@opendatalabs/personal-server-ts-server 0.0.1-canary.016adf9 → 0.0.1-canary.052d47e

package/dist/config/paths.js

@@ -0,0 +1,22 @@
+import { homedir } from "node:os";
+import { resolve } from "node:path";
+import { DEFAULT_ROOT_PATH } from "./defaults.js";
+/**
+ * Expands a leading "~" to the current user's home directory.
+ */
+export function expandHomePath(input) {
+    if (input === "~") {
+        return homedir();
+    }
+    if (input.startsWith("~/")) {
+        return resolve(homedir(), input.slice(2));
+    }
+    return input;
+}
+/**
+ * Resolves the configured root path (or default) to an absolute path.
+ */
+export function resolveRootPath(input) {
+    return resolve(expandHomePath(input ?? DEFAULT_ROOT_PATH));
+}
+//# sourceMappingURL=paths.js.map

package/dist/config/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/config/paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAElD;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;QAClB,OAAO,OAAO,EAAE,CAAC;IACnB,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,OAAO,OAAO,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,OAAO,OAAO,CAAC,cAAc,CAAC,KAAK,IAAI,iBAAiB,CAAC,CAAC,CAAC;AAC7D,CAAC"}

package/dist/enclave-main.d.ts

@@ -0,0 +1,10 @@
+import { type Address, type Hex } from "viem";
+export interface EnclaveEnv {
+    ownerSignature: Hex;
+    accessToken: string;
+    serverAddress: Address;
+    serverPublicKey: Hex;
+}
+export declare function readEnclaveEnv(env: NodeJS.ProcessEnv): EnclaveEnv;
+export declare function runEnclaveMain(): Promise<void>;
+//# sourceMappingURL=enclave-main.d.ts.map

package/dist/enclave-main.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enclave-main.d.ts","sourceRoot":"","sources":["../src/enclave-main.ts"],"names":[],"mappings":"AACA,OAAO,EAAoB,KAAK,OAAO,EAAE,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAahE,MAAM,WAAW,UAAU;IACzB,cAAc,EAAE,GAAG,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,OAAO,CAAC;IACvB,eAAe,EAAE,GAAG,CAAC;CACtB;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,UAAU,CAmCjE;AAED,wBAAsB,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CA6DpD"}

package/dist/enclave-main.js

@@ -0,0 +1,115 @@
+import { createPublicOnlyAccount } from "@opendatalabs/personal-server-ts-core/keys";
+import { isAddress, isHex } from "viem";
+import { createServer } from "./bootstrap.js";
+import { loadConfig } from "./config/index.js";
+import { listenHttpServer } from "./listen.js";
+const REQUIRED_ENV = [
+    "VANA_MASTER_KEY_SIGNATURE",
+    "PS_ACCESS_TOKEN",
+    "PS_SERVER_ADDRESS",
+    "PS_SERVER_PUBLIC_KEY",
+];
+const SYNC_DISABLED = "false";
+export function readEnclaveEnv(env) {
+    if (env.VANA_OWNER_PRIVATE_KEY) {
+        throw new Error("VANA_OWNER_PRIVATE_KEY is forbidden in enclave profile");
+    }
+    for (const key of REQUIRED_ENV) {
+        if (!env[key]) {
+            throw new Error(`${key} is required in enclave profile`);
+        }
+    }
+    const ownerSignature = env.VANA_MASTER_KEY_SIGNATURE;
+    const accessToken = env.PS_ACCESS_TOKEN;
+    const serverAddress = env.PS_SERVER_ADDRESS;
+    const serverPublicKey = env.PS_SERVER_PUBLIC_KEY;
+    // Drop the master signature before config and application code can inspect env.
+    delete env.VANA_MASTER_KEY_SIGNATURE;
+    if (!isHex(ownerSignature)) {
+        throw new Error("VANA_MASTER_KEY_SIGNATURE must be hex encoded");
+    }
+    if (!isAddress(serverAddress)) {
+        throw new Error("PS_SERVER_ADDRESS must be an address");
+    }
+    if (!isHex(serverPublicKey)) {
+        throw new Error("PS_SERVER_PUBLIC_KEY must be hex encoded");
+    }
+    return {
+        ownerSignature,
+        accessToken,
+        serverAddress,
+        serverPublicKey,
+    };
+}
+export async function runEnclaveMain() {
+    const enclaveEnv = readEnclaveEnv(process.env);
+    const rootPath = process.env.PERSONAL_SERVER_ROOT_PATH;
+    const config = await loadConfig({ rootPath });
+    if (process.env.GATEWAY_URL) {
+        config.gateway.url = process.env.GATEWAY_URL;
+    }
+    if (process.env.STORAGE_API_URL) {
+        let storageApiUrl;
+        try {
+            storageApiUrl = new URL(process.env.STORAGE_API_URL);
+        }
+        catch {
+            throw new Error("STORAGE_API_URL must be a valid absolute https URL");
+        }
+        if (storageApiUrl.protocol !== "https:") {
+            throw new Error("STORAGE_API_URL must be a valid absolute https URL");
+        }
+        config.storage.config.vana = {
+            ...config.storage.config.vana,
+            apiUrl: process.env.STORAGE_API_URL,
+        };
+    }
+    // Preview-testing hook; production fetch behaviour is unchanged when unset.
+    if (process.env.VERCEL_PROTECTION_BYPASS) {
+        installGatewayBypass(config.gateway.url, process.env.VERCEL_PROTECTION_BYPASS);
+    }
+    config.sync.enabled = process.env.SYNC_ENABLED !== SYNC_DISABLED;
+    config.devUi.enabled = false;
+    config.tunnel.enabled = false;
+    const serverAccount = createPublicOnlyAccount({
+        address: enclaveEnv.serverAddress,
+        publicKey: enclaveEnv.serverPublicKey,
+    });
+    const context = await createServer(config, {
+        rootPath,
+        ownerSignature: enclaveEnv.ownerSignature,
+        serverAccount,
+        profile: "enclave",
+    });
+    const server = await listenHttpServer({
+        fetch: context.app.fetch,
+        port: config.server.port,
+        onListening: (info) => {
+            context.logger.info({ port: info.port }, "Enclave server started");
+        },
+    });
+    void context.startBackgroundServices();
+    const shutdown = (signal) => {
+        context.logger.info({ signal }, "Shutdown signal received");
+        server.close(() => {
+            void context.cleanup();
+        });
+    };
+    process.on("SIGTERM", () => shutdown("SIGTERM"));
+    process.on("SIGINT", () => shutdown("SIGINT"));
+}
+function installGatewayBypass(gatewayUrl, secret) {
+    const gatewayOrigin = new URL(gatewayUrl).origin;
+    const requestFetch = globalThis.fetch;
+    globalThis.fetch = (input, init) => {
+        const requestUrl = new URL(input instanceof Request ? input.url : input.toString());
+        if (requestUrl.origin !== gatewayOrigin) {
+            return requestFetch(input, init);
+        }
+        const headers = new Headers(input instanceof Request ? input.headers : undefined);
+        new Headers(init?.headers).forEach((value, key) => headers.set(key, value));
+        headers.set("x-vercel-protection-bypass", secret);
+        return requestFetch(input, { ...init, headers });
+    };
+}
+//# sourceMappingURL=enclave-main.js.map

