let context = ctx(DAI, calldata);
     let m = TokenTransfer::analyze(&context).unwrap();
-    let v = TokenTransfer::evaluate(&context, &m, &grant, &mut *conn)
+    let v = TokenTransfer::evaluate(&context, &m, &grant, &mut *conn).await.unwrap();
-        .await
+    assert!(v.iter().any(|e| matches!(e, EvalViolation::VolumetricLimitExceeded)));
-        .unwrap();
-    assert!(
-        v.iter()
-            .any(|e| matches!(e, EvalViolation::VolumetricLimitExceeded))
-    );
 }
 
 #[tokio::test]
@@ -319,13 +277,8 @@ async fn evaluate_no_volume_limits_always_passes() {
     let calldata = transfer_calldata(RECIPIENT, U256::from(u64::MAX));
     let context = ctx(DAI, calldata);
     let m = TokenTransfer::analyze(&context).unwrap();
-    let v = TokenTransfer::evaluate(&context, &m, &grant, &mut *conn)
+    let v = TokenTransfer::evaluate(&context, &m, &grant, &mut *conn).await.unwrap();
-        .await
+    assert!(!v.iter().any(|e| matches!(e, EvalViolation::VolumetricLimitExceeded)));
-        .unwrap();
-    assert!(
-        !v.iter()
-            .any(|e| matches!(e, EvalViolation::VolumetricLimitExceeded))
-    );
 }
 
 // ── try_find_grant ───────────────────────────────────────────────────────
@@ -337,9 +290,7 @@ async fn try_find_grant_roundtrip() {
 
     let basic = insert_basic(&mut conn, false).await;
     let settings = make_settings(Some(RECIPIENT), Some(5_000));
-    TokenTransfer::create_grant(&basic, &settings, &mut *conn)
+    TokenTransfer::create_grant(&basic, &settings, &mut *conn).await.unwrap();
-        .await
-        .unwrap();
 
     let calldata = transfer_calldata(RECIPIENT, U256::from(100u64));
     let found = TokenTransfer::try_find_grant(&ctx(DAI, calldata), &mut *conn)
@@ -361,9 +312,7 @@ async fn try_find_grant_revoked_returns_none() {
 
     let basic = insert_basic(&mut conn, true).await;
     let settings = make_settings(None, None);
-    TokenTransfer::create_grant(&basic, &settings, &mut *conn)
+    TokenTransfer::create_grant(&basic, &settings, &mut *conn).await.unwrap();
-        .await
-        .unwrap();
 
     let calldata = transfer_calldata(RECIPIENT, U256::from(1u64));
     let found = TokenTransfer::try_find_grant(&ctx(DAI, calldata), &mut *conn)
@@ -379,9 +328,7 @@ async fn try_find_grant_unknown_token_returns_none() {
 
     let basic = insert_basic(&mut conn, false).await;
     let settings = make_settings(None, None);
-    TokenTransfer::create_grant(&basic, &settings, &mut *conn)
+    TokenTransfer::create_grant(&basic, &settings, &mut *conn).await.unwrap();
-        .await
-        .unwrap();
 
     // Query with a different token contract
     let calldata = transfer_calldata(RECIPIENT, U256::from(1u64));
@@ -408,13 +355,9 @@ async fn find_all_grants_excludes_revoked() {
 
     let settings = make_settings(None, Some(1_000));
     let active = insert_basic(&mut conn, false).await;
-    TokenTransfer::create_grant(&active, &settings, &mut *conn)
+    TokenTransfer::create_grant(&active, &settings, &mut *conn).await.unwrap();
-        .await
-        .unwrap();
     let revoked = insert_basic(&mut conn, true).await;
-    TokenTransfer::create_grant(&revoked, &settings, &mut *conn)
+    TokenTransfer::create_grant(&revoked, &settings, &mut *conn).await.unwrap();
-        .await
-        .unwrap();
 
     let all = TokenTransfer::find_all_grants(&mut *conn).await.unwrap();
     assert_eq!(all.len(), 1);
@@ -427,17 +370,12 @@ async fn find_all_grants_loads_volume_limits() {
 
     let basic = insert_basic(&mut conn, false).await;
     let settings = make_settings(None, Some(9_999));
-    TokenTransfer::create_grant(&basic, &settings, &mut *conn)
+    TokenTransfer::create_grant(&basic, &settings, &mut *conn).await.unwrap();
-        .await
-        .unwrap();
 
     let all = TokenTransfer::find_all_grants(&mut *conn).await.unwrap();
     assert_eq!(all.len(), 1);
     assert_eq!(all[0].settings.volume_limits.len(), 1);
-    assert_eq!(
+    assert_eq!(all[0].settings.volume_limits[0].max_volume, U256::from(9_999u64));
-        all[0].settings.volume_limits[0].max_volume,
-        U256::from(9_999u64)
-    );
 }
 
 #[tokio::test]
@@ -450,11 +388,7 @@ async fn find_all_grants_multiple_grants_batch_loaded() {
         .await
         .unwrap();
     let b2 = insert_basic(&mut conn, false).await;
-    TokenTransfer::create_grant(
+    TokenTransfer::create_grant(&b2, &make_settings(Some(RECIPIENT), Some(2_000)), &mut *conn)
-        &b2,
-        &make_settings(Some(RECIPIENT), Some(2_000)),
-        &mut *conn,
-    )
         .await
         .unwrap();
 

server/crates/arbiter-server/src/evm/safe_signer.rs

@@ -1,14 +1,14 @@
 use std::sync::Mutex;
 
-use crate::safe_cell::{SafeCell, SafeCellHandle as _};
 use alloy::{
     consensus::SignableTransaction,
     network::{TxSigner, TxSignerSync},
-    primitives::{Address, B256, ChainId, Signature},
+    primitives::{Address, ChainId, Signature, B256},
     signers::{Error, Result, Signer, SignerSync, utils::secret_key_to_address},
 };
 use async_trait::async_trait;
-use k256::ecdsa::{self, RecoveryId, SigningKey, signature::hazmat::PrehashSigner};
+use k256::ecdsa::{self, signature::hazmat::PrehashSigner, RecoveryId, SigningKey};
+use memsafe::MemSafe;
 
 /// An Ethereum signer that stores its secp256k1 secret key inside a
 /// hardware-protected [`MemSafe`] cell.
@@ -20,7 +20,7 @@ use k256::ecdsa::{self, RecoveryId, SigningKey, signature::hazmat::PrehashSigner
 /// Because [`MemSafe::read`] requires `&mut self` while the [`Signer`] trait
 /// requires `&self`, the cell is wrapped in a [`Mutex`].
 pub struct SafeSigner {
-    key: Mutex<SafeCell<SigningKey>>,
+    key: Mutex<MemSafe<SigningKey>>,
     address: Address,
     chain_id: Option<ChainId>,
 }
@@ -42,13 +42,14 @@ impl std::fmt::Debug for SafeSigner {
 /// rejection, but we retry to be correct).
 ///
 /// Returns the protected key bytes and the derived Ethereum address.
-pub fn generate(rng: &mut impl rand::Rng) -> (SafeCell<[u8; 32]>, Address) {
+pub fn generate(rng: &mut impl rand::Rng) -> (MemSafe<[u8; 32]>, Address) {
     loop {
-        let mut cell = SafeCell::new_inline(|w: &mut [u8; 32]| {
+        let mut cell = MemSafe::new([0u8; 32]).expect("MemSafe allocation");
-            rng.fill_bytes(w);
+        {
-        });
+            let mut w = cell.write().expect("MemSafe write");
-
+            rng.fill_bytes(w.as_mut());
-        let reader = cell.read();
+        }
+        let reader = cell.read().expect("MemSafe read");
         if let Ok(sk) = SigningKey::from_slice(reader.as_ref()) {
             let address = secret_key_to_address(&sk);
             drop(reader);
@@ -63,8 +64,8 @@ impl SafeSigner {
     /// The key bytes are read from protected memory, parsed as a secp256k1
     /// scalar, and immediately moved into a new [`MemSafe`] cell. The raw
     /// bytes are never exposed outside this function.
-    pub fn from_cell(mut cell: SafeCell<Vec<u8>>) -> Result<Self> {
+    pub fn from_memsafe(mut cell: MemSafe<Vec<u8>>) -> Result<Self> {
-        let reader = cell.read();
+        let reader = cell.read().map_err(Error::other)?;
         let sk = SigningKey::from_slice(reader.as_slice()).map_err(Error::other)?;
         drop(reader);
         Self::new(sk)
@@ -74,7 +75,7 @@ impl SafeSigner {
     /// memory region.
     pub fn new(key: SigningKey) -> Result<Self> {
         let address = secret_key_to_address(&key);
-        let cell = SafeCell::new(key);
+        let cell = MemSafe::new(key).map_err(Error::other)?;
         Ok(Self {
             key: Mutex::new(cell),
             address,
@@ -83,25 +84,25 @@ impl SafeSigner {
     }
 
     fn sign_hash_inner(&self, hash: &B256) -> Result<Signature> {
-        #[allow(clippy::expect_used)]
         let mut cell = self.key.lock().expect("SafeSigner mutex poisoned");
-        let reader = cell.read();
+        let reader = cell.read().map_err(Error::other)?;
         let sig: (ecdsa::Signature, RecoveryId) = reader.sign_prehash(hash.as_ref())?;
         Ok(sig.into())
     }
 
-    fn sign_tx_inner(&self, tx: &mut dyn SignableTransaction<Signature>) -> Result<Signature> {
+    fn sign_tx_inner(
+        &self,
+        tx: &mut dyn SignableTransaction<Signature>,
+    ) -> Result<Signature> {
         if let Some(chain_id) = self.chain_id
             && !tx.set_chain_id_checked(chain_id)
         {
             return Err(Error::TransactionChainIdMismatch {
                 signer: chain_id,
-                #[allow(clippy::expect_used)]
+                tx: tx.chain_id().unwrap(),
-                tx: tx.chain_id().expect("Chain ID is guaranteed to be set"),
             });
         }
-        self.sign_hash_inner(&tx.signature_hash())
+        self.sign_hash_inner(&tx.signature_hash()).map_err(Error::other)
-            .map_err(Error::other)
     }
 }
 

server/crates/arbiter-server/src/grpc/client.rs

@@ -1,137 +0,0 @@
-use arbiter_proto::{
-    proto::client::{
-        AuthChallenge as ProtoAuthChallenge,
-        AuthChallengeRequest as ProtoAuthChallengeRequest,
-        AuthChallengeSolution as ProtoAuthChallengeSolution, AuthOk as ProtoAuthOk,
-        ClientConnectError, ClientRequest, ClientResponse,
-        client_connect_error::Code as ProtoClientConnectErrorCode,
-        client_request::Payload as ClientRequestPayload,
-        client_response::Payload as ClientResponsePayload,
-    },
-    transport::{Bi, Error as TransportError},
-};
-use async_trait::async_trait;
-use futures::StreamExt as _;
-use tokio::sync::mpsc;
-use tonic::{Status, Streaming};
-
-use crate::actors::client::{
-    self, ClientError, ConnectErrorCode, Request as DomainRequest, Response as DomainResponse,
-};
-
-pub struct GrpcTransport {
-    sender: mpsc::Sender<Result<ClientResponse, Status>>,
-    receiver: Streaming<ClientRequest>,
-}
-
-impl GrpcTransport {
-    pub fn new(
-        sender: mpsc::Sender<Result<ClientResponse, Status>>,
-        receiver: Streaming<ClientRequest>,
-    ) -> Self {
-        Self { sender, receiver }
-    }
-
-    fn request_to_domain(request: ClientRequest) -> Result<DomainRequest, Status> {
-        match request.payload {
-            Some(ClientRequestPayload::AuthChallengeRequest(ProtoAuthChallengeRequest {
-                pubkey,
-            })) => Ok(DomainRequest::AuthChallengeRequest { pubkey }),
-            Some(ClientRequestPayload::AuthChallengeSolution(
-                ProtoAuthChallengeSolution { signature },
-            )) => Ok(DomainRequest::AuthChallengeSolution { signature }),
-            None => Err(Status::invalid_argument("Missing client request payload")),
-        }
-    }
-
-    fn response_to_proto(response: DomainResponse) -> ClientResponse {
-        let payload = match response {
-            DomainResponse::AuthChallenge { pubkey, nonce } => {
-                ClientResponsePayload::AuthChallenge(ProtoAuthChallenge { pubkey, nonce })
-            }
-            DomainResponse::AuthOk => ClientResponsePayload::AuthOk(ProtoAuthOk {}),
-            DomainResponse::ClientConnectError { code } => {
-                ClientResponsePayload::ClientConnectError(ClientConnectError {
-                    code: match code {
-                        ConnectErrorCode::Unknown => ProtoClientConnectErrorCode::Unknown,
-                        ConnectErrorCode::ApprovalDenied => {
-                            ProtoClientConnectErrorCode::ApprovalDenied
-                        }
-                        ConnectErrorCode::NoUserAgentsOnline => {
-                            ProtoClientConnectErrorCode::NoUserAgentsOnline
-                        }
-                    }
-                    .into(),
-                })
-            }
-        };
-
-        ClientResponse {
-            payload: Some(payload),
-        }
-    }
-
-    fn error_to_status(value: ClientError) -> Status {
-        match value {
-            ClientError::MissingRequestPayload | ClientError::UnexpectedRequestPayload => {
-                Status::invalid_argument("Expected message with payload")
-            }
-            ClientError::StateTransitionFailed => Status::internal("State machine error"),
-            ClientError::Auth(ref err) => auth_error_status(err),
-            ClientError::ConnectionRegistrationFailed => {
-                Status::internal("Connection registration failed")
-            }
-        }
-    }
-}
-
-#[async_trait]
-impl Bi<DomainRequest, Result<DomainResponse, ClientError>> for GrpcTransport {
-    async fn send(&mut self, item: Result<DomainResponse, ClientError>) -> Result<(), TransportError> {
-        let outbound = match item {
-            Ok(message) => Ok(Self::response_to_proto(message)),
-            Err(err) => Err(Self::error_to_status(err)),
-        };
-
-        self.sender
-            .send(outbound)
-            .await
-            .map_err(|_| TransportError::ChannelClosed)
-    }
-
-    async fn recv(&mut self) -> Option<DomainRequest> {
-        match self.receiver.next().await {
-            Some(Ok(item)) => match Self::request_to_domain(item) {
-                Ok(request) => Some(request),
-                Err(status) => {
-                    let _ = self.sender.send(Err(status)).await;
-                    None
-                }
-            },
-            Some(Err(error)) => {
-                tracing::error!(error = ?error, "grpc client recv failed; closing stream");
-                None
-            }
-            None => None,
-        }
-    }
-}
-
-fn auth_error_status(value: &client::auth::Error) -> Status {
-    use client::auth::Error;
-
-    match value {
-        Error::UnexpectedMessagePayload | Error::InvalidClientPubkeyLength => {
-            Status::invalid_argument(value.to_string())
-        }
-        Error::InvalidAuthPubkeyEncoding => {
-            Status::invalid_argument("Failed to convert pubkey to VerifyingKey")
-        }
-        Error::InvalidChallengeSolution => Status::unauthenticated(value.to_string()),
-        Error::ApproveError(_) => Status::permission_denied(value.to_string()),
-        Error::Transport => Status::internal("Transport error"),
-        Error::DatabasePoolUnavailable => Status::internal("Database pool error"),
-        Error::DatabaseOperationFailed => Status::internal("Database error"),
-        Error::InternalError => Status::internal("Internal error"),
-    }
-}

server/crates/arbiter-server/src/grpc/mod.rs

@@ -1,65 +0,0 @@
-
-use arbiter_proto::proto::{
-    client::{ClientRequest, ClientResponse},
-    user_agent::{UserAgentRequest, UserAgentResponse},
-};
-use tokio::sync::mpsc;
-use tokio_stream::wrappers::ReceiverStream;
-use tonic::{Request, Response, Status, async_trait};
-use tracing::info;
-
-use crate::{
-    DEFAULT_CHANNEL_SIZE,
-    actors::{client::{ClientConnection, connect_client}, user_agent::{UserAgentConnection, connect_user_agent}},
-};
-
-pub mod client;
-pub mod user_agent;
-
-#[async_trait]
-impl arbiter_proto::proto::arbiter_service_server::ArbiterService for super::Server {
-    type UserAgentStream = ReceiverStream<Result<UserAgentResponse, Status>>;
-    type ClientStream = ReceiverStream<Result<ClientResponse, Status>>;
-
-    #[tracing::instrument(level = "debug", skip(self))]
-    async fn client(
-        &self,
-        request: Request<tonic::Streaming<ClientRequest>>,
-    ) -> Result<Response<Self::ClientStream>, Status> {
-        let req_stream = request.into_inner();
-        let (tx, rx) = mpsc::channel(DEFAULT_CHANNEL_SIZE);
-
-        let transport = client::GrpcTransport::new(tx, req_stream);
-        let props = ClientConnection::new(
-            self.context.db.clone(),
-            Box::new(transport),
-            self.context.actors.clone(),
-        );
-        tokio::spawn(connect_client(props));
-
-        info!(event = "connection established", "grpc.client");
-
-        Ok(Response::new(ReceiverStream::new(rx)))
-    }
-
-    #[tracing::instrument(level = "debug", skip(self))]
-    async fn user_agent(
-        &self,
-        request: Request<tonic::Streaming<UserAgentRequest>>,
-    ) -> Result<Response<Self::UserAgentStream>, Status> {
-        let req_stream = request.into_inner();
-        let (tx, rx) = mpsc::channel(DEFAULT_CHANNEL_SIZE);
-
-        let transport = user_agent::GrpcTransport::new(tx, req_stream);
-        let props = UserAgentConnection::new(
-            self.context.db.clone(),
-            self.context.actors.clone(),
-            Box::new(transport),
-        );
-        tokio::spawn(connect_user_agent(props));
-
-        info!(event = "connection established", "grpc.user_agent");
-
-        Ok(Response::new(ReceiverStream::new(rx)))
-    }
-}

