@opendatalabs/vana-sdk 3.22.0 → 3.23.0-pr.211.3227174

package/dist/index.browser.js

@@ -1138,289 +1138,8 @@ var init_browser2 = __esm({
   }
 });
 
-// src/errors.ts
-var VanaError = class extends Error {
-  constructor(message, code) {
-    super(message);
-    this.code = code;
-    this.name = this.constructor.name;
-    if (Error.captureStackTrace) {
-      Error.captureStackTrace(this, this.constructor);
-    }
-  }
-  code;
-};
-var RelayerError = class extends VanaError {
-  constructor(message, statusCode, response) {
-    super(message, "RELAYER_ERROR");
-    this.statusCode = statusCode;
-    this.response = response;
-  }
-  statusCode;
-  response;
-};
-var UserRejectedRequestError = class extends VanaError {
-  constructor(message = "User rejected the signature request") {
-    super(message, "USER_REJECTED_REQUEST");
-  }
-};
-var InvalidConfigurationError = class extends VanaError {
-  constructor(message) {
-    super(message, "INVALID_CONFIGURATION");
-  }
-};
-var ContractNotFoundError = class extends VanaError {
-  constructor(contractName, chainId) {
-    super(
-      `Contract ${contractName} not found on chain ${chainId}`,
-      "CONTRACT_NOT_FOUND"
-    );
-  }
-};
-var BlockchainError = class extends VanaError {
-  constructor(message, originalError) {
-    super(message, "BLOCKCHAIN_ERROR");
-    this.originalError = originalError;
-  }
-  originalError;
-};
-var SerializationError = class extends VanaError {
-  constructor(message) {
-    super(message, "SERIALIZATION_ERROR");
-  }
-};
-var SignatureError = class extends VanaError {
-  constructor(message, originalError) {
-    super(message, "SIGNATURE_ERROR");
-    this.originalError = originalError;
-  }
-  originalError;
-};
-var NetworkError = class extends VanaError {
-  constructor(message, originalError) {
-    super(message, "NETWORK_ERROR");
-    this.originalError = originalError;
-  }
-  originalError;
-};
-var NonceError = class extends VanaError {
-  constructor(message) {
-    super(message, "NONCE_ERROR");
-  }
-};
-var PersonalServerError = class extends VanaError {
-  constructor(message, originalError) {
-    super(message, "PERSONAL_SERVER_ERROR");
-    this.originalError = originalError;
-  }
-  originalError;
-};
-var ServerUrlMismatchError = class extends VanaError {
-  constructor(existingUrl, providedUrl, serverId) {
-    super(
-      `Server ${serverId} is already registered with URL "${existingUrl}". Cannot change to "${providedUrl}".`,
-      "SERVER_URL_MISMATCH"
-    );
-    this.existingUrl = existingUrl;
-    this.providedUrl = providedUrl;
-    this.serverId = serverId;
-  }
-  existingUrl;
-  providedUrl;
-  serverId;
-};
-var PermissionError = class extends VanaError {
-  constructor(message, originalError) {
-    super(message, "PERMISSION_ERROR");
-    this.originalError = originalError;
-  }
-  originalError;
-};
-var ReadOnlyError = class extends VanaError {
-  constructor(operation, suggestion = "Initialize the SDK with a walletClient to perform this operation") {
-    super(
-      `Operation '${operation}' requires a wallet client. ${suggestion}`,
-      "READ_ONLY_ERROR"
-    );
-    this.operation = operation;
-    this.suggestion = suggestion;
-  }
-  /** The operation that was attempted */
-  operation;
-  /** Suggested solution for fixing the error */
-  suggestion;
-};
-var TransactionPendingError = class extends VanaError {
-  constructor(operationId, message, lastKnownStatus) {
-    super(
-      `Transaction operation pending: ${message} (operationId: ${operationId})`,
-      "TRANSACTION_PENDING"
-    );
-    this.operationId = operationId;
-    this.lastKnownStatus = lastKnownStatus;
-  }
-  operationId;
-  lastKnownStatus;
-  /**
-   * Converts the error to a JSON-serializable format.
-   *
-   * @remarks
-   * Useful for logging, storage, or transmission of error details.
-   *
-   * @returns JSON representation of the error
-   */
-  toJSON() {
-    return {
-      name: this.name,
-      code: this.code,
-      message: this.message,
-      operationId: this.operationId,
-      lastKnownStatus: this.lastKnownStatus
-    };
-  }
-};
-var PersonalServerWriteError = class extends VanaError {
-  constructor(message, code, status, errorCode = null, details) {
-    super(message, code);
-    this.status = status;
-    this.errorCode = errorCode;
-    this.details = details;
-  }
-  status;
-  errorCode;
-  details;
-};
-var WriteRequestError = class extends PersonalServerWriteError {
-  constructor(message, details) {
-    super(message, "WRITE_INVALID_REQUEST", void 0, null, details);
-  }
-};
-var WriteTransportError = class extends PersonalServerWriteError {
-  constructor(message, attempts, cause) {
-    super(message, "WRITE_TRANSPORT_ERROR", void 0, null, { attempts });
-    this.attempts = attempts;
-    this.cause = cause;
-  }
-  attempts;
-};
-var WriteSessionError = class extends PersonalServerWriteError {
-  constructor(message, status, errorCode = null, details) {
-    super(message, "WRITE_SESSION_REJECTED", status, errorCode, details);
-  }
-};
-var WriteSessionExpiredError = class extends PersonalServerWriteError {
-  constructor(message, details) {
-    super(message, "WRITE_SESSION_EXPIRED", void 0, null, details);
-  }
-};
-var WriteUnauthorizedError = class extends PersonalServerWriteError {
-  constructor(message, errorCode = null, details) {
-    super(message, "WRITE_UNAUTHORIZED", 401, errorCode, details);
-  }
-};
-var WriteForbiddenError = class extends PersonalServerWriteError {
-  constructor(message, errorCode = null, details) {
-    super(message, "WRITE_FORBIDDEN", 403, errorCode, details);
-  }
-};
-var WriteConflictError = class extends PersonalServerWriteError {
-  constructor(message, errorCode = null, details) {
-    super(message, "WRITE_CONFLICT", 409, errorCode, details);
-  }
-};
-var WriteLineageError = class extends PersonalServerWriteError {
-  constructor(message, status = 422, errorCode = null, details) {
-    super(message, "WRITE_LINEAGE_REJECTED", status, errorCode, details);
-  }
-};
-var WriteRejectedError = class extends PersonalServerWriteError {
-  constructor(message, status, errorCode = null, details) {
-    super(message, "WRITE_REJECTED", status, errorCode, details);
-  }
-};
-var LineageReadError = class extends VanaError {
-  constructor(message, status, errorCode = null, details) {
-    super(message, "LINEAGE_READ_ERROR");
-    this.status = status;
-    this.errorCode = errorCode;
-    this.details = details;
-  }
-  status;
-  errorCode;
-  details;
-};
-var DerivativeQuestionRejectedError = class extends PersonalServerWriteError {
-  constructor(message, status, errorCode = null, details) {
-    super(message, "DERIVATIVE_QUESTION_REJECTED", status, errorCode, details);
-  }
-};
-var DerivativeQuestionInvalidError = class extends PersonalServerWriteError {
-  constructor(message, status = 400, errorCode = null, details) {
-    super(message, "DERIVATIVE_QUESTION_INVALID", status, errorCode, details);
-  }
-};
-var DerivativeQuestionNotFoundError = class extends PersonalServerWriteError {
-  constructor(message, errorCode = null, details) {
-    super(message, "DERIVATIVE_QUESTION_NOT_FOUND", 404, errorCode, details);
-  }
-};
-var DerivativeDerivedScopeRequiredError = class extends PersonalServerWriteError {
-  constructor(message, errorCode = null, details) {
-    super(
-      message,
-      "DERIVATIVE_DERIVED_SCOPE_REQUIRED",
-      400,
-      errorCode,
-      details
-    );
-  }
-};
-var DerivativeSourceNotGrantedError = class extends PersonalServerWriteError {
-  constructor(message, errorCode = null, details) {
-    super(message, "DERIVATIVE_SOURCE_NOT_GRANTED", 403, errorCode, details);
-  }
-};
-var DerivativeCycleError = class extends PersonalServerWriteError {
-  constructor(message, errorCode = null, details) {
-    super(message, "DERIVATIVE_CYCLE", 409, errorCode, details);
-  }
-};
-var DerivativeComputeUnavailableError = class extends PersonalServerWriteError {
-  constructor(message, errorCode = null, details) {
-    super(message, "DERIVATIVE_COMPUTE_UNAVAILABLE", 503, errorCode, details);
-  }
-};
-var DerivativeQuestionTimeoutError = class extends PersonalServerWriteError {
-  constructor(message, details) {
-    super(message, "DERIVATIVE_QUESTION_TIMEOUT", void 0, null, details);
-  }
-};
-var DerivativeQuestionFailedError = class extends PersonalServerWriteError {
-  constructor(message, details) {
-    super(message, "DERIVATIVE_QUESTION_FAILED", void 0, null, details);
-  }
-};
-var DataPointDeletedError = class extends VanaError {
-  constructor(message, details = {}) {
-    super(message, "DATA_POINT_DELETED");
-    this.details = details;
-  }
-  details;
-};
-var DataPointNotFoundError = class extends VanaError {
-  constructor(message, details = {}) {
-    super(message, "DATA_POINT_NOT_FOUND");
-    this.details = details;
-  }
-  details;
-};
-var DataPointVersionConflictError = class extends VanaError {
-  constructor(message, details = {}) {
-    super(message, "DATA_POINT_VERSION_CONFLICT");
-    this.details = details;
-  }
-  details;
-};
+// src/index.browser.ts
+export * from "./errors.js";
 
 // src/contracts/contractController.ts
 import {
@@ -31495,31 +31214,11 @@ async function decryptWithPassword(encrypted, password) {
 
 // src/auth/web3-signed.ts
 import { recoverMessageAddress as recoverMessageAddress2 } from "viem";
-
-// src/auth/errors.ts
-var MissingAuthError = class extends VanaError {
-  constructor(message = "Missing authentication", details) {
-    super(message, "MISSING_AUTH");
-    this.details = details;
-  }
-  details;
-};
-var InvalidSignatureError = class extends VanaError {
-  constructor(details, message = "Invalid signature") {
-    super(message, "INVALID_SIGNATURE");
-    this.details = details;
-  }
-  details;
-};
-var ExpiredTokenError = class extends VanaError {
-  constructor(details, message = "Token has expired") {
-    super(message, "EXPIRED_TOKEN");
-    this.details = details;
-  }
-  details;
-};
-
-// src/auth/web3-signed.ts
+import {
+  MissingAuthError,
+  InvalidSignatureError,
+  ExpiredTokenError
+} from "./auth/errors.js";
 var WEB3_SIGNED_PREFIX = "Web3Signed ";
 var CLOCK_SKEW_SECONDS = 60;
 function base64urlDecode(input) {
@@ -31637,6 +31336,13 @@ async function verifyWeb3Signed(params) {
   return { signer, payload };
 }
 