package/dist/enclave-main.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enclave-main.js","sourceRoot":"","sources":["../src/enclave-main.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,EAAE,SAAS,EAAE,KAAK,EAA0B,MAAM,MAAM,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C,MAAM,YAAY,GAAG;IACnB,2BAA2B;IAC3B,iBAAiB;IACjB,mBAAmB;IACnB,sBAAsB;CACd,CAAC;AACX,MAAM,aAAa,GAAG,OAAO,CAAC;AAS9B,MAAM,UAAU,cAAc,CAAC,GAAsB;IACnD,IAAI,GAAG,CAAC,sBAAsB,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,iCAAiC,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG,GAAG,CAAC,yBAAmC,CAAC;IAC/D,MAAM,WAAW,GAAG,GAAG,CAAC,eAAyB,CAAC;IAClD,MAAM,aAAa,GAAG,GAAG,CAAC,iBAA2B,CAAC;IACtD,MAAM,eAAe,GAAG,GAAG,CAAC,oBAA8B,CAAC;IAE3D,gFAAgF;IAChF,OAAO,GAAG,CAAC,yBAAyB,CAAC;IAErC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IAED,OAAO;QACL,cAAc;QACd,WAAW;QACX,aAAa;QACb,eAAe;KAChB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,MAAM,UAAU,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;IACvD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC9C,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QAC5B,MAAM,CAAC,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IAC/C,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC;QAChC,IAAI,aAAkB,CAAC;QACvB,IAAI,CAAC;YACH,aAAa,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,aAAa,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,GAAG;YAC3B,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI;YAC7B,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe;SACpC,CAAC;IACJ,CAAC;IACD,4EAA4E;IAC5E,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,CAAC;QACzC,oBAAoB,CAClB,MAAM,CAAC,OAAO,CAAC,GAAG,EAClB,OAAO,CAAC,GAAG,CAAC,wBAAwB,CACrC,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,aAAa,CAAC;IACjE,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC;IAC7B,MAAM,CAAC,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC;IAE9B,MAAM,aAAa,GAAG,uBAAuB,CAAC;QAC5C,OAAO,EAAE,UAAU,CAAC,aAAa;QACjC,SAAS,EAAE,UAAU,CAAC,eAAe;KACtC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE;QACzC,QAAQ;QACR,cAAc,EAAE,UAAU,CAAC,cAAc;QACzC,aAAa;QACb,OAAO,EAAE,SAAS;KACnB,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC;QACpC,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK;QACxB,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI;QACxB,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;YACpB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,wBAAwB,CAAC,CAAC;QACrE,CAAC;KACF,CAAC,CAAC;IAEH,KAAK,OAAO,CAAC,uBAAuB,EAAE,CAAC;IAEvC,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,EAAE;QAClC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,0BAA0B,CAAC,CAAC;QAC5D,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;YAChB,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC;QACzB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,oBAAoB,CAAC,UAAkB,EAAE,MAAc;IAC9D,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;IACjD,MAAM,YAAY,GAAG,UAAU,CAAC,KAAK,CAAC;IACtC,UAAU,CAAC,KAAK,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACjC,MAAM,UAAU,GAAG,IAAI,GAAG,CACxB,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,CACxD,CAAC;QACF,IAAI,UAAU,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;YACxC,OAAO,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACnC,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,OAAO,CACzB,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CACrD,CAAC;QACF,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;QAC5E,OAAO,CAAC,GAAG,CAAC,4BAA4B,EAAE,MAAM,CAAC,CAAC;QAElD,OAAO,YAAY,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACnD,CAAC,CAAC;AACJ,CAAC"}

package/dist/hono-context.d.ts

@@ -0,0 +1,14 @@
+import "hono";
+import type { GatewayGrantResponse } from "@opendatalabs/vana-sdk/node";
+import type { AuthMechanism, RequestAuth } from "./middleware/web3-auth.js";
+declare module "hono" {
+    interface ContextVariableMap {
+        auth: RequestAuth | undefined;
+        grant: GatewayGrantResponse | undefined;
+        authMechanism: AuthMechanism | undefined;
+        isPolicyBypass: boolean | undefined;
+        devBypass: boolean | undefined;
+    }
+}
+export {};
+//# sourceMappingURL=hono-context.d.ts.map

