refactor(server::db): introduced newtype wrappers for entity id's in database

mise.toml

@@ -22,3 +22,5 @@ run = '''
 dart pub global activate protoc_plugin && \
 protoc --dart_out=grpc:useragent/lib/proto --proto_path=protobufs/ $(find protobufs -name '*.proto' | sort)
 '''
+
+[tasks.generate_schema]

server/Cargo.toml

@@ -6,7 +6,7 @@ resolver = "3"
 
 
 [workspace.dependencies]
-alloy = "2.0.4"
+alloy = "2.0.0"
 async-trait = "0.1.89"
 base64 = "0.22.1"
 chrono = { version = "0.4.44", features = ["serde"] }
@@ -16,15 +16,15 @@ kameo = {git = "https://github.com/hdbg/kameo.git", rev = "805b417"}
 kameo_actors = {git = "https://github.com/hdbg/kameo.git", rev = "805b417"}
 hmac = "0.13.0"
 miette = { version = "7.6.0", features = ["fancy", "serde"] }
-ml-dsa = { version = "0.1.0-rc.9", features = ["zeroize"] }
+ml-dsa = { version = "0.1.0-rc.8", features = ["zeroize"] }
 mutants = "0.0.4"
 prost = "0.14.3"
 prost-types = { version = "0.14.3", features = ["chrono"] }
 rand = "0.10.1"
 rcgen = { version = "0.14.7", features = [ "aws_lc_rs",  "pem", "x509-parser", "zeroize" ], default-features = false }
 rstest = "0.26.1"
-rustls = { version = "0.23.40", features = ["aws-lc-rs", "logging", "prefer-post-quantum", "std"], default-features = false }
-rustls-pki-types = "1.14.1"
+rustls = { version = "0.23.38", features = ["aws-lc-rs", "logging", "prefer-post-quantum", "std"], default-features = false }
+rustls-pki-types = "1.14.0"
 sha2 = "0.11"
 smlang = "0.8.0"
 thiserror = "2.0.18"

server/crates/arbiter-client/Cargo.toml

@@ -21,7 +21,7 @@ tokio.workspace = true
 tokio-stream.workspace = true
 thiserror.workspace = true
 http = "1.4.0"
-rustls-webpki = { version = "0.103.13", features = ["aws-lc-rs"] }
+rustls-webpki = { version = "0.103.12", features = ["aws-lc-rs"] }
 async-trait.workspace = true
 chrono.workspace = true
 

server/crates/arbiter-server/Cargo.toml

@@ -9,8 +9,8 @@ license = "Apache-2.0"
 workspace = true
 
 [dependencies]
-diesel = { version = "2.3.9", features = ["chrono", "returning_clauses_for_sqlite_3_35", "serde_json", "time", "uuid"] }
-diesel-async = { version = "0.9.0", features = [
+diesel = { version = "2.3.7", features = ["chrono", "returning_clauses_for_sqlite_3_35", "serde_json", "time", "uuid"] }
+diesel-async = { version = "0.8.0", features = [
     "bb8",
     "migrations",
     "sqlite",
@@ -27,7 +27,7 @@ tokio.workspace = true
 rustls.workspace = true
 smlang.workspace = true
 thiserror.workspace = true
-diesel_migrations = { version = "2.3.2", features = ["sqlite"] }
+diesel_migrations = { version = "2.3.1", features = ["sqlite"] }
 async-trait.workspace = true
 tokio-stream.workspace = true
 rand.workspace = true
@@ -50,6 +50,7 @@ subtle = "2.6.1"
 x25519-dalek.workspace = true
 k256.workspace = true
 kameo_actors.workspace = true
+blahaj = "0.6.0"
 
 [dev-dependencies]
 proptest = "1.11.0"

server/crates/arbiter-server/migrations/2026-02-14-171124-0000_init/up.sql

@@ -43,13 +43,24 @@ create table if not exists arbiter_settings (
 insert into arbiter_settings (id) values (1) on conflict do nothing;
 -- ensure singleton row exists
 
-create table if not exists operator_client (
+create table if not exists operator_identity (
     id integer not null primary key,
     public_key blob not null,
     created_at integer not null default(unixepoch ('now')),
     updated_at integer not null default(unixepoch ('now'))
 ) STRICT;
-create unique index if not exists uniq_operator_client_public_key on operator_client (public_key);
+create unique index if not exists uniq_operator_client_public_key on operator_identity (public_key);
+
+create table if not exists operator (
+    id integer primary key references operator_identity(id) on delete restrict, -- same id as operator_identity
+
+    share blob not null,
+    share_nonce blob not null,
+
+    created_at integer not null default(unixepoch ('now')),
+    updated_at integer not null default(unixepoch ('now'))
+
+) STRICT;
 
 create table if not exists client_metadata (
     id integer not null primary key,

server/crates/arbiter-server/src/actors/bootstrap.rs

@@ -48,7 +48,7 @@ impl Bootstrapper {
         let row_count: i64 = {
             let mut conn = db.get().await?;
 
-            schema::operator_client::table
+            schema::operator_identity::table
                 .count()
                 .get_result(&mut conn)
                 .await?

server/crates/arbiter-server/src/actors/evm/mod.rs

@@ -3,7 +3,7 @@ use crate::{
     crypto::integrity,
     db::{
         DatabaseError, DatabasePool,
-        models::{self},
+        models::{self, EvmWalletId},
         schema,
     },
     evm::{
@@ -116,7 +116,7 @@ impl EvmActor {
     }
 
     #[message]
-    pub async fn list_wallets(&self) -> Result<Vec<(i32, Address)>, Error> {
+    pub async fn list_wallets(&self) -> Result<Vec<(EvmWalletId, Address)>, Error> {
         let mut conn = self.db.get().await.map_err(DatabaseError::from)?;
         let rows: Vec<models::EvmWallet> = schema::evm_wallet::table
             .select(models::EvmWallet::as_select())

server/crates/arbiter-server/src/actors/vault/mod.rs

@@ -6,7 +6,7 @@ use crate::{
     },
     db::{
         self,
-        models::{self, RootKeyHistory},
+        models::{self, RootKeyHistory, RootKeyHistoryId},
         schema::{self},
     },
 };
@@ -25,7 +25,6 @@ use strum::{EnumDiscriminants, IntoDiscriminant};
 use tracing::{error, info};
 
 pub mod events {
-
     #[derive(Clone, Copy)]
     pub struct Bootstrapped;
 
