@opendatalabs/personal-server-ts-core 0.0.1-canary.01ca694 → 0.0.1-canary.052d47e

package/dist/policy/data-write.d.ts

@@ -0,0 +1,69 @@
+import type { GatewayGrantResponse } from "@opendatalabs/vana-sdk/browser";
+import { type AuthSessionVerifierPort, type GrantVerifierPort, type RuntimeAvailabilityPort } from "../ports/index.js";
+/**
+ * Write-grant encoding: a grant scope entry prefixed with `write:` authorizes
+ * the grantee to WRITE into the scope it names (e.g. `write:notes.entries`,
+ * `write:notes.*`). The suffix uses the same pattern grammar as read scopes
+ * (`*` / `{prefix}.*` / exact), evaluated with the SDK's scopeMatchesPattern.
+ *
+ * Why a scope-entry prefix and not a new grant field: the gateway's grant
+ * shape (GatewayGrantResponse) has no permission axis — `scopes` is its only
+ * capability carrier — and the gateway validates scope entries as opaque
+ * non-empty strings, so `write:`-prefixed entries flow through createGrant /
+ * getGrant / the EIP-712 GrantRegistration signature unchanged. The Personal
+ * Server is the sole interpreter.
+ *
+ * Separation of powers falls out of the encoding:
+ *   - read policy matches the REQUESTED scope against grant entries verbatim
+ *     (scopeCoveredByGrant), and a requested scope never carries the prefix,
+ *     so `write:x` entries can never satisfy a read;
+ *   - write policy (below) only honors `write:`-prefixed entries, so plain
+ *     read entries can never satisfy a write.
+ */
+export declare const WRITE_SCOPE_PREFIX = "write:";
+export declare function isWriteScopeEntry(entry: string): boolean;
+/** The scope patterns a grant authorizes for writing (prefix stripped). */
+export declare function writeScopePatterns(grantScopes: readonly string[]): string[];
+export declare function scopeCoveredByWriteGrant(requestedScope: string, grantScopes: readonly string[]): boolean;
+/**
+ * Fee seam for builder writes. Write fee mechanics are undecided — the
+ * default (no port wired) is FREE. When a fee model lands (x402-style like
+ * reads, or something else), implement this port and wire it into
+ * DataWritePolicyPorts; the policy calls it after all authorization
+ * invariants pass, so a fee rejection never masks an auth failure.
+ */
+export interface WriteFeeVerifierPort {
+    assertWriteAllowed(input: {
+        builder: `0x${string}`;
+        grant: GatewayGrantResponse;
+        scope: string;
+    }): Promise<void>;
+}
+export interface DataWritePolicyInput {
+    signer: `0x${string}`;
+    grantId?: string;
+    requestedScope: string;
+    /**
+     * This server's owner address. The grant's grantor MUST equal it — a grant
+     * issued by a different owner is rejected. Required (not optional) so that
+     * TypeScript flags any caller that fails to bind the write to the server
+     * owner; the check also fails closed at runtime for untyped/JS callers.
+     */
+    serverOwner: `0x${string}`;
+}
+export interface DataWritePolicyPorts {
+    authSessionVerifier: AuthSessionVerifierPort;
+    grantVerifier: GrantVerifierPort;
+    runtimeAvailability?: RuntimeAvailabilityPort;
+    /** Absent = writes are free (see WriteFeeVerifierPort). */
+    writeFeeVerifier?: WriteFeeVerifierPort;
+}
+/**
+ * Authorize one builder write against a write-grant. Mirrors
+ * verifyDataReadPolicy invariant-for-invariant (builder registered, grant
+ * present / not revoked / not expired, scope coverage, grantee binding,
+ * owner binding) — but scope coverage only honors `write:`-prefixed grant
+ * entries, so a read-grant never confers write access.
+ */
+export declare function verifyDataWritePolicy(input: DataWritePolicyInput, ports: DataWritePolicyPorts): Promise<GatewayGrantResponse>;
+//# sourceMappingURL=data-write.d.ts.map

package/dist/policy/data-write.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"data-write.d.ts","sourceRoot":"","sources":["../../src/policy/data-write.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAa3E,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,EAC7B,MAAM,mBAAmB,CAAC;AAG3B;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,kBAAkB,WAAW,CAAC;AAE3C,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAExD;AAED,2EAA2E;AAC3E,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAK3E;AAED,wBAAgB,wBAAwB,CACtC,cAAc,EAAE,MAAM,EACtB,WAAW,EAAE,SAAS,MAAM,EAAE,GAC7B,OAAO,CAIT;AAED;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC,kBAAkB,CAAC,KAAK,EAAE;QACxB,OAAO,EAAE,KAAK,MAAM,EAAE,CAAC;QACvB,KAAK,EAAE,oBAAoB,CAAC;QAC5B,KAAK,EAAE,MAAM,CAAC;KACf,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,KAAK,MAAM,EAAE,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,oBAAoB;IACnC,mBAAmB,EAAE,uBAAuB,CAAC;IAC7C,aAAa,EAAE,iBAAiB,CAAC;IACjC,mBAAmB,CAAC,EAAE,uBAAuB,CAAC;IAC9C,2DAA2D;IAC3D,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;CACzC;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,oBAAoB,EAC3B,KAAK,EAAE,oBAAoB,GAC1B,OAAO,CAAC,oBAAoB,CAAC,CAkG/B"}