package/dist/hono-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hono-context.d.ts","sourceRoot":"","sources":["../src/hono-context.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,CAAC;AACd,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAE5E,OAAO,QAAQ,MAAM,CAAC;IACpB,UAAU,kBAAkB;QAC1B,IAAI,EAAE,WAAW,GAAG,SAAS,CAAC;QAC9B,KAAK,EAAE,oBAAoB,GAAG,SAAS,CAAC;QACxC,aAAa,EAAE,aAAa,GAAG,SAAS,CAAC;QACzC,cAAc,EAAE,OAAO,GAAG,SAAS,CAAC;QACpC,SAAS,EAAE,OAAO,GAAG,SAAS,CAAC;KAChC;CACF;AAED,OAAO,EAAE,CAAC"}

package/dist/hono-context.js

@@ -0,0 +1,2 @@
+import "hono";
+//# sourceMappingURL=hono-context.js.map

package/dist/hono-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hono-context.js","sourceRoot":"","sources":["../src/hono-context.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,CAAC"}

package/dist/index.js

@@ -1,23 +1,50 @@
-import { serve } from "@hono/node-server";
 import { createRequire } from "node:module";
-import { loadConfig } from "@opendatalabs/personal-server-ts-core/config";
+import { loadConfig } from "./config/index.js";
 import { createServer } from "./bootstrap.js";
 import { verifyTunnelUrl } from "./tunnel/index.js";
+import { runEnclaveMain } from "./enclave-main.js";
+import { listenHttpServer } from "./listen.js";
 const require = createRequire(import.meta.url);
 const pkg = require("../package.json");
 const DRAIN_TIMEOUT_MS = 5_000;
 async function main() {
+    if (process.env.ENCLAVE_MODE === "true") {
+        await runEnclaveMain();
+        return;
+    }
     const rootPath = process.env.PERSONAL_SERVER_ROOT_PATH;
     const config = await loadConfig({ rootPath });
     const context = await createServer(config, { rootPath });
     const { app, logger, devToken } = context;
-    const server = serve({ fetch: app.fetch, port: config.server.port }, (info) => {
-        logger.info({ port: info.port, version: pkg.version }, "Server started");
-        if (devToken) {
-            logger.info({ url: `http://localhost:${info.port}/ui` }, "Dev UI available");
-            logger.info({ devToken }, "Dev token (ephemeral)");
-        }
+    const server = await listenHttpServer({
+        fetch: app.fetch,
+        port: config.server.port,
+        onListening: (info) => {
+            logger.info({ port: info.port, version: pkg.version }, "Server started");
+            if (devToken) {
+                logger.info({ url: `http://localhost:${info.port}/ui` }, "Dev UI available");
+                logger.info({ devToken }, "Dev token (ephemeral)");
+            }
+        },
     });
+    let localAuthServer;
+    if (context.localApprovalPort) {
+        try {
+            localAuthServer = await listenHttpServer({
+                fetch: app.fetch,
+                port: context.localApprovalPort,
+                hostname: "127.0.0.1",
+                onListening: (info) => {
+                    const localApprovalOrigin = `http://127.0.0.1:${info.port}`;
+                    context.setLocalApprovalOrigin(localApprovalOrigin);
+                    logger.info({ localApprovalOrigin }, "Loopback auth listener started");
+                },
+            });
+        }
+        catch (err) {
+            logger.warn({ err, port: context.localApprovalPort }, "Loopback auth listener unavailable — public approval flow will require owner wallet auth");
+        }
+    }
     // Fire-and-forget: gateway check + tunnel connect (slow operations)
     // HTTP server is already listening so POST /v1/data/:scope works immediately
     context.startBackgroundServices().then(() => {
@@ -25,6 +52,7 @@ async function main() {
         const { tunnelManager, tunnelUrl } = context;
         if (tunnelUrl &&
             tunnelManager &&
+            context.isServerRegistered() &&
             tunnelManager.getStatus().status !== "error") {
             logger.info({ tunnelUrl }, "Verifying tunnel URL is reachable...");
             verifyTunnelUrl(tunnelUrl).then((result) => {
@@ -40,10 +68,18 @@ async function main() {
     });
     function shutdown(signal) {
         logger.info({ signal }, "Shutdown signal received, draining connections");
-        server.close(() => {
-            logger.info("Server stopped");
-            process.exit(0);
-        });
+        let pending = localAuthServer ? 2 : 1;
+        const finish = () => {
+            pending -= 1;
+            if (pending === 0) {
+                logger.info("Server stopped");
+                process.exit(0);
+            }
+        };
+        server.close(finish);
+        if (localAuthServer) {
+            localAuthServer.close(finish);
+        }
         // Force exit after drain timeout
         setTimeout(() => {
             logger.warn("Drain timeout exceeded, forcing exit");

