@opendatalabs/vana-sdk 3.22.0 → 3.23.0-pr.211.341f55d

package/dist/index.browser.js

@@ -1338,6 +1338,68 @@ var WriteRejectedError = class extends PersonalServerWriteError {
     super(message, "WRITE_REJECTED", status, errorCode, details);
   }
 };
+var JobsClientError = class extends VanaError {
+  constructor(message, code, status, errorCode = null, details) {
+    super(message, code);
+    this.status = status;
+    this.errorCode = errorCode;
+    this.details = details;
+  }
+  status;
+  errorCode;
+  details;
+};
+var BuilderUnknownError = class extends JobsClientError {
+  constructor(message, details) {
+    super(message, "JOB_BUILDER_UNKNOWN", 403, "BUILDER_UNKNOWN", details);
+  }
+};
+var GrantInvalidError = class extends JobsClientError {
+  constructor(message, details) {
+    super(message, "JOB_GRANT_INVALID", 403, "GRANT_INVALID", details);
+  }
+};
+var OwnerNotReadyError = class extends JobsClientError {
+  constructor(message, details) {
+    super(message, "JOB_OWNER_NOT_READY", 403, "OWNER_NOT_READY", details);
+  }
+};
+var JobIdTakenError = class extends JobsClientError {
+  constructor(message, details) {
+    super(message, "JOB_ID_TAKEN", 409, "JOB_ID_TAKEN", details);
+  }
+};
+var JobNotFoundError = class extends JobsClientError {
+  constructor(message, details) {
+    super(message, "JOB_NOT_FOUND", 404, "JOB_NOT_FOUND", details);
+  }
+};
+var JobRequestTooLargeError = class extends JobsClientError {
+  constructor(message, errorCode = "BODY_TOO_LARGE", details) {
+    super(message, "JOB_REQUEST_TOO_LARGE", 413, errorCode, details);
+  }
+};
+var JobTimeoutError = class extends JobsClientError {
+  constructor(message, details) {
+    super(message, "JOB_TIMEOUT", void 0, null, details);
+  }
+};
+var JobResultIntegrityError = class extends JobsClientError {
+  constructor(message, details) {
+    super(message, "JOB_RESULT_INTEGRITY", void 0, null, details);
+  }
+};
+var JobRejectedError = class extends JobsClientError {
+  constructor(message, status, errorCode = null, details) {
+    super(message, "JOB_REJECTED", status, errorCode, details);
+  }
+};
+var JobTransportError = class extends JobsClientError {
+  constructor(message, cause) {
+    super(message, "JOB_TRANSPORT_ERROR");
+    this.cause = cause;
+  }
+};
 var LineageReadError = class extends VanaError {
   constructor(message, status, errorCode = null, details) {
     super(message, "LINEAGE_READ_ERROR");
@@ -31736,9 +31798,514 @@ var RECORD_DATA_ACCESS_TYPES = {
   ]
 };
 
+// src/protocol/identity.ts
+init_interface();
+import * as secp256k13 from "@noble/secp256k1";
+import {
+  concat as concat4,
+  encodePacked,
+  fromHex as fromHex5,
+  getAddress,
+  isAddressEqual,
+  keccak256,
+  recoverPublicKey,
+  toBytes,
+  toHex as toHex6
+} from "viem";
+import { publicKeyToAddress } from "viem/accounts";
+var ENCLAVE_IDENTITY_EVIDENCE_VERSION = 1;
+var USER_PS_ID_DOMAIN = "vana.ps-enclave.v1";
+var ENCLAVE_WALLET_PURPOSE = "vana.ps-enclave.wallet.v1";
+var MASTER_SIGNATURE_DELIVERY_VERSION = "vana.ps-enclave.delivery.v1";
+var MASTER_SIGNATURE_DELIVERY_MAX_AGE_SECONDS = 600;
+var SEALED_ENVELOPE_VERSION = 1;
+var VANA_MAINNET_CHAIN_ID = 1480;
+var MOKSHA_CHAIN_ID = 14800;
+var KMS_ISSUED_PREFIX = "dstack-kms-issued";
+var PREIMAGE_SEPARATOR = ":";
+var UNCOMPRESSED_PUBLIC_KEY_BYTES = 65;
+var UNCOMPRESSED_PUBLIC_KEY_PREFIX = "04";
+var EMPTY_HEX = "0x";
+function emptyAnchor() {
+  return Object.freeze({
+    kmsRootPubkey: EMPTY_HEX,
+    appIds: Object.freeze([])
+  });
+}
+var ENCLAVE_TRUST_ANCHORS = Object.freeze({
+  // filled at fleet provisioning; verify fails closed while empty
+  [VANA_MAINNET_CHAIN_ID]: emptyAnchor(),
+  // filled at fleet provisioning; verify fails closed while empty
+  [MOKSHA_CHAIN_ID]: emptyAnchor()
+});
+function userPsId(chainId, ownerAddress) {
+  const packed = encodePacked(
