@opendatalabs/vana-sdk 3.22.0 → 3.23.0-pr.211.341f55d

package/dist/index.node.js

@@ -1347,6 +1347,68 @@ var WriteRejectedError = class extends PersonalServerWriteError {
     super(message, "WRITE_REJECTED", status, errorCode, details);
   }
 };
+var JobsClientError = class extends VanaError {
+  constructor(message, code, status, errorCode = null, details) {
+    super(message, code);
+    this.status = status;
+    this.errorCode = errorCode;
+    this.details = details;
+  }
+  status;
+  errorCode;
+  details;
+};
+var BuilderUnknownError = class extends JobsClientError {
+  constructor(message, details) {
+    super(message, "JOB_BUILDER_UNKNOWN", 403, "BUILDER_UNKNOWN", details);
+  }
+};
+var GrantInvalidError = class extends JobsClientError {
+  constructor(message, details) {
+    super(message, "JOB_GRANT_INVALID", 403, "GRANT_INVALID", details);
+  }
+};
+var OwnerNotReadyError = class extends JobsClientError {
+  constructor(message, details) {
+    super(message, "JOB_OWNER_NOT_READY", 403, "OWNER_NOT_READY", details);
+  }
+};
+var JobIdTakenError = class extends JobsClientError {
+  constructor(message, details) {
+    super(message, "JOB_ID_TAKEN", 409, "JOB_ID_TAKEN", details);
+  }
+};
+var JobNotFoundError = class extends JobsClientError {
+  constructor(message, details) {
+    super(message, "JOB_NOT_FOUND", 404, "JOB_NOT_FOUND", details);
+  }
+};
+var JobRequestTooLargeError = class extends JobsClientError {
+  constructor(message, errorCode = "BODY_TOO_LARGE", details) {
+    super(message, "JOB_REQUEST_TOO_LARGE", 413, errorCode, details);
+  }
+};
+var JobTimeoutError = class extends JobsClientError {
+  constructor(message, details) {
+    super(message, "JOB_TIMEOUT", void 0, null, details);
+  }
+};
+var JobResultIntegrityError = class extends JobsClientError {
+  constructor(message, details) {
+    super(message, "JOB_RESULT_INTEGRITY", void 0, null, details);
+  }
+};
+var JobRejectedError = class extends JobsClientError {
+  constructor(message, status, errorCode = null, details) {
+    super(message, "JOB_REJECTED", status, errorCode, details);
+  }
+};
+var JobTransportError = class extends JobsClientError {
+  constructor(message, cause) {
+    super(message, "JOB_TRANSPORT_ERROR");
+    this.cause = cause;
+  }
+};
 var LineageReadError = class extends VanaError {
   constructor(message, status, errorCode = null, details) {
     super(message, "LINEAGE_READ_ERROR");
@@ -31347,13 +31409,13 @@ var NodeCryptoAdapter = class {
    */
   async generateKeyPair() {
     try {
-      const secp256k14 = secp256k1Import2;
+      const secp256k15 = secp256k1Import2;
       let privateKey;
       do {
         privateKey = randomBytes2(32);
-      } while (!secp256k14.privateKeyVerify(privateKey));
+      } while (!secp256k15.privateKeyVerify(privateKey));
       const publicKey = Buffer.from(
-        secp256k14.publicKeyCreate(privateKey, true)
+        secp256k15.publicKeyCreate(privateKey, true)
       );
       return {
         privateKey: privateKey.toString("hex"),
@@ -32363,9 +32425,1068 @@ var RECORD_DATA_ACCESS_TYPES = {
   ]
 };
 
+// src/protocol/identity.ts
+init_interface();
+import * as secp256k14 from "@noble/secp256k1";
+import {
+  concat as concat4,
+  encodePacked,
+  fromHex as fromHex5,
+  getAddress,
+  isAddressEqual,
+  keccak256,
+  recoverPublicKey,
+  toBytes,
+  toHex as toHex7
+} from "viem";
+import { publicKeyToAddress } from "viem/accounts";
+var ENCLAVE_IDENTITY_EVIDENCE_VERSION = 1;
+var USER_PS_ID_DOMAIN = "vana.ps-enclave.v1";
+var ENCLAVE_WALLET_PURPOSE = "vana.ps-enclave.wallet.v1";
+var MASTER_SIGNATURE_DELIVERY_VERSION = "vana.ps-enclave.delivery.v1";
+var MASTER_SIGNATURE_DELIVERY_MAX_AGE_SECONDS = 600;
+var SEALED_ENVELOPE_VERSION = 1;
+var VANA_MAINNET_CHAIN_ID = 1480;
+var MOKSHA_CHAIN_ID = 14800;
+var KMS_ISSUED_PREFIX = "dstack-kms-issued";
+var PREIMAGE_SEPARATOR = ":";
+var UNCOMPRESSED_PUBLIC_KEY_BYTES = 65;
+var UNCOMPRESSED_PUBLIC_KEY_PREFIX = "04";
+var EMPTY_HEX = "0x";
+function emptyAnchor() {
+  return Object.freeze({
+    kmsRootPubkey: EMPTY_HEX,
+    appIds: Object.freeze([])
+  });
+}
+var ENCLAVE_TRUST_ANCHORS = Object.freeze({
+  // filled at fleet provisioning; verify fails closed while empty
+  [VANA_MAINNET_CHAIN_ID]: emptyAnchor(),
+  // filled at fleet provisioning; verify fails closed while empty
+  [MOKSHA_CHAIN_ID]: emptyAnchor()
+});
+function userPsId(chainId, ownerAddress) {
+  const packed = encodePacked(
+    ["string", "uint256", "address"],
+    [USER_PS_ID_DOMAIN, BigInt(chainId), getAddress(ownerAddress)]
+  );
+  return keccak256(packed);
+}
+function compressPublicKey(publicKey) {
+  return secp256k14.ProjectivePoint.fromHex(
+    fromHex5(publicKey, "bytes")
+  ).toRawBytes(true);
+}
+function sameKey(a, b) {
+  return toHex7(compressPublicKey(a)) === toHex7(compressPublicKey(b));
+}
+function assertUncompressedKey(publicKey) {
+  const hex = publicKey.slice(2);
+  if (hex.length !== UNCOMPRESSED_PUBLIC_KEY_BYTES * 2 || !hex.startsWith(UNCOMPRESSED_PUBLIC_KEY_PREFIX) || !/^[0-9a-fA-F]+$/.test(hex)) {
+    throw new Error("Public key must be a 65-byte uncompressed secp256k1 key");
+  }
+}
+function appRootPreimage(purpose, publicKey) {
+  const keyHex = toHex7(compressPublicKey(publicKey)).slice(2);
+  return keccak256(toBytes(`${purpose}${PREIMAGE_SEPARATOR}${keyHex}`));
+}
+function kmsIssuedPreimage(appId, appRootPublicKey) {
+  const prefix = concat4([
+    toBytes(`${KMS_ISSUED_PREFIX}${PREIMAGE_SEPARATOR}`),
+    fromHex5(appId, "bytes")
+  ]);
+  const compressed = compressPublicKey(appRootPublicKey);
+  return keccak256(concat4([prefix, compressed]));
+}
+async function recoverChainKey(hash, signature, link) {
+  try {
+    return (await recoverPublicKey({ hash, signature })).toLowerCase();
+  } catch {
+    throw new Error(`Invalid enclave signature chain link ${link}`);
+  }
+}
+async function verifyEnclaveIdentityEvidence(evidence, anchors, expected) {
+  if (evidence.v !== ENCLAVE_IDENTITY_EVIDENCE_VERSION) {
+    throw new Error("Unsupported enclave identity evidence version");
+  }
+  if (!Number.isInteger(evidence.epoch) || evidence.epoch < 1) {
+    throw new Error("Invalid enclave identity epoch");
+  }
+  if (evidence.chainId !== expected.chainId) {
+    throw new Error(
+      "Enclave identity chain ID does not match expected chain ID"
+    );
+  }
+  if (!isAddressEqual(evidence.ownerAddress, expected.ownerAddress)) {
+    throw new Error("Enclave identity owner does not match expected owner");
+  }
+  if (evidence.epoch !== expected.epoch) {
+    throw new Error("Enclave identity epoch does not match expected epoch");
+  }
+  const expectedUserPsId = userPsId(expected.chainId, expected.ownerAddress);
+  if (evidence.userPsId.toLowerCase() !== expectedUserPsId.toLowerCase()) {
+    throw new Error("Enclave userPsId does not match expected identity");
+  }
+  if (evidence.purpose !== ENCLAVE_WALLET_PURPOSE) {
+    throw new Error("Unexpected enclave wallet purpose");
+  }
+  if (anchors.kmsRootPubkey === EMPTY_HEX) {
+    throw new Error("KMS root trust anchor is not provisioned");
+  }
+  assertUncompressedKey(evidence.publicKey);
+  const derivedAddress = publicKeyToAddress(evidence.publicKey);
+  if (getAddress(derivedAddress) !== getAddress(evidence.address)) {
+    throw new Error("Enclave public key does not match its address");
+  }
+  const appRootPublicKey = await recoverChainKey(
+    appRootPreimage(evidence.purpose, evidence.publicKey),
+    evidence.signatureChain[0],
+    0
+  );
+  const kmsRootPublicKey = await recoverChainKey(
+    kmsIssuedPreimage(evidence.appId, appRootPublicKey),
+    evidence.signatureChain[1],
+    1
+  );
+  let matchesAnchor;
+  try {
+    matchesAnchor = sameKey(kmsRootPublicKey, anchors.kmsRootPubkey);
+  } catch {
+    throw new Error("KMS root trust anchor is malformed");
+  }
+  if (!matchesAnchor) {
+    throw new Error("KMS root public key does not match the trust anchor");
+  }
+  if (keccak256(kmsRootPublicKey) !== evidence.kmsRootFingerprint.toLowerCase()) {