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,8CAA8C,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEpD,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/C,MAAM,GAAG,GAAG,OAAO,CAAC,iBAAiB,CAAwB,CAAC;AAE9D,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAE/B,KAAK,UAAU,IAAI;IACjB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;IACvD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;IACzD,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IAE1C,MAAM,MAAM,GAAG,KAAK,CAClB,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAC9C,CAAC,IAAI,EAAE,EAAE;QACP,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,gBAAgB,CAAC,CAAC;QAEzE,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CACT,EAAE,GAAG,EAAE,oBAAoB,IAAI,CAAC,IAAI,KAAK,EAAE,EAC3C,kBAAkB,CACnB,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,uBAAuB,CAAC,CAAC;QACrD,CAAC;IACH,CAAC,CACF,CAAC;IAEF,oEAAoE;IACpE,6EAA6E;IAC7E,OAAO,CAAC,uBAAuB,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;QAC1C,6EAA6E;QAC7E,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;QAC7C,IACE,SAAS;YACT,aAAa;YACb,aAAa,CAAC,SAAS,EAAE,CAAC,MAAM,KAAK,OAAO,EAC5C,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,EAAE,sCAAsC,CAAC,CAAC;YACnE,eAAe,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;gBACzC,aAAa,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC1D,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;oBACrB,MAAM,CAAC,IAAI,CACT,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,EACxC,qBAAqB,CACtB,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,IAAI,CACT,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAC7D,8DAA8D,CAC/D,CAAC;gBACJ,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,SAAS,QAAQ,CAAC,MAAc;QAC9B,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,gDAAgD,CAAC,CAAC;QAE1E,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;YAChB,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAC9B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;QAEH,iCAAiC;QACjC,UAAU,CAAC,GAAG,EAAE;YACd,MAAM,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;YACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,EAAE,gBAAgB,CAAC,CAAC,KAAK,EAAE,CAAC;IAC/B,CAAC;IAED,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;IAC9C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAmB,MAAM,aAAa,CAAC;AAEhE,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/C,MAAM,GAAG,GAAG,OAAO,CAAC,iBAAiB,CAAwB,CAAC;AAE9D,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAC/B,KAAK,UAAU,IAAI;IACjB,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;QACxC,MAAM,cAAc,EAAE,CAAC;QACvB,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;IACvD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;IACzD,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IAE1C,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC;QACpC,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI;QACxB,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;YACpB,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,gBAAgB,CAAC,CAAC;YAEzE,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CACT,EAAE,GAAG,EAAE,oBAAoB,IAAI,CAAC,IAAI,KAAK,EAAE,EAC3C,kBAAkB,CACnB,CAAC;gBACF,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,uBAAuB,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;KACF,CAAC,CAAC;IAEH,IAAI,eAAuC,CAAC;IAC5C,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,eAAe,GAAG,MAAM,gBAAgB,CAAC;gBACvC,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,IAAI,EAAE,OAAO,CAAC,iBAAiB;gBAC/B,QAAQ,EAAE,WAAW;gBACrB,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;oBACpB,MAAM,mBAAmB,GAAG,oBAAoB,IAAI,CAAC,IAAI,EAAE,CAAC;oBAC5D,OAAO,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,CAAC;oBACpD,MAAM,CAAC,IAAI,CACT,EAAE,mBAAmB,EAAE,EACvB,gCAAgC,CACjC,CAAC;gBACJ,CAAC;aACF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CACT,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,iBAAiB,EAAE,EACxC,0FAA0F,CAC3F,CAAC;QACJ,CAAC;IACH,CAAC;IAED,oEAAoE;IACpE,6EAA6E;IAC7E,OAAO,CAAC,uBAAuB,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;QAC1C,6EAA6E;QAC7E,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;QAC7C,IACE,SAAS;YACT,aAAa;YACb,OAAO,CAAC,kBAAkB,EAAE;YAC5B,aAAa,CAAC,SAAS,EAAE,CAAC,MAAM,KAAK,OAAO,EAC5C,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,EAAE,sCAAsC,CAAC,CAAC;YACnE,eAAe,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;gBACzC,aAAa,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC1D,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;oBACrB,MAAM,CAAC,IAAI,CACT,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,EACxC,qBAAqB,CACtB,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,IAAI,CACT,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAC7D,8DAA8D,CAC/D,CAAC;gBACJ,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,SAAS,QAAQ,CAAC,MAAc;QAC9B,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,gDAAgD,CAAC,CAAC;QAE1E,IAAI,OAAO,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,GAAG,EAAE;YAClB,OAAO,IAAI,CAAC,CAAC;YACb,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;gBAClB,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;gBAC9B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC,CAAC;QAEF,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACrB,IAAI,eAAe,EAAE,CAAC;YACpB,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;QAED,iCAAiC;QACjC,UAAU,CAAC,GAAG,EAAE;YACd,MAAM,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;YACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,EAAE,gBAAgB,CAAC,CAAC,KAAK,EAAE,CAAC;IAC/B,CAAC;IAED,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;IAC9C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/jobs/types.d.ts

@@ -0,0 +1,17 @@
+import type { Hex } from "viem";
+export type JobFailureCode = "AUTH_INVALID" | "BUILDER_MISMATCH" | "OWNER_MISMATCH" | "GRANT_REVOKED" | "GRANT_INVALID" | "SIGNED_ARTIFACT_MISSING" | "SIGNED_ARTIFACT_INVALID" | "SERVER_NOT_REGISTERED" | "SCOPE_NOT_FOUND" | "VERSION_MISMATCH" | "DEADLINE_PASSED" | "RESULT_TOO_LARGE" | "INTERNAL";
+export interface JobExecuteResponse {
+    /** Base64 ECIES bytes: iv || ephemeral public key || ciphertext || MAC. */
+    resultCiphertext: string;
+    /** SHA-256 of ciphertext bytes. */
+    resultHash: Hex;
+    resultSize: number;
+}
+export interface JobExecuteError {
+    error: {
+        code: JobFailureCode;
+        message: string;
+        retryable: boolean;
+    };
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/jobs/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/jobs/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAGhC,MAAM,MAAM,cAAc,GACtB,cAAc,GACd,kBAAkB,GAClB,gBAAgB,GAChB,eAAe,GACf,eAAe,GACf,yBAAyB,GACzB,yBAAyB,GACzB,uBAAuB,GACvB,iBAAiB,GACjB,kBAAkB,GAClB,iBAAiB,GACjB,kBAAkB,GAClB,UAAU,CAAC;AAEf,MAAM,WAAW,kBAAkB;IACjC,2EAA2E;IAC3E,gBAAgB,EAAE,MAAM,CAAC;IACzB,mCAAmC;IACnC,UAAU,EAAE,GAAG,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE;QACL,IAAI,EAAE,cAAc,CAAC;QACrB,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,OAAO,CAAC;KACpB,CAAC;CACH"}

package/dist/jobs/types.js

@@ -0,0 +1,3 @@
+export {};
+// JOB_EXECUTE_WIRE_END
+//# sourceMappingURL=types.js.map

package/dist/jobs/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/jobs/types.ts"],"names":[],"mappings":";AAiCA,uBAAuB"}