+    ["string", "uint256", "address"],
+    [USER_PS_ID_DOMAIN, BigInt(chainId), getAddress(ownerAddress)]
+  );
+  return keccak256(packed);
+}
+function compressPublicKey(publicKey) {
+  return secp256k13.ProjectivePoint.fromHex(
+    fromHex5(publicKey, "bytes")
+  ).toRawBytes(true);
+}
+function sameKey(a, b) {
+  return toHex6(compressPublicKey(a)) === toHex6(compressPublicKey(b));
+}
+function assertUncompressedKey(publicKey) {
+  const hex = publicKey.slice(2);
+  if (hex.length !== UNCOMPRESSED_PUBLIC_KEY_BYTES * 2 || !hex.startsWith(UNCOMPRESSED_PUBLIC_KEY_PREFIX) || !/^[0-9a-fA-F]+$/.test(hex)) {
+    throw new Error("Public key must be a 65-byte uncompressed secp256k1 key");
+  }
+}
+function appRootPreimage(purpose, publicKey) {
+  const keyHex = toHex6(compressPublicKey(publicKey)).slice(2);
+  return keccak256(toBytes(`${purpose}${PREIMAGE_SEPARATOR}${keyHex}`));
+}
+function kmsIssuedPreimage(appId, appRootPublicKey) {
+  const prefix = concat4([
+    toBytes(`${KMS_ISSUED_PREFIX}${PREIMAGE_SEPARATOR}`),
+    fromHex5(appId, "bytes")
+  ]);
+  const compressed = compressPublicKey(appRootPublicKey);
+  return keccak256(concat4([prefix, compressed]));
+}
+async function recoverChainKey(hash, signature, link) {
+  try {
+    return (await recoverPublicKey({ hash, signature })).toLowerCase();
+  } catch {
+    throw new Error(`Invalid enclave signature chain link ${link}`);
+  }
+}
+async function verifyEnclaveIdentityEvidence(evidence, anchors, expected) {
+  if (evidence.v !== ENCLAVE_IDENTITY_EVIDENCE_VERSION) {
+    throw new Error("Unsupported enclave identity evidence version");
+  }
+  if (!Number.isInteger(evidence.epoch) || evidence.epoch < 1) {
+    throw new Error("Invalid enclave identity epoch");
+  }
+  if (evidence.chainId !== expected.chainId) {
+    throw new Error(
+      "Enclave identity chain ID does not match expected chain ID"
+    );
+  }
+  if (!isAddressEqual(evidence.ownerAddress, expected.ownerAddress)) {
+    throw new Error("Enclave identity owner does not match expected owner");
+  }
+  if (evidence.epoch !== expected.epoch) {
+    throw new Error("Enclave identity epoch does not match expected epoch");
+  }
+  const expectedUserPsId = userPsId(expected.chainId, expected.ownerAddress);
+  if (evidence.userPsId.toLowerCase() !== expectedUserPsId.toLowerCase()) {
+    throw new Error("Enclave userPsId does not match expected identity");
+  }
+  if (evidence.purpose !== ENCLAVE_WALLET_PURPOSE) {
+    throw new Error("Unexpected enclave wallet purpose");
+  }
+  if (anchors.kmsRootPubkey === EMPTY_HEX) {
+    throw new Error("KMS root trust anchor is not provisioned");
+  }
+  assertUncompressedKey(evidence.publicKey);
+  const derivedAddress = publicKeyToAddress(evidence.publicKey);
+  if (getAddress(derivedAddress) !== getAddress(evidence.address)) {
+    throw new Error("Enclave public key does not match its address");
+  }
+  const appRootPublicKey = await recoverChainKey(
+    appRootPreimage(evidence.purpose, evidence.publicKey),
+    evidence.signatureChain[0],
+    0
+  );
+  const kmsRootPublicKey = await recoverChainKey(
+    kmsIssuedPreimage(evidence.appId, appRootPublicKey),
+    evidence.signatureChain[1],
+    1
+  );
+  let matchesAnchor;
+  try {
+    matchesAnchor = sameKey(kmsRootPublicKey, anchors.kmsRootPubkey);
+  } catch {
+    throw new Error("KMS root trust anchor is malformed");
+  }
+  if (!matchesAnchor) {
+    throw new Error("KMS root public key does not match the trust anchor");
+  }
+  if (keccak256(kmsRootPublicKey) !== evidence.kmsRootFingerprint.toLowerCase()) {
+    throw new Error("KMS root fingerprint does not match the evidence");
+  }
+  const appId = evidence.appId.toLowerCase();
+  if (!anchors.appIds.some((allowedAppId) => allowedAppId.toLowerCase() === appId)) {
+    throw new Error("Enclave app ID is not trusted");
+  }
+}
