fix(proto): build script

AGENTS.md

@@ -67,7 +67,7 @@ The server is actor-based using the **kameo** crate. All long-lived state lives
 
 - **`Bootstrapper`** — Manages the one-time bootstrap token written to `~/.arbiter/bootstrap_token` on first run.
 - **`KeyHolder`** — Holds the encrypted root key and manages the Sealed/Unsealed vault state machine. On unseal, decrypts the root key into a `memsafe` hardened memory cell.
-- **`MessageRouter`** — Coordinates streaming messages between user agents and SDK clients.
+- **`FlowCoordinator`** — Coordinates cross-connection flow between user agents and SDK clients.
 - **`EvmActor`** — Handles EVM transaction policy enforcement and signing.
 
 Per-connection actors live under `actors/user_agent/` and `actors/client/`, each with `auth` (challenge-response authentication) and `session` (post-auth operations) sub-modules.

CLAUDE.md

@@ -67,7 +67,7 @@ The server is actor-based using the **kameo** crate. All long-lived state lives
 
 - **`Bootstrapper`** — Manages the one-time bootstrap token written to `~/.arbiter/bootstrap_token` on first run.
 - **`KeyHolder`** — Holds the encrypted root key and manages the Sealed/Unsealed vault state machine. On unseal, decrypts the root key into a `memsafe` hardened memory cell.
-- **`MessageRouter`** — Coordinates streaming messages between user agents and SDK clients.
+- **`FlowCoordinator`** — Coordinates cross-connection flow between user agents and SDK clients.
 - **`EvmActor`** — Handles EVM transaction policy enforcement and signing.
 
 Per-connection actors live under `actors/user_agent/` and `actors/client/`, each with `auth` (challenge-response authentication) and `session` (post-auth operations) sub-modules.

protobufs/client.proto

@@ -5,8 +5,15 @@ package arbiter.client;
 import "evm.proto";
 import "google/protobuf/empty.proto";
 
+message ClientInfo {
+  string name = 1;
+  optional string description = 2;
+  optional string version = 3;
+}
+
 message AuthChallengeRequest {
   bytes pubkey = 1;
+  ClientInfo client_info = 2;
 }
 
 message AuthChallenge {

protobufs/evm.proto

@@ -12,7 +12,8 @@ enum EvmError {
 }
 
 message WalletEntry {
-  bytes address = 1; // 20-byte Ethereum address
+  int32 id = 1;
+  bytes address = 2; // 20-byte Ethereum address
 }
 
 message WalletList {
@@ -46,7 +47,7 @@ message VolumeRateLimit {
 }
 
 message SharedSettings {
-  int32 wallet_id = 1;
+  int32 wallet_access_id = 1;
   uint64 chain_id = 2;
   optional google.protobuf.Timestamp valid_from = 3;
   optional google.protobuf.Timestamp valid_until = 4;
@@ -139,9 +140,8 @@ message TransactionEvalError {
 
 // --- UserAgent grant management ---
 message EvmGrantCreateRequest {
-  int32 client_id = 1;
+  SharedSettings shared = 1;
-  SharedSettings shared = 2;
+  SpecificGrant specific = 2;
-  SpecificGrant specific = 3;
 }
 
 message EvmGrantCreateResponse {
@@ -165,13 +165,13 @@ message EvmGrantDeleteResponse {
 // Basic grant info returned in grant listings
 message GrantEntry {
   int32 id = 1;
-  int32 client_id = 2;
+  int32 wallet_access_id = 2;
   SharedSettings shared = 3;
   SpecificGrant specific = 4;
 }
 
 message EvmGrantListRequest {
-  optional int32 wallet_id = 1;
+  optional int32 wallet_access_id = 1;
 }
 
 message EvmGrantListResponse {

protobufs/user_agent.proto

@@ -2,6 +2,7 @@ syntax = "proto3";
 
 package arbiter.user_agent;
 
+import "client.proto";
 import "evm.proto";
 import "google/protobuf/empty.proto";
 
@@ -22,10 +23,6 @@ enum SdkClientError {
   SDK_CLIENT_ERROR_INTERNAL = 4;
 }
 
-message SdkClientApproveRequest {
-  bytes pubkey = 1; // 32-byte ed25519 public key
-}
-
 message SdkClientRevokeRequest {
   int32 client_id = 1;
 }
@@ -33,20 +30,14 @@ message SdkClientRevokeRequest {
 message SdkClientEntry {
   int32 id = 1;
   bytes pubkey = 2;
-  int32 created_at = 3;
+  arbiter.client.ClientInfo info = 3;
+  int32 created_at = 4;
 }
 
 message SdkClientList {
   repeated SdkClientEntry clients = 1;
 }
 
-message SdkClientApproveResponse {
-  oneof result {
-    SdkClientEntry client = 1;
-    SdkClientError error = 2;
-  }
-}
-
 message SdkClientRevokeResponse {
   oneof result {
     google.protobuf.Empty ok = 1;
@@ -129,13 +120,34 @@ enum VaultState {
 
 message SdkClientConnectionRequest {
   bytes pubkey = 1;
+  arbiter.client.ClientInfo info = 2;
 }
 
 message SdkClientConnectionResponse {
   bool approved = 1;
+  bytes pubkey = 2;
 }
 
-message SdkClientConnectionCancel {}
+message SdkClientConnectionCancel {
+  bytes pubkey = 1;
+}
+
+message SdkClientWalletAccess {
+  int32 client_id = 1;
+  int32 wallet_id = 2;
+}
+
+message SdkClientGrantWalletAccess {
+  repeated SdkClientWalletAccess accesses = 1;
+}
+
+message SdkClientRevokeWalletAccess {
+  repeated SdkClientWalletAccess accesses = 1;
+}
+
+message ListWalletAccessResponse {
+  repeated SdkClientWalletAccess accesses = 1;
+}
 
 message UserAgentRequest {
   int32 id = 16;
@@ -151,10 +163,12 @@ message UserAgentRequest {
     arbiter.evm.EvmGrantDeleteRequest evm_grant_delete = 9;
     arbiter.evm.EvmGrantListRequest evm_grant_list = 10;
     SdkClientConnectionResponse sdk_client_connection_response = 11;
-    SdkClientApproveRequest sdk_client_approve = 12;
+    SdkClientRevokeRequest sdk_client_revoke = 12;
-    SdkClientRevokeRequest sdk_client_revoke = 13;
+    google.protobuf.Empty sdk_client_list = 13;
-    google.protobuf.Empty sdk_client_list = 14;
+    BootstrapEncryptedKey bootstrap_encrypted_key = 14;
-    BootstrapEncryptedKey bootstrap_encrypted_key = 15;
+    SdkClientGrantWalletAccess grant_wallet_access = 15;
+    SdkClientRevokeWalletAccess revoke_wallet_access = 17;
+    google.protobuf.Empty list_wallet_access = 18;
   }
 }
 message UserAgentResponse {
@@ -170,10 +184,11 @@ message UserAgentResponse {
     arbiter.evm.EvmGrantCreateResponse evm_grant_create = 8;
     arbiter.evm.EvmGrantDeleteResponse evm_grant_delete = 9;
     arbiter.evm.EvmGrantListResponse evm_grant_list = 10;
-    SdkClientConnectionResponse sdk_client_connection_response = 11;
+    SdkClientConnectionRequest sdk_client_connection_request = 11;
-    SdkClientApproveResponse sdk_client_approve_response = 12;
+    SdkClientConnectionCancel sdk_client_connection_cancel = 12;
     SdkClientRevokeResponse sdk_client_revoke_response = 13;
     SdkClientListResponse sdk_client_list_response = 14;
     BootstrapResult bootstrap_result = 15;
+    ListWalletAccessResponse list_wallet_access_response = 17;
   }
 }

server/crates/arbiter-client/src/auth.rs

@@ -1,8 +1,8 @@
 use arbiter_proto::{
-    format_challenge,
+    ClientMetadata, format_challenge,
     proto::client::{
-        AuthChallengeRequest, AuthChallengeSolution, AuthResult, ClientRequest,
+        AuthChallengeRequest, AuthChallengeSolution, AuthResult, ClientInfo as ProtoClientInfo,
-        client_request::Payload as ClientRequestPayload,
+        ClientRequest, client_request::Payload as ClientRequestPayload,
         client_response::Payload as ClientResponsePayload,
     },
 };
@@ -14,19 +14,7 @@ use crate::{
 };
 
 #[derive(Debug, thiserror::Error)]
-pub enum ConnectError {
+pub enum AuthError {
-    #[error("Could not establish connection")]
-    Connection(#[from] tonic::transport::Error),
-
-    #[error("Invalid server URI")]
-    InvalidUri(#[from] http::uri::InvalidUri),
-
-    #[error("Invalid CA certificate")]
-    InvalidCaCert(#[from] webpki::Error),
-
-    #[error("gRPC error")]
-    Grpc(#[from] tonic::Status),
-
     #[error("Auth challenge was not returned by server")]
     MissingAuthChallenge,
 
@@ -43,48 +31,54 @@ pub enum ConnectError {
     Storage(#[from] StorageError),
 }
 
-fn map_auth_result(code: i32) -> ConnectError {
+fn map_auth_result(code: i32) -> AuthError {
     match AuthResult::try_from(code).unwrap_or(AuthResult::Unspecified) {
-        AuthResult::ApprovalDenied => ConnectError::ApprovalDenied,
+        AuthResult::ApprovalDenied => AuthError::ApprovalDenied,
-        AuthResult::NoUserAgentsOnline => ConnectError::NoUserAgentsOnline,
+        AuthResult::NoUserAgentsOnline => AuthError::NoUserAgentsOnline,
         AuthResult::Unspecified
         | AuthResult::Success
         | AuthResult::InvalidKey
         | AuthResult::InvalidSignature
-        | AuthResult::Internal => ConnectError::UnexpectedAuthResponse,
+        | AuthResult::Internal => AuthError::UnexpectedAuthResponse,
     }
 }
 
 async fn send_auth_challenge_request(
     transport: &mut ClientTransport,
+    metadata: ClientMetadata,
     key: &ed25519_dalek::SigningKey,
-) -> std::result::Result<(), ConnectError> {
+) -> std::result::Result<(), AuthError> {
     transport
         .send(ClientRequest {
             request_id: next_request_id(),
             payload: Some(ClientRequestPayload::AuthChallengeRequest(
                 AuthChallengeRequest {
                     pubkey: key.verifying_key().to_bytes().to_vec(),
+                    client_info: Some(ProtoClientInfo {
+                        name: metadata.name,
+                        description: metadata.description,
+                        version: metadata.version,
+                    }),
                 },
             )),
         })
         .await
-        .map_err(|_| ConnectError::UnexpectedAuthResponse)
+        .map_err(|_| AuthError::UnexpectedAuthResponse)
 }
 
 async fn receive_auth_challenge(
     transport: &mut ClientTransport,
-) -> std::result::Result<arbiter_proto::proto::client::AuthChallenge, ConnectError> {
+) -> std::result::Result<arbiter_proto::proto::client::AuthChallenge, AuthError> {
     let response = transport
         .recv()
         .await
-        .map_err(|_| ConnectError::MissingAuthChallenge)?;
+        .map_err(|_| AuthError::MissingAuthChallenge)?;
 
-    let payload = response.payload.ok_or(ConnectError::MissingAuthChallenge)?;
+    let payload = response.payload.ok_or(AuthError::MissingAuthChallenge)?;
     match payload {
         ClientResponsePayload::AuthChallenge(challenge) => Ok(challenge),
         ClientResponsePayload::AuthResult(result) => Err(map_auth_result(result)),
-        _ => Err(ConnectError::UnexpectedAuthResponse),
+        _ => Err(AuthError::UnexpectedAuthResponse),
     }
 }
 
@@ -92,7 +86,7 @@ async fn send_auth_challenge_solution(
     transport: &mut ClientTransport,
     key: &ed25519_dalek::SigningKey,
     challenge: arbiter_proto::proto::client::AuthChallenge,
-) -> std::result::Result<(), ConnectError> {
+) -> std::result::Result<(), AuthError> {
     let challenge_payload = format_challenge(challenge.nonce, &challenge.pubkey);
     let signature = key.sign(&challenge_payload).to_bytes().to_vec();
 
@@ -104,20 +98,20 @@ async fn send_auth_challenge_solution(
             )),
         })
         .await
-        .map_err(|_| ConnectError::UnexpectedAuthResponse)
+        .map_err(|_| AuthError::UnexpectedAuthResponse)
 }
 
 async fn receive_auth_confirmation(
     transport: &mut ClientTransport,
-) -> std::result::Result<(), ConnectError> {
+) -> std::result::Result<(), AuthError> {
     let response = transport
         .recv()
         .await
-        .map_err(|_| ConnectError::UnexpectedAuthResponse)?;
+        .map_err(|_| AuthError::UnexpectedAuthResponse)?;
 
     let payload = response
         .payload
-        .ok_or(ConnectError::UnexpectedAuthResponse)?;
+        .ok_or(AuthError::UnexpectedAuthResponse)?;
     match payload {
         ClientResponsePayload::AuthResult(result)
             if AuthResult::try_from(result).ok() == Some(AuthResult::Success) =>
@@ -125,15 +119,16 @@ async fn receive_auth_confirmation(
             Ok(())
         }
         ClientResponsePayload::AuthResult(result) => Err(map_auth_result(result)),
-        _ => Err(ConnectError::UnexpectedAuthResponse),
+        _ => Err(AuthError::UnexpectedAuthResponse),
     }
 }
 
 pub(crate) async fn authenticate(
     transport: &mut ClientTransport,
+    metadata: ClientMetadata,
     key: &ed25519_dalek::SigningKey,
-) -> std::result::Result<(), ConnectError> {
+) -> std::result::Result<(), AuthError> {
-    send_auth_challenge_request(transport, key).await?;
+    send_auth_challenge_request(transport, metadata, key).await?;
     let challenge = receive_auth_challenge(transport).await?;
     send_auth_challenge_solution(transport, key, challenge).await?;
     receive_auth_confirmation(transport).await

server/crates/arbiter-client/src/bin/test_connect.rs

@@ -0,0 +1,48 @@
+
+use std::io::{self, Write};
+
+use arbiter_client::ArbiterClient;
+use arbiter_proto::{ClientMetadata, url::ArbiterUrl};
+use tonic::ConnectError;
+
+#[tokio::main]
+async fn main() {
+    println!("Testing connection to Arbiter server...");
+    print!("Enter ArbiterUrl: ");
+    let _ = io::stdout().flush();
+
+    let mut input = String::new();
+    if let Err(err) = io::stdin().read_line(&mut input) {
+        eprintln!("Failed to read input: {err}");
+        return;
+    }
+
+    let input = input.trim();
+    if input.is_empty() {
+        eprintln!("ArbiterUrl cannot be empty");
+        return;
+    }
+
+   
+
+    let url = match ArbiterUrl::try_from(input) {
+        Ok(url) => url,
+        Err(err) => {
+            eprintln!("Invalid ArbiterUrl: {err}");
+            return;
+        }
+    };
+
+     println!("{:#?}", url);
+
+    let metadata = ClientMetadata {
+        name: "arbiter-client test_connect".to_string(),
+        description: Some("Manual connection smoke test".to_string()),
+        version: Some(env!("CARGO_PKG_VERSION").to_string()),
+    };
+
+    match ArbiterClient::connect(url, metadata).await {
+        Ok(_) => println!("Connected and authenticated successfully."),
+        Err(err) => eprintln!("Failed to connect: {:#?}", err),
+    }
+}

server/crates/arbiter-client/src/client.rs

@@ -1,25 +1,36 @@
-use arbiter_proto::{proto::arbiter_service_client::ArbiterServiceClient, url::ArbiterUrl};
+use arbiter_proto::{ClientMetadata, proto::arbiter_service_client::ArbiterServiceClient, url::ArbiterUrl};
 use std::sync::Arc;
 use tokio::sync::{Mutex, mpsc};
 use tokio_stream::wrappers::ReceiverStream;
 use tonic::transport::ClientTlsConfig;
 
 use crate::{
-    auth::{ConnectError, authenticate},
+    StorageError, auth::{AuthError, authenticate}, storage::{FileSigningKeyStorage, SigningKeyStorage}, transport::{BUFFER_LENGTH, ClientTransport}
-    storage::{FileSigningKeyStorage, SigningKeyStorage},
-    transport::{BUFFER_LENGTH, ClientTransport},
 };
 
 #[cfg(feature = "evm")]
 use crate::wallets::evm::ArbiterEvmWallet;
 
 #[derive(Debug, thiserror::Error)]
-pub enum ClientError {
+pub enum Error {
     #[error("gRPC error")]
     Grpc(#[from] tonic::Status),
 
-    #[error("Connection closed by server")]
+    #[error("Could not establish connection")]
-    ConnectionClosed,
+    Connection(#[from] tonic::transport::Error),
+
+    #[error("Invalid server URI")]
+    InvalidUri(#[from] http::uri::InvalidUri),
+
+    #[error("Invalid CA certificate")]
+    InvalidCaCert(#[from] webpki::Error),
+
+    #[error("Authentication error")]
+    Authentication(#[from] AuthError),
+
+    #[error("Storage error")]
+    Storage(#[from] StorageError),
+    
 }
 
 pub struct ArbiterClient {
@@ -28,27 +39,29 @@ pub struct ArbiterClient {
 }
 
 impl ArbiterClient {
-    pub async fn connect(url: ArbiterUrl) -> Result<Self, ConnectError> {
+    pub async fn connect(url: ArbiterUrl, metadata: ClientMetadata) -> Result<Self, Error> {
         let storage = FileSigningKeyStorage::from_default_location()?;
-        Self::connect_with_storage(url, &storage).await
+        Self::connect_with_storage(url, metadata, &storage).await
     }
 
     pub async fn connect_with_storage<S: SigningKeyStorage>(
         url: ArbiterUrl,
+        metadata: ClientMetadata,
         storage: &S,
-    ) -> Result<Self, ConnectError> {
+    ) -> Result<Self, Error> {
         let key = storage.load_or_create()?;
-        Self::connect_with_key(url, key).await
+        Self::connect_with_key(url, metadata, key).await
     }
 
     pub async fn connect_with_key(
         url: ArbiterUrl,
+        metadata: ClientMetadata,
         key: ed25519_dalek::SigningKey,
-    ) -> Result<Self, ConnectError> {
+    ) -> Result<Self, Error> {
         let anchor = webpki::anchor_from_trusted_cert(&url.ca_cert)?.to_owned();
         let tls = ClientTlsConfig::new().trust_anchor(anchor);
 
-        let channel = tonic::transport::Channel::from_shared(format!("{}:{}", url.host, url.port))?
+        let channel = tonic::transport::Channel::from_shared(format!("https://{}:{}", url.host, url.port))?
             .tls_config(tls)?
             .connect()
             .await?;
@@ -62,7 +75,7 @@ impl ArbiterClient {
             receiver: response_stream,
         };
 
-        authenticate(&mut transport, &key).await?;
+        authenticate(&mut transport, metadata, &key).await?;
 
         Ok(Self {
             transport: Arc::new(Mutex::new(transport)),
@@ -70,7 +83,7 @@ impl ArbiterClient {
     }
 
     #[cfg(feature = "evm")]
-    pub async fn evm_wallets(&self) -> Result<Vec<ArbiterEvmWallet>, ClientError> {
+    pub async fn evm_wallets(&self) -> Result<Vec<ArbiterEvmWallet>, Error> {
         todo!("fetch EVM wallet list from server")
     }
 }

server/crates/arbiter-client/src/lib.rs

@@ -4,8 +4,8 @@ mod storage;
 mod transport;
 pub mod wallets;
 
-pub use auth::ConnectError;
+pub use auth::AuthError;
-pub use client::{ArbiterClient, ClientError};
+pub use client::{ArbiterClient, Error};
 pub use storage::{FileSigningKeyStorage, SigningKeyStorage, StorageError};
 
 #[cfg(feature = "evm")]

server/crates/arbiter-proto/build.rs

@@ -1,32 +1,28 @@
 use std::path::PathBuf;
-use tonic_prost_build::configure;
+use tonic_prost_build::{Config, configure};
 
 static PROTOBUF_DIR: &str = "../../../protobufs";
 
 fn main() -> Result<(), Box<dyn std::error::Error>> {
-    let manifest_dir = PathBuf::from(std::env::var("CARGO_MANIFEST_DIR")?);
+    println!("cargo::rerun-if-changed={PROTOBUF_DIR}");
-    let protobuf_dir = manifest_dir.join(PROTOBUF_DIR);
+
-    let protoc_include = protoc_bin_vendored::include_path()?;
     let protoc_path = protoc_bin_vendored::protoc_bin_path()?;
+    let protoc_include = protoc_bin_vendored::include_path()?;
 
-    unsafe {
+    let mut config = Config::new();
-        std::env::set_var("PROTOC", &protoc_path);
+    config.protoc_executable(protoc_path);
-        std::env::set_var("PROTOC_INCLUDE", &protoc_include);
-    }
 
-    println!("cargo::rerun-if-changed={}", protobuf_dir.display());
+    let protos = [
+        PathBuf::from(format!("{}/arbiter.proto", PROTOBUF_DIR)),
+        PathBuf::from(format!("{}/user_agent.proto", PROTOBUF_DIR)),
+        PathBuf::from(format!("{}/client.proto", PROTOBUF_DIR)),
+        PathBuf::from(format!("{}/evm.proto", PROTOBUF_DIR)),
+    ];
+
+    let includes = [PathBuf::from(PROTOBUF_DIR), protoc_include];
 
     configure()
         .message_attribute(".", "#[derive(::kameo::Reply)]")
-        .compile_well_known_types(true)
+        .compile_with_config(config, &protos, &includes)?;
-        .compile_protos(
-            &[
-                protobuf_dir.join("arbiter.proto"),
-                protobuf_dir.join("user_agent.proto"),
-                protobuf_dir.join("client.proto"),
-                protobuf_dir.join("evm.proto"),
-            ],
-            &[protobuf_dir],
-        )?;
     Ok(())
 }

server/crates/arbiter-proto/src/lib.rs

@@ -3,12 +3,6 @@ pub mod url;
 
 use base64::{Engine, prelude::BASE64_STANDARD};
 
-pub mod google {
-    pub mod protobuf {
-        tonic::include_proto!("google.protobuf");
-    }
-}
-
 pub mod proto {
     tonic::include_proto!("arbiter");
 
@@ -25,6 +19,13 @@ pub mod proto {
     }
 }
 
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ClientMetadata {
+    pub name: String,
+    pub description: Option<String>,
+    pub version: Option<String>,
+}
+
 pub static BOOTSTRAP_PATH: &str = "bootstrap_token";
 
 pub fn home_path() -> Result<std::path::PathBuf, std::io::Error> {

server/crates/arbiter-proto/src/transport.rs

@@ -89,7 +89,7 @@ pub trait Sender<Outbound>: Send + Sync {
 }
 
 #[async_trait]
-pub trait Receiver<Inbound>: Send + Sync  {
+pub trait Receiver<Inbound>: Send + Sync {
     async fn recv(&mut self) -> Option<Inbound>;
 }
 

server/crates/arbiter-proto/src/url.rs

@@ -7,6 +7,8 @@ const ARBITER_URL_SCHEME: &str = "arbiter";
 const CERT_QUERY_KEY: &str = "cert";
 const BOOTSTRAP_TOKEN_QUERY_KEY: &str = "bootstrap_token";
 
+
+#[derive(Debug, Clone)]
 pub struct ArbiterUrl {
     pub host: String,
     pub port: u16,

server/crates/arbiter-server/migrations/2026-02-14-171124-0000_init/up.sql

@@ -28,7 +28,7 @@ create table if not exists tls_history (
     id INTEGER not null PRIMARY KEY,
     cert text not null,
     cert_key text not null, -- PEM Encoded private key
-    ca_cert text not null, 
+    ca_cert text not null,
     ca_key text not null, -- PEM Encoded private key
     created_at integer not null default(unixepoch ('now'))
 ) STRICT;
@@ -40,7 +40,8 @@ create table if not exists arbiter_settings (
     tls_id integer references tls_history (id) on delete RESTRICT
 ) STRICT;
 
-insert into arbiter_settings (id) values (1) on conflict do nothing; -- ensure singleton row exists
+insert into arbiter_settings (id) values (1) on conflict do nothing;
+-- ensure singleton row exists
 
 create table if not exists useragent_client (
     id integer not null primary key,
@@ -50,15 +51,40 @@ create table if not exists useragent_client (
     created_at integer not null default(unixepoch ('now')),
     updated_at integer not null default(unixepoch ('now'))
 ) STRICT;
+create unique index if not exists uniq_useragent_client_public_key on useragent_client (public_key, key_type);
+
+create table if not exists client_metadata (
+    id integer not null primary key,
+    name text not null, -- human-readable name for the client
+    description text, -- optional description for the client
+    version text, -- client version for tracking and debugging
+    created_at integer not null default(unixepoch ('now'))
+) STRICT;
+
+-- created to track history of changes
+create table if not exists client_metadata_history (
+    id integer not null primary key,
+    metadata_id integer not null references client_metadata (id) on delete cascade,
+    client_id integer not null references program_client (id) on delete cascade,
+    created_at integer not null default(unixepoch ('now'))
+) STRICT;
+
+create unique index if not exists uniq_metadata_binding_client on client_metadata_history (client_id);
 
 create table if not exists program_client (
     id integer not null primary key,
     nonce integer not null default(1), -- used for auth challenge
     public_key blob not null,
+    metadata_id integer not null references client_metadata (id) on delete cascade,
     created_at integer not null default(unixepoch ('now')),
     updated_at integer not null default(unixepoch ('now'))
 ) STRICT;
 
+create unique index if not exists program_client_public_key_unique
+    on program_client (public_key);
+
+create unique index if not exists uniq_program_client_public_key on program_client (public_key);
+
 create table if not exists evm_wallet (
     id integer not null primary key,
     address blob not null, -- 20-byte Ethereum address
@@ -67,95 +93,101 @@ create table if not exists evm_wallet (
 ) STRICT;
 
 create unique index if not exists uniq_evm_wallet_address on evm_wallet (address);
+
 create unique index if not exists uniq_evm_wallet_aead on evm_wallet (aead_encrypted_id);
 
+create table if not exists evm_wallet_access (
+    id integer not null primary key,
+    wallet_id integer not null references evm_wallet (id) on delete cascade,
+    client_id integer not null references program_client (id) on delete cascade,
+    created_at integer not null default(unixepoch ('now'))
+) STRICT;
+
+create unique index if not exists uniq_wallet_access on evm_wallet_access (wallet_id, client_id);
+
 create table if not exists evm_ether_transfer_limit (
     id integer not null primary key,
-    window_secs integer not null,           -- window duration in seconds
+    window_secs integer not null, -- window duration in seconds
-    max_volume blob not null                -- big-endian 32-byte U256
+    max_volume blob not null -- big-endian 32-byte U256
 ) STRICT;
 
 -- Shared grant properties: client scope, timeframe, fee caps, and rate limit
 create table if not exists evm_basic_grant (
     id integer not null primary key,
-    wallet_id integer not null references evm_wallet(id) on delete restrict, 
+    wallet_access_id integer not null references evm_wallet_access (id) on delete restrict,
-    client_id integer not null references program_client(id) on delete restrict,
+    chain_id integer not null, -- EIP-155 chain ID
-    chain_id integer not null,              -- EIP-155 chain ID
+    valid_from integer, -- unix timestamp (seconds), null = no lower bound
-    valid_from integer,                     -- unix timestamp (seconds), null = no lower bound
+    valid_until integer, -- unix timestamp (seconds), null = no upper bound
-    valid_until integer,                    -- unix timestamp (seconds), null = no upper bound
+    max_gas_fee_per_gas blob, -- big-endian 32-byte U256, null = unlimited
-    max_gas_fee_per_gas blob,               -- big-endian 32-byte U256, null = unlimited
+    max_priority_fee_per_gas blob, -- big-endian 32-byte U256, null = unlimited
-    max_priority_fee_per_gas blob,          -- big-endian 32-byte U256, null = unlimited
+    rate_limit_count integer, -- max transactions in window, null = unlimited
-    rate_limit_count integer,               -- max transactions in window, null = unlimited
+    rate_limit_window_secs integer, -- window duration in seconds, null = unlimited
-    rate_limit_window_secs integer,         -- window duration in seconds, null = unlimited
+    revoked_at integer, -- unix timestamp when revoked, null = still active
-    revoked_at integer,                     -- unix timestamp when revoked, null = still active
+    created_at integer not null default(unixepoch ('now'))
-    created_at integer not null default(unixepoch('now'))
 ) STRICT;
 
 -- Shared transaction log for all EVM grants, used for rate limit tracking and auditing
 create table if not exists evm_transaction_log (
     id integer not null primary key,
-    grant_id integer not null references evm_basic_grant(id) on delete restrict,
+    wallet_access_id integer not null references evm_wallet_access (id) on delete restrict,
-    client_id integer not null references program_client(id) on delete restrict,
+    grant_id integer not null references evm_basic_grant (id) on delete restrict,
-    wallet_id integer not null references evm_wallet(id) on delete restrict,
     chain_id integer not null,
-    eth_value blob not null,     -- always present on any EVM tx
+    eth_value blob not null, -- always present on any EVM tx
-    signed_at integer not null default(unixepoch('now'))
+    signed_at integer not null default(unixepoch ('now'))
 ) STRICT;
 
-create index if not exists idx_evm_basic_grant_wallet_chain on evm_basic_grant(client_id, wallet_id, chain_id);
+create index if not exists idx_evm_basic_grant_access_chain on evm_basic_grant (wallet_access_id, chain_id);
 
 -- ===============================
 -- ERC20 token transfer grant
 -- ===============================
 create table if not exists evm_token_transfer_grant (
     id integer not null primary key,
-    basic_grant_id integer not null unique references evm_basic_grant(id) on delete cascade,
+    basic_grant_id integer not null unique references evm_basic_grant (id) on delete cascade,
-    token_contract blob not null,            -- 20-byte ERC20 contract address
+    token_contract blob not null, -- 20-byte ERC20 contract address
-    receiver blob                            -- 20-byte recipient address or null if every recipient allowed
+    receiver blob -- 20-byte recipient address or null if every recipient allowed
 ) STRICT;
 
 -- Per-window volume limits for token transfer grants
 create table if not exists evm_token_transfer_volume_limit (
     id integer not null primary key,
-    grant_id integer not null references evm_token_transfer_grant(id) on delete cascade,
+    grant_id integer not null references evm_token_transfer_grant (id) on delete cascade,
-    window_secs integer not null,           -- window duration in seconds
+    window_secs integer not null, -- window duration in seconds
-    max_volume blob not null                -- big-endian 32-byte U256
+    max_volume blob not null -- big-endian 32-byte U256
 ) STRICT;
 
 -- Log table for token transfer grant usage
 create table if not exists evm_token_transfer_log (
     id integer not null primary key,
-    grant_id integer not null references evm_token_transfer_grant(id) on delete restrict,
+    grant_id integer not null references evm_token_transfer_grant (id) on delete restrict,
-    log_id integer not null references evm_transaction_log(id) on delete restrict,
+    log_id integer not null references evm_transaction_log (id) on delete restrict,
-    chain_id integer not null,              -- EIP-155 chain ID
+    chain_id integer not null, -- EIP-155 chain ID
-    token_contract blob not null,           -- 20-byte ERC20 contract address
+    token_contract blob not null, -- 20-byte ERC20 contract address
-    recipient_address blob not null,        -- 20-byte recipient address
+    recipient_address blob not null, -- 20-byte recipient address
-    value blob not null,                    -- big-endian 32-byte U256
+    value blob not null, -- big-endian 32-byte U256
-    created_at integer not null default(unixepoch('now'))
+    created_at integer not null default(unixepoch ('now'))
 ) STRICT;
 
-create index if not exists idx_token_transfer_log_grant on evm_token_transfer_log(grant_id);
+create index if not exists idx_token_transfer_log_grant on evm_token_transfer_log (grant_id);
-create index if not exists idx_token_transfer_log_log_id on evm_token_transfer_log(log_id);
-create index if not exists idx_token_transfer_log_chain on evm_token_transfer_log(chain_id);
 
+create index if not exists idx_token_transfer_log_log_id on evm_token_transfer_log (log_id);
+
+create index if not exists idx_token_transfer_log_chain on evm_token_transfer_log (chain_id);
 
 -- ===============================
 -- Ether transfer grant (uses base log)
 -- ===============================
 create table if not exists evm_ether_transfer_grant (
     id integer not null primary key,
-    basic_grant_id integer not null unique references evm_basic_grant(id) on delete cascade,
+    basic_grant_id integer not null unique references evm_basic_grant (id) on delete cascade,
-    limit_id integer not null references evm_ether_transfer_limit(id) on delete restrict
+    limit_id integer not null references evm_ether_transfer_limit (id) on delete restrict
 ) STRICT;
 
 -- Specific recipient addresses for an ether transfer grant
 create table if not exists evm_ether_transfer_grant_target (
     id integer not null primary key,
-    grant_id integer not null references evm_ether_transfer_grant(id) on delete cascade,
+    grant_id integer not null references evm_ether_transfer_grant (id) on delete cascade,
-    address blob not null                   -- 20-byte recipient address
+    address blob not null -- 20-byte recipient address
 ) STRICT;
 
-create unique index if not exists uniq_ether_transfer_target on evm_ether_transfer_grant_target(grant_id, address);
+create unique index if not exists uniq_ether_transfer_target on evm_ether_transfer_grant_target (grant_id, address);
-
-CREATE UNIQUE INDEX program_client_public_key_unique
-    ON program_client (public_key);

server/crates/arbiter-server/src/actors/client/auth.rs

@@ -1,9 +1,10 @@
 use arbiter_proto::{
-    format_challenge,
+    ClientMetadata, format_challenge, transport::{Bi, expect_message}
-    transport::{Bi, expect_message},
 };
+use chrono::Utc;
 use diesel::{
-    ExpressionMethods as _, OptionalExtension as _, QueryDsl as _, dsl::insert_into, update,
+    ExpressionMethods as _, OptionalExtension as _, QueryDsl as _, SelectableHelper as _,
+    dsl::insert_into, update,
 };
 use diesel_async::RunQueryDsl as _;
 use ed25519_dalek::{Signature, VerifyingKey};
@@ -12,10 +13,14 @@ use tracing::error;
 
 use crate::{
     actors::{
-        client::ClientConnection,
+        client::{ClientConnection, ClientProfile},
-        router::{self, RequestClientApproval},
+        flow_coordinator::{self, RequestClientApproval},
+    },
+    db::{
+        self,
+        models::{ProgramClientMetadata, SqliteTimestamp},
+        schema::program_client,
     },
-    db::{self, schema::program_client},
 };
 
 #[derive(thiserror::Error, Debug, Clone, PartialEq, Eq)]
@@ -39,13 +44,18 @@ pub enum ApproveError {
     #[error("Client connection denied by user agents")]
     Denied,
     #[error("Upstream error: {0}")]
-    Upstream(router::ApprovalError),
+    Upstream(flow_coordinator::ApprovalError),
 }
 
 #[derive(Debug, Clone)]
 pub enum Inbound {
-    AuthChallengeRequest { pubkey: VerifyingKey },
+    AuthChallengeRequest {
-    AuthChallengeSolution { signature: Signature },
+        pubkey: VerifyingKey,
+        metadata: ClientMetadata,
+    },
+    AuthChallengeSolution {
+        signature: Signature,
+    },
 }
 
 #[derive(Debug, Clone)]
@@ -54,9 +64,17 @@ pub enum Outbound {
     AuthSuccess,
 }
 
+pub struct ClientInfo {
+    pub id: i32,
+    pub current_nonce: i32,
+}
+
 /// Atomically reads and increments the nonce for a known client.
 /// Returns `None` if the pubkey is not registered.
-async fn get_nonce(db: &db::DatabasePool, pubkey: &VerifyingKey) -> Result<Option<i32>, Error> {
+async fn get_client_and_nonce(
+    db: &db::DatabasePool,
+    pubkey: &VerifyingKey,
+) -> Result<Option<ClientInfo>, Error> {
     let pubkey_bytes = pubkey.as_bytes().to_vec();
 
     let mut conn = db.get().await.map_err(|e| {
@@ -83,8 +101,10 @@ async fn get_nonce(db: &db::DatabasePool, pubkey: &VerifyingKey) -> Result<Optio
                 .execute(conn)
                 .await?;
 
-            let _ = client_id;
+            Ok(Some(ClientInfo {
-            Ok(Some(current_nonce))
+                id: client_id,
+                current_nonce,
+            }))
         })
     })
     .await
@@ -96,13 +116,11 @@ async fn get_nonce(db: &db::DatabasePool, pubkey: &VerifyingKey) -> Result<Optio
 
 async fn approve_new_client(
     actors: &crate::actors::GlobalActors,
-    pubkey: VerifyingKey,
+    profile: ClientProfile,
 ) -> Result<(), Error> {
     let result = actors
-        .router
+        .flow_coordinator
-        .ask(RequestClientApproval {
+        .ask(RequestClientApproval { client: profile })
-            client_pubkey: pubkey,
-        })
         .await;
 
     match result {
@@ -113,65 +131,124 @@ async fn approve_new_client(
             Err(Error::ApproveError(ApproveError::Upstream(e)))
         }
         Err(e) => {
-            error!(error = ?e, "Approval request to router failed");
+            error!(error = ?e, "Approval request to flow coordinator failed");
             Err(Error::ApproveError(ApproveError::Internal))
         }
     }
 }
 
-enum InsertClientResult {
-    Inserted,
-    AlreadyExists,
-}
-
 async fn insert_client(
     db: &db::DatabasePool,
     pubkey: &VerifyingKey,
-) -> Result<InsertClientResult, Error> {
+    metadata: &ClientMetadata,
-    let now = std::time::SystemTime::now()
+) -> Result<i32, Error> {
-        .duration_since(std::time::UNIX_EPOCH)
+    use crate::db::schema::{client_metadata, program_client};
-        .unwrap_or_default()
+    let mut conn = db.get().await.map_err(|e| {
-        .as_secs() as i32;
+        error!(error = ?e, "Database pool error");
+        Error::DatabasePoolUnavailable
+    })?;
+
+    let metadata_id = insert_into(client_metadata::table)
+        .values((
+            client_metadata::name.eq(&metadata.name),
+            client_metadata::description.eq(&metadata.description),
+            client_metadata::version.eq(&metadata.version),
+        ))
+        .returning(client_metadata::id)
+        .get_result::<i32>(&mut conn)
+        .await
+        .map_err(|e| {
+            error!(error = ?e, "Failed to insert client metadata");
+            Error::DatabaseOperationFailed
+        })?;
+
+    let client_id = insert_into(program_client::table)
+        .values((
+            program_client::public_key.eq(pubkey.as_bytes().to_vec()),
+            program_client::metadata_id.eq(metadata_id),
+            program_client::nonce.eq(1), // pre-incremented; challenge uses 0
+        ))
+        .on_conflict_do_nothing()
+        .returning(program_client::id)
+        .get_result::<i32>(&mut conn)
+        .await
+        .map_err(|e| {
+            error!(error = ?e, "Failed to insert client metadata");
+            Error::DatabaseOperationFailed
+        })?;
+
+    Ok(client_id)
+}
+
+async fn sync_client_metadata(
+    db: &db::DatabasePool,
+    client_id: i32,
+    metadata: &ClientMetadata,
+) -> Result<(), Error> {
+    use crate::db::schema::{client_metadata, client_metadata_history};
+
+    let now = SqliteTimestamp(Utc::now());
 
     let mut conn = db.get().await.map_err(|e| {
         error!(error = ?e, "Database pool error");
         Error::DatabasePoolUnavailable
     })?;
 
-    match insert_into(program_client::table)
+    conn.exclusive_transaction(|conn| {
-        .values((
+        let metadata = metadata.clone();
-            program_client::public_key.eq(pubkey.as_bytes().to_vec()),
+        Box::pin(async move {
-            program_client::nonce.eq(1), // pre-incremented; challenge uses 0
+            let (current_metadata_id, current): (i32, ProgramClientMetadata) =
-            program_client::created_at.eq(now),
+                program_client::table
-            program_client::updated_at.eq(now),
+                    .find(client_id)
-        ))
+                    .inner_join(client_metadata::table)
-        .execute(&mut conn)
+                    .select((
-        .await
+                        program_client::metadata_id,
-    {
+                        ProgramClientMetadata::as_select(),
-        Ok(_) => {}
+                    ))
-        Err(diesel::result::Error::DatabaseError(
+                    .first(conn)
-            diesel::result::DatabaseErrorKind::UniqueViolation,
+                    .await?;
-            _,
-        )) => return Ok(InsertClientResult::AlreadyExists),
-        Err(e) => {
-            error!(error = ?e, "Failed to insert new client");
-            return Err(Error::DatabaseOperationFailed);
-        }
-    }
 
-    let client_id = program_client::table
+            let unchanged = current.name == metadata.name
-        .filter(program_client::public_key.eq(pubkey.as_bytes().to_vec()))
+                && current.description == metadata.description
-        .order(program_client::id.desc())
+                && current.version == metadata.version;
-        .select(program_client::id)
+            if unchanged {
-        .first::<i32>(&mut conn)
+                return Ok(());
-        .await
+            }
-        .map_err(|e| {
-            error!(error = ?e, "Failed to load inserted client id");
-            Error::DatabaseOperationFailed
-        })?;
 
-    let _ = client_id;
+            insert_into(client_metadata_history::table)
-    Ok(InsertClientResult::Inserted)
+                .values((
+                    client_metadata_history::metadata_id.eq(current_metadata_id),
+                    client_metadata_history::client_id.eq(client_id),
+                ))
+                .execute(conn)
+                .await?;
+
+            let metadata_id = insert_into(client_metadata::table)
+                .values((
+                    client_metadata::name.eq(&metadata.name),
+                    client_metadata::description.eq(&metadata.description),
+                    client_metadata::version.eq(&metadata.version),
+                ))
+                .returning(client_metadata::id)
+                .get_result::<i32>(conn)
+                .await?;
+
+            update(program_client::table.find(client_id))
+                .set((
+                    program_client::metadata_id.eq(metadata_id),
+                    program_client::updated_at.eq(now),
+                ))
+                .execute(conn)
+                .await?;
+
+            Ok::<(), diesel::result::Error>(())
+        })
+    })
+    .await
+    .map_err(|e| {
+        error!(error = ?e, "Database error");
+        Error::DatabaseOperationFailed
+    })
 }
 
 async fn challenge_client<T>(
@@ -217,26 +294,33 @@ pub async fn authenticate<T>(
 where
     T: Bi<Inbound, Result<Outbound, Error>> + Send + ?Sized,
 {
-    let Some(Inbound::AuthChallengeRequest { pubkey }) = transport.recv().await
+    let Some(Inbound::AuthChallengeRequest { pubkey, metadata }) = transport.recv().await else {
-    else {
         return Err(Error::Transport);
     };
 
-    let nonce = match get_nonce(&props.db, &pubkey).await? {
+    let info = match get_client_and_nonce(&props.db, &pubkey).await? {
         Some(nonce) => nonce,
         None => {
-            approve_new_client(&props.actors, pubkey).await?;
+            approve_new_client(
-            match insert_client(&props.db, &pubkey).await? {
+                &props.actors,
-                InsertClientResult::Inserted => 0,
+                ClientProfile {
-                InsertClientResult::AlreadyExists => match get_nonce(&props.db, &pubkey).await? {
+                    pubkey,
-                    Some(nonce) => nonce,
+                    metadata: metadata.clone(),
-                    None => return Err(Error::DatabaseOperationFailed),
                 },
+            )
+            .await?;
+            let client_id = insert_client(&props.db, &pubkey, &metadata).await?;
+            ClientInfo {
+                id: client_id,
+                current_nonce: 0,
             }
         }
     };
 
-    challenge_client(transport, pubkey, nonce).await?;
+    sync_client_metadata(&props.db, info.id, &metadata).await?;
+
+    challenge_client(transport, pubkey, info.current_nonce).await?;
+    
     transport
         .send(Ok(Outbound::AuthSuccess))
         .await

server/crates/arbiter-server/src/actors/client/mod.rs

@@ -1,12 +1,18 @@
-use arbiter_proto::transport::Bi;
+use arbiter_proto::{ClientMetadata, transport::Bi};
 use kameo::actor::Spawn;
 use tracing::{error, info};
 
 use crate::{
-    actors::{GlobalActors, client::session::ClientSession},
+    actors::{GlobalActors, client::{ session::ClientSession}},
     db,
 };
 
+#[derive(Debug, Clone)]
+pub struct ClientProfile {
+    pub pubkey: ed25519_dalek::VerifyingKey,
+    pub metadata: ClientMetadata,
+}
+
 pub struct ClientConnection {
     pub(crate) db: db::DatabasePool,
     pub(crate) actors: GlobalActors,

server/crates/arbiter-server/src/actors/client/session.rs

@@ -3,7 +3,8 @@ use tracing::error;
 
 use crate::{
     actors::{
-        GlobalActors, client::ClientConnection, keyholder::KeyHolderState, router::RegisterClient,
+        GlobalActors, client::ClientConnection, flow_coordinator::RegisterClient,
+        keyholder::KeyHolderState,
     },
     db,
 };
@@ -47,7 +48,7 @@ impl Actor for ClientSession {
     ) -> Result<Self, Self::Error> {
         args.props
             .actors
-            .router
+            .flow_coordinator
             .ask(RegisterClient { actor: this })
             .await
             .map_err(|_| Error::ConnectionRegistrationFailed)?;

server/crates/arbiter-server/src/actors/evm/mod.rs

@@ -105,7 +105,7 @@ impl EvmActor {
 #[messages]
 impl EvmActor {
     #[message]
-    pub async fn generate(&mut self) -> Result<Address, Error> {
+    pub async fn generate(&mut self) -> Result<(i32, Address), Error> {
         let (mut key_cell, address) = safe_signer::generate(&mut self.rng);
 
         let plaintext = key_cell.read_inline(|reader| SafeCell::new(reader.to_vec()));
@@ -117,19 +117,20 @@ impl EvmActor {
             .map_err(|_| Error::KeyholderSend)?;
 
         let mut conn = self.db.get().await?;
-        insert_into(schema::evm_wallet::table)
+        let wallet_id = insert_into(schema::evm_wallet::table)
             .values(&models::NewEvmWallet {
                 address: address.as_slice().to_vec(),
                 aead_encrypted_id: aead_id,
             })
-            .execute(&mut conn)
+            .returning(schema::evm_wallet::id)
+            .get_result(&mut conn)
             .await?;
 
