@opendatalabs/vana-sdk 3.22.0 → 3.23.0-pr.211.341f55d

package/dist/index.node.cjs

@@ -1180,6 +1180,8 @@ __export(index_node_exports, {
   BUILDER_REGISTRATION_TYPES: () => BUILDER_REGISTRATION_TYPES,
   BlockchainError: () => BlockchainError,
   BrowserPlatformAdapter: () => BrowserPlatformAdapter,
+  BuilderUnknownError: () => BuilderUnknownError,
+  CLAIM_POLL_FLOOR_MS: () => CLAIM_POLL_FLOOR_MS,
   CONTRACTS: () => CONTRACTS,
   CallbackStorage: () => CallbackStorage,
   ContractFactory: () => ContractFactory,
@@ -1188,6 +1190,8 @@ __export(index_node_exports, {
   DATA_REGISTRY_STATUS_ABI: () => DATA_REGISTRY_STATUS_ABI,
   DEFAULT_DERIVATIVE_STATUS_POLL_INTERVAL_MS: () => DEFAULT_DERIVATIVE_STATUS_POLL_INTERVAL_MS,
   DEFAULT_DERIVATIVE_STATUS_TIMEOUT_MS: () => DEFAULT_DERIVATIVE_STATUS_TIMEOUT_MS,
+  DEFAULT_JOB_DEADLINE_SECONDS: () => DEFAULT_JOB_DEADLINE_SECONDS,
+  DEFAULT_LEASE_SECONDS: () => DEFAULT_LEASE_SECONDS,
   DEFAULT_QUESTION_POLL_INTERVAL_MS: () => DEFAULT_QUESTION_POLL_INTERVAL_MS,
   DEFAULT_QUESTION_TIMEOUT_MS: () => DEFAULT_QUESTION_TIMEOUT_MS,
   DERIVATIVE_ERROR_CODES: () => DERIVATIVE_ERROR_CODES,
@@ -1212,6 +1216,9 @@ __export(index_node_exports, {
   DerivativeStatusSchema: () => DerivativeStatusSchema,
   DropboxStorage: () => DropboxStorage,
   ECIESError: () => ECIESError,
+  ENCLAVE_IDENTITY_EVIDENCE_VERSION: () => ENCLAVE_IDENTITY_EVIDENCE_VERSION,
+  ENCLAVE_TRUST_ANCHORS: () => ENCLAVE_TRUST_ANCHORS,
+  ENCLAVE_WALLET_PURPOSE: () => ENCLAVE_WALLET_PURPOSE,
   ESCROW_DEPOSIT_ABI: () => ESCROW_DEPOSIT_ABI2,
   ExpiredTokenError: () => ExpiredTokenError,
   FEE_REGISTRY_ABI: () => FEE_REGISTRY_ABI,
@@ -1220,12 +1227,25 @@ __export(index_node_exports, {
   GRANT_REGISTRATION_TYPES: () => GRANT_REGISTRATION_TYPES,
   GRANT_REVOCATION_TYPES: () => GRANT_REVOCATION_TYPES,
   GoogleDriveStorage: () => GoogleDriveStorage,
+  GrantInvalidError: () => GrantInvalidError,
   InMemoryTokenStore: () => InMemoryTokenStore,
   IngestResponseSchema: () => IngestResponseSchema,
   InvalidConfigurationError: () => InvalidConfigurationError,
   InvalidScopeEntryError: () => InvalidScopeEntryError,
   InvalidSignatureError: () => InvalidSignatureError,
   IpfsStorage: () => IpfsStorage,
+  JOB_OPERATIONS: () => JOB_OPERATIONS,
+  JOB_PROTOCOL_VERSION: () => JOB_PROTOCOL_VERSION,
+  JOB_STATES: () => JOB_STATES,
+  JobEnvelopeError: () => JobEnvelopeError,
+  JobIdTakenError: () => JobIdTakenError,
+  JobNotFoundError: () => JobNotFoundError,
+  JobRejectedError: () => JobRejectedError,
+  JobRequestTooLargeError: () => JobRequestTooLargeError,
+  JobResultIntegrityError: () => JobResultIntegrityError,
+  JobTimeoutError: () => JobTimeoutError,
+  JobTransportError: () => JobTransportError,
+  JobsClientError: () => JobsClientError,
   LINEAGE_FIELD: () => LINEAGE_FIELD,
   LINEAGE_KEY: () => LINEAGE_KEY,
   LineageEntrySchema: () => LineageEntrySchema,
@@ -1233,10 +1253,16 @@ __export(index_node_exports, {
   LineageNodeSchema: () => LineageNodeSchema,
   LineageReadError: () => LineageReadError,
   MASTER_KEY_MESSAGE: () => MASTER_KEY_MESSAGE,
+  MASTER_SIGNATURE_DELIVERY_MAX_AGE_SECONDS: () => MASTER_SIGNATURE_DELIVERY_MAX_AGE_SECONDS,
+  MASTER_SIGNATURE_DELIVERY_VERSION: () => MASTER_SIGNATURE_DELIVERY_VERSION,
+  MAX_ATTEMPTS: () => MAX_ATTEMPTS,
+  MAX_JOB_DEADLINE_SECONDS: () => MAX_JOB_DEADLINE_SECONDS,
+  MAX_LEASE_SECONDS: () => MAX_LEASE_SECONDS,
   MAX_LINEAGE_SOURCES: () => MAX_LINEAGE_SOURCES,
   MAX_QUESTION_CHARS: () => MAX_QUESTION_CHARS,
   MAX_QUESTION_MODEL_CHARS: () => MAX_QUESTION_MODEL_CHARS,
   MAX_QUESTION_SOURCE_SCOPES: () => MAX_QUESTION_SOURCE_SCOPES,
+  MAX_WAIT_SECONDS: () => MAX_WAIT_SECONDS,
   MissingAuthError: () => MissingAuthError,
   NATIVE_ASSET_ADDRESS: () => NATIVE_ASSET_ADDRESS,
   NATIVE_VANA_ASSET: () => NATIVE_VANA_ASSET,
@@ -1245,6 +1271,7 @@ __export(index_node_exports, {
   NodePlatformAdapter: () => NodePlatformAdapter,
   NonceError: () => NonceError,
   OAuthClient: () => OAuthClient,
+  OwnerNotReadyError: () => OwnerNotReadyError,
   PERSONAL_SERVER_LITE_OWNER_BINDING_PREFIX: () => PERSONAL_SERVER_LITE_OWNER_BINDING_PREFIX,
   PERSONAL_SERVER_LITE_OWNER_BINDING_PURPOSE: () => PERSONAL_SERVER_LITE_OWNER_BINDING_PURPOSE,
   PERSONAL_SERVER_LITE_OWNER_BINDING_VERSION: () => PERSONAL_SERVER_LITE_OWNER_BINDING_VERSION,
@@ -1270,6 +1297,7 @@ __export(index_node_exports, {
   RedactedLineageNodeSchema: () => RedactedLineageNodeSchema,
   RelayerError: () => RelayerError,
   SCOPE_ACTIONS: () => SCOPE_ACTIONS,
+  SEALED_ENVELOPE_VERSION: () => SEALED_ENVELOPE_VERSION,
   SERVER_REGISTRATION_TYPES: () => SERVER_REGISTRATION_TYPES,
   ScopeSchema: () => ScopeSchema,
   SerializationError: () => SerializationError,
@@ -1282,6 +1310,7 @@ __export(index_node_exports, {
   TOMBSTONE_METADATA_HASH: () => TOMBSTONE_METADATA_HASH,
   TOMBSTONE_METADATA_HASH_PREIMAGE: () => TOMBSTONE_METADATA_HASH_PREIMAGE,
   TransactionPendingError: () => TransactionPendingError,
+  USER_PS_ID_DOMAIN: () => USER_PS_ID_DOMAIN,
   UserRejectedRequestError: () => UserRejectedRequestError,
   VanaError: () => VanaError,
   VanaStorage: () => VanaStorage,
@@ -1300,6 +1329,7 @@ __export(index_node_exports, {
   WriteSessionExpiredError: () => WriteSessionExpiredError,
   WriteTransportError: () => WriteTransportError,
   WriteUnauthorizedError: () => WriteUnauthorizedError,
+  appRootPreimage: () => appRootPreimage,
   askPersonalServer: () => askPersonalServer,
   assertDerivedScopeNaming: () => assertDerivedScopeNaming,
   assertValidPkceVerifier: () => assertValidPkceVerifier,
@@ -1313,6 +1343,7 @@ __export(index_node_exports, {
   buildEscrowPaymentHeader: () => buildEscrowPaymentHeader,
   buildGrantPaymentHeader: () => buildGrantPaymentHeader,
   buildMarkDataPointUnavailableRequest: () => buildMarkDataPointUnavailableRequest,
+  buildMasterSignatureDelivery: () => buildMasterSignatureDelivery,
   buildPersonalServerDataReadRequest: () => buildPersonalServerDataReadRequest,
   buildPersonalServerLiteOwnerBindingMessage: () => buildPersonalServerLiteOwnerBindingMessage,
   buildPersonalServerLiteOwnerBindingSignature: () => buildPersonalServerLiteOwnerBindingSignature,
@@ -1321,6 +1352,7 @@ __export(index_node_exports, {
   buildSetDataPointStatusRequest: () => buildSetDataPointStatusRequest,
   buildWeb3SignedHeader: () => buildWeb3SignedHeader,
   builderRegistrationDomain: () => builderRegistrationDomain,
+  canonicalJobRequestBytes: () => canonicalJobRequestBytes,
   chains: () => chains,
   clearContractCache: () => clearContractCache,
   computeBodyHash: () => computeBodyHash,
@@ -1332,6 +1364,7 @@ __export(index_node_exports, {
   createDefaultNonceSource: () => createDefaultNonceSource,
   createEscrowGatewayClient: () => createEscrowGatewayClient,
   createGatewayClient: () => createGatewayClient,
+  createJobsClient: () => createJobsClient,
   createNodePlatformAdapter: () => createNodePlatformAdapter,
   createPlatformAdapter: () => createPlatformAdapter,
   createPlatformAdapterFor: () => createPlatformAdapterFor,
@@ -1356,6 +1389,7 @@ __export(index_node_exports, {
   encodeDepositTokenData: () => encodeDepositTokenData,
   encodeSetDataPointStatusData: () => encodeSetDataPointStatusData,
   encodeWriteMetadataHeader: () => encodeWriteMetadataHeader,
+  encryptMasterSignatureDelivery: () => encryptMasterSignatureDelivery,
   encryptWithPassword: () => encryptWithPassword,
   escrowContractAddress: () => escrowContractAddress,
   escrowPaymentDomain: () => escrowPaymentDomain,
@@ -1390,12 +1424,15 @@ __export(index_node_exports, {
   isPlatformSupported: () => isPlatformSupported,
   isRedactedLineageNode: () => isRedactedLineageNode,
   isTombstoneHashes: () => isTombstoneHashes,
+  kmsIssuedPreimage: () => kmsIssuedPreimage,
   listQuestions: () => listQuestions,
   mainnetServices: () => mainnetServices,
   moksha: () => moksha,
   mokshaServices: () => mokshaServices,
   mokshaTestnet: () => mokshaTestnet2,
   normalizeBinaryMimeType: () => normalizeBinaryMimeType,
+  openJobRequest: () => openJobRequest,
+  openJobResult: () => openJobResult,
   openWriteSession: () => openWriteSession,
   parsePSError: () => parsePSError,
   parsePersonalServerPaymentRequired: () => parsePersonalServerPaymentRequired,
@@ -1419,6 +1456,8 @@ __export(index_node_exports, {
   scopeMatchesPattern: () => scopeMatchesPattern,
   scopeNamespace: () => scopeNamespace,
   scopeToPathSegments: () => scopeToPathSegments,
+  sealJobRequest: () => sealJobRequest,
+  sealJobResult: () => sealJobResult,
   serializeECIES: () => serializeECIES,
   serverRegistrationDomain: () => serverRegistrationDomain,
   sessionCoversScope: () => sessionCoversScope,
@@ -1429,7 +1468,9 @@ __export(index_node_exports, {
   toDirectPaymentReceipt: () => toDirectPaymentReceipt,
   tombstoneDeletedAt: () => tombstoneDeletedAt,
   tryGrantPermissions: () => tryGrantPermissions,
+  userPsId: () => userPsId,
   vanaMainnet: () => vanaMainnet2,
+  verifyEnclaveIdentityEvidence: () => verifyEnclaveIdentityEvidence,
   verifyGrantRegistration: () => verifyGrantRegistration,
   verifyPkceChallenge: () => verifyPkceChallenge,
   verifyWeb3Signed: () => verifyWeb3Signed,
@@ -1640,6 +1681,68 @@ var WriteRejectedError = class extends PersonalServerWriteError {
     super(message, "WRITE_REJECTED", status, errorCode, details);
   }
 };
+var JobsClientError = class extends VanaError {
+  constructor(message, code, status, errorCode = null, details) {
+    super(message, code);
+    this.status = status;
+    this.errorCode = errorCode;
+    this.details = details;
+  }
+  status;
+  errorCode;
+  details;
+};
+var BuilderUnknownError = class extends JobsClientError {
+  constructor(message, details) {
+    super(message, "JOB_BUILDER_UNKNOWN", 403, "BUILDER_UNKNOWN", details);
+  }
+};
+var GrantInvalidError = class extends JobsClientError {
+  constructor(message, details) {
+    super(message, "JOB_GRANT_INVALID", 403, "GRANT_INVALID", details);
+  }
+};
+var OwnerNotReadyError = class extends JobsClientError {
+  constructor(message, details) {
+    super(message, "JOB_OWNER_NOT_READY", 403, "OWNER_NOT_READY", details);
+  }
+};
+var JobIdTakenError = class extends JobsClientError {
+  constructor(message, details) {
+    super(message, "JOB_ID_TAKEN", 409, "JOB_ID_TAKEN", details);
+  }
+};
+var JobNotFoundError = class extends JobsClientError {
+  constructor(message, details) {
+    super(message, "JOB_NOT_FOUND", 404, "JOB_NOT_FOUND", details);
+  }
+};
+var JobRequestTooLargeError = class extends JobsClientError {
+  constructor(message, errorCode = "BODY_TOO_LARGE", details) {
+    super(message, "JOB_REQUEST_TOO_LARGE", 413, errorCode, details);
+  }
+};
+var JobTimeoutError = class extends JobsClientError {
+  constructor(message, details) {
+    super(message, "JOB_TIMEOUT", void 0, null, details);
+  }
+};
+var JobResultIntegrityError = class extends JobsClientError {
+  constructor(message, details) {
+    super(message, "JOB_RESULT_INTEGRITY", void 0, null, details);
+  }
+};
+var JobRejectedError = class extends JobsClientError {
+  constructor(message, status, errorCode = null, details) {
+    super(message, "JOB_REJECTED", status, errorCode, details);
+  }
+};
+var JobTransportError = class extends JobsClientError {
+  constructor(message, cause) {
+    super(message, "JOB_TRANSPORT_ERROR");
+    this.cause = cause;
+  }
+};
 var LineageReadError = class extends VanaError {
   constructor(message, status, errorCode = null, details) {
     super(message, "LINEAGE_READ_ERROR");
@@ -31628,13 +31731,13 @@ var NodeCryptoAdapter = class {
    */
   async generateKeyPair() {
     try {
-      const secp256k14 = import_secp256k12.default;
+      const secp256k15 = import_secp256k12.default;
       let privateKey;
       do {
         privateKey = (0, import_crypto2.randomBytes)(32);
-      } while (!secp256k14.privateKeyVerify(privateKey));
+      } while (!secp256k15.privateKeyVerify(privateKey));
       const publicKey = Buffer.from(
-        secp256k14.publicKeyCreate(privateKey, true)
+        secp256k15.publicKeyCreate(privateKey, true)
       );
       return {
         privateKey: privateKey.toString("hex"),
@@ -32644,15 +32747,1059 @@ var RECORD_DATA_ACCESS_TYPES = {
   ]
 };
 
