@opendatalabs/vana-sdk 3.23.0 → 4.1.0

package/dist/index.node.js

@@ -1147,346 +1147,8 @@ var init_browser2 = __esm({
   }
 });
 
-// src/errors.ts
-var VanaError = class extends Error {
-  constructor(message, code) {
-    super(message);
-    this.code = code;
-    this.name = this.constructor.name;
-    if (Error.captureStackTrace) {
-      Error.captureStackTrace(this, this.constructor);
-    }
-  }
-  code;
-};
-var RelayerError = class extends VanaError {
-  constructor(message, statusCode, response) {
-    super(message, "RELAYER_ERROR");
-    this.statusCode = statusCode;
-    this.response = response;
-  }
-  statusCode;
-  response;
-};
-var UserRejectedRequestError = class extends VanaError {
-  constructor(message = "User rejected the signature request") {
-    super(message, "USER_REJECTED_REQUEST");
-  }
-};
-var InvalidConfigurationError = class extends VanaError {
-  constructor(message) {
-    super(message, "INVALID_CONFIGURATION");
-  }
-};
-var ContractNotFoundError = class extends VanaError {
-  constructor(contractName, chainId) {
-    super(
-      `Contract ${contractName} not found on chain ${chainId}`,
-      "CONTRACT_NOT_FOUND"
-    );
-  }
-};
-var BlockchainError = class extends VanaError {
-  constructor(message, originalError) {
-    super(message, "BLOCKCHAIN_ERROR");
-    this.originalError = originalError;
-  }
-  originalError;
-};
-var SerializationError = class extends VanaError {
-  constructor(message) {
-    super(message, "SERIALIZATION_ERROR");
-  }
-};
-var SignatureError = class extends VanaError {
-  constructor(message, originalError) {
-    super(message, "SIGNATURE_ERROR");
-    this.originalError = originalError;
-  }
-  originalError;
-};
-var NetworkError = class extends VanaError {
-  constructor(message, originalError) {
-    super(message, "NETWORK_ERROR");
-    this.originalError = originalError;
-  }
-  originalError;
-};
-var NonceError = class extends VanaError {
-  constructor(message) {
-    super(message, "NONCE_ERROR");
-  }
-};
-var PersonalServerError = class extends VanaError {
-  constructor(message, originalError) {
-    super(message, "PERSONAL_SERVER_ERROR");
-    this.originalError = originalError;
-  }
-  originalError;
-};
-var ServerUrlMismatchError = class extends VanaError {
-  constructor(existingUrl, providedUrl, serverId) {
-    super(
-      `Server ${serverId} is already registered with URL "${existingUrl}". Cannot change to "${providedUrl}".`,
-      "SERVER_URL_MISMATCH"
-    );
-    this.existingUrl = existingUrl;
-    this.providedUrl = providedUrl;
-    this.serverId = serverId;
-  }
-  existingUrl;
-  providedUrl;
-  serverId;
-};
-var PermissionError = class extends VanaError {
-  constructor(message, originalError) {
-    super(message, "PERMISSION_ERROR");
-    this.originalError = originalError;
-  }
-  originalError;
-};
-var ReadOnlyError = class extends VanaError {
-  constructor(operation, suggestion = "Initialize the SDK with a walletClient to perform this operation") {
-    super(
-      `Operation '${operation}' requires a wallet client. ${suggestion}`,
-      "READ_ONLY_ERROR"
-    );
-    this.operation = operation;
-    this.suggestion = suggestion;
-  }
-  /** The operation that was attempted */
-  operation;
-  /** Suggested solution for fixing the error */
-  suggestion;
-};
-var TransactionPendingError = class extends VanaError {
-  constructor(operationId, message, lastKnownStatus) {
-    super(
-      `Transaction operation pending: ${message} (operationId: ${operationId})`,
-      "TRANSACTION_PENDING"
-    );
-    this.operationId = operationId;
-    this.lastKnownStatus = lastKnownStatus;
-  }
-  operationId;
-  lastKnownStatus;
-  /**
-   * Converts the error to a JSON-serializable format.
-   *
-   * @remarks
-   * Useful for logging, storage, or transmission of error details.
-   *
-   * @returns JSON representation of the error
-   */
-  toJSON() {
-    return {
-      name: this.name,
-      code: this.code,
-      message: this.message,
-      operationId: this.operationId,
-      lastKnownStatus: this.lastKnownStatus
-    };
-  }
-};
-var PersonalServerWriteError = class extends VanaError {
-  constructor(message, code, status, errorCode = null, details) {
-    super(message, code);
-    this.status = status;
-    this.errorCode = errorCode;
-    this.details = details;
-  }
-  status;
-  errorCode;
-  details;
-};
-var WriteRequestError = class extends PersonalServerWriteError {
-  constructor(message, details) {
-    super(message, "WRITE_INVALID_REQUEST", void 0, null, details);
-  }
-};
-var WriteTransportError = class extends PersonalServerWriteError {
-  constructor(message, attempts, cause) {
-    super(message, "WRITE_TRANSPORT_ERROR", void 0, null, { attempts });
-    this.attempts = attempts;
-    this.cause = cause;
-  }
-  attempts;
-};
-var WriteSessionError = class extends PersonalServerWriteError {
-  constructor(message, status, errorCode = null, details) {
-    super(message, "WRITE_SESSION_REJECTED", status, errorCode, details);
-  }
-};
-var WriteSessionExpiredError = class extends PersonalServerWriteError {
-  constructor(message, details) {
-    super(message, "WRITE_SESSION_EXPIRED", void 0, null, details);
-  }
-};
-var WriteUnauthorizedError = class extends PersonalServerWriteError {
-  constructor(message, errorCode = null, details) {
-    super(message, "WRITE_UNAUTHORIZED", 401, errorCode, details);
-  }
-};
-var WriteForbiddenError = class extends PersonalServerWriteError {
-  constructor(message, errorCode = null, details) {
-    super(message, "WRITE_FORBIDDEN", 403, errorCode, details);
-  }
-};
-var WriteConflictError = class extends PersonalServerWriteError {
-  constructor(message, errorCode = null, details) {
-    super(message, "WRITE_CONFLICT", 409, errorCode, details);
-  }
-};
-var WriteLineageError = class extends PersonalServerWriteError {
-  constructor(message, status = 422, errorCode = null, details) {
-    super(message, "WRITE_LINEAGE_REJECTED", status, errorCode, details);
-  }
-};
-var WriteRejectedError = class extends PersonalServerWriteError {
-  constructor(message, status, errorCode = null, details) {
-    super(message, "WRITE_REJECTED", status, errorCode, details);
-  }
-};
-var JobsClientError = class extends VanaError {
-  constructor(message, code, status, errorCode = null, details) {
-    super(message, code);
-    this.status = status;
-    this.errorCode = errorCode;
-    this.details = details;
-  }
-  status;
-  errorCode;
-  details;
-};
-var BuilderUnknownError = class extends JobsClientError {
-  constructor(message, details) {
-    super(message, "JOB_BUILDER_UNKNOWN", 403, "BUILDER_UNKNOWN", details);
-  }
-};
-var GrantInvalidError = class extends JobsClientError {
-  constructor(message, details) {
-    super(message, "JOB_GRANT_INVALID", 403, "GRANT_INVALID", details);
-  }
-};
-var OwnerNotReadyError = class extends JobsClientError {
-  constructor(message, details) {
-    super(message, "JOB_OWNER_NOT_READY", 403, "OWNER_NOT_READY", details);
-  }
-};
-var JobIdTakenError = class extends JobsClientError {
-  constructor(message, details) {
-    super(message, "JOB_ID_TAKEN", 409, "JOB_ID_TAKEN", details);
-  }
-};
-var JobNotFoundError = class extends JobsClientError {
-  constructor(message, details) {
-    super(message, "JOB_NOT_FOUND", 404, "JOB_NOT_FOUND", details);
-  }
-};
-var JobRequestTooLargeError = class extends JobsClientError {
-  constructor(message, errorCode = "BODY_TOO_LARGE", details) {
-    super(message, "JOB_REQUEST_TOO_LARGE", 413, errorCode, details);
-  }
-};
-var JobTimeoutError = class extends JobsClientError {
-  constructor(message, details) {
-    super(message, "JOB_TIMEOUT", void 0, null, details);
-  }
-};
-var JobRejectedError = class extends JobsClientError {
-  constructor(message, status, errorCode = null, details) {
-    super(message, "JOB_REJECTED", status, errorCode, details);
-  }
-};
-var JobTransportError = class extends JobsClientError {
-  constructor(message, cause) {
-    super(message, "JOB_TRANSPORT_ERROR");
-    this.cause = cause;
-  }
-};
-var LineageReadError = class extends VanaError {
-  constructor(message, status, errorCode = null, details) {
-    super(message, "LINEAGE_READ_ERROR");
-    this.status = status;
-    this.errorCode = errorCode;
-    this.details = details;
-  }
-  status;
-  errorCode;
-  details;
-};
-var DerivativeQuestionRejectedError = class extends PersonalServerWriteError {
-  constructor(message, status, errorCode = null, details) {
-    super(message, "DERIVATIVE_QUESTION_REJECTED", status, errorCode, details);
-  }
-};
-var DerivativeQuestionInvalidError = class extends PersonalServerWriteError {
-  constructor(message, status = 400, errorCode = null, details) {
-    super(message, "DERIVATIVE_QUESTION_INVALID", status, errorCode, details);
-  }
-};
-var DerivativeQuestionNotFoundError = class extends PersonalServerWriteError {
-  constructor(message, errorCode = null, details) {
-    super(message, "DERIVATIVE_QUESTION_NOT_FOUND", 404, errorCode, details);
-  }
-};
-var DerivativeDerivedScopeRequiredError = class extends PersonalServerWriteError {
-  constructor(message, errorCode = null, details) {
-    super(
-      message,
-      "DERIVATIVE_DERIVED_SCOPE_REQUIRED",
-      400,
-      errorCode,
-      details
-    );
-  }
-};
-var DerivativeSourceNotGrantedError = class extends PersonalServerWriteError {
-  constructor(message, errorCode = null, details) {
-    super(message, "DERIVATIVE_SOURCE_NOT_GRANTED", 403, errorCode, details);
-  }
-};
-var DerivativeCycleError = class extends PersonalServerWriteError {
-  constructor(message, errorCode = null, details) {
-    super(message, "DERIVATIVE_CYCLE", 409, errorCode, details);
-  }
-};
-var DerivativeComputeUnavailableError = class extends PersonalServerWriteError {
-  constructor(message, errorCode = null, details) {
-    super(message, "DERIVATIVE_COMPUTE_UNAVAILABLE", 503, errorCode, details);
-  }
-};
-var DerivativeQuestionTimeoutError = class extends PersonalServerWriteError {
-  constructor(message, details) {
-    super(message, "DERIVATIVE_QUESTION_TIMEOUT", void 0, null, details);
-  }
-};
-var DerivativeQuestionFailedError = class extends PersonalServerWriteError {
-  constructor(message, details) {
-    super(message, "DERIVATIVE_QUESTION_FAILED", void 0, null, details);
-  }
-};
-var DataPointDeletedError = class extends VanaError {
-  constructor(message, details = {}) {
-    super(message, "DATA_POINT_DELETED");
-    this.details = details;
-  }
-  details;
-};
-var DataPointNotFoundError = class extends VanaError {
-  constructor(message, details = {}) {
-    super(message, "DATA_POINT_NOT_FOUND");
-    this.details = details;
-  }
-  details;
-};
-var DataPointVersionConflictError = class extends VanaError {
-  constructor(message, details = {}) {
-    super(message, "DATA_POINT_VERSION_CONFLICT");
-    this.details = details;
-  }
-  details;
-};
+// src/index.node.ts
+export * from "./errors.js";
 