-        Ok(address)
+        Ok((wallet_id, address))
     }
 
     #[message]
-    pub async fn list_wallets(&self) -> Result<Vec<Address>, Error> {
+    pub async fn list_wallets(&self) -> Result<Vec<(i32, Address)>, Error> {
         let mut conn = self.db.get().await?;
         let rows: Vec<models::EvmWallet> = schema::evm_wallet::table
             .select(models::EvmWallet::as_select())
@@ -138,7 +139,7 @@ impl EvmActor {
 
         Ok(rows
             .into_iter()
-            .map(|w| Address::from_slice(&w.address))
+            .map(|w| (w.id, Address::from_slice(&w.address)))
             .collect())
     }
 }
@@ -148,31 +149,24 @@ impl EvmActor {
     #[message]
     pub async fn useragent_create_grant(
         &mut self,
-        client_id: i32,
         basic: SharedGrantSettings,
         grant: SpecificGrant,
     ) -> Result<i32, evm::CreationError> {
         match grant {
             SpecificGrant::EtherTransfer(settings) => {
                 self.engine
-                    .create_grant::<EtherTransfer>(
+                    .create_grant::<EtherTransfer>(FullGrant {
-                        client_id,
+                        basic,
-                        FullGrant {
+                        specific: settings,
-                            basic,
+                    })
-                            specific: settings,
-                        },
-                    )
                     .await
             }
             SpecificGrant::TokenTransfer(settings) => {
                 self.engine
-                    .create_grant::<TokenTransfer>(
+                    .create_grant::<TokenTransfer>(FullGrant {
-                        client_id,
+                        basic,
-                        FullGrant {
+                        specific: settings,
-                            basic,
+                    })
-                            specific: settings,
-                        },
-                    )
                     .await
             }
         }
@@ -213,16 +207,19 @@ impl EvmActor {
             .await
             .optional()?
             .ok_or(SignTransactionError::WalletNotFound)?;
+        let wallet_access = schema::evm_wallet_access::table
+            .select(models::EvmWalletAccess::as_select())
+            .filter(schema::evm_wallet_access::wallet_id.eq(wallet.id))
+            .filter(schema::evm_wallet_access::client_id.eq(client_id))
+            .first(&mut conn)
+            .await
+            .optional()?
+            .ok_or(SignTransactionError::WalletNotFound)?;
         drop(conn);
 
         let meaning = self
             .engine
-            .evaluate_transaction(
+            .evaluate_transaction(wallet_access, transaction.clone(), RunKind::Execution)
-                wallet.id,
-                client_id,
-                transaction.clone(),
-                RunKind::Execution,
-            )
             .await?;
 
         Ok(meaning)
@@ -243,6 +240,14 @@ impl EvmActor {
             .await
             .optional()?
             .ok_or(SignTransactionError::WalletNotFound)?;
+        let wallet_access = schema::evm_wallet_access::table
+            .select(models::EvmWalletAccess::as_select())
+            .filter(schema::evm_wallet_access::wallet_id.eq(wallet.id))
+            .filter(schema::evm_wallet_access::client_id.eq(client_id))
+            .first(&mut conn)
+            .await
+            .optional()?
+            .ok_or(SignTransactionError::WalletNotFound)?;
         drop(conn);
 
         let raw_key: SafeCell<Vec<u8>> = self
@@ -256,12 +261,7 @@ impl EvmActor {
         let signer = safe_signer::SafeSigner::from_cell(raw_key)?;
 
         self.engine
-            .evaluate_transaction(
+            .evaluate_transaction(wallet_access, transaction.clone(), RunKind::Execution)
-                wallet.id,
-                client_id,
-                transaction.clone(),
-                RunKind::Execution,
-            )
             .await?;
 
         use alloy::network::TxSignerSync as _;

server/crates/arbiter-server/src/actors/flow_coordinator/client_connect_approval.rs

@@ -0,0 +1,101 @@
+use std::ops::ControlFlow;
+
+use kameo::{
+    Actor, messages,
+    prelude::{ActorId, ActorRef, ActorStopReason, Context, WeakActorRef},
+    reply::ReplySender,
+};
+
+use crate::actors::{
+    client::ClientProfile,
+    flow_coordinator::ApprovalError,
+    user_agent::{UserAgentSession, session::BeginNewClientApproval},
+};
+
+pub struct Args {
+    pub client: ClientProfile,
+    pub user_agents: Vec<ActorRef<UserAgentSession>>,
+    pub reply: ReplySender<Result<bool, ApprovalError>>
+}
+
+pub struct ClientApprovalController {
+    /// Number of UAs that have not yet responded (approval or denial) or died.
+    pending: usize,
+    /// Number of approvals received so far.
+    approved: usize,
+    reply: Option<ReplySender<Result<bool, ApprovalError>>>,
+}
+
+impl ClientApprovalController {
+    fn send_reply(&mut self, result: Result<bool, ApprovalError>) {
+        if let Some(reply) = self.reply.take() {
+            reply.send(result);
+        }
+    }
+}
+
+impl Actor for ClientApprovalController {
+    type Args = Args;
+    type Error = ();
+
+    async fn on_start(
+        Args { client, mut user_agents, reply }: Self::Args,
+        actor_ref: ActorRef<Self>,
+    ) -> Result<Self, Self::Error> {
+        let this = Self {
+            pending: user_agents.len(),
+            approved: 0,
+            reply: Some(reply),
+        };
+
+        for user_agent in user_agents.drain(..) {
+            actor_ref.link(&user_agent).await;
+            let _ = user_agent
+                .tell(BeginNewClientApproval {
+                    client: client.clone(),
+                    controller: actor_ref.clone(),
+                })
+                .await;
+        }
+
+        Ok(this)
+    }
+
+    async fn on_link_died(
+        &mut self,
+        _: WeakActorRef<Self>,
+        _: ActorId,
+        _: ActorStopReason,
+    ) -> Result<ControlFlow<ActorStopReason>, Self::Error> {
+        // A linked UA died before responding — counts as a non-approval.
+        self.pending = self.pending.saturating_sub(1);
+        if self.pending == 0 {
+            // At least one UA didn't approve: deny.
+            self.send_reply(Ok(false));
+            return Ok(ControlFlow::Break(ActorStopReason::Normal));
+        }
+        Ok(ControlFlow::Continue(()))
+    }
+}
+
+#[messages]
+impl ClientApprovalController {
+    #[message(ctx)]
+    pub async fn client_approval_answer(&mut self, approved: bool, ctx: &mut Context<Self, ()>) {
+        if !approved {
+            // Denial wins immediately regardless of other pending responses.
+            self.send_reply(Ok(false));
+            ctx.stop();
+            return;
+        }
+
+        self.approved += 1;
+        self.pending = self.pending.saturating_sub(1);
+
+        if self.pending == 0 {
+            // Every connected UA approved.
+            self.send_reply(Ok(true));
+            ctx.stop();
+        }
+    }
+}

server/crates/arbiter-server/src/actors/flow_coordinator/mod.rs

@@ -0,0 +1,118 @@
+use std::{collections::HashMap, ops::ControlFlow};
+
+use kameo::{
+    Actor,
+    actor::{ActorId, ActorRef, Spawn},
+    messages,
+    prelude::{ActorStopReason, Context, WeakActorRef},
+    reply::DelegatedReply,
+};
+use tracing::info;
+
+use crate::actors::{
+    client::{ClientProfile, session::ClientSession},
+    flow_coordinator::client_connect_approval::ClientApprovalController,
+    user_agent::session::UserAgentSession,
+};
+
+pub mod client_connect_approval;
+
+#[derive(Default)]
+pub struct FlowCoordinator {
+    pub user_agents: HashMap<ActorId, ActorRef<UserAgentSession>>,
+    pub clients: HashMap<ActorId, ActorRef<ClientSession>>,
+}
+
+impl Actor for FlowCoordinator {
+    type Args = Self;
+
+    type Error = ();
+
+    async fn on_start(args: Self::Args, _: ActorRef<Self>) -> Result<Self, Self::Error> {
+        Ok(args)
+    }
+
+    async fn on_link_died(
+        &mut self,
+        _: WeakActorRef<Self>,
+        id: ActorId,
+        _: ActorStopReason,
+    ) -> Result<ControlFlow<ActorStopReason>, Self::Error> {
+        if self.user_agents.remove(&id).is_some() {
+            info!(
+                ?id,
+                actor = "FlowCoordinator",
+                event = "useragent.disconnected"
+            );
+        } else if self.clients.remove(&id).is_some() {
+            info!(
+                ?id,
+                actor = "FlowCoordinator",
+                event = "client.disconnected"
+            );
+        } else {
+            info!(
+                ?id,
+                actor = "FlowCoordinator",
+                event = "unknown.actor.disconnected"
+            );
+        }
+        Ok(ControlFlow::Continue(()))
+    }
+}
+
+#[derive(Debug, thiserror::Error, Clone, PartialEq, Eq, Hash)]
+pub enum ApprovalError {
+    #[error("No user agents connected")]
+    NoUserAgentsConnected,
+}
+
+#[messages]
+impl FlowCoordinator {
+    #[message(ctx)]
+    pub async fn register_user_agent(
+        &mut self,
+        actor: ActorRef<UserAgentSession>,
+        ctx: &mut Context<Self, ()>,
+    ) {
+        info!(id = %actor.id(), actor = "FlowCoordinator", event = "useragent.connected");
+        ctx.actor_ref().link(&actor).await;
+        self.user_agents.insert(actor.id(), actor);
+    }
+
+    #[message(ctx)]
+    pub async fn register_client(
+        &mut self,
+        actor: ActorRef<ClientSession>,
+        ctx: &mut Context<Self, ()>,
+    ) {
+        info!(id = %actor.id(), actor = "FlowCoordinator", event = "client.connected");
+        ctx.actor_ref().link(&actor).await;
+        self.clients.insert(actor.id(), actor);
+    }
+
+    #[message(ctx)]
+    pub async fn request_client_approval(
+        &mut self,
+        client: ClientProfile,
+        ctx: &mut Context<Self, DelegatedReply<Result<bool, ApprovalError>>>,
+    ) -> DelegatedReply<Result<bool, ApprovalError>> {
+        let (reply, Some(reply_sender)) = ctx.reply_sender() else {
+            unreachable!("Expected `request_client_approval` to have callback channel");
+        };
+
+        let refs: Vec<_> = self.user_agents.values().cloned().collect();
+        if refs.is_empty() {
+            reply_sender.send(Err(ApprovalError::NoUserAgentsConnected));
+            return reply;
+        }
+
+        ClientApprovalController::spawn(client_connect_approval::Args {
+            client,
+            user_agents: refs,
+            reply: reply_sender,
+        });
+
+        reply
+    }
+}

server/crates/arbiter-server/src/actors/mod.rs

@@ -3,15 +3,18 @@ use miette::Diagnostic;
 use thiserror::Error;
 
 use crate::{
-    actors::{bootstrap::Bootstrapper, evm::EvmActor, keyholder::KeyHolder, router::MessageRouter},
+    actors::{
+        bootstrap::Bootstrapper, evm::EvmActor, flow_coordinator::FlowCoordinator,
+        keyholder::KeyHolder,
+    },
     db,
 };
 
 pub mod bootstrap;
 pub mod client;
 mod evm;
+pub mod flow_coordinator;
 pub mod keyholder;
-pub mod router;
 pub mod user_agent;
 
 #[derive(Error, Debug, Diagnostic)]
@@ -30,7 +33,7 @@ pub enum SpawnError {
 pub struct GlobalActors {
     pub key_holder: ActorRef<KeyHolder>,
     pub bootstrapper: ActorRef<Bootstrapper>,
-    pub router: ActorRef<MessageRouter>,
+    pub flow_coordinator: ActorRef<FlowCoordinator>,
     pub evm: ActorRef<EvmActor>,
 }
 
@@ -41,7 +44,7 @@ impl GlobalActors {
             bootstrapper: Bootstrapper::spawn(Bootstrapper::new(&db).await?),
             evm: EvmActor::spawn(EvmActor::new(key_holder.clone(), db)),
             key_holder,
-            router: MessageRouter::spawn(MessageRouter::default()),
+            flow_coordinator: FlowCoordinator::spawn(FlowCoordinator::default()),
         })
     }
 }

server/crates/arbiter-server/src/actors/router/mod.rs

@@ -1,173 +0,0 @@
-use std::{collections::HashMap, ops::ControlFlow};
-
-use ed25519_dalek::VerifyingKey;
-use kameo::{
-    Actor,
-    actor::{ActorId, ActorRef},
-    messages,
-    prelude::{ActorStopReason, Context, WeakActorRef},
-    reply::DelegatedReply,
-};
-use tokio::{sync::watch, task::JoinSet};
-use tracing::{info, warn};
-
-use crate::actors::{
-    client::session::ClientSession,
-    user_agent::session::{RequestNewClientApproval, UserAgentSession},
-};
-
-#[derive(Default)]
-pub struct MessageRouter {
-    pub user_agents: HashMap<ActorId, ActorRef<UserAgentSession>>,
-    pub clients: HashMap<ActorId, ActorRef<ClientSession>>,
-}
-
-impl Actor for MessageRouter {
-    type Args = Self;
-
-    type Error = ();
-
-    async fn on_start(args: Self::Args, _: ActorRef<Self>) -> Result<Self, Self::Error> {
-        Ok(args)
-    }
-
-    async fn on_link_died(
-        &mut self,
-        _: WeakActorRef<Self>,
-        id: ActorId,
-        _: ActorStopReason,
-    ) -> Result<ControlFlow<ActorStopReason>, Self::Error> {
-        if self.user_agents.remove(&id).is_some() {
-            info!(
-                ?id,
-                actor = "MessageRouter",
-                event = "useragent.disconnected"
-            );
-        } else if self.clients.remove(&id).is_some() {
-            info!(?id, actor = "MessageRouter", event = "client.disconnected");
-        } else {
-            info!(
-                ?id,
-                actor = "MessageRouter",
-                event = "unknown.actor.disconnected"
-            );
-        }
-        Ok(ControlFlow::Continue(()))
-    }
-}
-
-#[derive(Debug, thiserror::Error, Clone, PartialEq, Eq, Hash)]
-pub enum ApprovalError {
-    #[error("No user agents connected")]
-    NoUserAgentsConnected,
-}
-
-async fn request_client_approval(
-    user_agents: &[WeakActorRef<UserAgentSession>],
-    client_pubkey: VerifyingKey,
-) -> Result<bool, ApprovalError> {
-    if user_agents.is_empty() {
-        return Err(ApprovalError::NoUserAgentsConnected);
-    }
-
-    let mut pool = JoinSet::new();
-    let (cancel_tx, cancel_rx) = watch::channel(());
-
-    for weak_ref in user_agents {
-        match weak_ref.upgrade() {
-            Some(agent) => {
-                let cancel_rx = cancel_rx.clone();
-                pool.spawn(async move {
-                    agent
-                        .ask(RequestNewClientApproval {
-                            client_pubkey,
-                            cancel_flag: cancel_rx.clone(),
-                        })
-                        .await
-                });
-            }
-            None => {
-                warn!(
-                    id = weak_ref.id().to_string(),
-                    actor = "MessageRouter",
-                    event = "useragent.disconnected_before_approval"
-                );
-            }
-        }
-    }
-
-    while let Some(result) = pool.join_next().await {
-        match result {
-            Ok(Ok(approved)) => {
-                // cancel other pending requests
-                let _ = cancel_tx.send(());
-                return Ok(approved);
-            }
-            Ok(Err(err)) => {
-                warn!(
-                    ?err,
-                    actor = "MessageRouter",
-                    event = "useragent.approval_error"
-                );
-            }
-            Err(err) => {
-                warn!(
-                    ?err,
-                    actor = "MessageRouter",
-                    event = "useragent.approval_task_failed"
-                );
-            }
-        }
-    }
-
-    Err(ApprovalError::NoUserAgentsConnected)
-}
-
-#[messages]
-impl MessageRouter {
-    #[message(ctx)]
-    pub async fn register_user_agent(
-        &mut self,
-        actor: ActorRef<UserAgentSession>,
-        ctx: &mut Context<Self, ()>,
-    ) {
-        info!(id = %actor.id(), actor = "MessageRouter", event = "useragent.connected");
-        ctx.actor_ref().link(&actor).await;
-        self.user_agents.insert(actor.id(), actor);
-    }
-
-    #[message(ctx)]
-    pub async fn register_client(
-        &mut self,
-        actor: ActorRef<ClientSession>,
-        ctx: &mut Context<Self, ()>,
-    ) {
-        info!(id = %actor.id(), actor = "MessageRouter", event = "client.connected");
-        ctx.actor_ref().link(&actor).await;
-        self.clients.insert(actor.id(), actor);
-    }
-
-    #[message(ctx)]
-    pub async fn request_client_approval(
-        &mut self,
-        client_pubkey: VerifyingKey,
-        ctx: &mut Context<Self, DelegatedReply<Result<bool, ApprovalError>>>,
-    ) -> DelegatedReply<Result<bool, ApprovalError>> {
-        let (reply, Some(reply_sender)) = ctx.reply_sender() else {
-            unreachable!("Expected `request_client_approval` to have callback channel");
-        };
-
-        let weak_refs = self
-            .user_agents
-            .values()
-            .map(|agent| agent.downgrade())
-            .collect::<Vec<_>>();
-
-        tokio::task::spawn(async move {
-            let result = request_client_approval(&weak_refs, client_pubkey).await;
-            reply_sender.send(result);
-        });
-
-        reply
-    }
-}

server/crates/arbiter-server/src/actors/user_agent/mod.rs

@@ -1,8 +1,13 @@
 use crate::{
-    actors::GlobalActors,
+    actors::{GlobalActors, client::ClientProfile},
     db::{self, models::KeyType},
 };
 
+pub struct EvmAccessEntry {
+    pub wallet_id: i32,
+    pub sdk_client_id: i32,
+}
+
 /// Abstraction over Ed25519 / ECDSA-secp256k1 / RSA public keys used during the auth handshake.
 #[derive(Clone, Debug)]
 pub enum AuthPublicKey {
@@ -72,8 +77,8 @@ impl TryFrom<(KeyType, Vec<u8>)> for AuthPublicKey {
 // Messages, sent by user agent to connection client without having a request
 #[derive(Debug)]
 pub enum OutOfBand {
-    ClientConnectionRequest { pubkey: ed25519_dalek::VerifyingKey },
+    ClientConnectionRequest { profile: ClientProfile },
-    ClientConnectionCancel,
+    ClientConnectionCancel { pubkey: ed25519_dalek::VerifyingKey },
 }
 
 pub struct UserAgentConnection {

server/crates/arbiter-server/src/actors/user_agent/session.rs

@@ -1,15 +1,15 @@
-use std::borrow::Cow;
+use std::{borrow::Cow, collections::HashMap};
 
 use arbiter_proto::transport::Sender;
 use async_trait::async_trait;
 use ed25519_dalek::VerifyingKey;
-use kameo::{Actor, messages};
+use kameo::{Actor, actor::ActorRef, messages};
 use thiserror::Error;
-use tokio::sync::watch;
 use tracing::error;
 
 use crate::actors::{
-    router::RegisterUserAgent,
+    client::ClientProfile,
+    flow_coordinator::{RegisterUserAgent, client_connect_approval::ClientApprovalController},
     user_agent::{OutOfBand, UserAgentConnection},
 };
 
@@ -25,6 +25,19 @@ pub enum Error {
     Internal { message: Cow<'static, str> },
 }
 
+impl From<crate::db::PoolError> for Error {
+    fn from(err: crate::db::PoolError) -> Self {
+        error!(?err, "Database pool error");
+        Self::internal("Database pool error")
+    }
+}
+impl From<diesel::result::Error> for Error {
+    fn from(err: diesel::result::Error) -> Self {
+        error!(?err, "Database error");
+        Self::internal("Database error")
+    }
+}
+
 impl Error {
     pub fn internal(message: impl Into<Cow<'static, str>>) -> Self {
         Self::Internal {
@@ -33,19 +46,19 @@ impl Error {
     }
 }
 
+pub struct PendingClientApproval {
+    controller: ActorRef<ClientApprovalController>,
+}
+
 pub struct UserAgentSession {
     props: UserAgentConnection,
     state: UserAgentStateMachine<DummyContext>,
-    #[allow(dead_code, reason = "The session keeps ownership of the outbound transport even before the state-machine flow starts using it directly")]
     sender: Box<dyn Sender<OutOfBand>>,
+
+    pending_client_approvals: HashMap<VerifyingKey, PendingClientApproval>,
 }
 
-mod connection;
+pub mod connection;
-pub(crate) use connection::{
-    BootstrapError, HandleBootstrapEncryptedKey, HandleEvmWalletCreate, HandleEvmWalletList,
-    HandleGrantCreate, HandleGrantDelete, HandleGrantList, HandleQueryVaultState,
-};
-pub use connection::{HandleUnsealEncryptedKey, HandleUnsealRequest, UnsealError};
 
 impl UserAgentSession {
     pub(crate) fn new(props: UserAgentConnection, sender: Box<dyn Sender<OutOfBand>>) -> Self {
@@ -53,6 +66,7 @@ impl UserAgentSession {
             props,
             state: UserAgentStateMachine::new(DummyContext),
             sender,
+            pending_client_approvals: Default::default(),
         }
     }
 
@@ -84,26 +98,28 @@ impl UserAgentSession {
 #[messages]
 impl UserAgentSession {
     #[message]
-    pub async fn request_new_client_approval(
+    pub async fn begin_new_client_approval(
         &mut self,
-        client_pubkey: VerifyingKey,
+        client: ClientProfile,
-        mut cancel_flag: watch::Receiver<()>,
+        controller: ActorRef<ClientApprovalController>,
-    ) -> Result<bool, ()> {
+    ) {
-        if self
+        if let Err(e) = self
             .sender
             .send(OutOfBand::ClientConnectionRequest {
-                pubkey: client_pubkey,
+                profile: client.clone(),
             })
             .await
-            .is_err()
         {
-            return Err(());
+            error!(
+                ?e,
+                actor = "user_agent",
+                event = "failed to announce new client connection"
+            );
+            return;
         }
 
-        let _ = cancel_flag.changed().await;
+        self.pending_client_approvals
-
+            .insert(client.pubkey, PendingClientApproval { controller });
-        let _ = self.sender.send(OutOfBand::ClientConnectionCancel).await;
-        Ok(false)
     }
 }
 
@@ -118,15 +134,48 @@ impl Actor for UserAgentSession {
     ) -> Result<Self, Self::Error> {
         args.props
             .actors
-            .router
+            .flow_coordinator
             .ask(RegisterUserAgent {
                 actor: this.clone(),
             })
             .await
             .map_err(|err| {
-                error!(?err, "Failed to register user agent connection with router");
+                error!(
-                Error::internal("Failed to register user agent connection with router")
+                    ?err,
+                    "Failed to register user agent connection with flow coordinator"
+                );
+                Error::internal("Failed to register user agent connection with flow coordinator")
             })?;
         Ok(args)
     }
+
+    async fn on_link_died(
+        &mut self,
+        _: kameo::prelude::WeakActorRef<Self>,
+        id: kameo::prelude::ActorId,
+        _: kameo::prelude::ActorStopReason,
+    ) -> Result<std::ops::ControlFlow<kameo::prelude::ActorStopReason>, Self::Error> {
+        let cancelled_pubkey = self
+            .pending_client_approvals
+            .iter()
+            .find_map(|(k, v)| (v.controller.id() == id).then_some(*k));
+
+        if let Some(pubkey) = cancelled_pubkey {
+            self.pending_client_approvals.remove(&pubkey);
+
+            if let Err(e) = self
+                .sender
+                .send(OutOfBand::ClientConnectionCancel { pubkey })
+                .await
+            {
+                error!(
+                    ?e,
+                    actor = "user_agent",
+                    event = "failed to announce client connection cancellation"
+                );
+            }
+        }
+
+        Ok(std::ops::ControlFlow::Continue(()))
+    }
 }

server/crates/arbiter-server/src/actors/user_agent/session/connection.rs

@@ -2,13 +2,21 @@ use std::sync::Mutex;
 
 use alloy::primitives::Address;
 use chacha20poly1305::{AeadInPlace, XChaCha20Poly1305, XNonce, aead::KeyInit};
+use diesel::sql_types::ops::Add;
+use diesel::{BoolExpressionMethods as _, ExpressionMethods as _, QueryDsl as _, SelectableHelper};
+use diesel_async::{AsyncConnection, RunQueryDsl};
 use kameo::error::SendError;
-use kameo::messages;
+use kameo::prelude::Context;
+use kameo::{message, messages};
 use tracing::{error, info};
 use x25519_dalek::{EphemeralSecret, PublicKey};
 
+use crate::actors::flow_coordinator::client_connect_approval::ClientApprovalAnswer;
 use crate::actors::keyholder::KeyHolderState;
+use crate::actors::user_agent::EvmAccessEntry;
 use crate::actors::user_agent::session::Error;
+use crate::db::models::{ProgramClient, ProgramClientMetadata};
+use crate::db::schema::evm_wallet_access;
 use crate::evm::policies::{Grant, SpecificGrant};
 use crate::safe_cell::SafeCell;
 use crate::{
@@ -18,9 +26,9 @@ use crate::{
         },
         keyholder::{self, Bootstrap, TryUnseal},
         user_agent::session::{
-                UserAgentSession,
+            UserAgentSession,
-                state::{UnsealContext, UserAgentEvents, UserAgentStates},
+            state::{UnsealContext, UserAgentEvents, UserAgentStates},
-            },
+        },
     },
     safe_cell::SafeCellHandle as _,
 };
@@ -271,7 +279,7 @@ impl UserAgentSession {
 #[messages]
 impl UserAgentSession {
     #[message]
-    pub(crate) async fn handle_evm_wallet_create(&mut self) -> Result<Address, Error> {
+    pub(crate) async fn handle_evm_wallet_create(&mut self) -> Result<(i32, Address), Error> {
         match self.props.actors.evm.ask(Generate {}).await {
             Ok(address) => Ok(address),
             Err(SendError::HandlerError(err)) => Err(Error::internal(format!(
@@ -285,7 +293,7 @@ impl UserAgentSession {
     }
 
     #[message]
-    pub(crate) async fn handle_evm_wallet_list(&mut self) -> Result<Vec<Address>, Error> {
+    pub(crate) async fn handle_evm_wallet_list(&mut self) -> Result<Vec<(i32, Address)>, Error> {
         match self.props.actors.evm.ask(ListWallets {}).await {
             Ok(wallets) => Ok(wallets),
             Err(err) => {
@@ -296,6 +304,8 @@ impl UserAgentSession {
     }
 }
 
+
+
 #[messages]
 impl UserAgentSession {
     #[message]
@@ -312,7 +322,6 @@ impl UserAgentSession {
     #[message]
     pub(crate) async fn handle_grant_create(
         &mut self,
-        client_id: i32,
         basic: crate::evm::policies::SharedGrantSettings,
         grant: crate::evm::policies::SpecificGrant,
     ) -> Result<i32, Error> {
@@ -320,11 +329,7 @@ impl UserAgentSession {
             .props
             .actors
             .evm
-            .ask(UseragentCreateGrant {
+            .ask(UseragentCreateGrant { basic, grant })
-                client_id,
-                basic,
-                grant,
-            })
             .await
         {
             Ok(grant_id) => Ok(grant_id),
@@ -351,4 +356,131 @@ impl UserAgentSession {
             }
         }
     }
+
+    #[message]
+    pub(crate) async fn handle_grant_evm_wallet_access(
+        &mut self,
+        entries: Vec<EvmAccessEntry>,
+    ) -> Result<(), Error> {
+        let mut conn = self.props.db.get().await?;
+        conn.transaction(|conn| {
+            Box::pin(async move {
+                use crate::db::models::NewEvmWalletAccess;
+                use crate::db::schema::evm_wallet_access;
+
+                for entry in entries {
+                    diesel::insert_into(evm_wallet_access::table)
+                        .values(&NewEvmWalletAccess {
+                            wallet_id: entry.wallet_id,
+                            client_id: entry.sdk_client_id,
+                        })
+                        .on_conflict_do_nothing()
+                        .execute(conn)
+                        .await?;
+                }
+
+                Result::<_, Error>::Ok(())
+            })
+        })
+        .await?;
+        Ok(())
+    }
+
+    #[message]
+    pub(crate) async fn handle_revoke_evm_wallet_access(
+        &mut self,
+        entries: Vec<EvmAccessEntry>,
+    ) -> Result<(), Error> {
+        let mut conn = self.props.db.get().await?;
+        conn.transaction(|conn| {
+            Box::pin(async move {
+                use crate::db::schema::evm_wallet_access;
+                for entry in entries {
+                    diesel::delete(evm_wallet_access::table)
+                        .filter(
+                            evm_wallet_access::wallet_id
+                                .eq(entry.wallet_id)
+                                .and(evm_wallet_access::client_id.eq(entry.sdk_client_id)),
+                        )
+                        .execute(conn)
+                        .await?;
+                }
+
+                Result::<_, Error>::Ok(())
+            })
+        })
+        .await?;
+        Ok(())
+    }
+
+    #[message]
+    pub(crate) async fn handle_list_wallet_access(&mut self) -> Result<Vec<EvmAccessEntry>, Error> {
+        let mut conn = self.props.db.get().await?;
+        use crate::db::schema::evm_wallet_access;
+        let access_entries = evm_wallet_access::table
+            .select((evm_wallet_access::wallet_id, evm_wallet_access::client_id))
+            .load::<(i32, i32)>(&mut conn)
+            .await?
+            .into_iter()
+            .map(|(wallet_id, sdk_client_id)| EvmAccessEntry {
+                wallet_id,
+                sdk_client_id,
+            })
+            .collect();
+        Ok(access_entries)
+    }
+}
+
+#[messages]
+impl UserAgentSession {
+    #[message(ctx)]
+    pub(crate) async fn handle_new_client_approve(
+        &mut self,
+        approved: bool,
+        pubkey: ed25519_dalek::VerifyingKey,
+        ctx: &mut Context<Self, Result<(), Error>>,
+    ) -> Result<(), Error> {
+        let pending_approval = match self.pending_client_approvals.remove(&pubkey) {
+            Some(approval) => approval,
+            None => {
+                error!("Received client connection response for unknown client");
+                return Err(Error::internal("Unknown client in connection response"));
+            }
+        };
+
+        pending_approval
+            .controller
+            .tell(ClientApprovalAnswer { approved })
+            .await
+            .map_err(|err| {
+                error!(
+                    ?err,
+                    "Failed to send client approval response to controller"
+                );
+                Error::internal("Failed to send client approval response to controller")
+            })?;
+
+        ctx.actor_ref().unlink(&pending_approval.controller).await;
+
+        Ok(())
+    }
+
+    #[message]
+    pub(crate) async fn handle_sdk_client_list(
+        &mut self,
+    ) -> Result<Vec<(ProgramClient, ProgramClientMetadata)>, Error> {
+        use crate::db::schema::{client_metadata, program_client};
+        let mut conn = self.props.db.get().await?;
+
+        let clients = program_client::table
+            .inner_join(client_metadata::table)
+            .select((
+                ProgramClient::as_select(),
+                ProgramClientMetadata::as_select(),
+            ))
+            .load::<(ProgramClient, ProgramClientMetadata)>(&mut conn)
+            .await?;
+
+        Ok(clients)
+    }
 }

server/crates/arbiter-server/src/context/tls.rs

@@ -1,4 +1,4 @@
-use std::string::FromUtf8Error;
+use std::{net::IpAddr, string::FromUtf8Error};
 
 use diesel::{ExpressionMethods as _, QueryDsl, SelectableHelper as _};
 use diesel_async::{AsyncConnection, RunQueryDsl};
@@ -6,7 +6,7 @@ use miette::Diagnostic;
 use pem::Pem;
 use rcgen::{
     BasicConstraints, Certificate, CertificateParams, CertifiedIssuer, DistinguishedName, DnType,
-    IsCa, Issuer, KeyPair, KeyUsagePurpose,
+    IsCa, Issuer, KeyPair, KeyUsagePurpose, SanType,
 };
 use rustls::pki_types::pem::PemObject;
 use thiserror::Error;
@@ -114,6 +114,11 @@ impl TlsCa {
             KeyUsagePurpose::DigitalSignature,
             KeyUsagePurpose::KeyEncipherment,
         ];
+        params
+            .subject_alt_names
+            .push(SanType::IpAddress(IpAddr::from([
+                127, 0, 0, 1,
+            ])));
 
         let mut dn = DistinguishedName::new();
         dn.push(DnType::CommonName, "Arbiter Instance Leaf");

server/crates/arbiter-server/src/db/models.rs

@@ -21,7 +21,7 @@ pub mod types {
         sqlite::{Sqlite, SqliteType},
     };
 
-    #[derive(Debug, FromSqlRow, AsExpression)]
+    #[derive(Debug, FromSqlRow, AsExpression, Clone)]
     #[diesel(sql_type = Integer)]
     #[repr(transparent)] // hint compiler to optimize the wrapper struct away
     pub struct SqliteTimestamp(pub DateTime<Utc>);
@@ -185,12 +185,47 @@ pub struct EvmWallet {
     pub created_at: SqliteTimestamp,
 }
 
-#[derive(Queryable, Debug, Insertable, Selectable)]
+#[derive(Models, Queryable, Debug, Insertable, Selectable, Clone)]
+#[diesel(table_name = schema::evm_wallet_access, check_for_backend(Sqlite))]
+#[view(
+    NewEvmWalletAccess,
+    derive(Insertable),
+    omit(id, created_at),
+    attributes_with = "deriveless"
+)]
+pub struct EvmWalletAccess {
+    pub id: i32,
+    pub wallet_id: i32,
+    pub client_id: i32,
+    pub created_at: SqliteTimestamp,
+}
+
+#[derive(Models, Queryable, Debug, Insertable, Selectable)]
+#[diesel(table_name = schema::client_metadata, check_for_backend(Sqlite))]
+pub struct ProgramClientMetadata {
+    pub id: i32,
+    pub name: String,
+    pub description: Option<String>,
+    pub version: Option<String>,
+    pub created_at: SqliteTimestamp,
+}
+
+#[derive(Models, Queryable, Debug, Insertable, Selectable)]
+#[diesel(table_name = schema::client_metadata_history, check_for_backend(Sqlite))]
+pub struct ProgramClientMetadataHistory {
+    pub id: i32,
+    pub metadata_id: i32,
+    pub client_id: i32,
+    pub created_at: SqliteTimestamp,
+}
+
+#[derive(Models, Queryable, Debug, Insertable, Selectable)]
 #[diesel(table_name = schema::program_client, check_for_backend(Sqlite))]
 pub struct ProgramClient {
     pub id: i32,
     pub nonce: i32,
     pub public_key: Vec<u8>,
+    pub metadata_id: i32,
     pub created_at: SqliteTimestamp,
     pub updated_at: SqliteTimestamp,
 }
@@ -230,8 +265,7 @@ pub struct EvmEtherTransferLimit {
 )]
 pub struct EvmBasicGrant {
     pub id: i32,
-    pub wallet_id: i32, // references evm_wallet.id
+    pub wallet_access_id: i32, // references evm_wallet_access.id
-    pub client_id: i32, // references program_client.id
     pub chain_id: i32,
     pub valid_from: Option<SqliteTimestamp>,
     pub valid_until: Option<SqliteTimestamp>,
@@ -254,8 +288,7 @@ pub struct EvmBasicGrant {
 pub struct EvmTransactionLog {
     pub id: i32,
     pub grant_id: i32,
-    pub client_id: i32,
+    pub wallet_access_id: i32,
-    pub wallet_id: i32,
     pub chain_id: i32,
     pub eth_value: Vec<u8>,
     pub signed_at: SqliteTimestamp,

server/crates/arbiter-server/src/db/schema.rs

@@ -20,11 +20,29 @@ diesel::table! {
     }
 }
 
+diesel::table! {
+    client_metadata (id) {
+        id -> Integer,
+        name -> Text,
+        description -> Nullable<Text>,
+        version -> Nullable<Text>,
+        created_at -> Integer,
+    }
+}
+
+diesel::table! {
+    client_metadata_history (id) {
+        id -> Integer,
+        metadata_id -> Integer,
+        client_id -> Integer,
+        created_at -> Integer,
+    }
+}
+
 diesel::table! {
     evm_basic_grant (id) {
         id -> Integer,
-        wallet_id -> Integer,
+        wallet_access_id -> Integer,
-        client_id -> Integer,
         chain_id -> Integer,
         valid_from -> Nullable<Integer>,
         valid_until -> Nullable<Integer>,
@@ -95,9 +113,8 @@ diesel::table! {
 diesel::table! {
     evm_transaction_log (id) {
         id -> Integer,
+        wallet_access_id -> Integer,
         grant_id -> Integer,
-        client_id -> Integer,
-        wallet_id -> Integer,
         chain_id -> Integer,
         eth_value -> Binary,
         signed_at -> Integer,
@@ -113,11 +130,21 @@ diesel::table! {
     }
 }
 
+diesel::table! {
+    evm_wallet_access (id) {
+        id -> Integer,
+        wallet_id -> Integer,
+        client_id -> Integer,
+        created_at -> Integer,
+    }
+}
+
 diesel::table! {
     program_client (id) {
         id -> Integer,
         nonce -> Integer,
         public_key -> Binary,
+        metadata_id -> Integer,
         created_at -> Integer,
         updated_at -> Integer,
     }
@@ -151,17 +178,18 @@ diesel::table! {
         id -> Integer,
         nonce -> Integer,
         public_key -> Binary,
+        key_type -> Integer,
         created_at -> Integer,
         updated_at -> Integer,
-        key_type -> Integer,
     }
 }
 
 diesel::joinable!(aead_encrypted -> root_key_history (associated_root_key_id));
 diesel::joinable!(arbiter_settings -> root_key_history (root_key_id));
 diesel::joinable!(arbiter_settings -> tls_history (tls_id));
-diesel::joinable!(evm_basic_grant -> evm_wallet (wallet_id));
+diesel::joinable!(client_metadata_history -> client_metadata (metadata_id));
-diesel::joinable!(evm_basic_grant -> program_client (client_id));
+diesel::joinable!(client_metadata_history -> program_client (client_id));
+diesel::joinable!(evm_basic_grant -> evm_wallet_access (wallet_access_id));
 diesel::joinable!(evm_ether_transfer_grant -> evm_basic_grant (basic_grant_id));
 diesel::joinable!(evm_ether_transfer_grant -> evm_ether_transfer_limit (limit_id));
 diesel::joinable!(evm_ether_transfer_grant_target -> evm_ether_transfer_grant (grant_id));
@@ -169,11 +197,18 @@ diesel::joinable!(evm_token_transfer_grant -> evm_basic_grant (basic_grant_id));
 diesel::joinable!(evm_token_transfer_log -> evm_token_transfer_grant (grant_id));
 diesel::joinable!(evm_token_transfer_log -> evm_transaction_log (log_id));
 diesel::joinable!(evm_token_transfer_volume_limit -> evm_token_transfer_grant (grant_id));
+diesel::joinable!(evm_transaction_log -> evm_basic_grant (grant_id));
+diesel::joinable!(evm_transaction_log -> evm_wallet_access (wallet_access_id));
 diesel::joinable!(evm_wallet -> aead_encrypted (aead_encrypted_id));
+diesel::joinable!(evm_wallet_access -> evm_wallet (wallet_id));
+diesel::joinable!(evm_wallet_access -> program_client (client_id));
+diesel::joinable!(program_client -> client_metadata (metadata_id));
 
 diesel::allow_tables_to_appear_in_same_query!(
     aead_encrypted,
     arbiter_settings,
+    client_metadata,
+    client_metadata_history,
     evm_basic_grant,
     evm_ether_transfer_grant,
     evm_ether_transfer_grant_target,
@@ -183,6 +218,7 @@ diesel::allow_tables_to_appear_in_same_query!(
     evm_token_transfer_volume_limit,
     evm_transaction_log,
     evm_wallet,
+    evm_wallet_access,
     program_client,
     root_key_history,
     tls_history,

server/crates/arbiter-server/src/evm/mod.rs

@@ -6,13 +6,15 @@ use alloy::{
     primitives::{TxKind, U256},
 };
 use chrono::Utc;
-use diesel::{ExpressionMethods as _, QueryDsl, QueryResult, insert_into, sqlite::Sqlite};
+use diesel::{ExpressionMethods as _, QueryDsl as _, QueryResult, insert_into, sqlite::Sqlite};
 use diesel_async::{AsyncConnection, RunQueryDsl};
 
 use crate::{
     db::{
         self,
-        models::{EvmBasicGrant, NewEvmBasicGrant, NewEvmTransactionLog, SqliteTimestamp},
+        models::{
+            EvmBasicGrant, EvmWalletAccess, NewEvmBasicGrant, NewEvmTransactionLog, SqliteTimestamp,
+        },
         schema::{self, evm_transaction_log},
     },
     evm::policies::{
@@ -184,8 +186,7 @@ impl Engine {
                     let log_id: i32 = insert_into(evm_transaction_log::table)
                         .values(&NewEvmTransactionLog {
                             grant_id: grant.shared_grant_id,
-                            client_id: context.client_id,
+                            wallet_access_id: context.target.id,
-                            wallet_id: context.wallet_id,
                             chain_id: context.chain as i32,
                             eth_value: utils::u256_to_bytes(context.value).to_vec(),
                             signed_at: Utc::now().into(),
@@ -213,7 +214,6 @@ impl Engine {
 
     pub async fn create_grant<P: Policy>(
         &self,
-        client_id: i32,
         full_grant: FullGrant<P::Settings>,
     ) -> Result<i32, CreationError> {
         let mut conn = self.db.get().await?;
@@ -225,9 +225,8 @@ impl Engine {
 
                     let basic_grant: EvmBasicGrant = insert_into(evm_basic_grant::table)
                         .values(&NewEvmBasicGrant {
-                            wallet_id: full_grant.basic.wallet_id,
                             chain_id: full_grant.basic.chain as i32,
-                            client_id,
+                            wallet_access_id: full_grant.basic.wallet_access_id,
                             valid_from: full_grant.basic.valid_from.map(SqliteTimestamp),
                             valid_until: full_grant.basic.valid_until.map(SqliteTimestamp),
                             max_gas_fee_per_gas: full_grant
@@ -295,8 +294,7 @@ impl Engine {
 
     pub async fn evaluate_transaction(
         &self,
-        wallet_id: i32,
+        target: EvmWalletAccess,
-        client_id: i32,
         transaction: TxEip1559,
         run_kind: RunKind,
     ) -> Result<SpecificMeaning, VetError> {
@@ -304,8 +302,7 @@ impl Engine {
             return Err(VetError::ContractCreationNotSupported);
         };
         let context = policies::EvalContext {
-            wallet_id,
+            target,
-            client_id,
             chain: transaction.chain_id,
             to,
             value: transaction.value,

server/crates/arbiter-server/src/evm/policies.rs

@@ -10,7 +10,7 @@ use miette::Diagnostic;
 use thiserror::Error;
 
 use crate::{
-    db::models::{self, EvmBasicGrant},
+    db::models::{self, EvmBasicGrant, EvmWalletAccess},
     evm::utils,
 };
 
@@ -19,9 +19,8 @@ pub mod token_transfers;
 
 #[derive(Debug, Clone)]
 pub struct EvalContext {
-    // Which wallet is this transaction for
+    // Which wallet is this transaction for and who requested it
-    pub client_id: i32,
+    pub target: EvmWalletAccess,
-    pub wallet_id: i32,
 
     // The transaction data
     pub chain: ChainId,
@@ -145,8 +144,7 @@ pub struct VolumeRateLimit {
 