-// src/protocol/personal-server-registration.ts
+// src/protocol/identity.ts
+var secp256k14 = __toESM(require("@noble/secp256k1"), 1);
 var import_viem14 = require("viem");
+var import_accounts = require("viem/accounts");
+init_interface();
+var ENCLAVE_IDENTITY_EVIDENCE_VERSION = 1;
+var USER_PS_ID_DOMAIN = "vana.ps-enclave.v1";
+var ENCLAVE_WALLET_PURPOSE = "vana.ps-enclave.wallet.v1";
+var MASTER_SIGNATURE_DELIVERY_VERSION = "vana.ps-enclave.delivery.v1";
+var MASTER_SIGNATURE_DELIVERY_MAX_AGE_SECONDS = 600;
+var SEALED_ENVELOPE_VERSION = 1;
+var VANA_MAINNET_CHAIN_ID = 1480;
+var MOKSHA_CHAIN_ID = 14800;
+var KMS_ISSUED_PREFIX = "dstack-kms-issued";
+var PREIMAGE_SEPARATOR = ":";
+var UNCOMPRESSED_PUBLIC_KEY_BYTES = 65;
+var UNCOMPRESSED_PUBLIC_KEY_PREFIX = "04";
+var EMPTY_HEX = "0x";
+function emptyAnchor() {
+  return Object.freeze({
+    kmsRootPubkey: EMPTY_HEX,
+    appIds: Object.freeze([])
+  });
+}
+var ENCLAVE_TRUST_ANCHORS = Object.freeze({
+  // filled at fleet provisioning; verify fails closed while empty
+  [VANA_MAINNET_CHAIN_ID]: emptyAnchor(),
+  // filled at fleet provisioning; verify fails closed while empty
+  [MOKSHA_CHAIN_ID]: emptyAnchor()
+});
+function userPsId(chainId, ownerAddress) {
+  const packed = (0, import_viem14.encodePacked)(
+    ["string", "uint256", "address"],
+    [USER_PS_ID_DOMAIN, BigInt(chainId), (0, import_viem14.getAddress)(ownerAddress)]
+  );
+  return (0, import_viem14.keccak256)(packed);
+}
+function compressPublicKey(publicKey) {
+  return secp256k14.ProjectivePoint.fromHex(
+    (0, import_viem14.fromHex)(publicKey, "bytes")
+  ).toRawBytes(true);
+}
+function sameKey(a, b) {
+  return (0, import_viem14.toHex)(compressPublicKey(a)) === (0, import_viem14.toHex)(compressPublicKey(b));
+}
+function assertUncompressedKey(publicKey) {
+  const hex = publicKey.slice(2);
+  if (hex.length !== UNCOMPRESSED_PUBLIC_KEY_BYTES * 2 || !hex.startsWith(UNCOMPRESSED_PUBLIC_KEY_PREFIX) || !/^[0-9a-fA-F]+$/.test(hex)) {
+    throw new Error("Public key must be a 65-byte uncompressed secp256k1 key");
+  }
+}
+function appRootPreimage(purpose, publicKey) {
+  const keyHex = (0, import_viem14.toHex)(compressPublicKey(publicKey)).slice(2);
+  return (0, import_viem14.keccak256)((0, import_viem14.toBytes)(`${purpose}${PREIMAGE_SEPARATOR}${keyHex}`));
+}
+function kmsIssuedPreimage(appId, appRootPublicKey) {
+  const prefix = (0, import_viem14.concat)([
+    (0, import_viem14.toBytes)(`${KMS_ISSUED_PREFIX}${PREIMAGE_SEPARATOR}`),
+    (0, import_viem14.fromHex)(appId, "bytes")
+  ]);
+  const compressed = compressPublicKey(appRootPublicKey);
+  return (0, import_viem14.keccak256)((0, import_viem14.concat)([prefix, compressed]));
+}
+async function recoverChainKey(hash, signature, link) {
+  try {
+    return (await (0, import_viem14.recoverPublicKey)({ hash, signature })).toLowerCase();
+  } catch {
+    throw new Error(`Invalid enclave signature chain link ${link}`);
+  }
+}
+async function verifyEnclaveIdentityEvidence(evidence, anchors, expected) {
+  if (evidence.v !== ENCLAVE_IDENTITY_EVIDENCE_VERSION) {
+    throw new Error("Unsupported enclave identity evidence version");
+  }
+  if (!Number.isInteger(evidence.epoch) || evidence.epoch < 1) {
+    throw new Error("Invalid enclave identity epoch");
+  }
+  if (evidence.chainId !== expected.chainId) {
+    throw new Error(
+      "Enclave identity chain ID does not match expected chain ID"
+    );
+  }
+  if (!(0, import_viem14.isAddressEqual)(evidence.ownerAddress, expected.ownerAddress)) {
+    throw new Error("Enclave identity owner does not match expected owner");
+  }
+  if (evidence.epoch !== expected.epoch) {
+    throw new Error("Enclave identity epoch does not match expected epoch");
+  }
+  const expectedUserPsId = userPsId(expected.chainId, expected.ownerAddress);
+  if (evidence.userPsId.toLowerCase() !== expectedUserPsId.toLowerCase()) {
+    throw new Error("Enclave userPsId does not match expected identity");
+  }
+  if (evidence.purpose !== ENCLAVE_WALLET_PURPOSE) {
+    throw new Error("Unexpected enclave wallet purpose");
+  }
+  if (anchors.kmsRootPubkey === EMPTY_HEX) {
+    throw new Error("KMS root trust anchor is not provisioned");
+  }
+  assertUncompressedKey(evidence.publicKey);
+  const derivedAddress = (0, import_accounts.publicKeyToAddress)(evidence.publicKey);
+  if ((0, import_viem14.getAddress)(derivedAddress) !== (0, import_viem14.getAddress)(evidence.address)) {
+    throw new Error("Enclave public key does not match its address");
+  }
+  const appRootPublicKey = await recoverChainKey(
+    appRootPreimage(evidence.purpose, evidence.publicKey),
+    evidence.signatureChain[0],
+    0
+  );
+  const kmsRootPublicKey = await recoverChainKey(
+    kmsIssuedPreimage(evidence.appId, appRootPublicKey),
+    evidence.signatureChain[1],
+    1
+  );
+  let matchesAnchor;
+  try {
+    matchesAnchor = sameKey(kmsRootPublicKey, anchors.kmsRootPubkey);
+  } catch {
+    throw new Error("KMS root trust anchor is malformed");
+  }
+  if (!matchesAnchor) {
+    throw new Error("KMS root public key does not match the trust anchor");
+  }
+  if ((0, import_viem14.keccak256)(kmsRootPublicKey) !== evidence.kmsRootFingerprint.toLowerCase()) {
+    throw new Error("KMS root fingerprint does not match the evidence");
+  }
+  const appId = evidence.appId.toLowerCase();
+  if (!anchors.appIds.some((allowedAppId) => allowedAppId.toLowerCase() === appId)) {
+    throw new Error("Enclave app ID is not trusted");
+  }
+}
+async function buildMasterSignatureDelivery(evidence, masterSignature, now = Math.floor(Date.now() / 1e3)) {
+  deriveMasterKey(masterSignature);
+  const signerAddress = await recoverServerOwner(masterSignature);
+  if (!(0, import_viem14.isAddressEqual)(signerAddress, evidence.ownerAddress)) {
+    throw new Error("Master signature signer does not match evidence owner");
+  }
+  return {
+    v: MASTER_SIGNATURE_DELIVERY_VERSION,
+    userPsId: evidence.userPsId,
+    epoch: evidence.epoch,
+    enclaveAddress: evidence.address,
+    ownerAddress: evidence.ownerAddress,
+    masterSignature,
+    issuedAt: now
+  };
+}
+async function encryptMasterSignatureDelivery(delivery, publicKey, ecies) {
+  assertUncompressedKey(publicKey);
+  if (!(0, import_viem14.isAddressEqual)((0, import_accounts.publicKeyToAddress)(publicKey), delivery.enclaveAddress)) {
+    throw new Error(
+      "Public key does not belong to the delivery's enclave address"
+    );
+  }
+  const plaintext = (0, import_viem14.toBytes)(JSON.stringify(delivery));
+  const encrypted = await ecies.encrypt((0, import_viem14.fromHex)(publicKey, "bytes"), plaintext);
+  return `0x${serializeECIES(encrypted)}`;
+}
+
+// src/protocol/jobs.ts
+var JOB_PROTOCOL_VERSION = 1;
+var JOB_OPERATIONS = ["raw_read", "inference"];
+var JOB_STATES = [
+  "queued",
+  "claimed",
+  "running",
+  "completed",
+  "failed",
+  "expired",
+  "cancelled"
+];
+var DEFAULT_LEASE_SECONDS = 30;
+var MAX_LEASE_SECONDS = 300;
+var MAX_ATTEMPTS = 3;
+var MAX_WAIT_SECONDS = 25;
+var CLAIM_POLL_FLOOR_MS = 1e3;
+var DEFAULT_JOB_DEADLINE_SECONDS = 600;
+var MAX_JOB_DEADLINE_SECONDS = 3600;
+
+// src/protocol/jobs-client.ts
+var import_node_crypto = require("node:crypto");
+var import_sha26 = require("@noble/hashes/sha2");
+var import_viem16 = require("viem");
+var import_accounts2 = require("viem/accounts");
+
+// src/crypto/envelope/job.ts
+var import_sha25 = require("@noble/hashes/sha2");
+var import_viem15 = require("viem");
+init_constants();
+init_interface();
+var textDecoder = new TextDecoder();
+var textEncoder = new TextEncoder();
+var MAX_JOB_RESULT_HEADER_BYTES = 4096;
+var JOB_RESULT_LENGTH_PREFIX_BYTES = 4;
+var JobEnvelopeError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "JobEnvelopeError";
+  }
+};
+function sortJsonKeys(value) {
+  if (Array.isArray(value)) {
+    return value.map(sortJsonKeys);
+  }
+  if (value !== null && typeof value === "object") {
+    return Object.fromEntries(
+      Object.keys(value).sort().map((key) => [
+        key,
+        sortJsonKeys(value[key])
+      ])
+    );
+  }
+  return value;
+}
+function canonicalJsonBytes(value) {
+  return textEncoder.encode(JSON.stringify(sortJsonKeys(value)));
+}
+function canonicalJobRequestBytes(request) {
+  validateJobRequest(request);
+  return canonicalJsonBytes(request);
+}
+function requestPlaintext(envelope) {
+  validateRequestEnvelope(envelope);
+  return canonicalJsonBytes(envelope);
+}
+function resultPlaintext(result) {
+  const header = textEncoder.encode(
+    JSON.stringify({
+      v: result.v,
+      jobId: result.jobId,
+      scope: result.scope,
+      version: result.version,
+      contentType: result.contentType
+    })
+  );
+  if (header.length > MAX_JOB_RESULT_HEADER_BYTES) {
+    throw new JobEnvelopeError(
+      `Invalid job result: header exceeds ${MAX_JOB_RESULT_HEADER_BYTES} bytes`
+    );
+  }
+  const plaintext = new Uint8Array(
+    JOB_RESULT_LENGTH_PREFIX_BYTES + header.length + result.body.length
+  );
+  new DataView(plaintext.buffer).setUint32(0, header.length);
+  plaintext.set(header, JOB_RESULT_LENGTH_PREFIX_BYTES);
+  plaintext.set(result.body, JOB_RESULT_LENGTH_PREFIX_BYTES + header.length);
+  return plaintext;
+}
+function parseResultPlaintext(plaintext) {
+  if (plaintext.length < JOB_RESULT_LENGTH_PREFIX_BYTES) {
+    throw new JobEnvelopeError(
+      "Invalid job result: missing header length prefix"
+    );
+  }
+  const headerLength = new DataView(
+    plaintext.buffer,
+    plaintext.byteOffset,
+    JOB_RESULT_LENGTH_PREFIX_BYTES
+  ).getUint32(0);
+  if (headerLength > MAX_JOB_RESULT_HEADER_BYTES) {
+    throw new JobEnvelopeError(
+      `Invalid job result: header exceeds ${MAX_JOB_RESULT_HEADER_BYTES} bytes`
+    );
+  }
+  const remainingLength = plaintext.length - JOB_RESULT_LENGTH_PREFIX_BYTES;
+  if (headerLength > remainingLength) {
+    throw new JobEnvelopeError(
+      "Invalid job result: header length exceeds payload"
+    );
+  }
+  const headerEnd = JOB_RESULT_LENGTH_PREFIX_BYTES + headerLength;
+  const header = parseObject(
+    plaintext.subarray(JOB_RESULT_LENGTH_PREFIX_BYTES, headerEnd),
+    "job result header"
+  );
+  return validateResult({ ...header, body: plaintext.subarray(headerEnd) });
+}
+function encryptedBytesToBase64(encrypted) {
+  return toBase64((0, import_viem15.fromHex)(`0x${serializeECIES(encrypted)}`, "bytes"));
+}
+function encryptedToBytes(encrypted) {
+  const bytes = new Uint8Array(
+    encrypted.iv.length + encrypted.ephemPublicKey.length + encrypted.ciphertext.length + encrypted.mac.length
+  );
+  let offset = 0;
+  bytes.set(encrypted.iv, offset);
+  offset += encrypted.iv.length;
+  bytes.set(encrypted.ephemPublicKey, offset);
+  offset += encrypted.ephemPublicKey.length;
+  bytes.set(encrypted.ciphertext, offset);
+  offset += encrypted.ciphertext.length;
+  bytes.set(encrypted.mac, offset);
+  return bytes;
+}
+function bytesToEncrypted(bytes) {
+  const absoluteMinLength = FORMAT.IV_LENGTH + 1 + MAC.LENGTH + 1;
+  if (bytes.length < absoluteMinLength) {
+    throw new ECIESError(
+      `Invalid ECIES data: too short (${bytes.length} bytes, minimum ${absoluteMinLength} bytes required)`,
+      "DECRYPTION_FAILED"
+    );
+  }
+  const prefix = bytes[FORMAT.EPHEMERAL_KEY_OFFSET];
+  if (prefix !== CURVE.PREFIX.UNCOMPRESSED) {
+    throw new ECIESError(
+      `Invalid ephemeral public key: must be uncompressed format (0x04 prefix), got 0x${prefix.toString(16).padStart(2, "0")}`,
+      "DECRYPTION_FAILED"
+    );
+  }
+  const ephemKeySize = CURVE.UNCOMPRESSED_PUBLIC_KEY_LENGTH;
+  const minLength = FORMAT.IV_LENGTH + ephemKeySize + MAC.LENGTH + 1;
+  if (bytes.length < minLength) {
+    throw new ECIESError(
+      `Invalid ECIES data: too short (${bytes.length} bytes, minimum ${minLength} bytes required)`,
+      "DECRYPTION_FAILED"
+    );
+  }
+  return {
+    iv: bytes.subarray(FORMAT.IV_OFFSET, FORMAT.IV_OFFSET + FORMAT.IV_LENGTH),
+    ephemPublicKey: bytes.subarray(
+      FORMAT.EPHEMERAL_KEY_OFFSET,
+      FORMAT.EPHEMERAL_KEY_OFFSET + ephemKeySize
+    ),
+    ciphertext: bytes.subarray(
+      FORMAT.EPHEMERAL_KEY_OFFSET + ephemKeySize,
+      bytes.length - MAC.LENGTH
+    ),
+    mac: bytes.subarray(bytes.length - MAC.LENGTH)
+  };
+}
+function base64ToEncrypted(ciphertext) {
+  return deserializeECIES((0, import_viem15.toHex)(fromBase64(ciphertext)));
+}
+function parseObject(plaintext, kind) {
+  try {
+    const value = JSON.parse(textDecoder.decode(plaintext));
+    if (value === null || typeof value !== "object" || Array.isArray(value)) {
+      throw new JobEnvelopeError(`Invalid ${kind}: expected an object`);
+    }
+    return value;
+  } catch (error) {
+    if (error instanceof JobEnvelopeError) throw error;
