@opendatalabs/vana-sdk 3.22.0 → 3.23.0-pr.211.3227174

package/dist/crypto/envelope/job.cjs

@@ -0,0 +1,818 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var job_exports = {};
+__export(job_exports, {
+  JOB_RESULT_CHUNK_BYTES: () => JOB_RESULT_CHUNK_BYTES,
+  JOB_RESULT_FORMAT_VERSION: () => JOB_RESULT_FORMAT_VERSION,
+  JobEnvelopeError: () => JobEnvelopeError,
+  canonicalJobRequestBytes: () => canonicalJobRequestBytes,
+  openJobRequest: () => openJobRequest,
+  openJobResult: () => openJobResult,
+  openJobResultStream: () => openJobResultStream,
+  sealJobRequest: () => sealJobRequest,
+  sealJobResult: () => sealJobResult,
+  sealJobResultStream: () => sealJobResultStream
+});
+module.exports = __toCommonJS(job_exports);
+var import_sha2 = require("@noble/hashes/sha2");
+var import_viem = require("viem");
+var import_constants = require("../ecies/constants");
+var import_interface = require("../ecies/interface");
+var import_jobs = require("../../protocol/jobs");
+var import_encoding = require("../../utils/encoding");
+const textDecoder = new TextDecoder();
+const textEncoder = new TextEncoder();
+const MAX_JOB_RESULT_HEADER_BYTES = 4096;
+const WRAPPED_KEY_LENGTH_BYTES = 4;
+const FRAME_LENGTH_BYTES = 4;
+const FRAME_FLAGS_BYTES = 1;
+const AES_KEY_BYTES = 32;
+const AES_GCM_NONCE_BYTES = 12;
+const AES_GCM_TAG_BYTES = 16;
+const WRAPPED_METADATA_LENGTH_BYTES = 4;
+const WRAPPED_KEY_PLAINTEXT_PREFIX_BYTES = AES_KEY_BYTES + AES_GCM_NONCE_BYTES + WRAPPED_METADATA_LENGTH_BYTES;
+const MAX_WRAPPED_KEY_BYTES = 8192;
+const FINAL_FRAME_FLAG = 1;
+const MAX_CHUNK_INDEX = 4294967295;
+const JOB_RESULT_FORMAT_VERSION = 2;
+const JOB_RESULT_CHUNK_BYTES = 1024 * 1024;
+class JobEnvelopeError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "JobEnvelopeError";
+  }
+}
+function sortJsonKeys(value) {
+  if (Array.isArray(value)) {
+    return value.map(sortJsonKeys);
+  }
+  if (value !== null && typeof value === "object") {
+    return Object.fromEntries(
+      Object.keys(value).sort().map((key) => [
+        key,
+        sortJsonKeys(value[key])
+      ])
+    );
+  }
+  return value;
+}
+function canonicalJsonBytes(value) {
+  return textEncoder.encode(JSON.stringify(sortJsonKeys(value)));
+}
+function canonicalJobRequestBytes(request) {
+  validateJobRequest(request);
+  return canonicalJsonBytes(request);
+}
+function requestPlaintext(envelope) {
+  validateRequestEnvelope(envelope);
+  return canonicalJsonBytes(envelope);
+}
+function resultMetadata(result) {
+  return {
+    v: result.v,
+    jobId: result.jobId,
+    scope: result.scope,
+    version: result.version,
+    contentType: result.contentType
+  };
+}
+function encryptedBytesToBase64(encrypted) {
+  return (0, import_encoding.toBase64)((0, import_viem.fromHex)(`0x${(0, import_interface.serializeECIES)(encrypted)}`, "bytes"));
+}
+function encryptedToBytes(encrypted) {
+  const bytes = new Uint8Array(
+    encrypted.iv.length + encrypted.ephemPublicKey.length + encrypted.ciphertext.length + encrypted.mac.length
+  );
+  let offset = 0;
+  bytes.set(encrypted.iv, offset);
+  offset += encrypted.iv.length;
+  bytes.set(encrypted.ephemPublicKey, offset);
+  offset += encrypted.ephemPublicKey.length;
+  bytes.set(encrypted.ciphertext, offset);
+  offset += encrypted.ciphertext.length;
+  bytes.set(encrypted.mac, offset);
+  return bytes;
+}
+function bytesToEncrypted(bytes) {
+  const absoluteMinLength = import_constants.FORMAT.IV_LENGTH + 1 + import_constants.MAC.LENGTH + 1;
