@opendatalabs/vana-sdk 3.20.1 → 3.22.0-pr.207.0a5d07b

package/dist/index.node.cjs

@@ -1180,15 +1180,23 @@ __export(index_node_exports, {
   BUILDER_REGISTRATION_TYPES: () => BUILDER_REGISTRATION_TYPES,
   BlockchainError: () => BlockchainError,
   BrowserPlatformAdapter: () => BrowserPlatformAdapter,
+  BuilderUnknownError: () => BuilderUnknownError,
+  CLAIM_POLL_FLOOR_MS: () => CLAIM_POLL_FLOOR_MS,
   CONTRACTS: () => CONTRACTS,
   CallbackStorage: () => CallbackStorage,
   ContractFactory: () => ContractFactory,
   ContractNotFoundError: () => ContractNotFoundError,
   DATA_ACCESS_OP_TYPE: () => DATA_ACCESS_OP_TYPE,
   DATA_REGISTRY_STATUS_ABI: () => DATA_REGISTRY_STATUS_ABI,
+  DEFAULT_DERIVATIVE_STATUS_POLL_INTERVAL_MS: () => DEFAULT_DERIVATIVE_STATUS_POLL_INTERVAL_MS,
+  DEFAULT_DERIVATIVE_STATUS_TIMEOUT_MS: () => DEFAULT_DERIVATIVE_STATUS_TIMEOUT_MS,
+  DEFAULT_JOB_DEADLINE_SECONDS: () => DEFAULT_JOB_DEADLINE_SECONDS,
+  DEFAULT_LEASE_SECONDS: () => DEFAULT_LEASE_SECONDS,
   DEFAULT_QUESTION_POLL_INTERVAL_MS: () => DEFAULT_QUESTION_POLL_INTERVAL_MS,
   DEFAULT_QUESTION_TIMEOUT_MS: () => DEFAULT_QUESTION_TIMEOUT_MS,
+  DERIVATIVE_ERROR_CODES: () => DERIVATIVE_ERROR_CODES,
   DERIVATIVE_QUESTIONS_PATH: () => DERIVATIVE_QUESTIONS_PATH,
+  DERIVATIVE_STATUS_PATH: () => DERIVATIVE_STATUS_PATH,
   DataFileEnvelopeSchema: () => DataFileEnvelopeSchema,
   DataPointDeletedError: () => DataPointDeletedError,
   DataPointNotFoundError: () => DataPointNotFoundError,
@@ -1197,6 +1205,7 @@ __export(index_node_exports, {
   DerivativeComputeUnavailableError: () => DerivativeComputeUnavailableError,
   DerivativeCycleError: () => DerivativeCycleError,
   DerivativeDerivedScopeRequiredError: () => DerivativeDerivedScopeRequiredError,
+  DerivativeErrorCodeSchema: () => DerivativeErrorCodeSchema,
   DerivativeQuestionFailedError: () => DerivativeQuestionFailedError,
   DerivativeQuestionInvalidError: () => DerivativeQuestionInvalidError,
   DerivativeQuestionNotFoundError: () => DerivativeQuestionNotFoundError,
@@ -1204,8 +1213,12 @@ __export(index_node_exports, {
   DerivativeQuestionSchema: () => DerivativeQuestionSchema,
   DerivativeQuestionTimeoutError: () => DerivativeQuestionTimeoutError,
   DerivativeSourceNotGrantedError: () => DerivativeSourceNotGrantedError,
+  DerivativeStatusSchema: () => DerivativeStatusSchema,
   DropboxStorage: () => DropboxStorage,
   ECIESError: () => ECIESError,
+  ENCLAVE_IDENTITY_EVIDENCE_VERSION: () => ENCLAVE_IDENTITY_EVIDENCE_VERSION,
+  ENCLAVE_TRUST_ANCHORS: () => ENCLAVE_TRUST_ANCHORS,
+  ENCLAVE_WALLET_PURPOSE: () => ENCLAVE_WALLET_PURPOSE,
   ESCROW_DEPOSIT_ABI: () => ESCROW_DEPOSIT_ABI2,
   ExpiredTokenError: () => ExpiredTokenError,
   FEE_REGISTRY_ABI: () => FEE_REGISTRY_ABI,
@@ -1214,12 +1227,24 @@ __export(index_node_exports, {
   GRANT_REGISTRATION_TYPES: () => GRANT_REGISTRATION_TYPES,
   GRANT_REVOCATION_TYPES: () => GRANT_REVOCATION_TYPES,
   GoogleDriveStorage: () => GoogleDriveStorage,
+  GrantInvalidError: () => GrantInvalidError,
   InMemoryTokenStore: () => InMemoryTokenStore,
   IngestResponseSchema: () => IngestResponseSchema,
   InvalidConfigurationError: () => InvalidConfigurationError,
   InvalidScopeEntryError: () => InvalidScopeEntryError,
   InvalidSignatureError: () => InvalidSignatureError,
   IpfsStorage: () => IpfsStorage,
+  JOB_OPERATIONS: () => JOB_OPERATIONS,
+  JOB_PROTOCOL_VERSION: () => JOB_PROTOCOL_VERSION,
+  JOB_STATES: () => JOB_STATES,
+  JobEnvelopeError: () => JobEnvelopeError,
+  JobIdTakenError: () => JobIdTakenError,
+  JobNotFoundError: () => JobNotFoundError,
+  JobRejectedError: () => JobRejectedError,
+  JobRequestTooLargeError: () => JobRequestTooLargeError,
+  JobTimeoutError: () => JobTimeoutError,
+  JobTransportError: () => JobTransportError,
+  JobsClientError: () => JobsClientError,
   LINEAGE_FIELD: () => LINEAGE_FIELD,
   LINEAGE_KEY: () => LINEAGE_KEY,
   LineageEntrySchema: () => LineageEntrySchema,
@@ -1227,10 +1252,17 @@ __export(index_node_exports, {
   LineageNodeSchema: () => LineageNodeSchema,
   LineageReadError: () => LineageReadError,
   MASTER_KEY_MESSAGE: () => MASTER_KEY_MESSAGE,
+  MASTER_SIGNATURE_DELIVERY_MAX_AGE_SECONDS: () => MASTER_SIGNATURE_DELIVERY_MAX_AGE_SECONDS,
+  MASTER_SIGNATURE_DELIVERY_VERSION: () => MASTER_SIGNATURE_DELIVERY_VERSION,
+  MAX_ATTEMPTS: () => MAX_ATTEMPTS,
+  MAX_INLINE_RESULT_BYTES: () => MAX_INLINE_RESULT_BYTES,
+  MAX_JOB_DEADLINE_SECONDS: () => MAX_JOB_DEADLINE_SECONDS,
+  MAX_LEASE_SECONDS: () => MAX_LEASE_SECONDS,
   MAX_LINEAGE_SOURCES: () => MAX_LINEAGE_SOURCES,
   MAX_QUESTION_CHARS: () => MAX_QUESTION_CHARS,
   MAX_QUESTION_MODEL_CHARS: () => MAX_QUESTION_MODEL_CHARS,
   MAX_QUESTION_SOURCE_SCOPES: () => MAX_QUESTION_SOURCE_SCOPES,
+  MAX_WAIT_SECONDS: () => MAX_WAIT_SECONDS,
   MissingAuthError: () => MissingAuthError,
   NATIVE_ASSET_ADDRESS: () => NATIVE_ASSET_ADDRESS,
   NATIVE_VANA_ASSET: () => NATIVE_VANA_ASSET,
@@ -1239,6 +1271,7 @@ __export(index_node_exports, {
   NodePlatformAdapter: () => NodePlatformAdapter,
   NonceError: () => NonceError,
   OAuthClient: () => OAuthClient,
+  OwnerNotReadyError: () => OwnerNotReadyError,
   PERSONAL_SERVER_LITE_OWNER_BINDING_PREFIX: () => PERSONAL_SERVER_LITE_OWNER_BINDING_PREFIX,
   PERSONAL_SERVER_LITE_OWNER_BINDING_PURPOSE: () => PERSONAL_SERVER_LITE_OWNER_BINDING_PURPOSE,
   PERSONAL_SERVER_LITE_OWNER_BINDING_VERSION: () => PERSONAL_SERVER_LITE_OWNER_BINDING_VERSION,
@@ -1264,6 +1297,7 @@ __export(index_node_exports, {
   RedactedLineageNodeSchema: () => RedactedLineageNodeSchema,
   RelayerError: () => RelayerError,
   SCOPE_ACTIONS: () => SCOPE_ACTIONS,
+  SEALED_ENVELOPE_VERSION: () => SEALED_ENVELOPE_VERSION,
   SERVER_REGISTRATION_TYPES: () => SERVER_REGISTRATION_TYPES,
   ScopeSchema: () => ScopeSchema,
   SerializationError: () => SerializationError,
@@ -1276,6 +1310,7 @@ __export(index_node_exports, {
   TOMBSTONE_METADATA_HASH: () => TOMBSTONE_METADATA_HASH,
   TOMBSTONE_METADATA_HASH_PREIMAGE: () => TOMBSTONE_METADATA_HASH_PREIMAGE,
   TransactionPendingError: () => TransactionPendingError,
+  USER_PS_ID_DOMAIN: () => USER_PS_ID_DOMAIN,
   UserRejectedRequestError: () => UserRejectedRequestError,
   VanaError: () => VanaError,
   VanaStorage: () => VanaStorage,
@@ -1294,6 +1329,7 @@ __export(index_node_exports, {
   WriteSessionExpiredError: () => WriteSessionExpiredError,
   WriteTransportError: () => WriteTransportError,
   WriteUnauthorizedError: () => WriteUnauthorizedError,
+  appRootPreimage: () => appRootPreimage,
   askPersonalServer: () => askPersonalServer,
   assertDerivedScopeNaming: () => assertDerivedScopeNaming,
   assertValidPkceVerifier: () => assertValidPkceVerifier,
@@ -1307,6 +1343,7 @@ __export(index_node_exports, {
   buildEscrowPaymentHeader: () => buildEscrowPaymentHeader,
   buildGrantPaymentHeader: () => buildGrantPaymentHeader,
   buildMarkDataPointUnavailableRequest: () => buildMarkDataPointUnavailableRequest,
+  buildMasterSignatureDelivery: () => buildMasterSignatureDelivery,
   buildPersonalServerDataReadRequest: () => buildPersonalServerDataReadRequest,
   buildPersonalServerLiteOwnerBindingMessage: () => buildPersonalServerLiteOwnerBindingMessage,
   buildPersonalServerLiteOwnerBindingSignature: () => buildPersonalServerLiteOwnerBindingSignature,
@@ -1315,6 +1352,7 @@ __export(index_node_exports, {
   buildSetDataPointStatusRequest: () => buildSetDataPointStatusRequest,
   buildWeb3SignedHeader: () => buildWeb3SignedHeader,
   builderRegistrationDomain: () => builderRegistrationDomain,
+  canonicalJobRequestBytes: () => canonicalJobRequestBytes,
   chains: () => chains,
   clearContractCache: () => clearContractCache,
   computeBodyHash: () => computeBodyHash,
@@ -1326,6 +1364,7 @@ __export(index_node_exports, {
   createDefaultNonceSource: () => createDefaultNonceSource,
   createEscrowGatewayClient: () => createEscrowGatewayClient,
   createGatewayClient: () => createGatewayClient,
+  createJobsClient: () => createJobsClient,
   createNodePlatformAdapter: () => createNodePlatformAdapter,
   createPlatformAdapter: () => createPlatformAdapter,
   createPlatformAdapterFor: () => createPlatformAdapterFor,
@@ -1339,6 +1378,7 @@ __export(index_node_exports, {
   decryptWithPassword: () => decryptWithPassword,
   deleteDataPoint: () => deleteDataPoint,
   deleteQuestion: () => deleteQuestion,
+  derivativeStatusTarget: () => derivativeStatusTarget,
   deriveDataPointId: () => deriveDataPointId,
   deriveMasterKey: () => deriveMasterKey,
   deriveScopeKey: () => deriveScopeKey,
@@ -1349,6 +1389,7 @@ __export(index_node_exports, {
   encodeDepositTokenData: () => encodeDepositTokenData,
   encodeSetDataPointStatusData: () => encodeSetDataPointStatusData,
   encodeWriteMetadataHeader: () => encodeWriteMetadataHeader,
+  encryptMasterSignatureDelivery: () => encryptMasterSignatureDelivery,
   encryptWithPassword: () => encryptWithPassword,
   escrowContractAddress: () => escrowContractAddress,
   escrowPaymentDomain: () => escrowPaymentDomain,
@@ -1362,6 +1403,7 @@ __export(index_node_exports, {
   getContractAddress: () => getContractAddress,
   getContractController: () => getContractController,
   getContractInfo: () => getContractInfo,
+  getDerivativeStatus: () => getDerivativeStatus,
   getFee: () => getFee,
   getGatewayLineage: () => getGatewayLineage,
   getLineage: () => getLineage,
@@ -1377,16 +1419,20 @@ __export(index_node_exports, {
   isDataPointId: () => isDataPointId,
   isDataPointTombstone: () => isDataPointTombstone,
   isDataPortabilityGatewayConfig: () => isDataPortabilityGatewayConfig,
+  isDerivativeStatusSettled: () => isDerivativeStatusSettled,
   isECIESEncrypted: () => isECIESEncrypted,
   isPlatformSupported: () => isPlatformSupported,
   isRedactedLineageNode: () => isRedactedLineageNode,
   isTombstoneHashes: () => isTombstoneHashes,
+  kmsIssuedPreimage: () => kmsIssuedPreimage,
   listQuestions: () => listQuestions,
   mainnetServices: () => mainnetServices,
   moksha: () => moksha,
   mokshaServices: () => mokshaServices,
   mokshaTestnet: () => mokshaTestnet2,
   normalizeBinaryMimeType: () => normalizeBinaryMimeType,
+  openJobRequest: () => openJobRequest,
+  openJobResult: () => openJobResult,
   openWriteSession: () => openWriteSession,
   parsePSError: () => parsePSError,
   parsePersonalServerPaymentRequired: () => parsePersonalServerPaymentRequired,
@@ -1410,6 +1456,8 @@ __export(index_node_exports, {
   scopeMatchesPattern: () => scopeMatchesPattern,
   scopeNamespace: () => scopeNamespace,
   scopeToPathSegments: () => scopeToPathSegments,
+  sealJobRequest: () => sealJobRequest,
+  sealJobResult: () => sealJobResult,
   serializeECIES: () => serializeECIES,
   serverRegistrationDomain: () => serverRegistrationDomain,
   sessionCoversScope: () => sessionCoversScope,
@@ -1420,10 +1468,13 @@ __export(index_node_exports, {
   toDirectPaymentReceipt: () => toDirectPaymentReceipt,
   tombstoneDeletedAt: () => tombstoneDeletedAt,
   tryGrantPermissions: () => tryGrantPermissions,
+  userPsId: () => userPsId,
   vanaMainnet: () => vanaMainnet2,
+  verifyEnclaveIdentityEvidence: () => verifyEnclaveIdentityEvidence,
   verifyGrantRegistration: () => verifyGrantRegistration,
   verifyPkceChallenge: () => verifyPkceChallenge,
   verifyWeb3Signed: () => verifyWeb3Signed,
+  waitForDerivativeStatus: () => waitForDerivativeStatus,
   waitForQuestion: () => waitForQuestion,
   writeData: () => writeData,
   writePersonalServerData: () => writePersonalServerData
@@ -1630,6 +1681,63 @@ var WriteRejectedError = class extends PersonalServerWriteError {
     super(message, "WRITE_REJECTED", status, errorCode, details);
   }
 };
+var JobsClientError = class extends VanaError {
+  constructor(message, code, status, errorCode = null, details) {
+    super(message, code);
+    this.status = status;
+    this.errorCode = errorCode;
+    this.details = details;
+  }
+  status;
+  errorCode;
+  details;
+};
+var BuilderUnknownError = class extends JobsClientError {
+  constructor(message, details) {
+    super(message, "JOB_BUILDER_UNKNOWN", 403, "BUILDER_UNKNOWN", details);
+  }
+};
+var GrantInvalidError = class extends JobsClientError {
+  constructor(message, details) {
+    super(message, "JOB_GRANT_INVALID", 403, "GRANT_INVALID", details);
+  }
+};
+var OwnerNotReadyError = class extends JobsClientError {
+  constructor(message, details) {
+    super(message, "JOB_OWNER_NOT_READY", 403, "OWNER_NOT_READY", details);
+  }
+};
+var JobIdTakenError = class extends JobsClientError {
+  constructor(message, details) {
+    super(message, "JOB_ID_TAKEN", 409, "JOB_ID_TAKEN", details);
+  }
+};
+var JobNotFoundError = class extends JobsClientError {
+  constructor(message, details) {
+    super(message, "JOB_NOT_FOUND", 404, "JOB_NOT_FOUND", details);
+  }
+};
+var JobRequestTooLargeError = class extends JobsClientError {
+  constructor(message, errorCode = "BODY_TOO_LARGE", details) {
+    super(message, "JOB_REQUEST_TOO_LARGE", 413, errorCode, details);
+  }
+};
+var JobTimeoutError = class extends JobsClientError {
+  constructor(message, details) {
+    super(message, "JOB_TIMEOUT", void 0, null, details);
+  }
+};
+var JobRejectedError = class extends JobsClientError {
+  constructor(message, status, errorCode = null, details) {
+    super(message, "JOB_REJECTED", status, errorCode, details);
+  }
+};
+var JobTransportError = class extends JobsClientError {
+  constructor(message, cause) {
+    super(message, "JOB_TRANSPORT_ERROR");
+    this.cause = cause;
+  }
+};
 var LineageReadError = class extends VanaError {
   constructor(message, status, errorCode = null, details) {
     super(message, "LINEAGE_READ_ERROR");
@@ -31618,13 +31726,13 @@ var NodeCryptoAdapter = class {
    */
   async generateKeyPair() {
     try {
-      const secp256k14 = import_secp256k12.default;
+      const secp256k15 = import_secp256k12.default;
       let privateKey;
       do {
         privateKey = (0, import_crypto2.randomBytes)(32);
-      } while (!secp256k14.privateKeyVerify(privateKey));
+      } while (!secp256k15.privateKeyVerify(privateKey));
       const publicKey = Buffer.from(
-        secp256k14.publicKeyCreate(privateKey, true)
+        secp256k15.publicKeyCreate(privateKey, true)
       );
       return {
         privateKey: privateKey.toString("hex"),
@@ -32634,15 +32742,922 @@ var RECORD_DATA_ACCESS_TYPES = {
   ]
 };
 