@@ -64,7 +63,7 @@ pub enum Error {
 }
 
 struct Unsealed {
-    root_key_history_id: i32,
+    root_key_history_id: RootKeyHistoryId,
     root_key: KeyCell,
 }
 
@@ -73,8 +72,9 @@ struct Unsealed {
 enum State {
     #[default]
     Unbootstrapped,
+
     Sealed {
-        root_key_history_id: i32,
+        root_key_history_id: RootKeyHistoryId,
     },
     Unsealed(Unsealed),
 }
@@ -115,33 +115,38 @@ impl Vault {
 
     // Exclusive transaction to avoid race condtions if multiple vaults write
     // additional layer of protection against nonce-reuse
-    async fn get_new_nonce(pool: &db::DatabasePool, root_key_id: i32) -> Result<Nonce, Error> {
+    async fn get_new_nonce(
+        pool: &db::DatabasePool,
+        root_key_id: RootKeyHistoryId,
+    ) -> Result<Nonce, Error> {
         let mut conn = pool.get().await?;
 
         let nonce = conn
-            .exclusive_transaction(async |conn| {
-                let current_nonce: Vec<u8> = schema::root_key_history::table
-                    .filter(schema::root_key_history::id.eq(root_key_id))
-                    .select(schema::root_key_history::data_encryption_nonce)
-                    .first(&mut *conn)
-                    .await?;
+            .exclusive_transaction(|conn| {
+                Box::pin(async move {
+                    let current_nonce: Vec<u8> = schema::root_key_history::table
+                        .filter(schema::root_key_history::id.eq(root_key_id))
+                        .select(schema::root_key_history::data_encryption_nonce)
+                        .first(conn)
+                        .await?;
 
-                let mut nonce = Nonce::try_from(current_nonce.as_slice()).map_err(|()| {
-                    error!(
-                        "Broken database: invalid nonce for root key history id={}",
-                        root_key_id
-                    );
-                    Error::BrokenDatabase
-                })?;
-                nonce.increment();
+                    let mut nonce = Nonce::try_from(current_nonce.as_slice()).map_err(|()| {
+                        error!(
+                            "Broken database: invalid nonce for root key history id={:#?}",
+                            root_key_id
+                        );
+                        Error::BrokenDatabase
+                    })?;
+                    nonce.increment();
 
-                update(schema::root_key_history::table)
-                    .filter(schema::root_key_history::id.eq(root_key_id))
-                    .set(schema::root_key_history::data_encryption_nonce.eq(nonce.to_vec()))
-                    .execute(&mut *conn)
-                    .await?;
+                    update(schema::root_key_history::table)
+                        .filter(schema::root_key_history::id.eq(root_key_id))
+                        .set(schema::root_key_history::data_encryption_nonce.eq(nonce.to_vec()))
+                        .execute(conn)
+                        .await?;
 
-                Result::<_, Error>::Ok(nonce)
+                    Result::<_, Error>::Ok(nonce)
+                })
             })
             .await?;
 
@@ -183,26 +188,29 @@ impl Vault {
 
         let data_encryption_nonce_bytes = data_encryption_nonce.to_vec();
         let root_key_history_id = conn
-            .transaction(async |conn| {
-                let root_key_history_id: i32 = insert_into(schema::root_key_history::table)
-                    .values(&models::NewRootKeyHistory {
-                        ciphertext: root_key_ciphertext.clone(),
-                        tag: v1::ROOT_KEY_TAG.to_vec(),
-                        root_key_encryption_nonce: root_key_nonce.to_vec(),
-                        data_encryption_nonce: data_encryption_nonce_bytes.clone(),
-                        schema_version: 1,
-                        salt: salt.to_vec(),
-                    })
-                    .returning(schema::root_key_history::id)
-                    .get_result(&mut *conn)
-                    .await?;
+            .transaction(|conn| {
+                Box::pin(async move {
+                    let root_key_history_id: RootKeyHistoryId =
+                        insert_into(schema::root_key_history::table)
+                            .values(&models::NewRootKeyHistory {
+                                ciphertext: root_key_ciphertext,
+                                tag: v1::ROOT_KEY_TAG.to_vec(),
+                                root_key_encryption_nonce: root_key_nonce.to_vec(),
+                                data_encryption_nonce: data_encryption_nonce_bytes,
+                                schema_version: 1,
+                                salt: salt.to_vec(),
+                            })
+                            .returning(schema::root_key_history::id)
+                            .get_result(conn)
+                            .await?;
 
-                update(schema::arbiter_settings::table)
-                    .set(schema::arbiter_settings::root_key_id.eq(root_key_history_id))
-                    .execute(&mut *conn)
-                    .await?;
+                    update(schema::arbiter_settings::table)
+                        .set(schema::arbiter_settings::root_key_id.eq(root_key_history_id))
+                        .execute(conn)
+                        .await?;
 
-                Result::<_, diesel::result::Error>::Ok(root_key_history_id)
+                    Result::<_, diesel::result::Error>::Ok(root_key_history_id)
+                })
             })
             .await?;
 
@@ -340,7 +348,10 @@ impl Vault {
     }
 
     #[message]
-    pub fn sign_integrity(&mut self, mac_input: Vec<u8>) -> Result<(i32, Vec<u8>), Error> {
+    pub fn sign_integrity(
+        &mut self,
+        mac_input: Vec<u8>,
+    ) -> Result<(RootKeyHistoryId, Vec<u8>), Error> {
         let Unsealed {
             root_key,
             root_key_history_id,
@@ -352,7 +363,7 @@ impl Vault {
                 Ok(v) => v,
                 Err(_) => unreachable!("HMAC accepts keys of any size"),
             });
-        hmac.update(&root_key_history_id.to_be_bytes());
+        hmac.update(&root_key_history_id.to_raw().to_be_bytes());
         hmac.update(&mac_input);
 
         let mac = hmac.finalize().into_bytes().to_vec();
@@ -364,7 +375,7 @@ impl Vault {
         &mut self,
         mac_input: Vec<u8>,
         expected_mac: Vec<u8>,
-        key_version: i32,
+        key_version: RootKeyHistoryId,
     ) -> Result<bool, Error> {
         let Unsealed {
             root_key,
@@ -381,7 +392,7 @@ impl Vault {
                 Ok(v) => v,
                 Err(_) => unreachable!("HMAC accepts keys of any size"),
             });
-        hmac.update(&key_version.to_be_bytes());
+        hmac.update(&key_version.to_raw().to_be_bytes());
         hmac.update(&mac_input);
 