+  if (bytes.length < absoluteMinLength) {
+    throw new import_interface.ECIESError(
+      `Invalid ECIES data: too short (${bytes.length} bytes, minimum ${absoluteMinLength} bytes required)`,
+      "DECRYPTION_FAILED"
+    );
+  }
+  const prefix = bytes[import_constants.FORMAT.EPHEMERAL_KEY_OFFSET];
+  if (prefix !== import_constants.CURVE.PREFIX.UNCOMPRESSED) {
+    throw new import_interface.ECIESError(
+      `Invalid ephemeral public key: must be uncompressed format (0x04 prefix), got 0x${prefix.toString(16).padStart(2, "0")}`,
+      "DECRYPTION_FAILED"
+    );
+  }
+  const ephemKeySize = import_constants.CURVE.UNCOMPRESSED_PUBLIC_KEY_LENGTH;
+  const minLength = import_constants.FORMAT.IV_LENGTH + ephemKeySize + import_constants.MAC.LENGTH + 1;
+  if (bytes.length < minLength) {
+    throw new import_interface.ECIESError(
+      `Invalid ECIES data: too short (${bytes.length} bytes, minimum ${minLength} bytes required)`,
+      "DECRYPTION_FAILED"
+    );
+  }
+  return {
+    iv: bytes.subarray(import_constants.FORMAT.IV_OFFSET, import_constants.FORMAT.IV_OFFSET + import_constants.FORMAT.IV_LENGTH),
+    ephemPublicKey: bytes.subarray(
+      import_constants.FORMAT.EPHEMERAL_KEY_OFFSET,
+      import_constants.FORMAT.EPHEMERAL_KEY_OFFSET + ephemKeySize
+    ),
+    ciphertext: bytes.subarray(
+      import_constants.FORMAT.EPHEMERAL_KEY_OFFSET + ephemKeySize,
+      bytes.length - import_constants.MAC.LENGTH
+    ),
+    mac: bytes.subarray(bytes.length - import_constants.MAC.LENGTH)
+  };
+}
+function base64ToEncrypted(ciphertext) {
+  return (0, import_interface.deserializeECIES)((0, import_viem.toHex)((0, import_encoding.fromBase64)(ciphertext)));
+}
+function parseObject(plaintext, kind) {
+  try {
+    const value = JSON.parse(textDecoder.decode(plaintext));
+    if (value === null || typeof value !== "object" || Array.isArray(value)) {
+      throw new JobEnvelopeError(`Invalid ${kind}: expected an object`);
+    }
+    return value;
+  } catch (error) {
+    if (error instanceof JobEnvelopeError) throw error;
+    throw new JobEnvelopeError(`Invalid ${kind}: malformed JSON`);
+  }
+}
+function isPlainObject(value) {
+  if (value === null || typeof value !== "object") return false;
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+function requirePlainObject(value, field, kind) {
+  if (!isPlainObject(value)) {
+    throw new JobEnvelopeError(`Invalid ${kind}: invalid ${field}`);
+  }
+}
+function requireExactKeys(value, expectedKeys, kind) {
+  for (const key of expectedKeys) {
+    if (!Object.hasOwn(value, key) || value[key] === void 0) {
+      throw new JobEnvelopeError(`Invalid ${kind}: missing ${key}`);
+    }
+  }
+  const expected = new Set(expectedKeys);
+  for (const key of Reflect.ownKeys(value)) {
+    if (!expected.has(key)) {
+      throw new JobEnvelopeError(
+        `Invalid ${kind}: unknown field ${String(key)}`
+      );
+    }
+  }
+}
+function requireString(value, field, kind) {
+  if (typeof value !== "string" || value.length === 0) {
+    throw new JobEnvelopeError(`Invalid ${kind}: missing ${field}`);
+  }
+}
+function validateJobRequest(value) {
+  requirePlainObject(value, "request", "job request");
+  requireExactKeys(
+    value,
+    [
+      "v",
+      "jobId",
+      "owner",
+      "builder",
+      "builderPublicKey",
+      "grantId",
+      "scope",
+      "operation",
+      "pinnedVersion",
+      "deadline"
+    ],
+    "job request"
+  );
+  if (value.v !== import_jobs.JOB_PROTOCOL_VERSION) {
