feat(server): implement KeyStorage and state machine lifecycle

feat(tls): implement TLS certificate management and rotation
security(server): cargo-vet proper init
2026-02-16 15:57:14 +01:00 · 2026-02-16 15:57:00 +01:00 · 2026-02-14 19:16:09 +01:00 · 2026-02-14 19:04:50 +01:00
17 changed files with 119 additions and 962 deletions
--- a/protobufs/arbiter.proto
+++ b/protobufs/arbiter.proto
@@ -22,14 +22,12 @@ message UserAgentRequest {
  oneof payload {
    arbiter.auth.ClientMessage auth_message = 1;
    CertRotationAck cert_rotation_ack = 2;
-    UnsealRequest unseal_request = 3;
  }
 }
 message UserAgentResponse {
  oneof payload {
    arbiter.auth.ServerMessage auth_message = 1;
    CertRotationNotification cert_rotation_notification = 2;
-    UnsealResponse unseal_response = 3;
  }
 }

@@ -64,50 +62,6 @@ message CertRotationAck {
  bool cert_saved = 3;
 }

-// Vault Unseal Protocol (X25519 ECDH + ChaCha20Poly1305)
-message UnsealRequest {
-  oneof payload {
-    EphemeralKeyRequest ephemeral_key_request = 1;
-    SealedPassword sealed_password = 2;
-  }
-}
-
-message UnsealResponse {
-  oneof payload {
-    EphemeralKeyResponse ephemeral_key_response = 1;
-    UnsealResult unseal_result = 2;
-  }
-}
-
-message EphemeralKeyRequest {}
-
-message EphemeralKeyResponse {
-  // Server's X25519 ephemeral public key (32 bytes)
-  bytes server_pubkey = 1;
-
-  // Unix timestamp when this key expires (60 seconds from generation)
-  int64 expires_at = 2;
-}
-
-message SealedPassword {
-  // Client's X25519 ephemeral public key (32 bytes)
-  bytes client_pubkey = 1;
-
-  // ChaCha20Poly1305 encrypted password (ciphertext + tag)
-  bytes encrypted_password = 2;
-
-  // 12-byte nonce for ChaCha20Poly1305
-  bytes nonce = 3;
-}
-
-message UnsealResult {
-  // Whether unseal was successful
-  bool success = 1;
-
-  // Error message if unseal failed
-  optional string error_message = 2;
-}
-
 service ArbiterService {
  rpc Client(stream ClientRequest) returns (stream ClientResponse);
  rpc UserAgent(stream UserAgentRequest) returns (stream UserAgentResponse);
--- a/scripts/pycache/gen_erc20_registry.cpython-314.pyc
+++ b/scripts/pycache/gen_erc20_registry.cpython-314.pyc
--- a/server/Cargo.lock
+++ b/server/Cargo.lock
@@ -47,9 +47,9 @@ dependencies = [

 [[package]]
 name = "anyhow"
-version = "1.0.102"
+version = "1.0.101"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
+checksum = "5f0e0fee31ef5ed1ba1316088939cea399010ed7731dba877ed44aeb407a75ea"

 [[package]]
 name = "arbiter-client"
@@ -64,7 +64,6 @@ dependencies = [
 "kameo",
 "prost",
 "prost-build",
- "prost-types",
 "serde_json",
 "tokio",
 "tonic",
@@ -102,7 +101,6 @@ dependencies = [
 "tokio-stream",
 "tonic",
 "tracing",
- "x25519-dalek",
 "zeroize",
 ]

@@ -146,7 +144,7 @@ checksum = "3109e49b1e4909e9db6515a30c633684d68cdeaa252f215214cb4fa1a5bfee2c"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 2.0.117",
+ "syn 2.0.116",
 "synstructure",
 ]

@@ -158,7 +156,7 @@ checksum = "7b18050c2cd6fe86c3a76584ef5e0baf286d038cda203eb6223df2cc413565f7"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 2.0.117",
+ "syn 2.0.116",
 ]

 [[package]]
@@ -169,7 +167,7 @@ checksum = "9035ad2d096bed7955a320ee7e2230574d28fd3c3a0f186cbea1ff3c7eed5dbb"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 2.0.117",
+ "syn 2.0.116",
 ]

 [[package]]
@@ -186,9 +184,9 @@ checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"

 [[package]]
 name = "aws-lc-rs"
-version = "1.16.1"
+version = "1.15.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94bffc006df10ac2a68c83692d734a465f8ee6c5b384d8545a636f81d858f4bf"
+checksum = "7b7b6141e96a8c160799cc2d5adecd5cbbe5054cb8c7c4af53da0f83bb7ad256"
 dependencies = [
 "aws-lc-sys",
 "untrusted 0.7.1",
@@ -197,9 +195,9 @@ dependencies = [

 [[package]]
 name = "aws-lc-sys"
-version = "0.38.0"
+version = "0.37.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4321e568ed89bb5a7d291a7f37997c2c0df89809d7b6d12062c81ddb54aa782e"
+checksum = "b092fe214090261288111db7a2b2c2118e5a7f30dc2569f1732c4069a6840549"
 dependencies = [
 "cc",
 "cmake",
@@ -324,18 +322,18 @@ dependencies = [

 [[package]]
 name = "block-buffer"
-version = "0.12.0"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cdd35008169921d80bc60d3d0ab416eecb028c4cd653352907921d95084790be"
+checksum = "96eb4cdd6cf1b31d671e9efe75c5d1ec614776856cefbe109ca373554a6d514f"
 dependencies = [
 "hybrid-array",
 ]

 [[package]]
 name = "bumpalo"
-version = "3.20.2"
+version = "3.19.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d20789868f4b01b2f2caec9f5c4e0213b41e3e5702a50157d699ae31ced2fcb"
+checksum = "5dd9dc738b7a8311c7ade152424974d8115f2cdad61e8dab8dac9f2362298510"

 [[package]]
 name = "bytes"
@@ -398,9 +396,9 @@ dependencies = [

 [[package]]
 name = "chrono"
-version = "0.4.44"
+version = "0.4.43"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c673075a2e0e5f4a1dde27ce9dee1ea4558c7ffe648f576438a20ca1d2acc4b0"
+checksum = "fac4744fb15ae8337dc853fee7fb3f4e48c0fbaa23d0afe49c447b4fab126118"
 dependencies = [
 "iana-time-zone",
 "js-sys",
@@ -482,28 +480,13 @@ dependencies = [

 [[package]]
 name = "crypto-common"
-version = "0.2.1"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77727bb15fa921304124b128af125e7e3b968275d1b108b379190264f4423710"
+checksum = "211f05e03c7d03754740fd9e585de910a095d6b99f8bcfffdef8319fa02a8331"
 dependencies = [
 "hybrid-array",
 ]