-// src/protocol/personal-server-registration.ts
+// src/protocol/identity.ts
+var secp256k14 = __toESM(require("@noble/secp256k1"), 1);
 var import_viem14 = require("viem");
+var import_accounts = require("viem/accounts");
+init_interface();
+var ENCLAVE_IDENTITY_EVIDENCE_VERSION = 1;
+var USER_PS_ID_DOMAIN = "vana.ps-enclave.v1";
+var ENCLAVE_WALLET_PURPOSE = "vana.ps-enclave.wallet.v1";
+var MASTER_SIGNATURE_DELIVERY_VERSION = "vana.ps-enclave.delivery.v1";
+var MASTER_SIGNATURE_DELIVERY_MAX_AGE_SECONDS = 600;
+var SEALED_ENVELOPE_VERSION = 1;
+var VANA_MAINNET_CHAIN_ID = 1480;
+var MOKSHA_CHAIN_ID = 14800;
+var KMS_ISSUED_PREFIX = "dstack-kms-issued";
+var PREIMAGE_SEPARATOR = ":";
+var UNCOMPRESSED_PUBLIC_KEY_BYTES = 65;
+var UNCOMPRESSED_PUBLIC_KEY_PREFIX = "04";
+var EMPTY_HEX = "0x";
+function emptyAnchor() {
+  return Object.freeze({
+    kmsRootPubkey: EMPTY_HEX,
+    appIds: Object.freeze([])
+  });
+}
+var ENCLAVE_TRUST_ANCHORS = Object.freeze({
+  // filled at fleet provisioning; verify fails closed while empty
+  [VANA_MAINNET_CHAIN_ID]: emptyAnchor(),
+  // filled at fleet provisioning; verify fails closed while empty
+  [MOKSHA_CHAIN_ID]: emptyAnchor()
+});
+function userPsId(chainId, ownerAddress) {
+  const packed = (0, import_viem14.encodePacked)(
+    ["string", "uint256", "address"],
+    [USER_PS_ID_DOMAIN, BigInt(chainId), (0, import_viem14.getAddress)(ownerAddress)]
+  );
+  return (0, import_viem14.keccak256)(packed);
+}
+function compressPublicKey(publicKey) {
+  return secp256k14.ProjectivePoint.fromHex(
+    (0, import_viem14.fromHex)(publicKey, "bytes")
+  ).toRawBytes(true);
+}
+function sameKey(a, b) {
+  return (0, import_viem14.toHex)(compressPublicKey(a)) === (0, import_viem14.toHex)(compressPublicKey(b));
+}
+function assertUncompressedKey(publicKey) {
+  const hex = publicKey.slice(2);
+  if (hex.length !== UNCOMPRESSED_PUBLIC_KEY_BYTES * 2 || !hex.startsWith(UNCOMPRESSED_PUBLIC_KEY_PREFIX) || !/^[0-9a-fA-F]+$/.test(hex)) {
+    throw new Error("Public key must be a 65-byte uncompressed secp256k1 key");
+  }
+}
+function appRootPreimage(purpose, publicKey) {
+  const keyHex = (0, import_viem14.toHex)(compressPublicKey(publicKey)).slice(2);
+  return (0, import_viem14.keccak256)((0, import_viem14.toBytes)(`${purpose}${PREIMAGE_SEPARATOR}${keyHex}`));
+}
+function kmsIssuedPreimage(appId, appRootPublicKey) {
+  const prefix = (0, import_viem14.concat)([
+    (0, import_viem14.toBytes)(`${KMS_ISSUED_PREFIX}${PREIMAGE_SEPARATOR}`),
+    (0, import_viem14.fromHex)(appId, "bytes")
+  ]);
+  const compressed = compressPublicKey(appRootPublicKey);
+  return (0, import_viem14.keccak256)((0, import_viem14.concat)([prefix, compressed]));
+}
+async function recoverChainKey(hash, signature, link) {
+  try {
+    return (await (0, import_viem14.recoverPublicKey)({ hash, signature })).toLowerCase();
+  } catch {
+    throw new Error(`Invalid enclave signature chain link ${link}`);
+  }
+}
+async function verifyEnclaveIdentityEvidence(evidence, anchors, expected) {
+  if (evidence.v !== ENCLAVE_IDENTITY_EVIDENCE_VERSION) {
+    throw new Error("Unsupported enclave identity evidence version");
+  }
+  if (!Number.isInteger(evidence.epoch) || evidence.epoch < 1) {
+    throw new Error("Invalid enclave identity epoch");
+  }
+  if (evidence.chainId !== expected.chainId) {
+    throw new Error(
+      "Enclave identity chain ID does not match expected chain ID"
+    );
+  }
+  if (!(0, import_viem14.isAddressEqual)(evidence.ownerAddress, expected.ownerAddress)) {
+    throw new Error("Enclave identity owner does not match expected owner");
+  }
+  if (evidence.epoch !== expected.epoch) {
+    throw new Error("Enclave identity epoch does not match expected epoch");
+  }
+  const expectedUserPsId = userPsId(expected.chainId, expected.ownerAddress);
+  if (evidence.userPsId.toLowerCase() !== expectedUserPsId.toLowerCase()) {
+    throw new Error("Enclave userPsId does not match expected identity");
+  }
+  if (evidence.purpose !== ENCLAVE_WALLET_PURPOSE) {
+    throw new Error("Unexpected enclave wallet purpose");
+  }
+  if (anchors.kmsRootPubkey === EMPTY_HEX) {
+    throw new Error("KMS root trust anchor is not provisioned");
+  }
+  assertUncompressedKey(evidence.publicKey);
+  const derivedAddress = (0, import_accounts.publicKeyToAddress)(evidence.publicKey);
+  if ((0, import_viem14.getAddress)(derivedAddress) !== (0, import_viem14.getAddress)(evidence.address)) {
+    throw new Error("Enclave public key does not match its address");
+  }
+  const appRootPublicKey = await recoverChainKey(
+    appRootPreimage(evidence.purpose, evidence.publicKey),
+    evidence.signatureChain[0],
+    0
+  );
+  const kmsRootPublicKey = await recoverChainKey(
+    kmsIssuedPreimage(evidence.appId, appRootPublicKey),
+    evidence.signatureChain[1],
+    1
+  );
+  let matchesAnchor;
+  try {
+    matchesAnchor = sameKey(kmsRootPublicKey, anchors.kmsRootPubkey);
+  } catch {
+    throw new Error("KMS root trust anchor is malformed");
+  }
+  if (!matchesAnchor) {
+    throw new Error("KMS root public key does not match the trust anchor");
+  }
+  if ((0, import_viem14.keccak256)(kmsRootPublicKey) !== evidence.kmsRootFingerprint.toLowerCase()) {
+    throw new Error("KMS root fingerprint does not match the evidence");
+  }
+  const appId = evidence.appId.toLowerCase();
+  if (!anchors.appIds.some((allowedAppId) => allowedAppId.toLowerCase() === appId)) {
+    throw new Error("Enclave app ID is not trusted");
+  }
+}
+async function buildMasterSignatureDelivery(evidence, masterSignature, now = Math.floor(Date.now() / 1e3)) {
+  deriveMasterKey(masterSignature);
+  const signerAddress = await recoverServerOwner(masterSignature);
+  if (!(0, import_viem14.isAddressEqual)(signerAddress, evidence.ownerAddress)) {
+    throw new Error("Master signature signer does not match evidence owner");
+  }
+  return {
+    v: MASTER_SIGNATURE_DELIVERY_VERSION,
+    userPsId: evidence.userPsId,
+    epoch: evidence.epoch,
+    enclaveAddress: evidence.address,
+    ownerAddress: evidence.ownerAddress,
+    masterSignature,
+    issuedAt: now
+  };
+}
+async function encryptMasterSignatureDelivery(delivery, publicKey, ecies) {
+  assertUncompressedKey(publicKey);
+  if (!(0, import_viem14.isAddressEqual)((0, import_accounts.publicKeyToAddress)(publicKey), delivery.enclaveAddress)) {
+    throw new Error(
+      "Public key does not belong to the delivery's enclave address"
+    );
+  }
+  const plaintext = (0, import_viem14.toBytes)(JSON.stringify(delivery));
+  const encrypted = await ecies.encrypt((0, import_viem14.fromHex)(publicKey, "bytes"), plaintext);
+  return `0x${serializeECIES(encrypted)}`;
+}
+
+// src/protocol/jobs.ts
+var JOB_PROTOCOL_VERSION = 1;
+var JOB_OPERATIONS = ["raw_read", "inference"];
+var JOB_STATES = [
+  "queued",
+  "claimed",
+  "running",
+  "completed",
+  "failed",
+  "expired",
+  "cancelled"
+];
+var DEFAULT_LEASE_SECONDS = 30;
+var MAX_LEASE_SECONDS = 300;
+var MAX_ATTEMPTS = 3;
+var MAX_WAIT_SECONDS = 25;
+var CLAIM_POLL_FLOOR_MS = 1e3;
+var MAX_INLINE_RESULT_BYTES = 1048576;
+var DEFAULT_JOB_DEADLINE_SECONDS = 600;
+var MAX_JOB_DEADLINE_SECONDS = 3600;
+
+// src/protocol/jobs-client.ts
+var import_node_crypto = require("node:crypto");
+var import_viem16 = require("viem");
+var import_accounts2 = require("viem/accounts");
+
+// src/crypto/envelope/job.ts
+var import_sha25 = require("@noble/hashes/sha2");
+var import_viem15 = require("viem");
+init_interface();
+var textDecoder = new TextDecoder();
+var textEncoder = new TextEncoder();
+var JobEnvelopeError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "JobEnvelopeError";
+  }
+};
+function sortJsonKeys(value) {
+  if (Array.isArray(value)) {
+    return value.map(sortJsonKeys);
+  }
+  if (value !== null && typeof value === "object") {
+    return Object.fromEntries(
+      Object.keys(value).sort().map((key) => [
+        key,
+        sortJsonKeys(value[key])
+      ])
+    );
+  }
+  return value;
+}
+function canonicalJsonBytes(value) {
+  return textEncoder.encode(JSON.stringify(sortJsonKeys(value)));
+}
+function canonicalJobRequestBytes(request) {
+  validateJobRequest(request);
+  return canonicalJsonBytes(request);
+}
+function requestPlaintext(envelope) {
+  validateRequestEnvelope(envelope);
+  return canonicalJsonBytes(envelope);
+}
+function resultPlaintext(result) {
+  return textEncoder.encode(
+    JSON.stringify({
+      v: result.v,
+      jobId: result.jobId,
+      scope: result.scope,
+      version: result.version,
+      contentType: result.contentType,
+      body: result.body
+    })
+  );
+}
+function encryptedBytesToBase64(encrypted) {
+  return toBase64((0, import_viem15.fromHex)(`0x${serializeECIES(encrypted)}`, "bytes"));
+}
+function base64ToEncrypted(ciphertext) {
+  return deserializeECIES((0, import_viem15.toHex)(fromBase64(ciphertext)));
+}
+function parseObject(plaintext, kind) {
+  try {
+    const value = JSON.parse(textDecoder.decode(plaintext));
+    if (value === null || typeof value !== "object" || Array.isArray(value)) {
+      throw new JobEnvelopeError(`Invalid ${kind}: expected an object`);
+    }
+    return value;
+  } catch (error) {
+    if (error instanceof JobEnvelopeError) throw error;
+    throw new JobEnvelopeError(`Invalid ${kind}: malformed JSON`);
+  }
+}
+function isPlainObject2(value) {
+  if (value === null || typeof value !== "object") return false;
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+function requirePlainObject(value, field, kind) {
+  if (!isPlainObject2(value)) {
+    throw new JobEnvelopeError(`Invalid ${kind}: invalid ${field}`);
+  }
+}
+function requireExactKeys(value, expectedKeys, kind) {
+  for (const key of expectedKeys) {
+    if (!Object.hasOwn(value, key) || value[key] === void 0) {
+      throw new JobEnvelopeError(`Invalid ${kind}: missing ${key}`);
+    }
+  }
+  const expected = new Set(expectedKeys);
+  for (const key of Reflect.ownKeys(value)) {
+    if (!expected.has(key)) {
+      throw new JobEnvelopeError(
+        `Invalid ${kind}: unknown field ${String(key)}`
+      );
+    }
+  }
+}
+function requireString(value, field, kind) {
+  if (typeof value !== "string" || value.length === 0) {
+    throw new JobEnvelopeError(`Invalid ${kind}: missing ${field}`);
+  }
+}
+function validateJobRequest(value) {
+  requirePlainObject(value, "request", "job request");
+  requireExactKeys(
+    value,
+    [
+      "v",
+      "jobId",
+      "owner",
+      "builder",
+      "builderPublicKey",
+      "grantId",
+      "scope",
+      "operation",
+      "pinnedVersion",
+      "deadline"
+    ],
+    "job request"
+  );
+  if (value.v !== JOB_PROTOCOL_VERSION) {
+    throw new JobEnvelopeError(
+      `Unsupported job request version: ${String(value.v)}`
+    );
+  }
+  requireString(value.jobId, "jobId", "job request");
+  if (typeof value.owner !== "string" || !(0, import_viem15.isAddress)(value.owner)) {
+    throw new JobEnvelopeError("Invalid job request: invalid owner");
+  }
+  if (typeof value.builder !== "string" || !(0, import_viem15.isAddress)(value.builder)) {
+    throw new JobEnvelopeError("Invalid job request: invalid builder");
+  }
+  if (typeof value.builderPublicKey !== "string" || !(0, import_viem15.isHex)(value.builderPublicKey)) {
+    throw new JobEnvelopeError("Invalid job request: invalid builderPublicKey");
+  }
+  if (typeof value.grantId !== "string" || !(0, import_viem15.isHex)(value.grantId)) {
+    throw new JobEnvelopeError("Invalid job request: invalid grantId");
+  }
+  requireString(value.scope, "scope", "job request");
+  if (!JOB_OPERATIONS.includes(value.operation)) {
+    throw new JobEnvelopeError("Invalid job request: invalid operation");
+  }
+  if (value.pinnedVersion !== null && typeof value.pinnedVersion !== "string") {
+    throw new JobEnvelopeError("Invalid job request: missing pinnedVersion");
+  }
+  if (typeof value.deadline !== "string" || !Number.isFinite(Date.parse(value.deadline))) {
+    throw new JobEnvelopeError("Invalid job request: invalid deadline");
+  }
+  return value;
+}
+function validateRequestEnvelope(value) {
+  requirePlainObject(value, "envelope", "job request envelope");
+  requireExactKeys(value, ["request", "auth"], "job request envelope");
+  validateJobRequest(value.request);
+  requireString(value.auth, "auth", "job request envelope");
+  return value;
+}
+function validateResult(value) {
+  requirePlainObject(value, "result", "job result");
+  requireExactKeys(
+    value,
+    ["v", "jobId", "scope", "version", "contentType", "body"],
+    "job result"
+  );
+  if (value.v !== JOB_PROTOCOL_VERSION) {
+    throw new JobEnvelopeError(
+      `Unsupported job result version: ${String(value.v)}`
+    );
+  }
+  for (const field of ["jobId", "scope", "contentType"]) {
+    requireString(value[field], field, "job result");
+  }
+  if (typeof value.body !== "string") {
+    throw new JobEnvelopeError("Invalid job result: missing body");
+  }
+  if (value.version !== null && typeof value.version !== "string") {
+    throw new JobEnvelopeError("Invalid job result: missing version");
+  }
+  return value;
+}
+async function sealJobRequest(envelope, enclavePublicKey, ecies) {
+  const encrypted = await ecies.encrypt(
+    (0, import_viem15.fromHex)(enclavePublicKey, "bytes"),
+    requestPlaintext(envelope)
+  );
+  return encryptedBytesToBase64(encrypted);
+}
+async function openJobRequest(ciphertext, privateKey, ecies) {
+  const plaintext = await ecies.decrypt(
+    privateKey,
+    base64ToEncrypted(ciphertext)
+  );
+  return validateRequestEnvelope(
+    parseObject(plaintext, "job request envelope")
+  );
+}
+async function sealJobResult(result, builderPublicKey, ecies) {
+  validateResult(result);
+  const encrypted = await ecies.encrypt(
+    (0, import_viem15.fromHex)(builderPublicKey, "bytes"),
+    resultPlaintext(result)
+  );
+  const ciphertext = encryptedBytesToBase64(encrypted);
+  const bytes = fromBase64(ciphertext);
+  return { ciphertext, hash: (0, import_viem15.bytesToHex)((0, import_sha25.sha256)(bytes)), size: bytes.length };
+}
+async function openJobResult(ciphertext, builderPrivateKey, ecies, expect) {
+  const plaintext = await ecies.decrypt(
+    (0, import_viem15.fromHex)(builderPrivateKey, "bytes"),
+    base64ToEncrypted(ciphertext)
+  );
+  const result = validateResult(parseObject(plaintext, "job result"));
+  if (result.jobId !== expect.jobId) {
+    throw new JobEnvelopeError(
+      `Job result ID ${result.jobId} does not match expected job ID ${expect.jobId}`
+    );
+  }
+  if (expect.scope !== void 0 && result.scope !== expect.scope) {
+    throw new JobEnvelopeError(
+      `Job result scope ${result.scope} does not match expected scope ${expect.scope}`
+    );
+  }
+  if (expect.version !== void 0 && result.version !== expect.version) {
+    throw new JobEnvelopeError(
+      `Job result version ${String(result.version)} does not match expected version ${String(expect.version)}`
+    );
+  }
+  return result;
+}
+
+// src/protocol/write-signer.ts
+function isRecord(value) {
+  return value !== null && typeof value === "object";
+}
+function isViemWriteAccount(source) {
+  return isRecord(source) && source.type === "local" && typeof source.address === "string" && typeof source.signMessage === "function";
+}
+function isViemWriteWalletClient(source) {
+  return isRecord(source) && typeof source.signMessage === "function" && source.type !== "local" && (source.type === "walletClient" || "transport" in source);
+}
+function accountAddress(account) {
+  return typeof account === "string" ? account : account.address;
+}
+function resolveWriteSigner(source, options = {}) {
+  if (isViemWriteWalletClient(source)) {
+    const account = options.account ?? source.account;
+    if (account === void 0) {
+      throw new WriteRequestError(
+        "Viem wallet client requires an account option or account property"
+      );
+    }
+    return {
+      address: accountAddress(account),
+      signMessage: (message) => source.signMessage({ account, message })
+    };
+  }
+  if (isViemWriteAccount(source)) {
+    return {
+      address: source.address,
+      signMessage: (message) => source.signMessage({ message })
+    };
+  }
+  if (!isRecord(source) || typeof source.signMessage !== "function") {
+    throw new WriteRequestError(