+    throw new JobEnvelopeError(
+      `Unsupported job request version: ${String(value.v)}`
+    );
+  }
+  requireString(value.jobId, "jobId", "job request");
+  if (typeof value.owner !== "string" || !(0, import_viem.isAddress)(value.owner)) {
+    throw new JobEnvelopeError("Invalid job request: invalid owner");
+  }
+  if (typeof value.builder !== "string" || !(0, import_viem.isAddress)(value.builder)) {
+    throw new JobEnvelopeError("Invalid job request: invalid builder");
+  }
+  if (typeof value.builderPublicKey !== "string" || !(0, import_viem.isHex)(value.builderPublicKey)) {
+    throw new JobEnvelopeError("Invalid job request: invalid builderPublicKey");
+  }
+  if (typeof value.grantId !== "string" || !(0, import_viem.isHex)(value.grantId)) {
+    throw new JobEnvelopeError("Invalid job request: invalid grantId");
+  }
+  requireString(value.scope, "scope", "job request");
+  if (!import_jobs.JOB_OPERATIONS.includes(value.operation)) {
+    throw new JobEnvelopeError("Invalid job request: invalid operation");
+  }
+  if (value.pinnedVersion !== null && typeof value.pinnedVersion !== "string") {
+    throw new JobEnvelopeError("Invalid job request: missing pinnedVersion");
+  }
+  if (typeof value.deadline !== "string" || !Number.isFinite(Date.parse(value.deadline))) {
+    throw new JobEnvelopeError("Invalid job request: invalid deadline");
+  }
+  return value;
+}
+function validateRequestEnvelope(value) {
+  requirePlainObject(value, "envelope", "job request envelope");
+  requireExactKeys(value, ["request", "auth"], "job request envelope");
+  validateJobRequest(value.request);
+  requireString(value.auth, "auth", "job request envelope");
+  return value;
+}
+function validateResultMetadata(value) {
+  requirePlainObject(value, "metadata", "job result");
+  requireExactKeys(
+    value,
+    ["v", "jobId", "scope", "version", "contentType"],
+    "job result"
+  );
+  if (value.v !== import_jobs.JOB_PROTOCOL_VERSION) {
+    throw new JobEnvelopeError(
+      `Unsupported job result version: ${String(value.v)}`
+    );
+  }
+  for (const field of ["jobId", "scope", "contentType"]) {
+    requireString(value[field], field, "job result");
+  }
+  if (value.version !== null && typeof value.version !== "string") {
+    throw new JobEnvelopeError("Invalid job result: missing version");
+  }
+  return value;
+}
+function validateResult(value) {
+  requirePlainObject(value, "result", "job result");
+  requireExactKeys(
+    value,
+    ["v", "jobId", "scope", "version", "contentType", "body"],
+    "job result"
+  );
+  validateResultMetadata(resultMetadata(value));
+  if (!(value.body instanceof Uint8Array)) {
+    throw new JobEnvelopeError("Invalid job result: missing body");
+  }
+  return value;
+}
+function webCrypto() {
+  if (typeof globalThis.crypto === "undefined" || typeof globalThis.crypto.getRandomValues !== "function" || !globalThis.crypto.subtle) {
+    throw new JobEnvelopeError(
+      "Job result streaming requires the Web Crypto API"
+    );
+  }
+  return globalThis.crypto;
+}
+function uint32(value) {
+  const bytes = new Uint8Array(4);
+  new DataView(bytes.buffer).setUint32(0, value);
+  return bytes;
+}
+function readUint32(bytes, offset = 0) {
+  return new DataView(bytes.buffer, bytes.byteOffset + offset, 4).getUint32(0);
+}
+function wrappedKeyPlaintext(contentKey, noncePrefix, metadataBytes) {
+  const plaintext = new Uint8Array(
+    WRAPPED_KEY_PLAINTEXT_PREFIX_BYTES + metadataBytes.length
+  );