+    throw new JobEnvelopeError(`Invalid ${kind}: malformed JSON`);
+  }
+}
+function isPlainObject2(value) {
+  if (value === null || typeof value !== "object") return false;
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+function requirePlainObject(value, field, kind) {
+  if (!isPlainObject2(value)) {
+    throw new JobEnvelopeError(`Invalid ${kind}: invalid ${field}`);
+  }
+}
+function requireExactKeys(value, expectedKeys, kind) {
+  for (const key of expectedKeys) {
+    if (!Object.hasOwn(value, key) || value[key] === void 0) {
+      throw new JobEnvelopeError(`Invalid ${kind}: missing ${key}`);
+    }
+  }
+  const expected = new Set(expectedKeys);
+  for (const key of Reflect.ownKeys(value)) {
+    if (!expected.has(key)) {
+      throw new JobEnvelopeError(
+        `Invalid ${kind}: unknown field ${String(key)}`
+      );
+    }
+  }
+}
+function requireString(value, field, kind) {
+  if (typeof value !== "string" || value.length === 0) {
+    throw new JobEnvelopeError(`Invalid ${kind}: missing ${field}`);
+  }
+}
+function validateJobRequest(value) {
+  requirePlainObject(value, "request", "job request");
+  requireExactKeys(
+    value,
+    [
+      "v",
+      "jobId",
+      "owner",
+      "builder",
+      "builderPublicKey",
+      "grantId",
+      "scope",
+      "operation",
+      "pinnedVersion",
+      "deadline"
+    ],
+    "job request"
+  );
+  if (value.v !== JOB_PROTOCOL_VERSION) {
+    throw new JobEnvelopeError(
+      `Unsupported job request version: ${String(value.v)}`
+    );
+  }
+  requireString(value.jobId, "jobId", "job request");
+  if (typeof value.owner !== "string" || !(0, import_viem15.isAddress)(value.owner)) {
+    throw new JobEnvelopeError("Invalid job request: invalid owner");
+  }
+  if (typeof value.builder !== "string" || !(0, import_viem15.isAddress)(value.builder)) {
+    throw new JobEnvelopeError("Invalid job request: invalid builder");
+  }
+  if (typeof value.builderPublicKey !== "string" || !(0, import_viem15.isHex)(value.builderPublicKey)) {
+    throw new JobEnvelopeError("Invalid job request: invalid builderPublicKey");
+  }
+  if (typeof value.grantId !== "string" || !(0, import_viem15.isHex)(value.grantId)) {
+    throw new JobEnvelopeError("Invalid job request: invalid grantId");
+  }
+  requireString(value.scope, "scope", "job request");
+  if (!JOB_OPERATIONS.includes(value.operation)) {
+    throw new JobEnvelopeError("Invalid job request: invalid operation");
+  }
+  if (value.pinnedVersion !== null && typeof value.pinnedVersion !== "string") {
+    throw new JobEnvelopeError("Invalid job request: missing pinnedVersion");
+  }
+  if (typeof value.deadline !== "string" || !Number.isFinite(Date.parse(value.deadline))) {
+    throw new JobEnvelopeError("Invalid job request: invalid deadline");
+  }
+  return value;
+}
+function validateRequestEnvelope(value) {
+  requirePlainObject(value, "envelope", "job request envelope");
+  requireExactKeys(value, ["request", "auth"], "job request envelope");
+  validateJobRequest(value.request);
+  requireString(value.auth, "auth", "job request envelope");
+  return value;
+}
+function validateResult(value) {
+  requirePlainObject(value, "result", "job result");
+  requireExactKeys(
+    value,
+    ["v", "jobId", "scope", "version", "contentType", "body"],
+    "job result"
+  );
+  if (value.v !== JOB_PROTOCOL_VERSION) {
+    throw new JobEnvelopeError(
+      `Unsupported job result version: ${String(value.v)}`
+    );
+  }
+  for (const field of ["jobId", "scope", "contentType"]) {
+    requireString(value[field], field, "job result");
+  }
+  if (!(value.body instanceof Uint8Array)) {
+    throw new JobEnvelopeError("Invalid job result: missing body");
+  }
+  if (value.version !== null && typeof value.version !== "string") {
+    throw new JobEnvelopeError("Invalid job result: missing version");
+  }
+  return value;
+}
+async function sealJobRequest(envelope, enclavePublicKey, ecies) {
+  const encrypted = await ecies.encrypt(
+    (0, import_viem15.fromHex)(enclavePublicKey, "bytes"),
+    requestPlaintext(envelope)
+  );
+  return encryptedBytesToBase64(encrypted);
+}
+async function openJobRequest(ciphertext, privateKey, ecies) {
+  const plaintext = await ecies.decrypt(
+    privateKey,
+    base64ToEncrypted(ciphertext)
+  );
+  return validateRequestEnvelope(
+    parseObject(plaintext, "job request envelope")
+  );
+}
+async function sealJobResult(result, builderPublicKey, ecies) {
+  validateResult(result);
+  const encrypted = await ecies.encrypt(
+    (0, import_viem15.fromHex)(builderPublicKey, "bytes"),
+    resultPlaintext(result)
+  );
+  const bytes = encryptedToBytes(encrypted);
+  return { bytes, hash: (0, import_viem15.bytesToHex)((0, import_sha25.sha256)(bytes)), size: bytes.length };
+}
+async function openJobResult(sealedBytes, builderPrivateKey, ecies, expect) {
+  const plaintext = await ecies.decrypt(
+    (0, import_viem15.fromHex)(builderPrivateKey, "bytes"),
+    bytesToEncrypted(sealedBytes)
+  );
+  const result = parseResultPlaintext(plaintext);
+  if (result.jobId !== expect.jobId) {
+    throw new JobEnvelopeError(
+      `Job result ID ${result.jobId} does not match expected job ID ${expect.jobId}`
+    );
+  }
+  if (expect.scope !== void 0 && result.scope !== expect.scope) {
+    throw new JobEnvelopeError(
+      `Job result scope ${result.scope} does not match expected scope ${expect.scope}`
+    );
+  }
+  if (expect.version !== void 0 && result.version !== expect.version) {
+    throw new JobEnvelopeError(
+      `Job result version ${String(result.version)} does not match expected version ${String(expect.version)}`
+    );
+  }
+  return result;
+}
+
+// src/protocol/write-signer.ts
+function isRecord(value) {
+  return value !== null && typeof value === "object";
+}
+function isViemWriteAccount(source) {
+  return isRecord(source) && source.type === "local" && typeof source.address === "string" && typeof source.signMessage === "function";
+}
+function isViemWriteWalletClient(source) {
+  return isRecord(source) && typeof source.signMessage === "function" && source.type !== "local" && (source.type === "walletClient" || "transport" in source);
+}
+function accountAddress(account) {
+  return typeof account === "string" ? account : account.address;
+}
+function resolveWriteSigner(source, options = {}) {
+  if (isViemWriteWalletClient(source)) {
+    const account = options.account ?? source.account;
+    if (account === void 0) {
+      throw new WriteRequestError(
+        "Viem wallet client requires an account option or account property"
+      );
+    }
+    return {
+      address: accountAddress(account),
+      signMessage: (message) => source.signMessage({ account, message })
+    };
+  }
+  if (isViemWriteAccount(source)) {
+    return {
+      address: source.address,
+      signMessage: (message) => source.signMessage({ message })
+    };
+  }
+  if (!isRecord(source) || typeof source.signMessage !== "function") {
+    throw new WriteRequestError(
+      "signer must be a viem LocalAccount, a viem WalletClient, or a { signMessage } object"
+    );
+  }
+  return source;
+}
+
+// src/protocol/jobs-client.ts
+var IDENTITY_PATH = "/v1/identity";
+var JOBS_PATH = "/v1/jobs";
+var JOB_EXECUTE_PATH = "/v1/jobs/execute";
+var AUTHORIZATION_HEADER = "Authorization";
+var CONTENT_TYPE_HEADER = "Content-Type";
+var JSON_CONTENT_TYPE = "application/json";
+var GET_METHOD = "GET";
+var POST_METHOD = "POST";
+var RAW_READ_OPERATION = "raw_read";
+var SEALED_IDENTITY_STATE = "sealed";
+var HTTP_OK = 200;
+var HTTP_ACCEPTED = 202;
+var HTTP_UNAUTHORIZED = 401;
+var HTTP_FORBIDDEN = 403;
+var HTTP_NOT_FOUND = 404;
+var HTTP_CONFLICT = 409;
+var HTTP_PAYLOAD_TOO_LARGE = 413;
+var MILLISECONDS_PER_SECOND = 1e3;
+var DEFAULT_JOB_TIMEOUT_MS = 12e4;
+var DEFAULT_JOB_POLL_MS = CLAIM_POLL_FLOOR_MS;
+var TERMINAL_JOB_STATES = /* @__PURE__ */ new Set([
+  "completed",
+  "failed",
+  "expired",
+  "cancelled"
+]);
+function isRecord2(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function normalizeGateway(gatewayUrl) {
+  try {
+    const url = new URL(gatewayUrl);
+    if (url.pathname !== "/" || url.search !== "" || url.hash !== "") {
+      throw new JobRejectedError(
+        "gatewayUrl must be an origin without a path, query, or fragment"
+      );
+    }
+    return {
+      baseUrl: url.origin,
+      audience: url.origin
+    };
+  } catch (error) {
+    if (error instanceof JobRejectedError) throw error;
+    throw new JobRejectedError(
+      "gatewayUrl must be an absolute URL",
+      void 0,
+      null,
+      {
+        cause: error instanceof Error ? error.message : String(error)
+      }
+    );
+  }
+}
+function resolveFetch(fetchFn) {
+  const resolved = fetchFn ?? globalThis.fetch;
+  if (resolved === void 0) {
+    throw new JobRejectedError("No fetch implementation available");
+  }
+  return resolved;
+}
+function sourcePublicKey(source) {
+  if (isRecord2(source) && typeof source["publicKey"] === "string") {
+    return source["publicKey"];
+  }
+  return void 0;
+}
+function resolveBuilder(options) {
+  if (options.builderPrivateKey && options.builderAccount) {
+    throw new JobRejectedError(
+      "Provide builderPrivateKey or builderAccount, not both"
+    );
+  }
+  let source;
+  try {
+    source = options.builderPrivateKey ? (0, import_accounts2.privateKeyToAccount)(options.builderPrivateKey) : options.builderAccount;
+  } catch (error) {
+    throw new JobRejectedError("Invalid builder private key", void 0, null, {
+      cause: error instanceof Error ? error.message : String(error)
+    });
+  }
+  if (!source) {
+    throw new JobRejectedError(
+      "builderPrivateKey or builderAccount is required"
+    );
+  }
+  let signer;
+  try {
+    signer = resolveWriteSigner(source);
+  } catch (error) {
+    throw new JobRejectedError("Invalid builder signer", void 0, null, {
+      cause: error instanceof Error ? error.message : String(error)
+    });
+  }
+  const publicKey = sourcePublicKey(source);
+  if (!signer.address || !publicKey) {
+    throw new JobRejectedError(
+      "Builder signer must expose both address and publicKey"
+    );
+  }
+  return {
+    builder: {
+      address: signer.address,
+      publicKey,
+      signMessage: signer.signMessage
+    },
+    ...options.builderPrivateKey ? { privateKey: options.builderPrivateKey } : {}
+  };
+}
+function clampInteger(value, fallback, minimum, maximum, field) {
+  const resolved = value ?? fallback;
+  if (!Number.isFinite(resolved)) {
+    throw new JobRejectedError(`${field} must be a finite number`);
+  }
+  return Math.min(maximum, Math.max(minimum, Math.trunc(resolved)));
+}
+async function responseBody(response) {
+  try {
+    return await response.json();
+  } catch {
+    return null;
+  }
+}
+function gatewayErrorBody(body, fallback) {
+  if (!isRecord2(body)) return { code: null, message: fallback };
+  const code = typeof body["code"] === "string" ? body["code"] : null;
+  const message = typeof body["error"] === "string" ? body["error"] : typeof body["message"] === "string" ? body["message"] : fallback;
+  const reason = typeof body["reason"] === "string" ? body["reason"] : void 0;
+  const details = isRecord2(body["details"]) ? body["details"] : void 0;
+  return {
+    code,
+    message,
+    ...reason ? { reason } : {},
+    ...details ? { details } : {}
+  };
+}
+async function rejectedResponse(response, fallback) {
+  const parsed = gatewayErrorBody(await responseBody(response), fallback);
+  const details = response.status === HTTP_UNAUTHORIZED && parsed.reason ? { ...parsed.details, reason: parsed.reason } : parsed.details;
+  const message = response.status === HTTP_UNAUTHORIZED && parsed.reason ? `${parsed.message}: ${parsed.reason}` : parsed.message;
+  if (response.status === HTTP_FORBIDDEN) {
+    if (parsed.code === "BUILDER_UNKNOWN") {
+      return new BuilderUnknownError(parsed.message, details);
+    }
+    if (parsed.code === "GRANT_INVALID") {
+      return new GrantInvalidError(parsed.message, details);
+    }
+    if (parsed.code === "OWNER_NOT_READY") {
+      return new OwnerNotReadyError(parsed.message, details);
+    }
+  }
+  if (response.status === HTTP_NOT_FOUND) {
+    return new JobNotFoundError(parsed.message, details);
+  }
+  if (response.status === HTTP_CONFLICT && parsed.code === "JOB_ID_TAKEN") {
+    return new JobIdTakenError(parsed.message, details);
+  }
+  if (response.status === HTTP_PAYLOAD_TOO_LARGE) {
+    return new JobRequestTooLargeError(parsed.message, parsed.code, details);
+  }
+  return new JobRejectedError(message, response.status, parsed.code, details);
+}
+function requireStatus(value, status) {