+// src/index.browser.ts
+import {
+  MissingAuthError as MissingAuthError2,
+  InvalidSignatureError as InvalidSignatureError2,
+  ExpiredTokenError as ExpiredTokenError2
+} from "./auth/errors.js";
+
 // src/protocol/eip712.ts
 var DOMAIN_NAME = "Vana Data Portability";
 var DOMAIN_VERSION = "1";
@@ -31736,9 +31442,974 @@ var RECORD_DATA_ACCESS_TYPES = {
   ]
 };
 
+// src/protocol/identity.ts
+init_interface();
+import * as secp256k13 from "@noble/secp256k1";
+import {
+  concat as concat4,
+  encodePacked,
+  fromHex as fromHex5,
+  getAddress,
+  isAddressEqual,
+  keccak256,
+  recoverPublicKey,
+  toBytes,
+  toHex as toHex6
+} from "viem";
+import { publicKeyToAddress } from "viem/accounts";
+var ENCLAVE_IDENTITY_EVIDENCE_VERSION = 1;
+var USER_PS_ID_DOMAIN = "vana.ps-enclave.v1";
+var ENCLAVE_WALLET_PURPOSE = "vana.ps-enclave.wallet.v1";
+var MASTER_SIGNATURE_DELIVERY_VERSION = "vana.ps-enclave.delivery.v1";
+var MASTER_SIGNATURE_DELIVERY_MAX_AGE_SECONDS = 600;
+var SEALED_ENVELOPE_VERSION = 1;
+var VANA_MAINNET_CHAIN_ID = 1480;
+var MOKSHA_CHAIN_ID = 14800;
+var KMS_ISSUED_PREFIX = "dstack-kms-issued";
+var PREIMAGE_SEPARATOR = ":";
+var UNCOMPRESSED_PUBLIC_KEY_BYTES = 65;
+var UNCOMPRESSED_PUBLIC_KEY_PREFIX = "04";
+var EMPTY_HEX = "0x";
+function emptyAnchor() {
+  return Object.freeze({
+    kmsRootPubkey: EMPTY_HEX,
+    appIds: Object.freeze([])
+  });
+}
+var ENCLAVE_TRUST_ANCHORS = Object.freeze({
+  // filled at fleet provisioning; verify fails closed while empty
+  [VANA_MAINNET_CHAIN_ID]: emptyAnchor(),
+  // Moksha workers share this dstack app and KMS root; the controller does not derive owner keys.
+  [MOKSHA_CHAIN_ID]: Object.freeze({
+    kmsRootPubkey: "0x0434c76e0c3f52ec64cbf9bbf5c910c272330166fd656c0a86bb330963e46910e1a0e6fa51bec74be2f9129342707636060d85856d102cee8290185409ecf7422f",
+    appIds: Object.freeze([
+      "0xec9a39de98c760e1ded9f1e97016dc5f0e357cf2"
+    ])
+  })
+});
+function userPsId(chainId, ownerAddress) {
+  const packed = encodePacked(
+    ["string", "uint256", "address"],
+    [USER_PS_ID_DOMAIN, BigInt(chainId), getAddress(ownerAddress)]
+  );
+  return keccak256(packed);
+}
+function compressPublicKey(publicKey) {
+  return secp256k13.ProjectivePoint.fromHex(
+    fromHex5(publicKey, "bytes")
+  ).toRawBytes(true);
+}
+function sameKey(a, b) {
+  return toHex6(compressPublicKey(a)) === toHex6(compressPublicKey(b));
+}
+function assertUncompressedKey(publicKey) {
+  const hex = publicKey.slice(2);
+  if (hex.length !== UNCOMPRESSED_PUBLIC_KEY_BYTES * 2 || !hex.startsWith(UNCOMPRESSED_PUBLIC_KEY_PREFIX) || !/^[0-9a-fA-F]+$/.test(hex)) {
+    throw new Error("Public key must be a 65-byte uncompressed secp256k1 key");
+  }
+}
+function appRootPreimage(purpose, publicKey) {
+  const keyHex = toHex6(compressPublicKey(publicKey)).slice(2);
+  return keccak256(toBytes(`${purpose}${PREIMAGE_SEPARATOR}${keyHex}`));
+}
+function kmsIssuedPreimage(appId, appRootPublicKey) {
+  const prefix = concat4([
+    toBytes(`${KMS_ISSUED_PREFIX}${PREIMAGE_SEPARATOR}`),
+    fromHex5(appId, "bytes")
+  ]);
+  const compressed = compressPublicKey(appRootPublicKey);
+  return keccak256(concat4([prefix, compressed]));
+}
+async function recoverChainKey(hash, signature, link) {
+  try {
+    return (await recoverPublicKey({ hash, signature })).toLowerCase();
+  } catch {
+    throw new Error(`Invalid enclave signature chain link ${link}`);
+  }
+}
+async function verifyEnclaveIdentityEvidence(evidence, anchors, expected) {
+  if (evidence.v !== ENCLAVE_IDENTITY_EVIDENCE_VERSION) {
+    throw new Error("Unsupported enclave identity evidence version");
+  }
+  if (!Number.isInteger(evidence.epoch) || evidence.epoch < 1) {
+    throw new Error("Invalid enclave identity epoch");
+  }
+  if (evidence.chainId !== expected.chainId) {
+    throw new Error(
+      "Enclave identity chain ID does not match expected chain ID"
+    );
+  }
+  if (!isAddressEqual(evidence.ownerAddress, expected.ownerAddress)) {
+    throw new Error("Enclave identity owner does not match expected owner");
+  }
+  if (evidence.epoch !== expected.epoch) {
+    throw new Error("Enclave identity epoch does not match expected epoch");
+  }
+  const expectedUserPsId = userPsId(expected.chainId, expected.ownerAddress);
+  if (evidence.userPsId.toLowerCase() !== expectedUserPsId.toLowerCase()) {
+    throw new Error("Enclave userPsId does not match expected identity");
+  }
+  if (evidence.purpose !== ENCLAVE_WALLET_PURPOSE) {
+    throw new Error("Unexpected enclave wallet purpose");
+  }
+  if (anchors.kmsRootPubkey === EMPTY_HEX) {
+    throw new Error("KMS root trust anchor is not provisioned");
+  }
+  assertUncompressedKey(evidence.publicKey);
+  const derivedAddress = publicKeyToAddress(evidence.publicKey);
+  if (getAddress(derivedAddress) !== getAddress(evidence.address)) {
+    throw new Error("Enclave public key does not match its address");
+  }
+  const appRootPublicKey = await recoverChainKey(
+    appRootPreimage(evidence.purpose, evidence.publicKey),
+    evidence.signatureChain[0],
+    0
+  );
+  const kmsRootPublicKey = await recoverChainKey(
+    kmsIssuedPreimage(evidence.appId, appRootPublicKey),
+    evidence.signatureChain[1],
+    1
+  );
+  let matchesAnchor;
+  try {
+    matchesAnchor = sameKey(kmsRootPublicKey, anchors.kmsRootPubkey);
+  } catch {
+    throw new Error("KMS root trust anchor is malformed");
+  }
+  if (!matchesAnchor) {
+    throw new Error("KMS root public key does not match the trust anchor");
+  }
+  if (keccak256(kmsRootPublicKey) !== evidence.kmsRootFingerprint.toLowerCase()) {
+    throw new Error("KMS root fingerprint does not match the evidence");
+  }
+  const appId = evidence.appId.toLowerCase();
+  if (!anchors.appIds.some((allowedAppId) => allowedAppId.toLowerCase() === appId)) {
+    throw new Error("Enclave app ID is not trusted");
+  }
+}
+async function buildMasterSignatureDelivery(evidence, masterSignature, now = Math.floor(Date.now() / 1e3)) {
+  deriveMasterKey(masterSignature);
+  const signerAddress = await recoverServerOwner(masterSignature);
+  if (!isAddressEqual(signerAddress, evidence.ownerAddress)) {
+    throw new Error("Master signature signer does not match evidence owner");
+  }
+  return {
+    v: MASTER_SIGNATURE_DELIVERY_VERSION,
+    userPsId: evidence.userPsId,
+    epoch: evidence.epoch,
+    enclaveAddress: evidence.address,
+    ownerAddress: evidence.ownerAddress,
+    masterSignature,
+    issuedAt: now
+  };
+}
+async function encryptMasterSignatureDelivery(delivery, publicKey, ecies) {
+  assertUncompressedKey(publicKey);
+  if (!isAddressEqual(publicKeyToAddress(publicKey), delivery.enclaveAddress)) {
+    throw new Error(
+      "Public key does not belong to the delivery's enclave address"
+    );
+  }
+  const plaintext = toBytes(JSON.stringify(delivery));
+  const encrypted = await ecies.encrypt(fromHex5(publicKey, "bytes"), plaintext);
+  return `0x${serializeECIES(encrypted)}`;
+}
+
+// src/protocol/jobs.ts
+var JOB_PROTOCOL_VERSION = 1;
+var JOB_OPERATIONS = ["raw_read", "inference"];
+var JOB_STATES = [
+  "queued",
+  "claimed",
+  "running",
+  "completed",
+  "failed",
+  "expired",
+  "cancelled"
+];
+var DEFAULT_LEASE_SECONDS = 30;
+var MAX_LEASE_SECONDS = 300;
+var MAX_ATTEMPTS = 3;
+var MAX_WAIT_SECONDS = 25;
+var CLAIM_POLL_FLOOR_MS = 1e3;
+var DEFAULT_JOB_DEADLINE_SECONDS = 600;
+var MAX_JOB_DEADLINE_SECONDS = 3600;
+
+// src/crypto/envelope/job.ts
+init_constants();
+init_interface();
+import { sha256 as sha2565 } from "@noble/hashes/sha2";
+import { bytesToHex as bytesToHex2, fromHex as fromHex6, isAddress, isHex, toHex as toHex7 } from "viem";
+var textDecoder = new TextDecoder();
+var textEncoder = new TextEncoder();
+var MAX_JOB_RESULT_HEADER_BYTES = 4096;
+var WRAPPED_KEY_LENGTH_BYTES = 4;
+var FRAME_LENGTH_BYTES = 4;
+var FRAME_FLAGS_BYTES = 1;
+var AES_KEY_BYTES = 32;
+var AES_GCM_NONCE_BYTES = 12;
+var AES_GCM_TAG_BYTES = 16;
+var WRAPPED_METADATA_LENGTH_BYTES = 4;
+var WRAPPED_KEY_PLAINTEXT_PREFIX_BYTES = AES_KEY_BYTES + AES_GCM_NONCE_BYTES + WRAPPED_METADATA_LENGTH_BYTES;
+var MAX_WRAPPED_KEY_BYTES = 8192;
+var FINAL_FRAME_FLAG = 1;
+var MAX_CHUNK_INDEX = 4294967295;
+var JOB_RESULT_FORMAT_VERSION = 2;
+var JOB_RESULT_CHUNK_BYTES = 1024 * 1024;
+var JobEnvelopeError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "JobEnvelopeError";
+  }
+};
+function sortJsonKeys(value) {
+  if (Array.isArray(value)) {
+    return value.map(sortJsonKeys);
+  }
+  if (value !== null && typeof value === "object") {
+    return Object.fromEntries(
+      Object.keys(value).sort().map((key) => [
+        key,
+        sortJsonKeys(value[key])
+      ])
+    );
+  }
+  return value;
+}
+function canonicalJsonBytes(value) {
+  return textEncoder.encode(JSON.stringify(sortJsonKeys(value)));
+}
+function canonicalJobRequestBytes(request) {
+  validateJobRequest(request);
+  return canonicalJsonBytes(request);
+}
+function requestPlaintext(envelope) {
+  validateRequestEnvelope(envelope);
+  return canonicalJsonBytes(envelope);
+}
+function resultMetadata(result) {
+  return {
+    v: result.v,
+    jobId: result.jobId,
+    scope: result.scope,
+    version: result.version,
+    contentType: result.contentType
+  };
+}
+function encryptedBytesToBase64(encrypted) {
+  return toBase64(fromHex6(`0x${serializeECIES(encrypted)}`, "bytes"));
+}
+function encryptedToBytes(encrypted) {
+  const bytes = new Uint8Array(
+    encrypted.iv.length + encrypted.ephemPublicKey.length + encrypted.ciphertext.length + encrypted.mac.length
+  );
+  let offset = 0;
+  bytes.set(encrypted.iv, offset);
+  offset += encrypted.iv.length;
+  bytes.set(encrypted.ephemPublicKey, offset);
+  offset += encrypted.ephemPublicKey.length;
+  bytes.set(encrypted.ciphertext, offset);
+  offset += encrypted.ciphertext.length;
+  bytes.set(encrypted.mac, offset);
+  return bytes;
+}
+function bytesToEncrypted(bytes) {
+  const absoluteMinLength = FORMAT.IV_LENGTH + 1 + MAC.LENGTH + 1;
+  if (bytes.length < absoluteMinLength) {
+    throw new ECIESError(
+      `Invalid ECIES data: too short (${bytes.length} bytes, minimum ${absoluteMinLength} bytes required)`,
+      "DECRYPTION_FAILED"
+    );
+  }
+  const prefix = bytes[FORMAT.EPHEMERAL_KEY_OFFSET];
+  if (prefix !== CURVE.PREFIX.UNCOMPRESSED) {
+    throw new ECIESError(
+      `Invalid ephemeral public key: must be uncompressed format (0x04 prefix), got 0x${prefix.toString(16).padStart(2, "0")}`,
+      "DECRYPTION_FAILED"
+    );
+  }
+  const ephemKeySize = CURVE.UNCOMPRESSED_PUBLIC_KEY_LENGTH;
+  const minLength = FORMAT.IV_LENGTH + ephemKeySize + MAC.LENGTH + 1;
+  if (bytes.length < minLength) {
+    throw new ECIESError(
+      `Invalid ECIES data: too short (${bytes.length} bytes, minimum ${minLength} bytes required)`,
+      "DECRYPTION_FAILED"
+    );
+  }
+  return {
+    iv: bytes.subarray(FORMAT.IV_OFFSET, FORMAT.IV_OFFSET + FORMAT.IV_LENGTH),
+    ephemPublicKey: bytes.subarray(
+      FORMAT.EPHEMERAL_KEY_OFFSET,
+      FORMAT.EPHEMERAL_KEY_OFFSET + ephemKeySize
+    ),
+    ciphertext: bytes.subarray(
+      FORMAT.EPHEMERAL_KEY_OFFSET + ephemKeySize,
+      bytes.length - MAC.LENGTH
+    ),
+    mac: bytes.subarray(bytes.length - MAC.LENGTH)
+  };
+}
+function base64ToEncrypted(ciphertext) {
+  return deserializeECIES(toHex7(fromBase64(ciphertext)));
+}
+function parseObject(plaintext, kind) {
+  try {
+    const value = JSON.parse(textDecoder.decode(plaintext));
