docs(service): clarify ACL setup requirements for service and interactive user access

.claude/memory/feedback_widget_decomposition.md

@@ -0,0 +1,11 @@
+---
+name: Widget decomposition and provider subscriptions
+description: Prefer splitting screens into multiple focused files/widgets; each widget subscribes to its own relevant providers
+type: feedback
+---
+
+Split screens into multiple smaller widgets across multiple files. Each widget should subscribe only to the providers it needs (`ref.watch` at lowest possible level), rather than having one large screen widget that watches everything and passes data down as parameters.
+
+**Why:** Reduces unnecessary rebuilds; improves readability; each file has one clear responsibility.
+
+**How to apply:** When building a new screen, identify which sub-widgets need their own provider subscriptions and extract them into separate files (e.g., `widgets/grant_card.dart` watches enrichment providers itself, rather than the screen doing it and passing resolved strings down).

.gitignore

@@ -3,3 +3,4 @@ scripts/__pycache__/
 .DS_Store
 .cargo/config.toml
 .vscode/
+docs/

AGENTS.md

@@ -67,7 +67,7 @@ The server is actor-based using the **kameo** crate. All long-lived state lives
 
 - **`Bootstrapper`** — Manages the one-time bootstrap token written to `~/.arbiter/bootstrap_token` on first run.
 - **`KeyHolder`** — Holds the encrypted root key and manages the Sealed/Unsealed vault state machine. On unseal, decrypts the root key into a `memsafe` hardened memory cell.
-- **`MessageRouter`** — Coordinates streaming messages between user agents and SDK clients.
+- **`FlowCoordinator`** — Coordinates cross-connection flow between user agents and SDK clients.
 - **`EvmActor`** — Handles EVM transaction policy enforcement and signing.
 
 Per-connection actors live under `actors/user_agent/` and `actors/client/`, each with `auth` (challenge-response authentication) and `session` (post-auth operations) sub-modules.

CLAUDE.md

@@ -67,7 +67,7 @@ The server is actor-based using the **kameo** crate. All long-lived state lives
 
 - **`Bootstrapper`** — Manages the one-time bootstrap token written to `~/.arbiter/bootstrap_token` on first run.
 - **`KeyHolder`** — Holds the encrypted root key and manages the Sealed/Unsealed vault state machine. On unseal, decrypts the root key into a `memsafe` hardened memory cell.
-- **`MessageRouter`** — Coordinates streaming messages between user agents and SDK clients.
+- **`FlowCoordinator`** — Coordinates cross-connection flow between user agents and SDK clients.
 - **`EvmActor`** — Handles EVM transaction policy enforcement and signing.
 
 Per-connection actors live under `actors/user_agent/` and `actors/client/`, each with `auth` (challenge-response authentication) and `session` (post-auth operations) sub-modules.

docs/superpowers/plans/2026-03-28-grant-grid-view.md

@@ -0,0 +1,821 @@
+# Grant Grid View Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Add an "EVM Grants" dashboard tab that displays all grants as enriched cards (type, chain, wallet address, client name) with per-card revoke support.
+
+**Architecture:** A new `walletAccessListProvider` fetches wallet accesses with their DB row IDs. The screen (`grants.dart`) watches only `evmGrantsProvider` for top-level state. Each `GrantCard` widget (its own file) watches enrichment providers (`walletAccessListProvider`, `evmProvider`, `sdkClientsProvider`) and the revoke mutation directly — keeping rebuilds scoped to the card. The screen is registered as a dashboard tab in `AdaptiveScaffold`.
+
+**Tech Stack:** Flutter, Riverpod (`riverpod_annotation` + `build_runner` codegen), `sizer` (adaptive sizing), `auto_route`, Protocol Buffers (Dart), `Palette` design tokens.
+
+---
+
+## File Map
+
+| File | Action | Responsibility |
+|---|---|---|
+| `useragent/lib/theme/palette.dart` | Modify | Add `Palette.token` (indigo accent for token-transfer cards) |
+| `useragent/lib/features/connection/evm/wallet_access.dart` | Modify | Add `listAllWalletAccesses()` function |
+| `useragent/lib/providers/sdk_clients/wallet_access_list.dart` | Create | `WalletAccessListProvider` — fetches full wallet access list with IDs |
+| `useragent/lib/screens/dashboard/evm/grants/widgets/grant_card.dart` | Create | `GrantCard` widget — watches enrichment providers + revoke mutation; one card per grant |
+| `useragent/lib/screens/dashboard/evm/grants/grants.dart` | Create | `EvmGrantsScreen` — watches `evmGrantsProvider`; handles loading/error/empty/data states; renders `GrantCard` list |
+| `useragent/lib/router.dart` | Modify | Register `EvmGrantsRoute` in dashboard children |
+| `useragent/lib/screens/dashboard.dart` | Modify | Add Grants entry to `routes` list and `NavigationDestination` list |
+
+---
+
+## Task 1: Add `Palette.token`
+
+**Files:**
+- Modify: `useragent/lib/theme/palette.dart`
+
+- [ ] **Step 1: Add the color**
+
+Replace the contents of `useragent/lib/theme/palette.dart` with:
+
+```dart
+import 'package:flutter/material.dart';
+
+class Palette {
+  static const ink = Color(0xFF15263C);
+  static const coral = Color(0xFFE26254);
+  static const cream = Color(0xFFFFFAF4);
+  static const line = Color(0x1A15263C);
+  static const token = Color(0xFF5C6BC0);
+}
+```
+
+- [ ] **Step 2: Verify**
+
+```sh
+cd useragent && flutter analyze lib/theme/palette.dart
+```
+
+Expected: no issues.
+
+- [ ] **Step 3: Commit**
+
+```sh
+jj describe -m "feat(theme): add Palette.token for token-transfer grant cards"
+jj new
+```
+
+---
+
+## Task 2: Add `listAllWalletAccesses` feature function
+
+**Files:**
+- Modify: `useragent/lib/features/connection/evm/wallet_access.dart`
+
+`readClientWalletAccess` (existing) filters the list to one client's wallet IDs and returns `Set<int>`. This new function returns the complete unfiltered list with row IDs so the grant cards can resolve wallet_access_id → wallet + client.
+
+- [ ] **Step 1: Append function**
+
+Add at the bottom of `useragent/lib/features/connection/evm/wallet_access.dart`:
+
+```dart
+Future<List<SdkClientWalletAccess>> listAllWalletAccesses(
+  Connection connection,
+) async {
+  final response = await connection.ask(
+    UserAgentRequest(listWalletAccess: Empty()),
+  );
+  if (!response.hasListWalletAccessResponse()) {
+    throw Exception(
+      'Expected list wallet access response, got ${response.whichPayload()}',
+    );
+  }
+  return response.listWalletAccessResponse.accesses.toList(growable: false);
+}
+```
+
+Each returned `SdkClientWalletAccess` has:
+- `.id` — the `evm_wallet_access` row ID (same value as `wallet_access_id` in a `GrantEntry`)
+- `.access.walletId` — the EVM wallet DB ID
+- `.access.sdkClientId` — the SDK client DB ID
+
+- [ ] **Step 2: Verify**
+
+```sh
+cd useragent && flutter analyze lib/features/connection/evm/wallet_access.dart
+```
+
+Expected: no issues.
+
+- [ ] **Step 3: Commit**
+
+```sh
+jj describe -m "feat(evm): add listAllWalletAccesses feature function"
+jj new
+```
+
+---
+
+## Task 3: Create `WalletAccessListProvider`
+
+**Files:**
+- Create: `useragent/lib/providers/sdk_clients/wallet_access_list.dart`
+- Generated: `useragent/lib/providers/sdk_clients/wallet_access_list.g.dart`
+
+Mirrors the structure of `EvmGrants` in `providers/evm/evm_grants.dart` — class-based `@riverpod` with a `refresh()` method.
+
+- [ ] **Step 1: Write the provider**
+
+Create `useragent/lib/providers/sdk_clients/wallet_access_list.dart`:
+
+```dart
+import 'package:arbiter/features/connection/evm/wallet_access.dart';
+import 'package:arbiter/proto/user_agent.pb.dart';
+import 'package:arbiter/providers/connection/connection_manager.dart';
+import 'package:mtcore/markettakers.dart';
+import 'package:riverpod_annotation/riverpod_annotation.dart';
+
+part 'wallet_access_list.g.dart';
+
+@riverpod
+class WalletAccessList extends _$WalletAccessList {
+  @override
+  Future<List<SdkClientWalletAccess>?> build() async {
+    final connection = await ref.watch(connectionManagerProvider.future);
+    if (connection == null) {
+      return null;
+    }
+
+    try {
+      return await listAllWalletAccesses(connection);
+    } catch (e, st) {
+      talker.handle(e, st);
+      rethrow;
+    }
+  }
+
+  Future<void> refresh() async {
+    final connection = await ref.read(connectionManagerProvider.future);
+    if (connection == null) {
+      state = const AsyncData(null);
+      return;
+    }
+
+    state = const AsyncLoading();
+    state = await AsyncValue.guard(() => listAllWalletAccesses(connection));
+  }
+}
+```
+
+- [ ] **Step 2: Run code generation**
+
+```sh
+cd useragent && dart run build_runner build --delete-conflicting-outputs
+```
+
+Expected: `useragent/lib/providers/sdk_clients/wallet_access_list.g.dart` created. No errors.
+
+- [ ] **Step 3: Verify**
+
+```sh
+cd useragent && flutter analyze lib/providers/sdk_clients/
+```
+
+Expected: no issues.
+
+- [ ] **Step 4: Commit**
+
+```sh
+jj describe -m "feat(providers): add WalletAccessListProvider"
+jj new
+```
+
+---
+
+## Task 4: Create `GrantCard` widget
+
+**Files:**
+- Create: `useragent/lib/screens/dashboard/evm/grants/widgets/grant_card.dart`
+
+This widget owns all per-card logic: enrichment lookups, revoke action, and rebuild scope. The screen only passes it a `GrantEntry` — the card fetches everything else itself.
+
+**Key types:**
+- `GrantEntry` (from `proto/evm.pb.dart`): `.id`, `.shared.walletAccessId`, `.shared.chainId`, `.specific.whichGrant()`
+- `SpecificGrant_Grant.etherTransfer` / `.tokenTransfer` — enum values for the oneof
+- `SdkClientWalletAccess` (from `proto/user_agent.pb.dart`): `.id`, `.access.walletId`, `.access.sdkClientId`
+- `WalletEntry` (from `proto/evm.pb.dart`): `.id`, `.address` (List<int>)
+- `SdkClientEntry` (from `proto/user_agent.pb.dart`): `.id`, `.info.name`
+- `revokeEvmGrantMutation` — `Mutation<void>` (global; all revoke buttons disable together while any revoke is in flight)
+- `executeRevokeEvmGrant(ref, grantId: int)` — `Future<void>`
+
+- [ ] **Step 1: Write the widget**
+
+Create `useragent/lib/screens/dashboard/evm/grants/widgets/grant_card.dart`:
+
+```dart
+import 'package:arbiter/proto/evm.pb.dart';
+import 'package:arbiter/proto/user_agent.pb.dart';
+import 'package:arbiter/providers/evm/evm.dart';
+import 'package:arbiter/providers/evm/evm_grants.dart';
+import 'package:arbiter/providers/sdk_clients/list.dart';
+import 'package:arbiter/providers/sdk_clients/wallet_access_list.dart';
+import 'package:arbiter/theme/palette.dart';
+import 'package:flutter/material.dart';
+import 'package:hooks_riverpod/experimental/mutation.dart';
+import 'package:hooks_riverpod/hooks_riverpod.dart';
+import 'package:sizer/sizer.dart';
+
+String _shortAddress(List<int> bytes) {
+  final hex = bytes.map((b) => b.toRadixString(16).padLeft(2, '0')).join();
+  return '0x${hex.substring(0, 6)}...${hex.substring(hex.length - 4)}';
+}
+
+String _formatError(Object error) {
+  final message = error.toString();
+  if (message.startsWith('Exception: ')) {
+    return message.substring('Exception: '.length);
+  }
+  return message;
+}
+
+class GrantCard extends ConsumerWidget {
+  const GrantCard({super.key, required this.grant});
+
+  final GrantEntry grant;
+
+  @override
+  Widget build(BuildContext context, WidgetRef ref) {
+    // Enrichment lookups — each watch scopes rebuilds to this card only
+    final walletAccesses =
+        ref.watch(walletAccessListProvider).asData?.value ?? const [];
+    final wallets = ref.watch(evmProvider).asData?.value ?? const [];
+    final clients = ref.watch(sdkClientsProvider).asData?.value ?? const [];
+    final revoking = ref.watch(revokeEvmGrantMutation) is MutationPending;
+
+    final isEther =
+        grant.specific.whichGrant() == SpecificGrant_Grant.etherTransfer;
+    final accent = isEther ? Palette.coral : Palette.token;
+    final typeLabel = isEther ? 'Ether' : 'Token';
+    final theme = Theme.of(context);
+    final muted = Palette.ink.withValues(alpha: 0.62);
+
+    // Resolve wallet_access_id → wallet address + client name
+    final accessById = <int, SdkClientWalletAccess>{
+      for (final a in walletAccesses) a.id: a,
+    };
+    final walletById = <int, WalletEntry>{
+      for (final w in wallets) w.id: w,
+    };
+    final clientNameById = <int, String>{
+      for (final c in clients) c.id: c.info.name,
+    };
+
+    final accessId = grant.shared.walletAccessId;
+    final access = accessById[accessId];
+    final wallet = access != null ? walletById[access.access.walletId] : null;
+
+    final walletLabel = wallet != null
+        ? _shortAddress(wallet.address)
+        : 'Access #$accessId';
+
+    final clientLabel = () {
+      if (access == null) return '';
+      final name = clientNameById[access.access.sdkClientId] ?? '';
+      return name.isEmpty ? 'Client #${access.access.sdkClientId}' : name;
+    }();
+
+    void showError(String message) {
+      if (!context.mounted) return;
+      ScaffoldMessenger.of(context).showSnackBar(
+        SnackBar(content: Text(message), behavior: SnackBarBehavior.floating),
+      );
+    }
+
+    Future<void> revoke() async {
+      try {
+        await executeRevokeEvmGrant(ref, grantId: grant.id);
+      } catch (e) {
+        showError(_formatError(e));
+      }
+    }
+
+    return Container(
+      decoration: BoxDecoration(
+        borderRadius: BorderRadius.circular(24),
+        color: Palette.cream.withValues(alpha: 0.92),
+        border: Border.all(color: Palette.line),
+      ),
+      child: IntrinsicHeight(
+        child: Row(
+          crossAxisAlignment: CrossAxisAlignment.stretch,
+          children: [
+            // Accent strip
+            Container(
+              width: 0.8.w,
+              decoration: BoxDecoration(
+                color: accent,
+                borderRadius: const BorderRadius.horizontal(
+                  left: Radius.circular(24),
+                ),
+              ),
+            ),
+            // Card body
+            Expanded(
+              child: Padding(
+                padding: EdgeInsets.symmetric(
+                  horizontal: 1.6.w,
+                  vertical: 1.4.h,
+                ),
+                child: Column(
+                  crossAxisAlignment: CrossAxisAlignment.start,
+                  children: [
+                    // Row 1: type badge · chain · spacer · revoke button
+                    Row(
+                      children: [
+                        Container(
+                          padding: EdgeInsets.symmetric(
+                            horizontal: 1.w,
+                            vertical: 0.4.h,
+                          ),
+                          decoration: BoxDecoration(
+                            color: accent.withValues(alpha: 0.15),
+                            borderRadius: BorderRadius.circular(8),
+                          ),
+                          child: Text(
+                            typeLabel,
+                            style: theme.textTheme.labelSmall?.copyWith(
+                              color: accent,
+                              fontWeight: FontWeight.w800,
+                            ),
+                          ),
+                        ),
+                        SizedBox(width: 1.w),
+                        Container(
+                          padding: EdgeInsets.symmetric(
+                            horizontal: 1.w,
+                            vertical: 0.4.h,
+                          ),
+                          decoration: BoxDecoration(
+                            color: Palette.ink.withValues(alpha: 0.06),
+                            borderRadius: BorderRadius.circular(8),
+                          ),
+                          child: Text(
+                            'Chain ${grant.shared.chainId}',
+                            style: theme.textTheme.labelSmall?.copyWith(
+                              color: muted,
+                              fontWeight: FontWeight.w700,
+                            ),
+                          ),
+                        ),
+                        const Spacer(),
+                        if (revoking)
+                          SizedBox(
+                            width: 1.8.h,
+                            height: 1.8.h,
+                            child: CircularProgressIndicator(
+                              strokeWidth: 2,
+                              color: Palette.coral,
+                            ),
+                          )
+                        else
+                          OutlinedButton.icon(
+                            onPressed: revoke,
+                            style: OutlinedButton.styleFrom(
+                              foregroundColor: Palette.coral,
+                              side: BorderSide(
+                                color: Palette.coral.withValues(alpha: 0.4),
+                              ),
+                              padding: EdgeInsets.symmetric(
+                                horizontal: 1.w,
+                                vertical: 0.6.h,
+                              ),
+                              shape: RoundedRectangleBorder(
+                                borderRadius: BorderRadius.circular(10),
+                              ),
+                            ),
+                            icon: const Icon(Icons.block_rounded, size: 16),
+                            label: const Text('Revoke'),
+                          ),
+                      ],
+                    ),
+                    SizedBox(height: 0.8.h),
+                    // Row 2: wallet address · client name
+                    Row(
+                      children: [
+                        Text(
+                          walletLabel,
+                          style: theme.textTheme.bodySmall?.copyWith(
+                            color: Palette.ink,
+                            fontFamily: 'monospace',
+                          ),
+                        ),
+                        Padding(
+                          padding: EdgeInsets.symmetric(horizontal: 0.8.w),
+                          child: Text(
+                            '·',
+                            style: theme.textTheme.bodySmall
+                                ?.copyWith(color: muted),
+                          ),
+                        ),
+                        Expanded(
+                          child: Text(
+                            clientLabel,
+                            maxLines: 1,
+                            overflow: TextOverflow.ellipsis,
+                            style: theme.textTheme.bodySmall
+                                ?.copyWith(color: muted),
+                          ),
+                        ),
+                      ],
+                    ),
+                  ],
+                ),
+              ),
+            ),
+          ],
+        ),
+      ),
+    );
+  }
+}
+```
+
+- [ ] **Step 2: Verify**
+
+```sh
+cd useragent && flutter analyze lib/screens/dashboard/evm/grants/widgets/grant_card.dart
+```
+
+Expected: no issues.
+
+- [ ] **Step 3: Commit**
+
+```sh
+jj describe -m "feat(grants): add GrantCard widget with self-contained enrichment"
+jj new
+```
+
+---
+
+## Task 5: Create `EvmGrantsScreen`
+
+**Files:**
+- Create: `useragent/lib/screens/dashboard/evm/grants/grants.dart`
+
+The screen watches only `evmGrantsProvider` for top-level state (loading / error / no connection / empty / data). When there is data it renders a list of `GrantCard` widgets — each card manages its own enrichment subscriptions.
+
+- [ ] **Step 1: Write the screen**
+
+Create `useragent/lib/screens/dashboard/evm/grants/grants.dart`:
+
+```dart
+import 'package:arbiter/proto/evm.pb.dart';
+import 'package:arbiter/providers/evm/evm_grants.dart';
+import 'package:arbiter/providers/sdk_clients/wallet_access_list.dart';
+import 'package:arbiter/router.gr.dart';
+import 'package:arbiter/screens/dashboard/evm/grants/widgets/grant_card.dart';
+import 'package:arbiter/theme/palette.dart';
+import 'package:arbiter/widgets/page_header.dart';
+import 'package:auto_route/auto_route.dart';
+import 'package:flutter/material.dart';
+import 'package:hooks_riverpod/hooks_riverpod.dart';
+import 'package:sizer/sizer.dart';
+
+String _formatError(Object error) {
+  final message = error.toString();
+  if (message.startsWith('Exception: ')) {
+    return message.substring('Exception: '.length);
+  }
+  return message;
+}
+
+// ─── State panel ──────────────────────────────────────────────────────────────
+
+class _StatePanel extends StatelessWidget {
+  const _StatePanel({
+    required this.icon,
+    required this.title,
+    required this.body,
+    this.actionLabel,
+    this.onAction,
+    this.busy = false,
+  });
+
+  final IconData icon;
+  final String title;
+  final String body;
+  final String? actionLabel;
+  final Future<void> Function()? onAction;
+  final bool busy;
+
+  @override
+  Widget build(BuildContext context) {
+    final theme = Theme.of(context);
+
+    return Container(
+      decoration: BoxDecoration(
+        borderRadius: BorderRadius.circular(24),
+        color: Palette.cream.withValues(alpha: 0.92),
+        border: Border.all(color: Palette.line),
+      ),
+      child: Padding(
+        padding: EdgeInsets.all(2.8.h),
+        child: Column(
+          crossAxisAlignment: CrossAxisAlignment.start,
+          children: [
+            if (busy)
+              SizedBox(
+                width: 2.8.h,
+                height: 2.8.h,
+                child: const CircularProgressIndicator(strokeWidth: 2.5),
+              )
+            else
+              Icon(icon, size: 34, color: Palette.coral),
+            SizedBox(height: 1.8.h),
+            Text(
+              title,
+              style: theme.textTheme.headlineSmall?.copyWith(
+                color: Palette.ink,
+                fontWeight: FontWeight.w800,
+              ),
+            ),
+            SizedBox(height: 1.h),
+            Text(
+              body,
+              style: theme.textTheme.bodyLarge?.copyWith(
+                color: Palette.ink.withValues(alpha: 0.72),
+                height: 1.5,
+              ),
+            ),
+            if (actionLabel != null && onAction != null) ...[
+              SizedBox(height: 2.h),
+              OutlinedButton.icon(
+                onPressed: () => onAction!(),
+                icon: const Icon(Icons.refresh),
+                label: Text(actionLabel!),
+              ),
+            ],
+          ],
+        ),
+      ),
+    );
+  }
+}
+
+// ─── Grant list ───────────────────────────────────────────────────────────────
+
+class _GrantList extends StatelessWidget {
+  const _GrantList({required this.grants});
+
+  final List<GrantEntry> grants;
+
+  @override
+  Widget build(BuildContext context) {
+    return Column(
+      children: [
+        for (var i = 0; i < grants.length; i++)
+          Padding(
+            padding: EdgeInsets.only(
+              bottom: i == grants.length - 1 ? 0 : 1.8.h,
+            ),
+            child: GrantCard(grant: grants[i]),
+          ),
+      ],
+    );
+  }
+}
+
+// ─── Screen ───────────────────────────────────────────────────────────────────
+
+@RoutePage()
+class EvmGrantsScreen extends ConsumerWidget {
+  const EvmGrantsScreen({super.key});
+
+  @override
+  Widget build(BuildContext context, WidgetRef ref) {
+    // Screen watches only the grant list for top-level state decisions
+    final grantsAsync = ref.watch(evmGrantsProvider);
+
+    Future<void> refresh() async {
+      await Future.wait([
+        ref.read(evmGrantsProvider.notifier).refresh(),
+        ref.read(walletAccessListProvider.notifier).refresh(),
+      ]);
+    }
+
+    void showMessage(String message) {
+      if (!context.mounted) return;
+      ScaffoldMessenger.of(context).showSnackBar(
+        SnackBar(content: Text(message), behavior: SnackBarBehavior.floating),
+      );
+    }
+
+    Future<void> safeRefresh() async {
+      try {
+        await refresh();
+      } catch (e) {
+        showMessage(_formatError(e));
+      }
+    }
+
+    final grantsState = grantsAsync.asData?.value;
+    final grants = grantsState?.grants;
+
+    final content = switch (grantsAsync) {
+      AsyncLoading() when grantsState == null => const _StatePanel(
+        icon: Icons.hourglass_top,
+        title: 'Loading grants',
+        body: 'Pulling grant registry from Arbiter.',
+        busy: true,
+      ),
+      AsyncError(:final error) => _StatePanel(
+        icon: Icons.sync_problem,
+        title: 'Grant registry unavailable',
+        body: _formatError(error),
+        actionLabel: 'Retry',
+        onAction: safeRefresh,
+      ),
+      AsyncData(:final value) when value == null => _StatePanel(
+        icon: Icons.portable_wifi_off,
+        title: 'No active server connection',
+        body: 'Reconnect to Arbiter to list EVM grants.',
+        actionLabel: 'Refresh',
+        onAction: safeRefresh,
+      ),
+      _ when grants != null && grants.isEmpty => _StatePanel(
+        icon: Icons.policy_outlined,
+        title: 'No grants yet',
+        body: 'Create a grant to allow SDK clients to sign transactions.',
+        actionLabel: 'Create grant',
+        onAction: () => context.router.push(const CreateEvmGrantRoute()),
+      ),
+      _ => _GrantList(grants: grants ?? const []),
+    };
+
+    return Scaffold(
+      body: SafeArea(
+        child: RefreshIndicator.adaptive(
+          color: Palette.ink,
+          backgroundColor: Colors.white,
+          onRefresh: safeRefresh,
+          child: ListView(
+            physics: const BouncingScrollPhysics(
+              parent: AlwaysScrollableScrollPhysics(),
+            ),
+            padding: EdgeInsets.fromLTRB(2.4.w, 2.4.h, 2.4.w, 3.2.h),
+            children: [
+              PageHeader(
+                title: 'EVM Grants',
+                isBusy: grantsAsync.isLoading,
+                actions: [
+                  FilledButton.icon(
+                    onPressed: () =>
+                        context.router.push(const CreateEvmGrantRoute()),
+                    icon: const Icon(Icons.add_rounded),
+                    label: const Text('Create grant'),
+                  ),
+                  SizedBox(width: 1.w),
+                  OutlinedButton.icon(
+                    onPressed: safeRefresh,
+                    style: OutlinedButton.styleFrom(
+                      foregroundColor: Palette.ink,
+                      side: BorderSide(color: Palette.line),
+                      padding: EdgeInsets.symmetric(
+                        horizontal: 1.4.w,
+                        vertical: 1.2.h,
+                      ),
+                      shape: RoundedRectangleBorder(
+                        borderRadius: BorderRadius.circular(14),
+                      ),
+                    ),
+                    icon: const Icon(Icons.refresh, size: 18),
+                    label: const Text('Refresh'),
+                  ),
+                ],
+              ),
+              SizedBox(height: 1.8.h),
+              content,
+            ],
+          ),
+        ),
+      ),
+    );
+  }
+}
+```
+
+- [ ] **Step 2: Verify**
+
+```sh
+cd useragent && flutter analyze lib/screens/dashboard/evm/grants/
+```
+
+Expected: no issues.
+
+- [ ] **Step 3: Commit**
+
+```sh
+jj describe -m "feat(grants): add EvmGrantsScreen"
+jj new
+```
+
+---
+
+## Task 6: Wire router and dashboard tab
+
+**Files:**
+- Modify: `useragent/lib/router.dart`
+- Modify: `useragent/lib/screens/dashboard.dart`
+- Regenerated: `useragent/lib/router.gr.dart`
+
+- [ ] **Step 1: Add route to `router.dart`**
+
+Replace the contents of `useragent/lib/router.dart` with:
+
+```dart
+import 'package:auto_route/auto_route.dart';
+
+import 'router.gr.dart';
+
+@AutoRouterConfig(generateForDir: ['lib/screens'])
+class Router extends RootStackRouter {
+  @override
+  List<AutoRoute> get routes => [
+    AutoRoute(page: Bootstrap.page, path: '/bootstrap', initial: true),
+    AutoRoute(page: ServerInfoSetupRoute.page, path: '/server-info'),
+    AutoRoute(page: ServerConnectionRoute.page, path: '/server-connection'),
+    AutoRoute(page: VaultSetupRoute.page, path: '/vault'),
+    AutoRoute(page: ClientDetailsRoute.page, path: '/clients/:clientId'),
+    AutoRoute(page: CreateEvmGrantRoute.page, path: '/evm-grants/create'),
+
+    AutoRoute(
+      page: DashboardRouter.page,
+      path: '/dashboard',
+      children: [
+        AutoRoute(page: EvmRoute.page, path: 'evm'),
+        AutoRoute(page: ClientsRoute.page, path: 'clients'),
+        AutoRoute(page: EvmGrantsRoute.page, path: 'grants'),
+        AutoRoute(page: AboutRoute.page, path: 'about'),
+      ],
+    ),
+  ];
+}
+```
+
+- [ ] **Step 2: Update `dashboard.dart`**
+
+In `useragent/lib/screens/dashboard.dart`, replace the `routes` constant:
+
+```dart
+final routes = [
+  const EvmRoute(),
+  const ClientsRoute(),
+  const EvmGrantsRoute(),
+  const AboutRoute(),
+];
+```
+
+And replace the `destinations` list inside `AdaptiveScaffold`:
+
+```dart
+destinations: const [
+  NavigationDestination(
+    icon: Icon(Icons.account_balance_wallet_outlined),
+    selectedIcon: Icon(Icons.account_balance_wallet),
+    label: 'Wallets',
+  ),
+  NavigationDestination(
+    icon: Icon(Icons.devices_other_outlined),
+    selectedIcon: Icon(Icons.devices_other),
+    label: 'Clients',
+  ),
+  NavigationDestination(
+    icon: Icon(Icons.policy_outlined),
+    selectedIcon: Icon(Icons.policy),
+    label: 'Grants',
+  ),
+  NavigationDestination(
+    icon: Icon(Icons.info_outline),
+    selectedIcon: Icon(Icons.info),
+    label: 'About',
+  ),
+],
+```
+
+- [ ] **Step 3: Regenerate router**
+
+```sh
+cd useragent && dart run build_runner build --delete-conflicting-outputs
+```
+
+Expected: `lib/router.gr.dart` updated, `EvmGrantsRoute` now available, no errors.
+
+- [ ] **Step 4: Full project verify**
+
+```sh
+cd useragent && flutter analyze
+```
+
+Expected: no issues.
+
+- [ ] **Step 5: Commit**
+
+```sh
+jj describe -m "feat(nav): add Grants dashboard tab"
+jj new
+```

docs/superpowers/specs/2026-03-28-grant-grid-view-design.md

@@ -0,0 +1,170 @@
+# Grant Grid View — Design Spec
+
+**Date:** 2026-03-28
+
+## Overview
+
+Add a "Grants" dashboard tab to the Flutter user-agent app that displays all EVM grants as a card-based grid. Each card shows a compact summary (type, chain, wallet address, client name) with a revoke action. The tab integrates into the existing `AdaptiveScaffold` navigation alongside Wallets, Clients, and About.
+
+## Scope
+
+- New `walletAccessListProvider` for fetching wallet access entries with their DB row IDs
+- New `EvmGrantsScreen` as a dashboard tab
+- Grant card widget with enriched display (type, chain, wallet, client)
+- Revoke action wired to existing `executeRevokeEvmGrant` mutation
+- Dashboard tab bar and router updated
+- New token-transfer accent color added to `Palette`
+
+**Out of scope:** Fixing grant creation (separate task).
+
+---
+
+## Data Layer
+
+### `walletAccessListProvider`
+
+**File:** `useragent/lib/providers/sdk_clients/wallet_access_list.dart`
+
+- `@riverpod` class, watches `connectionManagerProvider.future`
+- Returns `List<SdkClientWalletAccess>?` (null when not connected)
+- Each entry: `.id` (wallet_access_id), `.access.walletId`, `.access.sdkClientId`
+- Exposes a `refresh()` method following the same pattern as `EvmGrants.refresh()`
+
+### Enrichment at render time (Approach A)
+
+The `EvmGrantsScreen` watches four providers:
+1. `evmGrantsProvider` — the grant list
+2. `walletAccessListProvider` — to resolve wallet_access_id → (wallet_id, sdk_client_id)
+3. `evmProvider` — to resolve wallet_id → wallet address
+4. `sdkClientsProvider` — to resolve sdk_client_id → client name
+
+All lookups are in-memory Maps built inside the build method; no extra model class needed.
+
+Fallbacks:
+- Wallet address not found → `"Access #N"` where N is the wallet_access_id
+- Client name not found → `"Client #N"` where N is the sdk_client_id
+
+---
+
+## Route Structure
+
+```
+/dashboard
+  /evm          ← existing (Wallets tab)
+  /clients      ← existing (Clients tab)
+  /grants       ← NEW (Grants tab)
+  /about        ← existing
+
+/evm-grants/create  ← existing push route (unchanged)
+```
+
+### Changes to `router.dart`
+
+Add inside dashboard children:
+```dart
+AutoRoute(page: EvmGrantsRoute.page, path: 'grants'),
+```
+
+### Changes to `dashboard.dart`
+
+Add to `routes` list:
+```dart
+const EvmGrantsRoute()
+```
+
+Add `NavigationDestination`:
+```dart
+NavigationDestination(
+  icon: Icon(Icons.policy_outlined),
+  selectedIcon: Icon(Icons.policy),
+  label: 'Grants',
+),
+```
+
+---
+
+## Screen: `EvmGrantsScreen`
+
+**File:** `useragent/lib/screens/dashboard/evm/grants/grants.dart`
+
+```
+Scaffold
+└─ SafeArea
+   └─ RefreshIndicator.adaptive (refreshes evmGrantsProvider + walletAccessListProvider)
+      └─ ListView (BouncingScrollPhysics + AlwaysScrollableScrollPhysics)
+         ├─ PageHeader
+         │    title: 'EVM Grants'
+         │    isBusy: evmGrantsProvider.isLoading
+         │    actions: [CreateGrantButton, RefreshButton]
+         ├─ SizedBox(height: 1.8.h)
+         └─ <content>
+```
+
+### State handling
+
+Matches the pattern from `EvmScreen` and `ClientsScreen`:
+
+| State | Display |
+|---|---|
+| Loading (no data yet) | `_StatePanel` with spinner, "Loading grants" |
+| Error | `_StatePanel` with coral icon, error message, Retry button |
+| No connection | `_StatePanel`, "No active server connection" |
+| Empty list | `_StatePanel`, "No grants yet", with Create Grant shortcut |
+| Data | Column of `_GrantCard` widgets |
+
+### Header actions
+
+**CreateGrantButton:** `FilledButton.icon` with `Icons.add_rounded`, pushes `CreateEvmGrantRoute()` via `context.router.push(...)`.
+
+**RefreshButton:** `OutlinedButton.icon` with `Icons.refresh`, calls `ref.read(evmGrantsProvider.notifier).refresh()`.
+
+---
+
+## Grant Card: `_GrantCard`
+
+**Layout:**
+
+```
+Container (rounded 24, Palette.cream bg, Palette.line border)
+└─ IntrinsicHeight > Row
+   ├─ Accent strip (0.8.w wide, full height, rounded left)
+   └─ Padding > Column
+        ├─ Row 1: TypeBadge + ChainChip + Spacer + RevokeButton
+        └─ Row 2: WalletText + "·" + ClientText
+```
+
+**Accent color by grant type:**
+- Ether transfer → `Palette.coral`
+- Token transfer → `Palette.token` (new entry in `Palette` — indigo, e.g. `Color(0xFF5C6BC0)`)
+
+**TypeBadge:** Small pill container with accent color background at 15% opacity, accent-colored text. Label: `'Ether'` or `'Token'`.
+
+**ChainChip:** Small container: `'Chain ${grant.shared.chainId}'`, muted ink color.
+
+**WalletText:** Short hex address (`0xabc...def`) from wallet lookup, `bodySmall`, monospace font family.
+
+**ClientText:** Client name from `sdkClientsProvider` lookup, or fallback string. `bodySmall`, muted ink.
+
+**RevokeButton:**
+- `OutlinedButton` with `Icons.block_rounded` icon, label `'Revoke'`
+- `foregroundColor: Palette.coral`, `side: BorderSide(color: Palette.coral.withValues(alpha: 0.4))`
+- Disabled (replaced with `CircularProgressIndicator`) while `revokeEvmGrantMutation` is pending — note: this is a single global mutation, so all revoke buttons disable while any revoke is in flight
+- On press: calls `executeRevokeEvmGrant(ref, grantId: grant.id)`; shows `SnackBar` on error
+
+---
+
+## Adaptive Sizing
+
+All sizing uses `sizer` units (`1.h`, `1.w`, etc.). No hardcoded pixel values.
+
+---
+
+## Files to Create / Modify
+
+| File | Action |
+|---|---|
+| `lib/theme/palette.dart` | Modify — add `Palette.token` color |
+| `lib/providers/sdk_clients/wallet_access_list.dart` | Create |
+| `lib/screens/dashboard/evm/grants/grants.dart` | Create |
+| `lib/router.dart` | Modify — add grants route to dashboard children |
+| `lib/screens/dashboard.dart` | Modify — add tab to routes list and NavigationDestinations |

mise.lock

@@ -8,10 +8,18 @@ backend = "aqua:ast-grep/ast-grep"
 checksum = "sha256:5c830eae8456569e2f7212434ed9c238f58dca412d76045418ed6d394a755836"
 url = "https://github.com/ast-grep/ast-grep/releases/download/0.42.0/app-aarch64-unknown-linux-gnu.zip"
 
+[tools.ast-grep."platforms.linux-arm64-musl"]
+checksum = "sha256:5c830eae8456569e2f7212434ed9c238f58dca412d76045418ed6d394a755836"
+url = "https://github.com/ast-grep/ast-grep/releases/download/0.42.0/app-aarch64-unknown-linux-gnu.zip"
+
 [tools.ast-grep."platforms.linux-x64"]
 checksum = "sha256:e825a05603f0bcc4cd9076c4cc8c9abd6d008b7cd07d9aa3cc323ba4b8606651"
 url = "https://github.com/ast-grep/ast-grep/releases/download/0.42.0/app-x86_64-unknown-linux-gnu.zip"
 
+[tools.ast-grep."platforms.linux-x64-musl"]
+checksum = "sha256:e825a05603f0bcc4cd9076c4cc8c9abd6d008b7cd07d9aa3cc323ba4b8606651"
+url = "https://github.com/ast-grep/ast-grep/releases/download/0.42.0/app-x86_64-unknown-linux-gnu.zip"
+
 [tools.ast-grep."platforms.macos-arm64"]
 checksum = "sha256:fc300d5293b1c770a5aece03a8a193b92e71e87cec726c28096990691a582620"
 url = "https://github.com/ast-grep/ast-grep/releases/download/0.42.0/app-aarch64-apple-darwin.zip"
@@ -32,10 +40,6 @@ backend = "cargo:cargo-audit"
 version = "0.13.9"
 backend = "cargo:cargo-edit"
 
-[[tools."cargo:cargo-features"]]
-version = "1.0.0"
-backend = "cargo:cargo-features"
-
 [[tools."cargo:cargo-features-manager"]]
 version = "0.11.1"
 backend = "cargo:cargo-features-manager"
@@ -49,21 +53,13 @@ version = "0.9.126"
 backend = "cargo:cargo-nextest"
 
 [[tools."cargo:cargo-shear"]]
-version = "1.9.1"
+version = "1.11.2"
 backend = "cargo:cargo-shear"
 
 [[tools."cargo:cargo-vet"]]
 version = "0.10.2"
 backend = "cargo:cargo-vet"
 
-[[tools."cargo:diesel-cli"]]
-version = "2.3.6"
-backend = "cargo:diesel-cli"
-
-[tools."cargo:diesel-cli".options]
-default-features = "false"
-features = "sqlite,sqlite-bundled"
-
 [[tools."cargo:diesel_cli"]]
 version = "2.3.6"
 backend = "cargo:diesel_cli"
@@ -72,10 +68,6 @@ backend = "cargo:diesel_cli"
 default-features = "false"
 features = "sqlite,sqlite-bundled"
 
-[[tools."cargo:rinf_cli"]]
-version = "8.9.1"
-backend = "cargo:rinf_cli"
-
 [[tools.flutter]]
 version = "3.38.9-stable"
 backend = "asdf:flutter"
@@ -88,10 +80,18 @@ backend = "aqua:protocolbuffers/protobuf/protoc"
 checksum = "sha256:2594ff4fcae8cb57310d394d0961b236190ad9c5efbfdf1f597ea471d424fe79"
 url = "https://github.com/protocolbuffers/protobuf/releases/download/v29.6/protoc-29.6-linux-aarch_64.zip"
 
+[tools.protoc."platforms.linux-arm64-musl"]
+checksum = "sha256:2594ff4fcae8cb57310d394d0961b236190ad9c5efbfdf1f597ea471d424fe79"
+url = "https://github.com/protocolbuffers/protobuf/releases/download/v29.6/protoc-29.6-linux-aarch_64.zip"
+
 [tools.protoc."platforms.linux-x64"]
 checksum = "sha256:48785a926e73ffa3f68e2f22b14e7b849620c7a1d36809ac9249a5495e280323"
 url = "https://github.com/protocolbuffers/protobuf/releases/download/v29.6/protoc-29.6-linux-x86_64.zip"
 
+[tools.protoc."platforms.linux-x64-musl"]
+checksum = "sha256:48785a926e73ffa3f68e2f22b14e7b849620c7a1d36809ac9249a5495e280323"
+url = "https://github.com/protocolbuffers/protobuf/releases/download/v29.6/protoc-29.6-linux-x86_64.zip"
+
 [tools.protoc."platforms.macos-arm64"]
 checksum = "sha256:b9576b5fa1a1ef3fe13a8c91d9d8204b46545759bea5ae155cd6ba2ea4cdaeed"
 url = "https://github.com/protocolbuffers/protobuf/releases/download/v29.6/protoc-29.6-osx-aarch_64.zip"
@@ -109,24 +109,32 @@ version = "3.14.3"
 backend = "core:python"
 
 [tools.python."platforms.linux-arm64"]
-checksum = "sha256:be0f4dc2932f762292b27d46ea7d3e8e66ddf3969a5eb0254a229015ed402625"
-url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260303/cpython-3.14.3+20260303-aarch64-unknown-linux-gnu-install_only_stripped.tar.gz"
+checksum = "sha256:53700338695e402a1a1fe22be4a41fbdacc70e22bb308a48eca8ed67cb7992be"
+url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260324/cpython-3.14.3+20260324-aarch64-unknown-linux-gnu-install_only_stripped.tar.gz"
+
+[tools.python."platforms.linux-arm64-musl"]
+checksum = "sha256:53700338695e402a1a1fe22be4a41fbdacc70e22bb308a48eca8ed67cb7992be"
+url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260324/cpython-3.14.3+20260324-aarch64-unknown-linux-gnu-install_only_stripped.tar.gz"
 
 [tools.python."platforms.linux-x64"]
-checksum = "sha256:0a73413f89efd417871876c9accaab28a9d1e3cd6358fbfff171a38ec99302f0"
-url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260303/cpython-3.14.3+20260303-x86_64-unknown-linux-gnu-install_only_stripped.tar.gz"
+checksum = "sha256:d7a9f970914bb4c88756fe3bdcc186d4feb90e9500e54f1db47dae4dc9687e39"
+url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260324/cpython-3.14.3+20260324-x86_64-unknown-linux-gnu-install_only_stripped.tar.gz"
+
+[tools.python."platforms.linux-x64-musl"]
+checksum = "sha256:d7a9f970914bb4c88756fe3bdcc186d4feb90e9500e54f1db47dae4dc9687e39"
+url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260324/cpython-3.14.3+20260324-x86_64-unknown-linux-gnu-install_only_stripped.tar.gz"
 
 [tools.python."platforms.macos-arm64"]
-checksum = "sha256:4703cdf18b26798fde7b49b6b66149674c25f97127be6a10dbcf29309bdcdcdb"
-url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260303/cpython-3.14.3+20260303-aarch64-apple-darwin-install_only_stripped.tar.gz"
+checksum = "sha256:c43aecde4a663aebff99b9b83da0efec506479f1c3f98331442f33d2c43501f9"
+url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260324/cpython-3.14.3+20260324-aarch64-apple-darwin-install_only_stripped.tar.gz"
 
 [tools.python."platforms.macos-x64"]
-checksum = "sha256:76f1cc26e3d262eae8ca546a93e8bded10cf0323613f7e246fea2e10a8115eb7"
-url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260303/cpython-3.14.3+20260303-x86_64-apple-darwin-install_only_stripped.tar.gz"
+checksum = "sha256:9ab41dbc2f100a2a45d1833b9c11165f51051c558b5213eda9a9731d5948a0c0"
+url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260324/cpython-3.14.3+20260324-x86_64-apple-darwin-install_only_stripped.tar.gz"
 
 [tools.python."platforms.windows-x64"]
-checksum = "sha256:950c5f21a015c1bdd1337f233456df2470fab71e4d794407d27a84cb8b9909a0"
-url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260303/cpython-3.14.3+20260303-x86_64-pc-windows-msvc-install_only_stripped.tar.gz"
+checksum = "sha256:bbe19034b35b0267176a7442575ae7dc6343480fd4d35598cb7700173d431e09"
+url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260324/cpython-3.14.3+20260324-x86_64-pc-windows-msvc-install_only_stripped.tar.gz"
 
 [[tools.rust]]
 version = "1.93.0"

protobufs/client.proto

@@ -5,8 +5,15 @@ package arbiter.client;
 import "evm.proto";
 import "google/protobuf/empty.proto";
 
+message ClientInfo {
+  string name = 1;
+  optional string description = 2;
+  optional string version = 3;
+}
+
 message AuthChallengeRequest {
   bytes pubkey = 1;
+  ClientInfo client_info = 2;
 }
 
 message AuthChallenge {

protobufs/evm.proto

@@ -12,7 +12,8 @@ enum EvmError {
 }
 
 message WalletEntry {
-  bytes address = 1; // 20-byte Ethereum address
+  int32 id = 1;
+  bytes address = 2; // 20-byte Ethereum address
 }
 
 message WalletList {
@@ -46,7 +47,7 @@ message VolumeRateLimit {
 }
 
 message SharedSettings {
-  int32 wallet_id = 1;
+  int32 wallet_access_id = 1;
   uint64 chain_id = 2;
   optional google.protobuf.Timestamp valid_from = 3;
   optional google.protobuf.Timestamp valid_until = 4;
@@ -139,9 +140,8 @@ message TransactionEvalError {
 
 // --- UserAgent grant management ---
 message EvmGrantCreateRequest {
-  int32 client_id = 1;
-  SharedSettings shared = 2;
-  SpecificGrant specific = 3;
+  SharedSettings shared = 1;
+  SpecificGrant specific = 2;
 }
 
 message EvmGrantCreateResponse {
@@ -165,13 +165,13 @@ message EvmGrantDeleteResponse {
 // Basic grant info returned in grant listings
 message GrantEntry {
   int32 id = 1;
-  int32 client_id = 2;
+  int32 wallet_access_id = 2;
   SharedSettings shared = 3;
   SpecificGrant specific = 4;
 }
 
 message EvmGrantListRequest {
-  optional int32 wallet_id = 1;
+  optional int32 wallet_access_id = 1;
 }
 
 message EvmGrantListResponse {

protobufs/user_agent.proto

@@ -2,6 +2,7 @@ syntax = "proto3";
 
 package arbiter.user_agent;
 
+import "client.proto";
 import "evm.proto";
 import "google/protobuf/empty.proto";
 
@@ -22,10 +23,6 @@ enum SdkClientError {
   SDK_CLIENT_ERROR_INTERNAL = 4;
 }
 
-message SdkClientApproveRequest {
-  bytes pubkey = 1; // 32-byte ed25519 public key
-}
-
 message SdkClientRevokeRequest {
   int32 client_id = 1;
 }
@@ -33,20 +30,14 @@ message SdkClientRevokeRequest {
 message SdkClientEntry {
   int32 id = 1;
   bytes pubkey = 2;
-  int32 created_at = 3;
+  arbiter.client.ClientInfo info = 3;
+  int32 created_at = 4;
 }
 
 message SdkClientList {
   repeated SdkClientEntry clients = 1;
 }
 
-message SdkClientApproveResponse {
-  oneof result {
-    SdkClientEntry client = 1;
-    SdkClientError error = 2;
-  }
-}
-
 message SdkClientRevokeResponse {
   oneof result {
     google.protobuf.Empty ok = 1;
@@ -129,13 +120,39 @@ enum VaultState {
 
 message SdkClientConnectionRequest {
   bytes pubkey = 1;
+  arbiter.client.ClientInfo info = 2;
 }
 
 message SdkClientConnectionResponse {
   bool approved = 1;
+  bytes pubkey = 2;
 }
 
