@opendatalabs/vana-sdk 3.17.0 → 3.18.1

package/dist/index.browser.js

@@ -1349,6 +1349,27 @@ var LineageReadError = class extends VanaError {
   errorCode;
   details;
 };
+var DataPointDeletedError = class extends VanaError {
+  constructor(message, details = {}) {
+    super(message, "DATA_POINT_DELETED");
+    this.details = details;
+  }
+  details;
+};
+var DataPointNotFoundError = class extends VanaError {
+  constructor(message, details = {}) {
+    super(message, "DATA_POINT_NOT_FOUND");
+    this.details = details;
+  }
+  details;
+};
+var DataPointVersionConflictError = class extends VanaError {
+  constructor(message, details = {}) {
+    super(message, "DATA_POINT_VERSION_CONFLICT");
+    this.details = details;
+  }
+  details;
+};
 
 // src/contracts/contractController.ts
 import {
@@ -29111,6 +29132,22 @@ function getProtocolNetworkChainId(network) {
   return PROTOCOL_NETWORK_CHAIN_IDS[network];
 }
 
+// src/utils/response-body.ts
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+async function readJsonValue(res) {
+  try {
+    return await res.json();
+  } catch {
+    return null;
+  }
+}
+async function readJsonObject(res) {
+  const value = await readJsonValue(res);
+  return isPlainObject(value) ? value : {};
+}
+
 // src/storage/providers/vana-storage.ts
 var DEFAULT_ENDPOINT = "https://storage.vana.org";
 var LEGACY_BLOB_PATH_PREFIX = "/v1/blobs";
@@ -29282,6 +29319,65 @@ var VanaStorage = class {
     }
     return true;
   }
+  /**
+   * Delete every version's blob under `(owner, scope)` --
+   * `DELETE {prefix}/{owner}/{scope}` on vana-storage, signed with the same
+   * Web3Signed header as uploads (aud = endpoint origin, empty bodyHash).
+   * The worker accepts the owner's own signature or a personal server the
+   * owner registered with the gateway.
+   *
+   * @param ownerAddress - Must equal the provider's configured owner; a
+   *   mismatch throws before anything is signed so this wallet can never be
+   *   induced to sign a delete for another namespace.
+   * @param scope - The scope segment, e.g. `"instagram.profile"`.
+   */
+  async deleteScope(ownerAddress, scope) {
+    if (ownerAddress.toLowerCase() !== this.ownerAddress) {
+      throw new StorageError(
+        `deleteScope owner '${ownerAddress}' does not match the configured owner '${this.ownerAddress}'`,
+        "INVALID_OWNER",
+        "vana-storage"
+      );
+    }
+    if (scope.length === 0 || scope.includes("/") || isTraversalSegment(scope)) {
+      throw new StorageError(
+        `scope must be a single non-empty path segment, got '${scope}'`,
+        "INVALID_SCOPE",
+        "vana-storage"
+      );
+    }
+    const path = `${this.blobPathPrefix}/${this.ownerAddress}/${encodeURIComponent(scope)}`;
+    const header = await this.signRequest("DELETE", path);
+    let response;
+    try {
+      response = await this.fetchImpl(`${this.endpoint}${path}`, {
+        method: "DELETE",
+        headers: { authorization: header }
+      });
+    } catch (cause) {
+      throw new StorageError(
+        `vana-storage scope delete network error: ${describe(cause)}`,
+        "DELETE_ERROR",
+        "vana-storage",
+        { cause: cause instanceof Error ? cause : void 0 }
+      );
+    }
+    if (!response.ok) {
+      const responseText = await safeText(response);
+      throw new StorageError(
+        `vana-storage scope delete failed: ${response.status} ${response.statusText} - ${responseText}`,
+        "DELETE_FAILED",
+        "vana-storage"
+      );
+    }
+    const body = await readJsonObject(response);
+    return {
+      deleted: typeof body["deleted"] === "boolean" ? body["deleted"] : true,
+      scope: typeof body["scope"] === "string" ? body["scope"] : scope,
+      count: nonNegativeInteger(body["count"]) ?? 0,
+      totalBytes: nonNegativeInteger(body["totalBytes"]) ?? 0
+    };
+  }
   getConfig() {
     return {
       name: "vana-storage",
@@ -29410,6 +29506,12 @@ function encodeRelativePath(filename) {
   }
   return parts.map((p) => encodeURIComponent(p)).join("/");
 }
+function isTraversalSegment(segment) {
+  return segment === "." || segment === "..";
+}
+function nonNegativeInteger(value) {
+  return typeof value === "number" && Number.isInteger(value) && value >= 0 ? value : void 0;
+}
 function describe(value) {
   if (value instanceof Error) return value.message;
   return String(value);
@@ -32905,266 +33007,13 @@ function buildMarkDataPointUnavailableRequest(config, input) {
   });
 }
 
-// src/protocol/data-file.ts
-import { z } from "zod";
-var DataFileEnvelopeSchema = z.object({
-  $schema: z.string().url().optional(),
-  version: z.literal("1.0"),
-  scope: z.string(),
-  schemaId: z.string().optional(),
-  collectedAt: z.string().datetime(),
-  data: z.record(z.string(), z.unknown())
-});
-function createDataFileEnvelope(scope, collectedAt, data, schemaUrl, schemaId) {
-  return {
-    ...schemaUrl !== void 0 && { $schema: schemaUrl },
-    ...schemaId !== void 0 && { schemaId },
-    version: "1.0",
-    scope,
-    collectedAt,
-    data
-  };
-}
-var IngestResponseSchema = z.object({
-  scope: z.string(),
-  collectedAt: z.string().datetime(),