+async function buildMasterSignatureDelivery(evidence, masterSignature, now = Math.floor(Date.now() / 1e3)) {
+  deriveMasterKey(masterSignature);
+  const signerAddress = await recoverServerOwner(masterSignature);
+  if (!isAddressEqual(signerAddress, evidence.ownerAddress)) {
+    throw new Error("Master signature signer does not match evidence owner");
+  }
+  return {
+    v: MASTER_SIGNATURE_DELIVERY_VERSION,
+    userPsId: evidence.userPsId,
+    epoch: evidence.epoch,
+    enclaveAddress: evidence.address,
+    ownerAddress: evidence.ownerAddress,
+    masterSignature,
+    issuedAt: now
+  };
+}
+async function encryptMasterSignatureDelivery(delivery, publicKey, ecies) {
+  assertUncompressedKey(publicKey);
+  if (!isAddressEqual(publicKeyToAddress(publicKey), delivery.enclaveAddress)) {
+    throw new Error(
+      "Public key does not belong to the delivery's enclave address"
+    );
+  }
+  const plaintext = toBytes(JSON.stringify(delivery));
+  const encrypted = await ecies.encrypt(fromHex5(publicKey, "bytes"), plaintext);
+  return `0x${serializeECIES(encrypted)}`;
+}
+
+// src/protocol/jobs.ts
+var JOB_PROTOCOL_VERSION = 1;
+var JOB_OPERATIONS = ["raw_read", "inference"];
+var JOB_STATES = [
+  "queued",
+  "claimed",
+  "running",
+  "completed",
+  "failed",
+  "expired",
+  "cancelled"
+];
+var DEFAULT_LEASE_SECONDS = 30;
+var MAX_LEASE_SECONDS = 300;
+var MAX_ATTEMPTS = 3;
+var MAX_WAIT_SECONDS = 25;
+var CLAIM_POLL_FLOOR_MS = 1e3;
+var DEFAULT_JOB_DEADLINE_SECONDS = 600;
+var MAX_JOB_DEADLINE_SECONDS = 3600;
+
+// src/crypto/envelope/job.ts
+init_constants();
+init_interface();
+import { sha256 as sha2565 } from "@noble/hashes/sha2";
+import { bytesToHex as bytesToHex2, fromHex as fromHex6, isAddress, isHex, toHex as toHex7 } from "viem";
+var textDecoder = new TextDecoder();
+var textEncoder = new TextEncoder();
+var MAX_JOB_RESULT_HEADER_BYTES = 4096;
+var JOB_RESULT_LENGTH_PREFIX_BYTES = 4;
+var JobEnvelopeError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "JobEnvelopeError";
+  }
+};
+function sortJsonKeys(value) {
+  if (Array.isArray(value)) {
+    return value.map(sortJsonKeys);
+  }
+  if (value !== null && typeof value === "object") {
+    return Object.fromEntries(
+      Object.keys(value).sort().map((key) => [
+        key,
+        sortJsonKeys(value[key])
+      ])
+    );
+  }
+  return value;
+}
+function canonicalJsonBytes(value) {
+  return textEncoder.encode(JSON.stringify(sortJsonKeys(value)));
+}
+function canonicalJobRequestBytes(request) {
+  validateJobRequest(request);
+  return canonicalJsonBytes(request);
+}
+function requestPlaintext(envelope) {
+  validateRequestEnvelope(envelope);
+  return canonicalJsonBytes(envelope);
+}
+function resultPlaintext(result) {
+  const header = textEncoder.encode(
+    JSON.stringify({
+      v: result.v,
+      jobId: result.jobId,
+      scope: result.scope,
+      version: result.version,
+      contentType: result.contentType
+    })
+  );
+  if (header.length > MAX_JOB_RESULT_HEADER_BYTES) {
+    throw new JobEnvelopeError(
+      `Invalid job result: header exceeds ${MAX_JOB_RESULT_HEADER_BYTES} bytes`
+    );
+  }
+  const plaintext = new Uint8Array(
+    JOB_RESULT_LENGTH_PREFIX_BYTES + header.length + result.body.length
+  );
+  new DataView(plaintext.buffer).setUint32(0, header.length);
+  plaintext.set(header, JOB_RESULT_LENGTH_PREFIX_BYTES);
+  plaintext.set(result.body, JOB_RESULT_LENGTH_PREFIX_BYTES + header.length);
+  return plaintext;
+}
+function parseResultPlaintext(plaintext) {
+  if (plaintext.length < JOB_RESULT_LENGTH_PREFIX_BYTES) {
+    throw new JobEnvelopeError(
+      "Invalid job result: missing header length prefix"
+    );
+  }
+  const headerLength = new DataView(
+    plaintext.buffer,
+    plaintext.byteOffset,
+    JOB_RESULT_LENGTH_PREFIX_BYTES
+  ).getUint32(0);
+  if (headerLength > MAX_JOB_RESULT_HEADER_BYTES) {
+    throw new JobEnvelopeError(