+    throw new Error("KMS root fingerprint does not match the evidence");
+  }
+  const appId = evidence.appId.toLowerCase();
+  if (!anchors.appIds.some((allowedAppId) => allowedAppId.toLowerCase() === appId)) {
+    throw new Error("Enclave app ID is not trusted");
+  }
+}
+async function buildMasterSignatureDelivery(evidence, masterSignature, now = Math.floor(Date.now() / 1e3)) {
+  deriveMasterKey(masterSignature);
+  const signerAddress = await recoverServerOwner(masterSignature);
+  if (!isAddressEqual(signerAddress, evidence.ownerAddress)) {
+    throw new Error("Master signature signer does not match evidence owner");
+  }
+  return {
+    v: MASTER_SIGNATURE_DELIVERY_VERSION,
+    userPsId: evidence.userPsId,
+    epoch: evidence.epoch,
+    enclaveAddress: evidence.address,
+    ownerAddress: evidence.ownerAddress,
+    masterSignature,
+    issuedAt: now
+  };
+}
+async function encryptMasterSignatureDelivery(delivery, publicKey, ecies) {
+  assertUncompressedKey(publicKey);
+  if (!isAddressEqual(publicKeyToAddress(publicKey), delivery.enclaveAddress)) {
+    throw new Error(
+      "Public key does not belong to the delivery's enclave address"
+    );
+  }
+  const plaintext = toBytes(JSON.stringify(delivery));
+  const encrypted = await ecies.encrypt(fromHex5(publicKey, "bytes"), plaintext);
+  return `0x${serializeECIES(encrypted)}`;
+}
+
+// src/protocol/jobs.ts
+var JOB_PROTOCOL_VERSION = 1;
+var JOB_OPERATIONS = ["raw_read", "inference"];
+var JOB_STATES = [
+  "queued",
+  "claimed",
+  "running",
+  "completed",
+  "failed",
+  "expired",
+  "cancelled"
+];
+var DEFAULT_LEASE_SECONDS = 30;
+var MAX_LEASE_SECONDS = 300;
+var MAX_ATTEMPTS = 3;
+var MAX_WAIT_SECONDS = 25;
+var CLAIM_POLL_FLOOR_MS = 1e3;
+var DEFAULT_JOB_DEADLINE_SECONDS = 600;
+var MAX_JOB_DEADLINE_SECONDS = 3600;
+
+// src/protocol/jobs-client.ts
+import { randomUUID } from "node:crypto";
+import { sha256 as sha2566 } from "@noble/hashes/sha2";
+import {
+  bytesToHex as bytesToHex3,
+  isAddress as isAddress2,
+  isAddressEqual as isAddressEqual2,
+  isHex as isHex2
+} from "viem";
+import { privateKeyToAccount, publicKeyToAddress as publicKeyToAddress2 } from "viem/accounts";
+
+// src/crypto/envelope/job.ts
+init_constants();
+init_interface();
+import { sha256 as sha2565 } from "@noble/hashes/sha2";
+import { bytesToHex as bytesToHex2, fromHex as fromHex6, isAddress, isHex, toHex as toHex8 } from "viem";
+var textDecoder = new TextDecoder();
+var textEncoder = new TextEncoder();
+var MAX_JOB_RESULT_HEADER_BYTES = 4096;
+var JOB_RESULT_LENGTH_PREFIX_BYTES = 4;
+var JobEnvelopeError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "JobEnvelopeError";
+  }
+};
+function sortJsonKeys(value) {
+  if (Array.isArray(value)) {
+    return value.map(sortJsonKeys);
+  }
+  if (value !== null && typeof value === "object") {
+    return Object.fromEntries(
+      Object.keys(value).sort().map((key) => [
+        key,
+        sortJsonKeys(value[key])
+      ])
+    );
+  }
+  return value;
+}
+function canonicalJsonBytes(value) {
+  return textEncoder.encode(JSON.stringify(sortJsonKeys(value)));
+}
+function canonicalJobRequestBytes(request) {
+  validateJobRequest(request);
+  return canonicalJsonBytes(request);
+}
+function requestPlaintext(envelope) {
+  validateRequestEnvelope(envelope);
+  return canonicalJsonBytes(envelope);
+}
+function resultPlaintext(result) {
+  const header = textEncoder.encode(
+    JSON.stringify({
+      v: result.v,
+      jobId: result.jobId,
+      scope: result.scope,
+      version: result.version,
+      contentType: result.contentType
+    })
+  );
+  if (header.length > MAX_JOB_RESULT_HEADER_BYTES) {
+    throw new JobEnvelopeError(
+      `Invalid job result: header exceeds ${MAX_JOB_RESULT_HEADER_BYTES} bytes`
+    );
+  }
+  const plaintext = new Uint8Array(
+    JOB_RESULT_LENGTH_PREFIX_BYTES + header.length + result.body.length
+  );
+  new DataView(plaintext.buffer).setUint32(0, header.length);
+  plaintext.set(header, JOB_RESULT_LENGTH_PREFIX_BYTES);
+  plaintext.set(result.body, JOB_RESULT_LENGTH_PREFIX_BYTES + header.length);
+  return plaintext;
+}
+function parseResultPlaintext(plaintext) {
+  if (plaintext.length < JOB_RESULT_LENGTH_PREFIX_BYTES) {
+    throw new JobEnvelopeError(
+      "Invalid job result: missing header length prefix"
+    );
+  }
+  const headerLength = new DataView(
+    plaintext.buffer,
+    plaintext.byteOffset,
+    JOB_RESULT_LENGTH_PREFIX_BYTES
+  ).getUint32(0);
+  if (headerLength > MAX_JOB_RESULT_HEADER_BYTES) {
+    throw new JobEnvelopeError(
+      `Invalid job result: header exceeds ${MAX_JOB_RESULT_HEADER_BYTES} bytes`
+    );
+  }
+  const remainingLength = plaintext.length - JOB_RESULT_LENGTH_PREFIX_BYTES;
+  if (headerLength > remainingLength) {
+    throw new JobEnvelopeError(
+      "Invalid job result: header length exceeds payload"
+    );
+  }
+  const headerEnd = JOB_RESULT_LENGTH_PREFIX_BYTES + headerLength;
+  const header = parseObject(
+    plaintext.subarray(JOB_RESULT_LENGTH_PREFIX_BYTES, headerEnd),
+    "job result header"
+  );
+  return validateResult({ ...header, body: plaintext.subarray(headerEnd) });
+}
+function encryptedBytesToBase64(encrypted) {
+  return toBase64(fromHex6(`0x${serializeECIES(encrypted)}`, "bytes"));
+}
+function encryptedToBytes(encrypted) {
+  const bytes = new Uint8Array(
+    encrypted.iv.length + encrypted.ephemPublicKey.length + encrypted.ciphertext.length + encrypted.mac.length
+  );
+  let offset = 0;
+  bytes.set(encrypted.iv, offset);
+  offset += encrypted.iv.length;
+  bytes.set(encrypted.ephemPublicKey, offset);
+  offset += encrypted.ephemPublicKey.length;
+  bytes.set(encrypted.ciphertext, offset);
+  offset += encrypted.ciphertext.length;
+  bytes.set(encrypted.mac, offset);
+  return bytes;
+}
+function bytesToEncrypted(bytes) {
+  const absoluteMinLength = FORMAT.IV_LENGTH + 1 + MAC.LENGTH + 1;
+  if (bytes.length < absoluteMinLength) {
+    throw new ECIESError(
+      `Invalid ECIES data: too short (${bytes.length} bytes, minimum ${absoluteMinLength} bytes required)`,
+      "DECRYPTION_FAILED"
+    );
+  }
+  const prefix = bytes[FORMAT.EPHEMERAL_KEY_OFFSET];
+  if (prefix !== CURVE.PREFIX.UNCOMPRESSED) {
+    throw new ECIESError(
+      `Invalid ephemeral public key: must be uncompressed format (0x04 prefix), got 0x${prefix.toString(16).padStart(2, "0")}`,
+      "DECRYPTION_FAILED"
+    );
+  }
+  const ephemKeySize = CURVE.UNCOMPRESSED_PUBLIC_KEY_LENGTH;
+  const minLength = FORMAT.IV_LENGTH + ephemKeySize + MAC.LENGTH + 1;
+  if (bytes.length < minLength) {
+    throw new ECIESError(
+      `Invalid ECIES data: too short (${bytes.length} bytes, minimum ${minLength} bytes required)`,
+      "DECRYPTION_FAILED"
+    );
+  }
+  return {
+    iv: bytes.subarray(FORMAT.IV_OFFSET, FORMAT.IV_OFFSET + FORMAT.IV_LENGTH),
+    ephemPublicKey: bytes.subarray(
+      FORMAT.EPHEMERAL_KEY_OFFSET,
+      FORMAT.EPHEMERAL_KEY_OFFSET + ephemKeySize
+    ),
+    ciphertext: bytes.subarray(
+      FORMAT.EPHEMERAL_KEY_OFFSET + ephemKeySize,
+      bytes.length - MAC.LENGTH
+    ),
+    mac: bytes.subarray(bytes.length - MAC.LENGTH)
+  };
+}
+function base64ToEncrypted(ciphertext) {
+  return deserializeECIES(toHex8(fromBase64(ciphertext)));
+}
+function parseObject(plaintext, kind) {
+  try {
+    const value = JSON.parse(textDecoder.decode(plaintext));
+    if (value === null || typeof value !== "object" || Array.isArray(value)) {
+      throw new JobEnvelopeError(`Invalid ${kind}: expected an object`);
+    }
+    return value;
+  } catch (error) {
+    if (error instanceof JobEnvelopeError) throw error;
+    throw new JobEnvelopeError(`Invalid ${kind}: malformed JSON`);
+  }
+}
+function isPlainObject2(value) {
+  if (value === null || typeof value !== "object") return false;
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+function requirePlainObject(value, field, kind) {
+  if (!isPlainObject2(value)) {
+    throw new JobEnvelopeError(`Invalid ${kind}: invalid ${field}`);
+  }
+}
+function requireExactKeys(value, expectedKeys, kind) {