-  status: z.enum(["stored", "syncing"])
-});
-
-// src/protocol/personal-server-data.ts
-function personalServerDataReadPath(scope) {
-  return `/v1/data/${encodeURIComponent(scope)}`;
-}
-async function buildPersonalServerDataReadRequest(params) {
-  const path = personalServerDataReadPath(params.scope);
-  const baseUrl = params.personalServerUrl.replace(/\/+$/, "");
-  const audience = params.audience ?? baseUrl;
-  const headers = new Headers(params.headers);
-  headers.set(
-    "Authorization",
-    await buildWeb3SignedHeader({
-      aud: audience,
-      grantId: params.grantId,
-      method: "GET",
-      signMessage: params.signMessage,
-      uri: path
-    })
-  );
-  return new Request(`${baseUrl}${path}`, {
-    headers,
-    method: "GET"
-  });
-}
-async function readPersonalServerData(params) {
-  const fetchFn = params.fetch ?? globalThis.fetch;
-  if (fetchFn === void 0) {
-    throw new Error("No fetch implementation available");
-  }
-  const request = await buildPersonalServerDataReadRequest(params);
-  const response = await fetchFn(request);
-  if (!response.ok) {
-    throw new Error(
-      `Personal Server data read failed: ${response.status} ${response.statusText}`
-    );
-  }
-  return DataFileEnvelopeSchema.parse(await response.json());
-}
-
-// src/protocol/scopes.ts
-import { z as z2 } from "zod";
-var SOURCE_RE = /^[a-z0-9][a-z0-9_]*$/;
-var TAIL_SEGMENT_RE = /^[a-zA-Z0-9][a-zA-Z0-9_]*$/;
-var ScopeSchema = z2.string().refine(
-  (scope) => {
-    const parts = scope.split(".");
-    if (parts.length < 2 || parts.length > 3) return false;
-    const [source, ...tail] = parts;
-    return SOURCE_RE.test(source) && tail.every((part) => TAIL_SEGMENT_RE.test(part));
-  },
-  {
-    message: "Scope must be {source}.{category}[.{subcategory}]; source lowercase, tail may keep the historical camelCase form (e.g. spotify.savedTracks)"
-  }
-);
-function parseScope(scope) {
-  const validated = ScopeSchema.parse(scope);
-  const parts = validated.split(".");
-  return {
-    source: parts[0],
-    category: parts[1],
-    subcategory: parts[2],
-    raw: validated
-  };
-}
-function scopeToPathSegments(scope) {
-  const parsed = parseScope(scope);
-  const segments = [parsed.source, parsed.category];
-  if (parsed.subcategory) {
-    segments.push(parsed.subcategory);
-  }
-  return segments;
-}
-function scopeMatchesPattern(requestedScope, grantPattern) {
-  if (grantPattern === "*") return true;
-  if (grantPattern.endsWith(".*")) {
-    const prefix = grantPattern.slice(0, -1);
-    return requestedScope.startsWith(prefix);
-  }
-  return requestedScope === grantPattern;
-}
-function scopeCoveredByGrant(requestedScope, grantedScopes) {
-  return grantedScopes.some(
-    (pattern) => scopeMatchesPattern(requestedScope, pattern)
-  );
-}
-
-// src/protocol/scope-actions.ts
-var SCOPE_ACTIONS = ["read", "write"];
-var InvalidScopeEntryError = class extends Error {
-  /** The offending entry, verbatim (unknown because it may not be a string). */
-  entry;
-  constructor(entry, reason) {
-    super(`Invalid scope entry ${describeValue(entry)}: ${reason}`);
-    this.name = "InvalidScopeEntryError";
-    this.entry = entry;
-  }
-};
-var OPERATION_SEPARATOR = ":";
-function describeValue(value) {
-  if (typeof value === "string") return JSON.stringify(value);
-  if (value === null) return "null";
-  return `[${typeof value}]`;
-}
-var OPERATION_BY_PREFIX = {
-  write: "write"
-};
-function assertScopePart(entry, scope) {
-  if (scope.length === 0) {
-    throw new InvalidScopeEntryError(entry, "scope part is empty");
-  }
-  if (scope.includes(OPERATION_SEPARATOR)) {
-    throw new InvalidScopeEntryError(
-      entry,
-      `scope part must not contain "${OPERATION_SEPARATOR}"`
-    );
-  }
-}
-function parseScopeEntry(entry) {
-  const raw = entry;
-  if (typeof raw !== "string") {
-    throw new InvalidScopeEntryError(raw, "entry must be a string");
-  }
-  const separatorIndex = entry.indexOf(OPERATION_SEPARATOR);
-  if (separatorIndex === -1) {
-    assertScopePart(entry, entry);
-    return { scope: entry, action: "read" };
-  }
-  const prefix = entry.slice(0, separatorIndex);
-  const scope = entry.slice(separatorIndex + 1);
-  const action = Object.hasOwn(OPERATION_BY_PREFIX, prefix) ? OPERATION_BY_PREFIX[prefix] : void 0;
-  if (action === void 0) {
-    throw new InvalidScopeEntryError(
-      entry,
-      `unknown operation "${prefix}" (known: ${Object.keys(OPERATION_BY_PREFIX).join(", ")}; read has no prefix)`
-    );
-  }
-  assertScopePart(entry, scope);
-  return { scope, action };
-}
-function formatScopeEntry(parsed) {
-  const { scope, action } = parsed;
-  assertScopePart(scope, scope);
-  if (action === "read") return scope;
-  const prefix = Object.entries(OPERATION_BY_PREFIX).find(
-    ([, candidate]) => candidate === action
-  )?.[0];
-  if (prefix === void 0) {
-    throw new InvalidScopeEntryError(
-      scope,
-      `unknown action ${describeValue(action)} (known: ${SCOPE_ACTIONS.join(", ")})`
-    );
-  }
-  return `${prefix}${OPERATION_SEPARATOR}${scope}`;
-}
-function compareScopes(a, b) {
-  if (a < b) return -1;
-  if (a > b) return 1;
