@opendatalabs/vana-sdk 3.22.0 → 3.23.0-pr.211.341f55d

package/dist/crypto/envelope/job.js

@@ -0,0 +1,333 @@
+import { sha256 } from "@noble/hashes/sha2";
+import { bytesToHex, fromHex, isAddress, isHex, toHex } from "viem";
+import { CURVE, FORMAT, MAC } from "../ecies/constants.js";
+import {
+  deserializeECIES,
+  ECIESError,
+  serializeECIES
+} from "../ecies/interface.js";
+import {
+  JOB_OPERATIONS,
+  JOB_PROTOCOL_VERSION
+} from "../../protocol/jobs.js";
+import { fromBase64, toBase64 } from "../../utils/encoding.js";
+const textDecoder = new TextDecoder();
+const textEncoder = new TextEncoder();
+const MAX_JOB_RESULT_HEADER_BYTES = 4096;
+const JOB_RESULT_LENGTH_PREFIX_BYTES = 4;
+class JobEnvelopeError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "JobEnvelopeError";
+  }
+}
+function sortJsonKeys(value) {
+  if (Array.isArray(value)) {
+    return value.map(sortJsonKeys);
+  }
+  if (value !== null && typeof value === "object") {
+    return Object.fromEntries(
+      Object.keys(value).sort().map((key) => [
+        key,
+        sortJsonKeys(value[key])
+      ])
+    );
+  }
+  return value;
+}
+function canonicalJsonBytes(value) {
+  return textEncoder.encode(JSON.stringify(sortJsonKeys(value)));
+}
+function canonicalJobRequestBytes(request) {
+  validateJobRequest(request);
+  return canonicalJsonBytes(request);
+}
+function requestPlaintext(envelope) {
+  validateRequestEnvelope(envelope);
+  return canonicalJsonBytes(envelope);
+}
+function resultPlaintext(result) {
+  const header = textEncoder.encode(
+    JSON.stringify({
+      v: result.v,
+      jobId: result.jobId,
+      scope: result.scope,
+      version: result.version,
+      contentType: result.contentType
+    })
+  );
+  if (header.length > MAX_JOB_RESULT_HEADER_BYTES) {
+    throw new JobEnvelopeError(
+      `Invalid job result: header exceeds ${MAX_JOB_RESULT_HEADER_BYTES} bytes`
+    );
+  }
+  const plaintext = new Uint8Array(
+    JOB_RESULT_LENGTH_PREFIX_BYTES + header.length + result.body.length
+  );
+  new DataView(plaintext.buffer).setUint32(0, header.length);
+  plaintext.set(header, JOB_RESULT_LENGTH_PREFIX_BYTES);
+  plaintext.set(result.body, JOB_RESULT_LENGTH_PREFIX_BYTES + header.length);
+  return plaintext;
+}
+function parseResultPlaintext(plaintext) {
+  if (plaintext.length < JOB_RESULT_LENGTH_PREFIX_BYTES) {
+    throw new JobEnvelopeError(
+      "Invalid job result: missing header length prefix"
+    );
+  }
+  const headerLength = new DataView(
+    plaintext.buffer,
+    plaintext.byteOffset,
+    JOB_RESULT_LENGTH_PREFIX_BYTES
+  ).getUint32(0);
+  if (headerLength > MAX_JOB_RESULT_HEADER_BYTES) {
+    throw new JobEnvelopeError(
+      `Invalid job result: header exceeds ${MAX_JOB_RESULT_HEADER_BYTES} bytes`
+    );
+  }
+  const remainingLength = plaintext.length - JOB_RESULT_LENGTH_PREFIX_BYTES;
+  if (headerLength > remainingLength) {
+    throw new JobEnvelopeError(
+      "Invalid job result: header length exceeds payload"
+    );
+  }
+  const headerEnd = JOB_RESULT_LENGTH_PREFIX_BYTES + headerLength;
+  const header = parseObject(
+    plaintext.subarray(JOB_RESULT_LENGTH_PREFIX_BYTES, headerEnd),
+    "job result header"
+  );
+  return validateResult({ ...header, body: plaintext.subarray(headerEnd) });
+}
+function encryptedBytesToBase64(encrypted) {
+  return toBase64(fromHex(`0x${serializeECIES(encrypted)}`, "bytes"));
+}
+function encryptedToBytes(encrypted) {
+  const bytes = new Uint8Array(
+    encrypted.iv.length + encrypted.ephemPublicKey.length + encrypted.ciphertext.length + encrypted.mac.length
+  );
+  let offset = 0;
+  bytes.set(encrypted.iv, offset);
+  offset += encrypted.iv.length;
+  bytes.set(encrypted.ephemPublicKey, offset);
+  offset += encrypted.ephemPublicKey.length;
+  bytes.set(encrypted.ciphertext, offset);
+  offset += encrypted.ciphertext.length;
+  bytes.set(encrypted.mac, offset);
+  return bytes;
+}
+function bytesToEncrypted(bytes) {
+  const absoluteMinLength = FORMAT.IV_LENGTH + 1 + MAC.LENGTH + 1;
+  if (bytes.length < absoluteMinLength) {
+    throw new ECIESError(
+      `Invalid ECIES data: too short (${bytes.length} bytes, minimum ${absoluteMinLength} bytes required)`,
+      "DECRYPTION_FAILED"
+    );
+  }
+  const prefix = bytes[FORMAT.EPHEMERAL_KEY_OFFSET];
+  if (prefix !== CURVE.PREFIX.UNCOMPRESSED) {
+    throw new ECIESError(
+      `Invalid ephemeral public key: must be uncompressed format (0x04 prefix), got 0x${prefix.toString(16).padStart(2, "0")}`,
+      "DECRYPTION_FAILED"
+    );
+  }
+  const ephemKeySize = CURVE.UNCOMPRESSED_PUBLIC_KEY_LENGTH;
+  const minLength = FORMAT.IV_LENGTH + ephemKeySize + MAC.LENGTH + 1;
+  if (bytes.length < minLength) {
+    throw new ECIESError(
+      `Invalid ECIES data: too short (${bytes.length} bytes, minimum ${minLength} bytes required)`,
+      "DECRYPTION_FAILED"
+    );
+  }
+  return {
+    iv: bytes.subarray(FORMAT.IV_OFFSET, FORMAT.IV_OFFSET + FORMAT.IV_LENGTH),
+    ephemPublicKey: bytes.subarray(
+      FORMAT.EPHEMERAL_KEY_OFFSET,
+      FORMAT.EPHEMERAL_KEY_OFFSET + ephemKeySize
+    ),
+    ciphertext: bytes.subarray(
+      FORMAT.EPHEMERAL_KEY_OFFSET + ephemKeySize,
+      bytes.length - MAC.LENGTH
+    ),
+    mac: bytes.subarray(bytes.length - MAC.LENGTH)
+  };
+}
+function base64ToEncrypted(ciphertext) {
+  return deserializeECIES(toHex(fromBase64(ciphertext)));
+}
+function parseObject(plaintext, kind) {
+  try {
+    const value = JSON.parse(textDecoder.decode(plaintext));
+    if (value === null || typeof value !== "object" || Array.isArray(value)) {
+      throw new JobEnvelopeError(`Invalid ${kind}: expected an object`);
+    }
+    return value;
+  } catch (error) {
+    if (error instanceof JobEnvelopeError) throw error;
+    throw new JobEnvelopeError(`Invalid ${kind}: malformed JSON`);
+  }
+}
+function isPlainObject(value) {
+  if (value === null || typeof value !== "object") return false;
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+function requirePlainObject(value, field, kind) {
+  if (!isPlainObject(value)) {
+    throw new JobEnvelopeError(`Invalid ${kind}: invalid ${field}`);
+  }
+}
+function requireExactKeys(value, expectedKeys, kind) {
+  for (const key of expectedKeys) {
+    if (!Object.hasOwn(value, key) || value[key] === void 0) {
+      throw new JobEnvelopeError(`Invalid ${kind}: missing ${key}`);
+    }
+  }
+  const expected = new Set(expectedKeys);
+  for (const key of Reflect.ownKeys(value)) {
+    if (!expected.has(key)) {
+      throw new JobEnvelopeError(
+        `Invalid ${kind}: unknown field ${String(key)}`
+      );
+    }
+  }
+}
+function requireString(value, field, kind) {
+  if (typeof value !== "string" || value.length === 0) {
+    throw new JobEnvelopeError(`Invalid ${kind}: missing ${field}`);
+  }
+}
+function validateJobRequest(value) {
+  requirePlainObject(value, "request", "job request");
+  requireExactKeys(
+    value,
+    [
+      "v",
+      "jobId",
+      "owner",
+      "builder",
+      "builderPublicKey",
+      "grantId",
+      "scope",
+      "operation",
+      "pinnedVersion",
+      "deadline"
+    ],
+    "job request"
+  );
+  if (value.v !== JOB_PROTOCOL_VERSION) {
+    throw new JobEnvelopeError(
+      `Unsupported job request version: ${String(value.v)}`
+    );
+  }
+  requireString(value.jobId, "jobId", "job request");
+  if (typeof value.owner !== "string" || !isAddress(value.owner)) {
+    throw new JobEnvelopeError("Invalid job request: invalid owner");
+  }
+  if (typeof value.builder !== "string" || !isAddress(value.builder)) {
+    throw new JobEnvelopeError("Invalid job request: invalid builder");
+  }
+  if (typeof value.builderPublicKey !== "string" || !isHex(value.builderPublicKey)) {
+    throw new JobEnvelopeError("Invalid job request: invalid builderPublicKey");
+  }
+  if (typeof value.grantId !== "string" || !isHex(value.grantId)) {
+    throw new JobEnvelopeError("Invalid job request: invalid grantId");
+  }
+  requireString(value.scope, "scope", "job request");
+  if (!JOB_OPERATIONS.includes(value.operation)) {
+    throw new JobEnvelopeError("Invalid job request: invalid operation");
+  }
+  if (value.pinnedVersion !== null && typeof value.pinnedVersion !== "string") {
+    throw new JobEnvelopeError("Invalid job request: missing pinnedVersion");
+  }
+  if (typeof value.deadline !== "string" || !Number.isFinite(Date.parse(value.deadline))) {
+    throw new JobEnvelopeError("Invalid job request: invalid deadline");
+  }
+  return value;
+}
+function validateRequestEnvelope(value) {
+  requirePlainObject(value, "envelope", "job request envelope");
+  requireExactKeys(value, ["request", "auth"], "job request envelope");
+  validateJobRequest(value.request);
+  requireString(value.auth, "auth", "job request envelope");
+  return value;
+}
+function validateResult(value) {
+  requirePlainObject(value, "result", "job result");
+  requireExactKeys(
+    value,
+    ["v", "jobId", "scope", "version", "contentType", "body"],
+    "job result"
+  );
+  if (value.v !== JOB_PROTOCOL_VERSION) {
+    throw new JobEnvelopeError(
+      `Unsupported job result version: ${String(value.v)}`
+    );
+  }
+  for (const field of ["jobId", "scope", "contentType"]) {
+    requireString(value[field], field, "job result");
+  }
+  if (!(value.body instanceof Uint8Array)) {
+    throw new JobEnvelopeError("Invalid job result: missing body");
+  }
+  if (value.version !== null && typeof value.version !== "string") {
+    throw new JobEnvelopeError("Invalid job result: missing version");
+  }
+  return value;
+}
+async function sealJobRequest(envelope, enclavePublicKey, ecies) {
+  const encrypted = await ecies.encrypt(
+    fromHex(enclavePublicKey, "bytes"),
+    requestPlaintext(envelope)
+  );
+  return encryptedBytesToBase64(encrypted);
+}
+async function openJobRequest(ciphertext, privateKey, ecies) {
+  const plaintext = await ecies.decrypt(
+    privateKey,
+    base64ToEncrypted(ciphertext)
+  );
+  return validateRequestEnvelope(
+    parseObject(plaintext, "job request envelope")
+  );
+}
+async function sealJobResult(result, builderPublicKey, ecies) {
+  validateResult(result);
+  const encrypted = await ecies.encrypt(
+    fromHex(builderPublicKey, "bytes"),
+    resultPlaintext(result)
+  );
+  const bytes = encryptedToBytes(encrypted);
