deps(server): version bump

Reviewed-on: #83

docs/superpowers/plans/2026-03-28-grant-grid-view.md

@@ -1,821 +0,0 @@
-# Grant Grid View Implementation Plan
-
-> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
-
-**Goal:** Add an "EVM Grants" dashboard tab that displays all grants as enriched cards (type, chain, wallet address, client name) with per-card revoke support.
-
-**Architecture:** A new `walletAccessListProvider` fetches wallet accesses with their DB row IDs. The screen (`grants.dart`) watches only `evmGrantsProvider` for top-level state. Each `GrantCard` widget (its own file) watches enrichment providers (`walletAccessListProvider`, `evmProvider`, `sdkClientsProvider`) and the revoke mutation directly — keeping rebuilds scoped to the card. The screen is registered as a dashboard tab in `AdaptiveScaffold`.
-
-**Tech Stack:** Flutter, Riverpod (`riverpod_annotation` + `build_runner` codegen), `sizer` (adaptive sizing), `auto_route`, Protocol Buffers (Dart), `Palette` design tokens.
-
----
-
-## File Map
-
-| File | Action | Responsibility |
-|---|---|---|
-| `operator/lib/theme/palette.dart` | Modify | Add `Palette.token` (indigo accent for token-transfer cards) |
-| `operator/lib/features/connection/evm/wallet_access.dart` | Modify | Add `listAllWalletAccesses()` function |
-| `operator/lib/providers/sdk_clients/wallet_access_list.dart` | Create | `WalletAccessListProvider` — fetches full wallet access list with IDs |
-| `operator/lib/screens/dashboard/evm/grants/widgets/grant_card.dart` | Create | `GrantCard` widget — watches enrichment providers + revoke mutation; one card per grant |
-| `operator/lib/screens/dashboard/evm/grants/grants.dart` | Create | `EvmGrantsScreen` — watches `evmGrantsProvider`; handles loading/error/empty/data states; renders `GrantCard` list |
-| `operator/lib/router.dart` | Modify | Register `EvmGrantsRoute` in dashboard children |
-| `operator/lib/screens/dashboard.dart` | Modify | Add Grants entry to `routes` list and `NavigationDestination` list |
-
----
-
-## Task 1: Add `Palette.token`
-
-**Files:**
-- Modify: `operator/lib/theme/palette.dart`
-
-- [ ] **Step 1: Add the color**
-
-Replace the contents of `operator/lib/theme/palette.dart` with:
-
-```dart
-import 'package:flutter/material.dart';
-
-class Palette {
-  static const ink = Color(0xFF15263C);
-  static const coral = Color(0xFFE26254);
-  static const cream = Color(0xFFFFFAF4);
-  static const line = Color(0x1A15263C);
-  static const token = Color(0xFF5C6BC0);
-}
-```
-
-- [ ] **Step 2: Verify**
-
-```sh
-cd operator && flutter analyze lib/theme/palette.dart
-```
-
-Expected: no issues.
-
-- [ ] **Step 3: Commit**
-
-```sh
-jj describe -m "feat(theme): add Palette.token for token-transfer grant cards"
-jj new
-```
-
----
-
-## Task 2: Add `listAllWalletAccesses` feature function
-
-**Files:**
-- Modify: `operator/lib/features/connection/evm/wallet_access.dart`
-
-`readClientWalletAccess` (existing) filters the list to one client's wallet IDs and returns `Set<int>`. This new function returns the complete unfiltered list with row IDs so the grant cards can resolve wallet_access_id → wallet + client.
-
-- [ ] **Step 1: Append function**
-
-Add at the bottom of `operator/lib/features/connection/evm/wallet_access.dart`:
-
-```dart
-Future<List<SdkClientWalletAccess>> listAllWalletAccesses(
-  Connection connection,
-) async {
-  final response = await connection.ask(
-    OperatorRequest(listWalletAccess: Empty()),
-  );
-  if (!response.hasListWalletAccessResponse()) {
-    throw Exception(
-      'Expected list wallet access response, got ${response.whichPayload()}',
-    );
-  }
-  return response.listWalletAccessResponse.accesses.toList(growable: false);
-}
-```
-
-Each returned `SdkClientWalletAccess` has:
-- `.id` — the `evm_wallet_access` row ID (same value as `wallet_access_id` in a `GrantEntry`)
-- `.access.walletId` — the EVM wallet DB ID
-- `.access.sdkClientId` — the SDK client DB ID
-
-- [ ] **Step 2: Verify**
-
-```sh
-cd operator && flutter analyze lib/features/connection/evm/wallet_access.dart
-```
-
-Expected: no issues.
-
-- [ ] **Step 3: Commit**
-
-```sh
-jj describe -m "feat(evm): add listAllWalletAccesses feature function"
-jj new
-```
-
----
-
-## Task 3: Create `WalletAccessListProvider`
-
-**Files:**
-- Create: `operator/lib/providers/sdk_clients/wallet_access_list.dart`
-- Generated: `operator/lib/providers/sdk_clients/wallet_access_list.g.dart`
-
-Mirrors the structure of `EvmGrants` in `providers/evm/evm_grants.dart` — class-based `@riverpod` with a `refresh()` method.
-
-- [ ] **Step 1: Write the provider**
-
-Create `operator/lib/providers/sdk_clients/wallet_access_list.dart`:
-
-```dart
-import 'package:arbiter/features/connection/evm/wallet_access.dart';
-import 'package:arbiter/proto/operator.pb.dart';
-import 'package:arbiter/providers/connection/connection_manager.dart';
-import 'package:mtcore/markettakers.dart';
-import 'package:riverpod_annotation/riverpod_annotation.dart';
-
-part 'wallet_access_list.g.dart';
-
-@riverpod
-class WalletAccessList extends _$WalletAccessList {
-  @override
-  Future<List<SdkClientWalletAccess>?> build() async {
-    final connection = await ref.watch(connectionManagerProvider.future);
-    if (connection == null) {
-      return null;
-    }
-
-    try {
-      return await listAllWalletAccesses(connection);
-    } catch (e, st) {
-      talker.handle(e, st);
-      rethrow;
-    }
-  }
-
-  Future<void> refresh() async {
-    final connection = await ref.read(connectionManagerProvider.future);
-    if (connection == null) {
-      state = const AsyncData(null);
-      return;
-    }
-
-    state = const AsyncLoading();
-    state = await AsyncValue.guard(() => listAllWalletAccesses(connection));
-  }
-}
-```
-
-- [ ] **Step 2: Run code generation**
-
-```sh
-cd operator && dart run build_runner build --delete-conflicting-outputs
-```
-
-Expected: `operator/lib/providers/sdk_clients/wallet_access_list.g.dart` created. No errors.
-
-- [ ] **Step 3: Verify**
-
-```sh
-cd operator && flutter analyze lib/providers/sdk_clients/
-```
-
-Expected: no issues.
-
-- [ ] **Step 4: Commit**
-
-```sh
-jj describe -m "feat(providers): add WalletAccessListProvider"
-jj new
-```
-
----
-
-## Task 4: Create `GrantCard` widget
-
-**Files:**
-- Create: `operator/lib/screens/dashboard/evm/grants/widgets/grant_card.dart`
-
-This widget owns all per-card logic: enrichment lookups, revoke action, and rebuild scope. The screen only passes it a `GrantEntry` — the card fetches everything else itself.
-
-**Key types:**
-- `GrantEntry` (from `proto/evm.pb.dart`): `.id`, `.shared.walletAccessId`, `.shared.chainId`, `.specific.whichGrant()`
-- `SpecificGrant_Grant.etherTransfer` / `.tokenTransfer` — enum values for the oneof
-- `SdkClientWalletAccess` (from `proto/operator.pb.dart`): `.id`, `.access.walletId`, `.access.sdkClientId`
-- `WalletEntry` (from `proto/evm.pb.dart`): `.id`, `.address` (List<int>)
-- `SdkClientEntry` (from `proto/operator.pb.dart`): `.id`, `.info.name`
-- `revokeEvmGrantMutation` — `Mutation<void>` (global; all revoke buttons disable together while any revoke is in flight)
-- `executeRevokeEvmGrant(ref, grantId: int)` — `Future<void>`
-
-- [ ] **Step 1: Write the widget**
-
-Create `operator/lib/screens/dashboard/evm/grants/widgets/grant_card.dart`:
-
-```dart
-import 'package:arbiter/proto/evm.pb.dart';
-import 'package:arbiter/proto/operator.pb.dart';
-import 'package:arbiter/providers/evm/evm.dart';
-import 'package:arbiter/providers/evm/evm_grants.dart';
-import 'package:arbiter/providers/sdk_clients/list.dart';
-import 'package:arbiter/providers/sdk_clients/wallet_access_list.dart';
-import 'package:arbiter/theme/palette.dart';
-import 'package:flutter/material.dart';
-import 'package:hooks_riverpod/experimental/mutation.dart';
-import 'package:hooks_riverpod/hooks_riverpod.dart';
-import 'package:sizer/sizer.dart';
-
-String _shortAddress(List<int> bytes) {
-  final hex = bytes.map((b) => b.toRadixString(16).padLeft(2, '0')).join();
-  return '0x${hex.substring(0, 6)}...${hex.substring(hex.length - 4)}';
-}
-
-String _formatError(Object error) {
-  final message = error.toString();
-  if (message.startsWith('Exception: ')) {
-    return message.substring('Exception: '.length);
-  }
-  return message;
-}
-
-class GrantCard extends ConsumerWidget {
-  const GrantCard({super.key, required this.grant});
-
-  final GrantEntry grant;
-
-  @override
-  Widget build(BuildContext context, WidgetRef ref) {
-    // Enrichment lookups — each watch scopes rebuilds to this card only
-    final walletAccesses =
-        ref.watch(walletAccessListProvider).asData?.value ?? const [];
-    final wallets = ref.watch(evmProvider).asData?.value ?? const [];
-    final clients = ref.watch(sdkClientsProvider).asData?.value ?? const [];
-    final revoking = ref.watch(revokeEvmGrantMutation) is MutationPending;
-
-    final isEther =
-        grant.specific.whichGrant() == SpecificGrant_Grant.etherTransfer;
-    final accent = isEther ? Palette.coral : Palette.token;
-    final typeLabel = isEther ? 'Ether' : 'Token';
-    final theme = Theme.of(context);
-    final muted = Palette.ink.withValues(alpha: 0.62);
-
-    // Resolve wallet_access_id → wallet address + client name
-    final accessById = <int, SdkClientWalletAccess>{
-      for (final a in walletAccesses) a.id: a,
-    };
-    final walletById = <int, WalletEntry>{
-      for (final w in wallets) w.id: w,
-    };
-    final clientNameById = <int, String>{
-      for (final c in clients) c.id: c.info.name,
-    };
-
-    final accessId = grant.shared.walletAccessId;
-    final access = accessById[accessId];
-    final wallet = access != null ? walletById[access.access.walletId] : null;
-
-    final walletLabel = wallet != null
-        ? _shortAddress(wallet.address)
-        : 'Access #$accessId';
-
-    final clientLabel = () {
-      if (access == null) return '';
-      final name = clientNameById[access.access.sdkClientId] ?? '';
-      return name.isEmpty ? 'Client #${access.access.sdkClientId}' : name;
-    }();
-
-    void showError(String message) {
-      if (!context.mounted) return;
-      ScaffoldMessenger.of(context).showSnackBar(
-        SnackBar(content: Text(message), behavior: SnackBarBehavior.floating),
-      );
-    }
-
-    Future<void> revoke() async {
-      try {
-        await executeRevokeEvmGrant(ref, grantId: grant.id);
-      } catch (e) {
-        showError(_formatError(e));
-      }
-    }
-
-    return Container(
-      decoration: BoxDecoration(
-        borderRadius: BorderRadius.circular(24),
-        color: Palette.cream.withValues(alpha: 0.92),
-        border: Border.all(color: Palette.line),
-      ),
-      child: IntrinsicHeight(
-        child: Row(
-          crossAxisAlignment: CrossAxisAlignment.stretch,
-          children: [
-            // Accent strip
-            Container(
-              width: 0.8.w,
-              decoration: BoxDecoration(
-                color: accent,
-                borderRadius: const BorderRadius.horizontal(
-                  left: Radius.circular(24),
-                ),
-              ),
-            ),
-            // Card body
-            Expanded(
-              child: Padding(
-                padding: EdgeInsets.symmetric(
-                  horizontal: 1.6.w,
-                  vertical: 1.4.h,
-                ),
-                child: Column(
-                  crossAxisAlignment: CrossAxisAlignment.start,
-                  children: [
-                    // Row 1: type badge · chain · spacer · revoke button
-                    Row(
-                      children: [
-                        Container(
-                          padding: EdgeInsets.symmetric(
-                            horizontal: 1.w,
-                            vertical: 0.4.h,
-                          ),
-                          decoration: BoxDecoration(
-                            color: accent.withValues(alpha: 0.15),
-                            borderRadius: BorderRadius.circular(8),
-                          ),
-                          child: Text(
-                            typeLabel,
-                            style: theme.textTheme.labelSmall?.copyWith(
-                              color: accent,
-                              fontWeight: FontWeight.w800,
-                            ),
-                          ),
-                        ),
-                        SizedBox(width: 1.w),
-                        Container(
-                          padding: EdgeInsets.symmetric(
-                            horizontal: 1.w,
-                            vertical: 0.4.h,
-                          ),
-                          decoration: BoxDecoration(
-                            color: Palette.ink.withValues(alpha: 0.06),
-                            borderRadius: BorderRadius.circular(8),
-                          ),
-                          child: Text(
-                            'Chain ${grant.shared.chainId}',
-                            style: theme.textTheme.labelSmall?.copyWith(
-                              color: muted,
-                              fontWeight: FontWeight.w700,
-                            ),
-                          ),
-                        ),
-                        const Spacer(),
-                        if (revoking)
-                          SizedBox(
-                            width: 1.8.h,
-                            height: 1.8.h,
-                            child: CircularProgressIndicator(
-                              strokeWidth: 2,
-                              color: Palette.coral,
-                            ),