-  return 0;
-}
-function sortActions(actions) {
-  const present = new Set(actions);
-  return SCOPE_ACTIONS.filter((action) => present.has(action));
-}
-function grantPermissions(scopes) {
-  const byScope = /* @__PURE__ */ new Map();
-  for (const entry of scopes) {
-    const { scope, action } = parseScopeEntry(entry);
-    let actions = byScope.get(scope);
-    if (actions === void 0) {
-      actions = /* @__PURE__ */ new Set();
-      byScope.set(scope, actions);
-    }
-    actions.add(action);
-  }
-  return [...byScope.keys()].sort(compareScopes).map((scope) => ({
-    scope,
-    actions: sortActions(byScope.get(scope) ?? [])
-  }));
-}
-function permissionsToScopes(permissions) {
-  const byScope = /* @__PURE__ */ new Map();
-  for (const { scope, actions } of permissions) {
-    let merged = byScope.get(scope);
-    if (merged === void 0) {
-      merged = /* @__PURE__ */ new Set();
-      byScope.set(scope, merged);
-    }
-    for (const action of actions) {
-      if (!SCOPE_ACTIONS.includes(action)) {
-        throw new InvalidScopeEntryError(
-          scope,
-          `unknown action ${describeValue(action)} (known: ${SCOPE_ACTIONS.join(", ")})`
-        );
-      }
-      merged.add(action);
-    }
-  }
-  const entries = [];
-  for (const scope of [...byScope.keys()].sort(compareScopes)) {
-    for (const action of sortActions(byScope.get(scope) ?? [])) {
-      entries.push(formatScopeEntry({ scope, action }));
-    }
-  }
-  return entries;
-}
-function hasAction(scopes, scope, action) {
-  if (scope.includes(OPERATION_SEPARATOR)) return false;
-  for (const entry of scopes) {
-    let parsed;
-    try {
-      parsed = parseScopeEntry(entry);
-    } catch (error) {
-      if (error instanceof InvalidScopeEntryError) continue;
-      throw error;
-    }
-    if (parsed.action === action && scopeMatchesPattern(scope, parsed.scope)) {
-      return true;
-    }
-  }
-  return false;
-}
-function tryGrantPermissions(scopes) {
-  try {
-    return grantPermissions(scopes);
-  } catch (error) {
-    if (error instanceof InvalidScopeEntryError) return void 0;
-    throw error;
-  }
-}
-
-// src/protocol/personal-server-write.ts
-import { sha256 as sha2565 } from "@noble/hashes/sha2";
-import { bytesToHex as bytesToHex2, isAddress as isAddress5 } from "viem";
-import { z as z4 } from "zod";
+// src/protocol/data-point-deletion.ts
+import {
+  isAddress as isAddress5,
+  keccak256 as keccak2562,
+  maxUint256,
+  stringToBytes as stringToBytes3
+} from "viem";
 
 // src/protocol/lineage.ts
 import {
@@ -33172,7 +33021,7 @@ import {
   isAddress as isAddress4,
   keccak256
 } from "viem";
-import { z as z3 } from "zod";
+import { z } from "zod";
 
 // src/protocol/personal-server-error-body.ts
 function isRecord2(value) {
@@ -33264,10 +33113,10 @@ function deriveDataPointId(ownerAddress, scope) {
     )
   );
 }
-var DataPointIdSchema = z3.string().regex(DATA_POINT_ID_PATTERN).transform((value) => value.toLowerCase());
+var DataPointIdSchema = z.string().regex(DATA_POINT_ID_PATTERN).transform((value) => value.toLowerCase());
 var VERSION_PATTERN = /^[1-9]\d*$/;
 var NODE_VERSION_PATTERN = /^(0|[1-9]\d*)$/;
-var VersionSchema = z3.union([z3.string(), z3.number()]).transform(String).refine((value) => NODE_VERSION_PATTERN.test(value), {
+var VersionSchema = z.union([z.string(), z.number()]).transform(String).refine((value) => NODE_VERSION_PATTERN.test(value), {
   message: "version must be a decimal integer"
 });
 var ViewVersionSchema = VersionSchema.refine(
@@ -33291,44 +33140,49 @@ function assertDerivedScopeNaming(derivedScope, sourceScopes) {
     }
   }
 }
-var LineageNodeSchema = z3.object({
+var LineageNodeSchema = z.object({
   dataPointId: DataPointIdSchema,
-  scope: z3.string(),
+  scope: z.string(),
   /**
    * The node's current version, decimal string; `"0"` for a source that no
    * longer resolves to a registered data point.
    */
   version: VersionSchema,
   /** The node's tombstone time, or `null` when live. */
-  deletedAt: z3.string().nullable()
+  deletedAt: z.string().nullable(),
+  /**
+   * Never present on a visible node. Declared so a node that carries
+   * `redacted: true` next to an id, scope and version cannot slip through
+   * this branch of {@link LineageEntrySchema} with the key stripped.
+   */
+  redacted: z.never().optional()
 });
-var RedactedLineageNodeSchema = z3.object({
-  dataPointId: DataPointIdSchema,
-  redacted: z3.literal(true)
+var RedactedLineageNodeSchema = z.strictObject({
+  redacted: z.literal(true)
 });
-var LineageEntrySchema = z3.union([
+var LineageEntrySchema = z.union([
   RedactedLineageNodeSchema,
   LineageNodeSchema
 ]);
-var LineageGraphSchema = z3.object({
+var LineageGraphSchema = z.object({
   dataPointId: DataPointIdSchema,
   /** The data point owner; every node in the view belongs to it. */
-  ownerAddress: z3.string().optional(),
-  scope: z3.string(),
+  ownerAddress: z.string().optional(),
+  scope: z.string(),
   /**
    * The derived record's version whose lineage is shown: the requested one,
    * else the current one, else (current is a tombstone) the last version
    * that carried lineage.