+  return { bytes, hash: bytesToHex(sha256(bytes)), size: bytes.length };
+}
+async function openJobResult(sealedBytes, builderPrivateKey, ecies, expect) {
+  const plaintext = await ecies.decrypt(
+    fromHex(builderPrivateKey, "bytes"),
+    bytesToEncrypted(sealedBytes)
+  );
+  const result = parseResultPlaintext(plaintext);
+  if (result.jobId !== expect.jobId) {
+    throw new JobEnvelopeError(
+      `Job result ID ${result.jobId} does not match expected job ID ${expect.jobId}`
+    );
+  }
+  if (expect.scope !== void 0 && result.scope !== expect.scope) {
+    throw new JobEnvelopeError(
+      `Job result scope ${result.scope} does not match expected scope ${expect.scope}`
+    );
+  }
+  if (expect.version !== void 0 && result.version !== expect.version) {
+    throw new JobEnvelopeError(
+      `Job result version ${String(result.version)} does not match expected version ${String(expect.version)}`
+    );
+  }
+  return result;
+}
+export {
+  JobEnvelopeError,
+  canonicalJobRequestBytes,
+  openJobRequest,
+  openJobResult,
+  sealJobRequest,
+  sealJobResult
+};
+//# sourceMappingURL=job.js.map

package/dist/crypto/envelope/job.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/crypto/envelope/job.ts"],"sourcesContent":["/**\n * ECIES envelopes for encrypted job requests and results.\n *\n * Request plaintext is UTF-8 JSON with object keys sorted recursively and\n * array order preserved. Result plaintext is\n * `uint32be(header length) || JSON header || raw body`. The Request ciphertext\n * is base64 of `iv || ephemPub || ct || mac`, as specified\n * by the ECIES provider interface. Result ciphertext is the raw concatenated\n * byte sequence stored in object storage. The Gateway hashes raw ciphertext\n * bytes, not plaintext.\n * The builder verifies the decrypted result's job ID, scope, and version\n * bindings. The PS worker verifies\n * `auth.bodyHash === sha256(canonicalJobRequestBytes(request))`; the Gateway\n * never sees the plaintext. Flow: personal-server-ts\n * `docs/260903-jobs-contract.md`, section 1.\n *\n * @category Cryptography\n */\n\nimport { sha256 } from \"@noble/hashes/sha2\";\nimport { bytesToHex, fromHex, isAddress, isHex, toHex, type Hex } from \"viem\";\nimport { CURVE, FORMAT, MAC } from \"../ecies/constants\";\nimport {\n  deserializeECIES,\n  ECIESError,\n  serializeECIES,\n  type ECIESEncrypted,\n  type ECIESProvider,\n} from \"../ecies/interface\";\nimport {\n  JOB_OPERATIONS,\n  JOB_PROTOCOL_VERSION,\n  type JobOperation,\n  type JobRequest,\n  type JobRequestEnvelope,\n  type JobResult,\n} from \"../../protocol/jobs\";\nimport { fromBase64, toBase64 } from \"../../utils/encoding\";\n\nconst textDecoder = new TextDecoder();\nconst textEncoder = new TextEncoder();\n/** Result metadata is only a few short fields; cap it before decoding attacker-reachable bytes. */\nconst MAX_JOB_RESULT_HEADER_BYTES = 4096;\nconst JOB_RESULT_LENGTH_PREFIX_BYTES = 4;\n\n/** A job envelope or result did not match the jobs protocol. */\nexport class JobEnvelopeError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"JobEnvelopeError\";\n  }\n}\n\nfunction sortJsonKeys(value: unknown): unknown {\n  if (Array.isArray(value)) {\n    return value.map(sortJsonKeys);\n  }\n  if (value !== null && typeof value === \"object\") {\n    return Object.fromEntries(\n      Object.keys(value)\n        .sort()\n        .map((key) => [\n          key,\n          sortJsonKeys((value as Record<string, unknown>)[key]),\n        ]),\n    );\n  }\n  return value;\n}\n\nfunction canonicalJsonBytes(value: unknown): Uint8Array {\n  return textEncoder.encode(JSON.stringify(sortJsonKeys(value)));\n}\n\n/**\n * Returns the canonical UTF-8 JSON bytes committed to by the auth body hash.\n *\n * @param request - Job request to validate and serialize canonically.\n * @returns Recursively key-sorted, whitespace-free UTF-8 JSON bytes.\n * @throws {JobEnvelopeError} If the request does not match the protocol schema.\n */\nexport function canonicalJobRequestBytes(request: JobRequest): Uint8Array {\n  validateJobRequest(request);\n  return canonicalJsonBytes(request);\n}\n\nfunction requestPlaintext(envelope: JobRequestEnvelope): Uint8Array {\n  validateRequestEnvelope(envelope);\n  return canonicalJsonBytes(envelope);\n}\n\nfunction resultPlaintext(result: JobResult): Uint8Array {\n  const header = textEncoder.encode(\n    JSON.stringify({\n      v: result.v,\n      jobId: result.jobId,\n      scope: result.scope,\n      version: result.version,\n      contentType: result.contentType,\n    }),\n  );\n  if (header.length > MAX_JOB_RESULT_HEADER_BYTES) {\n    throw new JobEnvelopeError(\n      `Invalid job result: header exceeds ${MAX_JOB_RESULT_HEADER_BYTES} bytes`,\n    );\n  }\n\n  const plaintext = new Uint8Array(\n    JOB_RESULT_LENGTH_PREFIX_BYTES + header.length + result.body.length,\n  );\n  new DataView(plaintext.buffer).setUint32(0, header.length);\n  plaintext.set(header, JOB_RESULT_LENGTH_PREFIX_BYTES);\n  plaintext.set(result.body, JOB_RESULT_LENGTH_PREFIX_BYTES + header.length);\n  return plaintext;\n}\n\nfunction parseResultPlaintext(plaintext: Uint8Array): JobResult {\n  if (plaintext.length < JOB_RESULT_LENGTH_PREFIX_BYTES) {\n    throw new JobEnvelopeError(\n      \"Invalid job result: missing header length prefix\",\n    );\n  }\n\n  const headerLength = new DataView(\n    plaintext.buffer,\n    plaintext.byteOffset,\n    JOB_RESULT_LENGTH_PREFIX_BYTES,\n  ).getUint32(0);\n  if (headerLength > MAX_JOB_RESULT_HEADER_BYTES) {\n    throw new JobEnvelopeError(\n      `Invalid job result: header exceeds ${MAX_JOB_RESULT_HEADER_BYTES} bytes`,\n    );\n  }\n  const remainingLength = plaintext.length - JOB_RESULT_LENGTH_PREFIX_BYTES;\n  if (headerLength > remainingLength) {\n    throw new JobEnvelopeError(\n      \"Invalid job result: header length exceeds payload\",\n    );\n  }\n\n  const headerEnd = JOB_RESULT_LENGTH_PREFIX_BYTES + headerLength;\n  const header = parseObject(\n    plaintext.subarray(JOB_RESULT_LENGTH_PREFIX_BYTES, headerEnd),\n    \"job result header\",\n  );\n  return validateResult({ ...header, body: plaintext.subarray(headerEnd) });\n}\n\nfunction encryptedBytesToBase64(\n  encrypted: Awaited<ReturnType<ECIESProvider[\"encrypt\"]>>,\n): string {\n  return toBase64(fromHex(`0x${serializeECIES(encrypted)}`, \"bytes\"));\n}\n\nfunction encryptedToBytes(\n  encrypted: Awaited<ReturnType<ECIESProvider[\"encrypt\"]>>,\n): Uint8Array {\n  const bytes = new Uint8Array(\n    encrypted.iv.length +\n      encrypted.ephemPublicKey.length +\n      encrypted.ciphertext.length +\n      encrypted.mac.length,\n  );\n  let offset = 0;\n  bytes.set(encrypted.iv, offset);\n  offset += encrypted.iv.length;\n  bytes.set(encrypted.ephemPublicKey, offset);\n  offset += encrypted.ephemPublicKey.length;\n  bytes.set(encrypted.ciphertext, offset);\n  offset += encrypted.ciphertext.length;\n  bytes.set(encrypted.mac, offset);\n  return bytes;\n}\n\nfunction bytesToEncrypted(bytes: Uint8Array): ECIESEncrypted {\n  const absoluteMinLength = FORMAT.IV_LENGTH + 1 + MAC.LENGTH + 1;\n  if (bytes.length < absoluteMinLength) {\n    throw new ECIESError(\n      `Invalid ECIES data: too short (${bytes.length} bytes, minimum ${absoluteMinLength} bytes required)`,\n      \"DECRYPTION_FAILED\",\n    );\n  }\n\n  const prefix = bytes[FORMAT.EPHEMERAL_KEY_OFFSET];\n  if (prefix !== CURVE.PREFIX.UNCOMPRESSED) {\n    throw new ECIESError(\n      `Invalid ephemeral public key: must be uncompressed format (0x04 prefix), got 0x${prefix.toString(16).padStart(2, \"0\")}`,\n      \"DECRYPTION_FAILED\",\n    );\n  }\n\n  const ephemKeySize = CURVE.UNCOMPRESSED_PUBLIC_KEY_LENGTH;\n  const minLength = FORMAT.IV_LENGTH + ephemKeySize + MAC.LENGTH + 1;\n  if (bytes.length < minLength) {\n    throw new ECIESError(\n      `Invalid ECIES data: too short (${bytes.length} bytes, minimum ${minLength} bytes required)`,\n      \"DECRYPTION_FAILED\",\n    );\n  }\n\n  return {\n    iv: bytes.subarray(FORMAT.IV_OFFSET, FORMAT.IV_OFFSET + FORMAT.IV_LENGTH),\n    ephemPublicKey: bytes.subarray(\n      FORMAT.EPHEMERAL_KEY_OFFSET,\n      FORMAT.EPHEMERAL_KEY_OFFSET + ephemKeySize,\n    ),\n    ciphertext: bytes.subarray(\n      FORMAT.EPHEMERAL_KEY_OFFSET + ephemKeySize,\n      bytes.length - MAC.LENGTH,\n    ),\n    mac: bytes.subarray(bytes.length - MAC.LENGTH),\n  };\n}\n\nfunction base64ToEncrypted(ciphertext: string) {\n  return deserializeECIES(toHex(fromBase64(ciphertext)));\n}\n\nfunction parseObject(\n  plaintext: Uint8Array,\n  kind: string,\n): Record<string, unknown> {\n  try {\n    const value: unknown = JSON.parse(textDecoder.decode(plaintext));\n    if (value === null || typeof value !== \"object\" || Array.isArray(value)) {\n      throw new JobEnvelopeError(`Invalid ${kind}: expected an object`);\n    }\n    return value as Record<string, unknown>;\n  } catch (error) {\n    if (error instanceof JobEnvelopeError) throw error;\n    throw new JobEnvelopeError(`Invalid ${kind}: malformed JSON`);\n  }\n}\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  if (value === null || typeof value !== \"object\") return false;\n  const prototype = Object.getPrototypeOf(value);\n  return prototype === Object.prototype || prototype === null;\n}\n\nfunction requirePlainObject(\n  value: unknown,\n  field: string,\n  kind: string,\n): asserts value is Record<string, unknown> {\n  if (!isPlainObject(value)) {\n    throw new JobEnvelopeError(`Invalid ${kind}: invalid ${field}`);\n  }\n}\n\nfunction requireExactKeys(\n  value: Record<string, unknown>,\n  expectedKeys: readonly string[],\n  kind: string,\n): void {\n  for (const key of expectedKeys) {\n    if (!Object.hasOwn(value, key) || value[key] === undefined) {\n      throw new JobEnvelopeError(`Invalid ${kind}: missing ${key}`);\n    }\n  }\n  const expected = new Set<PropertyKey>(expectedKeys);\n  for (const key of Reflect.ownKeys(value)) {\n    if (!expected.has(key)) {\n      throw new JobEnvelopeError(\n        `Invalid ${kind}: unknown field ${String(key)}`,\n      );\n    }\n  }\n}\n\nfunction requireString(\n  value: unknown,\n  field: string,\n  kind: string,\n): asserts value is string {\n  if (typeof value !