-[[package]]
-name = "curve25519-dalek"
-version = "4.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97fb8b7c4503de7d6ae7b42ab72a5a59857b4c937ec27a3d4539dba95b5ab2be"
-dependencies = [
- "cfg-if",
- "cpufeatures 0.2.17",
- "curve25519-dalek-derive",
- "fiat-crypto 0.2.9",
- "rustc_version",
- "subtle",
- "zeroize",
-]
-
 [[package]]
 name = "curve25519-dalek"
 version = "5.0.0-pre.6"
@@ -513,8 +496,8 @@ dependencies = [
 "cfg-if",
 "cpufeatures 0.2.17",
 "curve25519-dalek-derive",
- "digest 0.11.1",
- "fiat-crypto 0.3.0",
+ "digest 0.11.0",
+ "fiat-crypto",
 "rustc_version",
 "subtle",
 "zeroize",
@@ -528,7 +511,7 @@ checksum = "f46882e17999c6cc590af592290432be3bce0428cb0d5f8b6715e4dc7b383eb3"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 2.0.117",
+ "syn 2.0.116",
 ]

 [[package]]
@@ -552,7 +535,7 @@ dependencies = [
 "proc-macro2",
 "quote",
 "strsim",
- "syn 2.0.117",
+ "syn 2.0.116",
 ]

 [[package]]
@@ -563,7 +546,7 @@ checksum = "d38308df82d1080de0afee5d069fa14b0326a88c14f15c5ccda35b4a6c414c81"
 dependencies = [
 "darling_core",
 "quote",
- "syn 2.0.117",
+ "syn 2.0.116",
 ]

 [[package]]
@@ -602,9 +585,9 @@ dependencies = [

 [[package]]
 name = "deranged"
-version = "0.5.8"
+version = "0.5.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
+checksum = "cc3dc5ad92c2e2d1c193bbbbdf2ea477cb81331de4f3103f267ca18368b988c4"
 dependencies = [
 "powerfmt",
 ]
@@ -650,7 +633,7 @@ dependencies = [
 "dsl_auto_type",
 "proc-macro2",
 "quote",
- "syn 2.0.117",
+ "syn 2.0.116",
 ]

 [[package]]
@@ -670,7 +653,7 @@ version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fe2444076b48641147115697648dc743c2c00b61adade0f01ce67133c7babe8c"
 dependencies = [
- "syn 2.0.117",
+ "syn 2.0.116",
 ]

 [[package]]
@@ -686,12 +669,12 @@ dependencies = [

 [[package]]
 name = "digest"
-version = "0.11.1"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "285743a676ccb6b3e116bc14cc69319b957867930ae9c4822f8e0f54509d7243"
+checksum = "f8bf3682cdec91817be507e4aa104314898b95b84d74f3d43882210101a545b6"
 dependencies = [
- "block-buffer 0.12.0",
- "crypto-common 0.2.1",
+ "block-buffer 0.11.0",
+ "crypto-common 0.2.0",
 ]

 [[package]]
@@ -702,7 +685,7 @@ checksum = "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 2.0.117",
+ "syn 2.0.116",
 ]

 [[package]]
@@ -722,7 +705,7 @@ dependencies = [
 "heck",
 "proc-macro2",
 "quote",
- "syn 2.0.117",
+ "syn 2.0.116",
 ]

 [[package]]
@@ -752,7 +735,7 @@ version = "3.0.0-pre.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "053618a4c3d3bc24f188aa660ae75a46eeab74ef07fb415c61431e5e7cd4749b"
 dependencies = [
- "curve25519-dalek 5.0.0-pre.6",
+ "curve25519-dalek",
 "ed25519",
 "rand_core 0.10.0",
 "sha2",
@@ -788,12 +771,6 @@ version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "37909eebbb50d72f9059c3b6d82c0463f2ff062c9e95845c43a6c9c0355411be"

-[[package]]
-name = "fiat-crypto"
-version = "0.2.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d"
-
 [[package]]
 name = "fiat-crypto"
 version = "0.3.0"
@@ -902,7 +879,7 @@ checksum = "e835b70203e41293343137df5c0664546da5745f82ec9b84d40be8336958447b"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 2.0.117",
+ "syn 2.0.116",
 ]

 [[package]]
@@ -963,19 +940,19 @@ checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
 dependencies = [
 "cfg-if",
 "libc",
- "r-efi 5.3.0",
+ "r-efi",
 "wasip2",
 ]

 [[package]]
 name = "getrandom"
-version = "0.4.2"
+version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0de51e6874e94e7bf76d726fc5d13ba782deca734ff60d5bb2fb2607c7406555"
+checksum = "139ef39800118c7683f2fd3c98c1b23c09ae076556b435f8e9064ae108aaeeec"
 dependencies = [
 "cfg-if",
 "libc",
- "r-efi 6.0.0",
+ "r-efi",
 "rand_core 0.10.0",
 "wasip2",
 "wasip3",
@@ -1089,9 +1066,9 @@ checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"

 [[package]]
 name = "hybrid-array"
-version = "0.4.8"
+version = "0.4.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8655f91cd07f2b9d0c24137bd650fe69617773435ee5ec83022377777ce65ef1"
+checksum = "e1b229d73f5803b562cc26e4da0396c8610a4ee209f4fac8fa4f8d709166dc45"
 dependencies = [
 "typenum",
 ]
@@ -1242,9 +1219,9 @@ dependencies = [

 [[package]]
 name = "js-sys"
-version = "0.3.91"
+version = "0.3.85"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b49715b7073f385ba4bc528e5747d02e66cb39c6146efb66b781f131f0fb399c"
+checksum = "8c942ebf8e95485ca0d52d97da7c5a2c387d0e7f0ba4c35e93bfcaee045955b3"
 dependencies = [
 "once_cell",
 "wasm-bindgen",
@@ -1274,7 +1251,7 @@ dependencies = [
 "heck",
 "proc-macro2",
 "quote",
- "syn 2.0.117",
+ "syn 2.0.116",
 ]

 [[package]]
@@ -1291,9 +1268,9 @@ checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"

 [[package]]
 name = "libc"
-version = "0.2.183"
+version = "0.2.182"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5b646652bf6661599e1da8901b3b9522896f01e736bad5f723fe7a3a27f899d"
+checksum = "6800badb6cb2082ffd7b6a67e6125bb39f18782f793520caee8cb8846be06112"

 [[package]]
 name = "libsqlite3-sys"
@@ -1307,9 +1284,9 @@ dependencies = [

 [[package]]
 name = "linux-raw-sys"
-version = "0.12.1"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
+checksum = "df1d3c3b53da64cf5760482273a98e575c651a67eec7f77df96b5b642de8f039"

 [[package]]
 name = "lock_api"
@@ -1385,7 +1362,7 @@ checksum = "db5b29714e950dbb20d5e6f74f9dcec4edbcc1067bb7f8ed198c097b8c1a818b"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 2.0.117",
+ "syn 2.0.116",
 ]

 [[package]]
@@ -1524,9 +1501,9 @@ checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"

 [[package]]
 name = "owo-colors"
-version = "4.3.0"
+version = "4.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d211803b9b6b570f68772237e415a029d5a50c65d382910b879fb19d3271f94d"
+checksum = "9c6901729fa79e91a0913333229e9ca5dc725089d1c363b2f4b4760709dc4a52"