 #[derive(Clone, Debug, PartialEq, Eq, Hash)]
 pub struct SharedGrantSettings {
-    pub wallet_id: i32,
+    pub wallet_access_id: i32,
-    pub client_id: i32,
     pub chain: ChainId,
 
     pub valid_from: Option<DateTime<Utc>>,
@@ -161,8 +159,7 @@ pub struct SharedGrantSettings {
 impl SharedGrantSettings {
     fn try_from_model(model: EvmBasicGrant) -> QueryResult<Self> {
         Ok(Self {
-            wallet_id: model.wallet_id,
+            wallet_access_id: model.wallet_access_id,
-            client_id: model.client_id,
             chain: model.chain_id as u64, // safe because chain_id is stored as i32 but is guaranteed to be a valid ChainId by the API when creating grants
             valid_from: model.valid_from.map(Into::into),
             valid_until: model.valid_until.map(Into::into),

server/crates/arbiter-server/src/evm/policies/ether_transfer/mod.rs

@@ -196,9 +196,8 @@ impl Policy for EtherTransfer {
             .inner_join(evm_basic_grant::table)
             .inner_join(evm_ether_transfer_grant_target::table)
             .filter(
-                evm_basic_grant::wallet_id
+                evm_basic_grant::wallet_access_id
-                    .eq(context.wallet_id)
+                    .eq(context.target.id)
-                    .and(evm_basic_grant::client_id.eq(context.client_id))
                     .and(evm_basic_grant::revoked_at.is_null())
                     .and(evm_ether_transfer_grant_target::address.eq(&target_bytes)),
             )

server/crates/arbiter-server/src/evm/policies/ether_transfer/tests.rs

@@ -5,7 +5,9 @@ use diesel_async::RunQueryDsl;
 
 use crate::db::{
     self, DatabaseConnection,
-    models::{EvmBasicGrant, NewEvmBasicGrant, NewEvmTransactionLog, SqliteTimestamp},
+    models::{
+        EvmBasicGrant, EvmWalletAccess, NewEvmBasicGrant, NewEvmTransactionLog, SqliteTimestamp,
+    },
     schema::{evm_basic_grant, evm_transaction_log},
 };
 use crate::evm::{
@@ -15,8 +17,7 @@ use crate::evm::{
 
 use super::{EtherTransfer, Settings};
 
-const WALLET_ID: i32 = 1;
+const WALLET_ACCESS_ID: i32 = 1;
-const CLIENT_ID: i32 = 2;
 const CHAIN_ID: u64 = 1;
 
 const ALLOWED: Address = address!("1111111111111111111111111111111111111111");
@@ -24,8 +25,12 @@ const OTHER: Address = address!("2222222222222222222222222222222222222222");
 
 fn ctx(to: Address, value: U256) -> EvalContext {
     EvalContext {
-        wallet_id: WALLET_ID,
+        target: EvmWalletAccess {
-        client_id: CLIENT_ID,
+            id: WALLET_ACCESS_ID,
+            wallet_id: 10,
+            client_id: 20,
+            created_at: SqliteTimestamp(Utc::now()),
+        },
         chain: CHAIN_ID,
         to,
         value,
@@ -38,8 +43,7 @@ fn ctx(to: Address, value: U256) -> EvalContext {
 async fn insert_basic(conn: &mut DatabaseConnection, revoked: bool) -> EvmBasicGrant {
     insert_into(evm_basic_grant::table)
         .values(NewEvmBasicGrant {
-            wallet_id: WALLET_ID,
+            wallet_access_id: WALLET_ACCESS_ID,
-            client_id: CLIENT_ID,
             chain_id: CHAIN_ID as i32,
             valid_from: None,
             valid_until: None,
@@ -67,14 +71,13 @@ fn make_settings(targets: Vec<Address>, max_volume: u64) -> Settings {
 
 fn shared() -> SharedGrantSettings {
     SharedGrantSettings {
-        wallet_id: WALLET_ID,
+        wallet_access_id: WALLET_ACCESS_ID,
         chain: CHAIN_ID,
         valid_from: None,
         valid_until: None,
         max_gas_fee_per_gas: None,
         max_priority_fee_per_gas: None,
         rate_limit: None,
-        client_id: CLIENT_ID,
     }
 }
 
@@ -153,8 +156,7 @@ async fn evaluate_passes_when_volume_within_limit() {
     insert_into(evm_transaction_log::table)
         .values(NewEvmTransactionLog {
             grant_id,
-            client_id: CLIENT_ID,
+            wallet_access_id: WALLET_ACCESS_ID,
-            wallet_id: WALLET_ID,
             chain_id: CHAIN_ID as i32,
             eth_value: utils::u256_to_bytes(U256::from(500u64)).to_vec(),
             signed_at: SqliteTimestamp(Utc::now()),
@@ -194,8 +196,7 @@ async fn evaluate_rejects_volume_over_limit() {
     insert_into(evm_transaction_log::table)
         .values(NewEvmTransactionLog {
             grant_id,
-            client_id: CLIENT_ID,
+            wallet_access_id: WALLET_ACCESS_ID,
-            wallet_id: WALLET_ID,
             chain_id: CHAIN_ID as i32,
             eth_value: utils::u256_to_bytes(U256::from(1_001u64)).to_vec(),
             signed_at: SqliteTimestamp(Utc::now()),
@@ -236,8 +237,7 @@ async fn evaluate_passes_at_exactly_volume_limit() {
     insert_into(evm_transaction_log::table)
         .values(NewEvmTransactionLog {
             grant_id,
-            client_id: CLIENT_ID,
+            wallet_access_id: WALLET_ACCESS_ID,
-            wallet_id: WALLET_ID,
             chain_id: CHAIN_ID as i32,
             eth_value: utils::u256_to_bytes(U256::from(1_000u64)).to_vec(),
             signed_at: SqliteTimestamp(Utc::now()),

server/crates/arbiter-server/src/evm/policies/token_transfers/mod.rs

@@ -209,8 +209,7 @@ impl Policy for TokenTransfer {
 
         let grant: Option<(EvmBasicGrant, EvmTokenTransferGrant)> = grant_join()
             .filter(evm_basic_grant::revoked_at.is_null())
-            .filter(evm_basic_grant::wallet_id.eq(context.wallet_id))
+            .filter(evm_basic_grant::wallet_access_id.eq(context.target.id))
-            .filter(evm_basic_grant::client_id.eq(context.client_id))
             .filter(evm_token_transfer_grant::token_contract.eq(&token_contract_bytes))
             .select((
                 EvmBasicGrant::as_select(),

server/crates/arbiter-server/src/evm/policies/token_transfers/tests.rs

@@ -6,7 +6,7 @@ use diesel_async::RunQueryDsl;
 
 use crate::db::{
     self, DatabaseConnection,
-    models::{EvmBasicGrant, NewEvmBasicGrant, SqliteTimestamp},
+    models::{EvmBasicGrant, EvmWalletAccess, NewEvmBasicGrant, SqliteTimestamp},
     schema::evm_basic_grant,
 };
 use crate::evm::{
@@ -21,8 +21,7 @@ use super::{Settings, TokenTransfer};
 const CHAIN_ID: u64 = 1;
 const DAI: Address = address!("6B175474E89094C44Da98b954EedeAC495271d0F");
 
-const WALLET_ID: i32 = 1;
+const WALLET_ACCESS_ID: i32 = 1;
-const CLIENT_ID: i32 = 2;
 
 const RECIPIENT: Address = address!("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa");
 const OTHER: Address = address!("bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb");
@@ -38,8 +37,12 @@ fn transfer_calldata(to: Address, value: U256) -> Bytes {
 
 fn ctx(to: Address, calldata: Bytes) -> EvalContext {
     EvalContext {
-        wallet_id: WALLET_ID,
+        target: EvmWalletAccess {
-        client_id: CLIENT_ID,
+            id: WALLET_ACCESS_ID,
+            wallet_id: 10,
+            client_id: 20,
+            created_at: SqliteTimestamp(Utc::now()),
+        },
         chain: CHAIN_ID,
         to,
         value: U256::ZERO,
@@ -52,8 +55,7 @@ fn ctx(to: Address, calldata: Bytes) -> EvalContext {
 async fn insert_basic(conn: &mut DatabaseConnection, revoked: bool) -> EvmBasicGrant {
     insert_into(evm_basic_grant::table)
         .values(NewEvmBasicGrant {
-            wallet_id: WALLET_ID,
+            wallet_access_id: WALLET_ACCESS_ID,
-            client_id: CLIENT_ID,
             chain_id: CHAIN_ID as i32,
             valid_from: None,
             valid_until: None,
@@ -86,14 +88,13 @@ fn make_settings(target: Option<Address>, max_volume: Option<u64>) -> Settings {
 
 fn shared() -> SharedGrantSettings {
     SharedGrantSettings {
-        wallet_id: WALLET_ID,
+        wallet_access_id: WALLET_ACCESS_ID,
         chain: CHAIN_ID,
         valid_from: None,
         valid_until: None,
         max_gas_fee_per_gas: None,
         max_priority_fee_per_gas: None,
         rate_limit: None,
-        client_id: CLIENT_ID,
     }
 }
 

server/crates/arbiter-server/src/grpc/client.rs

@@ -22,10 +22,11 @@ use crate::{
         keyholder::KeyHolderState,
     },
     grpc::request_tracker::RequestTracker,
-    utils::defer,
 };
 
 mod auth;
+mod inbound;
+mod outbound;
 
 async fn dispatch_loop(
     mut bi: GrpcBi<ClientRequest, ClientResponse>,
@@ -33,52 +34,53 @@ async fn dispatch_loop(
     mut request_tracker: RequestTracker,
 ) {
     loop {
-        let Some(conn) = bi.recv().await else {
+        let Some(message) = bi.recv().await else { return };
+
+        let conn = match message {
+            Ok(conn) => conn,
+            Err(err) => {
+                warn!(error = ?err, "Failed to receive client request");
+                return;
+            }
+        };
+
+        let request_id = match request_tracker.request(conn.request_id) {
+            Ok(id) => id,
+            Err(err) => {
+                let _ = bi.send(Err(err)).await;
+                return;
+            }
+        };
+
+        let Some(payload) = conn.payload else {
+            let _ = bi.send(Err(Status::invalid_argument("Missing client request payload"))).await;
             return;
         };
 
-        if dispatch_conn_message(&mut bi, &actor, &mut request_tracker, conn)
+        match dispatch_inner(&actor, payload).await {
-            .await
+            Ok(response) => {
-            .is_err()
+                if bi.send(Ok(ClientResponse {
-        {
+                    request_id: Some(request_id),
-            return;
+                    payload: Some(response),
+                })).await.is_err() {
+                    return;
+                }
+            }
+            Err(status) => {
+                let _ = bi.send(Err(status)).await;
+                return;
+            }
         }
     }
 }
 
-async fn dispatch_conn_message(
+async fn dispatch_inner(
-    bi: &mut GrpcBi<ClientRequest, ClientResponse>,
     actor: &ActorRef<ClientSession>,
-    request_tracker: &mut RequestTracker,
+    payload: ClientRequestPayload,
-    conn: Result<ClientRequest, Status>,
+) -> Result<ClientResponsePayload, Status> {
-) -> Result<(), ()> {
+    match payload {
-    let conn = match conn {
+        ClientRequestPayload::QueryVaultState(_) => {
-        Ok(conn) => conn,
+            let state = match actor.ask(HandleQueryVaultState {}).await {
-        Err(err) => {
-            warn!(error = ?err, "Failed to receive client request");
-            return Err(());
-        }
-    };
-
-    let request_id = match request_tracker.request(conn.request_id) {
-        Ok(request_id) => request_id,
-        Err(err) => {
-            let _ = bi.send(Err(err)).await;
-            return Err(());
-        }
-    };
-    let Some(payload) = conn.payload else {
-        let _ = bi
-            .send(Err(Status::invalid_argument(
-                "Missing client request payload",
-            )))
-            .await;
-        return Err(());
-    };
-
-    let payload = match payload {
-        ClientRequestPayload::QueryVaultState(_) => ClientResponsePayload::VaultState(
-            match actor.ask(HandleQueryVaultState {}).await {
                 Ok(KeyHolderState::Unbootstrapped) => ProtoVaultState::Unbootstrapped,
                 Ok(KeyHolderState::Sealed) => ProtoVaultState::Sealed,
                 Ok(KeyHolderState::Unsealed) => ProtoVaultState::Unsealed,
@@ -87,51 +89,30 @@ async fn dispatch_conn_message(
                     warn!(error = ?err, "Failed to query vault state");
                     ProtoVaultState::Error
                 }
-            }
+            };
-            .into(),
+            Ok(ClientResponsePayload::VaultState(state.into()))
-        ),
+        }
         payload => {
             warn!(?payload, "Unsupported post-auth client request");
-            let _ = bi
+            Err(Status::invalid_argument("Unsupported client request"))
-                .send(Err(Status::invalid_argument("Unsupported client request")))
-                .await;
-            return Err(());
-        }
-    };
-
-    bi.send(Ok(ClientResponse {
-        request_id: Some(request_id),
-        payload: Some(payload),
-    }))
-    .await
-    .map_err(|_| ())
-}
-
-pub async fn start(conn: ClientConnection, mut bi: GrpcBi<ClientRequest, ClientResponse>) {
-    let mut conn = conn;
-    let mut request_tracker = RequestTracker::default();
-    let mut response_id = None;
-
-    match auth::start(&mut conn, &mut bi, &mut request_tracker, &mut response_id).await {
-        Ok(_) => {
-            let actor =
-                client::session::ClientSession::spawn(client::session::ClientSession::new(conn));
-            let actor_for_cleanup = actor.clone();
-            let _ = defer(move || {
-                actor_for_cleanup.kill();
-            });
-
-            info!("Client authenticated successfully");
-            dispatch_loop(bi, actor, request_tracker).await;
-        }
-        Err(e) => {
-            let mut transport = auth::AuthTransportAdapter::new(
-                &mut bi,
-                &mut request_tracker,
-                &mut response_id,
-            );
-            let _ = transport.send(Err(e.clone())).await;
-            warn!(error = ?e, "Authentication failed");
         }
     }
 }
+
+pub async fn start(mut conn: ClientConnection, mut bi: GrpcBi<ClientRequest, ClientResponse>) {
+    let mut request_tracker = RequestTracker::default();
+
+    if let Err(e) = auth::start(&mut conn, &mut bi, &mut request_tracker).await {
+        let mut transport = auth::AuthTransportAdapter::new(&mut bi, &mut request_tracker);
+        let _ = transport.send(Err(e.clone())).await;
+        warn!(error = ?e, "Client authentication failed");
+        return;
+    };
+
+    let actor = client::session::ClientSession::spawn(client::session::ClientSession::new(conn));
+    let actor_for_cleanup = actor.clone();
+
+    info!("Client authenticated successfully");
+    dispatch_loop(bi, actor, request_tracker).await;
+    actor_for_cleanup.kill();
+}

server/crates/arbiter-server/src/grpc/client/auth.rs

@@ -1,11 +1,11 @@
 use arbiter_proto::{
-    proto::client::{
+    ClientMetadata, proto::client::{
         AuthChallenge as ProtoAuthChallenge, AuthChallengeRequest as ProtoAuthChallengeRequest,
         AuthChallengeSolution as ProtoAuthChallengeSolution, AuthResult as ProtoAuthResult,
-        ClientRequest, ClientResponse, client_request::Payload as ClientRequestPayload,
+        ClientInfo as ProtoClientInfo, ClientRequest, ClientResponse,
+        client_request::Payload as ClientRequestPayload,
         client_response::Payload as ClientResponsePayload,
-    },
+    }, transport::{Bi, Error as TransportError, Receiver, Sender, grpc::GrpcBi}
-    transport::{Bi, Error as TransportError, Receiver, Sender, grpc::GrpcBi},
 };
 use async_trait::async_trait;
 use tonic::Status;
@@ -19,19 +19,16 @@ use crate::{
 pub struct AuthTransportAdapter<'a> {
     bi: &'a mut GrpcBi<ClientRequest, ClientResponse>,
     request_tracker: &'a mut RequestTracker,
-    response_id: &'a mut Option<i32>,
 }
 
 impl<'a> AuthTransportAdapter<'a> {
     pub fn new(
         bi: &'a mut GrpcBi<ClientRequest, ClientResponse>,
         request_tracker: &'a mut RequestTracker,
-        response_id: &'a mut Option<i32>,
     ) -> Self {
         Self {
             bi,
             request_tracker,
-            response_id,
         }
     }
 
@@ -57,7 +54,7 @@ impl<'a> AuthTransportAdapter<'a> {
                     ProtoAuthResult::ApprovalDenied
                 }
                 auth::Error::ApproveError(auth::ApproveError::Upstream(
-                    crate::actors::router::ApprovalError::NoUserAgentsConnected,
+                    crate::actors::flow_coordinator::ApprovalError::NoUserAgentsConnected,
                 )) => ProtoAuthResult::NoUserAgentsOnline,
                 auth::Error::ApproveError(auth::ApproveError::Internal)
                 | auth::Error::DatabasePoolUnavailable
@@ -72,11 +69,9 @@ impl<'a> AuthTransportAdapter<'a> {
         &mut self,
         payload: ClientResponsePayload,
     ) -> Result<(), TransportError> {
-        let request_id = self.response_id.take();
-
         self.bi
             .send(Ok(ClientResponse {
-                request_id,
+                request_id: Some(self.request_tracker.current_request_id()),
                 payload: Some(payload),
             }))
             .await
@@ -114,19 +109,27 @@ impl Receiver<auth::Inbound> for AuthTransportAdapter<'_> {
             }
         };
 
-        let request_id = match self.request_tracker.request(request.request_id) {
+        match self.request_tracker.request(request.request_id) {
             Ok(request_id) => request_id,
             Err(error) => {
                 let _ = self.bi.send(Err(error)).await;
                 return None;
             }
         };
-        *self.response_id = Some(request_id);
-
         let payload = request.payload?;
 
         match payload {
-            ClientRequestPayload::AuthChallengeRequest(ProtoAuthChallengeRequest { pubkey }) => {
+            ClientRequestPayload::AuthChallengeRequest(ProtoAuthChallengeRequest {
+                pubkey,
+                client_info,
+            }) => {
+                let Some(client_info) = client_info else {
+                    let _ = self
+                        .bi
+                        .send(Err(Status::invalid_argument("Missing client info")))
+                        .await;
+                    return None;
+                };
                 let Ok(pubkey) = <[u8; 32]>::try_from(pubkey) else {
                     let _ = self.send_auth_result(ProtoAuthResult::InvalidKey).await;
                     return None;
@@ -135,7 +138,10 @@ impl Receiver<auth::Inbound> for AuthTransportAdapter<'_> {
                     let _ = self.send_auth_result(ProtoAuthResult::InvalidKey).await;
                     return None;
                 };
-                Some(auth::Inbound::AuthChallengeRequest { pubkey })
+                Some(auth::Inbound::AuthChallengeRequest {
+                    pubkey,
+                    metadata: client_metadata_from_proto(client_info),
+                })
             }
             ClientRequestPayload::AuthChallengeSolution(ProtoAuthChallengeSolution {
                 signature,
@@ -151,7 +157,9 @@ impl Receiver<auth::Inbound> for AuthTransportAdapter<'_> {
             _ => {
                 let _ = self
                     .bi
-                    .send(Err(Status::invalid_argument("Unsupported client auth request")))
+                    .send(Err(Status::invalid_argument(
+                        "Unsupported client auth request",
+                    )))
                     .await;
                 None
             }
@@ -161,13 +169,20 @@ impl Receiver<auth::Inbound> for AuthTransportAdapter<'_> {
 
 impl Bi<auth::Inbound, Result<auth::Outbound, auth::Error>> for AuthTransportAdapter<'_> {}
 
+fn client_metadata_from_proto(metadata: ProtoClientInfo) -> ClientMetadata {
+    ClientMetadata {
+        name: metadata.name,
+        description: metadata.description,
+        version: metadata.version,
+    }
+}
+
 pub async fn start(
     conn: &mut ClientConnection,
     bi: &mut GrpcBi<ClientRequest, ClientResponse>,
     request_tracker: &mut RequestTracker,
-    response_id: &mut Option<i32>,
 ) -> Result<(), auth::Error> {
-    let mut transport = AuthTransportAdapter::new(bi, request_tracker, response_id);
+    let mut transport = AuthTransportAdapter::new(bi, request_tracker);
     client::auth::authenticate(conn, &mut transport).await?;
     Ok(())
 }

server/crates/arbiter-server/src/grpc/mod.rs

@@ -18,6 +18,19 @@ pub mod client;
 mod request_tracker;
 pub mod user_agent;
 
+pub trait Convert {
+    type Output;
+
+    fn convert(self) -> Self::Output;
+}
+
+pub trait TryConvert {
+    type Output;
+    type Error;
+
+    fn try_convert(self) -> Result<Self::Output, Self::Error>;
+}
+
 #[async_trait]
 impl arbiter_proto::proto::arbiter_service_server::ArbiterService for super::Server {
     type UserAgentStream = ReceiverStream<Result<UserAgentResponse, Status>>;

server/crates/arbiter-server/src/grpc/request_tracker.rs

@@ -17,4 +17,10 @@ impl RequestTracker {
 
         Ok(id)
     }
+
+    // This is used to set the response id for auth responses, which need to match the request id of the auth challenge request.
+    // -1 offset is needed because request() increments the next_request_id after returning the current request id.
+    pub fn current_request_id(&self) -> i32 {
+        self.next_request_id - 1
+    }
 }

server/crates/arbiter-server/src/grpc/user_agent.rs

@@ -1,29 +1,30 @@
 use tokio::sync::mpsc;
 
 use arbiter_proto::{
-    google::protobuf::{Empty as ProtoEmpty, Timestamp as ProtoTimestamp},
     proto::{
+        client::ClientInfo as ProtoClientMetadata,
         evm::{
-            EtherTransferSettings as ProtoEtherTransferSettings, EvmError as ProtoEvmError,
+            EvmError as ProtoEvmError, EvmGrantCreateRequest, EvmGrantCreateResponse,
-            EvmGrantCreateRequest, EvmGrantCreateResponse, EvmGrantDeleteRequest,
+            EvmGrantDeleteRequest, EvmGrantDeleteResponse, EvmGrantList, EvmGrantListResponse,
-            EvmGrantDeleteResponse, EvmGrantList, EvmGrantListResponse, GrantEntry,
+            GrantEntry, WalletCreateResponse, WalletEntry, WalletList, WalletListResponse,
-            SharedSettings as ProtoSharedSettings, SpecificGrant as ProtoSpecificGrant,
+            evm_grant_create_response::Result as EvmGrantCreateResult,
-            TokenTransferSettings as ProtoTokenTransferSettings,
-            TransactionRateLimit as ProtoTransactionRateLimit,
-            VolumeRateLimit as ProtoVolumeRateLimit, WalletCreateResponse, WalletEntry, WalletList,
-            WalletListResponse, evm_grant_create_response::Result as EvmGrantCreateResult,
             evm_grant_delete_response::Result as EvmGrantDeleteResult,
             evm_grant_list_response::Result as EvmGrantListResult,
-            specific_grant::Grant as ProtoSpecificGrantType,
             wallet_create_response::Result as WalletCreateResult,
             wallet_list_response::Result as WalletListResult,
         },
         user_agent::{
             BootstrapEncryptedKey as ProtoBootstrapEncryptedKey,
-            BootstrapResult as ProtoBootstrapResult,
+            BootstrapResult as ProtoBootstrapResult, ListWalletAccessResponse,
-            SdkClientConnectionResponse as ProtoSdkClientConnectionResponse,
+            SdkClientConnectionCancel as ProtoSdkClientConnectionCancel,
-            UnsealEncryptedKey as ProtoUnsealEncryptedKey, UnsealResult as ProtoUnsealResult,
+            SdkClientConnectionRequest as ProtoSdkClientConnectionRequest,
-            UnsealStart, UserAgentRequest, UserAgentResponse, VaultState as ProtoVaultState,
+            SdkClientEntry as ProtoSdkClientEntry, SdkClientError as ProtoSdkClientError,
+            SdkClientGrantWalletAccess, SdkClientList as ProtoSdkClientList,
+            SdkClientListResponse as ProtoSdkClientListResponse, SdkClientRevokeWalletAccess,
+            SdkClientWalletAccess, UnsealEncryptedKey as ProtoUnsealEncryptedKey,
+            UnsealResult as ProtoUnsealResult, UnsealStart, UserAgentRequest, UserAgentResponse,
+            VaultState as ProtoVaultState,
+            sdk_client_list_response::Result as ProtoSdkClientListResult,
             user_agent_request::Payload as UserAgentRequestPayload,
             user_agent_response::Payload as UserAgentResponsePayload,
         },
@@ -31,35 +32,28 @@ use arbiter_proto::{
     transport::{Error as TransportError, Receiver, Sender, grpc::GrpcBi},
 };
 use async_trait::async_trait;
-use chrono::{TimeZone, Utc};
 use kameo::{
     actor::{ActorRef, Spawn as _},
     error::SendError,
 };
 use tonic::Status;
-use tracing::{info, warn};
+use tracing::{error, info, warn};
 
 use crate::{
     actors::{
         keyholder::KeyHolderState,
         user_agent::{
             OutOfBand, UserAgentConnection, UserAgentSession,
-            session::{
+            session::connection::{
-                BootstrapError, Error, HandleBootstrapEncryptedKey, HandleEvmWalletCreate,
+                BootstrapError, HandleBootstrapEncryptedKey, HandleEvmWalletCreate, HandleEvmWalletList, HandleGrantCreate, HandleGrantDelete, HandleGrantEvmWalletAccess, HandleGrantList, HandleListWalletAccess, HandleNewClientApprove, HandleQueryVaultState, HandleRevokeEvmWalletAccess, HandleSdkClientList, HandleUnsealEncryptedKey, HandleUnsealRequest, UnsealError
-                HandleEvmWalletList, HandleGrantCreate, HandleGrantDelete, HandleGrantList,
-                HandleQueryVaultState, HandleUnsealEncryptedKey, HandleUnsealRequest, UnsealError,
             },
         },
     },
-    evm::policies::{
+    grpc::{Convert, TryConvert, request_tracker::RequestTracker},
-        Grant, SharedGrantSettings, SpecificGrant, TransactionRateLimit, VolumeRateLimit,
-        ether_transfer, token_transfers,
-    },
-    grpc::request_tracker::RequestTracker,
-    utils::defer,
 };
-use alloy::primitives::{Address, U256};
 mod auth;
+mod inbound;
+mod outbound;
 
 pub struct OutOfBandAdapter(mpsc::Sender<OutOfBand>);
 
@@ -83,94 +77,109 @@ async fn dispatch_loop(
         tokio::select! {
             oob = receiver.recv() => {
                 let Some(oob) = oob else {
+                    warn!("Out-of-band message channel closed");
                     return;
                 };
 
-                if send_out_of_band(&mut bi, oob).await.is_err() {
+                let payload = match oob {
+                    OutOfBand::ClientConnectionRequest { profile } => {
+                        UserAgentResponsePayload::SdkClientConnectionRequest(ProtoSdkClientConnectionRequest {
+                            pubkey: profile.pubkey.to_bytes().to_vec(),
+                            info: Some(ProtoClientMetadata {
+                                name: profile.metadata.name,
+                                description: profile.metadata.description,
+                                version: profile.metadata.version,
+                            }),
+                        })
+                    }
+                    OutOfBand::ClientConnectionCancel { pubkey } => {
+                        UserAgentResponsePayload::SdkClientConnectionCancel(ProtoSdkClientConnectionCancel {
+                            pubkey: pubkey.to_bytes().to_vec(),
+                        })
+                    }
+                };
+
+                if bi.send(Ok(UserAgentResponse { id: None, payload: Some(payload) })).await.is_err() {
                     return;
                 }
             }
 
-            conn = bi.recv() => {
+            message = bi.recv() => {
-                let Some(conn) = conn else {
+                let Some(message) = message else { return; };
+
+                let conn = match message {
+                    Ok(conn) => conn,
+                    Err(err) => {
+                        warn!(error = ?err, "Failed to receive user agent request");
+                        return;
+                    }
+                };
+
+                let request_id = match request_tracker.request(conn.id) {
+                    Ok(id) => id,
+                    Err(err) => {
+                        let _ = bi.send(Err(err)).await;
+                        return;
+                    }
+                };
+
+                let Some(payload) = conn.payload else {
+                    let _ = bi.send(Err(Status::invalid_argument("Missing user-agent request payload"))).await;
                     return;
                 };
 
-                if dispatch_conn_message(&mut bi, &actor, &mut request_tracker, conn)
+                match dispatch_inner(&actor, payload).await {
-                    .await
+                    Ok(Some(response)) => {
-                    .is_err()
+                        if bi.send(Ok(UserAgentResponse {
-                {
+                            id: Some(request_id),
-                    return;
+                            payload: Some(response),
+                        })).await.is_err() {
+                            return;
+                        }
+                    }
+                    Ok(None) => {}
+                    Err(status) => {
+                         error!(?status, "Failed to process user agent request");
+                        let _ = bi.send(Err(status)).await;
+                        return;
+                    }
                 }
             }
         }
     }
 }
 
-async fn dispatch_conn_message(
+async fn dispatch_inner(
-    bi: &mut GrpcBi<UserAgentRequest, UserAgentResponse>,
     actor: &ActorRef<UserAgentSession>,
-    request_tracker: &mut RequestTracker,
+    payload: UserAgentRequestPayload,
-    conn: Result<UserAgentRequest, Status>,
+) -> Result<Option<UserAgentResponsePayload>, Status> {
-) -> Result<(), ()> {
+    let response = match payload {
-    let conn = match conn {
-        Ok(conn) => conn,
-        Err(err) => {
-            warn!(error = ?err, "Failed to receive user agent request");
-            return Err(());
-        }
-    };
-
-    let request_id = match request_tracker.request(conn.id) {
-        Ok(request_id) => request_id,
-        Err(err) => {
-            let _ = bi.send(Err(err)).await;
-            return Err(());
-        }
-    };
-
-    let Some(payload) = conn.payload else {
-        let _ = bi
-            .send(Err(Status::invalid_argument(
-                "Missing user-agent request payload",
-            )))
-            .await;
-        return Err(());
-    };
-
-    let payload = match payload {
         UserAgentRequestPayload::UnsealStart(UnsealStart { client_pubkey }) => {
-            let client_pubkey = match <[u8; 32]>::try_from(client_pubkey) {
+            let client_pubkey = <[u8; 32]>::try_from(client_pubkey)
-                Ok(bytes) => x25519_dalek::PublicKey::from(bytes),
+                .map(x25519_dalek::PublicKey::from)
-                Err(_) => {
+                .map_err(|_| Status::invalid_argument("Invalid X25519 public key"))?;
-                    let _ = bi
-                        .send(Err(Status::invalid_argument("Invalid X25519 public key")))
-                        .await;
-                    return Err(());
-                }
-            };
 
-            match actor.ask(HandleUnsealRequest { client_pubkey }).await {
+            let response = actor
-                Ok(response) => UserAgentResponsePayload::UnsealStartResponse(
+                .ask(HandleUnsealRequest { client_pubkey })
-                    arbiter_proto::proto::user_agent::UnsealStartResponse {
+                .await
-                        server_pubkey: response.server_pubkey.as_bytes().to_vec(),
+                .map_err(|err| {
-                    },
-                ),
-                Err(err) => {
                     warn!(error = ?err, "Failed to handle unseal start request");
-                    let _ = bi
+                    Status::internal("Failed to start unseal flow")
-                        .send(Err(Status::internal("Failed to start unseal flow")))
+                })?;
-                        .await;
+
-                    return Err(());
+            UserAgentResponsePayload::UnsealStartResponse(
-                }
+                arbiter_proto::proto::user_agent::UnsealStartResponse {
-            }
+                    server_pubkey: response.server_pubkey.as_bytes().to_vec(),
+                },
+            )
         }
+
         UserAgentRequestPayload::UnsealEncryptedKey(ProtoUnsealEncryptedKey {
             nonce,
             ciphertext,
             associated_data,
-        }) => UserAgentResponsePayload::UnsealResult(
+        }) => {
-            match actor
+            let result = match actor
                 .ask(HandleUnsealEncryptedKey {
                     nonce,
                     ciphertext,
@@ -184,20 +193,18 @@ async fn dispatch_conn_message(
                 }
                 Err(err) => {
                     warn!(error = ?err, "Failed to handle unseal request");
-                    let _ = bi
+                    return Err(Status::internal("Failed to unseal vault"));
-                        .send(Err(Status::internal("Failed to unseal vault")))
-                        .await;
-                    return Err(());
                 }
-            }
+            };
-            .into(),
+            UserAgentResponsePayload::UnsealResult(result.into())
-        ),
+        }
+
         UserAgentRequestPayload::BootstrapEncryptedKey(ProtoBootstrapEncryptedKey {
             nonce,
             ciphertext,
             associated_data,
-        }) => UserAgentResponsePayload::BootstrapResult(
+        }) => {
-            match actor
+            let result = match actor
                 .ask(HandleBootstrapEncryptedKey {
                     nonce,
                     ciphertext,
@@ -214,16 +221,14 @@ async fn dispatch_conn_message(
                 }
                 Err(err) => {
                     warn!(error = ?err, "Failed to handle bootstrap request");
-                    let _ = bi
+                    return Err(Status::internal("Failed to bootstrap vault"));
-                        .send(Err(Status::internal("Failed to bootstrap vault")))
-                        .await;
-                    return Err(());
                 }
-            }
+            };
-            .into(),
+            UserAgentResponsePayload::BootstrapResult(result.into())
-        ),
+        }
-        UserAgentRequestPayload::QueryVaultState(_) => UserAgentResponsePayload::VaultState(
+
-            match actor.ask(HandleQueryVaultState {}).await {
+        UserAgentRequestPayload::QueryVaultState(_) => {
+            let state = match actor.ask(HandleQueryVaultState {}).await {
                 Ok(KeyHolderState::Unbootstrapped) => ProtoVaultState::Unbootstrapped,
                 Ok(KeyHolderState::Sealed) => ProtoVaultState::Sealed,
                 Ok(KeyHolderState::Unsealed) => ProtoVaultState::Unsealed,
@@ -231,346 +236,203 @@ async fn dispatch_conn_message(
                     warn!(error = ?err, "Failed to query vault state");
                     ProtoVaultState::Error
                 }
-            }
+            };
-            .into(),
+            UserAgentResponsePayload::VaultState(state.into())
-        ),
+        }
-        UserAgentRequestPayload::EvmWalletCreate(_) => UserAgentResponsePayload::EvmWalletCreate(
+
-            EvmGrantOrWallet::wallet_create_response(actor.ask(HandleEvmWalletCreate {}).await),
+        UserAgentRequestPayload::EvmWalletCreate(_) => {
-        ),
+            let result = match actor.ask(HandleEvmWalletCreate {}).await {
-        UserAgentRequestPayload::EvmWalletList(_) => UserAgentResponsePayload::EvmWalletList(
+                Ok((wallet_id, address)) => WalletCreateResult::Wallet(WalletEntry {
-            EvmGrantOrWallet::wallet_list_response(actor.ask(HandleEvmWalletList {}).await),
+                    id: wallet_id,
-        ),
+                    address: address.to_vec(),
-        UserAgentRequestPayload::EvmGrantList(_) => UserAgentResponsePayload::EvmGrantList(
+                }),
-            EvmGrantOrWallet::grant_list_response(actor.ask(HandleGrantList {}).await),
+                Err(err) => {
-        ),
+                    warn!(error = ?err, "Failed to create EVM wallet");
-        UserAgentRequestPayload::EvmGrantCreate(EvmGrantCreateRequest {
+                    WalletCreateResult::Error(ProtoEvmError::Internal.into())
-            client_id,
-            shared,
-            specific,
-        }) => {
-            let (basic, grant) = match parse_grant_request(shared, specific) {
-                Ok(values) => values,
-                Err(status) => {
-                    let _ = bi.send(Err(status)).await;
-                    return Err(());
                 }
             };
-
+            UserAgentResponsePayload::EvmWalletCreate(WalletCreateResponse {
-            UserAgentResponsePayload::EvmGrantCreate(EvmGrantOrWallet::grant_create_response(
+                result: Some(result),
-                actor
+            })
-                    .ask(HandleGrantCreate {
-                        client_id,
-                        basic,
-                        grant,
-                    })
-                    .await,
-            ))
         }
-        UserAgentRequestPayload::EvmGrantDelete(EvmGrantDeleteRequest { grant_id }) => {
-            UserAgentResponsePayload::EvmGrantDelete(EvmGrantOrWallet::grant_delete_response(
-                actor.ask(HandleGrantDelete { grant_id }).await,
-            ))
-        }
-        payload => {
-            warn!(?payload, "Unsupported post-auth user agent request");
-            let _ = bi
-                .send(Err(Status::invalid_argument(
-                    "Unsupported user-agent request",
-                )))
-                .await;
-            return Err(());
-        }
-    };
 
-    bi.send(Ok(UserAgentResponse {
+        UserAgentRequestPayload::EvmWalletList(_) => {
-        id: Some(request_id),
+            let result = match actor.ask(HandleEvmWalletList {}).await {
-        payload: Some(payload),
+                Ok(wallets) => WalletListResult::Wallets(WalletList {
-    }))
+                    wallets: wallets
-    .await
+                        .into_iter()
-    .map_err(|_| ())
+                        .map(|(id, address)| WalletEntry {
-}
+                            address: address.to_vec(),
-
+                            id,
-async fn send_out_of_band(
+                        })
-    bi: &mut GrpcBi<UserAgentRequest, UserAgentResponse>,
+                        .collect(),
-    oob: OutOfBand,
-) -> Result<(), ()> {
-    let payload = match oob {
-        // The current protobuf response payload carries only an approval boolean.
-        // Keep emitting this shape until a dedicated out-of-band request/cancel payload
-        // is reintroduced in the protocol definition.
-        OutOfBand::ClientConnectionRequest { pubkey: _ } => {
-            UserAgentResponsePayload::SdkClientConnectionResponse(
-                ProtoSdkClientConnectionResponse { approved: false },
-            )
-        }
-        OutOfBand::ClientConnectionCancel => UserAgentResponsePayload::SdkClientConnectionResponse(
-            ProtoSdkClientConnectionResponse { approved: false },
-        ),
-    };
-
-    bi.send(Ok(UserAgentResponse {
-        id: None,
-        payload: Some(payload),
-    }))
-    .await
-    .map_err(|_| ())
-}
-
-fn parse_grant_request(
-    shared: Option<ProtoSharedSettings>,
-    specific: Option<ProtoSpecificGrant>,
-) -> Result<(SharedGrantSettings, SpecificGrant), Status> {
-    let shared = shared.ok_or_else(|| Status::invalid_argument("Missing shared grant settings"))?;
-    let specific =
-        specific.ok_or_else(|| Status::invalid_argument("Missing specific grant settings"))?;
-
-    Ok((
-        shared_settings_from_proto(shared)?,
-        specific_grant_from_proto(specific)?,
-    ))
-}
-
-fn shared_settings_from_proto(shared: ProtoSharedSettings) -> Result<SharedGrantSettings, Status> {
-    Ok(SharedGrantSettings {
-        wallet_id: shared.wallet_id,
-        client_id: 0,
-        chain: shared.chain_id,
-        valid_from: shared.valid_from.map(proto_timestamp_to_utc).transpose()?,
-        valid_until: shared.valid_until.map(proto_timestamp_to_utc).transpose()?,
-        max_gas_fee_per_gas: shared
-            .max_gas_fee_per_gas
-            .as_deref()
-            .map(u256_from_proto_bytes)
-            .transpose()?,
-        max_priority_fee_per_gas: shared
-            .max_priority_fee_per_gas
-            .as_deref()
-            .map(u256_from_proto_bytes)
-            .transpose()?,
-        rate_limit: shared.rate_limit.map(|limit| TransactionRateLimit {
-            count: limit.count,
-            window: chrono::Duration::seconds(limit.window_secs),
-        }),
-    })
-}
-
-fn specific_grant_from_proto(specific: ProtoSpecificGrant) -> Result<SpecificGrant, Status> {
-    match specific.grant {
-        Some(ProtoSpecificGrantType::EtherTransfer(ProtoEtherTransferSettings {
-            targets,
-            limit,
-        })) => Ok(SpecificGrant::EtherTransfer(ether_transfer::Settings {
-            target: targets
-                .into_iter()
-                .map(address_from_bytes)
-                .collect::<Result<_, _>>()?,
-            limit: volume_rate_limit_from_proto(limit.ok_or_else(|| {
-                Status::invalid_argument("Missing ether transfer volume rate limit")
-            })?)?,
-        })),
-        Some(ProtoSpecificGrantType::TokenTransfer(ProtoTokenTransferSettings {
-            token_contract,
-            target,
-            volume_limits,
-        })) => Ok(SpecificGrant::TokenTransfer(token_transfers::Settings {
-            token_contract: address_from_bytes(token_contract)?,
-            target: target.map(address_from_bytes).transpose()?,
-            volume_limits: volume_limits
-                .into_iter()
-                .map(volume_rate_limit_from_proto)
-                .collect::<Result<_, _>>()?,
-        })),
-        None => Err(Status::invalid_argument("Missing specific grant kind")),
-    }
-}
-
-fn volume_rate_limit_from_proto(limit: ProtoVolumeRateLimit) -> Result<VolumeRateLimit, Status> {
-    Ok(VolumeRateLimit {
-        max_volume: u256_from_proto_bytes(&limit.max_volume)?,
-        window: chrono::Duration::seconds(limit.window_secs),
-    })
-}
-
-fn address_from_bytes(bytes: Vec<u8>) -> Result<Address, Status> {
-    if bytes.len() != 20 {
-        return Err(Status::invalid_argument("Invalid EVM address"));
-    }
-
-    Ok(Address::from_slice(&bytes))
-}
-
-fn u256_from_proto_bytes(bytes: &[u8]) -> Result<U256, Status> {
-    if bytes.len() > 32 {
-        return Err(Status::invalid_argument("Invalid U256 byte length"));
-    }
-
-    Ok(U256::from_be_slice(bytes))
-}
-
-fn proto_timestamp_to_utc(timestamp: ProtoTimestamp) -> Result<chrono::DateTime<Utc>, Status> {
-    Utc.timestamp_opt(timestamp.seconds, timestamp.nanos as u32)
-        .single()
-        .ok_or_else(|| Status::invalid_argument("Invalid timestamp"))
-}
-
-fn shared_settings_to_proto(shared: SharedGrantSettings) -> ProtoSharedSettings {
-    ProtoSharedSettings {
-        wallet_id: shared.wallet_id,
-        chain_id: shared.chain,
-        valid_from: shared.valid_from.map(|time| ProtoTimestamp {
-            seconds: time.timestamp(),
-            nanos: time.timestamp_subsec_nanos() as i32,
-        }),
-        valid_until: shared.valid_until.map(|time| ProtoTimestamp {
-            seconds: time.timestamp(),
-            nanos: time.timestamp_subsec_nanos() as i32,
-        }),
-        max_gas_fee_per_gas: shared
-            .max_gas_fee_per_gas
-            .map(|value| value.to_be_bytes::<32>().to_vec()),
-        max_priority_fee_per_gas: shared
-            .max_priority_fee_per_gas
-            .map(|value| value.to_be_bytes::<32>().to_vec()),
-        rate_limit: shared.rate_limit.map(|limit| ProtoTransactionRateLimit {
-            count: limit.count,
-            window_secs: limit.window.num_seconds(),
-        }),
-    }
-}
-
-fn specific_grant_to_proto(grant: SpecificGrant) -> ProtoSpecificGrant {
-    let grant = match grant {
-        SpecificGrant::EtherTransfer(settings) => {
-            ProtoSpecificGrantType::EtherTransfer(ProtoEtherTransferSettings {
-                targets: settings
-                    .target
-                    .into_iter()
-                    .map(|address| address.to_vec())
-                    .collect(),
-                limit: Some(ProtoVolumeRateLimit {
-                    max_volume: settings.limit.max_volume.to_be_bytes::<32>().to_vec(),
-                    window_secs: settings.limit.window.num_seconds(),
                 }),
+                Err(err) => {
+                    warn!(error = ?err, "Failed to list EVM wallets");
+                    WalletListResult::Error(ProtoEvmError::Internal.into())
+                }
+            };
+            UserAgentResponsePayload::EvmWalletList(WalletListResponse {
+                result: Some(result),
             })
         }
-        SpecificGrant::TokenTransfer(settings) => {
+
-            ProtoSpecificGrantType::TokenTransfer(ProtoTokenTransferSettings {
+        UserAgentRequestPayload::EvmGrantList(_) => {
-                token_contract: settings.token_contract.to_vec(),
+            let result = match actor.ask(HandleGrantList {}).await {
-                target: settings.target.map(|address| address.to_vec()),
+                Ok(grants) => EvmGrantListResult::Grants(EvmGrantList {
-                volume_limits: settings
+                    grants: grants
-                    .volume_limits
+                        .into_iter()
-                    .into_iter()
+                        .map(|grant| GrantEntry {
-                    .map(|limit| ProtoVolumeRateLimit {
+                            id: grant.id,
-                        max_volume: limit.max_volume.to_be_bytes::<32>().to_vec(),
+                            wallet_access_id: grant.shared.wallet_access_id,
-                        window_secs: limit.window.num_seconds(),
+                            shared: Some(grant.shared.convert()),
-                    })
+                            specific: Some(grant.settings.convert()),
-                    .collect(),
+                        })
+                        .collect(),
+                }),
+                Err(err) => {
+                    warn!(error = ?err, "Failed to list EVM grants");
+                    EvmGrantListResult::Error(ProtoEvmError::Internal.into())
+                }
+            };
+            UserAgentResponsePayload::EvmGrantList(EvmGrantListResponse {
+                result: Some(result),
             })
         }
+
+        UserAgentRequestPayload::EvmGrantCreate(EvmGrantCreateRequest { shared, specific }) => {
+            let basic = shared
+                .ok_or_else(|| Status::invalid_argument("Missing shared grant settings"))?
+                .try_convert()?;
+            let grant = specific
+                .ok_or_else(|| Status::invalid_argument("Missing specific grant settings"))?
+                .try_convert()?;
+
+            let result = match actor.ask(HandleGrantCreate { basic, grant }).await {
+                Ok(grant_id) => EvmGrantCreateResult::GrantId(grant_id),
+                Err(err) => {
+                    warn!(error = ?err, "Failed to create EVM grant");
+                    EvmGrantCreateResult::Error(ProtoEvmError::Internal.into())
+                }
+            };
+            UserAgentResponsePayload::EvmGrantCreate(EvmGrantCreateResponse {
+                result: Some(result),
+            })
+        }
+
+        UserAgentRequestPayload::EvmGrantDelete(EvmGrantDeleteRequest { grant_id }) => {
+            let result = match actor.ask(HandleGrantDelete { grant_id }).await {
+                Ok(()) => EvmGrantDeleteResult::Ok(()),
+                Err(err) => {
+                    warn!(error = ?err, "Failed to delete EVM grant");
+                    EvmGrantDeleteResult::Error(ProtoEvmError::Internal.into())
+                }
+            };
+            UserAgentResponsePayload::EvmGrantDelete(EvmGrantDeleteResponse {
+                result: Some(result),
+            })
+        }
+
+        UserAgentRequestPayload::SdkClientConnectionResponse(resp) => {
+            let pubkey_bytes = <[u8; 32]>::try_from(resp.pubkey)
+                .map_err(|_| Status::invalid_argument("Invalid Ed25519 public key length"))?;
+            let pubkey = ed25519_dalek::VerifyingKey::from_bytes(&pubkey_bytes)
+                .map_err(|_| Status::invalid_argument("Invalid Ed25519 public key"))?;
+
+            actor
+                .ask(HandleNewClientApprove {
+                    approved: resp.approved,
+                    pubkey,
+                })
+                .await
+                .map_err(|err| {
+                    warn!(?err, "Failed to process client connection response");
+                    Status::internal("Failed to process response")
+                })?;
+
+            return Ok(None);
+        }
+
+        UserAgentRequestPayload::SdkClientRevoke(_) => todo!(),
+
+        UserAgentRequestPayload::SdkClientList(_) => {
+            let result = match actor.ask(HandleSdkClientList {}).await {
+                Ok(clients) => ProtoSdkClientListResult::Clients(ProtoSdkClientList {
+                    clients: clients
+                        .into_iter()
+                        .map(|(client, metadata)| ProtoSdkClientEntry {
+                            id: client.id,
+                            pubkey: client.public_key,
+                            info: Some(ProtoClientMetadata {
+                                name: metadata.name,
+                                description: metadata.description,
+                                version: metadata.version,
+                            }),
+                            created_at: client.created_at.0.timestamp() as i32,
+                        })
+                        .collect(),
+                }),
+                Err(err) => {
+                    warn!(error = ?err, "Failed to list SDK clients");
+                    ProtoSdkClientListResult::Error(ProtoSdkClientError::Internal.into())
+                }
+            };
+            UserAgentResponsePayload::SdkClientListResponse(ProtoSdkClientListResponse {
+                result: Some(result),
+            })
+        }
+
+        UserAgentRequestPayload::GrantWalletAccess(SdkClientGrantWalletAccess { accesses }) => {
+            let entries = accesses.try_convert()?;
+
+            match actor.ask(HandleGrantEvmWalletAccess { entries }).await {
+                Ok(()) => {
+                    info!("Successfully granted wallet access");
+                    return Ok(None);
+                }
+                Err(err) => {
+                    warn!(error = ?err, "Failed to grant wallet access");
+                    return Err(Status::internal("Failed to grant wallet access"));
+                }
+            }
+        }
+
+        UserAgentRequestPayload::RevokeWalletAccess(SdkClientRevokeWalletAccess { accesses }) => {
+            let entries = accesses.try_convert()?;
+
+            match actor.ask(HandleRevokeEvmWalletAccess { entries }).await {
+                Ok(()) => {
+                    info!("Successfully revoked wallet access");
+                    return Ok(None);
+                }
+                Err(err) => {
+                    warn!(error = ?err, "Failed to revoke wallet access");
+                    return Err(Status::internal("Failed to revoke wallet access"));
+                }
+            }
+        }
+
+        UserAgentRequestPayload::ListWalletAccess(_) => {
+            let result = match actor.ask(HandleListWalletAccess {}).await {
+                Ok(accesses) => ListWalletAccessResponse {
+                    accesses: accesses.into_iter().map(|a| a.convert()).collect(),
+                },
+                Err(err) => {
+                    warn!(error = ?err, "Failed to list wallet access");
+                    return Err(Status::internal("Failed to list wallet access"));
+                }
+            };
+            UserAgentResponsePayload::ListWalletAccessResponse(result)
+        }
+
+        UserAgentRequestPayload::AuthChallengeRequest(..)
+        | UserAgentRequestPayload::AuthChallengeSolution(..) => {
+            warn!(?payload, "Unsupported post-auth user agent request");
+            return Err(Status::invalid_argument("Unsupported user-agent request"));
+        }
     };
 