+    if (value === null || typeof value !== "object" || Array.isArray(value)) {
+      throw new JobEnvelopeError(`Invalid ${kind}: expected an object`);
+    }
+    return value;
+  } catch (error) {
+    if (error instanceof JobEnvelopeError) throw error;
+    throw new JobEnvelopeError(`Invalid ${kind}: malformed JSON`);
+  }
+}
+function isPlainObject2(value) {
+  if (value === null || typeof value !== "object") return false;
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+function requirePlainObject(value, field, kind) {
+  if (!isPlainObject2(value)) {
+    throw new JobEnvelopeError(`Invalid ${kind}: invalid ${field}`);
+  }
+}
+function requireExactKeys(value, expectedKeys, kind) {
+  for (const key of expectedKeys) {
+    if (!Object.hasOwn(value, key) || value[key] === void 0) {
+      throw new JobEnvelopeError(`Invalid ${kind}: missing ${key}`);
+    }
+  }
+  const expected = new Set(expectedKeys);
+  for (const key of Reflect.ownKeys(value)) {
+    if (!expected.has(key)) {
+      throw new JobEnvelopeError(
+        `Invalid ${kind}: unknown field ${String(key)}`
+      );
+    }
+  }
+}
+function requireString(value, field, kind) {
+  if (typeof value !== "string" || value.length === 0) {
+    throw new JobEnvelopeError(`Invalid ${kind}: missing ${field}`);
+  }
+}
+function validateJobRequest(value) {
+  requirePlainObject(value, "request", "job request");
+  requireExactKeys(
+    value,
+    [
+      "v",
+      "jobId",
+      "owner",
+      "builder",
+      "builderPublicKey",
+      "grantId",
+      "scope",
+      "operation",
+      "pinnedVersion",
+      "deadline"
+    ],
+    "job request"
+  );
+  if (value.v !== JOB_PROTOCOL_VERSION) {
+    throw new JobEnvelopeError(
+      `Unsupported job request version: ${String(value.v)}`
+    );
+  }
+  requireString(value.jobId, "jobId", "job request");
+  if (typeof value.owner !== "string" || !isAddress(value.owner)) {
+    throw new JobEnvelopeError("Invalid job request: invalid owner");
+  }
+  if (typeof value.builder !== "string" || !isAddress(value.builder)) {
+    throw new JobEnvelopeError("Invalid job request: invalid builder");
+  }
+  if (typeof value.builderPublicKey !== "string" || !isHex(value.builderPublicKey)) {
+    throw new JobEnvelopeError("Invalid job request: invalid builderPublicKey");
+  }
+  if (typeof value.grantId !== "string" || !isHex(value.grantId)) {
+    throw new JobEnvelopeError("Invalid job request: invalid grantId");
+  }
+  requireString(value.scope, "scope", "job request");
+  if (!JOB_OPERATIONS.includes(value.operation)) {
+    throw new JobEnvelopeError("Invalid job request: invalid operation");
+  }
+  if (value.pinnedVersion !== null && typeof value.pinnedVersion !== "string") {
+    throw new JobEnvelopeError("Invalid job request: missing pinnedVersion");
+  }
+  if (typeof value.deadline !== "string" || !Number.isFinite(Date.parse(value.deadline))) {
+    throw new JobEnvelopeError("Invalid job request: invalid deadline");
+  }
+  return value;
+}
+function validateRequestEnvelope(value) {
+  requirePlainObject(value, "envelope", "job request envelope");
+  requireExactKeys(value, ["request", "auth"], "job request envelope");
+  validateJobRequest(value.request);
+  requireString(value.auth, "auth", "job request envelope");
+  return value;
+}
+function validateResultMetadata(value) {
+  requirePlainObject(value, "metadata", "job result");
+  requireExactKeys(
+    value,
+    ["v", "jobId", "scope", "version", "contentType"],
+    "job result"
+  );
+  if (value.v !== JOB_PROTOCOL_VERSION) {
+    throw new JobEnvelopeError(
+      `Unsupported job result version: ${String(value.v)}`
+    );
+  }
+  for (const field of ["jobId", "scope", "contentType"]) {
+    requireString(value[field], field, "job result");
+  }
+  if (value.version !== null && typeof value.version !== "string") {
+    throw new JobEnvelopeError("Invalid job result: missing version");
+  }
+  return value;
+}
+function validateResult(value) {
+  requirePlainObject(value, "result", "job result");
+  requireExactKeys(
+    value,
+    ["v", "jobId", "scope", "version", "contentType", "body"],
+    "job result"
+  );
+  validateResultMetadata(resultMetadata(value));
+  if (!(value.body instanceof Uint8Array)) {
+    throw new JobEnvelopeError("Invalid job result: missing body");
+  }
+  return value;
+}
+function webCrypto() {
+  if (typeof globalThis.crypto === "undefined" || typeof globalThis.crypto.getRandomValues !== "function" || !globalThis.crypto.subtle) {
+    throw new JobEnvelopeError(
+      "Job result streaming requires the Web Crypto API"
+    );
+  }
+  return globalThis.crypto;
+}
+function uint32(value) {
+  const bytes = new Uint8Array(4);
+  new DataView(bytes.buffer).setUint32(0, value);
+  return bytes;
+}
+function readUint32(bytes, offset = 0) {
+  return new DataView(bytes.buffer, bytes.byteOffset + offset, 4).getUint32(0);
+}
+function wrappedKeyPlaintext(contentKey, noncePrefix, metadataBytes) {
+  const plaintext = new Uint8Array(
+    WRAPPED_KEY_PLAINTEXT_PREFIX_BYTES + metadataBytes.length
+  );
+  plaintext.set(contentKey, 0);
+  plaintext.set(noncePrefix, AES_KEY_BYTES);
+  new DataView(plaintext.buffer).setUint32(
+    AES_KEY_BYTES + AES_GCM_NONCE_BYTES,
+    metadataBytes.length
+  );
+  plaintext.set(metadataBytes, WRAPPED_KEY_PLAINTEXT_PREFIX_BYTES);
+  return plaintext;
+}
+function parseWrappedKeyPlaintext(plaintext) {
+  if (plaintext.length < WRAPPED_KEY_PLAINTEXT_PREFIX_BYTES) {
+    throw new JobEnvelopeError("Invalid job result: wrapped key is truncated");
+  }
+  const metadataLength = readUint32(
+    plaintext,
+    AES_KEY_BYTES + AES_GCM_NONCE_BYTES
+  );
+  if (metadataLength > MAX_JOB_RESULT_HEADER_BYTES) {
+    throw new JobEnvelopeError(
+      `Invalid job result: header exceeds ${MAX_JOB_RESULT_HEADER_BYTES} bytes`
+    );
+  }
+  if (plaintext.length !== WRAPPED_KEY_PLAINTEXT_PREFIX_BYTES + metadataLength) {
+    throw new JobEnvelopeError(
+      "Invalid job result: header length exceeds payload"
+    );
+  }
+  const metadataBytes = plaintext.slice(WRAPPED_KEY_PLAINTEXT_PREFIX_BYTES);
+  const metadata = validateResultMetadata(
+    parseObject(metadataBytes, "job result header")
+  );
+  return {
+    contentKey: plaintext.slice(0, AES_KEY_BYTES),
+    noncePrefix: plaintext.slice(
+      AES_KEY_BYTES,
+      AES_KEY_BYTES + AES_GCM_NONCE_BYTES
+    ),
+    metadataBytes,
+    metadata
+  };
+}
+async function importAesKey(contentKey, usage) {
+  return webCrypto().subtle.importKey(
+    "raw",
+    contentKey,
+    { name: "AES-GCM" },
+    false,
+    [usage]
+  );
+}
+function chunkNonce(noncePrefix, chunkIndex) {
+  if (chunkIndex > MAX_CHUNK_INDEX) {
+    throw new JobEnvelopeError("Invalid job result: too many chunks");
+  }
+  const nonce = noncePrefix.slice();
+  const view = new DataView(nonce.buffer, nonce.byteOffset, nonce.byteLength);
+  view.setUint32(8, view.getUint32(8) ^ chunkIndex);
+  return nonce;
+}
+function chunkAad(metadataBytes, chunkIndex, final, plaintextLength) {
+  const aad = new Uint8Array(14 + metadataBytes.length);
+  aad[0] = JOB_RESULT_FORMAT_VERSION;
+  aad.set(uint32(metadataBytes.length), 1);
+  aad.set(metadataBytes, 5);
+  aad.set(uint32(chunkIndex), 5 + metadataBytes.length);
+  aad[9 + metadataBytes.length] = final ? FINAL_FRAME_FLAG : 0;
+  aad.set(uint32(plaintextLength), 10 + metadataBytes.length);
+  return aad;
+}
+async function encryptResultChunk(key, noncePrefix, metadataBytes, plaintext, chunkIndex, final) {
+  const encrypted = new Uint8Array(
+    await webCrypto().subtle.encrypt(
+      {
+        name: "AES-GCM",
+        iv: chunkNonce(noncePrefix, chunkIndex),
+        additionalData: chunkAad(
+          metadataBytes,
+          chunkIndex,
+          final,
+          plaintext.length
+        ),
+        tagLength: AES_GCM_TAG_BYTES * 8
+      },
+      key,
+      plaintext
+    )
+  );
+  const frame = new Uint8Array(
+    FRAME_LENGTH_BYTES + FRAME_FLAGS_BYTES + encrypted.length
+  );
+  new DataView(frame.buffer).setUint32(0, encrypted.length);
+  frame[FRAME_LENGTH_BYTES] = final ? FINAL_FRAME_FLAG : 0;
+  frame.set(encrypted, FRAME_LENGTH_BYTES + FRAME_FLAGS_BYTES);
+  return frame;
+}
+function verifyResultBindings(metadata, expect) {
+  if (metadata.jobId !== expect.jobId) {
+    throw new JobEnvelopeError(
+      `Job result ID ${metadata.jobId} does not match expected job ID ${expect.jobId}`
+    );
+  }
+  if (expect.scope !== void 0 && metadata.scope !== expect.scope) {
+    throw new JobEnvelopeError(
+      `Job result scope ${metadata.scope} does not match expected scope ${expect.scope}`
+    );
+  }
+  if (expect.version !== void 0 && metadata.version !== expect.version) {
+    throw new JobEnvelopeError(
+      `Job result version ${String(metadata.version)} does not match expected version ${String(expect.version)}`
+    );
+  }
+}
+var ByteStreamReader = class {
+  reader;
+  current;
+  offset = 0;
+  ended = false;
+  constructor(stream) {
+    this.reader = stream.getReader();
+  }
+  async ensureBytes() {
+    while (!this.current || this.offset === this.current.length) {
+      if (this.ended) return false;
+      const next = await this.reader.read();
+      if (next.done) {
+        this.ended = true;
+        this.current = void 0;
+        return false;
+      }
+      if (!(next.value instanceof Uint8Array)) {
+        throw new JobEnvelopeError(
+          "Invalid job result: stream yielded non-byte data"
+        );
+      }
+      this.current = next.value;
+      this.offset = 0;
+    }
+    return true;
+  }
+  async readExactOrNull(length) {
+    if (!await this.ensureBytes()) return null;
+    const bytes = new Uint8Array(length);
+    let written = 0;
+    while (written < length) {
+      if (!await this.ensureBytes()) {
+        throw new JobEnvelopeError("Invalid job result: truncated payload");
+      }
+      const available = this.current.length - this.offset;
+      const count = Math.min(available, length - written);
+      bytes.set(
+        this.current.subarray(this.offset, this.offset + count),
+        written
+      );
+      this.offset += count;
+      written += count;
+    }
+    return bytes;
+  }
+  async readExact(length) {
+    const bytes = await this.readExactOrNull(length);
+    if (!bytes) {
+      throw new JobEnvelopeError("Invalid job result: truncated payload");
+    }
+    return bytes;
+  }
+  async hasRemaining() {
+    return this.ensureBytes();
+  }
+  async cancel(reason) {
+    await this.reader.cancel(reason);
+  }
+};
+function normalizeChunkError(error) {
+  if (error instanceof JobEnvelopeError) return error;
+  return new JobEnvelopeError(
+    `Invalid job result: chunk authentication failed${error instanceof Error ? `: ${error.message}` : ""}`
+  );
+}
+async function sealJobRequest(envelope, enclavePublicKey, ecies) {
+  const encrypted = await ecies.encrypt(
+    fromHex6(enclavePublicKey, "bytes"),
+    requestPlaintext(envelope)
+  );
+  return encryptedBytesToBase64(encrypted);
+}
+async function openJobRequest(ciphertext, privateKey, ecies) {
+  const plaintext = await ecies.decrypt(
+    privateKey,
+    base64ToEncrypted(ciphertext)
+  );
+  return validateRequestEnvelope(
+    parseObject(plaintext, "job request envelope")
+  );
+}
+async function sealJobResultStream(metadataValue, builderPublicKey, ecies) {
+  const metadata = validateResultMetadata(metadataValue);