+      "signer must be a viem LocalAccount, a viem WalletClient, or a { signMessage } object"
+    );
+  }
+  return source;
+}
+
+// src/protocol/jobs-client.ts
+var IDENTITY_PATH = "/v1/identity";
+var JOBS_PATH = "/v1/jobs";
+var JOB_EXECUTE_PATH = "/v1/jobs/execute";
+var AUTHORIZATION_HEADER = "Authorization";
+var CONTENT_TYPE_HEADER = "Content-Type";
+var JSON_CONTENT_TYPE = "application/json";
+var GET_METHOD = "GET";
+var POST_METHOD = "POST";
+var RAW_READ_OPERATION = "raw_read";
+var SEALED_IDENTITY_STATE = "sealed";
+var HTTP_OK = 200;
+var HTTP_ACCEPTED = 202;
+var HTTP_FORBIDDEN = 403;
+var HTTP_NOT_FOUND = 404;
+var HTTP_CONFLICT = 409;
+var HTTP_PAYLOAD_TOO_LARGE = 413;
+var MILLISECONDS_PER_SECOND = 1e3;
+var DEFAULT_JOB_TIMEOUT_MS = 12e4;
+var DEFAULT_JOB_POLL_MS = CLAIM_POLL_FLOOR_MS;
+var TERMINAL_JOB_STATES = /* @__PURE__ */ new Set([
+  "completed",
+  "failed",
+  "expired",
+  "cancelled"
+]);
+function isRecord2(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function normalizeGateway(gatewayUrl) {
+  try {
+    const url = new URL(gatewayUrl);
+    if (url.pathname !== "/" || url.search !== "" || url.hash !== "") {
+      throw new JobRejectedError(
+        "gatewayUrl must be an origin without a path, query, or fragment"
+      );
+    }
+    return {
+      baseUrl: url.origin,
+      audience: url.origin
+    };
+  } catch (error) {
+    if (error instanceof JobRejectedError) throw error;
+    throw new JobRejectedError(
+      "gatewayUrl must be an absolute URL",
+      void 0,
+      null,
+      {
+        cause: error instanceof Error ? error.message : String(error)
+      }
+    );
+  }
+}
+function resolveFetch(fetchFn) {
+  const resolved = fetchFn ?? globalThis.fetch;
+  if (resolved === void 0) {
+    throw new JobRejectedError("No fetch implementation available");
+  }
+  return resolved;
+}
+function sourcePublicKey(source) {
+  if (isRecord2(source) && typeof source["publicKey"] === "string") {
+    return source["publicKey"];
+  }
+  return void 0;
+}
+function resolveBuilder(options) {
+  if (options.builderPrivateKey && options.builderAccount) {
+    throw new JobRejectedError(
+      "Provide builderPrivateKey or builderAccount, not both"
+    );
+  }
+  let source;
+  try {
+    source = options.builderPrivateKey ? (0, import_accounts2.privateKeyToAccount)(options.builderPrivateKey) : options.builderAccount;
+  } catch (error) {
+    throw new JobRejectedError("Invalid builder private key", void 0, null, {
+      cause: error instanceof Error ? error.message : String(error)
+    });
+  }
+  if (!source) {
+    throw new JobRejectedError(
+      "builderPrivateKey or builderAccount is required"
+    );
+  }
+  let signer;
+  try {
+    signer = resolveWriteSigner(source);
+  } catch (error) {
+    throw new JobRejectedError("Invalid builder signer", void 0, null, {
+      cause: error instanceof Error ? error.message : String(error)
+    });
+  }
+  const publicKey = sourcePublicKey(source);
+  if (!signer.address || !publicKey) {
+    throw new JobRejectedError(
+      "Builder signer must expose both address and publicKey"
+    );
+  }
+  return {
+    builder: {
+      address: signer.address,
+      publicKey,
+      signMessage: signer.signMessage
+    },
+    ...options.builderPrivateKey ? { privateKey: options.builderPrivateKey } : {}
+  };
+}
+function clampInteger(value, fallback, minimum, maximum, field) {
+  const resolved = value ?? fallback;
+  if (!Number.isFinite(resolved)) {
+    throw new JobRejectedError(`${field} must be a finite number`);
+  }
+  return Math.min(maximum, Math.max(minimum, Math.trunc(resolved)));
+}
+async function responseBody(response) {
+  try {
+    return await response.json();
+  } catch {
+    return null;
+  }
+}
+function gatewayErrorBody(body, fallback) {
+  if (!isRecord2(body)) return { code: null, message: fallback };
+  const code = typeof body["code"] === "string" ? body["code"] : null;
+  const message = typeof body["error"] === "string" ? body["error"] : typeof body["message"] === "string" ? body["message"] : fallback;
+  const details = isRecord2(body["details"]) ? body["details"] : void 0;
+  return { code, message, ...details ? { details } : {} };
+}
+async function rejectedResponse(response, fallback) {
+  const parsed = gatewayErrorBody(await responseBody(response), fallback);
+  const details = parsed.details;
+  if (response.status === HTTP_FORBIDDEN) {
+    if (parsed.code === "BUILDER_UNKNOWN") {
+      return new BuilderUnknownError(parsed.message, details);
+    }
+    if (parsed.code === "GRANT_INVALID") {
+      return new GrantInvalidError(parsed.message, details);
+    }
+    if (parsed.code === "OWNER_NOT_READY") {
+      return new OwnerNotReadyError(parsed.message, details);
+    }
+  }
+  if (response.status === HTTP_NOT_FOUND) {
+    return new JobNotFoundError(parsed.message, details);
+  }
+  if (response.status === HTTP_CONFLICT && parsed.code === "JOB_ID_TAKEN") {
+    return new JobIdTakenError(parsed.message, details);
+  }
+  if (response.status === HTTP_PAYLOAD_TOO_LARGE) {
+    return new JobRequestTooLargeError(parsed.message, parsed.code, details);
+  }
+  return new JobRejectedError(
+    parsed.message,
+    response.status,
+    parsed.code,
+    details
+  );
+}
+function requireStatus(value, status) {
+  if (!isRecord2(value) || !isNonEmptyString(value["jobId"]) || typeof value["state"] !== "string" || !JOB_STATES.includes(value["state"]) || !isNonEmptyString(value["owner"]) || !isNonEmptyString(value["grantId"]) || !isNonEmptyString(value["scope"]) || !isNonEmptyString(value["operation"]) || !JOB_OPERATIONS.includes(value["operation"])) {
+    throw new JobRejectedError(
+      "Gateway response did not contain a job status",
+      status
+    );
+  }
+  return value;
+}
+function isNonEmptyString(value) {
+  return typeof value === "string" && value.length > 0;
+}
+function hasMatchingIdentityKey(value) {
+  const address = value["address"];
+  const publicKey = value["publicKey"];
+  if (typeof address !== "string" || !(0, import_viem16.isAddress)(address) || typeof publicKey !== "string" || !(0, import_viem16.isHex)(publicKey)) {
+    return false;
+  }
+  try {
+    return (0, import_accounts2.publicKeyToAddress)(publicKey).toLowerCase() === address.toLowerCase();
+  } catch {
+    return false;
+  }
+}
+function jobDeadline(job) {
+  const candidate = job;
+  for (const field of ["deadlineAt", "deadline"]) {
+    if (typeof candidate[field] === "string") {
+      const parsed = Date.parse(candidate[field]);
+      if (Number.isFinite(parsed)) return parsed;
+    }
+  }
+  return void 0;
+}
+function sleep2(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function requireFiniteDuration(value, field) {
+  if (!Number.isFinite(value)) {
+    throw new JobRejectedError(`${field} must be a finite number`);
+  }
+  return Math.max(0, value);
+}
+function createJobsClient(options) {
+  const { baseUrl, audience } = normalizeGateway(options.gatewayUrl);
+  const fetchFn = resolveFetch(options.fetch);
+  const { builder, privateKey } = resolveBuilder(options);
+  const ecies = options.ecies ?? new NodeECIESUint8Provider();
+  const now = options.now ?? (() => /* @__PURE__ */ new Date());
+  async function request(url, init, description) {
+    try {
+      return await fetchFn(url, init);
+    } catch (error) {
+      throw new JobTransportError(
+        `${description} failed: ${error instanceof Error ? error.message : String(error)}`,
+        error
+      );
+    }
+  }
+  async function getIdentity(owner) {
+    const query = new URLSearchParams({
+      owner,
+      chainId: String(options.chainId)
+    });
+    const response = await request(
+      `${baseUrl}${IDENTITY_PATH}?${query.toString()}`,
+      { method: GET_METHOD },
+      "Owner identity lookup"
+    );
+    if (!response.ok) {
+      throw await rejectedResponse(response, "Owner identity lookup rejected");
+    }
+    const body = await responseBody(response);
+    if (!isRecord2(body) || body["state"] !== SEALED_IDENTITY_STATE || !isRecord2(body["identity"])) {
+      throw new OwnerNotReadyError("Owner identity is not sealed", {
+        state: isRecord2(body) ? body["state"] : void 0
+      });
+    }
+    if (!hasMatchingIdentityKey(body["identity"])) {
+      throw new JobRejectedError(
+        "Gateway returned a malformed or mismatched owner identity",
+        response.status
+      );
+    }
+    return body["identity"];
+  }
+  const client = {
+    async submitRawRead(params) {
+      const identity = await getIdentity(params.owner);
+      const deadlineSeconds = clampInteger(
+        params.deadlineSeconds,
+        DEFAULT_JOB_DEADLINE_SECONDS,
+        1,
+        MAX_JOB_DEADLINE_SECONDS,
+        "deadlineSeconds"
+      );
+      const wait = clampInteger(params.wait, 0, 0, MAX_WAIT_SECONDS, "wait");
+      const jobId = (0, import_node_crypto.randomUUID)();
+      const nowMs = now().getTime();
+      if (!Number.isFinite(nowMs)) {
+        throw new JobRejectedError("now must return a valid Date");
+      }
+      const deadline = new Date(
+        nowMs + deadlineSeconds * MILLISECONDS_PER_SECOND
+      ).toISOString();
+      const requestBody = {
+        v: JOB_PROTOCOL_VERSION,
+        jobId,
+        owner: params.owner,
+        builder: builder.address,
+        builderPublicKey: builder.publicKey,
+        grantId: params.grantId,
+        scope: params.scope,
+        operation: RAW_READ_OPERATION,
+        pinnedVersion: params.pinnedVersion ?? null,
+        deadline
+      };
+      const auth = await buildWeb3SignedHeader({
+        signMessage: builder.signMessage,
+        aud: audience,
+        method: POST_METHOD,
+        uri: JOB_EXECUTE_PATH,
+        bodyHash: computeBodyHash(canonicalJobRequestBytes(requestBody)),
+        nonce: (0, import_node_crypto.randomUUID)()
+      });
+      const requestCiphertext = await sealJobRequest(
+        { request: requestBody, auth },
+        identity.publicKey,
+        ecies
+      );
+      const submission = {
+        owner: requestBody.owner,
+        grantId: requestBody.grantId,
+        scope: requestBody.scope,
+        operation: requestBody.operation,
+        idempotencyKey: (0, import_node_crypto.randomUUID)(),
+        jobId,
+        deadline,
+        requestCiphertext
+      };
+      const bodyBytes = new TextEncoder().encode(JSON.stringify(submission));
+      const authorization = await buildWeb3SignedHeader({
+        signMessage: builder.signMessage,
+        aud: audience,
+        method: POST_METHOD,
+        uri: JOBS_PATH,
+        body: bodyBytes,
+        nonce: (0, import_node_crypto.randomUUID)()
+      });
+      const response = await request(
+        `${baseUrl}${JOBS_PATH}?wait=${wait}`,
+        {
+          method: POST_METHOD,
+          headers: {
+            [AUTHORIZATION_HEADER]: authorization,
+            [CONTENT_TYPE_HEADER]: JSON_CONTENT_TYPE
+          },
+          body: bodyBytes
+        },
+        "Job submission"
+      );
+      if (!response.ok) {
+        throw await rejectedResponse(response, "Job submission rejected");
+      }
+      const body = await responseBody(response);
+      if (response.status === HTTP_OK && isRecord2(body)) {
+        const job = requireStatus(body["job"], response.status);
+        if (job.jobId !== jobId) {
+          throw new JobRejectedError(
+            "Gateway returned a job id that does not match the submission",
+            response.status
+          );
+        }
+        return { jobId, state: job.state, job };
+      }
+      if (response.status === HTTP_ACCEPTED && isRecord2(body) && body["jobId"] === jobId && typeof body["state"] === "string" && JOB_STATES.includes(body["state"])) {
+        return { jobId, state: body["state"] };
+      }
+      throw new JobRejectedError(
+        "Gateway returned an undocumented job submission response",
+        response.status
+      );
+    },
+    async getJob(jobId) {
+      const path = `${JOBS_PATH}/${encodeURIComponent(jobId)}`;
+      const authorization = await buildWeb3SignedHeader({
+        signMessage: builder.signMessage,
+        aud: audience,
+        method: GET_METHOD,
+        uri: path,
+        nonce: (0, import_node_crypto.randomUUID)()
+      });
+      const response = await request(
+        `${baseUrl}${path}`,
+        {
+          method: GET_METHOD,
+          headers: { [AUTHORIZATION_HEADER]: authorization }
+        },
+        "Job status read"
+      );
+      if (!response.ok) {
+        throw await rejectedResponse(response, "Job status read rejected");
+      }
+      const body = await responseBody(response);
+      return requireStatus(
+        isRecord2(body) ? body["job"] : void 0,
+        response.status
+      );
+    },
+    async waitForJob(jobId, waitOptions = {}) {
+      const timeoutMs = requireFiniteDuration(
+        waitOptions.timeoutMs ?? DEFAULT_JOB_TIMEOUT_MS,
+        "timeoutMs"
+      );
+      const pollMs = Math.max(
+        CLAIM_POLL_FLOOR_MS,
+        requireFiniteDuration(
+          waitOptions.pollMs ?? DEFAULT_JOB_POLL_MS,
+          "pollMs"
+        )
+      );
+      const startedAt = Date.now();
+      const callerDeadline = startedAt + timeoutMs;
+      let latest;
+      for (; ; ) {
+        if (Date.now() >= callerDeadline || latest && Date.now() >= (jobDeadline(latest) ?? Infinity)) {
+          throw new JobTimeoutError(
+            `Timed out waiting for terminal job ${jobId}`,
+            {
+              jobId,
+              timeoutMs,
+              state: latest?.state
+            }
+          );
+        }
+        latest = await client.getJob(jobId);
+        if (TERMINAL_JOB_STATES.has(latest.state)) return latest;
+        const effectiveDeadline = Math.min(
+          callerDeadline,
+          jobDeadline(latest) ?? Infinity
+        );
+        const remaining = effectiveDeadline - Date.now();
+        if (remaining <= 0) {
+          throw new JobTimeoutError(
+            `Timed out waiting for terminal job ${jobId}`,
+            {
+              jobId,
+              timeoutMs,
+              state: latest.state
+            }
+          );
+        }
+        await sleep2(Math.min(pollMs, remaining));
+      }
+    },
+    async openResult(job, openOptions) {
+      if (!job.resultCiphertext) {
+        throw new JobRejectedError(
+          "Job status does not include inline resultCiphertext",
+          void 0,
+          null,
+          {
+            jobId: job.jobId,
+            state: job.state,
+            resultHandle: job.resultHandle,
+            maxInlineResultBytes: MAX_INLINE_RESULT_BYTES
+          }
+        );
+      }
+      if (!privateKey) {
+        throw new JobRejectedError(
+          "openResult requires createJobsClient({ builderPrivateKey })"
+        );
+      }
+      return openJobResult(
+        job.resultCiphertext,
+        privateKey,
+        ecies,
+        openOptions.expect
+      );
+    },
+    async readRaw(params) {
+      const submitted = await client.submitRawRead(params);
+      const job = submitted.job && TERMINAL_JOB_STATES.has(submitted.job.state) ? submitted.job : await client.waitForJob(submitted.jobId, {
+        timeoutMs: params.timeoutMs,
+        pollMs: params.pollMs
+      });
+      return client.openResult(job, {
+        expect: {
+          jobId: submitted.jobId,
+          scope: params.scope,
+          ...params.pinnedVersion !== void 0 && params.pinnedVersion !== null ? { version: params.pinnedVersion } : {}
+        }
+      });
+    }
+  };
+  return client;
+}
+
+// src/protocol/personal-server-registration.ts
+var import_viem17 = require("viem");
 var PERSONAL_SERVER_REGISTRATION_DEFAULT_CHAIN_ID = vanaMainnet2.id;
 var PERSONAL_SERVER_REGISTRATION_DEFAULT_VERIFYING_CONTRACT = getContractAddress(
   PERSONAL_SERVER_REGISTRATION_DEFAULT_CHAIN_ID,
   "DataPortabilityServers"
 );
 function assertAddress(value, name) {
-  if (!(0, import_viem14.isAddress)(value)) {
+  if (!(0, import_viem17.isAddress)(value)) {
     throw new Error(`${name} must be a valid EVM address`);
   }
 }
@@ -32728,12 +33743,12 @@ async function buildPersonalServerRegistrationSignature(input) {
 var registerPersonalServerSignature = buildPersonalServerRegistrationSignature;
 