+  for (const key of expectedKeys) {
+    if (!Object.hasOwn(value, key) || value[key] === void 0) {
+      throw new JobEnvelopeError(`Invalid ${kind}: missing ${key}`);
+    }
+  }
+  const expected = new Set(expectedKeys);
+  for (const key of Reflect.ownKeys(value)) {
+    if (!expected.has(key)) {
+      throw new JobEnvelopeError(
+        `Invalid ${kind}: unknown field ${String(key)}`
+      );
+    }
+  }
+}
+function requireString(value, field, kind) {
+  if (typeof value !== "string" || value.length === 0) {
+    throw new JobEnvelopeError(`Invalid ${kind}: missing ${field}`);
+  }
+}
+function validateJobRequest(value) {
+  requirePlainObject(value, "request", "job request");
+  requireExactKeys(
+    value,
+    [
+      "v",
+      "jobId",
+      "owner",
+      "builder",
+      "builderPublicKey",
+      "grantId",
+      "scope",
+      "operation",
+      "pinnedVersion",
+      "deadline"
+    ],
+    "job request"
+  );
+  if (value.v !== JOB_PROTOCOL_VERSION) {
+    throw new JobEnvelopeError(
+      `Unsupported job request version: ${String(value.v)}`
+    );
+  }
+  requireString(value.jobId, "jobId", "job request");
+  if (typeof value.owner !== "string" || !isAddress(value.owner)) {
+    throw new JobEnvelopeError("Invalid job request: invalid owner");
+  }
+  if (typeof value.builder !== "string" || !isAddress(value.builder)) {
+    throw new JobEnvelopeError("Invalid job request: invalid builder");
+  }
+  if (typeof value.builderPublicKey !== "string" || !isHex(value.builderPublicKey)) {
+    throw new JobEnvelopeError("Invalid job request: invalid builderPublicKey");
+  }
+  if (typeof value.grantId !== "string" || !isHex(value.grantId)) {
+    throw new JobEnvelopeError("Invalid job request: invalid grantId");
+  }
+  requireString(value.scope, "scope", "job request");
+  if (!JOB_OPERATIONS.includes(value.operation)) {
+    throw new JobEnvelopeError("Invalid job request: invalid operation");
+  }
+  if (value.pinnedVersion !== null && typeof value.pinnedVersion !== "string") {
+    throw new JobEnvelopeError("Invalid job request: missing pinnedVersion");
+  }
+  if (typeof value.deadline !== "string" || !Number.isFinite(Date.parse(value.deadline))) {
+    throw new JobEnvelopeError("Invalid job request: invalid deadline");
+  }
+  return value;
+}
+function validateRequestEnvelope(value) {
+  requirePlainObject(value, "envelope", "job request envelope");
+  requireExactKeys(value, ["request", "auth"], "job request envelope");
+  validateJobRequest(value.request);
+  requireString(value.auth, "auth", "job request envelope");
+  return value;
+}
+function validateResult(value) {
+  requirePlainObject(value, "result", "job result");
+  requireExactKeys(
+    value,
+    ["v", "jobId", "scope", "version", "contentType", "body"],
+    "job result"
+  );
+  if (value.v !== JOB_PROTOCOL_VERSION) {
+    throw new JobEnvelopeError(
+      `Unsupported job result version: ${String(value.v)}`
+    );
+  }
+  for (const field of ["jobId", "scope", "contentType"]) {
+    requireString(value[field], field, "job result");
+  }
+  if (!(value.body instanceof Uint8Array)) {
+    throw new JobEnvelopeError("Invalid job result: missing body");
+  }
+  if (value.version !== null && typeof value.version !== "string") {
+    throw new JobEnvelopeError("Invalid job result: missing version");
+  }
+  return value;
+}
+async function sealJobRequest(envelope, enclavePublicKey, ecies) {
+  const encrypted = await ecies.encrypt(
+    fromHex6(enclavePublicKey, "bytes"),
+    requestPlaintext(envelope)
+  );
+  return encryptedBytesToBase64(encrypted);
+}
+async function openJobRequest(ciphertext, privateKey, ecies) {
+  const plaintext = await ecies.decrypt(
+    privateKey,
+    base64ToEncrypted(ciphertext)
+  );
+  return validateRequestEnvelope(
+    parseObject(plaintext, "job request envelope")
+  );
+}
+async function sealJobResult(result, builderPublicKey, ecies) {
+  validateResult(result);
+  const encrypted = await ecies.encrypt(
+    fromHex6(builderPublicKey, "bytes"),
+    resultPlaintext(result)
+  );
+  const bytes = encryptedToBytes(encrypted);
+  return { bytes, hash: bytesToHex2(sha2565(bytes)), size: bytes.length };
+}
+async function openJobResult(sealedBytes, builderPrivateKey, ecies, expect) {
+  const plaintext = await ecies.decrypt(
+    fromHex6(builderPrivateKey, "bytes"),
+    bytesToEncrypted(sealedBytes)
+  );
+  const result = parseResultPlaintext(plaintext);
+  if (result.jobId !== expect.jobId) {
+    throw new JobEnvelopeError(
+      `Job result ID ${result.jobId} does not match expected job ID ${expect.jobId}`
+    );
+  }
+  if (expect.scope !== void 0 && result.scope !== expect.scope) {
+    throw new JobEnvelopeError(
+      `Job result scope ${result.scope} does not match expected scope ${expect.scope}`
+    );
+  }
+  if (expect.version !== void 0 && result.version !== expect.version) {
+    throw new JobEnvelopeError(
+      `Job result version ${String(result.version)} does not match expected version ${String(expect.version)}`
+    );
+  }
+  return result;
+}
+
+// src/protocol/write-signer.ts
+function isRecord(value) {
+  return value !== null && typeof value === "object";
+}
+function isViemWriteAccount(source) {
+  return isRecord(source) && source.type === "local" && typeof source.address === "string" && typeof source.signMessage === "function";
+}
+function isViemWriteWalletClient(source) {
+  return isRecord(source) && typeof source.signMessage === "function" && source.type !== "local" && (source.type === "walletClient" || "transport" in source);
+}
+function accountAddress(account) {
+  return typeof account === "string" ? account : account.address;
+}
+function resolveWriteSigner(source, options = {}) {
+  if (isViemWriteWalletClient(source)) {
+    const account = options.account ?? source.account;
+    if (account === void 0) {
+      throw new WriteRequestError(
+        "Viem wallet client requires an account option or account property"
+      );
+    }
+    return {
+      address: accountAddress(account),
+      signMessage: (message) => source.signMessage({ account, message })
+    };
+  }
+  if (isViemWriteAccount(source)) {
+    return {
+      address: source.address,
+      signMessage: (message) => source.signMessage({ message })
+    };
+  }
+  if (!isRecord(source) || typeof source.signMessage !== "function") {
+    throw new WriteRequestError(
+      "signer must be a viem LocalAccount, a viem WalletClient, or a { signMessage } object"
+    );
+  }
+  return source;
+}
+
+// src/protocol/jobs-client.ts
+var IDENTITY_PATH = "/v1/identity";
+var JOBS_PATH = "/v1/jobs";
+var JOB_EXECUTE_PATH = "/v1/jobs/execute";
+var AUTHORIZATION_HEADER = "Authorization";
+var CONTENT_TYPE_HEADER = "Content-Type";
+var JSON_CONTENT_TYPE = "application/json";
+var GET_METHOD = "GET";
+var POST_METHOD = "POST";
+var RAW_READ_OPERATION = "raw_read";
+var SEALED_IDENTITY_STATE = "sealed";
+var HTTP_OK = 200;
+var HTTP_ACCEPTED = 202;
+var HTTP_UNAUTHORIZED = 401;
+var HTTP_FORBIDDEN = 403;
+var HTTP_NOT_FOUND = 404;
+var HTTP_CONFLICT = 409;
+var HTTP_PAYLOAD_TOO_LARGE = 413;
+var MILLISECONDS_PER_SECOND = 1e3;
+var DEFAULT_JOB_TIMEOUT_MS = 12e4;
+var DEFAULT_JOB_POLL_MS = CLAIM_POLL_FLOOR_MS;
+var TERMINAL_JOB_STATES = /* @__PURE__ */ new Set([
+  "completed",
+  "failed",
+  "expired",
+  "cancelled"
+]);
+function isRecord2(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function normalizeGateway(gatewayUrl) {
+  try {
+    const url = new URL(gatewayUrl);
+    if (url.pathname !== "/" || url.search !== "" || url.hash !== "") {
+      throw new JobRejectedError(
+        "gatewayUrl must be an origin without a path, query, or fragment"
+      );
+    }
+    return {
+      baseUrl: url.origin,
+      audience: url.origin
+    };
+  } catch (error) {
+    if (error instanceof JobRejectedError) throw error;
+    throw new JobRejectedError(
+      "gatewayUrl must be an absolute URL",
+      void 0,
+      null,
+      {
+        cause: error instanceof Error ? error.message : String(error)