 // src/contracts/contractController.ts
 import {
@@ -31860,31 +31522,11 @@ async function decryptWithPassword(encrypted, password) {
 
 // src/auth/web3-signed.ts
 import { recoverMessageAddress as recoverMessageAddress2 } from "viem";
-
-// src/auth/errors.ts
-var MissingAuthError = class extends VanaError {
-  constructor(message = "Missing authentication", details) {
-    super(message, "MISSING_AUTH");
-    this.details = details;
-  }
-  details;
-};
-var InvalidSignatureError = class extends VanaError {
-  constructor(details, message = "Invalid signature") {
-    super(message, "INVALID_SIGNATURE");
-    this.details = details;
-  }
-  details;
-};
-var ExpiredTokenError = class extends VanaError {
-  constructor(details, message = "Token has expired") {
-    super(message, "EXPIRED_TOKEN");
-    this.details = details;
-  }
-  details;
-};
-
-// src/auth/web3-signed.ts
+import {
+  MissingAuthError,
+  InvalidSignatureError,
+  ExpiredTokenError
+} from "./auth/errors.js";
 var WEB3_SIGNED_PREFIX = "Web3Signed ";
 var CLOCK_SKEW_SECONDS = 60;
 function base64urlDecode(input) {
@@ -32002,6 +31644,13 @@ async function verifyWeb3Signed(params) {
   return { signer, payload };
 }
 
+// src/index.node.ts
+import {
+  MissingAuthError as MissingAuthError2,
+  InvalidSignatureError as InvalidSignatureError2,
+  ExpiredTokenError as ExpiredTokenError2
+} from "./auth/errors.js";
+
 // src/auth/pkce.ts
 var PKCE_VERIFIER_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~";
 var PKCE_VERIFIER_MIN_LENGTH = 43;
@@ -32369,6 +32018,9 @@ function escrowPaymentDomain(config) {
     config.contracts.dataPortabilityEscrow
   );
 }
+function withdrawAuthorizationDomain(config) {
+  return escrowPaymentDomain(config);
+}
 var GRANT_REGISTRATION_TYPES = {
   GrantRegistration: [
     { name: "grantorAddress", type: "address" },
@@ -32401,6 +32053,15 @@ var BUILDER_REGISTRATION_TYPES = {
     { name: "appUrl", type: "string" }
   ]
 };
+var WITHDRAW_AUTHORIZATION_TYPES = {
+  WithdrawAuthorization: [
+    { name: "account", type: "address" },
+    { name: "asset", type: "address" },
+    { name: "amount", type: "uint256" },
+    { name: "withdrawNonce", type: "uint256" },
+    { name: "deadline", type: "uint256" }
+  ]
+};
 var ADD_DATA_TYPES = {
   AddData: [
     { name: "ownerAddress", type: "address" },
@@ -32419,6 +32080,14 @@ var RECORD_DATA_ACCESS_TYPES = {
     { name: "recordId", type: "bytes32" }
   ]
 };
+function buildWithdrawAuthorizationTypedData(config, message) {
+  return {
+    domain: withdrawAuthorizationDomain(config),
+    types: WITHDRAW_AUTHORIZATION_TYPES,
+    primaryType: "WithdrawAuthorization",
+    message
+  };
+}
 