    */
   version: ViewVersionSchema,
-  deletedAt: z3.string().nullable(),
-  sources: z3.array(LineageEntrySchema),
-  derivatives: z3.array(LineageEntrySchema),
+  deletedAt: z.string().nullable(),
+  sources: z.array(LineageEntrySchema),
+  derivatives: z.array(LineageEntrySchema),
   /** `true` when `derivatives` was cut at the server's cap (1000). */
-  derivativesTruncated: z3.boolean().optional()
+  derivativesTruncated: z.boolean().optional()
 });
 function isRedactedLineageNode(entry) {
-  return "redacted" in entry && entry.redacted === true;
+  return "redacted" in entry && entry.redacted === true && Object.keys(entry).length === 1;
 }
 function personalServerLineagePath(scope, version) {
   return `/v1/data/${encodeURIComponent(scope)}/lineage${version === void 0 ? "" : `/${String(version)}`}`;
@@ -33470,7 +33324,449 @@ function getLineage(params) {
   return "personalServerUrl" in params ? getPersonalServerLineage(params) : getGatewayLineage(params);
 }
 
+// src/protocol/data-point-deletion.ts
+var TOMBSTONE_DATA_HASH_PREIMAGE = "vana.data-point.tombstone.v1";
+var TOMBSTONE_METADATA_HASH_PREIMAGE = "vana.data-point.tombstone.metadata.v1";
+var TOMBSTONE_DATA_HASH = "0x30c45ee72fe56d1927701316925ab7ceacd3b6f9267061735d59396f075c6222";
+var TOMBSTONE_METADATA_HASH = "0xc5255a141acd6a2ae55971b62c0a85977c2511989dc114ad2abc2b7644f57d90";
+function computeTombstoneHash(preimage) {
+  return keccak2562(stringToBytes3(preimage));
+}
+function isTombstoneHashes(dataHash, metadataHash) {
+  return typeof dataHash === "string" && typeof metadataHash === "string" && dataHash.toLowerCase() === TOMBSTONE_DATA_HASH && metadataHash.toLowerCase() === TOMBSTONE_METADATA_HASH;
+}
+function isDataPointTombstone(value) {
+  if (!isPlainObject(value)) return false;
+  if (typeof value["deletedAt"] === "string") return true;
+  return isTombstoneHashes(
+    typeof value["dataHash"] === "string" ? value["dataHash"] : void 0,
+    typeof value["metadataHash"] === "string" ? value["metadataHash"] : void 0
+  );
+}
+function tombstoneDeletedAt(value) {
+  if (!isPlainObject(value)) return null;
+  const deletedAt = value["deletedAt"];
+  return typeof deletedAt === "string" ? deletedAt : null;
+}
+function assertAddress4(value, name) {
+  if (!isAddress5(value)) {
+    throw new Error(`${name} must be a valid EVM address`);
+  }
+}
+function assertUint256(value, name) {
+  if (value < 0n || value > maxUint256) {
+    throw new Error(`${name} must fit in uint256, got ${value}`);
+  }
+}
+function getAccountAddress3(account) {
+  if (!account) return void 0;
+  return typeof account === "string" ? account : account.address;
+}
+function isDataPointDeletionSigner(source) {
+  return "address" in source && typeof source.signTypedData === "function";
+}
+function createViemDataPointDeletionSigner(source, options = {}) {
+  if (isDataPointDeletionSigner(source)) {
+    return source;
+  }
+  const accountAddress2 = getAccountAddress3(options.account) ?? getAccountAddress3(source.account);
+  if (accountAddress2) {
+    return {
+      address: accountAddress2,
+      signTypedData: (typedData) => source.signTypedData({
+        ...typedData,
+        account: options.account ?? source.account ?? accountAddress2
+      })
+    };
+  }
+  throw new Error(
+    "Viem wallet client requires an account option or account property"
+  );
+}
+function buildDataPointDeletionTypedData(input) {
+  assertAddress4(input.ownerAddress, "ownerAddress");
+  if (input.scope.length === 0) {
+    throw new Error("scope must be a non-empty string");
+  }
+  if (input.expectedVersion <= 0n) {
+    throw new Error("expectedVersion must be a positive version number");
+  }
+  assertUint256(input.expectedVersion, "expectedVersion");
+  return {
+    domain: dataRegistryDomain(input.config),
+    types: ADD_DATA_TYPES,
+    primaryType: "AddData",
+    message: {
+      ownerAddress: input.ownerAddress,
+      scope: input.scope,
+      dataHash: TOMBSTONE_DATA_HASH,
+      metadataHash: TOMBSTONE_METADATA_HASH,
+      expectedVersion: input.expectedVersion
+    }
+  };
+}
+async function buildDataPointDeletionSignature(input) {
+  const typedData = buildDataPointDeletionTypedData({
+    ownerAddress: input.signer.address,
+    scope: input.scope,
+    expectedVersion: input.expectedVersion,
+    config: input.config
+  });
+  const signature = await input.signer.signTypedData(typedData);
+  return {
+    signature,
+    signerAddress: input.signer.address,
+    typedData
+  };
+}
+function toError(value) {
+  return value instanceof Error ? value : new Error(String(value));
+}
+function parseExpectedVersion(value) {
+  if (typeof value !== "string" || !/^\d+$/.test(value)) {
+    throw new Error(
+      `Gateway returned a malformed expectedVersion: ${JSON.stringify(value)}`
+    );
+  }
+  const parsed = BigInt(value);
+  assertUint256(parsed, "Gateway expectedVersion");
+  return parsed;
+}
+async function deleteDataPoint(input) {
+  const ownerAddress = input.signer.address;
+  const dataPointId = deriveDataPointId(ownerAddress, input.scope);
+  let currentVersion = input.currentVersion;
+  if (currentVersion === void 0) {
+    const record = await input.gateway.getDataPoint(dataPointId);
+    if (record === null) {
+      throw new DataPointNotFoundError(
+        `No data point registered for scope '${input.scope}' owned by ${ownerAddress}`,
+        { dataPointId, scope: input.scope, ownerAddress }
+      );
+    }
+    if (isDataPointTombstone(record)) {
+      throw new DataPointDeletedError(