+      }
+    );
+  }
+}
+function resolveFetch(fetchFn) {
+  const resolved = fetchFn ?? globalThis.fetch;
+  if (resolved === void 0) {
+    throw new JobRejectedError("No fetch implementation available");
+  }
+  return resolved;
+}
+function sourcePublicKey(source) {
+  if (isRecord2(source) && typeof source["publicKey"] === "string") {
+    return source["publicKey"];
+  }
+  return void 0;
+}
+function resolveBuilder(options) {
+  if (options.builderPrivateKey && options.builderAccount) {
+    throw new JobRejectedError(
+      "Provide builderPrivateKey or builderAccount, not both"
+    );
+  }
+  let source;
+  try {
+    source = options.builderPrivateKey ? privateKeyToAccount(options.builderPrivateKey) : options.builderAccount;
+  } catch (error) {
+    throw new JobRejectedError("Invalid builder private key", void 0, null, {
+      cause: error instanceof Error ? error.message : String(error)
+    });
+  }
+  if (!source) {
+    throw new JobRejectedError(
+      "builderPrivateKey or builderAccount is required"
+    );
+  }
+  let signer;
+  try {
+    signer = resolveWriteSigner(source);
+  } catch (error) {
+    throw new JobRejectedError("Invalid builder signer", void 0, null, {
+      cause: error instanceof Error ? error.message : String(error)
+    });
+  }
+  const publicKey = sourcePublicKey(source);
+  if (!signer.address || !publicKey) {
+    throw new JobRejectedError(
+      "Builder signer must expose both address and publicKey"
+    );
+  }
+  return {
+    builder: {
+      address: signer.address,
+      publicKey,
+      signMessage: signer.signMessage
+    },
+    ...options.builderPrivateKey ? { privateKey: options.builderPrivateKey } : {}
+  };
+}
+function clampInteger(value, fallback, minimum, maximum, field) {
+  const resolved = value ?? fallback;
+  if (!Number.isFinite(resolved)) {
+    throw new JobRejectedError(`${field} must be a finite number`);
+  }
+  return Math.min(maximum, Math.max(minimum, Math.trunc(resolved)));
+}
+async function responseBody(response) {
+  try {
+    return await response.json();
+  } catch {
+    return null;
+  }
+}
+function gatewayErrorBody(body, fallback) {
+  if (!isRecord2(body)) return { code: null, message: fallback };
+  const code = typeof body["code"] === "string" ? body["code"] : null;
+  const message = typeof body["error"] === "string" ? body["error"] : typeof body["message"] === "string" ? body["message"] : fallback;
+  const reason = typeof body["reason"] === "string" ? body["reason"] : void 0;
+  const details = isRecord2(body["details"]) ? body["details"] : void 0;
+  return {
+    code,
+    message,
+    ...reason ? { reason } : {},
+    ...details ? { details } : {}
+  };
+}
+async function rejectedResponse(response, fallback) {
+  const parsed = gatewayErrorBody(await responseBody(response), fallback);
+  const details = response.status === HTTP_UNAUTHORIZED && parsed.reason ? { ...parsed.details, reason: parsed.reason } : parsed.details;
+  const message = response.status === HTTP_UNAUTHORIZED && parsed.reason ? `${parsed.message}: ${parsed.reason}` : parsed.message;
+  if (response.status === HTTP_FORBIDDEN) {
+    if (parsed.code === "BUILDER_UNKNOWN") {
+      return new BuilderUnknownError(parsed.message, details);
+    }
+    if (parsed.code === "GRANT_INVALID") {
+      return new GrantInvalidError(parsed.message, details);
+    }
+    if (parsed.code === "OWNER_NOT_READY") {
+      return new OwnerNotReadyError(parsed.message, details);
+    }
+  }
+  if (response.status === HTTP_NOT_FOUND) {
+    return new JobNotFoundError(parsed.message, details);
+  }
+  if (response.status === HTTP_CONFLICT && parsed.code === "JOB_ID_TAKEN") {
+    return new JobIdTakenError(parsed.message, details);
+  }
+  if (response.status === HTTP_PAYLOAD_TOO_LARGE) {
+    return new JobRequestTooLargeError(parsed.message, parsed.code, details);
+  }
+  return new JobRejectedError(message, response.status, parsed.code, details);
+}
+function requireStatus(value, status) {
+  if (!isRecord2(value) || !isNonEmptyString(value["jobId"]) || typeof value["state"] !== "string" || !JOB_STATES.includes(value["state"]) || !isNonEmptyString(value["owner"]) || !isNonEmptyString(value["grantId"]) || !isNonEmptyString(value["scope"]) || !isNonEmptyString(value["operation"]) || !JOB_OPERATIONS.includes(value["operation"])) {
+    throw new JobRejectedError(
+      "Gateway response did not contain a job status",
+      status
+    );
+  }
+  return value;
+}
+function isNonEmptyString(value) {
+  return typeof value === "string" && value.length > 0;
+}
+function hasMatchingIdentityKey(value) {
+  const address = value["address"];
+  const publicKey = value["publicKey"];
+  if (typeof address !== "string" || !isAddress2(address) || typeof publicKey !== "string" || !isHex2(publicKey)) {
+    return false;
+  }
+  try {
+    return publicKeyToAddress2(publicKey).toLowerCase() === address.toLowerCase();
+  } catch {
+    return false;
+  }
+}
+function hasExpectedIdentity(value, owner, chainId) {
+  const identityOwner = value["ownerAddress"];
+  const identityChainId = value["chainId"];
+  const identityUserPsId = value["userPsId"];
+  if (!hasMatchingIdentityKey(value) || typeof identityOwner !== "string" || !isAddress2(identityOwner) || typeof identityChainId !== "number" || typeof identityUserPsId !== "string" || !isHex2(identityUserPsId)) {
+    return false;
+  }
+  return isAddressEqual2(identityOwner, owner) && identityChainId === chainId && identityUserPsId.toLowerCase() === userPsId(chainId, owner).toLowerCase();
+}
+function sleep2(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function requireFiniteDuration(value, field) {
+  if (!Number.isFinite(value)) {
+    throw new JobRejectedError(`${field} must be a finite number`);
+  }
+  return Math.max(0, value);
+}
+function createJobsClient(options) {
+  const { baseUrl, audience } = normalizeGateway(options.gatewayUrl);
+  const fetchFn = resolveFetch(options.fetch);
+  const { builder, privateKey } = resolveBuilder(options);
+  const ecies = options.ecies ?? new NodeECIESUint8Provider();
+  const now = options.now ?? (() => /* @__PURE__ */ new Date());
+  async function request(url, init, description) {
+    try {
+      return await fetchFn(url, init);
+    } catch (error) {
+      throw new JobTransportError(
+        `${description} failed: ${error instanceof Error ? error.message : String(error)}`,
+        error
+      );
+    }
+  }
+  async function getIdentity(owner) {
+    const query = new URLSearchParams({
+      owner,
+      chainId: String(options.chainId)
+    });
+    const response = await request(
+      `${baseUrl}${IDENTITY_PATH}?${query.toString()}`,
+      { method: GET_METHOD },
+      "Owner identity lookup"
+    );
+    if (response.status === HTTP_NOT_FOUND) {
+      const parsed = gatewayErrorBody(
+        await responseBody(response),
+        "Owner identity not found"
+      );
+      throw new OwnerNotReadyError(parsed.message, parsed.details);
+    }
+    if (!response.ok) {
+      throw await rejectedResponse(response, "Owner identity lookup rejected");
+    }
+    const body = await responseBody(response);
+    if (!isRecord2(body) || body["state"] !== SEALED_IDENTITY_STATE || !isRecord2(body["identity"])) {
+      throw new OwnerNotReadyError("Owner identity is not sealed", {
+        state: isRecord2(body) ? body["state"] : void 0
+      });
+    }
+    if (!hasExpectedIdentity(body["identity"], owner, options.chainId)) {
+      throw new JobRejectedError(
+        "Gateway returned a malformed or mismatched owner identity",
+        response.status
+      );
+    }
+    return body["identity"];
+  }
+  const client = {
+    async submitRawRead(params) {
+      const identity = await getIdentity(params.owner);
+      const deadlineSeconds = clampInteger(
+        params.deadlineSeconds,
+        DEFAULT_JOB_DEADLINE_SECONDS,
+        1,
+        MAX_JOB_DEADLINE_SECONDS,
+        "deadlineSeconds"
+      );
+      const wait = clampInteger(params.wait, 0, 0, MAX_WAIT_SECONDS, "wait");