 // src/personal-server-lite/owner-binding.ts
-var import_viem15 = require("viem");
+var import_viem18 = require("viem");
 var PERSONAL_SERVER_LITE_OWNER_BINDING_VERSION = "vana.ps-lite.owner-binding.v1";
 var PERSONAL_SERVER_LITE_OWNER_BINDING_PURPOSE = "ps-lite-owner";
 var PERSONAL_SERVER_LITE_OWNER_BINDING_PREFIX = `${PERSONAL_SERVER_LITE_OWNER_BINDING_VERSION}:${PERSONAL_SERVER_LITE_OWNER_BINDING_PURPOSE}:`;
 function assertAddress2(value, name) {
-  if (!(0, import_viem15.isAddress)(value)) {
+  if (!(0, import_viem18.isAddress)(value)) {
     throw new Error(`${name} must be a valid EVM address`);
   }
 }
@@ -32783,7 +33798,7 @@ async function buildPersonalServerLiteOwnerBindingSignature(input) {
 var signPersonalServerLiteOwnerBinding = buildPersonalServerLiteOwnerBindingSignature;
 
 // src/account/personal-server-registration.ts
-var import_viem16 = require("viem");
+var import_viem19 = require("viem");
 var ACCOUNT_PERSONAL_SERVER_REGISTRATION_INTENT = "personal_server.server_registration.v1";
 var AccountPersonalServerRegistrationError = class extends Error {
   status;
@@ -32802,7 +33817,7 @@ function trimTrailingSlash(value) {
   return value.replace(/\/+$/, "");
 }
 function assertAddress3(value, name) {
-  if (!(0, import_viem16.isAddress)(value)) {
+  if (!(0, import_viem19.isAddress)(value)) {
     throw new Error(`${name} must be a valid EVM address`);
   }
 }
@@ -32823,7 +33838,7 @@ function accountErrorMessage(status, body) {
   if (nestedMessage) {
     return nestedMessage;
   }
-  if (isRecord(body) && typeof body.message === "string") {
+  if (isRecord3(body) && typeof body.message === "string") {
     return body.message;
   }
   const code = accountErrorCode(body);
@@ -32837,7 +33852,7 @@ function accountErrorCode(body) {
   if (nestedCode) {
     return nestedCode;
   }
-  if (isRecord(body)) {
+  if (isRecord3(body)) {
     if (typeof body.code === "string") {
       return body.code;
     }
@@ -32848,13 +33863,13 @@ function accountErrorCode(body) {
   return void 0;
 }
 function nestedAccountErrorField(body, field) {
-  if (!isRecord(body) || !isRecord(body.error)) {
+  if (!isRecord3(body) || !isRecord3(body.error)) {
     return void 0;
   }
   const value = body.error[field];
   return typeof value === "string" ? value : void 0;
 }
-function isRecord(value) {
+function isRecord3(value) {
   return typeof value === "object" && value !== null;
 }
 function normalizeAccountResponse(response) {
@@ -33066,7 +34081,7 @@ function accountOwnerBindingError(error) {
 }
 