         Ok(hmac.verify_slice(&expected_mac).is_ok())
@@ -404,7 +415,7 @@ impl Vault {
 
 #[cfg(test)]
 mod tests {
-    use crate::actors::GlobalActors;
+    use crate::{actors::GlobalActors, db::models::RootKeyHistory};
     use arbiter_crypto::safecell::SafeCellHandle as _;
 
     use super::*;
@@ -440,8 +451,8 @@ mod tests {
         assert!(n2.to_vec() > n1.to_vec(), "nonce must increase");
 
         let mut conn = db.get().await.unwrap();
-        let root_row: models::RootKeyHistory = schema::root_key_history::table
-            .select(models::RootKeyHistory::as_select())
+        let root_row: RootKeyHistory = schema::root_key_history::table
+            .select(RootKeyHistory::as_select())
             .first(&mut conn)
             .await
             .unwrap();

server/crates/arbiter-server/src/context/tls.rs

@@ -174,26 +174,28 @@ impl TlsManager {
 
         {
             let mut conn = db.get().await?;
-            conn.transaction(async |conn| {
-                let new_tls_history = NewTlsHistory {
-                    cert: new_cert.cert.pem(),
-                    cert_key: new_cert.cert_key.serialize_pem(),
-                    ca_cert: encode_cert_to_pem(&ca.cert),
-                    ca_key: ca.issuer.key().serialize_pem(),
-                };
+            conn.transaction(|conn| {
+                Box::pin(async {
+                    let new_tls_history = NewTlsHistory {
+                        cert: new_cert.cert.pem(),
+                        cert_key: new_cert.cert_key.serialize_pem(),
+                        ca_cert: encode_cert_to_pem(&ca.cert),
+                        ca_key: ca.issuer.key().serialize_pem(),
+                    };
 
-                let inserted_tls_history: i32 = diesel::insert_into(tls_history::table)
-                    .values(&new_tls_history)
-                    .returning(tls_history::id)
-                    .get_result(&mut *conn)
-                    .await?;
+                    let inserted_tls_history: i32 = diesel::insert_into(tls_history::table)
+                        .values(&new_tls_history)
+                        .returning(tls_history::id)
+                        .get_result(conn)
+                        .await?;
 
-                diesel::update(arbiter_settings::table)
-                    .set(arbiter_settings::tls_id.eq(inserted_tls_history))
-                    .execute(&mut *conn)
-                    .await?;
+                    diesel::update(arbiter_settings::table)
+                        .set(arbiter_settings::tls_id.eq(inserted_tls_history))
+                        .execute(conn)
+                        .await?;
 
-                Result::<_, diesel::result::Error>::Ok(())
+                    Result::<_, diesel::result::Error>::Ok(())
+                })
             })
             .await?;
         }

server/crates/arbiter-server/src/db/models.rs

@@ -79,10 +79,41 @@ pub mod types {
         }
     }
 
-    #[derive(Debug, FromSqlRow, AsExpression, Clone)]
-    #[diesel(sql_type = Integer)]
-    #[repr(transparent)] // hint compiler to optimize the wrapper struct away
-    pub struct ChainId(pub i32);
+    macro_rules! declare_id {
+        ($name:ident) => {
+            #[derive(Debug, FromSqlRow, AsExpression, Clone, Hash, Copy, PartialEq, Eq)]
+            #[diesel(sql_type = Integer)]
+            #[repr(transparent)] // hint compiler to optimize the wrapper struct away
+            pub struct $name(i32);
+
+            impl $name {
+                pub const fn to_raw(self) -> i32 {
+                    self.0
+                }
+                pub const fn from_raw(raw: i32) -> Self {
+                    Self(raw)
+                }
+            }
+
+            impl FromSql<Integer, Sqlite> for $name {
+                fn from_sql(
+                    bytes: <Sqlite as diesel::backend::Backend>::RawValue<'_>,
+                ) -> diesel::deserialize::Result<Self> {
+                    FromSql::<Integer, Sqlite>::from_sql(bytes).map(Self)
+                }
+            }
+            impl ToSql<Integer, Sqlite> for $name {
+                fn to_sql<'b>(
+                    &'b self,
+                    out: &mut diesel::serialize::Output<'b, '_, Sqlite>,
+                ) -> diesel::serialize::Result {
+                    ToSql::<Integer, Sqlite>::to_sql(&self.0, out)
+                }
+            }
+        };
+    }
+
+    declare_id!(ChainId);
 
     #[expect(
         clippy::cast_sign_loss,
@@ -103,21 +134,13 @@ pub mod types {
         }
     };
 
-    impl FromSql<Integer, Sqlite> for ChainId {
-        fn from_sql(
-            bytes: <Sqlite as diesel::backend::Backend>::RawValue<'_>,
-        ) -> diesel::deserialize::Result<Self> {
-            FromSql::<Integer, Sqlite>::from_sql(bytes).map(Self)
-        }
-    }
-    impl ToSql<Integer, Sqlite> for ChainId {
-        fn to_sql<'b>(
-            &'b self,
-            out: &mut diesel::serialize::Output<'b, '_, Sqlite>,
-        ) -> diesel::serialize::Result {
-            ToSql::<Integer, Sqlite>::to_sql(&self.0, out)
-        }
-    }
+    declare_id!(OperatorId);
+    declare_id!(OperatorIdentityId);
+    declare_id!(AeadEncryptedId);
+    declare_id!(RootKeyHistoryId);
+    declare_id!(TlsHistoryId);
+    declare_id!(EvmWalletId);
+    declare_id!(ClientId);
 }
 pub use types::*;
 
@@ -130,12 +153,12 @@ pub use types::*;
 )]
 #[diesel(table_name = aead_encrypted, check_for_backend(Sqlite))]
 pub struct AeadEncrypted {
-    pub id: i32,
+    pub id: AeadEncryptedId,
     pub ciphertext: Vec<u8>,
     pub tag: Vec<u8>,
     pub current_nonce: Vec<u8>,
     pub schema_version: i32,
-    pub associated_root_key_id: i32, // references root_key_history.id
+    pub associated_root_key_id: RootKeyHistoryId,
     pub created_at: SqliteTimestamp,
 }
 