+  plaintext.set(contentKey, 0);
+  plaintext.set(noncePrefix, AES_KEY_BYTES);
+  new DataView(plaintext.buffer).setUint32(
+    AES_KEY_BYTES + AES_GCM_NONCE_BYTES,
+    metadataBytes.length
+  );
+  plaintext.set(metadataBytes, WRAPPED_KEY_PLAINTEXT_PREFIX_BYTES);
+  return plaintext;
+}
+function parseWrappedKeyPlaintext(plaintext) {
+  if (plaintext.length < WRAPPED_KEY_PLAINTEXT_PREFIX_BYTES) {
+    throw new JobEnvelopeError("Invalid job result: wrapped key is truncated");
+  }
+  const metadataLength = readUint32(
+    plaintext,
+    AES_KEY_BYTES + AES_GCM_NONCE_BYTES
+  );
+  if (metadataLength > MAX_JOB_RESULT_HEADER_BYTES) {
+    throw new JobEnvelopeError(
+      `Invalid job result: header exceeds ${MAX_JOB_RESULT_HEADER_BYTES} bytes`
+    );
+  }
+  if (plaintext.length !== WRAPPED_KEY_PLAINTEXT_PREFIX_BYTES + metadataLength) {
+    throw new JobEnvelopeError(
+      "Invalid job result: header length exceeds payload"
+    );
+  }
+  const metadataBytes = plaintext.slice(WRAPPED_KEY_PLAINTEXT_PREFIX_BYTES);
+  const metadata = validateResultMetadata(
+    parseObject(metadataBytes, "job result header")
+  );
+  return {
+    contentKey: plaintext.slice(0, AES_KEY_BYTES),
+    noncePrefix: plaintext.slice(
+      AES_KEY_BYTES,
+      AES_KEY_BYTES + AES_GCM_NONCE_BYTES
+    ),
+    metadataBytes,
+    metadata
+  };
+}
+async function importAesKey(contentKey, usage) {
+  return webCrypto().subtle.importKey(
+    "raw",
+    contentKey,
+    { name: "AES-GCM" },
+    false,
+    [usage]
+  );
+}
+function chunkNonce(noncePrefix, chunkIndex) {
+  if (chunkIndex > MAX_CHUNK_INDEX) {
+    throw new JobEnvelopeError("Invalid job result: too many chunks");
+  }
+  const nonce = noncePrefix.slice();
+  const view = new DataView(nonce.buffer, nonce.byteOffset, nonce.byteLength);
+  view.setUint32(8, view.getUint32(8) ^ chunkIndex);
+  return nonce;
+}
+function chunkAad(metadataBytes, chunkIndex, final, plaintextLength) {
+  const aad = new Uint8Array(14 + metadataBytes.length);
+  aad[0] = JOB_RESULT_FORMAT_VERSION;
+  aad.set(uint32(metadataBytes.length), 1);
+  aad.set(metadataBytes, 5);
+  aad.set(uint32(chunkIndex), 5 + metadataBytes.length);
+  aad[9 + metadataBytes.length] = final ? FINAL_FRAME_FLAG : 0;
+  aad.set(uint32(plaintextLength), 10 + metadataBytes.length);
+  return aad;
+}
+async function encryptResultChunk(key, noncePrefix, metadataBytes, plaintext, chunkIndex, final) {
+  const encrypted = new Uint8Array(
+    await webCrypto().subtle.encrypt(
+      {
+        name: "AES-GCM",
+        iv: chunkNonce(noncePrefix, chunkIndex),
+        additionalData: chunkAad(
+          metadataBytes,
+          chunkIndex,
+          final,
+          plaintext.length
+        ),
+        tagLength: AES_GCM_TAG_BYTES * 8
+      },
+      key,
+      plaintext
+    )
+  );
+  const frame = new Uint8Array(
+    FRAME_LENGTH_BYTES + FRAME_FLAGS_BYTES + encrypted.length
+  );
+  new DataView(frame.buffer).setUint32(0, encrypted.length);
+  frame[FRAME_LENGTH_BYTES] = final ? FINAL_FRAME_FLAG : 0;
+  frame.set(encrypted, FRAME_LENGTH_BYTES + FRAME_FLAGS_BYTES);
+  return frame;
+}
+function verifyResultBindings(metadata, expect) {
+  if (metadata.jobId !== expect.jobId) {
+    throw new JobEnvelopeError(
+      `Job result ID ${metadata.jobId} does not match expected job ID ${expect.jobId}`
+    );
+  }
+  if (expect.scope !== void 0 && metadata.scope !== expect.scope) {
+    throw new JobEnvelopeError(