-    ProtoSpecificGrant { grant: Some(grant) }
+    Ok(Some(response))
-}
-
-struct EvmGrantOrWallet;
-
-impl EvmGrantOrWallet {
-    fn wallet_create_response<M>(
-        result: Result<Address, SendError<M, Error>>,
-    ) -> WalletCreateResponse {
-        let result = match result {
-            Ok(wallet) => WalletCreateResult::Wallet(WalletEntry {
-                address: wallet.to_vec(),
-            }),
-            Err(err) => {
-                warn!(error = ?err, "Failed to create EVM wallet");
-                WalletCreateResult::Error(ProtoEvmError::Internal.into())
-            }
-        };
-
-        WalletCreateResponse {
-            result: Some(result),
-        }
-    }
-
-    fn wallet_list_response<M>(
-        result: Result<Vec<Address>, SendError<M, Error>>,
-    ) -> WalletListResponse {
-        let result = match result {
-            Ok(wallets) => WalletListResult::Wallets(WalletList {
-                wallets: wallets
-                    .into_iter()
-                    .map(|wallet| WalletEntry {
-                        address: wallet.to_vec(),
-                    })
-                    .collect(),
-            }),
-            Err(err) => {
-                warn!(error = ?err, "Failed to list EVM wallets");
-                WalletListResult::Error(ProtoEvmError::Internal.into())
-            }
-        };
-
-        WalletListResponse {
-            result: Some(result),
-        }
-    }
-
-    fn grant_create_response<M>(
-        result: Result<i32, SendError<M, Error>>,
-    ) -> EvmGrantCreateResponse {
-        let result = match result {
-            Ok(grant_id) => EvmGrantCreateResult::GrantId(grant_id),
-            Err(err) => {
-                warn!(error = ?err, "Failed to create EVM grant");
-                EvmGrantCreateResult::Error(ProtoEvmError::Internal.into())
-            }
-        };
-
-        EvmGrantCreateResponse {
-            result: Some(result),
-        }
-    }
-
-    fn grant_delete_response<M>(result: Result<(), SendError<M, Error>>) -> EvmGrantDeleteResponse {
-        let result = match result {
-            Ok(()) => EvmGrantDeleteResult::Ok(ProtoEmpty {}),
-            Err(err) => {
-                warn!(error = ?err, "Failed to delete EVM grant");
-                EvmGrantDeleteResult::Error(ProtoEvmError::Internal.into())
-            }
-        };
-
-        EvmGrantDeleteResponse {
-            result: Some(result),
-        }
-    }
-
-    fn grant_list_response<M>(
-        result: Result<Vec<Grant<SpecificGrant>>, SendError<M, Error>>,
-    ) -> EvmGrantListResponse {
-        let result = match result {
-            Ok(grants) => EvmGrantListResult::Grants(EvmGrantList {
-                grants: grants
-                    .into_iter()
-                    .map(|grant| GrantEntry {
-                        id: grant.id,
-                        client_id: grant.shared.client_id,
-                        shared: Some(shared_settings_to_proto(grant.shared)),
-                        specific: Some(specific_grant_to_proto(grant.settings)),
-                    })
-                    .collect(),
-            }),
-            Err(err) => {
-                warn!(error = ?err, "Failed to list EVM grants");
-                EvmGrantListResult::Error(ProtoEvmError::Internal.into())
-            }
-        };
-
-        EvmGrantListResponse {
-            result: Some(result),
-        }
-    }
 }
 
 pub async fn start(
@@ -578,10 +440,8 @@ pub async fn start(
     mut bi: GrpcBi<UserAgentRequest, UserAgentResponse>,
 ) {
     let mut request_tracker = RequestTracker::default();
-    let mut response_id = None;
 
-    let pubkey = match auth::start(&mut conn, &mut bi, &mut request_tracker, &mut response_id).await
+    let pubkey = match auth::start(&mut conn, &mut bi, &mut request_tracker).await {
-    {
         Ok(pubkey) => pubkey,
         Err(e) => {
             warn!(error = ?e, "Authentication failed");
@@ -595,10 +455,7 @@ pub async fn start(
     let actor = UserAgentSession::spawn(UserAgentSession::new(conn, Box::new(oob_adapter)));
     let actor_for_cleanup = actor.clone();
 
-    let _ = defer(move || {
-        actor_for_cleanup.kill();
-    });
-
     info!(?pubkey, "User authenticated successfully");
     dispatch_loop(bi, actor, oob_receiver, request_tracker).await;
+    actor_for_cleanup.kill();
 }

server/crates/arbiter-server/src/grpc/user_agent/auth.rs

@@ -21,19 +21,16 @@ use crate::{
 pub struct AuthTransportAdapter<'a> {
     bi: &'a mut GrpcBi<UserAgentRequest, UserAgentResponse>,
     request_tracker: &'a mut RequestTracker,
-    response_id: &'a mut Option<i32>,
 }
 
 impl<'a> AuthTransportAdapter<'a> {
     pub fn new(
         bi: &'a mut GrpcBi<UserAgentRequest, UserAgentResponse>,
         request_tracker: &'a mut RequestTracker,
-        response_id: &'a mut Option<i32>,
     ) -> Self {
         Self {
             bi,
             request_tracker,
-            response_id,
         }
     }
 
@@ -41,11 +38,9 @@ impl<'a> AuthTransportAdapter<'a> {
         &mut self,
         payload: UserAgentResponsePayload,
     ) -> Result<(), TransportError> {
-        let id = self.response_id.take();
-
         self.bi
             .send(Ok(UserAgentResponse {
-                id,
+                id: Some(self.request_tracker.current_request_id()),
                 payload: Some(payload),
             }))
             .await
@@ -75,9 +70,14 @@ impl Sender<Result<auth::Outbound, auth::Error>> for AuthTransportAdapter<'_> {
             Err(Error::InvalidBootstrapToken) => {
                 UserAgentResponsePayload::AuthResult(ProtoAuthResult::TokenInvalid.into())
             }
-            Err(Error::Internal { details }) => return self.bi.send(Err(Status::internal(details))).await,
+            Err(Error::Internal { details }) => {
+                return self.bi.send(Err(Status::internal(details))).await;
+            }
             Err(Error::Transport) => {
-                return self.bi.send(Err(Status::unavailable("transport error"))).await;
+                return self
+                    .bi
+                    .send(Err(Status::unavailable("transport error")))
+                    .await;
             }
         };
 
@@ -96,14 +96,13 @@ impl Receiver<auth::Inbound> for AuthTransportAdapter<'_> {
             }
         };
 
-        let request_id = match self.request_tracker.request(request.id) {
+        match self.request_tracker.request(request.id) {
             Ok(request_id) => request_id,
             Err(error) => {
                 let _ = self.bi.send(Err(error)).await;
                 return None;
             }
         };
-        *self.response_id = Some(request_id);
 
         let Some(payload) = request.payload else {
             warn!(
@@ -173,8 +172,7 @@ pub async fn start(
     conn: &mut UserAgentConnection,
     bi: &mut GrpcBi<UserAgentRequest, UserAgentResponse>,
     request_tracker: &mut RequestTracker,
-    response_id: &mut Option<i32>,
 ) -> Result<AuthPublicKey, auth::Error> {
-    let transport = AuthTransportAdapter::new(bi, request_tracker, response_id);
+    let transport = AuthTransportAdapter::new(bi, request_tracker);
     auth::authenticate(conn, transport).await
 }

server/crates/arbiter-server/src/grpc/user_agent/inbound.rs

@@ -0,0 +1,152 @@
+use arbiter_proto::proto::evm::{
+    EtherTransferSettings as ProtoEtherTransferSettings,
+    SharedSettings as ProtoSharedSettings,
+    SpecificGrant as ProtoSpecificGrant,
+    TokenTransferSettings as ProtoTokenTransferSettings,
+    TransactionRateLimit as ProtoTransactionRateLimit,
+    VolumeRateLimit as ProtoVolumeRateLimit,
+    specific_grant::Grant as ProtoSpecificGrantType,
+};
+use arbiter_proto::proto::user_agent::SdkClientWalletAccess;
+use alloy::primitives::{Address, U256};
+use chrono::{DateTime, TimeZone, Utc};
+use prost_types::Timestamp as ProtoTimestamp;
+use tonic::Status;
+
+use crate::actors::user_agent::EvmAccessEntry;
+use crate::{
+    evm::policies::{
+        SharedGrantSettings, SpecificGrant, TransactionRateLimit, VolumeRateLimit,
+        ether_transfer, token_transfers,
+    },
+    grpc::TryConvert,
+};
+
+fn address_from_bytes(bytes: Vec<u8>) -> Result<Address, Status> {
+    if bytes.len() != 20 {
+        return Err(Status::invalid_argument("Invalid EVM address"));
+    }
+    Ok(Address::from_slice(&bytes))
+}
+
+fn u256_from_proto_bytes(bytes: &[u8]) -> Result<U256, Status> {
+    if bytes.len() > 32 {
+        return Err(Status::invalid_argument("Invalid U256 byte length"));
+    }
+    Ok(U256::from_be_slice(bytes))
+}
+
+impl TryConvert for ProtoTimestamp {
+    type Output = DateTime<Utc>;
+    type Error = Status;
+
+    fn try_convert(self) -> Result<DateTime<Utc>, Status> {
+        Utc.timestamp_opt(self.seconds, self.nanos as u32)
+            .single()
+            .ok_or_else(|| Status::invalid_argument("Invalid timestamp"))
+    }
+}
+
+impl TryConvert for ProtoTransactionRateLimit {
+    type Output = TransactionRateLimit;
+    type Error = Status;
+
+    fn try_convert(self) -> Result<TransactionRateLimit, Status> {
+        Ok(TransactionRateLimit {
+            count: self.count,
+            window: chrono::Duration::seconds(self.window_secs),
+        })
+    }
+}
+
+impl TryConvert for ProtoVolumeRateLimit {
+    type Output = VolumeRateLimit;
+    type Error = Status;
+
+    fn try_convert(self) -> Result<VolumeRateLimit, Status> {
+        Ok(VolumeRateLimit {
+            max_volume: u256_from_proto_bytes(&self.max_volume)?,
+            window: chrono::Duration::seconds(self.window_secs),
+        })
+    }
+}
+
+impl TryConvert for ProtoSharedSettings {
+    type Output = SharedGrantSettings;
+    type Error = Status;
+
+    fn try_convert(self) -> Result<SharedGrantSettings, Status> {
+        Ok(SharedGrantSettings {
+            wallet_access_id: self.wallet_access_id,
+            chain: self.chain_id,
+            valid_from: self.valid_from.map(ProtoTimestamp::try_convert).transpose()?,
+            valid_until: self.valid_until.map(ProtoTimestamp::try_convert).transpose()?,
+            max_gas_fee_per_gas: self
+                .max_gas_fee_per_gas
+                .as_deref()
+                .map(u256_from_proto_bytes)
+                .transpose()?,
+            max_priority_fee_per_gas: self
+                .max_priority_fee_per_gas
+                .as_deref()
+                .map(u256_from_proto_bytes)
+                .transpose()?,
+            rate_limit: self
+                .rate_limit
+                .map(ProtoTransactionRateLimit::try_convert)
+                .transpose()?,
+        })
+    }
+}
+
+impl TryConvert for ProtoSpecificGrant {
+    type Output = SpecificGrant;
+    type Error = Status;
+
+    fn try_convert(self) -> Result<SpecificGrant, Status> {
+        match self.grant {
+            Some(ProtoSpecificGrantType::EtherTransfer(ProtoEtherTransferSettings {
+                targets,
+                limit,
+            })) => Ok(SpecificGrant::EtherTransfer(ether_transfer::Settings {
+                target: targets
+                    .into_iter()
+                    .map(address_from_bytes)
+                    .collect::<Result<_, _>>()?,
+                limit: limit
+                    .ok_or_else(|| {
+                        Status::invalid_argument("Missing ether transfer volume rate limit")
+                    })?
+                    .try_convert()?,
+            })),
+            Some(ProtoSpecificGrantType::TokenTransfer(ProtoTokenTransferSettings {
+                token_contract,
+                target,
+                volume_limits,
+            })) => Ok(SpecificGrant::TokenTransfer(token_transfers::Settings {
+                token_contract: address_from_bytes(token_contract)?,
+                target: target.map(address_from_bytes).transpose()?,
+                volume_limits: volume_limits
+                    .into_iter()
+                    .map(ProtoVolumeRateLimit::try_convert)
+                    .collect::<Result<_, _>>()?,
+            })),
+            None => Err(Status::invalid_argument("Missing specific grant kind")),
+        }
+    }
+}
+
+impl TryConvert for Vec<SdkClientWalletAccess> {
+    type Output = Vec<EvmAccessEntry>;
+    type Error = Status;
+
+    fn try_convert(self) -> Result<Vec<EvmAccessEntry>, Status> {
+        Ok(self
+            .into_iter()
+            .map(|SdkClientWalletAccess { client_id, wallet_id }| EvmAccessEntry {
+                wallet_id,
+                sdk_client_id: client_id,
+            })
+            .collect())
+    }
+}

server/crates/arbiter-server/src/grpc/user_agent/outbound.rs

@@ -0,0 +1,108 @@
+use arbiter_proto::proto::{
+    evm::{
+        EtherTransferSettings as ProtoEtherTransferSettings, SharedSettings as ProtoSharedSettings,
+        SpecificGrant as ProtoSpecificGrant, TokenTransferSettings as ProtoTokenTransferSettings,
+        TransactionRateLimit as ProtoTransactionRateLimit, VolumeRateLimit as ProtoVolumeRateLimit,
+        specific_grant::Grant as ProtoSpecificGrantType,
+    },
+    user_agent::SdkClientWalletAccess as ProtoSdkClientWalletAccess,
+};
+use chrono::{DateTime, Utc};
+use prost_types::Timestamp as ProtoTimestamp;
+
+use crate::{
+    actors::user_agent::EvmAccessEntry,
+    evm::policies::{SharedGrantSettings, SpecificGrant, TransactionRateLimit, VolumeRateLimit},
+    grpc::Convert,
+};
+
+impl Convert for DateTime<Utc> {
+    type Output = ProtoTimestamp;
+
+    fn convert(self) -> ProtoTimestamp {
+        ProtoTimestamp {
+            seconds: self.timestamp(),
+            nanos: self.timestamp_subsec_nanos() as i32,
+        }
+    }
+}
+
+impl Convert for TransactionRateLimit {
+    type Output = ProtoTransactionRateLimit;
+
+    fn convert(self) -> ProtoTransactionRateLimit {
+        ProtoTransactionRateLimit {
+            count: self.count,
+            window_secs: self.window.num_seconds(),
+        }
+    }
+}
+
+impl Convert for VolumeRateLimit {
+    type Output = ProtoVolumeRateLimit;
+
+    fn convert(self) -> ProtoVolumeRateLimit {
+        ProtoVolumeRateLimit {
+            max_volume: self.max_volume.to_be_bytes::<32>().to_vec(),
+            window_secs: self.window.num_seconds(),
+        }
+    }
+}
+
+impl Convert for SharedGrantSettings {
+    type Output = ProtoSharedSettings;
+
+    fn convert(self) -> ProtoSharedSettings {
+        ProtoSharedSettings {
+            wallet_access_id: self.wallet_access_id,
+            chain_id: self.chain,
+            valid_from: self.valid_from.map(DateTime::convert),
+            valid_until: self.valid_until.map(DateTime::convert),
+            max_gas_fee_per_gas: self
+                .max_gas_fee_per_gas
+                .map(|value| value.to_be_bytes::<32>().to_vec()),
+            max_priority_fee_per_gas: self
+                .max_priority_fee_per_gas
+                .map(|value| value.to_be_bytes::<32>().to_vec()),
+            rate_limit: self.rate_limit.map(TransactionRateLimit::convert),
+        }
+    }
+}
+
+impl Convert for SpecificGrant {
+    type Output = ProtoSpecificGrant;
+
+    fn convert(self) -> ProtoSpecificGrant {
+        let grant = match self {
+            SpecificGrant::EtherTransfer(s) => {
+                ProtoSpecificGrantType::EtherTransfer(ProtoEtherTransferSettings {
+                    targets: s.target.into_iter().map(|a| a.to_vec()).collect(),
+                    limit: Some(s.limit.convert()),
+                })
+            }
+            SpecificGrant::TokenTransfer(s) => {
+                ProtoSpecificGrantType::TokenTransfer(ProtoTokenTransferSettings {
+                    token_contract: s.token_contract.to_vec(),
+                    target: s.target.map(|a| a.to_vec()),
+                    volume_limits: s
+                        .volume_limits
+                        .into_iter()
+                        .map(VolumeRateLimit::convert)
+                        .collect(),
+                })
+            }
+        };
+        ProtoSpecificGrant { grant: Some(grant) }
+    }
+}
+
+impl Convert for EvmAccessEntry {
+    type Output = ProtoSdkClientWalletAccess;
+
+    fn convert(self) -> Self::Output {
+        ProtoSdkClientWalletAccess {
+            client_id: self.sdk_client_id,
+            wallet_id: self.wallet_id,
+        }
+    }
+}

server/crates/arbiter-server/tests/client/auth.rs

@@ -1,15 +1,52 @@
+use arbiter_proto::ClientMetadata;
 use arbiter_proto::transport::{Receiver, Sender};
 use arbiter_server::actors::GlobalActors;
 use arbiter_server::{
     actors::client::{ClientConnection, auth, connect_client},
-    db::{self, schema},
+    db,
 };
-use diesel::{ExpressionMethods as _, insert_into};
+use diesel::{ExpressionMethods as _, NullableExpressionMethods as _, QueryDsl as _, insert_into};
 use diesel_async::RunQueryDsl;
 use ed25519_dalek::Signer as _;
 
 use super::common::ChannelTransport;
 
+fn metadata(name: &str, description: Option<&str>, version: Option<&str>) -> ClientMetadata {
+    ClientMetadata {
+        name: name.to_owned(),
+        description: description.map(str::to_owned),
+        version: version.map(str::to_owned),
+    }
+}
+
+async fn insert_registered_client(
+    db: &db::DatabasePool,
+    pubkey: Vec<u8>,
+    metadata: &ClientMetadata,
+) {
+    use arbiter_server::db::schema::{client_metadata, program_client};
+
+    let mut conn = db.get().await.unwrap();
+    let metadata_id: i32 = insert_into(client_metadata::table)
+        .values((
+            client_metadata::name.eq(&metadata.name),
+            client_metadata::description.eq(&metadata.description),
+            client_metadata::version.eq(&metadata.version),
+        ))
+        .returning(client_metadata::id)
+        .get_result(&mut conn)
+        .await
+        .unwrap();
+    insert_into(program_client::table)
+        .values((
+            program_client::public_key.eq(pubkey),
+            program_client::metadata_id.eq(metadata_id),
+        ))
+        .execute(&mut conn)
+        .await
+        .unwrap();
+}
+
 #[tokio::test]
 #[test_log::test]
 pub async fn test_unregistered_pubkey_rejected() {
@@ -28,6 +65,7 @@ pub async fn test_unregistered_pubkey_rejected() {
     test_transport
         .send(auth::Inbound::AuthChallengeRequest {
             pubkey: new_key.verifying_key(),
+            metadata: metadata("client", Some("desc"), Some("1.0.0")),
         })
         .await
         .unwrap();
@@ -44,14 +82,12 @@ pub async fn test_challenge_auth() {
     let new_key = ed25519_dalek::SigningKey::generate(&mut rand::rng());
     let pubkey_bytes = new_key.verifying_key().to_bytes().to_vec();
 
-    {
+    insert_registered_client(
-        let mut conn = db.get().await.unwrap();
+        &db,
-        insert_into(schema::program_client::table)
+        pubkey_bytes.clone(),
-            .values(schema::program_client::public_key.eq(pubkey_bytes.clone()))
+        &metadata("client", Some("desc"), Some("1.0.0")),
-            .execute(&mut conn)
+    )
-            .await
+    .await;
-            .unwrap();
-    }
 
     let (server_transport, mut test_transport) = ChannelTransport::new();
     let actors = GlobalActors::spawn(db.clone()).await.unwrap();
@@ -66,6 +102,7 @@ pub async fn test_challenge_auth() {
     test_transport
         .send(auth::Inbound::AuthChallengeRequest {
             pubkey: new_key.verifying_key(),
+            metadata: metadata("client", Some("desc"), Some("1.0.0")),
         })
         .await
         .unwrap();
@@ -106,3 +143,182 @@ pub async fn test_challenge_auth() {
     task.await.unwrap();
 }
 
+#[tokio::test]
+#[test_log::test]
+pub async fn test_metadata_unchanged_does_not_append_history() {
+    let db = db::create_test_pool().await;
+    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+    let props = ClientConnection::new(db.clone(), actors);
+
+    let new_key = ed25519_dalek::SigningKey::generate(&mut rand::rng());
+    let requested = metadata("client", Some("desc"), Some("1.0.0"));
+
+    {
+        use arbiter_server::db::schema::{client_metadata, program_client};
+        let mut conn = db.get().await.unwrap();
+        let metadata_id: i32 = insert_into(client_metadata::table)
+            .values((
+                client_metadata::name.eq(&requested.name),
+                client_metadata::description.eq(&requested.description),
+                client_metadata::version.eq(&requested.version),
+            ))
+            .returning(client_metadata::id)
+            .get_result(&mut conn)
+            .await
+            .unwrap();
+        insert_into(program_client::table)
+            .values((
+                program_client::public_key.eq(new_key.verifying_key().to_bytes().to_vec()),
+                program_client::metadata_id.eq(metadata_id),
+            ))
+            .execute(&mut conn)
+            .await
+            .unwrap();
+    }
+
+    let (server_transport, mut test_transport) = ChannelTransport::new();
+    let task = tokio::spawn(async move {
+        let mut server_transport = server_transport;
+        connect_client(props, &mut server_transport).await;
+    });
+
+    test_transport
+        .send(auth::Inbound::AuthChallengeRequest {
+            pubkey: new_key.verifying_key(),
+            metadata: requested,
+        })
+        .await
+        .unwrap();
+
+    let response = test_transport.recv().await.unwrap().unwrap();
+    let (pubkey, nonce) = match response {
+        auth::Outbound::AuthChallenge { pubkey, nonce } => (pubkey, nonce),
+        other => panic!("Expected AuthChallenge, got {other:?}"),
+    };
+    let signature = new_key.sign(&arbiter_proto::format_challenge(nonce, pubkey.as_bytes()));
+    test_transport
+        .send(auth::Inbound::AuthChallengeSolution { signature })
+        .await
+        .unwrap();
+    let _ = test_transport.recv().await.unwrap();
+    task.await.unwrap();
+
+    {
+        use arbiter_server::db::schema::{client_metadata, client_metadata_history};
+        let mut conn = db.get().await.unwrap();
+        let metadata_count: i64 = client_metadata::table
+            .count()
+            .get_result(&mut conn)
+            .await
+            .unwrap();
+        let history_count: i64 = client_metadata_history::table
+            .count()
+            .get_result(&mut conn)
+            .await
+            .unwrap();
+        assert_eq!(metadata_count, 1);
+        assert_eq!(history_count, 0);
+    }
+}
+
+#[tokio::test]
+#[test_log::test]
+pub async fn test_metadata_change_appends_history_and_repoints_binding() {
+    let db = db::create_test_pool().await;
+    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+    let props = ClientConnection::new(db.clone(), actors);
+
+    let new_key = ed25519_dalek::SigningKey::generate(&mut rand::rng());
+
+    {
+        use arbiter_server::db::schema::{client_metadata, program_client};
+        let mut conn = db.get().await.unwrap();
+        let metadata_id: i32 = insert_into(client_metadata::table)
+            .values((
+                client_metadata::name.eq("client"),
+                client_metadata::description.eq(Some("old")),
+                client_metadata::version.eq(Some("1.0.0")),
+            ))
+            .returning(client_metadata::id)
+            .get_result(&mut conn)
+            .await
+            .unwrap();
+        insert_into(program_client::table)
+            .values((
+                program_client::public_key.eq(new_key.verifying_key().to_bytes().to_vec()),
+                program_client::metadata_id.eq(metadata_id),
+            ))
+            .execute(&mut conn)
+            .await
+            .unwrap();
+    }
+
+    let (server_transport, mut test_transport) = ChannelTransport::new();
+    let task = tokio::spawn(async move {
+        let mut server_transport = server_transport;
+        connect_client(props, &mut server_transport).await;
+    });
+
+    test_transport
+        .send(auth::Inbound::AuthChallengeRequest {
+            pubkey: new_key.verifying_key(),
+            metadata: metadata("client", Some("new"), Some("2.0.0")),
+        })
+        .await
+        .unwrap();
+
+    let response = test_transport.recv().await.unwrap().unwrap();
+    let (pubkey, nonce) = match response {
+        auth::Outbound::AuthChallenge { pubkey, nonce } => (pubkey, nonce),
+        other => panic!("Expected AuthChallenge, got {other:?}"),
+    };
+    let signature = new_key.sign(&arbiter_proto::format_challenge(nonce, pubkey.as_bytes()));
+    test_transport
+        .send(auth::Inbound::AuthChallengeSolution { signature })
+        .await
+        .unwrap();
+    let _ = test_transport.recv().await.unwrap();
+    task.await.unwrap();
+
+    {
+        use arbiter_server::db::schema::{
+            client_metadata, client_metadata_history, program_client,
+        };
+        let mut conn = db.get().await.unwrap();
+        let metadata_count: i64 = client_metadata::table
+            .count()
+            .get_result(&mut conn)
+            .await
+            .unwrap();
+        let history_count: i64 = client_metadata_history::table
+            .count()
+            .get_result(&mut conn)
+            .await
+            .unwrap();
+        let metadata_id = program_client::table
+            .select(program_client::metadata_id)
+            .first::<i32>(&mut conn)
+            .await
+            .unwrap();
+        let current = client_metadata::table
+            .find(metadata_id)
+            .select((
+                client_metadata::name,
+                client_metadata::description.nullable(),
+                client_metadata::version.nullable(),
+            ))
+            .first::<(String, Option<String>, Option<String>)>(&mut conn)
+            .await
+            .unwrap();
+        assert_eq!(metadata_count, 2);
+        assert_eq!(history_count, 1);
+        assert_eq!(
+            current,
+            (
+                "client".to_owned(),
+                Some("new".to_owned()),
+                Some("2.0.0".to_owned())
+            )
+        );
+    }
+}

server/crates/arbiter-server/tests/user_agent/unseal.rs

@@ -2,9 +2,9 @@ use arbiter_server::{
     actors::{
         GlobalActors,
         keyholder::{Bootstrap, Seal},
-        user_agent::session::{
+        user_agent::{UserAgentSession, session::connection::{
-            HandleUnsealEncryptedKey, HandleUnsealRequest, UnsealError, UserAgentSession,
+            HandleUnsealEncryptedKey, HandleUnsealRequest, UnsealError,
-        },
+        }},
     },
     db,
     safe_cell::{SafeCell, SafeCellHandle as _},

server/crates/arbiter-tokens-registry/src/evm/mod.rs

@@ -1 +1 @@
-pub mod nonfungible;
+pub mod nonfungible;

server/crates/arbiter-tokens-registry/src/lib.rs

@@ -1 +1 @@
-pub mod evm;
+pub mod evm;

useragent/docs/superpowers/plans/2026-03-25-client-wallet-access.md

@@ -0,0 +1,75 @@
+# Client Wallet Access Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Add a dedicated client details screen under `Clients` where operators can view a client and manage the set of accessible EVM wallets.
+
+**Architecture:** Keep the existing `Clients` list as the entry point and add a focused details route/screen for one `SdkClientEntry`. Use Riverpod providers for the wallet inventory, client-scoped access draft, and save mutation. Because the current proto surface does not expose client-wallet-access RPCs, implement the UI and provider boundaries with an explicit unsupported save path instead of faking persistence.
+
+**Tech Stack:** Flutter, AutoRoute, hooks_riverpod/riverpod, flutter_test
+
+---
+
+### Task 1: Add focused tests for client-details draft behavior
+
+**Files:**
+- Create: `test/screens/dashboard/clients/details/client_wallet_access_controller_test.dart`
+- Create: `test/screens/dashboard/clients/details/client_details_screen_test.dart`
+
+- [ ] **Step 1: Write the failing controller test**
+- [ ] **Step 2: Run the controller test to verify it fails**
+- [ ] **Step 3: Write the failing screen test**
+- [ ] **Step 4: Run the screen test to verify it fails**
+
+### Task 2: Add client-details state and data helpers
+
+**Files:**
+- Create: `lib/providers/sdk_clients/details.dart`
+- Create: `lib/providers/sdk_clients/details.g.dart`
+- Create: `lib/providers/sdk_clients/wallet_access.dart`
+- Create: `lib/providers/sdk_clients/wallet_access.g.dart`
+
+- [ ] **Step 1: Add provider types for selected client lookup**
+- [ ] **Step 2: Add provider/notifier types for wallet-access draft state**
+- [ ] **Step 3: Implement unsupported save mutation boundary**
+- [ ] **Step 4: Run controller tests to make them pass**
+
+### Task 3: Build the client-details UI with granular widgets
+
+**Files:**
+- Create: `lib/screens/dashboard/clients/details/client_details.dart`
+- Create: `lib/screens/dashboard/clients/details/widgets/client_details_header.dart`
+- Create: `lib/screens/dashboard/clients/details/widgets/client_summary_card.dart`
+- Create: `lib/screens/dashboard/clients/details/widgets/wallet_access_section.dart`
+- Create: `lib/screens/dashboard/clients/details/widgets/wallet_access_search_field.dart`
+- Create: `lib/screens/dashboard/clients/details/widgets/wallet_access_list.dart`
+- Create: `lib/screens/dashboard/clients/details/widgets/wallet_access_tile.dart`
+- Create: `lib/screens/dashboard/clients/details/widgets/wallet_access_save_bar.dart`
+- Create: `lib/screens/dashboard/clients/details/widgets/client_details_state_panel.dart`
+
+- [ ] **Step 1: Build the screen shell and summary widgets**
+- [ ] **Step 2: Build the wallet-access list/search/save widgets**
+- [ ] **Step 3: Keep widget files granular and avoid hardcoded sizes**
+- [ ] **Step 4: Run the screen tests to make them pass**
+
+### Task 4: Wire navigation from the clients list
+
+**Files:**
+- Modify: `lib/router.dart`
+- Modify: `lib/router.gr.dart`
+- Modify: `lib/screens/dashboard/clients/table.dart`
+
+- [ ] **Step 1: Add the client-details route**
+- [ ] **Step 2: Add a row affordance to open the client-details screen**
+- [ ] **Step 3: Keep the existing list usable as an overview**
+- [ ] **Step 4: Run targeted screen tests again**
+
+### Task 5: Regenerate code and verify the feature
+
+**Files:**
+- Modify: generated files as required by build tools
+
+- [ ] **Step 1: Run code generation**
+- [ ] **Step 2: Run widget/provider tests**
+- [ ] **Step 3: Run Flutter analysis on touched code**
+- [ ] **Step 4: Review for requirement coverage and report the backend save limitation clearly**

useragent/docs/superpowers/specs/2026-03-25-client-wallet-access-design.md

@@ -0,0 +1,289 @@
+# Client Wallet Access Design
+
+Date: 2026-03-25
+Status: Proposed
+
+## Goal
+
+Add a client-centric UI that lets an operator choose which EVM wallets are visible to a given SDK client.
+
+The mental model is:
+
+> For this SDK client, choose which wallets it can see.
+
+This UI should live under the existing `Clients` area, not under `Wallets`, because the permission is being edited from the client's perspective.
+
+## Current Context
+
+The current Flutter app has:
+
+- A top-level dashboard with `Wallets`, `Clients`, and `About`
+- A `Clients` screen that currently acts as a registry/list of `SdkClientEntry`
+- A `Wallets` screen that lists managed EVM wallets
+- An EVM grant creation flow that still manually asks for `Client ID`
+
+Relevant observations from the current codebase:
+
+- `SdkClientEntry` is already a richer admin-facing object than `WalletEntry`
+- `WalletEntry` is currently minimal and not suited to owning the relationship UI
+- The `Clients` screen already presents expandable client rows, which makes it the most natural entry point for a details view
+
+## Chosen Approach
+
+Use a dedicated client details screen.
+
+From the `Clients` list, the operator opens one client and lands on a screen dedicated to that client. That screen includes a wallet access section that shows:
+
+- Client identity and metadata
+- Current wallet access selection
+- A searchable/selectable list of available wallets
+- Save feedback and error states
+
+This is preferred over inline editing or a modal because it scales better when more capabilities are added later, such as:
+
+- Search
+- Bulk actions
+- Explanatory copy
+- Access summaries
+- Future permission categories beyond wallet visibility
+
+## User Experience
+
+### Entry
+
+The operator starts on the existing `Clients` screen.
+
+Each client row gains a clear affordance to open details, for example:
+
+- Tapping the row
+- A trailing button such as `Manage access`
+
+The existing list remains the overview surface. Editing does not happen inline.
+
+### Client Details Screen
+
+The screen is focused on a single client and should contain:
+
+1. A lightweight header with back navigation
+2. A client summary section
+3. A wallet access section
+4. Save/status feedback
+
+The wallet access section is the core interaction:
+
+- Show all available EVM wallets
+- Show which wallets are currently accessible to this client
+- Allow toggling access on/off
+- Allow filtering/searching wallets when the list grows
+- Show empty/loading/error states
+
+### Save Model
+
+Use an explicit save action rather than auto-save.
+
+Reasons:
+
+- Permission changes are administrative and should feel deliberate
+- Multiple checkbox changes can be staged together
+- It creates a clear place for pending, success, and failure states
+
+The screen should track:
+
+- Original selection from the server
+- Current local selection in the form
+- Whether there are unsaved changes
+
+## Information Architecture
+
+### Navigation
+
+Add a nested route under the dashboard clients area for client details.
+
+Conceptually:
+
+- `Clients` remains the list screen
+- `Client Details` becomes the edit/manage screen for one client
+
+This keeps the current top-level tabs intact and avoids turning wallet access into a global dashboard concern.
+
+### Screen Ownership
+
+Wallet visibility is owned by the client details screen, not by the wallets screen.
+
+The wallets screen can remain focused on wallet inventory and wallet creation.
+
+## State Management
+
+Use Riverpod.
+
+State should be split by concern instead of managed in one large widget:
+
+- Provider for the client list
+- Provider for the wallet list
+- Provider for the selected client details data
+- Provider or notifier for wallet-access editing state
+- Mutation/provider for saving wallet access changes
+
+Recommended shape:
+
+- One provider fetches the wallet inventory
+- One provider fetches wallet access for a specific client
+- One notifier owns the editable selection set for the client details form
+- One mutation performs save and refreshes dependent providers
+
+The editing provider should expose:
+
+- Current selected wallet identifiers
+- Original selected wallet identifiers
+- `hasChanges`
+- `isSaving`
+- Validation or request error message when relevant
+
+This keeps the UI declarative and prevents the screen widget from holding all state locally.
+
+## Data Model Assumptions
+
+The UI assumes there is or will be a backend/API surface equivalent to:
+
+- List SDK clients
+- List EVM wallets
+- Read wallet access entries for one client
+- Replace or update wallet access entries for one client
+
+The screen should work with wallet identifiers that are stable from the backend perspective. If the backend only exposes positional IDs today, that should be normalized before binding the UI tightly to list index order.
+
+This is important because the current grant creation screen derives `walletId` from list position, which is not a robust long-term UI contract.
+
+## Layout and Styling Constraints
+
+Implementation must follow these constraints:
+
+- Use Riverpod for screen state and mutations
+- Do not hardcode widths and heights
+- Prefer layout driven by padding, constraints, flex, wrapping, and intrinsic content
+- Keep widgets granular; a widget should not exceed roughly 50 lines
+- Do not place all client-details widgets into a single file
+- Create a dedicated widgets folder for the client details screen
+- Reuse existing UI patterns and helper widgets where it is reasonable, but do not force reuse when it harms clarity
+
+Recommended implementation structure:
+
+- `lib/screens/dashboard/clients/details/`
+- `lib/screens/dashboard/clients/details/client_details.dart`
+- `lib/screens/dashboard/clients/details/widgets/...`
+
+## Widget Decomposition
+
+The client details feature should be composed from small widgets with single responsibilities.
+
+Suggested widget split:
+
+- `ClientDetailsScreen`
+- `ClientDetailsScaffold`
+- `ClientDetailsHeader`
+- `ClientSummaryCard`
+- `WalletAccessSection`
+- `WalletAccessSearchField`
+- `WalletAccessList`
+- `WalletAccessListItem`
+- `WalletAccessEmptyState`
+- `WalletAccessErrorState`
+- `WalletAccessSaveBar`
+
+If useful, existing generic state panels or cards from the current screens can be adapted or extracted, but only where that reduces duplication without making the code harder to follow.
+
+## Interaction Details
+
+### Client Summary
+
+Display the client's:
+
+- Name
+- ID
+- Version
+- Description
+- Public key summary
+- Registration date
+
+This gives the operator confidence that they are editing the intended client.
+
+### Wallet Access List
+
+Each wallet item should show enough identity to make selection safe:
+
+- Human-readable label if one exists in the backend later
+- Otherwise the wallet address
+- Optional secondary metadata if available later
+
+Each item should have a clear selected/unselected control, most likely a checkbox.
+
+### Unsaved Changes
+
+When the current selection differs from the original selection:
+
+- Show a save bar or action row
+- Enable `Save`
+- Optionally show `Reset` or `Discard`
+
+When there are no changes:
+
+- Save action is disabled or visually deemphasized
+
+### Loading and Errors
+
+The screen should independently handle:
+
+- Client not found
+- Wallet list unavailable
+- Wallet access unavailable
+- Save failure
+- Empty wallet inventory
+
+These states should be explicit in the UI rather than collapsed into a blank screen.
+
+## Reuse Guidance
+
+Reasonable reuse candidates from the current codebase:
+
+- Existing color/theme primitives
+- Existing state/empty panels if they can be extracted cleanly
+- Existing wallet formatting helpers, if they are generalized
+
+Reuse should not be prioritized over good boundaries. If the existing widget is too coupled to another screen, create a new focused widget instead.
+
+## Testing Strategy
+
+Plan for widget and provider-level coverage.
+
+At minimum, implementation should be testable for:
+
+- Rendering client summary
+- Rendering preselected wallet access
+- Toggling wallet selection
+- Dirty state detection
+- Save success refresh flow
+- Save failure preserving local edits
+- Empty/loading/error states
+
+Given the current test directory is empty, this feature is a good place to establish basic screen/provider tests rather than relying only on manual verification.
+
+## Out of Scope
+
+The following are not required for the first version unless backend requirements force them:
+
+- Cross-client bulk editing
+- Wallet-side permission management
+- Audit history UI
+- Role templates
+- Non-EVM asset permissions
+
+## Recommendation Summary
+
+Implement wallet access management as a dedicated client details screen under `Clients`.
+
+This gives the cleanest product model:
+
+- `Clients` answers "who is this app/client?"
+- `Wallet access` answers "what wallets can it see?"
+
+It also gives the best technical path for Riverpod-managed state, granular widget decomposition, and future expansion without crowding the existing client list UI.