 // src/protocol/identity.ts
 init_interface();
@@ -32448,17 +32117,21 @@ var PREIMAGE_SEPARATOR = ":";
 var UNCOMPRESSED_PUBLIC_KEY_BYTES = 65;
 var UNCOMPRESSED_PUBLIC_KEY_PREFIX = "04";
 var EMPTY_HEX = "0x";
-function emptyAnchor() {
-  return Object.freeze({
-    kmsRootPubkey: EMPTY_HEX,
-    appIds: Object.freeze([])
-  });
-}
+var MAINNET_ANCHOR = Object.freeze({
+  kmsRootPubkey: "0x0434c76e0c3f52ec64cbf9bbf5c910c272330166fd656c0a86bb330963e46910e1a0e6fa51bec74be2f9129342707636060d85856d102cee8290185409ecf7422f",
+  appIds: Object.freeze([
+    "0x01bb1b6dcaf1ea170f1480c5e53b093f384d939a"
+  ])
+});
 var ENCLAVE_TRUST_ANCHORS = Object.freeze({
-  // filled at fleet provisioning; verify fails closed while empty
-  [VANA_MAINNET_CHAIN_ID]: emptyAnchor(),
-  // filled at fleet provisioning; verify fails closed while empty
-  [MOKSHA_CHAIN_ID]: emptyAnchor()
+  [VANA_MAINNET_CHAIN_ID]: MAINNET_ANCHOR,
+  // Moksha workers share this dstack app and KMS root; the controller does not derive owner keys.
+  [MOKSHA_CHAIN_ID]: Object.freeze({
+    kmsRootPubkey: "0x0434c76e0c3f52ec64cbf9bbf5c910c272330166fd656c0a86bb330963e46910e1a0e6fa51bec74be2f9129342707636060d85856d102cee8290185409ecf7422f",
+    appIds: Object.freeze([
+      "0xec9a39de98c760e1ded9f1e97016dc5f0e357cf2"
+    ])
+  })
 });
 function userPsId(chainId, ownerAddress) {
   const packed = encodePacked(
@@ -32605,13 +32278,14 @@ var MAX_LEASE_SECONDS = 300;
 var MAX_ATTEMPTS = 3;
 var MAX_WAIT_SECONDS = 25;
 var CLAIM_POLL_FLOOR_MS = 1e3;
-var MAX_INLINE_RESULT_BYTES = 1048576;
 var DEFAULT_JOB_DEADLINE_SECONDS = 600;
 var MAX_JOB_DEADLINE_SECONDS = 3600;
 
 // src/protocol/jobs-client.ts
 import { randomUUID } from "node:crypto";
+import { sha256 as sha2566 } from "@noble/hashes/sha2";
 import {
+  bytesToHex as bytesToHex3,
   isAddress as isAddress2,
   isAddressEqual as isAddressEqual2,
   isHex as isHex2
@@ -32619,11 +32293,26 @@ import {
 import { privateKeyToAccount, publicKeyToAddress as publicKeyToAddress2 } from "viem/accounts";
 