-message SdkClientConnectionCancel {}
+message SdkClientConnectionCancel {
+  bytes pubkey = 1;
+}
+
+message WalletAccess {
+  int32 wallet_id = 1;
+  int32 sdk_client_id = 2;
+}
+
+message SdkClientWalletAccess {
+  int32 id = 1;
+  WalletAccess access = 2;
+}
+
+message SdkClientGrantWalletAccess {
+  repeated WalletAccess accesses = 1;
+}
+
+message SdkClientRevokeWalletAccess {
+  repeated int32 accesses = 1;
+}
+
+message ListWalletAccessResponse {
+  repeated SdkClientWalletAccess accesses = 1;
+}
 
 message UserAgentRequest {
   int32 id = 16;
@@ -151,10 +168,12 @@ message UserAgentRequest {
     arbiter.evm.EvmGrantDeleteRequest evm_grant_delete = 9;
     arbiter.evm.EvmGrantListRequest evm_grant_list = 10;
     SdkClientConnectionResponse sdk_client_connection_response = 11;
-    SdkClientApproveRequest sdk_client_approve = 12;
-    SdkClientRevokeRequest sdk_client_revoke = 13;
-    google.protobuf.Empty sdk_client_list = 14;
-    BootstrapEncryptedKey bootstrap_encrypted_key = 15;
+    SdkClientRevokeRequest sdk_client_revoke = 12;
+    google.protobuf.Empty sdk_client_list = 13;
+    BootstrapEncryptedKey bootstrap_encrypted_key = 14;
+    SdkClientGrantWalletAccess grant_wallet_access = 15;
+    SdkClientRevokeWalletAccess revoke_wallet_access = 17;
+    google.protobuf.Empty list_wallet_access = 18;
   }
 }
 message UserAgentResponse {
@@ -170,10 +189,11 @@ message UserAgentResponse {
     arbiter.evm.EvmGrantCreateResponse evm_grant_create = 8;
     arbiter.evm.EvmGrantDeleteResponse evm_grant_delete = 9;
     arbiter.evm.EvmGrantListResponse evm_grant_list = 10;
-    SdkClientConnectionResponse sdk_client_connection_response = 11;
-    SdkClientApproveResponse sdk_client_approve_response = 12;
+    SdkClientConnectionRequest sdk_client_connection_request = 11;
+    SdkClientConnectionCancel sdk_client_connection_cancel = 12;
     SdkClientRevokeResponse sdk_client_revoke_response = 13;
     SdkClientListResponse sdk_client_list_response = 14;
     BootstrapResult bootstrap_result = 15;
+    ListWalletAccessResponse list_wallet_access_response = 17;
   }
 }

server/Cargo.lock

@@ -669,6 +669,56 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "anstream"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "824a212faf96e9acacdbd09febd34438f8f711fb84e09a8916013cd7815ca28d"
+dependencies = [
+ "anstyle",
+ "anstyle-parse",
+ "anstyle-query",
+ "anstyle-wincon",
+ "colorchoice",
+ "is_terminal_polyfill",
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle"
+version = "1.0.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"
+
+[[package]]
+name = "anstyle-parse"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52ce7f38b242319f7cabaa6813055467063ecdc9d355bbb4ce0c68908cd8130e"
+dependencies = [
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle-query"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "anstyle-wincon"
+version = "3.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
+dependencies = [
+ "anstyle",
+ "once_cell_polyfill",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "anyhow"
 version = "1.0.102"
@@ -730,6 +780,7 @@ dependencies = [
  "async-trait",
  "chacha20poly1305",
  "chrono",
+ "clap",
  "dashmap",
  "diesel",
  "diesel-async",
@@ -761,6 +812,7 @@ dependencies = [
  "tonic",
  "tracing",
  "tracing-subscriber",
+ "windows-service",
  "x25519-dalek",
  "zeroize",
 ]
@@ -1433,6 +1485,46 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "clap"
+version = "4.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b193af5b67834b676abd72466a96c1024e6a6ad978a1f484bd90b85c94041351"
+dependencies = [
+ "clap_builder",
+ "clap_derive",
+]
+
+[[package]]
+name = "clap_builder"
+version = "4.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "714a53001bf66416adb0e2ef5ac857140e7dc3a0c48fb28b2f10762fc4b5069f"
+dependencies = [
+ "anstream",
+ "anstyle",
+ "clap_lex",
+ "strsim",
+]
+
+[[package]]
+name = "clap_derive"
+version = "4.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1110bd8a634a1ab8cb04345d8d878267d57c3cf1b38d91b71af6686408bbca6a"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+]
+
+[[package]]
+name = "clap_lex"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
+
 [[package]]
 name = "cmake"
 version = "0.1.57"
@@ -1442,6 +1534,12 @@ dependencies = [
  "cc",
 ]
 
+[[package]]
+name = "colorchoice"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
+
 [[package]]
 name = "console"
 version = "0.15.11"
@@ -2051,7 +2149,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -2853,6 +2951,12 @@ version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7655c9839580ee829dfacba1d1278c2b7883e50a277ff7541299489d6bdfdc45"
 
+[[package]]
+name = "is_terminal_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"
+
 [[package]]
 name = "itertools"
 version = "0.10.5"
@@ -3186,7 +3290,7 @@ version = "0.50.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
 dependencies = [
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -3320,6 +3424,12 @@ version = "1.21.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
 
+[[package]]
+name = "once_cell_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
+
 [[package]]
 name = "opaque-debug"
 version = "0.3.1"
@@ -4285,7 +4395,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -4701,7 +4811,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3a766e1110788c36f4fa1c2b71b387a7815aa65f88ce0229841826633d93723e"
 dependencies = [
  "libc",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -4895,7 +5005,7 @@ dependencies = [
  "getrandom 0.4.2",
  "once_cell",
  "rustix",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -5469,6 +5579,12 @@ version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
 
+[[package]]
+name = "utf8parse"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
+
 [[package]]
 name = "uuid"
 version = "1.22.0"
@@ -5675,6 +5791,12 @@ dependencies = [
  "rustls-pki-types",
 ]
 
+[[package]]
+name = "widestring"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72069c3113ab32ab29e5584db3c6ec55d416895e60715417b5b883a357c3e471"
+
 [[package]]
 name = "winapi"
 version = "0.3.9"
@@ -5747,6 +5869,17 @@ dependencies = [
  "windows-link",
 ]
 
+[[package]]
+name = "windows-service"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "193cae8e647981c35bc947fdd57ba7928b1fa0d4a79305f6dd2dc55221ac35ac"
+dependencies = [
+ "bitflags",
+ "widestring",
+ "windows-sys 0.59.0",
+]
+
 [[package]]
 name = "windows-strings"
 version = "0.5.1"

server/crates/arbiter-client/src/auth.rs

@@ -1,8 +1,8 @@
 use arbiter_proto::{
-    format_challenge,
+    ClientMetadata, format_challenge,
     proto::client::{
-        AuthChallengeRequest, AuthChallengeSolution, AuthResult, ClientRequest,
-        client_request::Payload as ClientRequestPayload,
+        AuthChallengeRequest, AuthChallengeSolution, AuthResult, ClientInfo as ProtoClientInfo,
+        ClientRequest, client_request::Payload as ClientRequestPayload,
         client_response::Payload as ClientResponsePayload,
     },
 };
@@ -14,19 +14,7 @@ use crate::{
 };
 
 #[derive(Debug, thiserror::Error)]
-pub enum ConnectError {
-    #[error("Could not establish connection")]
-    Connection(#[from] tonic::transport::Error),
-
-    #[error("Invalid server URI")]
-    InvalidUri(#[from] http::uri::InvalidUri),
-
-    #[error("Invalid CA certificate")]
-    InvalidCaCert(#[from] webpki::Error),
-
-    #[error("gRPC error")]
-    Grpc(#[from] tonic::Status),
-
+pub enum AuthError {
     #[error("Auth challenge was not returned by server")]
     MissingAuthChallenge,
 
@@ -43,48 +31,54 @@ pub enum ConnectError {
     Storage(#[from] StorageError),
 }
 
-fn map_auth_result(code: i32) -> ConnectError {
+fn map_auth_result(code: i32) -> AuthError {
     match AuthResult::try_from(code).unwrap_or(AuthResult::Unspecified) {
-        AuthResult::ApprovalDenied => ConnectError::ApprovalDenied,
-        AuthResult::NoUserAgentsOnline => ConnectError::NoUserAgentsOnline,
+        AuthResult::ApprovalDenied => AuthError::ApprovalDenied,
+        AuthResult::NoUserAgentsOnline => AuthError::NoUserAgentsOnline,
         AuthResult::Unspecified
         | AuthResult::Success
         | AuthResult::InvalidKey
         | AuthResult::InvalidSignature
-        | AuthResult::Internal => ConnectError::UnexpectedAuthResponse,
+        | AuthResult::Internal => AuthError::UnexpectedAuthResponse,
     }
 }
 
 async fn send_auth_challenge_request(
     transport: &mut ClientTransport,
+    metadata: ClientMetadata,
     key: &ed25519_dalek::SigningKey,
-) -> std::result::Result<(), ConnectError> {
+) -> std::result::Result<(), AuthError> {
     transport
         .send(ClientRequest {
             request_id: next_request_id(),
             payload: Some(ClientRequestPayload::AuthChallengeRequest(
                 AuthChallengeRequest {
                     pubkey: key.verifying_key().to_bytes().to_vec(),
+                    client_info: Some(ProtoClientInfo {
+                        name: metadata.name,
+                        description: metadata.description,
+                        version: metadata.version,
+                    }),
                 },
             )),
         })
         .await
-        .map_err(|_| ConnectError::UnexpectedAuthResponse)
+        .map_err(|_| AuthError::UnexpectedAuthResponse)
 }
 
 async fn receive_auth_challenge(
     transport: &mut ClientTransport,
-) -> std::result::Result<arbiter_proto::proto::client::AuthChallenge, ConnectError> {
+) -> std::result::Result<arbiter_proto::proto::client::AuthChallenge, AuthError> {
     let response = transport
         .recv()
         .await
-        .map_err(|_| ConnectError::MissingAuthChallenge)?;
+        .map_err(|_| AuthError::MissingAuthChallenge)?;
 
-    let payload = response.payload.ok_or(ConnectError::MissingAuthChallenge)?;
+    let payload = response.payload.ok_or(AuthError::MissingAuthChallenge)?;
     match payload {
         ClientResponsePayload::AuthChallenge(challenge) => Ok(challenge),
         ClientResponsePayload::AuthResult(result) => Err(map_auth_result(result)),
-        _ => Err(ConnectError::UnexpectedAuthResponse),
+        _ => Err(AuthError::UnexpectedAuthResponse),
     }
 }
 
@@ -92,7 +86,7 @@ async fn send_auth_challenge_solution(
     transport: &mut ClientTransport,
     key: &ed25519_dalek::SigningKey,
     challenge: arbiter_proto::proto::client::AuthChallenge,
-) -> std::result::Result<(), ConnectError> {
+) -> std::result::Result<(), AuthError> {
     let challenge_payload = format_challenge(challenge.nonce, &challenge.pubkey);
     let signature = key.sign(&challenge_payload).to_bytes().to_vec();
 
@@ -104,20 +98,20 @@ async fn send_auth_challenge_solution(
             )),
         })
         .await
-        .map_err(|_| ConnectError::UnexpectedAuthResponse)
+        .map_err(|_| AuthError::UnexpectedAuthResponse)
 }
 
 async fn receive_auth_confirmation(
     transport: &mut ClientTransport,
-) -> std::result::Result<(), ConnectError> {
+) -> std::result::Result<(), AuthError> {
     let response = transport
         .recv()
         .await
-        .map_err(|_| ConnectError::UnexpectedAuthResponse)?;
+        .map_err(|_| AuthError::UnexpectedAuthResponse)?;
 
     let payload = response
         .payload
-        .ok_or(ConnectError::UnexpectedAuthResponse)?;
+        .ok_or(AuthError::UnexpectedAuthResponse)?;
     match payload {
         ClientResponsePayload::AuthResult(result)
             if AuthResult::try_from(result).ok() == Some(AuthResult::Success) =>
@@ -125,15 +119,16 @@ async fn receive_auth_confirmation(
             Ok(())
         }
         ClientResponsePayload::AuthResult(result) => Err(map_auth_result(result)),
-        _ => Err(ConnectError::UnexpectedAuthResponse),
+        _ => Err(AuthError::UnexpectedAuthResponse),
     }
 }
 
 pub(crate) async fn authenticate(
     transport: &mut ClientTransport,
+    metadata: ClientMetadata,
     key: &ed25519_dalek::SigningKey,
-) -> std::result::Result<(), ConnectError> {
-    send_auth_challenge_request(transport, key).await?;
+) -> std::result::Result<(), AuthError> {
+    send_auth_challenge_request(transport, metadata, key).await?;
     let challenge = receive_auth_challenge(transport).await?;
     send_auth_challenge_solution(transport, key, challenge).await?;
     receive_auth_confirmation(transport).await

server/crates/arbiter-client/src/bin/test_connect.rs

@@ -0,0 +1,48 @@
+
+use std::io::{self, Write};
+
+use arbiter_client::ArbiterClient;
+use arbiter_proto::{ClientMetadata, url::ArbiterUrl};
+use tonic::ConnectError;
+
+#[tokio::main]
+async fn main() {
+    println!("Testing connection to Arbiter server...");
+    print!("Enter ArbiterUrl: ");
+    let _ = io::stdout().flush();
+
+    let mut input = String::new();
+    if let Err(err) = io::stdin().read_line(&mut input) {
+        eprintln!("Failed to read input: {err}");
+        return;
+    }
+
+    let input = input.trim();
+    if input.is_empty() {
+        eprintln!("ArbiterUrl cannot be empty");
+        return;
+    }
+
+   
+
+    let url = match ArbiterUrl::try_from(input) {
+        Ok(url) => url,
+        Err(err) => {
+            eprintln!("Invalid ArbiterUrl: {err}");
+            return;
+        }
+    };
+
+     println!("{:#?}", url);
+
+    let metadata = ClientMetadata {
+        name: "arbiter-client test_connect".to_string(),
+        description: Some("Manual connection smoke test".to_string()),
+        version: Some(env!("CARGO_PKG_VERSION").to_string()),
+    };
+
+    match ArbiterClient::connect(url, metadata).await {
+        Ok(_) => println!("Connected and authenticated successfully."),
+        Err(err) => eprintln!("Failed to connect: {:#?}", err),
+    }
+}

server/crates/arbiter-client/src/client.rs

@@ -1,25 +1,36 @@
-use arbiter_proto::{proto::arbiter_service_client::ArbiterServiceClient, url::ArbiterUrl};
+use arbiter_proto::{ClientMetadata, proto::arbiter_service_client::ArbiterServiceClient, url::ArbiterUrl};
 use std::sync::Arc;
 use tokio::sync::{Mutex, mpsc};
 use tokio_stream::wrappers::ReceiverStream;
 use tonic::transport::ClientTlsConfig;
 
 use crate::{
-    auth::{ConnectError, authenticate},
-    storage::{FileSigningKeyStorage, SigningKeyStorage},
-    transport::{BUFFER_LENGTH, ClientTransport},
+    StorageError, auth::{AuthError, authenticate}, storage::{FileSigningKeyStorage, SigningKeyStorage}, transport::{BUFFER_LENGTH, ClientTransport}
 };
 
 #[cfg(feature = "evm")]
 use crate::wallets::evm::ArbiterEvmWallet;
 
 #[derive(Debug, thiserror::Error)]
-pub enum ClientError {
+pub enum Error {
     #[error("gRPC error")]
     Grpc(#[from] tonic::Status),
 
-    #[error("Connection closed by server")]
-    ConnectionClosed,
+    #[error("Could not establish connection")]
+    Connection(#[from] tonic::transport::Error),
+
+    #[error("Invalid server URI")]
+    InvalidUri(#[from] http::uri::InvalidUri),
+
+    #[error("Invalid CA certificate")]
+    InvalidCaCert(#[from] webpki::Error),
+
+    #[error("Authentication error")]
+    Authentication(#[from] AuthError),
+
+    #[error("Storage error")]
+    Storage(#[from] StorageError),
+    
 }
 
 pub struct ArbiterClient {
@@ -28,27 +39,29 @@ pub struct ArbiterClient {
 }
 
 impl ArbiterClient {
-    pub async fn connect(url: ArbiterUrl) -> Result<Self, ConnectError> {
+    pub async fn connect(url: ArbiterUrl, metadata: ClientMetadata) -> Result<Self, Error> {
         let storage = FileSigningKeyStorage::from_default_location()?;
-        Self::connect_with_storage(url, &storage).await
+        Self::connect_with_storage(url, metadata, &storage).await
     }
 
     pub async fn connect_with_storage<S: SigningKeyStorage>(
         url: ArbiterUrl,
+        metadata: ClientMetadata,
         storage: &S,
-    ) -> Result<Self, ConnectError> {
+    ) -> Result<Self, Error> {
         let key = storage.load_or_create()?;
-        Self::connect_with_key(url, key).await
+        Self::connect_with_key(url, metadata, key).await
     }
 
     pub async fn connect_with_key(
         url: ArbiterUrl,
+        metadata: ClientMetadata,
         key: ed25519_dalek::SigningKey,
-    ) -> Result<Self, ConnectError> {
+    ) -> Result<Self, Error> {
         let anchor = webpki::anchor_from_trusted_cert(&url.ca_cert)?.to_owned();
         let tls = ClientTlsConfig::new().trust_anchor(anchor);
 
-        let channel = tonic::transport::Channel::from_shared(format!("{}:{}", url.host, url.port))?
+        let channel = tonic::transport::Channel::from_shared(format!("https://{}:{}", url.host, url.port))?
             .tls_config(tls)?
             .connect()
             .await?;
@@ -62,7 +75,7 @@ impl ArbiterClient {
             receiver: response_stream,
         };
 
-        authenticate(&mut transport, &key).await?;
+        authenticate(&mut transport, metadata, &key).await?;
 
         Ok(Self {
             transport: Arc::new(Mutex::new(transport)),
@@ -70,7 +83,7 @@ impl ArbiterClient {
     }
 
     #[cfg(feature = "evm")]
-    pub async fn evm_wallets(&self) -> Result<Vec<ArbiterEvmWallet>, ClientError> {
+    pub async fn evm_wallets(&self) -> Result<Vec<ArbiterEvmWallet>, Error> {
         todo!("fetch EVM wallet list from server")
     }
 }

server/crates/arbiter-client/src/lib.rs

@@ -4,8 +4,8 @@ mod storage;
 mod transport;
 pub mod wallets;
 
-pub use auth::ConnectError;
-pub use client::{ArbiterClient, ClientError};
+pub use auth::AuthError;
+pub use client::{ArbiterClient, Error};
 pub use storage::{FileSigningKeyStorage, SigningKeyStorage, StorageError};
 
 #[cfg(feature = "evm")]

server/crates/arbiter-proto/build.rs

@@ -1,32 +1,21 @@
-use std::path::PathBuf;
 use tonic_prost_build::configure;
 
 static PROTOBUF_DIR: &str = "../../../protobufs";
 
 fn main() -> Result<(), Box<dyn std::error::Error>> {
-    let manifest_dir = PathBuf::from(std::env::var("CARGO_MANIFEST_DIR")?);
-    let protobuf_dir = manifest_dir.join(PROTOBUF_DIR);
-    let protoc_include = protoc_bin_vendored::include_path()?;
-    let protoc_path = protoc_bin_vendored::protoc_bin_path()?;
-
-    unsafe {
-        std::env::set_var("PROTOC", &protoc_path);
-        std::env::set_var("PROTOC_INCLUDE", &protoc_include);
-    }
-
-    println!("cargo::rerun-if-changed={}", protobuf_dir.display());
+    println!("cargo::rerun-if-changed={PROTOBUF_DIR}");
 
     configure()
         .message_attribute(".", "#[derive(::kameo::Reply)]")
-        .compile_well_known_types(true)
         .compile_protos(
             &[
-                protobuf_dir.join("arbiter.proto"),
-                protobuf_dir.join("user_agent.proto"),
-                protobuf_dir.join("client.proto"),
-                protobuf_dir.join("evm.proto"),
+                format!("{}/arbiter.proto", PROTOBUF_DIR),
+                format!("{}/user_agent.proto", PROTOBUF_DIR),
+                format!("{}/client.proto", PROTOBUF_DIR),
+                format!("{}/evm.proto", PROTOBUF_DIR),
             ],
-            &[protobuf_dir],
-        )?;
+            &[PROTOBUF_DIR.to_string()],
+        )
+        .unwrap();
     Ok(())
 }

server/crates/arbiter-proto/src/lib.rs

@@ -2,12 +2,10 @@ pub mod transport;
 pub mod url;
 
 use base64::{Engine, prelude::BASE64_STANDARD};
-
-pub mod google {
-    pub mod protobuf {
-        tonic::include_proto!("google.protobuf");
-    }
-}
+use std::{
+    path::PathBuf,
+    sync::{LazyLock, RwLock},
+};
 
 pub mod proto {
     tonic::include_proto!("arbiter");
@@ -25,9 +23,35 @@ pub mod proto {
     }
 }
 
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ClientMetadata {
+    pub name: String,
+    pub description: Option<String>,
+    pub version: Option<String>,
+}
+
 pub static BOOTSTRAP_PATH: &str = "bootstrap_token";
+pub const DEFAULT_SERVER_PORT: u16 = 50051;
+static HOME_OVERRIDE: LazyLock<RwLock<Option<PathBuf>>> = LazyLock::new(|| RwLock::new(None));
+
+pub fn set_home_path_override(path: Option<PathBuf>) -> Result<(), std::io::Error> {
+    let mut lock = HOME_OVERRIDE
+        .write()
+        .map_err(|_| std::io::Error::other("home path override lock poisoned"))?;
+    *lock = path;
+    Ok(())
+}
 
 pub fn home_path() -> Result<std::path::PathBuf, std::io::Error> {
+    if let Some(path) = HOME_OVERRIDE
+        .read()
+        .map_err(|_| std::io::Error::other("home path override lock poisoned"))?
+        .clone()
+    {
+        std::fs::create_dir_all(&path)?;
+        return Ok(path);
+    }
+
     static ARBITER_HOME: &str = ".arbiter";
     let home_dir = std::env::home_dir().ok_or(std::io::Error::new(
         std::io::ErrorKind::PermissionDenied,

server/crates/arbiter-proto/src/transport.rs

@@ -89,7 +89,7 @@ pub trait Sender<Outbound>: Send + Sync {
 }
 
 #[async_trait]
-pub trait Receiver<Inbound>: Send + Sync  {
+pub trait Receiver<Inbound>: Send + Sync {
     async fn recv(&mut self) -> Option<Inbound>;
 }
 

server/crates/arbiter-proto/src/url.rs

@@ -7,6 +7,8 @@ const ARBITER_URL_SCHEME: &str = "arbiter";
 const CERT_QUERY_KEY: &str = "cert";
 const BOOTSTRAP_TOKEN_QUERY_KEY: &str = "bootstrap_token";
 
+
+#[derive(Debug, Clone)]
 pub struct ArbiterUrl {
     pub host: String,
     pub port: u16,

server/crates/arbiter-server/Cargo.toml

@@ -53,7 +53,11 @@ spki.workspace = true
 alloy.workspace = true
 prost-types.workspace = true
 arbiter-tokens-registry.path = "../arbiter-tokens-registry"
+clap = { version = "4.6", features = ["derive"] }
 
 [dev-dependencies]
 insta = "1.46.3"
 test-log = { version = "0.2", default-features = false, features = ["trace"] }
+
+[target.'cfg(windows)'.dependencies]
+windows-service = "0.8"

server/crates/arbiter-server/migrations/2026-02-14-171124-0000_init/up.sql

@@ -40,7 +40,8 @@ create table if not exists arbiter_settings (
     tls_id integer references tls_history (id) on delete RESTRICT
 ) STRICT;
 
-insert into arbiter_settings (id) values (1) on conflict do nothing; -- ensure singleton row exists
+insert into arbiter_settings (id) values (1) on conflict do nothing;
+-- ensure singleton row exists
 
 create table if not exists useragent_client (
     id integer not null primary key,
@@ -50,15 +51,40 @@ create table if not exists useragent_client (
     created_at integer not null default(unixepoch ('now')),
     updated_at integer not null default(unixepoch ('now'))
 ) STRICT;
+create unique index if not exists uniq_useragent_client_public_key on useragent_client (public_key, key_type);
+
+create table if not exists client_metadata (
+    id integer not null primary key,
+    name text not null, -- human-readable name for the client
+    description text, -- optional description for the client
+    version text, -- client version for tracking and debugging
+    created_at integer not null default(unixepoch ('now'))
+) STRICT;
+
+-- created to track history of changes
+create table if not exists client_metadata_history (
+    id integer not null primary key,
+    metadata_id integer not null references client_metadata (id) on delete cascade,
+    client_id integer not null references program_client (id) on delete cascade,
+    created_at integer not null default(unixepoch ('now'))
+) STRICT;
+
+create unique index if not exists uniq_metadata_binding_client on client_metadata_history (client_id);
 
 create table if not exists program_client (
     id integer not null primary key,
     nonce integer not null default(1), -- used for auth challenge
     public_key blob not null,
+    metadata_id integer not null references client_metadata (id) on delete cascade,
     created_at integer not null default(unixepoch ('now')),
     updated_at integer not null default(unixepoch ('now'))
 ) STRICT;
 
+create unique index if not exists program_client_public_key_unique
+    on program_client (public_key);
+
+create unique index if not exists uniq_program_client_public_key on program_client (public_key);
+
 create table if not exists evm_wallet (
     id integer not null primary key,
     address blob not null, -- 20-byte Ethereum address
@@ -67,95 +93,101 @@ create table if not exists evm_wallet (
 ) STRICT;
 
 create unique index if not exists uniq_evm_wallet_address on evm_wallet (address);
+
 create unique index if not exists uniq_evm_wallet_aead on evm_wallet (aead_encrypted_id);
 
+create table if not exists evm_wallet_access (
+    id integer not null primary key,
+    wallet_id integer not null references evm_wallet (id) on delete cascade,
+    client_id integer not null references program_client (id) on delete cascade,
+    created_at integer not null default(unixepoch ('now'))
+) STRICT;
+
+create unique index if not exists uniq_wallet_access on evm_wallet_access (wallet_id, client_id);
+
 create table if not exists evm_ether_transfer_limit (
     id integer not null primary key,
-    window_secs integer not null,           -- window duration in seconds
-    max_volume blob not null                -- big-endian 32-byte U256
+    window_secs integer not null, -- window duration in seconds
+    max_volume blob not null -- big-endian 32-byte U256
 ) STRICT;
 
 -- Shared grant properties: client scope, timeframe, fee caps, and rate limit
 create table if not exists evm_basic_grant (
     id integer not null primary key,
-    wallet_id integer not null references evm_wallet(id) on delete restrict, 
-    client_id integer not null references program_client(id) on delete restrict,
-    chain_id integer not null,              -- EIP-155 chain ID
-    valid_from integer,                     -- unix timestamp (seconds), null = no lower bound
-    valid_until integer,                    -- unix timestamp (seconds), null = no upper bound
-    max_gas_fee_per_gas blob,               -- big-endian 32-byte U256, null = unlimited
-    max_priority_fee_per_gas blob,          -- big-endian 32-byte U256, null = unlimited
-    rate_limit_count integer,               -- max transactions in window, null = unlimited
-    rate_limit_window_secs integer,         -- window duration in seconds, null = unlimited
-    revoked_at integer,                     -- unix timestamp when revoked, null = still active
-    created_at integer not null default(unixepoch('now'))
+    wallet_access_id integer not null references evm_wallet_access (id) on delete restrict,
+    chain_id integer not null, -- EIP-155 chain ID
+    valid_from integer, -- unix timestamp (seconds), null = no lower bound
+    valid_until integer, -- unix timestamp (seconds), null = no upper bound
+    max_gas_fee_per_gas blob, -- big-endian 32-byte U256, null = unlimited
+    max_priority_fee_per_gas blob, -- big-endian 32-byte U256, null = unlimited
+    rate_limit_count integer, -- max transactions in window, null = unlimited
+    rate_limit_window_secs integer, -- window duration in seconds, null = unlimited
+    revoked_at integer, -- unix timestamp when revoked, null = still active
+    created_at integer not null default(unixepoch ('now'))
 ) STRICT;
 
 -- Shared transaction log for all EVM grants, used for rate limit tracking and auditing
 create table if not exists evm_transaction_log (
     id integer not null primary key,
-    grant_id integer not null references evm_basic_grant(id) on delete restrict,
-    client_id integer not null references program_client(id) on delete restrict,
-    wallet_id integer not null references evm_wallet(id) on delete restrict,
+    wallet_access_id integer not null references evm_wallet_access (id) on delete restrict,
+    grant_id integer not null references evm_basic_grant (id) on delete restrict,
     chain_id integer not null,
-    eth_value blob not null,     -- always present on any EVM tx
-    signed_at integer not null default(unixepoch('now'))
+    eth_value blob not null, -- always present on any EVM tx
+    signed_at integer not null default(unixepoch ('now'))
 ) STRICT;
 
-create index if not exists idx_evm_basic_grant_wallet_chain on evm_basic_grant(client_id, wallet_id, chain_id);
+create index if not exists idx_evm_basic_grant_access_chain on evm_basic_grant (wallet_access_id, chain_id);
 
 -- ===============================
 -- ERC20 token transfer grant
 -- ===============================
 create table if not exists evm_token_transfer_grant (
     id integer not null primary key,
-    basic_grant_id integer not null unique references evm_basic_grant(id) on delete cascade,
-    token_contract blob not null,            -- 20-byte ERC20 contract address
-    receiver blob                            -- 20-byte recipient address or null if every recipient allowed
+    basic_grant_id integer not null unique references evm_basic_grant (id) on delete cascade,
+    token_contract blob not null, -- 20-byte ERC20 contract address
+    receiver blob -- 20-byte recipient address or null if every recipient allowed
 ) STRICT;
 
 -- Per-window volume limits for token transfer grants
 create table if not exists evm_token_transfer_volume_limit (
     id integer not null primary key,
-    grant_id integer not null references evm_token_transfer_grant(id) on delete cascade,
-    window_secs integer not null,           -- window duration in seconds
-    max_volume blob not null                -- big-endian 32-byte U256
+    grant_id integer not null references evm_token_transfer_grant (id) on delete cascade,
+    window_secs integer not null, -- window duration in seconds
+    max_volume blob not null -- big-endian 32-byte U256
 ) STRICT;
 
 -- Log table for token transfer grant usage
 create table if not exists evm_token_transfer_log (
     id integer not null primary key,
-    grant_id integer not null references evm_token_transfer_grant(id) on delete restrict,
-    log_id integer not null references evm_transaction_log(id) on delete restrict,
-    chain_id integer not null,              -- EIP-155 chain ID
-    token_contract blob not null,           -- 20-byte ERC20 contract address
-    recipient_address blob not null,        -- 20-byte recipient address
-    value blob not null,                    -- big-endian 32-byte U256
-    created_at integer not null default(unixepoch('now'))
+    grant_id integer not null references evm_token_transfer_grant (id) on delete restrict,
+    log_id integer not null references evm_transaction_log (id) on delete restrict,
+    chain_id integer not null, -- EIP-155 chain ID
+    token_contract blob not null, -- 20-byte ERC20 contract address
+    recipient_address blob not null, -- 20-byte recipient address
+    value blob not null, -- big-endian 32-byte U256
+    created_at integer not null default(unixepoch ('now'))
 ) STRICT;
 
-create index if not exists idx_token_transfer_log_grant on evm_token_transfer_log(grant_id);
-create index if not exists idx_token_transfer_log_log_id on evm_token_transfer_log(log_id);
-create index if not exists idx_token_transfer_log_chain on evm_token_transfer_log(chain_id);
+create index if not exists idx_token_transfer_log_grant on evm_token_transfer_log (grant_id);
 
+create index if not exists idx_token_transfer_log_log_id on evm_token_transfer_log (log_id);
+
+create index if not exists idx_token_transfer_log_chain on evm_token_transfer_log (chain_id);
 
 -- ===============================
 -- Ether transfer grant (uses base log)
 -- ===============================
 create table if not exists evm_ether_transfer_grant (
     id integer not null primary key,
-    basic_grant_id integer not null unique references evm_basic_grant(id) on delete cascade,
-    limit_id integer not null references evm_ether_transfer_limit(id) on delete restrict
+    basic_grant_id integer not null unique references evm_basic_grant (id) on delete cascade,
+    limit_id integer not null references evm_ether_transfer_limit (id) on delete restrict
 ) STRICT;
 
 -- Specific recipient addresses for an ether transfer grant
 create table if not exists evm_ether_transfer_grant_target (
     id integer not null primary key,
-    grant_id integer not null references evm_ether_transfer_grant(id) on delete cascade,
-    address blob not null                   -- 20-byte recipient address
+    grant_id integer not null references evm_ether_transfer_grant (id) on delete cascade,
+    address blob not null -- 20-byte recipient address
 ) STRICT;
 
-create unique index if not exists uniq_ether_transfer_target on evm_ether_transfer_grant_target(grant_id, address);
-
-CREATE UNIQUE INDEX program_client_public_key_unique
-    ON program_client (public_key);
+create unique index if not exists uniq_ether_transfer_target on evm_ether_transfer_grant_target (grant_id, address);

server/crates/arbiter-server/src/actors/client/auth.rs

@@ -1,9 +1,10 @@
 use arbiter_proto::{
-    format_challenge,
-    transport::{Bi, expect_message},
+    ClientMetadata, format_challenge, transport::{Bi, expect_message}
 };
+use chrono::Utc;
 use diesel::{
-    ExpressionMethods as _, OptionalExtension as _, QueryDsl as _, dsl::insert_into, update,
+    ExpressionMethods as _, OptionalExtension as _, QueryDsl as _, SelectableHelper as _,
+    dsl::insert_into, update,
 };
 use diesel_async::RunQueryDsl as _;
 use ed25519_dalek::{Signature, VerifyingKey};
@@ -12,10 +13,14 @@ use tracing::error;
 
 use crate::{
     actors::{
-        client::ClientConnection,
-        router::{self, RequestClientApproval},
+        client::{ClientConnection, ClientProfile},
+        flow_coordinator::{self, RequestClientApproval},
+    },
+    db::{
+        self,
+        models::{ProgramClientMetadata, SqliteTimestamp},
+        schema::program_client,
     },
-    db::{self, schema::program_client},
 };
 
 #[derive(thiserror::Error, Debug, Clone, PartialEq, Eq)]
@@ -39,13 +44,18 @@ pub enum ApproveError {
     #[error("Client connection denied by user agents")]
     Denied,
     #[error("Upstream error: {0}")]
-    Upstream(router::ApprovalError),
+    Upstream(flow_coordinator::ApprovalError),
 }
 
 #[derive(Debug, Clone)]
 pub enum Inbound {
-    AuthChallengeRequest { pubkey: VerifyingKey },
-    AuthChallengeSolution { signature: Signature },
+    AuthChallengeRequest {
+        pubkey: VerifyingKey,
+        metadata: ClientMetadata,
+    },
+    AuthChallengeSolution {
+        signature: Signature,
+    },
 }
 
 #[derive(Debug, Clone)]
@@ -54,9 +64,17 @@ pub enum Outbound {
     AuthSuccess,
 }
 
+pub struct ClientInfo {
+    pub id: i32,
+    pub current_nonce: i32,
+}
+
 /// Atomically reads and increments the nonce for a known client.
 /// Returns `None` if the pubkey is not registered.
-async fn get_nonce(db: &db::DatabasePool, pubkey: &VerifyingKey) -> Result<Option<i32>, Error> {
+async fn get_client_and_nonce(
+    db: &db::DatabasePool,
+    pubkey: &VerifyingKey,
+) -> Result<Option<ClientInfo>, Error> {
     let pubkey_bytes = pubkey.as_bytes().to_vec();
 
     let mut conn = db.get().await.map_err(|e| {
@@ -83,8 +101,10 @@ async fn get_nonce(db: &db::DatabasePool, pubkey: &VerifyingKey) -> Result<Optio
                 .execute(conn)
                 .await?;
 
-            let _ = client_id;
-            Ok(Some(current_nonce))
+            Ok(Some(ClientInfo {
+                id: client_id,
+                current_nonce,
+            }))
         })
     })
     .await
@@ -96,13 +116,11 @@ async fn get_nonce(db: &db::DatabasePool, pubkey: &VerifyingKey) -> Result<Optio
 
 async fn approve_new_client(
     actors: &crate::actors::GlobalActors,
-    pubkey: VerifyingKey,
+    profile: ClientProfile,
 ) -> Result<(), Error> {
     let result = actors
-        .router
-        .ask(RequestClientApproval {
-            client_pubkey: pubkey,
-        })
+        .flow_coordinator
+        .ask(RequestClientApproval { client: profile })
         .await;
 
     match result {
@@ -113,65 +131,124 @@ async fn approve_new_client(
             Err(Error::ApproveError(ApproveError::Upstream(e)))
         }
         Err(e) => {
-            error!(error = ?e, "Approval request to router failed");
+            error!(error = ?e, "Approval request to flow coordinator failed");
             Err(Error::ApproveError(ApproveError::Internal))
         }
     }
 }
 
-enum InsertClientResult {
-    Inserted,
-    AlreadyExists,
-}
-
 async fn insert_client(
     db: &db::DatabasePool,
     pubkey: &VerifyingKey,
-) -> Result<InsertClientResult, Error> {
-    let now = std::time::SystemTime::now()
-        .duration_since(std::time::UNIX_EPOCH)
-        .unwrap_or_default()
-        .as_secs() as i32;
+    metadata: &ClientMetadata,
+) -> Result<i32, Error> {
+    use crate::db::schema::{client_metadata, program_client};
+    let mut conn = db.get().await.map_err(|e| {
+        error!(error = ?e, "Database pool error");
+        Error::DatabasePoolUnavailable
+    })?;
+
+    let metadata_id = insert_into(client_metadata::table)
+        .values((
+            client_metadata::name.eq(&metadata.name),
+            client_metadata::description.eq(&metadata.description),
+            client_metadata::version.eq(&metadata.version),
+        ))
+        .returning(client_metadata::id)
+        .get_result::<i32>(&mut conn)
+        .await
+        .map_err(|e| {
+            error!(error = ?e, "Failed to insert client metadata");
+            Error::DatabaseOperationFailed
+        })?;
+
+    let client_id = insert_into(program_client::table)
+        .values((
+            program_client::public_key.eq(pubkey.as_bytes().to_vec()),
+            program_client::metadata_id.eq(metadata_id),
+            program_client::nonce.eq(1), // pre-incremented; challenge uses 0
+        ))
+        .on_conflict_do_nothing()
+        .returning(program_client::id)
+        .get_result::<i32>(&mut conn)
+        .await
+        .map_err(|e| {
+            error!(error = ?e, "Failed to insert client metadata");
+            Error::DatabaseOperationFailed
+        })?;
+
+    Ok(client_id)
+}
+
+async fn sync_client_metadata(
+    db: &db::DatabasePool,
+    client_id: i32,
+    metadata: &ClientMetadata,
+) -> Result<(), Error> {
+    use crate::db::schema::{client_metadata, client_metadata_history};
+
+    let now = SqliteTimestamp(Utc::now());
 
     let mut conn = db.get().await.map_err(|e| {
         error!(error = ?e, "Database pool error");
         Error::DatabasePoolUnavailable
     })?;
 
-    match insert_into(program_client::table)
-        .values((
-            program_client::public_key.eq(pubkey.as_bytes().to_vec()),
-            program_client::nonce.eq(1), // pre-incremented; challenge uses 0
-            program_client::created_at.eq(now),
-            program_client::updated_at.eq(now),
-        ))
-        .execute(&mut conn)
-        .await
-    {
-        Ok(_) => {}
-        Err(diesel::result::Error::DatabaseError(
-            diesel::result::DatabaseErrorKind::UniqueViolation,
-            _,
-        )) => return Ok(InsertClientResult::AlreadyExists),
-        Err(e) => {
-            error!(error = ?e, "Failed to insert new client");
-            return Err(Error::DatabaseOperationFailed);
-        }
-    }
+    conn.exclusive_transaction(|conn| {
+        let metadata = metadata.clone();
+        Box::pin(async move {
+            let (current_metadata_id, current): (i32, ProgramClientMetadata) =
+                program_client::table
+                    .find(client_id)
+                    .inner_join(client_metadata::table)
+                    .select((
+                        program_client::metadata_id,
+                        ProgramClientMetadata::as_select(),
+                    ))
+                    .first(conn)
+                    .await?;
 
-    let client_id = program_client::table
-        .filter(program_client::public_key.eq(pubkey.as_bytes().to_vec()))
-        .order(program_client::id.desc())
-        .select(program_client::id)
-        .first::<i32>(&mut conn)
-        .await
-        .map_err(|e| {
-            error!(error = ?e, "Failed to load inserted client id");
-            Error::DatabaseOperationFailed
-        })?;
+            let unchanged = current.name == metadata.name
+                && current.description == metadata.description
+                && current.version == metadata.version;
+            if unchanged {
+                return Ok(());
+            }
 
-    let _ = client_id;
-    Ok(InsertClientResult::Inserted)
+            insert_into(client_metadata_history::table)
+                .values((
+                    client_metadata_history::metadata_id.eq(current_metadata_id),
+                    client_metadata_history::client_id.eq(client_id),
+                ))
+                .execute(conn)
+                .await?;
+
+            let metadata_id = insert_into(client_metadata::table)
+                .values((
+                    client_metadata::name.eq(&metadata.name),
+                    client_metadata::description.eq(&metadata.description),
+                    client_metadata::version.eq(&metadata.version),
+                ))
+                .returning(client_metadata::id)
+                .get_result::<i32>(conn)
+                .await?;
+
+            update(program_client::table.find(client_id))
+                .set((
+                    program_client::metadata_id.eq(metadata_id),
+                    program_client::updated_at.eq(now),
+                ))
+                .execute(conn)
+                .await?;
+
+            Ok::<(), diesel::result::Error>(())
+        })
+    })
+    .await
+    .map_err(|e| {
+        error!(error = ?e, "Database error");
+        Error::DatabaseOperationFailed
+    })
 }
 
 async fn challenge_client<T>(
@@ -217,26 +294,33 @@ pub async fn authenticate<T>(
 where
     T: Bi<Inbound, Result<Outbound, Error>> + Send + ?Sized,
 {
-    let Some(Inbound::AuthChallengeRequest { pubkey }) = transport.recv().await
-    else {
+    let Some(Inbound::AuthChallengeRequest { pubkey, metadata }) = transport.recv().await else {
         return Err(Error::Transport);
     };
 
-    let nonce = match get_nonce(&props.db, &pubkey).await? {
+    let info = match get_client_and_nonce(&props.db, &pubkey).await? {
         Some(nonce) => nonce,
         None => {
-            approve_new_client(&props.actors, pubkey).await?;
-            match insert_client(&props.db, &pubkey).await? {
-                InsertClientResult::Inserted => 0,
-                InsertClientResult::AlreadyExists => match get_nonce(&props.db, &pubkey).await? {
-                    Some(nonce) => nonce,
-                    None => return Err(Error::DatabaseOperationFailed),
+            approve_new_client(
+                &props.actors,
+                ClientProfile {
+                    pubkey,
+                    metadata: metadata.clone(),
                 },
+            )
+            .await?;
+            let client_id = insert_client(&props.db, &pubkey, &metadata).await?;
+            ClientInfo {
+                id: client_id,
+                current_nonce: 0,
             }
         }
     };
 
-    challenge_client(transport, pubkey, nonce).await?;
+    sync_client_metadata(&props.db, info.id, &metadata).await?;
+
+    challenge_client(transport, pubkey, info.current_nonce).await?;
+    
     transport
         .send(Ok(Outbound::AuthSuccess))
         .await

server/crates/arbiter-server/src/actors/client/mod.rs

@@ -1,12 +1,18 @@
-use arbiter_proto::transport::Bi;
+use arbiter_proto::{ClientMetadata, transport::Bi};
 use kameo::actor::Spawn;
 use tracing::{error, info};
 
 use crate::{
-    actors::{GlobalActors, client::session::ClientSession},
+    actors::{GlobalActors, client::{ session::ClientSession}},
     db,
 };
 
+#[derive(Debug, Clone)]
+pub struct ClientProfile {
+    pub pubkey: ed25519_dalek::VerifyingKey,
+    pub metadata: ClientMetadata,
+}
+
 pub struct ClientConnection {
     pub(crate) db: db::DatabasePool,
     pub(crate) actors: GlobalActors,

server/crates/arbiter-server/src/actors/client/session.rs

@@ -3,7 +3,8 @@ use tracing::error;
 
 use crate::{
     actors::{
-        GlobalActors, client::ClientConnection, keyholder::KeyHolderState, router::RegisterClient,
+        GlobalActors, client::ClientConnection, flow_coordinator::RegisterClient,
+        keyholder::KeyHolderState,
     },
     db,
 };
@@ -47,7 +48,7 @@ impl Actor for ClientSession {
     ) -> Result<Self, Self::Error> {
         args.props
             .actors
-            .router
+            .flow_coordinator
             .ask(RegisterClient { actor: this })
             .await
             .map_err(|_| Error::ConnectionRegistrationFailed)?;

server/crates/arbiter-server/src/actors/evm/mod.rs

@@ -9,12 +9,12 @@ use rand::{SeedableRng, rng, rngs::StdRng};
 use crate::{
     actors::keyholder::{CreateNew, Decrypt, KeyHolder},
     db::{
-        self, DatabasePool,
+        self, DatabaseError, DatabasePool,
         models::{self, SqliteTimestamp},
         schema,
     },
     evm::{
-        self, ListGrantsError, RunKind,
+        self, RunKind,
         policies::{
             FullGrant, Grant, SharedGrantSettings, SpecificGrant, SpecificMeaning,
             ether_transfer::EtherTransfer, token_transfers::TokenTransfer,
@@ -33,11 +33,7 @@ pub enum SignTransactionError {
 
     #[error("Database error: {0}")]
     #[diagnostic(code(arbiter::evm::sign::database))]
-    Database(#[from] diesel::result::Error),
-
-    #[error("Database pool error: {0}")]
-    #[diagnostic(code(arbiter::evm::sign::pool))]
-    Pool(#[from] db::PoolError),
+    Database(#[from] DatabaseError),
 
     #[error("Keyholder error: {0}")]
     #[diagnostic(code(arbiter::evm::sign::keyholder))]
@@ -68,15 +64,7 @@ pub enum Error {
 
     #[error("Database error: {0}")]
     #[diagnostic(code(arbiter::evm::database))]
-    Database(#[from] diesel::result::Error),
-
-    #[error("Database pool error: {0}")]
-    #[diagnostic(code(arbiter::evm::database_pool))]
-    DatabasePool(#[from] db::PoolError),
-
-    #[error("Grant creation error: {0}")]
-    #[diagnostic(code(arbiter::evm::creation))]
-    Creation(#[from] evm::CreationError),
+    Database(#[from] DatabaseError),
 }
 
 #[derive(Actor)]
@@ -105,7 +93,7 @@ impl EvmActor {
 #[messages]
 impl EvmActor {
     #[message]
-    pub async fn generate(&mut self) -> Result<Address, Error> {
+    pub async fn generate(&mut self) -> Result<(i32, Address), Error> {
         let (mut key_cell, address) = safe_signer::generate(&mut self.rng);
 
         let plaintext = key_cell.read_inline(|reader| SafeCell::new(reader.to_vec()));
@@ -116,29 +104,32 @@ impl EvmActor {
             .await
             .map_err(|_| Error::KeyholderSend)?;
 
-        let mut conn = self.db.get().await?;
-        insert_into(schema::evm_wallet::table)
+        let mut conn = self.db.get().await.map_err(DatabaseError::from)?;
+        let wallet_id = insert_into(schema::evm_wallet::table)
             .values(&models::NewEvmWallet {
                 address: address.as_slice().to_vec(),
                 aead_encrypted_id: aead_id,
             })
-            .execute(&mut conn)
-            .await?;
+            .returning(schema::evm_wallet::id)
+            .get_result(&mut conn)
+            .await
+            .map_err(DatabaseError::from)?;
 
-        Ok(address)
+        Ok((wallet_id, address))
     }
 
     #[message]
-    pub async fn list_wallets(&self) -> Result<Vec<Address>, Error> {
-        let mut conn = self.db.get().await?;
+    pub async fn list_wallets(&self) -> Result<Vec<(i32, Address)>, Error> {
+        let mut conn = self.db.get().await.map_err(DatabaseError::from)?;
         let rows: Vec<models::EvmWallet> = schema::evm_wallet::table
             .select(models::EvmWallet::as_select())
             .load(&mut conn)
-            .await?;
+            .await
+            .map_err(DatabaseError::from)?;
 
         Ok(rows
             .into_iter()
-            .map(|w| Address::from_slice(&w.address))
+            .map(|w| (w.id, Address::from_slice(&w.address)))
             .collect())
     }
 }
@@ -148,31 +139,24 @@ impl EvmActor {
     #[message]
     pub async fn useragent_create_grant(
         &mut self,
-        client_id: i32,
         basic: SharedGrantSettings,
         grant: SpecificGrant,
-    ) -> Result<i32, evm::CreationError> {
+    ) -> Result<i32, DatabaseError> {
         match grant {
             SpecificGrant::EtherTransfer(settings) => {
                 self.engine
-                    .create_grant::<EtherTransfer>(
-                        client_id,
-                        FullGrant {
-                            basic,
-                            specific: settings,
-                        },
-                    )
+                    .create_grant::<EtherTransfer>(FullGrant {
+                        basic,
+                        specific: settings,
+                    })
                     .await
             }
             SpecificGrant::TokenTransfer(settings) => {
                 self.engine
-                    .create_grant::<TokenTransfer>(
-                        client_id,
-                        FullGrant {
-                            basic,
-                            specific: settings,
-                        },
-                    )
+                    .create_grant::<TokenTransfer>(FullGrant {
+                        basic,
+                        specific: settings,
+                    })
                     .await
             }
         }
@@ -180,22 +164,23 @@ impl EvmActor {
 
     #[message]
     pub async fn useragent_delete_grant(&mut self, grant_id: i32) -> Result<(), Error> {
-        let mut conn = self.db.get().await?;
+        let mut conn = self.db.get().await.map_err(DatabaseError::from)?;
         diesel::update(schema::evm_basic_grant::table)
             .filter(schema::evm_basic_grant::id.eq(grant_id))
             .set(schema::evm_basic_grant::revoked_at.eq(SqliteTimestamp::now()))
             .execute(&mut conn)
-            .await?;
+            .await
+            .map_err(DatabaseError::from)?;
         Ok(())
     }
 
     #[message]
     pub async fn useragent_list_grants(&mut self) -> Result<Vec<Grant<SpecificGrant>>, Error> {
-        match self.engine.list_all_grants().await {
-            Ok(grants) => Ok(grants),
-            Err(ListGrantsError::Database(db)) => Err(Error::Database(db)),
-            Err(ListGrantsError::Pool(pool)) => Err(Error::DatabasePool(pool)),
-        }
+        Ok(self
+            .engine
+            .list_all_grants()
+            .await
+            .map_err(DatabaseError::from)?)
     }
 