-                          )
-                        else
-                          OutlinedButton.icon(
-                            onPressed: revoke,
-                            style: OutlinedButton.styleFrom(
-                              foregroundColor: Palette.coral,
-                              side: BorderSide(
-                                color: Palette.coral.withValues(alpha: 0.4),
-                              ),
-                              padding: EdgeInsets.symmetric(
-                                horizontal: 1.w,
-                                vertical: 0.6.h,
-                              ),
-                              shape: RoundedRectangleBorder(
-                                borderRadius: BorderRadius.circular(10),
-                              ),
-                            ),
-                            icon: const Icon(Icons.block_rounded, size: 16),
-                            label: const Text('Revoke'),
-                          ),
-                      ],
-                    ),
-                    SizedBox(height: 0.8.h),
-                    // Row 2: wallet address · client name
-                    Row(
-                      children: [
-                        Text(
-                          walletLabel,
-                          style: theme.textTheme.bodySmall?.copyWith(
-                            color: Palette.ink,
-                            fontFamily: 'monospace',
-                          ),
-                        ),
-                        Padding(
-                          padding: EdgeInsets.symmetric(horizontal: 0.8.w),
-                          child: Text(
-                            '·',
-                            style: theme.textTheme.bodySmall
-                                ?.copyWith(color: muted),
-                          ),
-                        ),
-                        Expanded(
-                          child: Text(
-                            clientLabel,
-                            maxLines: 1,
-                            overflow: TextOverflow.ellipsis,
-                            style: theme.textTheme.bodySmall
-                                ?.copyWith(color: muted),
-                          ),
-                        ),
-                      ],
-                    ),
-                  ],
-                ),
-              ),
-            ),
-          ],
-        ),
-      ),
-    );
-  }
-}
-```
-
-- [ ] **Step 2: Verify**
-
-```sh
-cd operator && flutter analyze lib/screens/dashboard/evm/grants/widgets/grant_card.dart
-```
-
-Expected: no issues.
-
-- [ ] **Step 3: Commit**
-
-```sh
-jj describe -m "feat(grants): add GrantCard widget with self-contained enrichment"
-jj new
-```
-
----
-
-## Task 5: Create `EvmGrantsScreen`
-
-**Files:**
-- Create: `operator/lib/screens/dashboard/evm/grants/grants.dart`
-
-The screen watches only `evmGrantsProvider` for top-level state (loading / error / no connection / empty / data). When there is data it renders a list of `GrantCard` widgets — each card manages its own enrichment subscriptions.
-
-- [ ] **Step 1: Write the screen**
-
-Create `operator/lib/screens/dashboard/evm/grants/grants.dart`:
-
-```dart
-import 'package:arbiter/proto/evm.pb.dart';
-import 'package:arbiter/providers/evm/evm_grants.dart';
-import 'package:arbiter/providers/sdk_clients/wallet_access_list.dart';
-import 'package:arbiter/router.gr.dart';
-import 'package:arbiter/screens/dashboard/evm/grants/widgets/grant_card.dart';
-import 'package:arbiter/theme/palette.dart';
-import 'package:arbiter/widgets/page_header.dart';
-import 'package:auto_route/auto_route.dart';
-import 'package:flutter/material.dart';
-import 'package:hooks_riverpod/hooks_riverpod.dart';
-import 'package:sizer/sizer.dart';
-
-String _formatError(Object error) {
-  final message = error.toString();
-  if (message.startsWith('Exception: ')) {
-    return message.substring('Exception: '.length);
-  }
-  return message;
-}
-
-// ─── State panel ──────────────────────────────────────────────────────────────
-
-class _StatePanel extends StatelessWidget {
-  const _StatePanel({
-    required this.icon,
-    required this.title,
-    required this.body,
-    this.actionLabel,
-    this.onAction,
-    this.busy = false,
-  });
-
-  final IconData icon;
-  final String title;
-  final String body;
-  final String? actionLabel;
-  final Future<void> Function()? onAction;
-  final bool busy;
-
-  @override
-  Widget build(BuildContext context) {
-    final theme = Theme.of(context);
-
-    return Container(
-      decoration: BoxDecoration(
-        borderRadius: BorderRadius.circular(24),
-        color: Palette.cream.withValues(alpha: 0.92),
-        border: Border.all(color: Palette.line),
-      ),
-      child: Padding(
-        padding: EdgeInsets.all(2.8.h),
-        child: Column(
-          crossAxisAlignment: CrossAxisAlignment.start,
-          children: [
-            if (busy)
-              SizedBox(
-                width: 2.8.h,
-                height: 2.8.h,
-                child: const CircularProgressIndicator(strokeWidth: 2.5),
-              )
-            else
-              Icon(icon, size: 34, color: Palette.coral),
-            SizedBox(height: 1.8.h),
-            Text(
-              title,
-              style: theme.textTheme.headlineSmall?.copyWith(
-                color: Palette.ink,
-                fontWeight: FontWeight.w800,
-              ),
-            ),
-            SizedBox(height: 1.h),
-            Text(
-              body,
-              style: theme.textTheme.bodyLarge?.copyWith(
-                color: Palette.ink.withValues(alpha: 0.72),
-                height: 1.5,
-              ),
-            ),
-            if (actionLabel != null && onAction != null) ...[
-              SizedBox(height: 2.h),
-              OutlinedButton.icon(
-                onPressed: () => onAction!(),
-                icon: const Icon(Icons.refresh),
-                label: Text(actionLabel!),
-              ),
-            ],
-          ],
-        ),
-      ),
-    );
-  }
-}
-
-// ─── Grant list ───────────────────────────────────────────────────────────────
-
-class _GrantList extends StatelessWidget {
-  const _GrantList({required this.grants});
-
-  final List<GrantEntry> grants;
-
-  @override
-  Widget build(BuildContext context) {
-    return Column(
-      children: [
-        for (var i = 0; i < grants.length; i++)
-          Padding(
-            padding: EdgeInsets.only(
-              bottom: i == grants.length - 1 ? 0 : 1.8.h,
-            ),
-            child: GrantCard(grant: grants[i]),
-          ),
-      ],
-    );
-  }
-}
-
-// ─── Screen ───────────────────────────────────────────────────────────────────
-
-@RoutePage()
-class EvmGrantsScreen extends ConsumerWidget {
-  const EvmGrantsScreen({super.key});
-
-  @override
-  Widget build(BuildContext context, WidgetRef ref) {
-    // Screen watches only the grant list for top-level state decisions
-    final grantsAsync = ref.watch(evmGrantsProvider);
-
-    Future<void> refresh() async {
-      await Future.wait([
-        ref.read(evmGrantsProvider.notifier).refresh(),
-        ref.read(walletAccessListProvider.notifier).refresh(),
-      ]);
-    }
-
-    void showMessage(String message) {
-      if (!context.mounted) return;
-      ScaffoldMessenger.of(context).showSnackBar(
-        SnackBar(content: Text(message), behavior: SnackBarBehavior.floating),
-      );
-    }
-
-    Future<void> safeRefresh() async {
-      try {
-        await refresh();
-      } catch (e) {
-        showMessage(_formatError(e));
-      }
-    }
-
-    final grantsState = grantsAsync.asData?.value;
-    final grants = grantsState?.grants;
-
-    final content = switch (grantsAsync) {
-      AsyncLoading() when grantsState == null => const _StatePanel(
-        icon: Icons.hourglass_top,
-        title: 'Loading grants',
-        body: 'Pulling grant registry from Arbiter.',
-        busy: true,
-      ),
-      AsyncError(:final error) => _StatePanel(
-        icon: Icons.sync_problem,
-        title: 'Grant registry unavailable',
-        body: _formatError(error),
-        actionLabel: 'Retry',
-        onAction: safeRefresh,
-      ),
-      AsyncData(:final value) when value == null => _StatePanel(
-        icon: Icons.portable_wifi_off,
-        title: 'No active server connection',
-        body: 'Reconnect to Arbiter to list EVM grants.',
-        actionLabel: 'Refresh',
-        onAction: safeRefresh,
-      ),
-      _ when grants != null && grants.isEmpty => _StatePanel(
-        icon: Icons.policy_outlined,
-        title: 'No grants yet',
-        body: 'Create a grant to allow SDK clients to sign transactions.',
-        actionLabel: 'Create grant',
-        onAction: () => context.router.push(const CreateEvmGrantRoute()),
-      ),
-      _ => _GrantList(grants: grants ?? const []),
-    };
-
-    return Scaffold(
-      body: SafeArea(
-        child: RefreshIndicator.adaptive(
-          color: Palette.ink,
-          backgroundColor: Colors.white,
-          onRefresh: safeRefresh,
-          child: ListView(
-            physics: const BouncingScrollPhysics(
-              parent: AlwaysScrollableScrollPhysics(),
-            ),
-            padding: EdgeInsets.fromLTRB(2.4.w, 2.4.h, 2.4.w, 3.2.h),
-            children: [
-              PageHeader(
-                title: 'EVM Grants',
-                isBusy: grantsAsync.isLoading,
-                actions: [
-                  FilledButton.icon(
-                    onPressed: () =>
-                        context.router.push(const CreateEvmGrantRoute()),
-                    icon: const Icon(Icons.add_rounded),
-                    label: const Text('Create grant'),
-                  ),
-                  SizedBox(width: 1.w),
-                  OutlinedButton.icon(
-                    onPressed: safeRefresh,
-                    style: OutlinedButton.styleFrom(
-                      foregroundColor: Palette.ink,
-                      side: BorderSide(color: Palette.line),
-                      padding: EdgeInsets.symmetric(
-                        horizontal: 1.4.w,
-                        vertical: 1.2.h,
-                      ),
-                      shape: RoundedRectangleBorder(
-                        borderRadius: BorderRadius.circular(14),
-                      ),
-                    ),
-                    icon: const Icon(Icons.refresh, size: 18),
-                    label: const Text('Refresh'),
-                  ),
-                ],
-              ),
-              SizedBox(height: 1.8.h),
-              content,
-            ],
-          ),
-        ),
-      ),
-    );
-  }
-}
-```
-
-- [ ] **Step 2: Verify**
-
-```sh
-cd operator && flutter analyze lib/screens/dashboard/evm/grants/
-```
-
-Expected: no issues.
-
-- [ ] **Step 3: Commit**
-
-```sh
-jj describe -m "feat(grants): add EvmGrantsScreen"
-jj new
-```
-
----
-
-## Task 6: Wire router and dashboard tab
-
-**Files:**
-- Modify: `operator/lib/router.dart`
-- Modify: `operator/lib/screens/dashboard.dart`
-- Regenerated: `operator/lib/router.gr.dart`
-
-- [ ] **Step 1: Add route to `router.dart`**
-
-Replace the contents of `operator/lib/router.dart` with:
-
-```dart
-import 'package:auto_route/auto_route.dart';
-
-import 'router.gr.dart';
-
-@AutoRouterConfig(generateForDir: ['lib/screens'])
-class Router extends RootStackRouter {
-  @override
-  List<AutoRoute> get routes => [
-    AutoRoute(page: Bootstrap.page, path: '/bootstrap', initial: true),
-    AutoRoute(page: ServerInfoSetupRoute.page, path: '/server-info'),
-    AutoRoute(page: ServerConnectionRoute.page, path: '/server-connection'),
-    AutoRoute(page: VaultSetupRoute.page, path: '/vault'),
-    AutoRoute(page: ClientDetailsRoute.page, path: '/clients/:clientId'),
-    AutoRoute(page: CreateEvmGrantRoute.page, path: '/evm-grants/create'),
-
-    AutoRoute(
-      page: DashboardRouter.page,
-      path: '/dashboard',
-      children: [
-        AutoRoute(page: EvmRoute.page, path: 'evm'),
-        AutoRoute(page: ClientsRoute.page, path: 'clients'),
-        AutoRoute(page: EvmGrantsRoute.page, path: 'grants'),
-        AutoRoute(page: AboutRoute.page, path: 'about'),
-      ],
-    ),
-  ];
-}
-```
-
-- [ ] **Step 2: Update `dashboard.dart`**
-
-In `operator/lib/screens/dashboard.dart`, replace the `routes` constant:
-
-```dart
-final routes = [
-  const EvmRoute(),
-  const ClientsRoute(),
-  const EvmGrantsRoute(),
-  const AboutRoute(),
-];
-```
-
-And replace the `destinations` list inside `AdaptiveScaffold`:
-
-```dart
-destinations: const [
-  NavigationDestination(
-    icon: Icon(Icons.account_balance_wallet_outlined),
-    selectedIcon: Icon(Icons.account_balance_wallet),
-    label: 'Wallets',
-  ),
-  NavigationDestination(
-    icon: Icon(Icons.devices_other_outlined),
-    selectedIcon: Icon(Icons.devices_other),
-    label: 'Clients',
-  ),
-  NavigationDestination(
-    icon: Icon(Icons.policy_outlined),
-    selectedIcon: Icon(Icons.policy),
-    label: 'Grants',
-  ),
-  NavigationDestination(
-    icon: Icon(Icons.info_outline),
-    selectedIcon: Icon(Icons.info),
-    label: 'About',
-  ),
-],
-```
-
-- [ ] **Step 3: Regenerate router**
-
-```sh
-cd operator && dart run build_runner build --delete-conflicting-outputs
-```
-
-Expected: `lib/router.gr.dart` updated, `EvmGrantsRoute` now available, no errors.
-
-- [ ] **Step 4: Full project verify**
-
-```sh
-cd operator && flutter analyze
-```
-
-Expected: no issues.
-
-- [ ] **Step 5: Commit**
-
-```sh
-jj describe -m "feat(nav): add Grants dashboard tab"
-jj new
-```