+      `Job result scope ${metadata.scope} does not match expected scope ${expect.scope}`
+    );
+  }
+  if (expect.version !== void 0 && metadata.version !== expect.version) {
+    throw new JobEnvelopeError(
+      `Job result version ${String(metadata.version)} does not match expected version ${String(expect.version)}`
+    );
+  }
+}
+class ByteStreamReader {
+  reader;
+  current;
+  offset = 0;
+  ended = false;
+  constructor(stream) {
+    this.reader = stream.getReader();
+  }
+  async ensureBytes() {
+    while (!this.current || this.offset === this.current.length) {
+      if (this.ended) return false;
+      const next = await this.reader.read();
+      if (next.done) {
+        this.ended = true;
+        this.current = void 0;
+        return false;
+      }
+      if (!(next.value instanceof Uint8Array)) {
+        throw new JobEnvelopeError(
+          "Invalid job result: stream yielded non-byte data"
+        );
+      }
+      this.current = next.value;
+      this.offset = 0;
+    }
+    return true;
+  }
+  async readExactOrNull(length) {
+    if (!await this.ensureBytes()) return null;
+    const bytes = new Uint8Array(length);
+    let written = 0;
+    while (written < length) {
+      if (!await this.ensureBytes()) {
+        throw new JobEnvelopeError("Invalid job result: truncated payload");
+      }
+      const available = this.current.length - this.offset;
+      const count = Math.min(available, length - written);
+      bytes.set(
+        this.current.subarray(this.offset, this.offset + count),
+        written
+      );
+      this.offset += count;
+      written += count;
+    }
+    return bytes;
+  }
+  async readExact(length) {
+    const bytes = await this.readExactOrNull(length);
+    if (!bytes) {
+      throw new JobEnvelopeError("Invalid job result: truncated payload");
+    }
+    return bytes;
+  }
+  async hasRemaining() {
+    return this.ensureBytes();
+  }
+  async cancel(reason) {
+    await this.reader.cancel(reason);
+  }
+}
+function normalizeChunkError(error) {
+  if (error instanceof JobEnvelopeError) return error;
+  return new JobEnvelopeError(
+    `Invalid job result: chunk authentication failed${error instanceof Error ? `: ${error.message}` : ""}`
+  );
+}
+async function sealJobRequest(envelope, enclavePublicKey, ecies) {
+  const encrypted = await ecies.encrypt(
+    (0, import_viem.fromHex)(enclavePublicKey, "bytes"),
+    requestPlaintext(envelope)
+  );
+  return encryptedBytesToBase64(encrypted);
+}
+async function openJobRequest(ciphertext, privateKey, ecies) {
+  const plaintext = await ecies.decrypt(
+    privateKey,
+    base64ToEncrypted(ciphertext)
+  );
+  return validateRequestEnvelope(
+    parseObject(plaintext, "job request envelope")
+  );
+}
+async function sealJobResultStream(metadataValue, builderPublicKey, ecies) {
+  const metadata = validateResultMetadata(metadataValue);
+  const metadataBytes = canonicalJsonBytes(metadata);
+  if (metadataBytes.length > MAX_JOB_RESULT_HEADER_BYTES) {
+    throw new JobEnvelopeError(
+      `Invalid job result: header exceeds ${MAX_JOB_RESULT_HEADER_BYTES} bytes`
+    );
+  }
+  const crypto = webCrypto();
+  const contentKey = crypto.getRandomValues(new Uint8Array(AES_KEY_BYTES));
+  const noncePrefix = crypto.getRandomValues(
+    new Uint8Array(AES_GCM_NONCE_BYTES)
+  );
+  const key = await importAesKey(contentKey, "encrypt");
+  const keyPlaintext = wrappedKeyPlaintext(
+    contentKey,
+    noncePrefix,
+    metadataBytes
+  );
+  const encryptedKey = await ecies.encrypt(