 [[package]]
 name = "parking_lot"
@@ -1591,29 +1568,29 @@ dependencies = [

 [[package]]
 name = "pin-project"
-version = "1.1.11"
+version = "1.1.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1749c7ed4bcaf4c3d0a3efc28538844fb29bcdd7d2b67b2be7e20ba861ff517"
+checksum = "677f1add503faace112b9f1373e43e9e054bfdd22ff1a63c1bc485eaec6a6a8a"
 dependencies = [
 "pin-project-internal",
 ]

 [[package]]
 name = "pin-project-internal"
-version = "1.1.11"
+version = "1.1.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9b20ed30f105399776b9c883e68e536ef602a16ae6f596d2c473591d6ad64c6"
+checksum = "6e918e4ff8c4549eb882f14b3a4bc8c8bc93de829416eacf579f1207a8fbf861"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 2.0.117",
+ "syn 2.0.116",
 ]

 [[package]]
 name = "pin-project-lite"
-version = "0.2.17"
+version = "0.2.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
+checksum = "3b3cff922bd51709b605d9ead9aa71031d81447142d828eb4a6eba76fe619f9b"

 [[package]]
 name = "pin-utils"
@@ -1657,7 +1634,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "479ca8adacdd7ce8f1fb39ce9ecccbfe93a3f1344b3d0d97f20bc0196208f62b"
 dependencies = [
 "proc-macro2",
- "syn 2.0.117",
+ "syn 2.0.116",
 ]

 [[package]]
@@ -1696,7 +1673,7 @@ dependencies = [
 "pulldown-cmark",
 "pulldown-cmark-to-cmark",
 "regex",
- "syn 2.0.117",
+ "syn 2.0.116",
 "tempfile",
 ]

@@ -1710,7 +1687,7 @@ dependencies = [
 "itertools",
 "proc-macro2",
 "quote",
- "syn 2.0.117",
+ "syn 2.0.116",
 ]

 [[package]]
@@ -1719,15 +1696,14 @@ version = "0.14.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8991c4cbdb8bc5b11f0b074ffe286c30e523de90fee5ba8132f1399f23cb3dd7"
 dependencies = [
- "chrono",
 "prost",
 ]

 [[package]]
 name = "pulldown-cmark"
-version = "0.13.1"
+version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "83c41efbf8f90ac44de7f3a868f0867851d261b56291732d0cbf7cceaaeb55a6"
+checksum = "1e8bbe1a966bd2f362681a44f6edce3c2310ac21e4d5067a6e7ec396297a6ea0"
 dependencies = [
 "bitflags",
 "memchr",
@@ -1745,9 +1721,9 @@ dependencies = [

 [[package]]
 name = "quote"
-version = "1.0.45"
+version = "1.0.44"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924"
+checksum = "21b2ebcf727b7760c461f091f9f0f539b77b8e87f2fd88131e7f1b433b3cece4"
 dependencies = [
 "proc-macro2",
 ]
@@ -1758,12 +1734,6 @@ version = "5.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"

-[[package]]
-name = "r-efi"
-version = "6.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
-
 [[package]]
 name = "rand"
 version = "0.10.0"
@@ -1771,7 +1741,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bc266eb313df6c5c09c1c7b1fbe2510961e5bcd3add930c1e31f7ed9da0feff8"
 dependencies = [
 "chacha20 0.10.0",
- "getrandom 0.4.2",
+ "getrandom 0.4.1",
 "rand_core 0.10.0",
 ]

@@ -1839,9 +1809,9 @@ dependencies = [

 [[package]]
 name = "regex-syntax"
-version = "0.8.10"
+version = "0.8.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc897dd8d9e8bd1ed8cdad82b5966c3e0ecae09fb1907d58efaa013543185d0a"
+checksum = "a96887878f22d7bad8a3b6dc5b7440e0ada9a245242924394987b21cf2210a4c"

 [[package]]
 name = "ring"
@@ -1893,9 +1863,9 @@ dependencies = [

 [[package]]
 name = "rustix"
-version = "1.1.4"
+version = "1.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
+checksum = "146c9e247ccc180c1f61615433868c99f3de3ae256a30a43b49f67c2d9171f34"
 dependencies = [
 "bitflags",
 "errno",
@@ -1906,9 +1876,9 @@ dependencies = [

 [[package]]
 name = "rustls"
-version = "0.23.37"
+version = "0.23.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "758025cb5fccfd3bc2fd74708fd4682be41d99e5dff73c377c0646c6012c73a4"
+checksum = "c665f33d38cea657d9614f766881e4d510e0eda4239891eea56b4cadcf01801b"
 dependencies = [
 "aws-lc-rs",
 "log",
@@ -2003,7 +1973,7 @@ checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 2.0.117",
+ "syn 2.0.116",
 ]

 [[package]]
@@ -2036,7 +2006,7 @@ checksum = "7c5f3b1e2dc8aad28310d8410bd4d7e180eca65fca176c52ab00d364475d0024"
 dependencies = [
 "cfg-if",
 "cpufeatures 0.2.17",
- "digest 0.11.1",
+ "digest 0.11.0",
 ]

 [[package]]
@@ -2111,12 +2081,12 @@ dependencies = [

 [[package]]
 name = "socket2"
-version = "0.6.3"
+version = "0.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3a766e1110788c36f4fa1c2b71b387a7815aa65f88ce0229841826633d93723e"
+checksum = "86f4aa3ad99f2088c990dfa82d367e19cb29268ed67c574d10d0a4bfe71f07e0"
 dependencies = [
 "libc",
- "windows-sys 0.61.2",
+ "windows-sys 0.60.2",
 ]

 [[package]]
@@ -2183,9 +2153,9 @@ dependencies = [

 [[package]]
 name = "syn"
-version = "2.0.117"
+version = "2.0.116"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99"
+checksum = "3df424c70518695237746f84cede799c9c58fcb37450d7b23716568cc8bc69cb"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -2206,17 +2176,17 @@ checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 2.0.117",
+ "syn 2.0.116",
 ]

 [[package]]
 name = "tempfile"
-version = "3.27.0"
+version = "3.25.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
+checksum = "0136791f7c95b1f6dd99f9cc786b91bb81c3800b639b3478e561ddb7be95e5f1"
 dependencies = [
 "fastrand",
- "getrandom 0.4.2",
+ "getrandom 0.4.1",
 "once_cell",
 "rustix",
 "windows-sys 0.61.2",
@@ -2250,7 +2220,7 @@ checksum = "be35209fd0781c5401458ab66e4f98accf63553e8fae7425503e92fdd319783b"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 2.0.117",
+ "syn 2.0.116",
 ]

 [[package]]
@@ -2280,7 +2250,7 @@ checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 2.0.117",
+ "syn 2.0.116",
 ]

 [[package]]
@@ -2325,9 +2295,9 @@ dependencies = [

 [[package]]
 name = "tokio"
-version = "1.50.0"
+version = "1.49.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "27ad5e34374e03cfffefc301becb44e9dc3c17584f414349ebe29ed26661822d"
+checksum = "72a2903cd7736441aac9df9d7688bd0ce48edccaadf181c3b90be801e81d3d86"
 dependencies = [
 "bytes",
 "libc",
@@ -2343,13 +2313,13 @@ dependencies = [