docs/superpowers/specs/2026-03-28-grant-grid-view-design.md

@@ -1,170 +0,0 @@
-# Grant Grid View — Design Spec
-
-**Date:** 2026-03-28
-
-## Overview
-
-Add a "Grants" dashboard tab to the Flutter operator app that displays all EVM grants as a card-based grid. Each card shows a compact summary (type, chain, wallet address, client name) with a revoke action. The tab integrates into the existing `AdaptiveScaffold` navigation alongside Wallets, Clients, and About.
-
-## Scope
-
-- New `walletAccessListProvider` for fetching wallet access entries with their DB row IDs
-- New `EvmGrantsScreen` as a dashboard tab
-- Grant card widget with enriched display (type, chain, wallet, client)
-- Revoke action wired to existing `executeRevokeEvmGrant` mutation
-- Dashboard tab bar and router updated
-- New token-transfer accent color added to `Palette`
-
-**Out of scope:** Fixing grant creation (separate task).
-
----
-
-## Data Layer
-
-### `walletAccessListProvider`
-
-**File:** `operator/lib/providers/sdk_clients/wallet_access_list.dart`
-
-- `@riverpod` class, watches `connectionManagerProvider.future`
-- Returns `List<SdkClientWalletAccess>?` (null when not connected)
-- Each entry: `.id` (wallet_access_id), `.access.walletId`, `.access.sdkClientId`
-- Exposes a `refresh()` method following the same pattern as `EvmGrants.refresh()`
-
-### Enrichment at render time (Approach A)
-
-The `EvmGrantsScreen` watches four providers:
-1. `evmGrantsProvider` — the grant list
-2. `walletAccessListProvider` — to resolve wallet_access_id → (wallet_id, sdk_client_id)
-3. `evmProvider` — to resolve wallet_id → wallet address
-4. `sdkClientsProvider` — to resolve sdk_client_id → client name
-
-All lookups are in-memory Maps built inside the build method; no extra model class needed.
-
-Fallbacks:
-- Wallet address not found → `"Access #N"` where N is the wallet_access_id
-- Client name not found → `"Client #N"` where N is the sdk_client_id
-
----
-
-## Route Structure
-
-```
-/dashboard
-  /evm          ← existing (Wallets tab)
-  /clients      ← existing (Clients tab)
-  /grants       ← NEW (Grants tab)
-  /about        ← existing
-
-/evm-grants/create  ← existing push route (unchanged)
-```
-
-### Changes to `router.dart`
-
-Add inside dashboard children:
-```dart
-AutoRoute(page: EvmGrantsRoute.page, path: 'grants'),
-```
-
-### Changes to `dashboard.dart`
-
-Add to `routes` list:
-```dart
-const EvmGrantsRoute()
-```
-
-Add `NavigationDestination`:
-```dart
-NavigationDestination(
-  icon: Icon(Icons.policy_outlined),
-  selectedIcon: Icon(Icons.policy),
-  label: 'Grants',
-),
-```
-
----
-
-## Screen: `EvmGrantsScreen`
-
-**File:** `operator/lib/screens/dashboard/evm/grants/grants.dart`
-
-```
-Scaffold
-└─ SafeArea
-   └─ RefreshIndicator.adaptive (refreshes evmGrantsProvider + walletAccessListProvider)
-      └─ ListView (BouncingScrollPhysics + AlwaysScrollableScrollPhysics)
-         ├─ PageHeader
-         │    title: 'EVM Grants'
-         │    isBusy: evmGrantsProvider.isLoading
-         │    actions: [CreateGrantButton, RefreshButton]
-         ├─ SizedBox(height: 1.8.h)
-         └─ <content>
-```
-
-### State handling
-
-Matches the pattern from `EvmScreen` and `ClientsScreen`:
-
-| State | Display |
-|---|---|
-| Loading (no data yet) | `_StatePanel` with spinner, "Loading grants" |
-| Error | `_StatePanel` with coral icon, error message, Retry button |
-| No connection | `_StatePanel`, "No active server connection" |
-| Empty list | `_StatePanel`, "No grants yet", with Create Grant shortcut |
-| Data | Column of `_GrantCard` widgets |
-
-### Header actions
-
-**CreateGrantButton:** `FilledButton.icon` with `Icons.add_rounded`, pushes `CreateEvmGrantRoute()` via `context.router.push(...)`.
-
-**RefreshButton:** `OutlinedButton.icon` with `Icons.refresh`, calls `ref.read(evmGrantsProvider.notifier).refresh()`.
-
----
-
-## Grant Card: `_GrantCard`
-
-**Layout:**
-
-```
-Container (rounded 24, Palette.cream bg, Palette.line border)
-└─ IntrinsicHeight > Row
-   ├─ Accent strip (0.8.w wide, full height, rounded left)
-   └─ Padding > Column
-        ├─ Row 1: TypeBadge + ChainChip + Spacer + RevokeButton
-        └─ Row 2: WalletText + "·" + ClientText
-```
-
-**Accent color by grant type:**
-- Ether transfer → `Palette.coral`
-- Token transfer → `Palette.token` (new entry in `Palette` — indigo, e.g. `Color(0xFF5C6BC0)`)
-
-**TypeBadge:** Small pill container with accent color background at 15% opacity, accent-colored text. Label: `'Ether'` or `'Token'`.
-
-**ChainChip:** Small container: `'Chain ${grant.shared.chainId}'`, muted ink color.
-
-**WalletText:** Short hex address (`0xabc...def`) from wallet lookup, `bodySmall`, monospace font family.
-
-**ClientText:** Client name from `sdkClientsProvider` lookup, or fallback string. `bodySmall`, muted ink.
-
-**RevokeButton:**
-- `OutlinedButton` with `Icons.block_rounded` icon, label `'Revoke'`
-- `foregroundColor: Palette.coral`, `side: BorderSide(color: Palette.coral.withValues(alpha: 0.4))`
-- Disabled (replaced with `CircularProgressIndicator`) while `revokeEvmGrantMutation` is pending — note: this is a single global mutation, so all revoke buttons disable while any revoke is in flight
-- On press: calls `executeRevokeEvmGrant(ref, grantId: grant.id)`; shows `SnackBar` on error
-
----
-
-## Adaptive Sizing
-
-All sizing uses `sizer` units (`1.h`, `1.w`, etc.). No hardcoded pixel values.
-
----
-
-## Files to Create / Modify
-
-| File | Action |
-|---|---|
-| `lib/theme/palette.dart` | Modify — add `Palette.token` color |
-| `lib/providers/sdk_clients/wallet_access_list.dart` | Create |
-| `lib/screens/dashboard/evm/grants/grants.dart` | Create |
-| `lib/router.dart` | Modify — add grants route to dashboard children |
-| `lib/screens/dashboard.dart` | Modify — add tab to routes list and NavigationDestinations |

server/Cargo.lock

@@ -44,9 +44,9 @@ checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"
 
 [[package]]
 name = "alloy"
-version = "2.0.4"
+version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d8010fc7e9e8643ef4e758cdccf3eef26734594aedf88a9d5ed35e51837d42ef"
+checksum = "d1172e33a862030da77768c11cf17a1f801590de94cf518392b65207f15810c8"
 dependencies = [
  "alloy-consensus",
  "alloy-contract",
@@ -78,9 +78,9 @@ dependencies = [
 
 [[package]]
 name = "alloy-consensus"
-version = "2.0.4"
+version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3d64da86c616b5092ea64eea648f311bbd58630a0b384c42d699175d6f9122b"
+checksum = "b44937ce84d2cbf1ee4010667bd9214bb7db134a91dd9ffa6b1b8b1d6b030449"
 dependencies = [
  "alloy-eips",
  "alloy-primitives",
@@ -96,7 +96,7 @@ dependencies = [
  "k256",
  "once_cell",
  "rand 0.8.6",
- "secp256k1",
+ "secp256k1 0.30.0",
  "serde",
  "serde_json",
  "serde_with",
@@ -105,9 +105,9 @@ dependencies = [
 
 [[package]]
 name = "alloy-consensus-any"
-version = "2.0.4"
+version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fd98696ca3617d3a9ba1a6f2011880cbfd5618228dab6400c9f8bca457859a8"
+checksum = "7bb0bdd61ddff726026676450e7e6a52c68aa39d98f2d60d05ad7caaea5b8100"
 dependencies = [
  "alloy-consensus",
  "alloy-eips",
@@ -119,9 +119,9 @@ dependencies = [
 
 [[package]]
 name = "alloy-contract"
-version = "2.0.4"
+version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "de3df0aadc569a8b277808a7d0ad0e421180654ea36a3c59e9ed2bb968c9a1cd"
+checksum = "b1475c7edc6780b1759ccdb7960e28d29856ecbed47cfcf9e25be6a5f48b0cfb"
 dependencies = [
  "alloy-consensus",
  "alloy-dyn-abi",
@@ -142,9 +142,9 @@ dependencies = [
 
 [[package]]
 name = "alloy-core"
-version = "1.5.7"
+version = "1.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23e8604b0c092fabc80d075ede181c9b9e596249c70b99253082d7e689836529"
+checksum = "62ddde5968de6044d67af107ad835bc0069a7ca245870b94c5958a7d8712b184"
 dependencies = [
  "alloy-dyn-abi",
  "alloy-json-abi",
@@ -155,9 +155,9 @@ dependencies = [
 
 [[package]]
 name = "alloy-dyn-abi"
-version = "1.5.7"
+version = "1.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cc2db5c583aaef0255aa63a4fe827f826090142528bba48d1bf4119b62780cad"
+checksum = "a475bb02d9cef2dbb99065c1664ab3fe1f9352e21d6d5ed3f02cdbfc06ed1abc"
 dependencies = [
  "alloy-json-abi",
  "alloy-primitives",
@@ -166,7 +166,7 @@ dependencies = [
  "itoa",
  "serde",
  "serde_json",
- "winnow 0.7.15",
+ "winnow 1.0.2",
 ]
 
 [[package]]
@@ -209,22 +209,23 @@ dependencies = [
 
 [[package]]
 name = "alloy-eip7928"
-version = "0.3.5"
+version = "0.4.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec6ae911a2fc304a7cb80a79fb7bed6d1474aed4e7c203df1f8ff538f64fc78d"
+checksum = "b3b12337f74cbfa451cb04dac173974814a6ff463079e1793aa09600ba8813ab"
 dependencies = [
  "alloy-primitives",
  "alloy-rlp",
  "borsh",
  "once_cell",
  "serde",
+ "thiserror",
 ]
 
 [[package]]
 name = "alloy-eips"
-version = "2.0.4"
+version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "64c0456f5f7a4497e9342d20f528e30f5288ddfa0d6a012bd5044afee46cd8a0"
+checksum = "154b0f566ebbfc256b63c8d643c6a299f40a6fcd50a9d756c1d191487dd06483"
 dependencies = [
  "alloy-eip2124",
  "alloy-eip2930",
@@ -245,9 +246,9 @@ dependencies = [
 
 [[package]]
 name = "alloy-genesis"
-version = "2.0.4"
+version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a71ff8b55d2b8aa05259f474cae7dea0e4991724dc18936b81cb23ec492a0c2a"
+checksum = "a0a930a68a6f0ac19231bc2f5f0bf13fad3a26fa7df2525354890c72366c2998"
 dependencies = [
  "alloy-eips",
  "alloy-primitives",
@@ -260,9 +261,9 @@ dependencies = [
 