@@ -148,7 +171,7 @@ pub struct AeadEncrypted {
     attributes_with = "deriveless"
 )]
 pub struct RootKeyHistory {
-    pub id: i32,
+    pub id: RootKeyHistoryId,
     pub ciphertext: Vec<u8>,
     pub tag: Vec<u8>,
     pub root_key_encryption_nonce: Vec<u8>,
@@ -166,7 +189,7 @@ pub struct RootKeyHistory {
     attributes_with = "deriveless"
 )]
 pub struct TlsHistory {
-    pub id: i32,
+    pub id: TlsHistoryId,
     pub cert: String,
     pub cert_key: String, // PEM Encoded private key
     pub ca_cert: String,  // PEM Encoded certificate for cert signing
@@ -191,7 +214,7 @@ pub struct ArbiterSettings {
     attributes_with = "deriveless"
 )]
 pub struct EvmWallet {
-    pub id: i32,
+    pub id: EvmWalletId,
     pub address: Vec<u8>,
     pub aead_encrypted_id: i32,
     pub created_at: SqliteTimestamp,
@@ -213,7 +236,7 @@ pub struct EvmWallet {
 )]
 pub struct EvmWalletAccess {
     pub id: i32,
-    pub wallet_id: i32,
+    pub wallet_id: EvmWalletId,
     pub client_id: i32,
     pub created_at: SqliteTimestamp,
 }
@@ -240,7 +263,7 @@ pub struct ProgramClientMetadataHistory {
 #[derive(Models, Queryable, Debug, Insertable, Selectable)]
 #[diesel(table_name = schema::program_client, check_for_backend(Sqlite))]
 pub struct ProgramClient {
-    pub id: i32,
+    pub id: ClientId,
     pub public_key: Vec<u8>,
     pub metadata_id: i32,
     pub created_at: SqliteTimestamp,
@@ -248,14 +271,24 @@ pub struct ProgramClient {
 }
 
 #[derive(Queryable, Debug)]
-#[diesel(table_name = schema::operator_client, check_for_backend(Sqlite))]
-pub struct OperatorClient {
-    pub id: i32,
+#[diesel(table_name = schema::operator_identity, check_for_backend(Sqlite))]
+pub struct OperatorIdentity {
+    pub id: OperatorIdentityId,
     pub public_key: Vec<u8>,
     pub created_at: SqliteTimestamp,
     pub updated_at: SqliteTimestamp,
 }
 
+#[derive(Queryable, Debug)]
+#[diesel(table_name = schema::operator, check_for_backend(Sqlite))]
+pub struct Operator {
+    pub id: OperatorId,
+    pub share: Vec<u8>,
+    pub share_nonce: Vec<u8>,
+    pub created_at: SqliteTimestamp,
+    pub updated_at: SqliteTimestamp,
+}
+
 #[derive(Models, Queryable, Debug, Insertable, Selectable)]
 #[diesel(table_name = evm_ether_transfer_limit, check_for_backend(Sqlite))]
 #[view(
@@ -399,7 +432,7 @@ pub struct IntegrityEnvelope {
     pub entity_kind: String,
     pub entity_id: Vec<u8>,
     pub payload_version: i32,
-    pub key_version: i32,
+    pub key_version: RootKeyHistoryId,
     pub mac: Vec<u8>,
     pub signed_at: SqliteTimestamp,
     pub created_at: SqliteTimestamp,

server/crates/arbiter-server/src/db/schema.rs

@@ -152,6 +152,25 @@ diesel::table! {
     }
 }
 
+diesel::table! {
+    operator (id) {
+        id -> Nullable<Integer>,
+        share -> Binary,
+        share_nonce -> Binary,
+        created_at -> Integer,
+        updated_at -> Integer,
+    }
+}
+
+diesel::table! {
+    operator_identity (id) {
+        id -> Integer,
+        public_key -> Binary,
+        created_at -> Integer,
+        updated_at -> Integer,
+    }
+}
+
 diesel::table! {
     program_client (id) {
         id -> Integer,
@@ -185,15 +204,6 @@ diesel::table! {
     }
 }
 
-diesel::table! {
-    operator_client (id) {
-        id -> Integer,
-        public_key -> Binary,
-        created_at -> Integer,
-        updated_at -> Integer,
-    }
-}
-
 diesel::joinable!(aead_encrypted -> root_key_history (associated_root_key_id));
 diesel::joinable!(arbiter_settings -> root_key_history (root_key_id));
 diesel::joinable!(arbiter_settings -> tls_history (tls_id));
@@ -212,6 +222,7 @@ diesel::joinable!(evm_transaction_log -> evm_wallet_access (wallet_access_id));
 diesel::joinable!(evm_wallet -> aead_encrypted (aead_encrypted_id));
 diesel::joinable!(evm_wallet_access -> evm_wallet (wallet_id));
 diesel::joinable!(evm_wallet_access -> program_client (client_id));
+diesel::joinable!(operator -> operator_identity (id));
 diesel::joinable!(program_client -> client_metadata (metadata_id));
 
 diesel::allow_tables_to_appear_in_same_query!(
@@ -230,8 +241,9 @@ diesel::allow_tables_to_appear_in_same_query!(
     evm_wallet,
     evm_wallet_access,
     integrity_envelope,
+    operator,
+    operator_identity,
     program_client,
     root_key_history,
     tls_history,
-    operator_client,
 );

server/crates/arbiter-server/src/evm/mod.rs

@@ -179,22 +179,24 @@ impl Engine {
         }
 
         if run_kind == RunKind::Execution {
-            conn.transaction(async |conn| {
-                let log_id: i32 = insert_into(evm_transaction_log::table)
-                    .values(&NewEvmTransactionLog {
-                        grant_id: grant.common_settings_id,
-                        wallet_access_id: context.target.id,
-                        chain_id: context.chain.into(),
-                        eth_value: utils::u256_to_bytes(context.value).to_vec(),
-                        signed_at: Utc::now().into(),
-                    })
-                    .returning(evm_transaction_log::id)
-                    .get_result(&mut *conn)
-                    .await?;
+            conn.transaction(|conn| {
+                Box::pin(async move {
+                    let log_id: i32 = insert_into(evm_transaction_log::table)
+                        .values(&NewEvmTransactionLog {
+                            grant_id: grant.common_settings_id,
+                            wallet_access_id: context.target.id,
+                            chain_id: context.chain.into(),
+                            eth_value: utils::u256_to_bytes(context.value).to_vec(),
+                            signed_at: Utc::now().into(),
+                        })
+                        .returning(evm_transaction_log::id)
+                        .get_result(conn)
+                        .await?;
 