server/crates/arbiter-server/src/grpc/user_agent.rs

@@ -1,509 +0,0 @@
-use arbiter_proto::{
-    proto::{
-        self,
-        evm::{
-            EtherTransferSettings as ProtoEtherTransferSettings, EvmError as ProtoEvmError,
-            EvmGrantCreateRequest, EvmGrantCreateResponse, EvmGrantDeleteRequest,
-            EvmGrantDeleteResponse, EvmGrantList, EvmGrantListResponse, GrantEntry,
-            SharedSettings as ProtoSharedSettings, SpecificGrant as ProtoSpecificGrant,
-            TokenTransferSettings as ProtoTokenTransferSettings,
-            VolumeRateLimit as ProtoVolumeRateLimit, WalletCreateResponse, WalletEntry, WalletList,
-            WalletListResponse, evm_grant_create_response::Result as EvmGrantCreateResult,
-            evm_grant_delete_response::Result as EvmGrantDeleteResult,
-            evm_grant_list_response::Result as EvmGrantListResult,
-            specific_grant::Grant as ProtoSpecificGrantType,
-            wallet_create_response::Result as WalletCreateResult,
-            wallet_list_response::Result as WalletListResult,
-        },
-        user_agent::{
-            AuthChallenge as ProtoAuthChallenge, AuthChallengeRequest as ProtoAuthChallengeRequest,
-            AuthChallengeSolution as ProtoAuthChallengeSolution, AuthOk as ProtoAuthOk,
-            BootstrapEncryptedKey as ProtoBootstrapEncryptedKey,
-            BootstrapResult as ProtoBootstrapResult, ClientConnectionCancel,
-            ClientConnectionRequest, ClientConnectionResponse, KeyType as ProtoKeyType,
-            UnsealEncryptedKey as ProtoUnsealEncryptedKey, UnsealResult as ProtoUnsealResult,
-            UnsealStart, UnsealStartResponse, UserAgentRequest, UserAgentResponse,
-            VaultState as ProtoVaultState, user_agent_request::Payload as UserAgentRequestPayload,
-            user_agent_response::Payload as UserAgentResponsePayload,
-        },
-    },
-    transport::{Bi, Error as TransportError},
-};
-use async_trait::async_trait;
-use futures::StreamExt as _;
-use prost_types::Timestamp;
-use tokio::sync::mpsc;
-use tonic::{Status, Streaming};
-
-use crate::{
-    actors::user_agent::{
-        self, AuthPublicKey, BootstrapError, Request as DomainRequest, Response as DomainResponse,
-        TransportResponseError, UnsealError, VaultState,
-    },
-    evm::{
-        policies::{Grant, SpecificGrant},
-        policies::{
-            SharedGrantSettings, TransactionRateLimit, VolumeRateLimit, ether_transfer,
-            token_transfers,
-        },
-    },
-};
-use alloy::primitives::{Address, U256};
-use chrono::{DateTime, TimeZone, Utc};
-
-pub struct GrpcTransport {
-    sender: mpsc::Sender<Result<UserAgentResponse, Status>>,
-    receiver: Streaming<UserAgentRequest>,
-}
-
-impl GrpcTransport {
-    pub fn new(
-        sender: mpsc::Sender<Result<UserAgentResponse, Status>>,
-        receiver: Streaming<UserAgentRequest>,
-    ) -> Self {
-        Self { sender, receiver }
-    }
-
-    fn request_to_domain(request: UserAgentRequest) -> Result<DomainRequest, Status> {
-        match request.payload {
-            Some(UserAgentRequestPayload::AuthChallengeRequest(ProtoAuthChallengeRequest {
-                pubkey,
-                bootstrap_token,
-                key_type,
-            })) => Ok(DomainRequest::AuthChallengeRequest {
-                pubkey: parse_auth_pubkey(key_type, pubkey)?,
-                bootstrap_token,
-            }),
-            Some(UserAgentRequestPayload::AuthChallengeSolution(ProtoAuthChallengeSolution {
-                signature,
-            })) => Ok(DomainRequest::AuthChallengeSolution { signature }),
-            Some(UserAgentRequestPayload::UnsealStart(UnsealStart { client_pubkey })) => {
-                let client_pubkey: [u8; 32] = client_pubkey
-                    .as_slice()
-                    .try_into()
-                    .map_err(|_| Status::invalid_argument("client_pubkey must be 32 bytes"))?;
-                Ok(DomainRequest::UnsealStart {
-                    client_pubkey: x25519_dalek::PublicKey::from(client_pubkey),
-                })
-            }
-            Some(UserAgentRequestPayload::UnsealEncryptedKey(ProtoUnsealEncryptedKey {
-                nonce,
-                ciphertext,
-                associated_data,
-            })) => Ok(DomainRequest::UnsealEncryptedKey {
-                nonce,
-                ciphertext,
-                associated_data,
-            }),
-            Some(UserAgentRequestPayload::BootstrapEncryptedKey(ProtoBootstrapEncryptedKey {
-                nonce,
-                ciphertext,
-                associated_data,
-            })) => Ok(DomainRequest::BootstrapEncryptedKey {
-                nonce,
-                ciphertext,
-                associated_data,
-            }),
-            Some(UserAgentRequestPayload::QueryVaultState(_)) => Ok(DomainRequest::QueryVaultState),
-            Some(UserAgentRequestPayload::EvmWalletCreate(_)) => Ok(DomainRequest::EvmWalletCreate),
-            Some(UserAgentRequestPayload::EvmWalletList(_)) => Ok(DomainRequest::EvmWalletList),
-            Some(UserAgentRequestPayload::ClientConnectionResponse(ClientConnectionResponse {
-                approved,
-            })) => Ok(DomainRequest::ClientConnectionResponse { approved }),
-
-            Some(UserAgentRequestPayload::EvmGrantList(_)) => Ok(DomainRequest::ListGrants),
-            Some(UserAgentRequestPayload::EvmGrantCreate(EvmGrantCreateRequest {
-                client_id,
-                shared,
-                specific,
-            })) => {
-                let shared = parse_shared_settings(client_id, shared)?;
-                let specific = parse_specific_grant(specific)?;
-                Ok(DomainRequest::EvmGrantCreate {
-                    client_id,
-                    shared,
-                    specific,
-                })
-            }
-            Some(UserAgentRequestPayload::EvmGrantDelete(EvmGrantDeleteRequest { grant_id })) => {
-                Ok(DomainRequest::EvmGrantDelete { grant_id })
-            }
-            None => Err(Status::invalid_argument(
-                "Missing user-agent request payload",
-            )),
-        }
-    }
-
-    fn response_to_proto(response: DomainResponse) -> UserAgentResponse {
-        let payload = match response {
-            DomainResponse::AuthChallenge { nonce } => {
-                UserAgentResponsePayload::AuthChallenge(ProtoAuthChallenge {
-                    pubkey: Vec::new(),
-                    nonce,
-                })
-            }
-            DomainResponse::AuthOk => UserAgentResponsePayload::AuthOk(ProtoAuthOk {}),
-            DomainResponse::UnsealStartResponse { server_pubkey } => {
-                UserAgentResponsePayload::UnsealStartResponse(UnsealStartResponse {
-                    server_pubkey: server_pubkey.as_bytes().to_vec(),
-                })
-            }
-            DomainResponse::UnsealResult(result) => UserAgentResponsePayload::UnsealResult(
-                match result {
-                    Ok(()) => ProtoUnsealResult::Success,
-                    Err(UnsealError::InvalidKey) => ProtoUnsealResult::InvalidKey,
-                    Err(UnsealError::Unbootstrapped) => ProtoUnsealResult::Unbootstrapped,
-                }
-                .into(),
-            ),
-            DomainResponse::BootstrapResult(result) => UserAgentResponsePayload::BootstrapResult(
-                match result {
-                    Ok(()) => ProtoBootstrapResult::Success,
-                    Err(BootstrapError::AlreadyBootstrapped) => {
-                        ProtoBootstrapResult::AlreadyBootstrapped
-                    }
-                    Err(BootstrapError::InvalidKey) => ProtoBootstrapResult::InvalidKey,
-                }
-                .into(),
-            ),
-            DomainResponse::VaultState(state) => UserAgentResponsePayload::VaultState(
-                match state {
-                    VaultState::Unbootstrapped => ProtoVaultState::Unbootstrapped,
-                    VaultState::Sealed => ProtoVaultState::Sealed,
-                    VaultState::Unsealed => ProtoVaultState::Unsealed,
-                }
-                .into(),
-            ),
-            DomainResponse::ClientConnectionRequest { pubkey } => {
-                UserAgentResponsePayload::ClientConnectionRequest(ClientConnectionRequest {
-                    pubkey: pubkey.to_bytes().to_vec(),
-                })
-            }
-            DomainResponse::ClientConnectionCancel => {
-                UserAgentResponsePayload::ClientConnectionCancel(ClientConnectionCancel {})
-            }
-            DomainResponse::EvmWalletCreate(result) => {
-                UserAgentResponsePayload::EvmWalletCreate(WalletCreateResponse {
-                    result: Some(match result {
-                        Ok(()) => WalletCreateResult::Wallet(WalletEntry {
-                            address: Vec::new(),
-                        }),
-                        Err(_) => WalletCreateResult::Error(ProtoEvmError::Internal.into()),
-                    }),
-                })
-            }
-            DomainResponse::EvmWalletList(wallets) => {
-                UserAgentResponsePayload::EvmWalletList(WalletListResponse {
-                    result: Some(WalletListResult::Wallets(WalletList {
-                        wallets: wallets
-                            .into_iter()
-                            .map(|addr| WalletEntry {
-                                address: addr.as_slice().to_vec(),
-                            })
-                            .collect(),
-                    })),
-                })
-            }
-            DomainResponse::ListGrants(grants) => {
-                UserAgentResponsePayload::EvmGrantList(EvmGrantListResponse {
-                    result: Some(EvmGrantListResult::Grants(EvmGrantList {
-                        grants: grants.into_iter().map(grant_to_proto).collect(),
-                    })),
-                })
-            }
-            DomainResponse::EvmGrantCreate(result) => {
-                UserAgentResponsePayload::EvmGrantCreate(EvmGrantCreateResponse {
-                    result: Some(match result {
-                        Ok(grant_id) => EvmGrantCreateResult::GrantId(grant_id),
-                        Err(_) => EvmGrantCreateResult::Error(ProtoEvmError::Internal.into()),
-                    }),
-                })
-            }
-            DomainResponse::EvmGrantDelete(result) => {
-                UserAgentResponsePayload::EvmGrantDelete(EvmGrantDeleteResponse {
-                    result: Some(match result {
-                        Ok(()) => EvmGrantDeleteResult::Ok(()),
-                        Err(_) => EvmGrantDeleteResult::Error(ProtoEvmError::Internal.into()),
-                    }),
-                })
-            }
-        };
-
-        UserAgentResponse {
-            payload: Some(payload),
-        }
-    }
-
-    fn error_to_status(value: TransportResponseError) -> Status {
-        match value {
-            TransportResponseError::UnexpectedRequestPayload => {
-                Status::invalid_argument("Expected message with payload")
-            }
-            TransportResponseError::InvalidStateForUnsealEncryptedKey => {
-                Status::failed_precondition("Invalid state for unseal encrypted key")
-            }
-            TransportResponseError::InvalidClientPubkeyLength => {
-                Status::invalid_argument("client_pubkey must be 32 bytes")
-            }
-            TransportResponseError::StateTransitionFailed => {
-                Status::internal("State machine error")
-            }
-            TransportResponseError::KeyHolderActorUnreachable => {
-                Status::internal("Vault is not available")
-            }
-            TransportResponseError::Auth(ref err) => auth_error_status(err),
-            TransportResponseError::ConnectionRegistrationFailed => {
-                Status::internal("Failed registering connection")
-            }
-        }
-    }
-}
-
-#[async_trait]
-impl Bi<DomainRequest, Result<DomainResponse, TransportResponseError>> for GrpcTransport {
-    async fn send(
-        &mut self,
-        item: Result<DomainResponse, TransportResponseError>,
-    ) -> Result<(), TransportError> {
-        let outbound = match item {
-            Ok(message) => Ok(Self::response_to_proto(message)),
-            Err(err) => Err(Self::error_to_status(err)),
-        };
-
-        self.sender
-            .send(outbound)
-            .await
-            .map_err(|_| TransportError::ChannelClosed)
-    }
-
-    async fn recv(&mut self) -> Option<DomainRequest> {
-        match self.receiver.next().await {
-            Some(Ok(item)) => match Self::request_to_domain(item) {
-                Ok(request) => Some(request),
-                Err(status) => {
-                    let _ = self.sender.send(Err(status)).await;
-                    None
-                }
-            },
-            Some(Err(error)) => {
-                tracing::error!(error = ?error, "grpc user-agent recv failed; closing stream");
-                None
-            }
-            None => None,
-        }
-    }
-}
-
-fn grant_to_proto(grant: Grant<SpecificGrant>) -> proto::evm::GrantEntry {
-    GrantEntry {
-        id: grant.id,
-        specific: Some(match grant.settings {
-            SpecificGrant::EtherTransfer(settings) => ProtoSpecificGrant {
-                grant: Some(ProtoSpecificGrantType::EtherTransfer(
-                    ProtoEtherTransferSettings {
-                        targets: settings
-                            .target
-                            .into_iter()
-                            .map(|addr| addr.as_slice().to_vec())
-                            .collect(),
-                        limit: Some(proto::evm::VolumeRateLimit {
-                            max_volume: settings.limit.max_volume.to_be_bytes_vec(),
-                            window_secs: settings.limit.window.num_seconds(),
-                        }),
-                    },
-                )),
-            },
-            SpecificGrant::TokenTransfer(settings) => ProtoSpecificGrant {
-                grant: Some(ProtoSpecificGrantType::TokenTransfer(
-                    ProtoTokenTransferSettings {
-                        token_contract: settings.token_contract.as_slice().to_vec(),
-                        target: settings.target.map(|addr| addr.as_slice().to_vec()),
-                        volume_limits: settings
-                            .volume_limits
-                            .into_iter()
-                            .map(|vrl| proto::evm::VolumeRateLimit {
-                                max_volume: vrl.max_volume.to_be_bytes_vec(),
-                                window_secs: vrl.window.num_seconds(),
-                            })
-                            .collect(),
-                    },
-                )),
-            },
-        }),
-        client_id: grant.shared.client_id,
-        shared: Some(proto::evm::SharedSettings {
-            wallet_id: grant.shared.wallet_id,
-            chain_id: grant.shared.chain,
-            valid_from: grant.shared.valid_from.map(|dt| Timestamp {
-                seconds: dt.timestamp(),
-                nanos: 0,
-            }),
-            valid_until: grant.shared.valid_until.map(|dt| Timestamp {
-                seconds: dt.timestamp(),
-                nanos: 0,
-            }),
-            max_gas_fee_per_gas: grant
-                .shared
-                .max_gas_fee_per_gas
-                .map(|fee| fee.to_be_bytes_vec()),
-            max_priority_fee_per_gas: grant
-                .shared
-                .max_priority_fee_per_gas
-                .map(|fee| fee.to_be_bytes_vec()),
-            rate_limit: grant
-                .shared
-                .rate_limit
-                .map(|limit| proto::evm::TransactionRateLimit {
-                    count: limit.count,
-                    window_secs: limit.window.num_seconds(),
-                }),
-        }),
-    }
-}
-
-fn parse_volume_rate_limit(vrl: ProtoVolumeRateLimit) -> Result<VolumeRateLimit, Status> {
-    Ok(VolumeRateLimit {
-        max_volume: U256::from_be_slice(&vrl.max_volume),
-        window: chrono::Duration::seconds(vrl.window_secs),
-    })
-}
-
-fn parse_shared_settings(
-    client_id: i32,
-    proto: Option<ProtoSharedSettings>,
-) -> Result<SharedGrantSettings, Status> {
-    let s = proto.ok_or_else(|| Status::invalid_argument("missing shared settings"))?;
-    let parse_u256 = |b: Vec<u8>| -> Result<U256, Status> {
-        if b.is_empty() {
-            Err(Status::invalid_argument("U256 bytes must not be empty"))
-        } else {
-            Ok(U256::from_be_slice(&b))
-        }
-    };
-    let parse_ts = |ts: prost_types::Timestamp| -> Result<DateTime<Utc>, Status> {
-        Utc.timestamp_opt(ts.seconds, ts.nanos as u32)
-            .single()
-            .ok_or_else(|| Status::invalid_argument("invalid timestamp"))
-    };
-    Ok(SharedGrantSettings {
-        wallet_id: s.wallet_id,
-        client_id,
-        chain: s.chain_id,
-        valid_from: s.valid_from.map(parse_ts).transpose()?,
-        valid_until: s.valid_until.map(parse_ts).transpose()?,
-        max_gas_fee_per_gas: s.max_gas_fee_per_gas.map(parse_u256).transpose()?,
-        max_priority_fee_per_gas: s.max_priority_fee_per_gas.map(parse_u256).transpose()?,
-        rate_limit: s.rate_limit.map(|rl| TransactionRateLimit {
-            count: rl.count,
-            window: chrono::Duration::seconds(rl.window_secs),
-        }),
-    })
-}
-
-fn parse_specific_grant(proto: Option<proto::evm::SpecificGrant>) -> Result<SpecificGrant, Status> {
-    use proto::evm::specific_grant::Grant as ProtoGrant;
-    let g = proto
-        .and_then(|sg| sg.grant)
-        .ok_or_else(|| Status::invalid_argument("missing specific grant"))?;
-    match g {
-        ProtoGrant::EtherTransfer(s) => {
-            let limit = parse_volume_rate_limit(
-                s.limit
-                    .ok_or_else(|| Status::invalid_argument("missing ether transfer limit"))?,
-            )?;
-            let target = s
-                .targets
-                .into_iter()
-                .map(|b| {
-                    if b.len() == 20 {
-                        Ok(Address::from_slice(&b))
-                    } else {
-                        Err(Status::invalid_argument(
-                            "ether transfer target must be 20 bytes",
-                        ))
-                    }
-                })
-                .collect::<Result<Vec<_>, _>>()?;
-            Ok(SpecificGrant::EtherTransfer(ether_transfer::Settings {
-                target,
-                limit,
-            }))
-        }
-        ProtoGrant::TokenTransfer(s) => {
-            if s.token_contract.len() != 20 {
-                return Err(Status::invalid_argument("token_contract must be 20 bytes"));
-            }
-            let target = s
-                .target
-                .map(|b| {
-                    if b.len() == 20 {
-                        Ok(Address::from_slice(&b))
-                    } else {
-                        Err(Status::invalid_argument(
-                            "token transfer target must be 20 bytes",
-                        ))
-                    }
-                })
-                .transpose()?;
-            let volume_limits = s
-                .volume_limits
-                .into_iter()
-                .map(parse_volume_rate_limit)
-                .collect::<Result<Vec<_>, _>>()?;
-            Ok(SpecificGrant::TokenTransfer(token_transfers::Settings {
-                token_contract: Address::from_slice(&s.token_contract),
-                target,
-                volume_limits,
-            }))
-        }
-    }
-}
-
-fn parse_auth_pubkey(key_type: i32, pubkey: Vec<u8>) -> Result<AuthPublicKey, Status> {
-    match ProtoKeyType::try_from(key_type).unwrap_or(ProtoKeyType::Unspecified) {
-        ProtoKeyType::Unspecified | ProtoKeyType::Ed25519 => {
-            let bytes: [u8; 32] = pubkey
-                .as_slice()
-                .try_into()
-                .map_err(|_| Status::invalid_argument("invalid Ed25519 public key length"))?;
-            let key = ed25519_dalek::VerifyingKey::from_bytes(&bytes)
-                .map_err(|_| Status::invalid_argument("invalid Ed25519 public key encoding"))?;
-            Ok(AuthPublicKey::Ed25519(key))
-        }
-        ProtoKeyType::EcdsaSecp256k1 => {
-            let key = k256::ecdsa::VerifyingKey::from_sec1_bytes(&pubkey)
-                .map_err(|_| Status::invalid_argument("invalid secp256k1 public key encoding"))?;
-            Ok(AuthPublicKey::EcdsaSecp256k1(key))
-        }
-        ProtoKeyType::Rsa => {
-            use rsa::pkcs8::DecodePublicKey as _;
-
-            let key = rsa::RsaPublicKey::from_public_key_der(&pubkey)
-                .map_err(|_| Status::invalid_argument("invalid RSA public key encoding"))?;
-            Ok(AuthPublicKey::Rsa(key))
-        }
-    }
-}
-
-fn auth_error_status(value: &user_agent::auth::Error) -> Status {
-    use user_agent::auth::Error;
-
-    match value {
-        Error::UnexpectedMessagePayload | Error::InvalidClientPubkeyLength => {
-            Status::invalid_argument(value.to_string())
-        }
-        Error::InvalidAuthPubkeyEncoding => {
-            Status::invalid_argument("Failed to convert pubkey to VerifyingKey")
-        }
-        Error::PublicKeyNotRegistered | Error::InvalidChallengeSolution => {
-            Status::unauthenticated(value.to_string())
-        }
-        Error::InvalidBootstrapToken => Status::invalid_argument("Invalid bootstrap token"),
-        Error::Transport => Status::internal("Transport error"),
-        Error::BootstrapperActorUnreachable => {
-            Status::internal("Bootstrap token consumption failed")
-        }
-        Error::DatabasePoolUnavailable => Status::internal("Database pool error"),
-        Error::DatabaseOperationFailed => Status::internal("Database error"),
-    }
-}

server/crates/arbiter-server/src/lib.rs

@@ -1,21 +1,137 @@
 #![forbid(unsafe_code)]
-#![deny(
+use arbiter_proto::{
-    clippy::unwrap_used,
+    proto::{
-    clippy::expect_used,
+        client::{ClientRequest, ClientResponse},
-    clippy::panic
+        user_agent::{UserAgentRequest, UserAgentResponse},
-)]
+    },
+    transport::{IdentityRecvConverter, SendConverter, grpc},
+};
+use async_trait::async_trait;
+use tokio_stream::wrappers::ReceiverStream;
 
-use crate::context::ServerContext;
+use tokio::sync::mpsc;
+use tonic::{Request, Response, Status};
+use tracing::info;
+
+use crate::{
+    actors::{
+        client::{self, ClientConnection as ClientConnectionProps, ClientError, connect_client},
+        user_agent::{self, TransportResponseError, UserAgentConnection, connect_user_agent},
+    },
+    context::ServerContext,
+};
 
 pub mod actors;
 pub mod context;
 pub mod db;
 pub mod evm;
-pub mod grpc;
-pub mod safe_cell;
 
 const DEFAULT_CHANNEL_SIZE: usize = 1000;
 