== \"string\" || value.length === 0) {\n    throw new JobEnvelopeError(`Invalid ${kind}: missing ${field}`);\n  }\n}\n\nfunction validateJobRequest(value: unknown): JobRequest {\n  requirePlainObject(value, \"request\", \"job request\");\n  requireExactKeys(\n    value,\n    [\n      \"v\",\n      \"jobId\",\n      \"owner\",\n      \"builder\",\n      \"builderPublicKey\",\n      \"grantId\",\n      \"scope\",\n      \"operation\",\n      \"pinnedVersion\",\n      \"deadline\",\n    ],\n    \"job request\",\n  );\n  if (value.v !== JOB_PROTOCOL_VERSION) {\n    throw new JobEnvelopeError(\n      `Unsupported job request version: ${String(value.v)}`,\n    );\n  }\n  requireString(value.jobId, \"jobId\", \"job request\");\n  if (typeof value.owner !== \"string\" || !isAddress(value.owner)) {\n    throw new JobEnvelopeError(\"Invalid job request: invalid owner\");\n  }\n  if (typeof value.builder !== \"string\" || !isAddress(value.builder)) {\n    throw new JobEnvelopeError(\"Invalid job request: invalid builder\");\n  }\n  if (\n    typeof value.builderPublicKey !== \"string\" ||\n    !isHex(value.builderPublicKey)\n  ) {\n    throw new JobEnvelopeError(\"Invalid job request: invalid builderPublicKey\");\n  }\n  if (typeof value.grantId !== \"string\" || !isHex(value.grantId)) {\n    throw new JobEnvelopeError(\"Invalid job request: invalid grantId\");\n  }\n  requireString(value.scope, \"scope\", \"job request\");\n  if (!JOB_OPERATIONS.includes(value.operation as JobOperation)) {\n    throw new JobEnvelopeError(\"Invalid job request: invalid operation\");\n  }\n  if (value.pinnedVersion !== null && typeof value.pinnedVersion !== \"string\") {\n    throw new JobEnvelopeError(\"Invalid job request: missing pinnedVersion\");\n  }\n  if (\n    typeof value.deadline !== \"string\" ||\n    !Number.isFinite(Date.parse(value.deadline))\n  ) {\n    throw new JobEnvelopeError(\"Invalid job request: invalid deadline\");\n  }\n  return value as unknown as JobRequest;\n}\n\nfunction validateRequestEnvelope(value: unknown): JobRequestEnvelope {\n  requirePlainObject(value, \"envelope\", \"job request envelope\");\n  requireExactKeys(value, [\"request\", \"auth\"], \"job request envelope\");\n  validateJobRequest(value.request);\n  requireString(value.auth, \"auth\", \"job request envelope\");\n  return value as unknown as JobRequestEnvelope;\n}\n\nfunction validateResult(value: unknown): JobResult {\n  requirePlainObject(value, \"result\", \"job result\");\n  requireExactKeys(\n    value,\n    [\"v\", \"jobId\", \"scope\", \"version\", \"contentType\", \"body\"],\n    \"job result\",\n  );\n  if (value.v !== JOB_PROTOCOL_VERSION) {\n    throw new JobEnvelopeError(\n      `Unsupported job result version: ${String(value.v)}`,\n    );\n  }\n  for (const field of [\"jobId\", \"scope\", \"contentType\"]) {\n    requireString(value[field], field, \"job result\");\n  }\n  if (!(value.body instanceof Uint8Array)) {\n    throw new JobEnvelopeError(\"Invalid job result: missing body\");\n  }\n  if (value.version !== null && typeof value.version !== \"string\") {\n    throw new JobEnvelopeError(\"Invalid job result: missing version\");\n  }\n  return value as unknown as JobResult;\n}\n\n/**\n * Encrypts a validated job request envelope for a Personal Server enclave.\n *\n * The PS worker verifies\n * `auth.bodyHash === sha256(canonicalJobRequestBytes(request))`; the Gateway\n * never sees the plaintext.\n *\n * @param envelope - Request and builder Web3Signed authorization to encrypt.\n * @param enclavePublicKey - Public key returned by `GET /v1/identity?owner=`.\n * @param ecies - Injected ECIES implementation.\n * @returns Base64 ciphertext encoded as `iv || ephemPub || ct || mac`.\n * @throws {JobEnvelopeError} If the envelope or request is invalid.\n * @throws If ECIES encryption fails or the enclave public key is invalid.\n *\n * @example\n * ```ts\n * const identity = await fetch(`/v1/identity?owner=${owner}`).then((response) =>\n *   response.json(),\n * );\n * const requestCiphertext = await sealJobRequest(\n *   requestEnvelope,\n *   identity.publicKey,\n *   ecies,\n * );\n * await fetch(\"/v1/jobs\", {\n *   method: \"POST\",\n *   body: JSON.stringify({ ...submission, requestCiphertext }),\n * });\n * ```\n */\nexport async function sealJobRequest(\n  envelope: JobRequestEnvelope,\n  enclavePublicKey: Hex,\n  ecies: ECIESProvider,\n): Promise<string> {\n  const encrypted = await ecies.encrypt(\n    fromHex(enclavePublicKey, \"bytes\"),\n    requestPlaintext(envelope),\n  );\n  return encryptedBytesToBase64(encrypted);\n}\n\n/**\n * Decrypts and validates a job request envelope inside the enclave.\n *\n * @param ciphertext - Base64 `iv || ephemPub || ct || mac` ciphertext.\n * @param privateKey - Enclave key bytes, supplied as `Uint8Array` so the agent can zero them after use.\n * @param ecies - Injected ECIES implementation.\n * @returns The validated request envelope exactly as parsed from plaintext.\n * @throws {JobEnvelopeError} If plaintext is malformed or fails schema validation.\n * @throws If ciphertext decoding or ECIES decryption fails.\n */\nexport async function openJobRequest(\n  ciphertext: string,\n  privateKey: Uint8Array,\n  ecies: ECIESProvider,\n): Promise<JobRequestEnvelope> {\n  const plaintext = await ecies.decrypt(\n    privateKey,\n    base64ToEncrypted(ciphertext),\n  );\n  return validateRequestEnvelope(\n    parseObject(plaintext, \"job request envelope\"),\n  );\n}\n\n/**\n * Encrypts a validated job result for its builder and describes the ciphertext.\n *\n * `hash` is lowercase `0x` SHA-256 of the raw sealed bytes, not the `sha256:`\n * prefix used by Web3Signed `bodyHash`. `size` is the sealed byte length. They\n * equal the Gateway's `resultHash` and `resultSize`.\n *\n * @param result - Job result to validate and encrypt.\n * @param builderPublicKey - Builder wallet public key recorded in the request.\n * @param ecies - Injected ECIES implementation.\n * @returns Raw sealed bytes plus their Gateway-compatible hash and size.\n * @throws {JobEnvelopeError} If the result does not match the protocol schema.\n * @throws If ECIES encryption fails or the builder public key is invalid.\n */\nexport async function sealJobResult(\n  result: JobResult,\n  builderPublicKey: Hex,\n  ecies: ECIESProvider,\n): Promise<{ bytes: Uint8Array; hash: Hex; size: number }> {\n  validateResult(result);\n  const encrypted = await ecies.encrypt(\n    fromHex(builderPublicKey, \"bytes\"),\n    resultPlaintext(result),\n  );\n  const bytes = encryptedToBytes(encrypted);\n  return { bytes, hash: bytesToHex(sha256(bytes)), size: bytes.length };\n}\n\n/**\n * Decrypts a job result and verifies its builder-visible protocol bindings.\n *\n * The builder private key is a `Hex` wallet key. For `expect.version`,\n * `undefined` skips the check while `null` requires a null result version.\n *\n * @param sealedBytes - Raw `iv || ephemPub || ct || mac` bytes.\n * @param builderPrivateKey - Builder's wallet private key as hex.\n * @param ecies - Injected ECIES implementation.\n * @param expect - Required job ID and optional scope and version bindings.\n * @returns The validated result when every supplied binding matches.\n * @throws {JobEnvelopeError} If plaintext is malformed, invalid, or a binding differs.\n * @throws If ciphertext decoding or ECIES decryption fails.\n *\n * @example\n * ```ts\n * const sealedBytes = new Uint8Array(await response.arrayBuffer());\n * const result = await openJobResult(sealedBytes, key, ecies, {\n *   jobId,\n *   scope,\n * });\n * const text = new TextDecoder().decode(result.body);\n * ```\n */\nexport async function openJobResult(\n  sealedBytes: Uint8Array,\n  builderPrivateKey: Hex,\n  ecies: ECIESProvider,\n  expect: { jobId: string; scope?: string; version?: string | null },\n): Promise<JobResult> {\n  const plaintext = await ecies.decrypt(\n    fromHex(builderPrivateKey, \"bytes\"),\n    bytesToEncrypted(sealedBytes),\n  );\n  const result = parseResultPlaintext(plaintext);\n  if (result.jobId !== expect.jobId) {\n    throw new JobEnvelopeError(\n      `Job result ID ${result.jobId} does not match expected job ID ${expect.jobId}`,\n    );\n  }\n  if (expect.scope !== undefined && result.scope !== expect.scope) {\n    throw new JobEnvelopeError(\n      `Job result scope ${result.scope} does not match expected scope ${expect.scope}`,\n    );\n  }\n  if (expect.version !== undefined && result.version !== expect.version) {\n    throw new JobEnvelopeError(\n      `Job result version ${String(result.version)} does not match expected version ${String(expect.version)}`,\n    );\n  }\n  return result;\n}\n"],"mappings":"AAmBA,SAAS,cAAc;AACvB,SAAS,YAAY,SAAS,WAAW,OAAO,aAAuB;AACvE,SAAS,OAAO,QAAQ,WAAW;AACnC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAGK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OAKK;AACP,SAAS,YAAY,gBAAgB;AAErC,MAAM,cAAc,IAAI,YAAY;AACpC,MAAM,cAAc,IAAI,YAAY;AAEpC,MAAM,8BAA8B;AACpC,MAAM,iCAAiC;AAGhC,MAAM,yBAAyB,MAAM;AAAA,EAC1C,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEA,SAAS,aAAa,OAAyB;AAC7C,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,MAAM,IAAI,YAAY;AAAA,EAC/B;AACA,MAAI,UAAU,QAAQ,OAAO,UAAU,UAAU;AAC/C,WAAO,OAAO;AAAA,MACZ,OAAO,KAAK,KAAK,EACd,KAAK,EACL,IAAI,CAAC,QAAQ;AAAA,QACZ;AAAA,QACA,aAAc,MAAkC,GAAG,CAAC;AAAA,MACtD,CAAC;AAAA,IACL;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,mBAAmB,OAA4B;AACtD,SAAO,YAAY,OAAO,KAAK,UAAU,aAAa,KAAK,CAAC,CAAC;AAC/D;AASO,SAAS,yBAAyB,SAAiC;AACxE,qBAAmB,OAAO;AAC1B,SAAO,mBAAmB,OAAO;AACnC;AAEA,SAAS,iBAAiB,UAA0C;AAClE,0BAAwB,QAAQ;AAChC,SAAO,mBAAmB,QAAQ;AACpC;AAEA,SAAS,gBAAgB,QAA+B;AACtD,QAAM,SAAS,YAAY;AAAA,IACzB,KAAK,UAAU;AAAA,MACb,GAAG,OAAO;AAAA,MACV,OAAO,OAAO;AAAA,MACd,OAAO,OAAO;AAAA,MACd,SAAS,OAAO;AAAA,MAChB,aAAa,OAAO;AAAA,IACtB,CAAC;AAAA,EACH;AACA,MAAI,OAAO,SAAS,6BAA6B;AAC/C,UAAM,IAAI;AAAA,MACR,sCAAsC,2BAA2B;AAAA,IACnE;AAAA,EACF;AAEA,QAAM,YAAY,IAAI;AAAA,IACpB,iCAAiC,OAAO,SAAS,OAAO,KAAK;AAAA,EAC/D;AACA,MAAI,SAAS,UAAU,MAAM,EAAE,UAAU,GAAG,OAAO,MAAM;AACzD,YAAU,IAAI,QAAQ,8BAA8B;AACpD,YAAU,IAAI,OAAO,MAAM,iCAAiC,OAAO,MAAM;AACzE,SAAO;AACT;AAEA,SAAS,qBAAqB,WAAkC;AAC9D,MAAI,UAAU,SAAS,gCAAgC;AACrD,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,eAAe,IAAI;AAAA,IACvB,UAAU;AAAA,IACV,UAAU;AAAA,IACV;AAAA,EACF,EAAE,UAAU,CAAC;AACb,MAAI,eAAe,6BAA6B;AAC9C,UAAM,IAAI;AAAA,MACR,sCAAsC,2BAA2B;AAAA,IACnE;AAAA,EACF;AACA,QAAM,kBAAkB,UAAU,SAAS;AAC3C,MAAI,eAAe,iBAAiB;AAClC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,YAAY,iCAAiC;AACnD,QAAM,SAAS;AAAA,IACb,UAAU,SAAS,gCAAgC,SAAS;AAAA,IAC5D;AAAA,EACF;AACA,SAAO,eAAe,EAAE,GAAG,QAAQ,MAAM,UAAU,SAAS,SAAS,EAAE,CAAC;AAC1E;AAEA,SAAS,uBACP,WACQ;AACR,SAAO,SAAS,QAAQ,KAAK,eAAe,SAAS,CAAC,IAAI,OAAO,CAAC;AACpE;AAEA,SAAS,iBACP,WACY;AACZ,QAAM,QAAQ,IAAI;AAAA,IAChB,UAAU,GAAG,SACX,UAAU,eAAe,SACzB,UAAU,WAAW,SACrB,UAAU,IAAI;AAAA,EAClB;AACA,MAAI,SAAS;AACb,QAAM,IAAI,UAAU,IAAI,MAAM;AAC9B,YAAU,UAAU,GAAG;AACvB,QAAM,IAAI,UAAU,gBAAgB,MAAM;AAC1C,YAAU,UAAU,eAAe;AACnC,QAAM,IAAI,UAAU,YAAY,MAAM;AACtC,YAAU,UAAU,WAAW;AAC/B,QAAM,IAAI,UAAU,KAAK,MAAM;AAC/B,SAAO;AACT;AAEA,SAAS,iBAAiB,OAAmC;AAC3D,QAAM,oBAAoB,OAAO,YAAY,IAAI,IAAI,SAAS;AAC9D,MAAI,MAAM,SAAS,mBAAmB;AACpC,UAAM,IAAI;AAAA,MACR,kCAAkC,MAAM,MAAM,mBAAmB,iBAAiB;AAAA,MAClF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,SAAS,MAAM,OAAO,oBAAoB;AAChD,MAAI,WAAW,MAAM,OAAO,cAAc;AACxC,UAAM,IAAI;AAAA,MACR,kFAAkF,OAAO,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC;AAAA,MACtH;AAAA,IACF;AAAA,EACF;AAEA,QAAM,eAAe,MAAM;AAC3B,QAAM,YAAY,OAAO,YAAY,eAAe,IAAI,SAAS;AACjE,MAAI,MAAM,SAAS,WAAW;AAC5B,UAAM,IAAI;AAAA,MACR,kCAAkC,MAAM,MAAM,mBAAmB,SAAS;AAAA,MAC1E;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,IAAI,MAAM,SAAS,OAAO,WAAW,OAAO,YAAY,OAAO,SAAS;AAAA,IACxE,gBAAgB,MAAM;AAAA,MACpB,OAAO;AAAA,MACP,OAAO,uBAAuB;AAAA,IAChC;AAAA,IACA,YAAY,MAAM;AAAA,MAChB,OAAO,uBAAuB;AAAA,MAC9B,MAAM,SAAS,IAAI;AAAA,IACrB;AAAA,IACA,KAAK,MAAM,SAAS,MAAM,SAAS,IAAI,MAAM;AAAA,EAC/C;AACF;AAEA,SAAS,kBAAkB,YAAoB;AAC7C,SAAO,iBAAiB,MAAM,WAAW,UAAU,CAAC,CAAC;AACvD;AAEA,SAAS,YACP,WACA,MACyB;AACzB,MAAI;AACF,UAAM,QAAiB,KAAK,MAAM,YAAY,OAAO,SAAS,CAAC;AAC/D,QAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AACvE,YAAM,IAAI,iBAAiB,WAAW,IAAI,sBAAsB;AAAA,IAClE;AACA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,iBAAiB,iBAAkB,OAAM;AAC7C,UAAM,IAAI,iBAAiB,WAAW,IAAI,kBAAkB;AAAA,EAC9D;AACF;AAEA,SAAS,cAAc,OAAkD;AACvE,MAAI,UAAU,QAAQ,OAAO,UAAU,SAAU,QAAO;AACxD,QAAM,YAAY,OAAO,eAAe,KAAK;AAC7C,SAAO,cAAc,OAAO,aAAa,cAAc;AACzD;AAEA,SAAS,mBACP,OACA,OACA,MAC0C;AAC1C,MAAI,CAAC,cAAc,KAAK,GAAG;AACzB,UAAM,IAAI,iBAAiB,WAAW,IAAI,aAAa,KAAK,EAAE;AAAA,EAChE;AACF;AAEA,SAAS,iBACP,OACA,cACA,MACM;AACN,aAAW,OAAO,cAAc;AAC9B,QAAI,CAAC,OAAO,OAAO,OAAO,GAAG,KAAK,MAAM,GAAG,MAAM,QAAW;AAC1D,YAAM,IAAI,iBAAiB,WAAW,IAAI,aAAa,GAAG,EAAE;AAAA,IAC9D;AAAA,EACF;AACA,QAAM,WAAW,IAAI,IAAiB,YAAY;AAClD,aAAW,OAAO,QAAQ,QAAQ,KAAK,GAAG;AACxC,QAAI,CAAC,SAAS,IAAI,GAAG,GAAG;AACtB,YAAM,IAAI;AAAA,QACR,WAAW,IAAI,mBAAmB,OAAO,GAAG,CAAC;AAAA,MAC/C;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,cACP,OACA,OACA,MACyB;AACzB,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG;AACnD,UAAM,IAAI,iBAAiB,WAAW,IAAI,aAAa,KAAK,EAAE;AAAA,EAChE;AACF;AAEA,SAAS,mBAAmB,OAA4B;AACtD,qBAAmB,OAAO,WAAW,aAAa;AAClD;AAAA,IACE;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA;AAAA,EACF;AACA,MAAI,MAAM,MAAM,sBAAsB;AACpC,UAAM,IAAI;AAAA,MACR,oCAAoC,OAAO,MAAM,CAAC,CAAC;AAAA,IACrD;AAAA,EACF;AACA,gBAAc,MAAM,OAAO,SAAS,aAAa;AACjD,MAAI,OAAO,MAAM,UAAU,YAAY,CAAC,UAAU,MAAM,KAAK,GAAG;AAC9D,UAAM,IAAI,iBAAiB,oCAAoC;AAAA,EACjE;AACA,MAAI,OAAO,MAAM,YAAY,YAAY,CAAC,UAAU,MAAM,OAAO,GAAG;AAClE,UAAM,IAAI,iBAAiB,sCAAsC;AAAA,EACnE;AACA,MACE,OAAO,MAAM,qBAAqB,YAClC,CAAC,MAAM,MAAM,gBAAgB,GAC7B;AACA,UAAM,IAAI,iBAAiB,+CAA+C;AAAA,EAC5E;AACA,MAAI,OAAO,MAAM,YAAY,YAAY,CAAC,MAAM,MAAM,OAAO,GAAG;AAC9D,UAAM,IAAI,iBAAiB,sCAAsC;AAAA,EACnE;AACA,gBAAc,MAAM,OAAO,SAAS,aAAa;AACjD,MAAI,CAAC,eAAe,SAAS,MAAM,SAAyB,GAAG;AAC7D,UAAM,IAAI,iBAAiB,wCAAwC;AAAA,EACrE;AACA,MAAI,MAAM,kBAAkB,QAAQ,OAAO,MAAM,kBAAkB,UAAU;AAC3E,UAAM,IAAI,iBAAiB,4CAA4C;AAAA,EACzE;AACA,MACE,OAAO,MAAM,aAAa,YAC1B,CAAC,OAAO,SAAS,KAAK,MAAM,MAAM,QAAQ,CAAC,GAC3C;AACA,UAAM,IAAI,iBAAiB,uCAAuC;AAAA,EACpE;AACA,SAAO;AACT;AAEA,SAAS,wBAAwB,OAAoC;AACnE,qBAAmB,OAAO,YAAY,sBAAsB;AAC5D,mBAAiB,OAAO,CAAC,WAAW,MAAM,GAAG,sBAAsB;AACnE,qBAAmB,MAAM,OAAO;AAChC,gBAAc,MAAM,MAAM,QAAQ,sBAAsB;AACxD,SAAO;AACT;AAEA,SAAS,eAAe,OAA2B;AACjD,qBAAmB,OAAO,UAAU,YAAY;AAChD;AAAA,IACE;AAAA,IACA,CAAC,KAAK,SAAS,SAAS,WAAW,eAAe,MAAM;AAAA,IACxD;AAAA,EACF;AACA,MAAI,MAAM,MAAM,sBAAsB;AACpC,UAAM,IAAI;AAAA,MACR,mCAAmC,OAAO,MAAM,CAAC,CAAC;AAAA,IACpD;AAAA,EACF;AACA,aAAW,SAAS,CAAC,SAAS,SAAS,aAAa,GAAG;AACrD,kBAAc,MAAM,KAAK,GAAG,OAAO,YAAY;AAAA,EACjD;AACA,MAAI,EAAE,MAAM,gBAAgB,aAAa;AACvC,UAAM,IAAI,iBAAiB,kCAAkC;AAAA,EAC/D;AACA,MAAI,MAAM,YAAY,QAAQ,OAAO,MAAM,YAAY,UAAU;AAC/D,UAAM,IAAI,iBAAiB,qCAAqC;AAAA,EAClE;AACA,SAAO;AACT;AAgCA,eAAsB,eACpB,UACA,kBACA,OACiB;AACjB,QAAM,YAAY,MAAM,MAAM;AAAA,IAC5B,QAAQ,kBAAkB,OAAO;AAAA,IACjC,iBAAiB,QAAQ;AAAA,EAC3B;AACA,SAAO,uBAAuB,SAAS;AACzC;AAYA,eAAsB,eACpB,YACA,YACA,OAC6B;AAC7B,QAAM,YAAY,MAAM,MAAM;AAAA,IAC5B;AAAA,IACA,kBAAkB,UAAU;AAAA,EAC9B;AACA,SAAO;AAAA,IACL,YAAY,WAAW,sBAAsB;AAAA,EAC/C;AACF;AAgBA,eAAsB,cACpB,QACA,kBACA,OACyD;AACzD,iBAAe,MAAM;AACrB,QAAM,YAAY,MAAM,MAAM;AAAA,IAC5B,QAAQ,kBAAkB,OAAO;AAAA,IACjC,gBAAgB,MAAM;AAAA,EACxB;AACA,QAAM,QAAQ,iBAAiB,SAAS;AACxC,SAAO,EAAE,OAAO,MAAM,WAAW,OAAO,KAAK,CAAC,GAAG,MAAM,MAAM,OAAO;AACtE;AA0BA,eAAsB,cACpB,aACA,mBACA,OACA,QACoB;AACpB,QAAM,YAAY,MAAM,MAAM;AAAA,IAC5B,QAAQ,mBAAmB,OAAO;AAAA,IAClC,iBAAiB,WAAW;AAAA,EAC9B;AACA,QAAM,SAAS,qBAAqB,SAAS;AAC7C,MAAI,OAAO,UAAU,OAAO,OAAO;AACjC,UAAM,IAAI;AAAA,MACR,iBAAiB,OAAO,KAAK,mCAAmC,OAAO,KAAK;AAAA,IAC9E;AAAA,EACF;AACA,MAAI,OAAO,UAAU,UAAa,OAAO,UAAU,OAAO,OAAO;AAC/D,UAAM,IAAI;AAAA,MACR,oBAAoB,OAAO,KAAK,kCAAkC,OAAO,KAAK;AAAA,IAChF;AAAA,EACF;AACA,MAAI,OAAO,YAAY,UAAa,OAAO,YAAY,OAAO,SAAS;AACrE,UAAM,IAAI;AAAA,MACR,sBAAsB,OAAO,OAAO,OAAO,CAAC,oCAAoC,OAAO,OAAO,OAAO,CAAC;AAAA,IACxG;AAAA,EACF;AACA,SAAO;AACT;","names":[]}

package/dist/direct/access-request-client.cjs

@@ -38,6 +38,9 @@ const VALID_STATUSES = [
 function normalizeStatus(value) {
   return VALID_STATUSES.includes(value) ? value : "pending";
 }
+function normalizeDelivery(value) {
+  return value === "enclave" || value === "personal_server" ? value : void 0;
+}
 function normalizeNetwork(value) {
   return value === "mainnet" || value === "moksha" ? value : void 0;
 }
@@ -258,6 +261,7 @@ function createDefaultAccessRequestClient(options) {
       const scopes = body.scopes && body.scopes.length > 0 ? body.scopes : body.scope ? [body.scope] : void 0;
       return {
         status: normalizeStatus(body.status),
+        delivery: normalizeDelivery(body.delivery),
         personalServerUrl: body.personalServerUrl,
         grantId: body.grantId,
         scope: body.scope ?? scopes?.[0],

package/dist/direct/access-request-client.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/direct/access-request-client.ts"],"sourcesContent":["/**\n * Default client for the Vana Account access-request API.\n *\n * @remarks\n * Calls the Vana Account endpoints that issue `dcr_*` ids and approval URLs and\n * report request status. Inject a custom {@link AccessRequestClient} on the\n * controller to point at a different deployment; pass `fetchFn` to supply a test\n * double for the HTTP layer.\n *\n * @category Direct\n * @module direct/access-request-client\n */\n\nimport type {\n  AccessRequest,\n  AccessRequestClient,\n  AccessRequestQuestion,\n  AccessRequestStatus,\n  AccessRequestStatusValue,\n  DirectEnv,\n} from \"./types\";\nimport { normalizeMobileContinuationUrl } from \"./types\";\nimport type { Web3SignedSignFn } from \"../auth/web3-signed-builder\";\nimport { parseScope, type ParsedScope } from \"../protocol/scopes\";\nimport { DirectConfigError } from \"./errors\";\n\n/** Minimal `fetch` signature so the client is testable without a global fetch. */\nexport type FetchLike = (\n  input: string,\n  init?: {\n    method?: string;\n    headers?: Record<string, string>;\n    body?: string;\n  },\n) => Promise<{\n  ok: boolean;\n  status: number;\n  statusText: string;\n  json(): Promise<unknown>;\n  text(): Promise<string>;\n}>;\n\n/** Options for {@link createDefaultAccessRequestClient}. */\nexport interface DefaultAccessRequestClientOptions {\n  /** Base URL of the Vana Account access-request API. */\n  baseUrl: string;\n  /** Base URL the user is sent to for approval. */\n  approvalBaseUrl: string;\n  /**\n   * Target environment. Pins the allowed mobile continuation link host\n   * (`open.vana.org` for production, `open-dev.vana.org` for dev). When omitted,\n   * both canonical hosts pass the structural continuation-URL check.\n   */\n  env?: DirectEnv;\n  /** `fetch` implementation. Defaults to the global `fetch`. */\n  fetchFn?: FetchLike;\n  /** App identity address used for direct access-request authentication. */\n  appAddress?: string;\n  /** EIP-191 signer for direct access-request authentication. */\n  signMessage?: Web3SignedSignFn;\n  /** Clock source used for signed request timestamps. */\n  now?: () => number;\n  /**\n   * Create the signed DCR idempotency key used when a create call omits one.\n   * Called once per create. Injectable for deterministic tests.\n   */\n  createIdempotencyKey?: () => string;\n}\n\nconst VALID_STATUSES: readonly AccessRequestStatusValue[] = [\n  \"pending\",\n  \"approved\",\n  \"ready_for_read\",\n  \"completed\",\n  \"denied\",\n  \"expired\",\n];\n\nfunction normalizeStatus(value: unknown): AccessRequestStatusValue {\n  return VALID_STATUSES.includes(value as AccessRequestStatusValue)\n    ? (value as AccessRequestStatusValue)\n    : \"pending\";\n}\n\nfunction normalizeNetwork(value: unknown): AccessRequest[\"network\"] {\n  return value === \"mainnet\" || value === \"moksha\" ? value : undefined;\n}\n\nfunction normalizeExpiresAt(value: unknown): string | undefined {\n  return typeof value === \"string\" && Number.isFinite(Date.parse(value))\n    ? value\n    : undefined;\n}\n\nfunction defaultCreateIdempotencyKey(): string {\n  if (typeof globalThis.crypto?.randomUUID !== \"function\") {\n    throw new Error(\n      \"Secure randomUUID is unavailable. Pass createIdempotencyKey to createDefaultAccessRequestClient.\",\n    );\n  }\n  return globalThis.crypto.randomUUID();\n}\n\nfunction stripTrailingSlash(url: string): string {\n  return url.replace(/\\/+$/, \"\");\n}\n\nconst DIRECT_ACCESS_REQUEST_MESSAGE_PREFIX = \"Vana Direct Access Request v1\";\n\ninterface DirectAccessRequestAuthInput {\n  body: string;\n  method: string;\n  path: string;\n  timestamp: string;\n}\n\nexport function buildDirectAccessRequestAuthMessage(\n  input: DirectAccessRequestAuthInput,\n): string {\n  return [\n    DIRECT_ACCESS_REQUEST_MESSAGE_PREFIX,\n    `method:${input.method.toUpperCase()}`,\n    `path:${input.path}`,\n    `timestamp:${input.timestamp}`,\n    `body:${input.body}`,\n  ].join(\"\\n\");\n}\n\nasync function buildDirectAccessRequestHeaders(\n  options: DefaultAccessRequestClientOptions,\n  input: Omit<DirectAccessRequestAuthInput, \"timestamp\">,\n): Promise<Record<string, string>> {\n  if (!options.appAddress && !options.signMessage) {\n    return {};\n  }\n  if (!options.appAddress || !options.signMessage) {\n    throw new Error(\n      \"Direct access-request authentication requires both `appAddress` and `signMessage`.