package/dist/policy/data-write.js

@@ -0,0 +1,131 @@
+import { scopeMatchesPattern } from "@opendatalabs/vana-sdk/browser";
+import { GrantExpiredError, GrantOwnerMismatchError, GrantRequiredError, GrantRevokedError, InvalidSignatureError, PsUnavailableError, ScopeMismatchError, ServerNotConfiguredError, UnregisteredBuilderError, } from "../errors/catalog.js";
+import { parseGrantExpiresAtSeconds } from "./data-read.js";
+/**
+ * Write-grant encoding: a grant scope entry prefixed with `write:` authorizes
+ * the grantee to WRITE into the scope it names (e.g. `write:notes.entries`,
+ * `write:notes.*`). The suffix uses the same pattern grammar as read scopes
+ * (`*` / `{prefix}.*` / exact), evaluated with the SDK's scopeMatchesPattern.
+ *
+ * Why a scope-entry prefix and not a new grant field: the gateway's grant
+ * shape (GatewayGrantResponse) has no permission axis — `scopes` is its only
+ * capability carrier — and the gateway validates scope entries as opaque
+ * non-empty strings, so `write:`-prefixed entries flow through createGrant /
+ * getGrant / the EIP-712 GrantRegistration signature unchanged. The Personal
+ * Server is the sole interpreter.
+ *
+ * Separation of powers falls out of the encoding:
+ *   - read policy matches the REQUESTED scope against grant entries verbatim
+ *     (scopeCoveredByGrant), and a requested scope never carries the prefix,
+ *     so `write:x` entries can never satisfy a read;
+ *   - write policy (below) only honors `write:`-prefixed entries, so plain
+ *     read entries can never satisfy a write.
+ */
+export const WRITE_SCOPE_PREFIX = "write:";
+export function isWriteScopeEntry(entry) {
+    return entry.startsWith(WRITE_SCOPE_PREFIX);
+}
+/** The scope patterns a grant authorizes for writing (prefix stripped). */
+export function writeScopePatterns(grantScopes) {
+    return grantScopes
+        .filter(isWriteScopeEntry)
+        .map((entry) => entry.slice(WRITE_SCOPE_PREFIX.length))
+        .filter((pattern) => pattern.length > 0);
+}
+export function scopeCoveredByWriteGrant(requestedScope, grantScopes) {
+    return writeScopePatterns(grantScopes).some((pattern) => scopeMatchesPattern(requestedScope, pattern));
+}
+/**
+ * Authorize one builder write against a write-grant. Mirrors
+ * verifyDataReadPolicy invariant-for-invariant (builder registered, grant
+ * present / not revoked / not expired, scope coverage, grantee binding,
+ * owner binding) — but scope coverage only honors `write:`-prefixed grant
+ * entries, so a read-grant never confers write access.
+ */
+export async function verifyDataWritePolicy(input, ports) {
+    const available = await ports.runtimeAvailability?.isAvailable();
+    if (available === false) {
+        throw new PsUnavailableError();
+    }
+    const builder = await ports.authSessionVerifier.getBuilder(input.signer);
+    if (!builder) {
+        throw new UnregisteredBuilderError();
+    }
+    if (!input.grantId) {
+        throw new GrantRequiredError({
+            reason: "No grantId bound to the write session",
+        });
+    }
+    const grant = await ports.grantVerifier.getGrant(input.grantId);
+    if (!grant) {
+        throw new GrantRequiredError({
+            reason: "Grant not found",
+            grantId: input.grantId,
+        });
+    }
+    if (grant.revokedAt !== null) {
+        throw new GrantRevokedError({ grantId: grant.id });
+    }
+    if (!grant.scopes || writeScopePatterns(grant.scopes).length === 0) {
+        throw new ScopeMismatchError({
+            requestedScope: input.requestedScope,
+            reason: "Grant has no write scopes",
+        });
+    }
+    if (grant.expiresAt !== null && grant.expiresAt !== undefined) {
+        const expiresAtSec = parseGrantExpiresAtSeconds(grant.expiresAt);
+        if (expiresAtSec === null) {
+            throw new ScopeMismatchError({
+                requestedScope: input.requestedScope,
+                reason: "Grant expiry is invalid",
+            });
+        }
+        if (expiresAtSec > 0) {
+            const nowSec = Math.floor(Date.now() / 1000);
+            if (expiresAtSec < nowSec) {
+                throw new GrantExpiredError({
+                    expiresAt: expiresAtSec,
+                });
+            }
+        }
+    }
+    if (!scopeCoveredByWriteGrant(input.requestedScope, grant.scopes)) {
+        throw new ScopeMismatchError({
+            requestedScope: input.requestedScope,
+            grantedScopes: grant.scopes,
+            reason: "Grant does not authorize writing to this scope",
+        });
+    }
+    if (builder.id.toLowerCase() !== grant.granteeId.toLowerCase()) {
+        throw new InvalidSignatureError({
+            reason: "Write signer is not the grant builder",
+            expected: grant.granteeId,
+            actual: input.signer,
+        });
+    }
+    // Ownership binding — the grant MUST have been issued by THIS server's
+    // owner (same fail-closed rules as verifyDataReadPolicy: a missing
+    // serverOwner or a grantor-less gateway response rejects, never skips).
+    if (!input.serverOwner) {
+        throw new ServerNotConfiguredError({
+            reason: "serverOwner is required to verify grant ownership",
+        });
+    }
+    if (!grant.grantorAddress ||
+        grant.grantorAddress.toLowerCase() !== input.serverOwner.toLowerCase()) {
+        throw new GrantOwnerMismatchError({
+            grantId: grant.id,
+            expected: input.serverOwner,
+            actual: grant.grantorAddress ?? null,
+        });
+    }
+    // All authorization invariants passed — apply the fee seam last (default
+    // free; see WriteFeeVerifierPort).
+    await ports.writeFeeVerifier?.assertWriteAllowed({
+        builder: input.signer,
+        grant,
+        scope: input.requestedScope,
+    });
+    return grant;
+}
+//# sourceMappingURL=data-write.js.map