package/dist/jobs/worker.d.ts

@@ -0,0 +1,30 @@
+import type { AccessLogWriter } from "@opendatalabs/personal-server-ts-core/logging/access-log";
+import type { DataStoragePort, ProtocolGatewayPort } from "@opendatalabs/personal-server-ts-core/ports";
+import type { ScopeDeletionTracker } from "@opendatalabs/personal-server-ts-core/sync";
+import { type DataPortabilityGatewayConfig } from "@opendatalabs/vana-sdk/node";
+import { type JobRequestEnvelope } from "@opendatalabs/vana-sdk/protocol/jobs";
+import type { ECIESProvider } from "@opendatalabs/vana-sdk/crypto/ecies/interface";
+import type { Logger } from "pino";
+import { type Address, type Hex } from "viem";
+import type { JobExecuteResponse, JobFailureCode } from "./types.js";
+export interface JobWorkerDeps {
+    serverOwner: Address;
+    serverAddress: Address;
+    serverPublicKey: Hex;
+    authAudience: string;
+    gateway: ProtocolGatewayPort;
+    gatewayConfig: DataPortabilityGatewayConfig;
+    storage: DataStoragePort;
+    ecies: ECIESProvider;
+    now?: () => Date;
+    logger: Logger;
+    accessLogWriter: AccessLogWriter;
+    scopeDeletions?: ScopeDeletionTracker;
+}
+export declare class JobFailure extends Error {
+    readonly code: JobFailureCode;
+    readonly retryable: boolean;
+    constructor(code: JobFailureCode, message: string, retryable: boolean);
+}
+export declare function executeJob(envelope: JobRequestEnvelope, deps: JobWorkerDeps): Promise<JobExecuteResponse>;
+//# sourceMappingURL=worker.d.ts.map

package/dist/jobs/worker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker.d.ts","sourceRoot":"","sources":["../../src/jobs/worker.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAChG,OAAO,KAAK,EACV,eAAe,EACf,mBAAmB,EACpB,MAAM,6CAA6C,CAAC;AAKrD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,4CAA4C,CAAC;AACvF,OAAO,EAEL,KAAK,4BAA4B,EAClC,MAAM,6BAA6B,CAAC;AAKrC,OAAO,EAGL,KAAK,kBAAkB,EAExB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+CAA+C,CAAC;AACnF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AACnC,OAAO,EAAkB,KAAK,OAAO,EAAE,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAE9D,OAAO,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAUrE,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,OAAO,CAAC;IACrB,aAAa,EAAE,OAAO,CAAC;IACvB,eAAe,EAAE,GAAG,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,mBAAmB,CAAC;IAC7B,aAAa,EAAE,4BAA4B,CAAC;IAC5C,OAAO,EAAE,eAAe,CAAC;IACzB,KAAK,EAAE,aAAa,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,eAAe,CAAC;IACjC,cAAc,CAAC,EAAE,oBAAoB,CAAC;CACvC;AAED,qBAAa,UAAW,SAAQ,KAAK;aAEjB,IAAI,EAAE,cAAc;aAEpB,SAAS,EAAE,OAAO;gBAFlB,IAAI,EAAE,cAAc,EACpC,OAAO,EAAE,MAAM,EACC,SAAS,EAAE,OAAO;CAKrC;AAED,wBAAsB,UAAU,CAC9B,QAAQ,EAAE,kBAAkB,EAC5B,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,kBAAkB,CAAC,CAc7B"}