+      const jobId = randomUUID();
+      const nowMs = now().getTime();
+      if (!Number.isFinite(nowMs)) {
+        throw new JobRejectedError("now must return a valid Date");
+      }
+      const deadline = new Date(
+        nowMs + deadlineSeconds * MILLISECONDS_PER_SECOND
+      ).toISOString();
+      const requestBody = {
+        v: JOB_PROTOCOL_VERSION,
+        jobId,
+        owner: params.owner,
+        builder: builder.address,
+        builderPublicKey: builder.publicKey,
+        grantId: params.grantId,
+        scope: params.scope,
+        operation: RAW_READ_OPERATION,
+        pinnedVersion: params.pinnedVersion ?? null,
+        deadline
+      };
+      const auth = await buildWeb3SignedHeader({
+        signMessage: builder.signMessage,
+        aud: audience,
+        method: POST_METHOD,
+        uri: JOB_EXECUTE_PATH,
+        bodyHash: computeBodyHash(canonicalJobRequestBytes(requestBody)),
+        nonce: randomUUID()
+      });
+      const requestCiphertext = await sealJobRequest(
+        { request: requestBody, auth },
+        identity.publicKey,
+        ecies
+      );
+      const submission = {
+        owner: requestBody.owner,
+        grantId: requestBody.grantId,
+        scope: requestBody.scope,
+        operation: requestBody.operation,
+        idempotencyKey: randomUUID(),
+        jobId,
+        deadline,
+        requestCiphertext
+      };
+      const bodyBytes = new TextEncoder().encode(JSON.stringify(submission));
+      const authorization = await buildWeb3SignedHeader({
+        signMessage: builder.signMessage,
+        aud: audience,
+        method: POST_METHOD,
+        uri: JOBS_PATH,
+        body: bodyBytes,
+        nonce: randomUUID()
+      });
+      const response = await request(
+        `${baseUrl}${JOBS_PATH}?wait=${wait}`,
+        {
+          method: POST_METHOD,
+          headers: {
+            [AUTHORIZATION_HEADER]: authorization,
+            [CONTENT_TYPE_HEADER]: JSON_CONTENT_TYPE
+          },
+          body: bodyBytes
+        },
+        "Job submission"
+      );
+      if (!response.ok) {
+        throw await rejectedResponse(response, "Job submission rejected");
+      }
+      const body = await responseBody(response);
+      if (response.status === HTTP_OK && isRecord2(body)) {
+        const job = requireStatus(body["job"], response.status);
+        if (job.jobId !== jobId) {
+          throw new JobRejectedError(
+            "Gateway returned a job id that does not match the submission",
+            response.status
+          );
+        }
+        return { jobId, state: job.state, job };
+      }
+      if (response.status === HTTP_ACCEPTED && isRecord2(body) && body["jobId"] === jobId && typeof body["state"] === "string" && JOB_STATES.includes(body["state"])) {
+        return { jobId, state: body["state"] };
+      }
+      throw new JobRejectedError(
+        "Gateway returned an undocumented job submission response",
+        response.status
+      );
+    },
+    async getJob(jobId) {
+      const path = `${JOBS_PATH}/${encodeURIComponent(jobId)}`;
+      const authorization = await buildWeb3SignedHeader({
+        signMessage: builder.signMessage,
+        aud: audience,
+        method: GET_METHOD,
+        uri: path,
+        nonce: randomUUID()
+      });
+      const response = await request(
+        `${baseUrl}${path}`,
+        {
+          method: GET_METHOD,
+          headers: { [AUTHORIZATION_HEADER]: authorization }
+        },
+        "Job status read"
+      );
+      if (!response.ok) {
+        throw await rejectedResponse(response, "Job status read rejected");
+      }
+      const body = await responseBody(response);
+      return requireStatus(
+        isRecord2(body) ? body["job"] : void 0,
+        response.status
+      );
+    },
+    async waitForJob(jobId, waitOptions = {}) {
+      const timeoutMs = requireFiniteDuration(
+        waitOptions.timeoutMs ?? DEFAULT_JOB_TIMEOUT_MS,
+        "timeoutMs"
+      );
+      const pollMs = Math.max(
+        CLAIM_POLL_FLOOR_MS,
+        requireFiniteDuration(
+          waitOptions.pollMs ?? DEFAULT_JOB_POLL_MS,
+          "pollMs"
+        )
+      );
+      const startedAt = Date.now();
+      const callerDeadline = startedAt + timeoutMs;
+      let latest;
+      for (; ; ) {
+        if (Date.now() >= callerDeadline) {
+          throw new JobTimeoutError(
+            `Timed out waiting for terminal job ${jobId}`,
+            {
+              jobId,
+              timeoutMs,
+              state: latest?.state
+            }
+          );
+        }
+        latest = await client.getJob(jobId);
+        if (TERMINAL_JOB_STATES.has(latest.state)) return latest;
+        const remaining = callerDeadline - Date.now();
+        if (remaining <= 0) {
+          throw new JobTimeoutError(
+            `Timed out waiting for terminal job ${jobId}`,
+            {
+              jobId,
+              timeoutMs,
+              state: latest.state
+            }
+          );
+        }
+        await sleep2(Math.min(pollMs, remaining));
+      }
+    },
+    async openResult(handle, openOptions) {
+      if (!privateKey) {
+        throw new JobRejectedError(
+          "openResult requires createJobsClient({ builderPrivateKey })"
+        );
+      }
+      const response = await request(
+        handle.url,
+        { method: GET_METHOD },
+        "Job result fetch"
+      );
+      if (!response.ok) {
+        throw await rejectedResponse(response, "Job result fetch rejected");
+      }
+      let bytes;
+      try {
+        bytes = new Uint8Array(await response.arrayBuffer());
+      } catch (error) {
+        throw new JobTransportError(
+          `Job result fetch failed: ${error instanceof Error ? error.message : String(error)}`,
+          error
+        );
+      }
+      const actualHash = bytesToHex3(sha2566(bytes));
+      if (actualHash.toLowerCase() !== handle.hash.toLowerCase()) {
+        throw new JobResultIntegrityError(
+          "Fetched job result hash does not match its handle",
+          {
+            objectKey: handle.objectKey,
+            expectedHash: handle.hash,
+            actualHash
+          }
+        );
+      }
+      if (bytes.length !== handle.size) {
+        throw new JobResultIntegrityError(
+          "Fetched job result size does not match its handle",
+          {
+            objectKey: handle.objectKey,
+            expectedSize: handle.size,
+            actualSize: bytes.length
+          }
+        );
+      }
+      return openJobResult(bytes, privateKey, ecies, openOptions.expect);
+    },
+    async readRaw(params) {
+      const submitted = await client.submitRawRead(params);
+      const job = submitted.job && TERMINAL_JOB_STATES.has(submitted.job.state) ? submitted.job : await client.waitForJob(submitted.jobId, {
+        timeoutMs: params.timeoutMs,
+        pollMs: params.pollMs
+      });
+      if (job.state !== "completed") {
+        throw new JobRejectedError(
+          `Job ${job.jobId} ended in state ${job.state}${job.failureReason ? `: ${job.failureReason}` : ""}`,
+          void 0,
+          null,
+          {
+            jobId: job.jobId,
+            state: job.state,
+            ...job.failureReason ? { failureReason: job.failureReason } : {}
+          }
+        );
+      }
+      if (!job.result) {
+        throw new JobRejectedError(
+          "Completed job status does not include a result handle",
+          void 0,
+          null,
+          { jobId: job.jobId, state: job.state }
+        );
+      }
+      return client.openResult(job.result, {
+        expect: {
+          jobId: submitted.jobId,
+          scope: params.scope,
+          ...params.pinnedVersion !== void 0 && params.pinnedVersion !== null ? { version: params.pinnedVersion } : {}
+        }
+      });
+    }
+  };
+  return client;
+}
+
 // src/protocol/personal-server-registration.ts
 import {
-  isAddress
+  isAddress as isAddress3
 } from "viem";
 var PERSONAL_SERVER_REGISTRATION_DEFAULT_CHAIN_ID = vanaMainnet2.id;