+  if (!isRecord2(value) || !isNonEmptyString(value["jobId"]) || typeof value["state"] !== "string" || !JOB_STATES.includes(value["state"]) || !isNonEmptyString(value["owner"]) || !isNonEmptyString(value["grantId"]) || !isNonEmptyString(value["scope"]) || !isNonEmptyString(value["operation"]) || !JOB_OPERATIONS.includes(value["operation"])) {
+    throw new JobRejectedError(
+      "Gateway response did not contain a job status",
+      status
+    );
+  }
+  return value;
+}
+function isNonEmptyString(value) {
+  return typeof value === "string" && value.length > 0;
+}
+function hasMatchingIdentityKey(value) {
+  const address = value["address"];
+  const publicKey = value["publicKey"];
+  if (typeof address !== "string" || !(0, import_viem16.isAddress)(address) || typeof publicKey !== "string" || !(0, import_viem16.isHex)(publicKey)) {
+    return false;
+  }
+  try {
+    return (0, import_accounts2.publicKeyToAddress)(publicKey).toLowerCase() === address.toLowerCase();
+  } catch {
+    return false;
+  }
+}
+function hasExpectedIdentity(value, owner, chainId) {
+  const identityOwner = value["ownerAddress"];
+  const identityChainId = value["chainId"];
+  const identityUserPsId = value["userPsId"];
+  if (!hasMatchingIdentityKey(value) || typeof identityOwner !== "string" || !(0, import_viem16.isAddress)(identityOwner) || typeof identityChainId !== "number" || typeof identityUserPsId !== "string" || !(0, import_viem16.isHex)(identityUserPsId)) {
+    return false;
+  }
+  return (0, import_viem16.isAddressEqual)(identityOwner, owner) && identityChainId === chainId && identityUserPsId.toLowerCase() === userPsId(chainId, owner).toLowerCase();
+}
+function sleep2(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function requireFiniteDuration(value, field) {
+  if (!Number.isFinite(value)) {
+    throw new JobRejectedError(`${field} must be a finite number`);
+  }
+  return Math.max(0, value);
+}
+function createJobsClient(options) {
+  const { baseUrl, audience } = normalizeGateway(options.gatewayUrl);
+  const fetchFn = resolveFetch(options.fetch);
+  const { builder, privateKey } = resolveBuilder(options);
+  const ecies = options.ecies ?? new NodeECIESUint8Provider();
+  const now = options.now ?? (() => /* @__PURE__ */ new Date());
+  async function request(url, init, description) {
+    try {
+      return await fetchFn(url, init);
+    } catch (error) {
+      throw new JobTransportError(
+        `${description} failed: ${error instanceof Error ? error.message : String(error)}`,
+        error
+      );
+    }
+  }
+  async function getIdentity(owner) {
+    const query = new URLSearchParams({
+      owner,
+      chainId: String(options.chainId)
+    });
+    const response = await request(
+      `${baseUrl}${IDENTITY_PATH}?${query.toString()}`,
+      { method: GET_METHOD },
+      "Owner identity lookup"
+    );
+    if (response.status === HTTP_NOT_FOUND) {
+      const parsed = gatewayErrorBody(
+        await responseBody(response),
+        "Owner identity not found"
+      );
+      throw new OwnerNotReadyError(parsed.message, parsed.details);
+    }
+    if (!response.ok) {
+      throw await rejectedResponse(response, "Owner identity lookup rejected");
+    }
+    const body = await responseBody(response);
+    if (!isRecord2(body) || body["state"] !== SEALED_IDENTITY_STATE || !isRecord2(body["identity"])) {
+      throw new OwnerNotReadyError("Owner identity is not sealed", {
+        state: isRecord2(body) ? body["state"] : void 0
+      });
+    }
+    if (!hasExpectedIdentity(body["identity"], owner, options.chainId)) {
+      throw new JobRejectedError(
+        "Gateway returned a malformed or mismatched owner identity",
+        response.status
+      );
+    }
+    return body["identity"];
+  }
+  const client = {
+    async submitRawRead(params) {
+      const identity = await getIdentity(params.owner);
+      const deadlineSeconds = clampInteger(
+        params.deadlineSeconds,
+        DEFAULT_JOB_DEADLINE_SECONDS,
+        1,
+        MAX_JOB_DEADLINE_SECONDS,
+        "deadlineSeconds"
+      );
+      const wait = clampInteger(params.wait, 0, 0, MAX_WAIT_SECONDS, "wait");
+      const jobId = (0, import_node_crypto.randomUUID)();
+      const nowMs = now().getTime();
+      if (!Number.isFinite(nowMs)) {
+        throw new JobRejectedError("now must return a valid Date");
+      }
+      const deadline = new Date(
+        nowMs + deadlineSeconds * MILLISECONDS_PER_SECOND
+      ).toISOString();
+      const requestBody = {
+        v: JOB_PROTOCOL_VERSION,
+        jobId,
+        owner: params.owner,
+        builder: builder.address,
+        builderPublicKey: builder.publicKey,
+        grantId: params.grantId,
+        scope: params.scope,
+        operation: RAW_READ_OPERATION,
+        pinnedVersion: params.pinnedVersion ?? null,
+        deadline
+      };
+      const auth = await buildWeb3SignedHeader({
+        signMessage: builder.signMessage,
+        aud: audience,
+        method: POST_METHOD,
+        uri: JOB_EXECUTE_PATH,
+        bodyHash: computeBodyHash(canonicalJobRequestBytes(requestBody)),
+        nonce: (0, import_node_crypto.randomUUID)()
+      });
+      const requestCiphertext = await sealJobRequest(
+        { request: requestBody, auth },
+        identity.publicKey,
+        ecies
+      );
+      const submission = {
+        owner: requestBody.owner,
+        grantId: requestBody.grantId,
+        scope: requestBody.scope,
+        operation: requestBody.operation,
+        idempotencyKey: (0, import_node_crypto.randomUUID)(),
+        jobId,
+        deadline,
+        requestCiphertext
+      };
+      const bodyBytes = new TextEncoder().encode(JSON.stringify(submission));
+      const authorization = await buildWeb3SignedHeader({
+        signMessage: builder.signMessage,
+        aud: audience,
+        method: POST_METHOD,
+        uri: JOBS_PATH,
+        body: bodyBytes,
+        nonce: (0, import_node_crypto.randomUUID)()
+      });
+      const response = await request(
+        `${baseUrl}${JOBS_PATH}?wait=${wait}`,
+        {
+          method: POST_METHOD,
+          headers: {
+            [AUTHORIZATION_HEADER]: authorization,
+            [CONTENT_TYPE_HEADER]: JSON_CONTENT_TYPE
+          },
+          body: bodyBytes
+        },
+        "Job submission"
+      );
+      if (!response.ok) {
+        throw await rejectedResponse(response, "Job submission rejected");
+      }
+      const body = await responseBody(response);
+      if (response.status === HTTP_OK && isRecord2(body)) {
+        const job = requireStatus(body["job"], response.status);
+        if (job.jobId !== jobId) {
+          throw new JobRejectedError(
+            "Gateway returned a job id that does not match the submission",
+            response.status
+          );
+        }
+        return { jobId, state: job.state, job };
+      }
+      if (response.status === HTTP_ACCEPTED && isRecord2(body) && body["jobId"] === jobId && typeof body["state"] === "string" && JOB_STATES.includes(body["state"])) {
+        return { jobId, state: body["state"] };
+      }
+      throw new JobRejectedError(
+        "Gateway returned an undocumented job submission response",
+        response.status
+      );
+    },
+    async getJob(jobId) {
+      const path = `${JOBS_PATH}/${encodeURIComponent(jobId)}`;
+      const authorization = await buildWeb3SignedHeader({
+        signMessage: builder.signMessage,
+        aud: audience,
+        method: GET_METHOD,
+        uri: path,
+        nonce: (0, import_node_crypto.randomUUID)()
+      });
+      const response = await request(
+        `${baseUrl}${path}`,
+        {
+          method: GET_METHOD,
+          headers: { [AUTHORIZATION_HEADER]: authorization }
+        },
+        "Job status read"
+      );
+      if (!response.ok) {
+        throw await rejectedResponse(response, "Job status read rejected");
+      }
+      const body = await responseBody(response);
+      return requireStatus(
+        isRecord2(body) ? body["job"] : void 0,
+        response.status
+      );
+    },
+    async waitForJob(jobId, waitOptions = {}) {
+      const timeoutMs = requireFiniteDuration(
+        waitOptions.timeoutMs ?? DEFAULT_JOB_TIMEOUT_MS,
+        "timeoutMs"
+      );
+      const pollMs = Math.max(
+        CLAIM_POLL_FLOOR_MS,
+        requireFiniteDuration(
+          waitOptions.pollMs ?? DEFAULT_JOB_POLL_MS,
+          "pollMs"
+        )
+      );
+      const startedAt = Date.now();
+      const callerDeadline = startedAt + timeoutMs;
+      let latest;
+      for (; ; ) {
+        if (Date.now() >= callerDeadline) {
+          throw new JobTimeoutError(
+            `Timed out waiting for terminal job ${jobId}`,
+            {
+              jobId,
+              timeoutMs,
+              state: latest?.state
+            }
+          );
+        }
+        latest = await client.getJob(jobId);
+        if (TERMINAL_JOB_STATES.has(latest.state)) return latest;
+        const remaining = callerDeadline - Date.now();
+        if (remaining <= 0) {
+          throw new JobTimeoutError(
+            `Timed out waiting for terminal job ${jobId}`,
+            {
+              jobId,
+              timeoutMs,
+              state: latest.state
+            }
+          );
+        }
+        await sleep2(Math.min(pollMs, remaining));
+      }
+    },
+    async openResult(handle, openOptions) {
+      if (!privateKey) {
+        throw new JobRejectedError(
+          "openResult requires createJobsClient({ builderPrivateKey })"
+        );
+      }
+      const response = await request(
+        handle.url,
+        { method: GET_METHOD },
+        "Job result fetch"
+      );
+      if (!response.ok) {
+        throw await rejectedResponse(response, "Job result fetch rejected");
+      }
+      let bytes;
+      try {
+        bytes = new Uint8Array(await response.arrayBuffer());
+      } catch (error) {
+        throw new JobTransportError(
+          `Job result fetch failed: ${error instanceof Error ? error.message : String(error)}`,
+          error
+        );
+      }
+      const actualHash = (0, import_viem16.bytesToHex)((0, import_sha26.sha256)(bytes));
+      if (actualHash.toLowerCase() !== handle.hash.toLowerCase()) {
+        throw new JobResultIntegrityError(
+          "Fetched job result hash does not match its handle",
+          {
+            objectKey: handle.objectKey,
+            expectedHash: handle.hash,
+            actualHash
+          }
+        );
+      }
+      if (bytes.length !== handle.size) {
+        throw new JobResultIntegrityError(
+          "Fetched job result size does not match its handle",
+          {
+            objectKey: handle.objectKey,
+            expectedSize: handle.size,
+            actualSize: bytes.length
+          }
+        );
+      }
+      return openJobResult(bytes, privateKey, ecies, openOptions.expect);
+    },
+    async readRaw(params) {
+      const submitted = await client.submitRawRead(params);
+      const job = submitted.job && TERMINAL_JOB_STATES.has(submitted.job.state) ? submitted.job : await client.waitForJob(submitted.jobId, {
+        timeoutMs: params.timeoutMs,
+        pollMs: params.pollMs
+      });
+      if (job.state !== "completed") {
+        throw new JobRejectedError(
+          `Job ${job.jobId} ended in state ${job.state}${job.failureReason ? `: ${job.failureReason}` : ""}`,
+          void 0,
+          null,
+          {
+            jobId: job.jobId,
+            state: job.state,
+            ...job.failureReason ? { failureReason: job.failureReason } : {}
+          }
+        );
+      }
+      if (!job.result) {
+        throw new JobRejectedError(
+          "Completed job status does not include a result handle",
+          void 0,
+          null,
+          { jobId: job.jobId, state: job.state }
+        );
+      }
+      return client.openResult(job.result, {
+        expect: {
+          jobId: submitted.jobId,
+          scope: params.scope,
+          ...params.pinnedVersion !== void 0 && params.pinnedVersion !== null ? { version: params.pinnedVersion } : {}
+        }
+      });
+    }
+  };
+  return client;
+}
+
+// src/protocol/personal-server-registration.ts
+var import_viem17 = require("viem");
 var PERSONAL_SERVER_REGISTRATION_DEFAULT_CHAIN_ID = vanaMainnet2.id;
 var PERSONAL_SERVER_REGISTRATION_DEFAULT_VERIFYING_CONTRACT = getContractAddress(
   PERSONAL_SERVER_REGISTRATION_DEFAULT_CHAIN_ID,
   "DataPortabilityServers"
 );
 function assertAddress(value, name) {
-  if (!(0, import_viem14.isAddress)(value)) {
+  if (!(0, import_viem17.isAddress)(value)) {
     throw new Error(`${name} must be a valid EVM address`);
   }
 }
@@ -32738,12 +33885,12 @@ async function buildPersonalServerRegistrationSignature(input) {
 var registerPersonalServerSignature = buildPersonalServerRegistrationSignature;
 