     #[message]
@@ -205,24 +190,29 @@ impl EvmActor {
         wallet_address: Address,
         transaction: TxEip1559,
     ) -> Result<SpecificMeaning, SignTransactionError> {
-        let mut conn = self.db.get().await?;
+        let mut conn = self.db.get().await.map_err(DatabaseError::from)?;
         let wallet = schema::evm_wallet::table
             .select(models::EvmWallet::as_select())
             .filter(schema::evm_wallet::address.eq(wallet_address.as_slice()))
             .first(&mut conn)
             .await
-            .optional()?
+            .optional()
+            .map_err(DatabaseError::from)?
+            .ok_or(SignTransactionError::WalletNotFound)?;
+        let wallet_access = schema::evm_wallet_access::table
+            .select(models::EvmWalletAccess::as_select())
+            .filter(schema::evm_wallet_access::wallet_id.eq(wallet.id))
+            .filter(schema::evm_wallet_access::client_id.eq(client_id))
+            .first(&mut conn)
+            .await
+            .optional()
+            .map_err(DatabaseError::from)?
             .ok_or(SignTransactionError::WalletNotFound)?;
         drop(conn);
 
         let meaning = self
             .engine
-            .evaluate_transaction(
-                wallet.id,
-                client_id,
-                transaction.clone(),
-                RunKind::Execution,
-            )
+            .evaluate_transaction(wallet_access, transaction.clone(), RunKind::Execution)
             .await?;
 
         Ok(meaning)
@@ -235,13 +225,23 @@ impl EvmActor {
         wallet_address: Address,
         mut transaction: TxEip1559,
     ) -> Result<Signature, SignTransactionError> {
-        let mut conn = self.db.get().await?;
+        let mut conn = self.db.get().await.map_err(DatabaseError::from)?;
         let wallet = schema::evm_wallet::table
             .select(models::EvmWallet::as_select())
             .filter(schema::evm_wallet::address.eq(wallet_address.as_slice()))
             .first(&mut conn)
             .await
-            .optional()?
+            .optional()
+            .map_err(DatabaseError::from)?
+            .ok_or(SignTransactionError::WalletNotFound)?;
+        let wallet_access = schema::evm_wallet_access::table
+            .select(models::EvmWalletAccess::as_select())
+            .filter(schema::evm_wallet_access::wallet_id.eq(wallet.id))
+            .filter(schema::evm_wallet_access::client_id.eq(client_id))
+            .first(&mut conn)
+            .await
+            .optional()
+            .map_err(DatabaseError::from)?
             .ok_or(SignTransactionError::WalletNotFound)?;
         drop(conn);
 
@@ -256,12 +256,7 @@ impl EvmActor {
         let signer = safe_signer::SafeSigner::from_cell(raw_key)?;
 
         self.engine
-            .evaluate_transaction(
-                wallet.id,
-                client_id,
-                transaction.clone(),
-                RunKind::Execution,
-            )
+            .evaluate_transaction(wallet_access, transaction.clone(), RunKind::Execution)
             .await?;
 
         use alloy::network::TxSignerSync as _;

server/crates/arbiter-server/src/actors/flow_coordinator/client_connect_approval.rs

@@ -0,0 +1,101 @@
+use std::ops::ControlFlow;
+
+use kameo::{
+    Actor, messages,
+    prelude::{ActorId, ActorRef, ActorStopReason, Context, WeakActorRef},
+    reply::ReplySender,
+};
+
+use crate::actors::{
+    client::ClientProfile,
+    flow_coordinator::ApprovalError,
+    user_agent::{UserAgentSession, session::BeginNewClientApproval},
+};
+
+pub struct Args {
+    pub client: ClientProfile,
+    pub user_agents: Vec<ActorRef<UserAgentSession>>,
+    pub reply: ReplySender<Result<bool, ApprovalError>>
+}
+
+pub struct ClientApprovalController {
+    /// Number of UAs that have not yet responded (approval or denial) or died.
+    pending: usize,
+    /// Number of approvals received so far.
+    approved: usize,
+    reply: Option<ReplySender<Result<bool, ApprovalError>>>,
+}
+
+impl ClientApprovalController {
+    fn send_reply(&mut self, result: Result<bool, ApprovalError>) {
+        if let Some(reply) = self.reply.take() {
+            reply.send(result);
+        }
+    }
+}
+
+impl Actor for ClientApprovalController {
+    type Args = Args;
+    type Error = ();
+
+    async fn on_start(
+        Args { client, mut user_agents, reply }: Self::Args,
+        actor_ref: ActorRef<Self>,
+    ) -> Result<Self, Self::Error> {
+        let this = Self {
+            pending: user_agents.len(),
+            approved: 0,
+            reply: Some(reply),
+        };
+
+        for user_agent in user_agents.drain(..) {
+            actor_ref.link(&user_agent).await;
+            let _ = user_agent
+                .tell(BeginNewClientApproval {
+                    client: client.clone(),
+                    controller: actor_ref.clone(),
+                })
+                .await;
+        }
+
+        Ok(this)
+    }
+
+    async fn on_link_died(
+        &mut self,
+        _: WeakActorRef<Self>,
+        _: ActorId,
+        _: ActorStopReason,
+    ) -> Result<ControlFlow<ActorStopReason>, Self::Error> {
+        // A linked UA died before responding — counts as a non-approval.
+        self.pending = self.pending.saturating_sub(1);
+        if self.pending == 0 {
+            // At least one UA didn't approve: deny.
+            self.send_reply(Ok(false));
+            return Ok(ControlFlow::Break(ActorStopReason::Normal));
+        }
+        Ok(ControlFlow::Continue(()))
+    }
+}
+
+#[messages]
+impl ClientApprovalController {
+    #[message(ctx)]
+    pub async fn client_approval_answer(&mut self, approved: bool, ctx: &mut Context<Self, ()>) {
+        if !approved {
+            // Denial wins immediately regardless of other pending responses.
+            self.send_reply(Ok(false));
+            ctx.stop();
+            return;
+        }
+
+        self.approved += 1;
+        self.pending = self.pending.saturating_sub(1);
+
+        if self.pending == 0 {
+            // Every connected UA approved.
+            self.send_reply(Ok(true));
+            ctx.stop();
+        }
+    }
+}

server/crates/arbiter-server/src/actors/flow_coordinator/mod.rs

@@ -0,0 +1,118 @@
+use std::{collections::HashMap, ops::ControlFlow};
+
+use kameo::{
+    Actor,
+    actor::{ActorId, ActorRef, Spawn},
+    messages,
+    prelude::{ActorStopReason, Context, WeakActorRef},
+    reply::DelegatedReply,
+};
+use tracing::info;
+
+use crate::actors::{
+    client::{ClientProfile, session::ClientSession},
+    flow_coordinator::client_connect_approval::ClientApprovalController,
+    user_agent::session::UserAgentSession,
+};
+
+pub mod client_connect_approval;
+
+#[derive(Default)]
+pub struct FlowCoordinator {
+    pub user_agents: HashMap<ActorId, ActorRef<UserAgentSession>>,
+    pub clients: HashMap<ActorId, ActorRef<ClientSession>>,
+}
+
+impl Actor for FlowCoordinator {
+    type Args = Self;
+
+    type Error = ();
+
+    async fn on_start(args: Self::Args, _: ActorRef<Self>) -> Result<Self, Self::Error> {
+        Ok(args)
+    }
+
+    async fn on_link_died(
+        &mut self,
+        _: WeakActorRef<Self>,
+        id: ActorId,
+        _: ActorStopReason,
+    ) -> Result<ControlFlow<ActorStopReason>, Self::Error> {
+        if self.user_agents.remove(&id).is_some() {
+            info!(
+                ?id,
+                actor = "FlowCoordinator",
+                event = "useragent.disconnected"
+            );
+        } else if self.clients.remove(&id).is_some() {
+            info!(
+                ?id,
+                actor = "FlowCoordinator",
+                event = "client.disconnected"
+            );
+        } else {
+            info!(
+                ?id,
+                actor = "FlowCoordinator",
+                event = "unknown.actor.disconnected"
+            );
+        }
+        Ok(ControlFlow::Continue(()))
+    }
+}
+
+#[derive(Debug, thiserror::Error, Clone, PartialEq, Eq, Hash)]
+pub enum ApprovalError {
+    #[error("No user agents connected")]
+    NoUserAgentsConnected,
+}
+
+#[messages]
+impl FlowCoordinator {
+    #[message(ctx)]
+    pub async fn register_user_agent(
+        &mut self,
+        actor: ActorRef<UserAgentSession>,
+        ctx: &mut Context<Self, ()>,
+    ) {
+        info!(id = %actor.id(), actor = "FlowCoordinator", event = "useragent.connected");
+        ctx.actor_ref().link(&actor).await;
+        self.user_agents.insert(actor.id(), actor);
+    }
+
+    #[message(ctx)]
+    pub async fn register_client(
+        &mut self,
+        actor: ActorRef<ClientSession>,
+        ctx: &mut Context<Self, ()>,
+    ) {
+        info!(id = %actor.id(), actor = "FlowCoordinator", event = "client.connected");
+        ctx.actor_ref().link(&actor).await;
+        self.clients.insert(actor.id(), actor);
+    }
+
+    #[message(ctx)]
+    pub async fn request_client_approval(
+        &mut self,
+        client: ClientProfile,
+        ctx: &mut Context<Self, DelegatedReply<Result<bool, ApprovalError>>>,
+    ) -> DelegatedReply<Result<bool, ApprovalError>> {
+        let (reply, Some(reply_sender)) = ctx.reply_sender() else {
+            unreachable!("Expected `request_client_approval` to have callback channel");
+        };
+
+        let refs: Vec<_> = self.user_agents.values().cloned().collect();
+        if refs.is_empty() {
+            reply_sender.send(Err(ApprovalError::NoUserAgentsConnected));
+            return reply;
+        }
+
+        ClientApprovalController::spawn(client_connect_approval::Args {
+            client,
+            user_agents: refs,
+            reply: reply_sender,
+        });
+
+        reply
+    }
+}

server/crates/arbiter-server/src/actors/mod.rs

@@ -3,15 +3,18 @@ use miette::Diagnostic;
 use thiserror::Error;
 
 use crate::{
-    actors::{bootstrap::Bootstrapper, evm::EvmActor, keyholder::KeyHolder, router::MessageRouter},
+    actors::{
+        bootstrap::Bootstrapper, evm::EvmActor, flow_coordinator::FlowCoordinator,
+        keyholder::KeyHolder,
+    },
     db,
 };
 
 pub mod bootstrap;
 pub mod client;
 mod evm;
+pub mod flow_coordinator;
 pub mod keyholder;
-pub mod router;
 pub mod user_agent;
 
 #[derive(Error, Debug, Diagnostic)]
@@ -30,7 +33,7 @@ pub enum SpawnError {
 pub struct GlobalActors {
     pub key_holder: ActorRef<KeyHolder>,
     pub bootstrapper: ActorRef<Bootstrapper>,
-    pub router: ActorRef<MessageRouter>,
+    pub flow_coordinator: ActorRef<FlowCoordinator>,
     pub evm: ActorRef<EvmActor>,
 }
 
@@ -41,7 +44,7 @@ impl GlobalActors {
             bootstrapper: Bootstrapper::spawn(Bootstrapper::new(&db).await?),
             evm: EvmActor::spawn(EvmActor::new(key_holder.clone(), db)),
             key_holder,
-            router: MessageRouter::spawn(MessageRouter::default()),
+            flow_coordinator: FlowCoordinator::spawn(FlowCoordinator::default()),
         })
     }
 }

server/crates/arbiter-server/src/actors/router/mod.rs

@@ -1,173 +0,0 @@
-use std::{collections::HashMap, ops::ControlFlow};
-
-use ed25519_dalek::VerifyingKey;
-use kameo::{
-    Actor,
-    actor::{ActorId, ActorRef},
-    messages,
-    prelude::{ActorStopReason, Context, WeakActorRef},
-    reply::DelegatedReply,
-};
-use tokio::{sync::watch, task::JoinSet};
-use tracing::{info, warn};
-
-use crate::actors::{
-    client::session::ClientSession,
-    user_agent::session::{RequestNewClientApproval, UserAgentSession},
-};
-
-#[derive(Default)]
-pub struct MessageRouter {
-    pub user_agents: HashMap<ActorId, ActorRef<UserAgentSession>>,
-    pub clients: HashMap<ActorId, ActorRef<ClientSession>>,
-}
-
-impl Actor for MessageRouter {
-    type Args = Self;
-
-    type Error = ();
-
-    async fn on_start(args: Self::Args, _: ActorRef<Self>) -> Result<Self, Self::Error> {
-        Ok(args)
-    }
-
-    async fn on_link_died(
-        &mut self,
-        _: WeakActorRef<Self>,
-        id: ActorId,
-        _: ActorStopReason,
-    ) -> Result<ControlFlow<ActorStopReason>, Self::Error> {
-        if self.user_agents.remove(&id).is_some() {
-            info!(
-                ?id,
-                actor = "MessageRouter",
-                event = "useragent.disconnected"
-            );
-        } else if self.clients.remove(&id).is_some() {
-            info!(?id, actor = "MessageRouter", event = "client.disconnected");
-        } else {
-            info!(
-                ?id,
-                actor = "MessageRouter",
-                event = "unknown.actor.disconnected"
-            );
-        }
-        Ok(ControlFlow::Continue(()))
-    }
-}
-
-#[derive(Debug, thiserror::Error, Clone, PartialEq, Eq, Hash)]
-pub enum ApprovalError {
-    #[error("No user agents connected")]
-    NoUserAgentsConnected,
-}
-
-async fn request_client_approval(
-    user_agents: &[WeakActorRef<UserAgentSession>],
-    client_pubkey: VerifyingKey,
-) -> Result<bool, ApprovalError> {
-    if user_agents.is_empty() {
-        return Err(ApprovalError::NoUserAgentsConnected);
-    }
-
-    let mut pool = JoinSet::new();
-    let (cancel_tx, cancel_rx) = watch::channel(());
-
-    for weak_ref in user_agents {
-        match weak_ref.upgrade() {
-            Some(agent) => {
-                let cancel_rx = cancel_rx.clone();
-                pool.spawn(async move {
-                    agent
-                        .ask(RequestNewClientApproval {
-                            client_pubkey,
-                            cancel_flag: cancel_rx.clone(),
-                        })
-                        .await
-                });
-            }
-            None => {
-                warn!(
-                    id = weak_ref.id().to_string(),
-                    actor = "MessageRouter",
-                    event = "useragent.disconnected_before_approval"
-                );
-            }
-        }
-    }
-
-    while let Some(result) = pool.join_next().await {
-        match result {
-            Ok(Ok(approved)) => {
-                // cancel other pending requests
-                let _ = cancel_tx.send(());
-                return Ok(approved);
-            }
-            Ok(Err(err)) => {
-                warn!(
-                    ?err,
-                    actor = "MessageRouter",
-                    event = "useragent.approval_error"
-                );
-            }
-            Err(err) => {
-                warn!(
-                    ?err,
-                    actor = "MessageRouter",
-                    event = "useragent.approval_task_failed"
-                );
-            }
-        }
-    }
-
-    Err(ApprovalError::NoUserAgentsConnected)
-}
-
-#[messages]
-impl MessageRouter {
-    #[message(ctx)]
-    pub async fn register_user_agent(
-        &mut self,
-        actor: ActorRef<UserAgentSession>,
-        ctx: &mut Context<Self, ()>,
-    ) {
-        info!(id = %actor.id(), actor = "MessageRouter", event = "useragent.connected");
-        ctx.actor_ref().link(&actor).await;
-        self.user_agents.insert(actor.id(), actor);
-    }
-
-    #[message(ctx)]
-    pub async fn register_client(
-        &mut self,
-        actor: ActorRef<ClientSession>,
-        ctx: &mut Context<Self, ()>,
-    ) {
-        info!(id = %actor.id(), actor = "MessageRouter", event = "client.connected");
-        ctx.actor_ref().link(&actor).await;
-        self.clients.insert(actor.id(), actor);
-    }
-
-    #[message(ctx)]
-    pub async fn request_client_approval(
-        &mut self,
-        client_pubkey: VerifyingKey,
-        ctx: &mut Context<Self, DelegatedReply<Result<bool, ApprovalError>>>,
-    ) -> DelegatedReply<Result<bool, ApprovalError>> {
-        let (reply, Some(reply_sender)) = ctx.reply_sender() else {
-            unreachable!("Expected `request_client_approval` to have callback channel");
-        };
-
-        let weak_refs = self
-            .user_agents
-            .values()
-            .map(|agent| agent.downgrade())
-            .collect::<Vec<_>>();
-
-        tokio::task::spawn(async move {
-            let result = request_client_approval(&weak_refs, client_pubkey).await;
-            reply_sender.send(result);
-        });
-
-        reply
-    }
-}

server/crates/arbiter-server/src/actors/user_agent/mod.rs

@@ -1,5 +1,5 @@
 use crate::{
-    actors::GlobalActors,
+    actors::{GlobalActors, client::ClientProfile},
     db::{self, models::KeyType},
 };
 
@@ -72,8 +72,8 @@ impl TryFrom<(KeyType, Vec<u8>)> for AuthPublicKey {
 // Messages, sent by user agent to connection client without having a request
 #[derive(Debug)]
 pub enum OutOfBand {
-    ClientConnectionRequest { pubkey: ed25519_dalek::VerifyingKey },
-    ClientConnectionCancel,
+    ClientConnectionRequest { profile: ClientProfile },
+    ClientConnectionCancel { pubkey: ed25519_dalek::VerifyingKey },
 }
 
 pub struct UserAgentConnection {

server/crates/arbiter-server/src/actors/user_agent/session.rs

@@ -1,15 +1,15 @@
-use std::borrow::Cow;
+use std::{borrow::Cow, collections::HashMap};
 
 use arbiter_proto::transport::Sender;
 use async_trait::async_trait;
 use ed25519_dalek::VerifyingKey;
-use kameo::{Actor, messages};
+use kameo::{Actor, actor::ActorRef, messages};
 use thiserror::Error;
-use tokio::sync::watch;
 use tracing::error;
 
 use crate::actors::{
-    router::RegisterUserAgent,
+    client::ClientProfile,
+    flow_coordinator::{RegisterUserAgent, client_connect_approval::ClientApprovalController},
     user_agent::{OutOfBand, UserAgentConnection},
 };
 
@@ -25,6 +25,19 @@ pub enum Error {
     Internal { message: Cow<'static, str> },
 }
 
+impl From<crate::db::PoolError> for Error {
+    fn from(err: crate::db::PoolError) -> Self {
+        error!(?err, "Database pool error");
+        Self::internal("Database pool error")
+    }
+}
+impl From<diesel::result::Error> for Error {
+    fn from(err: diesel::result::Error) -> Self {
+        error!(?err, "Database error");
+        Self::internal("Database error")
+    }
+}
+
 impl Error {
     pub fn internal(message: impl Into<Cow<'static, str>>) -> Self {
         Self::Internal {
@@ -33,19 +46,19 @@ impl Error {
     }
 }
 
+pub struct PendingClientApproval {
+    controller: ActorRef<ClientApprovalController>,
+}
+
 pub struct UserAgentSession {
     props: UserAgentConnection,
     state: UserAgentStateMachine<DummyContext>,
-    #[allow(dead_code, reason = "The session keeps ownership of the outbound transport even before the state-machine flow starts using it directly")]
     sender: Box<dyn Sender<OutOfBand>>,
+
+    pending_client_approvals: HashMap<VerifyingKey, PendingClientApproval>,
 }
 
-mod connection;
-pub(crate) use connection::{
-    BootstrapError, HandleBootstrapEncryptedKey, HandleEvmWalletCreate, HandleEvmWalletList,
-    HandleGrantCreate, HandleGrantDelete, HandleGrantList, HandleQueryVaultState,
-};
-pub use connection::{HandleUnsealEncryptedKey, HandleUnsealRequest, UnsealError};
+pub mod connection;
 
 impl UserAgentSession {
     pub(crate) fn new(props: UserAgentConnection, sender: Box<dyn Sender<OutOfBand>>) -> Self {
@@ -53,6 +66,7 @@ impl UserAgentSession {
             props,
             state: UserAgentStateMachine::new(DummyContext),
             sender,
+            pending_client_approvals: Default::default(),
         }
     }
 
@@ -84,26 +98,28 @@ impl UserAgentSession {
 #[messages]
 impl UserAgentSession {
     #[message]
-    pub async fn request_new_client_approval(
+    pub async fn begin_new_client_approval(
         &mut self,
-        client_pubkey: VerifyingKey,
-        mut cancel_flag: watch::Receiver<()>,
-    ) -> Result<bool, ()> {
-        if self
+        client: ClientProfile,
+        controller: ActorRef<ClientApprovalController>,
+    ) {
+        if let Err(e) = self
             .sender
             .send(OutOfBand::ClientConnectionRequest {
-                pubkey: client_pubkey,
+                profile: client.clone(),
             })
             .await
-            .is_err()
         {
-            return Err(());
+            error!(
+                ?e,
+                actor = "user_agent",
+                event = "failed to announce new client connection"
+            );
+            return;
         }
 
-        let _ = cancel_flag.changed().await;
-
-        let _ = self.sender.send(OutOfBand::ClientConnectionCancel).await;
-        Ok(false)
+        self.pending_client_approvals
+            .insert(client.pubkey, PendingClientApproval { controller });
     }
 }
 
@@ -118,15 +134,48 @@ impl Actor for UserAgentSession {
     ) -> Result<Self, Self::Error> {
         args.props
             .actors
-            .router
+            .flow_coordinator
             .ask(RegisterUserAgent {
                 actor: this.clone(),
             })
             .await
             .map_err(|err| {
-                error!(?err, "Failed to register user agent connection with router");
-                Error::internal("Failed to register user agent connection with router")
+                error!(
+                    ?err,
+                    "Failed to register user agent connection with flow coordinator"
+                );
+                Error::internal("Failed to register user agent connection with flow coordinator")
             })?;
         Ok(args)
     }
+
+    async fn on_link_died(
+        &mut self,
+        _: kameo::prelude::WeakActorRef<Self>,
+        id: kameo::prelude::ActorId,
+        _: kameo::prelude::ActorStopReason,
+    ) -> Result<std::ops::ControlFlow<kameo::prelude::ActorStopReason>, Self::Error> {
+        let cancelled_pubkey = self
+            .pending_client_approvals
+            .iter()
+            .find_map(|(k, v)| (v.controller.id() == id).then_some(*k));
+
+        if let Some(pubkey) = cancelled_pubkey {
+            self.pending_client_approvals.remove(&pubkey);
+
+            if let Err(e) = self
+                .sender
+                .send(OutOfBand::ClientConnectionCancel { pubkey })
+                .await
+            {
+                error!(
+                    ?e,
+                    actor = "user_agent",
+                    event = "failed to announce client connection cancellation"
+                );
+            }
+        }
+
+        Ok(std::ops::ControlFlow::Continue(()))
+    }
 }

server/crates/arbiter-server/src/actors/user_agent/session/connection.rs

@@ -2,13 +2,22 @@ use std::sync::Mutex;
 
 use alloy::primitives::Address;
 use chacha20poly1305::{AeadInPlace, XChaCha20Poly1305, XNonce, aead::KeyInit};
+use diesel::sql_types::ops::Add;
+use diesel::{BoolExpressionMethods as _, ExpressionMethods as _, QueryDsl as _, SelectableHelper};
+use diesel_async::{AsyncConnection, RunQueryDsl};
 use kameo::error::SendError;
-use kameo::messages;
+use kameo::prelude::Context;
+use kameo::{message, messages};
 use tracing::{error, info};
 use x25519_dalek::{EphemeralSecret, PublicKey};
 
+use crate::actors::flow_coordinator::client_connect_approval::ClientApprovalAnswer;
 use crate::actors::keyholder::KeyHolderState;
 use crate::actors::user_agent::session::Error;
+use crate::db::models::{
+    CoreEvmWalletAccess, EvmWalletAccess, NewEvmWalletAccess, ProgramClient, ProgramClientMetadata,
+};
+use crate::db::schema::evm_wallet_access;
 use crate::evm::policies::{Grant, SpecificGrant};
 use crate::safe_cell::SafeCell;
 use crate::{
@@ -18,9 +27,9 @@ use crate::{
         },
         keyholder::{self, Bootstrap, TryUnseal},
         user_agent::session::{
-                UserAgentSession,
-                state::{UnsealContext, UserAgentEvents, UserAgentStates},
-            },
+            UserAgentSession,
+            state::{UnsealContext, UserAgentEvents, UserAgentStates},
+        },
     },
     safe_cell::SafeCellHandle as _,
 };
@@ -271,7 +280,7 @@ impl UserAgentSession {
 #[messages]
 impl UserAgentSession {
     #[message]
-    pub(crate) async fn handle_evm_wallet_create(&mut self) -> Result<Address, Error> {
+    pub(crate) async fn handle_evm_wallet_create(&mut self) -> Result<(i32, Address), Error> {
         match self.props.actors.evm.ask(Generate {}).await {
             Ok(address) => Ok(address),
             Err(SendError::HandlerError(err)) => Err(Error::internal(format!(
@@ -285,7 +294,7 @@ impl UserAgentSession {
     }
 
     #[message]
-    pub(crate) async fn handle_evm_wallet_list(&mut self) -> Result<Vec<Address>, Error> {
+    pub(crate) async fn handle_evm_wallet_list(&mut self) -> Result<Vec<(i32, Address)>, Error> {
         match self.props.actors.evm.ask(ListWallets {}).await {
             Ok(wallets) => Ok(wallets),
             Err(err) => {
@@ -312,7 +321,6 @@ impl UserAgentSession {
     #[message]
     pub(crate) async fn handle_grant_create(
         &mut self,
-        client_id: i32,
         basic: crate::evm::policies::SharedGrantSettings,
         grant: crate::evm::policies::SpecificGrant,
     ) -> Result<i32, Error> {
@@ -320,11 +328,7 @@ impl UserAgentSession {
             .props
             .actors
             .evm
-            .ask(UseragentCreateGrant {
-                client_id,
-                basic,
-                grant,
-            })
+            .ask(UseragentCreateGrant { basic, grant })
             .await
         {
             Ok(grant_id) => Ok(grant_id),
@@ -351,4 +355,119 @@ impl UserAgentSession {
             }
         }
     }
+
+    #[message]
+    pub(crate) async fn handle_grant_evm_wallet_access(
+        &mut self,
+        entries: Vec<NewEvmWalletAccess>,
+    ) -> Result<(), Error> {
+        let mut conn = self.props.db.get().await?;
+        conn.transaction(|conn| {
+            Box::pin(async move {
+                use crate::db::schema::evm_wallet_access;
+
+                for entry in entries {
+                    diesel::insert_into(evm_wallet_access::table)
+                        .values(&entry)
+                        .on_conflict_do_nothing()
+                        .execute(conn)
+                        .await?;
+                }
+
+                Result::<_, Error>::Ok(())
+            })
+        })
+        .await?;
+        Ok(())
+    }
+
+    #[message]
+    pub(crate) async fn handle_revoke_evm_wallet_access(
+        &mut self,
+        entries: Vec<i32>,
+    ) -> Result<(), Error> {
+        let mut conn = self.props.db.get().await?;
+        conn.transaction(|conn| {
+            Box::pin(async move {
+                use crate::db::schema::evm_wallet_access;
+                for entry in entries {
+                    diesel::delete(evm_wallet_access::table)
+                        .filter(evm_wallet_access::wallet_id.eq(entry))
+                        .execute(conn)
+                        .await?;
+                }
+
+                Result::<_, Error>::Ok(())
+            })
+        })
+        .await?;
+        Ok(())
+    }
+
+    #[message]
+    pub(crate) async fn handle_list_wallet_access(
+        &mut self,
+    ) -> Result<Vec<EvmWalletAccess>, Error> {
+        let mut conn = self.props.db.get().await?;
+        use crate::db::schema::evm_wallet_access;
+        let access_entries = evm_wallet_access::table
+            .select(EvmWalletAccess::as_select())
+            .load::<_>(&mut conn)
+            .await?;
+        Ok(access_entries)
+    }
+}
+
+#[messages]
+impl UserAgentSession {
+    #[message(ctx)]
+    pub(crate) async fn handle_new_client_approve(
+        &mut self,
+        approved: bool,
+        pubkey: ed25519_dalek::VerifyingKey,
+        ctx: &mut Context<Self, Result<(), Error>>,
+    ) -> Result<(), Error> {
+        let pending_approval = match self.pending_client_approvals.remove(&pubkey) {
+            Some(approval) => approval,
+            None => {
+                error!("Received client connection response for unknown client");
+                return Err(Error::internal("Unknown client in connection response"));
+            }
+        };
+
+        pending_approval
+            .controller
+            .tell(ClientApprovalAnswer { approved })
+            .await
+            .map_err(|err| {
+                error!(
+                    ?err,
+                    "Failed to send client approval response to controller"
+                );
+                Error::internal("Failed to send client approval response to controller")
+            })?;
+
+        ctx.actor_ref().unlink(&pending_approval.controller).await;
+
+        Ok(())
+    }
+
+    #[message]
+    pub(crate) async fn handle_sdk_client_list(
+        &mut self,
+    ) -> Result<Vec<(ProgramClient, ProgramClientMetadata)>, Error> {
+        use crate::db::schema::{client_metadata, program_client};
+        let mut conn = self.props.db.get().await?;
+
+        let clients = program_client::table
+            .inner_join(client_metadata::table)
+            .select((
+                ProgramClient::as_select(),
+                ProgramClientMetadata::as_select(),
+            ))
+            .load::<(ProgramClient, ProgramClientMetadata)>(&mut conn)
+            .await?;
+
+        Ok(clients)
+    }
 }

server/crates/arbiter-server/src/cli.rs

@@ -0,0 +1,72 @@
+use std::{
+    net::{Ipv4Addr, SocketAddr, SocketAddrV4},
+    path::PathBuf,
+};
+
+use clap::{Args, Parser, Subcommand};
+
+const DEFAULT_LISTEN_ADDR: SocketAddr = SocketAddr::V4(SocketAddrV4::new(
+    Ipv4Addr::LOCALHOST,
+    arbiter_proto::DEFAULT_SERVER_PORT,
+));
+
+#[derive(Debug, Parser)]
+#[command(name = "arbiter-server")]
+#[command(about = "Arbiter gRPC server")]
+pub struct Cli {
+    #[command(subcommand)]
+    pub command: Option<Command>,
+}
+
+#[derive(Debug, Subcommand)]
+pub enum Command {
+    /// Run server in foreground mode.
+    Run(RunArgs),
+    /// Manage service lifecycle.
+    Service {
+        #[command(subcommand)]
+        command: ServiceCommand,
+    },
+}
+
+#[derive(Debug, Clone, Args)]
+pub struct RunArgs {
+    #[arg(long, default_value_t = DEFAULT_LISTEN_ADDR)]
+    pub listen_addr: SocketAddr,
+    #[arg(long)]
+    pub data_dir: Option<PathBuf>,
+}
+
+impl Default for RunArgs {
+    fn default() -> Self {
+        Self {
+            listen_addr: DEFAULT_LISTEN_ADDR,
+            data_dir: None,
+        }
+    }
+}
+
+#[derive(Debug, Subcommand)]
+pub enum ServiceCommand {
+    /// Install Windows service in Service Control Manager.
+    Install(ServiceInstallArgs),
+    /// Internal service entrypoint. SCM only.
+    #[command(hide = true)]
+    Run(ServiceRunArgs),
+}
+
+#[derive(Debug, Clone, Args)]
+pub struct ServiceInstallArgs {
+    #[arg(long)]
+    pub start: bool,
+    #[arg(long)]
+    pub data_dir: Option<PathBuf>,
+}
+
+#[derive(Debug, Clone, Args)]
+pub struct ServiceRunArgs {
+    #[arg(long, default_value_t = DEFAULT_LISTEN_ADDR)]
+    pub listen_addr: SocketAddr,
+    #[arg(long)]
+    pub data_dir: Option<PathBuf>,
+}

server/crates/arbiter-server/src/context/tls.rs

@@ -1,4 +1,4 @@
-use std::string::FromUtf8Error;
+use std::{net::IpAddr, string::FromUtf8Error};
 
 use diesel::{ExpressionMethods as _, QueryDsl, SelectableHelper as _};
 use diesel_async::{AsyncConnection, RunQueryDsl};
@@ -6,7 +6,7 @@ use miette::Diagnostic;
 use pem::Pem;
 use rcgen::{
     BasicConstraints, Certificate, CertificateParams, CertifiedIssuer, DistinguishedName, DnType,
-    IsCa, Issuer, KeyPair, KeyUsagePurpose,
+    IsCa, Issuer, KeyPair, KeyUsagePurpose, SanType,
 };
 use rustls::pki_types::pem::PemObject;
 use thiserror::Error;
@@ -114,6 +114,11 @@ impl TlsCa {
             KeyUsagePurpose::DigitalSignature,
             KeyUsagePurpose::KeyEncipherment,
         ];
+        params
+            .subject_alt_names
+            .push(SanType::IpAddress(IpAddr::from([
+                127, 0, 0, 1,
+            ])));
 
         let mut dn = DistinguishedName::new();
         dn.push(DnType::CommonName, "Arbiter Instance Leaf");

server/crates/arbiter-server/src/db/models.rs

@@ -21,7 +21,7 @@ pub mod types {
         sqlite::{Sqlite, SqliteType},
     };
 
-    #[derive(Debug, FromSqlRow, AsExpression)]
+    #[derive(Debug, FromSqlRow, AsExpression, Clone)]
     #[diesel(sql_type = Integer)]
     #[repr(transparent)] // hint compiler to optimize the wrapper struct away
     pub struct SqliteTimestamp(pub DateTime<Utc>);
@@ -185,12 +185,53 @@ pub struct EvmWallet {
     pub created_at: SqliteTimestamp,
 }
 
-#[derive(Queryable, Debug, Insertable, Selectable)]
+#[derive(Models, Queryable, Debug, Insertable, Selectable, Clone)]
+#[diesel(table_name = schema::evm_wallet_access, check_for_backend(Sqlite))]
+#[view(
+    NewEvmWalletAccess,
+    derive(Insertable),
+    omit(id, created_at),
+    attributes_with = "deriveless"
+)]
+#[view(
+    CoreEvmWalletAccess,
+    derive(Insertable),
+    omit(created_at),
+    attributes_with = "deriveless"
+)]
+pub struct EvmWalletAccess {
+    pub id: i32,
+    pub wallet_id: i32,
+    pub client_id: i32,
+    pub created_at: SqliteTimestamp,
+}
+
+#[derive(Models, Queryable, Debug, Insertable, Selectable)]
+#[diesel(table_name = schema::client_metadata, check_for_backend(Sqlite))]
+pub struct ProgramClientMetadata {
+    pub id: i32,
+    pub name: String,
+    pub description: Option<String>,
+    pub version: Option<String>,
+    pub created_at: SqliteTimestamp,
+}
+
+#[derive(Models, Queryable, Debug, Insertable, Selectable)]
+#[diesel(table_name = schema::client_metadata_history, check_for_backend(Sqlite))]
+pub struct ProgramClientMetadataHistory {
+    pub id: i32,
+    pub metadata_id: i32,
+    pub client_id: i32,
+    pub created_at: SqliteTimestamp,
+}
+
+#[derive(Models, Queryable, Debug, Insertable, Selectable)]
 #[diesel(table_name = schema::program_client, check_for_backend(Sqlite))]
 pub struct ProgramClient {
     pub id: i32,
     pub nonce: i32,
     pub public_key: Vec<u8>,
+    pub metadata_id: i32,
     pub created_at: SqliteTimestamp,
     pub updated_at: SqliteTimestamp,
 }
@@ -230,8 +271,7 @@ pub struct EvmEtherTransferLimit {
 )]
 pub struct EvmBasicGrant {
     pub id: i32,
-    pub wallet_id: i32, // references evm_wallet.id
-    pub client_id: i32, // references program_client.id
+    pub wallet_access_id: i32, // references evm_wallet_access.id
     pub chain_id: i32,
     pub valid_from: Option<SqliteTimestamp>,
     pub valid_until: Option<SqliteTimestamp>,
@@ -254,8 +294,7 @@ pub struct EvmBasicGrant {
 pub struct EvmTransactionLog {
     pub id: i32,
     pub grant_id: i32,
-    pub client_id: i32,
-    pub wallet_id: i32,
+    pub wallet_access_id: i32,
     pub chain_id: i32,
     pub eth_value: Vec<u8>,
     pub signed_at: SqliteTimestamp,

server/crates/arbiter-server/src/db/schema.rs

@@ -20,11 +20,29 @@ diesel::table! {
     }
 }
 
+diesel::table! {
+    client_metadata (id) {
+        id -> Integer,
+        name -> Text,
+        description -> Nullable<Text>,
+        version -> Nullable<Text>,
+        created_at -> Integer,
+    }
+}
+
+diesel::table! {
+    client_metadata_history (id) {
+        id -> Integer,
+        metadata_id -> Integer,
+        client_id -> Integer,
+        created_at -> Integer,
+    }
+}
+
 diesel::table! {
     evm_basic_grant (id) {
         id -> Integer,
-        wallet_id -> Integer,
-        client_id -> Integer,
+        wallet_access_id -> Integer,
         chain_id -> Integer,
         valid_from -> Nullable<Integer>,
         valid_until -> Nullable<Integer>,
@@ -95,9 +113,8 @@ diesel::table! {
 diesel::table! {
     evm_transaction_log (id) {
         id -> Integer,
+        wallet_access_id -> Integer,
         grant_id -> Integer,
-        client_id -> Integer,
-        wallet_id -> Integer,
         chain_id -> Integer,
         eth_value -> Binary,
         signed_at -> Integer,
@@ -113,11 +130,21 @@ diesel::table! {
     }
 }
 
+diesel::table! {
+    evm_wallet_access (id) {
+        id -> Integer,
+        wallet_id -> Integer,
+        client_id -> Integer,
+        created_at -> Integer,
+    }
+}
+
 diesel::table! {
     program_client (id) {
         id -> Integer,
         nonce -> Integer,
         public_key -> Binary,
+        metadata_id -> Integer,
         created_at -> Integer,
         updated_at -> Integer,
     }
@@ -151,17 +178,18 @@ diesel::table! {
         id -> Integer,
         nonce -> Integer,
         public_key -> Binary,
+        key_type -> Integer,
         created_at -> Integer,
         updated_at -> Integer,
-        key_type -> Integer,
     }
 }
 
 diesel::joinable!(aead_encrypted -> root_key_history (associated_root_key_id));
 diesel::joinable!(arbiter_settings -> root_key_history (root_key_id));
 diesel::joinable!(arbiter_settings -> tls_history (tls_id));
-diesel::joinable!(evm_basic_grant -> evm_wallet (wallet_id));
-diesel::joinable!(evm_basic_grant -> program_client (client_id));
+diesel::joinable!(client_metadata_history -> client_metadata (metadata_id));
+diesel::joinable!(client_metadata_history -> program_client (client_id));
+diesel::joinable!(evm_basic_grant -> evm_wallet_access (wallet_access_id));
 diesel::joinable!(evm_ether_transfer_grant -> evm_basic_grant (basic_grant_id));
 diesel::joinable!(evm_ether_transfer_grant -> evm_ether_transfer_limit (limit_id));
 diesel::joinable!(evm_ether_transfer_grant_target -> evm_ether_transfer_grant (grant_id));
@@ -169,11 +197,18 @@ diesel::joinable!(evm_token_transfer_grant -> evm_basic_grant (basic_grant_id));
 diesel::joinable!(evm_token_transfer_log -> evm_token_transfer_grant (grant_id));
 diesel::joinable!(evm_token_transfer_log -> evm_transaction_log (log_id));
 diesel::joinable!(evm_token_transfer_volume_limit -> evm_token_transfer_grant (grant_id));
+diesel::joinable!(evm_transaction_log -> evm_basic_grant (grant_id));
+diesel::joinable!(evm_transaction_log -> evm_wallet_access (wallet_access_id));
 diesel::joinable!(evm_wallet -> aead_encrypted (aead_encrypted_id));
+diesel::joinable!(evm_wallet_access -> evm_wallet (wallet_id));
+diesel::joinable!(evm_wallet_access -> program_client (client_id));
+diesel::joinable!(program_client -> client_metadata (metadata_id));
 
 diesel::allow_tables_to_appear_in_same_query!(
     aead_encrypted,
     arbiter_settings,
+    client_metadata,
+    client_metadata_history,
     evm_basic_grant,
     evm_ether_transfer_grant,
     evm_ether_transfer_grant_target,
@@ -183,6 +218,7 @@ diesel::allow_tables_to_appear_in_same_query!(
     evm_token_transfer_volume_limit,
     evm_transaction_log,
     evm_wallet,
+    evm_wallet_access,
     program_client,
     root_key_history,
     tls_history,

server/crates/arbiter-server/src/evm/mod.rs

@@ -6,13 +6,16 @@ use alloy::{
     primitives::{TxKind, U256},
 };
 use chrono::Utc;
-use diesel::{ExpressionMethods as _, QueryDsl, QueryResult, insert_into, sqlite::Sqlite};
+use diesel::{ExpressionMethods as _, QueryDsl as _, QueryResult, insert_into, sqlite::Sqlite};
 use diesel_async::{AsyncConnection, RunQueryDsl};
+use tracing_subscriber::registry::Data;
 
 use crate::{
     db::{
-        self,
-        models::{EvmBasicGrant, NewEvmBasicGrant, NewEvmTransactionLog, SqliteTimestamp},
+        self, DatabaseError,
+        models::{
+            EvmBasicGrant, EvmWalletAccess, NewEvmBasicGrant, NewEvmTransactionLog, SqliteTimestamp,
+        },
         schema::{self, evm_transaction_log},
     },
     evm::policies::{
@@ -28,12 +31,8 @@ mod utils;
 /// Errors that can only occur once the transaction meaning is known (during policy evaluation)
 #[derive(Debug, thiserror::Error, miette::Diagnostic)]
 pub enum PolicyError {
-    #[error("Database connection pool error")]
-    #[diagnostic(code(arbiter_server::evm::policy_error::pool))]
-    Pool(#[from] db::PoolError),
-    #[error("Database returned error")]
-    #[diagnostic(code(arbiter_server::evm::policy_error::database))]
-    Database(#[from] diesel::result::Error),
+    #[error("Database error")]
+    Error(#[from] crate::db::DatabaseError),
     #[error("Transaction violates policy: {0:?}")]
     #[diagnostic(code(arbiter_server::evm::policy_error::violation))]
     Violations(Vec<EvalViolation>),
@@ -55,16 +54,6 @@ pub enum VetError {
     Evaluated(SpecificMeaning, #[source] PolicyError),
 }
 
-#[derive(Debug, thiserror::Error, miette::Diagnostic)]
-pub enum SignError {
-    #[error("Database connection pool error")]
-    #[diagnostic(code(arbiter_server::evm::database_error))]
-    Pool(#[from] db::PoolError),
-    #[error("Database returned error")]
-    #[diagnostic(code(arbiter_server::evm::database_error))]
-    Database(#[from] diesel::result::Error),
-}
-
 #[derive(Debug, thiserror::Error, miette::Diagnostic)]
 pub enum AnalyzeError {
     #[error("Engine doesn't support granting permissions for contract creation")]
@@ -76,28 +65,6 @@ pub enum AnalyzeError {
     UnsupportedTransactionType,
 }
 
-#[derive(Debug, thiserror::Error, miette::Diagnostic)]
-pub enum CreationError {
-    #[error("Database connection pool error")]
-    #[diagnostic(code(arbiter_server::evm::creation_error::database_error))]
-    Pool(#[from] db::PoolError),
-
-    #[error("Database returned error")]
-    #[diagnostic(code(arbiter_server::evm::creation_error::database_error))]
-    Database(#[from] diesel::result::Error),
-}
-
-#[derive(Debug, thiserror::Error, miette::Diagnostic)]
-pub enum ListGrantsError {
-    #[error("Database connection pool error")]
-    #[diagnostic(code(arbiter_server::evm::list_grants_error::pool))]
-    Pool(#[from] db::PoolError),
-
-    #[error("Database returned error")]
-    #[diagnostic(code(arbiter_server::evm::list_grants_error::database))]
-    Database(#[from] diesel::result::Error),
-}
-
 /// Controls whether a transaction should be executed or only validated
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum RunKind {
@@ -165,16 +132,22 @@ impl Engine {
         meaning: &P::Meaning,
         run_kind: RunKind,
     ) -> Result<(), PolicyError> {
-        let mut conn = self.db.get().await?;
+        let mut conn = self.db.get().await.map_err(DatabaseError::from)?;
 
         let grant = P::try_find_grant(&context, &mut conn)
-            .await?
+            .await
+            .map_err(DatabaseError::from)?
             .ok_or(PolicyError::NoMatchingGrant)?;
 
         let mut violations =
             check_shared_constraints(&context, &grant.shared, grant.shared_grant_id, &mut conn)
-                .await?;
-        violations.extend(P::evaluate(&context, meaning, &grant, &mut conn).await?);
+                .await
+                .map_err(DatabaseError::from)?;
+        violations.extend(
+            P::evaluate(&context, meaning, &grant, &mut conn)
+                .await
+                .map_err(DatabaseError::from)?,
+        );
 
         if !violations.is_empty() {
             return Err(PolicyError::Violations(violations));
@@ -184,8 +157,7 @@ impl Engine {
                     let log_id: i32 = insert_into(evm_transaction_log::table)
                         .values(&NewEvmTransactionLog {
                             grant_id: grant.shared_grant_id,
-                            client_id: context.client_id,
-                            wallet_id: context.wallet_id,
+                            wallet_access_id: context.target.id,
                             chain_id: context.chain as i32,
                             eth_value: utils::u256_to_bytes(context.value).to_vec(),
                             signed_at: Utc::now().into(),
@@ -199,7 +171,8 @@ impl Engine {
                     QueryResult::Ok(())
                 })
             })
-            .await?;
+            .await
+            .map_err(DatabaseError::from)?;
         }
 
         Ok(())
@@ -213,9 +186,8 @@ impl Engine {
 
     pub async fn create_grant<P: Policy>(
         &self,
-        client_id: i32,
         full_grant: FullGrant<P::Settings>,
-    ) -> Result<i32, CreationError> {
+    ) -> Result<i32, DatabaseError> {
         let mut conn = self.db.get().await?;
 
         let id = conn
@@ -225,9 +197,8 @@ impl Engine {
 
                     let basic_grant: EvmBasicGrant = insert_into(evm_basic_grant::table)
                         .values(&NewEvmBasicGrant {
-                            wallet_id: full_grant.basic.wallet_id,
                             chain_id: full_grant.basic.chain as i32,
-                            client_id,
+                            wallet_access_id: full_grant.basic.wallet_access_id,
                             valid_from: full_grant.basic.valid_from.map(SqliteTimestamp),
                             valid_until: full_grant.basic.valid_until.map(SqliteTimestamp),
                             max_gas_fee_per_gas: full_grant
@@ -262,7 +233,7 @@ impl Engine {
         Ok(id)
     }
 
-    pub async fn list_all_grants(&self) -> Result<Vec<Grant<SpecificGrant>>, ListGrantsError> {
+    pub async fn list_all_grants(&self) -> Result<Vec<Grant<SpecificGrant>>, DatabaseError> {
         let mut conn = self.db.get().await?;
 
         let mut grants: Vec<Grant<SpecificGrant>> = Vec::new();
@@ -295,8 +266,7 @@ impl Engine {
 
     pub async fn evaluate_transaction(
         &self,
-        wallet_id: i32,
-        client_id: i32,
+        target: EvmWalletAccess,
         transaction: TxEip1559,
         run_kind: RunKind,
     ) -> Result<SpecificMeaning, VetError> {
@@ -304,8 +274,7 @@ impl Engine {
             return Err(VetError::ContractCreationNotSupported);
         };
         let context = policies::EvalContext {
-            wallet_id,
-            client_id,
+            target,
             chain: transaction.chain_id,
             to,
             value: transaction.value,

server/crates/arbiter-server/src/evm/policies.rs

@@ -10,7 +10,7 @@ use miette::Diagnostic;
 use thiserror::Error;
 
 use crate::{
-    db::models::{self, EvmBasicGrant},
+    db::models::{self, EvmBasicGrant, EvmWalletAccess},
     evm::utils,
 };
 
@@ -19,9 +19,8 @@ pub mod token_transfers;
 
 #[derive(Debug, Clone)]
 pub struct EvalContext {
-    // Which wallet is this transaction for
-    pub client_id: i32,
-    pub wallet_id: i32,
+    // Which wallet is this transaction for and who requested it
+    pub target: EvmWalletAccess,
 
     // The transaction data
     pub chain: ChainId,
@@ -145,8 +144,7 @@ pub struct VolumeRateLimit {
 