 // src/crypto/envelope/job.ts
+init_constants();
 init_interface();
 import { sha256 as sha2565 } from "@noble/hashes/sha2";
 import { bytesToHex as bytesToHex2, fromHex as fromHex6, isAddress, isHex, toHex as toHex8 } from "viem";
 var textDecoder = new TextDecoder();
 var textEncoder = new TextEncoder();
+var MAX_JOB_RESULT_HEADER_BYTES = 4096;
+var WRAPPED_KEY_LENGTH_BYTES = 4;
+var FRAME_LENGTH_BYTES = 4;
+var FRAME_FLAGS_BYTES = 1;
+var AES_KEY_BYTES = 32;
+var AES_GCM_NONCE_BYTES = 12;
+var AES_GCM_TAG_BYTES = 16;
+var WRAPPED_METADATA_LENGTH_BYTES = 4;
+var WRAPPED_KEY_PLAINTEXT_PREFIX_BYTES = AES_KEY_BYTES + AES_GCM_NONCE_BYTES + WRAPPED_METADATA_LENGTH_BYTES;
+var MAX_WRAPPED_KEY_BYTES = 8192;
+var FINAL_FRAME_FLAG = 1;
+var MAX_CHUNK_INDEX = 4294967295;
+var JOB_RESULT_FORMAT_VERSION = 2;
+var JOB_RESULT_CHUNK_BYTES = 1024 * 1024;
 var JobEnvelopeError = class extends Error {
   constructor(message) {
     super(message);
@@ -32655,21 +32344,68 @@ function requestPlaintext(envelope) {
   validateRequestEnvelope(envelope);
   return canonicalJsonBytes(envelope);
 }
-function resultPlaintext(result) {
-  return textEncoder.encode(
-    JSON.stringify({
-      v: result.v,
-      jobId: result.jobId,
-      scope: result.scope,
-      version: result.version,
-      contentType: result.contentType,
-      body: result.body
-    })
-  );
+function resultMetadata(result) {
+  return {
+    v: result.v,
+    jobId: result.jobId,
+    scope: result.scope,
+    version: result.version,
+    contentType: result.contentType
+  };
 }
 function encryptedBytesToBase64(encrypted) {
   return toBase64(fromHex6(`0x${serializeECIES(encrypted)}`, "bytes"));
 }
+function encryptedToBytes(encrypted) {
+  const bytes = new Uint8Array(
+    encrypted.iv.length + encrypted.ephemPublicKey.length + encrypted.ciphertext.length + encrypted.mac.length
+  );
+  let offset = 0;
+  bytes.set(encrypted.iv, offset);
+  offset += encrypted.iv.length;
+  bytes.set(encrypted.ephemPublicKey, offset);
+  offset += encrypted.ephemPublicKey.length;
+  bytes.set(encrypted.ciphertext, offset);
+  offset += encrypted.ciphertext.length;
+  bytes.set(encrypted.mac, offset);
+  return bytes;
+}
+function bytesToEncrypted(bytes) {
+  const absoluteMinLength = FORMAT.IV_LENGTH + 1 + MAC.LENGTH + 1;
+  if (bytes.length < absoluteMinLength) {
+    throw new ECIESError(
+      `Invalid ECIES data: too short (${bytes.length} bytes, minimum ${absoluteMinLength} bytes required)`,
+      "DECRYPTION_FAILED"
+    );
+  }
+  const prefix = bytes[FORMAT.EPHEMERAL_KEY_OFFSET];
+  if (prefix !== CURVE.PREFIX.UNCOMPRESSED) {
+    throw new ECIESError(
+      `Invalid ephemeral public key: must be uncompressed format (0x04 prefix), got 0x${prefix.toString(16).padStart(2, "0")}`,
+      "DECRYPTION_FAILED"
+    );
+  }
+  const ephemKeySize = CURVE.UNCOMPRESSED_PUBLIC_KEY_LENGTH;
+  const minLength = FORMAT.IV_LENGTH + ephemKeySize + MAC.LENGTH + 1;
+  if (bytes.length < minLength) {
+    throw new ECIESError(
+      `Invalid ECIES data: too short (${bytes.length} bytes, minimum ${minLength} bytes required)`,
+      "DECRYPTION_FAILED"
+    );
+  }
+  return {
+    iv: bytes.subarray(FORMAT.IV_OFFSET, FORMAT.IV_OFFSET + FORMAT.IV_LENGTH),
+    ephemPublicKey: bytes.subarray(
+      FORMAT.EPHEMERAL_KEY_OFFSET,
+      FORMAT.EPHEMERAL_KEY_OFFSET + ephemKeySize
+    ),
+    ciphertext: bytes.subarray(
+      FORMAT.EPHEMERAL_KEY_OFFSET + ephemKeySize,
+      bytes.length - MAC.LENGTH
+    ),
+    mac: bytes.subarray(bytes.length - MAC.LENGTH)
+  };
+}
 function base64ToEncrypted(ciphertext) {
   return deserializeECIES(toHex8(fromBase64(ciphertext)));
 }
@@ -32770,11 +32506,11 @@ function validateRequestEnvelope(value) {
   requireString(value.auth, "auth", "job request envelope");
   return value;
 }
-function validateResult(value) {
-  requirePlainObject(value, "result", "job result");
+function validateResultMetadata(value) {
+  requirePlainObject(value, "metadata", "job result");
   requireExactKeys(
     value,
-    ["v", "jobId", "scope", "version", "contentType", "body"],
+    ["v", "jobId", "scope", "version", "contentType"],
     "job result"
   );
   if (value.v !== JOB_PROTOCOL_VERSION) {
@@ -32785,14 +32521,222 @@ function validateResult(value) {
   for (const field of ["jobId", "scope", "contentType"]) {
     requireString(value[field], field, "job result");
   }
-  if (typeof value.body !== "string") {
-    throw new JobEnvelopeError("Invalid job result: missing body");
-  }
   if (value.version !== null && typeof value.version !== "string") {
     throw new JobEnvelopeError("Invalid job result: missing version");
   }
   return value;
 }
+function validateResult(value) {
+  requirePlainObject(value, "result", "job result");
+  requireExactKeys(
+    value,
+    ["v", "jobId", "scope", "version", "contentType", "body"],
+    "job result"
+  );
+  validateResultMetadata(resultMetadata(value));
+  if (!(value.body instanceof Uint8Array)) {
+    throw new JobEnvelopeError("Invalid job result: missing body");
+  }
+  return value;
+}
+function webCrypto() {
+  if (typeof globalThis.crypto === "undefined" || typeof globalThis.crypto.getRandomValues !== "function" || !globalThis.crypto.subtle) {
+    throw new JobEnvelopeError(
+      "Job result streaming requires the Web Crypto API"
+    );
+  }
+  return globalThis.crypto;
+}
+function uint32(value) {
+  const bytes = new Uint8Array(4);
+  new DataView(bytes.buffer).setUint32(0, value);
+  return bytes;
+}
+function readUint32(bytes, offset = 0) {
+  return new DataView(bytes.buffer, bytes.byteOffset + offset, 4).getUint32(0);
+}
+function wrappedKeyPlaintext(contentKey, noncePrefix, metadataBytes) {
+  const plaintext = new Uint8Array(
+    WRAPPED_KEY_PLAINTEXT_PREFIX_BYTES + metadataBytes.length
+  );
+  plaintext.set(contentKey, 0);
+  plaintext.set(noncePrefix, AES_KEY_BYTES);
+  new DataView(plaintext.buffer).setUint32(
+    AES_KEY_BYTES + AES_GCM_NONCE_BYTES,
+    metadataBytes.length
+  );
+  plaintext.set(metadataBytes, WRAPPED_KEY_PLAINTEXT_PREFIX_BYTES);
+  return plaintext;
+}
+function parseWrappedKeyPlaintext(plaintext) {
+  if (plaintext.length < WRAPPED_KEY_PLAINTEXT_PREFIX_BYTES) {
+    throw new JobEnvelopeError("Invalid job result: wrapped key is truncated");
+  }
+  const metadataLength = readUint32(
+    plaintext,
+    AES_KEY_BYTES + AES_GCM_NONCE_BYTES
+  );
+  if (metadataLength > MAX_JOB_RESULT_HEADER_BYTES) {
+    throw new JobEnvelopeError(
+      `Invalid job result: header exceeds ${MAX_JOB_RESULT_HEADER_BYTES} bytes`
+    );
+  }
+  if (plaintext.length !== WRAPPED_KEY_PLAINTEXT_PREFIX_BYTES + metadataLength) {
+    throw new JobEnvelopeError(
+      "Invalid job result: header length exceeds payload"
+    );
+  }
+  const metadataBytes = plaintext.slice(WRAPPED_KEY_PLAINTEXT_PREFIX_BYTES);
+  const metadata = validateResultMetadata(
+    parseObject(metadataBytes, "job result header")
+  );
+  return {
+    contentKey: plaintext.slice(0, AES_KEY_BYTES),
+    noncePrefix: plaintext.slice(
+      AES_KEY_BYTES,
+      AES_KEY_BYTES + AES_GCM_NONCE_BYTES
+    ),
+    metadataBytes,
+    metadata
+  };
+}
+async function importAesKey(contentKey, usage) {
+  return webCrypto().subtle.importKey(
+    "raw",
+    contentKey,
+    { name: "AES-GCM" },
+    false,
+    [usage]
+  );
+}
+function chunkNonce(noncePrefix, chunkIndex) {
+  if (chunkIndex > MAX_CHUNK_INDEX) {
+    throw new JobEnvelopeError("Invalid job result: too many chunks");
+  }
+  const nonce = noncePrefix.slice();
+  const view = new DataView(nonce.buffer, nonce.byteOffset, nonce.byteLength);
+  view.setUint32(8, view.getUint32(8) ^ chunkIndex);
+  return nonce;
+}
+function chunkAad(metadataBytes, chunkIndex, final, plaintextLength) {
+  const aad = new Uint8Array(14 + metadataBytes.length);
+  aad[0] = JOB_RESULT_FORMAT_VERSION;
+  aad.set(uint32(metadataBytes.length), 1);
+  aad.set(metadataBytes, 5);
+  aad.set(uint32(chunkIndex), 5 + metadataBytes.length);
+  aad[9 + metadataBytes.length] = final ? FINAL_FRAME_FLAG : 0;
+  aad.set(uint32(plaintextLength), 10 + metadataBytes.length);
+  return aad;
+}
+async function encryptResultChunk(key, noncePrefix, metadataBytes, plaintext, chunkIndex, final) {
+  const encrypted = new Uint8Array(
+    await webCrypto().subtle.encrypt(
+      {
+        name: "AES-GCM",
+        iv: chunkNonce(noncePrefix, chunkIndex),
+        additionalData: chunkAad(
+          metadataBytes,
+          chunkIndex,
+          final,
+          plaintext.length
+        ),
+        tagLength: AES_GCM_TAG_BYTES * 8
+      },
+      key,
+      plaintext
+    )
+  );
+  const frame = new Uint8Array(
+    FRAME_LENGTH_BYTES + FRAME_FLAGS_BYTES + encrypted.length
+  );
+  new DataView(frame.buffer).setUint32(0, encrypted.length);
+  frame[FRAME_LENGTH_BYTES] = final ? FINAL_FRAME_FLAG : 0;
+  frame.set(encrypted, FRAME_LENGTH_BYTES + FRAME_FLAGS_BYTES);
+  return frame;
+}
+function verifyResultBindings(metadata, expect) {
+  if (metadata.jobId !== expect.jobId) {
+    throw new JobEnvelopeError(
+      `Job result ID ${metadata.jobId} does not match expected job ID ${expect.jobId}`
+    );
+  }
+  if (expect.scope !== void 0 && metadata.scope !== expect.scope) {
+    throw new JobEnvelopeError(
+      `Job result scope ${metadata.scope} does not match expected scope ${expect.scope}`
+    );
+  }
+  if (expect.version !== void 0 && metadata.version !== expect.version) {
+    throw new JobEnvelopeError(
+      `Job result version ${String(metadata.version)} does not match expected version ${String(expect.version)}`
+    );
+  }
+}
+var ByteStreamReader = class {
+  reader;
+  current;
+  offset = 0;
+  ended = false;
+  constructor(stream) {
+    this.reader = stream.getReader();
+  }
+  async ensureBytes() {
+    while (!this.current || this.offset === this.current.length) {
+      if (this.ended) return false;
+      const next = await this.reader.read();
+      if (next.done) {
+        this.ended = true;
+        this.current = void 0;
+        return false;
+      }
+      if (!(next.value instanceof Uint8Array)) {
+        throw new JobEnvelopeError(
+          "Invalid job result: stream yielded non-byte data"
+        );
+      }
+      this.current = next.value;
+      this.offset = 0;
+    }
+    return true;
+  }
+  async readExactOrNull(length) {
+    if (!await this.ensureBytes()) return null;
+    const bytes = new Uint8Array(length);
+    let written = 0;
+    while (written < length) {
+      if (!await this.ensureBytes()) {
+        throw new JobEnvelopeError("Invalid job result: truncated payload");
+      }
+      const available = this.current.length - this.offset;
+      const count = Math.min(available, length - written);
+      bytes.set(
+        this.current.subarray(this.offset, this.offset + count),
+        written
+      );
+      this.offset += count;
+      written += count;
+    }
+    return bytes;
+  }
+  async readExact(length) {
+    const bytes = await this.readExactOrNull(length);
+    if (!bytes) {
+      throw new JobEnvelopeError("Invalid job result: truncated payload");
+    }
+    return bytes;
+  }
+  async hasRemaining() {
+    return this.ensureBytes();
+  }
+  async cancel(reason) {
+    await this.reader.cancel(reason);
+  }
+};
+function normalizeChunkError(error) {
+  if (error instanceof JobEnvelopeError) return error;
+  return new JobEnvelopeError(
+    `Invalid job result: chunk authentication failed${error instanceof Error ? `: ${error.message}` : ""}`
+  );
+}
 async function sealJobRequest(envelope, enclavePublicKey, ecies) {
   const encrypted = await ecies.encrypt(
     fromHex6(enclavePublicKey, "bytes"),
@@ -32809,41 +32753,333 @@ async function openJobRequest(ciphertext, privateKey, ecies) {
     parseObject(plaintext, "job request envelope")
   );
 }
-async function sealJobResult(result, builderPublicKey, ecies) {
-  validateResult(result);