package/dist/policy/data-write.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"data-write.js","sourceRoot":"","sources":["../../src/policy/data-write.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,sBAAsB,CAAC;AAM9B,OAAO,EAAE,0BAA0B,EAAE,MAAM,gBAAgB,CAAC;AAE5D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,QAAQ,CAAC;AAE3C,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO,KAAK,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;AAC9C,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,kBAAkB,CAAC,WAA8B;IAC/D,OAAO,WAAW;SACf,MAAM,CAAC,iBAAiB,CAAC;SACzB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;SACtD,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,cAAsB,EACtB,WAA8B;IAE9B,OAAO,kBAAkB,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CACtD,mBAAmB,CAAC,cAAc,EAAE,OAAO,CAAC,CAC7C,CAAC;AACJ,CAAC;AAsCD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAA2B,EAC3B,KAA2B;IAE3B,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,mBAAmB,EAAE,WAAW,EAAE,CAAC;IACjE,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;QACxB,MAAM,IAAI,kBAAkB,EAAE,CAAC;IACjC,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,mBAAmB,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACzE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,wBAAwB,EAAE,CAAC;IACvC,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACnB,MAAM,IAAI,kBAAkB,CAAC;YAC3B,MAAM,EAAE,uCAAuC;SAChD,CAAC,CAAC;IACL,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,kBAAkB,CAAC;YAC3B,MAAM,EAAE,iBAAiB;YACzB,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAC7B,MAAM,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,kBAAkB,CAAC;YAC3B,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,MAAM,EAAE,2BAA2B;SACpC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAC9D,MAAM,YAAY,GAAG,0BAA0B,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACjE,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;YAC1B,MAAM,IAAI,kBAAkB,CAAC;gBAC3B,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,MAAM,EAAE,yBAAyB;aAClC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YAC7C,IAAI,YAAY,GAAG,MAAM,EAAE,CAAC;gBAC1B,MAAM,IAAI,iBAAiB,CAAC;oBAC1B,SAAS,EAAE,YAAY;iBACxB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,wBAAwB,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,kBAAkB,CAAC;YAC3B,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,aAAa,EAAE,KAAK,CAAC,MAAM;YAC3B,MAAM,EAAE,gDAAgD;SACzD,CAAC,CAAC;IACL,CAAC;IAED,IAAI,OAAO,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC;QAC/D,MAAM,IAAI,qBAAqB,CAAC;YAC9B,MAAM,EAAE,uCAAuC;YAC/C,QAAQ,EAAE,KAAK,CAAC,SAAS;YACzB,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;IACL,CAAC;IAED,uEAAuE;IACvE,mEAAmE;IACnE,wEAAwE;IACxE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QACvB,MAAM,IAAI,wBAAwB,CAAC;YACjC,MAAM,EAAE,mDAAmD;SAC5D,CAAC,CAAC;IACL,CAAC;IACD,IACE,CAAC,KAAK,CAAC,cAAc;QACrB,KAAK,CAAC,cAAc,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,WAAW,CAAC,WAAW,EAAE,EACtE,CAAC;QACD,MAAM,IAAI,uBAAuB,CAAC;YAChC,OAAO,EAAE,KAAK,CAAC,EAAE;YACjB,QAAQ,EAAE,KAAK,CAAC,WAAW;YAC3B,MAAM,EAAE,KAAK,CAAC,cAAc,IAAI,IAAI;SACrC,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACzE,mCAAmC;IACnC,MAAM,KAAK,CAAC,gBAAgB,EAAE,kBAAkB,CAAC;QAC/C,OAAO,EAAE,KAAK,CAAC,MAAM;QACrB,KAAK;QACL,KAAK,EAAE,KAAK,CAAC,cAAc;KAC5B,CAAC,CAAC;IAEH,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/policy/index.d.ts