-                P::record_transaction(&context, meaning, log_id, &grant, &mut *conn).await?;
+                    P::record_transaction(&context, meaning, log_id, &grant, conn).await?;
 
-                QueryResult::Ok(())
+                    QueryResult::Ok(())
+                })
             })
             .await
             .map_err(DatabaseError::from)?;
@@ -220,52 +222,54 @@ impl Engine {
         let vault = self.vault.clone();
 
         let id = conn
-            .transaction(async |conn| {
-                use schema::evm_basic_grant;
+            .transaction(|conn| {
+                Box::pin(async move {
+                    use schema::evm_basic_grant;
 
-                #[expect(
-                    clippy::cast_possible_truncation,
-                    clippy::cast_possible_wrap,
-                    clippy::as_conversions,
-                    reason = "fixme! #86"
-                )]
-                let basic_grant: EvmBasicGrant = insert_into(evm_basic_grant::table)
-                    .values(&NewEvmBasicGrant {
-                        chain_id: full_grant.shared.chain.into(),
-                        wallet_access_id: full_grant.shared.wallet_access_id,
-                        valid_from: full_grant.shared.valid_from.map(SqliteTimestamp),
-                        valid_until: full_grant.shared.valid_until.map(SqliteTimestamp),
-                        max_gas_fee_per_gas: full_grant
-                            .shared
-                            .max_gas_fee_per_gas
-                            .map(|fee| utils::u256_to_bytes(fee).to_vec()),
-                        max_priority_fee_per_gas: full_grant
-                            .shared
-                            .max_priority_fee_per_gas
-                            .map(|fee| utils::u256_to_bytes(fee).to_vec()),
-                        rate_limit_count: full_grant
-                            .shared
-                            .rate_limit
-                            .as_ref()
-                            .map(|rl| rl.count as i32),
-                        rate_limit_window_secs: full_grant
-                            .shared
-                            .rate_limit
-                            .as_ref()
-                            .map(|rl| rl.window.num_seconds() as i32),
-                        revoked_at: None,
-                    })
-                    .returning(evm_basic_grant::all_columns)
-                    .get_result(&mut *conn)
-                    .await?;
+                    #[expect(
+                        clippy::cast_possible_truncation,
+                        clippy::cast_possible_wrap,
+                        clippy::as_conversions,
+                        reason = "fixme! #86"
+                    )]
+                    let basic_grant: EvmBasicGrant = insert_into(evm_basic_grant::table)
+                        .values(&NewEvmBasicGrant {
+                            chain_id: full_grant.shared.chain.into(),
+                            wallet_access_id: full_grant.shared.wallet_access_id,
+                            valid_from: full_grant.shared.valid_from.map(SqliteTimestamp),
+                            valid_until: full_grant.shared.valid_until.map(SqliteTimestamp),
+                            max_gas_fee_per_gas: full_grant
+                                .shared
+                                .max_gas_fee_per_gas
+                                .map(|fee| utils::u256_to_bytes(fee).to_vec()),
+                            max_priority_fee_per_gas: full_grant
+                                .shared
+                                .max_priority_fee_per_gas
+                                .map(|fee| utils::u256_to_bytes(fee).to_vec()),
+                            rate_limit_count: full_grant
+                                .shared
+                                .rate_limit
+                                .as_ref()
+                                .map(|rl| rl.count as i32),
+                            rate_limit_window_secs: full_grant
+                                .shared
+                                .rate_limit
+                                .as_ref()
+                                .map(|rl| rl.window.num_seconds() as i32),
+                            revoked_at: None,
+                        })
+                        .returning(evm_basic_grant::all_columns)
+                        .get_result(conn)
+                        .await?;
 
-                P::create_grant(&basic_grant, &full_grant.specific, &mut *conn).await?;
+                    P::create_grant(&basic_grant, &full_grant.specific, conn).await?;
 
-                integrity::sign_entity(&mut *conn, &vault, &full_grant, basic_grant.id)
-                    .await
-                    .map_err(|_| diesel::result::Error::RollbackTransaction)?;
+                    integrity::sign_entity(conn, &vault, &full_grant, basic_grant.id)
+                        .await
+                        .map_err(|_| diesel::result::Error::RollbackTransaction)?;
 
-                QueryResult::Ok(basic_grant.id)
+                    QueryResult::Ok(basic_grant.id)
+                })
             })
             .await?;
 
@@ -359,7 +363,8 @@ mod tests {
     use crate::db::{
         self, DatabaseConnection,
         models::{
-            EvmBasicGrant, EvmWalletAccess, NewEvmBasicGrant, NewEvmTransactionLog, SqliteTimestamp,
+            EvmBasicGrant, EvmWalletAccess, EvmWalletId, NewEvmBasicGrant, NewEvmTransactionLog,
+            SqliteTimestamp,
         },
         schema::{evm_basic_grant, evm_transaction_log},
     };
@@ -377,7 +382,7 @@ mod tests {
         EvalContext {
             target: EvmWalletAccess {
                 id: WALLET_ACCESS_ID,
-                wallet_id: 10,
+                wallet_id: EvmWalletId::from_raw(5),
                 client_id: 20,
                 created_at: SqliteTimestamp(Utc::now()),
             },

server/crates/arbiter-server/src/evm/policies/ether_transfer/tests.rs

@@ -3,7 +3,8 @@ use crate::{
     db::{
         self, DatabaseConnection,
         models::{
-            EvmBasicGrant, EvmWalletAccess, NewEvmBasicGrant, NewEvmTransactionLog, SqliteTimestamp,
+            EvmBasicGrant, EvmWalletAccess, EvmWalletId, NewEvmBasicGrant, NewEvmTransactionLog,
+            SqliteTimestamp,
         },
         schema::{evm_basic_grant, evm_transaction_log},
     },
@@ -31,7 +32,7 @@ fn ctx(to: Address, value: U256) -> EvalContext {
     EvalContext {
         target: EvmWalletAccess {
             id: WALLET_ACCESS_ID,
-            wallet_id: 10,
+            wallet_id: EvmWalletId::from_raw(10),
             client_id: 20,
             created_at: SqliteTimestamp(Utc::now()),
         },