useragent/lib/features/callouts/active_callout.dart

@@ -0,0 +1,16 @@
+import 'package:arbiter/features/callouts/callout_event.dart';
+import 'package:freezed_annotation/freezed_annotation.dart';
+
+part 'active_callout.freezed.dart';
+
+@freezed
+abstract class ActiveCallout with _$ActiveCallout {
+  const factory ActiveCallout({
+    required String id,
+    required String title,
+    required String description,
+    String? iconUrl,
+    required DateTime addedAt,
+    required CalloutData data,
+  }) = _ActiveCallout;
+}

useragent/lib/features/callouts/active_callout.freezed.dart

@@ -0,0 +1,304 @@
+// GENERATED CODE - DO NOT MODIFY BY HAND
+// coverage:ignore-file
+// ignore_for_file: type=lint
+// ignore_for_file: unused_element, deprecated_member_use, deprecated_member_use_from_same_package, use_function_type_syntax_for_parameters, unnecessary_const, avoid_init_to_null, invalid_override_different_default_values_named, prefer_expression_function_bodies, annotate_overrides, invalid_annotation_target, unnecessary_question_mark
+
+part of 'active_callout.dart';
+
+// **************************************************************************
+// FreezedGenerator
+// **************************************************************************
+
+// dart format off
+T _$identity<T>(T value) => value;
+/// @nodoc
+mixin _$ActiveCallout {
+
+ String get id; String get title; String get description; String? get iconUrl; DateTime get addedAt; CalloutData get data;
+/// Create a copy of ActiveCallout
+/// with the given fields replaced by the non-null parameter values.
+@JsonKey(includeFromJson: false, includeToJson: false)
+@pragma('vm:prefer-inline')
+$ActiveCalloutCopyWith<ActiveCallout> get copyWith => _$ActiveCalloutCopyWithImpl<ActiveCallout>(this as ActiveCallout, _$identity);
+
+
+
+@override
+bool operator ==(Object other) {
+  return identical(this, other) || (other.runtimeType == runtimeType&&other is ActiveCallout&&(identical(other.id, id) || other.id == id)&&(identical(other.title, title) || other.title == title)&&(identical(other.description, description) || other.description == description)&&(identical(other.iconUrl, iconUrl) || other.iconUrl == iconUrl)&&(identical(other.addedAt, addedAt) || other.addedAt == addedAt)&&(identical(other.data, data) || other.data == data));
+}
+
+
+@override
+int get hashCode => Object.hash(runtimeType,id,title,description,iconUrl,addedAt,data);
+
+@override
+String toString() {
+  return 'ActiveCallout(id: $id, title: $title, description: $description, iconUrl: $iconUrl, addedAt: $addedAt, data: $data)';
+}
+
+
+}
+
+/// @nodoc
+abstract mixin class $ActiveCalloutCopyWith<$Res>  {
+  factory $ActiveCalloutCopyWith(ActiveCallout value, $Res Function(ActiveCallout) _then) = _$ActiveCalloutCopyWithImpl;
+@useResult
+$Res call({
+ String id, String title, String description, String? iconUrl, DateTime addedAt, CalloutData data
+});
+
+
+$CalloutDataCopyWith<$Res> get data;
+
+}
+/// @nodoc
+class _$ActiveCalloutCopyWithImpl<$Res>
+    implements $ActiveCalloutCopyWith<$Res> {
+  _$ActiveCalloutCopyWithImpl(this._self, this._then);
+
+  final ActiveCallout _self;
+  final $Res Function(ActiveCallout) _then;
+
+/// Create a copy of ActiveCallout
+/// with the given fields replaced by the non-null parameter values.
+@pragma('vm:prefer-inline') @override $Res call({Object? id = null,Object? title = null,Object? description = null,Object? iconUrl = freezed,Object? addedAt = null,Object? data = null,}) {
+  return _then(_self.copyWith(
+id: null == id ? _self.id : id // ignore: cast_nullable_to_non_nullable
+as String,title: null == title ? _self.title : title // ignore: cast_nullable_to_non_nullable
+as String,description: null == description ? _self.description : description // ignore: cast_nullable_to_non_nullable
+as String,iconUrl: freezed == iconUrl ? _self.iconUrl : iconUrl // ignore: cast_nullable_to_non_nullable
+as String?,addedAt: null == addedAt ? _self.addedAt : addedAt // ignore: cast_nullable_to_non_nullable
+as DateTime,data: null == data ? _self.data : data // ignore: cast_nullable_to_non_nullable
+as CalloutData,
+  ));
+}
+/// Create a copy of ActiveCallout
+/// with the given fields replaced by the non-null parameter values.
+@override
+@pragma('vm:prefer-inline')
+$CalloutDataCopyWith<$Res> get data {
+  
+  return $CalloutDataCopyWith<$Res>(_self.data, (value) {
+    return _then(_self.copyWith(data: value));
+  });
+}
+}
+
+
+/// Adds pattern-matching-related methods to [ActiveCallout].
+extension ActiveCalloutPatterns on ActiveCallout {
+/// A variant of `map` that fallback to returning `orElse`.
+///
+/// It is equivalent to doing:
+/// ```dart
+/// switch (sealedClass) {
+///   case final Subclass value:
+///     return ...;
+///   case _:
+///     return orElse();
+/// }
+/// ```
+
+@optionalTypeArgs TResult maybeMap<TResult extends Object?>(TResult Function( _ActiveCallout value)?  $default,{required TResult orElse(),}){
+final _that = this;
+switch (_that) {
+case _ActiveCallout() when $default != null:
+return $default(_that);case _:
+  return orElse();
+
+}
+}
+/// A `switch`-like method, using callbacks.
+///
+/// Callbacks receives the raw object, upcasted.
+/// It is equivalent to doing:
+/// ```dart
+/// switch (sealedClass) {
+///   case final Subclass value:
+///     return ...;
+///   case final Subclass2 value:
+///     return ...;
+/// }
+/// ```
+
+@optionalTypeArgs TResult map<TResult extends Object?>(TResult Function( _ActiveCallout value)  $default,){
+final _that = this;
+switch (_that) {
+case _ActiveCallout():
+return $default(_that);case _:
+  throw StateError('Unexpected subclass');
+
+}
+}
+/// A variant of `map` that fallback to returning `null`.
+///
+/// It is equivalent to doing:
+/// ```dart
+/// switch (sealedClass) {
+///   case final Subclass value:
+///     return ...;
+///   case _:
+///     return null;
+/// }
+/// ```
+
+@optionalTypeArgs TResult? mapOrNull<TResult extends Object?>(TResult? Function( _ActiveCallout value)?  $default,){
+final _that = this;
+switch (_that) {
+case _ActiveCallout() when $default != null:
+return $default(_that);case _:
+  return null;
+
+}
+}
+/// A variant of `when` that fallback to an `orElse` callback.
+///
+/// It is equivalent to doing:
+/// ```dart
+/// switch (sealedClass) {
+///   case Subclass(:final field):
+///     return ...;
+///   case _:
+///     return orElse();
+/// }
+/// ```
+
+@optionalTypeArgs TResult maybeWhen<TResult extends Object?>(TResult Function( String id,  String title,  String description,  String? iconUrl,  DateTime addedAt,  CalloutData data)?  $default,{required TResult orElse(),}) {final _that = this;
+switch (_that) {
+case _ActiveCallout() when $default != null:
+return $default(_that.id,_that.title,_that.description,_that.iconUrl,_that.addedAt,_that.data);case _:
+  return orElse();
+
+}
+}
+/// A `switch`-like method, using callbacks.
+///
+/// As opposed to `map`, this offers destructuring.
+/// It is equivalent to doing:
+/// ```dart
+/// switch (sealedClass) {
+///   case Subclass(:final field):
+///     return ...;
+///   case Subclass2(:final field2):
+///     return ...;
+/// }
+/// ```
+
+@optionalTypeArgs TResult when<TResult extends Object?>(TResult Function( String id,  String title,  String description,  String? iconUrl,  DateTime addedAt,  CalloutData data)  $default,) {final _that = this;
+switch (_that) {
+case _ActiveCallout():
+return $default(_that.id,_that.title,_that.description,_that.iconUrl,_that.addedAt,_that.data);case _:
+  throw StateError('Unexpected subclass');
+
+}
+}
+/// A variant of `when` that fallback to returning `null`
+///
+/// It is equivalent to doing:
+/// ```dart
+/// switch (sealedClass) {
+///   case Subclass(:final field):
+///     return ...;
+///   case _:
+///     return null;
+/// }
+/// ```
+
+@optionalTypeArgs TResult? whenOrNull<TResult extends Object?>(TResult? Function( String id,  String title,  String description,  String? iconUrl,  DateTime addedAt,  CalloutData data)?  $default,) {final _that = this;
+switch (_that) {
+case _ActiveCallout() when $default != null:
+return $default(_that.id,_that.title,_that.description,_that.iconUrl,_that.addedAt,_that.data);case _:
+  return null;
+
+}
+}
+
+}
+
+/// @nodoc
+
+
+class _ActiveCallout implements ActiveCallout {
+  const _ActiveCallout({required this.id, required this.title, required this.description, this.iconUrl, required this.addedAt, required this.data});
+  
+
+@override final  String id;
+@override final  String title;
+@override final  String description;
+@override final  String? iconUrl;
+@override final  DateTime addedAt;
+@override final  CalloutData data;
+
+/// Create a copy of ActiveCallout
+/// with the given fields replaced by the non-null parameter values.
+@override @JsonKey(includeFromJson: false, includeToJson: false)
+@pragma('vm:prefer-inline')
+_$ActiveCalloutCopyWith<_ActiveCallout> get copyWith => __$ActiveCalloutCopyWithImpl<_ActiveCallout>(this, _$identity);
+
+
+
+@override
+bool operator ==(Object other) {
+  return identical(this, other) || (other.runtimeType == runtimeType&&other is _ActiveCallout&&(identical(other.id, id) || other.id == id)&&(identical(other.title, title) || other.title == title)&&(identical(other.description, description) || other.description == description)&&(identical(other.iconUrl, iconUrl) || other.iconUrl == iconUrl)&&(identical(other.addedAt, addedAt) || other.addedAt == addedAt)&&(identical(other.data, data) || other.data == data));
+}
+
+
+@override
+int get hashCode => Object.hash(runtimeType,id,title,description,iconUrl,addedAt,data);
+
+@override
+String toString() {
+  return 'ActiveCallout(id: $id, title: $title, description: $description, iconUrl: $iconUrl, addedAt: $addedAt, data: $data)';
+}
+
+
+}
+
+/// @nodoc
+abstract mixin class _$ActiveCalloutCopyWith<$Res> implements $ActiveCalloutCopyWith<$Res> {
+  factory _$ActiveCalloutCopyWith(_ActiveCallout value, $Res Function(_ActiveCallout) _then) = __$ActiveCalloutCopyWithImpl;
+@override @useResult
+$Res call({
+ String id, String title, String description, String? iconUrl, DateTime addedAt, CalloutData data
+});
+
+
+@override $CalloutDataCopyWith<$Res> get data;
+
+}
+/// @nodoc
+class __$ActiveCalloutCopyWithImpl<$Res>
+    implements _$ActiveCalloutCopyWith<$Res> {
+  __$ActiveCalloutCopyWithImpl(this._self, this._then);
+
+  final _ActiveCallout _self;
+  final $Res Function(_ActiveCallout) _then;
+
+/// Create a copy of ActiveCallout
+/// with the given fields replaced by the non-null parameter values.
+@override @pragma('vm:prefer-inline') $Res call({Object? id = null,Object? title = null,Object? description = null,Object? iconUrl = freezed,Object? addedAt = null,Object? data = null,}) {
+  return _then(_ActiveCallout(
+id: null == id ? _self.id : id // ignore: cast_nullable_to_non_nullable
+as String,title: null == title ? _self.title : title // ignore: cast_nullable_to_non_nullable
+as String,description: null == description ? _self.description : description // ignore: cast_nullable_to_non_nullable
+as String,iconUrl: freezed == iconUrl ? _self.iconUrl : iconUrl // ignore: cast_nullable_to_non_nullable
+as String?,addedAt: null == addedAt ? _self.addedAt : addedAt // ignore: cast_nullable_to_non_nullable
+as DateTime,data: null == data ? _self.data : data // ignore: cast_nullable_to_non_nullable
+as CalloutData,
+  ));
+}
+
+/// Create a copy of ActiveCallout
+/// with the given fields replaced by the non-null parameter values.
+@override
+@pragma('vm:prefer-inline')
+$CalloutDataCopyWith<$Res> get data {
+  
+  return $CalloutDataCopyWith<$Res>(_self.data, (value) {
+    return _then(_self.copyWith(data: value));
+  });
+}
+}
+
+// dart format on

useragent/lib/features/callouts/callout_event.dart

@@ -0,0 +1,25 @@
+import 'package:arbiter/proto/client.pb.dart';
+import 'package:freezed_annotation/freezed_annotation.dart';
+import 'package:hooks_riverpod/experimental/mutation.dart';
+
+part 'callout_event.freezed.dart';
+
+@freezed
+sealed class CalloutData with _$CalloutData {
+  const factory CalloutData.connectApproval({
+    required String pubkey,
+    required ClientInfo clientInfo,
+  }) = ConnectApprovalData;
+}
+
+@freezed
+sealed class CalloutEvent with _$CalloutEvent {
+  const factory CalloutEvent.added({
+    required String id,
+    required CalloutData data,
+  }) = CalloutEventAdded;
+
+  const factory CalloutEvent.cancelled({
+    required String id,
+  }) = CalloutEventCancelled;
+}

useragent/lib/features/callouts/callout_event.freezed.dart

@@ -0,0 +1,602 @@
+// GENERATED CODE - DO NOT MODIFY BY HAND
+// coverage:ignore-file
+// ignore_for_file: type=lint
+// ignore_for_file: unused_element, deprecated_member_use, deprecated_member_use_from_same_package, use_function_type_syntax_for_parameters, unnecessary_const, avoid_init_to_null, invalid_override_different_default_values_named, prefer_expression_function_bodies, annotate_overrides, invalid_annotation_target, unnecessary_question_mark
+
+part of 'callout_event.dart';
+
+// **************************************************************************
+// FreezedGenerator
+// **************************************************************************
+
+// dart format off
+T _$identity<T>(T value) => value;
+/// @nodoc
+mixin _$CalloutData {
+
+ String get pubkey; ClientInfo get clientInfo;
+/// Create a copy of CalloutData
+/// with the given fields replaced by the non-null parameter values.
+@JsonKey(includeFromJson: false, includeToJson: false)
+@pragma('vm:prefer-inline')
+$CalloutDataCopyWith<CalloutData> get copyWith => _$CalloutDataCopyWithImpl<CalloutData>(this as CalloutData, _$identity);
+
+
+
+@override
+bool operator ==(Object other) {
+  return identical(this, other) || (other.runtimeType == runtimeType&&other is CalloutData&&(identical(other.pubkey, pubkey) || other.pubkey == pubkey)&&(identical(other.clientInfo, clientInfo) || other.clientInfo == clientInfo));
+}
+
+
+@override
+int get hashCode => Object.hash(runtimeType,pubkey,clientInfo);
+
+@override
+String toString() {
+  return 'CalloutData(pubkey: $pubkey, clientInfo: $clientInfo)';
+}
+
+
+}
+
+/// @nodoc
+abstract mixin class $CalloutDataCopyWith<$Res>  {
+  factory $CalloutDataCopyWith(CalloutData value, $Res Function(CalloutData) _then) = _$CalloutDataCopyWithImpl;
+@useResult
+$Res call({
+ String pubkey, ClientInfo clientInfo
+});
+
+
+
+
+}
+/// @nodoc
+class _$CalloutDataCopyWithImpl<$Res>
+    implements $CalloutDataCopyWith<$Res> {
+  _$CalloutDataCopyWithImpl(this._self, this._then);
+
+  final CalloutData _self;
+  final $Res Function(CalloutData) _then;
+
+/// Create a copy of CalloutData
+/// with the given fields replaced by the non-null parameter values.
+@pragma('vm:prefer-inline') @override $Res call({Object? pubkey = null,Object? clientInfo = null,}) {
+  return _then(_self.copyWith(
+pubkey: null == pubkey ? _self.pubkey : pubkey // ignore: cast_nullable_to_non_nullable
+as String,clientInfo: null == clientInfo ? _self.clientInfo : clientInfo // ignore: cast_nullable_to_non_nullable
+as ClientInfo,
+  ));
+}
+
+}
+
+
+/// Adds pattern-matching-related methods to [CalloutData].
+extension CalloutDataPatterns on CalloutData {
+/// A variant of `map` that fallback to returning `orElse`.
+///
+/// It is equivalent to doing:
+/// ```dart
+/// switch (sealedClass) {
+///   case final Subclass value:
+///     return ...;
+///   case _:
+///     return orElse();
+/// }
+/// ```
+
+@optionalTypeArgs TResult maybeMap<TResult extends Object?>({TResult Function( ConnectApprovalData value)?  connectApproval,required TResult orElse(),}){
+final _that = this;
+switch (_that) {
+case ConnectApprovalData() when connectApproval != null:
+return connectApproval(_that);case _:
+  return orElse();
+
+}
+}
+/// A `switch`-like method, using callbacks.
+///
+/// Callbacks receives the raw object, upcasted.
+/// It is equivalent to doing:
+/// ```dart
+/// switch (sealedClass) {
+///   case final Subclass value:
+///     return ...;
+///   case final Subclass2 value:
+///     return ...;
+/// }
+/// ```
+
+@optionalTypeArgs TResult map<TResult extends Object?>({required TResult Function( ConnectApprovalData value)  connectApproval,}){
+final _that = this;
+switch (_that) {
+case ConnectApprovalData():
+return connectApproval(_that);}
+}
+/// A variant of `map` that fallback to returning `null`.
+///
+/// It is equivalent to doing:
+/// ```dart
+/// switch (sealedClass) {
+///   case final Subclass value:
+///     return ...;
+///   case _:
+///     return null;
+/// }
+/// ```
+
+@optionalTypeArgs TResult? mapOrNull<TResult extends Object?>({TResult? Function( ConnectApprovalData value)?  connectApproval,}){
+final _that = this;
+switch (_that) {
+case ConnectApprovalData() when connectApproval != null:
+return connectApproval(_that);case _:
+  return null;
+
+}
+}
+/// A variant of `when` that fallback to an `orElse` callback.
+///
+/// It is equivalent to doing:
+/// ```dart
+/// switch (sealedClass) {
+///   case Subclass(:final field):
+///     return ...;
+///   case _:
+///     return orElse();
+/// }
+/// ```
+
+@optionalTypeArgs TResult maybeWhen<TResult extends Object?>({TResult Function( String pubkey,  ClientInfo clientInfo)?  connectApproval,required TResult orElse(),}) {final _that = this;
+switch (_that) {
+case ConnectApprovalData() when connectApproval != null:
+return connectApproval(_that.pubkey,_that.clientInfo);case _:
+  return orElse();
+
+}
+}
+/// A `switch`-like method, using callbacks.
+///
+/// As opposed to `map`, this offers destructuring.
+/// It is equivalent to doing:
+/// ```dart
+/// switch (sealedClass) {
+///   case Subclass(:final field):
+///     return ...;
+///   case Subclass2(:final field2):
+///     return ...;
+/// }
+/// ```
+
+@optionalTypeArgs TResult when<TResult extends Object?>({required TResult Function( String pubkey,  ClientInfo clientInfo)  connectApproval,}) {final _that = this;
+switch (_that) {
+case ConnectApprovalData():
+return connectApproval(_that.pubkey,_that.clientInfo);}
+}
+/// A variant of `when` that fallback to returning `null`
+///
+/// It is equivalent to doing:
+/// ```dart
+/// switch (sealedClass) {
+///   case Subclass(:final field):
+///     return ...;
+///   case _:
+///     return null;
+/// }
+/// ```
+
+@optionalTypeArgs TResult? whenOrNull<TResult extends Object?>({TResult? Function( String pubkey,  ClientInfo clientInfo)?  connectApproval,}) {final _that = this;
+switch (_that) {
+case ConnectApprovalData() when connectApproval != null:
+return connectApproval(_that.pubkey,_that.clientInfo);case _:
+  return null;
+
+}
+}
+
+}
+
+/// @nodoc
+
+
+class ConnectApprovalData implements CalloutData {
+  const ConnectApprovalData({required this.pubkey, required this.clientInfo});
+  
+
+@override final  String pubkey;
+@override final  ClientInfo clientInfo;
+
+/// Create a copy of CalloutData
+/// with the given fields replaced by the non-null parameter values.
+@override @JsonKey(includeFromJson: false, includeToJson: false)
+@pragma('vm:prefer-inline')
+$ConnectApprovalDataCopyWith<ConnectApprovalData> get copyWith => _$ConnectApprovalDataCopyWithImpl<ConnectApprovalData>(this, _$identity);
+
+
+
+@override
+bool operator ==(Object other) {
+  return identical(this, other) || (other.runtimeType == runtimeType&&other is ConnectApprovalData&&(identical(other.pubkey, pubkey) || other.pubkey == pubkey)&&(identical(other.clientInfo, clientInfo) || other.clientInfo == clientInfo));
+}
+
+
+@override
+int get hashCode => Object.hash(runtimeType,pubkey,clientInfo);
+
+@override
+String toString() {
+  return 'CalloutData.connectApproval(pubkey: $pubkey, clientInfo: $clientInfo)';
+}
+
+
+}
+
+/// @nodoc
+abstract mixin class $ConnectApprovalDataCopyWith<$Res> implements $CalloutDataCopyWith<$Res> {
+  factory $ConnectApprovalDataCopyWith(ConnectApprovalData value, $Res Function(ConnectApprovalData) _then) = _$ConnectApprovalDataCopyWithImpl;
+@override @useResult
+$Res call({
+ String pubkey, ClientInfo clientInfo
+});
+
+
+
+
+}
+/// @nodoc
+class _$ConnectApprovalDataCopyWithImpl<$Res>
+    implements $ConnectApprovalDataCopyWith<$Res> {
+  _$ConnectApprovalDataCopyWithImpl(this._self, this._then);
+
+  final ConnectApprovalData _self;
+  final $Res Function(ConnectApprovalData) _then;
+
+/// Create a copy of CalloutData
+/// with the given fields replaced by the non-null parameter values.
+@override @pragma('vm:prefer-inline') $Res call({Object? pubkey = null,Object? clientInfo = null,}) {
+  return _then(ConnectApprovalData(
+pubkey: null == pubkey ? _self.pubkey : pubkey // ignore: cast_nullable_to_non_nullable
+as String,clientInfo: null == clientInfo ? _self.clientInfo : clientInfo // ignore: cast_nullable_to_non_nullable
+as ClientInfo,
+  ));
+}
+
+
+}
+
+/// @nodoc
+mixin _$CalloutEvent {
+
+ String get id;
+/// Create a copy of CalloutEvent
+/// with the given fields replaced by the non-null parameter values.
+@JsonKey(includeFromJson: false, includeToJson: false)
+@pragma('vm:prefer-inline')
+$CalloutEventCopyWith<CalloutEvent> get copyWith => _$CalloutEventCopyWithImpl<CalloutEvent>(this as CalloutEvent, _$identity);
+
+
+
+@override
+bool operator ==(Object other) {
+  return identical(this, other) || (other.runtimeType == runtimeType&&other is CalloutEvent&&(identical(other.id, id) || other.id == id));
+}
+
+
+@override
+int get hashCode => Object.hash(runtimeType,id);
+
+@override
+String toString() {
+  return 'CalloutEvent(id: $id)';
+}
+
+
+}
+
+/// @nodoc
+abstract mixin class $CalloutEventCopyWith<$Res>  {
+  factory $CalloutEventCopyWith(CalloutEvent value, $Res Function(CalloutEvent) _then) = _$CalloutEventCopyWithImpl;
+@useResult
+$Res call({
+ String id
+});
+
+
+
+
+}
+/// @nodoc
+class _$CalloutEventCopyWithImpl<$Res>
+    implements $CalloutEventCopyWith<$Res> {
+  _$CalloutEventCopyWithImpl(this._self, this._then);
+
+  final CalloutEvent _self;
+  final $Res Function(CalloutEvent) _then;
+
+/// Create a copy of CalloutEvent
+/// with the given fields replaced by the non-null parameter values.
+@pragma('vm:prefer-inline') @override $Res call({Object? id = null,}) {
+  return _then(_self.copyWith(
+id: null == id ? _self.id : id // ignore: cast_nullable_to_non_nullable
+as String,
+  ));
+}
+
+}
+
+
+/// Adds pattern-matching-related methods to [CalloutEvent].
+extension CalloutEventPatterns on CalloutEvent {
+/// A variant of `map` that fallback to returning `orElse`.
+///
+/// It is equivalent to doing:
+/// ```dart
+/// switch (sealedClass) {
+///   case final Subclass value:
+///     return ...;
+///   case _:
+///     return orElse();
+/// }
+/// ```
+
+@optionalTypeArgs TResult maybeMap<TResult extends Object?>({TResult Function( CalloutEventAdded value)?  added,TResult Function( CalloutEventCancelled value)?  cancelled,required TResult orElse(),}){
+final _that = this;
+switch (_that) {
+case CalloutEventAdded() when added != null:
+return added(_that);case CalloutEventCancelled() when cancelled != null:
+return cancelled(_that);case _:
+  return orElse();
+
+}
+}
+/// A `switch`-like method, using callbacks.
+///
+/// Callbacks receives the raw object, upcasted.
+/// It is equivalent to doing:
+/// ```dart
+/// switch (sealedClass) {
+///   case final Subclass value:
+///     return ...;
+///   case final Subclass2 value:
+///     return ...;
+/// }
+/// ```
+
+@optionalTypeArgs TResult map<TResult extends Object?>({required TResult Function( CalloutEventAdded value)  added,required TResult Function( CalloutEventCancelled value)  cancelled,}){
+final _that = this;
+switch (_that) {
+case CalloutEventAdded():
+return added(_that);case CalloutEventCancelled():
+return cancelled(_that);}
+}
+/// A variant of `map` that fallback to returning `null`.
+///
+/// It is equivalent to doing:
+/// ```dart
+/// switch (sealedClass) {
+///   case final Subclass value:
+///     return ...;
+///   case _:
+///     return null;
+/// }
+/// ```
+
+@optionalTypeArgs TResult? mapOrNull<TResult extends Object?>({TResult? Function( CalloutEventAdded value)?  added,TResult? Function( CalloutEventCancelled value)?  cancelled,}){
+final _that = this;
+switch (_that) {
+case CalloutEventAdded() when added != null:
+return added(_that);case CalloutEventCancelled() when cancelled != null:
+return cancelled(_that);case _:
+  return null;
+
+}
+}
+/// A variant of `when` that fallback to an `orElse` callback.
+///
+/// It is equivalent to doing:
+/// ```dart
+/// switch (sealedClass) {
+///   case Subclass(:final field):
+///     return ...;
+///   case _:
+///     return orElse();
+/// }
+/// ```
+
+@optionalTypeArgs TResult maybeWhen<TResult extends Object?>({TResult Function( String id,  CalloutData data)?  added,TResult Function( String id)?  cancelled,required TResult orElse(),}) {final _that = this;
+switch (_that) {
+case CalloutEventAdded() when added != null:
+return added(_that.id,_that.data);case CalloutEventCancelled() when cancelled != null:
+return cancelled(_that.id);case _:
+  return orElse();
+
+}
+}
+/// A `switch`-like method, using callbacks.
+///
+/// As opposed to `map`, this offers destructuring.
+/// It is equivalent to doing:
+/// ```dart
+/// switch (sealedClass) {
+///   case Subclass(:final field):
+///     return ...;
+///   case Subclass2(:final field2):
+///     return ...;
+/// }
+/// ```
+
+@optionalTypeArgs TResult when<TResult extends Object?>({required TResult Function( String id,  CalloutData data)  added,required TResult Function( String id)  cancelled,}) {final _that = this;
+switch (_that) {
+case CalloutEventAdded():
+return added(_that.id,_that.data);case CalloutEventCancelled():
+return cancelled(_that.id);}
+}
+/// A variant of `when` that fallback to returning `null`
+///
+/// It is equivalent to doing:
+/// ```dart
+/// switch (sealedClass) {
+///   case Subclass(:final field):
+///     return ...;
+///   case _:
+///     return null;
+/// }
+/// ```
+
+@optionalTypeArgs TResult? whenOrNull<TResult extends Object?>({TResult? Function( String id,  CalloutData data)?  added,TResult? Function( String id)?  cancelled,}) {final _that = this;
+switch (_that) {
+case CalloutEventAdded() when added != null:
+return added(_that.id,_that.data);case CalloutEventCancelled() when cancelled != null:
+return cancelled(_that.id);case _:
+  return null;
+
+}
+}
+
+}
+
+/// @nodoc
+
+
+class CalloutEventAdded implements CalloutEvent {
+  const CalloutEventAdded({required this.id, required this.data});
+  
+
+@override final  String id;
+ final  CalloutData data;
+
+/// Create a copy of CalloutEvent
+/// with the given fields replaced by the non-null parameter values.
+@override @JsonKey(includeFromJson: false, includeToJson: false)
+@pragma('vm:prefer-inline')
+$CalloutEventAddedCopyWith<CalloutEventAdded> get copyWith => _$CalloutEventAddedCopyWithImpl<CalloutEventAdded>(this, _$identity);
+
+
+
+@override
+bool operator ==(Object other) {
+  return identical(this, other) || (other.runtimeType == runtimeType&&other is CalloutEventAdded&&(identical(other.id, id) || other.id == id)&&(identical(other.data, data) || other.data == data));
+}
+
+
+@override
+int get hashCode => Object.hash(runtimeType,id,data);
+
+@override
+String toString() {
+  return 'CalloutEvent.added(id: $id, data: $data)';
+}
+
+
+}
+
+/// @nodoc
+abstract mixin class $CalloutEventAddedCopyWith<$Res> implements $CalloutEventCopyWith<$Res> {
+  factory $CalloutEventAddedCopyWith(CalloutEventAdded value, $Res Function(CalloutEventAdded) _then) = _$CalloutEventAddedCopyWithImpl;
+@override @useResult
+$Res call({
+ String id, CalloutData data
+});
+
+
+$CalloutDataCopyWith<$Res> get data;
+
+}
+/// @nodoc
+class _$CalloutEventAddedCopyWithImpl<$Res>
+    implements $CalloutEventAddedCopyWith<$Res> {
+  _$CalloutEventAddedCopyWithImpl(this._self, this._then);
+
+  final CalloutEventAdded _self;
+  final $Res Function(CalloutEventAdded) _then;
+
+/// Create a copy of CalloutEvent
+/// with the given fields replaced by the non-null parameter values.
+@override @pragma('vm:prefer-inline') $Res call({Object? id = null,Object? data = null,}) {
+  return _then(CalloutEventAdded(
+id: null == id ? _self.id : id // ignore: cast_nullable_to_non_nullable
+as String,data: null == data ? _self.data : data // ignore: cast_nullable_to_non_nullable
+as CalloutData,
+  ));
+}
+
+/// Create a copy of CalloutEvent
+/// with the given fields replaced by the non-null parameter values.
+@override
+@pragma('vm:prefer-inline')
+$CalloutDataCopyWith<$Res> get data {
+  
+  return $CalloutDataCopyWith<$Res>(_self.data, (value) {
+    return _then(_self.copyWith(data: value));
+  });
+}
+}
+
+/// @nodoc
+
+
+class CalloutEventCancelled implements CalloutEvent {
+  const CalloutEventCancelled({required this.id});
+  
+
+@override final  String id;
+
+/// Create a copy of CalloutEvent
+/// with the given fields replaced by the non-null parameter values.
+@override @JsonKey(includeFromJson: false, includeToJson: false)
+@pragma('vm:prefer-inline')
+$CalloutEventCancelledCopyWith<CalloutEventCancelled> get copyWith => _$CalloutEventCancelledCopyWithImpl<CalloutEventCancelled>(this, _$identity);
+
+
+
+@override
+bool operator ==(Object other) {
+  return identical(this, other) || (other.runtimeType == runtimeType&&other is CalloutEventCancelled&&(identical(other.id, id) || other.id == id));
+}
+
+
+@override
+int get hashCode => Object.hash(runtimeType,id);
+
+@override
+String toString() {
+  return 'CalloutEvent.cancelled(id: $id)';
+}
+
+
+}
+
+/// @nodoc
+abstract mixin class $CalloutEventCancelledCopyWith<$Res> implements $CalloutEventCopyWith<$Res> {
+  factory $CalloutEventCancelledCopyWith(CalloutEventCancelled value, $Res Function(CalloutEventCancelled) _then) = _$CalloutEventCancelledCopyWithImpl;
+@override @useResult
+$Res call({
+ String id
+});
+
+
+
+
+}
+/// @nodoc
+class _$CalloutEventCancelledCopyWithImpl<$Res>
+    implements $CalloutEventCancelledCopyWith<$Res> {
+  _$CalloutEventCancelledCopyWithImpl(this._self, this._then);
+
+  final CalloutEventCancelled _self;
+  final $Res Function(CalloutEventCancelled) _then;
+
+/// Create a copy of CalloutEvent
+/// with the given fields replaced by the non-null parameter values.
+@override @pragma('vm:prefer-inline') $Res call({Object? id = null,}) {
+  return _then(CalloutEventCancelled(
+id: null == id ? _self.id : id // ignore: cast_nullable_to_non_nullable
+as String,
+  ));
+}
+
+
+}
+
+// dart format on

useragent/lib/features/callouts/callout_manager.dart

@@ -0,0 +1,57 @@
+import 'package:arbiter/features/callouts/active_callout.dart';
+import 'package:arbiter/features/callouts/callout_event.dart';
+import 'package:arbiter/features/callouts/types/sdk_connect_approve.dart'
+    as connect_approve;
+import 'package:arbiter/proto/client.pb.dart';
+import 'package:riverpod_annotation/riverpod_annotation.dart';
+
+part 'callout_manager.g.dart';
+
+@Riverpod(keepAlive: true)
+class CalloutManager extends _$CalloutManager {
+  @override
+  Map<String, ActiveCallout> build() {
+    ref.listen(connect_approve.connectApproveEventsProvider, (_, next) {
+      next.whenData(_processEvent);
+    });
+    return {};
+  }
+
+  void _processEvent(CalloutEvent event) {
+    switch (event) {
+      case CalloutEventAdded(:final id, :final data):
+        state = {...state, id: _toActiveCallout(id, data)};
+      case CalloutEventCancelled(:final id):
+        state = {...state}..remove(id);
+    }
+  }
+
+  Future<void> sendDecision(String id, bool approved) async {
+    final callout = state[id];
+    if (callout == null) return;
+    switch (callout.data) {
+      case ConnectApprovalData(:final pubkey):
+        await connect_approve.sendDecision(ref, pubkey, approved);
+    }
+    dismiss(id);
+  }
+
+  void dismiss(String id) {
+    state = {...state}..remove(id);
+  }
+}
+
+ActiveCallout _toActiveCallout(String id, CalloutData data) => switch (data) {
+  ConnectApprovalData(:final clientInfo) => ActiveCallout(
+    id: id,
+    title: 'Connection Request',
+    description: _clientDisplayName(clientInfo) != null
+        ? '${_clientDisplayName(clientInfo)} is requesting a connection.'
+        : 'An SDK client is requesting a connection.',
+    addedAt: DateTime.now(),
+    data: data,
+  ),
+};
+
+String? _clientDisplayName(ClientInfo info) =>
+    info.hasName() && info.name.isNotEmpty ? info.name : null;

useragent/lib/features/callouts/callout_manager.g.dart

@@ -0,0 +1,67 @@
+// GENERATED CODE - DO NOT MODIFY BY HAND
+
+part of 'callout_manager.dart';
+
+// **************************************************************************
+// RiverpodGenerator
+// **************************************************************************
+
+// GENERATED CODE - DO NOT MODIFY BY HAND
+// ignore_for_file: type=lint, type=warning
+
+@ProviderFor(CalloutManager)
+final calloutManagerProvider = CalloutManagerProvider._();
+
+final class CalloutManagerProvider
+    extends $NotifierProvider<CalloutManager, Map<String, ActiveCallout>> {
+  CalloutManagerProvider._()
+    : super(
+        from: null,
+        argument: null,
+        retry: null,
+        name: r'calloutManagerProvider',
+        isAutoDispose: false,
+        dependencies: null,
+        $allTransitiveDependencies: null,
+      );
+
+  @override
+  String debugGetCreateSourceHash() => _$calloutManagerHash();
+
+  @$internal
+  @override
+  CalloutManager create() => CalloutManager();
+
+  /// {@macro riverpod.override_with_value}
+  Override overrideWithValue(Map<String, ActiveCallout> value) {
+    return $ProviderOverride(
+      origin: this,
+      providerOverride: $SyncValueProvider<Map<String, ActiveCallout>>(value),
+    );
+  }
+}
+
+String _$calloutManagerHash() => r'ff8c9a03a6bbbca822242eb497c503b18240a289';
+
+abstract class _$CalloutManager extends $Notifier<Map<String, ActiveCallout>> {
+  Map<String, ActiveCallout> build();
+  @$mustCallSuper
+  @override
+  void runBuild() {
+    final ref =
+        this.ref
+            as $Ref<Map<String, ActiveCallout>, Map<String, ActiveCallout>>;
+    final element =
+        ref.element
+            as $ClassProviderElement<
+              AnyNotifier<
+                Map<String, ActiveCallout>,
+                Map<String, ActiveCallout>
+              >,
+              Map<String, ActiveCallout>,
+              Object?,
+              Object?
+            >;
+    element.handleCreate(ref, build);
+  }
+}

useragent/lib/features/callouts/show_callout.dart

@@ -0,0 +1,99 @@
+import 'package:arbiter/features/callouts/callout_event.dart';
+import 'package:arbiter/features/callouts/callout_manager.dart';
+import 'package:arbiter/screens/callouts/sdk_connect.dart';
+import 'package:flutter/material.dart';
+import 'package:hooks_riverpod/hooks_riverpod.dart';
+
+Future<void> showCallout(BuildContext context, WidgetRef ref, String id) async {
+  final data = ref.read(calloutManagerProvider)[id]?.data;
+  if (data == null) return;
+
+  await showGeneralDialog(
+    context: context,
+    barrierDismissible: false,
+    barrierLabel: MaterialLocalizations.of(context).modalBarrierDismissLabel,
+    barrierColor: Colors.transparent,
+    transitionDuration: const Duration(milliseconds: 320),
+    pageBuilder: (_, animation, _) => _CalloutOverlay(
+      id: id,
+      data: data,
+      animation: animation,
+    ),
+  );
+}
+
+class _CalloutOverlay extends ConsumerWidget {
+  const _CalloutOverlay({
+    required this.id,
+    required this.data,
+    required this.animation,
+  });
+
+  final String id;
+  final CalloutData data;
+  final Animation<double> animation;
+
+  @override
+  Widget build(BuildContext context, WidgetRef ref) {
+    ref.listen(
+      calloutManagerProvider.select((map) => map.containsKey(id)),
+      (wasPresent, isPresent) {
+        if (wasPresent == true && !isPresent && context.mounted) {
+          Navigator.of(context).pop();
+        }
+      },
+    );
+
+    final content = switch (data) {
+      ConnectApprovalData(:final pubkey, :final clientInfo) => SdkConnectCallout(
+        pubkey: pubkey,
+        clientInfo: clientInfo,
+        onAccept: () => ref.read(calloutManagerProvider.notifier).sendDecision(id, true),
+        onDecline: () => ref.read(calloutManagerProvider.notifier).sendDecision(id, false),
+      ),
+    };
+
+    final barrierAnim = CurvedAnimation(
+      parent: animation,
+      curve: const Interval(0, 0.3125, curve: Curves.easeOut),
+    );
+    final popupAnim = CurvedAnimation(
+      parent: animation,
+      curve: const Interval(0.3125, 1, curve: Curves.easeOutCubic),
+    );
+
+    return Material(
+      type: MaterialType.transparency,
+      child: Stack(
+        children: [
+          Positioned.fill(
+            child: AnimatedBuilder(
+              animation: barrierAnim,
+              builder: (_, __) => ColoredBox(
+                color: Colors.black.withValues(alpha: 0.35 * barrierAnim.value),
+              ),
+            ),
+          ),
+          SafeArea(
+            child: Align(
+              alignment: Alignment.bottomCenter,
+              child: Padding(
+                padding: const EdgeInsets.all(16),
+                child: FadeTransition(
+                  opacity: popupAnim,
+                  child: SlideTransition(
+                    position: Tween<Offset>(
+                      begin: const Offset(0, 0.08),
+                      end: Offset.zero,
+                    ).animate(popupAnim),
+                    child: content,
+                  ),
+                ),
+              ),
+            ),
+          ),
+        ],
+      ),
+    );
+  }
+}

useragent/lib/features/callouts/show_callout_list.dart

@@ -0,0 +1,218 @@
+import 'package:arbiter/features/callouts/active_callout.dart';
+import 'package:arbiter/features/callouts/callout_manager.dart';
+import 'package:arbiter/features/callouts/show_callout.dart';
+import 'package:arbiter/theme/palette.dart';
+import 'package:flutter/material.dart';
+import 'package:hooks_riverpod/hooks_riverpod.dart';
+import 'package:sizer/sizer.dart';
+import 'package:timeago/timeago.dart' as timeago;
+
+Future<void> showCalloutList(BuildContext context, WidgetRef ref) async {
+  final selectedId = await showGeneralDialog<String>(
+    context: context,
+    barrierDismissible: true,
+    barrierLabel: MaterialLocalizations.of(context).modalBarrierDismissLabel,
+    barrierColor: Colors.transparent,
+    transitionDuration: const Duration(milliseconds: 280),
+    pageBuilder: (_, animation, __) => _CalloutListOverlay(animation: animation),
+  );
+
+  if (selectedId != null && context.mounted) {
+    await showCallout(context, ref, selectedId);
+  }
+}
+
+class _CalloutListOverlay extends ConsumerWidget {
+  const _CalloutListOverlay({required this.animation});
+
+  final Animation<double> animation;
+
+  @override
+  Widget build(BuildContext context, WidgetRef ref) {
+    final callouts = ref.watch(calloutManagerProvider);
+
+    final barrierAnim = CurvedAnimation(
+      parent: animation,
+      curve: const Interval(0, 0.3, curve: Curves.easeOut),
+    );
+    final panelAnim = CurvedAnimation(
+      parent: animation,
+      curve: const Interval(0.3, 1, curve: Curves.easeOutCubic),
+    );
+
+    return Material(
+      type: MaterialType.transparency,
+      child: Stack(
+        children: [
+          Positioned.fill(
+            child: GestureDetector(
+              behavior: HitTestBehavior.opaque,
+              onTap: () => Navigator.of(context).pop(),
+              child: AnimatedBuilder(
+                animation: barrierAnim,
+                builder: (_, __) => ColoredBox(
+                  color: Colors.black.withValues(alpha: 0.35 * barrierAnim.value),
+                ),
+              ),
+            ),
+          ),
+          SafeArea(
+            child: Align(
+              alignment: Alignment.bottomCenter,
+              child: Padding(
+                padding: EdgeInsets.all(1.6.h),
+                child: FadeTransition(
+                  opacity: panelAnim,
+                  child: SlideTransition(
+                    position: Tween<Offset>(
+                      begin: const Offset(0, 0.08),
+                      end: Offset.zero,
+                    ).animate(panelAnim),
+                    child: GestureDetector(
+                      onTap: () {},
+                      child: _CalloutListPanel(callouts: callouts),
+                    ),
+                  ),
+                ),
+              ),
+            ),
+          ),
+        ],
+      ),
+    );
+  }
+}
+
+class _CalloutListPanel extends StatelessWidget {
+  const _CalloutListPanel({required this.callouts});
+
+  final Map<String, ActiveCallout> callouts;
+
+  @override
+  Widget build(BuildContext context) {
+    final theme = Theme.of(context);
+
+    return Container(
+      width: double.infinity,
+      constraints: BoxConstraints(maxHeight: 48.h),
+      decoration: BoxDecoration(
+        color: Palette.cream,
+        borderRadius: BorderRadius.circular(24),
+        border: Border.all(color: Palette.line),
+      ),
+      child: Column(
+        mainAxisSize: MainAxisSize.min,
+        crossAxisAlignment: CrossAxisAlignment.start,
+        children: [
+          Padding(
+            padding: EdgeInsets.fromLTRB(2.h, 2.h, 2.h, 1.2.h),
+            child: Text(
+              'Notifications',
+              style: theme.textTheme.titleMedium?.copyWith(
+                color: Palette.ink,
+                fontWeight: FontWeight.w800,
+              ),
+            ),
+          ),
+          if (callouts.isEmpty)
+            Padding(
+              padding: EdgeInsets.fromLTRB(2.h, 0, 2.h, 2.h),
+              child: Text(
+                'No pending notifications.',
+                style: theme.textTheme.bodyMedium?.copyWith(
+                  color: Palette.ink.withValues(alpha: 0.50),
+                ),
+              ),
+            )
+          else
+            Flexible(
+              child: SingleChildScrollView(
+                padding: EdgeInsets.fromLTRB(1.2.h, 0, 1.2.h, 1.2.h),
+                child: Column(
+                  spacing: 0.5.h,
+                  children: [
+                    for (final entry in callouts.values)
+                      _CalloutListEntry(
+                        callout: entry,
+                        onTap: () => Navigator.of(context).pop(entry.id),
+                      ),
+                  ],
+                ),
+              ),
+            ),
+        ],
+      ),
+    );
+  }
+}
+
+class _CalloutListEntry extends StatelessWidget {
+  const _CalloutListEntry({required this.callout, required this.onTap});
+
+  final ActiveCallout callout;
+  final VoidCallback onTap;
+
+  @override
+  Widget build(BuildContext context) {
+    final theme = Theme.of(context);
+
+    return InkWell(
+      borderRadius: BorderRadius.circular(16),
+      onTap: onTap,
+      child: Container(
+        padding: EdgeInsets.symmetric(horizontal: 1.2.h, vertical: 1.2.h),
+        decoration: BoxDecoration(
+          borderRadius: BorderRadius.circular(16),
+          border: Border.all(color: Palette.line),
+        ),
+        child: Row(
+          crossAxisAlignment: CrossAxisAlignment.start,
+          spacing: 1.2.h,
+          children: [
+            if (callout.iconUrl != null)
+              CircleAvatar(
+                radius: 2.2.h,
+                backgroundColor: Palette.line,
+                backgroundImage: NetworkImage(callout.iconUrl!),
+              ),
+            Expanded(
+              child: Column(
+                crossAxisAlignment: CrossAxisAlignment.start,
+                spacing: 0.3.h,
+                children: [
+                  Row(
+                    crossAxisAlignment: CrossAxisAlignment.start,
+                    children: [
+                      Expanded(
+                        child: Text(
+                          callout.title,
+                          style: theme.textTheme.bodyMedium?.copyWith(
+                            color: Palette.ink,
+                            fontWeight: FontWeight.w700,
+                          ),
+                        ),
+                      ),
+                      Text(
+                        timeago.format(callout.addedAt),
+                        style: theme.textTheme.bodySmall?.copyWith(
+                          color: Palette.ink.withValues(alpha: 0.45),
+                        ),
+                      ),
+                    ],
+                  ),
+                  Text(
+                    callout.description,
+                    style: theme.textTheme.bodySmall?.copyWith(
+                      color: Palette.ink.withValues(alpha: 0.65),
+                      height: 1.4,
+                    ),
+                  ),
+                ],
+              ),
+            ),
+          ],
+        ),
+      ),
+    );
+  }
+}

useragent/lib/features/callouts/types/sdk_connect_approve.dart

@@ -0,0 +1,51 @@
+import 'dart:convert';
+
+import 'package:arbiter/features/callouts/callout_event.dart';
+import 'package:arbiter/proto/user_agent.pb.dart';
+import 'package:arbiter/providers/connection/connection_manager.dart';
+import 'package:riverpod_annotation/riverpod_annotation.dart';
+
+part 'sdk_connect_approve.g.dart';
+
+@riverpod
+Stream<CalloutEvent> connectApproveEvents(Ref ref) async* {
+  final connection = await ref.watch(connectionManagerProvider.future);
+  if (connection == null) return;
+
+  await for (final message in connection.outOfBandMessages) {
+    switch (message.whichPayload()) {
+      case UserAgentResponse_Payload.sdkClientConnectionRequest:
+        final body = message.sdkClientConnectionRequest;
+        final id = base64Encode(body.pubkey);
+        yield CalloutEvent.added(
+          id: 'connect_approve:$id',
+          data: CalloutData.connectApproval(
+            pubkey: id,
+            clientInfo: body.info,
+          ),
+        );
+
+      case UserAgentResponse_Payload.sdkClientConnectionCancel:
+        final id = base64Encode(message.sdkClientConnectionCancel.pubkey);
+        yield CalloutEvent.cancelled(id: 'connect_approve:$id');
+
+      default:
+        break;
+    }
+  }
+}
+
+Future<void> sendDecision(Ref ref, String pubkey, bool approved) async {
+  final connection = await ref.watch(connectionManagerProvider.future);
+  if (connection == null) return;
+
+  final bytes = base64Decode(pubkey);
+
+  final req = UserAgentRequest(sdkClientConnectionResponse: SdkClientConnectionResponse(
+    approved: approved,
+    pubkey: bytes
+  ));
+
+  await connection.tell(req);
+
+}

useragent/lib/features/callouts/types/sdk_connect_approve.g.dart

@@ -0,0 +1,50 @@
+// GENERATED CODE - DO NOT MODIFY BY HAND
+
+part of 'sdk_connect_approve.dart';
+
+// **************************************************************************
+// RiverpodGenerator
+// **************************************************************************
+
+// GENERATED CODE - DO NOT MODIFY BY HAND
+// ignore_for_file: type=lint, type=warning
+
+@ProviderFor(connectApproveEvents)
+final connectApproveEventsProvider = ConnectApproveEventsProvider._();
+
+final class ConnectApproveEventsProvider
+    extends
+        $FunctionalProvider<
+          AsyncValue<CalloutEvent>,
+          CalloutEvent,
+          Stream<CalloutEvent>
+        >
+    with $FutureModifier<CalloutEvent>, $StreamProvider<CalloutEvent> {
+  ConnectApproveEventsProvider._()
+    : super(
+        from: null,
+        argument: null,
+        retry: null,
+        name: r'connectApproveEventsProvider',
+        isAutoDispose: true,
+        dependencies: null,
+        $allTransitiveDependencies: null,
+      );
+
+  @override
+  String debugGetCreateSourceHash() => _$connectApproveEventsHash();
+
+  @$internal
+  @override
+  $StreamProviderElement<CalloutEvent> $createElement(
+    $ProviderPointer pointer,
+  ) => $StreamProviderElement(pointer);
+
+  @override
+  Stream<CalloutEvent> create(Ref ref) {
+    return connectApproveEvents(ref);
+  }
+}
+
+String _$connectApproveEventsHash() =>
+    r'6a0998288afc0836a7c1701a983f64c33d318fd6';

useragent/lib/features/connection/auth.dart

@@ -66,7 +66,7 @@ Future<Connection> connectAndAuthorize(
         KeyAlgorithm.ed25519 => KeyType.KEY_TYPE_ED25519,
       },
     );
-    final response = await connection.request(
+    final response = await connection.ask(
       UserAgentRequest(authChallengeRequest: req),
     );
     talker.info(
@@ -94,7 +94,7 @@ Future<Connection> connectAndAuthorize(
     );
 
     final signature = await key.sign(challenge);
-    final solutionResponse = await connection.request(
+    final solutionResponse = await connection.ask(
       UserAgentRequest(authChallengeSolution: AuthChallengeSolution(signature: signature)),
     );
 

useragent/lib/features/connection/connection.dart

@@ -29,7 +29,7 @@ class Connection {
 
   Stream<UserAgentResponse> get outOfBandMessages => _outOfBandMessages.stream;
 