 // src/personal-server-lite/owner-binding.ts
-var import_viem15 = require("viem");
+var import_viem18 = require("viem");
 var PERSONAL_SERVER_LITE_OWNER_BINDING_VERSION = "vana.ps-lite.owner-binding.v1";
 var PERSONAL_SERVER_LITE_OWNER_BINDING_PURPOSE = "ps-lite-owner";
 var PERSONAL_SERVER_LITE_OWNER_BINDING_PREFIX = `${PERSONAL_SERVER_LITE_OWNER_BINDING_VERSION}:${PERSONAL_SERVER_LITE_OWNER_BINDING_PURPOSE}:`;
 function assertAddress2(value, name) {
-  if (!(0, import_viem15.isAddress)(value)) {
+  if (!(0, import_viem18.isAddress)(value)) {
     throw new Error(`${name} must be a valid EVM address`);
   }
 }
@@ -32793,7 +33940,7 @@ async function buildPersonalServerLiteOwnerBindingSignature(input) {
 var signPersonalServerLiteOwnerBinding = buildPersonalServerLiteOwnerBindingSignature;
 
 // src/account/personal-server-registration.ts
-var import_viem16 = require("viem");
+var import_viem19 = require("viem");
 var ACCOUNT_PERSONAL_SERVER_REGISTRATION_INTENT = "personal_server.server_registration.v1";
 var AccountPersonalServerRegistrationError = class extends Error {
   status;
@@ -32812,7 +33959,7 @@ function trimTrailingSlash(value) {
   return value.replace(/\/+$/, "");
 }
 function assertAddress3(value, name) {
-  if (!(0, import_viem16.isAddress)(value)) {
+  if (!(0, import_viem19.isAddress)(value)) {
     throw new Error(`${name} must be a valid EVM address`);
   }
 }
@@ -32833,7 +33980,7 @@ function accountErrorMessage(status, body) {
   if (nestedMessage) {
     return nestedMessage;
   }
-  if (isRecord(body) && typeof body.message === "string") {
+  if (isRecord3(body) && typeof body.message === "string") {
     return body.message;
   }
   const code = accountErrorCode(body);
@@ -32847,7 +33994,7 @@ function accountErrorCode(body) {
   if (nestedCode) {
     return nestedCode;
   }
-  if (isRecord(body)) {
+  if (isRecord3(body)) {
     if (typeof body.code === "string") {
       return body.code;
     }
@@ -32858,13 +34005,13 @@ function accountErrorCode(body) {
   return void 0;
 }
 function nestedAccountErrorField(body, field) {
-  if (!isRecord(body) || !isRecord(body.error)) {
+  if (!isRecord3(body) || !isRecord3(body.error)) {
     return void 0;
   }
   const value = body.error[field];
   return typeof value === "string" ? value : void 0;
 }
-function isRecord(value) {
+function isRecord3(value) {
   return typeof value === "object" && value !== null;
 }
 function normalizeAccountResponse(response) {
@@ -33076,7 +34223,7 @@ function accountOwnerBindingError(error) {
 }
 