+  const metadataBytes = canonicalJsonBytes(metadata);
+  if (metadataBytes.length > MAX_JOB_RESULT_HEADER_BYTES) {
+    throw new JobEnvelopeError(
+      `Invalid job result: header exceeds ${MAX_JOB_RESULT_HEADER_BYTES} bytes`
+    );
+  }
+  const crypto2 = webCrypto();
+  const contentKey = crypto2.getRandomValues(new Uint8Array(AES_KEY_BYTES));
+  const noncePrefix = crypto2.getRandomValues(
+    new Uint8Array(AES_GCM_NONCE_BYTES)
+  );
+  const key = await importAesKey(contentKey, "encrypt");
+  const keyPlaintext = wrappedKeyPlaintext(
+    contentKey,
+    noncePrefix,
+    metadataBytes
+  );
+  const encryptedKey = await ecies.encrypt(
+    fromHex6(builderPublicKey, "bytes"),
+    keyPlaintext
+  );
+  contentKey.fill(0);
+  keyPlaintext.fill(0);
+  const wrappedKey = encryptedToBytes(encryptedKey);
+  if (wrappedKey.length > MAX_WRAPPED_KEY_BYTES) {
+    throw new JobEnvelopeError("Invalid job result: wrapped key is too large");
+  }
+  const header = new Uint8Array(
+    1 + WRAPPED_KEY_LENGTH_BYTES + wrappedKey.length
+  );
+  header[0] = JOB_RESULT_FORMAT_VERSION;
+  new DataView(header.buffer).setUint32(1, wrappedKey.length);
+  header.set(wrappedKey, 1 + WRAPPED_KEY_LENGTH_BYTES);
+  let pending = new Uint8Array(JOB_RESULT_CHUNK_BYTES);
+  let pendingLength = 0;
+  let chunkIndex = 0;
+  const transform = new TransformStream({
+    async transform(chunk, controller) {
+      if (!(chunk instanceof Uint8Array)) {
+        throw new JobEnvelopeError(
+          "Invalid job result: stream yielded non-byte data"
+        );
+      }
+      let offset = 0;
+      while (offset < chunk.length) {
+        if (pendingLength === JOB_RESULT_CHUNK_BYTES) {
+          controller.enqueue(
+            await encryptResultChunk(
+              key,
+              noncePrefix,
+              metadataBytes,
+              pending,
+              chunkIndex,
+              false
+            )
+          );
+          chunkIndex += 1;
+          pending = new Uint8Array(JOB_RESULT_CHUNK_BYTES);
+          pendingLength = 0;
+        }
+        const count = Math.min(
+          chunk.length - offset,
+          JOB_RESULT_CHUNK_BYTES - pendingLength
+        );
+        pending.set(chunk.subarray(offset, offset + count), pendingLength);
+        pendingLength += count;
+        offset += count;
+      }
+    },
+    async flush(controller) {
+      controller.enqueue(
+        await encryptResultChunk(
+          key,
+          noncePrefix,
+          metadataBytes,
+          pending.subarray(0, pendingLength),
+          chunkIndex,
+          true
+        )
+      );
+    }
+  });
+  return { header, transform };
+}
+async function sealJobResult(result, builderPublicKey, ecies) {
+  validateResult(result);
+  const sealed = await sealJobResultStream(
+    resultMetadata(result),
+    builderPublicKey,
+    ecies
+  );
+  const frameCount = Math.max(
+    1,
+    Math.ceil(result.body.length / JOB_RESULT_CHUNK_BYTES)
+  );
+  const size = sealed.header.length + result.body.length + frameCount * (FRAME_LENGTH_BYTES + FRAME_FLAGS_BYTES + AES_GCM_TAG_BYTES);
+  const bytes = new Uint8Array(size);
+  bytes.set(sealed.header, 0);
+  let outputOffset = sealed.header.length;
+  const reader = sealed.transform.readable.getReader();
+  const drain = (async () => {
+    for (; ; ) {
+      const next = await reader.read();
+      if (next.done) break;
+      bytes.set(next.value, outputOffset);
+      outputOffset += next.value.length;
+    }
+  })();
+  const writer = sealed.transform.writable.getWriter();
+  const fill = (async () => {
+    for (let offset = 0; offset < result.body.length; offset += JOB_RESULT_CHUNK_BYTES) {
+      await writer.write(
+        result.body.subarray(offset, offset + JOB_RESULT_CHUNK_BYTES)
+      );
+    }
+    await writer.close();
+  })();
+  await Promise.all([drain, fill]);
+  if (outputOffset !== bytes.length) {
+    throw new JobEnvelopeError("Invalid job result: sealed size mismatch");
+  }
+  return { bytes, hash: bytesToHex2(sha2565(bytes)), size };
+}
+async function openJobResultStream(bytesStream, builderPrivateKey, ecies, expect) {
+  const reader = new ByteStreamReader(bytesStream);
+  const headerPrefix = await reader.readExact(1 + WRAPPED_KEY_LENGTH_BYTES);
+  const formatVersion = headerPrefix[0];
+  if (formatVersion !== JOB_RESULT_FORMAT_VERSION) {
+    throw new JobEnvelopeError(
+      `Unsupported job result format: ${String(formatVersion)}`
+    );
+  }
+  const wrappedKeyLength = readUint32(headerPrefix, 1);
+  if (wrappedKeyLength === 0 || wrappedKeyLength > MAX_WRAPPED_KEY_BYTES) {
+    throw new JobEnvelopeError(
+      "Invalid job result: invalid wrapped key length"
+    );
+  }
+  const wrappedKey = await reader.readExact(wrappedKeyLength);
+  const keyPlaintext = await ecies.decrypt(
+    fromHex6(builderPrivateKey, "bytes"),
+    bytesToEncrypted(wrappedKey)
+  );
+  const parsed = parseWrappedKeyPlaintext(keyPlaintext);
+  verifyResultBindings(parsed.metadata, expect);
+  const key = await importAesKey(parsed.contentKey, "decrypt");
+  parsed.contentKey.fill(0);
+  keyPlaintext.fill(0);
+  let chunkIndex = 0;
+  let finished = false;
+  const body = new ReadableStream({
+    async pull(controller) {
+      if (finished) {
+        controller.close();
+        return;
+      }
+      try {
+        const frameHeader = await reader.readExactOrNull(
+          FRAME_LENGTH_BYTES + FRAME_FLAGS_BYTES
+        );
+        if (!frameHeader) {
+          throw new JobEnvelopeError("Invalid job result: missing final chunk");
+        }
+        const encryptedLength = readUint32(frameHeader);
+        if (encryptedLength < AES_GCM_TAG_BYTES || encryptedLength > JOB_RESULT_CHUNK_BYTES + AES_GCM_TAG_BYTES) {
+          throw new JobEnvelopeError(
+            "Invalid job result: invalid chunk length"
+          );
+        }
+        const flags = frameHeader[FRAME_LENGTH_BYTES];
+        if (flags !== 0 && flags !== FINAL_FRAME_FLAG) {
+          throw new JobEnvelopeError("Invalid job result: invalid chunk flags");
+        }
+        const final = flags === FINAL_FRAME_FLAG;
+        const plaintextLength = encryptedLength - AES_GCM_TAG_BYTES;
+        if (!final && plaintextLength !== JOB_RESULT_CHUNK_BYTES) {
+          throw new JobEnvelopeError(
+            "Invalid job result: short non-final chunk"
+          );
+        }
+        const encrypted = await reader.readExact(encryptedLength);
+        const plaintext = new Uint8Array(
+          await webCrypto().subtle.decrypt(
+            {
+              name: "AES-GCM",
+              iv: chunkNonce(parsed.noncePrefix, chunkIndex),
+              additionalData: chunkAad(
+                parsed.metadataBytes,
+                chunkIndex,
+                final,
+                plaintextLength
+              ),
+              tagLength: AES_GCM_TAG_BYTES * 8
+            },
+            key,
+            encrypted
+          )
+        );
+        if (plaintext.length !== plaintextLength) {
+          throw new JobEnvelopeError(
+            "Invalid job result: decrypted chunk length mismatch"
+          );
+        }
+        chunkIndex += 1;
+        if (final) {
+          if (await reader.hasRemaining()) {
+            throw new JobEnvelopeError(
+              "Invalid job result: bytes follow final chunk"
+            );
+          }
+          finished = true;
+        }
+        controller.enqueue(plaintext);
+        if (finished) controller.close();
+      } catch (error) {
+        controller.error(normalizeChunkError(error));
+        void reader.cancel(error).catch(() => void 0);
+      }
+    },
+    cancel(reason) {
+      return reader.cancel(reason);
+    }
+  });
+  return { metadata: parsed.metadata, body };
+}
+function bufferedResultBodySize(sealedBytes) {
+  if (sealedBytes.length < 1 + WRAPPED_KEY_LENGTH_BYTES) {
+    throw new JobEnvelopeError("Invalid job result: truncated payload");
+  }
+  if (sealedBytes[0] !== JOB_RESULT_FORMAT_VERSION) {
+    throw new JobEnvelopeError(
+      `Unsupported job result format: ${String(sealedBytes[0])}`
+    );
+  }
+  const wrappedKeyLength = readUint32(sealedBytes, 1);
+  if (wrappedKeyLength === 0 || wrappedKeyLength > MAX_WRAPPED_KEY_BYTES) {
+    throw new JobEnvelopeError(
+      "Invalid job result: invalid wrapped key length"
+    );
+  }
+  let offset = 1 + WRAPPED_KEY_LENGTH_BYTES + wrappedKeyLength;
+  if (offset > sealedBytes.length) {
+    throw new JobEnvelopeError("Invalid job result: truncated payload");
+  }
+  let bodySize = 0;
+  let sawFinal = false;
+  while (offset < sealedBytes.length) {
+    if (sealedBytes.length - offset < FRAME_LENGTH_BYTES + FRAME_FLAGS_BYTES) {
+      throw new JobEnvelopeError("Invalid job result: truncated payload");
+    }
+    const encryptedLength = readUint32(sealedBytes, offset);
+    const flags = sealedBytes[offset + FRAME_LENGTH_BYTES];
+    if (encryptedLength < AES_GCM_TAG_BYTES || encryptedLength > JOB_RESULT_CHUNK_BYTES + AES_GCM_TAG_BYTES || flags !== 0 && flags !== FINAL_FRAME_FLAG) {
+      throw new JobEnvelopeError("Invalid job result: invalid chunk framing");
+    }
+    const plaintextLength = encryptedLength - AES_GCM_TAG_BYTES;
+    if (flags === 0 && plaintextLength !== JOB_RESULT_CHUNK_BYTES) {
+      throw new JobEnvelopeError("Invalid job result: short non-final chunk");
+    }
+    offset += FRAME_LENGTH_BYTES + FRAME_FLAGS_BYTES;
+    if (encryptedLength > sealedBytes.length - offset) {
+      throw new JobEnvelopeError("Invalid job result: truncated payload");
+    }
+    offset += encryptedLength;
+    bodySize += plaintextLength;
+    if (flags === FINAL_FRAME_FLAG) {
+      sawFinal = true;
+      if (offset !== sealedBytes.length) {
+        throw new JobEnvelopeError(
+          "Invalid job result: bytes follow final chunk"
+        );
+      }
+    }
+  }
+  if (!sawFinal) {
+    throw new JobEnvelopeError("Invalid job result: missing final chunk");
+  }
+  return bodySize;
+}
+async function openJobResult(sealedBytes, builderPrivateKey, ecies, expect) {
+  const bodySize = bufferedResultBodySize(sealedBytes);
+  const stream = new ReadableStream({
+    start(controller) {
+      controller.enqueue(sealedBytes);
+      controller.close();
+    }
+  });
+  const opened = await openJobResultStream(
+    stream,
+    builderPrivateKey,
+    ecies,
+    expect
+  );
+  const body = new Uint8Array(bodySize);
+  let offset = 0;
+  await opened.body.pipeTo(
+    new WritableStream({
+      write(chunk) {
+        body.set(chunk, offset);
+        offset += chunk.length;
+      }
+    })
+  );
+  if (offset !== body.length) {
+    throw new JobEnvelopeError("Invalid job result: opened size mismatch");
+  }
+  return { ...opened.metadata, body };
+}
+
 // src/protocol/personal-server-registration.ts
 import {
-  isAddress
+  isAddress as isAddress2
 } from "viem";
 var PERSONAL_SERVER_REGISTRATION_DEFAULT_CHAIN_ID = vanaMainnet2.id;
 var PERSONAL_SERVER_REGISTRATION_DEFAULT_VERIFYING_CONTRACT = getContractAddress(
@@ -31746,7 +32417,7 @@ var PERSONAL_SERVER_REGISTRATION_DEFAULT_VERIFYING_CONTRACT = getContractAddress
   "DataPortabilityServers"
 );
 function assertAddress(value, name) {
-  if (!isAddress(value)) {
+  if (!isAddress2(value)) {
     throw new Error(`${name} must be a valid EVM address`);
   }
 }
@@ -31833,13 +32504,13 @@ var registerPersonalServerSignature = buildPersonalServerRegistrationSignature;
 