+      `Invalid job result: header exceeds ${MAX_JOB_RESULT_HEADER_BYTES} bytes`
+    );
+  }
+  const remainingLength = plaintext.length - JOB_RESULT_LENGTH_PREFIX_BYTES;
+  if (headerLength > remainingLength) {
+    throw new JobEnvelopeError(
+      "Invalid job result: header length exceeds payload"
+    );
+  }
+  const headerEnd = JOB_RESULT_LENGTH_PREFIX_BYTES + headerLength;
+  const header = parseObject(
+    plaintext.subarray(JOB_RESULT_LENGTH_PREFIX_BYTES, headerEnd),
+    "job result header"
+  );
+  return validateResult({ ...header, body: plaintext.subarray(headerEnd) });
+}
+function encryptedBytesToBase64(encrypted) {
+  return toBase64(fromHex6(`0x${serializeECIES(encrypted)}`, "bytes"));
+}
+function encryptedToBytes(encrypted) {
+  const bytes = new Uint8Array(
+    encrypted.iv.length + encrypted.ephemPublicKey.length + encrypted.ciphertext.length + encrypted.mac.length
+  );
+  let offset = 0;
+  bytes.set(encrypted.iv, offset);
+  offset += encrypted.iv.length;
+  bytes.set(encrypted.ephemPublicKey, offset);
+  offset += encrypted.ephemPublicKey.length;
+  bytes.set(encrypted.ciphertext, offset);
+  offset += encrypted.ciphertext.length;
+  bytes.set(encrypted.mac, offset);
+  return bytes;
+}
+function bytesToEncrypted(bytes) {
+  const absoluteMinLength = FORMAT.IV_LENGTH + 1 + MAC.LENGTH + 1;
+  if (bytes.length < absoluteMinLength) {
+    throw new ECIESError(
+      `Invalid ECIES data: too short (${bytes.length} bytes, minimum ${absoluteMinLength} bytes required)`,
+      "DECRYPTION_FAILED"
+    );
+  }
+  const prefix = bytes[FORMAT.EPHEMERAL_KEY_OFFSET];
+  if (prefix !== CURVE.PREFIX.UNCOMPRESSED) {
+    throw new ECIESError(
+      `Invalid ephemeral public key: must be uncompressed format (0x04 prefix), got 0x${prefix.toString(16).padStart(2, "0")}`,
+      "DECRYPTION_FAILED"
+    );
+  }
+  const ephemKeySize = CURVE.UNCOMPRESSED_PUBLIC_KEY_LENGTH;
+  const minLength = FORMAT.IV_LENGTH + ephemKeySize + MAC.LENGTH + 1;
+  if (bytes.length < minLength) {
+    throw new ECIESError(
+      `Invalid ECIES data: too short (${bytes.length} bytes, minimum ${minLength} bytes required)`,
+      "DECRYPTION_FAILED"
+    );
+  }
+  return {
+    iv: bytes.subarray(FORMAT.IV_OFFSET, FORMAT.IV_OFFSET + FORMAT.IV_LENGTH),
+    ephemPublicKey: bytes.subarray(
+      FORMAT.EPHEMERAL_KEY_OFFSET,
+      FORMAT.EPHEMERAL_KEY_OFFSET + ephemKeySize
+    ),
+    ciphertext: bytes.subarray(
+      FORMAT.EPHEMERAL_KEY_OFFSET + ephemKeySize,
+      bytes.length - MAC.LENGTH
+    ),
+    mac: bytes.subarray(bytes.length - MAC.LENGTH)
+  };
+}
+function base64ToEncrypted(ciphertext) {
+  return deserializeECIES(toHex7(fromBase64(ciphertext)));
+}
+function parseObject(plaintext, kind) {
+  try {
+    const value = JSON.parse(textDecoder.decode(plaintext));
+    if (value === null || typeof value !== "object" || Array.isArray(value)) {
+      throw new JobEnvelopeError(`Invalid ${kind}: expected an object`);
+    }
+    return value;
+  } catch (error) {
+    if (error instanceof JobEnvelopeError) throw error;
+    throw new JobEnvelopeError(`Invalid ${kind}: malformed JSON`);
+  }
+}
+function isPlainObject2(value) {
+  if (value === null || typeof value !== "object") return false;
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+function requirePlainObject(value, field, kind) {
+  if (!isPlainObject2(value)) {
+    throw new JobEnvelopeError(`Invalid ${kind}: invalid ${field}`);
+  }
+}
+function requireExactKeys(value, expectedKeys, kind) {
+  for (const key of expectedKeys) {
+    if (!Object.hasOwn(value, key) || value[key] === void 0) {
+      throw new JobEnvelopeError(`Invalid ${kind}: missing ${key}`);
+    }
+  }
+  const expected = new Set(expectedKeys);
+  for (const key of Reflect.ownKeys(value)) {
+    if (!expected.has(key)) {
+      throw new JobEnvelopeError(