+    (0, import_viem.fromHex)(builderPublicKey, "bytes"),
+    keyPlaintext
+  );
+  contentKey.fill(0);
+  keyPlaintext.fill(0);
+  const wrappedKey = encryptedToBytes(encryptedKey);
+  if (wrappedKey.length > MAX_WRAPPED_KEY_BYTES) {
+    throw new JobEnvelopeError("Invalid job result: wrapped key is too large");
+  }
+  const header = new Uint8Array(
+    1 + WRAPPED_KEY_LENGTH_BYTES + wrappedKey.length
+  );
+  header[0] = JOB_RESULT_FORMAT_VERSION;
+  new DataView(header.buffer).setUint32(1, wrappedKey.length);
+  header.set(wrappedKey, 1 + WRAPPED_KEY_LENGTH_BYTES);
+  let pending = new Uint8Array(JOB_RESULT_CHUNK_BYTES);
+  let pendingLength = 0;
+  let chunkIndex = 0;
+  const transform = new TransformStream({
+    async transform(chunk, controller) {
+      if (!(chunk instanceof Uint8Array)) {
+        throw new JobEnvelopeError(
+          "Invalid job result: stream yielded non-byte data"
+        );
+      }
+      let offset = 0;
+      while (offset < chunk.length) {
+        if (pendingLength === JOB_RESULT_CHUNK_BYTES) {
+          controller.enqueue(
+            await encryptResultChunk(
+              key,
+              noncePrefix,
+              metadataBytes,
+              pending,
+              chunkIndex,
+              false
+            )
+          );
+          chunkIndex += 1;
+          pending = new Uint8Array(JOB_RESULT_CHUNK_BYTES);
+          pendingLength = 0;
+        }
+        const count = Math.min(
+          chunk.length - offset,
+          JOB_RESULT_CHUNK_BYTES - pendingLength
+        );
+        pending.set(chunk.subarray(offset, offset + count), pendingLength);
+        pendingLength += count;
+        offset += count;
+      }
+    },
+    async flush(controller) {
+      controller.enqueue(
+        await encryptResultChunk(
+          key,
+          noncePrefix,
+          metadataBytes,
+          pending.subarray(0, pendingLength),
+          chunkIndex,
+          true
+        )
+      );
+    }
+  });
+  return { header, transform };
+}
+async function sealJobResult(result, builderPublicKey, ecies) {
+  validateResult(result);
+  const sealed = await sealJobResultStream(
+    resultMetadata(result),
+    builderPublicKey,
+    ecies
+  );
+  const frameCount = Math.max(
+    1,
+    Math.ceil(result.body.length / JOB_RESULT_CHUNK_BYTES)
+  );
+  const size = sealed.header.length + result.body.length + frameCount * (FRAME_LENGTH_BYTES + FRAME_FLAGS_BYTES + AES_GCM_TAG_BYTES);
+  const bytes = new Uint8Array(size);
+  bytes.set(sealed.header, 0);
+  let outputOffset = sealed.header.length;
+  const reader = sealed.transform.readable.getReader();
+  const drain = (async () => {
+    for (; ; ) {
+      const next = await reader.read();
+      if (next.done) break;
+      bytes.set(next.value, outputOffset);
+      outputOffset += next.value.length;
+    }
+  })();
+  const writer = sealed.transform.writable.getWriter();
+  const fill = (async () => {
+    for (let offset = 0; offset < result.body.length; offset += JOB_RESULT_CHUNK_BYTES) {
+      await writer.write(
+        result.body.subarray(offset, offset + JOB_RESULT_CHUNK_BYTES)
+      );
+    }
+    await writer.close();
+  })();
+  await Promise.all([drain, fill]);
+  if (outputOffset !== bytes.length) {
+    throw new JobEnvelopeError("Invalid job result: sealed size mismatch");
+  }
+  return { bytes, hash: (0, import_viem.bytesToHex)((0, import_sha2.sha256)(bytes)), size };
+}
+async function openJobResultStream(bytesStream, builderPrivateKey, ecies, expect) {