\",\n    );\n  }\n\n  const timestamp = String(options.now?.() ?? Date.now());\n  const signature = await options.signMessage(\n    buildDirectAccessRequestAuthMessage({ ...input, timestamp }),\n  );\n\n  return {\n    \"X-Vana-App-Address\": options.appAddress,\n    \"X-Vana-App-Signature\": signature,\n    \"X-Vana-App-Timestamp\": timestamp,\n  };\n}\n\n/**\n * Build an approval URL for a request id, matching the documented format\n * (`{app}/data-connection-requests/{requestId}?mode=page`).\n *\n * @param approvalBaseUrl - Base URL of the Vana approval app.\n * @param requestId - The `dcr_*` request id.\n * @returns The full approval URL.\n */\nexport function buildApprovalUrl(\n  approvalBaseUrl: string,\n  requestId: string,\n): string {\n  return `${stripTrailingSlash(approvalBaseUrl)}/data-connection-requests/${encodeURIComponent(\n    requestId,\n  )}?mode=page`;\n}\n\n/** The `recompute` values the question contract defines today. */\nconst RECOMPUTE_VALUES: readonly string[] = [\"snapshot\", \"on-change\"];\n\nfunction parseConcreteScope(field: string, value: unknown): ParsedScope {\n  if (typeof value !== \"string\") {\n    throw new DirectConfigError(`${field} must be a string`, { field });\n  }\n  try {\n    return parseScope(value);\n  } catch {\n    throw new DirectConfigError(\n      `${field} \"${value}\" is not a concrete scope. Use {source}.{category}[.{subcategory}] with no wildcard and no operation prefix.`,\n      { field, value },\n    );\n  }\n}\n\n/**\n * Validate the derivative questions on a create input against the request\n * scope entries.\n *\n * @remarks\n * Client-side mirror of the access-request service rules so builders fail\n * fast, before the create request is signed and sent; the service remains\n * authoritative. Rules: 1 to 4 questions; every `derivedScope` and every\n * `sourceScope` is a concrete scope (wildcards rejected); 1 to 16 source\n * scopes per question with no duplicates and none equal to the derived scope;\n * the first dot-segment of the derived scope differs from the first\n * dot-segment of every source scope; the derived scope appears verbatim in\n * `scopes` as a bare read entry; no two questions share a derived scope; the\n * question text is 1 to 4000 characters after trimming; `recompute`, when\n * present, is `\"snapshot\"` or `\"on-change\"`.\n *\n * @param questions - The `questions` array from the create input.\n * @param scopes - The request's grant scope entries, verbatim.\n * @throws {DirectConfigError} - When any rule is violated. The message names\n * the offending question index and field.\n */\nexport function validateAccessRequestQuestions(\n  questions: readonly AccessRequestQuestion[],\n  scopes: readonly string[],\n): void {\n  if (questions.length === 0 || questions.length > 4) {\n    throw new DirectConfigError(\n      `questions must contain 1 to 4 entries when present, got ${questions.length}. Omit the field to send no questions.`,\n      { count: questions.length },\n    );\n  }\n  const seenDerived = new Set<string>();\n  questions.forEach((question, index) => {\n    const label = `questions[${index}]`;\n    const derived = parseConcreteScope(\n      `${label}.derivedScope`,\n      question.derivedScope,\n    );\n    if (seenDerived.has(question.derivedScope)) {\n      throw new DirectConfigError(\n        `${label}.derivedScope \"${question.derivedScope}\" is already used by an earlier question. Each question must target its own derived scope.`,\n        { derivedScope: question.derivedScope },\n      );\n    }\n    seenDerived.add(question.derivedScope);\n    // The bare entry (no operation prefix) is what makes the answer readable\n    // by the app: `write:coach.weekly` alone would not grant the read back.\n    if (!scopes.includes(question.derivedScope)) {\n      throw new DirectConfigError(\n        `${label}.derivedScope \"${question.derivedScope}\" must also appear in scopes as a bare read entry, so the app can read the answer it asked for.`,\n        { derivedScope: question.derivedScope, scopes: [...scopes] },\n      );\n    }\n    if (\n      question.sourceScopes.length === 0 ||\n      question.sourceScopes.length > 16\n    ) {\n      throw new DirectConfigError(\n        `${label}.sourceScopes must contain 1 to 16 entries, got ${question.sourceScopes.length}.`,\n        { count: question.sourceScopes.length },\n      );\n    }\n    const seenSources = new Set<string>();\n    for (const sourceScope of question.sourceScopes) {\n      const source = parseConcreteScope(`${label}.sourceScopes`, sourceScope);\n      if (seenSources.has(sourceScope)) {\n        throw new DirectConfigError(\n          `${label}.sourceScopes contains \"${sourceScope}\" more than once. Deduplicate the source scopes.`,\n          { sourceScope },\n        );\n      }\n      seenSources.add(sourceScope);\n      if (sourceScope === question.derivedScope) {\n        throw new DirectConfigError(\n          `${label}.sourceScopes must not contain the derived scope \"${question.derivedScope}\".`,\n          { sourceScope },\n        );\n      }\n      if (source.source === derived.source) {\n        throw new DirectConfigError(\n          `${label}.derivedScope \"${question.derivedScope}\" must not share its first dot-segment \"${derived.source}\" with source scope \"${sourceScope}\". Name the derived scope under the app's own namespace.`,\n          { derivedScope: question.derivedScope, sourceScope },\n        );\n      }\n    }\n    if (typeof question.question !== \"string\") {\n      throw new DirectConfigError(`${label}.question must be a string`, {\n        field: `${label}.question`,\n      });\n    }\n    const trimmedLength = question.question.trim().length;\n    if (trimmedLength === 0 || trimmedLength > 4000) {\n      throw new DirectConfigError(\n        `${label}.question must be 1 to 4000 characters after trimming, got ${trimmedLength}.`,\n        { length: trimmedLength },\n      );\n    }\n    if (\n      question.recompute !== undefined &&\n      !RECOMPUTE_VALUES.includes(question.recompute)\n    ) {\n      throw new DirectConfigError(\n        `${label}.recompute must be \"snapshot\" or \"on-change\" when present, got \"${String(question.recompute)}\".`,\n        { recompute: question.recompute },\n      );\n    }\n  });\n}\n\n/**\n * Create the default {@link AccessRequestClient} for the Vana Account\n * access-request API.\n *\n * @param options - Base URLs and an optional `fetch` implementation.\n * @returns An {@link AccessRequestClient} backed by HTTP calls.\n */\nexport function createDefaultAccessRequestClient(\n  options: DefaultAccessRequestClientOptions,\n): AccessRequestClient {\n  const fetchFn = options.fetchFn ?? (globalThis.fetch as FetchLike);\n  if (!fetchFn) {\n    throw new Error(\n      \"No fetch implementation available. Pass `fetchFn` to createDefaultAccessRequestClient.\",\n    );\n  }\n  const base = stripTrailingSlash(options.baseUrl);\n\n  return {\n    async createAccessRequest(input): Promise<AccessRequest> {\n      if (input.questions !== undefined) {\n        validateAccessRequestQuestions(input.questions, input.scopes);\n      }\n      const path = \"/api/data-connection-requests\";\n      // Every call is an independent logical create, so it gets its own key.\n      // The client cannot tell two look-alike creates apart — one shared backend\n      // controller serves many users with the same app, scopes, and returnUrl —\n      // so deriving a key from the input would let the service deduplicate two\n      // users onto a single DCR. Retrying an uncertain create is the caller's\n      // decision: pass the same `idempotencyKey` back in.\n      const idempotencyKey =\n        input.idempotencyKey ??\n        (options.createIdempotencyKey ?? defaultCreateIdempotencyKey)();\n      const body = JSON.stringify({\n        appAddress: input.appAddress,\n        app: input.app,\n        source: input.source,\n        scopes: input.scopes,\n        returnUrl: input.returnUrl,\n        network: input.network,\n        ...(input.foregroundDelivery !== undefined\n          ? { foregroundDelivery: input.foregroundDelivery }\n          : {}),\n        ...(input.questions !== undefined\n          ? { questions: input.questions }\n          : {}),\n        idempotencyKey,\n      });\n      const res = await fetchFn(`${base}${path}`, {\n        method: \"POST\",\n        headers: {\n          \"Content-Type\": \"application/json\",\n          ...(await buildDirectAccessRequestHeaders(options, {\n            body,\n            method: \"POST\",\n            path,\n          })),\n        },\n        body,\n      });\n      if (!res.ok) {\n        throw new Error(\n          `Access request service error: ${res.status} ${res.statusText}`,\n        );\n      }\n      const responseBody = (await res.json()) as {\n        requestId?: string;\n        id?: string;\n        approvalUrl?: string;\n        appAddress?: string;\n        network?: unknown;\n        expiresAt?: unknown;\n        mobileContinuationUrl?: unknown;\n      };\n      const requestId = responseBody.requestId ?? responseBody.id;\n      if (!requestId) {\n        throw new Error(\"Access request service returned no requestId\");\n      }\n      return {\n        requestId,\n        approvalUrl:\n          responseBody.approvalUrl ??