+        `Data point ${dataPointId} (scope '${input.scope}') is already deleted`,
+        {
+          dataPointId,
+          scope: input.scope,
+          ownerAddress,
+          deletedAt: tombstoneDeletedAt(record)
+        }
+      );
+    }
+    currentVersion = parseExpectedVersion(record.expectedVersion);
+  }
+  if (currentVersion < 0n || currentVersion >= maxUint256) {
+    throw new Error(
+      `currentVersion ${currentVersion} cannot be incremented to a uint256 tombstone version`
+    );
+  }
+  const tombstoneVersion = currentVersion + 1n;
+  const signed = await buildDataPointDeletionSignature({
+    signer: input.signer,
+    scope: input.scope,
+    expectedVersion: tombstoneVersion,
+    config: input.config
+  });
+  const tombstone = await input.gateway.deleteDataPoint({
+    ownerAddress,
+    scope: input.scope,
+    expectedVersion: tombstoneVersion.toString(),
+    signature: signed.signature
+  });
+  const base = {
+    dataPointId,
+    ownerAddress,
+    scope: input.scope,
+    version: tombstoneVersion.toString(),
+    signature: signed.signature,
+    tombstone
+  };
+  try {
+    const storage = await input.storage.deleteScope(ownerAddress, input.scope);
+    return { ...base, status: "deleted", storage };
+  } catch (cause) {
+    return { ...base, status: "partial", storageError: toError(cause) };
+  }
+}
+
+// src/protocol/data-file.ts
+import { z as z2 } from "zod";
+var DataFileEnvelopeSchema = z2.object({
+  $schema: z2.string().url().optional(),
+  version: z2.literal("1.0"),
+  scope: z2.string(),
+  schemaId: z2.string().optional(),
+  collectedAt: z2.string().datetime(),
+  data: z2.record(z2.string(), z2.unknown())
+});
+function createDataFileEnvelope(scope, collectedAt, data, schemaUrl, schemaId) {
+  return {
+    ...schemaUrl !== void 0 && { $schema: schemaUrl },
+    ...schemaId !== void 0 && { schemaId },
+    version: "1.0",
+    scope,
+    collectedAt,
+    data
+  };
+}
+var IngestResponseSchema = z2.object({
+  scope: z2.string(),
+  collectedAt: z2.string().datetime(),
+  status: z2.enum(["stored", "syncing"])
+});
+
+// src/protocol/personal-server-data.ts
+function personalServerDataReadPath(scope) {
+  return `/v1/data/${encodeURIComponent(scope)}`;
+}
+async function buildPersonalServerDataReadRequest(params) {
+  const path = personalServerDataReadPath(params.scope);
+  const baseUrl = params.personalServerUrl.replace(/\/+$/, "");
+  const audience = params.audience ?? baseUrl;
+  const headers = new Headers(params.headers);
+  headers.set(
+    "Authorization",
+    await buildWeb3SignedHeader({
+      aud: audience,
+      grantId: params.grantId,
+      method: "GET",
+      signMessage: params.signMessage,
+      uri: path
+    })
+  );
+  return new Request(`${baseUrl}${path}`, {
+    headers,
+    method: "GET"
+  });
+}
+async function readPersonalServerData(params) {
+  const fetchFn = params.fetch ?? globalThis.fetch;
+  if (fetchFn === void 0) {
+    throw new Error("No fetch implementation available");
+  }
+  const request = await buildPersonalServerDataReadRequest(params);
+  const response = await fetchFn(request);
+  if (response.status === 410) {
+    throw new DataPointDeletedError(
+      `Personal Server scope '${params.scope}' has been deleted`,
+      {
+        scope: params.scope,
+        deletedAt: tombstoneDeletedAt(await readJsonValue(response))
+      }
+    );
+  }
+  if (!response.ok) {
+    throw new Error(
+      `Personal Server data read failed: ${response.status} ${response.statusText}`
+    );
+  }
+  const body = await response.json();
+  if (isDataPointTombstone(body)) {
+    throw new DataPointDeletedError(
+      `Personal Server scope '${params.scope}' has been deleted`,
+      { scope: params.scope, deletedAt: tombstoneDeletedAt(body) }
+    );
+  }
+  return DataFileEnvelopeSchema.parse(body);
+}
+
+// src/protocol/scopes.ts
+import { z as z3 } from "zod";
+var SOURCE_RE = /^[a-z0-9][a-z0-9_]*$/;
+var TAIL_SEGMENT_RE = /^[a-zA-Z0-9][a-zA-Z0-9_]*$/;
+var ScopeSchema = z3.string().refine(
+  (scope) => {
+    const parts = scope.split(".");
+    if (parts.length < 2 || parts.length > 3) return false;
+    const [source, ...tail] = parts;
+    return SOURCE_RE.test(source) && tail.every((part) => TAIL_SEGMENT_RE.test(part));
+  },
+  {
+    message: "Scope must be {source}.{category}[.{subcategory}]; source lowercase, tail may keep the historical camelCase form (e.g. spotify.savedTracks)"
+  }
+);
+function parseScope(scope) {
+  const validated = ScopeSchema.parse(scope);
+  const parts = validated.split(".");
+  return {
+    source: parts[0],
+    category: parts[1],
+    subcategory: parts[2],
+    raw: validated
+  };
+}
+function scopeToPathSegments(scope) {
+  const parsed = parseScope(scope);
+  const segments = [parsed.source, parsed.category];
+  if (parsed.subcategory) {
+    segments.push(parsed.subcategory);
+  }
+  return segments;
+}
+function scopeMatchesPattern(requestedScope, grantPattern) {
+  if (grantPattern === "*") return true;
+  if (grantPattern.endsWith(".*")) {
+    const prefix = grantPattern.slice(0, -1);
+    return requestedScope.startsWith(prefix);
+  }
+  return requestedScope === grantPattern;
+}
+function scopeCoveredByGrant(requestedScope, grantedScopes) {
+  return grantedScopes.some(
+    (pattern) => scopeMatchesPattern(requestedScope, pattern)
+  );
+}
+
+// src/protocol/scope-actions.ts
+var SCOPE_ACTIONS = ["read", "write"];
+var InvalidScopeEntryError = class extends Error {
+  /** The offending entry, verbatim (unknown because it may not be a string). */
+  entry;