+  const reader = new ByteStreamReader(bytesStream);
+  const headerPrefix = await reader.readExact(1 + WRAPPED_KEY_LENGTH_BYTES);
+  const formatVersion = headerPrefix[0];
+  if (formatVersion !== JOB_RESULT_FORMAT_VERSION) {
+    throw new JobEnvelopeError(
+      `Unsupported job result format: ${String(formatVersion)}`
+    );
+  }
+  const wrappedKeyLength = readUint32(headerPrefix, 1);
+  if (wrappedKeyLength === 0 || wrappedKeyLength > MAX_WRAPPED_KEY_BYTES) {
+    throw new JobEnvelopeError(
+      "Invalid job result: invalid wrapped key length"
+    );
+  }
+  const wrappedKey = await reader.readExact(wrappedKeyLength);
+  const keyPlaintext = await ecies.decrypt(
+    (0, import_viem.fromHex)(builderPrivateKey, "bytes"),
+    bytesToEncrypted(wrappedKey)
+  );
+  const parsed = parseWrappedKeyPlaintext(keyPlaintext);
+  verifyResultBindings(parsed.metadata, expect);
+  const key = await importAesKey(parsed.contentKey, "decrypt");
+  parsed.contentKey.fill(0);
+  keyPlaintext.fill(0);
+  let chunkIndex = 0;
+  let finished = false;
+  const body = new ReadableStream({
+    async pull(controller) {
+      if (finished) {
+        controller.close();
+        return;
+      }
+      try {
+        const frameHeader = await reader.readExactOrNull(
+          FRAME_LENGTH_BYTES + FRAME_FLAGS_BYTES
+        );
+        if (!frameHeader) {
+          throw new JobEnvelopeError("Invalid job result: missing final chunk");
+        }
+        const encryptedLength = readUint32(frameHeader);
+        if (encryptedLength < AES_GCM_TAG_BYTES || encryptedLength > JOB_RESULT_CHUNK_BYTES + AES_GCM_TAG_BYTES) {
+          throw new JobEnvelopeError(
+            "Invalid job result: invalid chunk length"
+          );
+        }
+        const flags = frameHeader[FRAME_LENGTH_BYTES];
+        if (flags !== 0 && flags !== FINAL_FRAME_FLAG) {
+          throw new JobEnvelopeError("Invalid job result: invalid chunk flags");
+        }
+        const final = flags === FINAL_FRAME_FLAG;
+        const plaintextLength = encryptedLength - AES_GCM_TAG_BYTES;
+        if (!final && plaintextLength !== JOB_RESULT_CHUNK_BYTES) {
+          throw new JobEnvelopeError(
+            "Invalid job result: short non-final chunk"
+          );
+        }
+        const encrypted = await reader.readExact(encryptedLength);
+        const plaintext = new Uint8Array(
+          await webCrypto().subtle.decrypt(
+            {
+              name: "AES-GCM",
+              iv: chunkNonce(parsed.noncePrefix, chunkIndex),
+              additionalData: chunkAad(
+                parsed.metadataBytes,
+                chunkIndex,
+                final,
+                plaintextLength
+              ),
+              tagLength: AES_GCM_TAG_BYTES * 8
+            },
+            key,
+            encrypted
+          )
+        );
+        if (plaintext.length !== plaintextLength) {
+          throw new JobEnvelopeError(
+            "Invalid job result: decrypted chunk length mismatch"
+          );
+        }
+        chunkIndex += 1;
+        if (final) {
+          if (await reader.hasRemaining()) {
+            throw new JobEnvelopeError(
+              "Invalid job result: bytes follow final chunk"
+            );
+          }
+          finished = true;
+        }
+        controller.enqueue(plaintext);
+        if (finished) controller.close();
+      } catch (error) {
+        controller.error(normalizeChunkError(error));