 // src/protocol/grants.ts
-var import_viem17 = require("viem");
+var import_viem20 = require("viem");
 function isHexString(value) {
   return typeof value === "string" && value.startsWith("0x");
 }
@@ -33111,7 +34126,7 @@ async function verifyGrantRegistration(input) {
   }
   let valid;
   try {
-    valid = await (0, import_viem17.verifyTypedData)({
+    valid = await (0, import_viem20.verifyTypedData)({
       address: input.grantorAddress,
       domain: grantRegistrationDomain(input.gatewayConfig),
       types: GRANT_REGISTRATION_TYPES,
@@ -33146,8 +34161,8 @@ async function verifyGrantRegistration(input) {
 }
 
 // src/protocol/fee-registry.ts
-var import_viem18 = require("viem");
-var FEE_REGISTRY_ABI = (0, import_viem18.parseAbi)([
+var import_viem21 = require("viem");
+var FEE_REGISTRY_ABI = (0, import_viem21.parseAbi)([
   "struct Fee { uint256 amount; address asset; address payee; bool enabled; }",
   "function fees(bytes32 operation) view returns (Fee)",
   "function operationKey(string name) pure returns (bytes32)"
@@ -33230,7 +34245,7 @@ async function getOpFee(client, config, opType, opts) {
 }
 