package/dist/jobs/worker.js

@@ -0,0 +1,217 @@
+import { randomUUID } from "node:crypto";
+import { assertScopeNotDeleted, redactEnvelopeForGrantee, } from "@opendatalabs/personal-server-ts-core/api";
+import { readDataContract } from "@opendatalabs/personal-server-ts-core/contracts";
+import { DataDeletedError, GrantRevokedError, InvalidSignatureError, ProtocolError, SignedArtifactInvalidError, SignedArtifactMissingError, UnregisteredBuilderError, } from "@opendatalabs/personal-server-ts-core/errors";
+import { verifyDataReadPolicy, verifySignedArtifacts, } from "@opendatalabs/personal-server-ts-core/policy";
+import { verifyWeb3Signed, } from "@opendatalabs/vana-sdk/node";
+import { canonicalJobRequestBytes, sealJobResult, } from "@opendatalabs/vana-sdk/crypto/envelope/job";
+import { JOB_PROTOCOL_VERSION, MAX_INLINE_RESULT_BYTES, } from "@opendatalabs/vana-sdk/protocol/jobs";
+import { isAddressEqual } from "viem";
+import { publicKeyToAddress } from "viem/accounts";
+const RAW_READ = "raw_read";
+const EXECUTE_PATH = "/v1/jobs/execute";
+const POST = "POST";
+const JSON_CONTENT_TYPE = "application/json";
+const UNKNOWN_METADATA = "unknown";
+const MILLISECONDS_PER_SECOND = 1_000;
+const JOB_EXECUTION_FAILED_LOG = "Enclave job execution failed";
+export class JobFailure extends Error {
+    code;
+    retryable;
+    constructor(code, message, retryable) {
+        super(message);
+        this.code = code;
+        this.retryable = retryable;
+        this.name = "JobFailure";
+    }
+}
+export async function executeJob(envelope, deps) {
+    try {
+        return await executeJobUnsafe(envelope, deps);
+    }
+    catch (error) {
+        if (error instanceof JobFailure) {
+            throw error;
+        }
+        deps.logger.warn({ jobId: envelope.request.jobId, error: errorSummary(error) }, JOB_EXECUTION_FAILED_LOG);
+        throw new JobFailure("INTERNAL", "job execution failed", true);
+    }
+}
+async function executeJobUnsafe(envelope, deps) {
+    const { request } = envelope;
+    if (request.v !== JOB_PROTOCOL_VERSION) {
+        throw new JobFailure("INTERNAL", "protocol version not supported", false);
+    }
+    if (request.operation !== RAW_READ) {
+        throw new JobFailure("INTERNAL", "operation not supported", false);
+    }
+    const now = deps.now?.() ?? new Date();
+    if (!validDeadline(request.deadline, now)) {
+        throw new JobFailure("DEADLINE_PASSED", "job deadline passed", false);
+    }
+    const auth = await verifyJobAuth(envelope, deps.authAudience, now);
+    if (!sameAddress(auth.signer, request.builder)) {
+        throw new JobFailure("BUILDER_MISMATCH", "builder identity mismatch", false);
+    }
+    if (!sameAddress(request.owner, deps.serverOwner)) {
+        throw new JobFailure("OWNER_MISMATCH", "job owner mismatch", false);
+    }
+    let grant;
+    try {
+        grant = await verifyDataReadPolicy({
+            signer: request.builder,
+            grantId: request.grantId,
+            requestedScope: request.scope,
+            serverOwner: deps.serverOwner,
+        }, { authSessionVerifier: deps.gateway, grantVerifier: deps.gateway });
+    }
+    catch (error) {
+        throw mapPolicyFailure(error);
+    }
+    const builder = await deps.gateway.getBuilder(request.builder);
+    if (!builder) {
+        throw new JobFailure("BUILDER_MISMATCH", "builder is not registered", false);
+    }
+    try {
+        await verifySignedArtifacts({
+            grant,
+            builder,
+            gatewayConfig: deps.gatewayConfig,
+            ownerAddress: deps.serverOwner,
+        });
+    }
+    catch (error) {
+        throw mapArtifactFailure(error);
+    }
+    let builderKeyAddress;
+    try {
+        builderKeyAddress = publicKeyToAddress(builder.publicKey);
+    }
+    catch {
+        throw new JobFailure("SIGNED_ARTIFACT_INVALID", "builder public key is invalid", false);
+    }
+    if (!sameAddress(builderKeyAddress, request.builder) ||
+        builder.publicKey.toLowerCase() !== request.builderPublicKey.toLowerCase()) {
+        throw new JobFailure("BUILDER_MISMATCH", "builder key mismatch", false);
+    }
+    const registration = await deps.gateway.getServer(deps.serverAddress);
+    if (!registration ||
+        registration.revokedAt !== null ||
+        !sameAddress(registration.ownerAddress, deps.serverOwner) ||
+        registration.publicKey.toLowerCase() !== deps.serverPublicKey.toLowerCase()) {
+        throw new JobFailure("SERVER_NOT_REGISTERED", "server registration is invalid", false);
+    }
+    const entry = deps.storage.findEntry({ scope: request.scope });
+    try {
+        await assertScopeNotDeleted({ scopeDeletions: deps.scopeDeletions, serverOwner: deps.serverOwner }, request.scope, entry);
+    }
+    catch (error) {
+        if (error instanceof DataDeletedError) {
+            throw new JobFailure("SCOPE_NOT_FOUND", "scope not found", false);
+        }
+        throw error;
+    }
+    const read = await readDataContract({
+        storage: deps.storage,
+        scopeParam: request.scope,
+    });
+    if (!read.ok || !entry) {
+        throw new JobFailure("SCOPE_NOT_FOUND", "scope not found", false);
+    }
+    const localVersion = await deps.storage.findLatestVersionByScope(request.scope);
+    if (request.pinnedVersion !== null &&
+        String(localVersion) !== request.pinnedVersion) {
+        throw new JobFailure("VERSION_MISMATCH", "scope version mismatch", true);
+    }
+    const redacted = redactEnvelopeForGrantee(read.envelope);
+    const result = {
+        v: JOB_PROTOCOL_VERSION,
+        jobId: request.jobId,
+        scope: request.scope,
+        version: localVersion === 0 ? null : String(localVersion),
+        contentType: JSON_CONTENT_TYPE,
+        body: Buffer.from(JSON.stringify(redacted)).toString("base64"),
+    };
+    const sealed = await sealJobResult(result, request.builderPublicKey, deps.ecies);
+    if (sealed.size > MAX_INLINE_RESULT_BYTES) {
+        throw new JobFailure("RESULT_TOO_LARGE", "encrypted result is too large", false);
+    }
+    await deps.accessLogWriter.write({
+        logId: randomUUID(),
+        grantId: request.grantId,
+        builder: request.builder,
+        action: "read",
+        scope: request.scope,
+        timestamp: now.toISOString(),
+        ipAddress: UNKNOWN_METADATA,
+        userAgent: UNKNOWN_METADATA,
+    });
+    deps.logger.info({ jobId: request.jobId, scope: request.scope, version: localVersion }, "Enclave job read served");
+    return {
+        resultCiphertext: sealed.ciphertext,
+        resultHash: sealed.hash,
+        resultSize: sealed.size,
+    };
+}
+async function verifyJobAuth(envelope, authAudience, now) {
+    try {
+        // aud = Gateway origin; contract section 1 step 1 amendment.
+        return await verifyWeb3Signed({
+            headerValue: envelope.auth,
+            expectedOrigin: authAudience,
+            expectedMethod: POST,
+            expectedPath: EXECUTE_PATH,
+            bodyBytes: canonicalJobRequestBytes(envelope.request),
+            now: Math.floor(now.getTime() / MILLISECONDS_PER_SECOND),
+        });
+    }
+    catch {
+        throw new JobFailure("AUTH_INVALID", "job authorization is invalid", false);
+    }
+}
+function mapPolicyFailure(error) {
+    if (error instanceof GrantRevokedError) {
+        return new JobFailure("GRANT_REVOKED", "grant is revoked", false);
+    }
+    if (error instanceof InvalidSignatureError ||
+        error instanceof UnregisteredBuilderError) {
+        return new JobFailure("BUILDER_MISMATCH", "builder is not authorized", false);
+    }
+    if (error instanceof ProtocolError) {
+        return new JobFailure("GRANT_INVALID", "grant is invalid", false);
+    }
+    return new JobFailure("INTERNAL", "policy verification failed", true);
+}
+function mapArtifactFailure(error) {
+    if (error instanceof SignedArtifactMissingError) {
+        return new JobFailure("SIGNED_ARTIFACT_MISSING", "signed artifact is missing", false);
+    }
+    if (error instanceof GrantRevokedError) {
+        return new JobFailure("GRANT_REVOKED", "grant is revoked", false);
+    }
+    if (error instanceof SignedArtifactInvalidError) {
+        return new JobFailure("SIGNED_ARTIFACT_INVALID", "signed artifact is invalid", false);
+    }
+    if (error instanceof ProtocolError) {
+        return new JobFailure("SIGNED_ARTIFACT_INVALID", "signed artifact is invalid", false);
+    }
+    return new JobFailure("INTERNAL", "artifact verification failed", true);
+}
+function errorSummary(error) {
+    return error instanceof Error
+        ? `${error.name}: ${error.message}`
+        : String(error);
+}
+function validDeadline(deadline, now) {
+    const timestamp = Date.parse(deadline);
+    return Number.isFinite(timestamp) && timestamp > now.getTime();
+}
+function sameAddress(left, right) {
+    try {
+        return isAddressEqual(left, right);
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=worker.js.map