\n          buildApprovalUrl(options.approvalBaseUrl, requestId),\n        appAddress: responseBody.appAddress ?? input.appAddress,\n        network: normalizeNetwork(responseBody.network),\n        expiresAt: normalizeExpiresAt(responseBody.expiresAt),\n        mobileContinuationUrl: normalizeMobileContinuationUrl(\n          responseBody.mobileContinuationUrl,\n          options.env,\n        ),\n      };\n    },\n\n    async getAccessRequestStatus(\n      requestId: string,\n    ): Promise<AccessRequestStatus> {\n      const path = `/api/data-connection-requests/${encodeURIComponent(requestId)}`;\n      const res = await fetchFn(`${base}${path}`, {\n        method: \"GET\",\n        headers: await buildDirectAccessRequestHeaders(options, {\n          body: \"\",\n          method: \"GET\",\n          path,\n        }),\n      });\n      if (!res.ok) {\n        throw new Error(\n          `Access request service error: ${res.status} ${res.statusText}`,\n        );\n      }\n      const body = (await res.json()) as {\n        status?: string;\n        personalServerUrl?: string;\n        grantId?: string;\n        scope?: string;\n        mobileContinuationUrl?: unknown;\n        scopes?: string[];\n      };\n      // `scopes` is the full approved set; `scope` is the first of them, kept\n      // for callers (and deployments) that predate the array.\n      const scopes =\n        body.scopes && body.scopes.length > 0\n          ? body.scopes\n          : body.scope\n            ? [body.scope]\n            : undefined;\n      return {\n        status: normalizeStatus(body.status),\n        personalServerUrl: body.personalServerUrl,\n        grantId: body.grantId,\n        scope: body.scope ?? scopes?.[0],\n        scopes,\n        mobileContinuationUrl: normalizeMobileContinuationUrl(\n          body.mobileContinuationUrl,\n          options.env,\n        ),\n      };\n    },\n\n    async acknowledgeRead(requestId: string): Promise<void> {\n      const path = `/api/data-connection-requests/${encodeURIComponent(requestId)}/consumer-ack`;\n      const res = await fetchFn(`${base}${path}`, {\n        method: \"POST\",\n        headers: await buildDirectAccessRequestHeaders(options, {\n          body: \"\",\n          method: \"POST\",\n          path,\n        }),\n      });\n      if (!res.ok) {\n        throw new Error(\n          `Access request ack service error: ${res.status} ${res.statusText}`,\n        );\n      }\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAqBA,mBAA+C;AAE/C,oBAA6C;AAC7C,oBAAkC;AA6ClC,MAAM,iBAAsD;AAAA,EAC1D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,SAAS,gBAAgB,OAA0C;AACjE,SAAO,eAAe,SAAS,KAAiC,IAC3D,QACD;AACN;AAEA,SAAS,iBAAiB,OAA0C;AAClE,SAAO,UAAU,aAAa,UAAU,WAAW,QAAQ;AAC7D;AAEA,SAAS,mBAAmB,OAAoC;AAC9D,SAAO,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,MAAM,KAAK,CAAC,IACjE,QACA;AACN;AAEA,SAAS,8BAAsC;AAC7C,MAAI,OAAO,WAAW,QAAQ,eAAe,YAAY;AACvD,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO,WAAW,OAAO,WAAW;AACtC;AAEA,SAAS,mBAAmB,KAAqB;AAC/C,SAAO,IAAI,QAAQ,QAAQ,EAAE;AAC/B;AAEA,MAAM,uCAAuC;AAStC,SAAS,oCACd,OACQ;AACR,SAAO;AAAA,IACL;AAAA,IACA,UAAU,MAAM,OAAO,YAAY,CAAC;AAAA,IACpC,QAAQ,MAAM,IAAI;AAAA,IAClB,aAAa,MAAM,SAAS;AAAA,IAC5B,QAAQ,MAAM,IAAI;AAAA,EACpB,EAAE,KAAK,IAAI;AACb;AAEA,eAAe,gCACb,SACA,OACiC;AACjC,MAAI,CAAC,QAAQ,cAAc,CAAC,QAAQ,aAAa;AAC/C,WAAO,CAAC;AAAA,EACV;AACA,MAAI,CAAC,QAAQ,cAAc,CAAC,QAAQ,aAAa;AAC/C,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,YAAY,OAAO,QAAQ,MAAM,KAAK,KAAK,IAAI,CAAC;AACtD,QAAM,YAAY,MAAM,QAAQ;AAAA,IAC9B,oCAAoC,EAAE,GAAG,OAAO,UAAU,CAAC;AAAA,EAC7D;AAEA,SAAO;AAAA,IACL,sBAAsB,QAAQ;AAAA,IAC9B,wBAAwB;AAAA,IACxB,wBAAwB;AAAA,EAC1B;AACF;AAUO,SAAS,iBACd,iBACA,WACQ;AACR,SAAO,GAAG,mBAAmB,eAAe,CAAC,6BAA6B;AAAA,IACxE;AAAA,EACF,CAAC;AACH;AAGA,MAAM,mBAAsC,CAAC,YAAY,WAAW;AAEpE,SAAS,mBAAmB,OAAe,OAA6B;AACtE,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,IAAI,gCAAkB,GAAG,KAAK,qBAAqB,EAAE,MAAM,CAAC;AAAA,EACpE;AACA,MAAI;AACF,eAAO,0BAAW,KAAK;AAAA,EACzB,QAAQ;AACN,UAAM,IAAI;AAAA,MACR,GAAG,KAAK,KAAK,KAAK;AAAA,MAClB,EAAE,OAAO,MAAM;AAAA,IACjB;AAAA,EACF;AACF;AAuBO,SAAS,+BACd,WACA,QACM;AACN,MAAI,UAAU,WAAW,KAAK,UAAU,SAAS,GAAG;AAClD,UAAM,IAAI;AAAA,MACR,2DAA2D,UAAU,MAAM;AAAA,MAC3E,EAAE,OAAO,UAAU,OAAO;AAAA,IAC5B;AAAA,EACF;AACA,QAAM,cAAc,oBAAI,IAAY;AACpC,YAAU,QAAQ,CAAC,UAAU,UAAU;AACrC,UAAM,QAAQ,aAAa,KAAK;AAChC,UAAM,UAAU;AAAA,MACd,GAAG,KAAK;AAAA,MACR,SAAS;AAAA,IACX;AACA,QAAI,YAAY,IAAI,SAAS,YAAY,GAAG;AAC1C,YAAM,IAAI;AAAA,QACR,GAAG,KAAK,kBAAkB,SAAS,YAAY;AAAA,QAC/C,EAAE,cAAc,SAAS,aAAa;AAAA,MACxC;AAAA,IACF;AACA,gBAAY,IAAI,SAAS,YAAY;AAGrC,QAAI,CAAC,OAAO,SAAS,SAAS,YAAY,GAAG;AAC3C,YAAM,IAAI;AAAA,QACR,GAAG,KAAK,kBAAkB,SAAS,YAAY;AAAA,QAC/C,EAAE,cAAc,SAAS,cAAc,QAAQ,CAAC,GAAG,MAAM,EAAE;AAAA,MAC7D;AAAA,IACF;AACA,QACE,SAAS,aAAa,WAAW,KACjC,SAAS,aAAa,SAAS,IAC/B;AACA,YAAM,IAAI;AAAA,QACR,GAAG,KAAK,mDAAmD,SAAS,aAAa,MAAM;AAAA,QACvF,EAAE,OAAO,SAAS,aAAa,OAAO;AAAA,MACxC;AAAA,IACF;AACA,UAAM,cAAc,oBAAI,IAAY;AACpC,eAAW,eAAe,SAAS,cAAc;AAC/C,YAAM,SAAS,mBAAmB,GAAG,KAAK,iBAAiB,WAAW;AACtE,UAAI,YAAY,IAAI,WAAW,GAAG;AAChC,cAAM,IAAI;AAAA,UACR,GAAG,KAAK,2BAA2B,WAAW;AAAA,UAC9C,EAAE,YAAY;AAAA,QAChB;AAAA,MACF;AACA,kBAAY,IAAI,WAAW;AAC3B,UAAI,gBAAgB,SAAS,cAAc;AACzC,cAAM,IAAI;AAAA,UACR,GAAG,KAAK,qDAAqD,SAAS,YAAY;AAAA,UAClF,EAAE,YAAY;AAAA,QAChB;AAAA,MACF;AACA,UAAI,OAAO,WAAW,QAAQ,QAAQ;AACpC,cAAM,IAAI;AAAA,UACR,GAAG,KAAK,kBAAkB,SAAS,YAAY,2CAA2C,QAAQ,MAAM,wBAAwB,WAAW;AAAA,UAC3I,EAAE,cAAc,SAAS,cAAc,YAAY;AAAA,QACrD;AAAA,MACF;AAAA,IACF;AACA,QAAI,OAAO,SAAS,aAAa,UAAU;AACzC,YAAM,IAAI,gCAAkB,GAAG,KAAK,8BAA8B;AAAA,QAChE,OAAO,GAAG,KAAK;AAAA,MACjB,CAAC;AAAA,IACH;AACA,UAAM,gBAAgB,SAAS,SAAS,KAAK,EAAE;AAC/C,QAAI,kBAAkB,KAAK,gBAAgB,KAAM;AAC/C,YAAM,IAAI;AAAA,QACR,GAAG,KAAK,8DAA8D,aAAa;AAAA,QACnF,EAAE,QAAQ,cAAc;AAAA,MAC1B;AAAA,IACF;AACA,QACE,SAAS,cAAc,UACvB,CAAC,iBAAiB,SAAS,SAAS,SAAS,GAC7C;AACA,YAAM,IAAI;AAAA,QACR,GAAG,KAAK,mEAAmE,OAAO,SAAS,SAAS,CAAC;AAAA,QACrG,EAAE,WAAW,SAAS,UAAU;AAAA,MAClC;AAAA,IACF;AAAA,EACF,CAAC;AACH;AASO,SAAS,iCACd,SACqB;AACrB,QAAM,UAAU,QAAQ,WAAY,WAAW;AAC/C,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,OAAO,mBAAmB,QAAQ,OAAO;AAE/C,SAAO;AAAA,IACL,MAAM,oBAAoB,OAA+B;AACvD,UAAI,MAAM,cAAc,QAAW;AACjC,uCAA+B,MAAM,WAAW,MAAM,MAAM;AAAA,MAC9D;AACA,YAAM,OAAO;AAOb,YAAM,iBACJ,MAAM,mBACL,QAAQ,wBAAwB,6BAA6B;AAChE,YAAM,OAAO,KAAK,UAAU;AAAA,QAC1B,YAAY,MAAM;AAAA,QAClB,KAAK,MAAM;AAAA,QACX,QAAQ,MAAM;AAAA,QACd,QAAQ,MAAM;AAAA,QACd,WAAW,MAAM;AAAA,QACjB,SAAS,MAAM;AAAA,QACf,GAAI,MAAM,uBAAuB,SAC7B,EAAE,oBAAoB,MAAM,mBAAmB,IAC/C,CAAC;AAAA,QACL,GAAI,MAAM,cAAc,SACpB,EAAE,WAAW,MAAM,UAAU,IAC7B,CAAC;AAAA,QACL;AAAA,MACF,CAAC;AACD,YAAM,MAAM,MAAM,QAAQ,GAAG,IAAI,GAAG,IAAI,IAAI;AAAA,QAC1C,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,gBAAgB;AAAA,UAChB,GAAI,MAAM,gCAAgC,SAAS;AAAA,YACjD;AAAA,YACA,QAAQ;AAAA,YACR;AAAA,UACF,CAAC;AAAA,QACH;AAAA,QACA;AAAA,MACF,CAAC;AACD,UAAI,CAAC,IAAI,IAAI;AACX,cAAM,IAAI;AAAA,UACR,iCAAiC,IAAI,MAAM,IAAI,IAAI,UAAU;AAAA,QAC/D;AAAA,MACF;AACA,YAAM,eAAgB,MAAM,IAAI,KAAK;AASrC,YAAM,YAAY,aAAa,aAAa,aAAa;AACzD,UAAI,CAAC,WAAW;AACd,cAAM,IAAI,MAAM,8CAA8C;AAAA,MAChE;AACA,aAAO;AAAA,QACL;AAAA,QACA,aACE,aAAa,eACb,iBAAiB,QAAQ,iBAAiB,SAAS;AAAA,QACrD,YAAY,aAAa,cAAc,MAAM;AAAA,QAC7C,SAAS,iBAAiB,aAAa,OAAO;AAAA,QAC9C,WAAW,mBAAmB,aAAa,SAAS;AAAA,QACpD,2BAAuB;AAAA,UACrB,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IAEA,MAAM,uBACJ,WAC8B;AAC9B,YAAM,OAAO,iCAAiC,mBAAmB,SAAS,CAAC;AAC3E,YAAM,MAAM,MAAM,QAAQ,GAAG,IAAI,GAAG,IAAI,IAAI;AAAA,QAC1C,QAAQ;AAAA,QACR,SAAS,MAAM,gCAAgC,SAAS;AAAA,UACtD,MAAM;AAAA,UACN,QAAQ;AAAA,UACR;AAAA,QACF,CAAC;AAAA,MACH,CAAC;AACD,UAAI,CAAC,IAAI,IAAI;AACX,cAAM,IAAI;AAAA,UACR,iCAAiC,IAAI,MAAM,IAAI,IAAI,UAAU;AAAA,QAC/D;AAAA,MACF;AACA,YAAM,OAAQ,MAAM,IAAI,KAAK;AAU7B,YAAM,SACJ,KAAK,UAAU,KAAK,OAAO,SAAS,IAChC,KAAK,SACL,KAAK,QACH,CAAC,KAAK,KAAK,IACX;AACR,aAAO;AAAA,QACL,QAAQ,gBAAgB,KAAK,MAAM;AAAA,QACnC,mBAAmB,KAAK;AAAA,QACxB,SAAS,KAAK;AAAA,QACd,OAAO,KAAK,SAAS,SAAS,CAAC;AAAA,QAC/B;AAAA,QACA,2BAAuB;AAAA,UACrB,KAAK;AAAA,UACL,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IAEA,MAAM,gBAAgB,WAAkC;AACtD,YAAM,OAAO,iCAAiC,mBAAmB,SAAS,CAAC;AAC3E,YAAM,MAAM,MAAM,QAAQ,GAAG,IAAI,GAAG,IAAI,IAAI;AAAA,QAC1C,QAAQ;AAAA,QACR,SAAS,MAAM,gCAAgC,SAAS;AAAA,UACtD,MAAM;AAAA,UACN,QAAQ;AAAA,UACR;AAAA,QACF,CAAC;AAAA,MACH,CAAC;AACD,UAAI,CAAC,IAAI,IAAI;AACX,cAAM,IAAI;AAAA,UACR,qCAAqC,IAAI,MAAM,IAAI,IAAI,UAAU;AAAA,QACnE;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/direct/access-request-client.ts"],"sourcesContent":["/**\n * Default client for the Vana Account access-request API.\n *\n * @remarks\n * Calls the Vana Account endpoints that issue `dcr_*` ids and approval URLs and\n * report request status. Inject a custom {@link AccessRequestClient} on the\n * controller to point at a different deployment; pass `fetchFn` to supply a test\n * double for the HTTP layer.\n *\n * @category Direct\n * @module direct/access-request-client\n */\n\nimport type {\n  AccessRequest,\n  AccessRequestClient,\n  AccessRequestDelivery,\n  AccessRequestQuestion,\n  AccessRequestStatus,\n  AccessRequestStatusValue,\n  DirectEnv,\n} from \"./types\";\nimport { normalizeMobileContinuationUrl } from \"./types\";\nimport type { Web3SignedSignFn } from \"../auth/web3-signed-builder\";\nimport { parseScope, type ParsedScope } from \"../protocol/scopes\";\nimport { DirectConfigError } from \"./errors\";\n\n/** Minimal `fetch` signature so the client is testable without a global fetch. */\nexport type FetchLike = (\n  input: string,\n  init?: {\n    method?: string;\n    headers?: Record<string, string>;\n    body?: string;\n  },\n) => Promise<{\n  ok: boolean;\n  status: number;\n  statusText: string;\n  json(): Promise<unknown>;\n  text(): Promise<string>;\n}>;\n\n/** Options for {@link createDefaultAccessRequestClient}. */\nexport interface DefaultAccessRequestClientOptions {\n  /** Base URL of the Vana Account access-request API. */\n  baseUrl: string;\n  /** Base URL the user is sent to for approval. */\n  approvalBaseUrl: string;\n  /**\n   * Target environment. Pins the allowed mobile continuation link host\n   * (`open.vana.org` for production, `open-dev.vana.org` for dev). When omitted,\n   * both canonical hosts pass the structural continuation-URL check.\n   */\n  env?: DirectEnv;\n  /** `fetch` implementation. Defaults to the global `fetch`. */\n  fetchFn?: FetchLike;\n  /** App identity address used for direct access-request authentication. */\n  appAddress?: string;\n  /** EIP-191 signer for direct access-request authentication. */\n  signMessage?: Web3SignedSignFn;\n  /** Clock source used for signed request timestamps. */\n  now?: () => number;\n  /**\n   * Create the signed DCR idempotency key used when a create call omits one.\n   * Called once per create. Injectable for deterministic tests.