 #[derive(Clone, Debug, PartialEq, Eq, Hash)]
 pub struct SharedGrantSettings {
-    pub wallet_id: i32,
-    pub client_id: i32,
+    pub wallet_access_id: i32,
     pub chain: ChainId,
 
     pub valid_from: Option<DateTime<Utc>>,
@@ -161,8 +159,7 @@ pub struct SharedGrantSettings {
 impl SharedGrantSettings {
     fn try_from_model(model: EvmBasicGrant) -> QueryResult<Self> {
         Ok(Self {
-            wallet_id: model.wallet_id,
-            client_id: model.client_id,
+            wallet_access_id: model.wallet_access_id,
             chain: model.chain_id as u64, // safe because chain_id is stored as i32 but is guaranteed to be a valid ChainId by the API when creating grants
             valid_from: model.valid_from.map(Into::into),
             valid_until: model.valid_until.map(Into::into),

server/crates/arbiter-server/src/evm/policies/ether_transfer/mod.rs

@@ -196,9 +196,8 @@ impl Policy for EtherTransfer {
             .inner_join(evm_basic_grant::table)
             .inner_join(evm_ether_transfer_grant_target::table)
             .filter(
-                evm_basic_grant::wallet_id
-                    .eq(context.wallet_id)
-                    .and(evm_basic_grant::client_id.eq(context.client_id))
+                evm_basic_grant::wallet_access_id
+                    .eq(context.target.id)
                     .and(evm_basic_grant::revoked_at.is_null())
                     .and(evm_ether_transfer_grant_target::address.eq(&target_bytes)),
             )

server/crates/arbiter-server/src/evm/policies/ether_transfer/tests.rs

@@ -5,7 +5,9 @@ use diesel_async::RunQueryDsl;
 
 use crate::db::{
     self, DatabaseConnection,
-    models::{EvmBasicGrant, NewEvmBasicGrant, NewEvmTransactionLog, SqliteTimestamp},
+    models::{
+        EvmBasicGrant, EvmWalletAccess, NewEvmBasicGrant, NewEvmTransactionLog, SqliteTimestamp,
+    },
     schema::{evm_basic_grant, evm_transaction_log},
 };
 use crate::evm::{
@@ -15,8 +17,7 @@ use crate::evm::{
 
 use super::{EtherTransfer, Settings};
 
-const WALLET_ID: i32 = 1;
-const CLIENT_ID: i32 = 2;
+const WALLET_ACCESS_ID: i32 = 1;
 const CHAIN_ID: u64 = 1;
 
 const ALLOWED: Address = address!("1111111111111111111111111111111111111111");
@@ -24,8 +25,12 @@ const OTHER: Address = address!("2222222222222222222222222222222222222222");
 
 fn ctx(to: Address, value: U256) -> EvalContext {
     EvalContext {
-        wallet_id: WALLET_ID,
-        client_id: CLIENT_ID,
+        target: EvmWalletAccess {
+            id: WALLET_ACCESS_ID,
+            wallet_id: 10,
+            client_id: 20,
+            created_at: SqliteTimestamp(Utc::now()),
+        },
         chain: CHAIN_ID,
         to,
         value,
@@ -38,8 +43,7 @@ fn ctx(to: Address, value: U256) -> EvalContext {
 async fn insert_basic(conn: &mut DatabaseConnection, revoked: bool) -> EvmBasicGrant {
     insert_into(evm_basic_grant::table)
         .values(NewEvmBasicGrant {
-            wallet_id: WALLET_ID,
-            client_id: CLIENT_ID,
+            wallet_access_id: WALLET_ACCESS_ID,
             chain_id: CHAIN_ID as i32,
             valid_from: None,
             valid_until: None,
@@ -67,14 +71,13 @@ fn make_settings(targets: Vec<Address>, max_volume: u64) -> Settings {
 
 fn shared() -> SharedGrantSettings {
     SharedGrantSettings {
-        wallet_id: WALLET_ID,
+        wallet_access_id: WALLET_ACCESS_ID,
         chain: CHAIN_ID,
         valid_from: None,
         valid_until: None,
         max_gas_fee_per_gas: None,
         max_priority_fee_per_gas: None,
         rate_limit: None,
-        client_id: CLIENT_ID,
     }
 }
 
@@ -153,8 +156,7 @@ async fn evaluate_passes_when_volume_within_limit() {
     insert_into(evm_transaction_log::table)
         .values(NewEvmTransactionLog {
             grant_id,
-            client_id: CLIENT_ID,
-            wallet_id: WALLET_ID,
+            wallet_access_id: WALLET_ACCESS_ID,
             chain_id: CHAIN_ID as i32,
             eth_value: utils::u256_to_bytes(U256::from(500u64)).to_vec(),
             signed_at: SqliteTimestamp(Utc::now()),
@@ -194,8 +196,7 @@ async fn evaluate_rejects_volume_over_limit() {
     insert_into(evm_transaction_log::table)
         .values(NewEvmTransactionLog {
             grant_id,
-            client_id: CLIENT_ID,
-            wallet_id: WALLET_ID,
+            wallet_access_id: WALLET_ACCESS_ID,
             chain_id: CHAIN_ID as i32,
             eth_value: utils::u256_to_bytes(U256::from(1_001u64)).to_vec(),
             signed_at: SqliteTimestamp(Utc::now()),
@@ -236,8 +237,7 @@ async fn evaluate_passes_at_exactly_volume_limit() {
     insert_into(evm_transaction_log::table)
         .values(NewEvmTransactionLog {
             grant_id,
-            client_id: CLIENT_ID,
-            wallet_id: WALLET_ID,
+            wallet_access_id: WALLET_ACCESS_ID,
             chain_id: CHAIN_ID as i32,
             eth_value: utils::u256_to_bytes(U256::from(1_000u64)).to_vec(),
             signed_at: SqliteTimestamp(Utc::now()),

server/crates/arbiter-server/src/evm/policies/token_transfers/mod.rs

@@ -209,8 +209,7 @@ impl Policy for TokenTransfer {
 
         let grant: Option<(EvmBasicGrant, EvmTokenTransferGrant)> = grant_join()
             .filter(evm_basic_grant::revoked_at.is_null())
-            .filter(evm_basic_grant::wallet_id.eq(context.wallet_id))
-            .filter(evm_basic_grant::client_id.eq(context.client_id))
+            .filter(evm_basic_grant::wallet_access_id.eq(context.target.id))
             .filter(evm_token_transfer_grant::token_contract.eq(&token_contract_bytes))
             .select((
                 EvmBasicGrant::as_select(),

server/crates/arbiter-server/src/evm/policies/token_transfers/tests.rs

@@ -6,7 +6,7 @@ use diesel_async::RunQueryDsl;
 
 use crate::db::{
     self, DatabaseConnection,
-    models::{EvmBasicGrant, NewEvmBasicGrant, SqliteTimestamp},
+    models::{EvmBasicGrant, EvmWalletAccess, NewEvmBasicGrant, SqliteTimestamp},
     schema::evm_basic_grant,
 };
 use crate::evm::{
@@ -21,8 +21,7 @@ use super::{Settings, TokenTransfer};
 const CHAIN_ID: u64 = 1;
 const DAI: Address = address!("6B175474E89094C44Da98b954EedeAC495271d0F");
 
-const WALLET_ID: i32 = 1;
-const CLIENT_ID: i32 = 2;
+const WALLET_ACCESS_ID: i32 = 1;
 
 const RECIPIENT: Address = address!("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa");
 const OTHER: Address = address!("bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb");
@@ -38,8 +37,12 @@ fn transfer_calldata(to: Address, value: U256) -> Bytes {
 
 fn ctx(to: Address, calldata: Bytes) -> EvalContext {
     EvalContext {
-        wallet_id: WALLET_ID,
-        client_id: CLIENT_ID,
+        target: EvmWalletAccess {
+            id: WALLET_ACCESS_ID,
+            wallet_id: 10,
+            client_id: 20,
+            created_at: SqliteTimestamp(Utc::now()),
+        },
         chain: CHAIN_ID,
         to,
         value: U256::ZERO,
@@ -52,8 +55,7 @@ fn ctx(to: Address, calldata: Bytes) -> EvalContext {
 async fn insert_basic(conn: &mut DatabaseConnection, revoked: bool) -> EvmBasicGrant {
     insert_into(evm_basic_grant::table)
         .values(NewEvmBasicGrant {
-            wallet_id: WALLET_ID,
-            client_id: CLIENT_ID,
+            wallet_access_id: WALLET_ACCESS_ID,
             chain_id: CHAIN_ID as i32,
             valid_from: None,
             valid_until: None,
@@ -86,14 +88,13 @@ fn make_settings(target: Option<Address>, max_volume: Option<u64>) -> Settings {
 
 fn shared() -> SharedGrantSettings {
     SharedGrantSettings {
-        wallet_id: WALLET_ID,
+        wallet_access_id: WALLET_ACCESS_ID,
         chain: CHAIN_ID,
         valid_from: None,
         valid_until: None,
         max_gas_fee_per_gas: None,
         max_priority_fee_per_gas: None,
         rate_limit: None,
-        client_id: CLIENT_ID,
     }
 }
 

server/crates/arbiter-server/src/grpc/client.rs

@@ -22,10 +22,11 @@ use crate::{
         keyholder::KeyHolderState,
     },
     grpc::request_tracker::RequestTracker,
-    utils::defer,
 };
 
 mod auth;
+mod inbound;
+mod outbound;
 
 async fn dispatch_loop(
     mut bi: GrpcBi<ClientRequest, ClientResponse>,
@@ -33,52 +34,53 @@ async fn dispatch_loop(
     mut request_tracker: RequestTracker,
 ) {
     loop {
-        let Some(conn) = bi.recv().await else {
+        let Some(message) = bi.recv().await else { return };
+
+        let conn = match message {
+            Ok(conn) => conn,
+            Err(err) => {
+                warn!(error = ?err, "Failed to receive client request");
+                return;
+            }
+        };
+
+        let request_id = match request_tracker.request(conn.request_id) {
+            Ok(id) => id,
+            Err(err) => {
+                let _ = bi.send(Err(err)).await;
+                return;
+            }
+        };
+
+        let Some(payload) = conn.payload else {
+            let _ = bi.send(Err(Status::invalid_argument("Missing client request payload"))).await;
             return;
         };
 
-        if dispatch_conn_message(&mut bi, &actor, &mut request_tracker, conn)
-            .await
-            .is_err()
-        {
-            return;
+        match dispatch_inner(&actor, payload).await {
+            Ok(response) => {
+                if bi.send(Ok(ClientResponse {
+                    request_id: Some(request_id),
+                    payload: Some(response),
+                })).await.is_err() {
+                    return;
+                }
+            }
+            Err(status) => {
+                let _ = bi.send(Err(status)).await;
+                return;
+            }
         }
     }
 }
 
-async fn dispatch_conn_message(
-    bi: &mut GrpcBi<ClientRequest, ClientResponse>,
+async fn dispatch_inner(
     actor: &ActorRef<ClientSession>,
-    request_tracker: &mut RequestTracker,
-    conn: Result<ClientRequest, Status>,
-) -> Result<(), ()> {
-    let conn = match conn {
-        Ok(conn) => conn,
-        Err(err) => {
-            warn!(error = ?err, "Failed to receive client request");
-            return Err(());
-        }
-    };
-
-    let request_id = match request_tracker.request(conn.request_id) {
-        Ok(request_id) => request_id,
-        Err(err) => {
-            let _ = bi.send(Err(err)).await;
-            return Err(());
-        }
-    };
-    let Some(payload) = conn.payload else {
-        let _ = bi
-            .send(Err(Status::invalid_argument(
-                "Missing client request payload",
-            )))
-            .await;
-        return Err(());
-    };
-
-    let payload = match payload {
-        ClientRequestPayload::QueryVaultState(_) => ClientResponsePayload::VaultState(
-            match actor.ask(HandleQueryVaultState {}).await {
+    payload: ClientRequestPayload,
+) -> Result<ClientResponsePayload, Status> {
+    match payload {
+        ClientRequestPayload::QueryVaultState(_) => {
+            let state = match actor.ask(HandleQueryVaultState {}).await {
                 Ok(KeyHolderState::Unbootstrapped) => ProtoVaultState::Unbootstrapped,
                 Ok(KeyHolderState::Sealed) => ProtoVaultState::Sealed,
                 Ok(KeyHolderState::Unsealed) => ProtoVaultState::Unsealed,
@@ -87,51 +89,30 @@ async fn dispatch_conn_message(
                     warn!(error = ?err, "Failed to query vault state");
                     ProtoVaultState::Error
                 }
-            }
-            .into(),
-        ),
+            };
+            Ok(ClientResponsePayload::VaultState(state.into()))
+        }
         payload => {
             warn!(?payload, "Unsupported post-auth client request");
-            let _ = bi
-                .send(Err(Status::invalid_argument("Unsupported client request")))
-                .await;
-            return Err(());
-        }
-    };
-
-    bi.send(Ok(ClientResponse {
-        request_id: Some(request_id),
-        payload: Some(payload),
-    }))
-    .await
-    .map_err(|_| ())
-}
-
-pub async fn start(conn: ClientConnection, mut bi: GrpcBi<ClientRequest, ClientResponse>) {
-    let mut conn = conn;
-    let mut request_tracker = RequestTracker::default();
-    let mut response_id = None;
-
-    match auth::start(&mut conn, &mut bi, &mut request_tracker, &mut response_id).await {
-        Ok(_) => {
-            let actor =
-                client::session::ClientSession::spawn(client::session::ClientSession::new(conn));
-            let actor_for_cleanup = actor.clone();
-            let _ = defer(move || {
-                actor_for_cleanup.kill();
-            });
-
-            info!("Client authenticated successfully");
-            dispatch_loop(bi, actor, request_tracker).await;
-        }
-        Err(e) => {
-            let mut transport = auth::AuthTransportAdapter::new(
-                &mut bi,
-                &mut request_tracker,
-                &mut response_id,
-            );
-            let _ = transport.send(Err(e.clone())).await;
-            warn!(error = ?e, "Authentication failed");
+            Err(Status::invalid_argument("Unsupported client request"))
         }
     }
 }
+
+pub async fn start(mut conn: ClientConnection, mut bi: GrpcBi<ClientRequest, ClientResponse>) {
+    let mut request_tracker = RequestTracker::default();
+
+    if let Err(e) = auth::start(&mut conn, &mut bi, &mut request_tracker).await {
+        let mut transport = auth::AuthTransportAdapter::new(&mut bi, &mut request_tracker);
+        let _ = transport.send(Err(e.clone())).await;
+        warn!(error = ?e, "Client authentication failed");
+        return;
+    };
+
+    let actor = client::session::ClientSession::spawn(client::session::ClientSession::new(conn));
+    let actor_for_cleanup = actor.clone();
+
+    info!("Client authenticated successfully");
+    dispatch_loop(bi, actor, request_tracker).await;
+    actor_for_cleanup.kill();
+}

server/crates/arbiter-server/src/grpc/client/auth.rs

@@ -1,11 +1,11 @@
 use arbiter_proto::{
-    proto::client::{
+    ClientMetadata, proto::client::{
         AuthChallenge as ProtoAuthChallenge, AuthChallengeRequest as ProtoAuthChallengeRequest,
         AuthChallengeSolution as ProtoAuthChallengeSolution, AuthResult as ProtoAuthResult,
-        ClientRequest, ClientResponse, client_request::Payload as ClientRequestPayload,
+        ClientInfo as ProtoClientInfo, ClientRequest, ClientResponse,
+        client_request::Payload as ClientRequestPayload,
         client_response::Payload as ClientResponsePayload,
-    },
-    transport::{Bi, Error as TransportError, Receiver, Sender, grpc::GrpcBi},
+    }, transport::{Bi, Error as TransportError, Receiver, Sender, grpc::GrpcBi}
 };
 use async_trait::async_trait;
 use tonic::Status;
@@ -19,19 +19,16 @@ use crate::{
 pub struct AuthTransportAdapter<'a> {
     bi: &'a mut GrpcBi<ClientRequest, ClientResponse>,
     request_tracker: &'a mut RequestTracker,
-    response_id: &'a mut Option<i32>,
 }
 
 impl<'a> AuthTransportAdapter<'a> {
     pub fn new(
         bi: &'a mut GrpcBi<ClientRequest, ClientResponse>,
         request_tracker: &'a mut RequestTracker,
-        response_id: &'a mut Option<i32>,
     ) -> Self {
         Self {
             bi,
             request_tracker,
-            response_id,
         }
     }
 
@@ -57,7 +54,7 @@ impl<'a> AuthTransportAdapter<'a> {
                     ProtoAuthResult::ApprovalDenied
                 }
                 auth::Error::ApproveError(auth::ApproveError::Upstream(
-                    crate::actors::router::ApprovalError::NoUserAgentsConnected,
+                    crate::actors::flow_coordinator::ApprovalError::NoUserAgentsConnected,
                 )) => ProtoAuthResult::NoUserAgentsOnline,
                 auth::Error::ApproveError(auth::ApproveError::Internal)
                 | auth::Error::DatabasePoolUnavailable
@@ -72,11 +69,9 @@ impl<'a> AuthTransportAdapter<'a> {
         &mut self,
         payload: ClientResponsePayload,
     ) -> Result<(), TransportError> {
-        let request_id = self.response_id.take();
-
         self.bi
             .send(Ok(ClientResponse {
-                request_id,
+                request_id: Some(self.request_tracker.current_request_id()),
                 payload: Some(payload),
             }))
             .await
@@ -114,19 +109,27 @@ impl Receiver<auth::Inbound> for AuthTransportAdapter<'_> {
             }
         };
 
-        let request_id = match self.request_tracker.request(request.request_id) {
+        match self.request_tracker.request(request.request_id) {
             Ok(request_id) => request_id,
             Err(error) => {
                 let _ = self.bi.send(Err(error)).await;
                 return None;
             }
         };
-        *self.response_id = Some(request_id);
-
         let payload = request.payload?;
 
         match payload {
-            ClientRequestPayload::AuthChallengeRequest(ProtoAuthChallengeRequest { pubkey }) => {
+            ClientRequestPayload::AuthChallengeRequest(ProtoAuthChallengeRequest {
+                pubkey,
+                client_info,
+            }) => {
+                let Some(client_info) = client_info else {
+                    let _ = self
+                        .bi
+                        .send(Err(Status::invalid_argument("Missing client info")))
+                        .await;
+                    return None;
+                };
                 let Ok(pubkey) = <[u8; 32]>::try_from(pubkey) else {
                     let _ = self.send_auth_result(ProtoAuthResult::InvalidKey).await;
                     return None;
@@ -135,7 +138,10 @@ impl Receiver<auth::Inbound> for AuthTransportAdapter<'_> {
                     let _ = self.send_auth_result(ProtoAuthResult::InvalidKey).await;
                     return None;
                 };
-                Some(auth::Inbound::AuthChallengeRequest { pubkey })
+                Some(auth::Inbound::AuthChallengeRequest {
+                    pubkey,
+                    metadata: client_metadata_from_proto(client_info),
+                })
             }
             ClientRequestPayload::AuthChallengeSolution(ProtoAuthChallengeSolution {
                 signature,
@@ -151,7 +157,9 @@ impl Receiver<auth::Inbound> for AuthTransportAdapter<'_> {
             _ => {
                 let _ = self
                     .bi
-                    .send(Err(Status::invalid_argument("Unsupported client auth request")))
+                    .send(Err(Status::invalid_argument(
+                        "Unsupported client auth request",
+                    )))
                     .await;
                 None
             }
@@ -161,13 +169,20 @@ impl Receiver<auth::Inbound> for AuthTransportAdapter<'_> {
 
 impl Bi<auth::Inbound, Result<auth::Outbound, auth::Error>> for AuthTransportAdapter<'_> {}
 
+fn client_metadata_from_proto(metadata: ProtoClientInfo) -> ClientMetadata {
+    ClientMetadata {
+        name: metadata.name,
+        description: metadata.description,
+        version: metadata.version,
+    }
+}
+
 pub async fn start(
     conn: &mut ClientConnection,
     bi: &mut GrpcBi<ClientRequest, ClientResponse>,
     request_tracker: &mut RequestTracker,
-    response_id: &mut Option<i32>,
 ) -> Result<(), auth::Error> {
-    let mut transport = AuthTransportAdapter::new(bi, request_tracker, response_id);
+    let mut transport = AuthTransportAdapter::new(bi, request_tracker);
     client::auth::authenticate(conn, &mut transport).await?;
     Ok(())
 }

server/crates/arbiter-server/src/grpc/mod.rs

@@ -18,6 +18,19 @@ pub mod client;
 mod request_tracker;
 pub mod user_agent;
 
+pub trait Convert {
+    type Output;
+
+    fn convert(self) -> Self::Output;
+}
+
+pub trait TryConvert {
+    type Output;
+    type Error;
+
+    fn try_convert(self) -> Result<Self::Output, Self::Error>;
+}
+
 #[async_trait]
 impl arbiter_proto::proto::arbiter_service_server::ArbiterService for super::Server {
     type UserAgentStream = ReceiverStream<Result<UserAgentResponse, Status>>;

server/crates/arbiter-server/src/grpc/request_tracker.rs

@@ -17,4 +17,10 @@ impl RequestTracker {
 
         Ok(id)
     }
+
+    // This is used to set the response id for auth responses, which need to match the request id of the auth challenge request.
+    // -1 offset is needed because request() increments the next_request_id after returning the current request id.
+    pub fn current_request_id(&self) -> i32 {
+        self.next_request_id - 1
+    }
 }

server/crates/arbiter-server/src/grpc/user_agent.rs

@@ -1,29 +1,30 @@
 use tokio::sync::mpsc;
 
 use arbiter_proto::{
-    google::protobuf::{Empty as ProtoEmpty, Timestamp as ProtoTimestamp},
     proto::{
+        client::ClientInfo as ProtoClientMetadata,
         evm::{
-            EtherTransferSettings as ProtoEtherTransferSettings, EvmError as ProtoEvmError,
-            EvmGrantCreateRequest, EvmGrantCreateResponse, EvmGrantDeleteRequest,
-            EvmGrantDeleteResponse, EvmGrantList, EvmGrantListResponse, GrantEntry,
-            SharedSettings as ProtoSharedSettings, SpecificGrant as ProtoSpecificGrant,
-            TokenTransferSettings as ProtoTokenTransferSettings,
-            TransactionRateLimit as ProtoTransactionRateLimit,
-            VolumeRateLimit as ProtoVolumeRateLimit, WalletCreateResponse, WalletEntry, WalletList,
-            WalletListResponse, evm_grant_create_response::Result as EvmGrantCreateResult,
+            EvmError as ProtoEvmError, EvmGrantCreateRequest, EvmGrantCreateResponse,
+            EvmGrantDeleteRequest, EvmGrantDeleteResponse, EvmGrantList, EvmGrantListResponse,
+            GrantEntry, WalletCreateResponse, WalletEntry, WalletList, WalletListResponse,
+            evm_grant_create_response::Result as EvmGrantCreateResult,
             evm_grant_delete_response::Result as EvmGrantDeleteResult,
             evm_grant_list_response::Result as EvmGrantListResult,
-            specific_grant::Grant as ProtoSpecificGrantType,
             wallet_create_response::Result as WalletCreateResult,
             wallet_list_response::Result as WalletListResult,
         },
         user_agent::{
             BootstrapEncryptedKey as ProtoBootstrapEncryptedKey,
-            BootstrapResult as ProtoBootstrapResult,
-            SdkClientConnectionResponse as ProtoSdkClientConnectionResponse,
-            UnsealEncryptedKey as ProtoUnsealEncryptedKey, UnsealResult as ProtoUnsealResult,
-            UnsealStart, UserAgentRequest, UserAgentResponse, VaultState as ProtoVaultState,
+            BootstrapResult as ProtoBootstrapResult, ListWalletAccessResponse,
+            SdkClientConnectionCancel as ProtoSdkClientConnectionCancel,
+            SdkClientConnectionRequest as ProtoSdkClientConnectionRequest,
+            SdkClientEntry as ProtoSdkClientEntry, SdkClientError as ProtoSdkClientError,
+            SdkClientGrantWalletAccess, SdkClientList as ProtoSdkClientList,
+            SdkClientListResponse as ProtoSdkClientListResponse, SdkClientRevokeWalletAccess,
+            SdkClientWalletAccess, UnsealEncryptedKey as ProtoUnsealEncryptedKey,
+            UnsealResult as ProtoUnsealResult, UnsealStart, UserAgentRequest, UserAgentResponse,
+            VaultState as ProtoVaultState,
+            sdk_client_list_response::Result as ProtoSdkClientListResult,
             user_agent_request::Payload as UserAgentRequestPayload,
             user_agent_response::Payload as UserAgentResponsePayload,
         },
@@ -31,35 +32,33 @@ use arbiter_proto::{
     transport::{Error as TransportError, Receiver, Sender, grpc::GrpcBi},
 };
 use async_trait::async_trait;
-use chrono::{TimeZone, Utc};
 use kameo::{
     actor::{ActorRef, Spawn as _},
     error::SendError,
 };
 use tonic::Status;
-use tracing::{info, warn};
+use tracing::{error, info, warn};
 
 use crate::{
     actors::{
         keyholder::KeyHolderState,
         user_agent::{
             OutOfBand, UserAgentConnection, UserAgentSession,
-            session::{
-                BootstrapError, Error, HandleBootstrapEncryptedKey, HandleEvmWalletCreate,
-                HandleEvmWalletList, HandleGrantCreate, HandleGrantDelete, HandleGrantList,
-                HandleQueryVaultState, HandleUnsealEncryptedKey, HandleUnsealRequest, UnsealError,
+            session::connection::{
+                BootstrapError, HandleBootstrapEncryptedKey, HandleEvmWalletCreate,
+                HandleEvmWalletList, HandleGrantCreate, HandleGrantDelete,
+                HandleGrantEvmWalletAccess, HandleGrantList, HandleListWalletAccess,
+                HandleNewClientApprove, HandleQueryVaultState, HandleRevokeEvmWalletAccess,
+                HandleSdkClientList, HandleUnsealEncryptedKey, HandleUnsealRequest, UnsealError,
             },
         },
     },
-    evm::policies::{
-        Grant, SharedGrantSettings, SpecificGrant, TransactionRateLimit, VolumeRateLimit,
-        ether_transfer, token_transfers,
-    },
-    grpc::request_tracker::RequestTracker,
-    utils::defer,
+    db::models::{CoreEvmWalletAccess, NewEvmWalletAccess},
+    grpc::{Convert, TryConvert, request_tracker::RequestTracker},
 };
-use alloy::primitives::{Address, U256};
 mod auth;
+mod inbound;
+mod outbound;
 
 pub struct OutOfBandAdapter(mpsc::Sender<OutOfBand>);
 
@@ -83,94 +82,109 @@ async fn dispatch_loop(
         tokio::select! {
             oob = receiver.recv() => {
                 let Some(oob) = oob else {
+                    warn!("Out-of-band message channel closed");
                     return;
                 };
 
-                if send_out_of_band(&mut bi, oob).await.is_err() {
+                let payload = match oob {
+                    OutOfBand::ClientConnectionRequest { profile } => {
+                        UserAgentResponsePayload::SdkClientConnectionRequest(ProtoSdkClientConnectionRequest {
+                            pubkey: profile.pubkey.to_bytes().to_vec(),
+                            info: Some(ProtoClientMetadata {
+                                name: profile.metadata.name,
+                                description: profile.metadata.description,
+                                version: profile.metadata.version,
+                            }),
+                        })
+                    }
+                    OutOfBand::ClientConnectionCancel { pubkey } => {
+                        UserAgentResponsePayload::SdkClientConnectionCancel(ProtoSdkClientConnectionCancel {
+                            pubkey: pubkey.to_bytes().to_vec(),
+                        })
+                    }
+                };
+
+                if bi.send(Ok(UserAgentResponse { id: None, payload: Some(payload) })).await.is_err() {
                     return;
                 }
             }
 
-            conn = bi.recv() => {
-                let Some(conn) = conn else {
+            message = bi.recv() => {
+                let Some(message) = message else { return; };
+
+                let conn = match message {
+                    Ok(conn) => conn,
+                    Err(err) => {
+                        warn!(error = ?err, "Failed to receive user agent request");
+                        return;
+                    }
+                };
+
+                let request_id = match request_tracker.request(conn.id) {
+                    Ok(id) => id,
+                    Err(err) => {
+                        let _ = bi.send(Err(err)).await;
+                        return;
+                    }
+                };
+
+                let Some(payload) = conn.payload else {
+                    let _ = bi.send(Err(Status::invalid_argument("Missing user-agent request payload"))).await;
                     return;
                 };
 
-                if dispatch_conn_message(&mut bi, &actor, &mut request_tracker, conn)
-                    .await
-                    .is_err()
-                {
-                    return;
+                match dispatch_inner(&actor, payload).await {
+                    Ok(Some(response)) => {
+                        if bi.send(Ok(UserAgentResponse {
+                            id: Some(request_id),
+                            payload: Some(response),
+                        })).await.is_err() {
+                            return;
+                        }
+                    }
+                    Ok(None) => {}
+                    Err(status) => {
+                         error!(?status, "Failed to process user agent request");
+                        let _ = bi.send(Err(status)).await;
+                        return;
+                    }
                 }
             }
         }
     }
 }
 
-async fn dispatch_conn_message(
-    bi: &mut GrpcBi<UserAgentRequest, UserAgentResponse>,
+async fn dispatch_inner(
     actor: &ActorRef<UserAgentSession>,
-    request_tracker: &mut RequestTracker,
-    conn: Result<UserAgentRequest, Status>,
-) -> Result<(), ()> {
-    let conn = match conn {
-        Ok(conn) => conn,
-        Err(err) => {
-            warn!(error = ?err, "Failed to receive user agent request");
-            return Err(());
-        }
-    };
-
-    let request_id = match request_tracker.request(conn.id) {
-        Ok(request_id) => request_id,
-        Err(err) => {
-            let _ = bi.send(Err(err)).await;
-            return Err(());
-        }
-    };
-
-    let Some(payload) = conn.payload else {
-        let _ = bi
-            .send(Err(Status::invalid_argument(
-                "Missing user-agent request payload",
-            )))
-            .await;
-        return Err(());
-    };
-
-    let payload = match payload {
+    payload: UserAgentRequestPayload,
+) -> Result<Option<UserAgentResponsePayload>, Status> {
+    let response = match payload {
         UserAgentRequestPayload::UnsealStart(UnsealStart { client_pubkey }) => {
-            let client_pubkey = match <[u8; 32]>::try_from(client_pubkey) {
-                Ok(bytes) => x25519_dalek::PublicKey::from(bytes),
-                Err(_) => {
-                    let _ = bi
-                        .send(Err(Status::invalid_argument("Invalid X25519 public key")))
-                        .await;
-                    return Err(());
-                }
-            };
+            let client_pubkey = <[u8; 32]>::try_from(client_pubkey)
+                .map(x25519_dalek::PublicKey::from)
+                .map_err(|_| Status::invalid_argument("Invalid X25519 public key"))?;
 
-            match actor.ask(HandleUnsealRequest { client_pubkey }).await {
-                Ok(response) => UserAgentResponsePayload::UnsealStartResponse(
-                    arbiter_proto::proto::user_agent::UnsealStartResponse {
-                        server_pubkey: response.server_pubkey.as_bytes().to_vec(),
-                    },
-                ),
-                Err(err) => {
+            let response = actor
+                .ask(HandleUnsealRequest { client_pubkey })
+                .await
+                .map_err(|err| {
                     warn!(error = ?err, "Failed to handle unseal start request");
-                    let _ = bi
-                        .send(Err(Status::internal("Failed to start unseal flow")))
-                        .await;
-                    return Err(());
-                }
-            }
+                    Status::internal("Failed to start unseal flow")
+                })?;
+
+            UserAgentResponsePayload::UnsealStartResponse(
+                arbiter_proto::proto::user_agent::UnsealStartResponse {
+                    server_pubkey: response.server_pubkey.as_bytes().to_vec(),
+                },
+            )
         }
+
         UserAgentRequestPayload::UnsealEncryptedKey(ProtoUnsealEncryptedKey {
             nonce,
             ciphertext,
             associated_data,
-        }) => UserAgentResponsePayload::UnsealResult(
-            match actor
+        }) => {
+            let result = match actor
                 .ask(HandleUnsealEncryptedKey {
                     nonce,
                     ciphertext,
@@ -184,20 +198,18 @@ async fn dispatch_conn_message(
                 }
                 Err(err) => {
                     warn!(error = ?err, "Failed to handle unseal request");
-                    let _ = bi
-                        .send(Err(Status::internal("Failed to unseal vault")))
-                        .await;
-                    return Err(());
+                    return Err(Status::internal("Failed to unseal vault"));
                 }
-            }
-            .into(),
-        ),
+            };
+            UserAgentResponsePayload::UnsealResult(result.into())
+        }
+
         UserAgentRequestPayload::BootstrapEncryptedKey(ProtoBootstrapEncryptedKey {
             nonce,
             ciphertext,
             associated_data,
-        }) => UserAgentResponsePayload::BootstrapResult(
-            match actor
+        }) => {
+            let result = match actor
                 .ask(HandleBootstrapEncryptedKey {
                     nonce,
                     ciphertext,
@@ -214,16 +226,14 @@ async fn dispatch_conn_message(
                 }
                 Err(err) => {
                     warn!(error = ?err, "Failed to handle bootstrap request");
-                    let _ = bi
-                        .send(Err(Status::internal("Failed to bootstrap vault")))
-                        .await;
-                    return Err(());
+                    return Err(Status::internal("Failed to bootstrap vault"));
                 }
-            }
-            .into(),
-        ),
-        UserAgentRequestPayload::QueryVaultState(_) => UserAgentResponsePayload::VaultState(
-            match actor.ask(HandleQueryVaultState {}).await {
+            };
+            UserAgentResponsePayload::BootstrapResult(result.into())
+        }
+
+        UserAgentRequestPayload::QueryVaultState(_) => {
+            let state = match actor.ask(HandleQueryVaultState {}).await {
                 Ok(KeyHolderState::Unbootstrapped) => ProtoVaultState::Unbootstrapped,
                 Ok(KeyHolderState::Sealed) => ProtoVaultState::Sealed,
                 Ok(KeyHolderState::Unsealed) => ProtoVaultState::Unsealed,
@@ -231,346 +241,202 @@ async fn dispatch_conn_message(
                     warn!(error = ?err, "Failed to query vault state");
                     ProtoVaultState::Error
                 }
-            }
-            .into(),
-        ),
-        UserAgentRequestPayload::EvmWalletCreate(_) => UserAgentResponsePayload::EvmWalletCreate(
-            EvmGrantOrWallet::wallet_create_response(actor.ask(HandleEvmWalletCreate {}).await),
-        ),
-        UserAgentRequestPayload::EvmWalletList(_) => UserAgentResponsePayload::EvmWalletList(
-            EvmGrantOrWallet::wallet_list_response(actor.ask(HandleEvmWalletList {}).await),
-        ),
-        UserAgentRequestPayload::EvmGrantList(_) => UserAgentResponsePayload::EvmGrantList(
-            EvmGrantOrWallet::grant_list_response(actor.ask(HandleGrantList {}).await),
-        ),
-        UserAgentRequestPayload::EvmGrantCreate(EvmGrantCreateRequest {
-            client_id,
-            shared,
-            specific,
-        }) => {
-            let (basic, grant) = match parse_grant_request(shared, specific) {
-                Ok(values) => values,
-                Err(status) => {
-                    let _ = bi.send(Err(status)).await;
-                    return Err(());
+            };
+            UserAgentResponsePayload::VaultState(state.into())
+        }
+
+        UserAgentRequestPayload::EvmWalletCreate(_) => {
+            let result = match actor.ask(HandleEvmWalletCreate {}).await {
+                Ok((wallet_id, address)) => WalletCreateResult::Wallet(WalletEntry {
+                    id: wallet_id,
+                    address: address.to_vec(),
+                }),
+                Err(err) => {
+                    warn!(error = ?err, "Failed to create EVM wallet");
+                    WalletCreateResult::Error(ProtoEvmError::Internal.into())
                 }
             };
-
-            UserAgentResponsePayload::EvmGrantCreate(EvmGrantOrWallet::grant_create_response(
-                actor
-                    .ask(HandleGrantCreate {
-                        client_id,
-                        basic,
-                        grant,
-                    })
-                    .await,
-            ))
+            UserAgentResponsePayload::EvmWalletCreate(WalletCreateResponse {
+                result: Some(result),
+            })
         }
-        UserAgentRequestPayload::EvmGrantDelete(EvmGrantDeleteRequest { grant_id }) => {
-            UserAgentResponsePayload::EvmGrantDelete(EvmGrantOrWallet::grant_delete_response(
-                actor.ask(HandleGrantDelete { grant_id }).await,
-            ))
-        }
-        payload => {
-            warn!(?payload, "Unsupported post-auth user agent request");
-            let _ = bi
-                .send(Err(Status::invalid_argument(
-                    "Unsupported user-agent request",
-                )))
-                .await;
-            return Err(());
-        }
-    };
 
-    bi.send(Ok(UserAgentResponse {
-        id: Some(request_id),
-        payload: Some(payload),
-    }))
-    .await
-    .map_err(|_| ())
-}
-
-async fn send_out_of_band(
-    bi: &mut GrpcBi<UserAgentRequest, UserAgentResponse>,
-    oob: OutOfBand,
-) -> Result<(), ()> {
-    let payload = match oob {
-        // The current protobuf response payload carries only an approval boolean.
-        // Keep emitting this shape until a dedicated out-of-band request/cancel payload
-        // is reintroduced in the protocol definition.
-        OutOfBand::ClientConnectionRequest { pubkey: _ } => {
-            UserAgentResponsePayload::SdkClientConnectionResponse(
-                ProtoSdkClientConnectionResponse { approved: false },
-            )
-        }
-        OutOfBand::ClientConnectionCancel => UserAgentResponsePayload::SdkClientConnectionResponse(
-            ProtoSdkClientConnectionResponse { approved: false },
-        ),
-    };
-
-    bi.send(Ok(UserAgentResponse {
-        id: None,
-        payload: Some(payload),
-    }))
-    .await
-    .map_err(|_| ())
-}
-
-fn parse_grant_request(
-    shared: Option<ProtoSharedSettings>,
-    specific: Option<ProtoSpecificGrant>,
-) -> Result<(SharedGrantSettings, SpecificGrant), Status> {
-    let shared = shared.ok_or_else(|| Status::invalid_argument("Missing shared grant settings"))?;
-    let specific =
-        specific.ok_or_else(|| Status::invalid_argument("Missing specific grant settings"))?;
-
-    Ok((
-        shared_settings_from_proto(shared)?,
-        specific_grant_from_proto(specific)?,
-    ))
-}
-
-fn shared_settings_from_proto(shared: ProtoSharedSettings) -> Result<SharedGrantSettings, Status> {
-    Ok(SharedGrantSettings {
-        wallet_id: shared.wallet_id,
-        client_id: 0,
-        chain: shared.chain_id,
-        valid_from: shared.valid_from.map(proto_timestamp_to_utc).transpose()?,
-        valid_until: shared.valid_until.map(proto_timestamp_to_utc).transpose()?,
-        max_gas_fee_per_gas: shared
-            .max_gas_fee_per_gas
-            .as_deref()
-            .map(u256_from_proto_bytes)
-            .transpose()?,
-        max_priority_fee_per_gas: shared
-            .max_priority_fee_per_gas
-            .as_deref()
-            .map(u256_from_proto_bytes)
-            .transpose()?,
-        rate_limit: shared.rate_limit.map(|limit| TransactionRateLimit {
-            count: limit.count,
-            window: chrono::Duration::seconds(limit.window_secs),
-        }),
-    })
-}
-
-fn specific_grant_from_proto(specific: ProtoSpecificGrant) -> Result<SpecificGrant, Status> {
-    match specific.grant {
-        Some(ProtoSpecificGrantType::EtherTransfer(ProtoEtherTransferSettings {
-            targets,
-            limit,
-        })) => Ok(SpecificGrant::EtherTransfer(ether_transfer::Settings {
-            target: targets
-                .into_iter()
-                .map(address_from_bytes)
-                .collect::<Result<_, _>>()?,
-            limit: volume_rate_limit_from_proto(limit.ok_or_else(|| {
-                Status::invalid_argument("Missing ether transfer volume rate limit")
-            })?)?,
-        })),
-        Some(ProtoSpecificGrantType::TokenTransfer(ProtoTokenTransferSettings {
-            token_contract,
-            target,
-            volume_limits,
-        })) => Ok(SpecificGrant::TokenTransfer(token_transfers::Settings {
-            token_contract: address_from_bytes(token_contract)?,
-            target: target.map(address_from_bytes).transpose()?,
-            volume_limits: volume_limits
-                .into_iter()
-                .map(volume_rate_limit_from_proto)
-                .collect::<Result<_, _>>()?,
-        })),
-        None => Err(Status::invalid_argument("Missing specific grant kind")),
-    }
-}
-
-fn volume_rate_limit_from_proto(limit: ProtoVolumeRateLimit) -> Result<VolumeRateLimit, Status> {
-    Ok(VolumeRateLimit {
-        max_volume: u256_from_proto_bytes(&limit.max_volume)?,
-        window: chrono::Duration::seconds(limit.window_secs),
-    })
-}
-
-fn address_from_bytes(bytes: Vec<u8>) -> Result<Address, Status> {
-    if bytes.len() != 20 {
-        return Err(Status::invalid_argument("Invalid EVM address"));
-    }
-
-    Ok(Address::from_slice(&bytes))
-}
-
-fn u256_from_proto_bytes(bytes: &[u8]) -> Result<U256, Status> {
-    if bytes.len() > 32 {
-        return Err(Status::invalid_argument("Invalid U256 byte length"));
-    }
-
-    Ok(U256::from_be_slice(bytes))
-}
-
-fn proto_timestamp_to_utc(timestamp: ProtoTimestamp) -> Result<chrono::DateTime<Utc>, Status> {
-    Utc.timestamp_opt(timestamp.seconds, timestamp.nanos as u32)
-        .single()
-        .ok_or_else(|| Status::invalid_argument("Invalid timestamp"))
-}
-
-fn shared_settings_to_proto(shared: SharedGrantSettings) -> ProtoSharedSettings {
-    ProtoSharedSettings {
-        wallet_id: shared.wallet_id,
-        chain_id: shared.chain,
-        valid_from: shared.valid_from.map(|time| ProtoTimestamp {
-            seconds: time.timestamp(),
-            nanos: time.timestamp_subsec_nanos() as i32,
-        }),
-        valid_until: shared.valid_until.map(|time| ProtoTimestamp {
-            seconds: time.timestamp(),
-            nanos: time.timestamp_subsec_nanos() as i32,
-        }),
-        max_gas_fee_per_gas: shared
-            .max_gas_fee_per_gas
-            .map(|value| value.to_be_bytes::<32>().to_vec()),
-        max_priority_fee_per_gas: shared
-            .max_priority_fee_per_gas
-            .map(|value| value.to_be_bytes::<32>().to_vec()),
-        rate_limit: shared.rate_limit.map(|limit| ProtoTransactionRateLimit {
-            count: limit.count,
-            window_secs: limit.window.num_seconds(),
-        }),
-    }
-}
-
-fn specific_grant_to_proto(grant: SpecificGrant) -> ProtoSpecificGrant {
-    let grant = match grant {
-        SpecificGrant::EtherTransfer(settings) => {
-            ProtoSpecificGrantType::EtherTransfer(ProtoEtherTransferSettings {
-                targets: settings
-                    .target
-                    .into_iter()
-                    .map(|address| address.to_vec())
-                    .collect(),
-                limit: Some(ProtoVolumeRateLimit {
-                    max_volume: settings.limit.max_volume.to_be_bytes::<32>().to_vec(),
-                    window_secs: settings.limit.window.num_seconds(),
+        UserAgentRequestPayload::EvmWalletList(_) => {
+            let result = match actor.ask(HandleEvmWalletList {}).await {
+                Ok(wallets) => WalletListResult::Wallets(WalletList {
+                    wallets: wallets
+                        .into_iter()
+                        .map(|(id, address)| WalletEntry {
+                            address: address.to_vec(),
+                            id,
+                        })
+                        .collect(),
                 }),
+                Err(err) => {
+                    warn!(error = ?err, "Failed to list EVM wallets");
+                    WalletListResult::Error(ProtoEvmError::Internal.into())
+                }
+            };
+            UserAgentResponsePayload::EvmWalletList(WalletListResponse {
+                result: Some(result),
             })
         }
-        SpecificGrant::TokenTransfer(settings) => {
-            ProtoSpecificGrantType::TokenTransfer(ProtoTokenTransferSettings {
-                token_contract: settings.token_contract.to_vec(),
-                target: settings.target.map(|address| address.to_vec()),
-                volume_limits: settings
-                    .volume_limits
-                    .into_iter()
-                    .map(|limit| ProtoVolumeRateLimit {
-                        max_volume: limit.max_volume.to_be_bytes::<32>().to_vec(),
-                        window_secs: limit.window.num_seconds(),
-                    })
-                    .collect(),
+
+        UserAgentRequestPayload::EvmGrantList(_) => {
+            let result = match actor.ask(HandleGrantList {}).await {
+                Ok(grants) => EvmGrantListResult::Grants(EvmGrantList {
+                    grants: grants
+                        .into_iter()
+                        .map(|grant| GrantEntry {
+                            id: grant.id,
+                            wallet_access_id: grant.shared.wallet_access_id,
+                            shared: Some(grant.shared.convert()),
+                            specific: Some(grant.settings.convert()),
+                        })
+                        .collect(),
+                }),
+                Err(err) => {
+                    warn!(error = ?err, "Failed to list EVM grants");
+                    EvmGrantListResult::Error(ProtoEvmError::Internal.into())
+                }
+            };
+            UserAgentResponsePayload::EvmGrantList(EvmGrantListResponse {
+                result: Some(result),
             })
         }
+
+        UserAgentRequestPayload::EvmGrantCreate(EvmGrantCreateRequest { shared, specific }) => {
+            let basic = shared
+                .ok_or_else(|| Status::invalid_argument("Missing shared grant settings"))?
+                .try_convert()?;
+            let grant = specific
+                .ok_or_else(|| Status::invalid_argument("Missing specific grant settings"))?
+                .try_convert()?;
+
+            let result = match actor.ask(HandleGrantCreate { basic, grant }).await {
+                Ok(grant_id) => EvmGrantCreateResult::GrantId(grant_id),
+                Err(err) => {
+                    warn!(error = ?err, "Failed to create EVM grant");
+                    EvmGrantCreateResult::Error(ProtoEvmError::Internal.into())
+                }
+            };
+            UserAgentResponsePayload::EvmGrantCreate(EvmGrantCreateResponse {
+                result: Some(result),
+            })
+        }
+
+        UserAgentRequestPayload::EvmGrantDelete(EvmGrantDeleteRequest { grant_id }) => {
+            let result = match actor.ask(HandleGrantDelete { grant_id }).await {
+                Ok(()) => EvmGrantDeleteResult::Ok(()),
+                Err(err) => {
+                    warn!(error = ?err, "Failed to delete EVM grant");
+                    EvmGrantDeleteResult::Error(ProtoEvmError::Internal.into())
+                }
+            };
+            UserAgentResponsePayload::EvmGrantDelete(EvmGrantDeleteResponse {
+                result: Some(result),
+            })
+        }
+
+        UserAgentRequestPayload::SdkClientConnectionResponse(resp) => {
+            let pubkey_bytes = <[u8; 32]>::try_from(resp.pubkey)
+                .map_err(|_| Status::invalid_argument("Invalid Ed25519 public key length"))?;
+            let pubkey = ed25519_dalek::VerifyingKey::from_bytes(&pubkey_bytes)
+                .map_err(|_| Status::invalid_argument("Invalid Ed25519 public key"))?;
+
+            actor
+                .ask(HandleNewClientApprove {
+                    approved: resp.approved,
+                    pubkey,
+                })
+                .await
+                .map_err(|err| {
+                    warn!(?err, "Failed to process client connection response");
+                    Status::internal("Failed to process response")
+                })?;
+
+            return Ok(None);
+        }
+
+        UserAgentRequestPayload::SdkClientRevoke(_) => todo!(),
+
+        UserAgentRequestPayload::SdkClientList(_) => {
+            let result = match actor.ask(HandleSdkClientList {}).await {
+                Ok(clients) => ProtoSdkClientListResult::Clients(ProtoSdkClientList {
+                    clients: clients
+                        .into_iter()
+                        .map(|(client, metadata)| ProtoSdkClientEntry {
+                            id: client.id,
+                            pubkey: client.public_key,
+                            info: Some(ProtoClientMetadata {
+                                name: metadata.name,
+                                description: metadata.description,
+                                version: metadata.version,
+                            }),
+                            created_at: client.created_at.0.timestamp() as i32,
+                        })
+                        .collect(),
+                }),
+                Err(err) => {
+                    warn!(error = ?err, "Failed to list SDK clients");
+                    ProtoSdkClientListResult::Error(ProtoSdkClientError::Internal.into())
+                }
+            };
+            UserAgentResponsePayload::SdkClientListResponse(ProtoSdkClientListResponse {
+                result: Some(result),
+            })
+        }
+
+        UserAgentRequestPayload::GrantWalletAccess(SdkClientGrantWalletAccess { accesses }) => {
+            let entries: Vec<NewEvmWalletAccess> =
+                accesses.into_iter().map(|a| a.convert()).collect();
+
+            match actor.ask(HandleGrantEvmWalletAccess { entries }).await {
+                Ok(()) => {
+                    info!("Successfully granted wallet access");
+                    return Ok(None);
+                }
+                Err(err) => {
+                    warn!(error = ?err, "Failed to grant wallet access");
+                    return Err(Status::internal("Failed to grant wallet access"));
+                }
+            }
+        }
+
+        UserAgentRequestPayload::RevokeWalletAccess(SdkClientRevokeWalletAccess { accesses }) => {
+            match actor.ask(HandleRevokeEvmWalletAccess { entries: accesses }).await {
+                Ok(()) => {
+                    info!("Successfully revoked wallet access");
+                    return Ok(None);
+                }
+                Err(err) => {
+                    warn!(error = ?err, "Failed to revoke wallet access");
+                    return Err(Status::internal("Failed to revoke wallet access"));
+                }
+            }
+        }
+
+        UserAgentRequestPayload::ListWalletAccess(_) => {
+            let result = match actor.ask(HandleListWalletAccess {}).await {
+                Ok(accesses) => ListWalletAccessResponse {
+                    accesses: accesses.into_iter().map(|a| a.convert()).collect(),
+                },
+                Err(err) => {
+                    warn!(error = ?err, "Failed to list wallet access");
+                    return Err(Status::internal("Failed to list wallet access"));
+                }
+            };
+            UserAgentResponsePayload::ListWalletAccessResponse(result)
+        }
+
+        UserAgentRequestPayload::AuthChallengeRequest(..)
+        | UserAgentRequestPayload::AuthChallengeSolution(..) => {
+            warn!(?payload, "Unsupported post-auth user agent request");
+            return Err(Status::invalid_argument("Unsupported user-agent request"));
+        }
     };
 