 // src/personal-server-lite/owner-binding.ts
 import {
-  isAddress as isAddress2
+  isAddress as isAddress3
 } from "viem";
 var PERSONAL_SERVER_LITE_OWNER_BINDING_VERSION = "vana.ps-lite.owner-binding.v1";
 var PERSONAL_SERVER_LITE_OWNER_BINDING_PURPOSE = "ps-lite-owner";
 var PERSONAL_SERVER_LITE_OWNER_BINDING_PREFIX = `${PERSONAL_SERVER_LITE_OWNER_BINDING_VERSION}:${PERSONAL_SERVER_LITE_OWNER_BINDING_PURPOSE}:`;
 function assertAddress2(value, name) {
-  if (!isAddress2(value)) {
+  if (!isAddress3(value)) {
     throw new Error(`${name} must be a valid EVM address`);
   }
 }
@@ -31889,7 +32560,7 @@ async function buildPersonalServerLiteOwnerBindingSignature(input) {
 var signPersonalServerLiteOwnerBinding = buildPersonalServerLiteOwnerBindingSignature;
 
 // src/account/personal-server-registration.ts
-import { isAddress as isAddress3 } from "viem";
+import { isAddress as isAddress4 } from "viem";
 var ACCOUNT_PERSONAL_SERVER_REGISTRATION_INTENT = "personal_server.server_registration.v1";
 var AccountPersonalServerRegistrationError = class extends Error {
   status;
@@ -31908,7 +32579,7 @@ function trimTrailingSlash(value) {
   return value.replace(/\/+$/, "");
 }
 function assertAddress3(value, name) {
-  if (!isAddress3(value)) {
+  if (!isAddress4(value)) {
     throw new Error(`${name} must be a valid EVM address`);
   }
 }
@@ -32434,19 +33105,21 @@ function buildMarkDataPointUnavailableRequest(config, input) {
 
 // src/protocol/data-point-deletion.ts
 import {
-  isAddress as isAddress5,
-  keccak256 as keccak2562,
+  isAddress as isAddress6,
+  keccak256 as keccak2563,
   maxUint256,
   stringToBytes as stringToBytes3
 } from "viem";
+import { DataPointDeletedError, DataPointNotFoundError } from "./errors.js";
 
 // src/protocol/lineage.ts
 import {
   encodeAbiParameters,
-  isAddress as isAddress4,
-  keccak256
+  isAddress as isAddress5,
+  keccak256 as keccak2562
 } from "viem";
 import { z } from "zod";
+import { LineageReadError, WriteRequestError as WriteRequestError2 } from "./errors.js";
 
 // src/protocol/personal-server-error-body.ts
 function isRecord2(value) {
@@ -32478,6 +33151,7 @@ async function readPersonalServerErrorBody(response) {
 }
 