+  constructor(entry, reason) {
+    super(`Invalid scope entry ${describeValue(entry)}: ${reason}`);
+    this.name = "InvalidScopeEntryError";
+    this.entry = entry;
+  }
+};
+var OPERATION_SEPARATOR = ":";
+function describeValue(value) {
+  if (typeof value === "string") return JSON.stringify(value);
+  if (value === null) return "null";
+  return `[${typeof value}]`;
+}
+var OPERATION_BY_PREFIX = {
+  write: "write"
+};
+function assertScopePart(entry, scope) {
+  if (scope.length === 0) {
+    throw new InvalidScopeEntryError(entry, "scope part is empty");
+  }
+  if (scope.includes(OPERATION_SEPARATOR)) {
+    throw new InvalidScopeEntryError(
+      entry,
+      `scope part must not contain "${OPERATION_SEPARATOR}"`
+    );
+  }
+}
+function parseScopeEntry(entry) {
+  const raw = entry;
+  if (typeof raw !== "string") {
+    throw new InvalidScopeEntryError(raw, "entry must be a string");
+  }
+  const separatorIndex = entry.indexOf(OPERATION_SEPARATOR);
+  if (separatorIndex === -1) {
+    assertScopePart(entry, entry);
+    return { scope: entry, action: "read" };
+  }
+  const prefix = entry.slice(0, separatorIndex);
+  const scope = entry.slice(separatorIndex + 1);
+  const action = Object.hasOwn(OPERATION_BY_PREFIX, prefix) ? OPERATION_BY_PREFIX[prefix] : void 0;
+  if (action === void 0) {
+    throw new InvalidScopeEntryError(
+      entry,
+      `unknown operation "${prefix}" (known: ${Object.keys(OPERATION_BY_PREFIX).join(", ")}; read has no prefix)`
+    );
+  }
+  assertScopePart(entry, scope);
+  return { scope, action };
+}
+function formatScopeEntry(parsed) {
+  const { scope, action } = parsed;
+  assertScopePart(scope, scope);
+  if (action === "read") return scope;
+  const prefix = Object.entries(OPERATION_BY_PREFIX).find(
+    ([, candidate]) => candidate === action
+  )?.[0];
+  if (prefix === void 0) {
+    throw new InvalidScopeEntryError(
+      scope,
+      `unknown action ${describeValue(action)} (known: ${SCOPE_ACTIONS.join(", ")})`
+    );
+  }
+  return `${prefix}${OPERATION_SEPARATOR}${scope}`;
+}
+function compareScopes(a, b) {
+  if (a < b) return -1;
+  if (a > b) return 1;
+  return 0;
+}
+function sortActions(actions) {
+  const present = new Set(actions);
+  return SCOPE_ACTIONS.filter((action) => present.has(action));
+}
+function grantPermissions(scopes) {
+  const byScope = /* @__PURE__ */ new Map();
+  for (const entry of scopes) {
+    const { scope, action } = parseScopeEntry(entry);
+    let actions = byScope.get(scope);
+    if (actions === void 0) {
+      actions = /* @__PURE__ */ new Set();
+      byScope.set(scope, actions);
+    }
+    actions.add(action);
+  }
+  return [...byScope.keys()].sort(compareScopes).map((scope) => ({
+    scope,
+    actions: sortActions(byScope.get(scope) ?? [])
+  }));
+}
+function permissionsToScopes(permissions) {
+  const byScope = /* @__PURE__ */ new Map();
+  for (const { scope, actions } of permissions) {
+    let merged = byScope.get(scope);
+    if (merged === void 0) {
+      merged = /* @__PURE__ */ new Set();
+      byScope.set(scope, merged);
+    }
+    for (const action of actions) {
+      if (!SCOPE_ACTIONS.includes(action)) {
+        throw new InvalidScopeEntryError(
+          scope,
+          `unknown action ${describeValue(action)} (known: ${SCOPE_ACTIONS.join(", ")})`
+        );
+      }
+      merged.add(action);
+    }
+  }
+  const entries = [];
+  for (const scope of [...byScope.keys()].sort(compareScopes)) {
+    for (const action of sortActions(byScope.get(scope) ?? [])) {
+      entries.push(formatScopeEntry({ scope, action }));
+    }
+  }
+  return entries;
+}
+function hasAction(scopes, scope, action) {
+  if (scope.includes(OPERATION_SEPARATOR)) return false;
+  for (const entry of scopes) {
+    let parsed;
+    try {
+      parsed = parseScopeEntry(entry);
+    } catch (error) {
+      if (error instanceof InvalidScopeEntryError) continue;
+      throw error;
+    }
+    if (parsed.action === action && scopeMatchesPattern(scope, parsed.scope)) {
+      return true;
+    }
+  }
+  return false;
+}
+function tryGrantPermissions(scopes) {
+  try {
+    return grantPermissions(scopes);
+  } catch (error) {
+    if (error instanceof InvalidScopeEntryError) return void 0;
+    throw error;
+  }
+}
+
 // src/protocol/personal-server-write.ts
+import { sha256 as sha2565 } from "@noble/hashes/sha2";
+import { bytesToHex as bytesToHex2, isAddress as isAddress6 } from "viem";
+import { z as z4 } from "zod";
 var WRITE_SESSION_PATH = "/v1/write/session";
 var WRITE_SIGNATURE_HEADER = "X-Vana-Write-Signature";
 var WRITE_METADATA_HEADER = "X-Vana-Metadata";
@@ -33773,7 +34069,7 @@ function normalizeLineage(lineage, derivedScope) {
   for (const entry of lineage) {
     let id;
     if (isLineagePair(entry)) {
-      if (!isAddress5(entry.ownerAddress, { strict: false })) {
+      if (!isAddress6(entry.ownerAddress, { strict: false })) {
         throw new WriteRequestError(
           "lineage source ownerAddress must be an EVM address",
           { ownerAddress: entry.ownerAddress }
@@ -34035,14 +34331,44 @@ function withGrantPermissions(grant) {
 }
 function createGatewayClient(baseUrl) {
   const base = baseUrl.replace(/\/+$/, "");
+  function malformedBody(res) {
+    return new Error(
+      `Gateway error: ${res.status} malformed response body (expected a JSON envelope)`
+    );
+  }
+  async function readEnvelope(res) {
+    const envelope = await readJsonValue(res);
+    if (!isPlainObject(envelope) || !("data" in envelope)) {
+      throw malformedBody(res);
+    }