-  const encrypted = await ecies.encrypt(
+async function sealJobResultStream(metadataValue, builderPublicKey, ecies) {
+  const metadata = validateResultMetadata(metadataValue);
+  const metadataBytes = canonicalJsonBytes(metadata);
+  if (metadataBytes.length > MAX_JOB_RESULT_HEADER_BYTES) {
+    throw new JobEnvelopeError(
+      `Invalid job result: header exceeds ${MAX_JOB_RESULT_HEADER_BYTES} bytes`
+    );
+  }
+  const crypto2 = webCrypto();
+  const contentKey = crypto2.getRandomValues(new Uint8Array(AES_KEY_BYTES));
+  const noncePrefix = crypto2.getRandomValues(
+    new Uint8Array(AES_GCM_NONCE_BYTES)
+  );
+  const key = await importAesKey(contentKey, "encrypt");
+  const keyPlaintext = wrappedKeyPlaintext(
+    contentKey,
+    noncePrefix,
+    metadataBytes
+  );
+  const encryptedKey = await ecies.encrypt(
     fromHex6(builderPublicKey, "bytes"),
-    resultPlaintext(result)
+    keyPlaintext
   );
-  const ciphertext = encryptedBytesToBase64(encrypted);
-  const bytes = fromBase64(ciphertext);
-  return { ciphertext, hash: bytesToHex2(sha2565(bytes)), size: bytes.length };
+  contentKey.fill(0);
+  keyPlaintext.fill(0);
+  const wrappedKey = encryptedToBytes(encryptedKey);
+  if (wrappedKey.length > MAX_WRAPPED_KEY_BYTES) {
+    throw new JobEnvelopeError("Invalid job result: wrapped key is too large");
+  }
+  const header = new Uint8Array(
+    1 + WRAPPED_KEY_LENGTH_BYTES + wrappedKey.length
+  );
+  header[0] = JOB_RESULT_FORMAT_VERSION;
+  new DataView(header.buffer).setUint32(1, wrappedKey.length);
+  header.set(wrappedKey, 1 + WRAPPED_KEY_LENGTH_BYTES);
+  let pending = new Uint8Array(JOB_RESULT_CHUNK_BYTES);
+  let pendingLength = 0;
+  let chunkIndex = 0;
+  const transform = new TransformStream({
+    async transform(chunk, controller) {
+      if (!(chunk instanceof Uint8Array)) {
+        throw new JobEnvelopeError(
+          "Invalid job result: stream yielded non-byte data"
+        );
+      }
+      let offset = 0;
+      while (offset < chunk.length) {
+        if (pendingLength === JOB_RESULT_CHUNK_BYTES) {
+          controller.enqueue(
+            await encryptResultChunk(
+              key,
+              noncePrefix,
+              metadataBytes,
+              pending,
+              chunkIndex,
+              false
+            )
+          );
+          chunkIndex += 1;
+          pending = new Uint8Array(JOB_RESULT_CHUNK_BYTES);
+          pendingLength = 0;
+        }
+        const count = Math.min(
+          chunk.length - offset,
+          JOB_RESULT_CHUNK_BYTES - pendingLength
+        );
+        pending.set(chunk.subarray(offset, offset + count), pendingLength);
+        pendingLength += count;
+        offset += count;
+      }
+    },
+    async flush(controller) {
+      controller.enqueue(
+        await encryptResultChunk(
+          key,
+          noncePrefix,
+          metadataBytes,
+          pending.subarray(0, pendingLength),
+          chunkIndex,
+          true
+        )
+      );
+    }
+  });
+  return { header, transform };
 }
-async function openJobResult(ciphertext, builderPrivateKey, ecies, expect) {
-  const plaintext = await ecies.decrypt(
-    fromHex6(builderPrivateKey, "bytes"),
-    base64ToEncrypted(ciphertext)
+async function sealJobResult(result, builderPublicKey, ecies) {
+  validateResult(result);
+  const sealed = await sealJobResultStream(
+    resultMetadata(result),
+    builderPublicKey,
+    ecies
+  );
+  const frameCount = Math.max(
+    1,
+    Math.ceil(result.body.length / JOB_RESULT_CHUNK_BYTES)
   );
-  const result = validateResult(parseObject(plaintext, "job result"));
-  if (result.jobId !== expect.jobId) {
+  const size = sealed.header.length + result.body.length + frameCount * (FRAME_LENGTH_BYTES + FRAME_FLAGS_BYTES + AES_GCM_TAG_BYTES);
+  const bytes = new Uint8Array(size);
+  bytes.set(sealed.header, 0);
+  let outputOffset = sealed.header.length;
+  const reader = sealed.transform.readable.getReader();
+  const drain = (async () => {
+    for (; ; ) {
+      const next = await reader.read();
+      if (next.done) break;
+      bytes.set(next.value, outputOffset);
+      outputOffset += next.value.length;
+    }
+  })();
+  const writer = sealed.transform.writable.getWriter();
+  const fill = (async () => {
+    for (let offset = 0; offset < result.body.length; offset += JOB_RESULT_CHUNK_BYTES) {
+      await writer.write(
+        result.body.subarray(offset, offset + JOB_RESULT_CHUNK_BYTES)
+      );
+    }
+    await writer.close();
+  })();
+  await Promise.all([drain, fill]);
+  if (outputOffset !== bytes.length) {
+    throw new JobEnvelopeError("Invalid job result: sealed size mismatch");
+  }
+  return { bytes, hash: bytesToHex2(sha2565(bytes)), size };
+}
+async function openJobResultStream(bytesStream, builderPrivateKey, ecies, expect) {
+  const reader = new ByteStreamReader(bytesStream);
+  const headerPrefix = await reader.readExact(1 + WRAPPED_KEY_LENGTH_BYTES);
+  const formatVersion = headerPrefix[0];
+  if (formatVersion !== JOB_RESULT_FORMAT_VERSION) {
     throw new JobEnvelopeError(
-      `Job result ID ${result.jobId} does not match expected job ID ${expect.jobId}`
+      `Unsupported job result format: ${String(formatVersion)}`
     );
   }
-  if (expect.scope !== void 0 && result.scope !== expect.scope) {
+  const wrappedKeyLength = readUint32(headerPrefix, 1);
+  if (wrappedKeyLength === 0 || wrappedKeyLength > MAX_WRAPPED_KEY_BYTES) {
     throw new JobEnvelopeError(
-      `Job result scope ${result.scope} does not match expected scope ${expect.scope}`
+      "Invalid job result: invalid wrapped key length"
     );
   }
-  if (expect.version !== void 0 && result.version !== expect.version) {
+  const wrappedKey = await reader.readExact(wrappedKeyLength);
+  const keyPlaintext = await ecies.decrypt(
+    fromHex6(builderPrivateKey, "bytes"),
+    bytesToEncrypted(wrappedKey)
+  );
+  const parsed = parseWrappedKeyPlaintext(keyPlaintext);
+  verifyResultBindings(parsed.metadata, expect);
+  const key = await importAesKey(parsed.contentKey, "decrypt");
+  parsed.contentKey.fill(0);
+  keyPlaintext.fill(0);
+  let chunkIndex = 0;
+  let finished = false;
+  const body = new ReadableStream({
+    async pull(controller) {
+      if (finished) {
+        controller.close();
+        return;
+      }
+      try {
+        const frameHeader = await reader.readExactOrNull(
+          FRAME_LENGTH_BYTES + FRAME_FLAGS_BYTES
+        );
+        if (!frameHeader) {
+          throw new JobEnvelopeError("Invalid job result: missing final chunk");
+        }
+        const encryptedLength = readUint32(frameHeader);
+        if (encryptedLength < AES_GCM_TAG_BYTES || encryptedLength > JOB_RESULT_CHUNK_BYTES + AES_GCM_TAG_BYTES) {
+          throw new JobEnvelopeError(
+            "Invalid job result: invalid chunk length"
+          );
+        }
+        const flags = frameHeader[FRAME_LENGTH_BYTES];
+        if (flags !== 0 && flags !== FINAL_FRAME_FLAG) {
+          throw new JobEnvelopeError("Invalid job result: invalid chunk flags");
+        }
+        const final = flags === FINAL_FRAME_FLAG;
+        const plaintextLength = encryptedLength - AES_GCM_TAG_BYTES;
+        if (!final && plaintextLength !== JOB_RESULT_CHUNK_BYTES) {
+          throw new JobEnvelopeError(
+            "Invalid job result: short non-final chunk"
+          );
+        }
+        const encrypted = await reader.readExact(encryptedLength);
+        const plaintext = new Uint8Array(
+          await webCrypto().subtle.decrypt(
+            {
+              name: "AES-GCM",
+              iv: chunkNonce(parsed.noncePrefix, chunkIndex),
+              additionalData: chunkAad(
+                parsed.metadataBytes,
+                chunkIndex,
+                final,
+                plaintextLength
+              ),
+              tagLength: AES_GCM_TAG_BYTES * 8
+            },
+            key,
+            encrypted
+          )
+        );
+        if (plaintext.length !== plaintextLength) {
+          throw new JobEnvelopeError(
+            "Invalid job result: decrypted chunk length mismatch"
+          );
+        }
+        chunkIndex += 1;
+        if (final) {
+          if (await reader.hasRemaining()) {
+            throw new JobEnvelopeError(
+              "Invalid job result: bytes follow final chunk"
+            );
+          }
+          finished = true;
+        }
+        controller.enqueue(plaintext);
+        if (finished) controller.close();
+      } catch (error) {
+        controller.error(normalizeChunkError(error));
+        void reader.cancel(error).catch(() => void 0);
+      }
+    },
+    cancel(reason) {
+      return reader.cancel(reason);
+    }
+  });
+  return { metadata: parsed.metadata, body };
+}
+function bufferedResultBodySize(sealedBytes) {
+  if (sealedBytes.length < 1 + WRAPPED_KEY_LENGTH_BYTES) {
+    throw new JobEnvelopeError("Invalid job result: truncated payload");
+  }
+  if (sealedBytes[0] !== JOB_RESULT_FORMAT_VERSION) {
     throw new JobEnvelopeError(
-      `Job result version ${String(result.version)} does not match expected version ${String(expect.version)}`
+      `Unsupported job result format: ${String(sealedBytes[0])}`
     );
   }
-  return result;
+  const wrappedKeyLength = readUint32(sealedBytes, 1);
+  if (wrappedKeyLength === 0 || wrappedKeyLength > MAX_WRAPPED_KEY_BYTES) {
+    throw new JobEnvelopeError(
+      "Invalid job result: invalid wrapped key length"
+    );
+  }
+  let offset = 1 + WRAPPED_KEY_LENGTH_BYTES + wrappedKeyLength;
+  if (offset > sealedBytes.length) {
+    throw new JobEnvelopeError("Invalid job result: truncated payload");
+  }
+  let bodySize = 0;
+  let sawFinal = false;
+  while (offset < sealedBytes.length) {
+    if (sealedBytes.length - offset < FRAME_LENGTH_BYTES + FRAME_FLAGS_BYTES) {
+      throw new JobEnvelopeError("Invalid job result: truncated payload");
+    }
+    const encryptedLength = readUint32(sealedBytes, offset);
+    const flags = sealedBytes[offset + FRAME_LENGTH_BYTES];
+    if (encryptedLength < AES_GCM_TAG_BYTES || encryptedLength > JOB_RESULT_CHUNK_BYTES + AES_GCM_TAG_BYTES || flags !== 0 && flags !== FINAL_FRAME_FLAG) {
+      throw new JobEnvelopeError("Invalid job result: invalid chunk framing");
+    }
+    const plaintextLength = encryptedLength - AES_GCM_TAG_BYTES;
+    if (flags === 0 && plaintextLength !== JOB_RESULT_CHUNK_BYTES) {
+      throw new JobEnvelopeError("Invalid job result: short non-final chunk");
+    }
+    offset += FRAME_LENGTH_BYTES + FRAME_FLAGS_BYTES;
+    if (encryptedLength > sealedBytes.length - offset) {
+      throw new JobEnvelopeError("Invalid job result: truncated payload");
+    }
+    offset += encryptedLength;
+    bodySize += plaintextLength;
+    if (flags === FINAL_FRAME_FLAG) {
+      sawFinal = true;
+      if (offset !== sealedBytes.length) {
+        throw new JobEnvelopeError(
+          "Invalid job result: bytes follow final chunk"
+        );
+      }
+    }
+  }
+  if (!sawFinal) {
+    throw new JobEnvelopeError("Invalid job result: missing final chunk");
+  }
+  return bodySize;
+}
+async function openJobResult(sealedBytes, builderPrivateKey, ecies, expect) {
+  const bodySize = bufferedResultBodySize(sealedBytes);
+  const stream = new ReadableStream({
+    start(controller) {
+      controller.enqueue(sealedBytes);
+      controller.close();
+    }
+  });
+  const opened = await openJobResultStream(
+    stream,
+    builderPrivateKey,
+    ecies,
+    expect
+  );
+  const body = new Uint8Array(bodySize);
+  let offset = 0;
+  await opened.body.pipeTo(
+    new WritableStream({
+      write(chunk) {
+        body.set(chunk, offset);
+        offset += chunk.length;
+      }
+    })
+  );
+  if (offset !== body.length) {
+    throw new JobEnvelopeError("Invalid job result: opened size mismatch");
+  }
+  return { ...opened.metadata, body };
 }
 