 [[package]]
 name = "alloy-json-abi"
-version = "1.5.7"
+version = "1.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e9dbe713da0c737d9e5e387b0ba790eb98b14dd207fe53eef50e19a5a8ec3dac"
+checksum = "7c36c9d7f9021601b04bfef14a4b64849f6d73116a4e91e071d7fbfe10247901"
 dependencies = [
  "alloy-primitives",
  "alloy-sol-type-parser",
@@ -272,9 +273,9 @@ dependencies = [
 
 [[package]]
 name = "alloy-json-rpc"
-version = "2.0.4"
+version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "19e352478b756bad5d7203148e4b461861282ea2ded3da406ba24868b52cd098"
+checksum = "2e92108767c8c95b5e521570e039e374e65198c4179a98d200412c083d6c26d5"
 dependencies = [
  "alloy-primitives",
  "alloy-sol-types",
@@ -287,9 +288,9 @@ dependencies = [
 
 [[package]]
 name = "alloy-network"
-version = "2.0.4"
+version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed08ae169869e08370ed121612e0d3dadac33d1a256e9f2465926b23f0bd7d95"
+checksum = "c4546c9fae2861d4159ee3b25c44ab3edb90f21b849e86cf2086cacb1d56d8ac"
 dependencies = [
  "alloy-consensus",
  "alloy-consensus-any",
@@ -313,9 +314,9 @@ dependencies = [
 
 [[package]]
 name = "alloy-network-primitives"
-version = "2.0.4"
+version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02e6c7ad28afe348a9a9c5624b67ee5b3607b8de98d5816b3056ecdfa6fa2697"
+checksum = "ca2c325d5934445209c8d22fc67d27e2cf9fb79054b8154d9e522d6a4ee3a4f7"
 dependencies = [
  "alloy-consensus",
  "alloy-eips",
@@ -326,9 +327,9 @@ dependencies = [
 
 [[package]]
 name = "alloy-primitives"
-version = "1.5.7"
+version = "1.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "de3b431b4e72cd8bd0ec7a50b4be18e73dab74de0dba180eef171055e5d5926e"
+checksum = "4885c1409b6936c4898e646ef58baf6ec54edaf6d8179f79df805a7b85b7cf3e"
 dependencies = [
  "alloy-rlp",
  "bytes",
@@ -336,7 +337,7 @@ dependencies = [
  "const-hex",
  "derive_more",
  "foldhash 0.2.0",
- "hashbrown 0.16.1",
+ "hashbrown 0.17.0",
  "indexmap 2.14.0",
  "itoa",
  "k256",
@@ -347,15 +348,16 @@ dependencies = [
  "rapidhash",
  "ruint",
  "rustc-hash",
+ "secp256k1 0.31.1",
  "serde",
- "sha3 0.10.9",
+ "sha3",
 ]
 
 [[package]]
 name = "alloy-provider"
-version = "2.0.4"
+version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "93a7c17472b55482d4734154c2f5ed13f72e03f6752cebb927f6a2d8b52e646c"
+checksum = "ff4536d25780fcf51a338c26153c526c99649be1273600684ef10b397a207d4a"
 dependencies = [
  "alloy-chains",
  "alloy-consensus",
@@ -414,9 +416,9 @@ dependencies = [
 
 [[package]]
 name = "alloy-rpc-client"
-version = "2.0.4"
+version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5beb5c2fe6b960c8e8b038e69fd502a90a2e930afa4770efb748b163b0767729"
+checksum = "7f8d765656f02f993fa0565abeb3554ccd6a0d72ea44ce0558b983136639bd6b"
 dependencies = [
  "alloy-json-rpc",
  "alloy-primitives",
@@ -437,9 +439,9 @@ dependencies = [
 
 [[package]]
 name = "alloy-rpc-types"
-version = "2.0.4"
+version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ee1257a278f6d293e05c5162c5940a1561b1aa85ded0028b464c81de37ebfa5"
+checksum = "2a05ef5b11fad72068e6f011c21445bc5b596ac850644c4a14c30d845ce56de8"
 dependencies = [
  "alloy-primitives",
  "alloy-rpc-types-eth",
@@ -449,9 +451,9 @@ dependencies = [
 
 [[package]]
 name = "alloy-rpc-types-any"
-version = "2.0.4"
+version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a234bfbdf7a76c3d13808f729af5321852de3dedcaa6fc6d5f54787aaf54c6a"
+checksum = "b06bfe79149dd53de5b196aa3c96db0500b7cf0ed72dbd1a31bac7660bc7cc65"
 dependencies = [
  "alloy-consensus-any",
  "alloy-network-primitives",
@@ -464,9 +466,9 @@ dependencies = [
 
 [[package]]
 name = "alloy-rpc-types-eth"
-version = "2.0.4"
+version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56a282daf869eeb7383d3d5c2deb35b0b3fb45ecb329513af4090fc61245ee18"
+checksum = "b41d1a11f58b456c199e04591befc64cb236fa2574a7275a07b98b173727bd39"
 dependencies = [
  "alloy-consensus",
  "alloy-consensus-any",
@@ -485,9 +487,9 @@ dependencies = [
 
 [[package]]
 name = "alloy-serde"
-version = "2.0.4"
+version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a0eada2558e921b39dfcead33c487364df9b31374f5733c1c9d2c891c4529933"
+checksum = "bcf028ac8bcb161ad7c104243e710cece8e1a794f65ee6c35c4c4d693c8e80ee"
 dependencies = [
  "alloy-primitives",
  "serde",
@@ -496,9 +498,9 @@ dependencies = [
 
 [[package]]
 name = "alloy-signer"
-version = "2.0.4"
+version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41eb29f7a8adcd8941fbb8e134022a133e6f8dfd345f2e3b7109599f8a7dca08"
+checksum = "1a5f392f2f56b2417ea6b74e1e116c6f35df5ab5fce4dc422e277d72ee18ff7b"
 dependencies = [
  "alloy-primitives",
  "async-trait",
@@ -511,9 +513,9 @@ dependencies = [
 
 [[package]]
 name = "alloy-signer-local"
-version = "2.0.4"
+version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bef839e7ce9b59aa60fa9a175e97986c6145c888d643b0f1fb0a3e7b8e56a2e2"
+checksum = "78de3d4ed62e2c90e16be166d0ddfe41944bb5979752703199073acf976083f2"
 dependencies = [
  "alloy-consensus",
  "alloy-network",
@@ -527,9 +529,9 @@ dependencies = [
 
 [[package]]
 name = "alloy-sol-macro"
-version = "1.5.7"
+version = "1.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ab81bab693da9bb79f7a95b64b394718259fdd7e41dceeced4cad57cb71c4f6a"
+checksum = "840128ed2b2971d6d4668a553fe403a82683d3acc646c73e75887e7157408033"
 dependencies = [
  "alloy-sol-macro-expander",
  "alloy-sol-macro-input",
@@ -541,9 +543,9 @@ dependencies = [
 
 [[package]]
 name = "alloy-sol-macro-expander"
-version = "1.5.7"
+version = "1.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "489f1620bb7e2483fb5819ed01ab6edc1d2f93939dce35a5695085a1afd1d699"
+checksum = "63ec265e5d65d725175f6ca7711c970824c90ef9c0d1f1973711d4150ee612dd"
 dependencies = [
  "alloy-json-abi",
  "alloy-sol-macro-input",
@@ -553,16 +555,16 @@ dependencies = [
  "proc-macro-error2",
  "proc-macro2",
  "quote",
- "sha3 0.10.9",
+ "sha3",
  "syn 2.0.117",
  "syn-solidity",
 ]
 
 [[package]]
 name = "alloy-sol-macro-input"
-version = "1.5.7"
+version = "1.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56cef806ad22d4392c5fc83cf8f2089f988eb99c7067b4e0c6f1971fc1cca318"
+checksum = "89bf01077f18650876cfa682eb1f949967b5cde03f1a51c955c469d2c9b4aa67"
 dependencies = [
  "alloy-json-abi",
  "const-hex",
@@ -578,19 +580,19 @@ dependencies = [
 
 [[package]]
 name = "alloy-sol-type-parser"
-version = "1.5.7"
+version = "1.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6df77fea9d6a2a75c0ef8d2acbdfd92286cc599983d3175ccdc170d3433d249"
+checksum = "857b470ecdd2ed38beaf82ad1a38c516a8ff75266750f38b9eeed001d575241b"
 dependencies = [
  "serde",
- "winnow 0.7.15",
+ "winnow 1.0.2",
 ]
 
 [[package]]
 name = "alloy-sol-types"
-version = "1.5.7"
+version = "1.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "64612d29379782a5dde6f4b6570d9c756d734d760c0c94c254d361e678a6591f"
+checksum = "384cf252de0db2dec52821eac037a7f57e2aa33fe5b900ce6fe39973402341f1"
 dependencies = [
  "alloy-json-abi",
  "alloy-primitives",
@@ -600,9 +602,9 @@ dependencies = [
 
 [[package]]
 name = "alloy-transport"
-version = "2.0.4"
+version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3ac7a80c0bac3e44559d53d002e34c461dc2f23262b42cafec019bc70551abbe"
+checksum = "39f42ee1ef30d4d3d8b4ea5794937fccfc69e2bb1cd5bcf42d62afc57b049081"
 dependencies = [
  "alloy-json-rpc",
  "auto_impl",
@@ -623,9 +625,9 @@ dependencies = [
 
 [[package]]
 name = "alloy-transport-http"
-version = "2.0.4"
+version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eed3ed3300a998f88639ed619fdbbd88bd82865e00c6a8ecb796c99eb12358f6"
+checksum = "ee68bc7d713e033eeaaecb8fd13d5d8a41af97226c4388930ad459285b8e9f70"
 dependencies = [
  "alloy-json-rpc",
  "alloy-transport",
@@ -655,9 +657,9 @@ dependencies = [
 
 [[package]]
 name = "alloy-tx-macros"
-version = "2.0.4"
+version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "99fce0350197dcd4ba4e9a7dd43915d908c0eb0e7352755791709a705e1c76b6"
+checksum = "dc2cd27809c88c413e5542dbd5a8eff8c12f0086af920e881ae586d3a787d5e5"
 dependencies = [
  "darling 0.23.0",
  "proc-macro2",
@@ -676,9 +678,9 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.102"
+version = "1.0.103"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
+checksum = "2a4385e2e34eb35d6b3efe798b9eb88096925d87726c0798709bf56d9ed84af3"
 
 [[package]]
 name = "arbiter-client"
@@ -719,7 +721,6 @@ dependencies = [
  "proc-macro2",
  "quote",
  "syn 2.0.117",
- "trybuild",
 ]
 
 [[package]]
@@ -1226,7 +1227,7 @@ version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "08807e080ed7f9d5433fa9b275196cfc35414f66a0c79d864dc51a0d825231a3"
 dependencies = [
- "bit-vec",
+ "bit-vec 0.8.0",
 ]
 
 [[package]]
@@ -1235,6 +1236,15 @@ version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5e764a1d40d510daf35e07be9eb06e75770908c27d411ee6c92109c9840eaaf7"
 
+[[package]]
+name = "bit-vec"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b71798fca2c1fe1086445a7258a4bc81e6e49dcd24c8d0dd9a1e57395b603f51"
+dependencies = [
+ "serde",
+]
+
 [[package]]
 name = "bitcoin-io"
 version = "0.1.4"
@@ -1435,9 +1445,9 @@ dependencies = [
 
 [[package]]
 name = "chrono"
-version = "0.4.44"
+version = "0.4.45"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c673075a2e0e5f4a1dde27ce9dee1ea4558c7ffe648f576438a20ca1d2acc4b0"
+checksum = "1aa79e62e7697b8e29b513a68abacf485adcd1fe8284a4316c5ae868e6633327"
 dependencies = [
  "iana-time-zone",
  "js-sys",
@@ -1636,6 +1646,7 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "77727bb15fa921304124b128af125e7e3b968275d1b108b379190264f4423710"
 dependencies = [
+ "getrandom 0.4.2",
  "hybrid-array",
  "rand_core 0.10.1",
 ]
@@ -1860,9 +1871,9 @@ dependencies = [
 
 [[package]]
 name = "diesel"
-version = "2.3.9"
+version = "2.3.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9940fb8467a0a06312218ed384185cb8536aa10d8ec017d0ce7fad2c1bd882d5"
+checksum = "29fe29a87fb84c631ffb3ba21798c4b1f3a964701ba78f0dce4bf8668562ec88"
 dependencies = [
  "chrono",
  "diesel_derives",
@@ -1876,9 +1887,9 @@ dependencies = [
 