 // src/protocol/escrow-deposit.ts
-var import_viem19 = require("viem");
+var import_viem22 = require("viem");
 var ESCROW_DEPOSIT_ABI = [
   {
     type: "function",
@@ -33255,14 +34270,14 @@ function escrowContractAddress(config) {
   return config.contracts.dataPortabilityEscrow;
 }
 function encodeDepositNativeData(input) {
-  return (0, import_viem19.encodeFunctionData)({
+  return (0, import_viem22.encodeFunctionData)({
     abi: ESCROW_DEPOSIT_ABI,
     functionName: "depositNative",
     args: [input.account]
   });
 }
 function encodeDepositTokenData(input) {
-  return (0, import_viem19.encodeFunctionData)({
+  return (0, import_viem22.encodeFunctionData)({
     abi: ESCROW_DEPOSIT_ABI,
     functionName: "depositToken",
     args: [input.account, input.token, input.amount]
@@ -33283,7 +34298,7 @@ function buildDepositTokenRequest(config, input) {
 }
 
 // src/protocol/data-point-status.ts
-var import_viem20 = require("viem");
+var import_viem23 = require("viem");
 var DataPointStatus = /* @__PURE__ */ ((DataPointStatus2) => {
   DataPointStatus2[DataPointStatus2["None"] = 0] = "None";
   DataPointStatus2[DataPointStatus2["Active"] = 1] = "Active";
@@ -33307,7 +34322,7 @@ function dataRegistryContractAddress(config) {
   return config.contracts.dataRegistry;
 }
 function encodeSetDataPointStatusData(input) {
-  return (0, import_viem20.encodeFunctionData)({
+  return (0, import_viem23.encodeFunctionData)({
     abi: DATA_REGISTRY_STATUS_ABI,
     functionName: "setStatus",
     args: [input.scope, input.status]
@@ -33327,14 +34342,14 @@ function buildMarkDataPointUnavailableRequest(config, input) {
 }
 
 // src/protocol/data-point-deletion.ts
-var import_viem22 = require("viem");
+var import_viem25 = require("viem");
 
 // src/protocol/lineage.ts
-var import_viem21 = require("viem");
+var import_viem24 = require("viem");
 var import_zod = require("zod");
 
 // src/protocol/personal-server-error-body.ts
-function isRecord2(value) {
+function isRecord4(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 async function readPersonalServerErrorBody(response) {
@@ -33344,8 +34359,8 @@ async function readPersonalServerErrorBody(response) {
   } catch {
     return { errorCode: null, message: null };
   }
-  if (!isRecord2(body)) return { errorCode: null, message: null };
-  const nested = isRecord2(body.error) ? body.error : null;
+  if (!isRecord4(body)) return { errorCode: null, message: null };
+  const nested = isRecord4(body.error) ? body.error : null;
   const gatewayShape = typeof body.error === "string" && typeof body.code === "string";
   const code = nested?.errorCode ?? nested?.code ?? body.errorCode ?? (gatewayShape ? body.code : void 0) ?? (typeof body.error === "string" ? body.error : void 0) ?? body.code;
   const message = nested?.message ?? body.message ?? (gatewayShape ? body.error : void 0);
@@ -33358,63 +34373,23 @@ async function readPersonalServerErrorBody(response) {
   return {
     errorCode: typeof code === "string" ? code : null,
     message: typeof message === "string" ? message : null,
-    ...isRecord2(details) ? { details } : {}
+    ...isRecord4(details) ? { details } : {}
   };
 }
 
-// src/protocol/write-signer.ts
-function isRecord3(value) {
-  return value !== null && typeof value === "object";
-}
-function isViemWriteAccount(source) {
-  return isRecord3(source) && source.type === "local" && typeof source.address === "string" && typeof source.signMessage === "function";
-}
-function isViemWriteWalletClient(source) {
-  return isRecord3(source) && typeof source.signMessage === "function" && source.type !== "local" && (source.type === "walletClient" || "transport" in source);
-}
-function accountAddress(account) {
-  return typeof account === "string" ? account : account.address;
-}
-function resolveWriteSigner(source, options = {}) {
-  if (isViemWriteWalletClient(source)) {
-    const account = options.account ?? source.account;
-    if (account === void 0) {
-      throw new WriteRequestError(
-        "Viem wallet client requires an account option or account property"
-      );
-    }
-    return {
-      address: accountAddress(account),
-      signMessage: (message) => source.signMessage({ account, message })
-    };
-  }
-  if (isViemWriteAccount(source)) {
-    return {
-      address: source.address,
-      signMessage: (message) => source.signMessage({ message })
-    };
-  }
-  if (!isRecord3(source) || typeof source.signMessage !== "function") {
-    throw new WriteRequestError(
-      "signer must be a viem LocalAccount, a viem WalletClient, or a { signMessage } object"
-    );
-  }
-  return source;
-}
-
 // src/protocol/lineage.ts
 var DATA_POINT_ID_PATTERN = /^0x[0-9a-fA-F]{64}$/;
 function isDataPointId(value) {
   return typeof value === "string" && DATA_POINT_ID_PATTERN.test(value);
 }
 function deriveDataPointId(ownerAddress, scope) {
-  if (!(0, import_viem21.isAddress)(ownerAddress, { strict: false })) {
+  if (!(0, import_viem24.isAddress)(ownerAddress, { strict: false })) {
     throw new Error(
       `ownerAddress is not an EVM address: ${String(ownerAddress)}`
     );
   }
-  return (0, import_viem21.keccak256)(
-    (0, import_viem21.encodeAbiParameters)(
+  return (0, import_viem24.keccak256)(
+    (0, import_viem24.encodeAbiParameters)(
       [
         { name: "ownerAddress", type: "address" },
         { name: "scope", type: "string" }
@@ -33503,7 +34478,7 @@ function gatewayLineagePath(dataPointId, version) {
 function normalizeBaseUrl(url) {
   return url.replace(/\/+$/, "");
 }
-function resolveFetch(fetchFn) {
+function resolveFetch2(fetchFn) {
   const resolved = fetchFn ?? globalThis.fetch;
   if (resolved === void 0) {
     throw new LineageReadError("No fetch implementation available");
@@ -33544,7 +34519,7 @@ async function parseLineageGraph(source, response) {
       { cause: err instanceof Error ? err.message : String(err) }
     );
   }
-  const envelope = isRecord2(body) && isRecord2(body.data) ? body : void 0;
+  const envelope = isRecord4(body) && isRecord4(body.data) ? body : void 0;
   const parsed = LineageGraphSchema.safeParse(envelope?.data ?? body);
   if (!parsed.success) {
     throw new LineageReadError(
@@ -33554,7 +34529,7 @@ async function parseLineageGraph(source, response) {
       { issues: parsed.error.issues }
     );
   }
-  const proof = isRecord2(envelope?.proof) ? envelope.proof : void 0;
+  const proof = isRecord4(envelope?.proof) ? envelope.proof : void 0;
   return proof === void 0 ? parsed.data : { ...parsed.data, proof };
 }
 async function sendLineageRead(source, fetchFn, url, headers) {
@@ -33575,7 +34550,7 @@ async function sendLineageRead(source, fetchFn, url, headers) {
   return parseLineageGraph(source, response);
 }
 async function getPersonalServerLineage(params) {
-  const fetchFn = resolveFetch(params.fetch);
+  const fetchFn = resolveFetch2(params.fetch);
   const baseUrl = normalizeBaseUrl(params.personalServerUrl);
   const audience = params.audience ?? baseUrl;
   const signer = resolveWriteSigner(params.signer, { account: params.account });
@@ -33610,7 +34585,7 @@ async function getGatewayLineage(params) {
       { dataPointId: params.dataPointId }
     );
   }
-  const fetchFn = resolveFetch(params.fetch);
+  const fetchFn = resolveFetch2(params.fetch);
   const baseUrl = normalizeBaseUrl(params.gatewayUrl);
   const signer = resolveWriteSigner(params.signer, { account: params.account });
   const uri = gatewayLineagePath(
@@ -33640,7 +34615,7 @@ var TOMBSTONE_METADATA_HASH_PREIMAGE = "vana.data-point.tombstone.metadata.v1";
 var TOMBSTONE_DATA_HASH = "0x30c45ee72fe56d1927701316925ab7ceacd3b6f9267061735d59396f075c6222";
 var TOMBSTONE_METADATA_HASH = "0xc5255a141acd6a2ae55971b62c0a85977c2511989dc114ad2abc2b7644f57d90";
 function computeTombstoneHash(preimage) {
-  return (0, import_viem22.keccak256)((0, import_viem22.stringToBytes)(preimage));
+  return (0, import_viem25.keccak256)((0, import_viem25.stringToBytes)(preimage));
 }
 function isTombstoneHashes(dataHash, metadataHash) {
   return typeof dataHash === "string" && typeof metadataHash === "string" && dataHash.toLowerCase() === TOMBSTONE_DATA_HASH && metadataHash.toLowerCase() === TOMBSTONE_METADATA_HASH;
@@ -33659,12 +34634,12 @@ function tombstoneDeletedAt(value) {
   return typeof deletedAt === "string" ? deletedAt : null;
 }
 function assertAddress4(value, name) {
-  if (!(0, import_viem22.isAddress)(value)) {
+  if (!(0, import_viem25.isAddress)(value)) {
     throw new Error(`${name} must be a valid EVM address`);
   }
 }
 function assertUint256(value, name) {
-  if (value < 0n || value > import_viem22.maxUint256) {
+  if (value < 0n || value > import_viem25.maxUint256) {
     throw new Error(`${name} must fit in uint256, got ${value}`);
   }
 }
@@ -33767,7 +34742,7 @@ async function deleteDataPoint(input) {
     }
     currentVersion = parseExpectedVersion(record.expectedVersion);
   }
-  if (currentVersion < 0n || currentVersion >= import_viem22.maxUint256) {
+  if (currentVersion < 0n || currentVersion >= import_viem25.maxUint256) {
     throw new Error(
       `currentVersion ${currentVersion} cannot be incremented to a uint256 tombstone version`
     );
@@ -34074,17 +35049,17 @@ function tryGrantPermissions(scopes) {
 }
 
 // src/protocol/personal-server-write.ts
-var import_sha26 = require("@noble/hashes/sha2");
-var import_viem24 = require("viem");
+var import_sha27 = require("@noble/hashes/sha2");
+var import_viem27 = require("viem");
 var import_zod4 = require("zod");
 