 [[package]]
 name = "tokio-macros"
-version = "2.6.1"
+version = "2.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c55a2eff8b69ce66c84f85e1da1c233edc36ceb85a2058d11b0d6a3c7e7569c"
+checksum = "af407857209536a95c8e56f8231ef2c2e2aff839b22e07a1ffcbc617e9db9fa5"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 2.0.117",
+ "syn 2.0.116",
 ]

 [[package]]
@@ -2411,18 +2381,18 @@ dependencies = [

 [[package]]
 name = "toml_parser"
-version = "1.0.9+spec-1.1.0"
+version = "1.0.8+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "702d4415e08923e7e1ef96cd5727c0dfed80b4d2fa25db9647fe5eb6f7c5a4c4"
+checksum = "0742ff5ff03ea7e67c8ae6c93cac239e0d9784833362da3f9a9c1da8dfefcbdc"
 dependencies = [
 "winnow",
 ]

 [[package]]
 name = "tonic"
-version = "0.14.5"
+version = "0.14.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fec7c61a0695dc1887c1b53952990f3ad2e3a31453e1f49f10e75424943a93ec"
+checksum = "7f32a6f80051a4111560201420c7885d0082ba9efe2ab61875c587bb6b18b9a0"
 dependencies = [
 "async-trait",
 "axum",
@@ -2452,21 +2422,21 @@ dependencies = [

 [[package]]
 name = "tonic-build"
-version = "0.14.5"
+version = "0.14.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1882ac3bf5ef12877d7ed57aad87e75154c11931c2ba7e6cde5e22d63522c734"
+checksum = "ce6d8958ed3be404120ca43ffa0fb1e1fc7be214e96c8d33bd43a131b6eebc9e"
 dependencies = [
 "prettyplease",
 "proc-macro2",
 "quote",
- "syn 2.0.117",
+ "syn 2.0.116",
 ]

 [[package]]
 name = "tonic-prost"
-version = "0.14.5"
+version = "0.14.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a55376a0bbaa4975a3f10d009ad763d8f4108f067c7c2e74f3001fb49778d309"
+checksum = "9f86539c0089bfd09b1f8c0ab0239d80392af74c21bc9e0f15e1b4aca4c1647f"
 dependencies = [
 "bytes",
 "prost",
@@ -2475,16 +2445,16 @@ dependencies = [

 [[package]]
 name = "tonic-prost-build"
-version = "0.14.5"
+version = "0.14.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3144df636917574672e93d0f56d7edec49f90305749c668df5101751bb8f95a"
+checksum = "65873ace111e90344b8973e94a1fc817c924473affff24629281f90daed1cd2e"
 dependencies = [
 "prettyplease",
 "proc-macro2",
 "prost-build",
 "prost-types",
 "quote",
- "syn 2.0.117",
+ "syn 2.0.116",
 "tempfile",
 "tonic-build",
 ]
@@ -2539,7 +2509,7 @@ checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 2.0.117",
+ "syn 2.0.116",
 ]

 [[package]]
@@ -2638,9 +2608,9 @@ checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"

 [[package]]
 name = "uuid"
-version = "1.22.0"
+version = "1.21.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a68d3c8f01c0cfa54a75291d83601161799e4a89a39e0929f4b0354d88757a37"
+checksum = "b672338555252d43fd2240c714dc444b8c6fb0a5c5335e65a07bba7742735ddb"
 dependencies = [
 "js-sys",
 "wasm-bindgen",
@@ -2693,9 +2663,9 @@ dependencies = [

 [[package]]
 name = "wasm-bindgen"
-version = "0.2.114"
+version = "0.2.108"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6532f9a5c1ece3798cb1c2cfdba640b9b3ba884f5db45973a6f442510a87d38e"
+checksum = "64024a30ec1e37399cf85a7ffefebdb72205ca1c972291c51512360d90bd8566"
 dependencies = [
 "cfg-if",
 "once_cell",
@@ -2706,9 +2676,9 @@ dependencies = [

 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.114"
+version = "0.2.108"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "18a2d50fcf105fb33bb15f00e7a77b772945a2ee45dcf454961fd843e74c18e6"
+checksum = "008b239d9c740232e71bd39e8ef6429d27097518b6b30bdf9086833bd5b6d608"
 dependencies = [
 "quote",
 "wasm-bindgen-macro-support",
@@ -2716,22 +2686,22 @@ dependencies = [

 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.114"
+version = "0.2.108"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "03ce4caeaac547cdf713d280eda22a730824dd11e6b8c3ca9e42247b25c631e3"
+checksum = "5256bae2d58f54820e6490f9839c49780dff84c65aeab9e772f15d5f0e913a55"
 dependencies = [
 "bumpalo",
 "proc-macro2",
 "quote",
- "syn 2.0.117",
+ "syn 2.0.116",
 "wasm-bindgen-shared",
 ]

 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.114"
+version = "0.2.108"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75a326b8c223ee17883a4251907455a2431acc2791c98c26279376490c378c16"
+checksum = "1f01b580c9ac74c8d8f0c0e4afb04eeef2acf145458e52c03845ee9cd23e3d12"
 dependencies = [
 "unicode-ident",
 ]
@@ -2813,7 +2783,7 @@ checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 2.0.117",
+ "syn 2.0.116",
 ]

 [[package]]
@@ -2824,7 +2794,7 @@ checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 2.0.117",
+ "syn 2.0.116",
 ]

 [[package]]
@@ -3009,9 +2979,9 @@ checksum = "d6bbff5f0aada427a1e5a6da5f1f98158182f26556f345ac9e04d36d0ebed650"

 [[package]]
 name = "winnow"
-version = "0.7.15"
+version = "0.7.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df79d97927682d2fd8adb29682d1140b343be4ac0f08fd68b7765d9c059d3945"
+checksum = "5a5364e9d77fcdeeaa6062ced926ee3381faa2ee02d3eb83a5c27a8825540829"

 [[package]]
 name = "wit-bindgen"
@@ -3043,7 +3013,7 @@ dependencies = [
 "heck",
 "indexmap",
 "prettyplease",
- "syn 2.0.117",
+ "syn 2.0.116",
 "wasm-metadata",
 "wit-bindgen-core",
 "wit-component",
@@ -3059,7 +3029,7 @@ dependencies = [
 "prettyplease",
 "proc-macro2",
 "quote",
- "syn 2.0.117",
+ "syn 2.0.116",
 "wit-bindgen-core",
 "wit-bindgen-rust",
 ]
@@ -3101,18 +3071,6 @@ dependencies = [
 "wasmparser",
 ]

-[[package]]
-name = "x25519-dalek"
-version = "2.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c7e468321c81fb07fa7f4c636c3972b9100f0346e5b6a9f2bd0603a52f7ed277"
-dependencies = [
- "curve25519-dalek 4.1.3",
- "rand_core 0.6.4",
- "serde",
- "zeroize",
-]
-
 [[package]]
 name = "x509-parser"
 version = "0.18.1"
@@ -3145,20 +3103,6 @@ name = "zeroize"
 version = "1.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b97154e67e32c85465826e8bcc1c59429aaaf107c1e4a9e53c8d8ccd5eff88d0"
-dependencies = [
- "zeroize_derive",
-]
-
-[[package]]
-name = "zeroize_derive"
-version = "1.4.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85a5b4158499876c763cb03bc4e49185d3cccbabb15b33c627f7884f43db852e"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.117",
-]