 // src/protocol/write-signer.ts
+import { WriteRequestError } from "./errors.js";
 function isRecord3(value) {
   return value !== null && typeof value === "object";
 }
@@ -32523,12 +33197,12 @@ function isDataPointId(value) {
   return typeof value === "string" && DATA_POINT_ID_PATTERN.test(value);
 }
 function deriveDataPointId(ownerAddress, scope) {
-  if (!isAddress4(ownerAddress, { strict: false })) {
+  if (!isAddress5(ownerAddress, { strict: false })) {
     throw new Error(
       `ownerAddress is not an EVM address: ${String(ownerAddress)}`
     );
   }
-  return keccak256(
+  return keccak2562(
     encodeAbiParameters(
       [
         { name: "ownerAddress", type: "address" },
@@ -32558,7 +33232,7 @@ function derivedScopeViolatesNaming(derivedScope, sourceScope) {
 function assertDerivedScopeNaming(derivedScope, sourceScopes) {
   for (const sourceScope of sourceScopes) {
     if (derivedScopeViolatesNaming(derivedScope, sourceScope)) {
-      throw new WriteRequestError(
+      throw new WriteRequestError2(
         `Derived scope ${derivedScope} must not share its first segment with source scope ${sourceScope}; put derivatives in the app's own namespace`,
         { scope: derivedScope, sourceScope }
       );
@@ -32755,7 +33429,7 @@ var TOMBSTONE_METADATA_HASH_PREIMAGE = "vana.data-point.tombstone.metadata.v1";
 var TOMBSTONE_DATA_HASH = "0x30c45ee72fe56d1927701316925ab7ceacd3b6f9267061735d59396f075c6222";
 var TOMBSTONE_METADATA_HASH = "0xc5255a141acd6a2ae55971b62c0a85977c2511989dc114ad2abc2b7644f57d90";
 function computeTombstoneHash(preimage) {
-  return keccak2562(stringToBytes3(preimage));
+  return keccak2563(stringToBytes3(preimage));
 }
 function isTombstoneHashes(dataHash, metadataHash) {
   return typeof dataHash === "string" && typeof metadataHash === "string" && dataHash.toLowerCase() === TOMBSTONE_DATA_HASH && metadataHash.toLowerCase() === TOMBSTONE_METADATA_HASH;
@@ -32774,7 +33448,7 @@ function tombstoneDeletedAt(value) {
   return typeof deletedAt === "string" ? deletedAt : null;
 }
 function assertAddress4(value, name) {
-  if (!isAddress5(value)) {
+  if (!isAddress6(value)) {
     throw new Error(`${name} must be a valid EVM address`);
   }
 }
@@ -32916,6 +33590,9 @@ async function deleteDataPoint(input) {
   }
 }
 
+// src/protocol/personal-server-data.ts
+import { DataPointDeletedError as DataPointDeletedError2 } from "./errors.js";
+
 // src/protocol/data-file.ts
 import { z as z2 } from "zod";
 var DataFileEnvelopeSchema = z2.object({
@@ -32974,7 +33651,7 @@ async function readPersonalServerData(params) {
   const request = await buildPersonalServerDataReadRequest(params);
   const response = await fetchFn(request);
   if (response.status === 410) {
-    throw new DataPointDeletedError(
+    throw new DataPointDeletedError2(
       `Personal Server scope '${params.scope}' has been deleted`,
       {
         scope: params.scope,
@@ -32989,7 +33666,7 @@ async function readPersonalServerData(params) {
   }
   const body = await response.json();
   if (isDataPointTombstone(body)) {
-    throw new DataPointDeletedError(
+    throw new DataPointDeletedError2(
       `Personal Server scope '${params.scope}' has been deleted`,
       { scope: params.scope, deletedAt: tombstoneDeletedAt(body) }
     );
@@ -33189,20 +33866,31 @@ function tryGrantPermissions(scopes) {
 }
 
 // src/protocol/personal-server-write.ts
-import { sha256 as sha2566 } from "@noble/hashes/sha2";
-import { bytesToHex as bytesToHex3, isAddress as isAddress6 } from "viem";
+import { sha256 as sha2567 } from "@noble/hashes/sha2";
+import { bytesToHex as bytesToHex4, isAddress as isAddress7 } from "viem";
 import { z as z4 } from "zod";
+import {
+  WriteConflictError,
+  WriteForbiddenError,
+  WriteLineageError,
+  WriteRejectedError,
+  WriteRequestError as WriteRequestError4,
+  WriteSessionError,
+  WriteSessionExpiredError,
+  WriteUnauthorizedError
+} from "./errors.js";
 
 // src/protocol/write-request.ts
-import { sha256 as sha2565 } from "@noble/hashes/sha2";
-import { bytesToHex as bytesToHex2 } from "viem";
+import { sha256 as sha2566 } from "@noble/hashes/sha2";
+import { bytesToHex as bytesToHex3 } from "viem";
+import { WriteRequestError as WriteRequestError3, WriteTransportError } from "./errors.js";
 function normalizeBaseUrl2(url) {
   return url.replace(/\/+$/, "");
 }
 function resolveFetch2(fetchFn) {
   const resolved = fetchFn ?? globalThis.fetch;
   if (resolved === void 0) {
-    throw new WriteRequestError("No fetch implementation available");
+    throw new WriteRequestError3("No fetch implementation available");
   }
   return resolved;
 }
@@ -33257,27 +33945,27 @@ function nextProofIat(proofKey) {
   return sleep2(waitSec * 1e3).then(() => iat);
 }
 function freshProofNonce() {
-  const webCrypto = globalThis.crypto;
-  if (typeof webCrypto?.randomUUID === "function") {
-    return webCrypto.randomUUID();
+  const webCrypto2 = globalThis.crypto;
+  if (typeof webCrypto2?.randomUUID === "function") {
+    return webCrypto2.randomUUID();
   }
-  if (typeof webCrypto?.getRandomValues === "function") {
-    return bytesToHex2(webCrypto.getRandomValues(new Uint8Array(16)));
+  if (typeof webCrypto2?.getRandomValues === "function") {
+    return bytesToHex3(webCrypto2.getRandomValues(new Uint8Array(16)));
   }
-  throw new WriteRequestError(
+  throw new WriteRequestError3(
     "No secure random source available to build a proof nonce; provide a crypto global"
   );
 }
 function proofKeyFor(parts) {
-  return bytesToHex2(
-    sha2565(
+  return bytesToHex3(
+    sha2566(
       new TextEncoder().encode(
         JSON.stringify([
           parts.aud,
           parts.method,
           parts.uri,
           parts.grantId,
-          parts.signedBytes ? bytesToHex2(sha2565(parts.signedBytes)) : ""
+          parts.signedBytes ? bytesToHex3(sha2566(parts.signedBytes)) : ""
         ])
       )
     )
@@ -33420,7 +34108,7 @@ function isWriteSession(value) {
 }
 function sessionCoversScope(session, scope) {
   if (!isRecord2(session) || !Array.isArray(session.writeScopes) || !session.writeScopes.every((pattern) => typeof pattern === "string")) {
-    throw new WriteRequestError("session must come from openWriteSession");
+    throw new WriteRequestError4("session must come from openWriteSession");
   }
   return session.writeScopes.some(
     (pattern) => scopeMatchesPattern(scope, pattern)
@@ -33445,12 +34133,12 @@ function encodeWriteMetadataHeader(metadata) {
   try {
     json = JSON.stringify(metadata);
   } catch (err) {
-    throw new WriteRequestError(
+    throw new WriteRequestError4(
       `metadata is not JSON-serialisable: ${errorMessage(err)}`
     );
   }
   if (typeof json !== "string") {
-    throw new WriteRequestError("metadata must serialise to JSON");
+    throw new WriteRequestError4("metadata must serialise to JSON");
   }
   return json.replace(
     /[\u007f-\uffff]/g,
@@ -33464,7 +34152,7 @@ function binaryWriteSignedBytes(input) {
     mimeType: normalizeBinaryMimeType(input.contentType),
     ...input.filename ? { filename: input.filename } : {},
     sizeBytes: input.bytes.length,
-    contentHash: bytesToHex3(sha2566(input.bytes)),
+    contentHash: bytesToHex4(sha2567(input.bytes)),
     encoding: "base64",
     content: toBase64(input.bytes),
     ...metadata !== void 0 ? { metadata } : {}
@@ -33485,7 +34173,7 @@ function setFilenameHeader(headers, filename) {
 function assertNoReservedKeys(value, where) {
   for (const key of RESERVED_WRITE_KEYS) {
     if (Object.prototype.hasOwnProperty.call(value, key)) {
-      throw new WriteRequestError(
+      throw new WriteRequestError4(
         `${where} must not contain the reserved ${key} key; the Personal Server stamps it`,
         { key }
       );
@@ -33497,10 +34185,10 @@ function isLineagePair(value) {
 }
 function normalizeLineage(lineage, derivedScope) {
   if (!Array.isArray(lineage)) {
-    throw new WriteRequestError("lineage must be an array of data point ids");
+    throw new WriteRequestError4("lineage must be an array of data point ids");
   }
   if (lineage.length > MAX_LINEAGE_SOURCES) {
-    throw new WriteRequestError(
+    throw new WriteRequestError4(
       `lineage lists ${lineage.length} sources; the maximum is ${MAX_LINEAGE_SOURCES}`,
       { max: MAX_LINEAGE_SOURCES, count: lineage.length }
     );
@@ -33512,14 +34200,14 @@ function normalizeLineage(lineage, derivedScope) {
   for (const entry of lineage) {
     let id;
     if (isLineagePair(entry)) {
-      if (!isAddress6(entry.ownerAddress, { strict: false })) {
-        throw new WriteRequestError(
+      if (!isAddress7(entry.ownerAddress, { strict: false })) {
+        throw new WriteRequestError4(
           "lineage source ownerAddress must be an EVM address",
           { ownerAddress: entry.ownerAddress }
         );
       }
       if (entry.scope.length === 0) {
-        throw new WriteRequestError("lineage source scope is required");
+        throw new WriteRequestError4("lineage source scope is required");
       }
       id = deriveDataPointId(entry.ownerAddress, entry.scope);
       sourceScopes.push(entry.scope);
@@ -33527,14 +34215,14 @@ function normalizeLineage(lineage, derivedScope) {
     } else if (isDataPointId(entry)) {
       id = entry;
     } else {
-      throw new WriteRequestError(
+      throw new WriteRequestError4(
         "lineage entries must be 32-byte hex data point ids or { ownerAddress, scope } pairs",
         { entry }
       );
     }
     const normalized = id.toLowerCase();
     if (seen.has(normalized)) {
-      throw new WriteRequestError("lineage must not repeat a data point id", {
+      throw new WriteRequestError4("lineage must not repeat a data point id", {
         dataPointId: normalized
       });
     }
@@ -33543,7 +34231,7 @@ function normalizeLineage(lineage, derivedScope) {
   }
   for (const own of ownIds) {
     if (seen.has(own)) {
-      throw new WriteRequestError(
+      throw new WriteRequestError4(
         "lineage must not cite the record's own data point",
         { dataPointId: own, scope: derivedScope }
       );
@@ -33554,7 +34242,7 @@ function normalizeLineage(lineage, derivedScope) {
 }
 function assertNoLineageField(value, where) {
   if (Object.prototype.hasOwnProperty.call(value, LINEAGE_FIELD)) {
-    throw new WriteRequestError(
+    throw new WriteRequestError4(
       `${where}.${LINEAGE_FIELD} is reserved; pass sources through the lineage option`
     );
   }
@@ -33562,7 +34250,7 @@ function assertNoLineageField(value, where) {
 function buildMetadataHeader(metadata, sources) {
   if (metadata !== void 0) {
     if (!isRecord2(metadata)) {
-      throw new WriteRequestError("metadata must be a plain object");
+      throw new WriteRequestError4("metadata must be a plain object");
     }
     assertNoReservedKeys(metadata, "metadata");
     assertNoLineageField(metadata, "metadata");
@@ -33575,24 +34263,24 @@ function buildMetadataHeader(metadata, sources) {
 }
 function prepareWrite(params) {
   if (params.binary !== void 0 && params.data !== void 0) {
-    throw new WriteRequestError("Pass either data or binary, not both");
+    throw new WriteRequestError4("Pass either data or binary, not both");
   }
   const rawLineage = params.lineage;
   const sources = rawLineage === void 0 || rawLineage === null ? void 0 : normalizeLineage(rawLineage, params.scope);
   if (params.binary !== void 0) {
     const { bytes, contentType, filename } = params.binary;
     if (!(bytes instanceof Uint8Array)) {
-      throw new WriteRequestError("binary.bytes must be a Uint8Array");
+      throw new WriteRequestError4("binary.bytes must be a Uint8Array");
     }
     if (typeof contentType !== "string" || contentType.trim() === "") {
-      throw new WriteRequestError("binary.contentType is required");
+      throw new WriteRequestError4("binary.contentType is required");
     }
     if (filename !== void 0) {
       if (typeof filename !== "string") {
-        throw new WriteRequestError("binary.filename must be a string");
+        throw new WriteRequestError4("binary.filename must be a string");
       }
       if (filename !== filename.trim()) {
-        throw new WriteRequestError(
+        throw new WriteRequestError4(
           "binary.filename must not have leading or trailing whitespace"
         );
       }
@@ -33612,13 +34300,13 @@ function prepareWrite(params) {
     };
   }
   if (params.data === void 0) {
-    throw new WriteRequestError("Pass data (a JSON object) or binary");
+    throw new WriteRequestError4("Pass data (a JSON object) or binary");
   }
   if (!isRecord2(params.data)) {
-    throw new WriteRequestError("data must be a plain JSON object");
+    throw new WriteRequestError4("data must be a plain JSON object");
   }
   if (params.metadata !== void 0) {
-    throw new WriteRequestError(
+    throw new WriteRequestError4(
       "metadata applies to binary writes; put fields to store inside data"
     );
   }
@@ -33629,12 +34317,12 @@ function prepareWrite(params) {
   try {
     text = JSON.stringify(record);
   } catch (err) {
-    throw new WriteRequestError(
+    throw new WriteRequestError4(
       `data is not JSON-serialisable: ${errorMessage(err)}`
     );
   }
   if (typeof text !== "string" || !text.startsWith("{")) {
-    throw new WriteRequestError("data must serialise to a JSON object");
+    throw new WriteRequestError4("data must serialise to a JSON object");
   }
   const body = new TextEncoder().encode(text);
   return {
@@ -33663,11 +34351,11 @@ async function writeErrorFromResponse(response) {
 async function writeData(params) {
   const { session } = params;
   if (!isWriteSession(session)) {
-    throw new WriteRequestError("session must come from openWriteSession");
+    throw new WriteRequestError4("session must come from openWriteSession");
   }
   const fetchFn = resolveFetch2(params.fetch);
   if (typeof params.scope !== "string" || params.scope.length === 0) {
-    throw new WriteRequestError("scope is required");
+    throw new WriteRequestError4("scope is required");
   }
   const prepared = prepareWrite(params);
   if (Date.now() >= session.expiresAt) {
@@ -33763,6 +34451,21 @@ async function writePersonalServerData(params) {
 