\n   */\n  createIdempotencyKey?: () => string;\n}\n\nconst VALID_STATUSES: readonly AccessRequestStatusValue[] = [\n  \"pending\",\n  \"approved\",\n  \"ready_for_read\",\n  \"completed\",\n  \"denied\",\n  \"expired\",\n];\n\nfunction normalizeStatus(value: unknown): AccessRequestStatusValue {\n  return VALID_STATUSES.includes(value as AccessRequestStatusValue)\n    ? (value as AccessRequestStatusValue)\n    : \"pending\";\n}\n\nfunction normalizeDelivery(value: unknown): AccessRequestDelivery | undefined {\n  return value === \"enclave\" || value === \"personal_server\" ? value : undefined;\n}\n\nfunction normalizeNetwork(value: unknown): AccessRequest[\"network\"] {\n  return value === \"mainnet\" || value === \"moksha\" ? value : undefined;\n}\n\nfunction normalizeExpiresAt(value: unknown): string | undefined {\n  return typeof value === \"string\" && Number.isFinite(Date.parse(value))\n    ? value\n    : undefined;\n}\n\nfunction defaultCreateIdempotencyKey(): string {\n  if (typeof globalThis.crypto?.randomUUID !== \"function\") {\n    throw new Error(\n      \"Secure randomUUID is unavailable. Pass createIdempotencyKey to createDefaultAccessRequestClient.\",\n    );\n  }\n  return globalThis.crypto.randomUUID();\n}\n\nfunction stripTrailingSlash(url: string): string {\n  return url.replace(/\\/+$/, \"\");\n}\n\nconst DIRECT_ACCESS_REQUEST_MESSAGE_PREFIX = \"Vana Direct Access Request v1\";\n\ninterface DirectAccessRequestAuthInput {\n  body: string;\n  method: string;\n  path: string;\n  timestamp: string;\n}\n\nexport function buildDirectAccessRequestAuthMessage(\n  input: DirectAccessRequestAuthInput,\n): string {\n  return [\n    DIRECT_ACCESS_REQUEST_MESSAGE_PREFIX,\n    `method:${input.method.toUpperCase()}`,\n    `path:${input.path}`,\n    `timestamp:${input.timestamp}`,\n    `body:${input.body}`,\n  ].join(\"\\n\");\n}\n\nasync function buildDirectAccessRequestHeaders(\n  options: DefaultAccessRequestClientOptions,\n  input: Omit<DirectAccessRequestAuthInput, \"timestamp\">,\n): Promise<Record<string, string>> {\n  if (!options.appAddress && !options.signMessage) {\n    return {};\n  }\n  if (!options.appAddress || !options.signMessage) {\n    throw new Error(\n      \"Direct access-request authentication requires both `appAddress` and `signMessage`.\",\n    );\n  }\n\n  const timestamp = String(options.now?.() ?? Date.now());\n  const signature = await options.signMessage(\n    buildDirectAccessRequestAuthMessage({ ...input, timestamp }),\n  );\n\n  return {\n    \"X-Vana-App-Address\": options.appAddress,\n    \"X-Vana-App-Signature\": signature,\n    \"X-Vana-App-Timestamp\": timestamp,\n  };\n}\n\n/**\n * Build an approval URL for a request id, matching the documented format\n * (`{app}/data-connection-requests/{requestId}?mode=page`).\n *\n * @param approvalBaseUrl - Base URL of the Vana approval app.\n * @param requestId - The `dcr_*` request id.\n * @returns The full approval URL.\n */\nexport function buildApprovalUrl(\n  approvalBaseUrl: string,\n  requestId: string,\n): string {\n  return `${stripTrailingSlash(approvalBaseUrl)}/data-connection-requests/${encodeURIComponent(\n    requestId,\n  )}?mode=page`;\n}\n\n/** The `recompute` values the question contract defines today. */\nconst RECOMPUTE_VALUES: readonly string[] = [\"snapshot\", \"on-change\"];\n\nfunction parseConcreteScope(field: string, value: unknown): ParsedScope {\n  if (typeof value !== \"string\") {\n    throw new DirectConfigError(`${field} must be a string`, { field });\n  }\n  try {\n    return parseScope(value);\n  } catch {\n    throw new DirectConfigError(\n      `${field} \"${value}\" is not a concrete scope. Use {source}.{category}[.{subcategory}] with no wildcard and no operation prefix.`,\n      { field, value },\n    );\n  }\n}\n\n/**\n * Validate the derivative questions on a create input against the request\n * scope entries.\n *\n * @remarks\n * Client-side mirror of the access-request service rules so builders fail\n * fast, before the create request is signed and sent; the service remains\n * authoritative. Rules: 1 to 4 questions; every `derivedScope` and every\n * `sourceScope` is a concrete scope (wildcards rejected); 1 to 16 source\n * scopes per question with no duplicates and none equal to the derived scope;\n * the first dot-segment of the derived scope differs from the first\n * dot-segment of every source scope; the derived scope appears verbatim in\n * `scopes` as a bare read entry; no two questions share a derived scope; the\n * question text is 1 to 4000 characters after trimming; `recompute`, when\n * present, is `\"snapshot\"` or `\"on-change\"`.\n *\n * @param questions - The `questions` array from the create input.\n * @param scopes - The request's grant scope entries, verbatim.\n * @throws {DirectConfigError} - When any rule is violated. The message names\n * the offending question index and field.\n */\nexport function validateAccessRequestQuestions(\n  questions: readonly AccessRequestQuestion[],\n  scopes: readonly string[],\n): void {\n  if (questions.length === 0 || questions.length > 4) {\n    throw new DirectConfigError(\n      `questions must contain 1 to 4 entries when present, got ${questions.length}. Omit the field to send no questions.`,\n      { count: questions.length },\n    );\n  }\n  const seenDerived = new Set<string>();\n  questions.forEach((question, index) => {\n    const label = `questions[${index}]`;\n    const derived = parseConcreteScope(\n      `${label}.derivedScope`,\n      question.derivedScope,\n    );\n    if (seenDerived.has(question.derivedScope)) {\n      throw new DirectConfigError(\n        `${label}.derivedScope \"${question.derivedScope}\" is already used by an earlier question. Each question must target its own derived scope.`,\n        { derivedScope: question.derivedScope },\n      );\n    }\n    seenDerived.add(question.derivedScope);\n    // The bare entry (no operation prefix) is what makes the answer readable\n    // by the app: `write:coach.weekly` alone would not grant the read back.\n    if (!scopes.includes(question.derivedScope)) {\n      throw new DirectConfigError(\n        `${label}.derivedScope \"${question.derivedScope}\" must also appear in scopes as a bare read entry, so the app can read the answer it asked for.`,\n        { derivedScope: question.derivedScope, scopes: [...scopes] },\n      );\n    }\n    if (\n      question.sourceScopes.length === 0 ||\n      question.sourceScopes.length > 16\n    ) {\n      throw new DirectConfigError(\n        `${label}.sourceScopes must contain 1 to 16 entries, got ${question.sourceScopes.length}.`,\n        { count: question.sourceScopes.length },\n      );\n    }\n    const seenSources = new Set<string>();\n    for (const sourceScope of question.sourceScopes) {\n      const source = parseConcreteScope(`${label}.sourceScopes`, sourceScope);\n      if (seenSources.has(sourceScope)) {\n        throw new DirectConfigError(\n          `${label}.sourceScopes contains \"${sourceScope}\" more than once. Deduplicate the source scopes.`,\n          { sourceScope },\n        );\n      }\n      seenSources.add(sourceScope);\n      if (sourceScope === question.derivedScope) {\n        throw new DirectConfigError(\n          `${label}.sourceScopes must not contain the derived scope \"${question.derivedScope}\".`,\n          { sourceScope },\n        );\n      }\n      if (source.source === derived.source) {\n        throw new DirectConfigError(\n          `${label}.derivedScope \"${question.derivedScope}\" must not share its first dot-segment \"${derived.source}\" with source scope \"${sourceScope}\". Name the derived scope under the app's own namespace.`,\n          { derivedScope: question.derivedScope, sourceScope },\n        );\n      }\n    }\n    if (typeof question.question !== \"string\") {\n      throw new DirectConfigError(`${label}.question must be a string`, {\n        field: `${label}.question`,\n      });\n    }\n    const trimmedLength = question.question.trim().length;\n    if (trimmedLength === 0 || trimmedLength > 4000) {\n      throw new DirectConfigError(\n        `${label}.question must be 1 to 4000 characters after trimming, got ${trimmedLength}.`,\n        { length: trimmedLength },\n      );\n    }\n    if (\n      question.recompute !== undefined &&\n      !RECOMPUTE_VALUES.includes(question.recompute)\n    ) {\n      throw new DirectConfigError(\n        `${label}.recompute must be \"snapshot\" or \"on-change\" when present, got \"${String(question.recompute)}\".`,\n        { recompute: question.recompute },\n      );\n    }\n  });\n}\n\n/**\n * Create the default {@link AccessRequestClient} for the Vana Account\n * access-request API.\n *\n * @param options - Base URLs and an optional `fetch` implementation.\n * @returns An {@link AccessRequestClient} backed by HTTP calls.\n */\nexport function createDefaultAccessRequestClient(\n  options: DefaultAccessRequestClientOptions,\n): AccessRequestClient {\n  const fetchFn = options.fetchFn ?? (globalThis.fetch as FetchLike);\n  if (!fetchFn) {\n    throw new Error(\n      \"No fetch implementation available. Pass `fetchFn` to createDefaultAccessRequestClient.\",\n    );\n  }\n  const base = stripTrailingSlash(options.baseUrl);\n\n  return {\n    async createAccessRequest(input): Promise<AccessRequest> {\n      if (input.questions !== undefined) {\n        validateAccessRequestQuestions(input.questions, input.scopes);\n      }\n      const path = \"/api/data-connection-requests\";\n      // Every call is an independent logical create, so it gets its own key.\n      // The client cannot tell two look-alike creates apart — one shared backend\n      // controller serves many users with the same app, scopes, and returnUrl —\n      // so deriving a key from the input would let the service deduplicate two\n      // users onto a single DCR. Retrying an uncertain create is the caller's\n      // decision: pass the same `idempotencyKey` back in.\n      const idempotencyKey =\n        input.idempotencyKey ??\n        (options.createIdempotencyKey ?? defaultCreateIdempotencyKey)();\n      const body = JSON.stringify({\n        appAddress: input.appAddress,\n        app: input.app,\n        source: input.source,\n        scopes: input.scopes,\n        returnUrl: input.returnUrl,\n        network: input.network,\n        ...(input.foregroundDelivery !== undefined\n          ? { foregroundDelivery: input.foregroundDelivery }\n          : {}),\n        ...(input.questions !