+struct UserAgentGrpcSender;
+
+impl SendConverter for UserAgentGrpcSender {
+    type Input = Result<UserAgentResponse, TransportResponseError>;
+    type Output = Result<UserAgentResponse, Status>;
+
+    fn convert(&self, item: Self::Input) -> Self::Output {
+        match item {
+            Ok(message) => Ok(message),
+            Err(err) => Err(user_agent_error_status(err)),
+        }
+    }
+}
+
+struct ClientGrpcSender;
+
+impl SendConverter for ClientGrpcSender {
+    type Input = Result<ClientResponse, ClientError>;
+    type Output = Result<ClientResponse, Status>;
+
+    fn convert(&self, item: Self::Input) -> Self::Output {
+        match item {
+            Ok(message) => Ok(message),
+            Err(err) => Err(client_error_status(err)),
+        }
+    }
+}
+
+fn client_error_status(value: ClientError) -> Status {
+    match value {
+        ClientError::MissingRequestPayload | ClientError::UnexpectedRequestPayload => {
+            Status::invalid_argument("Expected message with payload")
+        }
+        ClientError::StateTransitionFailed => Status::internal("State machine error"),
+        ClientError::Auth(ref err) => client_auth_error_status(err),
+        ClientError::ConnectionRegistrationFailed => {
+            Status::internal("Connection registration failed")
+        }
+    }
+}
+
+fn client_auth_error_status(value: &client::auth::Error) -> Status {
+    use client::auth::Error;
+    match value {
+        Error::UnexpectedMessagePayload | Error::InvalidClientPubkeyLength => {
+            Status::invalid_argument(value.to_string())
+        }
+        Error::InvalidAuthPubkeyEncoding => {
+            Status::invalid_argument("Failed to convert pubkey to VerifyingKey")
+        }
+        Error::InvalidChallengeSolution => Status::unauthenticated(value.to_string()),
+        Error::NotRegistered => Status::permission_denied(value.to_string()),
+        Error::Transport => Status::internal("Transport error"),
+        Error::DatabasePoolUnavailable => Status::internal("Database pool error"),
+        Error::DatabaseOperationFailed => Status::internal("Database error"),
+        Error::InternalError => Status::internal("Internal error"),
+    }
+}
+
+fn user_agent_error_status(value: TransportResponseError) -> Status {
+    match value {
+        TransportResponseError::MissingRequestPayload
+        | TransportResponseError::UnexpectedRequestPayload => {
+            Status::invalid_argument("Expected message with payload")
+        }
+        TransportResponseError::InvalidStateForUnsealEncryptedKey => {
+            Status::failed_precondition("Invalid state for unseal encrypted key")
+        }
+        TransportResponseError::InvalidClientPubkeyLength => {
+            Status::invalid_argument("client_pubkey must be 32 bytes")
+        }
+        TransportResponseError::StateTransitionFailed => Status::internal("State machine error"),
+        TransportResponseError::KeyHolderActorUnreachable => {
+            Status::internal("Vault is not available")
+        }
+        TransportResponseError::Auth(ref err) => auth_error_status(err),
+        TransportResponseError::ConnectionRegistrationFailed => {
+            Status::internal("Failed registering connection")
+        }
+    }
+}
+
+fn auth_error_status(value: &user_agent::auth::Error) -> Status {
+    use user_agent::auth::Error;
+    match value {
+        Error::UnexpectedMessagePayload | Error::InvalidClientPubkeyLength => {
+            Status::invalid_argument(value.to_string())
+        }
+        Error::InvalidAuthPubkeyEncoding => {
+            Status::invalid_argument("Failed to convert pubkey to VerifyingKey")
+        }
+        Error::PublicKeyNotRegistered | Error::InvalidChallengeSolution => {
+            Status::unauthenticated(value.to_string())
+        }
+        Error::InvalidBootstrapToken => Status::invalid_argument("Invalid bootstrap token"),
+        Error::Transport => Status::internal("Transport error"),
+        Error::BootstrapperActorUnreachable => {
+            Status::internal("Bootstrap token consumption failed")
+        }
+        Error::DatabasePoolUnavailable => Status::internal("Database pool error"),
+        Error::DatabaseOperationFailed => Status::internal("Database error"),
+    }
+}
+
 pub struct Server {
     context: ServerContext,
 }
@@ -26,3 +142,60 @@ impl Server {
     }
 }
 
+#[async_trait]
+impl arbiter_proto::proto::arbiter_service_server::ArbiterService for Server {
+    type UserAgentStream = ReceiverStream<Result<UserAgentResponse, Status>>;
+    type ClientStream = ReceiverStream<Result<ClientResponse, Status>>;
+
+    #[tracing::instrument(level = "debug", skip(self))]
+    async fn client(
+        &self,
+        request: Request<tonic::Streaming<ClientRequest>>,
+    ) -> Result<Response<Self::ClientStream>, Status> {
+        let req_stream = request.into_inner();
+        let (tx, rx) = mpsc::channel(DEFAULT_CHANNEL_SIZE);
+
+        let transport = grpc::GrpcAdapter::new(
+            tx,
+            req_stream,
+            IdentityRecvConverter::<ClientRequest>::new(),
+            ClientGrpcSender,
+        );
+        let props = ClientConnectionProps::new(
+            self.context.db.clone(),
+            Box::new(transport),
+            self.context.actors.clone(),
+        );
+        tokio::spawn(connect_client(props));
+
+        info!(event = "connection established", "grpc.client");
+
+        Ok(Response::new(ReceiverStream::new(rx)))
+    }
+
+    #[tracing::instrument(level = "debug", skip(self))]
+    async fn user_agent(
+        &self,
+        request: Request<tonic::Streaming<UserAgentRequest>>,
+    ) -> Result<Response<Self::UserAgentStream>, Status> {
+        let req_stream = request.into_inner();
+        let (tx, rx) = mpsc::channel(DEFAULT_CHANNEL_SIZE);
+
+        let transport = grpc::GrpcAdapter::new(
+            tx,
+            req_stream,
+            IdentityRecvConverter::<UserAgentRequest>::new(),
+            UserAgentGrpcSender,
+        );
+        let props = UserAgentConnection::new(
+            self.context.db.clone(),
+            self.context.actors.clone(),
+            Box::new(transport),
+        );
+        tokio::spawn(connect_user_agent(props));
+
+        info!(event = "connection established", "grpc.user_agent");
+
+        Ok(Response::new(ReceiverStream::new(rx)))
+    }
+}

server/crates/arbiter-server/src/main.rs

@@ -3,7 +3,6 @@ use std::net::SocketAddr;
 use arbiter_proto::{proto::arbiter_service_server::ArbiterServiceServer, url::ArbiterUrl};
 use arbiter_server::{Server, actors::bootstrap::GetToken, context::ServerContext, db};
 use miette::miette;
-use rustls::crypto::aws_lc_rs;
 use tonic::transport::{Identity, ServerTlsConfig};
 use tracing::info;
 
@@ -11,8 +10,6 @@ const PORT: u16 = 50051;
 
 #[tokio::main]
 async fn main() -> miette::Result<()> {
-    aws_lc_rs::default_provider().install_default().unwrap();
-
     tracing_subscriber::fmt()
         .with_env_filter(
             tracing_subscriber::EnvFilter::try_from_default_env()

server/crates/arbiter-server/src/safe_cell.rs

@@ -1,111 +0,0 @@
-use std::ops::{Deref, DerefMut};
-use std::{any::type_name, fmt};
-
-use memsafe::MemSafe;
-
-pub trait SafeCellHandle<T> {
-    type CellRead<'a>: Deref<Target = T>
-    where
-        Self: 'a,
-        T: 'a;
-    type CellWrite<'a>: Deref<Target = T> + DerefMut<Target = T>
-    where
-        Self: 'a,
-        T: 'a;
-
-    fn new(value: T) -> Self
-    where
-        Self: Sized;
-
-    fn read(&mut self) -> Self::CellRead<'_>;
-    fn write(&mut self) -> Self::CellWrite<'_>;
-
-    fn new_inline<F>(f: F) -> Self
-    where
-        Self: Sized,
-        T: Default,
-        F: for<'a> FnOnce(&'a mut T),
-    {
-        let mut cell = Self::new(T::default());
-        {
-            let mut handle = cell.write();
-            f(handle.deref_mut());
-        }
-        cell
-    }
-
-    #[inline(always)]
-    fn read_inline<F, R>(&mut self, f: F) -> R
-    where
-        F: FnOnce(&T) -> R,
-    {
-        f(&*self.read())
-    }
-
-    #[inline(always)]
-    fn write_inline<F, R>(&mut self, f: F) -> R
-    where
-        F: FnOnce(&mut T) -> R,
-    {
-        f(&mut *self.write())
-    }
-}
-
-pub struct MemSafeCell<T>(MemSafe<T>);
-
-impl<T> fmt::Debug for MemSafeCell<T> {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        f.debug_struct("MemSafeCell")
-            .field("inner", &format_args!("<protected {}>", type_name::<T>()))
-            .finish()
-    }
-}
-
-impl<T> SafeCellHandle<T> for MemSafeCell<T> {
-    type CellRead<'a>
-        = memsafe::MemSafeRead<'a, T>
-    where
-        Self: 'a,
-        T: 'a;
-    type CellWrite<'a>
-        = memsafe::MemSafeWrite<'a, T>
-    where
-        Self: 'a,
-        T: 'a;
-
-    fn new(value: T) -> Self {
-        match MemSafe::new(value) {
-            Ok(inner) => Self(inner),
-            Err(err) => {
-                // If protected memory cannot be allocated, process integrity is compromised.
-                abort_memory_breach("safe cell allocation", &err)
-            }
-        }
-    }
-
-    #[inline(always)]
-    fn read(&mut self) -> Self::CellRead<'_> {
-        match self.0.read() {
-            Ok(inner) => inner,
-            Err(err) => abort_memory_breach("safe cell read", &err),
-        }
-    }
-
-    #[inline(always)]
-    fn write(&mut self) -> Self::CellWrite<'_> {
-        match self.0.write() {
-            Ok(inner) => inner,
-            Err(err) => {
-                // If protected memory becomes unwritable here, treat it as a fatal memory breach.
-                abort_memory_breach("safe cell write", &err)
-            }
-        }
-    }
-}
-
-fn abort_memory_breach(action: &str, err: &memsafe::error::MemoryError) -> ! {
-    eprintln!("fatal {action}: {err}");
-    std::process::abort();
-}
-
-pub type SafeCell<T> = MemSafeCell<T>;

server/crates/arbiter-server/tests/client/auth.rs

@@ -1,7 +1,20 @@
+use alloy::{
+    consensus::TxEip1559,
+    primitives::{Address, Bytes, TxKind, U256},
+    rlp::Encodable,
+};
+use arbiter_proto::proto::{
+    client::{
+        AuthChallengeRequest, AuthChallengeSolution, ClientRequest,
+        client_request::Payload as ClientRequestPayload,
+        client_response::Payload as ClientResponsePayload,
+    },
+    evm::EvmSignTransactionRequest,
+};
 use arbiter_proto::transport::Bi;
 use arbiter_server::actors::GlobalActors;
 use arbiter_server::{
-    actors::client::{ClientConnection, Request, Response, connect_client},
+    actors::client::{ClientConnection, connect_client},
     db::{self, schema},
 };
 use diesel::{ExpressionMethods as _, insert_into};
@@ -24,8 +37,12 @@ pub async fn test_unregistered_pubkey_rejected() {
     let pubkey_bytes = new_key.verifying_key().to_bytes().to_vec();
 
     test_transport
-        .send(Request::AuthChallengeRequest {
+        .send(ClientRequest {
+            payload: Some(ClientRequestPayload::AuthChallengeRequest(
+                AuthChallengeRequest {
                     pubkey: pubkey_bytes,
+                },
+            )),
         })
         .await
         .unwrap();
@@ -59,8 +76,12 @@ pub async fn test_challenge_auth() {
 
     // Send challenge request
     test_transport
-        .send(Request::AuthChallengeRequest {
+        .send(ClientRequest {
+            payload: Some(ClientRequestPayload::AuthChallengeRequest(
+                AuthChallengeRequest {
                     pubkey: pubkey_bytes,
+                },
+            )),
         })
         .await
         .unwrap();
@@ -71,20 +92,24 @@ pub async fn test_challenge_auth() {
         .await
         .expect("should receive challenge");
     let challenge = match response {
-        Ok(resp) => match resp {
+        Ok(resp) => match resp.payload {
-            Response::AuthChallenge { pubkey, nonce } => (pubkey, nonce),
+            Some(ClientResponsePayload::AuthChallenge(c)) => c,
             other => panic!("Expected AuthChallenge, got {other:?}"),
         },
         Err(err) => panic!("Expected Ok response, got Err({err:?})"),
     };
 
     // Sign the challenge and send solution
-    let formatted_challenge = arbiter_proto::format_challenge(challenge.1, &challenge.0);
+    let formatted_challenge = arbiter_proto::format_challenge(challenge.nonce, &challenge.pubkey);
     let signature = new_key.sign(&formatted_challenge);
 
     test_transport
-        .send(Request::AuthChallengeSolution {
+        .send(ClientRequest {
+            payload: Some(ClientRequestPayload::AuthChallengeSolution(
+                AuthChallengeSolution {
                     signature: signature.to_bytes().to_vec(),
+                },
+            )),
         })
         .await
         .unwrap();
@@ -92,3 +117,106 @@ pub async fn test_challenge_auth() {
     // Auth completes, session spawned
     task.await.unwrap();
 }
+
+#[tokio::test]
+#[test_log::test]
+pub async fn test_evm_sign_request_payload_is_handled() {
+    let db = db::create_test_pool().await;
+
+    let new_key = ed25519_dalek::SigningKey::generate(&mut rand::rng());
+    let pubkey_bytes = new_key.verifying_key().to_bytes().to_vec();
+
+    {
+        let mut conn = db.get().await.unwrap();
+        insert_into(schema::program_client::table)
+            .values(schema::program_client::public_key.eq(pubkey_bytes.clone()))
+            .execute(&mut conn)
+            .await
+            .unwrap();
+    }
+
+    let (server_transport, mut test_transport) = ChannelTransport::new();
+    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+
+    let props = ClientConnection::new(db.clone(), Box::new(server_transport), actors);
+    let task = tokio::spawn(connect_client(props));
+
+    test_transport
+        .send(ClientRequest {
+            payload: Some(ClientRequestPayload::AuthChallengeRequest(
+                AuthChallengeRequest {
+                    pubkey: pubkey_bytes,
+                },
+            )),
+        })
+        .await
+        .unwrap();
+
+    let response = test_transport
+        .recv()
+        .await
+        .expect("should receive challenge");
+    let challenge = match response {
+        Ok(resp) => match resp.payload {
+            Some(ClientResponsePayload::AuthChallenge(c)) => c,
+            other => panic!("Expected AuthChallenge, got {other:?}"),
+        },
+        Err(err) => panic!("Expected Ok response, got Err({err:?})"),
+    };
+
+    let formatted_challenge = arbiter_proto::format_challenge(challenge.nonce, &challenge.pubkey);
+    let signature = new_key.sign(&formatted_challenge);
+
+    test_transport
+        .send(ClientRequest {
+            payload: Some(ClientRequestPayload::AuthChallengeSolution(
+                AuthChallengeSolution {
+                    signature: signature.to_bytes().to_vec(),
+                },
+            )),
+        })
+        .await
+        .unwrap();
+
+    task.await.unwrap();
+
+    let tx = TxEip1559 {
+        chain_id: 1,
+        nonce: 0,
+        gas_limit: 21_000,
+        max_fee_per_gas: 1,
+        max_priority_fee_per_gas: 1,
+        to: TxKind::Call(Address::from_slice(&[0x11; 20])),
+        value: U256::ZERO,
+        input: Bytes::new(),
+        access_list: Default::default(),
+    };
+
+    let mut rlp_transaction = Vec::new();
+    tx.encode(&mut rlp_transaction);
+
+    test_transport
+        .send(ClientRequest {
+            payload: Some(ClientRequestPayload::EvmSignTransaction(
+                EvmSignTransactionRequest {
+                    wallet_address: [0x22; 20].to_vec(),
+                    rlp_transaction,
+                },
+            )),
+        })
+        .await
+        .unwrap();
+
+    let response = test_transport
+        .recv()
+        .await
+        .expect("should receive sign response");
+
+    match response {
+        Ok(resp) => match resp.payload {
+            Some(ClientResponsePayload::EvmSignTransaction(_)) => {}
+            other => panic!("Expected EvmSignTransaction response, got {other:?}"),
+        },
+        Err(err) => panic!("Expected Ok response, got Err({err:?})"),
+    }
+}

server/crates/arbiter-server/tests/common/mod.rs

@@ -1,18 +1,19 @@
 use arbiter_proto::transport::{Bi, Error};
 use arbiter_server::{
     actors::keyholder::KeyHolder,
-    db::{self, schema}, safe_cell::{SafeCell, SafeCellHandle as _},
+    db::{self, schema},
 };
 use async_trait::async_trait;
 use diesel::QueryDsl;
 use diesel_async::RunQueryDsl;
+use memsafe::MemSafe;
 use tokio::sync::mpsc;
 
 #[allow(dead_code)]
 pub async fn bootstrapped_keyholder(db: &db::DatabasePool) -> KeyHolder {
     let mut actor = KeyHolder::new(db.clone()).await.unwrap();
     actor
-        .bootstrap(SafeCell::new(b"test-seal-key".to_vec()))
+        .bootstrap(MemSafe::new(b"test-seal-key".to_vec()).unwrap())
         .await
         .unwrap();
     actor

server/crates/arbiter-server/tests/keyholder/concurrency.rs

@@ -3,11 +3,11 @@ use std::collections::{HashMap, HashSet};
 use arbiter_server::{
     actors::keyholder::{CreateNew, Error, KeyHolder},
     db::{self, models, schema},
-    safe_cell::{SafeCell, SafeCellHandle as _},
 };
 use diesel::{ExpressionMethods as _, QueryDsl, SelectableHelper, dsl::sql_query};
 use diesel_async::RunQueryDsl;
 use kameo::actor::{ActorRef, Spawn as _};
+use memsafe::MemSafe;
 use tokio::task::JoinSet;
 
 use crate::common;
@@ -24,7 +24,7 @@ async fn write_concurrently(
             let plaintext = format!("{prefix}-{i}").into_bytes();
             let id = actor
                 .ask(CreateNew {
-                    plaintext: SafeCell::new(plaintext.clone()),
+                    plaintext: MemSafe::new(plaintext.clone()).unwrap(),
                 })
                 .await
                 .unwrap();
@@ -118,7 +118,7 @@ async fn insert_failure_does_not_create_partial_row() {
     drop(conn);
 
     let err = actor
-        .create_new(SafeCell::new(b"should fail".to_vec()))
+        .create_new(MemSafe::new(b"should fail".to_vec()).unwrap())
         .await
         .unwrap_err();
     assert!(matches!(err, Error::DatabaseTransaction(_)));
@@ -162,12 +162,12 @@ async fn decrypt_roundtrip_after_high_concurrency() {
 
     let mut decryptor = KeyHolder::new(db.clone()).await.unwrap();
     decryptor
-        .try_unseal(SafeCell::new(b"test-seal-key".to_vec()))
+        .try_unseal(MemSafe::new(b"test-seal-key".to_vec()).unwrap())
         .await
         .unwrap();
 
     for (id, plaintext) in expected {
         let mut decrypted = decryptor.decrypt(id).await.unwrap();
-        assert_eq!(*decrypted.read(), plaintext);
+        assert_eq!(*decrypted.read().unwrap(), plaintext);
     }
 }

server/crates/arbiter-server/tests/keyholder/lifecycle.rs

@@ -1,10 +1,10 @@
 use arbiter_server::{
     actors::keyholder::{Error, KeyHolder},
     db::{self, models, schema},
-    safe_cell::{SafeCell, SafeCellHandle as _},
 };
 use diesel::{QueryDsl, SelectableHelper};
 use diesel_async::RunQueryDsl;
+use memsafe::MemSafe;
 
 use crate::common;
 