 // src/protocol/derivative-questions.ts
 import { z as z5 } from "zod";
+import {
+  DerivativeComputeUnavailableError,
+  DerivativeCycleError,
+  DerivativeDerivedScopeRequiredError,
+  DerivativeQuestionFailedError,
+  DerivativeQuestionInvalidError,
+  DerivativeQuestionNotFoundError,
+  DerivativeQuestionRejectedError,
+  DerivativeQuestionTimeoutError,
+  DerivativeSourceNotGrantedError,
+  WriteConflictError as WriteConflictError2,
+  WriteForbiddenError as WriteForbiddenError2,
+  WriteRequestError as WriteRequestError5,
+  WriteUnauthorizedError as WriteUnauthorizedError2
+} from "./errors.js";
 var DERIVATIVE_QUESTIONS_PATH = "/v1/derivatives/questions";
 var MAX_QUESTION_SOURCE_SCOPES = 16;
 var MAX_QUESTION_CHARS = 8e3;
@@ -33845,15 +34548,15 @@ function fetchIdOf(fetchFn) {
 }
 function resolveRequest(params) {
   if (typeof params.personalServerUrl !== "string" || params.personalServerUrl.length === 0) {
-    throw new WriteRequestError("personalServerUrl is required");
+    throw new WriteRequestError5("personalServerUrl is required");
   }
   if (typeof params.grantId !== "string" || params.grantId.length === 0) {
-    throw new WriteRequestError(
+    throw new WriteRequestError5(
       "grantId is required; a question call runs under the grant carrying write:<derivedScope>"
     );
   }
   if (params.signer === null || typeof params.signer !== "object") {
-    throw new WriteRequestError(
+    throw new WriteRequestError5(
       "signer must be a viem LocalAccount, a viem WalletClient, or a { signMessage } object"
     );
   }
@@ -33929,13 +34632,13 @@ async function questionErrorFromResponse(response, body) {
   }
   switch (response.status) {
     case 401:
-      return new WriteUnauthorizedError(text, errorCode, details);
+      return new WriteUnauthorizedError2(text, errorCode, details);
     case 403:
-      return new WriteForbiddenError(text, errorCode, details);
+      return new WriteForbiddenError2(text, errorCode, details);
     case 404:
       return new DerivativeQuestionNotFoundError(text, errorCode, details);
     case 409:
-      return new WriteConflictError(text, errorCode, details);
+      return new WriteConflictError2(text, errorCode, details);
     default:
       return new DerivativeQuestionRejectedError(
         text,
@@ -34037,22 +34740,22 @@ async function sendQuestionRequest(params, spec, schema) {
 }
 function assertQuestionId(questionId) {
   if (typeof questionId !== "string" || questionId.length === 0) {
-    throw new WriteRequestError("questionId is required");
+    throw new WriteRequestError5("questionId is required");
   }
   return `${DERIVATIVE_QUESTIONS_PATH}/${encodeURIComponent(questionId)}`;
 }
 function registrationBody(params) {
   const { derivedScope, question } = params;
   if (typeof derivedScope !== "string" || derivedScope.length === 0) {
-    throw new WriteRequestError("derivedScope is required");
+    throw new WriteRequestError5("derivedScope is required");
   }
   if (!Array.isArray(params.sourceScopes) || params.sourceScopes.length === 0) {
-    throw new WriteRequestError(
+    throw new WriteRequestError5(
       "sourceScopes must be a non-empty array of scopes"
     );
   }
   if (params.sourceScopes.length > MAX_QUESTION_SOURCE_SCOPES) {
-    throw new WriteRequestError(
+    throw new WriteRequestError5(
       `sourceScopes lists ${params.sourceScopes.length} scopes; the maximum is ${MAX_QUESTION_SOURCE_SCOPES}`,
       { max: MAX_QUESTION_SOURCE_SCOPES, count: params.sourceScopes.length }
     );
@@ -34060,15 +34763,15 @@ function registrationBody(params) {
   const sourceScopes = [];
   for (const scope of params.sourceScopes) {
     if (typeof scope !== "string" || scope.length === 0) {
-      throw new WriteRequestError("sourceScopes entries must be scope strings");
+      throw new WriteRequestError5("sourceScopes entries must be scope strings");
     }
     if (sourceScopes.includes(scope)) {
-      throw new WriteRequestError("sourceScopes must not repeat a scope", {
+      throw new WriteRequestError5("sourceScopes must not repeat a scope", {
         duplicate: scope
       });
     }
     if (scope === derivedScope) {
-      throw new WriteRequestError(
+      throw new WriteRequestError5(
         "derivedScope cannot be one of its own sources",
         { scope }
       );
@@ -34076,17 +34779,17 @@ function registrationBody(params) {
     sourceScopes.push(scope);
   }
   if (typeof question !== "string" || question.trim() === "") {
-    throw new WriteRequestError("question must be a non-empty string");
+    throw new WriteRequestError5("question must be a non-empty string");
   }
   if (question.length > MAX_QUESTION_CHARS) {
-    throw new WriteRequestError(
+    throw new WriteRequestError5(
       `question is ${question.length} characters; the maximum is ${MAX_QUESTION_CHARS}`,
       { max: MAX_QUESTION_CHARS, length: question.length }
     );
   }
   if (params.model !== void 0) {
     if (typeof params.model !== "string" || params.model.length > MAX_QUESTION_MODEL_CHARS || !MODEL_ID_PATTERN.test(params.model)) {
-      throw new WriteRequestError("model must be a provider model id", {
+      throw new WriteRequestError5("model must be a provider model id", {
         model: params.model
       });
     }
@@ -34122,7 +34825,7 @@ async function getQuestion(params) {
 }
 async function listQuestions(params) {
   if (typeof params.derivedScope !== "string" || params.derivedScope.length === 0) {
-    throw new WriteRequestError(
+    throw new WriteRequestError5(
       "derivedScope is required; a builder may only list its own questions on a scope it may write"
     );
   }
@@ -34227,6 +34930,12 @@ async function askPersonalServer(params) {
 
 // src/protocol/derivative-status.ts
 import { z as z6 } from "zod";
+import {
+  DerivativeQuestionRejectedError as DerivativeQuestionRejectedError2,
+  DerivativeQuestionTimeoutError as DerivativeQuestionTimeoutError2,
+  WriteRequestError as WriteRequestError6,
+  WriteTransportError as WriteTransportError2
+} from "./errors.js";
 var DERIVATIVE_STATUS_PATH = "/v1/derivatives/status";
 var DEFAULT_DERIVATIVE_STATUS_TIMEOUT_MS = 12e4;
 var DEFAULT_DERIVATIVE_STATUS_POLL_INTERVAL_MS = 2e3;
@@ -34257,13 +34966,13 @@ function normalizeBaseUrl3(url) {
 function resolveFetch3(fetchFn) {
   const resolved = fetchFn ?? globalThis.fetch;
   if (resolved === void 0) {
-    throw new WriteRequestError("No fetch implementation available");
+    throw new WriteRequestError6("No fetch implementation available");
   }
   return resolved;
 }
 function requireDerivedScope(derivedScope) {
   if (typeof derivedScope !== "string" || derivedScope.length === 0) {
-    throw new WriteRequestError("derivedScope is required");
+    throw new WriteRequestError6("derivedScope is required");
   }
   return derivedScope;
 }
@@ -34282,7 +34991,7 @@ function sleep3(ms, signal) {
   });
 }
 function timeoutError(latest, timeoutMs) {
-  return new DerivativeQuestionTimeoutError(
+  return new DerivativeQuestionTimeoutError2(
     `Derived scope ${latest.derivedScope} was still ${latest.status} after ${timeoutMs}ms`,
     {
       derivedScope: latest.derivedScope,
@@ -34295,7 +35004,7 @@ function timeoutError(latest, timeoutMs) {
 }
 function abortError2(signal) {
   const reason = signal?.reason;
-  return reason instanceof Error ? reason : new WriteRequestError("Derivative status wait was aborted");
+  return reason instanceof Error ? reason : new WriteRequestError6("Derivative status wait was aborted");
 }
 function isDerivativeStatusSettled(status) {
   if (status.status === "ready") return true;
@@ -34328,7 +35037,7 @@ async function getDerivativeStatus(params) {
       }
     );
   } catch (err) {
-    throw new WriteTransportError(
+    throw new WriteTransportError2(
       `Derivative status read failed: ${err instanceof Error ? err.message : String(err)}`,
       1,
       err
@@ -34343,7 +35052,7 @@ async function getDerivativeStatus(params) {
   try {
     body = await response.json();
   } catch (err) {
-    throw new DerivativeQuestionRejectedError(
+    throw new DerivativeQuestionRejectedError2(
       "Derivative status response is not JSON",
       response.status,
       null,
@@ -34352,7 +35061,7 @@ async function getDerivativeStatus(params) {
   }
   const parsed = DerivativeStatusSchema.safeParse(body);
   if (!parsed.success) {
-    throw new DerivativeQuestionRejectedError(
+    throw new DerivativeQuestionRejectedError2(
       "Derivative status response is not a status view",
       response.status,
       null,
@@ -34386,6 +35095,11 @@ async function waitForDerivativeStatus(params) {
 }
 