@@ -1,2 +1,4 @@
-export { verifyDataReadPolicy, type DataReadPolicyInput, type DataReadPolicyPorts, } from "./data-read.js";
+export { verifyDataReadPolicy, parseGrantExpiresAtSeconds, type DataReadPolicyInput, type DataReadPolicyPorts, } from "./data-read.js";
+export { deriveBuilderId, verifySignedArtifacts, type SignedArtifactInput, type SignedBuilder, type SignedGrant, } from "./signed-artifacts.js";
+export { WRITE_SCOPE_PREFIX, isWriteScopeEntry, writeScopePatterns, scopeCoveredByWriteGrant, verifyDataWritePolicy, type DataWritePolicyInput, type DataWritePolicyPorts, type WriteFeeVerifierPort, } from "./data-write.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/policy/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/policy/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,GACzB,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/policy/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,GACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,KAAK,WAAW,GACjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,wBAAwB,EACxB,qBAAqB,EACrB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,GAC1B,MAAM,iBAAiB,CAAC"}

package/dist/policy/index.js

@@ -1,2 +1,4 @@
-export { verifyDataReadPolicy, } from "./data-read.js";
+export { verifyDataReadPolicy, parseGrantExpiresAtSeconds, } from "./data-read.js";
+export { deriveBuilderId, verifySignedArtifacts, } from "./signed-artifacts.js";
+export { WRITE_SCOPE_PREFIX, isWriteScopeEntry, writeScopePatterns, scopeCoveredByWriteGrant, verifyDataWritePolicy, } from "./data-write.js";
 //# sourceMappingURL=index.js.map

package/dist/policy/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/policy/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,GAGrB,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/policy/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,0BAA0B,GAG3B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,eAAe,EACf,qBAAqB,GAItB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,wBAAwB,EACxB,qBAAqB,GAItB,MAAM,iBAAiB,CAAC"}

package/dist/policy/signed-artifacts.d.ts

@@ -0,0 +1,17 @@
+import { type Builder, type DataPortabilityGatewayConfig, type GatewayGrantResponse } from "@opendatalabs/vana-sdk/browser";
+import { type Address, type Hex } from "viem";
+export type SignedGrant = GatewayGrantResponse & {
+    signature?: string;
+};
+export type SignedBuilder = Builder & {
+    signature?: string;
+};
+export interface SignedArtifactInput {
+    grant: SignedGrant;
+    builder: SignedBuilder;
+    gatewayConfig: DataPortabilityGatewayConfig;
+    ownerAddress: Address;
+}
+export declare function verifySignedArtifacts(input: SignedArtifactInput): Promise<void>;
+export declare function deriveBuilderId(builder: Pick<Builder, "ownerAddress" | "granteeAddress" | "publicKey" | "appUrl">, gatewayConfig: DataPortabilityGatewayConfig): Hex;
+//# sourceMappingURL=signed-artifacts.d.ts.map

package/dist/policy/signed-artifacts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signed-artifacts.d.ts","sourceRoot":"","sources":["../../src/policy/signed-artifacts.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,OAAO,EACZ,KAAK,4BAA4B,EACjC,KAAK,oBAAoB,EAC1B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAML,KAAK,OAAO,EACZ,KAAK,GAAG,EACT,MAAM,MAAM,CAAC;AAQd,MAAM,MAAM,WAAW,GAAG,oBAAoB,GAAG;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AACxE,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAgB7D,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,WAAW,CAAC;IACnB,OAAO,EAAE,aAAa,CAAC;IACvB,aAAa,EAAE,4BAA4B,CAAC;IAC5C,YAAY,EAAE,OAAO,CAAC;CACvB;AAED,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC,IAAI,CAAC,CAiEf;AAED,wBAAgB,eAAe,CAC7B,OAAO,EAAE,IAAI,CACX,OAAO,EACP,cAAc,GAAG,gBAAgB,GAAG,WAAW,GAAG,QAAQ,CAC3D,EACD,aAAa,EAAE,4BAA4B,GAC1C,GAAG,CAoCL"}