 [[package]]
 name = "diesel-async"
-version = "0.9.0"
+version = "0.9.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c20ddcc6737cecdaef3dfecb2796bdfe3002456521189d30be8e4c5a1bc821d"
+checksum = "dd39af30158d444884f166fe4c58f35dc40ad71ad017bb59408a3448526ff4bd"
 dependencies = [
  "bb8",
  "diesel",
@@ -1966,12 +1977,6 @@ dependencies = [
  "syn 2.0.117",
 ]
 
-[[package]]
-name = "dissimilar"
-version = "1.0.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aeda16ab4059c5fd2a83f2b9c9e9c981327b18aa8e3b313f7e6563799d4f093e"
-
 [[package]]
 name = "downcast-rs"
 version = "2.0.2"
@@ -2443,8 +2448,6 @@ dependencies = [
  "allocator-api2",
  "equivalent",
  "foldhash 0.2.0",
- "serde",
- "serde_core",
 ]
 
 [[package]]
@@ -2452,6 +2455,11 @@ name = "hashbrown"
 version = "0.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4f467dd6dccf739c208452f8014c75c18bb8301b050ad1cfb27153803edb0f51"
+dependencies = [
+ "foldhash 0.2.0",
+ "serde",
+ "serde_core",
+]
 
 [[package]]
 name = "heck"
@@ -2500,9 +2508,9 @@ dependencies = [
 
 [[package]]
 name = "http"
-version = "1.4.0"
+version = "1.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3ba2a386d7f85a81f119ad7498ebe444d2e22c2af0b86b069416ace48b3311a"
+checksum = "6970f50e31d6fc17d3fa27329444bfa74e196cf62e95052a3f6fee181dba6425"
 dependencies = [
  "bytes",
  "itoa",
@@ -2997,15 +3005,6 @@ dependencies = [
  "syn 2.0.117",
 ]
 
-[[package]]
-name = "keccak"
-version = "0.1.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb26cec98cce3a3d96cbb7bced3c4b16e3d13f27ec56dbd62cbc8f39cfb9d653"
-dependencies = [
- "cpufeatures 0.2.17",
-]
-
 [[package]]
 name = "keccak"
 version = "0.2.0"
@@ -3129,9 +3128,9 @@ checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154"
 
 [[package]]
 name = "macro-string"
-version = "0.1.4"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b27834086c65ec3f9387b096d66e99f221cf081c2b738042aa252bcd41204e3"
+checksum = "59a9dbbfc75d2688ed057456ce8a3ee3f48d12eec09229f560f3643b9f275653"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -3207,7 +3206,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "36c791ecdf977c99f45f23280405d7723727470f6689a5e6dbf513ac547ae10d"
 dependencies = [
  "serde",
- "toml 0.9.12+spec-1.1.0",
+ "toml",
 ]
 
 [[package]]
@@ -3256,18 +3255,18 @@ dependencies = [
 
 [[package]]
 name = "ml-dsa"
-version = "0.1.0-rc.9"
+version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3a596bd65985e2b343c3fd6cc4ade15cdd76da66b15936cfbce72ea661cdbb2"
+checksum = "add6b9d92e496f16f4526d68ff29da1483aba4b119baeab8bed3b9e3544a6f3d"
 dependencies = [
  "const-oid 0.10.2",
+ "crypto-common 0.2.1",
  "ctutils",
  "hybrid-array",
  "module-lattice",
  "pkcs8 0.11.0",
- "rand_core 0.10.1",
- "sha3 0.11.0",
- "signature 3.0.0-rc.10",
+ "shake",
+ "signature 3.0.0",
  "zeroize",
 ]
 
@@ -3281,15 +3280,15 @@ dependencies = [
  "kem",
  "module-lattice",
  "rand_core 0.10.1",
- "sha3 0.11.0",
+ "sha3",
  "zeroize",
 ]
 
 [[package]]
 name = "module-lattice"
-version = "0.2.2"
+version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc7c90d33a0dac244570c26461d761ffaeadb3bfc2b17cc625ae2185cafdffae"
+checksum = "0c61b87c9683ab7cb1c6871d261ad5479b6b10ceb52c4352aaca3b5d35a8febe"
 dependencies = [
  "ctutils",
  "hybrid-array",
@@ -3746,7 +3745,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4b45fcc2344c680f5025fe57779faef368840d0bd1f42f216291f0dc4ace4744"
 dependencies = [
  "bit-set",
- "bit-vec",
+ "bit-vec 0.8.0",
  "bitflags",
  "num-traits",
  "rand 0.9.4",
@@ -3760,9 +3759,9 @@ dependencies = [
 
 [[package]]
 name = "prost"
-version = "0.14.3"
+version = "0.14.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2ea70524a2f82d518bce41317d0fae74151505651af45faf1ffbd6fd33f0568"
+checksum = "528ac67416ff8646872a3c02cad9cc4ee5dc9f9540c9b10771855c95cb2e5ae1"
 dependencies = [
  "bytes",
  "prost-derive",
@@ -3791,9 +3790,9 @@ dependencies = [
 
 [[package]]
 name = "prost-derive"
-version = "0.14.3"
+version = "0.14.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "27c6023962132f4b30eb4c172c91ce92d933da334c59c23cddee82358ddafb0b"
+checksum = "b570b25f7617e43d59005d0990ccb79e950a423952cea19671b7a876da390adf"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -3804,9 +3803,9 @@ dependencies = [
 
 [[package]]
 name = "prost-types"
-version = "0.14.3"
+version = "0.14.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8991c4cbdb8bc5b11f0b074ffe286c30e523de90fee5ba8132f1399f23cb3dd7"
+checksum = "f94967dc7688f3054c7fac87473ffae4cc4c3904800e2d9f5b857246d8963b0a"
 dependencies = [
  "chrono",
  "prost",
@@ -4020,9 +4019,9 @@ dependencies = [
 
 [[package]]
 name = "rcgen"
-version = "0.14.7"
+version = "0.14.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "10b99e0098aa4082912d4c649628623db6aba77335e4f4569ff5083a6448b32e"
+checksum = "57f6d249aad744e274e682777a50283a225a32705394ee6d5fcc01efa25e4055"
 dependencies = [
  "aws-lc-rs",
  "pem",
@@ -4313,9 +4312,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.40"
+version = "0.23.41"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef86cd5876211988985292b91c96a8f2d298df24e75989a43a3c73f2d4d8168b"
+checksum = "6b92b125634d9b795e7beca796cc790df15a7fb38323bf3196fda83292d06b1f"
 dependencies = [
  "aws-lc-rs",
  "log",
@@ -4476,10 +4475,21 @@ checksum = "b50c5943d326858130af85e049f2661ba3c78b26589b8ab98e65e80ae44a1252"
 dependencies = [
  "bitcoin_hashes",
  "rand 0.8.6",
- "secp256k1-sys",
+ "secp256k1-sys 0.10.1",
  "serde",
 ]
 
+[[package]]
+name = "secp256k1"
+version = "0.31.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2c3c81b43dc2d8877c216a3fccf76677ee1ebccd429566d3e67447290d0c42b2"
+dependencies = [
+ "bitcoin_hashes",
+ "rand 0.9.4",
+ "secp256k1-sys 0.11.0",
+]
+
 [[package]]
 name = "secp256k1-sys"
 version = "0.10.1"
@@ -4489,6 +4499,15 @@ dependencies = [
  "cc",
 ]
 
+[[package]]
+name = "secp256k1-sys"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dcb913707158fadaf0d8702c2db0e857de66eb003ccfdda5924b5f5ac98efb38"
+dependencies = [
+ "cc",
+]
+
 [[package]]
 name = "security-framework"
 version = "3.7.0"
@@ -4651,16 +4670,6 @@ dependencies = [
  "digest 0.11.2",
 ]
 
-[[package]]
-name = "sha3"
-version = "0.10.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77fd7028345d415a4034cf8777cd4f8ab1851274233b45f84e3d955502d93874"
-dependencies = [
- "digest 0.10.7",
- "keccak 0.1.6",
-]
-
 [[package]]
 name = "sha3"
 version = "0.11.0"
@@ -4668,7 +4677,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "be176f1a57ce4e3d31c1a166222d9768de5954f811601fb7ca06fc8203905ce1"
 dependencies = [
  "digest 0.11.2",
- "keccak 0.2.0",
+ "keccak",
 ]
 
 [[package]]
@@ -4681,6 +4690,17 @@ dependencies = [
  "cfg-if",
 ]
 
+[[package]]
+name = "shake"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09057cb2149ad4cbd2da1e26b351f9a4c354219421229c69c3063e6f61947c4a"
+dependencies = [
+ "digest 0.11.2",
+ "keccak",
+ "sponge-cursor",
+]
+
 [[package]]
 name = "sharded-slab"
 version = "0.1.7"
@@ -4718,9 +4738,9 @@ dependencies = [
 
 [[package]]
 name = "signature"
-version = "3.0.0-rc.10"
+version = "3.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f1880df446116126965eeec169136b2e0251dba37c6223bcc819569550edea3"
+checksum = "28d567dcbaf0049cb8ac2608a76cd95ff9e4412e1899d389ee400918ca7537f5"
 dependencies = [
  "digest 0.11.2",
  "rand_core 0.10.1",
@@ -4814,6 +4834,12 @@ dependencies = [
  "der 0.8.0",
 ]
 
+[[package]]
+name = "sponge-cursor"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a0219bd7d979d58245a4f41f695e1ac9f8befdffadd7f61f1bae9e39abc6620"
+
 [[package]]
 name = "sqlite-wasm-rs"
 version = "0.5.3"
@@ -4943,9 +4969,9 @@ dependencies = [
 
 [[package]]
 name = "syn-solidity"
-version = "1.5.7"
+version = "1.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53f425ae0b12e2f5ae65542e00898d500d4d318b4baf09f40fd0d410454e9947"
+checksum = "ec005042c7d952febc1a3ef5b0f6674e9054aa836877a31c90b20e25b3d31744"
 dependencies = [
  "paste",
  "proc-macro2",
@@ -4979,12 +5005,6 @@ version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "55937e1799185b12863d447f42597ed69d9928686b8d88a1df17376a097d8369"
 
-[[package]]
-name = "target-triple"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "591ef38edfb78ca4771ee32cf494cb8771944bee237a9b91fc9c1424ac4b777b"
-
 [[package]]
 name = "tempfile"
 version = "3.27.0"
@@ -4998,15 +5018,6 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
-[[package]]
-name = "termcolor"
-version = "1.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "06794f8f6c5c898b3275aebefa6b8a1cb24cd2c6c79397ab15774837a0bc5755"
-dependencies = [
- "winapi-util",
-]
-
 [[package]]
 name = "terminal_size"
 version = "0.4.4"
@@ -5154,9 +5165,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.52.1"
+version = "1.52.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b67dee974fe86fd92cc45b7a95fdd2f99a36a6d7b0d431a231178d3d670bbcc6"
+checksum = "8fc7f01b389ac15039e4dc9531aa973a135d7a4135281b12d7c1bc79fd57fffe"
 dependencies = [
  "bytes",
  "libc",
@@ -5229,21 +5240,6 @@ dependencies = [
  "winnow 0.7.15",
 ]
 
-[[package]]
-name = "toml"
-version = "1.1.2+spec-1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "81f3d15e84cbcd896376e6730314d59fb5a87f31e4b038454184435cd57defee"
-dependencies = [
- "indexmap 2.14.0",
- "serde_core",
- "serde_spanned",
- "toml_datetime 1.1.1+spec-1.1.0",
- "toml_parser",
- "toml_writer",
- "winnow 1.0.2",
-]
-
 [[package]]
 name = "toml_datetime"
 version = "0.7.5+spec-1.1.0"
@@ -5283,17 +5279,11 @@ dependencies = [
  "winnow 1.0.2",
 ]
 
-[[package]]
-name = "toml_writer"
-version = "1.1.1+spec-1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "756daf9b1013ebe47a8776667b466417e2d4c5679d441c26230efd9ef78692db"
-
 [[package]]
 name = "tonic"
-version = "0.14.5"
+version = "0.14.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fec7c61a0695dc1887c1b53952990f3ad2e3a31453e1f49f10e75424943a93ec"
+checksum = "ac2a5518c70fa84342385732db33fb3f44bc4cc748936eb5833d2df34d6445ef"
 dependencies = [
  "async-trait",
  "axum",
@@ -5323,9 +5313,9 @@ dependencies = [
 
 [[package]]
 name = "tonic-build"
-version = "0.14.5"
+version = "0.14.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1882ac3bf5ef12877d7ed57aad87e75154c11931c2ba7e6cde5e22d63522c734"
+checksum = "c68f61875ac5293cf72e6c8cf0158086428c82c37229e98c840878f1706b0322"
 dependencies = [
  "prettyplease",
  "proc-macro2",
@@ -5335,9 +5325,9 @@ dependencies = [
 
 [[package]]
 name = "tonic-prost"
-version = "0.14.5"
+version = "0.14.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a55376a0bbaa4975a3f10d009ad763d8f4108f067c7c2e74f3001fb49778d309"
+checksum = "50849f68853be452acf590cde0b146665b8d507b3b8af17261df47e02c209ea0"
 dependencies = [
  "bytes",
  "prost",
@@ -5346,9 +5336,9 @@ dependencies = [
 