package/dist/jobs/worker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker.js","sourceRoot":"","sources":["../../src/jobs/worker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iDAAiD,CAAC;AACnF,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,qBAAqB,EACrB,aAAa,EACb,0BAA0B,EAC1B,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,8CAA8C,CAAC;AAMtD,OAAO,EACL,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,8CAA8C,CAAC;AAEtD,OAAO,EACL,gBAAgB,GAEjB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,wBAAwB,EACxB,aAAa,GACd,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,oBAAoB,EACpB,uBAAuB,GAGxB,MAAM,sCAAsC,CAAC;AAG9C,OAAO,EAAE,cAAc,EAA0B,MAAM,MAAM,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAGnD,MAAM,QAAQ,GAAG,UAAU,CAAC;AAC5B,MAAM,YAAY,GAAG,kBAAkB,CAAC;AACxC,MAAM,IAAI,GAAG,MAAM,CAAC;AACpB,MAAM,iBAAiB,GAAG,kBAAkB,CAAC;AAC7C,MAAM,gBAAgB,GAAG,SAAS,CAAC;AACnC,MAAM,uBAAuB,GAAG,KAAK,CAAC;AACtC,MAAM,wBAAwB,GAAG,8BAA8B,CAAC;AAiBhE,MAAM,OAAO,UAAW,SAAQ,KAAK;IAEjB;IAEA;IAHlB,YACkB,IAAoB,EACpC,OAAe,EACC,SAAkB;QAElC,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,SAAI,GAAJ,IAAI,CAAgB;QAEpB,cAAS,GAAT,SAAS,CAAS;QAGlC,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,QAA4B,EAC5B,IAAmB;IAEnB,IAAI,CAAC;QACH,OAAO,MAAM,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;YAChC,MAAM,KAAK,CAAC;QACd,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,EAAE,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,EAC7D,wBAAwB,CACzB,CAAC;QACF,MAAM,IAAI,UAAU,CAAC,UAAU,EAAE,sBAAsB,EAAE,IAAI,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,QAA4B,EAC5B,IAAmB;IAEnB,MAAM,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC;IAC7B,IAAI,OAAO,CAAC,CAAC,KAAK,oBAAoB,EAAE,CAAC;QACvC,MAAM,IAAI,UAAU,CAAC,UAAU,EAAE,gCAAgC,EAAE,KAAK,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,IAAI,UAAU,CAAC,UAAU,EAAE,yBAAyB,EAAE,KAAK,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC;IACvC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,qBAAqB,EAAE,KAAK,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IACnE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,UAAU,CAClB,kBAAkB,EAClB,2BAA2B,EAC3B,KAAK,CACN,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,oBAAoB,EAAE,KAAK,CAAC,CAAC;IACtE,CAAC;IAED,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,oBAAoB,CAChC;YACE,MAAM,EAAE,OAAO,CAAC,OAAO;YACvB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,cAAc,EAAE,OAAO,CAAC,KAAK;YAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,EACD,EAAE,mBAAmB,EAAE,IAAI,CAAC,OAAO,EAAE,aAAa,EAAE,IAAI,CAAC,OAAO,EAAE,CACnE,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/D,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,UAAU,CAClB,kBAAkB,EAClB,2BAA2B,EAC3B,KAAK,CACN,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,qBAAqB,CAAC;YAC1B,KAAK;YACL,OAAO;YACP,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,YAAY,EAAE,IAAI,CAAC,WAAW;SAC/B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;IAED,IAAI,iBAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,iBAAiB,GAAG,kBAAkB,CAAC,OAAO,CAAC,SAAgB,CAAC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,UAAU,CAClB,yBAAyB,EACzB,+BAA+B,EAC/B,KAAK,CACN,CAAC;IACJ,CAAC;IACD,IACE,CAAC,WAAW,CAAC,iBAAiB,EAAE,OAAO,CAAC,OAAO,CAAC;QAChD,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,gBAAgB,CAAC,WAAW,EAAE,EAC1E,CAAC;QACD,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,sBAAsB,EAAE,KAAK,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACtE,IACE,CAAC,YAAY;QACb,YAAY,CAAC,SAAS,KAAK,IAAI;QAC/B,CAAC,WAAW,CAAC,YAAY,CAAC,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC;QACzD,YAAY,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,EAC3E,CAAC;QACD,MAAM,IAAI,UAAU,CAClB,uBAAuB,EACvB,gCAAgC,EAChC,KAAK,CACN,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IAC/D,IAAI,CAAC;QACH,MAAM,qBAAqB,CACzB,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,EACtE,OAAO,CAAC,KAAK,EACb,KAAK,CACN,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,gBAAgB,EAAE,CAAC;YACtC,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,iBAAiB,EAAE,KAAK,CAAC,CAAC;QACpE,CAAC;QAED,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC;QAClC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,UAAU,EAAE,OAAO,CAAC,KAAK;KAC1B,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QACvB,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,iBAAiB,EAAE,KAAK,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,wBAAwB,CAC9D,OAAO,CAAC,KAAK,CACd,CAAC;IACF,IACE,OAAO,CAAC,aAAa,KAAK,IAAI;QAC9B,MAAM,CAAC,YAAY,CAAC,KAAK,OAAO,CAAC,aAAa,EAC9C,CAAC;QACD,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,wBAAwB,EAAE,IAAI,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,QAAQ,GAAG,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzD,MAAM,MAAM,GAAc;QACxB,CAAC,EAAE,oBAAoB;QACvB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,OAAO,EAAE,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC;QACzD,WAAW,EAAE,iBAAiB;QAC9B,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;KAC/D,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,aAAa,CAChC,MAAM,EACN,OAAO,CAAC,gBAAgB,EACxB,IAAI,CAAC,KAAK,CACX,CAAC;IACF,IAAI,MAAM,CAAC,IAAI,GAAG,uBAAuB,EAAE,CAAC;QAC1C,MAAM,IAAI,UAAU,CAClB,kBAAkB,EAClB,+BAA+B,EAC/B,KAAK,CACN,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC;QAC/B,KAAK,EAAE,UAAU,EAAE;QACnB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,MAAM;QACd,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;QAC5B,SAAS,EAAE,gBAAgB;QAC3B,SAAS,EAAE,gBAAgB;KAC5B,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,EACrE,yBAAyB,CAC1B,CAAC;IAEF,OAAO;QACL,gBAAgB,EAAE,MAAM,CAAC,UAAU;QACnC,UAAU,EAAE,MAAM,CAAC,IAAI;QACvB,UAAU,EAAE,MAAM,CAAC,IAAI;KACxB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,QAA4B,EAC5B,YAAoB,EACpB,GAAS;IAET,IAAI,CAAC;QACH,6DAA6D;QAC7D,OAAO,MAAM,gBAAgB,CAAC;YAC5B,WAAW,EAAE,QAAQ,CAAC,IAAI;YAC1B,cAAc,EAAE,YAAY;YAC5B,cAAc,EAAE,IAAI;YACpB,YAAY,EAAE,YAAY;YAC1B,SAAS,EAAE,wBAAwB,CAAC,QAAQ,CAAC,OAAO,CAAC;YACrD,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,uBAAuB,CAAC;SACzD,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,UAAU,CAAC,cAAc,EAAE,8BAA8B,EAAE,KAAK,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,KAAK,YAAY,iBAAiB,EAAE,CAAC;QACvC,OAAO,IAAI,UAAU,CAAC,eAAe,EAAE,kBAAkB,EAAE,KAAK,CAAC,CAAC;IACpE,CAAC;IACD,IACE,KAAK,YAAY,qBAAqB;QACtC,KAAK,YAAY,wBAAwB,EACzC,CAAC;QACD,OAAO,IAAI,UAAU,CACnB,kBAAkB,EAClB,2BAA2B,EAC3B,KAAK,CACN,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,YAAY,aAAa,EAAE,CAAC;QACnC,OAAO,IAAI,UAAU,CAAC,eAAe,EAAE,kBAAkB,EAAE,KAAK,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,IAAI,UAAU,CAAC,UAAU,EAAE,4BAA4B,EAAE,IAAI,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,KAAK,YAAY,0BAA0B,EAAE,CAAC;QAChD,OAAO,IAAI,UAAU,CACnB,yBAAyB,EACzB,4BAA4B,EAC5B,KAAK,CACN,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,YAAY,iBAAiB,EAAE,CAAC;QACvC,OAAO,IAAI,UAAU,CAAC,eAAe,EAAE,kBAAkB,EAAE,KAAK,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,KAAK,YAAY,0BAA0B,EAAE,CAAC;QAChD,OAAO,IAAI,UAAU,CACnB,yBAAyB,EACzB,4BAA4B,EAC5B,KAAK,CACN,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,YAAY,aAAa,EAAE,CAAC;QACnC,OAAO,IAAI,UAAU,CACnB,yBAAyB,EACzB,4BAA4B,EAC5B,KAAK,CACN,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,UAAU,CAAC,UAAU,EAAE,8BAA8B,EAAE,IAAI,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,KAAK,YAAY,KAAK;QAC3B,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE;QACnC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB,EAAE,GAAS;IAChD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAEvC,OAAO,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;AACjE,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,KAAa;IAC9C,IAAI,CAAC;QACH,OAAO,cAAc,CAAC,IAAe,EAAE,KAAgB,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/keys/server-account.d.ts