+    return envelope;
+  }
   async function unwrapEnvelope(res) {
-    const envelope = await res.json();
-    return envelope.data;
+    return (await readEnvelope(res)).data;
   }
   function getMutationId(body, key) {
+    if (!isPlainObject(body)) return void 0;
     const value = body[key] ?? body["id"];
     return typeof value === "string" ? value : void 0;
   }
+  async function readBody(res) {
+    const raw = await readJsonObject(res);
+    const data = raw["data"];
+    if (isPlainObject(data) && "proof" in raw) {
+      return data;
+    }
+    return raw;
+  }
+  function stringOrUndefined(value) {
+    return typeof value === "string" ? value : void 0;
+  }
+  async function deletedError(res, details) {
+    const body = await readBody(res);
+    return new DataPointDeletedError(
+      `Data point ${details.dataPointId ?? details.scope ?? ""} has been deleted`,
+      { ...details, deletedAt: tombstoneDeletedAt(body) }
+    );
+  }
   return {
     async isRegisteredBuilder(address) {
       const builder = await this.getBuilder(address);
@@ -34099,13 +34425,29 @@ function createGatewayClient(baseUrl) {
       }
       return await res.json();
     },
-    async getDataPoint(dataPointId) {
-      const res = await fetch(`${base}/v1/data/${dataPointId}`);
+    async getDataPoint(dataPointId, options) {
+      const query = options?.includeDeleted ? "?includeDeleted=true" : "";
+      const res = await fetch(`${base}/v1/data/${dataPointId}${query}`);
       if (res.status === 404) return null;
+      if (res.status === 410) {
+        throw await deletedError(res, { dataPointId });
+      }
       if (!res.ok) {
         throw new Error(`Gateway error: ${res.status} ${res.statusText}`);
       }
-      return unwrapEnvelope(res);
+      const record = await unwrapEnvelope(res);
+      if (!options?.includeDeleted && isDataPointTombstone(record)) {
+        throw new DataPointDeletedError(
+          `Data point ${dataPointId} has been deleted`,
+          {
+            dataPointId,
+            scope: record.scope,
+            ownerAddress: record.ownerAddress,
+            deletedAt: tombstoneDeletedAt(record)
+          }
+        );
+      }
+      return record;
     },
     async listDataPointsByOwner(owner, cursor, options) {
       const params = new URLSearchParams({ user: owner });
@@ -34118,14 +34460,24 @@ function createGatewayClient(baseUrl) {
       if (options?.limit !== void 0) {
         params.set("limit", String(options.limit));
       }
+      if (options?.includeDeleted) {
+        params.set("includeDeleted", "true");
+      }
       const res = await fetch(`${base}/v1/data?${params.toString()}`);
       if (!res.ok) {
         throw new Error(`Gateway error: ${res.status} ${res.statusText}`);
       }
-      const envelope = await res.json();
-      const nextCursor = envelope.pagination?.hasMore === false ? null : envelope.pagination?.nextCursor ?? null;
+      const envelope = await readEnvelope(res);
+      if (!isPlainObject(envelope.data) || !Array.isArray(envelope.data["dataPoints"])) {
+        throw malformedBody(res);
+      }
+      const rows = envelope.data["dataPoints"];
+      const pagination = isPlainObject(envelope["pagination"]) ? envelope["pagination"] : void 0;
+      const rawCursor = pagination?.["nextCursor"];
+      const nextCursor = pagination?.["hasMore"] === false || typeof rawCursor !== "string" ? null : rawCursor;
+      const dataPoints = options?.includeDeleted ? rows : rows.filter((row) => !isDataPointTombstone(row));
       return {
-        dataPoints: envelope.data.dataPoints,
+        dataPoints,
         cursor: nextCursor
       };
     },
@@ -34152,7 +34504,7 @@ function createGatewayClient(baseUrl) {
         })
       });
       if (res.status === 409) {
-        const body2 = await res.json().catch(() => ({}));
+        const body2 = await readJsonObject(res);
         return {
           serverId: getMutationId(body2, "serverId"),
           alreadyRegistered: true
@@ -34161,7 +34513,7 @@ function createGatewayClient(baseUrl) {
       if (!res.ok) {
         throw new Error(`Gateway error: ${res.status} ${res.statusText}`);
       }
-      const body = await res.json().catch(() => ({}));
+      const body = await readJsonObject(res);
       return {
         serverId: getMutationId(body, "serverId"),
         alreadyRegistered: false
@@ -34182,19 +34534,16 @@ function createGatewayClient(baseUrl) {
         })
       });
       if (res.status === 409) {
-        const body2 = await res.json().catch(() => ({}));
+        const body2 = await readJsonObject(res);
         return {
-          builderId: getMutationId(
-            body2,
-            "builderId"
-          ),
+          builderId: getMutationId(body2, "builderId"),
           alreadyRegistered: true
         };
       }
       if (!res.ok) {
         throw new Error(`Gateway error: ${res.status} ${res.statusText}`);
       }
-      const body = await res.json().catch(() => ({}));
+      const body = await readJsonObject(res);
       return {
         builderId: getMutationId(body, "builderId"),
         alreadyRegistered: false
@@ -34216,17 +34565,77 @@ function createGatewayClient(baseUrl) {
         })
       });
       if (!res.ok) {
-        const body2 = await res.json().catch(() => ({}));
-        const detail = body2.error ?? res.statusText;
+        const body2 = await readJsonObject(res);
+        const detail = stringOrUndefined(body2["error"]) ?? res.statusText;
         throw new Error(`Gateway error: ${res.status} ${detail}`);
       }