-    ProtoSpecificGrant { grant: Some(grant) }
-}
-
-struct EvmGrantOrWallet;
-
-impl EvmGrantOrWallet {
-    fn wallet_create_response<M>(
-        result: Result<Address, SendError<M, Error>>,
-    ) -> WalletCreateResponse {
-        let result = match result {
-            Ok(wallet) => WalletCreateResult::Wallet(WalletEntry {
-                address: wallet.to_vec(),
-            }),
-            Err(err) => {
-                warn!(error = ?err, "Failed to create EVM wallet");
-                WalletCreateResult::Error(ProtoEvmError::Internal.into())
-            }
-        };
-
-        WalletCreateResponse {
-            result: Some(result),
-        }
-    }
-
-    fn wallet_list_response<M>(
-        result: Result<Vec<Address>, SendError<M, Error>>,
-    ) -> WalletListResponse {
-        let result = match result {
-            Ok(wallets) => WalletListResult::Wallets(WalletList {
-                wallets: wallets
-                    .into_iter()
-                    .map(|wallet| WalletEntry {
-                        address: wallet.to_vec(),
-                    })
-                    .collect(),
-            }),
-            Err(err) => {
-                warn!(error = ?err, "Failed to list EVM wallets");
-                WalletListResult::Error(ProtoEvmError::Internal.into())
-            }
-        };
-
-        WalletListResponse {
-            result: Some(result),
-        }
-    }
-
-    fn grant_create_response<M>(
-        result: Result<i32, SendError<M, Error>>,
-    ) -> EvmGrantCreateResponse {
-        let result = match result {
-            Ok(grant_id) => EvmGrantCreateResult::GrantId(grant_id),
-            Err(err) => {
-                warn!(error = ?err, "Failed to create EVM grant");
-                EvmGrantCreateResult::Error(ProtoEvmError::Internal.into())
-            }
-        };
-
-        EvmGrantCreateResponse {
-            result: Some(result),
-        }
-    }
-
-    fn grant_delete_response<M>(result: Result<(), SendError<M, Error>>) -> EvmGrantDeleteResponse {
-        let result = match result {
-            Ok(()) => EvmGrantDeleteResult::Ok(ProtoEmpty {}),
-            Err(err) => {
-                warn!(error = ?err, "Failed to delete EVM grant");
-                EvmGrantDeleteResult::Error(ProtoEvmError::Internal.into())
-            }
-        };
-
-        EvmGrantDeleteResponse {
-            result: Some(result),
-        }
-    }
-
-    fn grant_list_response<M>(
-        result: Result<Vec<Grant<SpecificGrant>>, SendError<M, Error>>,
-    ) -> EvmGrantListResponse {
-        let result = match result {
-            Ok(grants) => EvmGrantListResult::Grants(EvmGrantList {
-                grants: grants
-                    .into_iter()
-                    .map(|grant| GrantEntry {
-                        id: grant.id,
-                        client_id: grant.shared.client_id,
-                        shared: Some(shared_settings_to_proto(grant.shared)),
-                        specific: Some(specific_grant_to_proto(grant.settings)),
-                    })
-                    .collect(),
-            }),
-            Err(err) => {
-                warn!(error = ?err, "Failed to list EVM grants");
-                EvmGrantListResult::Error(ProtoEvmError::Internal.into())
-            }
-        };
-
-        EvmGrantListResponse {
-            result: Some(result),
-        }
-    }
+    Ok(Some(response))
 }
 
 pub async fn start(
@@ -578,10 +444,8 @@ pub async fn start(
     mut bi: GrpcBi<UserAgentRequest, UserAgentResponse>,
 ) {
     let mut request_tracker = RequestTracker::default();
-    let mut response_id = None;
 
-    let pubkey = match auth::start(&mut conn, &mut bi, &mut request_tracker, &mut response_id).await
-    {
+    let pubkey = match auth::start(&mut conn, &mut bi, &mut request_tracker).await {
         Ok(pubkey) => pubkey,
         Err(e) => {
             warn!(error = ?e, "Authentication failed");
@@ -595,10 +459,7 @@ pub async fn start(
     let actor = UserAgentSession::spawn(UserAgentSession::new(conn, Box::new(oob_adapter)));
     let actor_for_cleanup = actor.clone();
 
-    let _ = defer(move || {
-        actor_for_cleanup.kill();
-    });
-
     info!(?pubkey, "User authenticated successfully");
     dispatch_loop(bi, actor, oob_receiver, request_tracker).await;
+    actor_for_cleanup.kill();
 }

server/crates/arbiter-server/src/grpc/user_agent/auth.rs

@@ -21,19 +21,16 @@ use crate::{
 pub struct AuthTransportAdapter<'a> {
     bi: &'a mut GrpcBi<UserAgentRequest, UserAgentResponse>,
     request_tracker: &'a mut RequestTracker,
-    response_id: &'a mut Option<i32>,
 }
 
 impl<'a> AuthTransportAdapter<'a> {
     pub fn new(
         bi: &'a mut GrpcBi<UserAgentRequest, UserAgentResponse>,
         request_tracker: &'a mut RequestTracker,
-        response_id: &'a mut Option<i32>,
     ) -> Self {
         Self {
             bi,
             request_tracker,
-            response_id,
         }
     }
 
@@ -41,11 +38,9 @@ impl<'a> AuthTransportAdapter<'a> {
         &mut self,
         payload: UserAgentResponsePayload,
     ) -> Result<(), TransportError> {
-        let id = self.response_id.take();
-
         self.bi
             .send(Ok(UserAgentResponse {
-                id,
+                id: Some(self.request_tracker.current_request_id()),
                 payload: Some(payload),
             }))
             .await
@@ -75,9 +70,14 @@ impl Sender<Result<auth::Outbound, auth::Error>> for AuthTransportAdapter<'_> {
             Err(Error::InvalidBootstrapToken) => {
                 UserAgentResponsePayload::AuthResult(ProtoAuthResult::TokenInvalid.into())
             }
-            Err(Error::Internal { details }) => return self.bi.send(Err(Status::internal(details))).await,
+            Err(Error::Internal { details }) => {
+                return self.bi.send(Err(Status::internal(details))).await;
+            }
             Err(Error::Transport) => {
-                return self.bi.send(Err(Status::unavailable("transport error"))).await;
+                return self
+                    .bi
+                    .send(Err(Status::unavailable("transport error")))
+                    .await;
             }
         };
 
@@ -96,14 +96,13 @@ impl Receiver<auth::Inbound> for AuthTransportAdapter<'_> {
             }
         };
 
-        let request_id = match self.request_tracker.request(request.id) {
+        match self.request_tracker.request(request.id) {
             Ok(request_id) => request_id,
             Err(error) => {
                 let _ = self.bi.send(Err(error)).await;
                 return None;
             }
         };
-        *self.response_id = Some(request_id);
 
         let Some(payload) = request.payload else {
             warn!(
@@ -173,8 +172,7 @@ pub async fn start(
     conn: &mut UserAgentConnection,
     bi: &mut GrpcBi<UserAgentRequest, UserAgentResponse>,
     request_tracker: &mut RequestTracker,
-    response_id: &mut Option<i32>,
 ) -> Result<AuthPublicKey, auth::Error> {
-    let transport = AuthTransportAdapter::new(bi, request_tracker, response_id);
+    let transport = AuthTransportAdapter::new(bi, request_tracker);
     auth::authenticate(conn, transport).await
 }

server/crates/arbiter-server/src/grpc/user_agent/inbound.rs

@@ -0,0 +1,168 @@
+use alloy::primitives::{Address, U256};
+use arbiter_proto::proto::evm::{
+    EtherTransferSettings as ProtoEtherTransferSettings, SharedSettings as ProtoSharedSettings,
+    SpecificGrant as ProtoSpecificGrant, TokenTransferSettings as ProtoTokenTransferSettings,
+    TransactionRateLimit as ProtoTransactionRateLimit, VolumeRateLimit as ProtoVolumeRateLimit,
+    specific_grant::Grant as ProtoSpecificGrantType,
+};
+use arbiter_proto::proto::user_agent::{SdkClientWalletAccess, WalletAccess};
+use chrono::{DateTime, TimeZone, Utc};
+use prost_types::Timestamp as ProtoTimestamp;
+use tonic::Status;
+
+use crate::db::models::{CoreEvmWalletAccess, NewEvmWallet, NewEvmWalletAccess};
+use crate::grpc::Convert;
+use crate::{
+    evm::policies::{
+        SharedGrantSettings, SpecificGrant, TransactionRateLimit, VolumeRateLimit, ether_transfer,
+        token_transfers,
+    },
+    grpc::TryConvert,
+};
+
+fn address_from_bytes(bytes: Vec<u8>) -> Result<Address, Status> {
+    if bytes.len() != 20 {
+        return Err(Status::invalid_argument("Invalid EVM address"));
+    }
+    Ok(Address::from_slice(&bytes))
+}
+
+fn u256_from_proto_bytes(bytes: &[u8]) -> Result<U256, Status> {
+    if bytes.len() > 32 {
+        return Err(Status::invalid_argument("Invalid U256 byte length"));
+    }
+    Ok(U256::from_be_slice(bytes))
+}
+
+impl TryConvert for ProtoTimestamp {
+    type Output = DateTime<Utc>;
+    type Error = Status;
+
+    fn try_convert(self) -> Result<DateTime<Utc>, Status> {
+        Utc.timestamp_opt(self.seconds, self.nanos as u32)
+            .single()
+            .ok_or_else(|| Status::invalid_argument("Invalid timestamp"))
+    }
+}
+
+impl TryConvert for ProtoTransactionRateLimit {
+    type Output = TransactionRateLimit;
+    type Error = Status;
+
+    fn try_convert(self) -> Result<TransactionRateLimit, Status> {
+        Ok(TransactionRateLimit {
+            count: self.count,
+            window: chrono::Duration::seconds(self.window_secs),
+        })
+    }
+}
+
+impl TryConvert for ProtoVolumeRateLimit {
+    type Output = VolumeRateLimit;
+    type Error = Status;
+
+    fn try_convert(self) -> Result<VolumeRateLimit, Status> {
+        Ok(VolumeRateLimit {
+            max_volume: u256_from_proto_bytes(&self.max_volume)?,
+            window: chrono::Duration::seconds(self.window_secs),
+        })
+    }
+}
+
+impl TryConvert for ProtoSharedSettings {
+    type Output = SharedGrantSettings;
+    type Error = Status;
+
+    fn try_convert(self) -> Result<SharedGrantSettings, Status> {
+        Ok(SharedGrantSettings {
+            wallet_access_id: self.wallet_access_id,
+            chain: self.chain_id,
+            valid_from: self
+                .valid_from
+                .map(ProtoTimestamp::try_convert)
+                .transpose()?,
+            valid_until: self
+                .valid_until
+                .map(ProtoTimestamp::try_convert)
+                .transpose()?,
+            max_gas_fee_per_gas: self
+                .max_gas_fee_per_gas
+                .as_deref()
+                .map(u256_from_proto_bytes)
+                .transpose()?,
+            max_priority_fee_per_gas: self
+                .max_priority_fee_per_gas
+                .as_deref()
+                .map(u256_from_proto_bytes)
+                .transpose()?,
+            rate_limit: self
+                .rate_limit
+                .map(ProtoTransactionRateLimit::try_convert)
+                .transpose()?,
+        })
+    }
+}
+
+impl TryConvert for ProtoSpecificGrant {
+    type Output = SpecificGrant;
+    type Error = Status;
+
+    fn try_convert(self) -> Result<SpecificGrant, Status> {
+        match self.grant {
+            Some(ProtoSpecificGrantType::EtherTransfer(ProtoEtherTransferSettings {
+                targets,
+                limit,
+            })) => Ok(SpecificGrant::EtherTransfer(ether_transfer::Settings {
+                target: targets
+                    .into_iter()
+                    .map(address_from_bytes)
+                    .collect::<Result<_, _>>()?,
+                limit: limit
+                    .ok_or_else(|| {
+                        Status::invalid_argument("Missing ether transfer volume rate limit")
+                    })?
+                    .try_convert()?,
+            })),
+            Some(ProtoSpecificGrantType::TokenTransfer(ProtoTokenTransferSettings {
+                token_contract,
+                target,
+                volume_limits,
+            })) => Ok(SpecificGrant::TokenTransfer(token_transfers::Settings {
+                token_contract: address_from_bytes(token_contract)?,
+                target: target.map(address_from_bytes).transpose()?,
+                volume_limits: volume_limits
+                    .into_iter()
+                    .map(ProtoVolumeRateLimit::try_convert)
+                    .collect::<Result<_, _>>()?,
+            })),
+            None => Err(Status::invalid_argument("Missing specific grant kind")),
+        }
+    }
+}
+
+impl Convert for WalletAccess {
+    type Output = NewEvmWalletAccess;
+
+    fn convert(self) -> Self::Output {
+        NewEvmWalletAccess {
+            wallet_id: self.wallet_id,
+            client_id: self.sdk_client_id,
+        }
+    }
+}
+
+impl TryConvert for SdkClientWalletAccess {
+    type Output = CoreEvmWalletAccess;
+    type Error = Status;
+
+    fn try_convert(self) -> Result<CoreEvmWalletAccess, Status> {
+        let Some(access) = self.access else {
+            return Err(Status::invalid_argument("Missing wallet access entry"));
+        };
+        Ok(CoreEvmWalletAccess {
+            wallet_id: access.wallet_id,
+            client_id: access.sdk_client_id,
+            id: self.id,
+        })
+    }
+}

server/crates/arbiter-server/src/grpc/user_agent/outbound.rs

@@ -0,0 +1,111 @@
+use arbiter_proto::proto::{
+    evm::{
+        EtherTransferSettings as ProtoEtherTransferSettings, SharedSettings as ProtoSharedSettings,
+        SpecificGrant as ProtoSpecificGrant, TokenTransferSettings as ProtoTokenTransferSettings,
+        TransactionRateLimit as ProtoTransactionRateLimit, VolumeRateLimit as ProtoVolumeRateLimit,
+        specific_grant::Grant as ProtoSpecificGrantType,
+    },
+    user_agent::{SdkClientWalletAccess as ProtoSdkClientWalletAccess, WalletAccess},
+};
+use chrono::{DateTime, Utc};
+use prost_types::Timestamp as ProtoTimestamp;
+
+use crate::{
+    db::models::EvmWalletAccess,
+    evm::policies::{SharedGrantSettings, SpecificGrant, TransactionRateLimit, VolumeRateLimit},
+    grpc::Convert,
+};
+
+impl Convert for DateTime<Utc> {
+    type Output = ProtoTimestamp;
+
+    fn convert(self) -> ProtoTimestamp {
+        ProtoTimestamp {
+            seconds: self.timestamp(),
+            nanos: self.timestamp_subsec_nanos() as i32,
+        }
+    }
+}
+
+impl Convert for TransactionRateLimit {
+    type Output = ProtoTransactionRateLimit;
+
+    fn convert(self) -> ProtoTransactionRateLimit {
+        ProtoTransactionRateLimit {
+            count: self.count,
+            window_secs: self.window.num_seconds(),
+        }
+    }
+}
+
+impl Convert for VolumeRateLimit {
+    type Output = ProtoVolumeRateLimit;
+
+    fn convert(self) -> ProtoVolumeRateLimit {
+        ProtoVolumeRateLimit {
+            max_volume: self.max_volume.to_be_bytes::<32>().to_vec(),
+            window_secs: self.window.num_seconds(),
+        }
+    }
+}
+
+impl Convert for SharedGrantSettings {
+    type Output = ProtoSharedSettings;
+
+    fn convert(self) -> ProtoSharedSettings {
+        ProtoSharedSettings {
+            wallet_access_id: self.wallet_access_id,
+            chain_id: self.chain,
+            valid_from: self.valid_from.map(DateTime::convert),
+            valid_until: self.valid_until.map(DateTime::convert),
+            max_gas_fee_per_gas: self
+                .max_gas_fee_per_gas
+                .map(|value| value.to_be_bytes::<32>().to_vec()),
+            max_priority_fee_per_gas: self
+                .max_priority_fee_per_gas
+                .map(|value| value.to_be_bytes::<32>().to_vec()),
+            rate_limit: self.rate_limit.map(TransactionRateLimit::convert),
+        }
+    }
+}
+
+impl Convert for SpecificGrant {
+    type Output = ProtoSpecificGrant;
+
+    fn convert(self) -> ProtoSpecificGrant {
+        let grant = match self {
+            SpecificGrant::EtherTransfer(s) => {
+                ProtoSpecificGrantType::EtherTransfer(ProtoEtherTransferSettings {
+                    targets: s.target.into_iter().map(|a| a.to_vec()).collect(),
+                    limit: Some(s.limit.convert()),
+                })
+            }
+            SpecificGrant::TokenTransfer(s) => {
+                ProtoSpecificGrantType::TokenTransfer(ProtoTokenTransferSettings {
+                    token_contract: s.token_contract.to_vec(),
+                    target: s.target.map(|a| a.to_vec()),
+                    volume_limits: s
+                        .volume_limits
+                        .into_iter()
+                        .map(VolumeRateLimit::convert)
+                        .collect(),
+                })
+            }
+        };
+        ProtoSpecificGrant { grant: Some(grant) }
+    }
+}
+
+impl Convert for EvmWalletAccess {
+    type Output = ProtoSdkClientWalletAccess;
+
+    fn convert(self) -> Self::Output {
+        Self::Output {
+            id: self.id,
+            access: Some(WalletAccess {
+                wallet_id: self.wallet_id,
+                sdk_client_id: self.client_id,
+            }),
+        }
+    }
+}

server/crates/arbiter-server/src/lib.rs

@@ -1,5 +1,13 @@
 #![forbid(unsafe_code)]
-use crate::context::ServerContext;
+
+use std::{net::SocketAddr, path::PathBuf};
+
+use arbiter_proto::{proto::arbiter_service_server::ArbiterServiceServer, url::ArbiterUrl};
+use miette::miette;
+use tonic::transport::{Identity, ServerTlsConfig};
+use tracing::info;
+
+use crate::{actors::bootstrap::GetToken, context::ServerContext};
 
 pub mod actors;
 pub mod context;
@@ -18,3 +26,64 @@ impl Server {
         Self { context }
     }
 }
+
+#[derive(Debug, Clone)]
+pub struct RunConfig {
+    pub addr: SocketAddr,
+    pub data_dir: Option<PathBuf>,
+    pub log_arbiter_url: bool,
+}
+
+impl RunConfig {
+    pub fn new(addr: SocketAddr, data_dir: Option<PathBuf>) -> Self {
+        Self {
+            addr,
+            data_dir,
+            log_arbiter_url: true,
+        }
+    }
+}
+
+pub async fn run_server_until_shutdown<F>(config: RunConfig, shutdown: F) -> miette::Result<()>
+where
+    F: Future<Output = ()> + Send + 'static,
+{
+    arbiter_proto::set_home_path_override(config.data_dir.clone())
+        .map_err(|err| miette!("failed to set home path override: {err}"))?;
+
+    let db = db::create_pool(None).await?;
+    info!(addr = %config.addr, "Database ready");
+
+    let context = ServerContext::new(db).await?;
+    info!(addr = %config.addr, "Server context ready");
+
+    if config.log_arbiter_url {
+        let url = ArbiterUrl {
+            host: config.addr.ip().to_string(),
+            port: config.addr.port(),
+            ca_cert: context.tls.ca_cert().clone().into_owned(),
+            bootstrap_token: context
+                .actors
+                .bootstrapper
+                .ask(GetToken)
+                .await
+                .map_err(|err| miette!("failed to get bootstrap token from actor: {err}"))?,
+        };
+        info!(%url, "Server URL");
+    }
+
+    let tls = ServerTlsConfig::new().identity(Identity::from_pem(
+        context.tls.cert_pem(),
+        context.tls.key_pem(),
+    ));
+
+    tonic::transport::Server::builder()
+        .tls_config(tls)
+        .map_err(|err| miette!("Failed to setup TLS: {err}"))?
+        .add_service(ArbiterServiceServer::new(Server::new(context)))
+        .serve_with_shutdown(config.addr, shutdown)
+        .await
+        .map_err(|e| miette!("gRPC server error: {e}"))?;
+
+    Ok(())
+}

server/crates/arbiter-server/src/main.rs

@@ -1,56 +1,42 @@
-use std::net::SocketAddr;
+mod cli;
+mod service;
 
-use arbiter_proto::{proto::arbiter_service_server::ArbiterServiceServer, url::ArbiterUrl};
-use arbiter_server::{Server, actors::bootstrap::GetToken, context::ServerContext, db};
-use miette::miette;
+use clap::Parser;
+use cli::{Cli, Command, RunArgs, ServiceCommand};
 use rustls::crypto::aws_lc_rs;
-use tonic::transport::{Identity, ServerTlsConfig};
 use tracing::info;
 
-const PORT: u16 = 50051;
-
 #[tokio::main]
 async fn main() -> miette::Result<()> {
     aws_lc_rs::default_provider().install_default().unwrap();
+    init_logging();
 
-    tracing_subscriber::fmt()
+    let cli = Cli::parse();
+
+    match cli.command {
+        None => run_foreground(RunArgs::default()).await,
+        Some(Command::Run(args)) => run_foreground(args).await,
+        Some(Command::Service { command }) => match command {
+            ServiceCommand::Install(args) => service::install_service(args),
+            ServiceCommand::Run(args) => service::run_service_dispatcher(args),
+        },
+    }
+}
+
+async fn run_foreground(args: RunArgs) -> miette::Result<()> {
+    info!(addr = %args.listen_addr, "Starting arbiter server");
+    arbiter_server::run_server_until_shutdown(
+        arbiter_server::RunConfig::new(args.listen_addr, args.data_dir),
+        std::future::pending::<()>(),
+    )
+    .await
+}
+
+fn init_logging() {
+    let _ = tracing_subscriber::fmt()
         .with_env_filter(
             tracing_subscriber::EnvFilter::try_from_default_env()
                 .unwrap_or_else(|_| tracing_subscriber::EnvFilter::new("info")),
         )
-        .init();
-
-    info!("Starting arbiter server");
-
-    let db = db::create_pool(None).await?;
-    info!("Database ready");
-
-    let context = ServerContext::new(db).await?;
-
-    let addr: SocketAddr = format!("127.0.0.1:{PORT}").parse().expect("valid address");
-    info!(%addr, "Starting gRPC server");
-
-    let url = ArbiterUrl {
-        host: addr.ip().to_string(),
-        port: addr.port(),
-        ca_cert: context.tls.ca_cert().clone().into_owned(),
-        bootstrap_token: context.actors.bootstrapper.ask(GetToken).await.unwrap(),
-    };
-
-    info!(%url, "Server URL");
-
-    let tls = ServerTlsConfig::new().identity(Identity::from_pem(
-        context.tls.cert_pem(),
-        context.tls.key_pem(),
-    ));
-
-    tonic::transport::Server::builder()
-        .tls_config(tls)
-        .map_err(|err| miette!("Faild to setup TLS: {err}"))?
-        .add_service(ArbiterServiceServer::new(Server::new(context)))
-        .serve(addr)
-        .await
-        .map_err(|e| miette::miette!("gRPC server error: {e}"))?;
-
-    unreachable!("gRPC server should run indefinitely");
+        .try_init();
 }

server/crates/arbiter-server/src/service/mod.rs

@@ -0,0 +1,19 @@
+#[cfg(windows)]
+mod windows;
+
+#[cfg(windows)]
+pub use windows::{install_service, run_service_dispatcher};
+
+#[cfg(not(windows))]
+pub fn install_service(_: crate::cli::ServiceInstallArgs) -> miette::Result<()> {
+    Err(miette::miette!(
+        "service install is currently supported only on Windows"
+    ))
+}
+
+#[cfg(not(windows))]
+pub fn run_service_dispatcher(_: crate::cli::ServiceRunArgs) -> miette::Result<()> {
+    Err(miette::miette!(
+        "service run entrypoint is currently supported only on Windows"
+    ))
+}

server/crates/arbiter-server/src/service/windows.rs

@@ -0,0 +1,230 @@
+use std::{
+    ffi::OsString,
+    path::{Path, PathBuf},
+    process::Command,
+    sync::mpsc,
+    time::Duration,
+};
+
+use miette::{Context as _, IntoDiagnostic as _, miette};
+use windows_service::{
+    define_windows_service,
+    service::{
+        ServiceAccess, ServiceControl, ServiceControlAccept, ServiceErrorControl, ServiceExitCode,
+        ServiceInfo, ServiceStartType, ServiceState, ServiceStatus, ServiceType,
+    },
+    service_control_handler::{self, ServiceControlHandlerResult},
+    service_dispatcher,
+    service_manager::{ServiceManager, ServiceManagerAccess},
+};
+
+use crate::cli::{ServiceInstallArgs, ServiceRunArgs};
+use arbiter_server::{RunConfig, run_server_until_shutdown};
+
+const SERVICE_NAME: &str = "ArbiterServer";
+const SERVICE_DISPLAY_NAME: &str = "Arbiter Server";
+
+pub fn default_service_data_dir() -> PathBuf {
+    let base = std::env::var_os("PROGRAMDATA")
+        .map(PathBuf::from)
+        .unwrap_or_else(|| PathBuf::from(r"C:\ProgramData"));
+    base.join("Arbiter")
+}
+
+pub fn install_service(args: ServiceInstallArgs) -> miette::Result<()> {
+    ensure_admin_rights()?;
+
+    let executable = std::env::current_exe().into_diagnostic()?;
+    let data_dir = args.data_dir.unwrap_or_else(default_service_data_dir);
+
+    std::fs::create_dir_all(&data_dir)
+        .into_diagnostic()
+        .with_context(|| format!("failed to create service data dir: {}", data_dir.display()))?;
+    ensure_token_acl_contract(&data_dir)?;
+
+    let manager_access = ServiceManagerAccess::CONNECT | ServiceManagerAccess::CREATE_SERVICE;
+    let manager = ServiceManager::local_computer(None::<&str>, manager_access)
+        .into_diagnostic()
+        .wrap_err("failed to open Service Control Manager")?;
+
+    let launch_arguments = vec![
+        OsString::from("service"),
+        OsString::from("run"),
+        OsString::from("--data-dir"),
+        data_dir.as_os_str().to_os_string(),
+    ];
+
+    let service_info = ServiceInfo {
+        name: OsString::from(SERVICE_NAME),
+        display_name: OsString::from(SERVICE_DISPLAY_NAME),
+        service_type: ServiceType::OWN_PROCESS,
+        start_type: ServiceStartType::AutoStart,
+        error_control: ServiceErrorControl::Normal,
+        executable_path: executable,
+        launch_arguments,
+        dependencies: vec![],
+        account_name: Some(OsString::from(r"NT AUTHORITY\LocalService")),
+        account_password: None,
+    };
+
+    let service = manager
+        .create_service(
+            &service_info,
+            ServiceAccess::QUERY_STATUS | ServiceAccess::START,
+        )
+        .into_diagnostic()
+        .wrap_err("failed to create Windows service in SCM")?;
+
+    if args.start {
+        service
+            .start::<&str>(&[])
+            .into_diagnostic()
+            .wrap_err("service created but failed to start")?;
+    }
+
+    Ok(())
+}
+
+pub fn run_service_dispatcher(args: ServiceRunArgs) -> miette::Result<()> {
+    SERVICE_RUN_ARGS
+        .set(args)
+        .map_err(|_| miette!("service runtime args are already initialized"))?;
+
+    service_dispatcher::start(SERVICE_NAME, ffi_service_main)
+        .into_diagnostic()
+        .wrap_err("failed to start service dispatcher")?;
+
+    Ok(())
+}
+
+define_windows_service!(ffi_service_main, service_main);
+
+static SERVICE_RUN_ARGS: std::sync::OnceLock<ServiceRunArgs> = std::sync::OnceLock::new();
+
+fn service_main(_arguments: Vec<OsString>) {
+    if let Err(error) = run_service_main() {
+        tracing::error!(error = ?error, "Windows service main failed");
+    }
+}
+
+fn run_service_main() -> miette::Result<()> {
+    let args = SERVICE_RUN_ARGS
+        .get()
+        .cloned()
+        .ok_or_else(|| miette!("service run args are missing"))?;
+
+    let (shutdown_tx, shutdown_rx) = mpsc::channel::<()>();
+
+    let status_handle =
+        service_control_handler::register(SERVICE_NAME, move |control| match control {
+            ServiceControl::Stop => {
+                let _ = shutdown_tx.send(());
+                ServiceControlHandlerResult::NoError
+            }
+            ServiceControl::Interrogate => ServiceControlHandlerResult::NoError,
+            _ => ServiceControlHandlerResult::NotImplemented,
+        })
+        .into_diagnostic()
+        .wrap_err("failed to register service control handler")?;
+
+    set_status(
+        &status_handle,
+        ServiceState::StartPending,
+        ServiceControlAccept::empty(),
+    )?;
+
+    let runtime = tokio::runtime::Builder::new_multi_thread()
+        .enable_all()
+        .build()
+        .into_diagnostic()
+        .wrap_err("failed to build tokio runtime for service")?;
+
+    set_status(
+        &status_handle,
+        ServiceState::Running,
+        ServiceControlAccept::STOP,
+    )?;
+
+    let data_dir = args.data_dir.unwrap_or_else(default_service_data_dir);
+    let config = RunConfig {
+        addr: args.listen_addr,
+        data_dir: Some(data_dir),
+        log_arbiter_url: true,
+    };
+
+    let result = runtime.block_on(run_server_until_shutdown(config, async move {
+        let _ = tokio::task::spawn_blocking(move || shutdown_rx.recv()).await;
+    }));
+
+    set_status(
+        &status_handle,
+        ServiceState::Stopped,
+        ServiceControlAccept::empty(),
+    )?;
+
+    result
+}
+
+fn set_status(
+    status_handle: &service_control_handler::ServiceStatusHandle,
+    current_state: ServiceState,
+    controls_accepted: ServiceControlAccept,
+) -> miette::Result<()> {
+    status_handle
+        .set_service_status(ServiceStatus {
+            service_type: ServiceType::OWN_PROCESS,
+            current_state,
+            controls_accepted,
+            exit_code: ServiceExitCode::Win32(0),
+            checkpoint: 0,
+            wait_hint: Duration::from_secs(10),
+            process_id: None,
+        })
+        .into_diagnostic()
+        .wrap_err("failed to update service state")?;
+
+    Ok(())
+}
+
+fn ensure_admin_rights() -> miette::Result<()> {
+    let status = Command::new("net")
+        .arg("session")
+        .status()
+        .into_diagnostic()
+        .wrap_err("failed to check administrator rights")?;
+
+    if status.success() {
+        Ok(())
+    } else {
+        Err(miette!(
+            "administrator privileges are required to install Windows service"
+        ))
+    }
+}
+
+fn ensure_token_acl_contract(data_dir: &Path) -> miette::Result<()> {
+    // IMPORTANT: Keep this ACL setup explicit.
+    // The service account needs write access, while the interactive user only needs read access
+    // to the bootstrap token and service data directory.
+    let target = data_dir.as_os_str();
+
+    let status = Command::new("icacls")
+        .arg(target)
+        .arg("/grant")
+        .arg("*S-1-5-19:(OI)(CI)M")
+        .arg("/grant")
+        .arg("*S-1-5-32-545:(OI)(CI)RX")
+        .arg("/T")
+        .arg("/C")
+        .status()
+        .into_diagnostic()
+        .wrap_err("failed to apply ACLs for service data directory")?;
+
+    if status.success() {
+        Ok(())
+    } else {
+        Err(miette!(
+            "failed to ensure ACL contract for service data directory"
+        ))
+    }
+}

server/crates/arbiter-server/tests/client/auth.rs

@@ -1,15 +1,52 @@
+use arbiter_proto::ClientMetadata;
 use arbiter_proto::transport::{Receiver, Sender};
 use arbiter_server::actors::GlobalActors;
 use arbiter_server::{
     actors::client::{ClientConnection, auth, connect_client},
-    db::{self, schema},
+    db,
 };
-use diesel::{ExpressionMethods as _, insert_into};
+use diesel::{ExpressionMethods as _, NullableExpressionMethods as _, QueryDsl as _, insert_into};
 use diesel_async::RunQueryDsl;
 use ed25519_dalek::Signer as _;
 
 use super::common::ChannelTransport;
 
+fn metadata(name: &str, description: Option<&str>, version: Option<&str>) -> ClientMetadata {
+    ClientMetadata {
+        name: name.to_owned(),
+        description: description.map(str::to_owned),
+        version: version.map(str::to_owned),
+    }
+}
+
+async fn insert_registered_client(
+    db: &db::DatabasePool,
+    pubkey: Vec<u8>,
+    metadata: &ClientMetadata,
+) {
+    use arbiter_server::db::schema::{client_metadata, program_client};
+
+    let mut conn = db.get().await.unwrap();
+    let metadata_id: i32 = insert_into(client_metadata::table)
+        .values((
+            client_metadata::name.eq(&metadata.name),
+            client_metadata::description.eq(&metadata.description),
+            client_metadata::version.eq(&metadata.version),
+        ))
+        .returning(client_metadata::id)
+        .get_result(&mut conn)
+        .await
+        .unwrap();
+    insert_into(program_client::table)
+        .values((
+            program_client::public_key.eq(pubkey),
+            program_client::metadata_id.eq(metadata_id),
+        ))
+        .execute(&mut conn)
+        .await
+        .unwrap();
+}
+
 #[tokio::test]
 #[test_log::test]
 pub async fn test_unregistered_pubkey_rejected() {
@@ -28,6 +65,7 @@ pub async fn test_unregistered_pubkey_rejected() {
     test_transport
         .send(auth::Inbound::AuthChallengeRequest {
             pubkey: new_key.verifying_key(),
+            metadata: metadata("client", Some("desc"), Some("1.0.0")),
         })
         .await
         .unwrap();
@@ -44,14 +82,12 @@ pub async fn test_challenge_auth() {
     let new_key = ed25519_dalek::SigningKey::generate(&mut rand::rng());
     let pubkey_bytes = new_key.verifying_key().to_bytes().to_vec();
 
-    {
-        let mut conn = db.get().await.unwrap();
-        insert_into(schema::program_client::table)
-            .values(schema::program_client::public_key.eq(pubkey_bytes.clone()))
-            .execute(&mut conn)
-            .await
-            .unwrap();
-    }
+    insert_registered_client(
+        &db,
+        pubkey_bytes.clone(),
+        &metadata("client", Some("desc"), Some("1.0.0")),
+    )
+    .await;
 
     let (server_transport, mut test_transport) = ChannelTransport::new();
     let actors = GlobalActors::spawn(db.clone()).await.unwrap();
@@ -66,6 +102,7 @@ pub async fn test_challenge_auth() {
     test_transport
         .send(auth::Inbound::AuthChallengeRequest {
             pubkey: new_key.verifying_key(),
+            metadata: metadata("client", Some("desc"), Some("1.0.0")),
         })
         .await
         .unwrap();
@@ -106,3 +143,182 @@ pub async fn test_challenge_auth() {
     task.await.unwrap();
 }
 
+#[tokio::test]
+#[test_log::test]
+pub async fn test_metadata_unchanged_does_not_append_history() {
+    let db = db::create_test_pool().await;
+    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+    let props = ClientConnection::new(db.clone(), actors);
+
+    let new_key = ed25519_dalek::SigningKey::generate(&mut rand::rng());
+    let requested = metadata("client", Some("desc"), Some("1.0.0"));
+
+    {
+        use arbiter_server::db::schema::{client_metadata, program_client};
+        let mut conn = db.get().await.unwrap();
+        let metadata_id: i32 = insert_into(client_metadata::table)
+            .values((
+                client_metadata::name.eq(&requested.name),
+                client_metadata::description.eq(&requested.description),
+                client_metadata::version.eq(&requested.version),
+            ))
+            .returning(client_metadata::id)
+            .get_result(&mut conn)
+            .await
+            .unwrap();
+        insert_into(program_client::table)
+            .values((
+                program_client::public_key.eq(new_key.verifying_key().to_bytes().to_vec()),
+                program_client::metadata_id.eq(metadata_id),
+            ))
+            .execute(&mut conn)
+            .await
+            .unwrap();
+    }
+
+    let (server_transport, mut test_transport) = ChannelTransport::new();
+    let task = tokio::spawn(async move {
+        let mut server_transport = server_transport;
+        connect_client(props, &mut server_transport).await;
+    });
+
+    test_transport
+        .send(auth::Inbound::AuthChallengeRequest {
+            pubkey: new_key.verifying_key(),
+            metadata: requested,
+        })
+        .await
+        .unwrap();
+
+    let response = test_transport.recv().await.unwrap().unwrap();
+    let (pubkey, nonce) = match response {
+        auth::Outbound::AuthChallenge { pubkey, nonce } => (pubkey, nonce),
+        other => panic!("Expected AuthChallenge, got {other:?}"),
+    };
+    let signature = new_key.sign(&arbiter_proto::format_challenge(nonce, pubkey.as_bytes()));
+    test_transport
+        .send(auth::Inbound::AuthChallengeSolution { signature })
+        .await
+        .unwrap();
+    let _ = test_transport.recv().await.unwrap();
+    task.await.unwrap();
+
+    {
+        use arbiter_server::db::schema::{client_metadata, client_metadata_history};
+        let mut conn = db.get().await.unwrap();
+        let metadata_count: i64 = client_metadata::table
+            .count()
+            .get_result(&mut conn)
+            .await
+            .unwrap();
+        let history_count: i64 = client_metadata_history::table
+            .count()
+            .get_result(&mut conn)
+            .await
+            .unwrap();
+        assert_eq!(metadata_count, 1);
+        assert_eq!(history_count, 0);
+    }
+}
+
+#[tokio::test]
+#[test_log::test]
+pub async fn test_metadata_change_appends_history_and_repoints_binding() {
+    let db = db::create_test_pool().await;
+    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+    let props = ClientConnection::new(db.clone(), actors);
+
+    let new_key = ed25519_dalek::SigningKey::generate(&mut rand::rng());
+
+    {
+        use arbiter_server::db::schema::{client_metadata, program_client};
+        let mut conn = db.get().await.unwrap();
+        let metadata_id: i32 = insert_into(client_metadata::table)
+            .values((
+                client_metadata::name.eq("client"),
+                client_metadata::description.eq(Some("old")),
+                client_metadata::version.eq(Some("1.0.0")),
+            ))
+            .returning(client_metadata::id)
+            .get_result(&mut conn)
+            .await
+            .unwrap();
+        insert_into(program_client::table)
+            .values((
+                program_client::public_key.eq(new_key.verifying_key().to_bytes().to_vec()),
+                program_client::metadata_id.eq(metadata_id),
+            ))
+            .execute(&mut conn)
+            .await
+            .unwrap();
+    }
+
+    let (server_transport, mut test_transport) = ChannelTransport::new();
+    let task = tokio::spawn(async move {
+        let mut server_transport = server_transport;
+        connect_client(props, &mut server_transport).await;
+    });
+
+    test_transport
+        .send(auth::Inbound::AuthChallengeRequest {
+            pubkey: new_key.verifying_key(),
+            metadata: metadata("client", Some("new"), Some("2.0.0")),
+        })
+        .await
+        .unwrap();
+
+    let response = test_transport.recv().await.unwrap().unwrap();
+    let (pubkey, nonce) = match response {
+        auth::Outbound::AuthChallenge { pubkey, nonce } => (pubkey, nonce),
+        other => panic!("Expected AuthChallenge, got {other:?}"),
+    };
+    let signature = new_key.sign(&arbiter_proto::format_challenge(nonce, pubkey.as_bytes()));
+    test_transport
+        .send(auth::Inbound::AuthChallengeSolution { signature })
+        .await
+        .unwrap();
+    let _ = test_transport.recv().await.unwrap();
+    task.await.unwrap();
+
+    {
+        use arbiter_server::db::schema::{
+            client_metadata, client_metadata_history, program_client,
+        };
+        let mut conn = db.get().await.unwrap();
+        let metadata_count: i64 = client_metadata::table
+            .count()
+            .get_result(&mut conn)
+            .await
+            .unwrap();
+        let history_count: i64 = client_metadata_history::table
+            .count()
+            .get_result(&mut conn)
+            .await
+            .unwrap();
+        let metadata_id = program_client::table
+            .select(program_client::metadata_id)
+            .first::<i32>(&mut conn)
+            .await
+            .unwrap();
+        let current = client_metadata::table
+            .find(metadata_id)
+            .select((
+                client_metadata::name,
+                client_metadata::description.nullable(),
+                client_metadata::version.nullable(),
+            ))
+            .first::<(String, Option<String>, Option<String>)>(&mut conn)
+            .await
+            .unwrap();
+        assert_eq!(metadata_count, 2);
+        assert_eq!(history_count, 1);
+        assert_eq!(
+            current,
+            (
+                "client".to_owned(),
+                Some("new".to_owned()),
+                Some("2.0.0".to_owned())
+            )
+        );
+    }
+}

server/crates/arbiter-server/tests/user_agent/unseal.rs

@@ -2,9 +2,9 @@ use arbiter_server::{
     actors::{
         GlobalActors,
         keyholder::{Bootstrap, Seal},
-        user_agent::session::{
-            HandleUnsealEncryptedKey, HandleUnsealRequest, UnsealError, UserAgentSession,
-        },
+        user_agent::{UserAgentSession, session::connection::{
+            HandleUnsealEncryptedKey, HandleUnsealRequest, UnsealError,
+        }},
     },
     db,
     safe_cell::{SafeCell, SafeCellHandle as _},

useragent/lib/features/callouts/active_callout.dart

@@ -0,0 +1,16 @@
+import 'package:arbiter/features/callouts/callout_event.dart';
+import 'package:freezed_annotation/freezed_annotation.dart';
+
+part 'active_callout.freezed.dart';
+
+@freezed
+abstract class ActiveCallout with _$ActiveCallout {
+  const factory ActiveCallout({
+    required String id,
+    required String title,
+    required String description,
+    String? iconUrl,
+    required DateTime addedAt,
+    required CalloutData data,
+  }) = _ActiveCallout;
+}

useragent/lib/features/callouts/active_callout.freezed.dart

@@ -0,0 +1,304 @@
+// GENERATED CODE - DO NOT MODIFY BY HAND
+// coverage:ignore-file
+// ignore_for_file: type=lint
+// ignore_for_file: unused_element, deprecated_member_use, deprecated_member_use_from_same_package, use_function_type_syntax_for_parameters, unnecessary_const, avoid_init_to_null, invalid_override_different_default_values_named, prefer_expression_function_bodies, annotate_overrides, invalid_annotation_target, unnecessary_question_mark
+
+part of 'active_callout.dart';
+
+// **************************************************************************
+// FreezedGenerator
+// **************************************************************************
+
+// dart format off
+T _$identity<T>(T value) => value;
+/// @nodoc
+mixin _$ActiveCallout {
+
+ String get id; String get title; String get description; String? get iconUrl; DateTime get addedAt; CalloutData get data;
+/// Create a copy of ActiveCallout
+/// with the given fields replaced by the non-null parameter values.
+@JsonKey(includeFromJson: false, includeToJson: false)
+@pragma('vm:prefer-inline')
+$ActiveCalloutCopyWith<ActiveCallout> get copyWith => _$ActiveCalloutCopyWithImpl<ActiveCallout>(this as ActiveCallout, _$identity);
+
+
+
+@override
+bool operator ==(Object other) {
+  return identical(this, other) || (other.runtimeType == runtimeType&&other is ActiveCallout&&(identical(other.id, id) || other.id == id)&&(identical(other.title, title) || other.title == title)&&(identical(other.description, description) || other.description == description)&&(identical(other.iconUrl, iconUrl) || other.iconUrl == iconUrl)&&(identical(other.addedAt, addedAt) || other.addedAt == addedAt)&&(identical(other.data, data) || other.data == data));
+}
+
+
+@override
+int get hashCode => Object.hash(runtimeType,id,title,description,iconUrl,addedAt,data);
+
+@override
+String toString() {
+  return 'ActiveCallout(id: $id, title: $title, description: $description, iconUrl: $iconUrl, addedAt: $addedAt, data: $data)';
+}
+
+
+}
+
+/// @nodoc
+abstract mixin class $ActiveCalloutCopyWith<$Res>  {
+  factory $ActiveCalloutCopyWith(ActiveCallout value, $Res Function(ActiveCallout) _then) = _$ActiveCalloutCopyWithImpl;
+@useResult
+$Res call({
+ String id, String title, String description, String? iconUrl, DateTime addedAt, CalloutData data
+});
+
+
+$CalloutDataCopyWith<$Res> get data;
+
+}
+/// @nodoc
+class _$ActiveCalloutCopyWithImpl<$Res>
+    implements $ActiveCalloutCopyWith<$Res> {
+  _$ActiveCalloutCopyWithImpl(this._self, this._then);
+
+  final ActiveCallout _self;
+  final $Res Function(ActiveCallout) _then;
+
+/// Create a copy of ActiveCallout
+/// with the given fields replaced by the non-null parameter values.
+@pragma('vm:prefer-inline') @override $Res call({Object? id = null,Object? title = null,Object? description = null,Object? iconUrl = freezed,Object? addedAt = null,Object? data = null,}) {
+  return _then(_self.copyWith(
+id: null == id ? _self.id : id // ignore: cast_nullable_to_non_nullable
+as String,title: null == title ? _self.title : title // ignore: cast_nullable_to_non_nullable
+as String,description: null == description ? _self.description : description // ignore: cast_nullable_to_non_nullable
+as String,iconUrl: freezed == iconUrl ? _self.iconUrl : iconUrl // ignore: cast_nullable_to_non_nullable
+as String?,addedAt: null == addedAt ? _self.addedAt : addedAt // ignore: cast_nullable_to_non_nullable
+as DateTime,data: null == data ? _self.data : data // ignore: cast_nullable_to_non_nullable
+as CalloutData,
+  ));
+}
+/// Create a copy of ActiveCallout
+/// with the given fields replaced by the non-null parameter values.
+@override
+@pragma('vm:prefer-inline')
+$CalloutDataCopyWith<$Res> get data {
+  
+  return $CalloutDataCopyWith<$Res>(_self.data, (value) {
+    return _then(_self.copyWith(data: value));
+  });
+}
+}
+
+
+/// Adds pattern-matching-related methods to [ActiveCallout].
+extension ActiveCalloutPatterns on ActiveCallout {
+/// A variant of `map` that fallback to returning `orElse`.
+///
+/// It is equivalent to doing:
+/// ```dart
+/// switch (sealedClass) {
+///   case final Subclass value:
+///     return ...;
+///   case _:
+///     return orElse();
+/// }
+/// ```
+
+@optionalTypeArgs TResult maybeMap<TResult extends Object?>(TResult Function( _ActiveCallout value)?  $default,{required TResult orElse(),}){
+final _that = this;
+switch (_that) {
+case _ActiveCallout() when $default != null:
+return $default(_that);case _:
+  return orElse();
+
+}
+}
+/// A `switch`-like method, using callbacks.
+///
+/// Callbacks receives the raw object, upcasted.
+/// It is equivalent to doing:
+/// ```dart
+/// switch (sealedClass) {
+///   case final Subclass value:
+///     return ...;
+///   case final Subclass2 value:
+///     return ...;
+/// }
+/// ```
+
+@optionalTypeArgs TResult map<TResult extends Object?>(TResult Function( _ActiveCallout value)  $default,){
+final _that = this;
+switch (_that) {
+case _ActiveCallout():
+return $default(_that);case _:
+  throw StateError('Unexpected subclass');
+
+}
+}
+/// A variant of `map` that fallback to returning `null`.
+///
+/// It is equivalent to doing:
+/// ```dart
+/// switch (sealedClass) {
+///   case final Subclass value:
+///     return ...;
+///   case _:
+///     return null;
+/// }
+/// ```
+
+@optionalTypeArgs TResult? mapOrNull<TResult extends Object?>(TResult? Function( _ActiveCallout value)?  $default,){
+final _that = this;
+switch (_that) {
+case _ActiveCallout() when $default != null:
+return $default(_that);case _:
+  return null;
+
+}
+}
+/// A variant of `when` that fallback to an `orElse` callback.
+///
+/// It is equivalent to doing:
+/// ```dart
+/// switch (sealedClass) {
+///   case Subclass(:final field):
+///     return ...;
+///   case _:
+///     return orElse();
+/// }
+/// ```
+
+@optionalTypeArgs TResult maybeWhen<TResult extends Object?>(TResult Function( String id,  String title,  String description,  String? iconUrl,  DateTime addedAt,  CalloutData data)?  $default,{required TResult orElse(),}) {final _that = this;
+switch (_that) {
+case _ActiveCallout() when $default != null:
+return $default(_that.id,_that.title,_that.description,_that.iconUrl,_that.addedAt,_that.data);case _:
+  return orElse();
+
+}
+}
+/// A `switch`-like method, using callbacks.
+///
+/// As opposed to `map`, this offers destructuring.
+/// It is equivalent to doing:
+/// ```dart
+/// switch (sealedClass) {
+///   case Subclass(:final field):
+///     return ...;
+///   case Subclass2(:final field2):
+///     return ...;
+/// }
+/// ```
+
+@optionalTypeArgs TResult when<TResult extends Object?>(TResult Function( String id,  String title,  String description,  String? iconUrl,  DateTime addedAt,  CalloutData data)  $default,) {final _that = this;
+switch (_that) {
+case _ActiveCallout():
+return $default(_that.id,_that.title,_that.description,_that.iconUrl,_that.addedAt,_that.data);case _:
+  throw StateError('Unexpected subclass');
+
+}
+}
+/// A variant of `when` that fallback to returning `null`
+///
+/// It is equivalent to doing:
+/// ```dart
+/// switch (sealedClass) {
+///   case Subclass(:final field):
+///     return ...;
+///   case _:
+///     return null;
+/// }
+/// ```
+
+@optionalTypeArgs TResult? whenOrNull<TResult extends Object?>(TResult? Function( String id,  String title,  String description,  String? iconUrl,  DateTime addedAt,  CalloutData data)?  $default,) {final _that = this;
+switch (_that) {
+case _ActiveCallout() when $default != null:
+return $default(_that.id,_that.title,_that.description,_that.iconUrl,_that.addedAt,_that.data);case _:
+  return null;
+
+}
+}
+
+}
+
+/// @nodoc
+
+
+class _ActiveCallout implements ActiveCallout {
+  const _ActiveCallout({required this.id, required this.title, required this.description, this.iconUrl, required this.addedAt, required this.data});
+  
+
+@override final  String id;
+@override final  String title;
+@override final  String description;
+@override final  String? iconUrl;
+@override final  DateTime addedAt;
+@override final  CalloutData data;
+
+/// Create a copy of ActiveCallout
+/// with the given fields replaced by the non-null parameter values.
+@override @JsonKey(includeFromJson: false, includeToJson: false)
+@pragma('vm:prefer-inline')
+_$ActiveCalloutCopyWith<_ActiveCallout> get copyWith => __$ActiveCalloutCopyWithImpl<_ActiveCallout>(this, _$identity);
+
+
+
+@override
+bool operator ==(Object other) {
+  return identical(this, other) || (other.runtimeType == runtimeType&&other is _ActiveCallout&&(identical(other.id, id) || other.id == id)&&(identical(other.title, title) || other.title == title)&&(identical(other.description, description) || other.description == description)&&(identical(other.iconUrl, iconUrl) || other.iconUrl == iconUrl)&&(identical(other.addedAt, addedAt) || other.addedAt == addedAt)&&(identical(other.data, data) || other.data == data));
+}
+
+
+@override
+int get hashCode => Object.hash(runtimeType,id,title,description,iconUrl,addedAt,data);
+
+@override
+String toString() {
+  return 'ActiveCallout(id: $id, title: $title, description: $description, iconUrl: $iconUrl, addedAt: $addedAt, data: $data)';
+}
+
+
+}
+
+/// @nodoc
+abstract mixin class _$ActiveCalloutCopyWith<$Res> implements $ActiveCalloutCopyWith<$Res> {
+  factory _$ActiveCalloutCopyWith(_ActiveCallout value, $Res Function(_ActiveCallout) _then) = __$ActiveCalloutCopyWithImpl;
+@override @useResult
+$Res call({
+ String id, String title, String description, String? iconUrl, DateTime addedAt, CalloutData data
+});
+
+
+@override $CalloutDataCopyWith<$Res> get data;
+
+}
+/// @nodoc
+class __$ActiveCalloutCopyWithImpl<$Res>
+    implements _$ActiveCalloutCopyWith<$Res> {
+  __$ActiveCalloutCopyWithImpl(this._self, this._then);
+
+  final _ActiveCallout _self;
+  final $Res Function(_ActiveCallout) _then;
+
+/// Create a copy of ActiveCallout
+/// with the given fields replaced by the non-null parameter values.
+@override @pragma('vm:prefer-inline') $Res call({Object? id = null,Object? title = null,Object? description = null,Object? iconUrl = freezed,Object? addedAt = null,Object? data = null,}) {
+  return _then(_ActiveCallout(
+id: null == id ? _self.id : id // ignore: cast_nullable_to_non_nullable
+as String,title: null == title ? _self.title : title // ignore: cast_nullable_to_non_nullable
+as String,description: null == description ? _self.description : description // ignore: cast_nullable_to_non_nullable
+as String,iconUrl: freezed == iconUrl ? _self.iconUrl : iconUrl // ignore: cast_nullable_to_non_nullable
+as String?,addedAt: null == addedAt ? _self.addedAt : addedAt // ignore: cast_nullable_to_non_nullable
+as DateTime,data: null == data ? _self.data : data // ignore: cast_nullable_to_non_nullable
+as CalloutData,
+  ));
+}
+
+/// Create a copy of ActiveCallout
+/// with the given fields replaced by the non-null parameter values.
+@override
+@pragma('vm:prefer-inline')
+$CalloutDataCopyWith<$Res> get data {
+  
+  return $CalloutDataCopyWith<$Res>(_self.data, (value) {
+    return _then(_self.copyWith(data: value));
+  });
+}
+}
+
+// dart format on