@@ -14,7 +14,7 @@ async fn test_bootstrap() {
     let db = db::create_test_pool().await;
     let mut actor = KeyHolder::new(db.clone()).await.unwrap();
 
-    let seal_key = SafeCell::new(b"test-seal-key".to_vec());
+    let seal_key = MemSafe::new(b"test-seal-key".to_vec()).unwrap();
     actor.bootstrap(seal_key).await.unwrap();
 
     let mut conn = db.get().await.unwrap();
@@ -43,7 +43,7 @@ async fn test_bootstrap_rejects_double() {
     let db = db::create_test_pool().await;
     let mut actor = common::bootstrapped_keyholder(&db).await;
 
-    let seal_key2 = SafeCell::new(b"test-seal-key".to_vec());
+    let seal_key2 = MemSafe::new(b"test-seal-key".to_vec()).unwrap();
     let err = actor.bootstrap(seal_key2).await.unwrap_err();
     assert!(matches!(err, Error::AlreadyBootstrapped));
 }
@@ -55,7 +55,7 @@ async fn test_create_new_before_bootstrap_fails() {
     let mut actor = KeyHolder::new(db).await.unwrap();
 
     let err = actor
-        .create_new(SafeCell::new(b"data".to_vec()))
+        .create_new(MemSafe::new(b"data".to_vec()).unwrap())
         .await
         .unwrap_err();
     assert!(matches!(err, Error::NotBootstrapped));
@@ -91,17 +91,17 @@ async fn test_unseal_correct_password() {
 
     let plaintext = b"survive a restart";
     let aead_id = actor
-        .create_new(SafeCell::new(plaintext.to_vec()))
+        .create_new(MemSafe::new(plaintext.to_vec()).unwrap())
         .await
         .unwrap();
     drop(actor);
 
     let mut actor = KeyHolder::new(db.clone()).await.unwrap();
-    let seal_key = SafeCell::new(b"test-seal-key".to_vec());
+    let seal_key = MemSafe::new(b"test-seal-key".to_vec()).unwrap();
     actor.try_unseal(seal_key).await.unwrap();
 
     let mut decrypted = actor.decrypt(aead_id).await.unwrap();
-    assert_eq!(*decrypted.read(), plaintext);
+    assert_eq!(*decrypted.read().unwrap(), plaintext);
 }
 
 #[tokio::test]
@@ -112,20 +112,20 @@ async fn test_unseal_wrong_then_correct_password() {
 
     let plaintext = b"important data";
     let aead_id = actor
-        .create_new(SafeCell::new(plaintext.to_vec()))
+        .create_new(MemSafe::new(plaintext.to_vec()).unwrap())
         .await
         .unwrap();
     drop(actor);
 
     let mut actor = KeyHolder::new(db.clone()).await.unwrap();
 
-    let bad_key = SafeCell::new(b"wrong-password".to_vec());
+    let bad_key = MemSafe::new(b"wrong-password".to_vec()).unwrap();
     let err = actor.try_unseal(bad_key).await.unwrap_err();
     assert!(matches!(err, Error::InvalidKey));
 
-    let good_key = SafeCell::new(b"test-seal-key".to_vec());
+    let good_key = MemSafe::new(b"test-seal-key".to_vec()).unwrap();
     actor.try_unseal(good_key).await.unwrap();
 
     let mut decrypted = actor.decrypt(aead_id).await.unwrap();
-    assert_eq!(*decrypted.read(), plaintext);
+    assert_eq!(*decrypted.read().unwrap(), plaintext);
 }

server/crates/arbiter-server/tests/keyholder/storage.rs

@@ -3,10 +3,10 @@ use std::collections::HashSet;
 use arbiter_server::{
     actors::keyholder::{Error, encryption::v1},
     db::{self, models, schema},
-    safe_cell::{SafeCell, SafeCellHandle as _},
 };
 use diesel::{ExpressionMethods as _, QueryDsl, SelectableHelper, dsl::update};
 use diesel_async::RunQueryDsl;
+use memsafe::MemSafe;
 
 use crate::common;
 
@@ -18,12 +18,12 @@ async fn test_create_decrypt_roundtrip() {
 
     let plaintext = b"hello arbiter";
     let aead_id = actor
-        .create_new(SafeCell::new(plaintext.to_vec()))
+        .create_new(MemSafe::new(plaintext.to_vec()).unwrap())
         .await
         .unwrap();
 
     let mut decrypted = actor.decrypt(aead_id).await.unwrap();
-    assert_eq!(*decrypted.read(), plaintext);
+    assert_eq!(*decrypted.read().unwrap(), plaintext);
 }
 
 #[tokio::test]
@@ -44,11 +44,11 @@ async fn test_ciphertext_differs_across_entries() {
 
     let plaintext = b"same content";
     let id1 = actor
-        .create_new(SafeCell::new(plaintext.to_vec()))
+        .create_new(MemSafe::new(plaintext.to_vec()).unwrap())
         .await
         .unwrap();
     let id2 = actor
-        .create_new(SafeCell::new(plaintext.to_vec()))
+        .create_new(MemSafe::new(plaintext.to_vec()).unwrap())
         .await
         .unwrap();
 
@@ -70,8 +70,8 @@ async fn test_ciphertext_differs_across_entries() {
 
     let mut d1 = actor.decrypt(id1).await.unwrap();
     let mut d2 = actor.decrypt(id2).await.unwrap();
-    assert_eq!(*d1.read(), plaintext);
+    assert_eq!(*d1.read().unwrap(), plaintext);
-    assert_eq!(*d2.read(), plaintext);
+    assert_eq!(*d2.read().unwrap(), plaintext);
 }
 
 #[tokio::test]
@@ -83,7 +83,7 @@ async fn test_nonce_never_reused() {
     let n = 5;
     for i in 0..n {
         actor
-            .create_new(SafeCell::new(format!("secret {i}").into_bytes()))
+            .create_new(MemSafe::new(format!("secret {i}").into_bytes()).unwrap())
             .await
             .unwrap();
     }
@@ -137,7 +137,7 @@ async fn broken_db_nonce_format_fails_closed() {
     drop(conn);
 
     let err = actor
-        .create_new(SafeCell::new(b"must fail".to_vec()))
+        .create_new(MemSafe::new(b"must fail".to_vec()).unwrap())
         .await
         .unwrap_err();
     assert!(matches!(err, Error::BrokenDatabase));
@@ -145,7 +145,7 @@ async fn broken_db_nonce_format_fails_closed() {
     let db = db::create_test_pool().await;
     let mut actor = common::bootstrapped_keyholder(&db).await;
     let id = actor
-        .create_new(SafeCell::new(b"decrypt target".to_vec()))
+        .create_new(MemSafe::new(b"decrypt target".to_vec()).unwrap())
         .await
         .unwrap();
     let mut conn = db.get().await.unwrap();

server/crates/arbiter-server/tests/user_agent.rs

@@ -2,5 +2,7 @@ mod common;
 
 #[path = "user_agent/auth.rs"]
 mod auth;
+#[path = "user_agent/sdk_client.rs"]
+mod sdk_client;
 #[path = "user_agent/unseal.rs"]
 mod unseal;

server/crates/arbiter-server/tests/user_agent/auth.rs

@@ -1,9 +1,14 @@
+use arbiter_proto::proto::user_agent::{
+    AuthChallengeRequest, AuthChallengeSolution, KeyType as ProtoKeyType, UserAgentRequest,
+    user_agent_request::Payload as UserAgentRequestPayload,
+    user_agent_response::Payload as UserAgentResponsePayload,
+};
 use arbiter_proto::transport::Bi;
 use arbiter_server::{
     actors::{
         GlobalActors,
         bootstrap::GetToken,
-        user_agent::{AuthPublicKey, Request, Response, UserAgentConnection, connect_user_agent},
+        user_agent::{UserAgentConnection, connect_user_agent},
     },
     db::{self, schema},
 };
@@ -25,10 +30,17 @@ pub async fn test_bootstrap_token_auth() {
     let task = tokio::spawn(connect_user_agent(props));
 
     let new_key = ed25519_dalek::SigningKey::generate(&mut rand::rng());
+    let pubkey_bytes = new_key.verifying_key().to_bytes().to_vec();
+
     test_transport
-        .send(Request::AuthChallengeRequest {
+        .send(UserAgentRequest {
-            pubkey: AuthPublicKey::Ed25519(new_key.verifying_key()),
+            payload: Some(UserAgentRequestPayload::AuthChallengeRequest(
+                AuthChallengeRequest {
+                    pubkey: pubkey_bytes,
                     bootstrap_token: Some(token),
+                    key_type: ProtoKeyType::Ed25519.into(),
+                },
+            )),
         })
         .await
         .unwrap();
@@ -55,10 +67,17 @@ pub async fn test_bootstrap_invalid_token_auth() {
     let task = tokio::spawn(connect_user_agent(props));
 
     let new_key = ed25519_dalek::SigningKey::generate(&mut rand::rng());
+    let pubkey_bytes = new_key.verifying_key().to_bytes().to_vec();
+
     test_transport
-        .send(Request::AuthChallengeRequest {
+        .send(UserAgentRequest {
-            pubkey: AuthPublicKey::Ed25519(new_key.verifying_key()),
+            payload: Some(UserAgentRequestPayload::AuthChallengeRequest(
+                AuthChallengeRequest {
+                    pubkey: pubkey_bytes,
                     bootstrap_token: Some("invalid_token".to_string()),
+                    key_type: ProtoKeyType::Ed25519.into(),
+                },
+            )),
         })
         .await
         .unwrap();
@@ -104,9 +123,14 @@ pub async fn test_challenge_auth() {
 
     // Send challenge request
     test_transport
-        .send(Request::AuthChallengeRequest {
+        .send(UserAgentRequest {
-            pubkey: AuthPublicKey::Ed25519(new_key.verifying_key()),
+            payload: Some(UserAgentRequestPayload::AuthChallengeRequest(
+                AuthChallengeRequest {
+                    pubkey: pubkey_bytes,
                     bootstrap_token: None,
+                    key_type: ProtoKeyType::Ed25519.into(),
+                },
+            )),
         })
         .await
         .unwrap();
@@ -117,19 +141,24 @@ pub async fn test_challenge_auth() {
         .await
         .expect("should receive challenge");
     let challenge = match response {
-        Ok(resp) => match resp {
+        Ok(resp) => match resp.payload {
-            Response::AuthChallenge { nonce } => nonce,
+            Some(UserAgentResponsePayload::AuthChallenge(c)) => c,
             other => panic!("Expected AuthChallenge, got {other:?}"),
         },
         Err(err) => panic!("Expected Ok response, got Err({err:?})"),
     };
 
-    let formatted_challenge = arbiter_proto::format_challenge(challenge, &pubkey_bytes);
+    // Sign the challenge and send solution
+    let formatted_challenge = arbiter_proto::format_challenge(challenge.nonce, &challenge.pubkey);
     let signature = new_key.sign(&formatted_challenge);
 
     test_transport
-        .send(Request::AuthChallengeSolution {
+        .send(UserAgentRequest {
+            payload: Some(UserAgentRequestPayload::AuthChallengeSolution(
+                AuthChallengeSolution {
                     signature: signature.to_bytes().to_vec(),
+                },
+            )),
         })
         .await
         .unwrap();

server/crates/arbiter-server/tests/user_agent/sdk_client.rs

@@ -0,0 +1,270 @@
+use arbiter_proto::proto::user_agent::{
+    SdkClientApproveRequest, SdkClientError as ProtoSdkClientError, SdkClientRevokeRequest,
+    UserAgentRequest, sdk_client_approve_response, sdk_client_list_response,
+    sdk_client_revoke_response, user_agent_request::Payload as UserAgentRequestPayload,
+    user_agent_response::Payload as UserAgentResponsePayload,
+};
+use arbiter_server::{
+    actors::{GlobalActors, user_agent::session::UserAgentSession},
+    db,
+};
+
+/// Shared helper: create a session and register a client pubkey via sdk_client_approve.
+async fn make_session(db: &db::DatabasePool) -> UserAgentSession {
+    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+    UserAgentSession::new_test(db.clone(), actors)
+}
+
+#[tokio::test]
+#[test_log::test]
+async fn test_sdk_client_approve_registers_client() {
+    let db = db::create_test_pool().await;
+    let mut session = make_session(&db).await;
+
+    let pubkey = [0x42u8; 32];
+
+    let response = session
+        .process_transport_inbound(UserAgentRequest {
+            payload: Some(UserAgentRequestPayload::SdkClientApprove(
+                SdkClientApproveRequest {
+                    pubkey: pubkey.to_vec(),
+                },
+            )),
+        })
+        .await
+        .expect("handler should succeed");
+
+    let entry = match response.payload.unwrap() {
+        UserAgentResponsePayload::SdkClientApprove(resp) => match resp.result.unwrap() {
+            sdk_client_approve_response::Result::Client(e) => e,
+            sdk_client_approve_response::Result::Error(e) => {
+                panic!("Expected Client, got error {:?}", e)
+            }
+        },
+        other => panic!("Expected SdkClientApprove, got {other:?}"),
+    };
+
+    assert_eq!(entry.pubkey, pubkey.to_vec());
+    assert!(entry.id > 0);
+}
+
+#[tokio::test]
+#[test_log::test]
+async fn test_sdk_client_approve_duplicate_returns_already_exists() {
+    let db = db::create_test_pool().await;
+    let mut session = make_session(&db).await;
+
+    let pubkey = [0x11u8; 32];
+    let req = UserAgentRequest {
+        payload: Some(UserAgentRequestPayload::SdkClientApprove(
+            SdkClientApproveRequest {
+                pubkey: pubkey.to_vec(),
+            },
+        )),
+    };
+
+    session
+        .process_transport_inbound(req.clone())
+        .await
+        .unwrap();
+
+    let response = session
+        .process_transport_inbound(req)
+        .await
+        .expect("second insert should not panic");
+
+    match response.payload.unwrap() {
+        UserAgentResponsePayload::SdkClientApprove(resp) => match resp.result.unwrap() {
+            sdk_client_approve_response::Result::Error(code) => {
+                assert_eq!(code, ProtoSdkClientError::AlreadyExists as i32);
+            }
+            sdk_client_approve_response::Result::Client(_) => {
+                panic!("Expected AlreadyExists error for duplicate pubkey")
+            }
+        },
+        other => panic!("Expected SdkClientApprove, got {other:?}"),
+    }
+}
+
+#[tokio::test]
+#[test_log::test]
+async fn test_sdk_client_list_shows_registered_clients() {
+    let db = db::create_test_pool().await;
+    let mut session = make_session(&db).await;
+
+    let pubkey_a = [0x0Au8; 32];
+    let pubkey_b = [0x0Bu8; 32];
+
+    for pubkey in [pubkey_a, pubkey_b] {
+        session
+            .process_transport_inbound(UserAgentRequest {
+                payload: Some(UserAgentRequestPayload::SdkClientApprove(
+                    SdkClientApproveRequest {
+                        pubkey: pubkey.to_vec(),
+                    },
+                )),
+            })
+            .await
+            .unwrap();
+    }
+
+    let response = session
+        .process_transport_inbound(UserAgentRequest {
+            payload: Some(UserAgentRequestPayload::SdkClientList(())),
+        })
+        .await
+        .expect("list should succeed");
+
+    let clients = match response.payload.unwrap() {
+        UserAgentResponsePayload::SdkClientList(resp) => match resp.result.unwrap() {
+            sdk_client_list_response::Result::Clients(list) => list.clients,
+            sdk_client_list_response::Result::Error(e) => {
+                panic!("Expected Clients, got error {:?}", e)
+            }
+        },
+        other => panic!("Expected SdkClientList, got {other:?}"),
+    };
+
+    assert_eq!(clients.len(), 2);
+    let pubkeys: Vec<Vec<u8>> = clients.into_iter().map(|e| e.pubkey).collect();
+    assert!(pubkeys.contains(&pubkey_a.to_vec()));
+    assert!(pubkeys.contains(&pubkey_b.to_vec()));
+}
+
+#[tokio::test]
+#[test_log::test]
+async fn test_sdk_client_revoke_removes_client() {
+    let db = db::create_test_pool().await;
+    let mut session = make_session(&db).await;
+
+    let pubkey = [0xBBu8; 32];
+
+    // Register a client and get its id
+    let approve_response = session
+        .process_transport_inbound(UserAgentRequest {
+            payload: Some(UserAgentRequestPayload::SdkClientApprove(
+                SdkClientApproveRequest {
+                    pubkey: pubkey.to_vec(),
+                },
+            )),
+        })
+        .await
+        .unwrap();
+
+    let client_id = match approve_response.payload.unwrap() {
+        UserAgentResponsePayload::SdkClientApprove(resp) => match resp.result.unwrap() {
+            sdk_client_approve_response::Result::Client(e) => e.id,
+            sdk_client_approve_response::Result::Error(e) => panic!("approve failed: {:?}", e),
+        },
+        other => panic!("{other:?}"),
+    };
+
+    // Revoke the client
+    let revoke_response = session
+        .process_transport_inbound(UserAgentRequest {
+            payload: Some(UserAgentRequestPayload::SdkClientRevoke(
+                SdkClientRevokeRequest { client_id },
+            )),
+        })
+        .await
+        .expect("revoke should succeed");
+
+    match revoke_response.payload.unwrap() {
+        UserAgentResponsePayload::SdkClientRevoke(resp) => match resp.result.unwrap() {
+            sdk_client_revoke_response::Result::Ok(_) => {}
+            sdk_client_revoke_response::Result::Error(e) => {
+                panic!("Expected Ok, got error {:?}", e)
+            }
+        },
+        other => panic!("Expected SdkClientRevoke, got {other:?}"),
+    }
+
+    // List should now be empty
+    let list_response = session
+        .process_transport_inbound(UserAgentRequest {
+            payload: Some(UserAgentRequestPayload::SdkClientList(())),
+        })
+        .await
+        .unwrap();
+
+    let clients = match list_response.payload.unwrap() {
+        UserAgentResponsePayload::SdkClientList(resp) => match resp.result.unwrap() {
+            sdk_client_list_response::Result::Clients(list) => list.clients,
+            sdk_client_list_response::Result::Error(e) => panic!("list error: {:?}", e),
+        },
+        other => panic!("{other:?}"),
+    };
+    assert!(clients.is_empty(), "client should be removed after revoke");
+}
+
+#[tokio::test]
+#[test_log::test]
+async fn test_sdk_client_revoke_not_found_returns_error() {
+    let db = db::create_test_pool().await;
+    let mut session = make_session(&db).await;
+
+    let response = session
+        .process_transport_inbound(UserAgentRequest {
+            payload: Some(UserAgentRequestPayload::SdkClientRevoke(
+                SdkClientRevokeRequest { client_id: 9999 },
+            )),
+        })
+        .await
+        .unwrap();
+
+    match response.payload.unwrap() {
+        UserAgentResponsePayload::SdkClientRevoke(resp) => match resp.result.unwrap() {
+            sdk_client_revoke_response::Result::Error(code) => {
+                assert_eq!(code, ProtoSdkClientError::NotFound as i32);
+            }
+            sdk_client_revoke_response::Result::Ok(_) => {
+                panic!("Expected NotFound error for missing client_id")
+            }
+        },
+        other => panic!("Expected SdkClientRevoke, got {other:?}"),
+    }
+}
+
+#[tokio::test]
+#[test_log::test]
+async fn test_sdk_client_approve_rejected_client_cannot_auth() {
+    // Verify the core flow: only pre-approved clients can authenticate
+    use arbiter_proto::proto::client::{
+        AuthChallengeRequest, ClientRequest, client_request::Payload as ClientRequestPayload,
+        client_response::Payload as ClientResponsePayload,
+    };
+    use arbiter_proto::transport::Bi as _;
+    use arbiter_server::actors::client::{ClientConnection, connect_client};
+
+    let db = db::create_test_pool().await;
+    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+
+    let new_key = ed25519_dalek::SigningKey::generate(&mut rand::rng());
+    let pubkey_bytes = new_key.verifying_key().to_bytes().to_vec();
+
+    let (server_transport, mut test_transport) = super::common::ChannelTransport::<_, _>::new();
+    let props = ClientConnection::new(db.clone(), Box::new(server_transport), actors.clone());
+    let task = tokio::spawn(connect_client(props));
+
+    test_transport
+        .send(ClientRequest {
+            payload: Some(ClientRequestPayload::AuthChallengeRequest(
+                AuthChallengeRequest {
+                    pubkey: pubkey_bytes.clone(),
+                },
+            )),
+        })
+        .await
+        .unwrap();
+
+    let response = test_transport.recv().await.unwrap().unwrap();
+    assert!(
+        matches!(
+            response.payload.unwrap(),
+            ClientResponsePayload::ClientConnectError(_)
+        ),
+        "unregistered client should be rejected"
+    );
+
+    task.await.unwrap();
+}

server/crates/arbiter-server/tests/user_agent/unseal.rs

@@ -1,23 +1,30 @@
+use arbiter_proto::proto::user_agent::{
+    UnsealEncryptedKey, UnsealResult, UnsealStart, UserAgentRequest,
+    user_agent_request::Payload as UserAgentRequestPayload,
+    user_agent_response::Payload as UserAgentResponsePayload,
+};
 use arbiter_server::{
     actors::{
         GlobalActors,
         keyholder::{Bootstrap, Seal},
-        user_agent::{Request, Response, UnsealError, session::UserAgentSession},
+        user_agent::session::UserAgentSession,
     },
     db,
-    safe_cell::{SafeCell, SafeCellHandle as _},
 };
 use chacha20poly1305::{AeadInPlace, XChaCha20Poly1305, XNonce, aead::KeyInit};
+use memsafe::MemSafe;
 use x25519_dalek::{EphemeralSecret, PublicKey};
 