-  Future<UserAgentResponse> request(UserAgentRequest message) async {
+  Future<UserAgentResponse> ask(UserAgentRequest message) async {
     _ensureOpen();
 
     final requestId = _nextRequestId++;
@@ -49,7 +49,23 @@ class Connection {
     return completer.future;
   }
 
+  Future<void> tell(UserAgentRequest message) async {
+    _ensureOpen();
+
+    final requestId = _nextRequestId++;
+    message.id = requestId;
+
+    talker.debug('Sending message: ${message.toDebugString()}');
+
+    try {
+      _tx.add(message);
+    } catch (error, stackTrace) {
+      talker.error('Failed to send message: $error', error, stackTrace);
+    }
+  }
+
   Future<void> close() async {
+    talker.debug('Closing connection...');
     final rxSubscription = _rxSubscription;
     if (rxSubscription == null) {
       return;
@@ -86,6 +102,7 @@ class Connection {
   }
 
   void _handleDone() {
+    talker.debug('Connection closed by server.');
     if (_rxSubscription == null) {
       return;
     }

useragent/lib/features/connection/evm.dart

@@ -4,7 +4,7 @@ import 'package:arbiter/proto/user_agent.pb.dart';
 import 'package:protobuf/well_known_types/google/protobuf/empty.pb.dart';
 
 Future<List<WalletEntry>> listEvmWallets(Connection connection) async {
-  final response = await connection.request(
+  final response = await connection.ask(
     UserAgentRequest(evmWalletList: Empty()),
   );
   if (!response.hasEvmWalletList()) {
@@ -25,7 +25,7 @@ Future<List<WalletEntry>> listEvmWallets(Connection connection) async {
 }
 
 Future<void> createEvmWallet(Connection connection) async {
-  final response = await connection.request(
+  final response = await connection.ask(
     UserAgentRequest(evmWalletCreate: Empty()),
   );
   if (!response.hasEvmWalletCreate()) {

useragent/lib/features/connection/evm/grants.dart

@@ -4,16 +4,10 @@ import 'package:arbiter/proto/user_agent.pb.dart';
 import 'package:fixnum/fixnum.dart';
 import 'package:protobuf/well_known_types/google/protobuf/timestamp.pb.dart';
 
-Future<List<GrantEntry>> listEvmGrants(
+Future<List<GrantEntry>> listEvmGrants(Connection connection) async {
-  Connection connection, {
-  int? walletId,
-}) async {
   final request = EvmGrantListRequest();
-  if (walletId != null) {
-    request.walletId = walletId;
-  }
 
-  final response = await connection.request(
+  final response = await connection.ask(
     UserAgentRequest(evmGrantList: request),
   );
   if (!response.hasEvmGrantList()) {
@@ -45,42 +39,11 @@ Future<int> createEvmGrant(
   TransactionRateLimit? rateLimit,
   required SpecificGrant specific,
 }) async {
-  final response = await connection.request(
+  throw UnimplementedError('EVM grant creation is not yet implemented.');
-    UserAgentRequest(
-      evmGrantCreate: EvmGrantCreateRequest(
-        clientId: clientId,
-        shared: SharedSettings(
-          walletId: walletId,
-          chainId: chainId,
-          validFrom: validFrom == null ? null : _toTimestamp(validFrom),
-          validUntil: validUntil == null ? null : _toTimestamp(validUntil),
-          maxGasFeePerGas: maxGasFeePerGas,
-          maxPriorityFeePerGas: maxPriorityFeePerGas,
-          rateLimit: rateLimit,
-        ),
-        specific: specific,
-      ),
-    ),
-  );
-  if (!response.hasEvmGrantCreate()) {
-    throw Exception(
-      'Expected EVM grant create response, got ${response.whichPayload()}',
-    );
-  }
-
-  final result = response.evmGrantCreate;
-  switch (result.whichResult()) {
-    case EvmGrantCreateResponse_Result.grantId:
-      return result.grantId;
-    case EvmGrantCreateResponse_Result.error:
-      throw Exception(_describeGrantError(result.error));
-    case EvmGrantCreateResponse_Result.notSet:
-      throw Exception('Grant creation returned no result.');
-  }
 }
 
 Future<void> deleteEvmGrant(Connection connection, int grantId) async {
-  final response = await connection.request(
+  final response = await connection.ask(
     UserAgentRequest(evmGrantDelete: EvmGrantDeleteRequest(grantId: grantId)),
   );
   if (!response.hasEvmGrantDelete()) {

useragent/lib/features/connection/evm/wallet_access.dart

@@ -0,0 +1,58 @@
+import 'package:arbiter/features/connection/connection.dart';
+import 'package:arbiter/proto/user_agent.pb.dart';
+import 'package:protobuf/well_known_types/google/protobuf/empty.pb.dart';
+
+Future<Set<int>> readClientWalletAccess(
+  Connection connection, {
+  required int clientId,
+}) async {
+  final response = await connection.ask(
+    UserAgentRequest(listWalletAccess: Empty()),
+  );
+  if (!response.hasListWalletAccessResponse()) {
+    throw Exception(
+      'Expected list wallet access response, got ${response.whichPayload()}',
+    );
+  }
+  return {
+    for (final access in response.listWalletAccessResponse.accesses)
+      if (access.clientId == clientId) access.walletId,
+  };
+}
+
+Future<void> writeClientWalletAccess(
+  Connection connection, {
+  required int clientId,
+  required Set<int> walletIds,
+}) async {
+  final current = await readClientWalletAccess(connection, clientId: clientId);
+
+  final toGrant = walletIds.difference(current);
+  final toRevoke = current.difference(walletIds);
+
+  if (toGrant.isNotEmpty) {
+    await connection.tell(
+      UserAgentRequest(
+        grantWalletAccess: SdkClientGrantWalletAccess(
+          accesses: [
+            for (final walletId in toGrant)
+              SdkClientWalletAccess(clientId: clientId, walletId: walletId),
+          ],
+        ),
+      ),
+    );
+  }
+
+  if (toRevoke.isNotEmpty) {
+    await connection.tell(
+      UserAgentRequest(
+        revokeWalletAccess: SdkClientRevokeWalletAccess(
+          accesses: [
+            for (final walletId in toRevoke)
+              SdkClientWalletAccess(clientId: clientId, walletId: walletId),
+          ],
+        ),
+      ),
+    );
+  }
+}

useragent/lib/features/connection/vault.dart

@@ -10,7 +10,7 @@ Future<BootstrapResult> bootstrapVault(
 ) async {
   final encryptedKey = await _encryptVaultKeyMaterial(connection, password);
 
-  final response = await connection.request(
+  final response = await connection.ask(
     UserAgentRequest(
       bootstrapEncryptedKey: BootstrapEncryptedKey(
         nonce: encryptedKey.nonce,
@@ -31,7 +31,7 @@ Future<BootstrapResult> bootstrapVault(
 Future<UnsealResult> unsealVault(Connection connection, String password) async {
   final encryptedKey = await _encryptVaultKeyMaterial(connection, password);
 
-  final response = await connection.request(
+  final response = await connection.ask(
     UserAgentRequest(
       unsealEncryptedKey: UnsealEncryptedKey(
         nonce: encryptedKey.nonce,
@@ -56,7 +56,7 @@ Future<_EncryptedVaultKey> _encryptVaultKeyMaterial(
   final clientKeyPair = await keyExchange.newKeyPair();
   final clientPublicKey = await clientKeyPair.extractPublicKey();
 
-  final handshakeResponse = await connection.request(
+  final handshakeResponse = await connection.ask(
     UserAgentRequest(unsealStart: UnsealStart(clientPubkey: clientPublicKey.bytes)),
   );
   if (!handshakeResponse.hasUnsealStartResponse()) {

useragent/lib/proto/client.pb.dart

@@ -22,12 +22,91 @@ export 'package:protobuf/protobuf.dart' show GeneratedMessageGenericExtensions;
 
 export 'client.pbenum.dart';
 
+class ClientInfo extends $pb.GeneratedMessage {
+  factory ClientInfo({
+    $core.String? name,
+    $core.String? description,
+    $core.String? version,
+  }) {
+    final result = create();
+    if (name != null) result.name = name;
+    if (description != null) result.description = description;
+    if (version != null) result.version = version;
+    return result;
+  }
+
+  ClientInfo._();
+
+  factory ClientInfo.fromBuffer($core.List<$core.int> data,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromBuffer(data, registry);
+  factory ClientInfo.fromJson($core.String json,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromJson(json, registry);
+
+  static final $pb.BuilderInfo _i = $pb.BuilderInfo(
+      _omitMessageNames ? '' : 'ClientInfo',
+      package: const $pb.PackageName(_omitMessageNames ? '' : 'arbiter.client'),
+      createEmptyInstance: create)
+    ..aOS(1, _omitFieldNames ? '' : 'name')
+    ..aOS(2, _omitFieldNames ? '' : 'description')
+    ..aOS(3, _omitFieldNames ? '' : 'version')
+    ..hasRequiredFields = false;
+
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  ClientInfo clone() => deepCopy();
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  ClientInfo copyWith(void Function(ClientInfo) updates) =>
+      super.copyWith((message) => updates(message as ClientInfo)) as ClientInfo;
+
+  @$core.override
+  $pb.BuilderInfo get info_ => _i;
+
+  @$core.pragma('dart2js:noInline')
+  static ClientInfo create() => ClientInfo._();
+  @$core.override
+  ClientInfo createEmptyInstance() => create();
+  @$core.pragma('dart2js:noInline')
+  static ClientInfo getDefault() => _defaultInstance ??=
+      $pb.GeneratedMessage.$_defaultFor<ClientInfo>(create);
+  static ClientInfo? _defaultInstance;
+
+  @$pb.TagNumber(1)
+  $core.String get name => $_getSZ(0);
+  @$pb.TagNumber(1)
+  set name($core.String value) => $_setString(0, value);
+  @$pb.TagNumber(1)
+  $core.bool hasName() => $_has(0);
+  @$pb.TagNumber(1)
+  void clearName() => $_clearField(1);
+
+  @$pb.TagNumber(2)
+  $core.String get description => $_getSZ(1);
+  @$pb.TagNumber(2)
+  set description($core.String value) => $_setString(1, value);
+  @$pb.TagNumber(2)
+  $core.bool hasDescription() => $_has(1);
+  @$pb.TagNumber(2)
+  void clearDescription() => $_clearField(2);
+
+  @$pb.TagNumber(3)
+  $core.String get version => $_getSZ(2);
+  @$pb.TagNumber(3)
+  set version($core.String value) => $_setString(2, value);
+  @$pb.TagNumber(3)
+  $core.bool hasVersion() => $_has(2);
+  @$pb.TagNumber(3)
+  void clearVersion() => $_clearField(3);
+}
+
 class AuthChallengeRequest extends $pb.GeneratedMessage {
   factory AuthChallengeRequest({
     $core.List<$core.int>? pubkey,
+    ClientInfo? clientInfo,
   }) {
     final result = create();
     if (pubkey != null) result.pubkey = pubkey;
+    if (clientInfo != null) result.clientInfo = clientInfo;
     return result;
   }
 
@@ -46,6 +125,8 @@ class AuthChallengeRequest extends $pb.GeneratedMessage {
       createEmptyInstance: create)
     ..a<$core.List<$core.int>>(
         1, _omitFieldNames ? '' : 'pubkey', $pb.PbFieldType.OY)
+    ..aOM<ClientInfo>(2, _omitFieldNames ? '' : 'clientInfo',
+        subBuilder: ClientInfo.create)
     ..hasRequiredFields = false;
 
   @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
@@ -75,6 +156,17 @@ class AuthChallengeRequest extends $pb.GeneratedMessage {
   $core.bool hasPubkey() => $_has(0);
   @$pb.TagNumber(1)
   void clearPubkey() => $_clearField(1);
+
+  @$pb.TagNumber(2)
+  ClientInfo get clientInfo => $_getN(1);
+  @$pb.TagNumber(2)
+  set clientInfo(ClientInfo value) => $_setField(2, value);
+  @$pb.TagNumber(2)
+  $core.bool hasClientInfo() => $_has(1);
+  @$pb.TagNumber(2)
+  void clearClientInfo() => $_clearField(2);
+  @$pb.TagNumber(2)
+  ClientInfo ensureClientInfo() => $_ensure(1);
 }
 
 class AuthChallenge extends $pb.GeneratedMessage {

useragent/lib/proto/client.pbjson.dart

@@ -55,18 +55,62 @@ final $typed_data.Uint8List vaultStateDescriptor = $convert.base64Decode(
     'VfVU5CT09UU1RSQVBQRUQQARIWChJWQVVMVF9TVEFURV9TRUFMRUQQAhIYChRWQVVMVF9TVEFU'
     'RV9VTlNFQUxFRBADEhUKEVZBVUxUX1NUQVRFX0VSUk9SEAQ=');
 
+@$core.Deprecated('Use clientInfoDescriptor instead')
+const ClientInfo$json = {
+  '1': 'ClientInfo',
+  '2': [
+    {'1': 'name', '3': 1, '4': 1, '5': 9, '10': 'name'},
+    {
+      '1': 'description',
+      '3': 2,
+      '4': 1,
+      '5': 9,
+      '9': 0,
+      '10': 'description',
+      '17': true
+    },
+    {
+      '1': 'version',
+      '3': 3,
+      '4': 1,
+      '5': 9,
+      '9': 1,
+      '10': 'version',
+      '17': true
+    },
+  ],
+  '8': [
+    {'1': '_description'},
+    {'1': '_version'},
+  ],
+};
+
+/// Descriptor for `ClientInfo`. Decode as a `google.protobuf.DescriptorProto`.
+final $typed_data.Uint8List clientInfoDescriptor = $convert.base64Decode(
+    'CgpDbGllbnRJbmZvEhIKBG5hbWUYASABKAlSBG5hbWUSJQoLZGVzY3JpcHRpb24YAiABKAlIAF'
+    'ILZGVzY3JpcHRpb26IAQESHQoHdmVyc2lvbhgDIAEoCUgBUgd2ZXJzaW9uiAEBQg4KDF9kZXNj'
+    'cmlwdGlvbkIKCghfdmVyc2lvbg==');
+
 @$core.Deprecated('Use authChallengeRequestDescriptor instead')
 const AuthChallengeRequest$json = {
   '1': 'AuthChallengeRequest',
   '2': [
     {'1': 'pubkey', '3': 1, '4': 1, '5': 12, '10': 'pubkey'},
+    {
+      '1': 'client_info',
+      '3': 2,
+      '4': 1,
+      '5': 11,
+      '6': '.arbiter.client.ClientInfo',
+      '10': 'clientInfo'
+    },
   ],
 };
 
 /// Descriptor for `AuthChallengeRequest`. Decode as a `google.protobuf.DescriptorProto`.
-final $typed_data.Uint8List authChallengeRequestDescriptor =
+final $typed_data.Uint8List authChallengeRequestDescriptor = $convert.base64Decode(
-    $convert.base64Decode(
+    'ChRBdXRoQ2hhbGxlbmdlUmVxdWVzdBIWCgZwdWJrZXkYASABKAxSBnB1YmtleRI7CgtjbGllbn'
-        'ChRBdXRoQ2hhbGxlbmdlUmVxdWVzdBIWCgZwdWJrZXkYASABKAxSBnB1YmtleQ==');
+    'RfaW5mbxgCIAEoCzIaLmFyYml0ZXIuY2xpZW50LkNsaWVudEluZm9SCmNsaWVudEluZm8=');
 
 @$core.Deprecated('Use authChallengeDescriptor instead')
 const AuthChallenge$json = {

useragent/lib/proto/evm.pb.dart

@@ -26,9 +26,11 @@ export 'evm.pbenum.dart';
 
 class WalletEntry extends $pb.GeneratedMessage {
   factory WalletEntry({
+    $core.int? id,
     $core.List<$core.int>? address,
   }) {
     final result = create();
+    if (id != null) result.id = id;
     if (address != null) result.address = address;
     return result;
   }
@@ -46,8 +48,9 @@ class WalletEntry extends $pb.GeneratedMessage {
       _omitMessageNames ? '' : 'WalletEntry',
       package: const $pb.PackageName(_omitMessageNames ? '' : 'arbiter.evm'),
       createEmptyInstance: create)
+    ..aI(1, _omitFieldNames ? '' : 'id')
     ..a<$core.List<$core.int>>(
-        1, _omitFieldNames ? '' : 'address', $pb.PbFieldType.OY)
+        2, _omitFieldNames ? '' : 'address', $pb.PbFieldType.OY)
     ..hasRequiredFields = false;
 
   @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
@@ -70,13 +73,22 @@ class WalletEntry extends $pb.GeneratedMessage {
   static WalletEntry? _defaultInstance;
 
   @$pb.TagNumber(1)
-  $core.List<$core.int> get address => $_getN(0);
+  $core.int get id => $_getIZ(0);
   @$pb.TagNumber(1)
-  set address($core.List<$core.int> value) => $_setBytes(0, value);
+  set id($core.int value) => $_setSignedInt32(0, value);
   @$pb.TagNumber(1)
-  $core.bool hasAddress() => $_has(0);
+  $core.bool hasId() => $_has(0);
   @$pb.TagNumber(1)
-  void clearAddress() => $_clearField(1);
+  void clearId() => $_clearField(1);
+
+  @$pb.TagNumber(2)
+  $core.List<$core.int> get address => $_getN(1);
+  @$pb.TagNumber(2)
+  set address($core.List<$core.int> value) => $_setBytes(1, value);
+  @$pb.TagNumber(2)
+  $core.bool hasAddress() => $_has(1);
+  @$pb.TagNumber(2)
+  void clearAddress() => $_clearField(2);
 }
 
 class WalletList extends $pb.GeneratedMessage {
@@ -436,7 +448,7 @@ class VolumeRateLimit extends $pb.GeneratedMessage {
 
 class SharedSettings extends $pb.GeneratedMessage {
   factory SharedSettings({
-    $core.int? walletId,
+    $core.int? walletAccessId,
     $fixnum.Int64? chainId,
     $0.Timestamp? validFrom,
     $0.Timestamp? validUntil,
@@ -445,7 +457,7 @@ class SharedSettings extends $pb.GeneratedMessage {
     TransactionRateLimit? rateLimit,
   }) {
     final result = create();
-    if (walletId != null) result.walletId = walletId;
+    if (walletAccessId != null) result.walletAccessId = walletAccessId;
     if (chainId != null) result.chainId = chainId;
     if (validFrom != null) result.validFrom = validFrom;
     if (validUntil != null) result.validUntil = validUntil;
@@ -469,7 +481,7 @@ class SharedSettings extends $pb.GeneratedMessage {
       _omitMessageNames ? '' : 'SharedSettings',
       package: const $pb.PackageName(_omitMessageNames ? '' : 'arbiter.evm'),
       createEmptyInstance: create)
-    ..aI(1, _omitFieldNames ? '' : 'walletId')
+    ..aI(1, _omitFieldNames ? '' : 'walletAccessId')
     ..a<$fixnum.Int64>(2, _omitFieldNames ? '' : 'chainId', $pb.PbFieldType.OU6,
         defaultOrMaker: $fixnum.Int64.ZERO)
     ..aOM<$0.Timestamp>(3, _omitFieldNames ? '' : 'validFrom',
@@ -504,13 +516,13 @@ class SharedSettings extends $pb.GeneratedMessage {
   static SharedSettings? _defaultInstance;
 
   @$pb.TagNumber(1)
-  $core.int get walletId => $_getIZ(0);
+  $core.int get walletAccessId => $_getIZ(0);
   @$pb.TagNumber(1)
-  set walletId($core.int value) => $_setSignedInt32(0, value);
+  set walletAccessId($core.int value) => $_setSignedInt32(0, value);
   @$pb.TagNumber(1)
-  $core.bool hasWalletId() => $_has(0);
+  $core.bool hasWalletAccessId() => $_has(0);
   @$pb.TagNumber(1)
-  void clearWalletId() => $_clearField(1);
+  void clearWalletAccessId() => $_clearField(1);
 
   @$pb.TagNumber(2)
   $fixnum.Int64 get chainId => $_getI64(1);
@@ -1625,12 +1637,10 @@ class TransactionEvalError extends $pb.GeneratedMessage {
 /// --- UserAgent grant management ---
 class EvmGrantCreateRequest extends $pb.GeneratedMessage {
   factory EvmGrantCreateRequest({
-    $core.int? clientId,
     SharedSettings? shared,
     SpecificGrant? specific,
   }) {
     final result = create();
-    if (clientId != null) result.clientId = clientId;
     if (shared != null) result.shared = shared;
     if (specific != null) result.specific = specific;
     return result;
@@ -1649,10 +1659,9 @@ class EvmGrantCreateRequest extends $pb.GeneratedMessage {
       _omitMessageNames ? '' : 'EvmGrantCreateRequest',
       package: const $pb.PackageName(_omitMessageNames ? '' : 'arbiter.evm'),
       createEmptyInstance: create)
-    ..aI(1, _omitFieldNames ? '' : 'clientId')
+    ..aOM<SharedSettings>(1, _omitFieldNames ? '' : 'shared',
-    ..aOM<SharedSettings>(2, _omitFieldNames ? '' : 'shared',
         subBuilder: SharedSettings.create)
-    ..aOM<SpecificGrant>(3, _omitFieldNames ? '' : 'specific',
+    ..aOM<SpecificGrant>(2, _omitFieldNames ? '' : 'specific',
         subBuilder: SpecificGrant.create)
     ..hasRequiredFields = false;
 
@@ -1677,35 +1686,26 @@ class EvmGrantCreateRequest extends $pb.GeneratedMessage {
   static EvmGrantCreateRequest? _defaultInstance;
 
   @$pb.TagNumber(1)
-  $core.int get clientId => $_getIZ(0);
+  SharedSettings get shared => $_getN(0);
   @$pb.TagNumber(1)
-  set clientId($core.int value) => $_setSignedInt32(0, value);
+  set shared(SharedSettings value) => $_setField(1, value);
   @$pb.TagNumber(1)
-  $core.bool hasClientId() => $_has(0);
+  $core.bool hasShared() => $_has(0);
   @$pb.TagNumber(1)
-  void clearClientId() => $_clearField(1);
+  void clearShared() => $_clearField(1);
+  @$pb.TagNumber(1)
+  SharedSettings ensureShared() => $_ensure(0);
 
   @$pb.TagNumber(2)
-  SharedSettings get shared => $_getN(1);
+  SpecificGrant get specific => $_getN(1);
   @$pb.TagNumber(2)
-  set shared(SharedSettings value) => $_setField(2, value);
+  set specific(SpecificGrant value) => $_setField(2, value);
   @$pb.TagNumber(2)
-  $core.bool hasShared() => $_has(1);
+  $core.bool hasSpecific() => $_has(1);
   @$pb.TagNumber(2)
-  void clearShared() => $_clearField(2);
+  void clearSpecific() => $_clearField(2);
   @$pb.TagNumber(2)
-  SharedSettings ensureShared() => $_ensure(1);
+  SpecificGrant ensureSpecific() => $_ensure(1);
-
-  @$pb.TagNumber(3)
-  SpecificGrant get specific => $_getN(2);
-  @$pb.TagNumber(3)
-  set specific(SpecificGrant value) => $_setField(3, value);
-  @$pb.TagNumber(3)
-  $core.bool hasSpecific() => $_has(2);
-  @$pb.TagNumber(3)
-  void clearSpecific() => $_clearField(3);
-  @$pb.TagNumber(3)
-  SpecificGrant ensureSpecific() => $_ensure(2);
 }
 
 enum EvmGrantCreateResponse_Result { grantId, error, notSet }
@@ -1939,13 +1939,13 @@ class EvmGrantDeleteResponse extends $pb.GeneratedMessage {
 class GrantEntry extends $pb.GeneratedMessage {
   factory GrantEntry({
     $core.int? id,
-    $core.int? clientId,
+    $core.int? walletAccessId,
     SharedSettings? shared,
     SpecificGrant? specific,
   }) {
     final result = create();
     if (id != null) result.id = id;
-    if (clientId != null) result.clientId = clientId;
+    if (walletAccessId != null) result.walletAccessId = walletAccessId;
     if (shared != null) result.shared = shared;
     if (specific != null) result.specific = specific;
     return result;
@@ -1965,7 +1965,7 @@ class GrantEntry extends $pb.GeneratedMessage {
       package: const $pb.PackageName(_omitMessageNames ? '' : 'arbiter.evm'),
       createEmptyInstance: create)
     ..aI(1, _omitFieldNames ? '' : 'id')
-    ..aI(2, _omitFieldNames ? '' : 'clientId')
+    ..aI(2, _omitFieldNames ? '' : 'walletAccessId')
     ..aOM<SharedSettings>(3, _omitFieldNames ? '' : 'shared',
         subBuilder: SharedSettings.create)
     ..aOM<SpecificGrant>(4, _omitFieldNames ? '' : 'specific',
@@ -2000,13 +2000,13 @@ class GrantEntry extends $pb.GeneratedMessage {
   void clearId() => $_clearField(1);
 
   @$pb.TagNumber(2)
-  $core.int get clientId => $_getIZ(1);
+  $core.int get walletAccessId => $_getIZ(1);
   @$pb.TagNumber(2)
-  set clientId($core.int value) => $_setSignedInt32(1, value);
+  set walletAccessId($core.int value) => $_setSignedInt32(1, value);
   @$pb.TagNumber(2)
-  $core.bool hasClientId() => $_has(1);
+  $core.bool hasWalletAccessId() => $_has(1);
   @$pb.TagNumber(2)
-  void clearClientId() => $_clearField(2);
+  void clearWalletAccessId() => $_clearField(2);
 
   @$pb.TagNumber(3)
   SharedSettings get shared => $_getN(2);
@@ -2033,10 +2033,10 @@ class GrantEntry extends $pb.GeneratedMessage {
 
 class EvmGrantListRequest extends $pb.GeneratedMessage {
   factory EvmGrantListRequest({
-    $core.int? walletId,
+    $core.int? walletAccessId,
   }) {
     final result = create();
-    if (walletId != null) result.walletId = walletId;
+    if (walletAccessId != null) result.walletAccessId = walletAccessId;
     return result;
   }
 
@@ -2053,7 +2053,7 @@ class EvmGrantListRequest extends $pb.GeneratedMessage {
       _omitMessageNames ? '' : 'EvmGrantListRequest',
       package: const $pb.PackageName(_omitMessageNames ? '' : 'arbiter.evm'),
       createEmptyInstance: create)
-    ..aI(1, _omitFieldNames ? '' : 'walletId')
+    ..aI(1, _omitFieldNames ? '' : 'walletAccessId')
     ..hasRequiredFields = false;
 
   @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
@@ -2076,13 +2076,13 @@ class EvmGrantListRequest extends $pb.GeneratedMessage {
   static EvmGrantListRequest? _defaultInstance;
 
   @$pb.TagNumber(1)
-  $core.int get walletId => $_getIZ(0);
+  $core.int get walletAccessId => $_getIZ(0);
   @$pb.TagNumber(1)
-  set walletId($core.int value) => $_setSignedInt32(0, value);
+  set walletAccessId($core.int value) => $_setSignedInt32(0, value);
   @$pb.TagNumber(1)
-  $core.bool hasWalletId() => $_has(0);
+  $core.bool hasWalletAccessId() => $_has(0);
   @$pb.TagNumber(1)
-  void clearWalletId() => $_clearField(1);
+  void clearWalletAccessId() => $_clearField(1);
 }
 
 enum EvmGrantListResponse_Result { grants, error, notSet }

useragent/lib/proto/evm.pbjson.dart

@@ -34,13 +34,15 @@ final $typed_data.Uint8List evmErrorDescriptor = $convert.base64Decode(
 const WalletEntry$json = {
   '1': 'WalletEntry',
   '2': [
-    {'1': 'address', '3': 1, '4': 1, '5': 12, '10': 'address'},
+    {'1': 'id', '3': 1, '4': 1, '5': 5, '10': 'id'},
+    {'1': 'address', '3': 2, '4': 1, '5': 12, '10': 'address'},
   ],
 };
 
 /// Descriptor for `WalletEntry`. Decode as a `google.protobuf.DescriptorProto`.
-final $typed_data.Uint8List walletEntryDescriptor = $convert
+final $typed_data.Uint8List walletEntryDescriptor = $convert.base64Decode(
-    .base64Decode('CgtXYWxsZXRFbnRyeRIYCgdhZGRyZXNzGAEgASgMUgdhZGRyZXNz');
+    'CgtXYWxsZXRFbnRyeRIOCgJpZBgBIAEoBVICaWQSGAoHYWRkcmVzcxgCIAEoDFIHYWRkcmVzcw'
+    '==');
 
 @$core.Deprecated('Use walletListDescriptor instead')
 const WalletList$json = {
@@ -162,7 +164,7 @@ final $typed_data.Uint8List volumeRateLimitDescriptor = $convert.base64Decode(
 const SharedSettings$json = {
   '1': 'SharedSettings',
   '2': [
-    {'1': 'wallet_id', '3': 1, '4': 1, '5': 5, '10': 'walletId'},
+    {'1': 'wallet_access_id', '3': 1, '4': 1, '5': 5, '10': 'walletAccessId'},
     {'1': 'chain_id', '3': 2, '4': 1, '5': 4, '10': 'chainId'},
     {
       '1': 'valid_from',
@@ -224,15 +226,15 @@ const SharedSettings$json = {
 
 /// Descriptor for `SharedSettings`. Decode as a `google.protobuf.DescriptorProto`.
 final $typed_data.Uint8List sharedSettingsDescriptor = $convert.base64Decode(
-    'Cg5TaGFyZWRTZXR0aW5ncxIbCgl3YWxsZXRfaWQYASABKAVSCHdhbGxldElkEhkKCGNoYWluX2'
+    'Cg5TaGFyZWRTZXR0aW5ncxIoChB3YWxsZXRfYWNjZXNzX2lkGAEgASgFUg53YWxsZXRBY2Nlc3'
-    'lkGAIgASgEUgdjaGFpbklkEj4KCnZhbGlkX2Zyb20YAyABKAsyGi5nb29nbGUucHJvdG9idWYu'
+    'NJZBIZCghjaGFpbl9pZBgCIAEoBFIHY2hhaW5JZBI+Cgp2YWxpZF9mcm9tGAMgASgLMhouZ29v'
-    'VGltZXN0YW1wSABSCXZhbGlkRnJvbYgBARJACgt2YWxpZF91bnRpbBgEIAEoCzIaLmdvb2dsZS'
+    'Z2xlLnByb3RvYnVmLlRpbWVzdGFtcEgAUgl2YWxpZEZyb22IAQESQAoLdmFsaWRfdW50aWwYBC'
-    '5wcm90b2J1Zi5UaW1lc3RhbXBIAVIKdmFsaWRVbnRpbIgBARIxChNtYXhfZ2FzX2ZlZV9wZXJf'
+    'ABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wSAFSCnZhbGlkVW50aWyIAQESMQoTbWF4'
-    'Z2FzGAUgASgMSAJSD21heEdhc0ZlZVBlckdhc4gBARI7ChhtYXhfcHJpb3JpdHlfZmVlX3Blcl'
+    'X2dhc19mZWVfcGVyX2dhcxgFIAEoDEgCUg9tYXhHYXNGZWVQZXJHYXOIAQESOwoYbWF4X3ByaW'
-    '9nYXMYBiABKAxIA1IUbWF4UHJpb3JpdHlGZWVQZXJHYXOIAQESRQoKcmF0ZV9saW1pdBgHIAEo'
+    '9yaXR5X2ZlZV9wZXJfZ2FzGAYgASgMSANSFG1heFByaW9yaXR5RmVlUGVyR2FziAEBEkUKCnJh'
-    'CzIhLmFyYml0ZXIuZXZtLlRyYW5zYWN0aW9uUmF0ZUxpbWl0SARSCXJhdGVMaW1pdIgBAUINCg'
+    'dGVfbGltaXQYByABKAsyIS5hcmJpdGVyLmV2bS5UcmFuc2FjdGlvblJhdGVMaW1pdEgEUglyYX'
-    'tfdmFsaWRfZnJvbUIOCgxfdmFsaWRfdW50aWxCFgoUX21heF9nYXNfZmVlX3Blcl9nYXNCGwoZ'
+    'RlTGltaXSIAQFCDQoLX3ZhbGlkX2Zyb21CDgoMX3ZhbGlkX3VudGlsQhYKFF9tYXhfZ2FzX2Zl'
-    'X21heF9wcmlvcml0eV9mZWVfcGVyX2dhc0INCgtfcmF0ZV9saW1pdA==');
+    'ZV9wZXJfZ2FzQhsKGV9tYXhfcHJpb3JpdHlfZmVlX3Blcl9nYXNCDQoLX3JhdGVfbGltaXQ=');
 
 @$core.Deprecated('Use etherTransferSettingsDescriptor instead')
 const EtherTransferSettings$json = {
@@ -631,10 +633,9 @@ final $typed_data.Uint8List transactionEvalErrorDescriptor = $convert.base64Deco
 const EvmGrantCreateRequest$json = {
   '1': 'EvmGrantCreateRequest',
   '2': [
-    {'1': 'client_id', '3': 1, '4': 1, '5': 5, '10': 'clientId'},
     {
       '1': 'shared',
-      '3': 2,
+      '3': 1,
       '4': 1,
       '5': 11,
       '6': '.arbiter.evm.SharedSettings',
@@ -642,7 +643,7 @@ const EvmGrantCreateRequest$json = {
     },
     {
       '1': 'specific',
-      '3': 3,
+      '3': 2,
       '4': 1,
       '5': 11,
       '6': '.arbiter.evm.SpecificGrant',
@@ -653,9 +654,9 @@ const EvmGrantCreateRequest$json = {
 
 /// Descriptor for `EvmGrantCreateRequest`. Decode as a `google.protobuf.DescriptorProto`.
 final $typed_data.Uint8List evmGrantCreateRequestDescriptor = $convert.base64Decode(
-    'ChVFdm1HcmFudENyZWF0ZVJlcXVlc3QSGwoJY2xpZW50X2lkGAEgASgFUghjbGllbnRJZBIzCg'
+    'ChVFdm1HcmFudENyZWF0ZVJlcXVlc3QSMwoGc2hhcmVkGAEgASgLMhsuYXJiaXRlci5ldm0uU2'
-    'ZzaGFyZWQYAiABKAsyGy5hcmJpdGVyLmV2bS5TaGFyZWRTZXR0aW5nc1IGc2hhcmVkEjYKCHNw'
+    'hhcmVkU2V0dGluZ3NSBnNoYXJlZBI2CghzcGVjaWZpYxgCIAEoCzIaLmFyYml0ZXIuZXZtLlNw'
-    'ZWNpZmljGAMgASgLMhouYXJiaXRlci5ldm0uU3BlY2lmaWNHcmFudFIIc3BlY2lmaWM=');
+    'ZWNpZmljR3JhbnRSCHNwZWNpZmlj');
 
 @$core.Deprecated('Use evmGrantCreateResponseDescriptor instead')
 const EvmGrantCreateResponse$json = {
@@ -734,7 +735,7 @@ const GrantEntry$json = {
   '1': 'GrantEntry',
   '2': [
     {'1': 'id', '3': 1, '4': 1, '5': 5, '10': 'id'},
-    {'1': 'client_id', '3': 2, '4': 1, '5': 5, '10': 'clientId'},
+    {'1': 'wallet_access_id', '3': 2, '4': 1, '5': 5, '10': 'walletAccessId'},
     {
       '1': 'shared',
       '3': 3,
@@ -756,34 +757,34 @@ const GrantEntry$json = {
 
 /// Descriptor for `GrantEntry`. Decode as a `google.protobuf.DescriptorProto`.
 final $typed_data.Uint8List grantEntryDescriptor = $convert.base64Decode(
-    'CgpHcmFudEVudHJ5Eg4KAmlkGAEgASgFUgJpZBIbCgljbGllbnRfaWQYAiABKAVSCGNsaWVudE'
+    'CgpHcmFudEVudHJ5Eg4KAmlkGAEgASgFUgJpZBIoChB3YWxsZXRfYWNjZXNzX2lkGAIgASgFUg'
-    'lkEjMKBnNoYXJlZBgDIAEoCzIbLmFyYml0ZXIuZXZtLlNoYXJlZFNldHRpbmdzUgZzaGFyZWQS'
+    '53YWxsZXRBY2Nlc3NJZBIzCgZzaGFyZWQYAyABKAsyGy5hcmJpdGVyLmV2bS5TaGFyZWRTZXR0'
-    'NgoIc3BlY2lmaWMYBCABKAsyGi5hcmJpdGVyLmV2bS5TcGVjaWZpY0dyYW50UghzcGVjaWZpYw'
+    'aW5nc1IGc2hhcmVkEjYKCHNwZWNpZmljGAQgASgLMhouYXJiaXRlci5ldm0uU3BlY2lmaWNHcm'
-    '==');
+    'FudFIIc3BlY2lmaWM=');
 
 @$core.Deprecated('Use evmGrantListRequestDescriptor instead')
 const EvmGrantListRequest$json = {
   '1': 'EvmGrantListRequest',
   '2': [
     {
-      '1': 'wallet_id',
+      '1': 'wallet_access_id',
       '3': 1,
       '4': 1,
       '5': 5,
       '9': 0,
-      '10': 'walletId',
+      '10': 'walletAccessId',
       '17': true
     },
   ],
   '8': [
-    {'1': '_wallet_id'},
+    {'1': '_wallet_access_id'},
   ],
 };
 
 /// Descriptor for `EvmGrantListRequest`. Decode as a `google.protobuf.DescriptorProto`.
 final $typed_data.Uint8List evmGrantListRequestDescriptor = $convert.base64Decode(
-    'ChNFdm1HcmFudExpc3RSZXF1ZXN0EiAKCXdhbGxldF9pZBgBIAEoBUgAUgh3YWxsZXRJZIgBAU'
+    'ChNFdm1HcmFudExpc3RSZXF1ZXN0Ei0KEHdhbGxldF9hY2Nlc3NfaWQYASABKAVIAFIOd2FsbG'
-    'IMCgpfd2FsbGV0X2lk');
+    'V0QWNjZXNzSWSIAQFCEwoRX3dhbGxldF9hY2Nlc3NfaWQ=');
 
 @$core.Deprecated('Use evmGrantListResponseDescriptor instead')
 const EvmGrantListResponse$json = {

useragent/lib/proto/user_agent.pbenum.dart

@@ -39,6 +39,36 @@ class KeyType extends $pb.ProtobufEnum {
   const KeyType._(super.value, super.name);
 }
 
+class SdkClientError extends $pb.ProtobufEnum {
+  static const SdkClientError SDK_CLIENT_ERROR_UNSPECIFIED =
+      SdkClientError._(0, _omitEnumNames ? '' : 'SDK_CLIENT_ERROR_UNSPECIFIED');
+  static const SdkClientError SDK_CLIENT_ERROR_ALREADY_EXISTS =
+      SdkClientError._(
+          1, _omitEnumNames ? '' : 'SDK_CLIENT_ERROR_ALREADY_EXISTS');
+  static const SdkClientError SDK_CLIENT_ERROR_NOT_FOUND =
+      SdkClientError._(2, _omitEnumNames ? '' : 'SDK_CLIENT_ERROR_NOT_FOUND');
+  static const SdkClientError SDK_CLIENT_ERROR_HAS_RELATED_DATA =
+      SdkClientError._(
+          3, _omitEnumNames ? '' : 'SDK_CLIENT_ERROR_HAS_RELATED_DATA');
+  static const SdkClientError SDK_CLIENT_ERROR_INTERNAL =
+      SdkClientError._(4, _omitEnumNames ? '' : 'SDK_CLIENT_ERROR_INTERNAL');
+
+  static const $core.List<SdkClientError> values = <SdkClientError>[
+    SDK_CLIENT_ERROR_UNSPECIFIED,
+    SDK_CLIENT_ERROR_ALREADY_EXISTS,
+    SDK_CLIENT_ERROR_NOT_FOUND,
+    SDK_CLIENT_ERROR_HAS_RELATED_DATA,
+    SDK_CLIENT_ERROR_INTERNAL,
+  ];
+
+  static final $core.List<SdkClientError?> _byValue =
+      $pb.ProtobufEnum.$_initByValueList(values, 4);
+  static SdkClientError? valueOf($core.int value) =>
+      value < 0 || value >= _byValue.length ? null : _byValue[value];
+
+  const SdkClientError._(super.value, super.name);
+}
+
 class AuthResult extends $pb.ProtobufEnum {
   static const AuthResult AUTH_RESULT_UNSPECIFIED =
       AuthResult._(0, _omitEnumNames ? '' : 'AUTH_RESULT_UNSPECIFIED');

useragent/lib/proto/user_agent.pbjson.dart

@@ -31,6 +31,25 @@ final $typed_data.Uint8List keyTypeDescriptor = $convert.base64Decode(
     'CgdLZXlUeXBlEhgKFEtFWV9UWVBFX1VOU1BFQ0lGSUVEEAASFAoQS0VZX1RZUEVfRUQyNTUxOR'
     'ABEhwKGEtFWV9UWVBFX0VDRFNBX1NFQ1AyNTZLMRACEhAKDEtFWV9UWVBFX1JTQRAD');
 