useragent/lib/features/callouts/callout_event.dart

@@ -0,0 +1,25 @@
+import 'package:arbiter/proto/client.pb.dart';
+import 'package:freezed_annotation/freezed_annotation.dart';
+import 'package:hooks_riverpod/experimental/mutation.dart';
+
+part 'callout_event.freezed.dart';
+
+@freezed
+sealed class CalloutData with _$CalloutData {
+  const factory CalloutData.connectApproval({
+    required String pubkey,
+    required ClientInfo clientInfo,
+  }) = ConnectApprovalData;
+}
+
+@freezed
+sealed class CalloutEvent with _$CalloutEvent {
+  const factory CalloutEvent.added({
+    required String id,
+    required CalloutData data,
+  }) = CalloutEventAdded;
+
+  const factory CalloutEvent.cancelled({
+    required String id,
+  }) = CalloutEventCancelled;
+}

useragent/lib/features/callouts/callout_event.freezed.dart

@@ -0,0 +1,602 @@
+// GENERATED CODE - DO NOT MODIFY BY HAND
+// coverage:ignore-file
+// ignore_for_file: type=lint
+// ignore_for_file: unused_element, deprecated_member_use, deprecated_member_use_from_same_package, use_function_type_syntax_for_parameters, unnecessary_const, avoid_init_to_null, invalid_override_different_default_values_named, prefer_expression_function_bodies, annotate_overrides, invalid_annotation_target, unnecessary_question_mark
+
+part of 'callout_event.dart';
+
+// **************************************************************************
+// FreezedGenerator
+// **************************************************************************
+
+// dart format off
+T _$identity<T>(T value) => value;
+/// @nodoc
+mixin _$CalloutData {
+
+ String get pubkey; ClientInfo get clientInfo;
+/// Create a copy of CalloutData
+/// with the given fields replaced by the non-null parameter values.
+@JsonKey(includeFromJson: false, includeToJson: false)
+@pragma('vm:prefer-inline')
+$CalloutDataCopyWith<CalloutData> get copyWith => _$CalloutDataCopyWithImpl<CalloutData>(this as CalloutData, _$identity);
+
+
+
+@override
+bool operator ==(Object other) {
+  return identical(this, other) || (other.runtimeType == runtimeType&&other is CalloutData&&(identical(other.pubkey, pubkey) || other.pubkey == pubkey)&&(identical(other.clientInfo, clientInfo) || other.clientInfo == clientInfo));
+}
+
+
+@override
+int get hashCode => Object.hash(runtimeType,pubkey,clientInfo);
+
+@override
+String toString() {
+  return 'CalloutData(pubkey: $pubkey, clientInfo: $clientInfo)';
+}
+
+
+}
+
+/// @nodoc
+abstract mixin class $CalloutDataCopyWith<$Res>  {
+  factory $CalloutDataCopyWith(CalloutData value, $Res Function(CalloutData) _then) = _$CalloutDataCopyWithImpl;
+@useResult
+$Res call({
+ String pubkey, ClientInfo clientInfo
+});
+
+
+
+
+}
+/// @nodoc
+class _$CalloutDataCopyWithImpl<$Res>
+    implements $CalloutDataCopyWith<$Res> {
+  _$CalloutDataCopyWithImpl(this._self, this._then);
+
+  final CalloutData _self;
+  final $Res Function(CalloutData) _then;
+
+/// Create a copy of CalloutData
+/// with the given fields replaced by the non-null parameter values.
+@pragma('vm:prefer-inline') @override $Res call({Object? pubkey = null,Object? clientInfo = null,}) {
+  return _then(_self.copyWith(
+pubkey: null == pubkey ? _self.pubkey : pubkey // ignore: cast_nullable_to_non_nullable
+as String,clientInfo: null == clientInfo ? _self.clientInfo : clientInfo // ignore: cast_nullable_to_non_nullable
+as ClientInfo,
+  ));
+}
+
+}
+
+
+/// Adds pattern-matching-related methods to [CalloutData].
+extension CalloutDataPatterns on CalloutData {
+/// A variant of `map` that fallback to returning `orElse`.
+///
+/// It is equivalent to doing:
+/// ```dart
+/// switch (sealedClass) {
+///   case final Subclass value:
+///     return ...;
+///   case _:
+///     return orElse();
+/// }
+/// ```
+
+@optionalTypeArgs TResult maybeMap<TResult extends Object?>({TResult Function( ConnectApprovalData value)?  connectApproval,required TResult orElse(),}){
+final _that = this;
+switch (_that) {
+case ConnectApprovalData() when connectApproval != null:
+return connectApproval(_that);case _:
+  return orElse();
+
+}
+}
+/// A `switch`-like method, using callbacks.
+///
+/// Callbacks receives the raw object, upcasted.
+/// It is equivalent to doing:
+/// ```dart
+/// switch (sealedClass) {
+///   case final Subclass value:
+///     return ...;
+///   case final Subclass2 value:
+///     return ...;
+/// }
+/// ```
+
+@optionalTypeArgs TResult map<TResult extends Object?>({required TResult Function( ConnectApprovalData value)  connectApproval,}){
+final _that = this;
+switch (_that) {
+case ConnectApprovalData():
+return connectApproval(_that);}
+}
+/// A variant of `map` that fallback to returning `null`.
+///
+/// It is equivalent to doing:
+/// ```dart
+/// switch (sealedClass) {
+///   case final Subclass value:
+///     return ...;
+///   case _:
+///     return null;
+/// }
+/// ```
+
+@optionalTypeArgs TResult? mapOrNull<TResult extends Object?>({TResult? Function( ConnectApprovalData value)?  connectApproval,}){
+final _that = this;
+switch (_that) {
+case ConnectApprovalData() when connectApproval != null:
+return connectApproval(_that);case _:
+  return null;
+
+}
+}
+/// A variant of `when` that fallback to an `orElse` callback.
+///
+/// It is equivalent to doing:
+/// ```dart
+/// switch (sealedClass) {
+///   case Subclass(:final field):
+///     return ...;
+///   case _:
+///     return orElse();
+/// }
+/// ```
+
+@optionalTypeArgs TResult maybeWhen<TResult extends Object?>({TResult Function( String pubkey,  ClientInfo clientInfo)?  connectApproval,required TResult orElse(),}) {final _that = this;
+switch (_that) {
+case ConnectApprovalData() when connectApproval != null:
+return connectApproval(_that.pubkey,_that.clientInfo);case _:
+  return orElse();
+
+}
+}
+/// A `switch`-like method, using callbacks.
+///
+/// As opposed to `map`, this offers destructuring.
+/// It is equivalent to doing:
+/// ```dart
+/// switch (sealedClass) {
+///   case Subclass(:final field):
+///     return ...;
+///   case Subclass2(:final field2):
+///     return ...;
+/// }
+/// ```
+
+@optionalTypeArgs TResult when<TResult extends Object?>({required TResult Function( String pubkey,  ClientInfo clientInfo)  connectApproval,}) {final _that = this;
+switch (_that) {
+case ConnectApprovalData():
+return connectApproval(_that.pubkey,_that.clientInfo);}
+}
+/// A variant of `when` that fallback to returning `null`
+///
+/// It is equivalent to doing:
+/// ```dart
+/// switch (sealedClass) {
+///   case Subclass(:final field):
+///     return ...;
+///   case _:
+///     return null;
+/// }
+/// ```
+
+@optionalTypeArgs TResult? whenOrNull<TResult extends Object?>({TResult? Function( String pubkey,  ClientInfo clientInfo)?  connectApproval,}) {final _that = this;
+switch (_that) {
+case ConnectApprovalData() when connectApproval != null:
+return connectApproval(_that.pubkey,_that.clientInfo);case _:
+  return null;
+
+}
+}
+
+}
+
+/// @nodoc
+
+
+class ConnectApprovalData implements CalloutData {
+  const ConnectApprovalData({required this.pubkey, required this.clientInfo});
+  
+
+@override final  String pubkey;
+@override final  ClientInfo clientInfo;
+
+/// Create a copy of CalloutData
+/// with the given fields replaced by the non-null parameter values.
+@override @JsonKey(includeFromJson: false, includeToJson: false)
+@pragma('vm:prefer-inline')
+$ConnectApprovalDataCopyWith<ConnectApprovalData> get copyWith => _$ConnectApprovalDataCopyWithImpl<ConnectApprovalData>(this, _$identity);
+
+
+
+@override
+bool operator ==(Object other) {
+  return identical(this, other) || (other.runtimeType == runtimeType&&other is ConnectApprovalData&&(identical(other.pubkey, pubkey) || other.pubkey == pubkey)&&(identical(other.clientInfo, clientInfo) || other.clientInfo == clientInfo));
+}
+
+
+@override
+int get hashCode => Object.hash(runtimeType,pubkey,clientInfo);
+
+@override
+String toString() {
+  return 'CalloutData.connectApproval(pubkey: $pubkey, clientInfo: $clientInfo)';
+}
+
+
+}
+
+/// @nodoc
+abstract mixin class $ConnectApprovalDataCopyWith<$Res> implements $CalloutDataCopyWith<$Res> {
+  factory $ConnectApprovalDataCopyWith(ConnectApprovalData value, $Res Function(ConnectApprovalData) _then) = _$ConnectApprovalDataCopyWithImpl;
+@override @useResult
+$Res call({
+ String pubkey, ClientInfo clientInfo
+});
+
+
+
+
+}
+/// @nodoc
+class _$ConnectApprovalDataCopyWithImpl<$Res>
+    implements $ConnectApprovalDataCopyWith<$Res> {
+  _$ConnectApprovalDataCopyWithImpl(this._self, this._then);
+
+  final ConnectApprovalData _self;
+  final $Res Function(ConnectApprovalData) _then;
+
+/// Create a copy of CalloutData
+/// with the given fields replaced by the non-null parameter values.
+@override @pragma('vm:prefer-inline') $Res call({Object? pubkey = null,Object? clientInfo = null,}) {
+  return _then(ConnectApprovalData(
+pubkey: null == pubkey ? _self.pubkey : pubkey // ignore: cast_nullable_to_non_nullable
+as String,clientInfo: null == clientInfo ? _self.clientInfo : clientInfo // ignore: cast_nullable_to_non_nullable
+as ClientInfo,
+  ));
+}
+
+
+}
+
+/// @nodoc
+mixin _$CalloutEvent {
+
+ String get id;
+/// Create a copy of CalloutEvent
+/// with the given fields replaced by the non-null parameter values.
+@JsonKey(includeFromJson: false, includeToJson: false)
+@pragma('vm:prefer-inline')
+$CalloutEventCopyWith<CalloutEvent> get copyWith => _$CalloutEventCopyWithImpl<CalloutEvent>(this as CalloutEvent, _$identity);
+
+
+
+@override
+bool operator ==(Object other) {
+  return identical(this, other) || (other.runtimeType == runtimeType&&other is CalloutEvent&&(identical(other.id, id) || other.id == id));
+}
+
+
+@override
+int get hashCode => Object.hash(runtimeType,id);
+
+@override
+String toString() {
+  return 'CalloutEvent(id: $id)';
+}
+
+
+}
+
+/// @nodoc
+abstract mixin class $CalloutEventCopyWith<$Res>  {
+  factory $CalloutEventCopyWith(CalloutEvent value, $Res Function(CalloutEvent) _then) = _$CalloutEventCopyWithImpl;
+@useResult
+$Res call({
+ String id
+});
+
+
+
+
+}
+/// @nodoc
+class _$CalloutEventCopyWithImpl<$Res>
+    implements $CalloutEventCopyWith<$Res> {
+  _$CalloutEventCopyWithImpl(this._self, this._then);
+
+  final CalloutEvent _self;
+  final $Res Function(CalloutEvent) _then;
+
+/// Create a copy of CalloutEvent
+/// with the given fields replaced by the non-null parameter values.
+@pragma('vm:prefer-inline') @override $Res call({Object? id = null,}) {
+  return _then(_self.copyWith(
+id: null == id ? _self.id : id // ignore: cast_nullable_to_non_nullable
+as String,
+  ));
+}
+
+}
+
+
+/// Adds pattern-matching-related methods to [CalloutEvent].
+extension CalloutEventPatterns on CalloutEvent {
+/// A variant of `map` that fallback to returning `orElse`.
+///
+/// It is equivalent to doing:
+/// ```dart
+/// switch (sealedClass) {
+///   case final Subclass value:
+///     return ...;
+///   case _:
+///     return orElse();
+/// }
+/// ```
+
+@optionalTypeArgs TResult maybeMap<TResult extends Object?>({TResult Function( CalloutEventAdded value)?  added,TResult Function( CalloutEventCancelled value)?  cancelled,required TResult orElse(),}){
+final _that = this;
+switch (_that) {
+case CalloutEventAdded() when added != null:
+return added(_that);case CalloutEventCancelled() when cancelled != null:
+return cancelled(_that);case _:
+  return orElse();
+
+}
+}
+/// A `switch`-like method, using callbacks.
+///
+/// Callbacks receives the raw object, upcasted.
+/// It is equivalent to doing:
+/// ```dart
+/// switch (sealedClass) {
+///   case final Subclass value:
+///     return ...;
+///   case final Subclass2 value:
+///     return ...;
+/// }
+/// ```
+
+@optionalTypeArgs TResult map<TResult extends Object?>({required TResult Function( CalloutEventAdded value)  added,required TResult Function( CalloutEventCancelled value)  cancelled,}){
+final _that = this;
+switch (_that) {
+case CalloutEventAdded():
+return added(_that);case CalloutEventCancelled():
+return cancelled(_that);}
+}
+/// A variant of `map` that fallback to returning `null`.
+///
+/// It is equivalent to doing:
+/// ```dart
+/// switch (sealedClass) {
+///   case final Subclass value:
+///     return ...;
+///   case _:
+///     return null;
+/// }
+/// ```
+
+@optionalTypeArgs TResult? mapOrNull<TResult extends Object?>({TResult? Function( CalloutEventAdded value)?  added,TResult? Function( CalloutEventCancelled value)?  cancelled,}){
+final _that = this;
+switch (_that) {
+case CalloutEventAdded() when added != null:
+return added(_that);case CalloutEventCancelled() when cancelled != null:
+return cancelled(_that);case _:
+  return null;
+
+}
+}
+/// A variant of `when` that fallback to an `orElse` callback.
+///
+/// It is equivalent to doing:
+/// ```dart
+/// switch (sealedClass) {
+///   case Subclass(:final field):
+///     return ...;
+///   case _:
+///     return orElse();
+/// }
+/// ```
+
+@optionalTypeArgs TResult maybeWhen<TResult extends Object?>({TResult Function( String id,  CalloutData data)?  added,TResult Function( String id)?  cancelled,required TResult orElse(),}) {final _that = this;
+switch (_that) {
+case CalloutEventAdded() when added != null:
+return added(_that.id,_that.data);case CalloutEventCancelled() when cancelled != null:
+return cancelled(_that.id);case _:
+  return orElse();
+
+}
+}
+/// A `switch`-like method, using callbacks.
+///
+/// As opposed to `map`, this offers destructuring.
+/// It is equivalent to doing:
+/// ```dart
+/// switch (sealedClass) {
+///   case Subclass(:final field):
+///     return ...;
+///   case Subclass2(:final field2):
+///     return ...;
+/// }
+/// ```
+
+@optionalTypeArgs TResult when<TResult extends Object?>({required TResult Function( String id,  CalloutData data)  added,required TResult Function( String id)  cancelled,}) {final _that = this;
+switch (_that) {
+case CalloutEventAdded():
+return added(_that.id,_that.data);case CalloutEventCancelled():
+return cancelled(_that.id);}
+}
+/// A variant of `when` that fallback to returning `null`
+///
+/// It is equivalent to doing:
+/// ```dart
+/// switch (sealedClass) {
+///   case Subclass(:final field):
+///     return ...;
+///   case _:
+///     return null;
+/// }
+/// ```
+
+@optionalTypeArgs TResult? whenOrNull<TResult extends Object?>({TResult? Function( String id,  CalloutData data)?  added,TResult? Function( String id)?  cancelled,}) {final _that = this;
+switch (_that) {
+case CalloutEventAdded() when added != null:
+return added(_that.id,_that.data);case CalloutEventCancelled() when cancelled != null:
+return cancelled(_that.id);case _:
+  return null;
+
+}
+}
+
+}
+
+/// @nodoc
+
+
+class CalloutEventAdded implements CalloutEvent {
+  const CalloutEventAdded({required this.id, required this.data});
+  
+
+@override final  String id;
+ final  CalloutData data;
+
+/// Create a copy of CalloutEvent
+/// with the given fields replaced by the non-null parameter values.
+@override @JsonKey(includeFromJson: false, includeToJson: false)
+@pragma('vm:prefer-inline')
+$CalloutEventAddedCopyWith<CalloutEventAdded> get copyWith => _$CalloutEventAddedCopyWithImpl<CalloutEventAdded>(this, _$identity);
+
+
+
+@override
+bool operator ==(Object other) {
+  return identical(this, other) || (other.runtimeType == runtimeType&&other is CalloutEventAdded&&(identical(other.id, id) || other.id == id)&&(identical(other.data, data) || other.data == data));
+}
+
+
+@override
+int get hashCode => Object.hash(runtimeType,id,data);
+
+@override
+String toString() {
+  return 'CalloutEvent.added(id: $id, data: $data)';
+}
+
+
+}
+
+/// @nodoc
+abstract mixin class $CalloutEventAddedCopyWith<$Res> implements $CalloutEventCopyWith<$Res> {
+  factory $CalloutEventAddedCopyWith(CalloutEventAdded value, $Res Function(CalloutEventAdded) _then) = _$CalloutEventAddedCopyWithImpl;
+@override @useResult
+$Res call({
+ String id, CalloutData data
+});
+
+
+$CalloutDataCopyWith<$Res> get data;
+
+}
+/// @nodoc
+class _$CalloutEventAddedCopyWithImpl<$Res>
+    implements $CalloutEventAddedCopyWith<$Res> {
+  _$CalloutEventAddedCopyWithImpl(this._self, this._then);
+
+  final CalloutEventAdded _self;
+  final $Res Function(CalloutEventAdded) _then;
+
+/// Create a copy of CalloutEvent
+/// with the given fields replaced by the non-null parameter values.
+@override @pragma('vm:prefer-inline') $Res call({Object? id = null,Object? data = null,}) {
+  return _then(CalloutEventAdded(
+id: null == id ? _self.id : id // ignore: cast_nullable_to_non_nullable
+as String,data: null == data ? _self.data : data // ignore: cast_nullable_to_non_nullable
+as CalloutData,
+  ));
+}
+
+/// Create a copy of CalloutEvent
+/// with the given fields replaced by the non-null parameter values.
+@override
+@pragma('vm:prefer-inline')
+$CalloutDataCopyWith<$Res> get data {
+  
+  return $CalloutDataCopyWith<$Res>(_self.data, (value) {
+    return _then(_self.copyWith(data: value));
+  });
+}
+}
+
+/// @nodoc
+
+
+class CalloutEventCancelled implements CalloutEvent {
+  const CalloutEventCancelled({required this.id});
+  
+
+@override final  String id;
+
+/// Create a copy of CalloutEvent
+/// with the given fields replaced by the non-null parameter values.
+@override @JsonKey(includeFromJson: false, includeToJson: false)
+@pragma('vm:prefer-inline')
+$CalloutEventCancelledCopyWith<CalloutEventCancelled> get copyWith => _$CalloutEventCancelledCopyWithImpl<CalloutEventCancelled>(this, _$identity);
+
+
+
+@override
+bool operator ==(Object other) {
+  return identical(this, other) || (other.runtimeType == runtimeType&&other is CalloutEventCancelled&&(identical(other.id, id) || other.id == id));
+}
+
+
+@override
+int get hashCode => Object.hash(runtimeType,id);
+
+@override
+String toString() {
+  return 'CalloutEvent.cancelled(id: $id)';
+}
+
+
+}
+
+/// @nodoc
+abstract mixin class $CalloutEventCancelledCopyWith<$Res> implements $CalloutEventCopyWith<$Res> {
+  factory $CalloutEventCancelledCopyWith(CalloutEventCancelled value, $Res Function(CalloutEventCancelled) _then) = _$CalloutEventCancelledCopyWithImpl;
+@override @useResult
+$Res call({
+ String id
+});
+
+
+
+
+}
+/// @nodoc
+class _$CalloutEventCancelledCopyWithImpl<$Res>
+    implements $CalloutEventCancelledCopyWith<$Res> {
+  _$CalloutEventCancelledCopyWithImpl(this._self, this._then);
+
+  final CalloutEventCancelled _self;
+  final $Res Function(CalloutEventCancelled) _then;
+
+/// Create a copy of CalloutEvent
+/// with the given fields replaced by the non-null parameter values.
+@override @pragma('vm:prefer-inline') $Res call({Object? id = null,}) {
+  return _then(CalloutEventCancelled(
+id: null == id ? _self.id : id // ignore: cast_nullable_to_non_nullable
+as String,
+  ));
+}
+
+
+}
+
+// dart format on

useragent/lib/features/callouts/callout_manager.dart

@@ -0,0 +1,57 @@
+import 'package:arbiter/features/callouts/active_callout.dart';
+import 'package:arbiter/features/callouts/callout_event.dart';
+import 'package:arbiter/features/callouts/types/sdk_connect_approve.dart'
+    as connect_approve;
+import 'package:arbiter/proto/client.pb.dart';
+import 'package:riverpod_annotation/riverpod_annotation.dart';
+
+part 'callout_manager.g.dart';
+
+@Riverpod(keepAlive: true)
+class CalloutManager extends _$CalloutManager {
+  @override
+  Map<String, ActiveCallout> build() {
+    ref.listen(connect_approve.connectApproveEventsProvider, (_, next) {
+      next.whenData(_processEvent);
+    });
+    return {};
+  }
+
+  void _processEvent(CalloutEvent event) {
+    switch (event) {
+      case CalloutEventAdded(:final id, :final data):
+        state = {...state, id: _toActiveCallout(id, data)};
+      case CalloutEventCancelled(:final id):
+        state = {...state}..remove(id);
+    }
+  }
+
+  Future<void> sendDecision(String id, bool approved) async {
+    final callout = state[id];
+    if (callout == null) return;
+    switch (callout.data) {
+      case ConnectApprovalData(:final pubkey):
+        await connect_approve.sendDecision(ref, pubkey, approved);
+    }
+    dismiss(id);
+  }
+
+  void dismiss(String id) {
+    state = {...state}..remove(id);
+  }
+}
+
+ActiveCallout _toActiveCallout(String id, CalloutData data) => switch (data) {
+  ConnectApprovalData(:final clientInfo) => ActiveCallout(
+    id: id,
+    title: 'Connection Request',
+    description: _clientDisplayName(clientInfo) != null
+        ? '${_clientDisplayName(clientInfo)} is requesting a connection.'
+        : 'An SDK client is requesting a connection.',
+    addedAt: DateTime.now(),
+    data: data,
+  ),
+};
+
+String? _clientDisplayName(ClientInfo info) =>
+    info.hasName() && info.name.isNotEmpty ? info.name : null;

useragent/lib/features/callouts/callout_manager.g.dart

@@ -0,0 +1,67 @@
+// GENERATED CODE - DO NOT MODIFY BY HAND
+
+part of 'callout_manager.dart';
+
+// **************************************************************************
+// RiverpodGenerator
+// **************************************************************************
+
+// GENERATED CODE - DO NOT MODIFY BY HAND
+// ignore_for_file: type=lint, type=warning
+
+@ProviderFor(CalloutManager)
+final calloutManagerProvider = CalloutManagerProvider._();
+
+final class CalloutManagerProvider
+    extends $NotifierProvider<CalloutManager, Map<String, ActiveCallout>> {
+  CalloutManagerProvider._()
+    : super(
+        from: null,
+        argument: null,
+        retry: null,
+        name: r'calloutManagerProvider',
+        isAutoDispose: false,
+        dependencies: null,
+        $allTransitiveDependencies: null,
+      );
+
+  @override
+  String debugGetCreateSourceHash() => _$calloutManagerHash();
+
+  @$internal
+  @override
+  CalloutManager create() => CalloutManager();
+
+  /// {@macro riverpod.override_with_value}
+  Override overrideWithValue(Map<String, ActiveCallout> value) {
+    return $ProviderOverride(
+      origin: this,
+      providerOverride: $SyncValueProvider<Map<String, ActiveCallout>>(value),
+    );
+  }
+}
+
+String _$calloutManagerHash() => r'ff8c9a03a6bbbca822242eb497c503b18240a289';
+
+abstract class _$CalloutManager extends $Notifier<Map<String, ActiveCallout>> {
+  Map<String, ActiveCallout> build();
+  @$mustCallSuper
+  @override
+  void runBuild() {
+    final ref =
+        this.ref
+            as $Ref<Map<String, ActiveCallout>, Map<String, ActiveCallout>>;
+    final element =
+        ref.element
+            as $ClassProviderElement<
+              AnyNotifier<
+                Map<String, ActiveCallout>,
+                Map<String, ActiveCallout>
+              >,
+              Map<String, ActiveCallout>,
+              Object?,
+              Object?
+            >;
+    element.handleCreate(ref, build);
+  }
+}

useragent/lib/features/callouts/show_callout.dart

@@ -0,0 +1,99 @@
+import 'package:arbiter/features/callouts/callout_event.dart';
+import 'package:arbiter/features/callouts/callout_manager.dart';
+import 'package:arbiter/screens/callouts/sdk_connect.dart';
+import 'package:flutter/material.dart';
+import 'package:hooks_riverpod/hooks_riverpod.dart';
+
+Future<void> showCallout(BuildContext context, WidgetRef ref, String id) async {
+  final data = ref.read(calloutManagerProvider)[id]?.data;
+  if (data == null) return;
+
+  await showGeneralDialog(
+    context: context,
+    barrierDismissible: false,
+    barrierLabel: MaterialLocalizations.of(context).modalBarrierDismissLabel,
+    barrierColor: Colors.transparent,
+    transitionDuration: const Duration(milliseconds: 320),
+    pageBuilder: (_, animation, _) => _CalloutOverlay(
+      id: id,
+      data: data,
+      animation: animation,
+    ),
+  );
+}
+
+class _CalloutOverlay extends ConsumerWidget {
+  const _CalloutOverlay({
+    required this.id,
+    required this.data,
+    required this.animation,
+  });
+
+  final String id;
+  final CalloutData data;
+  final Animation<double> animation;
+
+  @override
+  Widget build(BuildContext context, WidgetRef ref) {
+    ref.listen(
+      calloutManagerProvider.select((map) => map.containsKey(id)),
+      (wasPresent, isPresent) {
+        if (wasPresent == true && !isPresent && context.mounted) {
+          Navigator.of(context).pop();
+        }
+      },
+    );
+
+    final content = switch (data) {
+      ConnectApprovalData(:final pubkey, :final clientInfo) => SdkConnectCallout(
+        pubkey: pubkey,
+        clientInfo: clientInfo,
+        onAccept: () => ref.read(calloutManagerProvider.notifier).sendDecision(id, true),
+        onDecline: () => ref.read(calloutManagerProvider.notifier).sendDecision(id, false),
+      ),
+    };
+
+    final barrierAnim = CurvedAnimation(
+      parent: animation,
+      curve: const Interval(0, 0.3125, curve: Curves.easeOut),
+    );
+    final popupAnim = CurvedAnimation(
+      parent: animation,
+      curve: const Interval(0.3125, 1, curve: Curves.easeOutCubic),
+    );
+
+    return Material(
+      type: MaterialType.transparency,
+      child: Stack(
+        children: [
+          Positioned.fill(
+            child: AnimatedBuilder(
+              animation: barrierAnim,
+              builder: (_, __) => ColoredBox(
+                color: Colors.black.withValues(alpha: 0.35 * barrierAnim.value),
+              ),
+            ),
+          ),
+          SafeArea(
+            child: Align(
+              alignment: Alignment.bottomCenter,
+              child: Padding(
+                padding: const EdgeInsets.all(16),
+                child: FadeTransition(
+                  opacity: popupAnim,
+                  child: SlideTransition(
+                    position: Tween<Offset>(
+                      begin: const Offset(0, 0.08),
+                      end: Offset.zero,
+                    ).animate(popupAnim),
+                    child: content,
+                  ),
+                ),
+              ),
+            ),
+          ),
+        ],
+      ),
+    );
+  }
+}

useragent/lib/features/callouts/show_callout_list.dart

@@ -0,0 +1,218 @@
+import 'package:arbiter/features/callouts/active_callout.dart';
+import 'package:arbiter/features/callouts/callout_manager.dart';
+import 'package:arbiter/features/callouts/show_callout.dart';
+import 'package:arbiter/theme/palette.dart';
+import 'package:flutter/material.dart';
+import 'package:hooks_riverpod/hooks_riverpod.dart';
+import 'package:sizer/sizer.dart';
+import 'package:timeago/timeago.dart' as timeago;
+
+Future<void> showCalloutList(BuildContext context, WidgetRef ref) async {
+  final selectedId = await showGeneralDialog<String>(
+    context: context,
+    barrierDismissible: true,
+    barrierLabel: MaterialLocalizations.of(context).modalBarrierDismissLabel,
+    barrierColor: Colors.transparent,
+    transitionDuration: const Duration(milliseconds: 280),
+    pageBuilder: (_, animation, __) => _CalloutListOverlay(animation: animation),
+  );
+
+  if (selectedId != null && context.mounted) {
+    await showCallout(context, ref, selectedId);
+  }
+}
+
+class _CalloutListOverlay extends ConsumerWidget {
+  const _CalloutListOverlay({required this.animation});
+
+  final Animation<double> animation;
+
+  @override
+  Widget build(BuildContext context, WidgetRef ref) {
+    final callouts = ref.watch(calloutManagerProvider);
+
+    final barrierAnim = CurvedAnimation(
+      parent: animation,
+      curve: const Interval(0, 0.3, curve: Curves.easeOut),
+    );
+    final panelAnim = CurvedAnimation(
+      parent: animation,
+      curve: const Interval(0.3, 1, curve: Curves.easeOutCubic),
+    );
+
+    return Material(
+      type: MaterialType.transparency,
+      child: Stack(
+        children: [
+          Positioned.fill(
+            child: GestureDetector(
+              behavior: HitTestBehavior.opaque,
+              onTap: () => Navigator.of(context).pop(),
+              child: AnimatedBuilder(
+                animation: barrierAnim,
+                builder: (_, __) => ColoredBox(
+                  color: Colors.black.withValues(alpha: 0.35 * barrierAnim.value),
+                ),
+              ),
+            ),
+          ),
+          SafeArea(
+            child: Align(
+              alignment: Alignment.bottomCenter,
+              child: Padding(
+                padding: EdgeInsets.all(1.6.h),
+                child: FadeTransition(
+                  opacity: panelAnim,
+                  child: SlideTransition(
+                    position: Tween<Offset>(
+                      begin: const Offset(0, 0.08),
+                      end: Offset.zero,
+                    ).animate(panelAnim),
+                    child: GestureDetector(
+                      onTap: () {},
+                      child: _CalloutListPanel(callouts: callouts),
+                    ),
+                  ),
+                ),
+              ),
+            ),
+          ),
+        ],
+      ),
+    );
+  }
+}
+
+class _CalloutListPanel extends StatelessWidget {
+  const _CalloutListPanel({required this.callouts});
+
+  final Map<String, ActiveCallout> callouts;
+
+  @override
+  Widget build(BuildContext context) {
+    final theme = Theme.of(context);
+
+    return Container(
+      width: double.infinity,
+      constraints: BoxConstraints(maxHeight: 48.h),
+      decoration: BoxDecoration(
+        color: Palette.cream,
+        borderRadius: BorderRadius.circular(24),
+        border: Border.all(color: Palette.line),
+      ),
+      child: Column(
+        mainAxisSize: MainAxisSize.min,
+        crossAxisAlignment: CrossAxisAlignment.start,
+        children: [
+          Padding(
+            padding: EdgeInsets.fromLTRB(2.h, 2.h, 2.h, 1.2.h),
+            child: Text(
+              'Notifications',
+              style: theme.textTheme.titleMedium?.copyWith(
+                color: Palette.ink,
+                fontWeight: FontWeight.w800,
+              ),
+            ),
+          ),
+          if (callouts.isEmpty)
+            Padding(
+              padding: EdgeInsets.fromLTRB(2.h, 0, 2.h, 2.h),
+              child: Text(
+                'No pending notifications.',
+                style: theme.textTheme.bodyMedium?.copyWith(
+                  color: Palette.ink.withValues(alpha: 0.50),
+                ),
+              ),
+            )
+          else
+            Flexible(
+              child: SingleChildScrollView(
+                padding: EdgeInsets.fromLTRB(1.2.h, 0, 1.2.h, 1.2.h),
+                child: Column(
+                  spacing: 0.5.h,
+                  children: [
+                    for (final entry in callouts.values)
+                      _CalloutListEntry(
+                        callout: entry,
+                        onTap: () => Navigator.of(context).pop(entry.id),
+                      ),
+                  ],
+                ),
+              ),
+            ),
+        ],
+      ),
+    );
+  }
+}
+
+class _CalloutListEntry extends StatelessWidget {
+  const _CalloutListEntry({required this.callout, required this.onTap});
+
+  final ActiveCallout callout;
+  final VoidCallback onTap;
+
+  @override
+  Widget build(BuildContext context) {
+    final theme = Theme.of(context);
+
+    return InkWell(
+      borderRadius: BorderRadius.circular(16),
+      onTap: onTap,
+      child: Container(
+        padding: EdgeInsets.symmetric(horizontal: 1.2.h, vertical: 1.2.h),
+        decoration: BoxDecoration(
+          borderRadius: BorderRadius.circular(16),
+          border: Border.all(color: Palette.line),
+        ),
+        child: Row(
+          crossAxisAlignment: CrossAxisAlignment.start,
+          spacing: 1.2.h,
+          children: [
+            if (callout.iconUrl != null)
+              CircleAvatar(
+                radius: 2.2.h,
+                backgroundColor: Palette.line,
+                backgroundImage: NetworkImage(callout.iconUrl!),
+              ),
+            Expanded(
+              child: Column(
+                crossAxisAlignment: CrossAxisAlignment.start,
+                spacing: 0.3.h,
+                children: [
+                  Row(
+                    crossAxisAlignment: CrossAxisAlignment.start,
+                    children: [
+                      Expanded(
+                        child: Text(
+                          callout.title,
+                          style: theme.textTheme.bodyMedium?.copyWith(
+                            color: Palette.ink,
+                            fontWeight: FontWeight.w700,
+                          ),
+                        ),
+                      ),
+                      Text(
+                        timeago.format(callout.addedAt),
+                        style: theme.textTheme.bodySmall?.copyWith(
+                          color: Palette.ink.withValues(alpha: 0.45),
+                        ),
+                      ),
+                    ],
+                  ),
+                  Text(
+                    callout.description,
+                    style: theme.textTheme.bodySmall?.copyWith(
+                      color: Palette.ink.withValues(alpha: 0.65),
+                      height: 1.4,
+                    ),
+                  ),
+                ],
+              ),
+            ),
+          ],
+        ),
+      ),
+    );
+  }
+}

useragent/lib/features/callouts/types/sdk_connect_approve.dart

@@ -0,0 +1,51 @@
+import 'dart:convert';
+
+import 'package:arbiter/features/callouts/callout_event.dart';
+import 'package:arbiter/proto/user_agent.pb.dart';
+import 'package:arbiter/providers/connection/connection_manager.dart';
+import 'package:riverpod_annotation/riverpod_annotation.dart';
+
+part 'sdk_connect_approve.g.dart';
+
+@riverpod
+Stream<CalloutEvent> connectApproveEvents(Ref ref) async* {
+  final connection = await ref.watch(connectionManagerProvider.future);
+  if (connection == null) return;
+
+  await for (final message in connection.outOfBandMessages) {
+    switch (message.whichPayload()) {
+      case UserAgentResponse_Payload.sdkClientConnectionRequest:
+        final body = message.sdkClientConnectionRequest;
+        final id = base64Encode(body.pubkey);
+        yield CalloutEvent.added(
+          id: 'connect_approve:$id',
+          data: CalloutData.connectApproval(
+            pubkey: id,
+            clientInfo: body.info,
+          ),
+        );
+
+      case UserAgentResponse_Payload.sdkClientConnectionCancel:
+        final id = base64Encode(message.sdkClientConnectionCancel.pubkey);
+        yield CalloutEvent.cancelled(id: 'connect_approve:$id');
+
+      default:
+        break;
+    }
+  }
+}
+
+Future<void> sendDecision(Ref ref, String pubkey, bool approved) async {
+  final connection = await ref.watch(connectionManagerProvider.future);
+  if (connection == null) return;
+
+  final bytes = base64Decode(pubkey);
+
+  final req = UserAgentRequest(sdkClientConnectionResponse: SdkClientConnectionResponse(
+    approved: approved,
+    pubkey: bytes
+  ));
+
+  await connection.tell(req);
+
+}

useragent/lib/features/callouts/types/sdk_connect_approve.g.dart

@@ -0,0 +1,50 @@
+// GENERATED CODE - DO NOT MODIFY BY HAND
+
+part of 'sdk_connect_approve.dart';
+
+// **************************************************************************
+// RiverpodGenerator
+// **************************************************************************
+
+// GENERATED CODE - DO NOT MODIFY BY HAND
+// ignore_for_file: type=lint, type=warning
+
+@ProviderFor(connectApproveEvents)
+final connectApproveEventsProvider = ConnectApproveEventsProvider._();
+
+final class ConnectApproveEventsProvider
+    extends
+        $FunctionalProvider<
+          AsyncValue<CalloutEvent>,
+          CalloutEvent,
+          Stream<CalloutEvent>
+        >
+    with $FutureModifier<CalloutEvent>, $StreamProvider<CalloutEvent> {
+  ConnectApproveEventsProvider._()
+    : super(
+        from: null,
+        argument: null,
+        retry: null,
+        name: r'connectApproveEventsProvider',
+        isAutoDispose: true,
+        dependencies: null,
+        $allTransitiveDependencies: null,
+      );
+
+  @override
+  String debugGetCreateSourceHash() => _$connectApproveEventsHash();
+
+  @$internal
+  @override
+  $StreamProviderElement<CalloutEvent> $createElement(
+    $ProviderPointer pointer,
+  ) => $StreamProviderElement(pointer);
+
+  @override
+  Stream<CalloutEvent> create(Ref ref) {
+    return connectApproveEvents(ref);
+  }
+}
+
+String _$connectApproveEventsHash() =>
+    r'6a0998288afc0836a7c1701a983f64c33d318fd6';

useragent/lib/features/connection/auth.dart

@@ -66,7 +66,7 @@ Future<Connection> connectAndAuthorize(
         KeyAlgorithm.ed25519 => KeyType.KEY_TYPE_ED25519,
       },
     );
-    final response = await connection.request(
+    final response = await connection.ask(
       UserAgentRequest(authChallengeRequest: req),
     );
     talker.info(
@@ -94,7 +94,7 @@ Future<Connection> connectAndAuthorize(
     );
 
     final signature = await key.sign(challenge);
-    final solutionResponse = await connection.request(
+    final solutionResponse = await connection.ask(
       UserAgentRequest(authChallengeSolution: AuthChallengeSolution(signature: signature)),
     );
 

useragent/lib/features/connection/connection.dart

@@ -29,7 +29,7 @@ class Connection {
 
   Stream<UserAgentResponse> get outOfBandMessages => _outOfBandMessages.stream;
 
-  Future<UserAgentResponse> request(UserAgentRequest message) async {
+  Future<UserAgentResponse> ask(UserAgentRequest message) async {
     _ensureOpen();
 
     final requestId = _nextRequestId++;
@@ -49,7 +49,23 @@ class Connection {
     return completer.future;
   }
 
+  Future<void> tell(UserAgentRequest message) async {
+    _ensureOpen();
+
+    final requestId = _nextRequestId++;
+    message.id = requestId;
+
+    talker.debug('Sending message: ${message.toDebugString()}');
+
+    try {
+      _tx.add(message);
+    } catch (error, stackTrace) {
+      talker.error('Failed to send message: $error', error, stackTrace);
+    }
+  }
+
   Future<void> close() async {
+    talker.debug('Closing connection...');
     final rxSubscription = _rxSubscription;
     if (rxSubscription == null) {
       return;
@@ -86,6 +102,7 @@ class Connection {
   }
 
   void _handleDone() {
+    talker.debug('Connection closed by server.');
     if (_rxSubscription == null) {
       return;
     }

useragent/lib/features/connection/evm.dart

@@ -4,7 +4,7 @@ import 'package:arbiter/proto/user_agent.pb.dart';
 import 'package:protobuf/well_known_types/google/protobuf/empty.pb.dart';
 
 Future<List<WalletEntry>> listEvmWallets(Connection connection) async {
-  final response = await connection.request(
+  final response = await connection.ask(
     UserAgentRequest(evmWalletList: Empty()),
   );
   if (!response.hasEvmWalletList()) {
@@ -25,7 +25,7 @@ Future<List<WalletEntry>> listEvmWallets(Connection connection) async {
 }
 
 Future<void> createEvmWallet(Connection connection) async {
-  final response = await connection.request(
+  final response = await connection.ask(
     UserAgentRequest(evmWalletCreate: Empty()),
   );
   if (!response.hasEvmWalletCreate()) {

useragent/lib/features/connection/evm/grants.dart

@@ -4,16 +4,10 @@ import 'package:arbiter/proto/user_agent.pb.dart';
 import 'package:fixnum/fixnum.dart';
 import 'package:protobuf/well_known_types/google/protobuf/timestamp.pb.dart';
 
-Future<List<GrantEntry>> listEvmGrants(
-  Connection connection, {
-  int? walletId,
-}) async {
+Future<List<GrantEntry>> listEvmGrants(Connection connection) async {
   final request = EvmGrantListRequest();
-  if (walletId != null) {
-    request.walletId = walletId;
-  }
 
-  final response = await connection.request(
+  final response = await connection.ask(
     UserAgentRequest(evmGrantList: request),
   );
   if (!response.hasEvmGrantList()) {
@@ -35,52 +29,31 @@ Future<List<GrantEntry>> listEvmGrants(
 
 Future<int> createEvmGrant(
   Connection connection, {
-  required int clientId,
-  required int walletId,
-  required Int64 chainId,
-  DateTime? validFrom,
-  DateTime? validUntil,
-  List<int>? maxGasFeePerGas,
-  List<int>? maxPriorityFeePerGas,
-  TransactionRateLimit? rateLimit,
+  required SharedSettings sharedSettings,
   required SpecificGrant specific,
 }) async {
-  final response = await connection.request(
-    UserAgentRequest(
-      evmGrantCreate: EvmGrantCreateRequest(
-        clientId: clientId,
-        shared: SharedSettings(
-          walletId: walletId,
-          chainId: chainId,
-          validFrom: validFrom == null ? null : _toTimestamp(validFrom),
-          validUntil: validUntil == null ? null : _toTimestamp(validUntil),
-          maxGasFeePerGas: maxGasFeePerGas,
-          maxPriorityFeePerGas: maxPriorityFeePerGas,
-          rateLimit: rateLimit,
-        ),
-        specific: specific,
-      ),
+  final request = UserAgentRequest(
+    evmGrantCreate: EvmGrantCreateRequest(
+      shared: sharedSettings,
+      specific: specific,
     ),
   );
-  if (!response.hasEvmGrantCreate()) {
+
+  final resp = await connection.ask(request);
+
+  if (!resp.hasEvmGrantCreate()) {
     throw Exception(
-      'Expected EVM grant create response, got ${response.whichPayload()}',
+      'Expected EVM grant create response, got ${resp.whichPayload()}',
     );
   }
 
-  final result = response.evmGrantCreate;
-  switch (result.whichResult()) {
-    case EvmGrantCreateResponse_Result.grantId:
-      return result.grantId;
-    case EvmGrantCreateResponse_Result.error:
-      throw Exception(_describeGrantError(result.error));
-    case EvmGrantCreateResponse_Result.notSet:
-      throw Exception('Grant creation returned no result.');
-  }
+  final result = resp.evmGrantCreate;
+
+  return result.grantId;
 }
 
