Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

@@ -80,6 +129,9 @@ message UserAgentRequest {
     arbiter.evm.EvmGrantDeleteRequest evm_grant_delete = 9;
     arbiter.evm.EvmGrantListRequest evm_grant_list = 10;
     ClientConnectionResponse client_connection_response = 11;
+    SdkClientApproveRequest sdk_client_approve = 12;

@@ -13,0 +98,4 @@
+impl ArbiterSigner {
+    pub async fn connect_grpc(
+        url: ArbiterUrl,
+        key: ed25519_dalek::SigningKey,

@@ -13,0 +99,4 @@
+    pub async fn connect_grpc(
+        url: ArbiterUrl,
+        key: ed25519_dalek::SigningKey,
+        address: Address,

@@ -13,0 +104,4 @@
+        let anchor = webpki::anchor_from_trusted_cert(&url.ca_cert)?.to_owned();
+        let tls = ClientTlsConfig::new().trust_anchor(anchor);
+
+        // NOTE: We intentionally keep the same URL construction strategy as the user-agent crate

@@ -13,0 +112,4 @@
+            .await?;
+
+        let mut client = ArbiterServiceClient::new(channel);
+        let (tx, rx) = mpsc::channel(16);

@@ -13,0 +129,4 @@
+        })
+    }
+
+    async fn sign_transaction_via_arbiter(

@@ -13,0 +154,4 @@
+            )),
+        };
+
+        let mut transport = self.transport.lock().await;

@@ -13,0 +216,4 @@
+                .await
+                .map_err(|_| ConnectError::UnexpectedAuthResponse)?;
+
+            // Current server flow does not emit `AuthOk` for SDK clients, so we proceed after

@@ -64,0 +63,4 @@
+async fn get_nonce(
+    db: &db::DatabasePool,
+    pubkey: &VerifyingKey,
+) -> Result<Option<(i32, i32)>, Error> {

@@ -99,7 +99,6 @@ async fn request_client_approval(
     while let Some(result) = pool.join_next().await {
         match result {
             Ok(Ok(approved)) => {
-                // cancel other pending requests

@@ -31,2 +39,4 @@
 }
 
+impl TransportResponseError {
+    pub fn is_terminal(&self) -> bool {

@@ -334,0 +382,4 @@
+            .execute(&mut conn)
+            .await;
+
+        match insert_result {