 var PERSONAL_SERVER_REGISTRATION_DEFAULT_VERIFYING_CONTRACT = getContractAddress(
@@ -32373,7 +33494,7 @@ var PERSONAL_SERVER_REGISTRATION_DEFAULT_VERIFYING_CONTRACT = getContractAddress
   "DataPortabilityServers"
 );
 function assertAddress(value, name) {
-  if (!isAddress(value)) {
+  if (!isAddress3(value)) {
     throw new Error(`${name} must be a valid EVM address`);
   }
 }
@@ -32460,13 +33581,13 @@ var registerPersonalServerSignature = buildPersonalServerRegistrationSignature;
 
 // src/personal-server-lite/owner-binding.ts
 import {
-  isAddress as isAddress2
+  isAddress as isAddress4
 } from "viem";
 var PERSONAL_SERVER_LITE_OWNER_BINDING_VERSION = "vana.ps-lite.owner-binding.v1";
 var PERSONAL_SERVER_LITE_OWNER_BINDING_PURPOSE = "ps-lite-owner";
 var PERSONAL_SERVER_LITE_OWNER_BINDING_PREFIX = `${PERSONAL_SERVER_LITE_OWNER_BINDING_VERSION}:${PERSONAL_SERVER_LITE_OWNER_BINDING_PURPOSE}:`;
 function assertAddress2(value, name) {
-  if (!isAddress2(value)) {
+  if (!isAddress4(value)) {
     throw new Error(`${name} must be a valid EVM address`);
   }
 }
@@ -32516,7 +33637,7 @@ async function buildPersonalServerLiteOwnerBindingSignature(input) {
 var signPersonalServerLiteOwnerBinding = buildPersonalServerLiteOwnerBindingSignature;
 
 // src/account/personal-server-registration.ts
-import { isAddress as isAddress3 } from "viem";
+import { isAddress as isAddress5 } from "viem";
 var ACCOUNT_PERSONAL_SERVER_REGISTRATION_INTENT = "personal_server.server_registration.v1";
 var AccountPersonalServerRegistrationError = class extends Error {
   status;
@@ -32535,7 +33656,7 @@ function trimTrailingSlash(value) {
   return value.replace(/\/+$/, "");
 }
 function assertAddress3(value, name) {
-  if (!isAddress3(value)) {
+  if (!isAddress5(value)) {
     throw new Error(`${name} must be a valid EVM address`);
   }
 }
@@ -32556,7 +33677,7 @@ function accountErrorMessage(status, body) {
   if (nestedMessage) {
     return nestedMessage;
   }
-  if (isRecord(body) && typeof body.message === "string") {
+  if (isRecord3(body) && typeof body.message === "string") {
     return body.message;
   }
   const code = accountErrorCode(body);
@@ -32570,7 +33691,7 @@ function accountErrorCode(body) {
   if (nestedCode) {
     return nestedCode;
   }
-  if (isRecord(body)) {
+  if (isRecord3(body)) {
     if (typeof body.code === "string") {
       return body.code;
     }
@@ -32581,13 +33702,13 @@ function accountErrorCode(body) {
   return void 0;
 }
 function nestedAccountErrorField(body, field) {
-  if (!isRecord(body) || !isRecord(body.error)) {
+  if (!isRecord3(body) || !isRecord3(body.error)) {
     return void 0;
   }
   const value = body.error[field];
   return typeof value === "string" ? value : void 0;
 }
-function isRecord(value) {
+function isRecord3(value) {
   return typeof value === "object" && value !== null;
 }
 function normalizeAccountResponse(response) {
@@ -33061,8 +34182,8 @@ function buildMarkDataPointUnavailableRequest(config, input) {
 
 // src/protocol/data-point-deletion.ts
 import {
-  isAddress as isAddress5,
-  keccak256 as keccak2562,
+  isAddress as isAddress7,
+  keccak256 as keccak2563,
   maxUint256,
   stringToBytes as stringToBytes3
 } from "viem";
@@ -33070,13 +34191,13 @@ import {
 // src/protocol/lineage.ts
 import {
   encodeAbiParameters,
-  isAddress as isAddress4,
-  keccak256
+  isAddress as isAddress6,
+  keccak256 as keccak2562
 } from "viem";
 import { z } from "zod";
 
 // src/protocol/personal-server-error-body.ts
-function isRecord2(value) {
+function isRecord4(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 async function readPersonalServerErrorBody(response) {
@@ -33086,8 +34207,8 @@ async function readPersonalServerErrorBody(response) {
   } catch {
     return { errorCode: null, message: null };
   }
-  if (!isRecord2(body)) return { errorCode: null, message: null };
-  const nested = isRecord2(body.error) ? body.error : null;
+  if (!isRecord4(body)) return { errorCode: null, message: null };
+  const nested = isRecord4(body.error) ? body.error : null;
   const gatewayShape = typeof body.error === "string" && typeof body.code === "string";
   const code = nested?.errorCode ?? nested?.code ?? body.errorCode ?? (gatewayShape ? body.code : void 0) ?? (typeof body.error === "string" ? body.error : void 0) ?? body.code;
   const message = nested?.message ?? body.message ?? (gatewayShape ? body.error : void 0);
@@ -33100,62 +34221,22 @@ async function readPersonalServerErrorBody(response) {
   return {
     errorCode: typeof code === "string" ? code : null,
     message: typeof message === "string" ? message : null,
-    ...isRecord2(details) ? { details } : {}
+    ...isRecord4(details) ? { details } : {}
   };
 }
 
-// src/protocol/write-signer.ts
-function isRecord3(value) {
-  return value !== null && typeof value === "object";
-}
-function isViemWriteAccount(source) {
-  return isRecord3(source) && source.type === "local" && typeof source.address === "string" && typeof source.signMessage === "function";
-}
-function isViemWriteWalletClient(source) {
-  return isRecord3(source) && typeof source.signMessage === "function" && source.type !== "local" && (source.type === "walletClient" || "transport" in source);
-}
-function accountAddress(account) {
-  return typeof account === "string" ? account : account.address;
-}
-function resolveWriteSigner(source, options = {}) {
-  if (isViemWriteWalletClient(source)) {
-    const account = options.account ?? source.account;
-    if (account === void 0) {
-      throw new WriteRequestError(
-        "Viem wallet client requires an account option or account property"
-      );
-    }
-    return {
-      address: accountAddress(account),
-      signMessage: (message) => source.signMessage({ account, message })
-    };
-  }
-  if (isViemWriteAccount(source)) {
-    return {
-      address: source.address,
-      signMessage: (message) => source.signMessage({ message })
-    };
-  }
-  if (!isRecord3(source) || typeof source.signMessage !== "function") {
-    throw new WriteRequestError(
-      "signer must be a viem LocalAccount, a viem WalletClient, or a { signMessage } object"
-    );
-  }
-  return source;
-}
-
 // src/protocol/lineage.ts
 var DATA_POINT_ID_PATTERN = /^0x[0-9a-fA-F]{64}$/;
 function isDataPointId(value) {
   return typeof value === "string" && DATA_POINT_ID_PATTERN.test(value);
 }
 function deriveDataPointId(ownerAddress, scope) {
-  if (!isAddress4(ownerAddress, { strict: false })) {
+  if (!isAddress6(ownerAddress, { strict: false })) {
     throw new Error(
       `ownerAddress is not an EVM address: ${String(ownerAddress)}`
     );
   }
-  return keccak256(
+  return keccak2562(
     encodeAbiParameters(
       [
         { name: "ownerAddress", type: "address" },
@@ -33245,7 +34326,7 @@ function gatewayLineagePath(dataPointId, version) {
 function normalizeBaseUrl(url) {
   return url.replace(/\/+$/, "");
 }
-function resolveFetch(fetchFn) {
+function resolveFetch2(fetchFn) {
   const resolved = fetchFn ?? globalThis.fetch;
   if (resolved === void 0) {
     throw new LineageReadError("No fetch implementation available");
@@ -33286,7 +34367,7 @@ async function parseLineageGraph(source, response) {
       { cause: err instanceof Error ? err.message : String(err) }
     );
   }
-  const envelope = isRecord2(body) && isRecord2(body.data) ? body : void 0;
+  const envelope = isRecord4(body) && isRecord4(body.data) ? body : void 0;
   const parsed = LineageGraphSchema.safeParse(envelope?.data ?? body);
   if (!parsed.success) {
     throw new LineageReadError(
@@ -33296,7 +34377,7 @@ async function parseLineageGraph(source, response) {
       { issues: parsed.error.issues }
     );
   }
-  const proof = isRecord2(envelope?.proof) ? envelope.proof : void 0;
+  const proof = isRecord4(envelope?.proof) ? envelope.proof : void 0;
   return proof === void 0 ? parsed.data : { ...parsed.data, proof };
 }
 async function sendLineageRead(source, fetchFn, url, headers) {
@@ -33317,7 +34398,7 @@ async function sendLineageRead(source, fetchFn, url, headers) {