== undefined\n          ? { questions: input.questions }\n          : {}),\n        idempotencyKey,\n      });\n      const res = await fetchFn(`${base}${path}`, {\n        method: \"POST\",\n        headers: {\n          \"Content-Type\": \"application/json\",\n          ...(await buildDirectAccessRequestHeaders(options, {\n            body,\n            method: \"POST\",\n            path,\n          })),\n        },\n        body,\n      });\n      if (!res.ok) {\n        throw new Error(\n          `Access request service error: ${res.status} ${res.statusText}`,\n        );\n      }\n      const responseBody = (await res.json()) as {\n        requestId?: string;\n        id?: string;\n        approvalUrl?: string;\n        appAddress?: string;\n        network?: unknown;\n        expiresAt?: unknown;\n        mobileContinuationUrl?: unknown;\n      };\n      const requestId = responseBody.requestId ?? responseBody.id;\n      if (!requestId) {\n        throw new Error(\"Access request service returned no requestId\");\n      }\n      return {\n        requestId,\n        approvalUrl:\n          responseBody.approvalUrl ??\n          buildApprovalUrl(options.approvalBaseUrl, requestId),\n        appAddress: responseBody.appAddress ?? input.appAddress,\n        network: normalizeNetwork(responseBody.network),\n        expiresAt: normalizeExpiresAt(responseBody.expiresAt),\n        mobileContinuationUrl: normalizeMobileContinuationUrl(\n          responseBody.mobileContinuationUrl,\n          options.env,\n        ),\n      };\n    },\n\n    async getAccessRequestStatus(\n      requestId: string,\n    ): Promise<AccessRequestStatus> {\n      const path = `/api/data-connection-requests/${encodeURIComponent(requestId)}`;\n      const res = await fetchFn(`${base}${path}`, {\n        method: \"GET\",\n        headers: await buildDirectAccessRequestHeaders(options, {\n          body: \"\",\n          method: \"GET\",\n          path,\n        }),\n      });\n      if (!res.ok) {\n        throw new Error(\n          `Access request service error: ${res.status} ${res.statusText}`,\n        );\n      }\n      const body = (await res.json()) as {\n        status?: string;\n        delivery?: unknown;\n        personalServerUrl?: string;\n        grantId?: string;\n        scope?: string;\n        mobileContinuationUrl?: unknown;\n        scopes?: string[];\n      };\n      // `scopes` is the full approved set; `scope` is the first of them, kept\n      // for callers (and deployments) that predate the array.\n      const scopes =\n        body.scopes && body.scopes.length > 0\n          ? body.scopes\n          : body.scope\n            ? [body.scope]\n            : undefined;\n      return {\n        status: normalizeStatus(body.status),\n        delivery: normalizeDelivery(body.delivery),\n        personalServerUrl: body.personalServerUrl,\n        grantId: body.grantId,\n        scope: body.scope ?? scopes?.[0],\n        scopes,\n        mobileContinuationUrl: normalizeMobileContinuationUrl(\n          body.mobileContinuationUrl,\n          options.env,\n        ),\n      };\n    },\n\n    async acknowledgeRead(requestId: string): Promise<void> {\n      const path = `/api/data-connection-requests/${encodeURIComponent(requestId)}/consumer-ack`;\n      const res = await fetchFn(`${base}${path}`, {\n        method: \"POST\",\n        headers: await buildDirectAccessRequestHeaders(options, {\n          body: \"\",\n          method: \"POST\",\n          path,\n        }),\n      });\n      if (!res.ok) {\n        throw new Error(\n          `Access request ack service error: ${res.status} ${res.statusText}`,\n        );\n      }\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAsBA,mBAA+C;AAE/C,oBAA6C;AAC7C,oBAAkC;AA6ClC,MAAM,iBAAsD;AAAA,EAC1D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,SAAS,gBAAgB,OAA0C;AACjE,SAAO,eAAe,SAAS,KAAiC,IAC3D,QACD;AACN;AAEA,SAAS,kBAAkB,OAAmD;AAC5E,SAAO,UAAU,aAAa,UAAU,oBAAoB,QAAQ;AACtE;AAEA,SAAS,iBAAiB,OAA0C;AAClE,SAAO,UAAU,aAAa,UAAU,WAAW,QAAQ;AAC7D;AAEA,SAAS,mBAAmB,OAAoC;AAC9D,SAAO,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,MAAM,KAAK,CAAC,IACjE,QACA;AACN;AAEA,SAAS,8BAAsC;AAC7C,MAAI,OAAO,WAAW,QAAQ,eAAe,YAAY;AACvD,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO,WAAW,OAAO,WAAW;AACtC;AAEA,SAAS,mBAAmB,KAAqB;AAC/C,SAAO,IAAI,QAAQ,QAAQ,EAAE;AAC/B;AAEA,MAAM,uCAAuC;AAStC,SAAS,oCACd,OACQ;AACR,SAAO;AAAA,IACL;AAAA,IACA,UAAU,MAAM,OAAO,YAAY,CAAC;AAAA,IACpC,QAAQ,MAAM,IAAI;AAAA,IAClB,aAAa,MAAM,SAAS;AAAA,IAC5B,QAAQ,MAAM,IAAI;AAAA,EACpB,EAAE,KAAK,IAAI;AACb;AAEA,eAAe,gCACb,SACA,OACiC;AACjC,MAAI,CAAC,QAAQ,cAAc,CAAC,QAAQ,aAAa;AAC/C,WAAO,CAAC;AAAA,EACV;AACA,MAAI,CAAC,QAAQ,cAAc,CAAC,QAAQ,aAAa;AAC/C,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,YAAY,OAAO,QAAQ,MAAM,KAAK,KAAK,IAAI,CAAC;AACtD,QAAM,YAAY,MAAM,QAAQ;AAAA,IAC9B,oCAAoC,EAAE,GAAG,OAAO,UAAU,CAAC;AAAA,EAC7D;AAEA,SAAO;AAAA,IACL,sBAAsB,QAAQ;AAAA,IAC9B,wBAAwB;AAAA,IACxB,wBAAwB;AAAA,EAC1B;AACF;AAUO,SAAS,iBACd,iBACA,WACQ;AACR,SAAO,GAAG,mBAAmB,eAAe,CAAC,6BAA6B;AAAA,IACxE;AAAA,EACF,CAAC;AACH;AAGA,MAAM,mBAAsC,CAAC,YAAY,WAAW;AAEpE,SAAS,mBAAmB,OAAe,OAA6B;AACtE,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,IAAI,gCAAkB,GAAG,KAAK,qBAAqB,EAAE,MAAM,CAAC;AAAA,EACpE;AACA,MAAI;AACF,eAAO,0BAAW,KAAK;AAAA,EACzB,QAAQ;AACN,UAAM,IAAI;AAAA,MACR,GAAG,KAAK,KAAK,KAAK;AAAA,MAClB,EAAE,OAAO,MAAM;AAAA,IACjB;AAAA,EACF;AACF;AAuBO,SAAS,+BACd,WACA,QACM;AACN,MAAI,UAAU,WAAW,KAAK,UAAU,SAAS,GAAG;AAClD,UAAM,IAAI;AAAA,MACR,2DAA2D,UAAU,MAAM;AAAA,MAC3E,EAAE,OAAO,UAAU,OAAO;AAAA,IAC5B;AAAA,EACF;AACA,QAAM,cAAc,oBAAI,IAAY;AACpC,YAAU,QAAQ,CAAC,UAAU,UAAU;AACrC,UAAM,QAAQ,aAAa,KAAK;AAChC,UAAM,UAAU;AAAA,MACd,GAAG,KAAK;AAAA,MACR,SAAS;AAAA,IACX;AACA,QAAI,YAAY,IAAI,SAAS,YAAY,GAAG;AAC1C,YAAM,IAAI;AAAA,QACR,GAAG,KAAK,kBAAkB,SAAS,YAAY;AAAA,QAC/C,EAAE,cAAc,SAAS,aAAa;AAAA,MACxC;AAAA,IACF;AACA,gBAAY,IAAI,SAAS,YAAY;AAGrC,QAAI,CAAC,OAAO,SAAS,SAAS,YAAY,GAAG;AAC3C,YAAM,IAAI;AAAA,QACR,GAAG,KAAK,kBAAkB,SAAS,YAAY;AAAA,QAC/C,EAAE,cAAc,SAAS,cAAc,QAAQ,CAAC,GAAG,MAAM,EAAE;AAAA,MAC7D;AAAA,IACF;AACA,QACE,SAAS,aAAa,WAAW,KACjC,SAAS,aAAa,SAAS,IAC/B;AACA,YAAM,IAAI;AAAA,QACR,GAAG,KAAK,mDAAmD,SAAS,aAAa,MAAM;AAAA,QACvF,EAAE,OAAO,SAAS,aAAa,OAAO;AAAA,MACxC;AAAA,IACF;AACA,UAAM,cAAc,oBAAI,IAAY;AACpC,eAAW,eAAe,SAAS,cAAc;AAC/C,YAAM,SAAS,mBAAmB,GAAG,KAAK,iBAAiB,WAAW;AACtE,UAAI,YAAY,IAAI,WAAW,GAAG;AAChC,cAAM,IAAI;AAAA,UACR,GAAG,KAAK,2BAA2B,WAAW;AAAA,UAC9C,EAAE,YAAY;AAAA,QAChB;AAAA,MACF;AACA,kBAAY,IAAI,WAAW;AAC3B,UAAI,gBAAgB,SAAS,cAAc;AACzC,cAAM,IAAI;AAAA,UACR,GAAG,KAAK,qDAAqD,SAAS,YAAY;AAAA,UAClF,EAAE,YAAY;AAAA,QAChB;AAAA,MACF;AACA,UAAI,OAAO,WAAW,QAAQ,QAAQ;AACpC,cAAM,IAAI;AAAA,UACR,GAAG,KAAK,kBAAkB,SAAS,YAAY,2CAA2C,QAAQ,MAAM,wBAAwB,WAAW;AAAA,UAC3I,EAAE,cAAc,SAAS,cAAc,YAAY;AAAA,QACrD;AAAA,MACF;AAAA,IACF;AACA,QAAI,OAAO,SAAS,aAAa,UAAU;AACzC,YAAM,IAAI,gCAAkB,GAAG,KAAK,8BAA8B;AAAA,QAChE,OAAO,GAAG,KAAK;AAAA,MACjB,CAAC;AAAA,IACH;AACA,UAAM,gBAAgB,SAAS,SAAS,KAAK,EAAE;AAC/C,QAAI,kBAAkB,KAAK,gBAAgB,KAAM;AAC/C,YAAM,IAAI;AAAA,QACR,GAAG,KAAK,8DAA8D,aAAa;AAAA,QACnF,EAAE,QAAQ,cAAc;AAAA,MAC1B;AAAA,IACF;AACA,QACE,SAAS,cAAc,UACvB,CAAC,iBAAiB,SAAS,SAAS,SAAS,GAC7C;AACA,YAAM,IAAI;AAAA,QACR,GAAG,KAAK,mEAAmE,OAAO,SAAS,SAAS,CAAC;AAAA,QACrG,EAAE,WAAW,SAAS,UAAU;AAAA,MAClC;AAAA,IACF;AAAA,EACF,CAAC;AACH;AASO,SAAS,iCACd,SACqB;AACrB,QAAM,UAAU,QAAQ,WAAY,WAAW;AAC/C,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,OAAO,mBAAmB,QAAQ,OAAO;AAE/C,SAAO;AAAA,IACL,MAAM,oBAAoB,OAA+B;AACvD,UAAI,MAAM,cAAc,QAAW;AACjC,uCAA+B,MAAM,WAAW,MAAM,MAAM;AAAA,MAC9D;AACA,YAAM,OAAO;AAOb,YAAM,iBACJ,MAAM,mBACL,QAAQ,wBAAwB,6BAA6B;AAChE,YAAM,OAAO,KAAK,UAAU;AAAA,QAC1B,YAAY,MAAM;AAAA,QAClB,KAAK,MAAM;AAAA,QACX,QAAQ,MAAM;AAAA,QACd,QAAQ,MAAM;AAAA,QACd,WAAW,MAAM;AAAA,QACjB,SAAS,MAAM;AAAA,QACf,GAAI,MAAM,uBAAuB,SAC7B,EAAE,oBAAoB,MAAM,mBAAmB,IAC/C,CAAC;AAAA,QACL,GAAI,MAAM,cAAc,SACpB,EAAE,WAAW,MAAM,UAAU,IAC7B,CAAC;AAAA,QACL;AAAA,MACF,CAAC;AACD,YAAM,MAAM,MAAM,QAAQ,GAAG,IAAI,GAAG,IAAI,IAAI;AAAA,QAC1C,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,gBAAgB;AAAA,UAChB,GAAI,MAAM,gCAAgC,SAAS;AAAA,YACjD;AAAA,YACA,QAAQ;AAAA,YACR;AAAA,UACF,CAAC;AAAA,QACH;AAAA,QACA;AAAA,MACF,CAAC;AACD,UAAI,CAAC,IAAI,IAAI;AACX,cAAM,IAAI;AAAA,UACR,iCAAiC,IAAI,MAAM,IAAI,IAAI,UAAU;AAAA,QAC/D;AAAA,MACF;AACA,YAAM,eAAgB,MAAM,IAAI,KAAK;AASrC,YAAM,YAAY,aAAa,aAAa,aAAa;AACzD,UAAI,CAAC,WAAW;AACd,cAAM,IAAI,MAAM,8CAA8C;AAAA,MAChE;AACA,aAAO;AAAA,QACL;AAAA,QACA,aACE,aAAa,eACb,iBAAiB,QAAQ,iBAAiB,SAAS;AAAA,QACrD,YAAY,aAAa,cAAc,MAAM;AAAA,QAC7C,SAAS,iBAAiB,aAAa,OAAO;AAAA,QAC9C,WAAW,mBAAmB,aAAa,SAAS;AAAA,QACpD,2BAAuB;AAAA,UACrB,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IAEA,MAAM,uBACJ,WAC8B;AAC9B,YAAM,OAAO,iCAAiC,mBAAmB,SAAS,CAAC;AAC3E,YAAM,MAAM,MAAM,QAAQ,GAAG,IAAI,GAAG,IAAI,IAAI;AAAA,QAC1C,QAAQ;AAAA,QACR,SAAS,MAAM,gCAAgC,SAAS;AAAA,UACtD,MAAM;AAAA,UACN,QAAQ;AAAA,UACR;AAAA,QACF,CAAC;AAAA,MACH,CAAC;AACD,UAAI,CAAC,IAAI,IAAI;AACX,cAAM,IAAI;AAAA,UACR,iCAAiC,IAAI,MAAM,IAAI,IAAI,UAAU;AAAA,QAC/D;AAAA,MACF;AACA,YAAM,OAAQ,MAAM,IAAI,KAAK;AAW7B,YAAM,SACJ,KAAK,UAAU,KAAK,OAAO,SAAS,IAChC,KAAK,SACL,KAAK,QACH,CAAC,KAAK,KAAK,IACX;AACR,aAAO;AAAA,QACL,QAAQ,gBAAgB,KAAK,MAAM;AAAA,QACnC,UAAU,kBAAkB,KAAK,QAAQ;AAAA,QACzC,mBAAmB,KAAK;AAAA,QACxB,SAAS,KAAK;AAAA,QACd,OAAO,KAAK,SAAS,SAAS,CAAC;AAAA,QAC/B;AAAA,QACA,2BAAuB;AAAA,UACrB,KAAK;AAAA,UACL,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IAEA,MAAM,gBAAgB,WAAkC;AACtD,YAAM,OAAO,iCAAiC,mBAAmB,SAAS,CAAC;AAC3E,YAAM,MAAM,MAAM,QAAQ,GAAG,IAAI,GAAG,IAAI,IAAI;AAAA,QAC1C,QAAQ;AAAA,QACR,SAAS,MAAM,gCAAgC,SAAS;AAAA,UACtD,MAAM;AAAA,UACN,QAAQ;AAAA,UACR;AAAA,QACF,CAAC;AAAA,MACH,CAAC;AACD,UAAI,CAAC,IAAI,IAAI;AACX,cAAM,IAAI;AAAA,UACR,qCAAqC,IAAI,MAAM,IAAI,IAAI,UAAU;AAAA,QACnE;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;","names":[]}

package/dist/direct/access-request-client.js

@@ -12,6 +12,9 @@ const VALID_STATUSES = [
 function normalizeStatus(value) {
   return VALID_STATUSES.includes(value) ? value : "pending";
 }
+function normalizeDelivery(value) {
+  return value === "enclave" || value === "personal_server" ? value : void 0;
+}
 function normalizeNetwork(value) {
   return value === "mainnet" || value === "moksha" ? value : void 0;
 }
@@ -232,6 +235,7 @@ function createDefaultAccessRequestClient(options) {
       const scopes = body.scopes && body.scopes.length > 0 ? body.scopes : body.scope ? [body.scope] : void 0;
       return {
         status: normalizeStatus(body.status),
+        delivery: normalizeDelivery(body.delivery),
         personalServerUrl: body.personalServerUrl,
         grantId: body.grantId,
         scope: body.scope ?? scopes?.[0],