 [[package]]
 name = "tonic-prost-build"
-version = "0.14.5"
+version = "0.14.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3144df636917574672e93d0f56d7edec49f90305749c668df5101751bb8f95a"
+checksum = "654e5643eff75d7f8c99197ce1440ed19a3474eada74c12bbac488b2cafdae27"
 dependencies = [
  "prettyplease",
  "proc-macro2",
@@ -5476,22 +5466,6 @@ version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
 
-[[package]]
-name = "trybuild"
-version = "1.0.117"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0710d4dfbeae4f9c390baa784c49858a7468fa433f3fe5d0ec5ebef651cf59f9"
-dependencies = [
- "dissimilar",
- "glob",
- "serde",
- "serde_derive",
- "serde_json",
- "target-triple",
- "termcolor",
- "toml 1.1.2+spec-1.1.0",
-]
-
 [[package]]
 name = "typenum"
 version = "1.20.0"
@@ -6068,9 +6042,6 @@ name = "winnow"
 version = "0.7.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "df79d97927682d2fd8adb29682d1140b343be4ac0f08fd68b7765d9c059d3945"
-dependencies = [
- "memchr",
-]
 
 [[package]]
 name = "winnow"
@@ -6199,7 +6170,7 @@ dependencies = [
  "kem",
  "ml-kem",
  "rand_core 0.10.1",
- "sha3 0.11.0",
+ "sha3",
  "x25519-dalek 3.0.0-pre.6",
  "zeroize",
 ]
@@ -6247,10 +6218,11 @@ dependencies = [
 
 [[package]]
 name = "yasna"
-version = "0.5.2"
+version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e17bb3549cc1321ae1296b9cdc2698e2b6cb1992adfa19a8c72e5b7a738f44cd"
+checksum = "b5f6765e852b9b4dc8e2a76843e4d64d1cea8e79bcde0b6901aea8e7c7f08282"
 dependencies = [
+ "bit-vec 0.9.1",
  "time",
 ]
 

server/Cargo.toml

@@ -6,31 +6,31 @@ resolver = "3"
 
 
 [workspace.dependencies]
-alloy = "2.0.4"
+alloy = "2.1.0"
 async-trait = "0.1.89"
 base64 = "0.22.1"
-chrono = { version = "0.4.44", features = ["serde"] }
+chrono = { version = "0.4.45", features = ["serde"] }
 futures = "0.3.32"
 k256 = { version = "0.13.4", features = ["ecdsa", "pkcs8"] }
 kameo = {git = "https://github.com/hdbg/kameo.git", rev = "805b417"}
 kameo_actors = {git = "https://github.com/hdbg/kameo.git", rev = "805b417"}
 hmac = "0.13.0"
 miette = { version = "7.6.0", features = ["fancy", "serde"] }
-ml-dsa = { version = "0.1.0-rc.9", features = ["zeroize"] }
+ml-dsa = { version = "0.1.1", features = ["zeroize"] }
 mutants = "0.0.4"
-prost = "0.14.3"
-prost-types = { version = "0.14.3", features = ["chrono"] }
+prost = "0.14.4"
+prost-types = { version = "0.14.4", features = ["chrono"] }
 rand = "0.10.1"
-rcgen = { version = "0.14.7", features = [ "aws_lc_rs",  "pem", "x509-parser", "zeroize" ], default-features = false }
+rcgen = { version = "0.14.8", features = [ "aws_lc_rs",  "pem", "x509-parser", "zeroize" ], default-features = false }
 rstest = "0.26.1"
-rustls = { version = "0.23.40", features = ["aws-lc-rs", "logging", "prefer-post-quantum", "std"], default-features = false }
+rustls = { version = "0.23.41", features = ["aws-lc-rs", "logging", "prefer-post-quantum", "std"], default-features = false }
 rustls-pki-types = "1.14.1"
 sha2 = "0.11"
 smlang = "0.8.0"
 thiserror = "2.0.18"
-tokio = { version = "1.52.1", features = ["full"] }
+tokio = { version = "1.52.3", features = ["full"] }
 tokio-stream = { version = "0.1.18", features = ["full"] }
-tonic = { version = "0.14.5", features = [ "deflate", "gzip", "tls-connect-info", "zstd" ] }
+tonic = { version = "0.14.6", features = [ "deflate", "gzip", "tls-connect-info", "zstd" ] }
 tracing = "0.1.44"
 x25519-dalek = { version = "2.0.1", features = ["getrandom"] }
 
@@ -129,6 +129,7 @@ rc_buffer = "warn"
 rc_mutex = "warn"
 redundant_test_prefix = "warn"
 redundant_type_annotations = "warn"
+ref_patterns = "warn"
 renamed_function_params = "warn"
 rest_pat_in_fully_bound_structs = "warn"
 return_and_then = "warn"

server/crates/arbiter-client/Cargo.toml

@@ -20,7 +20,7 @@ tonic.features = ["tls-aws-lc"]
 tokio.workspace = true
 tokio-stream.workspace = true
 thiserror.workspace = true
-http = "1.4.0"
+http = "1.4.2"
 rustls-webpki = { version = "0.103.13", features = ["aws-lc-rs"] }
 async-trait.workspace = true
 chrono.workspace = true

server/crates/arbiter-crypto/src/authn/v1.rs

@@ -1,8 +1,8 @@
 use chrono::{DateTime, Utc};
 use hmac::digest::Digest;
 use ml_dsa::{
-    EncodedVerifyingKey, Error, KeyGen, MlDsa87, Seed, Signature as MlDsaSignature,
-    SigningKey as MlDsaSigningKey, VerifyingKey as MlDsaVerifyingKey, signature::Keypair as _,
+    EncodedVerifyingKey, Error, ExpandedSigningKey, Generate, MlDsa87, Seed,
+    Signature as MlDsaSignature, SigningKey as MlDsaSigningKey, VerifyingKey as MlDsaVerifyingKey,
 };
 use rand::RngExt;
 
@@ -77,7 +77,10 @@ impl crate::hashing::Hashable for PublicKey {
 pub struct Signature(Box<MlDsaSignature<KeyParams>>);
 
 #[derive(Debug)]
-pub struct SigningKey(Box<MlDsaSigningKey<KeyParams>>);
+pub struct SigningKey {
+    key: Box<ExpandedSigningKey<KeyParams>>,
+    seed: Seed,
+}
 
 impl PublicKey {
     pub fn to_bytes(&self) -> Vec<u8> {
@@ -100,24 +103,31 @@ impl Signature {
 
 impl SigningKey {
     pub fn generate() -> Self {
-        Self(Box::new(KeyParams::key_gen(&mut rand::rng())))
+        let seed = MlDsaSigningKey::<KeyParams>::generate_from_rng(&mut rand::rng()).to_seed();
+        Self {
+            key: Box::new(ExpandedSigningKey::from_seed(&seed)),
+            seed,
+        }
     }
 
     pub fn from_seed(seed: [u8; 32]) -> Self {
-        Self(Box::new(KeyParams::from_seed(&Seed::from(seed))))
+        let seed = Seed::from(seed);
+        Self {
+            key: Box::new(ExpandedSigningKey::from_seed(&seed)),
+            seed,
+        }
     }
 
     pub fn to_seed(&self) -> [u8; 32] {
-        self.0.to_seed().into()
+        self.seed.into()
     }
 
     pub fn public_key(&self) -> PublicKey {
-        self.0.verifying_key().into()
+        self.key.verifying_key().into()
     }
 
     pub fn sign_message(&self, message: &[u8], context: &[u8]) -> Result<Signature, Error> {
-        self.0
-            .signing_key()
+        self.key
             .sign_deterministic(message, context)
             .map(Into::into)
     }
@@ -145,12 +155,6 @@ impl From<MlDsaSignature<KeyParams>> for Signature {
     }
 }
 
-impl From<MlDsaSigningKey<KeyParams>> for SigningKey {
-    fn from(value: MlDsaSigningKey<KeyParams>) -> Self {
-        Self(Box::new(value))
-    }
-}
-
 impl TryFrom<Vec<u8>> for PublicKey {
     type Error = ();
 
@@ -188,15 +192,15 @@ impl TryFrom<&'_ [u8]> for Signature {
 
 #[cfg(test)]
 mod tests {
-    use ml_dsa::{KeyGen, MlDsa87, signature::Keypair as _};
+    use ml_dsa::{Generate as _, MlDsa87, SigningKey as RealSigningKey, signature::Keypair as _};
 
     use crate::authn::AuthChallenge;
 
-    use super::{CLIENT_CONTEXT, PublicKey, Signature, SigningKey, OPERATOR_CONTEXT};
+    use super::{CLIENT_CONTEXT, OPERATOR_CONTEXT, PublicKey, Signature, SigningKey};
 
     #[test]
     fn public_key_round_trip_decodes() {
-        let key = MlDsa87::key_gen(&mut rand::rng());
+        let key = RealSigningKey::<MlDsa87>::generate();
         let encoded = PublicKey::from(key.verifying_key()).to_bytes();
 
         let decoded = PublicKey::try_from(encoded.as_slice()).expect("public key should decode");

server/crates/arbiter-crypto/src/integrity.rs

@@ -1,49 +0,0 @@
-use crate::hashing::Hashable;
-
-/// Marks a struct as a participant in the database integrity system.
-///
-/// Implementors are protected by an HMAC-SHA256 MAC stored in the
-/// `integrity_envelope` table. The MAC is computed over:
-///
-/// ```text
-/// HMAC-SHA256(key, len(KIND) || KIND || len(entity_id) || entity_id || VERSION || SHA256(Hashable))
-/// ```
-///
-/// Both `KIND` and `VERSION` act as domain separators — they prevent a valid
-/// MAC for one entity type or schema version from being accepted for another.
-///
-/// # Deriving
-///
-/// Use `#[derive(Integrable)]` with the `#[integrable(kind = "...")]` attribute.
-/// `VERSION` is computed automatically as an FNV-1a hash of the struct's field
-/// names and types, so it changes whenever the schema changes without any manual
-/// bookkeeping.
-///
-/// ```rust,ignore
-/// #[derive(Hashable, Integrable)]
-/// #[integrable(kind = "operator_credentials")]
-/// pub struct OperatorCredentials {
-///     pub pubkey: PublicKey,
-/// }
-/// ```
-///
-/// # Upgrading schema
-///
-/// When fields are added, removed, or reordered, `VERSION` changes automatically.
-/// Existing MAC records in the database will return [`PayloadVersionMismatch`] on
-/// verification — this is the signal to re-sign all rows for this `KIND` as part
-/// of a migration.
-///
-/// [`PayloadVersionMismatch`]: crate::integrity::Integrable
-pub trait Integrable: Hashable {
-    /// Stable name of this entity type as stored in `integrity_envelope.entity_kind`.
-    ///
-    /// Must be a valid schema name: starts with a letter, contains only `[a-zA-Z0-9_]`,
-    /// and must be globally unique across all `Integrable` types in the system.
-    const KIND: &'static str;
-
-    /// FNV-1a hash of the struct's field names and types at the time the derive
-    /// macro ran. Changes automatically when the schema changes, invalidating
-    /// existing MACs and signalling that a migration is required.
-    const VERSION: i32;
-}

server/crates/arbiter-crypto/src/lib.rs

@@ -1,7 +1,6 @@
 #[cfg(feature = "authn")]
 pub mod authn;
 pub mod hashing;
-pub mod integrity;
 #[cfg(feature = "safecell")]
 pub mod safecell;
 

server/crates/arbiter-macros/Cargo.toml

@@ -14,7 +14,6 @@ syn = { version = "2.0", features = ["derive", "fold", "full", "visit-mut"] }
 
 [dev-dependencies]
 arbiter-crypto = { path = "../arbiter-crypto" }
-trybuild = { version = "1.0", features = ["diff"] }
 