   return parseLineageGraph(source, response);
 }
 async function getPersonalServerLineage(params) {
-  const fetchFn = resolveFetch(params.fetch);
+  const fetchFn = resolveFetch2(params.fetch);
   const baseUrl = normalizeBaseUrl(params.personalServerUrl);
   const audience = params.audience ?? baseUrl;
   const signer = resolveWriteSigner(params.signer, { account: params.account });
@@ -33352,7 +34433,7 @@ async function getGatewayLineage(params) {
       { dataPointId: params.dataPointId }
     );
   }
-  const fetchFn = resolveFetch(params.fetch);
+  const fetchFn = resolveFetch2(params.fetch);
   const baseUrl = normalizeBaseUrl(params.gatewayUrl);
   const signer = resolveWriteSigner(params.signer, { account: params.account });
   const uri = gatewayLineagePath(
@@ -33382,7 +34463,7 @@ var TOMBSTONE_METADATA_HASH_PREIMAGE = "vana.data-point.tombstone.metadata.v1";
 var TOMBSTONE_DATA_HASH = "0x30c45ee72fe56d1927701316925ab7ceacd3b6f9267061735d59396f075c6222";
 var TOMBSTONE_METADATA_HASH = "0xc5255a141acd6a2ae55971b62c0a85977c2511989dc114ad2abc2b7644f57d90";
 function computeTombstoneHash(preimage) {
-  return keccak2562(stringToBytes3(preimage));
+  return keccak2563(stringToBytes3(preimage));
 }
 function isTombstoneHashes(dataHash, metadataHash) {
   return typeof dataHash === "string" && typeof metadataHash === "string" && dataHash.toLowerCase() === TOMBSTONE_DATA_HASH && metadataHash.toLowerCase() === TOMBSTONE_METADATA_HASH;
@@ -33401,7 +34482,7 @@ function tombstoneDeletedAt(value) {
   return typeof deletedAt === "string" ? deletedAt : null;
 }
 function assertAddress4(value, name) {
-  if (!isAddress5(value)) {
+  if (!isAddress7(value)) {
     throw new Error(`${name} must be a valid EVM address`);
   }
 }
@@ -33816,17 +34897,17 @@ function tryGrantPermissions(scopes) {
 }
 
 // src/protocol/personal-server-write.ts
-import { sha256 as sha2566 } from "@noble/hashes/sha2";
-import { bytesToHex as bytesToHex3, isAddress as isAddress6 } from "viem";
+import { sha256 as sha2568 } from "@noble/hashes/sha2";
+import { bytesToHex as bytesToHex5, isAddress as isAddress8 } from "viem";
 import { z as z4 } from "zod";
 
 // src/protocol/write-request.ts
-import { sha256 as sha2565 } from "@noble/hashes/sha2";
-import { bytesToHex as bytesToHex2 } from "viem";
+import { sha256 as sha2567 } from "@noble/hashes/sha2";
+import { bytesToHex as bytesToHex4 } from "viem";
 function normalizeBaseUrl2(url) {
   return url.replace(/\/+$/, "");
 }
-function resolveFetch2(fetchFn) {
+function resolveFetch3(fetchFn) {
   const resolved = fetchFn ?? globalThis.fetch;
   if (resolved === void 0) {
     throw new WriteRequestError("No fetch implementation available");
@@ -33839,7 +34920,7 @@ function errorMessage(err) {
 function finiteOr(value, fallback) {
   return typeof value === "number" && Number.isFinite(value) ? value : fallback;
 }
-function sleep2(ms) {
+function sleep3(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 var issuedProofIats = /* @__PURE__ */ new Map();
@@ -33881,7 +34962,7 @@ function nextProofIat(proofKey) {
   setIssuedProofIat(proofKey, iat, last);
   const waitSec = iat - nowSec - PROOF_IAT_MAX_AHEAD_SECONDS;
   if (waitSec <= 0) return Promise.resolve(iat);
-  return sleep2(waitSec * 1e3).then(() => iat);
+  return sleep3(waitSec * 1e3).then(() => iat);
 }
 function freshProofNonce() {
   const webCrypto = globalThis.crypto;
@@ -33889,22 +34970,22 @@ function freshProofNonce() {
     return webCrypto.randomUUID();
   }
   if (typeof webCrypto?.getRandomValues === "function") {
-    return bytesToHex2(webCrypto.getRandomValues(new Uint8Array(16)));
+    return bytesToHex4(webCrypto.getRandomValues(new Uint8Array(16)));
   }
   throw new WriteRequestError(
     "No secure random source available to build a proof nonce; provide a crypto global"
   );
 }
 function proofKeyFor(parts) {
-  return bytesToHex2(
-    sha2565(
+  return bytesToHex4(
+    sha2567(
       new TextEncoder().encode(
         JSON.stringify([
           parts.aud,
           parts.method,
           parts.uri,
           parts.grantId,
-          parts.signedBytes ? bytesToHex2(sha2565(parts.signedBytes)) : ""
+          parts.signedBytes ? bytesToHex4(sha2567(parts.signedBytes)) : ""
         ])
       )
     )
@@ -33922,7 +35003,7 @@ async function sendWithFreshProof(label, fetchFn, options, proofKey, build) {
       lastError = err;
     }
     if (attempt < attempts - 1) {
-      await sleep2(delayMs);
+      await sleep3(delayMs);
       delayMs *= 2;
     }
   }
@@ -33961,7 +35042,7 @@ function dataPath(scope) {
   return `/v1/data/${encodeURIComponent(scope)}`;
 }
 async function openWriteSession(params) {
-  const fetchFn = resolveFetch2(params.fetch);
+  const fetchFn = resolveFetch3(params.fetch);
   const personalServerUrl = normalizeBaseUrl2(params.personalServerUrl);
   const audience = params.audience ?? personalServerUrl;
   const signer = resolveWriteSigner(params.signer, { account: params.account });
@@ -34041,12 +35122,12 @@ async function openWriteSession(params) {
   };
 }
 function isWriteSession(value) {
-  if (!isRecord2(value)) return false;
+  if (!isRecord4(value)) return false;
   const signer = value.signer;
-  return typeof value.personalServerUrl === "string" && typeof value.audience === "string" && typeof value.grantId === "string" && typeof value.accessToken === "string" && value.accessToken.length > 0 && typeof value.expiresAt === "number" && Number.isFinite(value.expiresAt) && Array.isArray(value.writeScopes) && value.writeScopes.every((scope) => typeof scope === "string") && isRecord2(signer) && typeof signer.signMessage === "function";
+  return typeof value.personalServerUrl === "string" && typeof value.audience === "string" && typeof value.grantId === "string" && typeof value.accessToken === "string" && value.accessToken.length > 0 && typeof value.expiresAt === "number" && Number.isFinite(value.expiresAt) && Array.isArray(value.writeScopes) && value.writeScopes.every((scope) => typeof scope === "string") && isRecord4(signer) && typeof signer.signMessage === "function";
 }
 function sessionCoversScope(session, scope) {
-  if (!isRecord2(session) || !Array.isArray(session.writeScopes) || !session.writeScopes.every((pattern) => typeof pattern === "string")) {
+  if (!isRecord4(session) || !Array.isArray(session.writeScopes) || !session.writeScopes.every((pattern) => typeof pattern === "string")) {
     throw new WriteRequestError("session must come from openWriteSession");
   }
   return session.writeScopes.some(
@@ -34091,7 +35172,7 @@ function binaryWriteSignedBytes(input) {
     mimeType: normalizeBinaryMimeType(input.contentType),
     ...input.filename ? { filename: input.filename } : {},
     sizeBytes: input.bytes.length,
-    contentHash: bytesToHex3(sha2566(input.bytes)),
+    contentHash: bytesToHex5(sha2568(input.bytes)),
     encoding: "base64",
     content: toBase64(input.bytes),
     ...metadata !== void 0 ? { metadata } : {}
@@ -34120,7 +35201,7 @@ function assertNoReservedKeys(value, where) {
   }
 }
 function isLineagePair(value) {
-  return isRecord2(value) && typeof value.ownerAddress === "string" && typeof value.scope === "string";
+  return isRecord4(value) && typeof value.ownerAddress === "string" && typeof value.scope === "string";
 }
 function normalizeLineage(lineage, derivedScope) {
   if (!Array.isArray(lineage)) {
@@ -34139,7 +35220,7 @@ function normalizeLineage(lineage, derivedScope) {
   for (const entry of lineage) {
     let id;
     if (isLineagePair(entry)) {
-      if (!isAddress6(entry.ownerAddress, { strict: false })) {
+      if (!isAddress8(entry.ownerAddress, { strict: false })) {
         throw new WriteRequestError(
           "lineage source ownerAddress must be an EVM address",
           { ownerAddress: entry.ownerAddress }
@@ -34188,7 +35269,7 @@ function assertNoLineageField(value, where) {
 }
 function buildMetadataHeader(metadata, sources) {
   if (metadata !== void 0) {
-    if (!isRecord2(metadata)) {
+    if (!isRecord4(metadata)) {