-async fn setup_sealed_user_agent(seal_key: &[u8]) -> (db::DatabasePool, UserAgentSession) {
+async fn setup_sealed_user_agent(
+    seal_key: &[u8],
+) -> (db::DatabasePool, UserAgentSession) {
     let db = db::create_test_pool().await;
     let actors = GlobalActors::spawn(db.clone()).await.unwrap();
 
     actors
         .key_holder
         .ask(Bootstrap {
-            seal_key_raw: SafeCell::new(seal_key.to_vec()),
+            seal_key_raw: MemSafe::new(seal_key.to_vec()).unwrap(),
         })
         .await
         .unwrap();
@@ -28,23 +35,29 @@ async fn setup_sealed_user_agent(seal_key: &[u8]) -> (db::DatabasePool, UserAgen
     (db, session)
 }
 
-async fn client_dh_encrypt(user_agent: &mut UserAgentSession, key_to_send: &[u8]) -> Request {
+async fn client_dh_encrypt(
+    user_agent: &mut UserAgentSession,
+    key_to_send: &[u8],
+) -> UnsealEncryptedKey {
     let client_secret = EphemeralSecret::random();
     let client_public = PublicKey::from(&client_secret);
 
     let response = user_agent
-        .process_transport_inbound(Request::UnsealStart {
+        .process_transport_inbound(UserAgentRequest {
-            client_pubkey: client_public,
+            payload: Some(UserAgentRequestPayload::UnsealStart(UnsealStart {
+                client_pubkey: client_public.as_bytes().to_vec(),
+            })),
         })
         .await
         .unwrap();
 
-    let server_pubkey = match response {
+    let server_pubkey = match response.payload.unwrap() {
-        Response::UnsealStartResponse { server_pubkey } => server_pubkey,
+        UserAgentResponsePayload::UnsealStartResponse(resp) => resp.server_pubkey,
         other => panic!("Expected UnsealStartResponse, got {other:?}"),
     };
+    let server_public = PublicKey::from(<[u8; 32]>::try_from(server_pubkey.as_slice()).unwrap());
 
-    let shared_secret = client_secret.diffie_hellman(&server_pubkey);
+    let shared_secret = client_secret.diffie_hellman(&server_public);
     let cipher = XChaCha20Poly1305::new(shared_secret.as_bytes().into());
     let nonce = XNonce::from([0u8; 24]);
     let associated_data = b"unseal";
@@ -53,13 +66,19 @@ async fn client_dh_encrypt(user_agent: &mut UserAgentSession, key_to_send: &[u8]
         .encrypt_in_place(&nonce, associated_data, &mut ciphertext)
         .unwrap();
 
-    Request::UnsealEncryptedKey {
+    UnsealEncryptedKey {
         nonce: nonce.to_vec(),
         ciphertext,
         associated_data: associated_data.to_vec(),
     }
 }
 
+fn unseal_key_request(req: UnsealEncryptedKey) -> UserAgentRequest {
+    UserAgentRequest {
+        payload: Some(UserAgentRequestPayload::UnsealEncryptedKey(req)),
+    }
+}
+
 #[tokio::test]
 #[test_log::test]
 pub async fn test_unseal_success() {
@@ -69,11 +88,14 @@ pub async fn test_unseal_success() {
     let encrypted_key = client_dh_encrypt(&mut user_agent, seal_key).await;
 
     let response = user_agent
-        .process_transport_inbound(encrypted_key)
+        .process_transport_inbound(unseal_key_request(encrypted_key))
         .await
         .unwrap();
 
-    assert!(matches!(response, Response::UnsealResult(Ok(()))));
+    assert_eq!(
+        response.payload.unwrap(),
+        UserAgentResponsePayload::UnsealResult(UnsealResult::Success.into()),
+    );
 }
 
 #[tokio::test]
@@ -84,14 +106,14 @@ pub async fn test_unseal_wrong_seal_key() {
     let encrypted_key = client_dh_encrypt(&mut user_agent, b"wrong-key").await;
 
     let response = user_agent
-        .process_transport_inbound(encrypted_key)
+        .process_transport_inbound(unseal_key_request(encrypted_key))
         .await
         .unwrap();
 
-    assert!(matches!(
+    assert_eq!(
-        response,
+        response.payload.unwrap(),
-        Response::UnsealResult(Err(UnsealError::InvalidKey))
+        UserAgentResponsePayload::UnsealResult(UnsealResult::InvalidKey.into()),
-    ));
+    );
 }
 
 #[tokio::test]
@@ -103,25 +125,27 @@ pub async fn test_unseal_corrupted_ciphertext() {
     let client_public = PublicKey::from(&client_secret);
 
     user_agent
-        .process_transport_inbound(Request::UnsealStart {
+        .process_transport_inbound(UserAgentRequest {
-            client_pubkey: client_public,
+            payload: Some(UserAgentRequestPayload::UnsealStart(UnsealStart {
+                client_pubkey: client_public.as_bytes().to_vec(),
+            })),
         })
         .await
         .unwrap();
 
     let response = user_agent
-        .process_transport_inbound(Request::UnsealEncryptedKey {
+        .process_transport_inbound(unseal_key_request(UnsealEncryptedKey {
             nonce: vec![0u8; 24],
             ciphertext: vec![0u8; 32],
             associated_data: vec![],
-        })
+        }))
         .await
         .unwrap();
 
-    assert!(matches!(
+    assert_eq!(
-        response,
+        response.payload.unwrap(),
-        Response::UnsealResult(Err(UnsealError::InvalidKey))
+        UserAgentResponsePayload::UnsealResult(UnsealResult::InvalidKey.into()),
-    ));
+    );
 }
 
 #[tokio::test]
@@ -134,24 +158,27 @@ pub async fn test_unseal_retry_after_invalid_key() {
         let encrypted_key = client_dh_encrypt(&mut user_agent, b"wrong-key").await;
 
         let response = user_agent
-            .process_transport_inbound(encrypted_key)
+            .process_transport_inbound(unseal_key_request(encrypted_key))
             .await
             .unwrap();
 
-        assert!(matches!(
+        assert_eq!(
-            response,
+            response.payload.unwrap(),
-            Response::UnsealResult(Err(UnsealError::InvalidKey))
+            UserAgentResponsePayload::UnsealResult(UnsealResult::InvalidKey.into()),
-        ));
+        );
     }
 
     {
         let encrypted_key = client_dh_encrypt(&mut user_agent, seal_key).await;
 
         let response = user_agent
-            .process_transport_inbound(encrypted_key)
+            .process_transport_inbound(unseal_key_request(encrypted_key))
             .await
             .unwrap();
 
-        assert!(matches!(response, Response::UnsealResult(Ok(()))));
+        assert_eq!(
+            response.payload.unwrap(),
+            UserAgentResponsePayload::UnsealResult(UnsealResult::Success.into()),
+        );
     }
 }

server/crates/arbiter-terrors-poc/Cargo.toml

@@ -0,0 +1,7 @@
+[package]
+name = "arbiter-terrors-poc"
+version = "0.1.0"
+edition = "2024"
+
+[dependencies]
+terrors = "0.3"

server/crates/arbiter-terrors-poc/src/auth.rs

@@ -0,0 +1,139 @@
+use crate::errors::{InternalError1, InternalError2, InvalidSignature, NotRegistered};
+use terrors::OneOf;
+
+use crate::errors::ProtoError;
+
+// Each sub-call's error type already implements DrainInto<ProtoError>, so we convert
+// directly to ProtoError without broaden — no turbofish needed anywhere.
+//
+// Call chain:
+//   load_config()  → OneOf<(InternalError2,)>          → ProtoError::from
+//   get_nonce()    → OneOf<(InternalError1, InternalError2)> → ProtoError::from
+//   verify_sig()   → OneOf<(InvalidSignature,)>         → ProtoError::from
+pub fn process_request(id: u32, sig: &str) -> Result<String, ProtoError> {
+    if id == 0 {
+        return Err(ProtoError::NotRegistered);
+    }
+
+    let config = load_config(id).map_err(ProtoError::from)?;
+    let nonce = crate::db::get_nonce(id).map_err(ProtoError::from)?;
+    verify_signature(nonce, sig).map_err(ProtoError::from)?;
+
+    Ok(format!("config={config} nonce={nonce} sig={sig}"))
+}
+
+// Simulates loading a config value.
+// id=97 triggers InternalError2 ("config read failed").
+fn load_config(id: u32) -> Result<String, OneOf<(InternalError2,)>> {
+    if id == 97 {
+        return Err(OneOf::new(InternalError2("config read failed".to_owned())));
+    }
+    Ok(format!("cfg-{id}"))
+}
+
+pub fn verify_signature(_nonce: u32, sig: &str) -> Result<(), OneOf<(InvalidSignature,)>> {
+    if sig != "ok" {
+        return Err(OneOf::new(InvalidSignature));
+    }
+    Ok(())
+}
+
+type AuthError = OneOf<(
+    NotRegistered,
+    InvalidSignature,
+    InternalError1,
+    InternalError2,
+)>;
+
+pub fn authenticate(id: u32, sig: &str) -> Result<u32, AuthError> {
+    if id == 0 {
+        return Err(OneOf::new(NotRegistered));
+    }
+
+    // Return type AuthError lets the compiler infer the broaden target.
+    let nonce = crate::db::get_nonce(id).map_err(OneOf::broaden)?;
+    verify_signature(nonce, sig).map_err(OneOf::broaden)?;
+
+    Ok(nonce)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn verify_signature_ok() {
+        assert!(verify_signature(42, "ok").is_ok());
+    }
+
+    #[test]
+    fn verify_signature_bad() {
+        let err = verify_signature(42, "bad").unwrap_err();
+        assert!(err.narrow::<crate::errors::InvalidSignature, _>().is_ok());
+    }
+
+    #[test]
+    fn authenticate_success() {
+        assert_eq!(authenticate(1, "ok").unwrap(), 42);
+    }
+
+    #[test]
+    fn authenticate_not_registered() {
+        let err = authenticate(0, "ok").unwrap_err();
+        assert!(err.narrow::<crate::errors::NotRegistered, _>().is_ok());
+    }
+
+    #[test]
+    fn authenticate_invalid_signature() {
+        let err = authenticate(1, "bad").unwrap_err();
+        assert!(err.narrow::<crate::errors::InvalidSignature, _>().is_ok());
+    }
+
+    #[test]
+    fn authenticate_internal_error1() {
+        let err = authenticate(99, "ok").unwrap_err();
+        assert!(err.narrow::<crate::errors::InternalError1, _>().is_ok());
+    }
+
+    #[test]
+    fn authenticate_internal_error2() {
+        let err = authenticate(98, "ok").unwrap_err();
+        assert!(err.narrow::<crate::errors::InternalError2, _>().is_ok());
+    }
+
+    #[test]
+    fn process_request_success() {
+        let result = process_request(1, "ok").unwrap();
+        assert!(result.contains("nonce=42"));
+    }
+
+    #[test]
+    fn process_request_not_registered() {
+        let err = process_request(0, "ok").unwrap_err();
+        assert!(matches!(err, crate::errors::ProtoError::NotRegistered));
+    }
+
+    #[test]
+    fn process_request_invalid_signature() {
+        let err = process_request(1, "bad").unwrap_err();
+        assert!(matches!(err, crate::errors::ProtoError::InvalidSignature));
+    }
+
+    #[test]
+    fn process_request_internal_from_config() {
+        // id=97 → load_config returns InternalError2
+        let err = process_request(97, "ok").unwrap_err();
+        assert!(
+            matches!(err, crate::errors::ProtoError::Internal(ref msg) if msg == "config read failed")
+        );
+    }
+
+    #[test]
+    fn process_request_internal_from_db() {
+        // id=99 → get_nonce returns InternalError1
+        let err = process_request(99, "ok").unwrap_err();
+        assert!(
+            matches!(err, crate::errors::ProtoError::Internal(ref msg) if msg == "db pool unavailable")
+        );
+    }
+}

server/crates/arbiter-terrors-poc/src/db.rs

@@ -0,0 +1,38 @@
+use crate::errors::{InternalError1, InternalError2};
+use terrors::OneOf;
+
+// Simulates fetching a nonce from a database.
+// id=99 → InternalError1 (pool unavailable)
+// id=98 → InternalError2 (query timeout)
+pub fn get_nonce(id: u32) -> Result<u32, OneOf<(InternalError1, InternalError2)>> {
+    match id {
+        99 => Err(OneOf::new(InternalError1("db pool unavailable".to_owned()))),
+        98 => Err(OneOf::new(InternalError2("query timeout".to_owned()))),
+        _ => Ok(42),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn get_nonce_returns_nonce_for_valid_id() {
+        assert_eq!(get_nonce(1).unwrap(), 42);
+    }
+
+    #[test]
+    fn get_nonce_returns_internal_error1_for_sentinel() {
+        let err = get_nonce(99).unwrap_err();
+        let internal = err.narrow::<crate::errors::InternalError1, _>().unwrap();
+        assert_eq!(internal.0, "db pool unavailable");
+    }
+
+    #[test]
+    fn get_nonce_returns_internal_error2_for_sentinel() {
+        let err = get_nonce(98).unwrap_err();
+        let e = err.narrow::<crate::errors::InternalError1, _>().unwrap_err();
+        let internal = e.take::<crate::errors::InternalError2>();
+        assert_eq!(internal.0, "query timeout");
+    }
+}

server/crates/arbiter-terrors-poc/src/errors.rs

@@ -0,0 +1,130 @@
+use terrors::OneOf;
+
+// Wire boundary type — what would go into a proto response
+#[derive(Debug)]
+pub enum ProtoError {
+    NotRegistered,
+    InvalidSignature,
+    Internal(String), // Or Box<dyn Error>, who cares?
+}
+
+// Internal terrors types
+#[derive(Debug)]
+pub struct NotRegistered;
+#[derive(Debug)]
+pub struct InvalidSignature;
+#[derive(Debug)]
+pub struct InternalError1(pub String);
+#[derive(Debug)]
+pub struct InternalError2(pub String);
+
+// Errors can be scattered across the codebase as long as they implement Into<ProtoError>
+impl From<NotRegistered> for ProtoError {
+    fn from(_: NotRegistered) -> Self {
+        ProtoError::NotRegistered
+    }
+}
+
+impl From<InvalidSignature> for ProtoError {
+    fn from(_: InvalidSignature) -> Self {
+        ProtoError::InvalidSignature
+    }
+}
+
+impl From<InternalError1> for ProtoError {
+    fn from(e: InternalError1) -> Self {
+        ProtoError::Internal(e.0)
+    }
+}
+impl From<InternalError2> for ProtoError {
+    fn from(e: InternalError2) -> Self {
+        ProtoError::Internal(e.0)
+    }
+}
+
+/// Private helper trait for converting from OneOf<T...> where each T can be converted
+/// into the target type `O` by recursively narrowing until a match is found.
+/// 
+/// IDK why this isn't already in terrors.
+trait DrainInto<O>: terrors::TypeSet + Sized {
+    fn drain(e: OneOf<Self>) -> O;
+}
+
+macro_rules! impl_drain_into {
+    ($head:ident) => {
+        impl<$head, O> DrainInto<O> for ($head,)
+        where
+            $head: Into<O> + 'static,
+        {
+            fn drain(e: OneOf<($head,)>) -> O {
+                e.take().into()
+            }
+        }
+    };
+    ($head:ident, $($tail:ident),+) => {
+        impl<$head, $($tail),+, O> DrainInto<O> for ($head, $($tail),+)
+        where
+            $head: Into<O> + 'static,
+            ($($tail,)+): DrainInto<O>,
+        {
+            fn drain(e: OneOf<($head, $($tail),+)>) -> O {
+                match e.narrow::<$head, _>() {
+                    Ok(h) => h.into(),
+                    Err(rest) => <($($tail,)+)>::drain(rest),
+                }
+            }
+        }
+        impl_drain_into!($($tail),+);
+    };
+}
+
+// Generates impls for all tuple sizes from 1 up to 7 (restricted by terrors internal impl).
+// Each invocation produces one impl then recurses on the tail.
+impl_drain_into!(A, B, C, D, E, F, G, H, I);
+
+// Blanket From impl: body delegates to the recursive drain.
+impl<E: DrainInto<ProtoError>> From<OneOf<E>> for ProtoError {
+    fn from(e: OneOf<E>) -> Self {
+        E::drain(e)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn not_registered_converts_to_proto() {
+        let e: ProtoError = NotRegistered.into();
+        assert!(matches!(e, ProtoError::NotRegistered));
+    }
+
+    #[test]
+    fn invalid_signature_converts_to_proto() {
+        let e: ProtoError = InvalidSignature.into();
+        assert!(matches!(e, ProtoError::InvalidSignature));
+    }
+
+    #[test]
+    fn internal_converts_to_proto() {
+        let e: ProtoError = InternalError1("boom".into()).into();
+        assert!(matches!(e, ProtoError::Internal(msg) if msg == "boom"));
+    }
+
+    #[test]
+    fn one_of_remainder_converts_to_proto_invalid_signature() {
+        use terrors::OneOf;
+        let e: OneOf<(InvalidSignature, InternalError1)> = OneOf::new(InvalidSignature);
+        let proto = ProtoError::from(e);
+        assert!(matches!(proto, ProtoError::InvalidSignature));
+    }
+
+    #[test]
+    fn one_of_remainder_converts_to_proto_internal() {
+        use terrors::OneOf;
+        let e: OneOf<(InvalidSignature, InternalError1)> =
+            OneOf::new(InternalError1("db fail".into()));
+        let proto = ProtoError::from(e);
+        assert!(matches!(proto, ProtoError::Internal(msg) if msg == "db fail"));
+    }
+}

server/crates/arbiter-terrors-poc/src/main.rs

@@ -0,0 +1,43 @@
+mod auth;
+mod db;
+mod errors;
+
+use errors::ProtoError;
+
+fn run(id: u32, sig: &str) {
+    print!("authenticate(id={id}, sig={sig:?}) => ");
+    match auth::authenticate(id, sig) {
+        Ok(nonce) => println!("Ok(nonce={nonce})"),
+        Err(e) => match e.narrow::<errors::NotRegistered, _>() {
+            Ok(_) => println!("Err(NotRegistered) — handled locally"),
+            Err(remaining) => {
+                let proto = ProtoError::from(remaining);
+                println!("Err(ProtoError::{proto:?}) — forwarded to wire");
+            }
+        },
+    }
+}
+
+fn run_process(id: u32, sig: &str) {
+    print!("process_request(id={id}, sig={sig:?}) => ");
+    match auth::process_request(id, sig) {
+        Ok(s) => println!("Ok({s})"),
+        Err(e) => println!("Err(ProtoError::{e:?})"),
+    }
+}
+
+fn main() {
+    println!("=== authenticate ===");
+    run(0, "ok");   // NotRegistered
+    run(1, "bad");  // InvalidSignature
+    run(99, "ok");  // InternalError1
+    run(98, "ok");  // InternalError2
+    run(1, "ok");   // success
+
+    println!("\n=== process_request (Try chain) ===");
+    run_process(0, "ok");   // NotRegistered (guard, no I/O)
+    run_process(97, "ok");  // InternalError2 from load_config
+    run_process(99, "ok");  // InternalError1 from get_nonce
+    run_process(1, "bad");  // InvalidSignature from verify_signature
+    run_process(1, "ok");   // success
+}