-      const body = await res.json().catch(() => ({}));
+      const body = await readJsonObject(res);
       return {
-        dataPointId: getMutationId(
-          body,
-          "dataPointId"
-        ),
-        expectedVersion: body.expectedVersion
+        dataPointId: getMutationId(body, "dataPointId"),
+        expectedVersion: stringOrUndefined(body["expectedVersion"])
+      };
+    },
+    async deleteDataPoint(params) {
+      const dataPointId = deriveDataPointId(
+        params.ownerAddress,
+        params.scope
+      );
+      const details = {
+        dataPointId,
+        scope: params.scope,
+        ownerAddress: params.ownerAddress
+      };
+      const res = await fetch(`${base}/v1/data/${dataPointId}`, {
+        method: "DELETE",
+        headers: {
+          "Content-Type": "application/json",
+          Authorization: `Web3Signed ${params.signature}`
+        },
+        body: JSON.stringify({
+          ownerAddress: params.ownerAddress,
+          scope: params.scope,
+          expectedVersion: params.expectedVersion,
+          signature: params.signature
+        })
+      });
+      if (res.status === 404) {
+        throw new DataPointNotFoundError(
+          `Data point ${dataPointId} (scope '${params.scope}') is not registered`,
+          details
+        );
+      }
+      if (res.status === 409) {
+        const body2 = await readBody(res);
+        const currentExpectedVersion = stringOrUndefined(
+          body2["currentExpectedVersion"]
+        );
+        const detail = stringOrUndefined(body2["error"]) ?? res.statusText;
+        throw new DataPointVersionConflictError(
+          `Gateway error: 409 ${detail}`,
+          {
+            ...details,
+            expectedVersion: params.expectedVersion,
+            currentExpectedVersion
+          }
+        );
+      }
+      if (res.status === 410) {
+        throw await deletedError(res, details);
+      }
+      if (!res.ok) {
+        const body2 = await readBody(res);
+        const detail = stringOrUndefined(body2["error"]) ?? res.statusText;
+        throw new Error(`Gateway error: ${res.status} ${detail}`);
+      }
+      const body = await readBody(res);
+      return {
+        dataPointId: getMutationId(body, "dataPointId") ?? dataPointId,
+        ownerAddress: stringOrUndefined(body["ownerAddress"]),
+        scope: stringOrUndefined(body["scope"]),
+        dataHash: stringOrUndefined(body["dataHash"]),
+        metadataHash: stringOrUndefined(body["metadataHash"]),
+        expectedVersion: stringOrUndefined(body["expectedVersion"]),
+        deletedAt: tombstoneDeletedAt(body)
       };
     },
     async createGrant(params) {
@@ -34245,18 +34654,14 @@ function createGatewayClient(baseUrl) {
         })
       });
       if (res.status === 409) {
-        const body2 = await res.json().catch(() => ({}));
-        return {
-          grantId: getMutationId(body2, "grantId")
-        };
+        const body2 = await readJsonObject(res);
+        return { grantId: getMutationId(body2, "grantId") };
       }
       if (!res.ok) {
         throw new Error(`Gateway error: ${res.status} ${res.statusText}`);
       }
-      const body = await res.json();
-      return {
-        grantId: getMutationId(body, "grantId")
-      };
+      const body = await readJsonObject(res);
+      return { grantId: getMutationId(body, "grantId") };
     },
     async revokeGrant(params) {
       const res = await fetch(`${base}/v1/grants/${params.grantId}`, {
@@ -34526,7 +34931,10 @@ export {
   ContractNotFoundError,
   DATA_REGISTRY_STATUS_ABI,
   DataFileEnvelopeSchema,
+  DataPointDeletedError,
+  DataPointNotFoundError,
   DataPointStatus,
+  DataPointVersionConflictError,
   DropboxStorage,
   ECIESError,
   ESCROW_DEPOSIT_ABI2 as ESCROW_DEPOSIT_ABI,
@@ -34583,6 +34991,10 @@ export {
   SignatureError,
   StorageError,
   StorageManager,
+  TOMBSTONE_DATA_HASH,
+  TOMBSTONE_DATA_HASH_PREIMAGE,
+  TOMBSTONE_METADATA_HASH,
+  TOMBSTONE_METADATA_HASH_PREIMAGE,
   TransactionPendingError,
   UserRejectedRequestError,
   VanaError,
@@ -34605,6 +35017,8 @@ export {
   assertDerivedScopeNaming,
   assertValidPkceVerifier,
   binaryWriteSignedBytes,
+  buildDataPointDeletionSignature,
+  buildDataPointDeletionTypedData,
   buildDepositNativeRequest,
   buildDepositTokenRequest,
   buildMarkDataPointUnavailableRequest,
@@ -34620,6 +35034,7 @@ export {
   clearContractCache,
   computeBodyHash,
   computePkceChallenge,
+  computeTombstoneHash,
   contractCacheForTesting,
   createBrowserPlatformAdapter,
   createDataFileEnvelope,
@@ -34627,11 +35042,13 @@ export {
   createGatewayClient,
   createPlatformAdapterSafe,
   createVanaStorageProvider,
+  createViemDataPointDeletionSigner,
   createViemPersonalServerLiteOwnerBindingSigner,
   createViemPersonalServerRegistrationSigner,
   dataRegistryContractAddress,
   dataRegistryDomain,
   decryptWithPassword,
+  deleteDataPoint,
   deriveDataPointId,
   deriveMasterKey,
   deriveScopeKey,
@@ -34667,10 +35084,12 @@ export {
   grantRevocationDomain,
   hasAction,
   isDataPointId,
+  isDataPointTombstone,
   isDataPortabilityGatewayConfig,
   isECIESEncrypted,
   isPlatformSupported,
   isRedactedLineageNode,
+  isTombstoneHashes,
   mainnetServices,
   moksha,
   mokshaServices,
@@ -34700,6 +35119,7 @@ export {
   signPersonalServerLiteOwnerBinding,
   signPersonalServerLiteOwnerBindingWithAccountClient,
   signPersonalServerRegistrationWithAccount,
+  tombstoneDeletedAt,
   tryGrantPermissions,
   vanaMainnet2 as vanaMainnet,
   verifyGrantRegistration,