 // src/protocol/grants.ts
-var import_viem17 = require("viem");
+var import_viem20 = require("viem");
 function isHexString(value) {
   return typeof value === "string" && value.startsWith("0x");
 }
@@ -33121,7 +34268,7 @@ async function verifyGrantRegistration(input) {
   }
   let valid;
   try {
-    valid = await (0, import_viem17.verifyTypedData)({
+    valid = await (0, import_viem20.verifyTypedData)({
       address: input.grantorAddress,
       domain: grantRegistrationDomain(input.gatewayConfig),
       types: GRANT_REGISTRATION_TYPES,
@@ -33156,8 +34303,8 @@ async function verifyGrantRegistration(input) {
 }
 
 // src/protocol/fee-registry.ts
-var import_viem18 = require("viem");
-var FEE_REGISTRY_ABI = (0, import_viem18.parseAbi)([
+var import_viem21 = require("viem");
+var FEE_REGISTRY_ABI = (0, import_viem21.parseAbi)([
   "struct Fee { uint256 amount; address asset; address payee; bool enabled; }",
   "function fees(bytes32 operation) view returns (Fee)",
   "function operationKey(string name) pure returns (bytes32)"
@@ -33240,7 +34387,7 @@ async function getOpFee(client, config, opType, opts) {
 }
 
 // src/protocol/escrow-deposit.ts
-var import_viem19 = require("viem");
+var import_viem22 = require("viem");
 var ESCROW_DEPOSIT_ABI = [
   {
     type: "function",
@@ -33265,14 +34412,14 @@ function escrowContractAddress(config) {
   return config.contracts.dataPortabilityEscrow;
 }
 function encodeDepositNativeData(input) {
-  return (0, import_viem19.encodeFunctionData)({
+  return (0, import_viem22.encodeFunctionData)({
     abi: ESCROW_DEPOSIT_ABI,
     functionName: "depositNative",
     args: [input.account]
   });
 }
 function encodeDepositTokenData(input) {
-  return (0, import_viem19.encodeFunctionData)({
+  return (0, import_viem22.encodeFunctionData)({
     abi: ESCROW_DEPOSIT_ABI,
     functionName: "depositToken",
     args: [input.account, input.token, input.amount]
@@ -33293,7 +34440,7 @@ function buildDepositTokenRequest(config, input) {
 }
 
 // src/protocol/data-point-status.ts
-var import_viem20 = require("viem");
+var import_viem23 = require("viem");
 var DataPointStatus = /* @__PURE__ */ ((DataPointStatus2) => {
   DataPointStatus2[DataPointStatus2["None"] = 0] = "None";
   DataPointStatus2[DataPointStatus2["Active"] = 1] = "Active";
@@ -33317,7 +34464,7 @@ function dataRegistryContractAddress(config) {
   return config.contracts.dataRegistry;
 }
 function encodeSetDataPointStatusData(input) {
-  return (0, import_viem20.encodeFunctionData)({
+  return (0, import_viem23.encodeFunctionData)({
     abi: DATA_REGISTRY_STATUS_ABI,
     functionName: "setStatus",
     args: [input.scope, input.status]
@@ -33337,14 +34484,14 @@ function buildMarkDataPointUnavailableRequest(config, input) {
 }
 
 // src/protocol/data-point-deletion.ts
-var import_viem22 = require("viem");
+var import_viem25 = require("viem");
 
 // src/protocol/lineage.ts
-var import_viem21 = require("viem");
+var import_viem24 = require("viem");
 var import_zod = require("zod");
 
 // src/protocol/personal-server-error-body.ts
-function isRecord2(value) {
+function isRecord4(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 async function readPersonalServerErrorBody(response) {
@@ -33354,8 +34501,8 @@ async function readPersonalServerErrorBody(response) {
   } catch {
     return { errorCode: null, message: null };
   }
-  if (!isRecord2(body)) return { errorCode: null, message: null };
-  const nested = isRecord2(body.error) ? body.error : null;
+  if (!isRecord4(body)) return { errorCode: null, message: null };
+  const nested = isRecord4(body.error) ? body.error : null;
   const gatewayShape = typeof body.error === "string" && typeof body.code === "string";
   const code = nested?.errorCode ?? nested?.code ?? body.errorCode ?? (gatewayShape ? body.code : void 0) ?? (typeof body.error === "string" ? body.error : void 0) ?? body.code;
   const message = nested?.message ?? body.message ?? (gatewayShape ? body.error : void 0);
@@ -33368,63 +34515,23 @@ async function readPersonalServerErrorBody(response) {
   return {
     errorCode: typeof code === "string" ? code : null,
     message: typeof message === "string" ? message : null,
-    ...isRecord2(details) ? { details } : {}
+    ...isRecord4(details) ? { details } : {}
   };
 }
 