server/crates/arbiter-useragent/Cargo.toml

@@ -0,0 +1,29 @@
+[package]
+name = "arbiter-useragent"
+version = "0.1.0"
+edition = "2024"
+license = "Apache-2.0"
+
+[lints]
+workspace = true
+
+[dependencies]
+arbiter-proto.path = "../arbiter-proto"
+kameo.workspace = true
+tokio = {workspace = true, features = ["net"]}
+tonic.workspace = true
+tonic.features = ["tls-aws-lc"]
+tracing.workspace = true
+ed25519-dalek.workspace = true
+smlang.workspace = true
+x25519-dalek.workspace = true
+k256.workspace = true
+rsa.workspace = true
+sha2.workspace = true
+spki.workspace = true
+rand.workspace = true
+thiserror.workspace = true
+tokio-stream.workspace = true
+http = "1.4.0"
+rustls-webpki = { version = "0.103.9", features = ["aws-lc-rs"] }
+async-trait.workspace = true

server/crates/arbiter-useragent/src/grpc.rs

@@ -0,0 +1,70 @@
+use arbiter_proto::{
+    proto::{
+        arbiter_service_client::ArbiterServiceClient,
+        user_agent::{UserAgentRequest, UserAgentResponse},
+    },
+    transport::{IdentityRecvConverter, IdentitySendConverter, grpc},
+    url::ArbiterUrl,
+};
+use kameo::actor::{ActorRef, Spawn};
+
+use tokio::sync::mpsc;
+use tokio_stream::wrappers::ReceiverStream;
+
+use tonic::transport::ClientTlsConfig;
+
+use super::{SigningKeyEnum, UserAgentActor};
+
+#[derive(Debug, thiserror::Error)]
+pub enum ConnectError {
+    #[error("Could establish connection")]
+    Connection(#[from] tonic::transport::Error),
+
+    #[error("Invalid server URI")]
+    InvalidUri(#[from] http::uri::InvalidUri),
+
+    #[error("Invalid CA certificate")]
+    InvalidCaCert(#[from] webpki::Error),
+
+    #[error("gRPC error")]
+    Grpc(#[from] tonic::Status),
+}
+
+pub type UserAgentGrpc = ActorRef<
+    UserAgentActor<
+        grpc::GrpcAdapter<
+            IdentityRecvConverter<UserAgentResponse>,
+            IdentitySendConverter<UserAgentRequest>,
+        >,
+    >,
+>;
+pub async fn connect_grpc(
+    url: ArbiterUrl,
+    key: SigningKeyEnum,
+) -> Result<UserAgentGrpc, ConnectError> {
+    let bootstrap_token = url.bootstrap_token.clone();
+    let anchor = webpki::anchor_from_trusted_cert(&url.ca_cert)?.to_owned();
+    let tls = ClientTlsConfig::new().trust_anchor(anchor);
+
+    // TODO: if `host` is localhost, we need to verify server's process authenticity
+    let channel = tonic::transport::Channel::from_shared(format!("{}:{}", url.host, url.port))?
+        .tls_config(tls)?
+        .connect()
+        .await?;
+
+    let mut client = ArbiterServiceClient::new(channel);
+    let (tx, rx) = mpsc::channel(16);
+    let bistream = client.user_agent(ReceiverStream::new(rx)).await?;
+    let bistream = bistream.into_inner();
+
+    let adapter = grpc::GrpcAdapter::new(
+        tx,
+        bistream,
+        IdentityRecvConverter::new(),
+        IdentitySendConverter::new(),
+    );
+
+    let actor = UserAgentActor::spawn(UserAgentActor::new(key, bootstrap_token, adapter));
+
+    Ok(actor)
+}

server/crates/arbiter-useragent/src/lib.rs

@@ -0,0 +1,257 @@
+use arbiter_proto::{
+    format_challenge,
+    proto::user_agent::{
+        AuthChallengeRequest, AuthChallengeSolution, AuthOk, KeyType as ProtoKeyType,
+        UserAgentRequest, UserAgentResponse,
+        user_agent_request::Payload as UserAgentRequestPayload,
+        user_agent_response::Payload as UserAgentResponsePayload,
+    },
+    transport::Bi,
+};
+use kameo::{Actor, actor::ActorRef};
+use smlang::statemachine;
+use tokio::select;
+use tracing::{error, info};
+
+/// Signing key variants supported by the user-agent auth protocol.
+pub enum SigningKeyEnum {
+    Ed25519(ed25519_dalek::SigningKey),
+    /// secp256k1 ECDSA; public key is sent as SEC1 compressed 33 bytes; signature is raw 64-byte (r||s).
+    EcdsaSecp256k1(k256::ecdsa::SigningKey),
+    /// RSA for Windows Hello (KeyCredentialManager); public key is DER SPKI; signature is PSS+SHA-256.
+    Rsa(rsa::RsaPrivateKey),
+}
+
+impl SigningKeyEnum {
+    /// Returns the canonical public key bytes to include in `AuthChallengeRequest.pubkey`.
+    pub fn pubkey_bytes(&self) -> Vec<u8> {
+        match self {
+            SigningKeyEnum::Ed25519(k) => k.verifying_key().to_bytes().to_vec(),
+            // 33-byte SEC1 compressed point — compact and natively supported by secp256k1 tooling
+            SigningKeyEnum::EcdsaSecp256k1(k) => {
+                k.verifying_key().to_encoded_point(true).as_bytes().to_vec()
+            }
+            SigningKeyEnum::Rsa(k) => {
+                use rsa::pkcs8::EncodePublicKey as _;
+                k.to_public_key()
+                    .to_public_key_der()
+                    .expect("rsa SPKI encoding is infallible")
+                    .to_vec()
+            }
+        }
+    }
+
+    /// Returns the proto `KeyType` discriminant to send in `AuthChallengeRequest.key_type`.
+    pub fn proto_key_type(&self) -> ProtoKeyType {
+        match self {
+            SigningKeyEnum::Ed25519(_) => ProtoKeyType::Ed25519,
+            SigningKeyEnum::EcdsaSecp256k1(_) => ProtoKeyType::EcdsaSecp256k1,
+            SigningKeyEnum::Rsa(_) => ProtoKeyType::Rsa,
+        }
+    }
+
+    /// Signs `msg` and returns raw signature bytes matching the server-side verification.
+    pub fn sign(&self, msg: &[u8]) -> Vec<u8> {
+        match self {
+            SigningKeyEnum::Ed25519(k) => {
+                use ed25519_dalek::Signer as _;
+                k.sign(msg).to_bytes().to_vec()
+            }
+            SigningKeyEnum::EcdsaSecp256k1(k) => {
+                use k256::ecdsa::signature::Signer as _;
+                let sig: k256::ecdsa::Signature = k.sign(msg);
+                sig.to_bytes().to_vec()
+            }
+            SigningKeyEnum::Rsa(k) => {
+                use rsa::signature::RandomizedSigner as _;
+                let signing_key = rsa::pss::BlindedSigningKey::<sha2::Sha256>::new(k.clone());
+                // Use rand_core OsRng from the rsa crate's re-exported rand_core (0.6.x),
+                // which is the version rsa's signature API expects.
+                let sig = signing_key.sign_with_rng(&mut rsa::rand_core::OsRng, msg);
+                use rsa::signature::SignatureEncoding as _;
+                sig.to_vec()
+            }
+        }
+    }
+}
+
+statemachine! {
+    name: UserAgent,
+    custom_error: false,
+    transitions: {
+        *Init + SentAuthChallengeRequest = WaitingForServerAuth,
+        WaitingForServerAuth + ReceivedAuthChallenge = WaitingForAuthOk,
+        WaitingForServerAuth + ReceivedAuthOk = Authenticated,
+        WaitingForAuthOk + ReceivedAuthOk = Authenticated,
+    }
+}
+
+pub struct DummyContext;
+impl UserAgentStateMachineContext for DummyContext {}
+
+#[derive(Debug, thiserror::Error)]
+pub enum InboundError {
+    #[error("Invalid user agent response")]
+    InvalidResponse,
+    #[error("Expected response payload")]
+    MissingResponsePayload,
+    #[error("Unexpected response payload")]
+    UnexpectedResponsePayload,
+    #[error("Invalid state for auth challenge")]
+    InvalidStateForAuthChallenge,
+    #[error("Invalid state for auth ok")]
+    InvalidStateForAuthOk,
+    #[error("State machine error")]
+    StateTransitionFailed,
+    #[error("Transport send failed")]
+    TransportSendFailed,
+}
+
+pub struct UserAgentActor<Transport>
+where
+    Transport: Bi<UserAgentResponse, UserAgentRequest>,
+{
+    key: SigningKeyEnum,
+    bootstrap_token: Option<String>,
+    state: UserAgentStateMachine<DummyContext>,
+    transport: Transport,
+}
+
+impl<Transport> UserAgentActor<Transport>
+where
+    Transport: Bi<UserAgentResponse, UserAgentRequest>,
+{
+    pub fn new(key: SigningKeyEnum, bootstrap_token: Option<String>, transport: Transport) -> Self {
+        Self {
+            key,
+            bootstrap_token,
+            state: UserAgentStateMachine::new(DummyContext),
+            transport,
+        }
+    }
+
+    fn transition(&mut self, event: UserAgentEvents) -> Result<(), InboundError> {
+        self.state.process_event(event).map_err(|e| {
+            error!(?e, "useragent state transition failed");
+            InboundError::StateTransitionFailed
+        })?;
+        Ok(())
+    }
+
+    async fn send_auth_challenge_request(&mut self) -> Result<(), InboundError> {
+        let req = AuthChallengeRequest {
+            pubkey: self.key.pubkey_bytes(),
+            bootstrap_token: self.bootstrap_token.take(),
+            key_type: self.key.proto_key_type().into(),
+        };
+
+        self.transition(UserAgentEvents::SentAuthChallengeRequest)?;
+
+        self.transport
+            .send(UserAgentRequest {
+                payload: Some(UserAgentRequestPayload::AuthChallengeRequest(req)),
+            })
+            .await
+            .map_err(|_| InboundError::TransportSendFailed)?;
+
+        info!(actor = "useragent", "auth.request.sent");
+        Ok(())
+    }
+
+    async fn handle_auth_challenge(
+        &mut self,
+        challenge: arbiter_proto::proto::user_agent::AuthChallenge,
+    ) -> Result<(), InboundError> {
+        self.transition(UserAgentEvents::ReceivedAuthChallenge)?;
+
+        let formatted = format_challenge(challenge.nonce, &challenge.pubkey);
+        let signature_bytes = self.key.sign(&formatted);
+        let solution = AuthChallengeSolution {
+            signature: signature_bytes,
+        };
+
+        self.transport
+            .send(UserAgentRequest {
+                payload: Some(UserAgentRequestPayload::AuthChallengeSolution(solution)),
+            })
+            .await
+            .map_err(|_| InboundError::TransportSendFailed)?;
+
+        info!(actor = "useragent", "auth.solution.sent");
+        Ok(())
+    }
+
+    fn handle_auth_ok(&mut self, _ok: AuthOk) -> Result<(), InboundError> {
+        self.transition(UserAgentEvents::ReceivedAuthOk)?;
+        info!(actor = "useragent", "auth.ok");
+        Ok(())
+    }
+
+    pub async fn process_inbound_transport(
+        &mut self,
+        inbound: UserAgentResponse,
+    ) -> Result<(), InboundError> {
+        let payload = inbound
+            .payload
+            .ok_or(InboundError::MissingResponsePayload)?;
+
+        match payload {
+            UserAgentResponsePayload::AuthChallenge(challenge) => {
+                self.handle_auth_challenge(challenge).await
+            }
+            UserAgentResponsePayload::AuthOk(ok) => self.handle_auth_ok(ok),
+            _ => Err(InboundError::UnexpectedResponsePayload),
+        }
+    }
+}
+
+impl<Transport> Actor for UserAgentActor<Transport>
+where
+    Transport: Bi<UserAgentResponse, UserAgentRequest>,
+{
+    type Args = Self;
+
+    type Error = ();
+
+    async fn on_start(
+        mut args: Self::Args,
+        _actor_ref: ActorRef<Self>,
+    ) -> Result<Self, Self::Error> {
+        if let Err(err) = args.send_auth_challenge_request().await {
+            error!(?err, actor = "useragent", "auth.start.failed");
+            return Err(());
+        }
+        Ok(args)
+    }
+
+    async fn next(
+        &mut self,
+        _actor_ref: kameo::prelude::WeakActorRef<Self>,
+        mailbox_rx: &mut kameo::prelude::MailboxReceiver<Self>,
+    ) -> Option<kameo::mailbox::Signal<Self>> {
+        loop {
+            select! {
+                signal = mailbox_rx.recv() => {
+                    return signal;
+                }
+                inbound = self.transport.recv() => {
+                    match inbound {
+                        Some(inbound) => {
+                            if let Err(err) = self.process_inbound_transport(inbound).await {
+                                error!(?err, actor = "useragent", "transport.inbound.failed");
+                                return Some(kameo::mailbox::Signal::Stop);
+                            }
+                        }
+                        None => {
+                            info!(actor = "useragent", "transport.closed");
+                            return Some(kameo::mailbox::Signal::Stop);
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
+
+mod grpc;
+pub use grpc::{ConnectError, connect_grpc};

server/crates/arbiter-useragent/tests/auth.rs

@@ -0,0 +1,146 @@
+use arbiter_proto::{
+    format_challenge,
+    proto::user_agent::{
+        AuthChallenge, AuthOk, UserAgentRequest, UserAgentResponse,
+        user_agent_request::Payload as UserAgentRequestPayload,
+        user_agent_response::Payload as UserAgentResponsePayload,
+    },
+    transport::Bi,
+};
+use arbiter_useragent::{SigningKeyEnum, UserAgentActor};
+use async_trait::async_trait;
+use ed25519_dalek::SigningKey;
+use kameo::actor::Spawn;
+use tokio::sync::mpsc;
+use tokio::time::{Duration, timeout};
+
+struct TestTransport {
+    inbound_rx: mpsc::Receiver<UserAgentResponse>,
+    outbound_tx: mpsc::Sender<UserAgentRequest>,
+}
+
+#[async_trait]
+impl Bi<UserAgentResponse, UserAgentRequest> for TestTransport {
+    async fn send(
+        &mut self,
+        item: UserAgentRequest,
+    ) -> Result<(), arbiter_proto::transport::Error> {
+        self.outbound_tx
+            .send(item)
+            .await
+            .map_err(|_| arbiter_proto::transport::Error::ChannelClosed)
+    }
+
+    async fn recv(&mut self) -> Option<UserAgentResponse> {
+        self.inbound_rx.recv().await
+    }
+}
+
+fn make_transport() -> (
+    TestTransport,
+    mpsc::Sender<UserAgentResponse>,
+    mpsc::Receiver<UserAgentRequest>,
+) {
+    let (inbound_tx, inbound_rx) = mpsc::channel(8);
+    let (outbound_tx, outbound_rx) = mpsc::channel(8);
+    (
+        TestTransport {
+            inbound_rx,
+            outbound_tx,
+        },
+        inbound_tx,
+        outbound_rx,
+    )
+}
+
+fn test_key() -> SigningKeyEnum {
+    SigningKeyEnum::Ed25519(SigningKey::from_bytes(&[7u8; 32]))
+}
+
+#[tokio::test]
+async fn sends_auth_request_on_start_with_bootstrap_token() {
+    let key = test_key();
+    let pubkey = key.pubkey_bytes();
+    let bootstrap_token = Some("bootstrap-123".to_string());
+    let (transport, inbound_tx, mut outbound_rx) = make_transport();
+
+    let actor = UserAgentActor::spawn(UserAgentActor::new(key, bootstrap_token.clone(), transport));
+
+    let outbound = timeout(Duration::from_secs(1), outbound_rx.recv())
+        .await
+        .expect("timed out waiting for auth request")
+        .expect("channel closed before auth request");
+
+    let UserAgentRequest {
+        payload: Some(UserAgentRequestPayload::AuthChallengeRequest(req)),
+    } = outbound
+    else {
+        panic!("expected auth challenge request");
+    };
+
+    assert_eq!(req.pubkey, pubkey);
+    assert_eq!(req.bootstrap_token, bootstrap_token);
+
+    drop(inbound_tx);
+    drop(actor);
+}
+
+#[tokio::test]
+async fn challenge_flow_sends_solution_from_transport_inbound() {
+    let key = test_key();
+    let pubkey_bytes = key.pubkey_bytes();
+    let (transport, inbound_tx, mut outbound_rx) = make_transport();
+
+    let actor = UserAgentActor::spawn(UserAgentActor::new(key, None, transport));
+
+    let _initial_auth_request = timeout(Duration::from_secs(1), outbound_rx.recv())
+        .await
+        .expect("timed out waiting for initial auth request")
+        .expect("missing initial auth request");
+
+    let challenge = AuthChallenge {
+        pubkey: pubkey_bytes.clone(),
+        nonce: 42,
+    };
+    inbound_tx
+        .send(UserAgentResponse {
+            payload: Some(UserAgentResponsePayload::AuthChallenge(challenge.clone())),
+        })
+        .await
+        .unwrap();
+
+    let outbound = timeout(Duration::from_secs(1), outbound_rx.recv())
+        .await
+        .expect("timed out waiting for challenge solution")
+        .expect("missing challenge solution");
+
+    let UserAgentRequest {
+        payload: Some(UserAgentRequestPayload::AuthChallengeSolution(solution)),
+    } = outbound
+    else {
+        panic!("expected auth challenge solution");
+    };
+
+    // Verify the signature using the Ed25519 verifying key
+    let formatted = format_challenge(challenge.nonce, &challenge.pubkey);
+    let raw_key = SigningKey::from_bytes(&[7u8; 32]);
+    let sig: ed25519_dalek::Signature = solution
+        .signature
+        .as_slice()
+        .try_into()
+        .expect("signature bytes length");
+    raw_key
+        .verifying_key()
+        .verify_strict(&formatted, &sig)
+        .expect("solution signature should verify");
+
+    inbound_tx
+        .send(UserAgentResponse {
+            payload: Some(UserAgentResponsePayload::AuthOk(AuthOk {})),
+        })
+        .await
+        .unwrap();
+
+    drop(inbound_tx);
+    drop(actor);
+}

server/rules/safecell/new-inline.yaml

@@ -1,10 +0,0 @@
-id: safecell-new-inline
-language: Rust
-rule:
-  pattern: $CELL.write_inline(|$W| $BODY);
-  follows:
-    pattern: let mut $CELL = SafeCell::new($INIT);
-fix: 
-  template: let mut $CELL = SafeCell::new_inline(|$W| $BODY);
-  expandStart:
-    pattern: let mut $CELL = SafeCell::new($INIT)

server/rules/safecell/read-inline.yaml

@@ -1,17 +0,0 @@
-id: safecell-read-inline
-language: Rust
-rule:
-  pattern: 
-    context: |
-      {
-          let $READ = $CELL.read();
-          $$$BODY
-      }
-    selector: block
-  inside:
-    kind: block
-fix: 
-  template: | 
-    $CELL.read_inline(|$READ| { 
-      $$$BODY 
-    });

server/rules/safecell/write-inline.yaml

@@ -1,13 +0,0 @@
-id: safecell-write-inline
-language: Rust
-rule:
-  pattern: |
-    {
-        let mut $WRITE = $CELL.write();
-        $$$BODY
-    }
-fix: 
-  template: | 
-    $CELL.write_inline(|$WRITE| { 
-      $$$BODY 
-    });

server/sgconfig.yml

@@ -1,2 +0,0 @@
-ruleDirs:
-- ./rules

useragent/.dart_tool/extension_discovery/README.md

@@ -0,0 +1,31 @@
+Extension Discovery Cache
+=========================
+
+This folder is used by `package:extension_discovery` to cache lists of
+packages that contains extensions for other packages.
+
+DO NOT USE THIS FOLDER
+----------------------
+
+ * Do not read (or rely) the contents of this folder.
+ * Do write to this folder.
+
+If you're interested in the lists of extensions stored in this folder use the
+API offered by package `extension_discovery` to get this information.
+
+If this package doesn't work for your use-case, then don't try to read the
+contents of this folder. It may change, and will not remain stable.
+
+Use package `extension_discovery`
+---------------------------------
+
+If you want to access information from this folder.
+
+Feel free to delete this folder
+-------------------------------
+
+Files in this folder act as a cache, and the cache is discarded if the files
+are older than the modification time of `.dart_tool/package_config.json`.
+
+Hence, it should never be necessary to clear this cache manually, if you find a
+need to do please file a bug.