+        void reader.cancel(error).catch(() => void 0);
+      }
+    },
+    cancel(reason) {
+      return reader.cancel(reason);
+    }
+  });
+  return { metadata: parsed.metadata, body };
+}
+function bufferedResultBodySize(sealedBytes) {
+  if (sealedBytes.length < 1 + WRAPPED_KEY_LENGTH_BYTES) {
+    throw new JobEnvelopeError("Invalid job result: truncated payload");
+  }
+  if (sealedBytes[0] !== JOB_RESULT_FORMAT_VERSION) {
+    throw new JobEnvelopeError(
+      `Unsupported job result format: ${String(sealedBytes[0])}`
+    );
+  }
+  const wrappedKeyLength = readUint32(sealedBytes, 1);
+  if (wrappedKeyLength === 0 || wrappedKeyLength > MAX_WRAPPED_KEY_BYTES) {
+    throw new JobEnvelopeError(
+      "Invalid job result: invalid wrapped key length"
+    );
+  }
+  let offset = 1 + WRAPPED_KEY_LENGTH_BYTES + wrappedKeyLength;
+  if (offset > sealedBytes.length) {
+    throw new JobEnvelopeError("Invalid job result: truncated payload");
+  }
+  let bodySize = 0;
+  let sawFinal = false;
+  while (offset < sealedBytes.length) {
+    if (sealedBytes.length - offset < FRAME_LENGTH_BYTES + FRAME_FLAGS_BYTES) {
+      throw new JobEnvelopeError("Invalid job result: truncated payload");
+    }
+    const encryptedLength = readUint32(sealedBytes, offset);
+    const flags = sealedBytes[offset + FRAME_LENGTH_BYTES];
+    if (encryptedLength < AES_GCM_TAG_BYTES || encryptedLength > JOB_RESULT_CHUNK_BYTES + AES_GCM_TAG_BYTES || flags !== 0 && flags !== FINAL_FRAME_FLAG) {
+      throw new JobEnvelopeError("Invalid job result: invalid chunk framing");
+    }
+    const plaintextLength = encryptedLength - AES_GCM_TAG_BYTES;
+    if (flags === 0 && plaintextLength !== JOB_RESULT_CHUNK_BYTES) {
+      throw new JobEnvelopeError("Invalid job result: short non-final chunk");
+    }
+    offset += FRAME_LENGTH_BYTES + FRAME_FLAGS_BYTES;
+    if (encryptedLength > sealedBytes.length - offset) {
+      throw new JobEnvelopeError("Invalid job result: truncated payload");
+    }
+    offset += encryptedLength;
+    bodySize += plaintextLength;
+    if (flags === FINAL_FRAME_FLAG) {
+      sawFinal = true;
+      if (offset !== sealedBytes.length) {
+        throw new JobEnvelopeError(
+          "Invalid job result: bytes follow final chunk"
+        );
+      }
+    }
+  }
+  if (!sawFinal) {
+    throw new JobEnvelopeError("Invalid job result: missing final chunk");
+  }
+  return bodySize;
+}
+async function openJobResult(sealedBytes, builderPrivateKey, ecies, expect) {
+  const bodySize = bufferedResultBodySize(sealedBytes);
+  const stream = new ReadableStream({
+    start(controller) {
+      controller.enqueue(sealedBytes);
+      controller.close();
+    }
+  });
+  const opened = await openJobResultStream(
+    stream,
+    builderPrivateKey,
+    ecies,
+    expect
+  );
+  const body = new Uint8Array(bodySize);
+  let offset = 0;
+  await opened.body.pipeTo(
+    new WritableStream({
+      write(chunk) {
+        body.set(chunk, offset);
+        offset += chunk.length;
+      }
+    })
+  );
+  if (offset !== body.length) {
+    throw new JobEnvelopeError("Invalid job result: opened size mismatch");
+  }
+  return { ...opened.metadata, body };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  JOB_RESULT_CHUNK_BYTES,
+  JOB_RESULT_FORMAT_VERSION,
+  JobEnvelopeError,
+  canonicalJobRequestBytes,
+  openJobRequest,
+  openJobResult,
+  openJobResultStream,
+  sealJobRequest,
+  sealJobResult,
+  sealJobResultStream
+});
+//# sourceMappingURL=job.cjs.map