 [[package]]
 name = "zmij"
--- a/server/Cargo.toml
+++ b/server/Cargo.toml
@@ -23,4 +23,3 @@ async-trait = "0.1.89"
 futures = "0.3.31"
 tokio-stream = { version = "0.1.18", features = ["full"] }
 kameo = "0.19.2"
-prost-types = { version = "0.14.3", features = ["chrono"] }
--- a/server/crates/arbiter-proto/Cargo.toml
+++ b/server/crates/arbiter-proto/Cargo.toml
@@ -12,7 +12,6 @@ hex = "0.4.3"
 tonic-prost = "0.14.3"
 prost = "0.14.3"
 kameo.workspace = true
-prost-types.workspace = true

 [build-dependencies]
 prost-build = "0.14.3"
--- a/server/crates/arbiter-server/Cargo.toml
+++ b/server/crates/arbiter-server/Cargo.toml
@@ -47,7 +47,6 @@ argon2 = { version = "0.5", features = ["std"] }
 kameo.workspace = true
 hex = "0.4.3"
 chacha20poly1305 = "0.10.1"
-x25519-dalek = { version = "2.0", features = ["static_secrets"] }

 [dev-dependencies]
 test-log = { version = "0.2", default-features = false, features = ["trace"] }
--- a/server/crates/arbiter-server/src/.DS_Store
+++ b/server/crates/arbiter-server/src/.DS_Store
--- a/server/crates/arbiter-server/src/actors/user_agent.rs
+++ b/server/crates/arbiter-server/src/actors/user_agent.rs
@@ -95,8 +95,6 @@ pub struct UserAgentActor {
    bootstapper: ActorRef<BootstrapActor>,
    state: UserAgentStateMachine<DummyContext>,
    tx: Sender<Result<UserAgentResponse, Status>>,
-    context: ServerContext,
-    ephemeral_key: Option<crate::context::unseal::EphemeralKeyPair>,
 }

 impl UserAgentActor {
@@ -109,15 +107,12 @@ impl UserAgentActor {
            bootstapper: context.bootstrapper.clone(),
            state: UserAgentStateMachine::new(DummyContext),
            tx,
-            context,
-            ephemeral_key: None,
        }
    }

    pub(crate) fn new_manual(
        db: db::DatabasePool,
        bootstapper: ActorRef<BootstrapActor>,
-        context: ServerContext,
        tx: Sender<Result<UserAgentResponse, Status>>,
    ) -> Self {
        Self {
@@ -125,8 +120,6 @@ impl UserAgentActor {
            bootstapper,
            state: UserAgentStateMachine::new(DummyContext),
            tx,
-            context,
-            ephemeral_key: None,
        }
    }

@@ -314,121 +307,6 @@ impl UserAgentActor {
            Err(Status::unauthenticated("Invalid challenge solution"))
        }
    }
-
-    #[message(ctx)]
-    pub async fn handle_unseal_request(
-        &mut self,
-        request: arbiter_proto::proto::UnsealRequest,
-        ctx: &mut Context<Self, Output>,
-    ) -> Output {
-        use arbiter_proto::proto::{
-            EphemeralKeyResponse, SealedPassword, UnsealResponse, UnsealResult,
-            unseal_request::Payload as ReqPayload,
-            unseal_response::Payload as RespPayload,
-        };
-
-        match request.payload {
-            Some(ReqPayload::EphemeralKeyRequest(_)) => {
-                // Generate new ephemeral keypair
-                let keypair = crate::context::unseal::EphemeralKeyPair::generate();
-                let expires_at = keypair.expires_at() as i64;
-                let public_bytes = keypair.public_bytes();
-
-                // Store for later use
-                self.ephemeral_key = Some(keypair);
-
-                info!("Generated ephemeral X25519 keypair for unseal, expires at {}", expires_at);
-
-                Ok(UserAgentResponse {
-                    payload: Some(UserAgentResponsePayload::UnsealResponse(UnsealResponse {
-                        payload: Some(RespPayload::EphemeralKeyResponse(EphemeralKeyResponse {
-                            server_pubkey: public_bytes,
-                            expires_at,
-                        })),
-                    })),
-                })
-            }
-
-            Some(ReqPayload::SealedPassword(sealed)) => {
-                // Get and consume ephemeral key
-                let keypair = self
-                    .ephemeral_key
-                    .take()
-                    .ok_or_else(|| Status::failed_precondition("No ephemeral key generated"))?;
-
-                // Check expiration
-                if keypair.is_expired() {
-                    error!("Ephemeral key expired before sealed password was received");
-                    return Err(Status::deadline_exceeded("Ephemeral key expired"));
-                }
-
-                // Perform ECDH
-                let shared_secret = keypair
-                    .perform_dh(&sealed.client_pubkey)
-                    .map_err(|e| Status::invalid_argument(format!("Invalid client pubkey: {}", e)))?;
-
-                // Decrypt password
-                let nonce: [u8; 12] = sealed
-                    .nonce
-                    .as_slice()
-                    .try_into()
-                    .map_err(|_| Status::invalid_argument("Nonce must be 12 bytes"))?;
-
-                let password_bytes = crate::crypto::aead::decrypt(
-                    &sealed.encrypted_password,
-                    &shared_secret,
-                    &nonce,
-                )
-                .map_err(|e| {
-                    error!("Failed to decrypt password: {}", e);
-                    Status::internal(format!("Decryption failed: {}", e))
-                })?;
-
-                let password = String::from_utf8(password_bytes).map_err(|_| {
-                    error!("Password is not valid UTF-8");
-                    Status::invalid_argument("Password must be UTF-8")
-                })?;
-
-                // Call unseal on context
-                info!("Attempting to unseal vault with decrypted password");
-                let result = self.context.unseal(&password).await;
-
-                match result {
-                    Ok(()) => {
-                        info!("Vault unsealed successfully");
-                        Ok(UserAgentResponse {
-                            payload: Some(UserAgentResponsePayload::UnsealResponse(
-                                UnsealResponse {
-                                    payload: Some(RespPayload::UnsealResult(UnsealResult {
-                                        success: true,
-                                        error_message: None,
-                                    })),
-                                },
-                            )),
-                        })
-                    }
-                    Err(e) => {
-                        error!("Unseal failed: {}", e);
-                        Ok(UserAgentResponse {
-                            payload: Some(UserAgentResponsePayload::UnsealResponse(
-                                UnsealResponse {
-                                    payload: Some(RespPayload::UnsealResult(UnsealResult {
-                                        success: false,
-                                        error_message: Some(e.to_string()),
-                                    })),
-                                },
-                            )),
-                        })
-                    }
-                }
-            }
-
-            None => {
-                error!("Received empty unseal request");
-                Err(Status::invalid_argument("Empty unseal request"))
-            }
-        }
-    }
 }