package/dist/policy/signed-artifacts.js

@@ -0,0 +1,110 @@
+import { BUILDER_REGISTRATION_TYPES, builderRegistrationDomain, verifyGrantRegistration, } from "@opendatalabs/vana-sdk/browser";
+import { encodeAbiParameters, isAddressEqual, keccak256, recoverTypedDataAddress, toHex, } from "viem";
+import { publicKeyToAddress } from "viem/accounts";
+import { GrantRevokedError, SignedArtifactInvalidError, SignedArtifactMissingError, } from "../errors/catalog.js";
+const DOMAIN_TYPE = "DataPortabilityDomain(uint256 chainId,address verifyingContract)";
+const DOMAIN_TYPE_HASH = keccak256(toHex(DOMAIN_TYPE));
+function grantExpiryToUint256(value) {
+    if (value === null || value === "" || value === "0")
+        return "0";
+    if (/^\d+$/u.test(value))
+        return value;
+    const millis = Date.parse(value);
+    if (!Number.isNaN(millis))
+        return String(Math.floor(millis / 1000));
+    throw new SignedArtifactInvalidError({ artifact: "grant" });
+}
+export async function verifySignedArtifacts(input) {
+    // TODO(step-4): revokedAt is Gateway-attested; verify revocation on-chain (contract s1 step 6).
+    if (input.grant.revokedAt !== null) {
+        throw new GrantRevokedError({ grantId: input.grant.id });
+    }
+    if (!input.grant.signature || !input.builder.signature) {
+        throw new SignedArtifactMissingError();
+    }
+    let grant;
+    try {
+        grant = await verifyGrantRegistration({
+            gatewayConfig: input.gatewayConfig,
+            grantorAddress: input.grant.grantorAddress,
+            granteeId: input.grant.granteeId,
+            scopes: input.grant.scopes,
+            grantVersion: input.grant.grantVersion,
+            expiresAt: grantExpiryToUint256(input.grant.expiresAt),
+            signature: input.grant.signature,
+        });
+    }
+    catch {
+        throw new SignedArtifactInvalidError({ artifact: "grant" });
+    }
+    if (!grant.valid ||
+        !sameAddress(grant.grantorAddress, input.ownerAddress) ||
+        !sameAddress(grant.grantorAddress, input.grant.grantorAddress)) {
+        throw new SignedArtifactInvalidError({ artifact: "grant" });
+    }
+    let recoveredBuilder;
+    let publicKeyAddress;
+    let builderId;
+    try {
+        recoveredBuilder = await recoverTypedDataAddress({
+            domain: builderRegistrationDomain(input.gatewayConfig),
+            types: BUILDER_REGISTRATION_TYPES,
+            primaryType: "BuilderRegistration",
+            message: {
+                ownerAddress: input.builder.ownerAddress,
+                granteeAddress: input.builder.granteeAddress,
+                publicKey: input.builder.publicKey,
+                appUrl: input.builder.appUrl,
+            },
+            signature: input.builder.signature,
+        });
+        publicKeyAddress = publicKeyToAddress(input.builder.publicKey);
+        builderId = deriveBuilderId(input.builder, input.gatewayConfig);
+    }
+    catch {
+        throw new SignedArtifactInvalidError({ artifact: "builder" });
+    }
+    if (!sameAddress(recoveredBuilder, input.builder.ownerAddress) ||
+        !sameAddress(publicKeyAddress, input.builder.granteeAddress) ||
+        // id is not signed; rebinding it to the signed fields stops a Gateway from
+        // pairing an attacker's signed builder with the owner's grant.
+        builderId.toLowerCase() !== input.builder.id.toLowerCase() ||
+        builderId.toLowerCase() !== input.grant.granteeId.toLowerCase()) {
+        throw new SignedArtifactInvalidError({ artifact: "builder" });
+    }
+}
+export function deriveBuilderId(builder, gatewayConfig) {
+    const domain = builderRegistrationDomain(gatewayConfig);
+    if (domain.chainId === undefined || domain.verifyingContract === undefined) {
+        throw new Error("Builder registration domain is incomplete");
+    }
+    // Gateway/on-chain IDs use this custom domain separator, distinct from the
+    // standard EIP-712 domain hash used to verify the builder signature above.
+    const domainSeparator = keccak256(encodeAbiParameters([
+        { name: "typeHash", type: "bytes32" },
+        { name: "chainId", type: "uint256" },
+        { name: "verifyingContract", type: "address" },
+    ], [DOMAIN_TYPE_HASH, BigInt(domain.chainId), domain.verifyingContract]));
+    return keccak256(encodeAbiParameters([
+        { name: "domainSeparator", type: "bytes32" },
+        { name: "owner", type: "address" },
+        { name: "granteeAddress", type: "address" },
+        { name: "publicKey", type: "string" },
+        { name: "appUrl", type: "string" },
+    ], [
+        domainSeparator,
+        builder.ownerAddress,
+        builder.granteeAddress,
+        builder.publicKey,
+        builder.appUrl,
+    ]));
+}
+function sameAddress(left, right) {
+    try {
+        return isAddressEqual(left, right);
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=signed-artifacts.js.map