useragent/.dart_tool/extension_discovery/vs_code.json

@@ -0,0 +1 @@
+{"version":2,"entries":[{"package":"arbiter","rootUri":"../","packageUri":"lib/"}]}

useragent/.dart_tool/package_config.json

@@ -0,0 +1,172 @@
+{
+  "configVersion": 2,
+  "packages": [
+    {
+      "name": "async",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/async-2.13.0",
+      "packageUri": "lib/",
+      "languageVersion": "3.4"
+    },
+    {
+      "name": "boolean_selector",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/boolean_selector-2.1.2",
+      "packageUri": "lib/",
+      "languageVersion": "3.1"
+    },
+    {
+      "name": "characters",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/characters-1.4.0",
+      "packageUri": "lib/",
+      "languageVersion": "3.4"
+    },
+    {
+      "name": "clock",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/clock-1.1.2",
+      "packageUri": "lib/",
+      "languageVersion": "3.4"
+    },
+    {
+      "name": "collection",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/collection-1.19.1",
+      "packageUri": "lib/",
+      "languageVersion": "3.4"
+    },
+    {
+      "name": "fake_async",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/fake_async-1.3.3",
+      "packageUri": "lib/",
+      "languageVersion": "3.3"
+    },
+    {
+      "name": "flutter",
+      "rootUri": "file:///Users/kaska/.local/share/mise/installs/flutter/3.38.9-stable/packages/flutter",
+      "packageUri": "lib/",
+      "languageVersion": "3.8"
+    },
+    {
+      "name": "flutter_lints",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/flutter_lints-6.0.0",
+      "packageUri": "lib/",
+      "languageVersion": "3.8"
+    },
+    {
+      "name": "flutter_test",
+      "rootUri": "file:///Users/kaska/.local/share/mise/installs/flutter/3.38.9-stable/packages/flutter_test",
+      "packageUri": "lib/",
+      "languageVersion": "3.8"
+    },
+    {
+      "name": "leak_tracker",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/leak_tracker-11.0.2",
+      "packageUri": "lib/",
+      "languageVersion": "3.2"
+    },
+    {
+      "name": "leak_tracker_flutter_testing",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/leak_tracker_flutter_testing-3.0.10",
+      "packageUri": "lib/",
+      "languageVersion": "3.2"
+    },
+    {
+      "name": "leak_tracker_testing",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/leak_tracker_testing-3.0.2",
+      "packageUri": "lib/",
+      "languageVersion": "3.2"
+    },
+    {
+      "name": "lints",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/lints-6.1.0",
+      "packageUri": "lib/",
+      "languageVersion": "3.8"
+    },
+    {
+      "name": "matcher",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/matcher-0.12.17",
+      "packageUri": "lib/",
+      "languageVersion": "3.4"
+    },
+    {
+      "name": "material_color_utilities",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/material_color_utilities-0.11.1",
+      "packageUri": "lib/",
+      "languageVersion": "2.17"
+    },
+    {
+      "name": "meta",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/meta-1.17.0",
+      "packageUri": "lib/",
+      "languageVersion": "3.5"
+    },
+    {
+      "name": "path",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/path-1.9.1",
+      "packageUri": "lib/",
+      "languageVersion": "3.4"
+    },
+    {
+      "name": "sky_engine",
+      "rootUri": "file:///Users/kaska/.local/share/mise/installs/flutter/3.38.9-stable/bin/cache/pkg/sky_engine",
+      "packageUri": "lib/",
+      "languageVersion": "3.8"
+    },
+    {
+      "name": "source_span",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/source_span-1.10.2",
+      "packageUri": "lib/",
+      "languageVersion": "3.1"
+    },
+    {
+      "name": "stack_trace",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/stack_trace-1.12.1",
+      "packageUri": "lib/",
+      "languageVersion": "3.4"
+    },
+    {
+      "name": "stream_channel",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/stream_channel-2.1.4",
+      "packageUri": "lib/",
+      "languageVersion": "3.3"
+    },
+    {
+      "name": "string_scanner",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/string_scanner-1.4.1",
+      "packageUri": "lib/",
+      "languageVersion": "3.1"
+    },
+    {
+      "name": "term_glyph",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/term_glyph-1.2.2",
+      "packageUri": "lib/",
+      "languageVersion": "3.1"
+    },
+    {
+      "name": "test_api",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/test_api-0.7.7",
+      "packageUri": "lib/",
+      "languageVersion": "3.5"
+    },
+    {
+      "name": "vector_math",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/vector_math-2.2.0",
+      "packageUri": "lib/",
+      "languageVersion": "3.1"
+    },
+    {
+      "name": "vm_service",
+      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/vm_service-15.0.2",
+      "packageUri": "lib/",
+      "languageVersion": "3.5"
+    },
+    {
+      "name": "arbiter",
+      "rootUri": "../",
+      "packageUri": "lib/",
+      "languageVersion": "3.10"
+    }
+  ],
+  "generator": "pub",
+  "generatorVersion": "3.10.8",
+  "flutterRoot": "file:///Users/kaska/.local/share/mise/installs/flutter/3.38.9-stable",
+  "flutterVersion": "3.38.9",
+  "pubCache": "file:///Users/kaska/.pub-cache"
+}

useragent/.dart_tool/package_graph.json

@@ -0,0 +1,224 @@
+{
+  "roots": [
+    "arbiter"
+  ],
+  "packages": [
+    {
+      "name": "arbiter",
+      "version": "0.1.0",
+      "dependencies": [
+        "flutter"
+      ],
+      "devDependencies": [
+        "flutter_lints",
+        "flutter_test"
+      ]
+    },
+    {
+      "name": "flutter_lints",
+      "version": "6.0.0",
+      "dependencies": [
+        "lints"
+      ]
+    },
+    {
+      "name": "flutter_test",
+      "version": "0.0.0",
+      "dependencies": [
+        "clock",
+        "collection",
+        "fake_async",
+        "flutter",
+        "leak_tracker_flutter_testing",
+        "matcher",
+        "meta",
+        "path",
+        "stack_trace",
+        "stream_channel",
+        "test_api",
+        "vector_math"
+      ]
+    },
+    {
+      "name": "flutter",
+      "version": "0.0.0",
+      "dependencies": [
+        "characters",
+        "collection",
+        "material_color_utilities",
+        "meta",
+        "sky_engine",
+        "vector_math"
+      ]
+    },
+    {
+      "name": "lints",
+      "version": "6.1.0",
+      "dependencies": []
+    },
+    {
+      "name": "stream_channel",
+      "version": "2.1.4",
+      "dependencies": [
+        "async"
+      ]
+    },
+    {
+      "name": "meta",
+      "version": "1.17.0",
+      "dependencies": []
+    },
+    {
+      "name": "collection",
+      "version": "1.19.1",
+      "dependencies": []
+    },
+    {
+      "name": "leak_tracker_flutter_testing",
+      "version": "3.0.10",
+      "dependencies": [
+        "flutter",
+        "leak_tracker",
+        "leak_tracker_testing",
+        "matcher",
+        "meta"
+      ]
+    },
+    {
+      "name": "vector_math",
+      "version": "2.2.0",
+      "dependencies": []
+    },
+    {
+      "name": "stack_trace",
+      "version": "1.12.1",
+      "dependencies": [
+        "path"
+      ]
+    },
+    {
+      "name": "clock",
+      "version": "1.1.2",
+      "dependencies": []
+    },
+    {
+      "name": "fake_async",
+      "version": "1.3.3",
+      "dependencies": [
+        "clock",
+        "collection"
+      ]
+    },
+    {
+      "name": "path",
+      "version": "1.9.1",
+      "dependencies": []
+    },
+    {
+      "name": "matcher",
+      "version": "0.12.17",
+      "dependencies": [
+        "async",
+        "meta",
+        "stack_trace",
+        "term_glyph",
+        "test_api"
+      ]
+    },
+    {
+      "name": "test_api",
+      "version": "0.7.7",
+      "dependencies": [
+        "async",
+        "boolean_selector",
+        "collection",
+        "meta",
+        "source_span",
+        "stack_trace",
+        "stream_channel",
+        "string_scanner",
+        "term_glyph"
+      ]
+    },
+    {
+      "name": "sky_engine",
+      "version": "0.0.0",
+      "dependencies": []
+    },
+    {
+      "name": "material_color_utilities",
+      "version": "0.11.1",
+      "dependencies": [
+        "collection"
+      ]
+    },
+    {
+      "name": "characters",
+      "version": "1.4.0",
+      "dependencies": []
+    },
+    {
+      "name": "async",
+      "version": "2.13.0",
+      "dependencies": [
+        "collection",
+        "meta"
+      ]
+    },
+    {
+      "name": "leak_tracker_testing",
+      "version": "3.0.2",
+      "dependencies": [
+        "leak_tracker",
+        "matcher",
+        "meta"
+      ]
+    },
+    {
+      "name": "leak_tracker",
+      "version": "11.0.2",
+      "dependencies": [
+        "clock",
+        "collection",
+        "meta",
+        "path",
+        "vm_service"
+      ]
+    },
+    {
+      "name": "term_glyph",
+      "version": "1.2.2",
+      "dependencies": []
+    },
+    {
+      "name": "string_scanner",
+      "version": "1.4.1",
+      "dependencies": [
+        "source_span"
+      ]
+    },
+    {
+      "name": "source_span",
+      "version": "1.10.2",
+      "dependencies": [
+        "collection",
+        "path",
+        "term_glyph"
+      ]
+    },
+    {
+      "name": "boolean_selector",
+      "version": "2.1.2",
+      "dependencies": [
+        "source_span",
+        "string_scanner"
+      ]
+    },
+    {
+      "name": "vm_service",
+      "version": "15.0.2",
+      "dependencies": []
+    }
+  ],
+  "configVersion": 1
+}

useragent/.dart_tool/version

@@ -0,0 +1 @@
+3.38.9

useragent/README.md

@@ -1,4 +1,4 @@
-# useragent
+# app
 
 A new Flutter project.
 

useragent/android/.gitignore

@@ -1,14 +0,0 @@
-gradle-wrapper.jar
-/.gradle
-/captures/
-/gradlew
-/gradlew.bat
-/local.properties
-GeneratedPluginRegistrant.java
-.cxx/
-
-# Remember to never publicly share your keystore.
-# See https://flutter.dev/to/reference-keystore
-key.properties
-**/*.keystore
-**/*.jks

useragent/android/app/build.gradle.kts

@@ -1,44 +0,0 @@
-plugins {
-    id("com.android.application")
-    id("kotlin-android")
-    // The Flutter Gradle Plugin must be applied after the Android and Kotlin Gradle plugins.
-    id("dev.flutter.flutter-gradle-plugin")
-}
-
-android {
-    namespace = "com.example.useragent"
-    compileSdk = flutter.compileSdkVersion
-    ndkVersion = flutter.ndkVersion
-
-    compileOptions {
-        sourceCompatibility = JavaVersion.VERSION_17
-        targetCompatibility = JavaVersion.VERSION_17
-    }
-
-    kotlinOptions {
-        jvmTarget = JavaVersion.VERSION_17.toString()
-    }
-
-    defaultConfig {
-        // TODO: Specify your own unique Application ID (https://developer.android.com/studio/build/application-id.html).
-        applicationId = "com.example.useragent"
-        // You can update the following values to match your application needs.
-        // For more information, see: https://flutter.dev/to/review-gradle-config.
-        minSdk = flutter.minSdkVersion
-        targetSdk = flutter.targetSdkVersion
-        versionCode = flutter.versionCode
-        versionName = flutter.versionName
-    }
-
-    buildTypes {
-        release {
-            // TODO: Add your own signing config for the release build.
-            // Signing with the debug keys for now, so `flutter run --release` works.
-            signingConfig = signingConfigs.getByName("debug")
-        }
-    }
-}
-
-flutter {
-    source = "../.."
-}

useragent/android/app/src/debug/AndroidManifest.xml

@@ -1,7 +0,0 @@
-<manifest xmlns:android="http://schemas.android.com/apk/res/android">
-    <!-- The INTERNET permission is required for development. Specifically,
-         the Flutter tool needs it to communicate with the running application
-         to allow setting breakpoints, to provide hot reload, etc.
-    -->
-    <uses-permission android:name="android.permission.INTERNET"/>
-</manifest>

useragent/android/app/src/main/AndroidManifest.xml

@@ -1,45 +0,0 @@
-<manifest xmlns:android="http://schemas.android.com/apk/res/android">
-    <application
-        android:label="useragent"
-        android:name="${applicationName}"
-        android:icon="@mipmap/ic_launcher">
-        <activity
-            android:name=".MainActivity"
-            android:exported="true"
-            android:launchMode="singleTop"
-            android:taskAffinity=""
-            android:theme="@style/LaunchTheme"
-            android:configChanges="orientation|keyboardHidden|keyboard|screenSize|smallestScreenSize|locale|layoutDirection|fontScale|screenLayout|density|uiMode"
-            android:hardwareAccelerated="true"
-            android:windowSoftInputMode="adjustResize">
-            <!-- Specifies an Android theme to apply to this Activity as soon as
-                 the Android process has started. This theme is visible to the user
-                 while the Flutter UI initializes. After that, this theme continues
-                 to determine the Window background behind the Flutter UI. -->
-            <meta-data
-              android:name="io.flutter.embedding.android.NormalTheme"
-              android:resource="@style/NormalTheme"
-              />
-            <intent-filter>
-                <action android:name="android.intent.action.MAIN"/>
-                <category android:name="android.intent.category.LAUNCHER"/>
-            </intent-filter>
-        </activity>
-        <!-- Don't delete the meta-data below.
-             This is used by the Flutter tool to generate GeneratedPluginRegistrant.java -->
-        <meta-data
-            android:name="flutterEmbedding"
-            android:value="2" />
-    </application>
-    <!-- Required to query activities that can process text, see:
-         https://developer.android.com/training/package-visibility and
-         https://developer.android.com/reference/android/content/Intent#ACTION_PROCESS_TEXT.
-
-         In particular, this is used by the Flutter engine in io.flutter.plugin.text.ProcessTextPlugin. -->
-    <queries>
-        <intent>
-            <action android:name="android.intent.action.PROCESS_TEXT"/>
-            <data android:mimeType="text/plain"/>
-        </intent>
-    </queries>
-</manifest>

useragent/android/app/src/main/kotlin/com/example/useragent/MainActivity.kt

@@ -1,5 +0,0 @@
-package com.example.useragent
-
-import io.flutter.embedding.android.FlutterActivity
-
-class MainActivity : FlutterActivity()

useragent/android/app/src/main/res/drawable-v21/launch_background.xml

@@ -1,12 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!-- Modify this file to customize your launch splash screen -->
-<layer-list xmlns:android="http://schemas.android.com/apk/res/android">
-    <item android:drawable="?android:colorBackground" />
-
-    <!-- You can insert your own image assets here -->
-    <!-- <item>
-        <bitmap
-            android:gravity="center"
-            android:src="@mipmap/launch_image" />
-    </item> -->
-</layer-list>

useragent/android/app/src/main/res/drawable/launch_background.xml

@@ -1,12 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!-- Modify this file to customize your launch splash screen -->
-<layer-list xmlns:android="http://schemas.android.com/apk/res/android">
-    <item android:drawable="@android:color/white" />
-
-    <!-- You can insert your own image assets here -->
-    <!-- <item>
-        <bitmap
-            android:gravity="center"
-            android:src="@mipmap/launch_image" />
-    </item> -->
-</layer-list>

useragent/android/app/src/main/res/values-night/styles.xml

@@ -1,18 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<resources>
-    <!-- Theme applied to the Android Window while the process is starting when the OS's Dark Mode setting is on -->
-    <style name="LaunchTheme" parent="@android:style/Theme.Black.NoTitleBar">
-        <!-- Show a splash screen on the activity. Automatically removed when
-             the Flutter engine draws its first frame -->
-        <item name="android:windowBackground">@drawable/launch_background</item>
-    </style>
-    <!-- Theme applied to the Android Window as soon as the process has started.
-         This theme determines the color of the Android Window while your
-         Flutter UI initializes, as well as behind your Flutter UI while its
-         running.
-
-         This Theme is only used starting with V2 of Flutter's Android embedding. -->
-    <style name="NormalTheme" parent="@android:style/Theme.Black.NoTitleBar">
-        <item name="android:windowBackground">?android:colorBackground</item>
-    </style>
-</resources>

useragent/android/app/src/main/res/values/styles.xml

@@ -1,18 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<resources>
-    <!-- Theme applied to the Android Window while the process is starting when the OS's Dark Mode setting is off -->
-    <style name="LaunchTheme" parent="@android:style/Theme.Light.NoTitleBar">
-        <!-- Show a splash screen on the activity. Automatically removed when
-             the Flutter engine draws its first frame -->
-        <item name="android:windowBackground">@drawable/launch_background</item>
-    </style>
-    <!-- Theme applied to the Android Window as soon as the process has started.
-         This theme determines the color of the Android Window while your
-         Flutter UI initializes, as well as behind your Flutter UI while its
-         running.
-
-         This Theme is only used starting with V2 of Flutter's Android embedding. -->
-    <style name="NormalTheme" parent="@android:style/Theme.Light.NoTitleBar">
-        <item name="android:windowBackground">?android:colorBackground</item>
-    </style>
-</resources>

useragent/android/app/src/profile/AndroidManifest.xml

@@ -1,7 +0,0 @@
-<manifest xmlns:android="http://schemas.android.com/apk/res/android">
-    <!-- The INTERNET permission is required for development. Specifically,
-         the Flutter tool needs it to communicate with the running application
-         to allow setting breakpoints, to provide hot reload, etc.
-    -->
-    <uses-permission android:name="android.permission.INTERNET"/>
-</manifest>

useragent/android/build.gradle.kts

@@ -1,24 +0,0 @@
-allprojects {
-    repositories {
-        google()
-        mavenCentral()
-    }
-}
-
-val newBuildDir: Directory =
-    rootProject.layout.buildDirectory
-        .dir("../../build")
-        .get()
-rootProject.layout.buildDirectory.value(newBuildDir)
-
-subprojects {
-    val newSubprojectBuildDir: Directory = newBuildDir.dir(project.name)
-    project.layout.buildDirectory.value(newSubprojectBuildDir)
-}
-subprojects {
-    project.evaluationDependsOn(":app")
-}
-
-tasks.register<Delete>("clean") {
-    delete(rootProject.layout.buildDirectory)
-}

useragent/android/gradle.properties

@@ -1,2 +0,0 @@
-org.gradle.jvmargs=-Xmx8G -XX:MaxMetaspaceSize=4G -XX:ReservedCodeCacheSize=512m -XX:+HeapDumpOnOutOfMemoryError
-android.useAndroidX=true

useragent/android/gradle/wrapper/gradle-wrapper.properties

@@ -1,5 +0,0 @@
-distributionBase=GRADLE_USER_HOME
-distributionPath=wrapper/dists
-zipStoreBase=GRADLE_USER_HOME
-zipStorePath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.14-all.zip