 Future<void> deleteEvmGrant(Connection connection, int grantId) async {
-  final response = await connection.request(
+  final response = await connection.ask(
     UserAgentRequest(evmGrantDelete: EvmGrantDeleteRequest(grantId: grantId)),
   );
   if (!response.hasEvmGrantDelete()) {

useragent/lib/features/connection/evm/wallet_access.dart

@@ -0,0 +1,72 @@
+import 'package:arbiter/features/connection/connection.dart';
+import 'package:arbiter/proto/user_agent.pb.dart';
+import 'package:protobuf/well_known_types/google/protobuf/empty.pb.dart';
+
+Future<Set<int>> readClientWalletAccess(
+  Connection connection, {
+  required int clientId,
+}) async {
+  final response = await connection.ask(
+    UserAgentRequest(listWalletAccess: Empty()),
+  );
+  if (!response.hasListWalletAccessResponse()) {
+    throw Exception(
+      'Expected list wallet access response, got ${response.whichPayload()}',
+    );
+  }
+  return {
+    for (final entry in response.listWalletAccessResponse.accesses)
+      if (entry.access.sdkClientId == clientId) entry.access.walletId,
+  };
+}
+
+Future<List<SdkClientWalletAccess>> listAllWalletAccesses(
+  Connection connection,
+) async {
+  final response = await connection.ask(
+    UserAgentRequest(listWalletAccess: Empty()),
+  );
+  if (!response.hasListWalletAccessResponse()) {
+    throw Exception(
+      'Expected list wallet access response, got ${response.whichPayload()}',
+    );
+  }
+  return response.listWalletAccessResponse.accesses.toList(growable: false);
+}
+
+Future<void> writeClientWalletAccess(
+  Connection connection, {
+  required int clientId,
+  required Set<int> walletIds,
+}) async {
+  final current = await readClientWalletAccess(connection, clientId: clientId);
+
+  final toGrant = walletIds.difference(current);
+  final toRevoke = current.difference(walletIds);
+
+  if (toGrant.isNotEmpty) {
+    await connection.tell(
+      UserAgentRequest(
+        grantWalletAccess: SdkClientGrantWalletAccess(
+          accesses: [
+            for (final walletId in toGrant)
+              WalletAccess(sdkClientId: clientId, walletId: walletId),
+          ],
+        ),
+      ),
+    );
+  }
+
+  if (toRevoke.isNotEmpty) {
+    await connection.tell(
+      UserAgentRequest(
+        revokeWalletAccess: SdkClientRevokeWalletAccess(
+          accesses: [
+            for (final walletId in toRevoke)
+              walletId
+          ],
+        ),
+      ),
+    );
+  }
+}

useragent/lib/features/connection/vault.dart

@@ -10,7 +10,7 @@ Future<BootstrapResult> bootstrapVault(
 ) async {
   final encryptedKey = await _encryptVaultKeyMaterial(connection, password);
 
-  final response = await connection.request(
+  final response = await connection.ask(
     UserAgentRequest(
       bootstrapEncryptedKey: BootstrapEncryptedKey(
         nonce: encryptedKey.nonce,
@@ -31,7 +31,7 @@ Future<BootstrapResult> bootstrapVault(
 Future<UnsealResult> unsealVault(Connection connection, String password) async {
   final encryptedKey = await _encryptVaultKeyMaterial(connection, password);
 
-  final response = await connection.request(
+  final response = await connection.ask(
     UserAgentRequest(
       unsealEncryptedKey: UnsealEncryptedKey(
         nonce: encryptedKey.nonce,
@@ -56,7 +56,7 @@ Future<_EncryptedVaultKey> _encryptVaultKeyMaterial(
   final clientKeyPair = await keyExchange.newKeyPair();
   final clientPublicKey = await clientKeyPair.extractPublicKey();
 
-  final handshakeResponse = await connection.request(
+  final handshakeResponse = await connection.ask(
     UserAgentRequest(unsealStart: UnsealStart(clientPubkey: clientPublicKey.bytes)),
   );
   if (!handshakeResponse.hasUnsealStartResponse()) {

useragent/lib/proto/client.pb.dart

@@ -22,12 +22,91 @@ export 'package:protobuf/protobuf.dart' show GeneratedMessageGenericExtensions;
 
 export 'client.pbenum.dart';
 
+class ClientInfo extends $pb.GeneratedMessage {
+  factory ClientInfo({
+    $core.String? name,
+    $core.String? description,
+    $core.String? version,
+  }) {
+    final result = create();
+    if (name != null) result.name = name;
+    if (description != null) result.description = description;
+    if (version != null) result.version = version;
+    return result;
+  }
+
+  ClientInfo._();
+
+  factory ClientInfo.fromBuffer($core.List<$core.int> data,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromBuffer(data, registry);
+  factory ClientInfo.fromJson($core.String json,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromJson(json, registry);
+
+  static final $pb.BuilderInfo _i = $pb.BuilderInfo(
+      _omitMessageNames ? '' : 'ClientInfo',
+      package: const $pb.PackageName(_omitMessageNames ? '' : 'arbiter.client'),
+      createEmptyInstance: create)
+    ..aOS(1, _omitFieldNames ? '' : 'name')
+    ..aOS(2, _omitFieldNames ? '' : 'description')
+    ..aOS(3, _omitFieldNames ? '' : 'version')
+    ..hasRequiredFields = false;
+
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  ClientInfo clone() => deepCopy();
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  ClientInfo copyWith(void Function(ClientInfo) updates) =>
+      super.copyWith((message) => updates(message as ClientInfo)) as ClientInfo;
+
+  @$core.override
+  $pb.BuilderInfo get info_ => _i;
+
+  @$core.pragma('dart2js:noInline')
+  static ClientInfo create() => ClientInfo._();
+  @$core.override
+  ClientInfo createEmptyInstance() => create();
+  @$core.pragma('dart2js:noInline')
+  static ClientInfo getDefault() => _defaultInstance ??=
+      $pb.GeneratedMessage.$_defaultFor<ClientInfo>(create);
+  static ClientInfo? _defaultInstance;
+
+  @$pb.TagNumber(1)
+  $core.String get name => $_getSZ(0);
+  @$pb.TagNumber(1)
+  set name($core.String value) => $_setString(0, value);
+  @$pb.TagNumber(1)
+  $core.bool hasName() => $_has(0);
+  @$pb.TagNumber(1)
+  void clearName() => $_clearField(1);
+
+  @$pb.TagNumber(2)
+  $core.String get description => $_getSZ(1);
+  @$pb.TagNumber(2)
+  set description($core.String value) => $_setString(1, value);
+  @$pb.TagNumber(2)
+  $core.bool hasDescription() => $_has(1);
+  @$pb.TagNumber(2)
+  void clearDescription() => $_clearField(2);
+
+  @$pb.TagNumber(3)
+  $core.String get version => $_getSZ(2);
+  @$pb.TagNumber(3)
+  set version($core.String value) => $_setString(2, value);
+  @$pb.TagNumber(3)
+  $core.bool hasVersion() => $_has(2);
+  @$pb.TagNumber(3)
+  void clearVersion() => $_clearField(3);
+}
+
 class AuthChallengeRequest extends $pb.GeneratedMessage {
   factory AuthChallengeRequest({
     $core.List<$core.int>? pubkey,
+    ClientInfo? clientInfo,
   }) {
     final result = create();
     if (pubkey != null) result.pubkey = pubkey;
+    if (clientInfo != null) result.clientInfo = clientInfo;
     return result;
   }
 
@@ -46,6 +125,8 @@ class AuthChallengeRequest extends $pb.GeneratedMessage {
       createEmptyInstance: create)
     ..a<$core.List<$core.int>>(
         1, _omitFieldNames ? '' : 'pubkey', $pb.PbFieldType.OY)
+    ..aOM<ClientInfo>(2, _omitFieldNames ? '' : 'clientInfo',
+        subBuilder: ClientInfo.create)
     ..hasRequiredFields = false;
 
   @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
@@ -75,6 +156,17 @@ class AuthChallengeRequest extends $pb.GeneratedMessage {
   $core.bool hasPubkey() => $_has(0);
   @$pb.TagNumber(1)
   void clearPubkey() => $_clearField(1);
+
+  @$pb.TagNumber(2)
+  ClientInfo get clientInfo => $_getN(1);
+  @$pb.TagNumber(2)
+  set clientInfo(ClientInfo value) => $_setField(2, value);
+  @$pb.TagNumber(2)
+  $core.bool hasClientInfo() => $_has(1);
+  @$pb.TagNumber(2)
+  void clearClientInfo() => $_clearField(2);
+  @$pb.TagNumber(2)
+  ClientInfo ensureClientInfo() => $_ensure(1);
 }
 
 class AuthChallenge extends $pb.GeneratedMessage {

useragent/lib/proto/client.pbjson.dart

@@ -55,18 +55,62 @@ final $typed_data.Uint8List vaultStateDescriptor = $convert.base64Decode(
     'VfVU5CT09UU1RSQVBQRUQQARIWChJWQVVMVF9TVEFURV9TRUFMRUQQAhIYChRWQVVMVF9TVEFU'
     'RV9VTlNFQUxFRBADEhUKEVZBVUxUX1NUQVRFX0VSUk9SEAQ=');
 
+@$core.Deprecated('Use clientInfoDescriptor instead')
+const ClientInfo$json = {
+  '1': 'ClientInfo',
+  '2': [
+    {'1': 'name', '3': 1, '4': 1, '5': 9, '10': 'name'},
+    {
+      '1': 'description',
+      '3': 2,
+      '4': 1,
+      '5': 9,
+      '9': 0,
+      '10': 'description',
+      '17': true
+    },
+    {
+      '1': 'version',
+      '3': 3,
+      '4': 1,
+      '5': 9,
+      '9': 1,
+      '10': 'version',
+      '17': true
+    },
+  ],
+  '8': [
+    {'1': '_description'},
+    {'1': '_version'},
+  ],
+};
+
+/// Descriptor for `ClientInfo`. Decode as a `google.protobuf.DescriptorProto`.
+final $typed_data.Uint8List clientInfoDescriptor = $convert.base64Decode(
+    'CgpDbGllbnRJbmZvEhIKBG5hbWUYASABKAlSBG5hbWUSJQoLZGVzY3JpcHRpb24YAiABKAlIAF'
+    'ILZGVzY3JpcHRpb26IAQESHQoHdmVyc2lvbhgDIAEoCUgBUgd2ZXJzaW9uiAEBQg4KDF9kZXNj'
+    'cmlwdGlvbkIKCghfdmVyc2lvbg==');
+
 @$core.Deprecated('Use authChallengeRequestDescriptor instead')
 const AuthChallengeRequest$json = {
   '1': 'AuthChallengeRequest',
   '2': [
     {'1': 'pubkey', '3': 1, '4': 1, '5': 12, '10': 'pubkey'},
+    {
+      '1': 'client_info',
+      '3': 2,
+      '4': 1,
+      '5': 11,
+      '6': '.arbiter.client.ClientInfo',
+      '10': 'clientInfo'
+    },
   ],
 };
 
 /// Descriptor for `AuthChallengeRequest`. Decode as a `google.protobuf.DescriptorProto`.
-final $typed_data.Uint8List authChallengeRequestDescriptor =
-    $convert.base64Decode(
-        'ChRBdXRoQ2hhbGxlbmdlUmVxdWVzdBIWCgZwdWJrZXkYASABKAxSBnB1YmtleQ==');
+final $typed_data.Uint8List authChallengeRequestDescriptor = $convert.base64Decode(
+    'ChRBdXRoQ2hhbGxlbmdlUmVxdWVzdBIWCgZwdWJrZXkYASABKAxSBnB1YmtleRI7CgtjbGllbn'
+    'RfaW5mbxgCIAEoCzIaLmFyYml0ZXIuY2xpZW50LkNsaWVudEluZm9SCmNsaWVudEluZm8=');
 
 @$core.Deprecated('Use authChallengeDescriptor instead')
 const AuthChallenge$json = {

useragent/lib/proto/evm.pb.dart

@@ -26,9 +26,11 @@ export 'evm.pbenum.dart';
 
 class WalletEntry extends $pb.GeneratedMessage {
   factory WalletEntry({
+    $core.int? id,
     $core.List<$core.int>? address,
   }) {
     final result = create();
+    if (id != null) result.id = id;
     if (address != null) result.address = address;
     return result;
   }
@@ -46,8 +48,9 @@ class WalletEntry extends $pb.GeneratedMessage {
       _omitMessageNames ? '' : 'WalletEntry',
       package: const $pb.PackageName(_omitMessageNames ? '' : 'arbiter.evm'),
       createEmptyInstance: create)
+    ..aI(1, _omitFieldNames ? '' : 'id')
     ..a<$core.List<$core.int>>(
-        1, _omitFieldNames ? '' : 'address', $pb.PbFieldType.OY)
+        2, _omitFieldNames ? '' : 'address', $pb.PbFieldType.OY)
     ..hasRequiredFields = false;
 
   @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
@@ -70,13 +73,22 @@ class WalletEntry extends $pb.GeneratedMessage {
   static WalletEntry? _defaultInstance;
 
   @$pb.TagNumber(1)
-  $core.List<$core.int> get address => $_getN(0);
+  $core.int get id => $_getIZ(0);
   @$pb.TagNumber(1)
-  set address($core.List<$core.int> value) => $_setBytes(0, value);
+  set id($core.int value) => $_setSignedInt32(0, value);
   @$pb.TagNumber(1)
-  $core.bool hasAddress() => $_has(0);
+  $core.bool hasId() => $_has(0);
   @$pb.TagNumber(1)
-  void clearAddress() => $_clearField(1);
+  void clearId() => $_clearField(1);
+
+  @$pb.TagNumber(2)
+  $core.List<$core.int> get address => $_getN(1);
+  @$pb.TagNumber(2)
+  set address($core.List<$core.int> value) => $_setBytes(1, value);
+  @$pb.TagNumber(2)
+  $core.bool hasAddress() => $_has(1);
+  @$pb.TagNumber(2)
+  void clearAddress() => $_clearField(2);
 }
 
 class WalletList extends $pb.GeneratedMessage {
@@ -436,7 +448,7 @@ class VolumeRateLimit extends $pb.GeneratedMessage {
 
 class SharedSettings extends $pb.GeneratedMessage {
   factory SharedSettings({
-    $core.int? walletId,
+    $core.int? walletAccessId,
     $fixnum.Int64? chainId,
     $0.Timestamp? validFrom,
     $0.Timestamp? validUntil,
@@ -445,7 +457,7 @@ class SharedSettings extends $pb.GeneratedMessage {
     TransactionRateLimit? rateLimit,
   }) {
     final result = create();
-    if (walletId != null) result.walletId = walletId;
+    if (walletAccessId != null) result.walletAccessId = walletAccessId;
     if (chainId != null) result.chainId = chainId;
     if (validFrom != null) result.validFrom = validFrom;
     if (validUntil != null) result.validUntil = validUntil;
@@ -469,7 +481,7 @@ class SharedSettings extends $pb.GeneratedMessage {
       _omitMessageNames ? '' : 'SharedSettings',
       package: const $pb.PackageName(_omitMessageNames ? '' : 'arbiter.evm'),
       createEmptyInstance: create)
-    ..aI(1, _omitFieldNames ? '' : 'walletId')
+    ..aI(1, _omitFieldNames ? '' : 'walletAccessId')
     ..a<$fixnum.Int64>(2, _omitFieldNames ? '' : 'chainId', $pb.PbFieldType.OU6,
         defaultOrMaker: $fixnum.Int64.ZERO)
     ..aOM<$0.Timestamp>(3, _omitFieldNames ? '' : 'validFrom',
@@ -504,13 +516,13 @@ class SharedSettings extends $pb.GeneratedMessage {
   static SharedSettings? _defaultInstance;
 
   @$pb.TagNumber(1)
-  $core.int get walletId => $_getIZ(0);
+  $core.int get walletAccessId => $_getIZ(0);
   @$pb.TagNumber(1)
-  set walletId($core.int value) => $_setSignedInt32(0, value);
+  set walletAccessId($core.int value) => $_setSignedInt32(0, value);
   @$pb.TagNumber(1)
-  $core.bool hasWalletId() => $_has(0);
+  $core.bool hasWalletAccessId() => $_has(0);
   @$pb.TagNumber(1)
-  void clearWalletId() => $_clearField(1);
+  void clearWalletAccessId() => $_clearField(1);
 
   @$pb.TagNumber(2)
   $fixnum.Int64 get chainId => $_getI64(1);
@@ -1625,12 +1637,10 @@ class TransactionEvalError extends $pb.GeneratedMessage {
 /// --- UserAgent grant management ---
 class EvmGrantCreateRequest extends $pb.GeneratedMessage {
   factory EvmGrantCreateRequest({
-    $core.int? clientId,
     SharedSettings? shared,
     SpecificGrant? specific,
   }) {
     final result = create();
-    if (clientId != null) result.clientId = clientId;
     if (shared != null) result.shared = shared;
     if (specific != null) result.specific = specific;
     return result;
@@ -1649,10 +1659,9 @@ class EvmGrantCreateRequest extends $pb.GeneratedMessage {
       _omitMessageNames ? '' : 'EvmGrantCreateRequest',
       package: const $pb.PackageName(_omitMessageNames ? '' : 'arbiter.evm'),
       createEmptyInstance: create)
-    ..aI(1, _omitFieldNames ? '' : 'clientId')
-    ..aOM<SharedSettings>(2, _omitFieldNames ? '' : 'shared',
+    ..aOM<SharedSettings>(1, _omitFieldNames ? '' : 'shared',
         subBuilder: SharedSettings.create)
-    ..aOM<SpecificGrant>(3, _omitFieldNames ? '' : 'specific',
+    ..aOM<SpecificGrant>(2, _omitFieldNames ? '' : 'specific',
         subBuilder: SpecificGrant.create)
     ..hasRequiredFields = false;
 
@@ -1677,35 +1686,26 @@ class EvmGrantCreateRequest extends $pb.GeneratedMessage {
   static EvmGrantCreateRequest? _defaultInstance;
 
   @$pb.TagNumber(1)
-  $core.int get clientId => $_getIZ(0);
+  SharedSettings get shared => $_getN(0);
   @$pb.TagNumber(1)
-  set clientId($core.int value) => $_setSignedInt32(0, value);
+  set shared(SharedSettings value) => $_setField(1, value);
   @$pb.TagNumber(1)
-  $core.bool hasClientId() => $_has(0);
+  $core.bool hasShared() => $_has(0);
   @$pb.TagNumber(1)
-  void clearClientId() => $_clearField(1);
+  void clearShared() => $_clearField(1);
+  @$pb.TagNumber(1)
+  SharedSettings ensureShared() => $_ensure(0);
 
   @$pb.TagNumber(2)
-  SharedSettings get shared => $_getN(1);
+  SpecificGrant get specific => $_getN(1);
   @$pb.TagNumber(2)
-  set shared(SharedSettings value) => $_setField(2, value);
+  set specific(SpecificGrant value) => $_setField(2, value);
   @$pb.TagNumber(2)
-  $core.bool hasShared() => $_has(1);
+  $core.bool hasSpecific() => $_has(1);
   @$pb.TagNumber(2)
-  void clearShared() => $_clearField(2);
+  void clearSpecific() => $_clearField(2);
   @$pb.TagNumber(2)
-  SharedSettings ensureShared() => $_ensure(1);
-
-  @$pb.TagNumber(3)
-  SpecificGrant get specific => $_getN(2);
-  @$pb.TagNumber(3)
-  set specific(SpecificGrant value) => $_setField(3, value);
-  @$pb.TagNumber(3)
-  $core.bool hasSpecific() => $_has(2);
-  @$pb.TagNumber(3)
-  void clearSpecific() => $_clearField(3);
-  @$pb.TagNumber(3)
-  SpecificGrant ensureSpecific() => $_ensure(2);
+  SpecificGrant ensureSpecific() => $_ensure(1);
 }
 
 enum EvmGrantCreateResponse_Result { grantId, error, notSet }
@@ -1939,13 +1939,13 @@ class EvmGrantDeleteResponse extends $pb.GeneratedMessage {
 class GrantEntry extends $pb.GeneratedMessage {
   factory GrantEntry({
     $core.int? id,
-    $core.int? clientId,
+    $core.int? walletAccessId,
     SharedSettings? shared,
     SpecificGrant? specific,
   }) {
     final result = create();
     if (id != null) result.id = id;
-    if (clientId != null) result.clientId = clientId;
+    if (walletAccessId != null) result.walletAccessId = walletAccessId;
     if (shared != null) result.shared = shared;
     if (specific != null) result.specific = specific;
     return result;
@@ -1965,7 +1965,7 @@ class GrantEntry extends $pb.GeneratedMessage {
       package: const $pb.PackageName(_omitMessageNames ? '' : 'arbiter.evm'),
       createEmptyInstance: create)
     ..aI(1, _omitFieldNames ? '' : 'id')
-    ..aI(2, _omitFieldNames ? '' : 'clientId')
+    ..aI(2, _omitFieldNames ? '' : 'walletAccessId')
     ..aOM<SharedSettings>(3, _omitFieldNames ? '' : 'shared',
         subBuilder: SharedSettings.create)
     ..aOM<SpecificGrant>(4, _omitFieldNames ? '' : 'specific',
@@ -2000,13 +2000,13 @@ class GrantEntry extends $pb.GeneratedMessage {
   void clearId() => $_clearField(1);
 
   @$pb.TagNumber(2)
-  $core.int get clientId => $_getIZ(1);
+  $core.int get walletAccessId => $_getIZ(1);
   @$pb.TagNumber(2)
-  set clientId($core.int value) => $_setSignedInt32(1, value);
+  set walletAccessId($core.int value) => $_setSignedInt32(1, value);
   @$pb.TagNumber(2)
-  $core.bool hasClientId() => $_has(1);
+  $core.bool hasWalletAccessId() => $_has(1);
   @$pb.TagNumber(2)
-  void clearClientId() => $_clearField(2);
+  void clearWalletAccessId() => $_clearField(2);
 
   @$pb.TagNumber(3)
   SharedSettings get shared => $_getN(2);
@@ -2033,10 +2033,10 @@ class GrantEntry extends $pb.GeneratedMessage {
 
 class EvmGrantListRequest extends $pb.GeneratedMessage {
   factory EvmGrantListRequest({
-    $core.int? walletId,
+    $core.int? walletAccessId,
   }) {
     final result = create();
-    if (walletId != null) result.walletId = walletId;
+    if (walletAccessId != null) result.walletAccessId = walletAccessId;
     return result;
   }
 
@@ -2053,7 +2053,7 @@ class EvmGrantListRequest extends $pb.GeneratedMessage {
       _omitMessageNames ? '' : 'EvmGrantListRequest',
       package: const $pb.PackageName(_omitMessageNames ? '' : 'arbiter.evm'),
       createEmptyInstance: create)
-    ..aI(1, _omitFieldNames ? '' : 'walletId')
+    ..aI(1, _omitFieldNames ? '' : 'walletAccessId')
     ..hasRequiredFields = false;
 
   @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
@@ -2076,13 +2076,13 @@ class EvmGrantListRequest extends $pb.GeneratedMessage {
   static EvmGrantListRequest? _defaultInstance;
 
   @$pb.TagNumber(1)
-  $core.int get walletId => $_getIZ(0);
+  $core.int get walletAccessId => $_getIZ(0);
   @$pb.TagNumber(1)
-  set walletId($core.int value) => $_setSignedInt32(0, value);
+  set walletAccessId($core.int value) => $_setSignedInt32(0, value);
   @$pb.TagNumber(1)
-  $core.bool hasWalletId() => $_has(0);
+  $core.bool hasWalletAccessId() => $_has(0);
   @$pb.TagNumber(1)
-  void clearWalletId() => $_clearField(1);
+  void clearWalletAccessId() => $_clearField(1);
 }
 
 enum EvmGrantListResponse_Result { grants, error, notSet }

useragent/lib/proto/evm.pbjson.dart

@@ -34,13 +34,15 @@ final $typed_data.Uint8List evmErrorDescriptor = $convert.base64Decode(
 const WalletEntry$json = {
   '1': 'WalletEntry',
   '2': [
-    {'1': 'address', '3': 1, '4': 1, '5': 12, '10': 'address'},
+    {'1': 'id', '3': 1, '4': 1, '5': 5, '10': 'id'},
+    {'1': 'address', '3': 2, '4': 1, '5': 12, '10': 'address'},
   ],
 };
 
 /// Descriptor for `WalletEntry`. Decode as a `google.protobuf.DescriptorProto`.
-final $typed_data.Uint8List walletEntryDescriptor = $convert
-    .base64Decode('CgtXYWxsZXRFbnRyeRIYCgdhZGRyZXNzGAEgASgMUgdhZGRyZXNz');
+final $typed_data.Uint8List walletEntryDescriptor = $convert.base64Decode(
+    'CgtXYWxsZXRFbnRyeRIOCgJpZBgBIAEoBVICaWQSGAoHYWRkcmVzcxgCIAEoDFIHYWRkcmVzcw'
+    '==');
 
 @$core.Deprecated('Use walletListDescriptor instead')
 const WalletList$json = {
@@ -162,7 +164,7 @@ final $typed_data.Uint8List volumeRateLimitDescriptor = $convert.base64Decode(
 const SharedSettings$json = {
   '1': 'SharedSettings',
   '2': [
-    {'1': 'wallet_id', '3': 1, '4': 1, '5': 5, '10': 'walletId'},
+    {'1': 'wallet_access_id', '3': 1, '4': 1, '5': 5, '10': 'walletAccessId'},
     {'1': 'chain_id', '3': 2, '4': 1, '5': 4, '10': 'chainId'},
     {
       '1': 'valid_from',
@@ -224,15 +226,15 @@ const SharedSettings$json = {
 
 /// Descriptor for `SharedSettings`. Decode as a `google.protobuf.DescriptorProto`.
 final $typed_data.Uint8List sharedSettingsDescriptor = $convert.base64Decode(
-    'Cg5TaGFyZWRTZXR0aW5ncxIbCgl3YWxsZXRfaWQYASABKAVSCHdhbGxldElkEhkKCGNoYWluX2'
-    'lkGAIgASgEUgdjaGFpbklkEj4KCnZhbGlkX2Zyb20YAyABKAsyGi5nb29nbGUucHJvdG9idWYu'
-    'VGltZXN0YW1wSABSCXZhbGlkRnJvbYgBARJACgt2YWxpZF91bnRpbBgEIAEoCzIaLmdvb2dsZS'
-    '5wcm90b2J1Zi5UaW1lc3RhbXBIAVIKdmFsaWRVbnRpbIgBARIxChNtYXhfZ2FzX2ZlZV9wZXJf'
-    'Z2FzGAUgASgMSAJSD21heEdhc0ZlZVBlckdhc4gBARI7ChhtYXhfcHJpb3JpdHlfZmVlX3Blcl'
-    '9nYXMYBiABKAxIA1IUbWF4UHJpb3JpdHlGZWVQZXJHYXOIAQESRQoKcmF0ZV9saW1pdBgHIAEo'
-    'CzIhLmFyYml0ZXIuZXZtLlRyYW5zYWN0aW9uUmF0ZUxpbWl0SARSCXJhdGVMaW1pdIgBAUINCg'
-    'tfdmFsaWRfZnJvbUIOCgxfdmFsaWRfdW50aWxCFgoUX21heF9nYXNfZmVlX3Blcl9nYXNCGwoZ'
-    'X21heF9wcmlvcml0eV9mZWVfcGVyX2dhc0INCgtfcmF0ZV9saW1pdA==');
+    'Cg5TaGFyZWRTZXR0aW5ncxIoChB3YWxsZXRfYWNjZXNzX2lkGAEgASgFUg53YWxsZXRBY2Nlc3'
+    'NJZBIZCghjaGFpbl9pZBgCIAEoBFIHY2hhaW5JZBI+Cgp2YWxpZF9mcm9tGAMgASgLMhouZ29v'
+    'Z2xlLnByb3RvYnVmLlRpbWVzdGFtcEgAUgl2YWxpZEZyb22IAQESQAoLdmFsaWRfdW50aWwYBC'
+    'ABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wSAFSCnZhbGlkVW50aWyIAQESMQoTbWF4'
+    'X2dhc19mZWVfcGVyX2dhcxgFIAEoDEgCUg9tYXhHYXNGZWVQZXJHYXOIAQESOwoYbWF4X3ByaW'
+    '9yaXR5X2ZlZV9wZXJfZ2FzGAYgASgMSANSFG1heFByaW9yaXR5RmVlUGVyR2FziAEBEkUKCnJh'
+    'dGVfbGltaXQYByABKAsyIS5hcmJpdGVyLmV2bS5UcmFuc2FjdGlvblJhdGVMaW1pdEgEUglyYX'
+    'RlTGltaXSIAQFCDQoLX3ZhbGlkX2Zyb21CDgoMX3ZhbGlkX3VudGlsQhYKFF9tYXhfZ2FzX2Zl'
+    'ZV9wZXJfZ2FzQhsKGV9tYXhfcHJpb3JpdHlfZmVlX3Blcl9nYXNCDQoLX3JhdGVfbGltaXQ=');
 
 @$core.Deprecated('Use etherTransferSettingsDescriptor instead')
 const EtherTransferSettings$json = {
@@ -631,10 +633,9 @@ final $typed_data.Uint8List transactionEvalErrorDescriptor = $convert.base64Deco
 const EvmGrantCreateRequest$json = {
   '1': 'EvmGrantCreateRequest',
   '2': [
-    {'1': 'client_id', '3': 1, '4': 1, '5': 5, '10': 'clientId'},
     {
       '1': 'shared',
-      '3': 2,
+      '3': 1,
       '4': 1,
       '5': 11,
       '6': '.arbiter.evm.SharedSettings',
@@ -642,7 +643,7 @@ const EvmGrantCreateRequest$json = {
     },
     {
       '1': 'specific',
-      '3': 3,
+      '3': 2,
       '4': 1,
       '5': 11,
       '6': '.arbiter.evm.SpecificGrant',
@@ -653,9 +654,9 @@ const EvmGrantCreateRequest$json = {
 
 /// Descriptor for `EvmGrantCreateRequest`. Decode as a `google.protobuf.DescriptorProto`.
 final $typed_data.Uint8List evmGrantCreateRequestDescriptor = $convert.base64Decode(
-    'ChVFdm1HcmFudENyZWF0ZVJlcXVlc3QSGwoJY2xpZW50X2lkGAEgASgFUghjbGllbnRJZBIzCg'
-    'ZzaGFyZWQYAiABKAsyGy5hcmJpdGVyLmV2bS5TaGFyZWRTZXR0aW5nc1IGc2hhcmVkEjYKCHNw'
-    'ZWNpZmljGAMgASgLMhouYXJiaXRlci5ldm0uU3BlY2lmaWNHcmFudFIIc3BlY2lmaWM=');
+    'ChVFdm1HcmFudENyZWF0ZVJlcXVlc3QSMwoGc2hhcmVkGAEgASgLMhsuYXJiaXRlci5ldm0uU2'
+    'hhcmVkU2V0dGluZ3NSBnNoYXJlZBI2CghzcGVjaWZpYxgCIAEoCzIaLmFyYml0ZXIuZXZtLlNw'
+    'ZWNpZmljR3JhbnRSCHNwZWNpZmlj');
 
 @$core.Deprecated('Use evmGrantCreateResponseDescriptor instead')
 const EvmGrantCreateResponse$json = {
@@ -734,7 +735,7 @@ const GrantEntry$json = {
   '1': 'GrantEntry',
   '2': [
     {'1': 'id', '3': 1, '4': 1, '5': 5, '10': 'id'},
-    {'1': 'client_id', '3': 2, '4': 1, '5': 5, '10': 'clientId'},
+    {'1': 'wallet_access_id', '3': 2, '4': 1, '5': 5, '10': 'walletAccessId'},
     {
       '1': 'shared',
       '3': 3,
@@ -756,34 +757,34 @@ const GrantEntry$json = {
 
 /// Descriptor for `GrantEntry`. Decode as a `google.protobuf.DescriptorProto`.
 final $typed_data.Uint8List grantEntryDescriptor = $convert.base64Decode(
-    'CgpHcmFudEVudHJ5Eg4KAmlkGAEgASgFUgJpZBIbCgljbGllbnRfaWQYAiABKAVSCGNsaWVudE'
-    'lkEjMKBnNoYXJlZBgDIAEoCzIbLmFyYml0ZXIuZXZtLlNoYXJlZFNldHRpbmdzUgZzaGFyZWQS'
-    'NgoIc3BlY2lmaWMYBCABKAsyGi5hcmJpdGVyLmV2bS5TcGVjaWZpY0dyYW50UghzcGVjaWZpYw'
-    '==');
+    'CgpHcmFudEVudHJ5Eg4KAmlkGAEgASgFUgJpZBIoChB3YWxsZXRfYWNjZXNzX2lkGAIgASgFUg'
+    '53YWxsZXRBY2Nlc3NJZBIzCgZzaGFyZWQYAyABKAsyGy5hcmJpdGVyLmV2bS5TaGFyZWRTZXR0'
+    'aW5nc1IGc2hhcmVkEjYKCHNwZWNpZmljGAQgASgLMhouYXJiaXRlci5ldm0uU3BlY2lmaWNHcm'
+    'FudFIIc3BlY2lmaWM=');
 
 @$core.Deprecated('Use evmGrantListRequestDescriptor instead')
 const EvmGrantListRequest$json = {
   '1': 'EvmGrantListRequest',
   '2': [
     {
-      '1': 'wallet_id',
+      '1': 'wallet_access_id',
       '3': 1,
       '4': 1,
       '5': 5,
       '9': 0,
-      '10': 'walletId',
+      '10': 'walletAccessId',
       '17': true
     },
   ],
   '8': [
-    {'1': '_wallet_id'},
+    {'1': '_wallet_access_id'},
   ],
 };
 
 /// Descriptor for `EvmGrantListRequest`. Decode as a `google.protobuf.DescriptorProto`.
 final $typed_data.Uint8List evmGrantListRequestDescriptor = $convert.base64Decode(
-    'ChNFdm1HcmFudExpc3RSZXF1ZXN0EiAKCXdhbGxldF9pZBgBIAEoBUgAUgh3YWxsZXRJZIgBAU'
-    'IMCgpfd2FsbGV0X2lk');
+    'ChNFdm1HcmFudExpc3RSZXF1ZXN0Ei0KEHdhbGxldF9hY2Nlc3NfaWQYASABKAVIAFIOd2FsbG'
+    'V0QWNjZXNzSWSIAQFCEwoRX3dhbGxldF9hY2Nlc3NfaWQ=');
 
 @$core.Deprecated('Use evmGrantListResponseDescriptor instead')
 const EvmGrantListResponse$json = {

useragent/lib/proto/user_agent.pbenum.dart

@@ -39,6 +39,36 @@ class KeyType extends $pb.ProtobufEnum {
   const KeyType._(super.value, super.name);
 }
 
+class SdkClientError extends $pb.ProtobufEnum {
+  static const SdkClientError SDK_CLIENT_ERROR_UNSPECIFIED =
+      SdkClientError._(0, _omitEnumNames ? '' : 'SDK_CLIENT_ERROR_UNSPECIFIED');
+  static const SdkClientError SDK_CLIENT_ERROR_ALREADY_EXISTS =
+      SdkClientError._(
+          1, _omitEnumNames ? '' : 'SDK_CLIENT_ERROR_ALREADY_EXISTS');
+  static const SdkClientError SDK_CLIENT_ERROR_NOT_FOUND =
+      SdkClientError._(2, _omitEnumNames ? '' : 'SDK_CLIENT_ERROR_NOT_FOUND');
+  static const SdkClientError SDK_CLIENT_ERROR_HAS_RELATED_DATA =
+      SdkClientError._(
+          3, _omitEnumNames ? '' : 'SDK_CLIENT_ERROR_HAS_RELATED_DATA');
+  static const SdkClientError SDK_CLIENT_ERROR_INTERNAL =
+      SdkClientError._(4, _omitEnumNames ? '' : 'SDK_CLIENT_ERROR_INTERNAL');
+
+  static const $core.List<SdkClientError> values = <SdkClientError>[
+    SDK_CLIENT_ERROR_UNSPECIFIED,
+    SDK_CLIENT_ERROR_ALREADY_EXISTS,
+    SDK_CLIENT_ERROR_NOT_FOUND,
+    SDK_CLIENT_ERROR_HAS_RELATED_DATA,
+    SDK_CLIENT_ERROR_INTERNAL,
+  ];
+
+  static final $core.List<SdkClientError?> _byValue =
+      $pb.ProtobufEnum.$_initByValueList(values, 4);
+  static SdkClientError? valueOf($core.int value) =>
+      value < 0 || value >= _byValue.length ? null : _byValue[value];
+
+  const SdkClientError._(super.value, super.name);
+}
+
 class AuthResult extends $pb.ProtobufEnum {
   static const AuthResult AUTH_RESULT_UNSPECIFIED =
       AuthResult._(0, _omitEnumNames ? '' : 'AUTH_RESULT_UNSPECIFIED');

useragent/lib/proto/user_agent.pbjson.dart

@@ -31,6 +31,25 @@ final $typed_data.Uint8List keyTypeDescriptor = $convert.base64Decode(
     'CgdLZXlUeXBlEhgKFEtFWV9UWVBFX1VOU1BFQ0lGSUVEEAASFAoQS0VZX1RZUEVfRUQyNTUxOR'
     'ABEhwKGEtFWV9UWVBFX0VDRFNBX1NFQ1AyNTZLMRACEhAKDEtFWV9UWVBFX1JTQRAD');
 
+@$core.Deprecated('Use sdkClientErrorDescriptor instead')
+const SdkClientError$json = {
+  '1': 'SdkClientError',
+  '2': [
+    {'1': 'SDK_CLIENT_ERROR_UNSPECIFIED', '2': 0},
+    {'1': 'SDK_CLIENT_ERROR_ALREADY_EXISTS', '2': 1},
+    {'1': 'SDK_CLIENT_ERROR_NOT_FOUND', '2': 2},
+    {'1': 'SDK_CLIENT_ERROR_HAS_RELATED_DATA', '2': 3},
+    {'1': 'SDK_CLIENT_ERROR_INTERNAL', '2': 4},
+  ],
+};
+
+/// Descriptor for `SdkClientError`. Decode as a `google.protobuf.EnumDescriptorProto`.
+final $typed_data.Uint8List sdkClientErrorDescriptor = $convert.base64Decode(
+    'Cg5TZGtDbGllbnRFcnJvchIgChxTREtfQ0xJRU5UX0VSUk9SX1VOU1BFQ0lGSUVEEAASIwofU0'
+    'RLX0NMSUVOVF9FUlJPUl9BTFJFQURZX0VYSVNUUxABEh4KGlNES19DTElFTlRfRVJST1JfTk9U'
+    'X0ZPVU5EEAISJQohU0RLX0NMSUVOVF9FUlJPUl9IQVNfUkVMQVRFRF9EQVRBEAMSHQoZU0RLX0'
+    'NMSUVOVF9FUlJPUl9JTlRFUk5BTBAE');
+
 @$core.Deprecated('Use authResultDescriptor instead')
 const AuthResult$json = {
   '1': 'AuthResult',
@@ -105,6 +124,131 @@ final $typed_data.Uint8List vaultStateDescriptor = $convert.base64Decode(
     'VfVU5CT09UU1RSQVBQRUQQARIWChJWQVVMVF9TVEFURV9TRUFMRUQQAhIYChRWQVVMVF9TVEFU'
     'RV9VTlNFQUxFRBADEhUKEVZBVUxUX1NUQVRFX0VSUk9SEAQ=');
 
+@$core.Deprecated('Use sdkClientRevokeRequestDescriptor instead')
+const SdkClientRevokeRequest$json = {
+  '1': 'SdkClientRevokeRequest',
+  '2': [
+    {'1': 'client_id', '3': 1, '4': 1, '5': 5, '10': 'clientId'},
+  ],
+};
+
+/// Descriptor for `SdkClientRevokeRequest`. Decode as a `google.protobuf.DescriptorProto`.
+final $typed_data.Uint8List sdkClientRevokeRequestDescriptor =
+    $convert.base64Decode(
+        'ChZTZGtDbGllbnRSZXZva2VSZXF1ZXN0EhsKCWNsaWVudF9pZBgBIAEoBVIIY2xpZW50SWQ=');
+
+@$core.Deprecated('Use sdkClientEntryDescriptor instead')
+const SdkClientEntry$json = {
+  '1': 'SdkClientEntry',
+  '2': [
+    {'1': 'id', '3': 1, '4': 1, '5': 5, '10': 'id'},
+    {'1': 'pubkey', '3': 2, '4': 1, '5': 12, '10': 'pubkey'},
+    {
+      '1': 'info',
+      '3': 3,
+      '4': 1,
+      '5': 11,
+      '6': '.arbiter.client.ClientInfo',
+      '10': 'info'
+    },
+    {'1': 'created_at', '3': 4, '4': 1, '5': 5, '10': 'createdAt'},
+  ],
+};
+
+/// Descriptor for `SdkClientEntry`. Decode as a `google.protobuf.DescriptorProto`.
+final $typed_data.Uint8List sdkClientEntryDescriptor = $convert.base64Decode(
+    'Cg5TZGtDbGllbnRFbnRyeRIOCgJpZBgBIAEoBVICaWQSFgoGcHVia2V5GAIgASgMUgZwdWJrZX'
+    'kSLgoEaW5mbxgDIAEoCzIaLmFyYml0ZXIuY2xpZW50LkNsaWVudEluZm9SBGluZm8SHQoKY3Jl'
+    'YXRlZF9hdBgEIAEoBVIJY3JlYXRlZEF0');
+
+@$core.Deprecated('Use sdkClientListDescriptor instead')
+const SdkClientList$json = {
+  '1': 'SdkClientList',
+  '2': [
+    {
+      '1': 'clients',
+      '3': 1,
+      '4': 3,
+      '5': 11,
+      '6': '.arbiter.user_agent.SdkClientEntry',
+      '10': 'clients'
+    },
+  ],
+};
+
+/// Descriptor for `SdkClientList`. Decode as a `google.protobuf.DescriptorProto`.
+final $typed_data.Uint8List sdkClientListDescriptor = $convert.base64Decode(
+    'Cg1TZGtDbGllbnRMaXN0EjwKB2NsaWVudHMYASADKAsyIi5hcmJpdGVyLnVzZXJfYWdlbnQuU2'
+    'RrQ2xpZW50RW50cnlSB2NsaWVudHM=');
+
+@$core.Deprecated('Use sdkClientRevokeResponseDescriptor instead')
+const SdkClientRevokeResponse$json = {
+  '1': 'SdkClientRevokeResponse',
+  '2': [
+    {
+      '1': 'ok',
+      '3': 1,
+      '4': 1,
+      '5': 11,
+      '6': '.google.protobuf.Empty',
+      '9': 0,
+      '10': 'ok'
+    },
+    {
+      '1': 'error',
+      '3': 2,
+      '4': 1,
+      '5': 14,
+      '6': '.arbiter.user_agent.SdkClientError',
+      '9': 0,
+      '10': 'error'
+    },
+  ],
+  '8': [
+    {'1': 'result'},
+  ],
+};
+
+/// Descriptor for `SdkClientRevokeResponse`. Decode as a `google.protobuf.DescriptorProto`.
+final $typed_data.Uint8List sdkClientRevokeResponseDescriptor = $convert.base64Decode(
+    'ChdTZGtDbGllbnRSZXZva2VSZXNwb25zZRIoCgJvaxgBIAEoCzIWLmdvb2dsZS5wcm90b2J1Zi'
+    '5FbXB0eUgAUgJvaxI6CgVlcnJvchgCIAEoDjIiLmFyYml0ZXIudXNlcl9hZ2VudC5TZGtDbGll'
+    'bnRFcnJvckgAUgVlcnJvckIICgZyZXN1bHQ=');
+
+@$core.Deprecated('Use sdkClientListResponseDescriptor instead')
+const SdkClientListResponse$json = {
+  '1': 'SdkClientListResponse',
+  '2': [
+    {
+      '1': 'clients',
+      '3': 1,
+      '4': 1,
+      '5': 11,
+      '6': '.arbiter.user_agent.SdkClientList',
+      '9': 0,
+      '10': 'clients'
+    },
+    {
+      '1': 'error',
+      '3': 2,
+      '4': 1,
+      '5': 14,
+      '6': '.arbiter.user_agent.SdkClientError',
+      '9': 0,
+      '10': 'error'
+    },
+  ],
+  '8': [
+    {'1': 'result'},
+  ],
+};
+
+/// Descriptor for `SdkClientListResponse`. Decode as a `google.protobuf.DescriptorProto`.
+final $typed_data.Uint8List sdkClientListResponseDescriptor = $convert.base64Decode(
+    'ChVTZGtDbGllbnRMaXN0UmVzcG9uc2USPQoHY2xpZW50cxgBIAEoCzIhLmFyYml0ZXIudXNlcl'
+    '9hZ2VudC5TZGtDbGllbnRMaXN0SABSB2NsaWVudHMSOgoFZXJyb3IYAiABKA4yIi5hcmJpdGVy'
+    'LnVzZXJfYWdlbnQuU2RrQ2xpZW50RXJyb3JIAFIFZXJyb3JCCAoGcmVzdWx0');
+
 @$core.Deprecated('Use authChallengeRequestDescriptor instead')
 const AuthChallengeRequest$json = {
   '1': 'AuthChallengeRequest',
@@ -224,46 +368,152 @@ final $typed_data.Uint8List bootstrapEncryptedKeyDescriptor = $convert.base64Dec
     'RleHQYAiABKAxSCmNpcGhlcnRleHQSJwoPYXNzb2NpYXRlZF9kYXRhGAMgASgMUg5hc3NvY2lh'
     'dGVkRGF0YQ==');
 
-@$core.Deprecated('Use clientConnectionRequestDescriptor instead')
-const ClientConnectionRequest$json = {
-  '1': 'ClientConnectionRequest',
+@$core.Deprecated('Use sdkClientConnectionRequestDescriptor instead')
+const SdkClientConnectionRequest$json = {
+  '1': 'SdkClientConnectionRequest',
+  '2': [
+    {'1': 'pubkey', '3': 1, '4': 1, '5': 12, '10': 'pubkey'},
+    {
+      '1': 'info',
+      '3': 2,
+      '4': 1,
+      '5': 11,
+      '6': '.arbiter.client.ClientInfo',
+      '10': 'info'
+    },
+  ],
+};
+
+/// Descriptor for `SdkClientConnectionRequest`. Decode as a `google.protobuf.DescriptorProto`.
+final $typed_data.Uint8List sdkClientConnectionRequestDescriptor =
+    $convert.base64Decode(
+        'ChpTZGtDbGllbnRDb25uZWN0aW9uUmVxdWVzdBIWCgZwdWJrZXkYASABKAxSBnB1YmtleRIuCg'
+        'RpbmZvGAIgASgLMhouYXJiaXRlci5jbGllbnQuQ2xpZW50SW5mb1IEaW5mbw==');
+
+@$core.Deprecated('Use sdkClientConnectionResponseDescriptor instead')
+const SdkClientConnectionResponse$json = {
+  '1': 'SdkClientConnectionResponse',
+  '2': [
+    {'1': 'approved', '3': 1, '4': 1, '5': 8, '10': 'approved'},
+    {'1': 'pubkey', '3': 2, '4': 1, '5': 12, '10': 'pubkey'},
+  ],
+};
+
+/// Descriptor for `SdkClientConnectionResponse`. Decode as a `google.protobuf.DescriptorProto`.
+final $typed_data.Uint8List sdkClientConnectionResponseDescriptor =
+    $convert.base64Decode(
+        'ChtTZGtDbGllbnRDb25uZWN0aW9uUmVzcG9uc2USGgoIYXBwcm92ZWQYASABKAhSCGFwcHJvdm'
+        'VkEhYKBnB1YmtleRgCIAEoDFIGcHVia2V5');
+
+@$core.Deprecated('Use sdkClientConnectionCancelDescriptor instead')
+const SdkClientConnectionCancel$json = {
+  '1': 'SdkClientConnectionCancel',
   '2': [
     {'1': 'pubkey', '3': 1, '4': 1, '5': 12, '10': 'pubkey'},
   ],
 };
 
-/// Descriptor for `ClientConnectionRequest`. Decode as a `google.protobuf.DescriptorProto`.
-final $typed_data.Uint8List clientConnectionRequestDescriptor =
+/// Descriptor for `SdkClientConnectionCancel`. Decode as a `google.protobuf.DescriptorProto`.
+final $typed_data.Uint8List sdkClientConnectionCancelDescriptor =
     $convert.base64Decode(
-        'ChdDbGllbnRDb25uZWN0aW9uUmVxdWVzdBIWCgZwdWJrZXkYASABKAxSBnB1YmtleQ==');
+        'ChlTZGtDbGllbnRDb25uZWN0aW9uQ2FuY2VsEhYKBnB1YmtleRgBIAEoDFIGcHVia2V5');
 
-@$core.Deprecated('Use clientConnectionResponseDescriptor instead')
-const ClientConnectionResponse$json = {
-  '1': 'ClientConnectionResponse',
+@$core.Deprecated('Use walletAccessDescriptor instead')
+const WalletAccess$json = {
+  '1': 'WalletAccess',
   '2': [
-    {'1': 'approved', '3': 1, '4': 1, '5': 8, '10': 'approved'},
+    {'1': 'wallet_id', '3': 1, '4': 1, '5': 5, '10': 'walletId'},
+    {'1': 'sdk_client_id', '3': 2, '4': 1, '5': 5, '10': 'sdkClientId'},
   ],
 };
 
-/// Descriptor for `ClientConnectionResponse`. Decode as a `google.protobuf.DescriptorProto`.
-final $typed_data.Uint8List clientConnectionResponseDescriptor =
-    $convert.base64Decode(
-        'ChhDbGllbnRDb25uZWN0aW9uUmVzcG9uc2USGgoIYXBwcm92ZWQYASABKAhSCGFwcHJvdmVk');
+/// Descriptor for `WalletAccess`. Decode as a `google.protobuf.DescriptorProto`.
+final $typed_data.Uint8List walletAccessDescriptor = $convert.base64Decode(
+    'CgxXYWxsZXRBY2Nlc3MSGwoJd2FsbGV0X2lkGAEgASgFUgh3YWxsZXRJZBIiCg1zZGtfY2xpZW'
+    '50X2lkGAIgASgFUgtzZGtDbGllbnRJZA==');
 