+// src/protocol/jobs-client.ts
+import {
+  BuilderUnknownError,
+  GrantInvalidError,
+  JobIdTakenError,
+  JobNotFoundError,
+  JobRejectedError,
+  JobResultIntegrityError,
+  JobRequestTooLargeError,
+  JobTimeoutError,
+  JobTransportError,
+  OwnerNotReadyError
+} from "./errors.js";
+
 // src/protocol/write-signer.ts
+import { WriteRequestError } from "./errors.js";
 function isRecord(value) {
   return value !== null && typeof value === "object";
 }
@@ -33046,7 +33282,7 @@ async function rejectedResponse(response, fallback) {
   return new JobRejectedError(message, response.status, parsed.code, details);
 }
 function requireStatus(value, status) {
-  if (!isRecord2(value) || !isNonEmptyString(value["jobId"]) || typeof value["state"] !== "string" || !JOB_STATES.includes(value["state"]) || !isNonEmptyString(value["owner"]) || !isNonEmptyString(value["grantId"]) || !isNonEmptyString(value["scope"]) || !isNonEmptyString(value["operation"]) || !JOB_OPERATIONS.includes(value["operation"])) {
+  if (!isRecord2(value) || !isNonEmptyString(value["jobId"]) || typeof value["state"] !== "string" || !JOB_STATES.includes(value["state"]) || !isNonEmptyString(value["owner"]) || !isNonEmptyString(value["grantId"]) || !isNonEmptyString(value["scope"]) || !isNonEmptyString(value["operation"]) || !JOB_OPERATIONS.includes(value["operation"]) || value["state"] === "completed" && !isResultHandle(value["result"])) {
     throw new JobRejectedError(
       "Gateway response did not contain a job status",
       status
@@ -33057,6 +33293,17 @@ function requireStatus(value, status) {
 function isNonEmptyString(value) {
   return typeof value === "string" && value.length > 0;
 }
+function isResultHandle(value) {
+  if (!isRecord2(value) || !isNonEmptyString(value["objectKey"]) || !isNonEmptyString(value["url"]) || typeof value["size"] !== "number" || !Number.isInteger(value["size"]) || value["size"] < 0 || typeof value["hash"] !== "string" || !/^0x[0-9a-fA-F]{64}$/.test(value["hash"]) || typeof value["expiresAt"] !== "string" || Number.isNaN(Date.parse(value["expiresAt"]))) {
+    return false;
+  }
+  try {
+    const url = new URL(value["url"]);
+    return url.protocol === "https:" || url.protocol === "http:";
+  } catch {
+    return false;
+  }
+}
 function hasMatchingIdentityKey(value) {
   const address = value["address"];
   const publicKey = value["publicKey"];
@@ -33302,31 +33549,51 @@ function createJobsClient(options) {
         await sleep2(Math.min(pollMs, remaining));
       }
     },
-    async openResult(job, openOptions) {
-      if (!job.resultCiphertext) {
+    async openResult(handle, openOptions) {
+      if (!privateKey) {
         throw new JobRejectedError(
-          "Job status does not include inline resultCiphertext",
-          void 0,
-          null,
+          "openResult requires createJobsClient({ builderPrivateKey })"
+        );
+      }
+      const response = await request(
+        handle.url,
+        { method: GET_METHOD },
+        "Job result fetch"
+      );
+      if (!response.ok) {
+        throw await rejectedResponse(response, "Job result fetch rejected");
+      }
+      let bytes;
+      try {
+        bytes = new Uint8Array(await response.arrayBuffer());
+      } catch (error) {
+        throw new JobTransportError(
+          `Job result fetch failed: ${error instanceof Error ? error.message : String(error)}`,
+          error
+        );
+      }
+      const actualHash = bytesToHex3(sha2566(bytes));
+      if (actualHash.toLowerCase() !== handle.hash.toLowerCase()) {
+        throw new JobResultIntegrityError(
+          "Fetched job result hash does not match its handle",
           {
-            jobId: job.jobId,
-            state: job.state,
-            resultHandle: job.resultHandle,
-            maxInlineResultBytes: MAX_INLINE_RESULT_BYTES
+            objectKey: handle.objectKey,
+            expectedHash: handle.hash,
+            actualHash
           }
         );
       }
-      if (!privateKey) {
-        throw new JobRejectedError(
-          "openResult requires createJobsClient({ builderPrivateKey })"
+      if (bytes.length !== handle.size) {
+        throw new JobResultIntegrityError(
+          "Fetched job result size does not match its handle",
+          {
+            objectKey: handle.objectKey,
+            expectedSize: handle.size,
+            actualSize: bytes.length
+          }
         );
       }
-      return openJobResult(
-        job.resultCiphertext,
-        privateKey,
-        ecies,
-        openOptions.expect
-      );
+      return openJobResult(bytes, privateKey, ecies, openOptions.expect);
     },
     async readRaw(params) {
       const submitted = await client.submitRawRead(params);
@@ -33334,7 +33601,27 @@ function createJobsClient(options) {
         timeoutMs: params.timeoutMs,
         pollMs: params.pollMs
       });
-      return client.openResult(job, {
+      if (job.state !== "completed") {
+        throw new JobRejectedError(
+          `Job ${job.jobId} ended in state ${job.state}${job.failureReason ? `: ${job.failureReason}` : ""}`,
+          void 0,
+          null,
+          {
+            jobId: job.jobId,
+            state: job.state,
+            ...job.failureReason ? { failureReason: job.failureReason } : {}
+          }
+        );
+      }
+      if (!job.result) {
+        throw new JobRejectedError(
+          "Completed job status does not include a result handle",
+          void 0,
+          null,
+          { jobId: job.jobId, state: job.state }
+        );
+      }
+      return client.openResult(job.result, {
         expect: {
           jobId: submitted.jobId,
           scope: params.scope,
@@ -34049,6 +34336,7 @@ import {
   maxUint256,
   stringToBytes as stringToBytes3
 } from "viem";
+import { DataPointDeletedError, DataPointNotFoundError } from "./errors.js";
 