useragent/android/settings.gradle.kts

@@ -1,26 +0,0 @@
-pluginManagement {
-    val flutterSdkPath =
-        run {
-            val properties = java.util.Properties()
-            file("local.properties").inputStream().use { properties.load(it) }
-            val flutterSdkPath = properties.getProperty("flutter.sdk")
-            require(flutterSdkPath != null) { "flutter.sdk not set in local.properties" }
-            flutterSdkPath
-        }
-
-    includeBuild("$flutterSdkPath/packages/flutter_tools/gradle")
-
-    repositories {
-        google()
-        mavenCentral()
-        gradlePluginPortal()
-    }
-}
-
-plugins {
-    id("dev.flutter.flutter-plugin-loader") version "1.0.0"
-    id("com.android.application") version "8.11.1" apply false
-    id("org.jetbrains.kotlin.android") version "2.2.20" apply false
-}
-
-include(":app")

useragent/lib/features/connection/arbiter_url.dart

@@ -1,56 +0,0 @@
-import 'dart:convert';
-
-class ArbiterUrl {
-  const ArbiterUrl({
-    required this.host,
-    required this.port,
-    required this.caCert,
-    this.bootstrapToken,
-  });
-
-  final String host;
-  final int port;
-  final List<int> caCert;
-  final String? bootstrapToken;
-
-  static const _scheme = 'arbiter';
-  static const _certQueryKey = 'cert';
-  static const _bootstrapTokenQueryKey = 'bootstrap_token';
-
-  static ArbiterUrl parse(String value) {
-    final uri = Uri.tryParse(value);
-    if (uri == null || uri.scheme != _scheme) {
-      throw const FormatException("Invalid URL scheme, expected 'arbiter://'");
-    }
-
-    if (uri.host.isEmpty) {
-      throw const FormatException('Missing host in URL');
-    }
-
-    if (!uri.hasPort) {
-      throw const FormatException('Missing port in URL');
-    }
-
-    final cert = uri.queryParameters[_certQueryKey];
-    if (cert == null || cert.isEmpty) {
-      throw const FormatException("Missing 'cert' query parameter in URL");
-    }
-
-    final decodedCert = _decodeCert(cert);
-
-    return ArbiterUrl(
-      host: uri.host,
-      port: uri.port,
-      caCert: decodedCert,
-      bootstrapToken: uri.queryParameters[_bootstrapTokenQueryKey],
-    );
-  }
-
-  static List<int> _decodeCert(String cert) {
-    try {
-      return base64Url.decode(base64Url.normalize(cert));
-    } on FormatException catch (error) {
-      throw FormatException("Invalid base64 in 'cert' query parameter: ${error.message}");
-    }
-  }
-}

useragent/lib/features/connection/auth.dart

@@ -1,103 +0,0 @@
-import 'dart:async';
-import 'dart:convert';
-
-import 'package:arbiter/features/connection/connection.dart';
-import 'package:arbiter/features/connection/server_info_storage.dart';
-import 'package:arbiter/features/identity/pk_manager.dart';
-import 'package:arbiter/proto/arbiter.pbgrpc.dart';
-import 'package:arbiter/proto/user_agent.pb.dart';
-import 'package:grpc/grpc.dart';
-import 'package:mtcore/markettakers.dart';
-
-Future<Connection> connectAndAuthorize(
-  StoredServerInfo serverInfo,
-  KeyHandle key, {
-  String? bootstrapToken,
-}) async {
-  try {
-    final connection = await _connect(serverInfo);
-    talker.info(
-      'Connected to server at ${serverInfo.address}:${serverInfo.port}',
-    );
-    final pubkey = await key.getPublicKey();
-
-    final req = AuthChallengeRequest(
-      pubkey: pubkey,
-      bootstrapToken: bootstrapToken,
-      keyType: switch (key.alg) {
-        KeyAlgorithm.rsa => KeyType.KEY_TYPE_RSA,
-        KeyAlgorithm.ecdsa => KeyType.KEY_TYPE_ECDSA_SECP256K1,
-        KeyAlgorithm.ed25519 => KeyType.KEY_TYPE_ED25519,
-      },
-    );
-    await connection.send(UserAgentRequest(authChallengeRequest: req));
-    talker.info(
-      "Sent auth challenge request with pubkey ${base64Encode(pubkey)}",
-    );
-
-    final response = await connection.receive();
-    talker.info('Received response from server, checking auth flow...');
-
-    if (response.hasAuthOk()) {
-      talker.info('Authentication successful, connection established');
-      return connection;
-    }
-
-    if (!response.hasAuthChallenge()) {
-      throw Exception(
-        'Expected AuthChallengeResponse, got ${response.whichPayload()}',
-      );
-    }
-
-    final challenge = _formatChallenge(response.authChallenge, pubkey);
-    talker.info(
-      'Received auth challenge, signing with key ${base64Encode(pubkey)}',
-    );
-
-    final signature = await key.sign(challenge);
-    await connection.send(
-      UserAgentRequest(authChallengeSolution: AuthChallengeSolution(signature: signature)),
-    );
-
-    talker.info('Sent auth challenge solution, waiting for server response...');
-
-    final solutionResponse = await connection.receive();
-    if (!solutionResponse.hasAuthOk()) {
-      throw Exception(
-        'Expected AuthChallengeSolutionResponse, got ${solutionResponse.whichPayload()}',
-      );
-    }
-
-    talker.info('Authentication successful, connection established');
-    return connection;
-  } catch (e) {
-    throw Exception('Failed to connect to server: $e');
-  }
-}
-
-Future<Connection> _connect(StoredServerInfo serverInfo) async {
-  final channel = ClientChannel(
-    serverInfo.address,
-    port: serverInfo.port,
-    options: ChannelOptions(
-      connectTimeout: const Duration(seconds: 10),
-      credentials: ChannelCredentials.secure(
-        onBadCertificate: (cert, host) {
-          return true;
-        },
-      ),
-    ),
-  );
-
-  final client = ArbiterServiceClient(channel);
-  final tx = StreamController<UserAgentRequest>();
-  final rx = client.userAgent(tx.stream);
-
-  return Connection(channel: channel, tx: tx, rx: rx);
-}
-
-List<int> _formatChallenge(AuthChallenge challenge, List<int> pubkey) {
-  final encodedPubkey = base64Encode(pubkey);
-  final payload = "${challenge.nonce}:$encodedPubkey";
-  return utf8.encode(payload);
-}

useragent/lib/features/connection/connection.dart

@@ -1,37 +0,0 @@
-import 'dart:async';
-
-import 'package:arbiter/proto/user_agent.pb.dart';
-import 'package:grpc/grpc.dart';
-import 'package:mtcore/markettakers.dart';
-
-class Connection {
-  final ClientChannel channel;
-  final StreamController<UserAgentRequest> _tx;
-  final StreamIterator<UserAgentResponse> _rx;
-
-  Connection({
-    required this.channel,
-    required StreamController<UserAgentRequest> tx,
-    required ResponseStream<UserAgentResponse> rx,
-  }) : _tx = tx,
-       _rx = StreamIterator(rx);
-
-  Future<void> send(UserAgentRequest request) async {
-    talker.debug('Sending request: ${request.toDebugString()}');
-    _tx.add(request);
-  }
-
-  Future<UserAgentResponse> receive() async {
-    final hasValue = await _rx.moveNext();
-    if (!hasValue) {
-      throw Exception('Connection closed while waiting for server response.');
-    }
-    talker.debug('Received response: ${_rx.current.toDebugString()}');
-    return _rx.current;
-  }
-
-  Future<void> close() async {
-    await _tx.close();
-    await channel.shutdown();
-  }
-}

useragent/lib/features/connection/evm.dart

@@ -1,56 +0,0 @@
-import 'package:arbiter/features/connection/connection.dart';
-import 'package:arbiter/proto/evm.pb.dart';
-import 'package:arbiter/proto/user_agent.pb.dart';
-import 'package:protobuf/well_known_types/google/protobuf/empty.pb.dart';
-
-Future<List<WalletEntry>> listEvmWallets(Connection connection) async {
-  await connection.send(UserAgentRequest(evmWalletList: Empty()));
-
-  final response = await connection.receive();
-  if (!response.hasEvmWalletList()) {
-    throw Exception(
-      'Expected EVM wallet list response, got ${response.whichPayload()}',
-    );
-  }
-
-  final result = response.evmWalletList;
-  switch (result.whichResult()) {
-    case WalletListResponse_Result.wallets:
-      return result.wallets.wallets.toList(growable: false);
-    case WalletListResponse_Result.error:
-      throw Exception(_describeEvmError(result.error));
-    case WalletListResponse_Result.notSet:
-      throw Exception('EVM wallet list response was empty.');
-  }
-}
-
-Future<void> createEvmWallet(Connection connection) async {
-  await connection.send(UserAgentRequest(evmWalletCreate: Empty()));
-
-  final response = await connection.receive();
-  if (!response.hasEvmWalletCreate()) {
-    throw Exception(
-      'Expected EVM wallet create response, got ${response.whichPayload()}',
-    );
-  }
-
-  final result = response.evmWalletCreate;
-  switch (result.whichResult()) {
-    case WalletCreateResponse_Result.wallet:
-      return;
-    case WalletCreateResponse_Result.error:
-      throw Exception(_describeEvmError(result.error));
-    case WalletCreateResponse_Result.notSet:
-      throw Exception('Wallet creation returned no result.');
-  }
-}
-
-String _describeEvmError(EvmError error) {
-  return switch (error) {
-    EvmError.EVM_ERROR_VAULT_SEALED =>
-      'The vault is sealed. Unseal it before using EVM wallets.',
-    EvmError.EVM_ERROR_INTERNAL || EvmError.EVM_ERROR_UNSPECIFIED =>
-      'The server failed to process the EVM request.',
-    _ => 'The server failed to process the EVM request.',
-  };
-}

useragent/lib/features/connection/evm/grants.dart

@@ -1,122 +0,0 @@
-import 'package:arbiter/features/connection/connection.dart';
-import 'package:arbiter/proto/evm.pb.dart';
-import 'package:arbiter/proto/user_agent.pb.dart';
-import 'package:fixnum/fixnum.dart';
-import 'package:protobuf/well_known_types/google/protobuf/timestamp.pb.dart';
-
-Future<List<GrantEntry>> listEvmGrants(
-  Connection connection, {
-  int? walletId,
-}) async {
-  final request = EvmGrantListRequest();
-  if (walletId != null) {
-    request.walletId = walletId;
-  }
-
-  await connection.send(UserAgentRequest(evmGrantList: request));
-
-  final response = await connection.receive();
-  if (!response.hasEvmGrantList()) {
-    throw Exception(
-      'Expected EVM grant list response, got ${response.whichPayload()}',
-    );
-  }
-
-  final result = response.evmGrantList;
-  switch (result.whichResult()) {
-    case EvmGrantListResponse_Result.grants:
-      return result.grants.grants.toList(growable: false);
-    case EvmGrantListResponse_Result.error:
-      throw Exception(_describeGrantError(result.error));
-    case EvmGrantListResponse_Result.notSet:
-      throw Exception('EVM grant list response was empty.');
-  }
-}
-
-Future<int> createEvmGrant(
-  Connection connection, {
-  required int clientId,
-  required int walletId,
-  required Int64 chainId,
-  DateTime? validFrom,
-  DateTime? validUntil,
-  List<int>? maxGasFeePerGas,
-  List<int>? maxPriorityFeePerGas,
-  TransactionRateLimit? rateLimit,
-  required SpecificGrant specific,
-}) async {
-  await connection.send(
-    UserAgentRequest(
-      evmGrantCreate: EvmGrantCreateRequest(
-        clientId: clientId,
-        shared: SharedSettings(
-          walletId: walletId,
-          chainId: chainId,
-          validFrom: validFrom == null ? null : _toTimestamp(validFrom),
-          validUntil: validUntil == null ? null : _toTimestamp(validUntil),
-          maxGasFeePerGas: maxGasFeePerGas,
-          maxPriorityFeePerGas: maxPriorityFeePerGas,
-          rateLimit: rateLimit,
-        ),
-        specific: specific,
-      ),
-    ),
-  );
-
-  final response = await connection.receive();
-  if (!response.hasEvmGrantCreate()) {
-    throw Exception(
-      'Expected EVM grant create response, got ${response.whichPayload()}',
-    );
-  }
-
-  final result = response.evmGrantCreate;
-  switch (result.whichResult()) {
-    case EvmGrantCreateResponse_Result.grantId:
-      return result.grantId;
-    case EvmGrantCreateResponse_Result.error:
-      throw Exception(_describeGrantError(result.error));
-    case EvmGrantCreateResponse_Result.notSet:
-      throw Exception('Grant creation returned no result.');
-  }
-}
-
-Future<void> deleteEvmGrant(Connection connection, int grantId) async {
-  await connection.send(
-    UserAgentRequest(evmGrantDelete: EvmGrantDeleteRequest(grantId: grantId)),
-  );
-
-  final response = await connection.receive();
-  if (!response.hasEvmGrantDelete()) {
-    throw Exception(
-      'Expected EVM grant delete response, got ${response.whichPayload()}',
-    );
-  }
-
-  final result = response.evmGrantDelete;
-  switch (result.whichResult()) {
-    case EvmGrantDeleteResponse_Result.ok:
-      return;
-    case EvmGrantDeleteResponse_Result.error:
-      throw Exception(_describeGrantError(result.error));
-    case EvmGrantDeleteResponse_Result.notSet:
-      throw Exception('Grant revoke returned no result.');
-  }
-}
-
-Timestamp _toTimestamp(DateTime value) {
-  final utc = value.toUtc();
-  return Timestamp()
-    ..seconds = Int64(utc.millisecondsSinceEpoch ~/ 1000)
-    ..nanos = (utc.microsecondsSinceEpoch % 1000000) * 1000;
-}
-
-String _describeGrantError(EvmError error) {
-  return switch (error) {
-    EvmError.EVM_ERROR_VAULT_SEALED =>
-      'The vault is sealed. Unseal it before using EVM grants.',
-    EvmError.EVM_ERROR_INTERNAL || EvmError.EVM_ERROR_UNSPECIFIED =>
-      'The server failed to process the EVM grant request.',
-    _ => 'The server failed to process the EVM grant request.',
-  };
-}

useragent/lib/features/connection/server_info_storage.dart

@@ -1,62 +0,0 @@
-import 'dart:convert';
-
-import 'package:flutter_secure_storage/flutter_secure_storage.dart';
-import 'package:json_annotation/json_annotation.dart';
-
-part 'server_info_storage.g.dart';
-
-@JsonSerializable()
-class StoredServerInfo {
-  const StoredServerInfo({
-    required this.address,
-    required this.port,
-    required this.caCertFingerprint,
-  });
-
-  final String address;
-  final int port;
-  final String caCertFingerprint;
-
-  factory StoredServerInfo.fromJson(Map<String, dynamic> json) => _$StoredServerInfoFromJson(json);
-  Map<String, dynamic> toJson() => _$StoredServerInfoToJson(this);
-  
-}
-
-abstract class ServerInfoStorage {
-  Future<StoredServerInfo?> load();
-  Future<void> save(StoredServerInfo serverInfo);
-  Future<void> clear();
-}
-
-class SecureServerInfoStorage implements ServerInfoStorage {
-  static const _storageKey = 'server_info';
-
-  const SecureServerInfoStorage();
-
-  static const _storage = FlutterSecureStorage();
-
-  @override
-  Future<StoredServerInfo?> load() async {
-    return null;
-    final rawValue = await _storage.read(key: _storageKey);
-    if (rawValue == null) {
-      return null;
-    }
-
-    final decoded = jsonDecode(rawValue) as Map<String, dynamic>;
-    return StoredServerInfo.fromJson(decoded);
-  }
-
-  @override
-  Future<void> save(StoredServerInfo serverInfo) {
-    return _storage.write(
-      key: _storageKey,
-      value: jsonEncode(serverInfo.toJson()),
-    );
-  }
-
-  @override
-  Future<void> clear() {
-    return _storage.delete(key: _storageKey);
-  }
-}

useragent/lib/features/connection/server_info_storage.g.dart

@@ -1,21 +0,0 @@
-// GENERATED CODE - DO NOT MODIFY BY HAND
-
-part of 'server_info_storage.dart';
-
-// **************************************************************************
-// JsonSerializableGenerator
-// **************************************************************************
-
-StoredServerInfo _$StoredServerInfoFromJson(Map<String, dynamic> json) =>
-    StoredServerInfo(
-      address: json['address'] as String,
-      port: (json['port'] as num).toInt(),
-      caCertFingerprint: json['caCertFingerprint'] as String,
-    );
-
-Map<String, dynamic> _$StoredServerInfoToJson(StoredServerInfo instance) =>
-    <String, dynamic>{
-      'address': instance.address,
-      'port': instance.port,
-      'caCertFingerprint': instance.caCertFingerprint,
-    };

useragent/lib/features/connection/vault.dart

@@ -1,107 +0,0 @@
-import 'package:arbiter/features/connection/connection.dart';
-import 'package:arbiter/proto/user_agent.pb.dart';
-import 'package:cryptography/cryptography.dart';
-
-const _vaultKeyAssociatedData = 'arbiter.vault.password';
-
-Future<BootstrapResult> bootstrapVault(
-  Connection connection,
-  String password,
-) async {
-  final encryptedKey = await _encryptVaultKeyMaterial(connection, password);
-
-  await connection.send(
-    UserAgentRequest(
-      bootstrapEncryptedKey: BootstrapEncryptedKey(
-        nonce: encryptedKey.nonce,
-        ciphertext: encryptedKey.ciphertext,
-        associatedData: encryptedKey.associatedData,
-      ),
-    ),
-  );
-
-  final response = await connection.receive();
-  if (!response.hasBootstrapResult()) {
-    throw Exception(
-      'Expected bootstrap result, got ${response.whichPayload()}',
-    );
-  }
-
-  return response.bootstrapResult;
-}
-
-Future<UnsealResult> unsealVault(Connection connection, String password) async {
-  final encryptedKey = await _encryptVaultKeyMaterial(connection, password);
-
-  await connection.send(
-    UserAgentRequest(
-      unsealEncryptedKey: UnsealEncryptedKey(
-        nonce: encryptedKey.nonce,
-        ciphertext: encryptedKey.ciphertext,
-        associatedData: encryptedKey.associatedData,
-      ),
-    ),
-  );
-
-  final response = await connection.receive();
-  if (!response.hasUnsealResult()) {
-    throw Exception('Expected unseal result, got ${response.whichPayload()}');
-  }
-
-  return response.unsealResult;
-}
-
-Future<_EncryptedVaultKey> _encryptVaultKeyMaterial(
-  Connection connection,
-  String password,
-) async {
-  final keyExchange = X25519();
-  final cipher = Xchacha20.poly1305Aead();
-  final clientKeyPair = await keyExchange.newKeyPair();
-  final clientPublicKey = await clientKeyPair.extractPublicKey();
-
-  await connection.send(
-    UserAgentRequest(unsealStart: UnsealStart(clientPubkey: clientPublicKey.bytes)),
-  );
-
-  final handshakeResponse = await connection.receive();
-  if (!handshakeResponse.hasUnsealStartResponse()) {
-    throw Exception(
-      'Expected unseal handshake response, got ${handshakeResponse.whichPayload()}',
-    );
-  }
-
-  final serverPublicKey = SimplePublicKey(
-    handshakeResponse.unsealStartResponse.serverPubkey,
-    type: KeyPairType.x25519,
-  );
-  final sharedSecret = await keyExchange.sharedSecretKey(
-    keyPair: clientKeyPair,
-    remotePublicKey: serverPublicKey,
-  );
-
-  final secretBox = await cipher.encrypt(
-    password.codeUnits,
-    secretKey: sharedSecret,
-    nonce: cipher.newNonce(),
-    aad: _vaultKeyAssociatedData.codeUnits,
-  );
-
-  return _EncryptedVaultKey(
-    nonce: secretBox.nonce,
-    ciphertext: [...secretBox.cipherText, ...secretBox.mac.bytes],
-    associatedData: _vaultKeyAssociatedData.codeUnits,
-  );
-}
-
-class _EncryptedVaultKey {
-  const _EncryptedVaultKey({
-    required this.nonce,
-    required this.ciphertext,
-    required this.associatedData,
-  });
-
-  final List<int> nonce;
-  final List<int> ciphertext;
-  final List<int> associatedData;
-}