       throw new WriteRequestError("metadata must be a plain object");
     }
     assertNoReservedKeys(metadata, "metadata");
@@ -34241,7 +35322,7 @@ function prepareWrite(params) {
   if (params.data === void 0) {
     throw new WriteRequestError("Pass data (a JSON object) or binary");
   }
-  if (!isRecord2(params.data)) {
+  if (!isRecord4(params.data)) {
     throw new WriteRequestError("data must be a plain JSON object");
   }
   if (params.metadata !== void 0) {
@@ -34292,7 +35373,7 @@ async function writeData(params) {
   if (!isWriteSession(session)) {
     throw new WriteRequestError("session must come from openWriteSession");
   }
-  const fetchFn = resolveFetch2(params.fetch);
+  const fetchFn = resolveFetch3(params.fetch);
   if (typeof params.scope !== "string" || params.scope.length === 0) {
     throw new WriteRequestError("scope is required");
   }
@@ -34484,7 +35565,7 @@ function resolveRequest(params) {
       "signer must be a viem LocalAccount, a viem WalletClient, or a { signMessage } object"
     );
   }
-  const fetchFn = resolveFetch2(params.fetch);
+  const fetchFn = resolveFetch3(params.fetch);
   const baseUrl = normalizeBaseUrl2(params.personalServerUrl);
   const audience = params.audience ?? baseUrl;
   return {
@@ -34817,7 +35898,7 @@ async function waitForQuestion(params) {
         }
       );
     }
-    await sleep2(Math.min(pollIntervalMs, remaining));
+    await sleep3(Math.min(pollIntervalMs, remaining));
   }
 }
 async function askPersonalServer(params) {
@@ -34881,7 +35962,7 @@ function derivativeStatusTarget(derivedScope) {
 function normalizeBaseUrl3(url) {
   return url.replace(/\/+$/, "");
 }
-function resolveFetch3(fetchFn) {
+function resolveFetch4(fetchFn) {
   const resolved = fetchFn ?? globalThis.fetch;
   if (resolved === void 0) {
     throw new WriteRequestError("No fetch implementation available");
@@ -34894,7 +35975,7 @@ function requireDerivedScope(derivedScope) {
   }
   return derivedScope;
 }
-function sleep3(ms, signal) {
+function sleep4(ms, signal) {
   if (ms <= 0) return Promise.resolve();
   return new Promise((resolve, reject) => {
     const timer = setTimeout(() => {
@@ -34930,7 +36011,7 @@ function isDerivativeStatusSettled(status) {
 }
 async function getDerivativeStatus(params) {
   const derivedScope = requireDerivedScope(params.derivedScope);
-  const fetchFn = resolveFetch3(params.fetch);
+  const fetchFn = resolveFetch4(params.fetch);
   const baseUrl = normalizeBaseUrl3(params.personalServerUrl);
   const signer = resolveWriteSigner(params.signer, { account: params.account });
   const headers = new Headers(params.headers);
@@ -35008,7 +36089,7 @@ async function waitForDerivativeStatus(params) {
     if (waitMs > remaining) {
       throw timeoutError(latest, timeoutMs);
     }
-    await sleep3(waitMs, params.signal);
+    await sleep4(waitMs, params.signal);
   }
 }
 
@@ -36041,7 +37122,7 @@ var KNOWN_CODES = /* @__PURE__ */ new Set([
   "server_not_configured",
   "content_too_large"
 ]);
-function isRecord4(value) {
+function isRecord5(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function normalizeCode(value) {
@@ -36052,10 +37133,10 @@ function normalizeCode(value) {
   return KNOWN_CODES.has(code) ? code : null;
 }
 function extractPSErrorBody(body) {
-  if (!isRecord4(body)) {
+  if (!isRecord5(body)) {
     return null;
   }
-  const nested = isRecord4(body.error) ? body.error : null;
+  const nested = isRecord5(body.error) ? body.error : null;
   const code = normalizeCode(
     nested?.errorCode ?? nested?.code ?? body.errorCode ?? body.code
   );
@@ -36086,6 +37167,8 @@ export {
   BUILDER_REGISTRATION_TYPES,
   BlockchainError,
   BrowserPlatformAdapter,
+  BuilderUnknownError,
+  CLAIM_POLL_FLOOR_MS,
   CONTRACTS,
   CallbackStorage,
   ContractFactory,
@@ -36094,6 +37177,8 @@ export {
   DATA_REGISTRY_STATUS_ABI,
   DEFAULT_DERIVATIVE_STATUS_POLL_INTERVAL_MS,
   DEFAULT_DERIVATIVE_STATUS_TIMEOUT_MS,
+  DEFAULT_JOB_DEADLINE_SECONDS,
+  DEFAULT_LEASE_SECONDS,
   DEFAULT_QUESTION_POLL_INTERVAL_MS,
   DEFAULT_QUESTION_TIMEOUT_MS,
   DERIVATIVE_ERROR_CODES,
@@ -36118,6 +37203,9 @@ export {
   DerivativeStatusSchema,
   DropboxStorage,
   ECIESError,
+  ENCLAVE_IDENTITY_EVIDENCE_VERSION,
+  ENCLAVE_TRUST_ANCHORS,
+  ENCLAVE_WALLET_PURPOSE,
   ESCROW_DEPOSIT_ABI2 as ESCROW_DEPOSIT_ABI,
   ExpiredTokenError,
   FEE_REGISTRY_ABI,
@@ -36126,12 +37214,25 @@ export {
   GRANT_REGISTRATION_TYPES,
   GRANT_REVOCATION_TYPES,
   GoogleDriveStorage,
+  GrantInvalidError,
   InMemoryTokenStore,
   IngestResponseSchema,
   InvalidConfigurationError,
   InvalidScopeEntryError,
   InvalidSignatureError,
   IpfsStorage,
+  JOB_OPERATIONS,
+  JOB_PROTOCOL_VERSION,
+  JOB_STATES,
+  JobEnvelopeError,
+  JobIdTakenError,
+  JobNotFoundError,
+  JobRejectedError,
+  JobRequestTooLargeError,
+  JobResultIntegrityError,
+  JobTimeoutError,
+  JobTransportError,
+  JobsClientError,
   LINEAGE_FIELD,
   LINEAGE_KEY,
   LineageEntrySchema,
@@ -36139,10 +37240,16 @@ export {
   LineageNodeSchema,
   LineageReadError,
   MASTER_KEY_MESSAGE,
+  MASTER_SIGNATURE_DELIVERY_MAX_AGE_SECONDS,
+  MASTER_SIGNATURE_DELIVERY_VERSION,
+  MAX_ATTEMPTS,
+  MAX_JOB_DEADLINE_SECONDS,
+  MAX_LEASE_SECONDS,
   MAX_LINEAGE_SOURCES,
   MAX_QUESTION_CHARS,
   MAX_QUESTION_MODEL_CHARS,
   MAX_QUESTION_SOURCE_SCOPES,
+  MAX_WAIT_SECONDS,
   MissingAuthError,
   NATIVE_ASSET_ADDRESS,
   NATIVE_VANA_ASSET,
@@ -36151,6 +37258,7 @@ export {
   NodePlatformAdapter,
   NonceError,
   OAuthClient,
+  OwnerNotReadyError,
   PERSONAL_SERVER_LITE_OWNER_BINDING_PREFIX,
   PERSONAL_SERVER_LITE_OWNER_BINDING_PURPOSE,
   PERSONAL_SERVER_LITE_OWNER_BINDING_VERSION,
@@ -36176,6 +37284,7 @@ export {
   RedactedLineageNodeSchema,
   RelayerError,
   SCOPE_ACTIONS,
+  SEALED_ENVELOPE_VERSION,
   SERVER_REGISTRATION_TYPES,
   ScopeSchema,
   SerializationError,
@@ -36188,6 +37297,7 @@ export {
   TOMBSTONE_METADATA_HASH,
   TOMBSTONE_METADATA_HASH_PREIMAGE,
   TransactionPendingError,
+  USER_PS_ID_DOMAIN,
   UserRejectedRequestError,
   VanaError,
   VanaStorage,
@@ -36206,6 +37316,7 @@ export {
   WriteSessionExpiredError,
   WriteTransportError,
   WriteUnauthorizedError,
+  appRootPreimage,
   askPersonalServer,
   assertDerivedScopeNaming,
   assertValidPkceVerifier,
@@ -36219,6 +37330,7 @@ export {
   buildEscrowPaymentHeader,
   buildGrantPaymentHeader,
   buildMarkDataPointUnavailableRequest,
+  buildMasterSignatureDelivery,
   buildPersonalServerDataReadRequest,
   buildPersonalServerLiteOwnerBindingMessage,
   buildPersonalServerLiteOwnerBindingSignature,
@@ -36227,6 +37339,7 @@ export {
   buildSetDataPointStatusRequest,
   buildWeb3SignedHeader,
   builderRegistrationDomain,
+  canonicalJobRequestBytes,
   chains,
   clearContractCache,
   computeBodyHash,
@@ -36238,6 +37351,7 @@ export {
   createDefaultNonceSource,
   createEscrowGatewayClient,
   createGatewayClient,
+  createJobsClient,
   createNodePlatformAdapter,
   createPlatformAdapter,
   createPlatformAdapterFor,
@@ -36262,6 +37376,7 @@ export {
   encodeDepositTokenData,
   encodeSetDataPointStatusData,
   encodeWriteMetadataHeader,
+  encryptMasterSignatureDelivery,
   encryptWithPassword,
   escrowContractAddress,
   escrowPaymentDomain,
@@ -36296,12 +37411,15 @@ export {
   isPlatformSupported,
   isRedactedLineageNode,
   isTombstoneHashes,
+  kmsIssuedPreimage,
   listQuestions,
   mainnetServices,
   moksha,
   mokshaServices,
   mokshaTestnet2 as mokshaTestnet,
   normalizeBinaryMimeType,
+  openJobRequest,
+  openJobResult,
   openWriteSession,
   parsePSError,
   parsePersonalServerPaymentRequired,
@@ -36325,6 +37443,8 @@ export {
   scopeMatchesPattern,
   scopeNamespace,
   scopeToPathSegments,
+  sealJobRequest,
+  sealJobResult,
   serializeECIES,
   serverRegistrationDomain,
   sessionCoversScope,
@@ -36335,7 +37455,9 @@ export {
   toDirectPaymentReceipt,
   tombstoneDeletedAt,
   tryGrantPermissions,
+  userPsId,
   vanaMainnet2 as vanaMainnet,
+  verifyEnclaveIdentityEvidence,
   verifyGrantRegistration,
   verifyPkceChallenge,
   verifyWeb3Signed,