-// src/protocol/write-signer.ts
-function isRecord3(value) {
-  return value !== null && typeof value === "object";
-}
-function isViemWriteAccount(source) {
-  return isRecord3(source) && source.type === "local" && typeof source.address === "string" && typeof source.signMessage === "function";
-}
-function isViemWriteWalletClient(source) {
-  return isRecord3(source) && typeof source.signMessage === "function" && source.type !== "local" && (source.type === "walletClient" || "transport" in source);
-}
-function accountAddress(account) {
-  return typeof account === "string" ? account : account.address;
-}
-function resolveWriteSigner(source, options = {}) {
-  if (isViemWriteWalletClient(source)) {
-    const account = options.account ?? source.account;
-    if (account === void 0) {
-      throw new WriteRequestError(
-        "Viem wallet client requires an account option or account property"
-      );
-    }
-    return {
-      address: accountAddress(account),
-      signMessage: (message) => source.signMessage({ account, message })
-    };
-  }
-  if (isViemWriteAccount(source)) {
-    return {
-      address: source.address,
-      signMessage: (message) => source.signMessage({ message })
-    };
-  }
-  if (!isRecord3(source) || typeof source.signMessage !== "function") {
-    throw new WriteRequestError(
-      "signer must be a viem LocalAccount, a viem WalletClient, or a { signMessage } object"
-    );
-  }
-  return source;
-}
-
 // src/protocol/lineage.ts
 var DATA_POINT_ID_PATTERN = /^0x[0-9a-fA-F]{64}$/;
 function isDataPointId(value) {
   return typeof value === "string" && DATA_POINT_ID_PATTERN.test(value);
 }
 function deriveDataPointId(ownerAddress, scope) {
-  if (!(0, import_viem21.isAddress)(ownerAddress, { strict: false })) {
+  if (!(0, import_viem24.isAddress)(ownerAddress, { strict: false })) {
     throw new Error(
       `ownerAddress is not an EVM address: ${String(ownerAddress)}`
     );
   }
-  return (0, import_viem21.keccak256)(
-    (0, import_viem21.encodeAbiParameters)(
+  return (0, import_viem24.keccak256)(
+    (0, import_viem24.encodeAbiParameters)(
       [
         { name: "ownerAddress", type: "address" },
         { name: "scope", type: "string" }
@@ -33513,7 +34620,7 @@ function gatewayLineagePath(dataPointId, version) {
 function normalizeBaseUrl(url) {
   return url.replace(/\/+$/, "");
 }
-function resolveFetch(fetchFn) {
+function resolveFetch2(fetchFn) {
   const resolved = fetchFn ?? globalThis.fetch;
   if (resolved === void 0) {
     throw new LineageReadError("No fetch implementation available");
@@ -33554,7 +34661,7 @@ async function parseLineageGraph(source, response) {
       { cause: err instanceof Error ? err.message : String(err) }
     );
   }
-  const envelope = isRecord2(body) && isRecord2(body.data) ? body : void 0;
+  const envelope = isRecord4(body) && isRecord4(body.data) ? body : void 0;
   const parsed = LineageGraphSchema.safeParse(envelope?.data ?? body);
   if (!parsed.success) {
     throw new LineageReadError(
@@ -33564,7 +34671,7 @@ async function parseLineageGraph(source, response) {
       { issues: parsed.error.issues }
     );
   }
-  const proof = isRecord2(envelope?.proof) ? envelope.proof : void 0;
+  const proof = isRecord4(envelope?.proof) ? envelope.proof : void 0;
   return proof === void 0 ? parsed.data : { ...parsed.data, proof };
 }
 async function sendLineageRead(source, fetchFn, url, headers) {
@@ -33585,7 +34692,7 @@ async function sendLineageRead(source, fetchFn, url, headers) {
   return parseLineageGraph(source, response);
 }
 async function getPersonalServerLineage(params) {
-  const fetchFn = resolveFetch(params.fetch);
+  const fetchFn = resolveFetch2(params.fetch);
   const baseUrl = normalizeBaseUrl(params.personalServerUrl);
   const audience = params.audience ?? baseUrl;
   const signer = resolveWriteSigner(params.signer, { account: params.account });
@@ -33620,7 +34727,7 @@ async function getGatewayLineage(params) {
       { dataPointId: params.dataPointId }
     );
   }
-  const fetchFn = resolveFetch(params.fetch);
+  const fetchFn = resolveFetch2(params.fetch);
   const baseUrl = normalizeBaseUrl(params.gatewayUrl);
   const signer = resolveWriteSigner(params.signer, { account: params.account });
   const uri = gatewayLineagePath(
@@ -33650,7 +34757,7 @@ var TOMBSTONE_METADATA_HASH_PREIMAGE = "vana.data-point.tombstone.metadata.v1";
 var TOMBSTONE_DATA_HASH = "0x30c45ee72fe56d1927701316925ab7ceacd3b6f9267061735d59396f075c6222";
 var TOMBSTONE_METADATA_HASH = "0xc5255a141acd6a2ae55971b62c0a85977c2511989dc114ad2abc2b7644f57d90";
 function computeTombstoneHash(preimage) {
-  return (0, import_viem22.keccak256)((0, import_viem22.stringToBytes)(preimage));
+  return (0, import_viem25.keccak256)((0, import_viem25.stringToBytes)(preimage));
 }
 function isTombstoneHashes(dataHash, metadataHash) {
   return typeof dataHash === "string" && typeof metadataHash === "string" && dataHash.toLowerCase() === TOMBSTONE_DATA_HASH && metadataHash.toLowerCase() === TOMBSTONE_METADATA_HASH;
@@ -33669,12 +34776,12 @@ function tombstoneDeletedAt(value) {
   return typeof deletedAt === "string" ? deletedAt : null;
 }
 function assertAddress4(value, name) {
-  if (!(0, import_viem22.isAddress)(value)) {
+  if (!(0, import_viem25.isAddress)(value)) {
     throw new Error(`${name} must be a valid EVM address`);
   }
 }
 function assertUint256(value, name) {
-  if (value < 0n || value > import_viem22.maxUint256) {
+  if (value < 0n || value > import_viem25.maxUint256) {
     throw new Error(`${name} must fit in uint256, got ${value}`);
   }
 }
@@ -33777,7 +34884,7 @@ async function deleteDataPoint(input) {
     }
     currentVersion = parseExpectedVersion(record.expectedVersion);
   }
-  if (currentVersion < 0n || currentVersion >= import_viem22.maxUint256) {
+  if (currentVersion < 0n || currentVersion >= import_viem25.maxUint256) {
     throw new Error(
       `currentVersion ${currentVersion} cannot be incremented to a uint256 tombstone version`
     );
@@ -34084,17 +35191,17 @@ function tryGrantPermissions(scopes) {
 }
 
 // src/protocol/personal-server-write.ts
-var import_sha26 = require("@noble/hashes/sha2");
-var import_viem24 = require("viem");
+var import_sha28 = require("@noble/hashes/sha2");
+var import_viem27 = require("viem");
 var import_zod4 = require("zod");
 
 // src/protocol/write-request.ts
-var import_sha25 = require("@noble/hashes/sha2");
-var import_viem23 = require("viem");
+var import_sha27 = require("@noble/hashes/sha2");
+var import_viem26 = require("viem");
 function normalizeBaseUrl2(url) {
   return url.replace(/\/+$/, "");
 }
-function resolveFetch2(fetchFn) {
+function resolveFetch3(fetchFn) {
   const resolved = fetchFn ?? globalThis.fetch;
   if (resolved === void 0) {
     throw new WriteRequestError("No fetch implementation available");
@@ -34107,7 +35214,7 @@ function errorMessage(err) {
 function finiteOr(value, fallback) {
   return typeof value === "number" && Number.isFinite(value) ? value : fallback;
 }
-function sleep2(ms) {
+function sleep3(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 var issuedProofIats = /* @__PURE__ */ new Map();
@@ -34149,7 +35256,7 @@ function nextProofIat(proofKey) {
   setIssuedProofIat(proofKey, iat, last);
   const waitSec = iat - nowSec - PROOF_IAT_MAX_AHEAD_SECONDS;
   if (waitSec <= 0) return Promise.resolve(iat);
-  return sleep2(waitSec * 1e3).then(() => iat);
+  return sleep3(waitSec * 1e3).then(() => iat);
 }
 function freshProofNonce() {
   const webCrypto = globalThis.crypto;
@@ -34157,22 +35264,22 @@ function freshProofNonce() {
     return webCrypto.randomUUID();
   }
   if (typeof webCrypto?.getRandomValues === "function") {
-    return (0, import_viem23.bytesToHex)(webCrypto.getRandomValues(new Uint8Array(16)));
+    return (0, import_viem26.bytesToHex)(webCrypto.getRandomValues(new Uint8Array(16)));
   }
   throw new WriteRequestError(
     "No secure random source available to build a proof nonce; provide a crypto global"
   );
 }
 function proofKeyFor(parts) {
-  return (0, import_viem23.bytesToHex)(
-    (0, import_sha25.sha256)(
+  return (0, import_viem26.bytesToHex)(
+    (0, import_sha27.sha256)(
       new TextEncoder().encode(
         JSON.stringify([
           parts.aud,
           parts.method,
           parts.uri,
           parts.grantId,
-          parts.signedBytes ? (0, import_viem23.bytesToHex)((0, import_sha25.sha256)(parts.signedBytes)) : ""
+          parts.signedBytes ? (0, import_viem26.bytesToHex)((0, import_sha27.sha256)(parts.signedBytes)) : ""
         ])
       )
     )
@@ -34190,7 +35297,7 @@ async function sendWithFreshProof(label, fetchFn, options, proofKey, build) {
       lastError = err;
     }
     if (attempt < attempts - 1) {
-      await sleep2(delayMs);
+      await sleep3(delayMs);
       delayMs *= 2;
     }
   }
@@ -34229,7 +35336,7 @@ function dataPath(scope) {
   return `/v1/data/${encodeURIComponent(scope)}`;
 }
 async function openWriteSession(params) {
-  const fetchFn = resolveFetch2(params.fetch);
+  const fetchFn = resolveFetch3(params.fetch);
   const personalServerUrl = normalizeBaseUrl2(params.personalServerUrl);
   const audience = params.audience ?? personalServerUrl;
   const signer = resolveWriteSigner(params.signer, { account: params.account });
@@ -34309,12 +35416,12 @@ async function openWriteSession(params) {
   };
 }
 function isWriteSession(value) {
-  if (!isRecord2(value)) return false;
+  if (!isRecord4(value)) return false;
   const signer = value.signer;
-  return typeof value.personalServerUrl === "string" && typeof value.audience === "string" && typeof value.grantId === "string" && typeof value.accessToken === "string" && value.accessToken.length > 0 && typeof value.expiresAt === "number" && Number.isFinite(value.expiresAt) && Array.isArray(value.writeScopes) && value.writeScopes.every((scope) => typeof scope === "string") && isRecord2(signer) && typeof signer.signMessage === "function";
+  return typeof value.personalServerUrl === "string" && typeof value.audience === "string" && typeof value.grantId === "string" && typeof value.accessToken === "string" && value.accessToken.length > 0 && typeof value.expiresAt === "number" && Number.isFinite(value.expiresAt) && Array.isArray(value.writeScopes) && value.writeScopes.every((scope) => typeof scope === "string") && isRecord4(signer) && typeof signer.signMessage === "function";
 }
 function sessionCoversScope(session, scope) {
-  if (!isRecord2(session) || !Array.isArray(session.writeScopes) || !session.writeScopes.every((pattern) => typeof pattern === "string")) {
+  if (!isRecord4(session) || !Array.isArray(session.writeScopes) || !session.writeScopes.every((pattern) => typeof pattern === "string")) {
     throw new WriteRequestError("session must come from openWriteSession");
   }
   return session.writeScopes.some(
@@ -34359,7 +35466,7 @@ function binaryWriteSignedBytes(input) {
     mimeType: normalizeBinaryMimeType(input.contentType),
     ...input.filename ? { filename: input.filename } : {},
     sizeBytes: input.bytes.length,
-    contentHash: (0, import_viem24.bytesToHex)((0, import_sha26.sha256)(input.bytes)),
+    contentHash: (0, import_viem27.bytesToHex)((0, import_sha28.sha256)(input.bytes)),
     encoding: "base64",
     content: toBase64(input.bytes),
     ...metadata !== void 0 ? { metadata } : {}
@@ -34388,7 +35495,7 @@ function assertNoReservedKeys(value, where) {
   }
 }
 function isLineagePair(value) {
-  return isRecord2(value) && typeof value.ownerAddress === "string" && typeof value.scope === "string";
+  return isRecord4(value) && typeof value.ownerAddress === "string" && typeof value.scope === "string";
 }
 function normalizeLineage(lineage, derivedScope) {
   if (!Array.isArray(lineage)) {
@@ -34407,7 +35514,7 @@ function normalizeLineage(lineage, derivedScope) {
   for (const entry of lineage) {
     let id;
     if (isLineagePair(entry)) {
-      if (!(0, import_viem24.isAddress)(entry.ownerAddress, { strict: false })) {
+      if (!(0, import_viem27.isAddress)(entry.ownerAddress, { strict: false })) {
         throw new WriteRequestError(
           "lineage source ownerAddress must be an EVM address",
           { ownerAddress: entry.ownerAddress }
@@ -34456,7 +35563,7 @@ function assertNoLineageField(value, where) {
 }
 function buildMetadataHeader(metadata, sources) {
   if (metadata !== void 0) {
-    if (!isRecord2(metadata)) {
+    if (!isRecord4(metadata)) {
       throw new WriteRequestError("metadata must be a plain object");
     }
     assertNoReservedKeys(metadata, "metadata");
@@ -34509,7 +35616,7 @@ function prepareWrite(params) {
   if (params.data === void 0) {
     throw new WriteRequestError("Pass data (a JSON object) or binary");
   }
-  if (!isRecord2(params.data)) {
+  if (!isRecord4(params.data)) {
     throw new WriteRequestError("data must be a plain JSON object");
   }
   if (params.metadata !== void 0) {
@@ -34560,7 +35667,7 @@ async function writeData(params) {
   if (!isWriteSession(session)) {
     throw new WriteRequestError("session must come from openWriteSession");
   }
-  const fetchFn = resolveFetch2(params.fetch);
+  const fetchFn = resolveFetch3(params.fetch);
   if (typeof params.scope !== "string" || params.scope.length === 0) {
     throw new WriteRequestError("scope is required");
   }
@@ -34752,7 +35859,7 @@ function resolveRequest(params) {
       "signer must be a viem LocalAccount, a viem WalletClient, or a { signMessage } object"
     );
   }
-  const fetchFn = resolveFetch2(params.fetch);
+  const fetchFn = resolveFetch3(params.fetch);
   const baseUrl = normalizeBaseUrl2(params.personalServerUrl);
   const audience = params.audience ?? baseUrl;
   return {
@@ -35085,7 +36192,7 @@ async function waitForQuestion(params) {
         }
       );
     }
-    await sleep2(Math.min(pollIntervalMs, remaining));
+    await sleep3(Math.min(pollIntervalMs, remaining));
   }
 }
 async function askPersonalServer(params) {
@@ -35149,7 +36256,7 @@ function derivativeStatusTarget(derivedScope) {
 function normalizeBaseUrl3(url) {
   return url.replace(/\/+$/, "");
 }
-function resolveFetch3(fetchFn) {
+function resolveFetch4(fetchFn) {
   const resolved = fetchFn ?? globalThis.fetch;
   if (resolved === void 0) {
     throw new WriteRequestError("No fetch implementation available");
@@ -35162,7 +36269,7 @@ function requireDerivedScope(derivedScope) {
   }
   return derivedScope;
 }
-function sleep3(ms, signal) {
+function sleep4(ms, signal) {
   if (ms <= 0) return Promise.resolve();
   return new Promise((resolve, reject) => {
     const timer = setTimeout(() => {
@@ -35198,7 +36305,7 @@ function isDerivativeStatusSettled(status) {
 }
 async function getDerivativeStatus(params) {
   const derivedScope = requireDerivedScope(params.derivedScope);
-  const fetchFn = resolveFetch3(params.fetch);
+  const fetchFn = resolveFetch4(params.fetch);
   const baseUrl = normalizeBaseUrl3(params.personalServerUrl);
   const signer = resolveWriteSigner(params.signer, { account: params.account });
   const headers = new Headers(params.headers);
@@ -35276,7 +36383,7 @@ async function waitForDerivativeStatus(params) {
     if (waitMs > remaining) {
       throw timeoutError(latest, timeoutMs);
     }
-    await sleep3(waitMs, params.signal);
+    await sleep4(waitMs, params.signal);
   }
 }
 