 #[cfg(test)]
@@ -455,11 +333,9 @@ mod tests {
        let token = bootstrapper.get_token().unwrap();

        let bootstrapper_ref = BootstrapActor::spawn(bootstrapper);
-        let context = crate::ServerContext::new(db.clone()).await.unwrap();
        let user_agent = UserAgentActor::new_manual(
            db.clone(),
            bootstrapper_ref,
-            context,
            tokio::sync::mpsc::channel(1).0, // dummy channel, we won't actually send responses in this test
        );
        let user_agent_ref = UserAgentActor::spawn(user_agent);
--- a/server/crates/arbiter-server/src/context.rs
+++ b/server/crates/arbiter-server/src/context.rs
@@ -30,7 +30,6 @@ use crate::{
 pub(crate) mod bootstrap;
 pub(crate) mod lease;
 pub(crate) mod tls;
-pub(crate) mod unseal;

 #[derive(Error, Debug, Diagnostic)]
 pub enum InitError {
--- a/server/crates/arbiter-server/src/context/unseal.rs
+++ b/server/crates/arbiter-server/src/context/unseal.rs
@@ -1,161 +0,0 @@
-use std::time::{SystemTime, UNIX_EPOCH};
-
-use miette::Diagnostic;
-use secrecy::{ExposeSecret, SecretBox};
-use thiserror::Error;
-use x25519_dalek::{PublicKey, StaticSecret};
-
-const EPHEMERAL_KEY_LIFETIME_SECS: u64 = 60;
-
-#[derive(Error, Debug, Diagnostic)]
-pub enum UnsealError {
-    #[error("Invalid public key")]
-    #[diagnostic(code(arbiter_server::unseal::invalid_pubkey))]
-    InvalidPublicKey,
-}
-
-/// Ephemeral X25519 keypair for secure password transmission
-///
-/// Generated on-demand when client requests unseal. Expires after 60 seconds.
-/// Uses StaticSecret stored in SecretBox for automatic zeroization on drop.
-pub struct EphemeralKeyPair {
-    /// Secret key stored securely
-    secret: SecretBox<StaticSecret>,
-    public: PublicKey,
-    expires_at: u64,
-}
-
-impl EphemeralKeyPair {
-    /// Generate new ephemeral X25519 keypair
-    pub fn generate() -> Self {
-        // Generate random 32 bytes
-        let secret_bytes = rand::random::<[u8; 32]>();
-        let secret = StaticSecret::from(secret_bytes);
-        let public = PublicKey::from(&secret);
-
-        let now = SystemTime::now()
-            .duration_since(UNIX_EPOCH)
-            .expect("System time before UNIX epoch")
-            .as_secs();
-
-        Self {
-            secret: SecretBox::new(Box::new(secret)),
-            public,
-            expires_at: now + EPHEMERAL_KEY_LIFETIME_SECS,
-        }
-    }
-
-    /// Check if this ephemeral key has expired
-    pub fn is_expired(&self) -> bool {
-        let now = SystemTime::now()
-            .duration_since(UNIX_EPOCH)
-            .expect("System time before UNIX epoch")
-            .as_secs();
-
-        now > self.expires_at
-    }
-
-    /// Get expiration timestamp (Unix epoch seconds)
-    pub fn expires_at(&self) -> u64 {
-        self.expires_at
-    }
-
-    /// Get public key as bytes for transmission to client
-    pub fn public_bytes(&self) -> Vec<u8> {
-        self.public.as_bytes().to_vec()
-    }
-
-    /// Perform Diffie-Hellman key exchange with client's public key
-    ///
-    /// Returns 32-byte shared secret for ChaCha20Poly1305 encryption
-    pub fn perform_dh(&self, client_pubkey: &[u8]) -> Result<[u8; 32], UnsealError> {
-        // Parse client public key
-        let client_public = PublicKey::from(
-            <[u8; 32]>::try_from(client_pubkey).map_err(|_| UnsealError::InvalidPublicKey)?,
-        );
-
-        // Perform ECDH
-        let shared_secret = self.secret.expose_secret().diffie_hellman(&client_public);
-
-        Ok(shared_secret.to_bytes())
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn test_ephemeral_keypair_generation() {
-        let keypair = EphemeralKeyPair::generate();
-
-        // Public key should be 32 bytes
-        assert_eq!(keypair.public_bytes().len(), 32);
-
-        // Should not be expired immediately
-        assert!(!keypair.is_expired());
-
-        // Expiration should be ~60 seconds in future
-        let now = SystemTime::now()
-            .duration_since(UNIX_EPOCH)
-            .unwrap()
-            .as_secs();
-        let time_until_expiry = keypair.expires_at() - now;
-        assert!((59..=61).contains(&time_until_expiry));
-    }
-
-    #[test]
-    fn test_perform_dh_with_valid_key() {
-        let server_keypair = EphemeralKeyPair::generate();
-        let client_secret_bytes = rand::random::<[u8; 32]>();
-        let client_secret = StaticSecret::from(client_secret_bytes);
-        let client_public = PublicKey::from(&client_secret);
-
-        // Server performs DH
-        let server_shared_secret = server_keypair
-            .perform_dh(client_public.as_bytes())
-            .expect("DH should succeed");
-
-        // Client performs DH
-        let client_shared_secret = client_secret.diffie_hellman(&server_keypair.public);
-
-        // Shared secrets should match
-        assert_eq!(server_shared_secret, client_shared_secret.to_bytes());
-        assert_eq!(server_shared_secret.len(), 32);
-    }
-
-    #[test]
-    fn test_perform_dh_with_invalid_key() {
-        let keypair = EphemeralKeyPair::generate();
-
-        // Try with invalid length
-        let invalid_key = vec![1, 2, 3];
-        let result = keypair.perform_dh(&invalid_key);
-        assert!(result.is_err());
-
-        // Try with wrong length (not 32 bytes)
-        let invalid_key = vec![0u8; 16];
-        let result = keypair.perform_dh(&invalid_key);
-        assert!(result.is_err());
-    }
-
-    #[test]
-    fn test_different_keypairs_produce_different_shared_secrets() {
-        let server_keypair1 = EphemeralKeyPair::generate();
-        let server_keypair2 = EphemeralKeyPair::generate();
-
-        let client_secret_bytes = rand::random::<[u8; 32]>();
-        let client_secret = StaticSecret::from(client_secret_bytes);
-        let client_public = PublicKey::from(&client_secret);
-
-        let shared1 = server_keypair1
-            .perform_dh(client_public.as_bytes())
-            .unwrap();
-        let shared2 = server_keypair2
-            .perform_dh(client_public.as_bytes())
-            .unwrap();
-
-        // Different server keys should produce different shared secrets
-        assert_ne!(shared1, shared2);
-    }
-}
--- a/useragent/.dart_tool/extension_discovery/README.md
+++ b/useragent/.dart_tool/extension_discovery/README.md
@@ -1,31 +0,0 @@
-Extension Discovery Cache
-=========================
-
-This folder is used by `package:extension_discovery` to cache lists of
-packages that contains extensions for other packages.
-
-DO NOT USE THIS FOLDER
----------------------
-
- * Do not read (or rely) the contents of this folder.