server/crates/arbiter-server/src/evm/policies/token_transfers/tests.rs

@@ -2,7 +2,7 @@ use super::{Settings, TokenTransfer};
 use crate::{
     db::{
         self, DatabaseConnection,
-        models::{EvmBasicGrant, EvmWalletAccess, NewEvmBasicGrant, SqliteTimestamp},
+        models::{EvmBasicGrant, EvmWalletAccess, EvmWalletId, NewEvmBasicGrant, SqliteTimestamp},
         schema::evm_basic_grant,
     },
     evm::{
@@ -45,7 +45,7 @@ fn ctx(to: Address, calldata: Bytes) -> EvalContext {
     EvalContext {
         target: EvmWalletAccess {
             id: WALLET_ACCESS_ID,
-            wallet_id: 10,
+            wallet_id: EvmWalletId::from_raw(10),
             client_id: 20,
             created_at: SqliteTimestamp(Utc::now()),
         },

server/crates/arbiter-server/src/grpc/operator/evm.rs

@@ -90,7 +90,7 @@ async fn handle_wallet_list(
                 .into_iter()
                 .map(|(id, address)| WalletEntry {
                     address: address.to_vec(),
-                    id,
+                    id: id.to_raw(),
                 })
                 .collect(),
         }),

server/crates/arbiter-server/src/grpc/operator/inbound.rs

@@ -1,11 +1,10 @@
 use crate::{
-    db::models::{CoreEvmWalletAccess, NewEvmWalletAccess},
+    db::models::{CoreEvmWalletAccess, EvmWalletId, NewEvmWalletAccess},
     evm::policies::{
         SharedGrantSettings, SpecificGrant, TransactionRateLimit, VolumeRateLimit, ether_transfer,
         token_transfers,
     },
-    grpc::Convert,
-    grpc::TryConvert,
+    grpc::{Convert, TryConvert},
 };
 use arbiter_proto::{
     proto::evm::{
@@ -150,7 +149,7 @@ impl Convert for WalletAccess {
 
     fn convert(self) -> Self::Output {
         NewEvmWalletAccess {
-            wallet_id: self.wallet_id,
+            wallet_id: EvmWalletId::from_raw(self.wallet_id),
             client_id: self.sdk_client_id,
         }
     }
@@ -165,7 +164,7 @@ impl TryConvert for SdkClientWalletAccess {
             return Err(Status::invalid_argument("Missing wallet access entry"));
         };
         Ok(CoreEvmWalletAccess {
-            wallet_id: access.wallet_id,
+            wallet_id: EvmWalletId::from_raw(access.wallet_id),
             client_id: access.sdk_client_id,
             id: self.id,
         })

server/crates/arbiter-server/src/grpc/operator/outbound.rs

@@ -1,5 +1,5 @@
 use crate::{
-    db::models::EvmWalletAccess,
+    db::models::{EvmWalletAccess, EvmWalletId},
     evm::policies::{SharedGrantSettings, SpecificGrant, TransactionRateLimit, VolumeRateLimit},
     grpc::Convert,
 };
@@ -103,7 +103,7 @@ impl Convert for EvmWalletAccess {
         Self::Output {
             id: self.id,
             access: Some(WalletAccess {
-                wallet_id: self.wallet_id,
+                wallet_id: self.wallet_id.to_raw(),
                 sdk_client_id: self.client_id,
             }),
         }

server/crates/arbiter-server/src/grpc/operator/sdk_client.rs

@@ -1,8 +1,8 @@
 use crate::{
-    db::models::NewEvmWalletAccess,
+    db::models::{ClientId, NewEvmWalletAccess},
     grpc::Convert,
     peers::operator::{
-        OutOfBand, OperatorSession,
+        OperatorSession, OutOfBand,
         session::handlers::{
             HandleGrantEvmWalletAccess, HandleListWalletAccess, HandleNewClientApprove,
             HandleRevokeEvmWalletAccess, HandleSdkClientList,
@@ -11,8 +11,8 @@ use crate::{
 };
 use arbiter_crypto::authn;
 use arbiter_proto::proto::{
-    shared::ClientInfo as ProtoClientMetadata,
     operator::{
+        operator_response::Payload as OperatorResponsePayload,
         sdk_client::{
             self as proto_sdk_client, ConnectionCancel as ProtoSdkClientConnectionCancel,
             ConnectionRequest as ProtoSdkClientConnectionRequest,
@@ -24,8 +24,8 @@ use arbiter_proto::proto::{
             request::Payload as SdkClientRequestPayload,
             response::Payload as SdkClientResponsePayload,
         },
-        operator_response::Payload as OperatorResponsePayload,
     },
+    shared::ClientInfo as ProtoClientMetadata,
 };
 
 use kameo::actor::ActorRef;
@@ -115,7 +115,7 @@ async fn handle_list(
             clients: clients
                 .into_iter()
                 .map(|(client, metadata)| ProtoSdkClientEntry {
-                    id: client.id,
+                    id: client.id.to_raw(),
                     pubkey: client.public_key.clone(),
                     info: Some(ProtoClientMetadata {
                         name: metadata.name,

server/crates/arbiter-server/src/peers/client/auth.rs

@@ -171,42 +171,46 @@ async fn insert_client(
         Error::DatabasePoolUnavailable
     })?;
 
-    conn.exclusive_transaction(async |conn| {
-        let metadata_id = insert_into(client_metadata::table)
-            .values((
-                client_metadata::name.eq(&metadata.name),
-                client_metadata::description.eq(&metadata.description),
-                client_metadata::version.eq(&metadata.version),
-            ))
-            .returning(client_metadata::id)
-            .get_result::<i32>(&mut *conn)
-            .await?;
+    conn.exclusive_transaction(|conn| {
+        let vault = vault.clone();
+        let pubkey = pubkey.clone();
+        Box::pin(async move {
+            let metadata_id = insert_into(client_metadata::table)
+                .values((
+                    client_metadata::name.eq(&metadata.name),
+                    client_metadata::description.eq(&metadata.description),
+                    client_metadata::version.eq(&metadata.version),
+                ))
+                .returning(client_metadata::id)
+                .get_result::<i32>(conn)
+                .await?;
 
-        let client_id = insert_into(program_client::table)
-            .values((
-                program_client::public_key.eq(pubkey.to_bytes()),
-                program_client::metadata_id.eq(metadata_id),
-            ))
-            .on_conflict_do_nothing()
-            .returning(program_client::id)
-            .get_result::<i32>(&mut *conn)
-            .await?;
+            let client_id = insert_into(program_client::table)
+                .values((
+                    program_client::public_key.eq(pubkey.to_bytes()),
+                    program_client::metadata_id.eq(metadata_id),
+                ))
+                .on_conflict_do_nothing()
+                .returning(program_client::id)
+                .get_result::<i32>(conn)
+                .await?;
 