 // src/protocol/write-request.ts
-var import_sha25 = require("@noble/hashes/sha2");
-var import_viem23 = require("viem");
+var import_sha26 = require("@noble/hashes/sha2");
+var import_viem26 = require("viem");
 function normalizeBaseUrl2(url) {
   return url.replace(/\/+$/, "");
 }
-function resolveFetch2(fetchFn) {
+function resolveFetch3(fetchFn) {
   const resolved = fetchFn ?? globalThis.fetch;
   if (resolved === void 0) {
     throw new WriteRequestError("No fetch implementation available");
@@ -34097,7 +35072,7 @@ function errorMessage(err) {
 function finiteOr(value, fallback) {
   return typeof value === "number" && Number.isFinite(value) ? value : fallback;
 }
-function sleep2(ms) {
+function sleep3(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 var issuedProofIats = /* @__PURE__ */ new Map();
@@ -34139,7 +35114,7 @@ function nextProofIat(proofKey) {
   setIssuedProofIat(proofKey, iat, last);
   const waitSec = iat - nowSec - PROOF_IAT_MAX_AHEAD_SECONDS;
   if (waitSec <= 0) return Promise.resolve(iat);
-  return sleep2(waitSec * 1e3).then(() => iat);
+  return sleep3(waitSec * 1e3).then(() => iat);
 }
 function freshProofNonce() {
   const webCrypto = globalThis.crypto;
@@ -34147,22 +35122,22 @@ function freshProofNonce() {
     return webCrypto.randomUUID();
   }
   if (typeof webCrypto?.getRandomValues === "function") {
-    return (0, import_viem23.bytesToHex)(webCrypto.getRandomValues(new Uint8Array(16)));
+    return (0, import_viem26.bytesToHex)(webCrypto.getRandomValues(new Uint8Array(16)));
   }
   throw new WriteRequestError(
     "No secure random source available to build a proof nonce; provide a crypto global"
   );
 }
 function proofKeyFor(parts) {
-  return (0, import_viem23.bytesToHex)(
-    (0, import_sha25.sha256)(
+  return (0, import_viem26.bytesToHex)(
+    (0, import_sha26.sha256)(
       new TextEncoder().encode(
         JSON.stringify([
           parts.aud,
           parts.method,
           parts.uri,
           parts.grantId,
-          parts.signedBytes ? (0, import_viem23.bytesToHex)((0, import_sha25.sha256)(parts.signedBytes)) : ""
+          parts.signedBytes ? (0, import_viem26.bytesToHex)((0, import_sha26.sha256)(parts.signedBytes)) : ""
         ])
       )
     )
@@ -34180,7 +35155,7 @@ async function sendWithFreshProof(label, fetchFn, options, proofKey, build) {
       lastError = err;
     }
     if (attempt < attempts - 1) {
-      await sleep2(delayMs);
+      await sleep3(delayMs);
       delayMs *= 2;
     }
   }
@@ -34219,7 +35194,7 @@ function dataPath(scope) {
   return `/v1/data/${encodeURIComponent(scope)}`;
 }
 async function openWriteSession(params) {
-  const fetchFn = resolveFetch2(params.fetch);
+  const fetchFn = resolveFetch3(params.fetch);
   const personalServerUrl = normalizeBaseUrl2(params.personalServerUrl);
   const audience = params.audience ?? personalServerUrl;
   const signer = resolveWriteSigner(params.signer, { account: params.account });
@@ -34299,12 +35274,12 @@ async function openWriteSession(params) {
   };
 }
 function isWriteSession(value) {
-  if (!isRecord2(value)) return false;
+  if (!isRecord4(value)) return false;
   const signer = value.signer;
-  return typeof value.personalServerUrl === "string" && typeof value.audience === "string" && typeof value.grantId === "string" && typeof value.accessToken === "string" && value.accessToken.length > 0 && typeof value.expiresAt === "number" && Number.isFinite(value.expiresAt) && Array.isArray(value.writeScopes) && value.writeScopes.every((scope) => typeof scope === "string") && isRecord2(signer) && typeof signer.signMessage === "function";
+  return typeof value.personalServerUrl === "string" && typeof value.audience === "string" && typeof value.grantId === "string" && typeof value.accessToken === "string" && value.accessToken.length > 0 && typeof value.expiresAt === "number" && Number.isFinite(value.expiresAt) && Array.isArray(value.writeScopes) && value.writeScopes.every((scope) => typeof scope === "string") && isRecord4(signer) && typeof signer.signMessage === "function";
 }
 function sessionCoversScope(session, scope) {
-  if (!isRecord2(session) || !Array.isArray(session.writeScopes) || !session.writeScopes.every((pattern) => typeof pattern === "string")) {
+  if (!isRecord4(session) || !Array.isArray(session.writeScopes) || !session.writeScopes.every((pattern) => typeof pattern === "string")) {
     throw new WriteRequestError("session must come from openWriteSession");
   }
   return session.writeScopes.some(
@@ -34349,7 +35324,7 @@ function binaryWriteSignedBytes(input) {
     mimeType: normalizeBinaryMimeType(input.contentType),
     ...input.filename ? { filename: input.filename } : {},
     sizeBytes: input.bytes.length,
-    contentHash: (0, import_viem24.bytesToHex)((0, import_sha26.sha256)(input.bytes)),
+    contentHash: (0, import_viem27.bytesToHex)((0, import_sha27.sha256)(input.bytes)),
     encoding: "base64",
     content: toBase64(input.bytes),
     ...metadata !== void 0 ? { metadata } : {}
@@ -34378,7 +35353,7 @@ function assertNoReservedKeys(value, where) {
   }
 }
 function isLineagePair(value) {
-  return isRecord2(value) && typeof value.ownerAddress === "string" && typeof value.scope === "string";
+  return isRecord4(value) && typeof value.ownerAddress === "string" && typeof value.scope === "string";
 }
 function normalizeLineage(lineage, derivedScope) {
   if (!Array.isArray(lineage)) {
@@ -34397,7 +35372,7 @@ function normalizeLineage(lineage, derivedScope) {
   for (const entry of lineage) {
     let id;
     if (isLineagePair(entry)) {
-      if (!(0, import_viem24.isAddress)(entry.ownerAddress, { strict: false })) {
+      if (!(0, import_viem27.isAddress)(entry.ownerAddress, { strict: false })) {
         throw new WriteRequestError(
           "lineage source ownerAddress must be an EVM address",
           { ownerAddress: entry.ownerAddress }
@@ -34446,7 +35421,7 @@ function assertNoLineageField(value, where) {
 }
 function buildMetadataHeader(metadata, sources) {
   if (metadata !== void 0) {
-    if (!isRecord2(metadata)) {
+    if (!isRecord4(metadata)) {
       throw new WriteRequestError("metadata must be a plain object");
     }
     assertNoReservedKeys(metadata, "metadata");
@@ -34499,7 +35474,7 @@ function prepareWrite(params) {
   if (params.data === void 0) {
     throw new WriteRequestError("Pass data (a JSON object) or binary");
   }
-  if (!isRecord2(params.data)) {
+  if (!isRecord4(params.data)) {
     throw new WriteRequestError("data must be a plain JSON object");
   }
   if (params.metadata !== void 0) {
@@ -34550,7 +35525,7 @@ async function writeData(params) {
   if (!isWriteSession(session)) {
     throw new WriteRequestError("session must come from openWriteSession");
   }
-  const fetchFn = resolveFetch2(params.fetch);
+  const fetchFn = resolveFetch3(params.fetch);
   if (typeof params.scope !== "string" || params.scope.length === 0) {
     throw new WriteRequestError("scope is required");
   }
@@ -34662,6 +35637,13 @@ var QUESTION_STATUSES = [
   "failed",
   "stale"
 ];
+var DERIVATIVE_ERROR_CODES = [
+  "inference_unavailable",
+  "source_missing",
+  "grant_invalid",
+  "internal"
+];
+var DerivativeErrorCodeSchema = import_zod5.z.enum(DERIVATIVE_ERROR_CODES);
 var QuestionStatusSchema = import_zod5.z.enum(QUESTION_STATUSES);
 var QuestionRegisteredBySchema = import_zod5.z.union([
   import_zod5.z.object({ kind: import_zod5.z.literal("owner") }),
@@ -34683,6 +35665,14 @@ var DerivativeQuestionSchema = import_zod5.z.object({
   status: QuestionStatusSchema,
   /** A short reason, set only while `status` is `failed`. */
   error: nullableString,
+  /**
+   * The coarse failure class behind `error`, set only while `status` is
+   * `failed`. `null` from a Personal Server that predates the class
+   * (`personal-server-ts` before the status route).
+   */
+  errorCode: DerivativeErrorCodeSchema.nullish().transform(
+    (value) => value ?? null
+  ),
   createdAt: import_zod5.z.string(),
   updatedAt: nullableString,
   /** When the last compute finished, or `null` while `pending`. */
@@ -34727,7 +35717,7 @@ function resolveRequest(params) {
       "signer must be a viem LocalAccount, a viem WalletClient, or a { signMessage } object"
     );
   }
-  const fetchFn = resolveFetch2(params.fetch);
+  const fetchFn = resolveFetch3(params.fetch);
   const baseUrl = normalizeBaseUrl2(params.personalServerUrl);
   const audience = params.audience ?? baseUrl;
   return {
@@ -34815,6 +35805,7 @@ async function questionErrorFromResponse(response, body) {
       );
   }
 }
+var personalServerErrorFromQuestionResponse = questionErrorFromResponse;
 async function sendOnce(params, resolved, session, spec, bodyBytes) {
   return sendWithFreshProof(
     spec.label,
@@ -35059,7 +36050,7 @@ async function waitForQuestion(params) {
         }
       );
     }
-    await sleep2(Math.min(pollIntervalMs, remaining));
+    await sleep3(Math.min(pollIntervalMs, remaining));
   }
 }
 async function askPersonalServer(params) {
@@ -35094,6 +36085,166 @@ async function askPersonalServer(params) {
   return { registration, record };
 }
 