@@ -36309,7 +37416,7 @@ var KNOWN_CODES = /* @__PURE__ */ new Set([
   "server_not_configured",
   "content_too_large"
 ]);
-function isRecord4(value) {
+function isRecord5(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function normalizeCode(value) {
@@ -36320,10 +37427,10 @@ function normalizeCode(value) {
   return KNOWN_CODES.has(code) ? code : null;
 }
 function extractPSErrorBody(body) {
-  if (!isRecord4(body)) {
+  if (!isRecord5(body)) {
     return null;
   }
-  const nested = isRecord4(body.error) ? body.error : null;
+  const nested = isRecord5(body.error) ? body.error : null;
   const code = normalizeCode(
     nested?.errorCode ?? nested?.code ?? body.errorCode ?? body.code
   );
@@ -36355,6 +37462,8 @@ async function parsePSError(response) {
   BUILDER_REGISTRATION_TYPES,
   BlockchainError,
   BrowserPlatformAdapter,
+  BuilderUnknownError,
+  CLAIM_POLL_FLOOR_MS,
   CONTRACTS,
   CallbackStorage,
   ContractFactory,
@@ -36363,6 +37472,8 @@ async function parsePSError(response) {
   DATA_REGISTRY_STATUS_ABI,
   DEFAULT_DERIVATIVE_STATUS_POLL_INTERVAL_MS,
   DEFAULT_DERIVATIVE_STATUS_TIMEOUT_MS,
+  DEFAULT_JOB_DEADLINE_SECONDS,
+  DEFAULT_LEASE_SECONDS,
   DEFAULT_QUESTION_POLL_INTERVAL_MS,
   DEFAULT_QUESTION_TIMEOUT_MS,
   DERIVATIVE_ERROR_CODES,
@@ -36387,6 +37498,9 @@ async function parsePSError(response) {
   DerivativeStatusSchema,
   DropboxStorage,
   ECIESError,
+  ENCLAVE_IDENTITY_EVIDENCE_VERSION,
+  ENCLAVE_TRUST_ANCHORS,
+  ENCLAVE_WALLET_PURPOSE,
   ESCROW_DEPOSIT_ABI,
   ExpiredTokenError,
   FEE_REGISTRY_ABI,
@@ -36395,12 +37509,25 @@ async function parsePSError(response) {
   GRANT_REGISTRATION_TYPES,
   GRANT_REVOCATION_TYPES,
   GoogleDriveStorage,
+  GrantInvalidError,
   InMemoryTokenStore,
   IngestResponseSchema,
   InvalidConfigurationError,
   InvalidScopeEntryError,
   InvalidSignatureError,
   IpfsStorage,
+  JOB_OPERATIONS,
+  JOB_PROTOCOL_VERSION,
+  JOB_STATES,
+  JobEnvelopeError,
+  JobIdTakenError,
+  JobNotFoundError,
+  JobRejectedError,
+  JobRequestTooLargeError,
+  JobResultIntegrityError,
+  JobTimeoutError,
+  JobTransportError,
+  JobsClientError,
   LINEAGE_FIELD,
   LINEAGE_KEY,
   LineageEntrySchema,
@@ -36408,10 +37535,16 @@ async function parsePSError(response) {
   LineageNodeSchema,
   LineageReadError,
   MASTER_KEY_MESSAGE,
+  MASTER_SIGNATURE_DELIVERY_MAX_AGE_SECONDS,
+  MASTER_SIGNATURE_DELIVERY_VERSION,
+  MAX_ATTEMPTS,
+  MAX_JOB_DEADLINE_SECONDS,
+  MAX_LEASE_SECONDS,
   MAX_LINEAGE_SOURCES,
   MAX_QUESTION_CHARS,
   MAX_QUESTION_MODEL_CHARS,
   MAX_QUESTION_SOURCE_SCOPES,
+  MAX_WAIT_SECONDS,
   MissingAuthError,
   NATIVE_ASSET_ADDRESS,
   NATIVE_VANA_ASSET,
@@ -36420,6 +37553,7 @@ async function parsePSError(response) {
   NodePlatformAdapter,
   NonceError,
   OAuthClient,
+  OwnerNotReadyError,
   PERSONAL_SERVER_LITE_OWNER_BINDING_PREFIX,
   PERSONAL_SERVER_LITE_OWNER_BINDING_PURPOSE,
   PERSONAL_SERVER_LITE_OWNER_BINDING_VERSION,
@@ -36445,6 +37579,7 @@ async function parsePSError(response) {
   RedactedLineageNodeSchema,
   RelayerError,
   SCOPE_ACTIONS,
+  SEALED_ENVELOPE_VERSION,
   SERVER_REGISTRATION_TYPES,
   ScopeSchema,
   SerializationError,
@@ -36457,6 +37592,7 @@ async function parsePSError(response) {
   TOMBSTONE_METADATA_HASH,
   TOMBSTONE_METADATA_HASH_PREIMAGE,
   TransactionPendingError,
+  USER_PS_ID_DOMAIN,
   UserRejectedRequestError,
   VanaError,
   VanaStorage,
@@ -36475,6 +37611,7 @@ async function parsePSError(response) {
   WriteSessionExpiredError,
   WriteTransportError,
   WriteUnauthorizedError,
+  appRootPreimage,
   askPersonalServer,
   assertDerivedScopeNaming,
   assertValidPkceVerifier,
@@ -36488,6 +37625,7 @@ async function parsePSError(response) {
   buildEscrowPaymentHeader,
   buildGrantPaymentHeader,
   buildMarkDataPointUnavailableRequest,
+  buildMasterSignatureDelivery,
   buildPersonalServerDataReadRequest,
   buildPersonalServerLiteOwnerBindingMessage,
   buildPersonalServerLiteOwnerBindingSignature,
@@ -36496,6 +37634,7 @@ async function parsePSError(response) {
   buildSetDataPointStatusRequest,
   buildWeb3SignedHeader,
   builderRegistrationDomain,
+  canonicalJobRequestBytes,
   chains,
   clearContractCache,
   computeBodyHash,
@@ -36507,6 +37646,7 @@ async function parsePSError(response) {
   createDefaultNonceSource,
   createEscrowGatewayClient,
   createGatewayClient,
+  createJobsClient,
   createNodePlatformAdapter,
   createPlatformAdapter,
   createPlatformAdapterFor,
@@ -36531,6 +37671,7 @@ async function parsePSError(response) {
   encodeDepositTokenData,
   encodeSetDataPointStatusData,
   encodeWriteMetadataHeader,
+  encryptMasterSignatureDelivery,
   encryptWithPassword,
   escrowContractAddress,
   escrowPaymentDomain,
@@ -36565,12 +37706,15 @@ async function parsePSError(response) {
   isPlatformSupported,
   isRedactedLineageNode,
   isTombstoneHashes,
+  kmsIssuedPreimage,
   listQuestions,
   mainnetServices,
   moksha,
   mokshaServices,
   mokshaTestnet,
   normalizeBinaryMimeType,
+  openJobRequest,
+  openJobResult,
   openWriteSession,
   parsePSError,
   parsePersonalServerPaymentRequired,
@@ -36594,6 +37738,8 @@ async function parsePSError(response) {
   scopeMatchesPattern,
   scopeNamespace,
   scopeToPathSegments,
+  sealJobRequest,
+  sealJobResult,
   serializeECIES,
   serverRegistrationDomain,
   sessionCoversScope,
@@ -36604,7 +37750,9 @@ async function parsePSError(response) {
   toDirectPaymentReceipt,
   tombstoneDeletedAt,
   tryGrantPermissions,
+  userPsId,
   vanaMainnet,
+  verifyEnclaveIdentityEvidence,
   verifyGrantRegistration,
   verifyPkceChallenge,
   verifyWeb3Signed,