-        integrity::sign_entity(
-            &mut *conn,
-            vault,
-            &ClientCredentials {
-                pubkey: pubkey.clone(),
-            },
-            client_id,
-        )
-        .await
-        .map_err(|e| {
-            error!(error = ?e, "Failed to sign integrity tag for new client key");
-            Error::DatabaseOperationFailed
-        })?;
+            integrity::sign_entity(
+                conn,
+                &vault,
+                &ClientCredentials {
+                    pubkey: pubkey.clone(),
+                },
+                client_id,
+            )
+            .await
+            .map_err(|e| {
+                error!(error = ?e, "Failed to sign integrity tag for new client key");
+                Error::DatabaseOperationFailed
+            })?;
 
-        Ok(client_id)
+            Ok(client_id)
+        })
     })
     .await
 }
@@ -225,51 +229,55 @@ async fn sync_client_metadata(
         Error::DatabasePoolUnavailable
     })?;
 
-    conn.exclusive_transaction(async |conn| {
-        let (current_metadata_id, current): (i32, ProgramClientMetadata) = program_client::table
-            .find(client_id)
-            .inner_join(client_metadata::table)
-            .select((
-                program_client::metadata_id,
-                ProgramClientMetadata::as_select(),
-            ))
-            .first(&mut *conn)
-            .await?;
+    conn.exclusive_transaction(|conn| {
+        let metadata = metadata.clone();
+        Box::pin(async move {
+            let (current_metadata_id, current): (i32, ProgramClientMetadata) =
+                program_client::table
+                    .find(client_id)
+                    .inner_join(client_metadata::table)
+                    .select((
+                        program_client::metadata_id,
+                        ProgramClientMetadata::as_select(),
+                    ))
+                    .first(conn)
+                    .await?;
 
-        let unchanged = current.name == metadata.name
-            && current.description == metadata.description
-            && current.version == metadata.version;
-        if unchanged {
-            return Ok(());
-        }
+            let unchanged = current.name == metadata.name
+                && current.description == metadata.description
+                && current.version == metadata.version;
+            if unchanged {
+                return Ok(());
+            }
 
-        insert_into(client_metadata_history::table)
-            .values((
-                client_metadata_history::metadata_id.eq(current_metadata_id),
-                client_metadata_history::client_id.eq(client_id),
-            ))
-            .execute(&mut *conn)
-            .await?;
+            insert_into(client_metadata_history::table)
+                .values((
+                    client_metadata_history::metadata_id.eq(current_metadata_id),
+                    client_metadata_history::client_id.eq(client_id),
+                ))
+                .execute(conn)
+                .await?;
 
-        let metadata_id = insert_into(client_metadata::table)
-            .values((
-                client_metadata::name.eq(&metadata.name),
-                client_metadata::description.eq(&metadata.description),
-                client_metadata::version.eq(&metadata.version),
-            ))
-            .returning(client_metadata::id)
-            .get_result::<i32>(&mut *conn)
-            .await?;
+            let metadata_id = insert_into(client_metadata::table)
+                .values((
+                    client_metadata::name.eq(&metadata.name),
+                    client_metadata::description.eq(&metadata.description),
+                    client_metadata::version.eq(&metadata.version),
+                ))
+                .returning(client_metadata::id)
+                .get_result::<i32>(conn)
+                .await?;
 
-        update(program_client::table.find(client_id))
-            .set((
-                program_client::metadata_id.eq(metadata_id),
-                program_client::updated_at.eq(now),
-            ))
-            .execute(&mut *conn)
-            .await?;
+            update(program_client::table.find(client_id))
+                .set((
+                    program_client::metadata_id.eq(metadata_id),
+                    program_client::updated_at.eq(now),
+                ))
+                .execute(conn)
+                .await?;
 
-        Ok::<(), diesel::result::Error>(())
+            Ok::<(), diesel::result::Error>(())
+        })
     })
     .await
     .map_err(|e| {

server/crates/arbiter-server/src/peers/operator/auth/state.rs

@@ -4,7 +4,7 @@ use super::{
 };
 use crate::{
     actors::bootstrap::ConsumeToken,
-    db::{DatabasePool, schema::operator_client},
+    db::{DatabasePool, schema::operator_identity},
     peers::operator::auth::Outbound,
 };
 use arbiter_crypto::authn::{self, AuthChallenge, OPERATOR_CONTEXT};
@@ -19,7 +19,7 @@ pub(super) struct ChallengeRequest {
     pub(super) bootstrap_token: Option<String>,
 }
 
-pub struct ChallengeContext {
+pub(super) struct ChallengeContext {
     pub(super) challenge: AuthChallenge,
     pub(super) pubkey: authn::PublicKey,
     pub(super) bootstrap_token: Option<String>,
@@ -44,9 +44,9 @@ async fn get_client_id(db: &DatabasePool, pubkey: &authn::PublicKey) -> Result<O
         Error::internal("Database unavailable")
     })?;
 
-    operator_client::table
-        .filter(operator_client::public_key.eq(pubkey.to_bytes()))
-        .select(operator_client::id)
+    operator_identity::table
+        .filter(operator_identity::public_key.eq(pubkey.to_bytes()))
+        .select(operator_identity::id)
         .first::<i32>(&mut conn)
         .await
         .optional()
@@ -63,9 +63,9 @@ async fn register_key(db: &DatabasePool, pubkey: &authn::PublicKey) -> Result<i3
         Error::internal("Database unavailable")
     })?;
 