 [lints]
 workspace = true

server/crates/arbiter-macros/src/hashable.rs

@@ -53,16 +53,32 @@ struct FieldAccess {
 
 fn collect_field_accesses(struct_data: &DataStruct) -> Vec<FieldAccess> {
     match &struct_data.fields {
-        Fields::Named(fields) => crate::utils::sorted_named_fields(fields)
-            .into_iter()
-            .map(|field| {
-                let name = field.ident.as_ref().unwrap();
-                FieldAccess {
+        Fields::Named(fields) => {
+            // Keep deterministic alphabetical order for named fields.
+            // Do not remove this sort, because it keeps hash output stable regardless of source order.
+            let mut named_fields = fields
+                .named
+                .iter()
+                .map(|field| {
+                    let name = field
+                        .ident
+                        .as_ref()
+                        .expect("Fields::Named(fields) must have names")
+                        .clone();
+                    (name.to_string(), name)
+                })
+                .collect::<Vec<_>>();
+
+            named_fields.sort_by(|a, b| a.0.cmp(&b.0));
+
+            named_fields
+                .into_iter()
+                .map(|(_, name)| FieldAccess {
                     access: quote! { #name },
                     span: name.span(),
-                }
-            })
-            .collect(),
+                })
+                .collect()
+        }
         Fields::Unnamed(fields) => fields
             .unnamed
             .iter()

server/crates/arbiter-macros/src/integrable.rs

@@ -1,134 +0,0 @@
-use crate::utils::INTEGRABLE_TRAIT_PATH;
-use proc_macro2::TokenStream;
-use quote::quote;
-use syn::{DeriveInput, LitStr, spanned::Spanned as _};
-
-struct IntegrableAttr {
-    kind: String,
-}
-
-impl IntegrableAttr {
-    fn from_attrs(
-        attrs: &[syn::Attribute],
-        ident_span: proc_macro2::Span,
-    ) -> Result<Self, syn::Error> {
-        let mut kind: Option<String> = None;
-        let mut found = false;
-
-        for attr in attrs {
-            if !attr.path().is_ident("integrable") {
-                continue;
-            }
-            if found {
-                return Err(syn::Error::new(attr.span(), "duplicate #[integrable] attribute"));
-            }
-            found = true;
-            attr.parse_nested_meta(|meta| {
-                if meta.path.is_ident("kind") {
-                    let lit: LitStr = meta.value()?.parse()?;
-                    let v = lit.value();
-                    if v.is_empty() {
-                        return Err(syn::Error::new(lit.span(), "kind must not be empty"));
-                    }
-                    if !is_valid_kind(&v) {
-                        return Err(syn::Error::new(
-                            lit.span(),
-                            "kind must be a valid schema name: start with a letter, contain only [a-zA-Z0-9_]",
-                        ));
-                    }
-                    kind = Some(v);
-                } else {
-                    return Err(meta.error("unknown key; expected `kind`"));
-                }
-                Ok(())
-            })?;
-        }
-
-        let kind = kind.ok_or_else(|| {
-            syn::Error::new(ident_span, "#[integrable(kind = \"...\")] is required")
-        })?;
-
-        Ok(Self { kind })
-    }
-}
-
-fn is_valid_kind(s: &str) -> bool {
-    let mut chars = s.chars();
-    matches!(chars.next(), Some(c) if c.is_ascii_alphabetic())
-        && chars.all(|c| c.is_ascii_alphanumeric() || c == '_')
-}
-
-fn fnv1a(data: &[u8], mut hash: u32) -> u32 {
-    const FNV_PRIME: u32 = 16_777_619;
-    for &b in data {
-        hash ^= u32::from(b);
-        hash = hash.wrapping_mul(FNV_PRIME);
-    }
-    hash
-}
-
-// Hashes field names and types using the same alphabetical sort order as Hashable,
-// so that source-level field reordering never changes VERSION.
-fn compute_version(fields: &syn::Fields) -> i32 {
-    const FNV_OFFSET: u32 = 2_166_136_261;
-    let mut hash = FNV_OFFSET;
-
-    match fields {
-        syn::Fields::Named(named) => {
-            for field in crate::utils::sorted_named_fields(named) {
-                let name = field.ident.as_ref().unwrap().to_string();
-                let ty = &field.ty;
-                hash = fnv1a(name.as_bytes(), hash);
-                hash = fnv1a(quote!(#ty).to_string().as_bytes(), hash);
-            }
-        }
-        syn::Fields::Unnamed(unnamed) => {
-            for (i, field) in unnamed.unnamed.iter().enumerate() {
-                let ty = &field.ty;
-                hash = fnv1a(i.to_string().as_bytes(), hash);
-                hash = fnv1a(quote!(#ty).to_string().as_bytes(), hash);
-            }
-        }
-        syn::Fields::Unit => {}
-    }
-
-    // Clear sign bit to guarantee a positive i32; substitute 0 → 1.
-    let v = (hash >> 1).cast_signed();
-    if v == 0 { 1 } else { v }
-}
-
-pub(crate) fn derive(input: &DeriveInput) -> TokenStream {
-    let syn::Data::Struct(ref data) = input.data else {
-        return syn::Error::new(
-            input.ident.span(),
-            "#[derive(Integrable)] is only supported on structs",
-        )
-        .to_compile_error();
-    };
-
-    let integrable_trait = INTEGRABLE_TRAIT_PATH.to_path();
-    let hashable_trait = crate::utils::HASHABLE_TRAIT_PATH.to_path();
-    let ident = &input.ident;
-
-    let mut generics = input.generics.clone();
-    for type_param in generics.type_params_mut() {
-        type_param.bounds.push(syn::parse_quote!(#hashable_trait));
-    }
-    let (impl_generics, ty_generics, where_clause) = generics.split_for_impl();
-
-    let attr = match IntegrableAttr::from_attrs(&input.attrs, input.ident.span()) {
-        Ok(a) => a,
-        Err(e) => return e.to_compile_error(),
-    };
-
-    let kind = attr.kind;
-    let version = compute_version(&data.fields);
-
-    quote! {
-        #[automatically_derived]
-        impl #impl_generics #integrable_trait for #ident #ty_generics #where_clause {
-            const KIND: &'static str = #kind;
-            const VERSION: i32 = #version;
-        }
-    }
-}

server/crates/arbiter-macros/src/lib.rs

@@ -1,7 +1,6 @@
 use syn::{DeriveInput, parse_macro_input};
 
 mod hashable;
-mod integrable;
 mod utils;
 
 #[proc_macro_derive(Hashable)]
@@ -9,9 +8,3 @@ pub fn derive_hashable(input: proc_macro::TokenStream) -> proc_macro::TokenStrea
     let input = parse_macro_input!(input as DeriveInput);
     hashable::derive(&input).into()
 }
-
-#[proc_macro_derive(Integrable, attributes(integrable))]
-pub fn derive_integrable(input: proc_macro::TokenStream) -> proc_macro::TokenStream {
-    let input = parse_macro_input!(input as DeriveInput);
-    integrable::derive(&input).into()
-}

server/crates/arbiter-macros/src/utils.rs

@@ -22,14 +22,3 @@ macro_rules! ensure_path {
 
 ensure_path!(::arbiter_crypto::hashing::Hashable as HASHABLE_TRAIT_PATH);
 ensure_path!(::arbiter_crypto::hashing::Digest as HMAC_DIGEST_PATH);
-ensure_path!(::arbiter_crypto::integrity::Integrable as INTEGRABLE_TRAIT_PATH);
-
-/// Returns named struct fields sorted alphabetically by name.
-/// Both `Hashable` and `Integrable` derive macros must iterate fields in the
-/// same deterministic order so that source-level reordering never changes
-/// either the runtime hash or the compile-time VERSION.
-pub(crate) fn sorted_named_fields(fields: &syn::FieldsNamed) -> Vec<&syn::Field> {
-    let mut v: Vec<&syn::Field> = fields.named.iter().collect();
-    v.sort_by_key(|f| f.ident.as_ref().unwrap().to_string());
-    v
-}

server/crates/arbiter-macros/tests/integrable.rs

@@ -1,53 +0,0 @@
-use arbiter_crypto::integrity::Integrable;
-
-#[derive(arbiter_macros::Hashable, arbiter_macros::Integrable)]
-#[integrable(kind = "test_entity")]
-struct TestEntity {
-    value: i32,
-}
-
-#[derive(arbiter_macros::Hashable, arbiter_macros::Integrable)]
-#[integrable(kind = "other_entity")]
-struct OtherEntity {
-    label: String,
-    count: u64,
-}
-
-#[test]
-fn kind_is_set_correctly() {
-    assert_eq!(<TestEntity as Integrable>::KIND, "test_entity");
-    assert_eq!(<OtherEntity as Integrable>::KIND, "other_entity");
-}
-
-#[test]
-fn version_is_positive() {
-    const {
-        assert!(<TestEntity as Integrable>::VERSION > 0);
-        assert!(<OtherEntity as Integrable>::VERSION > 0);
-    }
-}
-
-#[test]
-fn different_field_layouts_produce_different_versions() {
-    assert_ne!(
-        <TestEntity as Integrable>::VERSION,
-        <OtherEntity as Integrable>::VERSION,
-    );
-}
-
-#[derive(arbiter_macros::Hashable, arbiter_macros::Integrable)]
-#[integrable(kind = "generic_entity")]
-struct GenericEntity<T> {
-    inner: T,
-}
-
-#[test]
-fn generic_struct_derives_integrable() {
-    assert_eq!(
-        <GenericEntity<TestEntity> as Integrable>::KIND,
-        "generic_entity"
-    );
-    const {
-        assert!(<GenericEntity<TestEntity> as Integrable>::VERSION > 0);
-    }
-}

server/crates/arbiter-macros/tests/integrable_errors.rs

@@ -1,5 +0,0 @@
-#[test]
-fn integrable_compile_fail() {
-    let t = trybuild::TestCases::new();
-    t.compile_fail("tests/ui/integrable/*.rs");
-}

server/crates/arbiter-macros/tests/ui/integrable/duplicate_attr.rs

@@ -1,8 +0,0 @@
-#[derive(arbiter_macros::Hashable, arbiter_macros::Integrable)]
-#[integrable(kind = "entity_a")]
-#[integrable(kind = "entity_b")]
-struct DuplicateAttr {
-    value: i32,
-}
-
-fn main() {}

server/crates/arbiter-macros/tests/ui/integrable/duplicate_attr.stderr

@@ -1,5 +0,0 @@
-error: duplicate #[integrable] attribute
- --> tests/ui/integrable/duplicate_attr.rs:3:1
-  |
-3 | #[integrable(kind = "entity_b")]
-  | ^

server/crates/arbiter-macros/tests/ui/integrable/empty_kind.rs

@@ -1,7 +0,0 @@
-#[derive(arbiter_macros::Hashable, arbiter_macros::Integrable)]
-#[integrable(kind = "")]
-struct EmptyKind {
-    value: i32,
-}
-
-fn main() {}

server/crates/arbiter-macros/tests/ui/integrable/empty_kind.stderr

@@ -1,5 +0,0 @@
-error: kind must not be empty
- --> tests/ui/integrable/empty_kind.rs:2:21
-  |
-2 | #[integrable(kind = "")]
-  |                     ^^

server/crates/arbiter-macros/tests/ui/integrable/enum_not_supported.rs

@@ -1,8 +0,0 @@
-#[derive(arbiter_macros::Integrable)]
-#[integrable(kind = "my_enum")]
-enum MyEnum {
-    A,
-    B,
-}
-
-fn main() {}

server/crates/arbiter-macros/tests/ui/integrable/enum_not_supported.stderr

@@ -1,5 +0,0 @@
-error: #[derive(Integrable)] is only supported on structs
- --> tests/ui/integrable/enum_not_supported.rs:3:6
-  |
-3 | enum MyEnum {
-  |      ^^^^^^

server/crates/arbiter-macros/tests/ui/integrable/invalid_kind.rs

@@ -1,7 +0,0 @@
-#[derive(arbiter_macros::Hashable, arbiter_macros::Integrable)]
-#[integrable(kind = "bad kind!")]
-struct InvalidKind {
-    value: i32,
-}
-
-fn main() {}

server/crates/arbiter-macros/tests/ui/integrable/invalid_kind.stderr

@@ -1,5 +0,0 @@
-error: kind must be a valid schema name: start with a letter, contain only [a-zA-Z0-9_]
- --> tests/ui/integrable/invalid_kind.rs:2:21
-  |
-2 | #[integrable(kind = "bad kind!")]
-  |                     ^^^^^^^^^^^

server/crates/arbiter-macros/tests/ui/integrable/missing_attr.rs

@@ -1,6 +0,0 @@
-#[derive(arbiter_macros::Hashable, arbiter_macros::Integrable)]
-struct MissingAttr {
-    value: i32,
-}
-
-fn main() {}

server/crates/arbiter-macros/tests/ui/integrable/missing_attr.stderr

@@ -1,5 +0,0 @@
-error: #[integrable(kind = "...")] is required
- --> tests/ui/integrable/missing_attr.rs:2:8
-  |
-2 | struct MissingAttr {
-  |        ^^^^^^^^^^^

server/crates/arbiter-proto/Cargo.toml

@@ -9,7 +9,7 @@ license = "Apache-2.0"
 tonic.workspace = true
 tokio.workspace = true
 futures.workspace = true
-tonic-prost = "0.14.5"
+tonic-prost = "0.14.6"
 prost.workspace = true
 kameo.workspace = true
 url = "2.5.8"
@@ -22,7 +22,7 @@ async-trait.workspace = true
 tokio-stream.workspace = true
 
 [build-dependencies]
-tonic-prost-build = "0.14.5"
+tonic-prost-build = "0.14.6"
 