- * Do write to this folder.
-
-If you're interested in the lists of extensions stored in this folder use the
-API offered by package `extension_discovery` to get this information.
-
-If this package doesn't work for your use-case, then don't try to read the
-contents of this folder. It may change, and will not remain stable.
-
-Use package `extension_discovery`
---------------------------------
-
-If you want to access information from this folder.
-
-Feel free to delete this folder
-------------------------------
-
-Files in this folder act as a cache, and the cache is discarded if the files
-are older than the modification time of `.dart_tool/package_config.json`.
-
-Hence, it should never be necessary to clear this cache manually, if you find a
-need to do please file a bug.
--- a/useragent/.dart_tool/extension_discovery/vs_code.json
+++ b/useragent/.dart_tool/extension_discovery/vs_code.json
@@ -1 +0,0 @@
-{"version":2,"entries":[{"package":"arbiter","rootUri":"../","packageUri":"lib/"}]}
--- a/useragent/.dart_tool/package_config.json
+++ b/useragent/.dart_tool/package_config.json
@@ -1,172 +0,0 @@
-{
-  "configVersion": 2,
-  "packages": [
-    {
-      "name": "async",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/async-2.13.0",
-      "packageUri": "lib/",
-      "languageVersion": "3.4"
-    },
-    {
-      "name": "boolean_selector",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/boolean_selector-2.1.2",
-      "packageUri": "lib/",
-      "languageVersion": "3.1"
-    },
-    {
-      "name": "characters",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/characters-1.4.0",
-      "packageUri": "lib/",
-      "languageVersion": "3.4"
-    },
-    {
-      "name": "clock",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/clock-1.1.2",
-      "packageUri": "lib/",
-      "languageVersion": "3.4"
-    },
-    {
-      "name": "collection",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/collection-1.19.1",
-      "packageUri": "lib/",
-      "languageVersion": "3.4"
-    },
-    {
-      "name": "fake_async",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/fake_async-1.3.3",
-      "packageUri": "lib/",
-      "languageVersion": "3.3"
-    },
-    {
-      "name": "flutter",
-      "rootUri": "file:///Users/kaska/.local/share/mise/installs/flutter/3.38.9-stable/packages/flutter",
-      "packageUri": "lib/",
-      "languageVersion": "3.8"
-    },
-    {
-      "name": "flutter_lints",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/flutter_lints-6.0.0",
-      "packageUri": "lib/",
-      "languageVersion": "3.8"
-    },
-    {
-      "name": "flutter_test",
-      "rootUri": "file:///Users/kaska/.local/share/mise/installs/flutter/3.38.9-stable/packages/flutter_test",
-      "packageUri": "lib/",
-      "languageVersion": "3.8"
-    },
-    {
-      "name": "leak_tracker",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/leak_tracker-11.0.2",
-      "packageUri": "lib/",
-      "languageVersion": "3.2"
-    },
-    {
-      "name": "leak_tracker_flutter_testing",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/leak_tracker_flutter_testing-3.0.10",
-      "packageUri": "lib/",
-      "languageVersion": "3.2"
-    },
-    {
-      "name": "leak_tracker_testing",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/leak_tracker_testing-3.0.2",
-      "packageUri": "lib/",
-      "languageVersion": "3.2"
-    },
-    {
-      "name": "lints",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/lints-6.1.0",
-      "packageUri": "lib/",
-      "languageVersion": "3.8"
-    },
-    {
-      "name": "matcher",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/matcher-0.12.17",
-      "packageUri": "lib/",
-      "languageVersion": "3.4"
-    },
-    {
-      "name": "material_color_utilities",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/material_color_utilities-0.11.1",
-      "packageUri": "lib/",
-      "languageVersion": "2.17"
-    },
-    {
-      "name": "meta",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/meta-1.17.0",
-      "packageUri": "lib/",
-      "languageVersion": "3.5"
-    },
-    {
-      "name": "path",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/path-1.9.1",
-      "packageUri": "lib/",
-      "languageVersion": "3.4"
-    },
-    {
-      "name": "sky_engine",
-      "rootUri": "file:///Users/kaska/.local/share/mise/installs/flutter/3.38.9-stable/bin/cache/pkg/sky_engine",
-      "packageUri": "lib/",
-      "languageVersion": "3.8"
-    },
-    {
-      "name": "source_span",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/source_span-1.10.2",
-      "packageUri": "lib/",
-      "languageVersion": "3.1"
-    },
-    {
-      "name": "stack_trace",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/stack_trace-1.12.1",
-      "packageUri": "lib/",
-      "languageVersion": "3.4"
-    },
-    {
-      "name": "stream_channel",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/stream_channel-2.1.4",
-      "packageUri": "lib/",
-      "languageVersion": "3.3"
-    },
-    {
-      "name": "string_scanner",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/string_scanner-1.4.1",
-      "packageUri": "lib/",
-      "languageVersion": "3.1"
-    },
-    {
-      "name": "term_glyph",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/term_glyph-1.2.2",
-      "packageUri": "lib/",
-      "languageVersion": "3.1"
-    },
-    {
-      "name": "test_api",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/test_api-0.7.7",
-      "packageUri": "lib/",
-      "languageVersion": "3.5"
-    },
-    {
-      "name": "vector_math",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/vector_math-2.2.0",
-      "packageUri": "lib/",
-      "languageVersion": "3.1"
-    },
-    {
-      "name": "vm_service",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/vm_service-15.0.2",
-      "packageUri": "lib/",
-      "languageVersion": "3.5"
-    },
-    {
-      "name": "arbiter",
-      "rootUri": "../",
-      "packageUri": "lib/",
-      "languageVersion": "3.10"
-    }
-  ],
-  "generator": "pub",
-  "generatorVersion": "3.10.8",
-  "flutterRoot": "file:///Users/kaska/.local/share/mise/installs/flutter/3.38.9-stable",
-  "flutterVersion": "3.38.9",
-  "pubCache": "file:///Users/kaska/.pub-cache"
-}
--- a/useragent/.dart_tool/package_graph.json
+++ b/useragent/.dart_tool/package_graph.json
@@ -1,224 +0,0 @@
-{
-  "roots": [
-    "arbiter"
-  ],
-  "packages": [
-    {
-      "name": "arbiter",
-      "version": "0.1.0",
-      "dependencies": [
-        "flutter"
-      ],
-      "devDependencies": [