+        `Invalid ${kind}: unknown field ${String(key)}`
+      );
+    }
+  }
+}
+function requireString(value, field, kind) {
+  if (typeof value !== "string" || value.length === 0) {
+    throw new JobEnvelopeError(`Invalid ${kind}: missing ${field}`);
+  }
+}
+function validateJobRequest(value) {
+  requirePlainObject(value, "request", "job request");
+  requireExactKeys(
+    value,
+    [
+      "v",
+      "jobId",
+      "owner",
+      "builder",
+      "builderPublicKey",
+      "grantId",
+      "scope",
+      "operation",
+      "pinnedVersion",
+      "deadline"
+    ],
+    "job request"
+  );
+  if (value.v !== JOB_PROTOCOL_VERSION) {
+    throw new JobEnvelopeError(
+      `Unsupported job request version: ${String(value.v)}`
+    );
+  }
+  requireString(value.jobId, "jobId", "job request");
+  if (typeof value.owner !== "string" || !isAddress(value.owner)) {
+    throw new JobEnvelopeError("Invalid job request: invalid owner");
+  }
+  if (typeof value.builder !== "string" || !isAddress(value.builder)) {
+    throw new JobEnvelopeError("Invalid job request: invalid builder");
+  }
+  if (typeof value.builderPublicKey !== "string" || !isHex(value.builderPublicKey)) {
+    throw new JobEnvelopeError("Invalid job request: invalid builderPublicKey");
+  }
+  if (typeof value.grantId !== "string" || !isHex(value.grantId)) {
+    throw new JobEnvelopeError("Invalid job request: invalid grantId");
+  }
+  requireString(value.scope, "scope", "job request");
+  if (!JOB_OPERATIONS.includes(value.operation)) {
+    throw new JobEnvelopeError("Invalid job request: invalid operation");
+  }
+  if (value.pinnedVersion !== null && typeof value.pinnedVersion !== "string") {
+    throw new JobEnvelopeError("Invalid job request: missing pinnedVersion");
+  }
+  if (typeof value.deadline !== "string" || !Number.isFinite(Date.parse(value.deadline))) {
+    throw new JobEnvelopeError("Invalid job request: invalid deadline");
+  }
+  return value;
+}
+function validateRequestEnvelope(value) {
+  requirePlainObject(value, "envelope", "job request envelope");
+  requireExactKeys(value, ["request", "auth"], "job request envelope");
+  validateJobRequest(value.request);
+  requireString(value.auth, "auth", "job request envelope");
+  return value;
+}
+function validateResult(value) {
+  requirePlainObject(value, "result", "job result");
+  requireExactKeys(
+    value,
+    ["v", "jobId", "scope", "version", "contentType", "body"],
+    "job result"
+  );
+  if (value.v !== JOB_PROTOCOL_VERSION) {
+    throw new JobEnvelopeError(
+      `Unsupported job result version: ${String(value.v)}`
+    );
+  }
+  for (const field of ["jobId", "scope", "contentType"]) {
+    requireString(value[field], field, "job result");
+  }
+  if (!(value.body instanceof Uint8Array)) {
+    throw new JobEnvelopeError("Invalid job result: missing body");
+  }
+  if (value.version !== null && typeof value.version !== "string") {
+    throw new JobEnvelopeError("Invalid job result: missing version");
+  }
+  return value;
+}
+async function sealJobRequest(envelope, enclavePublicKey, ecies) {
+  const encrypted = await ecies.encrypt(
+    fromHex6(enclavePublicKey, "bytes"),
+    requestPlaintext(envelope)
+  );
+  return encryptedBytesToBase64(encrypted);
+}
+async function openJobRequest(ciphertext, privateKey, ecies) {
+  const plaintext = await ecies.decrypt(
+    privateKey,
+    base64ToEncrypted(ciphertext)
+  );
+  return validateRequestEnvelope(
+    parseObject(plaintext, "job request envelope")
+  );
+}
+async function sealJobResult(result, builderPublicKey, ecies) {
+  validateResult(result);
+  const encrypted = await ecies.encrypt(
+    fromHex6(builderPublicKey, "bytes"),
+    resultPlaintext(result)
+  );
+  const bytes = encryptedToBytes(encrypted);
+  return { bytes, hash: bytesToHex2(sha2565(bytes)), size: bytes.length };
+}