 // src/protocol/gateway.ts
+import {
+  DataPointDeletedError as DataPointDeletedError3,
+  DataPointNotFoundError as DataPointNotFoundError2,
+  DataPointVersionConflictError
+} from "./errors.js";
 function withGrantPermissions(grant) {
   const stripped = { ...grant };
   delete stripped.permissions;
@@ -34431,7 +35145,7 @@ function createGatewayClient(baseUrl) {
   }
   async function deletedError(res, details) {
     const body = await readBody(res);
-    return new DataPointDeletedError(
+    return new DataPointDeletedError3(
       `Data point ${details.dataPointId ?? details.scope ?? ""} has been deleted`,
       { ...details, deletedAt: tombstoneDeletedAt(body) }
     );
@@ -34504,7 +35218,7 @@ function createGatewayClient(baseUrl) {
       }
       const record = await unwrapEnvelope(res);
       if (!options?.includeDeleted && isDataPointTombstone(record)) {
-        throw new DataPointDeletedError(
+        throw new DataPointDeletedError3(
           `Data point ${dataPointId} has been deleted`,
           {
             dataPointId,
@@ -34666,7 +35380,7 @@ function createGatewayClient(baseUrl) {
         })
       });
       if (res.status === 404) {
-        throw new DataPointNotFoundError(
+        throw new DataPointNotFoundError2(
           `Data point ${dataPointId} (scope '${params.scope}') is not registered`,
           details
         );
@@ -34989,42 +35703,34 @@ export {
   AccountPersonalServerLiteOwnerBindingError,
   AccountPersonalServerRegistrationError,
   BUILDER_REGISTRATION_TYPES,
-  BlockchainError,
   BrowserECIESUint8Provider as BrowserECIESProvider,
   BrowserPlatformAdapter,
+  CLAIM_POLL_FLOOR_MS,
   CONTRACTS,
   CallbackStorage,
   ContractFactory,
-  ContractNotFoundError,
   DATA_REGISTRY_STATUS_ABI,
   DEFAULT_DERIVATIVE_STATUS_POLL_INTERVAL_MS,
   DEFAULT_DERIVATIVE_STATUS_TIMEOUT_MS,
+  DEFAULT_JOB_DEADLINE_SECONDS,
+  DEFAULT_LEASE_SECONDS,
   DEFAULT_QUESTION_POLL_INTERVAL_MS,
   DEFAULT_QUESTION_TIMEOUT_MS,
   DERIVATIVE_ERROR_CODES,
   DERIVATIVE_QUESTIONS_PATH,
   DERIVATIVE_STATUS_PATH,
   DataFileEnvelopeSchema,
-  DataPointDeletedError,
-  DataPointNotFoundError,
   DataPointStatus,
-  DataPointVersionConflictError,
-  DerivativeComputeUnavailableError,
-  DerivativeCycleError,
-  DerivativeDerivedScopeRequiredError,
   DerivativeErrorCodeSchema,
-  DerivativeQuestionFailedError,
-  DerivativeQuestionInvalidError,
-  DerivativeQuestionNotFoundError,
-  DerivativeQuestionRejectedError,
   DerivativeQuestionSchema,
-  DerivativeQuestionTimeoutError,
-  DerivativeSourceNotGrantedError,
   DerivativeStatusSchema,
   DropboxStorage,
   ECIESError,
+  ENCLAVE_IDENTITY_EVIDENCE_VERSION,
+  ENCLAVE_TRUST_ANCHORS,
+  ENCLAVE_WALLET_PURPOSE,
   ESCROW_DEPOSIT_ABI2 as ESCROW_DEPOSIT_ABI,
-  ExpiredTokenError,
+  ExpiredTokenError2 as ExpiredTokenError,
   FEE_REGISTRY_ABI,
   GENERIC_PAYMENT_TYPES,
   GRANT_REGISTRATION_TYPES,
@@ -35032,26 +35738,34 @@ export {
   GoogleDriveStorage,
   InMemoryTokenStore,
   IngestResponseSchema,
-  InvalidConfigurationError,
   InvalidScopeEntryError,
-  InvalidSignatureError,
+  InvalidSignatureError2 as InvalidSignatureError,
   IpfsStorage,
+  JOB_OPERATIONS,
+  JOB_PROTOCOL_VERSION,
+  JOB_RESULT_CHUNK_BYTES,
+  JOB_RESULT_FORMAT_VERSION,
+  JOB_STATES,
+  JobEnvelopeError,
   LINEAGE_FIELD,
   LINEAGE_KEY,
   LineageEntrySchema,
   LineageGraphSchema,
   LineageNodeSchema,
-  LineageReadError,
   MASTER_KEY_MESSAGE,
+  MASTER_SIGNATURE_DELIVERY_MAX_AGE_SECONDS,
+  MASTER_SIGNATURE_DELIVERY_VERSION,
+  MAX_ATTEMPTS,
+  MAX_JOB_DEADLINE_SECONDS,
+  MAX_LEASE_SECONDS,
   MAX_LINEAGE_SOURCES,
   MAX_QUESTION_CHARS,
   MAX_QUESTION_MODEL_CHARS,
   MAX_QUESTION_SOURCE_SCOPES,
-  MissingAuthError,
+  MAX_WAIT_SECONDS,
+  MissingAuthError2 as MissingAuthError,
   NATIVE_ASSET_ADDRESS,
   NATIVE_VANA_ASSET,
-  NetworkError,
-  NonceError,
   OAuthClient,
   PERSONAL_SERVER_LITE_OWNER_BINDING_PREFIX,
   PERSONAL_SERVER_LITE_OWNER_BINDING_PURPOSE,
@@ -35061,9 +35775,6 @@ export {
   PKCE_CHALLENGE_PATTERN,
   PKCE_VERIFIER_PATTERN,
   PSError,
-  PermissionError,
-  PersonalServerError,
-  PersonalServerWriteError,
   PinataStorage,
   QUESTION_STATUSES,
   QuestionDeleteResultSchema,
@@ -35074,24 +35785,18 @@ export {
   RECORD_DATA_ACCESS_TYPES,
   REGISTRATION_KIND_FOR_OP,
   RESERVED_WRITE_KEYS,
-  ReadOnlyError,
   RedactedLineageNodeSchema,
-  RelayerError,
   SCOPE_ACTIONS,
+  SEALED_ENVELOPE_VERSION,
   SERVER_REGISTRATION_TYPES,
   ScopeSchema,
-  SerializationError,
-  ServerUrlMismatchError,
-  SignatureError,
   StorageError,
   StorageManager,
   TOMBSTONE_DATA_HASH,
   TOMBSTONE_DATA_HASH_PREIMAGE,
   TOMBSTONE_METADATA_HASH,
   TOMBSTONE_METADATA_HASH_PREIMAGE,
-  TransactionPendingError,
-  UserRejectedRequestError,
-  VanaError,
+  USER_PS_ID_DOMAIN,
   VanaStorage,
   WRITER_ATTRIBUTION_KEY,
   WRITE_CONTENT_DISPOSITION_HEADER,
@@ -35099,15 +35804,7 @@ export {
   WRITE_METADATA_HEADER,
   WRITE_SESSION_PATH,
   WRITE_SIGNATURE_HEADER,
-  WriteConflictError,
-  WriteForbiddenError,
-  WriteLineageError,
-  WriteRejectedError,
-  WriteRequestError,
-  WriteSessionError,
-  WriteSessionExpiredError,
-  WriteTransportError,
-  WriteUnauthorizedError,
+  appRootPreimage,
   askPersonalServer,
   assertDerivedScopeNaming,
   assertValidPkceVerifier,
@@ -35117,6 +35814,7 @@ export {
   buildDepositNativeRequest,
   buildDepositTokenRequest,
   buildMarkDataPointUnavailableRequest,
+  buildMasterSignatureDelivery,
   buildPersonalServerDataReadRequest,
   buildPersonalServerLiteOwnerBindingMessage,
   buildPersonalServerLiteOwnerBindingSignature,
@@ -35125,6 +35823,7 @@ export {
   buildSetDataPointStatusRequest,
   buildWeb3SignedHeader,
   builderRegistrationDomain,
+  canonicalJobRequestBytes,
   chains,
   clearContractCache,
   computeBodyHash,
@@ -35156,6 +35855,7 @@ export {
   encodeDepositTokenData,
   encodeSetDataPointStatusData,
   encodeWriteMetadataHeader,
+  encryptMasterSignatureDelivery,
   encryptWithPassword,
   escrowContractAddress,
   escrowPaymentDomain,
@@ -35190,12 +35890,16 @@ export {
   isPlatformSupported,
   isRedactedLineageNode,
   isTombstoneHashes,
+  kmsIssuedPreimage,
   listQuestions,
   mainnetServices,
   moksha,
   mokshaServices,
   mokshaTestnet2 as mokshaTestnet,
   normalizeBinaryMimeType,
+  openJobRequest,
+  openJobResult,
+  openJobResultStream,
   openWriteSession,
   parsePSError,
   parseScope,
@@ -35216,6 +35920,9 @@ export {
   scopeMatchesPattern,
   scopeNamespace,
   scopeToPathSegments,
+  sealJobRequest,
+  sealJobResult,
+  sealJobResultStream,
   serializeECIES,
   serverRegistrationDomain,
   sessionCoversScope,
@@ -35224,7 +35931,9 @@ export {
   signPersonalServerRegistrationWithAccount,
   tombstoneDeletedAt,
   tryGrantPermissions,
+  userPsId,
   vanaMainnet2 as vanaMainnet,
+  verifyEnclaveIdentityEvidence,
   verifyGrantRegistration,
   verifyPkceChallenge,
   verifyWeb3Signed,