+// src/protocol/derivative-status.ts
+var import_zod6 = require("zod");
+var DERIVATIVE_STATUS_PATH = "/v1/derivatives/status";
+var DEFAULT_DERIVATIVE_STATUS_TIMEOUT_MS = 12e4;
+var DEFAULT_DERIVATIVE_STATUS_POLL_INTERVAL_MS = 2e3;
+var nullable = (schema) => schema.nullish().transform((value) => value ?? null);
+var DerivativeStatusSchema = import_zod6.z.object({
+  derivedScope: import_zod6.z.string().min(1),
+  status: QuestionStatusSchema,
+  /** When the last compute finished, or `null` if none ever has. */
+  lastComputedAt: nullable(import_zod6.z.string()),
+  /** Local version of the derived record the last compute wrote. */
+  derivedVersion: nullable(import_zod6.z.number()),
+  derivedCollectedAt: nullable(import_zod6.z.string()),
+  /** The failure class; `null` unless `status` is `failed`. */
+  errorCode: nullable(DerivativeErrorCodeSchema),
+  /**
+   * Seconds until the Personal Server's next automatic retry, or `null` when
+   * none is pending or running — the terminal signature. Poll on this cadence
+   * rather than guessing one.
+   */
+  retryAfterSeconds: nullable(import_zod6.z.number())
+});
+function derivativeStatusTarget(derivedScope) {
+  return `${DERIVATIVE_STATUS_PATH}?derivedScope=${encodeURIComponent(derivedScope)}`;
+}
+function normalizeBaseUrl3(url) {
+  return url.replace(/\/+$/, "");
+}
+function resolveFetch4(fetchFn) {
+  const resolved = fetchFn ?? globalThis.fetch;
+  if (resolved === void 0) {
+    throw new WriteRequestError("No fetch implementation available");
+  }
+  return resolved;
+}
+function requireDerivedScope(derivedScope) {
+  if (typeof derivedScope !== "string" || derivedScope.length === 0) {
+    throw new WriteRequestError("derivedScope is required");
+  }
+  return derivedScope;
+}
+function sleep4(ms, signal) {
+  if (ms <= 0) return Promise.resolve();
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    const onAbort = () => {
+      clearTimeout(timer);
+      reject(abortError2(signal));
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
+function timeoutError(latest, timeoutMs) {
+  return new DerivativeQuestionTimeoutError(
+    `Derived scope ${latest.derivedScope} was still ${latest.status} after ${timeoutMs}ms`,
+    {
+      derivedScope: latest.derivedScope,
+      status: latest.status,
+      errorCode: latest.errorCode,
+      retryAfterSeconds: latest.retryAfterSeconds,
+      timeoutMs
+    }
+  );
+}
+function abortError2(signal) {
+  const reason = signal?.reason;
+  return reason instanceof Error ? reason : new WriteRequestError("Derivative status wait was aborted");
+}
+function isDerivativeStatusSettled(status) {
+  if (status.status === "ready") return true;
+  return status.status === "failed" && status.retryAfterSeconds === null;
+}
+async function getDerivativeStatus(params) {
+  const derivedScope = requireDerivedScope(params.derivedScope);
+  const fetchFn = resolveFetch4(params.fetch);
+  const baseUrl = normalizeBaseUrl3(params.personalServerUrl);
+  const signer = resolveWriteSigner(params.signer, { account: params.account });
+  const headers = new Headers(params.headers);
+  headers.set(
+    "Authorization",
+    await buildWeb3SignedHeader({
+      signMessage: signer.signMessage,
+      aud: params.audience ?? baseUrl,
+      method: "GET",
+      uri: DERIVATIVE_STATUS_PATH,
+      grantId: params.grantId
+    })
+  );
+  let response;
+  try {
+    response = await fetchFn(
+      `${baseUrl}${derivativeStatusTarget(derivedScope)}`,
+      {
+        method: "GET",
+        headers,
+        ...params.signal ? { signal: params.signal } : {}
+      }
+    );
+  } catch (err) {
+    throw new WriteTransportError(
+      `Derivative status read failed: ${err instanceof Error ? err.message : String(err)}`,
+      1,
+      err
+    );
+  }
+  if (!response.ok) {
+    throw await personalServerErrorFromQuestionResponse(
+      response
+    );
+  }
+  let body;
+  try {
+    body = await response.json();
+  } catch (err) {
+    throw new DerivativeQuestionRejectedError(
+      "Derivative status response is not JSON",
+      response.status,
+      null,
+      { cause: err instanceof Error ? err.message : String(err) }
+    );
+  }
+  const parsed = DerivativeStatusSchema.safeParse(body);
+  if (!parsed.success) {
+    throw new DerivativeQuestionRejectedError(
+      "Derivative status response is not a status view",
+      response.status,
+      null,
+      { issues: parsed.error.issues }
+    );
+  }
+  return parsed.data;
+}
+async function waitForDerivativeStatus(params) {
+  const timeoutMs = Math.max(
+    0,
+    params.timeoutMs ?? DEFAULT_DERIVATIVE_STATUS_TIMEOUT_MS
+  );
+  const pollIntervalMs = Math.max(
+    0,
+    params.pollIntervalMs ?? DEFAULT_DERIVATIVE_STATUS_POLL_INTERVAL_MS
+  );
+  const deadline = Date.now() + timeoutMs;
+  for (; ; ) {
+    if (params.signal?.aborted) throw abortError2(params.signal);
+    const latest = await getDerivativeStatus(params);
+    if (isDerivativeStatusSettled(latest)) return latest;
+    const remaining = deadline - Date.now();
+    if (remaining <= 0) throw timeoutError(latest, timeoutMs);
+    const waitMs = latest.retryAfterSeconds === null ? pollIntervalMs : latest.retryAfterSeconds * 1e3;
+    if (waitMs > remaining) {
+      throw timeoutError(latest, timeoutMs);
+    }
+    await sleep4(waitMs, params.signal);
+  }
+}
+
 // src/protocol/gateway.ts
 function withGrantPermissions(grant) {
   const stripped = { ...grant };
@@ -36123,7 +37274,7 @@ var KNOWN_CODES = /* @__PURE__ */ new Set([
   "server_not_configured",
   "content_too_large"
 ]);
-function isRecord4(value) {
+function isRecord5(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function normalizeCode(value) {
@@ -36134,10 +37285,10 @@ function normalizeCode(value) {
   return KNOWN_CODES.has(code) ? code : null;
 }
 function extractPSErrorBody(body) {
-  if (!isRecord4(body)) {
+  if (!isRecord5(body)) {
     return null;
   }
-  const nested = isRecord4(body.error) ? body.error : null;
+  const nested = isRecord5(body.error) ? body.error : null;
   const code = normalizeCode(
     nested?.errorCode ?? nested?.code ?? body.errorCode ?? body.code
   );
@@ -36169,15 +37320,23 @@ async function parsePSError(response) {
   BUILDER_REGISTRATION_TYPES,
   BlockchainError,
   BrowserPlatformAdapter,
+  BuilderUnknownError,
+  CLAIM_POLL_FLOOR_MS,
   CONTRACTS,
   CallbackStorage,
   ContractFactory,
   ContractNotFoundError,
   DATA_ACCESS_OP_TYPE,
   DATA_REGISTRY_STATUS_ABI,
+  DEFAULT_DERIVATIVE_STATUS_POLL_INTERVAL_MS,
+  DEFAULT_DERIVATIVE_STATUS_TIMEOUT_MS,
+  DEFAULT_JOB_DEADLINE_SECONDS,
+  DEFAULT_LEASE_SECONDS,
   DEFAULT_QUESTION_POLL_INTERVAL_MS,
   DEFAULT_QUESTION_TIMEOUT_MS,
+  DERIVATIVE_ERROR_CODES,
   DERIVATIVE_QUESTIONS_PATH,
+  DERIVATIVE_STATUS_PATH,
   DataFileEnvelopeSchema,
   DataPointDeletedError,
   DataPointNotFoundError,
@@ -36186,6 +37345,7 @@ async function parsePSError(response) {
   DerivativeComputeUnavailableError,
   DerivativeCycleError,
   DerivativeDerivedScopeRequiredError,
+  DerivativeErrorCodeSchema,
   DerivativeQuestionFailedError,
   DerivativeQuestionInvalidError,
   DerivativeQuestionNotFoundError,
@@ -36193,8 +37353,12 @@ async function parsePSError(response) {
   DerivativeQuestionSchema,
   DerivativeQuestionTimeoutError,
   DerivativeSourceNotGrantedError,
+  DerivativeStatusSchema,
   DropboxStorage,
   ECIESError,
+  ENCLAVE_IDENTITY_EVIDENCE_VERSION,
+  ENCLAVE_TRUST_ANCHORS,
+  ENCLAVE_WALLET_PURPOSE,
   ESCROW_DEPOSIT_ABI,
   ExpiredTokenError,
   FEE_REGISTRY_ABI,
@@ -36203,12 +37367,24 @@ async function parsePSError(response) {
   GRANT_REGISTRATION_TYPES,
   GRANT_REVOCATION_TYPES,
   GoogleDriveStorage,
+  GrantInvalidError,
   InMemoryTokenStore,
   IngestResponseSchema,
   InvalidConfigurationError,
   InvalidScopeEntryError,
   InvalidSignatureError,
   IpfsStorage,
+  JOB_OPERATIONS,
+  JOB_PROTOCOL_VERSION,
+  JOB_STATES,
+  JobEnvelopeError,
+  JobIdTakenError,
+  JobNotFoundError,
+  JobRejectedError,
+  JobRequestTooLargeError,
+  JobTimeoutError,
+  JobTransportError,
+  JobsClientError,
   LINEAGE_FIELD,
   LINEAGE_KEY,
   LineageEntrySchema,
@@ -36216,10 +37392,17 @@ async function parsePSError(response) {
   LineageNodeSchema,
   LineageReadError,
   MASTER_KEY_MESSAGE,
+  MASTER_SIGNATURE_DELIVERY_MAX_AGE_SECONDS,
+  MASTER_SIGNATURE_DELIVERY_VERSION,
+  MAX_ATTEMPTS,
+  MAX_INLINE_RESULT_BYTES,
+  MAX_JOB_DEADLINE_SECONDS,
+  MAX_LEASE_SECONDS,
   MAX_LINEAGE_SOURCES,
   MAX_QUESTION_CHARS,
   MAX_QUESTION_MODEL_CHARS,
   MAX_QUESTION_SOURCE_SCOPES,
+  MAX_WAIT_SECONDS,
   MissingAuthError,
   NATIVE_ASSET_ADDRESS,
   NATIVE_VANA_ASSET,
@@ -36228,6 +37411,7 @@ async function parsePSError(response) {
   NodePlatformAdapter,
   NonceError,
   OAuthClient,
+  OwnerNotReadyError,
   PERSONAL_SERVER_LITE_OWNER_BINDING_PREFIX,
   PERSONAL_SERVER_LITE_OWNER_BINDING_PURPOSE,
   PERSONAL_SERVER_LITE_OWNER_BINDING_VERSION,
@@ -36253,6 +37437,7 @@ async function parsePSError(response) {
   RedactedLineageNodeSchema,
   RelayerError,
   SCOPE_ACTIONS,
+  SEALED_ENVELOPE_VERSION,
   SERVER_REGISTRATION_TYPES,
   ScopeSchema,
   SerializationError,
@@ -36265,6 +37450,7 @@ async function parsePSError(response) {
   TOMBSTONE_METADATA_HASH,
   TOMBSTONE_METADATA_HASH_PREIMAGE,
   TransactionPendingError,
+  USER_PS_ID_DOMAIN,
   UserRejectedRequestError,
   VanaError,
   VanaStorage,
@@ -36283,6 +37469,7 @@ async function parsePSError(response) {
   WriteSessionExpiredError,
   WriteTransportError,
   WriteUnauthorizedError,
+  appRootPreimage,
   askPersonalServer,
   assertDerivedScopeNaming,
   assertValidPkceVerifier,
@@ -36296,6 +37483,7 @@ async function parsePSError(response) {
   buildEscrowPaymentHeader,
   buildGrantPaymentHeader,
   buildMarkDataPointUnavailableRequest,
+  buildMasterSignatureDelivery,
   buildPersonalServerDataReadRequest,
   buildPersonalServerLiteOwnerBindingMessage,
   buildPersonalServerLiteOwnerBindingSignature,
@@ -36304,6 +37492,7 @@ async function parsePSError(response) {
   buildSetDataPointStatusRequest,
   buildWeb3SignedHeader,
   builderRegistrationDomain,
+  canonicalJobRequestBytes,
   chains,
   clearContractCache,
   computeBodyHash,
@@ -36315,6 +37504,7 @@ async function parsePSError(response) {
   createDefaultNonceSource,
   createEscrowGatewayClient,
   createGatewayClient,
+  createJobsClient,
   createNodePlatformAdapter,
   createPlatformAdapter,
   createPlatformAdapterFor,
@@ -36328,6 +37518,7 @@ async function parsePSError(response) {
   decryptWithPassword,
   deleteDataPoint,
   deleteQuestion,
+  derivativeStatusTarget,
   deriveDataPointId,
   deriveMasterKey,
   deriveScopeKey,
@@ -36338,6 +37529,7 @@ async function parsePSError(response) {
   encodeDepositTokenData,
   encodeSetDataPointStatusData,
   encodeWriteMetadataHeader,
+  encryptMasterSignatureDelivery,
   encryptWithPassword,
   escrowContractAddress,
   escrowPaymentDomain,
@@ -36351,6 +37543,7 @@ async function parsePSError(response) {
   getContractAddress,
   getContractController,
   getContractInfo,
+  getDerivativeStatus,
   getFee,
   getGatewayLineage,
   getLineage,
@@ -36366,16 +37559,20 @@ async function parsePSError(response) {
   isDataPointId,
   isDataPointTombstone,
   isDataPortabilityGatewayConfig,
+  isDerivativeStatusSettled,
   isECIESEncrypted,
   isPlatformSupported,
   isRedactedLineageNode,
   isTombstoneHashes,
+  kmsIssuedPreimage,
   listQuestions,
   mainnetServices,
   moksha,
   mokshaServices,
   mokshaTestnet,
   normalizeBinaryMimeType,
+  openJobRequest,
+  openJobResult,
   openWriteSession,
   parsePSError,
   parsePersonalServerPaymentRequired,
@@ -36399,6 +37596,8 @@ async function parsePSError(response) {
   scopeMatchesPattern,
   scopeNamespace,
   scopeToPathSegments,
+  sealJobRequest,
+  sealJobResult,
   serializeECIES,
   serverRegistrationDomain,
   sessionCoversScope,
@@ -36409,10 +37608,13 @@ async function parsePSError(response) {
   toDirectPaymentReceipt,
   tombstoneDeletedAt,
   tryGrantPermissions,
+  userPsId,
   vanaMainnet,
+  verifyEnclaveIdentityEvidence,
   verifyGrantRegistration,
   verifyPkceChallenge,
   verifyWeb3Signed,
+  waitForDerivativeStatus,
   waitForQuestion,
   writeData,
   writePersonalServerData