 // src/protocol/lineage.ts
 import {
@@ -34057,6 +34345,7 @@ import {
   keccak256 as keccak2562
 } from "viem";
 import { z } from "zod";
+import { LineageReadError, WriteRequestError as WriteRequestError2 } from "./errors.js";
 
 // src/protocol/personal-server-error-body.ts
 function isRecord4(value) {
@@ -34128,7 +34417,7 @@ function derivedScopeViolatesNaming(derivedScope, sourceScope) {
 function assertDerivedScopeNaming(derivedScope, sourceScopes) {
   for (const sourceScope of sourceScopes) {
     if (derivedScopeViolatesNaming(derivedScope, sourceScope)) {
-      throw new WriteRequestError(
+      throw new WriteRequestError2(
         `Derived scope ${derivedScope} must not share its first segment with source scope ${sourceScope}; put derivatives in the app's own namespace`,
         { scope: derivedScope, sourceScope }
       );
@@ -34486,6 +34775,9 @@ async function deleteDataPoint(input) {
   }
 }
 
+// src/protocol/personal-server-data.ts
+import { DataPointDeletedError as DataPointDeletedError2 } from "./errors.js";
+
 // src/protocol/data-file.ts
 import { z as z2 } from "zod";
 var DataFileEnvelopeSchema = z2.object({
@@ -34544,7 +34836,7 @@ async function readPersonalServerData(params) {
   const request = await buildPersonalServerDataReadRequest(params);
   const response = await fetchFn(request);
   if (response.status === 410) {
-    throw new DataPointDeletedError(
+    throw new DataPointDeletedError2(
       `Personal Server scope '${params.scope}' has been deleted`,
       {
         scope: params.scope,
@@ -34559,7 +34851,7 @@ async function readPersonalServerData(params) {
   }
   const body = await response.json();
   if (isDataPointTombstone(body)) {
-    throw new DataPointDeletedError(
+    throw new DataPointDeletedError2(
       `Personal Server scope '${params.scope}' has been deleted`,
       { scope: params.scope, deletedAt: tombstoneDeletedAt(body) }
     );
@@ -34759,20 +35051,31 @@ function tryGrantPermissions(scopes) {
 }
 
 // src/protocol/personal-server-write.ts
-import { sha256 as sha2567 } from "@noble/hashes/sha2";
-import { bytesToHex as bytesToHex4, isAddress as isAddress8 } from "viem";
+import { sha256 as sha2568 } from "@noble/hashes/sha2";
+import { bytesToHex as bytesToHex5, isAddress as isAddress8 } from "viem";
 import { z as z4 } from "zod";
+import {
+  WriteConflictError,
+  WriteForbiddenError,
+  WriteLineageError,
+  WriteRejectedError,
+  WriteRequestError as WriteRequestError4,
+  WriteSessionError,
+  WriteSessionExpiredError,
+  WriteUnauthorizedError
+} from "./errors.js";
 