 [dev-dependencies]
 rstest.workspace = true

server/crates/arbiter-server/Cargo.toml

@@ -9,8 +9,8 @@ license = "Apache-2.0"
 workspace = true
 
 [dependencies]
-diesel = { version = "2.3.9", features = ["chrono", "returning_clauses_for_sqlite_3_35", "serde_json", "time", "uuid"] }
-diesel-async = { version = "0.9.0", features = [
+diesel = { version = "2.3.10", features = ["chrono", "returning_clauses_for_sqlite_3_35", "serde_json", "time", "uuid"] }
+diesel-async = { version = "0.9.2", features = [
     "bb8",
     "migrations",
     "sqlite",
@@ -44,7 +44,7 @@ hmac.workspace = true
 alloy.workspace = true
 prost-types.workspace = true
 arbiter-tokens-registry.path = "../arbiter-tokens-registry"
-anyhow = "1.0.102"
+anyhow = "1.0.103"
 mutants.workspace = true
 subtle = "2.6.1"
 x25519-dalek.workspace = true

server/crates/arbiter-server/src/crypto/integrity/v1.rs

@@ -52,7 +52,10 @@ pub const INTEGRITY_SUBKEY_TAG: &[u8] = b"arbiter/db-integrity-key/v1";
 
 pub type HmacSha256 = Hmac<Sha256>;
 
-pub use arbiter_crypto::integrity::Integrable;
+pub trait Integrable: Hashable {
+    const KIND: &'static str;
+    const VERSION: i32 = 1;
+}
 
 fn payload_hash(payload: &impl Hashable) -> [u8; 32] {
     let mut hasher = Sha256::new();
@@ -214,13 +217,15 @@ mod tests {
     };
     use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
 
-    use super::{Error, sign_entity, verify_entity};
-    #[derive(Clone, arbiter_macros::Hashable, arbiter_macros::Integrable)]
-    #[integrable(kind = "dummy_entity")]
+    use super::{Error, Integrable, sign_entity, verify_entity};
+    #[derive(Clone, arbiter_macros::Hashable)]
     struct DummyEntity {
         payload_version: i32,
         payload: Vec<u8>,
     }
+    impl Integrable for DummyEntity {
+        const KIND: &'static str = "dummy_entity";
+    }
 
     async fn bootstrapped_vault(db: &db::DatabasePool) -> ActorRef<Vault> {
         let actor = Vault::spawn(

server/crates/arbiter-server/src/evm/policies/ether_transfer/mod.rs

@@ -1,5 +1,6 @@
 use super::{DatabaseID, EvalContext, EvalViolation};
 use crate::{
+    crypto::integrity::v1::Integrable,
     db::models::{
         EvmBasicGrant, EvmEtherTransferGrant, EvmEtherTransferGrantTarget, EvmEtherTransferLimit,
         NewEvmEtherTransferLimit, SqliteTimestamp,
@@ -51,12 +52,14 @@ impl From<Meaning> for SpecificMeaning {
 }
 
 // A grant for ether transfers, which can be scoped to specific target addresses and volume limits
-#[derive(Debug, Clone, arbiter_macros::Hashable, arbiter_macros::Integrable)]
-#[integrable(kind = "EtherTransfer")]
+#[derive(Debug, Clone, arbiter_macros::Hashable)]
 pub struct Settings {
     pub target: Vec<Address>,
     pub limit: VolumeRateLimit,
 }
+impl Integrable for Settings {
+    const KIND: &'static str = "EtherTransfer";
+}
 
 impl From<Settings> for SpecificGrant {
     fn from(val: Settings) -> Self {

server/crates/arbiter-server/src/evm/policies/token_transfers/mod.rs

@@ -1,5 +1,6 @@
 use super::{DatabaseID, EvalContext, EvalViolation};
 use crate::{
+    crypto::integrity::Integrable,
     db::models::{
         EvmBasicGrant, EvmTokenTransferGrant, EvmTokenTransferVolumeLimit,
         NewEvmTokenTransferGrant, NewEvmTokenTransferLog, NewEvmTokenTransferVolumeLimit,
@@ -62,13 +63,15 @@ impl From<Meaning> for SpecificMeaning {
 }
 
 // A grant for token transfers, which can be scoped to specific target addresses and volume limits
-#[derive(Debug, Clone, arbiter_macros::Hashable, arbiter_macros::Integrable)]
-#[integrable(kind = "TokenTransfer")]
+#[derive(Debug, Clone, arbiter_macros::Hashable)]
 pub struct Settings {
     pub token_contract: Address,
     pub target: Option<Address>,
     pub volume_limits: Vec<VolumeRateLimit>,
 }
+impl Integrable for Settings {
+    const KIND: &'static str = "TokenTransfer";
+}
 
 impl From<Settings> for SpecificGrant {
     fn from(val: Settings) -> Self {

server/crates/arbiter-server/src/peers/client/mod.rs

@@ -1,5 +1,5 @@
 use crate::{
-    actors::GlobalActors, db, peers::client::session::ClientSession,
+    actors::GlobalActors, crypto::integrity::Integrable, db, peers::client::session::ClientSession,
 };
 use arbiter_crypto::authn;
 use arbiter_macros::Hashable;
@@ -14,12 +14,15 @@ pub struct ClientProfile {
     pub metadata: ClientMetadata,
 }
 
-#[derive(Hashable, arbiter_macros::Integrable)]
-#[integrable(kind = "client_credentials")]
+#[derive(Hashable)]
 pub struct ClientCredentials {
     pub pubkey: authn::PublicKey,
 }
 
+impl Integrable for ClientCredentials {
+    const KIND: &'static str = "client_credentials";
+}
+
 pub struct ClientConnection {
     pub(crate) db: db::DatabasePool,
     pub(crate) actors: GlobalActors,

server/crates/arbiter-server/src/peers/operator/mod.rs

@@ -3,7 +3,7 @@ use crate::{
         GlobalActors,
         vault::{GetState, Vault},
     },
-    crypto::integrity::{self, AttestationStatus},
+    crypto::integrity::{self, AttestationStatus, Integrable},
     db::{DatabaseError, DatabasePool},
     peers::client::ClientProfile,
 };
@@ -23,13 +23,16 @@ pub mod auth;
 pub mod session;
 pub mod vault_gate;
 
-#[derive(Debug, Clone, Hashable, arbiter_macros::Integrable)]
-#[integrable(kind = "operator_credentials")]
+#[derive(Debug, Clone, Hashable)]
 pub struct Credentials {
     pub id: i32,
     pub pubkey: authn::PublicKey,
 }
 
+impl Integrable for Credentials {
+    const KIND: &'static str = "operator_credentials";
+}
+
 // Messages, sent by operator to connection client without having a request
 #[derive(Debug)]
 pub enum OutOfBand {

server/crates/arbiter-server/tests/client/auth.rs

@@ -16,7 +16,7 @@ use arbiter_server::{
 
 use diesel::{ExpressionMethods as _, NullableExpressionMethods as _, QueryDsl as _, insert_into};
 use diesel_async::RunQueryDsl;
-use ml_dsa::{KeyGen, MlDsa87, SigningKey, VerifyingKey, signature::Keypair};
+use ml_dsa::{Generate as _, MlDsa87, SigningKey, VerifyingKey, signature::Keypair};
 
 fn metadata(name: &str, description: Option<&str>, version: Option<&str>) -> ClientMetadata {
     ClientMetadata {
@@ -73,7 +73,7 @@ async fn insert_registered_client(
 
 fn sign_client_challenge(key: &SigningKey<MlDsa87>, challenge: &AuthChallenge) -> authn::Signature {
     let challenge = challenge.format();
-    key.signing_key()
+    key.expanded_key()
         .sign_deterministic(&challenge, CLIENT_CONTEXT)
         .unwrap()
         .into()
@@ -81,7 +81,7 @@ fn sign_client_challenge(key: &SigningKey<MlDsa87>, challenge: &AuthChallenge) -
 
 async fn insert_bootstrap_sentinel_operator(db: &db::DatabasePool) {
     let mut conn = db.get().await.unwrap();
-    let sentinel_key = verifying_key(&MlDsa87::key_gen(&mut rand::rng()))
+    let sentinel_key = verifying_key(&SigningKey::<MlDsa87>::generate())
         .encode()
         .0
         .to_vec();
@@ -120,7 +120,7 @@ pub async fn unregistered_pubkey_rejected() {
         connect_client(props, &mut server_transport).await;
     });
 
-    let new_key = MlDsa87::key_gen(&mut rand::rng());
+    let new_key = SigningKey::<MlDsa87>::generate();
 
     test_transport
         .send(auth::Inbound::AuthChallengeRequest {
@@ -140,7 +140,7 @@ pub async fn challenge_auth() {
     let db = db::create_test_pool().await;
     let actors = spawn_test_actors(&db).await;
 
-    let new_key = MlDsa87::key_gen(&mut rand::rng());
+    let new_key = SigningKey::<MlDsa87>::generate();
 
     Box::pin(insert_registered_client(
         &db,
@@ -206,7 +206,7 @@ pub async fn challenge_auth() {
 pub async fn metadata_unchanged_does_not_append_history() {
     let db = db::create_test_pool().await;
     let actors = spawn_test_actors(&db).await;
-    let new_key = MlDsa87::key_gen(&mut rand::rng());
+    let new_key = SigningKey::<MlDsa87>::generate();
     let requested = metadata("client", Some("desc"), Some("1.0.0"));
 
     Box::pin(insert_registered_client(
@@ -269,7 +269,7 @@ pub async fn metadata_unchanged_does_not_append_history() {
 pub async fn metadata_change_appends_history_and_repoints_binding() {
     let db = db::create_test_pool().await;
     let actors = spawn_test_actors(&db).await;
-    let new_key = MlDsa87::key_gen(&mut rand::rng());
+    let new_key = SigningKey::<MlDsa87>::generate();
 
     Box::pin(insert_registered_client(
         &db,
@@ -357,7 +357,7 @@ pub async fn challenge_auth_rejects_integrity_tag_mismatch() {
     let db = db::create_test_pool().await;
     let actors = spawn_test_actors(&db).await;
 
-    let new_key = MlDsa87::key_gen(&mut rand::rng());
+    let new_key = SigningKey::<MlDsa87>::generate();
     let requested = metadata("client", Some("desc"), Some("1.0.0"));
 
     {

server/crates/arbiter-server/tests/operator/auth.rs

@@ -14,7 +14,7 @@ use arbiter_server::{
 use async_trait::async_trait;
 use diesel::{ExpressionMethods as _, QueryDsl, insert_into};
 use diesel_async::RunQueryDsl;
-use ml_dsa::{KeyGen, MlDsa87, SigningKey, VerifyingKey, signature::Keypair};
+use ml_dsa::{Generate as _, MlDsa87, SigningKey, VerifyingKey, signature::Keypair};
 use tokio::sync::mpsc;
 
 fn verifying_key(key: &SigningKey<MlDsa87>) -> VerifyingKey<MlDsa87> {
@@ -26,7 +26,7 @@ fn sign_operator_challenge(
     challenge: &AuthChallenge,
 ) -> authn::Signature {
     let challenge = challenge.format();
-    key.signing_key()
+    key.expanded_key()
         .sign_deterministic(&challenge, OPERATOR_CONTEXT)
         .unwrap()
         .into()
@@ -170,7 +170,7 @@ pub async fn bootstrap_token_auth() {
         auth::authenticate(&mut props, &mut server_transport).await
     });
 
-    let new_key = MlDsa87::key_gen(&mut rand::rng());
+    let new_key = SigningKey::<MlDsa87>::generate();
     test_transport
         .send(auth::Inbound::AuthChallengeRequest {
             pubkey: verifying_key(&new_key).into(),
@@ -227,7 +227,7 @@ pub async fn bootstrap_invalid_token_auth() {
         auth::authenticate(&mut props, &mut server_transport).await
     });
 
-    let new_key = MlDsa87::key_gen(&mut rand::rng());
+    let new_key = SigningKey::<MlDsa87>::generate();
     test_transport
         .send(auth::Inbound::AuthChallengeRequest {
             pubkey: verifying_key(&new_key).into(),
@@ -280,7 +280,7 @@ pub async fn challenge_auth() {
         .await
         .unwrap();
 
-    let new_key = MlDsa87::key_gen(&mut rand::rng());
+    let new_key = SigningKey::<MlDsa87>::generate();
     let pubkey_bytes = authn::PublicKey::from(verifying_key(&new_key)).to_bytes();
 
     {
@@ -366,7 +366,7 @@ pub async fn challenge_auth_rejects_integrity_tag_mismatch_when_unsealed() {
         .await
         .unwrap();
 
-    let new_key = MlDsa87::key_gen(&mut rand::rng());
+    let new_key = SigningKey::<MlDsa87>::generate();
     let pubkey_bytes = authn::PublicKey::from(verifying_key(&new_key)).to_bytes();
 
     {
@@ -439,7 +439,7 @@ pub async fn challenge_auth_rejects_invalid_signature() {
         .await
         .unwrap();
 
-    let new_key = MlDsa87::key_gen(&mut rand::rng());
+    let new_key = SigningKey::<MlDsa87>::generate();
     let pubkey_bytes = authn::PublicKey::from(verifying_key(&new_key)).to_bytes();
 
     {