-@$core.Deprecated('Use clientConnectionCancelDescriptor instead')
-const ClientConnectionCancel$json = {
-  '1': 'ClientConnectionCancel',
+@$core.Deprecated('Use sdkClientWalletAccessDescriptor instead')
+const SdkClientWalletAccess$json = {
+  '1': 'SdkClientWalletAccess',
+  '2': [
+    {'1': 'id', '3': 1, '4': 1, '5': 5, '10': 'id'},
+    {
+      '1': 'access',
+      '3': 2,
+      '4': 1,
+      '5': 11,
+      '6': '.arbiter.user_agent.WalletAccess',
+      '10': 'access'
+    },
+  ],
 };
 
-/// Descriptor for `ClientConnectionCancel`. Decode as a `google.protobuf.DescriptorProto`.
-final $typed_data.Uint8List clientConnectionCancelDescriptor =
-    $convert.base64Decode('ChZDbGllbnRDb25uZWN0aW9uQ2FuY2Vs');
+/// Descriptor for `SdkClientWalletAccess`. Decode as a `google.protobuf.DescriptorProto`.
+final $typed_data.Uint8List sdkClientWalletAccessDescriptor = $convert.base64Decode(
+    'ChVTZGtDbGllbnRXYWxsZXRBY2Nlc3MSDgoCaWQYASABKAVSAmlkEjgKBmFjY2VzcxgCIAEoCz'
+    'IgLmFyYml0ZXIudXNlcl9hZ2VudC5XYWxsZXRBY2Nlc3NSBmFjY2Vzcw==');
+
+@$core.Deprecated('Use sdkClientGrantWalletAccessDescriptor instead')
+const SdkClientGrantWalletAccess$json = {
+  '1': 'SdkClientGrantWalletAccess',
+  '2': [
+    {
+      '1': 'accesses',
+      '3': 1,
+      '4': 3,
+      '5': 11,
+      '6': '.arbiter.user_agent.WalletAccess',
+      '10': 'accesses'
+    },
+  ],
+};
+
+/// Descriptor for `SdkClientGrantWalletAccess`. Decode as a `google.protobuf.DescriptorProto`.
+final $typed_data.Uint8List sdkClientGrantWalletAccessDescriptor =
+    $convert.base64Decode(
+        'ChpTZGtDbGllbnRHcmFudFdhbGxldEFjY2VzcxI8CghhY2Nlc3NlcxgBIAMoCzIgLmFyYml0ZX'
+        'IudXNlcl9hZ2VudC5XYWxsZXRBY2Nlc3NSCGFjY2Vzc2Vz');
+
+@$core.Deprecated('Use sdkClientRevokeWalletAccessDescriptor instead')
+const SdkClientRevokeWalletAccess$json = {
+  '1': 'SdkClientRevokeWalletAccess',
+  '2': [
+    {'1': 'accesses', '3': 1, '4': 3, '5': 5, '10': 'accesses'},
+  ],
+};
+
+/// Descriptor for `SdkClientRevokeWalletAccess`. Decode as a `google.protobuf.DescriptorProto`.
+final $typed_data.Uint8List sdkClientRevokeWalletAccessDescriptor =
+    $convert.base64Decode(
+        'ChtTZGtDbGllbnRSZXZva2VXYWxsZXRBY2Nlc3MSGgoIYWNjZXNzZXMYASADKAVSCGFjY2Vzc2'
+        'Vz');
+
+@$core.Deprecated('Use listWalletAccessResponseDescriptor instead')
+const ListWalletAccessResponse$json = {
+  '1': 'ListWalletAccessResponse',
+  '2': [
+    {
+      '1': 'accesses',
+      '3': 1,
+      '4': 3,
+      '5': 11,
+      '6': '.arbiter.user_agent.SdkClientWalletAccess',
+      '10': 'accesses'
+    },
+  ],
+};
+
+/// Descriptor for `ListWalletAccessResponse`. Decode as a `google.protobuf.DescriptorProto`.
+final $typed_data.Uint8List listWalletAccessResponseDescriptor =
+    $convert.base64Decode(
+        'ChhMaXN0V2FsbGV0QWNjZXNzUmVzcG9uc2USRQoIYWNjZXNzZXMYASADKAsyKS5hcmJpdGVyLn'
+        'VzZXJfYWdlbnQuU2RrQ2xpZW50V2FsbGV0QWNjZXNzUghhY2Nlc3Nlcw==');
 
 @$core.Deprecated('Use userAgentRequestDescriptor instead')
 const UserAgentRequest$json = {
   '1': 'UserAgentRequest',
   '2': [
-    {'1': 'id', '3': 14, '4': 1, '5': 5, '10': 'id'},
+    {'1': 'id', '3': 16, '4': 1, '5': 5, '10': 'id'},
     {
       '1': 'auth_challenge_request',
       '3': 1,
@@ -355,23 +605,68 @@ const UserAgentRequest$json = {
       '10': 'evmGrantList'
     },
     {
-      '1': 'client_connection_response',
+      '1': 'sdk_client_connection_response',
       '3': 11,
       '4': 1,
       '5': 11,
-      '6': '.arbiter.user_agent.ClientConnectionResponse',
+      '6': '.arbiter.user_agent.SdkClientConnectionResponse',
       '9': 0,
-      '10': 'clientConnectionResponse'
+      '10': 'sdkClientConnectionResponse'
+    },
+    {
+      '1': 'sdk_client_revoke',
+      '3': 12,
+      '4': 1,
+      '5': 11,
+      '6': '.arbiter.user_agent.SdkClientRevokeRequest',
+      '9': 0,
+      '10': 'sdkClientRevoke'
+    },
+    {
+      '1': 'sdk_client_list',
+      '3': 13,
+      '4': 1,
+      '5': 11,
+      '6': '.google.protobuf.Empty',
+      '9': 0,
+      '10': 'sdkClientList'
     },
     {
       '1': 'bootstrap_encrypted_key',
-      '3': 12,
+      '3': 14,
       '4': 1,
       '5': 11,
       '6': '.arbiter.user_agent.BootstrapEncryptedKey',
       '9': 0,
       '10': 'bootstrapEncryptedKey'
     },
+    {
+      '1': 'grant_wallet_access',
+      '3': 15,
+      '4': 1,
+      '5': 11,
+      '6': '.arbiter.user_agent.SdkClientGrantWalletAccess',
+      '9': 0,
+      '10': 'grantWalletAccess'
+    },
+    {
+      '1': 'revoke_wallet_access',
+      '3': 17,
+      '4': 1,
+      '5': 11,
+      '6': '.arbiter.user_agent.SdkClientRevokeWalletAccess',
+      '9': 0,
+      '10': 'revokeWalletAccess'
+    },
+    {
+      '1': 'list_wallet_access',
+      '3': 18,
+      '4': 1,
+      '5': 11,
+      '6': '.google.protobuf.Empty',
+      '9': 0,
+      '10': 'listWalletAccess'
+    },
   ],
   '8': [
     {'1': 'payload'},
@@ -380,7 +675,7 @@ const UserAgentRequest$json = {
 
 /// Descriptor for `UserAgentRequest`. Decode as a `google.protobuf.DescriptorProto`.
 final $typed_data.Uint8List userAgentRequestDescriptor = $convert.base64Decode(
-    'ChBVc2VyQWdlbnRSZXF1ZXN0Eg4KAmlkGA4gASgFUgJpZBJgChZhdXRoX2NoYWxsZW5nZV9yZX'
+    'ChBVc2VyQWdlbnRSZXF1ZXN0Eg4KAmlkGBAgASgFUgJpZBJgChZhdXRoX2NoYWxsZW5nZV9yZX'
     'F1ZXN0GAEgASgLMiguYXJiaXRlci51c2VyX2FnZW50LkF1dGhDaGFsbGVuZ2VSZXF1ZXN0SABS'
     'FGF1dGhDaGFsbGVuZ2VSZXF1ZXN0EmMKF2F1dGhfY2hhbGxlbmdlX3NvbHV0aW9uGAIgASgLMi'
     'kuYXJiaXRlci51c2VyX2FnZW50LkF1dGhDaGFsbGVuZ2VTb2x1dGlvbkgAUhVhdXRoQ2hhbGxl'
@@ -395,17 +690,24 @@ final $typed_data.Uint8List userAgentRequestDescriptor = $convert.base64Decode(
     'DmV2bUdyYW50Q3JlYXRlEk4KEGV2bV9ncmFudF9kZWxldGUYCSABKAsyIi5hcmJpdGVyLmV2bS'
     '5Fdm1HcmFudERlbGV0ZVJlcXVlc3RIAFIOZXZtR3JhbnREZWxldGUSSAoOZXZtX2dyYW50X2xp'
     'c3QYCiABKAsyIC5hcmJpdGVyLmV2bS5Fdm1HcmFudExpc3RSZXF1ZXN0SABSDGV2bUdyYW50TG'
-    'lzdBJsChpjbGllbnRfY29ubmVjdGlvbl9yZXNwb25zZRgLIAEoCzIsLmFyYml0ZXIudXNlcl9h'
-    'Z2VudC5DbGllbnRDb25uZWN0aW9uUmVzcG9uc2VIAFIYY2xpZW50Q29ubmVjdGlvblJlc3Bvbn'
-    'NlEmMKF2Jvb3RzdHJhcF9lbmNyeXB0ZWRfa2V5GAwgASgLMikuYXJiaXRlci51c2VyX2FnZW50'
-    'LkJvb3RzdHJhcEVuY3J5cHRlZEtleUgAUhVib290c3RyYXBFbmNyeXB0ZWRLZXlCCQoHcGF5bG'
-    '9hZA==');
+    'lzdBJ2Ch5zZGtfY2xpZW50X2Nvbm5lY3Rpb25fcmVzcG9uc2UYCyABKAsyLy5hcmJpdGVyLnVz'
+    'ZXJfYWdlbnQuU2RrQ2xpZW50Q29ubmVjdGlvblJlc3BvbnNlSABSG3Nka0NsaWVudENvbm5lY3'
+    'Rpb25SZXNwb25zZRJYChFzZGtfY2xpZW50X3Jldm9rZRgMIAEoCzIqLmFyYml0ZXIudXNlcl9h'
+    'Z2VudC5TZGtDbGllbnRSZXZva2VSZXF1ZXN0SABSD3Nka0NsaWVudFJldm9rZRJACg9zZGtfY2'
+    'xpZW50X2xpc3QYDSABKAsyFi5nb29nbGUucHJvdG9idWYuRW1wdHlIAFINc2RrQ2xpZW50TGlz'
+    'dBJjChdib290c3RyYXBfZW5jcnlwdGVkX2tleRgOIAEoCzIpLmFyYml0ZXIudXNlcl9hZ2VudC'
+    '5Cb290c3RyYXBFbmNyeXB0ZWRLZXlIAFIVYm9vdHN0cmFwRW5jcnlwdGVkS2V5EmAKE2dyYW50'
+    'X3dhbGxldF9hY2Nlc3MYDyABKAsyLi5hcmJpdGVyLnVzZXJfYWdlbnQuU2RrQ2xpZW50R3Jhbn'
+    'RXYWxsZXRBY2Nlc3NIAFIRZ3JhbnRXYWxsZXRBY2Nlc3MSYwoUcmV2b2tlX3dhbGxldF9hY2Nl'
+    'c3MYESABKAsyLy5hcmJpdGVyLnVzZXJfYWdlbnQuU2RrQ2xpZW50UmV2b2tlV2FsbGV0QWNjZX'
+    'NzSABSEnJldm9rZVdhbGxldEFjY2VzcxJGChJsaXN0X3dhbGxldF9hY2Nlc3MYEiABKAsyFi5n'
+    'b29nbGUucHJvdG9idWYuRW1wdHlIAFIQbGlzdFdhbGxldEFjY2Vzc0IJCgdwYXlsb2Fk');
 
 @$core.Deprecated('Use userAgentResponseDescriptor instead')
 const UserAgentResponse$json = {
   '1': 'UserAgentResponse',
   '2': [
-    {'1': 'id', '3': 14, '4': 1, '5': 5, '9': 1, '10': 'id', '17': true},
+    {'1': 'id', '3': 16, '4': 1, '5': 5, '9': 1, '10': 'id', '17': true},
     {
       '1': 'auth_challenge',
       '3': 1,
@@ -497,32 +799,59 @@ const UserAgentResponse$json = {
       '10': 'evmGrantList'
     },
     {
-      '1': 'client_connection_request',
+      '1': 'sdk_client_connection_request',
       '3': 11,
       '4': 1,
       '5': 11,
-      '6': '.arbiter.user_agent.ClientConnectionRequest',
+      '6': '.arbiter.user_agent.SdkClientConnectionRequest',
       '9': 0,
-      '10': 'clientConnectionRequest'
+      '10': 'sdkClientConnectionRequest'
     },
     {
-      '1': 'client_connection_cancel',
+      '1': 'sdk_client_connection_cancel',
       '3': 12,
       '4': 1,
       '5': 11,
-      '6': '.arbiter.user_agent.ClientConnectionCancel',
+      '6': '.arbiter.user_agent.SdkClientConnectionCancel',
       '9': 0,
-      '10': 'clientConnectionCancel'
+      '10': 'sdkClientConnectionCancel'
+    },
+    {
+      '1': 'sdk_client_revoke_response',
+      '3': 13,
+      '4': 1,
+      '5': 11,
+      '6': '.arbiter.user_agent.SdkClientRevokeResponse',
+      '9': 0,
+      '10': 'sdkClientRevokeResponse'
+    },
+    {
+      '1': 'sdk_client_list_response',
+      '3': 14,
+      '4': 1,
+      '5': 11,
+      '6': '.arbiter.user_agent.SdkClientListResponse',
+      '9': 0,
+      '10': 'sdkClientListResponse'
     },
     {
       '1': 'bootstrap_result',
-      '3': 13,
+      '3': 15,
       '4': 1,
       '5': 14,
       '6': '.arbiter.user_agent.BootstrapResult',
       '9': 0,
       '10': 'bootstrapResult'
     },
+    {
+      '1': 'list_wallet_access_response',
+      '3': 17,
+      '4': 1,
+      '5': 11,
+      '6': '.arbiter.user_agent.ListWalletAccessResponse',
+      '9': 0,
+      '10': 'listWalletAccessResponse'
+    },
   ],
   '8': [
     {'1': 'payload'},
@@ -532,7 +861,7 @@ const UserAgentResponse$json = {
 
 /// Descriptor for `UserAgentResponse`. Decode as a `google.protobuf.DescriptorProto`.
 final $typed_data.Uint8List userAgentResponseDescriptor = $convert.base64Decode(
-    'ChFVc2VyQWdlbnRSZXNwb25zZRITCgJpZBgOIAEoBUgBUgJpZIgBARJKCg5hdXRoX2NoYWxsZW'
+    'ChFVc2VyQWdlbnRSZXNwb25zZRITCgJpZBgQIAEoBUgBUgJpZIgBARJKCg5hdXRoX2NoYWxsZW'
     '5nZRgBIAEoCzIhLmFyYml0ZXIudXNlcl9hZ2VudC5BdXRoQ2hhbGxlbmdlSABSDWF1dGhDaGFs'
     'bGVuZ2USQQoLYXV0aF9yZXN1bHQYAiABKA4yHi5hcmJpdGVyLnVzZXJfYWdlbnQuQXV0aFJlc3'
     'VsdEgAUgphdXRoUmVzdWx0El0KFXVuc2VhbF9zdGFydF9yZXNwb25zZRgDIAEoCzInLmFyYml0'
@@ -546,10 +875,16 @@ final $typed_data.Uint8List userAgentResponseDescriptor = $convert.base64Decode(
     '5ldm0uRXZtR3JhbnRDcmVhdGVSZXNwb25zZUgAUg5ldm1HcmFudENyZWF0ZRJPChBldm1fZ3Jh'
     'bnRfZGVsZXRlGAkgASgLMiMuYXJiaXRlci5ldm0uRXZtR3JhbnREZWxldGVSZXNwb25zZUgAUg'
     '5ldm1HcmFudERlbGV0ZRJJCg5ldm1fZ3JhbnRfbGlzdBgKIAEoCzIhLmFyYml0ZXIuZXZtLkV2'
-    'bUdyYW50TGlzdFJlc3BvbnNlSABSDGV2bUdyYW50TGlzdBJpChljbGllbnRfY29ubmVjdGlvbl'
-    '9yZXF1ZXN0GAsgASgLMisuYXJiaXRlci51c2VyX2FnZW50LkNsaWVudENvbm5lY3Rpb25SZXF1'
-    'ZXN0SABSF2NsaWVudENvbm5lY3Rpb25SZXF1ZXN0EmYKGGNsaWVudF9jb25uZWN0aW9uX2Nhbm'
-    'NlbBgMIAEoCzIqLmFyYml0ZXIudXNlcl9hZ2VudC5DbGllbnRDb25uZWN0aW9uQ2FuY2VsSABS'
-    'FmNsaWVudENvbm5lY3Rpb25DYW5jZWwSUAoQYm9vdHN0cmFwX3Jlc3VsdBgNIAEoDjIjLmFyYm'
-    'l0ZXIudXNlcl9hZ2VudC5Cb290c3RyYXBSZXN1bHRIAFIPYm9vdHN0cmFwUmVzdWx0QgkKB3Bh'
-    'eWxvYWRCBQoDX2lk');
+    'bUdyYW50TGlzdFJlc3BvbnNlSABSDGV2bUdyYW50TGlzdBJzCh1zZGtfY2xpZW50X2Nvbm5lY3'
+    'Rpb25fcmVxdWVzdBgLIAEoCzIuLmFyYml0ZXIudXNlcl9hZ2VudC5TZGtDbGllbnRDb25uZWN0'
+    'aW9uUmVxdWVzdEgAUhpzZGtDbGllbnRDb25uZWN0aW9uUmVxdWVzdBJwChxzZGtfY2xpZW50X2'
+    'Nvbm5lY3Rpb25fY2FuY2VsGAwgASgLMi0uYXJiaXRlci51c2VyX2FnZW50LlNka0NsaWVudENv'
+    'bm5lY3Rpb25DYW5jZWxIAFIZc2RrQ2xpZW50Q29ubmVjdGlvbkNhbmNlbBJqChpzZGtfY2xpZW'
+    '50X3Jldm9rZV9yZXNwb25zZRgNIAEoCzIrLmFyYml0ZXIudXNlcl9hZ2VudC5TZGtDbGllbnRS'
+    'ZXZva2VSZXNwb25zZUgAUhdzZGtDbGllbnRSZXZva2VSZXNwb25zZRJkChhzZGtfY2xpZW50X2'
+    'xpc3RfcmVzcG9uc2UYDiABKAsyKS5hcmJpdGVyLnVzZXJfYWdlbnQuU2RrQ2xpZW50TGlzdFJl'
+    'c3BvbnNlSABSFXNka0NsaWVudExpc3RSZXNwb25zZRJQChBib290c3RyYXBfcmVzdWx0GA8gAS'
+    'gOMiMuYXJiaXRlci51c2VyX2FnZW50LkJvb3RzdHJhcFJlc3VsdEgAUg9ib290c3RyYXBSZXN1'
+    'bHQSbQobbGlzdF93YWxsZXRfYWNjZXNzX3Jlc3BvbnNlGBEgASgLMiwuYXJiaXRlci51c2VyX2'
+    'FnZW50Lkxpc3RXYWxsZXRBY2Nlc3NSZXNwb25zZUgAUhhsaXN0V2FsbGV0QWNjZXNzUmVzcG9u'
+    'c2VCCQoHcGF5bG9hZEIFCgNfaWQ=');

useragent/lib/providers/connection/connection_manager.dart

@@ -14,7 +14,7 @@ class ConnectionManager extends _$ConnectionManager {
   Future<Connection?> build() async {
     final serverInfo = await ref.watch(serverInfoProvider.future);
     final key = await ref.watch(keyProvider.future);
-    final token = ref.watch(bootstrapTokenProvider);
+    final token = ref.read(bootstrapTokenProvider);
 
     if (serverInfo == null || key == null) {
       return null;

useragent/lib/providers/connection/connection_manager.g.dart

@@ -33,7 +33,7 @@ final class ConnectionManagerProvider
   ConnectionManager create() => ConnectionManager();
 }
 
-String _$connectionManagerHash() => r'd01084e550f315bc6cadfe74413a7f959426a80e';
+String _$connectionManagerHash() => r'f471afb49bdcde77238424942f5af1716634f084';
 
 abstract class _$ConnectionManager extends $AsyncNotifier<Connection?> {
   FutureOr<Connection?> build();

useragent/lib/providers/evm/evm.dart

@@ -1,6 +1,8 @@
-import 'package:arbiter/features/connection/evm.dart';
+import 'package:arbiter/features/connection/evm.dart' as evm;
 import 'package:arbiter/proto/evm.pb.dart';
 import 'package:arbiter/providers/connection/connection_manager.dart';
+import 'package:hooks_riverpod/experimental/mutation.dart';
+import 'package:hooks_riverpod/hooks_riverpod.dart';
 import 'package:riverpod_annotation/riverpod_annotation.dart';
 
 part 'evm.g.dart';
@@ -14,7 +16,7 @@ class Evm extends _$Evm {
       return null;
     }
 
-    return listEvmWallets(connection);
+    return evm.listEvmWallets(connection);
   }
 
   Future<void> refreshWallets() async {
@@ -25,16 +27,21 @@ class Evm extends _$Evm {
     }
 
     state = const AsyncLoading();
-    state = await AsyncValue.guard(() => listEvmWallets(connection));
+    state = await AsyncValue.guard(() => evm.listEvmWallets(connection));
   }
+}
 
-  Future<void> createWallet() async {
-    final connection = await ref.read(connectionManagerProvider.future);
+final createEvmWallet = Mutation();
+
+Future<void> executeCreateEvmWallet(MutationTarget target) async {
+  return await createEvmWallet.run(target, (tsx) async {
+       final connection = await tsx.get(connectionManagerProvider.future);
     if (connection == null) {
       throw Exception('Not connected to the server.');
     }
 
-    await createEvmWallet(connection);
-    state = await AsyncValue.guard(() => listEvmWallets(connection));
-  }
+    await evm.createEvmWallet(connection);
+
+    await tsx.get(evmProvider.notifier).refreshWallets();
+  });
 }

useragent/lib/providers/evm/evm.g.dart

@@ -33,7 +33,7 @@ final class EvmProvider
   Evm create() => Evm();
 }
 
-String _$evmHash() => r'f5d05bfa7b820d0b96026a47ca47702a3793af5d';
+String _$evmHash() => r'ca2c9736065c5dc7cc45d8485000dd85dfbfa572';
 
 abstract class _$Evm extends $AsyncNotifier<List<WalletEntry>?> {
   FutureOr<List<WalletEntry>?> build();

useragent/lib/providers/evm/evm_grants.dart

@@ -1,7 +1,6 @@
 import 'package:arbiter/features/connection/evm/grants.dart';
 import 'package:arbiter/proto/evm.pb.dart';
 import 'package:arbiter/providers/connection/connection_manager.dart';
-import 'package:fixnum/fixnum.dart';
 import 'package:freezed_annotation/freezed_annotation.dart';
 import 'package:hooks_riverpod/experimental/mutation.dart';
 import 'package:mtcore/markettakers.dart';
@@ -73,14 +72,7 @@ class EvmGrants extends _$EvmGrants {
 
 Future<int> executeCreateEvmGrant(
   MutationTarget ref, {
-  required int clientId,
-  required int walletId,
-  required Int64 chainId,
-  DateTime? validFrom,
-  DateTime? validUntil,
-  List<int>? maxGasFeePerGas,
-  List<int>? maxPriorityFeePerGas,
-  TransactionRateLimit? rateLimit,
+  required SharedSettings sharedSettings,
   required SpecificGrant specific,
 }) {
   return createEvmGrantMutation.run(ref, (tsx) async {
@@ -91,14 +83,7 @@ Future<int> executeCreateEvmGrant(
 
     final grantId = await createEvmGrant(
       connection,
-      clientId: clientId,
-      walletId: walletId,
-      chainId: chainId,
-      validFrom: validFrom,
-      validUntil: validUntil,
-      maxGasFeePerGas: maxGasFeePerGas,
-      maxPriorityFeePerGas: maxPriorityFeePerGas,
-      rateLimit: rateLimit,
+      sharedSettings: sharedSettings,
       specific: specific,
     );
 

useragent/lib/providers/sdk_clients/details.dart

@@ -0,0 +1,19 @@
+import 'package:arbiter/proto/user_agent.pb.dart';
+import 'package:arbiter/providers/sdk_clients/list.dart';
+import 'package:riverpod_annotation/riverpod_annotation.dart';
+
+part 'details.g.dart';
+
+@riverpod
+Future<SdkClientEntry?> clientDetails(Ref ref, int clientId) async {
+  final clients = await ref.watch(sdkClientsProvider.future);
+  if (clients == null) {
+    return null;
+  }
+  for (final client in clients) {
+    if (client.id == clientId) {
+      return client;
+    }
+  }
+  return null;
+}

useragent/lib/providers/sdk_clients/details.g.dart

@@ -0,0 +1,85 @@
+// GENERATED CODE - DO NOT MODIFY BY HAND
+
+part of 'details.dart';
+
+// **************************************************************************
+// RiverpodGenerator
+// **************************************************************************
+
+// GENERATED CODE - DO NOT MODIFY BY HAND
+// ignore_for_file: type=lint, type=warning
+
+@ProviderFor(clientDetails)
+final clientDetailsProvider = ClientDetailsFamily._();
+
+final class ClientDetailsProvider
+    extends
+        $FunctionalProvider<
+          AsyncValue<SdkClientEntry?>,
+          SdkClientEntry?,
+          FutureOr<SdkClientEntry?>
+        >
+    with $FutureModifier<SdkClientEntry?>, $FutureProvider<SdkClientEntry?> {
+  ClientDetailsProvider._({
+    required ClientDetailsFamily super.from,
+    required int super.argument,
+  }) : super(
+         retry: null,
+         name: r'clientDetailsProvider',
+         isAutoDispose: true,
+         dependencies: null,
+         $allTransitiveDependencies: null,
+       );
+
+  @override
+  String debugGetCreateSourceHash() => _$clientDetailsHash();
+
+  @override
+  String toString() {
+    return r'clientDetailsProvider'
+        ''
+        '($argument)';
+  }
+
+  @$internal
+  @override
+  $FutureProviderElement<SdkClientEntry?> $createElement(
+    $ProviderPointer pointer,
+  ) => $FutureProviderElement(pointer);
+
+  @override
+  FutureOr<SdkClientEntry?> create(Ref ref) {
+    final argument = this.argument as int;
+    return clientDetails(ref, argument);
+  }
+
+  @override
+  bool operator ==(Object other) {
+    return other is ClientDetailsProvider && other.argument == argument;
+  }
+
+  @override
+  int get hashCode {
+    return argument.hashCode;
+  }
+}
+
+String _$clientDetailsHash() => r'21449a1a2cc4fa4e65ce761e6342e97c1d957a7a';
+
+final class ClientDetailsFamily extends $Family
+    with $FunctionalFamilyOverride<FutureOr<SdkClientEntry?>, int> {
+  ClientDetailsFamily._()
+    : super(
+        retry: null,
+        name: r'clientDetailsProvider',
+        dependencies: null,
+        $allTransitiveDependencies: null,
+        isAutoDispose: true,
+      );
+
+  ClientDetailsProvider call(int clientId) =>
+      ClientDetailsProvider._(argument: clientId, from: this);
+
+  @override
+  String toString() => r'clientDetailsProvider';
+}

useragent/lib/providers/sdk_clients/list.dart

@@ -0,0 +1,34 @@
+import 'package:arbiter/proto/user_agent.pb.dart';
+import 'package:arbiter/providers/connection/connection_manager.dart';
+import 'package:protobuf/well_known_types/google/protobuf/empty.pb.dart';
+import 'package:riverpod_annotation/riverpod_annotation.dart';
+
+part 'list.g.dart';
+
+@riverpod
+Future<List<SdkClientEntry>?> sdkClients(Ref ref) async {
+  final connection = await ref.watch(connectionManagerProvider.future);
+  if (connection == null) {
+    return null;
+  }
+
+  final resp = await connection.ask(
+    UserAgentRequest(sdkClientList: Empty()),
+  );
+
+  if (!resp.hasSdkClientListResponse()) {
+    throw Exception(
+      'Expected SDK client list response, got ${resp.whichPayload()}',
+    );
+  }
+  final result = resp.sdkClientListResponse;
+
+  switch (result.whichResult()) {
+    case SdkClientListResponse_Result.clients:
+      return result.clients.clients.toList(growable: false);
+    case SdkClientListResponse_Result.error:
+      throw Exception('Error listing SDK clients: ${result.error}');
+    case SdkClientListResponse_Result.notSet:
+      throw Exception('SDK client list response was empty.');
+  }
+}

useragent/lib/providers/sdk_clients/list.g.dart

@@ -0,0 +1,51 @@
+// GENERATED CODE - DO NOT MODIFY BY HAND
+
+part of 'list.dart';
+
+// **************************************************************************
+// RiverpodGenerator
+// **************************************************************************
+
+// GENERATED CODE - DO NOT MODIFY BY HAND
+// ignore_for_file: type=lint, type=warning
+
+@ProviderFor(sdkClients)
+final sdkClientsProvider = SdkClientsProvider._();
+
+final class SdkClientsProvider
+    extends
+        $FunctionalProvider<
+          AsyncValue<List<SdkClientEntry>?>,
+          List<SdkClientEntry>?,
+          FutureOr<List<SdkClientEntry>?>
+        >
+    with
+        $FutureModifier<List<SdkClientEntry>?>,
+        $FutureProvider<List<SdkClientEntry>?> {
+  SdkClientsProvider._()
+    : super(
+        from: null,
+        argument: null,
+        retry: null,
+        name: r'sdkClientsProvider',
+        isAutoDispose: true,
+        dependencies: null,
+        $allTransitiveDependencies: null,
+      );
+
+  @override
+  String debugGetCreateSourceHash() => _$sdkClientsHash();
+
+  @$internal
+  @override
+  $FutureProviderElement<List<SdkClientEntry>?> $createElement(
+    $ProviderPointer pointer,
+  ) => $FutureProviderElement(pointer);
+
+  @override
+  FutureOr<List<SdkClientEntry>?> create(Ref ref) {
+    return sdkClients(ref);
+  }
+}
+
+String _$sdkClientsHash() => r'9b50ef901a7b68e4e604d6d0b4777dbd3e6499e1';

useragent/lib/providers/sdk_clients/wallet_access.dart

@@ -0,0 +1,174 @@
+import 'package:arbiter/features/connection/evm/wallet_access.dart';
+import 'package:arbiter/proto/evm.pb.dart';
+import 'package:arbiter/providers/connection/connection_manager.dart';
+import 'package:arbiter/providers/evm/evm.dart';
+import 'package:flutter/foundation.dart';
+import 'package:hooks_riverpod/experimental/mutation.dart';
+import 'package:riverpod_annotation/riverpod_annotation.dart';
+
+part 'wallet_access.g.dart';
+
+class ClientWalletOption {
+  const ClientWalletOption({required this.walletId, required this.address});
+
+  final int walletId;
+  final String address;
+}
+
+class ClientWalletAccessState {
+  const ClientWalletAccessState({
+    this.searchQuery = '',
+    this.originalWalletIds = const {},
+    this.selectedWalletIds = const {},
+  });
+
+  final String searchQuery;
+  final Set<int> originalWalletIds;
+  final Set<int> selectedWalletIds;
+
+  bool get hasChanges => !setEquals(originalWalletIds, selectedWalletIds);
+
+  ClientWalletAccessState copyWith({
+    String? searchQuery,
+    Set<int>? originalWalletIds,
+    Set<int>? selectedWalletIds,
+  }) {
+    return ClientWalletAccessState(
+      searchQuery: searchQuery ?? this.searchQuery,
+      originalWalletIds: originalWalletIds ?? this.originalWalletIds,
+      selectedWalletIds: selectedWalletIds ?? this.selectedWalletIds,
+    );
+  }
+}
+
+final saveClientWalletAccessMutation = Mutation<void>();
+
+abstract class ClientWalletAccessRepository {
+  Future<Set<int>> fetchSelectedWalletIds(int clientId);
+  Future<void> saveSelectedWalletIds(int clientId, Set<int> walletIds);
+}
+
+class ServerClientWalletAccessRepository
+    implements ClientWalletAccessRepository {
+  ServerClientWalletAccessRepository(this.ref);
+
+  final Ref ref;
+
+  @override
+  Future<Set<int>> fetchSelectedWalletIds(int clientId) async {
+    final connection = await ref.read(connectionManagerProvider.future);
+    if (connection == null) {
+      throw Exception('Not connected to the server.');
+    }
+    return readClientWalletAccess(connection, clientId: clientId);
+  }
+
+  @override
+  Future<void> saveSelectedWalletIds(int clientId, Set<int> walletIds) async {
+    final connection = await ref.read(connectionManagerProvider.future);
+    if (connection == null) {
+      throw Exception('Not connected to the server.');
+    }
+    await writeClientWalletAccess(
+      connection,
+      clientId: clientId,
+      walletIds: walletIds,
+    );
+  }
+}
+
+@riverpod
+ClientWalletAccessRepository clientWalletAccessRepository(Ref ref) {
+  return ServerClientWalletAccessRepository(ref);
+}
+
+@riverpod
+Future<List<ClientWalletOption>> clientWalletOptions(Ref ref) async {
+  final wallets = await ref.watch(evmProvider.future) ?? const <WalletEntry>[];
+  return [
+    for (var index = 0; index < wallets.length; index++)
+      ClientWalletOption(
+        walletId: index + 1,
+        address: formatWalletAddress(wallets[index].address),
+      ),
+  ];
+}
+
+@riverpod
+Future<Set<int>> clientWalletAccessSelection(Ref ref, int clientId) async {
+  final repository = ref.watch(clientWalletAccessRepositoryProvider);
+  return repository.fetchSelectedWalletIds(clientId);
+}
+
+@riverpod
+class ClientWalletAccessController extends _$ClientWalletAccessController {
+  @override
+  ClientWalletAccessState build(int clientId) {
+    final selection = ref.read(clientWalletAccessSelectionProvider(clientId));
+
+    void sync(AsyncValue<Set<int>> value) {
+      value.when(data: hydrate, error: (_, _) {}, loading: () {});
+    }
+
+    ref.listen<AsyncValue<Set<int>>>(
+      clientWalletAccessSelectionProvider(clientId),
+      (_, next) => sync(next),
+    );
+    return selection.when(
+      data: (walletIds) => ClientWalletAccessState(
+        originalWalletIds: Set.of(walletIds),
+        selectedWalletIds: Set.of(walletIds),
+      ),
+      error: (error, _) => const ClientWalletAccessState(),
+      loading: () => const ClientWalletAccessState(),
+    );
+  }
+
+  void hydrate(Set<int> selectedWalletIds) {
+    state = state.copyWith(
+      originalWalletIds: Set.of(selectedWalletIds),
+      selectedWalletIds: Set.of(selectedWalletIds),
+    );
+  }
+
+  void setSearchQuery(String value) {
+    state = state.copyWith(searchQuery: value);
+  }
+
+  void toggleWallet(int walletId) {
+    final next = Set<int>.of(state.selectedWalletIds);
+    if (!next.add(walletId)) {
+      next.remove(walletId);
+    }
+    state = state.copyWith(selectedWalletIds: next);
+  }
+
+  void discardChanges() {
+    state = state.copyWith(selectedWalletIds: Set.of(state.originalWalletIds));
+  }
+}
+
+Future<void> executeSaveClientWalletAccess(
+  MutationTarget ref, {
+  required int clientId,
+}) {
+  final mutation = saveClientWalletAccessMutation(clientId);
+  return mutation.run(ref, (tsx) async {
+    final repository = tsx.get(clientWalletAccessRepositoryProvider);
+    final controller = tsx.get(
+      clientWalletAccessControllerProvider(clientId).notifier,
+    );
+    final selectedWalletIds = tsx
+        .get(clientWalletAccessControllerProvider(clientId))
+        .selectedWalletIds;
+    await repository.saveSelectedWalletIds(clientId, selectedWalletIds);
+    controller.hydrate(selectedWalletIds);
+  });
+}
+
+String formatWalletAddress(List<int> bytes) {
+  final hex = bytes
+      .map((byte) => byte.toRadixString(16).padLeft(2, '0'))
+      .join();
+  return '0x$hex';
+}

useragent/lib/providers/sdk_clients/wallet_access.g.dart

@@ -0,0 +1,280 @@
+// GENERATED CODE - DO NOT MODIFY BY HAND
+
+part of 'wallet_access.dart';
+
+// **************************************************************************
+// RiverpodGenerator
+// **************************************************************************
+
+// GENERATED CODE - DO NOT MODIFY BY HAND
+// ignore_for_file: type=lint, type=warning
+
+@ProviderFor(clientWalletAccessRepository)
+final clientWalletAccessRepositoryProvider =
+    ClientWalletAccessRepositoryProvider._();
+
+final class ClientWalletAccessRepositoryProvider
+    extends
+        $FunctionalProvider<
+          ClientWalletAccessRepository,
+          ClientWalletAccessRepository,
+          ClientWalletAccessRepository
+        >
+    with $Provider<ClientWalletAccessRepository> {
+  ClientWalletAccessRepositoryProvider._()
+    : super(
+        from: null,
+        argument: null,
+        retry: null,
+        name: r'clientWalletAccessRepositoryProvider',
+        isAutoDispose: true,
+        dependencies: null,
+        $allTransitiveDependencies: null,
+      );
+
+  @override
+  String debugGetCreateSourceHash() => _$clientWalletAccessRepositoryHash();
+
+  @$internal
+  @override
+  $ProviderElement<ClientWalletAccessRepository> $createElement(
+    $ProviderPointer pointer,
+  ) => $ProviderElement(pointer);
+
+  @override
+  ClientWalletAccessRepository create(Ref ref) {
+    return clientWalletAccessRepository(ref);
+  }
+
+  /// {@macro riverpod.override_with_value}
+  Override overrideWithValue(ClientWalletAccessRepository value) {
+    return $ProviderOverride(
+      origin: this,
+      providerOverride: $SyncValueProvider<ClientWalletAccessRepository>(value),
+    );
+  }
+}
+
+String _$clientWalletAccessRepositoryHash() =>
+    r'bbc332284bc36a8b5d807bd5c45362b6b12b19e7';
+
+@ProviderFor(clientWalletOptions)
+final clientWalletOptionsProvider = ClientWalletOptionsProvider._();
+
+final class ClientWalletOptionsProvider
+    extends
+        $FunctionalProvider<
+          AsyncValue<List<ClientWalletOption>>,
+          List<ClientWalletOption>,
+          FutureOr<List<ClientWalletOption>>
+        >
+    with
+        $FutureModifier<List<ClientWalletOption>>,
+        $FutureProvider<List<ClientWalletOption>> {
+  ClientWalletOptionsProvider._()
+    : super(
+        from: null,
+        argument: null,
+        retry: null,
+        name: r'clientWalletOptionsProvider',
+        isAutoDispose: true,
+        dependencies: null,
+        $allTransitiveDependencies: null,
+      );
+
+  @override
+  String debugGetCreateSourceHash() => _$clientWalletOptionsHash();
+
+  @$internal
+  @override
+  $FutureProviderElement<List<ClientWalletOption>> $createElement(
+    $ProviderPointer pointer,
+  ) => $FutureProviderElement(pointer);
+
+  @override
+  FutureOr<List<ClientWalletOption>> create(Ref ref) {
+    return clientWalletOptions(ref);
+  }
+}
+
+String _$clientWalletOptionsHash() =>
+    r'32183c2b281e2a41400de07f2381132a706815ab';
+
+@ProviderFor(clientWalletAccessSelection)
+final clientWalletAccessSelectionProvider =
+    ClientWalletAccessSelectionFamily._();
+
+final class ClientWalletAccessSelectionProvider
+    extends
+        $FunctionalProvider<AsyncValue<Set<int>>, Set<int>, FutureOr<Set<int>>>
+    with $FutureModifier<Set<int>>, $FutureProvider<Set<int>> {
+  ClientWalletAccessSelectionProvider._({
+    required ClientWalletAccessSelectionFamily super.from,
+    required int super.argument,
+  }) : super(
+         retry: null,
+         name: r'clientWalletAccessSelectionProvider',
+         isAutoDispose: true,
+         dependencies: null,
+         $allTransitiveDependencies: null,
+       );
+
+  @override
+  String debugGetCreateSourceHash() => _$clientWalletAccessSelectionHash();
+
+  @override
+  String toString() {
+    return r'clientWalletAccessSelectionProvider'
+        ''
+        '($argument)';
+  }
+
+  @$internal
+  @override
+  $FutureProviderElement<Set<int>> $createElement($ProviderPointer pointer) =>
+      $FutureProviderElement(pointer);
+
+  @override
+  FutureOr<Set<int>> create(Ref ref) {
+    final argument = this.argument as int;
+    return clientWalletAccessSelection(ref, argument);
+  }
+
+  @override
+  bool operator ==(Object other) {
+    return other is ClientWalletAccessSelectionProvider &&
+        other.argument == argument;
+  }
+
+  @override
+  int get hashCode {
+    return argument.hashCode;
+  }
+}
+
+String _$clientWalletAccessSelectionHash() =>
+    r'f33705ee7201cd9b899cc058d6642de85a22b03e';
+
+final class ClientWalletAccessSelectionFamily extends $Family
+    with $FunctionalFamilyOverride<FutureOr<Set<int>>, int> {
+  ClientWalletAccessSelectionFamily._()
+    : super(
+        retry: null,
+        name: r'clientWalletAccessSelectionProvider',
+        dependencies: null,
+        $allTransitiveDependencies: null,
+        isAutoDispose: true,
+      );
+
+  ClientWalletAccessSelectionProvider call(int clientId) =>
+      ClientWalletAccessSelectionProvider._(argument: clientId, from: this);
+
+  @override
+  String toString() => r'clientWalletAccessSelectionProvider';
+}
+
+@ProviderFor(ClientWalletAccessController)
+final clientWalletAccessControllerProvider =
+    ClientWalletAccessControllerFamily._();
+
+final class ClientWalletAccessControllerProvider
+    extends
+        $NotifierProvider<
+          ClientWalletAccessController,
+          ClientWalletAccessState
+        > {
+  ClientWalletAccessControllerProvider._({
+    required ClientWalletAccessControllerFamily super.from,
+    required int super.argument,
+  }) : super(
+         retry: null,
+         name: r'clientWalletAccessControllerProvider',
+         isAutoDispose: true,
+         dependencies: null,
+         $allTransitiveDependencies: null,
+       );
+
+  @override
+  String debugGetCreateSourceHash() => _$clientWalletAccessControllerHash();
+
+  @override
+  String toString() {
+    return r'clientWalletAccessControllerProvider'
+        ''
+        '($argument)';
+  }
+
+  @$internal
+  @override
+  ClientWalletAccessController create() => ClientWalletAccessController();
+
+  /// {@macro riverpod.override_with_value}
+  Override overrideWithValue(ClientWalletAccessState value) {
+    return $ProviderOverride(
+      origin: this,
+      providerOverride: $SyncValueProvider<ClientWalletAccessState>(value),
+    );
+  }
+
+  @override
+  bool operator ==(Object other) {
+    return other is ClientWalletAccessControllerProvider &&
+        other.argument == argument;
+  }
+
+  @override
+  int get hashCode {
+    return argument.hashCode;
+  }
+}
+
+String _$clientWalletAccessControllerHash() =>
+    r'45bff81382fec3e8610190167b55667a7dfc1111';
+
+final class ClientWalletAccessControllerFamily extends $Family
+    with
+        $ClassFamilyOverride<
+          ClientWalletAccessController,
+          ClientWalletAccessState,
+          ClientWalletAccessState,
+          ClientWalletAccessState,
+          int
+        > {
+  ClientWalletAccessControllerFamily._()
+    : super(
+        retry: null,
+        name: r'clientWalletAccessControllerProvider',
+        dependencies: null,
+        $allTransitiveDependencies: null,
+        isAutoDispose: true,
+      );
+
+  ClientWalletAccessControllerProvider call(int clientId) =>
+      ClientWalletAccessControllerProvider._(argument: clientId, from: this);
+
+  @override
+  String toString() => r'clientWalletAccessControllerProvider';
+}
+
+abstract class _$ClientWalletAccessController
+    extends $Notifier<ClientWalletAccessState> {
+  late final _$args = ref.$arg as int;
+  int get clientId => _$args;
+
+  ClientWalletAccessState build(int clientId);
+  @$mustCallSuper
+  @override
+  void runBuild() {
+    final ref =
+        this.ref as $Ref<ClientWalletAccessState, ClientWalletAccessState>;
+    final element =
+        ref.element
+            as $ClassProviderElement<
+              AnyNotifier<ClientWalletAccessState, ClientWalletAccessState>,
+              ClientWalletAccessState,
+              Object?,
+              Object?
+            >;
+    element.handleCreate(ref, () => build(_$args));
+  }
+}

useragent/lib/providers/sdk_clients/wallet_access_list.dart

@@ -0,0 +1,22 @@
+import 'package:arbiter/features/connection/evm/wallet_access.dart';
+import 'package:arbiter/proto/user_agent.pb.dart';
+import 'package:arbiter/providers/connection/connection_manager.dart';
+import 'package:mtcore/markettakers.dart';
+import 'package:riverpod_annotation/riverpod_annotation.dart';
+
+part 'wallet_access_list.g.dart';
+
+@riverpod
+Future<List<SdkClientWalletAccess>?> walletAccessList(Ref ref) async {
+  final connection = await ref.watch(connectionManagerProvider.future);
+  if (connection == null) {
+    return null;
+  }
+
+  try {
+    return await listAllWalletAccesses(connection);
+  } catch (e, st) {
+    talker.handle(e, st);
+    rethrow;
+  }
+}

useragent/lib/providers/sdk_clients/wallet_access_list.g.dart

@@ -0,0 +1,51 @@
+// GENERATED CODE - DO NOT MODIFY BY HAND
+
+part of 'wallet_access_list.dart';
+
+// **************************************************************************
+// RiverpodGenerator
+// **************************************************************************
+
+// GENERATED CODE - DO NOT MODIFY BY HAND
+// ignore_for_file: type=lint, type=warning
+
+@ProviderFor(walletAccessList)
+final walletAccessListProvider = WalletAccessListProvider._();
+
+final class WalletAccessListProvider
+    extends
+        $FunctionalProvider<
+          AsyncValue<List<SdkClientWalletAccess>?>,
+          List<SdkClientWalletAccess>?,
+          FutureOr<List<SdkClientWalletAccess>?>
+        >
+    with
+        $FutureModifier<List<SdkClientWalletAccess>?>,
+        $FutureProvider<List<SdkClientWalletAccess>?> {
+  WalletAccessListProvider._()
+    : super(
+        from: null,
+        argument: null,
+        retry: null,
+        name: r'walletAccessListProvider',
+        isAutoDispose: true,
+        dependencies: null,
+        $allTransitiveDependencies: null,
+      );
+
+  @override
+  String debugGetCreateSourceHash() => _$walletAccessListHash();
+
+  @$internal
+  @override
+  $FutureProviderElement<List<SdkClientWalletAccess>?> $createElement(
+    $ProviderPointer pointer,
+  ) => $FutureProviderElement(pointer);
+
+  @override
+  FutureOr<List<SdkClientWalletAccess>?> create(Ref ref) {
+    return walletAccessList(ref);
+  }
+}
+
+String _$walletAccessListHash() => r'c06006d6792ae463105a539723e9bb396192f96b';

useragent/lib/providers/vault_state.dart

@@ -13,7 +13,7 @@ Future<VaultState?> vaultState(Ref ref) async {
     return null;
   }
 
-  final resp = await conn.request(UserAgentRequest(queryVaultState: Empty()));
+  final resp = await conn.ask(UserAgentRequest(queryVaultState: Empty()));
   if (resp.whichPayload() != UserAgentResponse_Payload.vaultState) {
     talker.warning('Expected vault state response, got ${resp.whichPayload()}');
     return null;

useragent/lib/providers/vault_state.g.dart

@@ -46,4 +46,4 @@ final class VaultStateProvider
   }
 }
 
-String _$vaultStateHash() => r'97085e49bc3a296e36fa6c04a8f4c9abafac0835';
+String _$vaultStateHash() => r'81887aa99a3e928efd73dbe85caf81284c9f5803';

useragent/lib/router.dart

@@ -10,6 +10,7 @@ class Router extends RootStackRouter {
     AutoRoute(page: ServerInfoSetupRoute.page, path: '/server-info'),
     AutoRoute(page: ServerConnectionRoute.page, path: '/server-connection'),
     AutoRoute(page: VaultSetupRoute.page, path: '/vault'),
+    AutoRoute(page: ClientDetailsRoute.page, path: '/clients/:clientId'),
     AutoRoute(page: CreateEvmGrantRoute.page, path: '/evm-grants/create'),
 
     AutoRoute(
@@ -17,6 +18,7 @@ class Router extends RootStackRouter {
       path: '/dashboard',
       children: [
         AutoRoute(page: EvmRoute.page, path: 'evm'),
+        AutoRoute(page: ClientsRoute.page, path: 'clients'),
         AutoRoute(page: EvmGrantsRoute.page, path: 'grants'),
         AutoRoute(page: AboutRoute.page, path: 'about'),
       ],