+async function openJobResult(sealedBytes, builderPrivateKey, ecies, expect) {
+  const plaintext = await ecies.decrypt(
+    fromHex6(builderPrivateKey, "bytes"),
+    bytesToEncrypted(sealedBytes)
+  );
+  const result = parseResultPlaintext(plaintext);
+  if (result.jobId !== expect.jobId) {
+    throw new JobEnvelopeError(
+      `Job result ID ${result.jobId} does not match expected job ID ${expect.jobId}`
+    );
+  }
+  if (expect.scope !== void 0 && result.scope !== expect.scope) {
+    throw new JobEnvelopeError(
+      `Job result scope ${result.scope} does not match expected scope ${expect.scope}`
+    );
+  }
+  if (expect.version !== void 0 && result.version !== expect.version) {
+    throw new JobEnvelopeError(
+      `Job result version ${String(result.version)} does not match expected version ${String(expect.version)}`
+    );
+  }
+  return result;
+}
+
 // src/protocol/personal-server-registration.ts
 import {
-  isAddress
+  isAddress as isAddress2
 } from "viem";
 var PERSONAL_SERVER_REGISTRATION_DEFAULT_CHAIN_ID = vanaMainnet2.id;
 var PERSONAL_SERVER_REGISTRATION_DEFAULT_VERIFYING_CONTRACT = getContractAddress(
@@ -31746,7 +32313,7 @@ var PERSONAL_SERVER_REGISTRATION_DEFAULT_VERIFYING_CONTRACT = getContractAddress
   "DataPortabilityServers"
 );
 function assertAddress(value, name) {
-  if (!isAddress(value)) {
+  if (!isAddress2(value)) {
     throw new Error(`${name} must be a valid EVM address`);
   }
 }
@@ -31833,13 +32400,13 @@ var registerPersonalServerSignature = buildPersonalServerRegistrationSignature;
 
 // src/personal-server-lite/owner-binding.ts
 import {
-  isAddress as isAddress2
+  isAddress as isAddress3
 } from "viem";
 var PERSONAL_SERVER_LITE_OWNER_BINDING_VERSION = "vana.ps-lite.owner-binding.v1";
 var PERSONAL_SERVER_LITE_OWNER_BINDING_PURPOSE = "ps-lite-owner";
 var PERSONAL_SERVER_LITE_OWNER_BINDING_PREFIX = `${PERSONAL_SERVER_LITE_OWNER_BINDING_VERSION}:${PERSONAL_SERVER_LITE_OWNER_BINDING_PURPOSE}:`;
 function assertAddress2(value, name) {
-  if (!isAddress2(value)) {
+  if (!isAddress3(value)) {
     throw new Error(`${name} must be a valid EVM address`);
   }
 }
@@ -31889,7 +32456,7 @@ async function buildPersonalServerLiteOwnerBindingSignature(input) {
 var signPersonalServerLiteOwnerBinding = buildPersonalServerLiteOwnerBindingSignature;
 
 // src/account/personal-server-registration.ts
-import { isAddress as isAddress3 } from "viem";
+import { isAddress as isAddress4 } from "viem";
 var ACCOUNT_PERSONAL_SERVER_REGISTRATION_INTENT = "personal_server.server_registration.v1";
 var AccountPersonalServerRegistrationError = class extends Error {
   status;
@@ -31908,7 +32475,7 @@ function trimTrailingSlash(value) {
   return value.replace(/\/+$/, "");
 }
 function assertAddress3(value, name) {
-  if (!isAddress3(value)) {
+  if (!isAddress4(value)) {
     throw new Error(`${name} must be a valid EVM address`);
   }
 }
@@ -32434,8 +33001,8 @@ function buildMarkDataPointUnavailableRequest(config, input) {
 
 // src/protocol/data-point-deletion.ts
 import {
-  isAddress as isAddress5,
-  keccak256 as keccak2562,
+  isAddress as isAddress6,
+  keccak256 as keccak2563,
   maxUint256,
   stringToBytes as stringToBytes3
 } from "viem";
@@ -32443,8 +33010,8 @@ import {
 // src/protocol/lineage.ts
 import {
   encodeAbiParameters,
-  isAddress as isAddress4,
-  keccak256
+  isAddress as isAddress5,
+  keccak256 as keccak2562
 } from "viem";
 import { z } from "zod";
 
@@ -32523,12 +33090,12 @@ function isDataPointId(value) {
   return typeof value === "string" && DATA_POINT_ID_PATTERN.test(value);
 }
 function deriveDataPointId(ownerAddress, scope) {
-  if (!isAddress4(ownerAddress, { strict: false })) {
+  if (!isAddress5(ownerAddress, { strict: false })) {
     throw new Error(
       `ownerAddress is not an EVM address: ${String(ownerAddress)}`
     );
   }
-  return keccak256(
+  return keccak2562(
     encodeAbiParameters(