+@$core.Deprecated('Use sdkClientErrorDescriptor instead')
+const SdkClientError$json = {
+  '1': 'SdkClientError',
+  '2': [
+    {'1': 'SDK_CLIENT_ERROR_UNSPECIFIED', '2': 0},
+    {'1': 'SDK_CLIENT_ERROR_ALREADY_EXISTS', '2': 1},
+    {'1': 'SDK_CLIENT_ERROR_NOT_FOUND', '2': 2},
+    {'1': 'SDK_CLIENT_ERROR_HAS_RELATED_DATA', '2': 3},
+    {'1': 'SDK_CLIENT_ERROR_INTERNAL', '2': 4},
+  ],
+};
+
+/// Descriptor for `SdkClientError`. Decode as a `google.protobuf.EnumDescriptorProto`.
+final $typed_data.Uint8List sdkClientErrorDescriptor = $convert.base64Decode(
+    'Cg5TZGtDbGllbnRFcnJvchIgChxTREtfQ0xJRU5UX0VSUk9SX1VOU1BFQ0lGSUVEEAASIwofU0'
+    'RLX0NMSUVOVF9FUlJPUl9BTFJFQURZX0VYSVNUUxABEh4KGlNES19DTElFTlRfRVJST1JfTk9U'
+    'X0ZPVU5EEAISJQohU0RLX0NMSUVOVF9FUlJPUl9IQVNfUkVMQVRFRF9EQVRBEAMSHQoZU0RLX0'
+    'NMSUVOVF9FUlJPUl9JTlRFUk5BTBAE');
+
 @$core.Deprecated('Use authResultDescriptor instead')
 const AuthResult$json = {
   '1': 'AuthResult',
@@ -105,6 +124,131 @@ final $typed_data.Uint8List vaultStateDescriptor = $convert.base64Decode(
     'VfVU5CT09UU1RSQVBQRUQQARIWChJWQVVMVF9TVEFURV9TRUFMRUQQAhIYChRWQVVMVF9TVEFU'
     'RV9VTlNFQUxFRBADEhUKEVZBVUxUX1NUQVRFX0VSUk9SEAQ=');
 
+@$core.Deprecated('Use sdkClientRevokeRequestDescriptor instead')
+const SdkClientRevokeRequest$json = {
+  '1': 'SdkClientRevokeRequest',
+  '2': [
+    {'1': 'client_id', '3': 1, '4': 1, '5': 5, '10': 'clientId'},
+  ],
+};
+
+/// Descriptor for `SdkClientRevokeRequest`. Decode as a `google.protobuf.DescriptorProto`.
+final $typed_data.Uint8List sdkClientRevokeRequestDescriptor =
+    $convert.base64Decode(
+        'ChZTZGtDbGllbnRSZXZva2VSZXF1ZXN0EhsKCWNsaWVudF9pZBgBIAEoBVIIY2xpZW50SWQ=');
+
+@$core.Deprecated('Use sdkClientEntryDescriptor instead')
+const SdkClientEntry$json = {
+  '1': 'SdkClientEntry',
+  '2': [
+    {'1': 'id', '3': 1, '4': 1, '5': 5, '10': 'id'},
+    {'1': 'pubkey', '3': 2, '4': 1, '5': 12, '10': 'pubkey'},
+    {
+      '1': 'info',
+      '3': 3,
+      '4': 1,
+      '5': 11,
+      '6': '.arbiter.client.ClientInfo',
+      '10': 'info'
+    },
+    {'1': 'created_at', '3': 4, '4': 1, '5': 5, '10': 'createdAt'},
+  ],
+};
+
+/// Descriptor for `SdkClientEntry`. Decode as a `google.protobuf.DescriptorProto`.
+final $typed_data.Uint8List sdkClientEntryDescriptor = $convert.base64Decode(
+    'Cg5TZGtDbGllbnRFbnRyeRIOCgJpZBgBIAEoBVICaWQSFgoGcHVia2V5GAIgASgMUgZwdWJrZX'
+    'kSLgoEaW5mbxgDIAEoCzIaLmFyYml0ZXIuY2xpZW50LkNsaWVudEluZm9SBGluZm8SHQoKY3Jl'
+    'YXRlZF9hdBgEIAEoBVIJY3JlYXRlZEF0');
+
+@$core.Deprecated('Use sdkClientListDescriptor instead')
+const SdkClientList$json = {
+  '1': 'SdkClientList',
+  '2': [
+    {
+      '1': 'clients',
+      '3': 1,
+      '4': 3,
+      '5': 11,
+      '6': '.arbiter.user_agent.SdkClientEntry',
+      '10': 'clients'
+    },
+  ],
+};
+
+/// Descriptor for `SdkClientList`. Decode as a `google.protobuf.DescriptorProto`.
+final $typed_data.Uint8List sdkClientListDescriptor = $convert.base64Decode(
+    'Cg1TZGtDbGllbnRMaXN0EjwKB2NsaWVudHMYASADKAsyIi5hcmJpdGVyLnVzZXJfYWdlbnQuU2'
+    'RrQ2xpZW50RW50cnlSB2NsaWVudHM=');
+
+@$core.Deprecated('Use sdkClientRevokeResponseDescriptor instead')
+const SdkClientRevokeResponse$json = {
+  '1': 'SdkClientRevokeResponse',
+  '2': [
+    {
+      '1': 'ok',
+      '3': 1,
+      '4': 1,
+      '5': 11,
+      '6': '.google.protobuf.Empty',
+      '9': 0,
+      '10': 'ok'
+    },
+    {
+      '1': 'error',
+      '3': 2,
+      '4': 1,
+      '5': 14,
+      '6': '.arbiter.user_agent.SdkClientError',
+      '9': 0,
+      '10': 'error'
+    },
+  ],
+  '8': [
+    {'1': 'result'},
+  ],
+};
+
+/// Descriptor for `SdkClientRevokeResponse`. Decode as a `google.protobuf.DescriptorProto`.
+final $typed_data.Uint8List sdkClientRevokeResponseDescriptor = $convert.base64Decode(
+    'ChdTZGtDbGllbnRSZXZva2VSZXNwb25zZRIoCgJvaxgBIAEoCzIWLmdvb2dsZS5wcm90b2J1Zi'
+    '5FbXB0eUgAUgJvaxI6CgVlcnJvchgCIAEoDjIiLmFyYml0ZXIudXNlcl9hZ2VudC5TZGtDbGll'
+    'bnRFcnJvckgAUgVlcnJvckIICgZyZXN1bHQ=');
+
+@$core.Deprecated('Use sdkClientListResponseDescriptor instead')
+const SdkClientListResponse$json = {
+  '1': 'SdkClientListResponse',
+  '2': [
+    {
+      '1': 'clients',
+      '3': 1,
+      '4': 1,
+      '5': 11,
+      '6': '.arbiter.user_agent.SdkClientList',
+      '9': 0,
+      '10': 'clients'
+    },
+    {
+      '1': 'error',
+      '3': 2,
+      '4': 1,
+      '5': 14,
+      '6': '.arbiter.user_agent.SdkClientError',
+      '9': 0,
+      '10': 'error'
+    },
+  ],
+  '8': [
+    {'1': 'result'},
+  ],
+};
+
+/// Descriptor for `SdkClientListResponse`. Decode as a `google.protobuf.DescriptorProto`.
+final $typed_data.Uint8List sdkClientListResponseDescriptor = $convert.base64Decode(
+    'ChVTZGtDbGllbnRMaXN0UmVzcG9uc2USPQoHY2xpZW50cxgBIAEoCzIhLmFyYml0ZXIudXNlcl'
+    '9hZ2VudC5TZGtDbGllbnRMaXN0SABSB2NsaWVudHMSOgoFZXJyb3IYAiABKA4yIi5hcmJpdGVy'
+    'LnVzZXJfYWdlbnQuU2RrQ2xpZW50RXJyb3JIAFIFZXJyb3JCCAoGcmVzdWx0');
+
 @$core.Deprecated('Use authChallengeRequestDescriptor instead')
 const AuthChallengeRequest$json = {
   '1': 'AuthChallengeRequest',
@@ -224,46 +368,138 @@ final $typed_data.Uint8List bootstrapEncryptedKeyDescriptor = $convert.base64Dec
     'RleHQYAiABKAxSCmNpcGhlcnRleHQSJwoPYXNzb2NpYXRlZF9kYXRhGAMgASgMUg5hc3NvY2lh'
     'dGVkRGF0YQ==');
 
-@$core.Deprecated('Use clientConnectionRequestDescriptor instead')
+@$core.Deprecated('Use sdkClientConnectionRequestDescriptor instead')
-const ClientConnectionRequest$json = {
+const SdkClientConnectionRequest$json = {
-  '1': 'ClientConnectionRequest',
+  '1': 'SdkClientConnectionRequest',
+  '2': [
+    {'1': 'pubkey', '3': 1, '4': 1, '5': 12, '10': 'pubkey'},
+    {
+      '1': 'info',
+      '3': 2,
+      '4': 1,
+      '5': 11,
+      '6': '.arbiter.client.ClientInfo',
+      '10': 'info'
+    },
+  ],
+};
+
+/// Descriptor for `SdkClientConnectionRequest`. Decode as a `google.protobuf.DescriptorProto`.
+final $typed_data.Uint8List sdkClientConnectionRequestDescriptor =
+    $convert.base64Decode(
+        'ChpTZGtDbGllbnRDb25uZWN0aW9uUmVxdWVzdBIWCgZwdWJrZXkYASABKAxSBnB1YmtleRIuCg'
+        'RpbmZvGAIgASgLMhouYXJiaXRlci5jbGllbnQuQ2xpZW50SW5mb1IEaW5mbw==');
+
+@$core.Deprecated('Use sdkClientConnectionResponseDescriptor instead')
+const SdkClientConnectionResponse$json = {
+  '1': 'SdkClientConnectionResponse',
+  '2': [
+    {'1': 'approved', '3': 1, '4': 1, '5': 8, '10': 'approved'},
+    {'1': 'pubkey', '3': 2, '4': 1, '5': 12, '10': 'pubkey'},
+  ],
+};
+
+/// Descriptor for `SdkClientConnectionResponse`. Decode as a `google.protobuf.DescriptorProto`.
+final $typed_data.Uint8List sdkClientConnectionResponseDescriptor =
+    $convert.base64Decode(
+        'ChtTZGtDbGllbnRDb25uZWN0aW9uUmVzcG9uc2USGgoIYXBwcm92ZWQYASABKAhSCGFwcHJvdm'
+        'VkEhYKBnB1YmtleRgCIAEoDFIGcHVia2V5');
+
+@$core.Deprecated('Use sdkClientConnectionCancelDescriptor instead')
+const SdkClientConnectionCancel$json = {
+  '1': 'SdkClientConnectionCancel',
   '2': [
     {'1': 'pubkey', '3': 1, '4': 1, '5': 12, '10': 'pubkey'},
   ],
 };
 
-/// Descriptor for `ClientConnectionRequest`. Decode as a `google.protobuf.DescriptorProto`.
+/// Descriptor for `SdkClientConnectionCancel`. Decode as a `google.protobuf.DescriptorProto`.
-final $typed_data.Uint8List clientConnectionRequestDescriptor =
+final $typed_data.Uint8List sdkClientConnectionCancelDescriptor =
     $convert.base64Decode(
-        'ChdDbGllbnRDb25uZWN0aW9uUmVxdWVzdBIWCgZwdWJrZXkYASABKAxSBnB1YmtleQ==');
+        'ChlTZGtDbGllbnRDb25uZWN0aW9uQ2FuY2VsEhYKBnB1YmtleRgBIAEoDFIGcHVia2V5');
 
-@$core.Deprecated('Use clientConnectionResponseDescriptor instead')
+@$core.Deprecated('Use sdkClientWalletAccessDescriptor instead')
-const ClientConnectionResponse$json = {
+const SdkClientWalletAccess$json = {
-  '1': 'ClientConnectionResponse',
+  '1': 'SdkClientWalletAccess',
   '2': [
-    {'1': 'approved', '3': 1, '4': 1, '5': 8, '10': 'approved'},
+    {'1': 'client_id', '3': 1, '4': 1, '5': 5, '10': 'clientId'},
+    {'1': 'wallet_id', '3': 2, '4': 1, '5': 5, '10': 'walletId'},
   ],
 };
 
-/// Descriptor for `ClientConnectionResponse`. Decode as a `google.protobuf.DescriptorProto`.
+/// Descriptor for `SdkClientWalletAccess`. Decode as a `google.protobuf.DescriptorProto`.
-final $typed_data.Uint8List clientConnectionResponseDescriptor =
+final $typed_data.Uint8List sdkClientWalletAccessDescriptor = $convert.base64Decode(
-    $convert.base64Decode(
+    'ChVTZGtDbGllbnRXYWxsZXRBY2Nlc3MSGwoJY2xpZW50X2lkGAEgASgFUghjbGllbnRJZBIbCg'
-        'ChhDbGllbnRDb25uZWN0aW9uUmVzcG9uc2USGgoIYXBwcm92ZWQYASABKAhSCGFwcHJvdmVk');
+    'l3YWxsZXRfaWQYAiABKAVSCHdhbGxldElk');
 
-@$core.Deprecated('Use clientConnectionCancelDescriptor instead')
+@$core.Deprecated('Use sdkClientGrantWalletAccessDescriptor instead')
-const ClientConnectionCancel$json = {
+const SdkClientGrantWalletAccess$json = {
-  '1': 'ClientConnectionCancel',
+  '1': 'SdkClientGrantWalletAccess',
+  '2': [
+    {
+      '1': 'accesses',
+      '3': 1,
+      '4': 3,
+      '5': 11,
+      '6': '.arbiter.user_agent.SdkClientWalletAccess',
+      '10': 'accesses'
+    },
+  ],
 };
 
-/// Descriptor for `ClientConnectionCancel`. Decode as a `google.protobuf.DescriptorProto`.
+/// Descriptor for `SdkClientGrantWalletAccess`. Decode as a `google.protobuf.DescriptorProto`.
-final $typed_data.Uint8List clientConnectionCancelDescriptor =
+final $typed_data.Uint8List sdkClientGrantWalletAccessDescriptor =
-    $convert.base64Decode('ChZDbGllbnRDb25uZWN0aW9uQ2FuY2Vs');
+    $convert.base64Decode(
+        'ChpTZGtDbGllbnRHcmFudFdhbGxldEFjY2VzcxJFCghhY2Nlc3NlcxgBIAMoCzIpLmFyYml0ZX'
+        'IudXNlcl9hZ2VudC5TZGtDbGllbnRXYWxsZXRBY2Nlc3NSCGFjY2Vzc2Vz');
+
+@$core.Deprecated('Use sdkClientRevokeWalletAccessDescriptor instead')
+const SdkClientRevokeWalletAccess$json = {
+  '1': 'SdkClientRevokeWalletAccess',
+  '2': [
+    {
+      '1': 'accesses',
+      '3': 1,
+      '4': 3,
+      '5': 11,
+      '6': '.arbiter.user_agent.SdkClientWalletAccess',
+      '10': 'accesses'
+    },
+  ],
+};
+
+/// Descriptor for `SdkClientRevokeWalletAccess`. Decode as a `google.protobuf.DescriptorProto`.
+final $typed_data.Uint8List sdkClientRevokeWalletAccessDescriptor =
+    $convert.base64Decode(
+        'ChtTZGtDbGllbnRSZXZva2VXYWxsZXRBY2Nlc3MSRQoIYWNjZXNzZXMYASADKAsyKS5hcmJpdG'
+        'VyLnVzZXJfYWdlbnQuU2RrQ2xpZW50V2FsbGV0QWNjZXNzUghhY2Nlc3Nlcw==');
+
+@$core.Deprecated('Use listWalletAccessResponseDescriptor instead')
+const ListWalletAccessResponse$json = {
+  '1': 'ListWalletAccessResponse',
+  '2': [
+    {
+      '1': 'accesses',
+      '3': 1,
+      '4': 3,
+      '5': 11,
+      '6': '.arbiter.user_agent.SdkClientWalletAccess',
+      '10': 'accesses'
+    },
+  ],
+};
+
+/// Descriptor for `ListWalletAccessResponse`. Decode as a `google.protobuf.DescriptorProto`.
+final $typed_data.Uint8List listWalletAccessResponseDescriptor =
+    $convert.base64Decode(
+        'ChhMaXN0V2FsbGV0QWNjZXNzUmVzcG9uc2USRQoIYWNjZXNzZXMYASADKAsyKS5hcmJpdGVyLn'
+        'VzZXJfYWdlbnQuU2RrQ2xpZW50V2FsbGV0QWNjZXNzUghhY2Nlc3Nlcw==');
 
 @$core.Deprecated('Use userAgentRequestDescriptor instead')
 const UserAgentRequest$json = {
   '1': 'UserAgentRequest',
   '2': [
-    {'1': 'id', '3': 14, '4': 1, '5': 5, '10': 'id'},
+    {'1': 'id', '3': 16, '4': 1, '5': 5, '10': 'id'},
     {
       '1': 'auth_challenge_request',
       '3': 1,
@@ -355,23 +591,68 @@ const UserAgentRequest$json = {
       '10': 'evmGrantList'
     },
     {
-      '1': 'client_connection_response',
+      '1': 'sdk_client_connection_response',
       '3': 11,
       '4': 1,
       '5': 11,
-      '6': '.arbiter.user_agent.ClientConnectionResponse',
+      '6': '.arbiter.user_agent.SdkClientConnectionResponse',
       '9': 0,
-      '10': 'clientConnectionResponse'
+      '10': 'sdkClientConnectionResponse'
+    },
+    {
+      '1': 'sdk_client_revoke',
+      '3': 12,
+      '4': 1,
+      '5': 11,
+      '6': '.arbiter.user_agent.SdkClientRevokeRequest',
+      '9': 0,
+      '10': 'sdkClientRevoke'
+    },
+    {
+      '1': 'sdk_client_list',
+      '3': 13,
+      '4': 1,
+      '5': 11,
+      '6': '.google.protobuf.Empty',
+      '9': 0,
+      '10': 'sdkClientList'
     },
     {
       '1': 'bootstrap_encrypted_key',
-      '3': 12,
+      '3': 14,
       '4': 1,
       '5': 11,
       '6': '.arbiter.user_agent.BootstrapEncryptedKey',
       '9': 0,
       '10': 'bootstrapEncryptedKey'
     },
+    {
+      '1': 'grant_wallet_access',
+      '3': 15,
+      '4': 1,
+      '5': 11,
+      '6': '.arbiter.user_agent.SdkClientGrantWalletAccess',
+      '9': 0,
+      '10': 'grantWalletAccess'
+    },
+    {
+      '1': 'revoke_wallet_access',
+      '3': 17,
+      '4': 1,
+      '5': 11,
+      '6': '.arbiter.user_agent.SdkClientRevokeWalletAccess',
+      '9': 0,
+      '10': 'revokeWalletAccess'
+    },
+    {
+      '1': 'list_wallet_access',
+      '3': 18,
+      '4': 1,
+      '5': 11,
+      '6': '.google.protobuf.Empty',
+      '9': 0,
+      '10': 'listWalletAccess'
+    },
   ],
   '8': [
     {'1': 'payload'},
@@ -380,7 +661,7 @@ const UserAgentRequest$json = {
 
 /// Descriptor for `UserAgentRequest`. Decode as a `google.protobuf.DescriptorProto`.
 final $typed_data.Uint8List userAgentRequestDescriptor = $convert.base64Decode(
-    'ChBVc2VyQWdlbnRSZXF1ZXN0Eg4KAmlkGA4gASgFUgJpZBJgChZhdXRoX2NoYWxsZW5nZV9yZX'
+    'ChBVc2VyQWdlbnRSZXF1ZXN0Eg4KAmlkGBAgASgFUgJpZBJgChZhdXRoX2NoYWxsZW5nZV9yZX'
     'F1ZXN0GAEgASgLMiguYXJiaXRlci51c2VyX2FnZW50LkF1dGhDaGFsbGVuZ2VSZXF1ZXN0SABS'
     'FGF1dGhDaGFsbGVuZ2VSZXF1ZXN0EmMKF2F1dGhfY2hhbGxlbmdlX3NvbHV0aW9uGAIgASgLMi'
     'kuYXJiaXRlci51c2VyX2FnZW50LkF1dGhDaGFsbGVuZ2VTb2x1dGlvbkgAUhVhdXRoQ2hhbGxl'
@@ -395,17 +676,24 @@ final $typed_data.Uint8List userAgentRequestDescriptor = $convert.base64Decode(
     'DmV2bUdyYW50Q3JlYXRlEk4KEGV2bV9ncmFudF9kZWxldGUYCSABKAsyIi5hcmJpdGVyLmV2bS'
     '5Fdm1HcmFudERlbGV0ZVJlcXVlc3RIAFIOZXZtR3JhbnREZWxldGUSSAoOZXZtX2dyYW50X2xp'
     'c3QYCiABKAsyIC5hcmJpdGVyLmV2bS5Fdm1HcmFudExpc3RSZXF1ZXN0SABSDGV2bUdyYW50TG'
-    'lzdBJsChpjbGllbnRfY29ubmVjdGlvbl9yZXNwb25zZRgLIAEoCzIsLmFyYml0ZXIudXNlcl9h'
+    'lzdBJ2Ch5zZGtfY2xpZW50X2Nvbm5lY3Rpb25fcmVzcG9uc2UYCyABKAsyLy5hcmJpdGVyLnVz'
-    'Z2VudC5DbGllbnRDb25uZWN0aW9uUmVzcG9uc2VIAFIYY2xpZW50Q29ubmVjdGlvblJlc3Bvbn'
+    'ZXJfYWdlbnQuU2RrQ2xpZW50Q29ubmVjdGlvblJlc3BvbnNlSABSG3Nka0NsaWVudENvbm5lY3'
-    'NlEmMKF2Jvb3RzdHJhcF9lbmNyeXB0ZWRfa2V5GAwgASgLMikuYXJiaXRlci51c2VyX2FnZW50'
+    'Rpb25SZXNwb25zZRJYChFzZGtfY2xpZW50X3Jldm9rZRgMIAEoCzIqLmFyYml0ZXIudXNlcl9h'
-    'LkJvb3RzdHJhcEVuY3J5cHRlZEtleUgAUhVib290c3RyYXBFbmNyeXB0ZWRLZXlCCQoHcGF5bG'
+    'Z2VudC5TZGtDbGllbnRSZXZva2VSZXF1ZXN0SABSD3Nka0NsaWVudFJldm9rZRJACg9zZGtfY2'
-    '9hZA==');
+    'xpZW50X2xpc3QYDSABKAsyFi5nb29nbGUucHJvdG9idWYuRW1wdHlIAFINc2RrQ2xpZW50TGlz'
+    'dBJjChdib290c3RyYXBfZW5jcnlwdGVkX2tleRgOIAEoCzIpLmFyYml0ZXIudXNlcl9hZ2VudC'
+    '5Cb290c3RyYXBFbmNyeXB0ZWRLZXlIAFIVYm9vdHN0cmFwRW5jcnlwdGVkS2V5EmAKE2dyYW50'
+    'X3dhbGxldF9hY2Nlc3MYDyABKAsyLi5hcmJpdGVyLnVzZXJfYWdlbnQuU2RrQ2xpZW50R3Jhbn'
+    'RXYWxsZXRBY2Nlc3NIAFIRZ3JhbnRXYWxsZXRBY2Nlc3MSYwoUcmV2b2tlX3dhbGxldF9hY2Nl'
+    'c3MYESABKAsyLy5hcmJpdGVyLnVzZXJfYWdlbnQuU2RrQ2xpZW50UmV2b2tlV2FsbGV0QWNjZX'
+    'NzSABSEnJldm9rZVdhbGxldEFjY2VzcxJGChJsaXN0X3dhbGxldF9hY2Nlc3MYEiABKAsyFi5n'
+    'b29nbGUucHJvdG9idWYuRW1wdHlIAFIQbGlzdFdhbGxldEFjY2Vzc0IJCgdwYXlsb2Fk');
 
 @$core.Deprecated('Use userAgentResponseDescriptor instead')
 const UserAgentResponse$json = {
   '1': 'UserAgentResponse',
   '2': [
-    {'1': 'id', '3': 14, '4': 1, '5': 5, '9': 1, '10': 'id', '17': true},
+    {'1': 'id', '3': 16, '4': 1, '5': 5, '9': 1, '10': 'id', '17': true},
     {
       '1': 'auth_challenge',
       '3': 1,
@@ -497,32 +785,59 @@ const UserAgentResponse$json = {
       '10': 'evmGrantList'
     },
     {
-      '1': 'client_connection_request',
+      '1': 'sdk_client_connection_request',
       '3': 11,
       '4': 1,
       '5': 11,
-      '6': '.arbiter.user_agent.ClientConnectionRequest',
+      '6': '.arbiter.user_agent.SdkClientConnectionRequest',
       '9': 0,
-      '10': 'clientConnectionRequest'
+      '10': 'sdkClientConnectionRequest'
     },
     {
-      '1': 'client_connection_cancel',
+      '1': 'sdk_client_connection_cancel',
       '3': 12,
       '4': 1,
       '5': 11,
-      '6': '.arbiter.user_agent.ClientConnectionCancel',
+      '6': '.arbiter.user_agent.SdkClientConnectionCancel',
       '9': 0,
-      '10': 'clientConnectionCancel'
+      '10': 'sdkClientConnectionCancel'
+    },
+    {
+      '1': 'sdk_client_revoke_response',
+      '3': 13,
+      '4': 1,
+      '5': 11,
+      '6': '.arbiter.user_agent.SdkClientRevokeResponse',
+      '9': 0,
+      '10': 'sdkClientRevokeResponse'
+    },
+    {
+      '1': 'sdk_client_list_response',
+      '3': 14,
+      '4': 1,
+      '5': 11,
+      '6': '.arbiter.user_agent.SdkClientListResponse',
+      '9': 0,
+      '10': 'sdkClientListResponse'
     },
     {
       '1': 'bootstrap_result',
-      '3': 13,
+      '3': 15,
       '4': 1,
       '5': 14,
       '6': '.arbiter.user_agent.BootstrapResult',
       '9': 0,
       '10': 'bootstrapResult'
     },
+    {
+      '1': 'list_wallet_access_response',
+      '3': 17,
+      '4': 1,
+      '5': 11,
+      '6': '.arbiter.user_agent.ListWalletAccessResponse',
+      '9': 0,
+      '10': 'listWalletAccessResponse'
+    },
   ],
   '8': [
     {'1': 'payload'},
@@ -532,7 +847,7 @@ const UserAgentResponse$json = {
 
 /// Descriptor for `UserAgentResponse`. Decode as a `google.protobuf.DescriptorProto`.
 final $typed_data.Uint8List userAgentResponseDescriptor = $convert.base64Decode(
-    'ChFVc2VyQWdlbnRSZXNwb25zZRITCgJpZBgOIAEoBUgBUgJpZIgBARJKCg5hdXRoX2NoYWxsZW'
+    'ChFVc2VyQWdlbnRSZXNwb25zZRITCgJpZBgQIAEoBUgBUgJpZIgBARJKCg5hdXRoX2NoYWxsZW'
     '5nZRgBIAEoCzIhLmFyYml0ZXIudXNlcl9hZ2VudC5BdXRoQ2hhbGxlbmdlSABSDWF1dGhDaGFs'
     'bGVuZ2USQQoLYXV0aF9yZXN1bHQYAiABKA4yHi5hcmJpdGVyLnVzZXJfYWdlbnQuQXV0aFJlc3'
     'VsdEgAUgphdXRoUmVzdWx0El0KFXVuc2VhbF9zdGFydF9yZXNwb25zZRgDIAEoCzInLmFyYml0'
@@ -546,10 +861,16 @@ final $typed_data.Uint8List userAgentResponseDescriptor = $convert.base64Decode(
     '5ldm0uRXZtR3JhbnRDcmVhdGVSZXNwb25zZUgAUg5ldm1HcmFudENyZWF0ZRJPChBldm1fZ3Jh'
     'bnRfZGVsZXRlGAkgASgLMiMuYXJiaXRlci5ldm0uRXZtR3JhbnREZWxldGVSZXNwb25zZUgAUg'
     '5ldm1HcmFudERlbGV0ZRJJCg5ldm1fZ3JhbnRfbGlzdBgKIAEoCzIhLmFyYml0ZXIuZXZtLkV2'
-    'bUdyYW50TGlzdFJlc3BvbnNlSABSDGV2bUdyYW50TGlzdBJpChljbGllbnRfY29ubmVjdGlvbl'
+    'bUdyYW50TGlzdFJlc3BvbnNlSABSDGV2bUdyYW50TGlzdBJzCh1zZGtfY2xpZW50X2Nvbm5lY3'
-    '9yZXF1ZXN0GAsgASgLMisuYXJiaXRlci51c2VyX2FnZW50LkNsaWVudENvbm5lY3Rpb25SZXF1'
+    'Rpb25fcmVxdWVzdBgLIAEoCzIuLmFyYml0ZXIudXNlcl9hZ2VudC5TZGtDbGllbnRDb25uZWN0'
-    'ZXN0SABSF2NsaWVudENvbm5lY3Rpb25SZXF1ZXN0EmYKGGNsaWVudF9jb25uZWN0aW9uX2Nhbm'
+    'aW9uUmVxdWVzdEgAUhpzZGtDbGllbnRDb25uZWN0aW9uUmVxdWVzdBJwChxzZGtfY2xpZW50X2'
-    'NlbBgMIAEoCzIqLmFyYml0ZXIudXNlcl9hZ2VudC5DbGllbnRDb25uZWN0aW9uQ2FuY2VsSABS'
+    'Nvbm5lY3Rpb25fY2FuY2VsGAwgASgLMi0uYXJiaXRlci51c2VyX2FnZW50LlNka0NsaWVudENv'
-    'FmNsaWVudENvbm5lY3Rpb25DYW5jZWwSUAoQYm9vdHN0cmFwX3Jlc3VsdBgNIAEoDjIjLmFyYm'
+    'bm5lY3Rpb25DYW5jZWxIAFIZc2RrQ2xpZW50Q29ubmVjdGlvbkNhbmNlbBJqChpzZGtfY2xpZW'
-    'l0ZXIudXNlcl9hZ2VudC5Cb290c3RyYXBSZXN1bHRIAFIPYm9vdHN0cmFwUmVzdWx0QgkKB3Bh'
+    '50X3Jldm9rZV9yZXNwb25zZRgNIAEoCzIrLmFyYml0ZXIudXNlcl9hZ2VudC5TZGtDbGllbnRS'
-    'eWxvYWRCBQoDX2lk');
+    'ZXZva2VSZXNwb25zZUgAUhdzZGtDbGllbnRSZXZva2VSZXNwb25zZRJkChhzZGtfY2xpZW50X2'
+    'xpc3RfcmVzcG9uc2UYDiABKAsyKS5hcmJpdGVyLnVzZXJfYWdlbnQuU2RrQ2xpZW50TGlzdFJl'
+    'c3BvbnNlSABSFXNka0NsaWVudExpc3RSZXNwb25zZRJQChBib290c3RyYXBfcmVzdWx0GA8gAS'
+    'gOMiMuYXJiaXRlci51c2VyX2FnZW50LkJvb3RzdHJhcFJlc3VsdEgAUg9ib290c3RyYXBSZXN1'
+    'bHQSbQobbGlzdF93YWxsZXRfYWNjZXNzX3Jlc3BvbnNlGBEgASgLMiwuYXJiaXRlci51c2VyX2'
+    'FnZW50Lkxpc3RXYWxsZXRBY2Nlc3NSZXNwb25zZUgAUhhsaXN0V2FsbGV0QWNjZXNzUmVzcG9u'
+    'c2VCCQoHcGF5bG9hZEIFCgNfaWQ=');

useragent/lib/providers/connection/connection_manager.dart

@@ -14,7 +14,7 @@ class ConnectionManager extends _$ConnectionManager {
   Future<Connection?> build() async {
     final serverInfo = await ref.watch(serverInfoProvider.future);
     final key = await ref.watch(keyProvider.future);
-    final token = ref.watch(bootstrapTokenProvider);
+    final token = ref.read(bootstrapTokenProvider);
 
     if (serverInfo == null || key == null) {
       return null;

useragent/lib/providers/connection/connection_manager.g.dart

@@ -33,7 +33,7 @@ final class ConnectionManagerProvider
   ConnectionManager create() => ConnectionManager();
 }
 
-String _$connectionManagerHash() => r'd01084e550f315bc6cadfe74413a7f959426a80e';
+String _$connectionManagerHash() => r'f471afb49bdcde77238424942f5af1716634f084';
 
 abstract class _$ConnectionManager extends $AsyncNotifier<Connection?> {
   FutureOr<Connection?> build();

useragent/lib/providers/evm/evm.dart

@@ -1,6 +1,8 @@
-import 'package:arbiter/features/connection/evm.dart';
+import 'package:arbiter/features/connection/evm.dart' as evm;
 import 'package:arbiter/proto/evm.pb.dart';
 import 'package:arbiter/providers/connection/connection_manager.dart';
+import 'package:hooks_riverpod/experimental/mutation.dart';
+import 'package:hooks_riverpod/hooks_riverpod.dart';
 import 'package:riverpod_annotation/riverpod_annotation.dart';
 
 part 'evm.g.dart';
@@ -14,7 +16,7 @@ class Evm extends _$Evm {
       return null;
     }
 
-    return listEvmWallets(connection);
+    return evm.listEvmWallets(connection);
   }
 
   Future<void> refreshWallets() async {
@@ -25,16 +27,21 @@ class Evm extends _$Evm {
     }
 
     state = const AsyncLoading();
-    state = await AsyncValue.guard(() => listEvmWallets(connection));
+    state = await AsyncValue.guard(() => evm.listEvmWallets(connection));
   }
+}
 
-  Future<void> createWallet() async {
+final createEvmWallet = Mutation();
-    final connection = await ref.read(connectionManagerProvider.future);
+
+Future<void> executeCreateEvmWallet(MutationTarget target) async {
+  return await createEvmWallet.run(target, (tsx) async {
+       final connection = await tsx.get(connectionManagerProvider.future);
     if (connection == null) {
       throw Exception('Not connected to the server.');
     }
 
-    await createEvmWallet(connection);
+    await evm.createEvmWallet(connection);
-    state = await AsyncValue.guard(() => listEvmWallets(connection));
+
-  }
+    await tsx.get(evmProvider.notifier).refreshWallets();
-}
+  });
+}

useragent/lib/providers/evm/evm.g.dart

@@ -33,7 +33,7 @@ final class EvmProvider
   Evm create() => Evm();
 }
 
-String _$evmHash() => r'f5d05bfa7b820d0b96026a47ca47702a3793af5d';
+String _$evmHash() => r'ca2c9736065c5dc7cc45d8485000dd85dfbfa572';
 
 abstract class _$Evm extends $AsyncNotifier<List<WalletEntry>?> {
   FutureOr<List<WalletEntry>?> build();

useragent/lib/providers/sdk_clients/details.dart

@@ -0,0 +1,19 @@
+import 'package:arbiter/proto/user_agent.pb.dart';
+import 'package:arbiter/providers/sdk_clients/list.dart';
+import 'package:riverpod_annotation/riverpod_annotation.dart';
+
+part 'details.g.dart';
+
+@riverpod
+Future<SdkClientEntry?> clientDetails(Ref ref, int clientId) async {
+  final clients = await ref.watch(sdkClientsProvider.future);
+  if (clients == null) {
+    return null;
+  }
+  for (final client in clients) {
+    if (client.id == clientId) {
+      return client;
+    }
+  }
+  return null;
+}

useragent/lib/providers/sdk_clients/details.g.dart

@@ -0,0 +1,85 @@
+// GENERATED CODE - DO NOT MODIFY BY HAND
+
+part of 'details.dart';
+
+// **************************************************************************
+// RiverpodGenerator
+// **************************************************************************
+
+// GENERATED CODE - DO NOT MODIFY BY HAND
+// ignore_for_file: type=lint, type=warning
+
+@ProviderFor(clientDetails)
+final clientDetailsProvider = ClientDetailsFamily._();
+
+final class ClientDetailsProvider
+    extends
+        $FunctionalProvider<
+          AsyncValue<SdkClientEntry?>,
+          SdkClientEntry?,
+          FutureOr<SdkClientEntry?>
+        >
+    with $FutureModifier<SdkClientEntry?>, $FutureProvider<SdkClientEntry?> {
+  ClientDetailsProvider._({
+    required ClientDetailsFamily super.from,
+    required int super.argument,
+  }) : super(
+         retry: null,
+         name: r'clientDetailsProvider',
+         isAutoDispose: true,
+         dependencies: null,
+         $allTransitiveDependencies: null,
+       );
+
+  @override
+  String debugGetCreateSourceHash() => _$clientDetailsHash();
+
+  @override
+  String toString() {
+    return r'clientDetailsProvider'
+        ''
+        '($argument)';
+  }
+
+  @$internal
+  @override
+  $FutureProviderElement<SdkClientEntry?> $createElement(
+    $ProviderPointer pointer,
+  ) => $FutureProviderElement(pointer);
+
+  @override
+  FutureOr<SdkClientEntry?> create(Ref ref) {
+    final argument = this.argument as int;
+    return clientDetails(ref, argument);
+  }
+
+  @override
+  bool operator ==(Object other) {
+    return other is ClientDetailsProvider && other.argument == argument;
+  }
+
+  @override
+  int get hashCode {
+    return argument.hashCode;
+  }
+}
+
+String _$clientDetailsHash() => r'21449a1a2cc4fa4e65ce761e6342e97c1d957a7a';
+
+final class ClientDetailsFamily extends $Family
+    with $FunctionalFamilyOverride<FutureOr<SdkClientEntry?>, int> {
+  ClientDetailsFamily._()
+    : super(
+        retry: null,
+        name: r'clientDetailsProvider',
+        dependencies: null,
+        $allTransitiveDependencies: null,
+        isAutoDispose: true,
+      );
+
+  ClientDetailsProvider call(int clientId) =>
+      ClientDetailsProvider._(argument: clientId, from: this);
+
+  @override
+  String toString() => r'clientDetailsProvider';
+}

useragent/lib/providers/sdk_clients/list.dart

@@ -0,0 +1,34 @@
+import 'package:arbiter/proto/user_agent.pb.dart';
+import 'package:arbiter/providers/connection/connection_manager.dart';
+import 'package:protobuf/well_known_types/google/protobuf/empty.pb.dart';
+import 'package:riverpod_annotation/riverpod_annotation.dart';
+
+part 'list.g.dart';
+
+@riverpod
+Future<List<SdkClientEntry>?> sdkClients(Ref ref) async {
+  final connection = await ref.watch(connectionManagerProvider.future);
+  if (connection == null) {
+    return null;
+  }
+
+  final resp = await connection.ask(
+    UserAgentRequest(sdkClientList: Empty()),
+  );
+
+  if (!resp.hasSdkClientListResponse()) {
+    throw Exception(
+      'Expected SDK client list response, got ${resp.whichPayload()}',
+    );
+  }
+  final result = resp.sdkClientListResponse;
+
+  switch (result.whichResult()) {
+    case SdkClientListResponse_Result.clients:
+      return result.clients.clients.toList(growable: false);
+    case SdkClientListResponse_Result.error:
+      throw Exception('Error listing SDK clients: ${result.error}');
+    case SdkClientListResponse_Result.notSet:
+      throw Exception('SDK client list response was empty.');
+  }
+}

useragent/lib/providers/sdk_clients/list.g.dart

@@ -0,0 +1,51 @@
+// GENERATED CODE - DO NOT MODIFY BY HAND
+
+part of 'list.dart';
+
+// **************************************************************************
+// RiverpodGenerator
+// **************************************************************************
+
+// GENERATED CODE - DO NOT MODIFY BY HAND
+// ignore_for_file: type=lint, type=warning
+
+@ProviderFor(sdkClients)
+final sdkClientsProvider = SdkClientsProvider._();
+
+final class SdkClientsProvider
+    extends
+        $FunctionalProvider<
+          AsyncValue<List<SdkClientEntry>?>,
+          List<SdkClientEntry>?,
+          FutureOr<List<SdkClientEntry>?>
+        >
+    with
+        $FutureModifier<List<SdkClientEntry>?>,
+        $FutureProvider<List<SdkClientEntry>?> {
+  SdkClientsProvider._()
+    : super(
+        from: null,
+        argument: null,
+        retry: null,
+        name: r'sdkClientsProvider',
+        isAutoDispose: true,
+        dependencies: null,
+        $allTransitiveDependencies: null,
+      );
+
+  @override
+  String debugGetCreateSourceHash() => _$sdkClientsHash();
+
+  @$internal
+  @override
+  $FutureProviderElement<List<SdkClientEntry>?> $createElement(
+    $ProviderPointer pointer,
+  ) => $FutureProviderElement(pointer);
+
+  @override
+  FutureOr<List<SdkClientEntry>?> create(Ref ref) {
+    return sdkClients(ref);
+  }
+}
+
+String _$sdkClientsHash() => r'9b50ef901a7b68e4e604d6d0b4777dbd3e6499e1';

useragent/lib/providers/sdk_clients/wallet_access.dart

@@ -0,0 +1,174 @@
+import 'package:arbiter/features/connection/evm/wallet_access.dart';
+import 'package:arbiter/proto/evm.pb.dart';
+import 'package:arbiter/providers/connection/connection_manager.dart';
+import 'package:arbiter/providers/evm/evm.dart';
+import 'package:flutter/foundation.dart';
+import 'package:hooks_riverpod/experimental/mutation.dart';
+import 'package:riverpod_annotation/riverpod_annotation.dart';
+
+part 'wallet_access.g.dart';
+
+class ClientWalletOption {
+  const ClientWalletOption({required this.walletId, required this.address});
+
+  final int walletId;
+  final String address;
+}
+
+class ClientWalletAccessState {
+  const ClientWalletAccessState({
+    this.searchQuery = '',
+    this.originalWalletIds = const {},
+    this.selectedWalletIds = const {},
+  });
+
+  final String searchQuery;
+  final Set<int> originalWalletIds;
+  final Set<int> selectedWalletIds;
+
+  bool get hasChanges => !setEquals(originalWalletIds, selectedWalletIds);
+
+  ClientWalletAccessState copyWith({
+    String? searchQuery,
+    Set<int>? originalWalletIds,
+    Set<int>? selectedWalletIds,
+  }) {
+    return ClientWalletAccessState(
+      searchQuery: searchQuery ?? this.searchQuery,
+      originalWalletIds: originalWalletIds ?? this.originalWalletIds,
+      selectedWalletIds: selectedWalletIds ?? this.selectedWalletIds,
+    );
+  }
+}
+
+final saveClientWalletAccessMutation = Mutation<void>();
+
+abstract class ClientWalletAccessRepository {
+  Future<Set<int>> fetchSelectedWalletIds(int clientId);
+  Future<void> saveSelectedWalletIds(int clientId, Set<int> walletIds);
+}
+
+class ServerClientWalletAccessRepository
+    implements ClientWalletAccessRepository {
+  ServerClientWalletAccessRepository(this.ref);
+
+  final Ref ref;
+
+  @override
+  Future<Set<int>> fetchSelectedWalletIds(int clientId) async {
+    final connection = await ref.read(connectionManagerProvider.future);
+    if (connection == null) {
+      throw Exception('Not connected to the server.');
+    }
+    return readClientWalletAccess(connection, clientId: clientId);
+  }
+
+  @override
+  Future<void> saveSelectedWalletIds(int clientId, Set<int> walletIds) async {
+    final connection = await ref.read(connectionManagerProvider.future);
+    if (connection == null) {
+      throw Exception('Not connected to the server.');
+    }
+    await writeClientWalletAccess(
+      connection,
+      clientId: clientId,
+      walletIds: walletIds,
+    );
+  }
+}
+
+@riverpod
+ClientWalletAccessRepository clientWalletAccessRepository(Ref ref) {
+  return ServerClientWalletAccessRepository(ref);
+}
+
+@riverpod
+Future<List<ClientWalletOption>> clientWalletOptions(Ref ref) async {
+  final wallets = await ref.watch(evmProvider.future) ?? const <WalletEntry>[];
+  return [
+    for (var index = 0; index < wallets.length; index++)
+      ClientWalletOption(
+        walletId: index + 1,
+        address: formatWalletAddress(wallets[index].address),
+      ),
+  ];
+}
+
+@riverpod
+Future<Set<int>> clientWalletAccessSelection(Ref ref, int clientId) async {
+  final repository = ref.watch(clientWalletAccessRepositoryProvider);
+  return repository.fetchSelectedWalletIds(clientId);
+}
+
+@riverpod
+class ClientWalletAccessController extends _$ClientWalletAccessController {
+  @override
+  ClientWalletAccessState build(int clientId) {
+    final selection = ref.read(clientWalletAccessSelectionProvider(clientId));
+
+    void sync(AsyncValue<Set<int>> value) {
+      value.when(data: hydrate, error: (_, _) {}, loading: () {});
+    }
+
+    ref.listen<AsyncValue<Set<int>>>(
+      clientWalletAccessSelectionProvider(clientId),
+      (_, next) => sync(next),
+    );
+    return selection.when(
+      data: (walletIds) => ClientWalletAccessState(
+        originalWalletIds: Set.of(walletIds),
+        selectedWalletIds: Set.of(walletIds),
+      ),
+      error: (error, _) => const ClientWalletAccessState(),
+      loading: () => const ClientWalletAccessState(),
+    );
+  }
+
+  void hydrate(Set<int> selectedWalletIds) {
+    state = state.copyWith(
+      originalWalletIds: Set.of(selectedWalletIds),
+      selectedWalletIds: Set.of(selectedWalletIds),
+    );
+  }
+
+  void setSearchQuery(String value) {
+    state = state.copyWith(searchQuery: value);
+  }
+
+  void toggleWallet(int walletId) {
+    final next = Set<int>.of(state.selectedWalletIds);
+    if (!next.add(walletId)) {
+      next.remove(walletId);
+    }
+    state = state.copyWith(selectedWalletIds: next);
+  }
+
+  void discardChanges() {
+    state = state.copyWith(selectedWalletIds: Set.of(state.originalWalletIds));
+  }
+}
+
+Future<void> executeSaveClientWalletAccess(
+  MutationTarget ref, {
+  required int clientId,
+}) {
+  final mutation = saveClientWalletAccessMutation(clientId);
+  return mutation.run(ref, (tsx) async {
+    final repository = tsx.get(clientWalletAccessRepositoryProvider);
+    final controller = tsx.get(
+      clientWalletAccessControllerProvider(clientId).notifier,
+    );
+    final selectedWalletIds = tsx
+        .get(clientWalletAccessControllerProvider(clientId))
+        .selectedWalletIds;
+    await repository.saveSelectedWalletIds(clientId, selectedWalletIds);
+    controller.hydrate(selectedWalletIds);
+  });
+}
+
+String formatWalletAddress(List<int> bytes) {
+  final hex = bytes
+      .map((byte) => byte.toRadixString(16).padLeft(2, '0'))
+      .join();
+  return '0x$hex';
+}