-        "flutter_lints",
-        "flutter_test"
-      ]
-    },
-    {
-      "name": "flutter_lints",
-      "version": "6.0.0",
-      "dependencies": [
-        "lints"
-      ]
-    },
-    {
-      "name": "flutter_test",
-      "version": "0.0.0",
-      "dependencies": [
-        "clock",
-        "collection",
-        "fake_async",
-        "flutter",
-        "leak_tracker_flutter_testing",
-        "matcher",
-        "meta",
-        "path",
-        "stack_trace",
-        "stream_channel",
-        "test_api",
-        "vector_math"
-      ]
-    },
-    {
-      "name": "flutter",
-      "version": "0.0.0",
-      "dependencies": [
-        "characters",
-        "collection",
-        "material_color_utilities",
-        "meta",
-        "sky_engine",
-        "vector_math"
-      ]
-    },
-    {
-      "name": "lints",
-      "version": "6.1.0",
-      "dependencies": []
-    },
-    {
-      "name": "stream_channel",
-      "version": "2.1.4",
-      "dependencies": [
-        "async"
-      ]
-    },
-    {
-      "name": "meta",
-      "version": "1.17.0",
-      "dependencies": []
-    },
-    {
-      "name": "collection",
-      "version": "1.19.1",
-      "dependencies": []
-    },
-    {
-      "name": "leak_tracker_flutter_testing",
-      "version": "3.0.10",
-      "dependencies": [
-        "flutter",
-        "leak_tracker",
-        "leak_tracker_testing",
-        "matcher",
-        "meta"
-      ]
-    },
-    {
-      "name": "vector_math",
-      "version": "2.2.0",
-      "dependencies": []
-    },
-    {
-      "name": "stack_trace",
-      "version": "1.12.1",
-      "dependencies": [
-        "path"
-      ]
-    },
-    {
-      "name": "clock",
-      "version": "1.1.2",
-      "dependencies": []
-    },
-    {
-      "name": "fake_async",
-      "version": "1.3.3",
-      "dependencies": [
-        "clock",
-        "collection"
-      ]
-    },
-    {
-      "name": "path",
-      "version": "1.9.1",
-      "dependencies": []
-    },
-    {
-      "name": "matcher",
-      "version": "0.12.17",
-      "dependencies": [
-        "async",
-        "meta",
-        "stack_trace",
-        "term_glyph",
-        "test_api"
-      ]
-    },
-    {
-      "name": "test_api",
-      "version": "0.7.7",
-      "dependencies": [
-        "async",
-        "boolean_selector",
-        "collection",
-        "meta",
-        "source_span",
-        "stack_trace",
-        "stream_channel",
-        "string_scanner",
-        "term_glyph"
-      ]
-    },
-    {
-      "name": "sky_engine",
-      "version": "0.0.0",
-      "dependencies": []
-    },
-    {
-      "name": "material_color_utilities",
-      "version": "0.11.1",
-      "dependencies": [
-        "collection"
-      ]
-    },
-    {
-      "name": "characters",
-      "version": "1.4.0",
-      "dependencies": []
-    },
-    {
-      "name": "async",
-      "version": "2.13.0",
-      "dependencies": [
-        "collection",
-        "meta"
-      ]
-    },
-    {
-      "name": "leak_tracker_testing",
-      "version": "3.0.2",
-      "dependencies": [
-        "leak_tracker",
-        "matcher",
-        "meta"
-      ]
-    },
-    {
-      "name": "leak_tracker",
-      "version": "11.0.2",
-      "dependencies": [
-        "clock",
-        "collection",
-        "meta",
-        "path",
-        "vm_service"
-      ]
-    },
-    {
-      "name": "term_glyph",
-      "version": "1.2.2",
-      "dependencies": []
-    },
-    {
-      "name": "string_scanner",
-      "version": "1.4.1",
-      "dependencies": [
-        "source_span"
-      ]
-    },
-    {
-      "name": "source_span",
-      "version": "1.10.2",
-      "dependencies": [
-        "collection",
-        "path",
-        "term_glyph"
-      ]
-    },
-    {
-      "name": "boolean_selector",
-      "version": "2.1.2",
-      "dependencies": [
-        "source_span",
-        "string_scanner"
-      ]
-    },
-    {
-      "name": "vm_service",
-      "version": "15.0.2",
-      "dependencies": []
-    }
-  ],
-  "configVersion": 1
-}
--- a/useragent/.dart_tool/version
+++ b/useragent/.dart_tool/version
@@ -1 +0,0 @@
-3.38.9
--- a/useragent/macos/Flutter/ephemeral/Flutter-Generated.xcconfig
+++ b/useragent/macos/Flutter/ephemeral/Flutter-Generated.xcconfig
@@ -1,11 +0,0 @@
-// This is a generated file; do not edit or check into version control.
-FLUTTER_ROOT=/Users/kaska/.local/share/mise/installs/flutter/3.38.9-stable
-FLUTTER_APPLICATION_PATH=/Users/kaska/Documents/Projects/Major/arbiter/useragent
-COCOAPODS_PARALLEL_CODE_SIGN=true
-FLUTTER_BUILD_DIR=build
-FLUTTER_BUILD_NAME=0.1.0
-FLUTTER_BUILD_NUMBER=0.1.0
-DART_OBFUSCATION=false
-TRACK_WIDGET_CREATION=true
-TREE_SHAKE_ICONS=false
-PACKAGE_CONFIG=.dart_tool/package_config.json
--- a/useragent/macos/Flutter/ephemeral/flutter_export_environment.sh
+++ b/useragent/macos/Flutter/ephemeral/flutter_export_environment.sh
@@ -1,12 +0,0 @@
-#!/bin/sh
-# This is a generated file; do not edit or check into version control.
-export "FLUTTER_ROOT=/Users/kaska/.local/share/mise/installs/flutter/3.38.9-stable"
-export "FLUTTER_APPLICATION_PATH=/Users/kaska/Documents/Projects/Major/arbiter/useragent"
-export "COCOAPODS_PARALLEL_CODE_SIGN=true"
-export "FLUTTER_BUILD_DIR=build"
-export "FLUTTER_BUILD_NAME=0.1.0"
-export "FLUTTER_BUILD_NUMBER=0.1.0"
-export "DART_OBFUSCATION=false"
-export "TRACK_WIDGET_CREATION=true"
-export "TREE_SHAKE_ICONS=false"
-export "PACKAGE_CONFIG=.dart_tool/package_config.json"
Author	SHA1	Message	Date
CleverWild	075d33219e	feat(server): implement KeyStorage and state machine lifecycle Some checks failed ci/woodpecker/pr/server-audit Pipeline was successful Details ci/woodpecker/pr/server-vet Pipeline failed Details ci/woodpecker/pr/server-test Pipeline failed Details ci/woodpecker/push/server-audit Pipeline was successful Details ci/woodpecker/push/server-vet Pipeline failed Details ci/woodpecker/push/server-test Pipeline failed Details	2026-02-16 15:57:14 +01:00
CleverWild	8cb6f4abe0	feat(tls): implement TLS certificate management and rotation	2026-02-16 15:57:00 +01:00
hdbg	4bac70a6e9	security(server): `cargo-vet` proper init All checks were successful ci/woodpecker/push/server-audit Pipeline was successful Details ci/woodpecker/push/server-vet Pipeline was successful Details ci/woodpecker/push/server-test Pipeline was successful Details	2026-02-14 19:16:09 +01:00
hdbg	54a41743be	housekeeping(server): trimmed-down dependencies	2026-02-14 19:04:50 +01:00
				`@@ -1 +0,0 @@`
				`{"version":2,"entries":[{"package":"arbiter","rootUri":"../","packageUri":"lib/"}]}`