       [
         { name: "ownerAddress", type: "address" },
@@ -32755,7 +33322,7 @@ var TOMBSTONE_METADATA_HASH_PREIMAGE = "vana.data-point.tombstone.metadata.v1";
 var TOMBSTONE_DATA_HASH = "0x30c45ee72fe56d1927701316925ab7ceacd3b6f9267061735d59396f075c6222";
 var TOMBSTONE_METADATA_HASH = "0xc5255a141acd6a2ae55971b62c0a85977c2511989dc114ad2abc2b7644f57d90";
 function computeTombstoneHash(preimage) {
-  return keccak2562(stringToBytes3(preimage));
+  return keccak2563(stringToBytes3(preimage));
 }
 function isTombstoneHashes(dataHash, metadataHash) {
   return typeof dataHash === "string" && typeof metadataHash === "string" && dataHash.toLowerCase() === TOMBSTONE_DATA_HASH && metadataHash.toLowerCase() === TOMBSTONE_METADATA_HASH;
@@ -32774,7 +33341,7 @@ function tombstoneDeletedAt(value) {
   return typeof deletedAt === "string" ? deletedAt : null;
 }
 function assertAddress4(value, name) {
-  if (!isAddress5(value)) {
+  if (!isAddress6(value)) {
     throw new Error(`${name} must be a valid EVM address`);
   }
 }
@@ -33189,13 +33756,13 @@ function tryGrantPermissions(scopes) {
 }
 
 // src/protocol/personal-server-write.ts
-import { sha256 as sha2566 } from "@noble/hashes/sha2";
-import { bytesToHex as bytesToHex3, isAddress as isAddress6 } from "viem";
+import { sha256 as sha2567 } from "@noble/hashes/sha2";
+import { bytesToHex as bytesToHex4, isAddress as isAddress7 } from "viem";
 import { z as z4 } from "zod";
 
 // src/protocol/write-request.ts
-import { sha256 as sha2565 } from "@noble/hashes/sha2";
-import { bytesToHex as bytesToHex2 } from "viem";
+import { sha256 as sha2566 } from "@noble/hashes/sha2";
+import { bytesToHex as bytesToHex3 } from "viem";
 function normalizeBaseUrl2(url) {
   return url.replace(/\/+$/, "");
 }
@@ -33262,22 +33829,22 @@ function freshProofNonce() {
     return webCrypto.randomUUID();
   }
   if (typeof webCrypto?.getRandomValues === "function") {
-    return bytesToHex2(webCrypto.getRandomValues(new Uint8Array(16)));
+    return bytesToHex3(webCrypto.getRandomValues(new Uint8Array(16)));
   }
   throw new WriteRequestError(
     "No secure random source available to build a proof nonce; provide a crypto global"
   );
 }
 function proofKeyFor(parts) {
-  return bytesToHex2(
-    sha2565(
+  return bytesToHex3(
+    sha2566(
       new TextEncoder().encode(
         JSON.stringify([
           parts.aud,
           parts.method,
           parts.uri,
           parts.grantId,
-          parts.signedBytes ? bytesToHex2(sha2565(parts.signedBytes)) : ""
+          parts.signedBytes ? bytesToHex3(sha2566(parts.signedBytes)) : ""
         ])
       )
     )
@@ -33464,7 +34031,7 @@ function binaryWriteSignedBytes(input) {
     mimeType: normalizeBinaryMimeType(input.contentType),
     ...input.filename ? { filename: input.filename } : {},
     sizeBytes: input.bytes.length,
-    contentHash: bytesToHex3(sha2566(input.bytes)),
+    contentHash: bytesToHex4(sha2567(input.bytes)),
     encoding: "base64",
     content: toBase64(input.bytes),
     ...metadata !== void 0 ? { metadata } : {}
@@ -33512,7 +34079,7 @@ function normalizeLineage(lineage, derivedScope) {
   for (const entry of lineage) {
     let id;
     if (isLineagePair(entry)) {
-      if (!isAddress6(entry.ownerAddress, { strict: false })) {
+      if (!isAddress7(entry.ownerAddress, { strict: false })) {
         throw new WriteRequestError(
           "lineage source ownerAddress must be an EVM address",
           { ownerAddress: entry.ownerAddress }
@@ -34992,6 +35559,8 @@ export {
   BlockchainError,
   BrowserECIESUint8Provider as BrowserECIESProvider,
   BrowserPlatformAdapter,
+  BuilderUnknownError,
+  CLAIM_POLL_FLOOR_MS,
   CONTRACTS,
   CallbackStorage,
   ContractFactory,
@@ -34999,6 +35568,8 @@ export {
   DATA_REGISTRY_STATUS_ABI,
   DEFAULT_DERIVATIVE_STATUS_POLL_INTERVAL_MS,
   DEFAULT_DERIVATIVE_STATUS_TIMEOUT_MS,