package/dist/policy/signed-artifacts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signed-artifacts.js","sourceRoot":"","sources":["../../src/policy/signed-artifacts.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,uBAAuB,GAIxB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,SAAS,EACT,uBAAuB,EACvB,KAAK,GAGN,MAAM,MAAM,CAAC;AACd,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EACL,iBAAiB,EACjB,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAK9B,MAAM,WAAW,GACf,kEAAkE,CAAC;AACrE,MAAM,gBAAgB,GAAG,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;AAEvD,SAAS,oBAAoB,CAAC,KAAoB;IAChD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE,IAAI,KAAK,KAAK,GAAG;QAAE,OAAO,GAAG,CAAC;IAChE,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAEvC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC;IAEpE,MAAM,IAAI,0BAA0B,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;AAC9D,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAA0B;IAE1B,gGAAgG;IAChG,IAAI,KAAK,CAAC,KAAK,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QACnC,MAAM,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACvD,MAAM,IAAI,0BAA0B,EAAE,CAAC;IACzC,CAAC;IAED,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,uBAAuB,CAAC;YACpC,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,cAAyB;YACrD,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAA0B;YACjD,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM;YAC1B,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,YAAY;YACtC,SAAS,EAAE,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC;YACtD,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAA0B;SAClD,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,0BAA0B,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,IACE,CAAC,KAAK,CAAC,KAAK;QACZ,CAAC,WAAW,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,YAAY,CAAC;QACtD,CAAC,WAAW,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,EAC9D,CAAC;QACD,MAAM,IAAI,0BAA0B,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,gBAAyB,CAAC;IAC9B,IAAI,gBAAyB,CAAC;IAC9B,IAAI,SAAc,CAAC;IACnB,IAAI,CAAC;QACH,gBAAgB,GAAG,MAAM,uBAAuB,CAAC;YAC/C,MAAM,EAAE,yBAAyB,CAAC,KAAK,CAAC,aAAa,CAAC;YACtD,KAAK,EAAE,0BAA0B;YACjC,WAAW,EAAE,qBAAqB;YAClC,OAAO,EAAE;gBACP,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,YAAuB;gBACnD,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,cAAyB;gBACvD,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;gBAClC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;aAC7B;YACD,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAA0B;SACpD,CAAC,CAAC;QACH,gBAAgB,GAAG,kBAAkB,CACnC,KAAK,CAAC,OAAO,CAAC,SAA0B,CACzC,CAAC;QACF,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,0BAA0B,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,IACE,CAAC,WAAW,CAAC,gBAAgB,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC;QAC1D,CAAC,WAAW,CAAC,gBAAgB,EAAE,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC;QAC5D,2EAA2E;QAC3E,+DAA+D;QAC/D,SAAS,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,WAAW,EAAE;QAC1D,SAAS,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,EAC/D,CAAC;QACD,MAAM,IAAI,0BAA0B,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,OAGC,EACD,aAA2C;IAE3C,MAAM,MAAM,GAAG,yBAAyB,CAAC,aAAa,CAAC,CAAC;IACxD,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,2EAA2E;IAC3E,2EAA2E;IAC3E,MAAM,eAAe,GAAG,SAAS,CAC/B,mBAAmB,CACjB;QACE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE;QACrC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE;QACpC,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE;KAC/C,EACD,CAAC,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,iBAAiB,CAAC,CACrE,CACF,CAAC;IAEF,OAAO,SAAS,CACd,mBAAmB,CACjB;QACE,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,SAAS,EAAE;QAC5C,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE;QAClC,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,SAAS,EAAE;QAC3C,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE;QACrC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE;KACnC,EACD;QACE,eAAe;QACf,OAAO,CAAC,YAAuB;QAC/B,OAAO,CAAC,cAAyB;QACjC,OAAO,CAAC,SAAS;QACjB,OAAO,CAAC,MAAM;KACf,CACF,CACF,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,KAAa;IAC9C,IAAI,CAAC;QACH,OAAO,cAAc,CAAC,IAAe,EAAE,KAAgB,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/ports/index.d.ts