@@ -0,0 +1,28 @@
+/**
+ * ServerAccount wraps a randomly generated private key for EIP-712 signing.
+ * The key is persisted to disk so the same address survives restarts.
+ */
+import type { TypedDataDomain } from "viem";
+export interface SignTypedDataParams {
+    domain: TypedDataDomain;
+    types: Record<string, Array<{
+        name: string;
+        type: string;
+    }>>;
+    primaryType: string;
+    message: Record<string, unknown>;
+}
+export interface ServerAccount {
+    address: `0x${string}`;
+    /** Uncompressed public key (65 bytes, 0x04 prefix). */
+    publicKey: `0x${string}`;
+    signTypedData(params: SignTypedDataParams): Promise<`0x${string}`>;
+    /** Sign a personal message (EIP-191). */
+    signMessage(message: string): Promise<`0x${string}`>;
+}
+/**
+ * Loads an existing server keypair from disk, or generates a new random one
+ * and persists it. Returns a ServerAccount suitable for EIP-712 signing.
+ */
+export declare function loadOrCreateServerAccount(keyPath: string): ServerAccount;
+//# sourceMappingURL=server-account.d.ts.map

package/dist/keys/server-account.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-account.d.ts","sourceRoot":"","sources":["../../src/keys/server-account.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,MAAM,CAAC;AAE5C,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,eAAe,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;IAC7D,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,KAAK,MAAM,EAAE,CAAC;IACvB,uDAAuD;IACvD,SAAS,EAAE,KAAK,MAAM,EAAE,CAAC;IACzB,aAAa,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC;IACnE,yCAAyC;IACzC,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC;CACtD;AAQD;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,CA2CxE"}