-    let id: i32 = diesel::insert_into(operator_client::table)
-        .values((operator_client::public_key.eq(pubkey_bytes),))
-        .returning(operator_client::id)
+    let id: i32 = diesel::insert_into(operator_identity::table)
+        .values((operator_identity::public_key.eq(pubkey_bytes),))
+        .returning(operator_identity::id)
         .get_result(&mut conn)
         .await
         .map_err(|e| {

server/crates/arbiter-server/src/peers/operator/session/handlers.rs

@@ -1,12 +1,16 @@
 use super::{Error, OperatorSession};
 use crate::{
-    actors::evm::{
-        ClientSignTransaction, Generate, ListWallets, OperatorCreateGrant, OperatorListGrants,
-        SignTransactionError as EvmSignError,
+    actors::{
+        evm::{
+            ClientSignTransaction, Generate, ListWallets, OperatorCreateGrant, OperatorListGrants,
+            SignTransactionError as EvmSignError,
+        },
+        flow_coordinator::client_connect_approval::ClientApprovalAnswer,
+        vault::VaultState,
+    },
+    db::models::{
+        EvmWalletAccess, EvmWalletId, NewEvmWalletAccess, ProgramClient, ProgramClientMetadata,
     },
-    actors::flow_coordinator::client_connect_approval::ClientApprovalAnswer,
-    actors::vault::VaultState,
-    db::models::{EvmWalletAccess, NewEvmWalletAccess, ProgramClient, ProgramClientMetadata},
     evm::policies::{Grant, SpecificGrant},
 };
 use arbiter_crypto::authn;
@@ -70,7 +74,9 @@ impl OperatorSession {
     }
 
     #[message]
-    pub(crate) async fn handle_evm_wallet_list(&mut self) -> Result<Vec<(i32, Address)>, Error> {
+    pub(crate) async fn handle_evm_wallet_list(
+        &mut self,
+    ) -> Result<Vec<(EvmWalletId, Address)>, Error> {
         match self.props.actors.evm.ask(ListWallets {}).await {
             Ok(wallets) => Ok(wallets),
             Err(err) => {
@@ -169,18 +175,20 @@ impl OperatorSession {
         entries: Vec<NewEvmWalletAccess>,
     ) -> Result<(), Error> {
         let mut conn = self.props.db.get().await?;
-        conn.transaction(async |conn| {
-            use crate::db::schema::evm_wallet_access;
+        conn.transaction(|conn| {
+            Box::pin(async move {
+                use crate::db::schema::evm_wallet_access;
 
-            for entry in entries {
-                diesel::insert_into(evm_wallet_access::table)
-                    .values(&entry)
-                    .on_conflict_do_nothing()
-                    .execute(&mut *conn)
-                    .await?;
-            }
+                for entry in entries {
+                    diesel::insert_into(evm_wallet_access::table)
+                        .values(&entry)
+                        .on_conflict_do_nothing()
+                        .execute(conn)
+                        .await?;
+                }
 
-            Result::<_, Error>::Ok(())
+                Result::<_, Error>::Ok(())
+            })
         })
         .await?;
         Ok(())
@@ -192,16 +200,18 @@ impl OperatorSession {
         entries: Vec<i32>,
     ) -> Result<(), Error> {
         let mut conn = self.props.db.get().await?;
-        conn.transaction(async |conn| {
-            use crate::db::schema::evm_wallet_access;
-            for entry in entries {
-                diesel::delete(evm_wallet_access::table)
-                    .filter(evm_wallet_access::wallet_id.eq(entry))
-                    .execute(&mut *conn)
-                    .await?;
-            }
+        conn.transaction(|conn| {
+            Box::pin(async move {
+                use crate::db::schema::evm_wallet_access;
+                for entry in entries {
+                    diesel::delete(evm_wallet_access::table)
+                        .filter(evm_wallet_access::wallet_id.eq(entry))
+                        .execute(conn)
+                        .await?;
+                }
 
-            Result::<_, Error>::Ok(())
+                Result::<_, Error>::Ok(())
+            })
         })
         .await?;
         Ok(())

server/crates/arbiter-server/tests/client/auth.rs

@@ -86,8 +86,8 @@ async fn insert_bootstrap_sentinel_operator(db: &db::DatabasePool) {
         .0
         .to_vec();
 
-    insert_into(schema::operator_client::table)
-        .values((schema::operator_client::public_key.eq(sentinel_key),))
+    insert_into(schema::operator_identity::table)
+        .values((schema::operator_identity::public_key.eq(sentinel_key),))
         .execute(&mut conn)
         .await
         .unwrap();

server/crates/arbiter-server/tests/operator/auth.rs

@@ -206,8 +206,8 @@ pub async fn bootstrap_token_auth() {
     task.await.unwrap().unwrap();
 
     let mut conn = db.get().await.unwrap();
-    let stored_pubkey: Vec<u8> = schema::operator_client::table
-        .select(schema::operator_client::public_key)
+    let stored_pubkey: Vec<u8> = schema::operator_identity::table
+        .select(schema::operator_identity::public_key)
         .first::<Vec<u8>>(&mut conn)
         .await
         .unwrap();
@@ -259,7 +259,7 @@ pub async fn bootstrap_invalid_token_auth() {
     ));
 
     let mut conn = db.get().await.unwrap();
-    let count: i64 = schema::operator_client::table
+    let count: i64 = schema::operator_identity::table
         .count()
         .get_result::<i64>(&mut conn)
         .await
@@ -285,9 +285,9 @@ pub async fn challenge_auth() {
 
     {
         let mut conn = db.get().await.unwrap();
-        let id: i32 = insert_into(schema::operator_client::table)
-            .values((schema::operator_client::public_key.eq(pubkey_bytes.clone()),))
-            .returning(schema::operator_client::id)
+        let id: i32 = insert_into(schema::operator_identity::table)
+            .values((schema::operator_identity::public_key.eq(pubkey_bytes.clone()),))
+            .returning(schema::operator_identity::id)
             .get_result(&mut conn)
             .await
             .unwrap();
@@ -371,8 +371,8 @@ pub async fn challenge_auth_rejects_integrity_tag_mismatch_when_unsealed() {
 
     {
         let mut conn = db.get().await.unwrap();
-        insert_into(schema::operator_client::table)
-            .values((schema::operator_client::public_key.eq(pubkey_bytes.clone()),))
+        insert_into(schema::operator_identity::table)
+            .values((schema::operator_identity::public_key.eq(pubkey_bytes.clone()),))
             .execute(&mut conn)
             .await
             .unwrap();
@@ -444,9 +444,9 @@ pub async fn challenge_auth_rejects_invalid_signature() {
 
     {
         let mut conn = db.get().await.unwrap();
-        let id: i32 = insert_into(schema::operator_client::table)
-            .values((schema::operator_client::public_key.eq(pubkey_bytes.clone()),))
-            .returning(schema::operator_client::id)
+        let id: i32 = insert_into(schema::operator_identity::table)
+            .values((schema::operator_identity::public_key.eq(pubkey_bytes.clone()),))
+            .returning(schema::operator_identity::id)
             .get_result(&mut conn)
             .await
             .unwrap();