+  DEFAULT_JOB_DEADLINE_SECONDS,
+  DEFAULT_LEASE_SECONDS,
   DEFAULT_QUESTION_POLL_INTERVAL_MS,
   DEFAULT_QUESTION_TIMEOUT_MS,
   DERIVATIVE_ERROR_CODES,
@@ -35023,6 +35594,9 @@ export {
   DerivativeStatusSchema,
   DropboxStorage,
   ECIESError,
+  ENCLAVE_IDENTITY_EVIDENCE_VERSION,
+  ENCLAVE_TRUST_ANCHORS,
+  ENCLAVE_WALLET_PURPOSE,
   ESCROW_DEPOSIT_ABI2 as ESCROW_DEPOSIT_ABI,
   ExpiredTokenError,
   FEE_REGISTRY_ABI,
@@ -35030,12 +35604,25 @@ export {
   GRANT_REGISTRATION_TYPES,
   GRANT_REVOCATION_TYPES,
   GoogleDriveStorage,
+  GrantInvalidError,
   InMemoryTokenStore,
   IngestResponseSchema,
   InvalidConfigurationError,
   InvalidScopeEntryError,
   InvalidSignatureError,
   IpfsStorage,
+  JOB_OPERATIONS,
+  JOB_PROTOCOL_VERSION,
+  JOB_STATES,
+  JobEnvelopeError,
+  JobIdTakenError,
+  JobNotFoundError,
+  JobRejectedError,
+  JobRequestTooLargeError,
+  JobResultIntegrityError,
+  JobTimeoutError,
+  JobTransportError,
+  JobsClientError,
   LINEAGE_FIELD,
   LINEAGE_KEY,
   LineageEntrySchema,
@@ -35043,16 +35630,23 @@ export {
   LineageNodeSchema,
   LineageReadError,
   MASTER_KEY_MESSAGE,
+  MASTER_SIGNATURE_DELIVERY_MAX_AGE_SECONDS,
+  MASTER_SIGNATURE_DELIVERY_VERSION,
+  MAX_ATTEMPTS,
+  MAX_JOB_DEADLINE_SECONDS,
+  MAX_LEASE_SECONDS,
   MAX_LINEAGE_SOURCES,
   MAX_QUESTION_CHARS,
   MAX_QUESTION_MODEL_CHARS,
   MAX_QUESTION_SOURCE_SCOPES,
+  MAX_WAIT_SECONDS,
   MissingAuthError,
   NATIVE_ASSET_ADDRESS,
   NATIVE_VANA_ASSET,
   NetworkError,
   NonceError,
   OAuthClient,
+  OwnerNotReadyError,
   PERSONAL_SERVER_LITE_OWNER_BINDING_PREFIX,
   PERSONAL_SERVER_LITE_OWNER_BINDING_PURPOSE,
   PERSONAL_SERVER_LITE_OWNER_BINDING_VERSION,
@@ -35078,6 +35672,7 @@ export {
   RedactedLineageNodeSchema,
   RelayerError,
   SCOPE_ACTIONS,
+  SEALED_ENVELOPE_VERSION,
   SERVER_REGISTRATION_TYPES,
   ScopeSchema,
   SerializationError,
@@ -35090,6 +35685,7 @@ export {
   TOMBSTONE_METADATA_HASH,
   TOMBSTONE_METADATA_HASH_PREIMAGE,
   TransactionPendingError,
+  USER_PS_ID_DOMAIN,
   UserRejectedRequestError,
   VanaError,
   VanaStorage,
@@ -35108,6 +35704,7 @@ export {
   WriteSessionExpiredError,
   WriteTransportError,
   WriteUnauthorizedError,
+  appRootPreimage,
   askPersonalServer,
   assertDerivedScopeNaming,
   assertValidPkceVerifier,
@@ -35117,6 +35714,7 @@ export {
   buildDepositNativeRequest,
   buildDepositTokenRequest,
   buildMarkDataPointUnavailableRequest,
+  buildMasterSignatureDelivery,
   buildPersonalServerDataReadRequest,
   buildPersonalServerLiteOwnerBindingMessage,
   buildPersonalServerLiteOwnerBindingSignature,
@@ -35125,6 +35723,7 @@ export {
   buildSetDataPointStatusRequest,
   buildWeb3SignedHeader,
   builderRegistrationDomain,
+  canonicalJobRequestBytes,
   chains,
   clearContractCache,
   computeBodyHash,
@@ -35156,6 +35755,7 @@ export {
   encodeDepositTokenData,
   encodeSetDataPointStatusData,
   encodeWriteMetadataHeader,
+  encryptMasterSignatureDelivery,
   encryptWithPassword,
   escrowContractAddress,
   escrowPaymentDomain,
@@ -35190,12 +35790,15 @@ export {
   isPlatformSupported,
   isRedactedLineageNode,
   isTombstoneHashes,
+  kmsIssuedPreimage,
   listQuestions,
   mainnetServices,
   moksha,
   mokshaServices,
   mokshaTestnet2 as mokshaTestnet,
   normalizeBinaryMimeType,
+  openJobRequest,
+  openJobResult,
   openWriteSession,
   parsePSError,
   parseScope,
@@ -35216,6 +35819,8 @@ export {
   scopeMatchesPattern,
   scopeNamespace,
   scopeToPathSegments,
+  sealJobRequest,
+  sealJobResult,
   serializeECIES,
   serverRegistrationDomain,
   sessionCoversScope,
@@ -35224,7 +35829,9 @@ export {
   signPersonalServerRegistrationWithAccount,
   tombstoneDeletedAt,
   tryGrantPermissions,
+  userPsId,
   vanaMainnet2 as vanaMainnet,
+  verifyEnclaveIdentityEvidence,
   verifyGrantRegistration,
   verifyPkceChallenge,
   verifyWeb3Signed,