@@ -1,4 +1,4 @@
-import type { Builder, DataFileEnvelope, FileListResult, FileRecord, GatewayGrantResponse, Schema, ServerInfo } from "@opendatalabs/vana-sdk/browser";
+import type { Builder, DataFileEnvelope, DataPointListResult, DataPointRecord, GatewayGrantResponse, ListDataPointsOptions, Schema, ServerInfo } from "@opendatalabs/vana-sdk/browser";
 import type { WriteResult } from "../storage/hierarchy/index.js";
 import type { DataBlockManifest, DataScopeBlock, ReadScopeBlocksResponse } from "../storage/blocks/index.js";
 import type { IndexEntry, NewIndexEntry, ScopeSummary } from "../storage/index/types.js";
@@ -7,8 +7,8 @@ export interface ProtocolGatewayPort {
     getGrant(grantId: string): Promise<GatewayGrantResponse | null>;
     getSchemaForScope(scope: string): Promise<Schema | null>;
     getServer(address: string): Promise<ServerInfo | null>;
-    getFile(fileId: string): Promise<FileRecord | null>;
-    listFilesSince(owner: string, cursor: string | null): Promise<FileListResult>;
+    getDataPoint(dataPointId: string): Promise<DataPointRecord | null>;
+    listDataPointsByOwner(owner: string, cursor: string | null, options?: ListDataPointsOptions): Promise<DataPointListResult>;
 }
 export interface GrantVerifierPort {
     getGrant(grantId: string): Promise<GatewayGrantResponse | null>;
@@ -16,25 +16,9 @@ export interface GrantVerifierPort {
 export interface AuthSessionVerifierPort {
     getBuilder(address: string): Promise<Builder | null>;
 }
-export interface SchemaResolverPort {
-    getSchemaForScope(scope: string): Promise<Schema | null>;
-}
-/** Result of registering (or idempotently resolving) a schema for a scope. */
-export interface RegisteredSchema {
-    schemaId: string;
-    definitionUrl: string;
-}
-/**
- * Registers a permissive "no-schema" schema for scopes that carry unstructured
- * data (e.g. binary blobs). Idempotent on scope at the gateway: registering an
- * already-registered scope returns its existing schemaId.
- */
-export interface SchemaRegistrarPort {
-    registerNoSchema(scope: string): Promise<RegisteredSchema>;
-}
 export interface FileRegistrySyncRegistryPort {
-    getFile(fileId: string): Promise<FileRecord | null>;
-    listFilesSince(owner: string, cursor: string | null): Promise<FileListResult>;
+    getDataPoint(dataPointId: string): Promise<DataPointRecord | null>;
+    listDataPointsByOwner(owner: string, cursor: string | null, options?: ListDataPointsOptions): Promise<DataPointListResult>;
 }
 export interface PlatformCryptoPort {
     randomBytes(length: number): Uint8Array;
@@ -67,6 +51,8 @@ export interface DataStoragePort extends RuntimeStoragePort {
     countVersions(scope: string): number;
     findEntry(lookup: DataStorageEntryLookup): IndexEntry | undefined;
     findByFileId(fileId: string): IndexEntry | undefined;
+    /** Dedup lookup for the download worker: find an entry by its DPv2 data-point id. */
+    findByDataPointId(dataPointId: string): IndexEntry | undefined;
     findUnsynced(options?: {
         limit?: number;
     }): IndexEntry[];
@@ -77,12 +63,35 @@ export interface DataStoragePort extends RuntimeStoragePort {
     readScopeBlocks?(scope: string, collectedAt: string, options: {
         cursor?: string;
         maxBytes: number;
+        /**
+         * Block-addressed read: return only these blocks, in this order. When
+         * set, `cursor` is ignored and no `nextCursor` is produced; `maxBytes`
+         * still applies and any ids it cuts off are reported as warnings.
+         */
+        blockIds?: readonly string[];
     }): Promise<ReadScopeBlocksResponse>;
+    /**
+     * Read a scope's block manifest (table of contents) without reading any block
+     * values. Returns null when the scope has no manifest yet.
+     */
+    readBlockManifest?(scope: string, collectedAt: string): Promise<DataBlockManifest | null>;
     hasScopeBlocks?(scope: string, collectedAt: string): boolean | Promise<boolean>;
+    canReadScopeBlocks?(scope: string, collectedAt: string): boolean | Promise<boolean>;
     writeEnvelope(envelope: DataFileEnvelope): Promise<WriteResult>;
     writeBlockManifest?(scope: string, collectedAt: string, manifest: DataBlockManifest, blocks: DataScopeBlock[]): Promise<void>;
     insertEntry(entry: NewIndexEntry): IndexEntry | Promise<IndexEntry>;
     updateFileId(path: string, fileId: string): boolean | Promise<boolean>;
+    /** Highest stored DPv2 `version` for a scope; 0 if none. */
+    findLatestVersionByScope(scope: string): number | Promise<number>;
+    /** Stamps the DPv2 dataPointId on an entry after registerDataPoint. */
+    updateDataPointId(path: string, dataPointId: string): boolean | Promise<boolean>;
+    /**
+     * Rewrites the DPv2 `version` on an entry. Used when the upload worker
+     * rebases a registration onto the registry's live version after a
+     * stale-expectedVersion conflict — the blob key embeds the version, so
+     * the local row must follow the registered one.
+     */
+    updateEntryVersion(path: string, version: number): boolean | Promise<boolean>;
     deleteScope(scope: string): Promise<number>;
     /**
      * Delete a single version (index entry + its local blob) by its gateway fileId.
@@ -90,23 +99,141 @@ export interface DataStoragePort extends RuntimeStoragePort {
      * Used by sync delete-reconciliation to drop a copy the gateway reports as deleted.
      */
     deleteByFileId(fileId: string): Promise<boolean>;
+    /**
+     * Delete a single version (index entry + its local blob + block sidecars)
+     * by its DPv2 identity (scope, collectedAt). Returns true if a local copy
+     * existed and was removed, false if none was present (no-op). Used by sync
+     * deletion reconciliation to drop the exact versions a gateway tombstone
+     * covers while leaving a newer local re-ingest in place.
+     */