useragent/lib/providers/sdk_clients/wallet_access.g.dart

@@ -0,0 +1,280 @@
+// GENERATED CODE - DO NOT MODIFY BY HAND
+
+part of 'wallet_access.dart';
+
+// **************************************************************************
+// RiverpodGenerator
+// **************************************************************************
+
+// GENERATED CODE - DO NOT MODIFY BY HAND
+// ignore_for_file: type=lint, type=warning
+
+@ProviderFor(clientWalletAccessRepository)
+final clientWalletAccessRepositoryProvider =
+    ClientWalletAccessRepositoryProvider._();
+
+final class ClientWalletAccessRepositoryProvider
+    extends
+        $FunctionalProvider<
+          ClientWalletAccessRepository,
+          ClientWalletAccessRepository,
+          ClientWalletAccessRepository
+        >
+    with $Provider<ClientWalletAccessRepository> {
+  ClientWalletAccessRepositoryProvider._()
+    : super(
+        from: null,
+        argument: null,
+        retry: null,
+        name: r'clientWalletAccessRepositoryProvider',
+        isAutoDispose: true,
+        dependencies: null,
+        $allTransitiveDependencies: null,
+      );
+
+  @override
+  String debugGetCreateSourceHash() => _$clientWalletAccessRepositoryHash();
+
+  @$internal
+  @override
+  $ProviderElement<ClientWalletAccessRepository> $createElement(
+    $ProviderPointer pointer,
+  ) => $ProviderElement(pointer);
+
+  @override
+  ClientWalletAccessRepository create(Ref ref) {
+    return clientWalletAccessRepository(ref);
+  }
+
+  /// {@macro riverpod.override_with_value}
+  Override overrideWithValue(ClientWalletAccessRepository value) {
+    return $ProviderOverride(
+      origin: this,
+      providerOverride: $SyncValueProvider<ClientWalletAccessRepository>(value),
+    );
+  }
+}
+
+String _$clientWalletAccessRepositoryHash() =>
+    r'bbc332284bc36a8b5d807bd5c45362b6b12b19e7';
+
+@ProviderFor(clientWalletOptions)
+final clientWalletOptionsProvider = ClientWalletOptionsProvider._();
+
+final class ClientWalletOptionsProvider
+    extends
+        $FunctionalProvider<
+          AsyncValue<List<ClientWalletOption>>,
+          List<ClientWalletOption>,
+          FutureOr<List<ClientWalletOption>>
+        >
+    with
+        $FutureModifier<List<ClientWalletOption>>,
+        $FutureProvider<List<ClientWalletOption>> {
+  ClientWalletOptionsProvider._()
+    : super(
+        from: null,
+        argument: null,
+        retry: null,
+        name: r'clientWalletOptionsProvider',
+        isAutoDispose: true,
+        dependencies: null,
+        $allTransitiveDependencies: null,
+      );
+
+  @override
+  String debugGetCreateSourceHash() => _$clientWalletOptionsHash();
+
+  @$internal
+  @override
+  $FutureProviderElement<List<ClientWalletOption>> $createElement(
+    $ProviderPointer pointer,
+  ) => $FutureProviderElement(pointer);
+
+  @override
+  FutureOr<List<ClientWalletOption>> create(Ref ref) {
+    return clientWalletOptions(ref);
+  }
+}
+
+String _$clientWalletOptionsHash() =>
+    r'32183c2b281e2a41400de07f2381132a706815ab';
+
+@ProviderFor(clientWalletAccessSelection)
+final clientWalletAccessSelectionProvider =
+    ClientWalletAccessSelectionFamily._();
+
+final class ClientWalletAccessSelectionProvider
+    extends
+        $FunctionalProvider<AsyncValue<Set<int>>, Set<int>, FutureOr<Set<int>>>
+    with $FutureModifier<Set<int>>, $FutureProvider<Set<int>> {
+  ClientWalletAccessSelectionProvider._({
+    required ClientWalletAccessSelectionFamily super.from,
+    required int super.argument,
+  }) : super(
+         retry: null,
+         name: r'clientWalletAccessSelectionProvider',
+         isAutoDispose: true,
+         dependencies: null,
+         $allTransitiveDependencies: null,
+       );
+
+  @override
+  String debugGetCreateSourceHash() => _$clientWalletAccessSelectionHash();
+
+  @override
+  String toString() {
+    return r'clientWalletAccessSelectionProvider'
+        ''
+        '($argument)';
+  }
+
+  @$internal
+  @override
+  $FutureProviderElement<Set<int>> $createElement($ProviderPointer pointer) =>
+      $FutureProviderElement(pointer);
+
+  @override
+  FutureOr<Set<int>> create(Ref ref) {
+    final argument = this.argument as int;
+    return clientWalletAccessSelection(ref, argument);
+  }
+
+  @override
+  bool operator ==(Object other) {
+    return other is ClientWalletAccessSelectionProvider &&
+        other.argument == argument;
+  }
+
+  @override
+  int get hashCode {
+    return argument.hashCode;
+  }
+}
+
+String _$clientWalletAccessSelectionHash() =>
+    r'f33705ee7201cd9b899cc058d6642de85a22b03e';
+
+final class ClientWalletAccessSelectionFamily extends $Family
+    with $FunctionalFamilyOverride<FutureOr<Set<int>>, int> {
+  ClientWalletAccessSelectionFamily._()
+    : super(
+        retry: null,
+        name: r'clientWalletAccessSelectionProvider',
+        dependencies: null,
+        $allTransitiveDependencies: null,
+        isAutoDispose: true,
+      );
+
+  ClientWalletAccessSelectionProvider call(int clientId) =>
+      ClientWalletAccessSelectionProvider._(argument: clientId, from: this);
+
+  @override
+  String toString() => r'clientWalletAccessSelectionProvider';
+}
+
+@ProviderFor(ClientWalletAccessController)
+final clientWalletAccessControllerProvider =
+    ClientWalletAccessControllerFamily._();
+
+final class ClientWalletAccessControllerProvider
+    extends
+        $NotifierProvider<
+          ClientWalletAccessController,
+          ClientWalletAccessState
+        > {
+  ClientWalletAccessControllerProvider._({
+    required ClientWalletAccessControllerFamily super.from,
+    required int super.argument,
+  }) : super(
+         retry: null,
+         name: r'clientWalletAccessControllerProvider',
+         isAutoDispose: true,
+         dependencies: null,
+         $allTransitiveDependencies: null,
+       );
+
+  @override
+  String debugGetCreateSourceHash() => _$clientWalletAccessControllerHash();
+
+  @override
+  String toString() {
+    return r'clientWalletAccessControllerProvider'
+        ''
+        '($argument)';
+  }
+
+  @$internal
+  @override
+  ClientWalletAccessController create() => ClientWalletAccessController();
+
+  /// {@macro riverpod.override_with_value}
+  Override overrideWithValue(ClientWalletAccessState value) {
+    return $ProviderOverride(
+      origin: this,
+      providerOverride: $SyncValueProvider<ClientWalletAccessState>(value),
+    );
+  }
+
+  @override
+  bool operator ==(Object other) {
+    return other is ClientWalletAccessControllerProvider &&
+        other.argument == argument;
+  }
+
+  @override
+  int get hashCode {
+    return argument.hashCode;
+  }
+}
+
+String _$clientWalletAccessControllerHash() =>
+    r'45bff81382fec3e8610190167b55667a7dfc1111';
+
+final class ClientWalletAccessControllerFamily extends $Family
+    with
+        $ClassFamilyOverride<
+          ClientWalletAccessController,
+          ClientWalletAccessState,
+          ClientWalletAccessState,
+          ClientWalletAccessState,
+          int
+        > {
+  ClientWalletAccessControllerFamily._()
+    : super(
+        retry: null,
+        name: r'clientWalletAccessControllerProvider',
+        dependencies: null,
+        $allTransitiveDependencies: null,
+        isAutoDispose: true,
+      );
+
+  ClientWalletAccessControllerProvider call(int clientId) =>
+      ClientWalletAccessControllerProvider._(argument: clientId, from: this);
+
+  @override
+  String toString() => r'clientWalletAccessControllerProvider';
+}
+
+abstract class _$ClientWalletAccessController
+    extends $Notifier<ClientWalletAccessState> {
+  late final _$args = ref.$arg as int;
+  int get clientId => _$args;
+
+  ClientWalletAccessState build(int clientId);
+  @$mustCallSuper
+  @override
+  void runBuild() {
+    final ref =
+        this.ref as $Ref<ClientWalletAccessState, ClientWalletAccessState>;
+    final element =
+        ref.element
+            as $ClassProviderElement<
+              AnyNotifier<ClientWalletAccessState, ClientWalletAccessState>,
+              ClientWalletAccessState,
+              Object?,
+              Object?
+            >;
+    element.handleCreate(ref, () => build(_$args));
+  }
+}

useragent/lib/providers/vault_state.dart

@@ -13,7 +13,7 @@ Future<VaultState?> vaultState(Ref ref) async {
     return null;
   }
 
-  final resp = await conn.request(UserAgentRequest(queryVaultState: Empty()));
+  final resp = await conn.ask(UserAgentRequest(queryVaultState: Empty()));
   if (resp.whichPayload() != UserAgentResponse_Payload.vaultState) {
     talker.warning('Expected vault state response, got ${resp.whichPayload()}');
     return null;

useragent/lib/providers/vault_state.g.dart

@@ -46,4 +46,4 @@ final class VaultStateProvider
   }
 }
 
-String _$vaultStateHash() => r'97085e49bc3a296e36fa6c04a8f4c9abafac0835';
+String _$vaultStateHash() => r'81887aa99a3e928efd73dbe85caf81284c9f5803';

useragent/lib/router.dart

@@ -10,6 +10,7 @@ class Router extends RootStackRouter {
     AutoRoute(page: ServerInfoSetupRoute.page, path: '/server-info'),
     AutoRoute(page: ServerConnectionRoute.page, path: '/server-connection'),
     AutoRoute(page: VaultSetupRoute.page, path: '/vault'),
+    AutoRoute(page: ClientDetailsRoute.page, path: '/clients/:clientId'),
     AutoRoute(page: CreateEvmGrantRoute.page, path: '/evm-grants/create'),
 
     AutoRoute(
@@ -17,7 +18,7 @@ class Router extends RootStackRouter {
       path: '/dashboard',
       children: [
         AutoRoute(page: EvmRoute.page, path: 'evm'),
-        AutoRoute(page: EvmGrantsRoute.page, path: 'grants'),
+        AutoRoute(page: ClientsRoute.page, path: 'clients'),
         AutoRoute(page: AboutRoute.page, path: 'about'),
       ],
     ),

useragent/lib/router.gr.dart

@@ -9,27 +9,31 @@
 // coverage:ignore-file
 
 // ignore_for_file: no_leading_underscores_for_library_prefixes
+import 'package:arbiter/proto/user_agent.pb.dart' as _i14;
 import 'package:arbiter/screens/bootstrap.dart' as _i2;
-import 'package:arbiter/screens/dashboard.dart' as _i4;
+import 'package:arbiter/screens/dashboard.dart' as _i7;
 import 'package:arbiter/screens/dashboard/about.dart' as _i1;
-import 'package:arbiter/screens/dashboard/evm.dart' as _i6;
+import 'package:arbiter/screens/dashboard/clients/details.dart' as _i3;
-import 'package:arbiter/screens/dashboard/evm_grant_create.dart' as _i3;
+import 'package:arbiter/screens/dashboard/clients/details/client_details.dart'
-import 'package:arbiter/screens/dashboard/evm_grants.dart' as _i5;
+    as _i4;
-import 'package:arbiter/screens/server_connection.dart' as _i7;
+import 'package:arbiter/screens/dashboard/clients/table.dart' as _i5;
-import 'package:arbiter/screens/server_info_setup.dart' as _i8;
+import 'package:arbiter/screens/dashboard/evm/evm.dart' as _i8;
-import 'package:arbiter/screens/vault_setup.dart' as _i9;
+import 'package:arbiter/screens/dashboard/evm/grants/grant_create.dart' as _i6;
-import 'package:auto_route/auto_route.dart' as _i10;
+import 'package:arbiter/screens/server_connection.dart' as _i9;
-import 'package:flutter/material.dart' as _i11;
+import 'package:arbiter/screens/server_info_setup.dart' as _i10;
+import 'package:arbiter/screens/vault_setup.dart' as _i11;
+import 'package:auto_route/auto_route.dart' as _i12;
+import 'package:flutter/material.dart' as _i13;
 
 /// generated route for
 /// [_i1.AboutScreen]
-class AboutRoute extends _i10.PageRouteInfo<void> {
+class AboutRoute extends _i12.PageRouteInfo<void> {
-  const AboutRoute({List<_i10.PageRouteInfo>? children})
+  const AboutRoute({List<_i12.PageRouteInfo>? children})
     : super(AboutRoute.name, initialChildren: children);
 
   static const String name = 'AboutRoute';
 
-  static _i10.PageInfo page = _i10.PageInfo(
+  static _i12.PageInfo page = _i12.PageInfo(
     name,
     builder: (data) {
       return const _i1.AboutScreen();
@@ -39,13 +43,13 @@ class AboutRoute extends _i10.PageRouteInfo<void> {
 
 /// generated route for
 /// [_i2.Bootstrap]
-class Bootstrap extends _i10.PageRouteInfo<void> {
+class Bootstrap extends _i12.PageRouteInfo<void> {
-  const Bootstrap({List<_i10.PageRouteInfo>? children})
+  const Bootstrap({List<_i12.PageRouteInfo>? children})
     : super(Bootstrap.name, initialChildren: children);
 
   static const String name = 'Bootstrap';
 
-  static _i10.PageInfo page = _i10.PageInfo(
+  static _i12.PageInfo page = _i12.PageInfo(
     name,
     builder: (data) {
       return const _i2.Bootstrap();
@@ -54,77 +58,176 @@ class Bootstrap extends _i10.PageRouteInfo<void> {
 }
 
 /// generated route for
-/// [_i3.CreateEvmGrantScreen]
+/// [_i3.ClientDetails]
-class CreateEvmGrantRoute extends _i10.PageRouteInfo<void> {
+class ClientDetails extends _i12.PageRouteInfo<ClientDetailsArgs> {
-  const CreateEvmGrantRoute({List<_i10.PageRouteInfo>? children})
+  ClientDetails({
+    _i13.Key? key,
+    required _i14.SdkClientEntry client,
+    List<_i12.PageRouteInfo>? children,
+  }) : super(
+         ClientDetails.name,
+         args: ClientDetailsArgs(key: key, client: client),
+         initialChildren: children,
+       );
+
+  static const String name = 'ClientDetails';
+
+  static _i12.PageInfo page = _i12.PageInfo(
+    name,
+    builder: (data) {
+      final args = data.argsAs<ClientDetailsArgs>();
+      return _i3.ClientDetails(key: args.key, client: args.client);
+    },
+  );
+}
+
+class ClientDetailsArgs {
+  const ClientDetailsArgs({this.key, required this.client});
+
+  final _i13.Key? key;
+
+  final _i14.SdkClientEntry client;
+
+  @override
+  String toString() {
+    return 'ClientDetailsArgs{key: $key, client: $client}';
+  }
+
+  @override
+  bool operator ==(Object other) {
+    if (identical(this, other)) return true;
+    if (other is! ClientDetailsArgs) return false;
+    return key == other.key && client == other.client;
+  }
+
+  @override
+  int get hashCode => key.hashCode ^ client.hashCode;
+}
+
+/// generated route for
+/// [_i4.ClientDetailsScreen]
+class ClientDetailsRoute extends _i12.PageRouteInfo<ClientDetailsRouteArgs> {
+  ClientDetailsRoute({
+    _i13.Key? key,
+    required int clientId,
+    List<_i12.PageRouteInfo>? children,
+  }) : super(
+         ClientDetailsRoute.name,
+         args: ClientDetailsRouteArgs(key: key, clientId: clientId),
+         rawPathParams: {'clientId': clientId},
+         initialChildren: children,
+       );
+
+  static const String name = 'ClientDetailsRoute';
+
+  static _i12.PageInfo page = _i12.PageInfo(
+    name,
+    builder: (data) {
+      final pathParams = data.inheritedPathParams;
+      final args = data.argsAs<ClientDetailsRouteArgs>(
+        orElse: () =>
+            ClientDetailsRouteArgs(clientId: pathParams.getInt('clientId')),
+      );
+      return _i4.ClientDetailsScreen(key: args.key, clientId: args.clientId);
+    },
+  );
+}
+
+class ClientDetailsRouteArgs {
+  const ClientDetailsRouteArgs({this.key, required this.clientId});
+
+  final _i13.Key? key;
+
+  final int clientId;
+
+  @override
+  String toString() {
+    return 'ClientDetailsRouteArgs{key: $key, clientId: $clientId}';
+  }
+
+  @override
+  bool operator ==(Object other) {
+    if (identical(this, other)) return true;
+    if (other is! ClientDetailsRouteArgs) return false;
+    return key == other.key && clientId == other.clientId;
+  }
+
+  @override
+  int get hashCode => key.hashCode ^ clientId.hashCode;
+}
+
+/// generated route for
+/// [_i5.ClientsScreen]
+class ClientsRoute extends _i12.PageRouteInfo<void> {
+  const ClientsRoute({List<_i12.PageRouteInfo>? children})
+    : super(ClientsRoute.name, initialChildren: children);
+
+  static const String name = 'ClientsRoute';
+
+  static _i12.PageInfo page = _i12.PageInfo(
+    name,
+    builder: (data) {
+      return const _i5.ClientsScreen();
+    },
+  );
+}
+
+/// generated route for
+/// [_i6.CreateEvmGrantScreen]
+class CreateEvmGrantRoute extends _i12.PageRouteInfo<void> {
+  const CreateEvmGrantRoute({List<_i12.PageRouteInfo>? children})
     : super(CreateEvmGrantRoute.name, initialChildren: children);
 
   static const String name = 'CreateEvmGrantRoute';
 
-  static _i10.PageInfo page = _i10.PageInfo(
+  static _i12.PageInfo page = _i12.PageInfo(
     name,
     builder: (data) {
-      return const _i3.CreateEvmGrantScreen();
+      return const _i6.CreateEvmGrantScreen();
     },
   );
 }
 
 /// generated route for
-/// [_i4.DashboardRouter]
+/// [_i7.DashboardRouter]
-class DashboardRouter extends _i10.PageRouteInfo<void> {
+class DashboardRouter extends _i12.PageRouteInfo<void> {
-  const DashboardRouter({List<_i10.PageRouteInfo>? children})
+  const DashboardRouter({List<_i12.PageRouteInfo>? children})
     : super(DashboardRouter.name, initialChildren: children);
 
   static const String name = 'DashboardRouter';
 
-  static _i10.PageInfo page = _i10.PageInfo(
+  static _i12.PageInfo page = _i12.PageInfo(
     name,
     builder: (data) {
-      return const _i4.DashboardRouter();
+      return const _i7.DashboardRouter();
     },
   );
 }
 
 /// generated route for
-/// [_i5.EvmGrantsScreen]
+/// [_i8.EvmScreen]
-class EvmGrantsRoute extends _i10.PageRouteInfo<void> {
+class EvmRoute extends _i12.PageRouteInfo<void> {
-  const EvmGrantsRoute({List<_i10.PageRouteInfo>? children})
+  const EvmRoute({List<_i12.PageRouteInfo>? children})
-    : super(EvmGrantsRoute.name, initialChildren: children);
-
-  static const String name = 'EvmGrantsRoute';
-
-  static _i10.PageInfo page = _i10.PageInfo(
-    name,
-    builder: (data) {
-      return const _i5.EvmGrantsScreen();
-    },
-  );
-}
-
-/// generated route for
-/// [_i6.EvmScreen]
-class EvmRoute extends _i10.PageRouteInfo<void> {
-  const EvmRoute({List<_i10.PageRouteInfo>? children})
     : super(EvmRoute.name, initialChildren: children);
 
   static const String name = 'EvmRoute';
 
-  static _i10.PageInfo page = _i10.PageInfo(
+  static _i12.PageInfo page = _i12.PageInfo(
     name,
     builder: (data) {
-      return const _i6.EvmScreen();
+      return const _i8.EvmScreen();
     },
   );
 }
 
 /// generated route for
-/// [_i7.ServerConnectionScreen]
+/// [_i9.ServerConnectionScreen]
 class ServerConnectionRoute
-    extends _i10.PageRouteInfo<ServerConnectionRouteArgs> {
+    extends _i12.PageRouteInfo<ServerConnectionRouteArgs> {
   ServerConnectionRoute({
-    _i11.Key? key,
+    _i13.Key? key,
     String? arbiterUrl,
-    List<_i10.PageRouteInfo>? children,
+    List<_i12.PageRouteInfo>? children,
   }) : super(
          ServerConnectionRoute.name,
          args: ServerConnectionRouteArgs(key: key, arbiterUrl: arbiterUrl),
@@ -133,13 +236,13 @@ class ServerConnectionRoute
 
   static const String name = 'ServerConnectionRoute';
 
-  static _i10.PageInfo page = _i10.PageInfo(
+  static _i12.PageInfo page = _i12.PageInfo(
     name,
     builder: (data) {
       final args = data.argsAs<ServerConnectionRouteArgs>(
         orElse: () => const ServerConnectionRouteArgs(),
       );
-      return _i7.ServerConnectionScreen(
+      return _i9.ServerConnectionScreen(
         key: args.key,
         arbiterUrl: args.arbiterUrl,
       );
@@ -150,7 +253,7 @@ class ServerConnectionRoute
 class ServerConnectionRouteArgs {
   const ServerConnectionRouteArgs({this.key, this.arbiterUrl});
 
-  final _i11.Key? key;
+  final _i13.Key? key;
 
   final String? arbiterUrl;
 
@@ -171,33 +274,33 @@ class ServerConnectionRouteArgs {
 }
 
 /// generated route for
-/// [_i8.ServerInfoSetupScreen]
+/// [_i10.ServerInfoSetupScreen]
-class ServerInfoSetupRoute extends _i10.PageRouteInfo<void> {
+class ServerInfoSetupRoute extends _i12.PageRouteInfo<void> {
-  const ServerInfoSetupRoute({List<_i10.PageRouteInfo>? children})
+  const ServerInfoSetupRoute({List<_i12.PageRouteInfo>? children})
     : super(ServerInfoSetupRoute.name, initialChildren: children);
 
   static const String name = 'ServerInfoSetupRoute';
 
-  static _i10.PageInfo page = _i10.PageInfo(
+  static _i12.PageInfo page = _i12.PageInfo(
     name,
     builder: (data) {
-      return const _i8.ServerInfoSetupScreen();
+      return const _i10.ServerInfoSetupScreen();
     },
   );
 }
 
 /// generated route for
-/// [_i9.VaultSetupScreen]
+/// [_i11.VaultSetupScreen]
-class VaultSetupRoute extends _i10.PageRouteInfo<void> {
+class VaultSetupRoute extends _i12.PageRouteInfo<void> {
-  const VaultSetupRoute({List<_i10.PageRouteInfo>? children})
+  const VaultSetupRoute({List<_i12.PageRouteInfo>? children})
     : super(VaultSetupRoute.name, initialChildren: children);
 
   static const String name = 'VaultSetupRoute';
 
-  static _i10.PageInfo page = _i10.PageInfo(
+  static _i12.PageInfo page = _i12.PageInfo(
     name,
     builder: (data) {
-      return const _i9.VaultSetupScreen();
+      return const _i11.VaultSetupScreen();
     },
   );
 }

useragent/lib/screens/callouts/sdk_connect.dart

@@ -0,0 +1,151 @@
+import 'package:arbiter/proto/client.pb.dart';
+import 'package:arbiter/theme/palette.dart';
+import 'package:flutter/material.dart';
+import 'package:sizer/sizer.dart';
+
+class SdkConnectCallout extends StatelessWidget {
+  const SdkConnectCallout({
+    super.key,
+    required this.pubkey,
+    required this.clientInfo,
+    this.onAccept,
+    this.onDecline,
+  });
+
+  final String pubkey;
+  final ClientInfo clientInfo;
+  final VoidCallback? onAccept;
+  final VoidCallback? onDecline;
+
+  @override
+  Widget build(BuildContext context) {
+    final theme = Theme.of(context);
+
+    final name = clientInfo.hasName() && clientInfo.name.isNotEmpty
+        ? clientInfo.name
+        : _shortPubkey(pubkey);
+
+    final hasDescription =
+        clientInfo.hasDescription() && clientInfo.description.isNotEmpty;
+    final hasVersion =
+        clientInfo.hasVersion() && clientInfo.version.isNotEmpty;
+    final showInfoCard = hasDescription || hasVersion;
+
+    return Container(
+      decoration: BoxDecoration(
+        color: Palette.cream,
+        borderRadius: BorderRadius.circular(24),
+        border: Border.all(color: Palette.line),
+      ),
+      padding: EdgeInsets.all(2.4.h),
+      child: Column(
+        mainAxisSize: MainAxisSize.min,
+        crossAxisAlignment: CrossAxisAlignment.center,
+        spacing: 1.6.h,
+        children: [
+          // if (clientInfo.iconUrl != null)
+          //   CircleAvatar(
+          //     radius: 36,
+          //     backgroundColor: Palette.line,
+          //     backgroundImage: NetworkImage(iconUrl!),
+          //   ),
+          Column(
+            crossAxisAlignment: CrossAxisAlignment.center,
+            spacing: 0.4.h,
+            children: [
+              Text(
+                name,
+                textAlign: TextAlign.center,
+                style: theme.textTheme.titleLarge?.copyWith(
+                  color: Palette.ink,
+                  fontWeight: FontWeight.w800,
+                ),
+              ),
+              Text(
+                'is requesting a connection',
+                textAlign: TextAlign.center,
+                style: theme.textTheme.bodyMedium?.copyWith(
+                  color: Palette.ink.withValues(alpha: 0.55),
+                ),
+              ),
+            ],
+          ),
+          if (showInfoCard)
+            Container(
+              width: double.infinity,
+              decoration: BoxDecoration(
+                color: Palette.ink.withValues(alpha: 0.04),
+                borderRadius: BorderRadius.circular(14),
+                border: Border.all(color: Palette.line),
+              ),
+              padding: EdgeInsets.symmetric(
+                horizontal: 1.6.w,
+                vertical: 1.2.h,
+              ),
+              child: Column(
+                crossAxisAlignment: CrossAxisAlignment.start,
+                spacing: 0.6.h,
+                children: [
+                  if (hasDescription)
+                    Text(
+                      clientInfo.description,
+                      style: theme.textTheme.bodyMedium?.copyWith(
+                        color: Palette.ink.withValues(alpha: 0.80),
+                        height: 1.5,
+                      ),
+                    ),
+                  if (hasVersion)
+                    Text(
+                      'v${clientInfo.version}',
+                      style: theme.textTheme.bodySmall?.copyWith(
+                        color: Palette.ink.withValues(alpha: 0.50),
+                      ),
+                    ),
+                ],
+              ),
+            ),
+          Row(
+            mainAxisAlignment: MainAxisAlignment.spaceEvenly,
+            children: [
+              Expanded(
+                child: OutlinedButton(
+                  onPressed: onDecline,
+                  style: OutlinedButton.styleFrom(
+                    foregroundColor: Palette.coral,
+                    side: BorderSide(
+                      color: Palette.coral.withValues(alpha: 0.50),
+                    ),
+                    shape: RoundedRectangleBorder(
+                      borderRadius: BorderRadius.circular(14),
+                    ),
+                    padding: EdgeInsets.symmetric(vertical: 1.4.h),
+                  ),
+                  child: const Text('Decline'),
+                ),
+              ),
+              Expanded(
+                child: FilledButton(
+                  onPressed: onAccept,
+                  style: FilledButton.styleFrom(
+                    backgroundColor: Palette.ink,
+                    foregroundColor: Palette.cream,
+                    shape: RoundedRectangleBorder(
+                      borderRadius: BorderRadius.circular(14),
+                    ),
+                    padding: EdgeInsets.symmetric(vertical: 1.4.h),
+                  ),
+                  child: const Text('Accept'),
+                ),
+              ),
+            ],
+          ),
+        ],
+      ),
+    );
+  }
+}
+
+String _shortPubkey(String base64Pubkey) {
+  if (base64Pubkey.length < 12) return base64Pubkey;
+  return '${base64Pubkey.substring(0, 8)}…${base64Pubkey.substring(base64Pubkey.length - 4)}';
+}

useragent/lib/screens/dashboard.dart

@@ -1,11 +1,15 @@
+import 'package:arbiter/features/callouts/callout_manager.dart';
+import 'package:arbiter/features/callouts/show_callout_list.dart';
 import 'package:arbiter/router.gr.dart';
+import 'package:arbiter/theme/palette.dart';
 import 'package:auto_route/auto_route.dart';
 import 'package:flutter/material.dart';
 import 'package:flutter_adaptive_scaffold/flutter_adaptive_scaffold.dart';
+import 'package:hooks_riverpod/hooks_riverpod.dart';
 
 const breakpoints = MaterialAdaptiveBreakpoints();
 
-final routes = [const EvmRoute(), const EvmGrantsRoute(), const AboutRoute()];
+final routes = [const EvmRoute(), const ClientsRoute(), const AboutRoute()];
 
 @RoutePage()
 class DashboardRouter extends StatelessWidget {
@@ -17,7 +21,6 @@ class DashboardRouter extends StatelessWidget {
       routes: routes,
       transitionBuilder: (context, child, animation) => FadeTransition(
         opacity: animation,
-        // the passed child is technically our animated selected-tab page
         child: child,
       ),
       builder: (context, child) {
@@ -31,9 +34,9 @@ class DashboardRouter extends StatelessWidget {
               label: "Wallets",
             ),
             NavigationDestination(
-              icon: Icon(Icons.rule_folder_outlined),
+              icon: Icon(Icons.devices_other_outlined),
-              selectedIcon: Icon(Icons.rule_folder),
+              selectedIcon: Icon(Icons.devices_other),
-              label: "Grants",
+              label: "Clients",
             ),
             NavigationDestination(
               icon: Icon(Icons.info_outline),
@@ -48,8 +51,54 @@ class DashboardRouter extends StatelessWidget {
           selectedIndex: currentActive,
           transitionDuration: const Duration(milliseconds: 800),
           internalAnimations: true,
+          trailingNavRail: const _CalloutBell(),
         );
       },
     );
   }
 }
+
+class _CalloutBell extends ConsumerWidget {
+  const _CalloutBell({super.key});
+
+  @override
+  Widget build(BuildContext context, WidgetRef ref) {
+    final count = ref.watch(
+      calloutManagerProvider.select((map) => map.length),
+    );
+
+    return IconButton(
+      onPressed: () => showCalloutList(context, ref),
+      icon: Stack(
+        clipBehavior: Clip.none,
+        children: [
+          Icon(
+            count > 0 ? Icons.notifications : Icons.notifications_outlined,
+            color: Palette.ink,
+          ),
+          if (count > 0)
+            Positioned(
+              top: -2,
+              right: -4,
+              child: Container(
+                padding: const EdgeInsets.symmetric(horizontal: 4, vertical: 1),
+                decoration: BoxDecoration(
+                  color: Colors.green,
+                  borderRadius: BorderRadius.circular(10),
+                ),
+                child: Text(
+                  count > 99 ? '99+' : '$count',
+                  style: const TextStyle(
+                    color: Colors.white,
+                    fontSize: 9,
+                    fontWeight: FontWeight.w800,
+                    height: 1.2,
+                  ),
+                ),
+              ),
+            ),
+        ],
+      ),
+    );
+  }
+}

useragent/lib/screens/dashboard/clients/details.dart

@@ -0,0 +1,17 @@
+
+import 'package:arbiter/proto/user_agent.pb.dart';
+import 'package:auto_route/auto_route.dart';
+import 'package:flutter/material.dart';
+import 'package:hooks_riverpod/hooks_riverpod.dart';
+
+@RoutePage()
+class ClientDetails extends ConsumerWidget {
+  final SdkClientEntry client;
+  const ClientDetails({super.key, required this.client});
+
+  @override
+  Widget build(BuildContext context, WidgetRef ref) {
+    throw UnimplementedError();
+  }
+
+}

useragent/lib/screens/dashboard/clients/details/client_details.dart

@@ -0,0 +1,56 @@
+import 'package:arbiter/providers/sdk_clients/details.dart';
+import 'package:arbiter/proto/user_agent.pb.dart';
+import 'package:arbiter/screens/dashboard/clients/details/widgets/client_details_content.dart';
+import 'package:arbiter/screens/dashboard/clients/details/widgets/client_details_state_panel.dart';
+import 'package:auto_route/auto_route.dart';
+import 'package:flutter/material.dart';
+import 'package:hooks_riverpod/hooks_riverpod.dart';
+
+@RoutePage()
+class ClientDetailsScreen extends ConsumerWidget {
+  const ClientDetailsScreen({super.key, @pathParam required this.clientId});
+
+  final int clientId;
+
+  @override
+  Widget build(BuildContext context, WidgetRef ref) {
+    final clientAsync = ref.watch(clientDetailsProvider(clientId));
+    return Scaffold(
+      body: SafeArea(
+        child: clientAsync.when(
+          data: (client) =>
+              _ClientDetailsState(clientId: clientId, client: client),
+          error: (error, _) => ClientDetailsStatePanel(
+            title: 'Client unavailable',
+            body: error.toString(),
+            icon: Icons.sync_problem,
+          ),
+          loading: () => const ClientDetailsStatePanel(
+            title: 'Loading client',
+            body: 'Pulling client details from Arbiter.',
+            icon: Icons.hourglass_top,
+          ),
+        ),
+      ),
+    );
+  }
+}
+
+class _ClientDetailsState extends StatelessWidget {
+  const _ClientDetailsState({required this.clientId, required this.client});
+
+  final int clientId;
+  final SdkClientEntry? client;
+
+  @override
+  Widget build(BuildContext context) {
+    if (client == null) {
+      return const ClientDetailsStatePanel(
+        title: 'Client not found',
+        body: 'The selected SDK client is no longer available.',
+        icon: Icons.person_off_outlined,
+      );
+    }
+    return ClientDetailsContent(clientId: clientId, client: client!);
+  }
+}

useragent/lib/screens/dashboard/clients/details/widgets/client_details_content.dart

@@ -0,0 +1,55 @@
+import 'package:arbiter/proto/user_agent.pb.dart';
+import 'package:arbiter/providers/sdk_clients/wallet_access.dart';
+import 'package:arbiter/screens/dashboard/clients/details/widgets/client_details_header.dart';
+import 'package:arbiter/screens/dashboard/clients/details/widgets/client_summary_card.dart';
+import 'package:arbiter/screens/dashboard/clients/details/widgets/wallet_access_save_bar.dart';
+import 'package:arbiter/screens/dashboard/clients/details/widgets/wallet_access_section.dart';
+import 'package:flutter/material.dart';
+import 'package:hooks_riverpod/experimental/mutation.dart';
+import 'package:hooks_riverpod/hooks_riverpod.dart';
+
+class ClientDetailsContent extends ConsumerWidget {
+  const ClientDetailsContent({
+    super.key,
+    required this.clientId,
+    required this.client,
+  });
+
+  final int clientId;
+  final SdkClientEntry client;
+
+  @override
+  Widget build(BuildContext context, WidgetRef ref) {
+    final state = ref.watch(clientWalletAccessControllerProvider(clientId));
+    final notifier = ref.read(
+      clientWalletAccessControllerProvider(clientId).notifier,
+    );
+    final saveMutation = ref.watch(saveClientWalletAccessMutation(clientId));
+    return ListView(
+      padding: const EdgeInsets.all(16),
+      children: [
+        const ClientDetailsHeader(),
+        const SizedBox(height: 16),
+        ClientSummaryCard(client: client),
+        const SizedBox(height: 16),
+        WalletAccessSection(
+          clientId: clientId,
+          state: state,
+          accessSelectionAsync: ref.watch(
+            clientWalletAccessSelectionProvider(clientId),
+          ),
+          isSavePending: saveMutation is MutationPending,
+          onSearchChanged: notifier.setSearchQuery,
+          onToggleWallet: notifier.toggleWallet,
+        ),
+        const SizedBox(height: 16),
+        WalletAccessSaveBar(
+          state: state,
+          saveMutation: saveMutation,
+          onDiscard: notifier.discardChanges,
+          onSave: () => executeSaveClientWalletAccess(ref, clientId: clientId),
+        ),
+      ],
+    );
+  }
+}

useragent/lib/screens/dashboard/clients/details/widgets/client_details_header.dart

@@ -0,0 +1,23 @@
+import 'package:flutter/material.dart';
+
+class ClientDetailsHeader extends StatelessWidget {
+  const ClientDetailsHeader({super.key});
+
+  @override
+  Widget build(BuildContext context) {
+    final theme = Theme.of(context);
+    return Row(
+      children: [
+        BackButton(onPressed: () => Navigator.of(context).maybePop()),
+        Expanded(
+          child: Text(
+            'Client Details',
+            style: theme.textTheme.headlineSmall?.copyWith(
+              fontWeight: FontWeight.w800,
+            ),
+          ),
+        ),
+      ],
+    );
+  }
+}

useragent/lib/screens/dashboard/clients/details/widgets/client_details_state_panel.dart

@@ -0,0 +1,45 @@
+import 'package:arbiter/theme/palette.dart';
+import 'package:flutter/material.dart';
+
+class ClientDetailsStatePanel extends StatelessWidget {
+  const ClientDetailsStatePanel({
+    super.key,
+    required this.title,
+    required this.body,
+    required this.icon,
+  });
+
+  final String title;
+  final String body;
+  final IconData icon;
+
+  @override
+  Widget build(BuildContext context) {
+    final theme = Theme.of(context);
+    return Center(
+      child: Padding(
+        padding: const EdgeInsets.all(24),
+        child: DecoratedBox(
+          decoration: BoxDecoration(
+            color: Palette.cream,
+            borderRadius: BorderRadius.circular(24),
+            border: Border.all(color: Palette.line),
+          ),
+          child: Padding(
+            padding: const EdgeInsets.all(24),
+            child: Column(
+              mainAxisSize: MainAxisSize.min,
+              children: [
+                Icon(icon, color: Palette.coral),
+                const SizedBox(height: 12),
+                Text(title, style: theme.textTheme.titleLarge),
+                const SizedBox(height: 8),
+                Text(body, textAlign: TextAlign.center),
+              ],
+            ),
+          ),
+        ),
+      ),
+    );
+  }
+}

useragent/lib/screens/dashboard/clients/details/widgets/client_summary_card.dart

@@ -0,0 +1,82 @@
+import 'package:arbiter/proto/user_agent.pb.dart';
+import 'package:arbiter/theme/palette.dart';
+import 'package:flutter/material.dart';
+
+class ClientSummaryCard extends StatelessWidget {
+  const ClientSummaryCard({super.key, required this.client});
+
+  final SdkClientEntry client;
+
+  @override
+  Widget build(BuildContext context) {
+    return DecoratedBox(
+      decoration: BoxDecoration(
+        color: Palette.cream,
+        borderRadius: BorderRadius.circular(24),
+        border: Border.all(color: Palette.line),
+      ),
+      child: Padding(
+        padding: const EdgeInsets.all(20),
+        child: Column(
+          crossAxisAlignment: CrossAxisAlignment.start,
+          children: [
+            Text(
+              client.info.name,
+              style: Theme.of(context).textTheme.titleLarge,
+            ),
+            const SizedBox(height: 8),
+            Text(client.info.description),
+            const SizedBox(height: 16),
+            Wrap(
+              runSpacing: 8,
+              spacing: 16,
+              children: [
+                _Fact(label: 'Client ID', value: '${client.id}'),
+                _Fact(label: 'Version', value: client.info.version),
+                _Fact(
+                  label: 'Registered',
+                  value: _formatDate(client.createdAt),
+                ),
+                _Fact(label: 'Pubkey', value: _shortPubkey(client.pubkey)),
+              ],
+            ),
+          ],
+        ),
+      ),
+    );
+  }
+}
+
+class _Fact extends StatelessWidget {
+  const _Fact({required this.label, required this.value});
+
+  final String label;
+  final String value;
+
+  @override
+  Widget build(BuildContext context) {
+    final theme = Theme.of(context);
+    return Column(
+      crossAxisAlignment: CrossAxisAlignment.start,
+      children: [
+        Text(label, style: theme.textTheme.labelMedium),
+        Text(value.isEmpty ? '—' : value, style: theme.textTheme.bodyMedium),
+      ],
+    );
+  }
+}
+
+String _formatDate(int unixSecs) {
+  final dt = DateTime.fromMillisecondsSinceEpoch(unixSecs * 1000).toLocal();
+  return '${dt.year}-${dt.month.toString().padLeft(2, '0')}-${dt.day.toString().padLeft(2, '0')}';
+}
+
+String _shortPubkey(List<int> bytes) {
+  final hex = bytes
+      .map((byte) => byte.toRadixString(16).padLeft(2, '0'))
+      .join();
+  if (hex.length < 12) {
+    return '0x$hex';
+  }
+  return '0x${hex.substring(0, 8)}...${hex.substring(hex.length - 4)}';
+}

useragent/lib/screens/dashboard/clients/details/widgets/wallet_access_list.dart

@@ -0,0 +1,33 @@
+import 'package:arbiter/providers/sdk_clients/wallet_access.dart';
+import 'package:arbiter/screens/dashboard/clients/details/widgets/wallet_access_tile.dart';
+import 'package:flutter/material.dart';
+
+class WalletAccessList extends StatelessWidget {
+  const WalletAccessList({
+    super.key,
+    required this.options,
+    required this.selectedWalletIds,
+    required this.enabled,
+    required this.onToggleWallet,
+  });
+
+  final List<ClientWalletOption> options;
+  final Set<int> selectedWalletIds;
+  final bool enabled;
+  final ValueChanged<int> onToggleWallet;
+
+  @override
+  Widget build(BuildContext context) {
+    return Column(
+      children: [
+        for (final option in options)
+          WalletAccessTile(
+            option: option,
+            value: selectedWalletIds.contains(option.walletId),
+            enabled: enabled,
+            onChanged: () => onToggleWallet(option.walletId),
+          ),
+      ],
+    );
+  }
+}

useragent/lib/screens/dashboard/clients/details/widgets/wallet_access_save_bar.dart

@@ -0,0 +1,60 @@
+import 'package:arbiter/providers/sdk_clients/wallet_access.dart';
+import 'package:arbiter/theme/palette.dart';
+import 'package:flutter/material.dart';
+import 'package:hooks_riverpod/experimental/mutation.dart';
+
+class WalletAccessSaveBar extends StatelessWidget {
+  const WalletAccessSaveBar({
+    super.key,
+    required this.state,
+    required this.saveMutation,
+    required this.onDiscard,
+    required this.onSave,
+  });
+
+  final ClientWalletAccessState state;
+  final MutationState<void> saveMutation;
+  final VoidCallback onDiscard;
+  final Future<void> Function() onSave;
+
+  @override
+  Widget build(BuildContext context) {
+    final isPending = saveMutation is MutationPending;
+    final errorText = switch (saveMutation) {
+      MutationError(:final error) => error.toString(),
+      _ => null,
+    };
+    return DecoratedBox(
+      decoration: BoxDecoration(
+        color: Palette.cream,
+        borderRadius: BorderRadius.circular(24),
+        border: Border.all(color: Palette.line),
+      ),
+      child: Padding(
+        padding: const EdgeInsets.all(16),
+        child: Column(
+          crossAxisAlignment: CrossAxisAlignment.start,
+          children: [
+            if (errorText != null) ...[
+              Text(errorText, style: TextStyle(color: Palette.coral)),
+              const SizedBox(height: 12),
+            ],
+            Row(
+              children: [
+                TextButton(
+                  onPressed: state.hasChanges && !isPending ? onDiscard : null,
+                  child: const Text('Reset'),
+                ),
+                const Spacer(),
+                FilledButton(
+                  onPressed: state.hasChanges && !isPending ? onSave : null,
+                  child: Text(isPending ? 'Saving...' : 'Save changes'),
+                ),
+              ],
+            ),
+          ],
+        ),
+      ),
+    );
+  }
+}