+    deleteVersion(scope: string, collectedAt: string): Promise<boolean>;
+    /**
+     * Drop a single unsynced index entry by path, WITHOUT touching any blob.
+     * Used by the upload worker to evict an orphaned row whose local payload
+     * file is already gone (e.g. a manual `data/<scope>` deletion): the row can
+     * never upload, so retrying it head-blocks the scope forever. Returns true
+     * if a row was removed. No-op-safe when the path is unknown.
+     */
+    dropUnsyncedEntry?(path: string): boolean | Promise<boolean>;
 }
 export interface RuntimeAvailabilityPort {
     isAvailable(): boolean | Promise<boolean>;
 }
-export interface FeeVerificationInput {
-    grantId: string;
-    builderAddress: `0x${string}`;
-    requestedScope: string;
+/**
+ * A gateway data-point row as seen by sync, including the deletion marker the
+ * plain SDK `DataPointRecord` does not model. `deletedAt` is null while the
+ * point is live and an ISO timestamp once the owner has tombstoned it.
+ */
+export interface DataPointFeedRecord extends DataPointRecord {
+    deletedAt: string | null;
+}
+export interface DataPointFeedListOptions extends ListDataPointsOptions {
+    /**
+     * Ask the gateway to include tombstoned rows (with `deletedAt` set). Sync
+     * always passes true: deletions must reach every replica or the local copy
+     * would be re-uploaded and resurrect the point.
+     */
+    includeDeleted?: boolean;
+}
+export interface DataPointFeedListResult {
+    dataPoints: DataPointFeedRecord[];
+    cursor: string | null;
 }
-export type FeeVerificationResult = {
-    ok: true;
+/**
+ * Deletion-aware view of the gateway data-point registry. Mirrors the SDK
+ * `GatewayClient` listing/lookup shape but surfaces `deletedAt`, which the
+ * SDK client (3.14) neither requests (`includeDeleted`) nor types.
+ */
+export interface DataPointFeedPort {
+    listDataPointsByOwner(owner: string, cursor: string | null, options?: DataPointFeedListOptions): Promise<DataPointFeedListResult>;
+    /**
+     * Current registry row for (owner, scope), deleted or not. Null when the
+     * point was never registered. A tombstoned point comes back with
+     * `deletedAt` set (never as a thrown 410).
+     */
+    getDataPoint(input: {
+        ownerAddress: string;
+        scope: string;
+    }): Promise<DataPointFeedRecord | null>;
+}
+export type TombstoneOutcome = {
+    status: "tombstoned";
+    dataPointId: string;
+    /** The tombstone's own version (previous current + 1). */
+    version: string;
+    deletedAt: string | null;
 } | {
-    ok: false;
-    reason?: string;
+    status: "already-deleted";
+    dataPointId: string;
+    /**
+     * The winning tombstone's registry version as the gateway reports it
+     * (possibly higher than the version this replica attempted), or null
+     * when the gateway did not say. Null means the covered key range is
+     * unknown, so callers defer enumeration rather than guess.
+     */
+    version: string | null;
+    deletedAt: string | null;
+} | {
+    /** The gateway has no row for (owner, scope): nothing to tombstone. */
+    status: "not-registered";
+    dataPointId: string;
 };
-export interface FeeVerifierPort {
-    verifyDataReadFee(input: FeeVerificationInput): Promise<FeeVerificationResult>;
+export interface DeleteBlobVersionsOutcome {
+    /** Versions whose blob existed and was deleted. */
+    deleted: string[];
+    /** Versions with no blob in storage (404): nothing to do, counts as done. */
+    missing: string[];
+    /** Versions whose delete failed (rate limit, 5xx, network); retry later. */
+    failed: Array<{
+        version: string;
+        error: string;
+    }>;
+}
+/**
+ * Remote side of durable deletion. `tombstone` is the durable fact (an
+ * owner-signed AddData with the tombstone commitments, recorded by the
+ * gateway); `deleteBlobVersions` removes the ciphertext of exactly the given
+ * versions, one exact-key delete per version, never a scope-wide prefix: a
+ * re-add registered after the tombstone lives under a higher version key and
+ * is untouched by construction. Callers MUST run tombstone first: a blob
+ * delete without a tombstone leaves a live registry row every replica would
+ * 404 on and then wedge.
+ */
+export interface DeleteDataPort {
+    tombstone(scope: string): Promise<TombstoneOutcome>;
+    deleteBlobVersions(scope: string, versions: string[]): Promise<DeleteBlobVersionsOutcome>;
+}
+/**
+ * Blob deletion work still to do after a tombstone landed, in one of three
+ * shapes:
+ *   - an exact key: `{ scope, version }`;
+ *   - a contiguous version range `{ scope, version: null, range }` (both
+ *     bounds inclusive, decimal strings): the registry versions a tombstone
+ *     covers, kept as bounds so a large tombstone version never has to be
+ *     materialised key by key; passes take keys from the head and advance
+ *     `from`;
+ *   - an unexpanded marker `{ scope, version: null }` (no range): the gateway
+ *     did not report the tombstone's version, so the covered range is not
+ *     known yet; the retry expands it once the registry answers.
+ */
+export interface PendingBlobDeletion {
+    scope: string;
+    version: string | null;
+    range?: {
+        from: string;
+        to: string;
+    };
+}
+/**
+ * Durable retry marker for blob deletions that could not complete AFTER the
+ * gateway tombstone landed (storage failure, rate limit, or a batch larger
+ * than one pass may send). The tombstone already makes the deletion stick;
+ * this only exists so later sync cycles finish removing the ciphertext, key
+ * by key.
+ */
+export interface PendingBlobDeletionStore {
+    list(): Promise<PendingBlobDeletion[]>;
+    add(keys: PendingBlobDeletion[]): Promise<void>;
+    remove(keys: PendingBlobDeletion[]): Promise<void>;
 }
-export declare const allowAllFeeVerifier: FeeVerifierPort;
 //# sourceMappingURL=index.d.ts.map