 // src/protocol/write-request.ts
-import { sha256 as sha2566 } from "@noble/hashes/sha2";
-import { bytesToHex as bytesToHex3 } from "viem";
+import { sha256 as sha2567 } from "@noble/hashes/sha2";
+import { bytesToHex as bytesToHex4 } from "viem";
+import { WriteRequestError as WriteRequestError3, WriteTransportError } from "./errors.js";
 function normalizeBaseUrl2(url) {
   return url.replace(/\/+$/, "");
 }
 function resolveFetch3(fetchFn) {
   const resolved = fetchFn ?? globalThis.fetch;
   if (resolved === void 0) {
-    throw new WriteRequestError("No fetch implementation available");
+    throw new WriteRequestError3("No fetch implementation available");
   }
   return resolved;
 }
@@ -34827,27 +35130,27 @@ function nextProofIat(proofKey) {
   return sleep3(waitSec * 1e3).then(() => iat);
 }
 function freshProofNonce() {
-  const webCrypto = globalThis.crypto;
-  if (typeof webCrypto?.randomUUID === "function") {
-    return webCrypto.randomUUID();
+  const webCrypto2 = globalThis.crypto;
+  if (typeof webCrypto2?.randomUUID === "function") {
+    return webCrypto2.randomUUID();
   }
-  if (typeof webCrypto?.getRandomValues === "function") {
-    return bytesToHex3(webCrypto.getRandomValues(new Uint8Array(16)));
+  if (typeof webCrypto2?.getRandomValues === "function") {
+    return bytesToHex4(webCrypto2.getRandomValues(new Uint8Array(16)));
   }
-  throw new WriteRequestError(
+  throw new WriteRequestError3(
     "No secure random source available to build a proof nonce; provide a crypto global"
   );
 }
 function proofKeyFor(parts) {
-  return bytesToHex3(
-    sha2566(
+  return bytesToHex4(
+    sha2567(
       new TextEncoder().encode(
         JSON.stringify([
           parts.aud,
           parts.method,
           parts.uri,
           parts.grantId,
-          parts.signedBytes ? bytesToHex3(sha2566(parts.signedBytes)) : ""
+          parts.signedBytes ? bytesToHex4(sha2567(parts.signedBytes)) : ""
         ])
       )
     )
@@ -34990,7 +35293,7 @@ function isWriteSession(value) {
 }
 function sessionCoversScope(session, scope) {
   if (!isRecord4(session) || !Array.isArray(session.writeScopes) || !session.writeScopes.every((pattern) => typeof pattern === "string")) {
-    throw new WriteRequestError("session must come from openWriteSession");
+    throw new WriteRequestError4("session must come from openWriteSession");
   }
   return session.writeScopes.some(
     (pattern) => scopeMatchesPattern(scope, pattern)
@@ -35015,12 +35318,12 @@ function encodeWriteMetadataHeader(metadata) {
   try {
     json = JSON.stringify(metadata);
   } catch (err) {
-    throw new WriteRequestError(
+    throw new WriteRequestError4(
       `metadata is not JSON-serialisable: ${errorMessage(err)}`
     );
   }
   if (typeof json !== "string") {
-    throw new WriteRequestError("metadata must serialise to JSON");
+    throw new WriteRequestError4("metadata must serialise to JSON");
   }
   return json.replace(
     /[\u007f-\uffff]/g,
@@ -35034,7 +35337,7 @@ function binaryWriteSignedBytes(input) {
     mimeType: normalizeBinaryMimeType(input.contentType),
     ...input.filename ? { filename: input.filename } : {},
     sizeBytes: input.bytes.length,
-    contentHash: bytesToHex4(sha2567(input.bytes)),
+    contentHash: bytesToHex5(sha2568(input.bytes)),
     encoding: "base64",
     content: toBase64(input.bytes),
     ...metadata !== void 0 ? { metadata } : {}
@@ -35055,7 +35358,7 @@ function setFilenameHeader(headers, filename) {
 function assertNoReservedKeys(value, where) {
   for (const key of RESERVED_WRITE_KEYS) {
     if (Object.prototype.hasOwnProperty.call(value, key)) {
-      throw new WriteRequestError(
+      throw new WriteRequestError4(
         `${where} must not contain the reserved ${key} key; the Personal Server stamps it`,
         { key }
       );
@@ -35067,10 +35370,10 @@ function isLineagePair(value) {
 }
 function normalizeLineage(lineage, derivedScope) {
   if (!Array.isArray(lineage)) {
-    throw new WriteRequestError("lineage must be an array of data point ids");
+    throw new WriteRequestError4("lineage must be an array of data point ids");
   }
   if (lineage.length > MAX_LINEAGE_SOURCES) {
-    throw new WriteRequestError(
+    throw new WriteRequestError4(
       `lineage lists ${lineage.length} sources; the maximum is ${MAX_LINEAGE_SOURCES}`,
       { max: MAX_LINEAGE_SOURCES, count: lineage.length }
     );
@@ -35083,13 +35386,13 @@ function normalizeLineage(lineage, derivedScope) {
     let id;
     if (isLineagePair(entry)) {
       if (!isAddress8(entry.ownerAddress, { strict: false })) {
-        throw new WriteRequestError(
+        throw new WriteRequestError4(
           "lineage source ownerAddress must be an EVM address",
           { ownerAddress: entry.ownerAddress }
         );
       }
       if (entry.scope.length === 0) {
-        throw new WriteRequestError("lineage source scope is required");
+        throw new WriteRequestError4("lineage source scope is required");
       }
       id = deriveDataPointId(entry.ownerAddress, entry.scope);
       sourceScopes.push(entry.scope);
@@ -35097,14 +35400,14 @@ function normalizeLineage(lineage, derivedScope) {
     } else if (isDataPointId(entry)) {
       id = entry;
     } else {
-      throw new WriteRequestError(
+      throw new WriteRequestError4(
         "lineage entries must be 32-byte hex data point ids or { ownerAddress, scope } pairs",
         { entry }
       );
     }
     const normalized = id.toLowerCase();
     if (seen.has(normalized)) {
-      throw new WriteRequestError("lineage must not repeat a data point id", {
+      throw new WriteRequestError4("lineage must not repeat a data point id", {
         dataPointId: normalized
       });
     }
@@ -35113,7 +35416,7 @@ function normalizeLineage(lineage, derivedScope) {
   }
   for (const own of ownIds) {
     if (seen.has(own)) {
-      throw new WriteRequestError(
+      throw new WriteRequestError4(
         "lineage must not cite the record's own data point",
         { dataPointId: own, scope: derivedScope }
       );
@@ -35124,7 +35427,7 @@ function normalizeLineage(lineage, derivedScope) {
 }
 function assertNoLineageField(value, where) {
   if (Object.prototype.hasOwnProperty.call(value, LINEAGE_FIELD)) {
-    throw new WriteRequestError(
+    throw new WriteRequestError4(
       `${where}.${LINEAGE_FIELD} is reserved; pass sources through the lineage option`
     );
   }
@@ -35132,7 +35435,7 @@ function assertNoLineageField(value, where) {
 function buildMetadataHeader(metadata, sources) {
   if (metadata !== void 0) {
     if (!isRecord4(metadata)) {
-      throw new WriteRequestError("metadata must be a plain object");
+      throw new WriteRequestError4("metadata must be a plain object");
     }
     assertNoReservedKeys(metadata, "metadata");
     assertNoLineageField(metadata, "metadata");
@@ -35145,24 +35448,24 @@ function buildMetadataHeader(metadata, sources) {
 }
 function prepareWrite(params) {
   if (params.binary !== void 0 && params.data !== void 0) {
-    throw new WriteRequestError("Pass either data or binary, not both");
+    throw new WriteRequestError4("Pass either data or binary, not both");
   }
   const rawLineage = params.lineage;
   const sources = rawLineage === void 0 || rawLineage === null ? void 0 : normalizeLineage(rawLineage, params.scope);
   if (params.binary !== void 0) {
     const { bytes, contentType, filename } = params.binary;
     if (!(bytes instanceof Uint8Array)) {
-      throw new WriteRequestError("binary.bytes must be a Uint8Array");
+      throw new WriteRequestError4("binary.bytes must be a Uint8Array");
     }
     if (typeof contentType !== "string" || contentType.trim() === "") {
-      throw new WriteRequestError("binary.contentType is required");
+      throw new WriteRequestError4("binary.contentType is required");
     }
     if (filename !== void 0) {
       if (typeof filename !== "string") {
-        throw new WriteRequestError("binary.filename must be a string");
+        throw new WriteRequestError4("binary.filename must be a string");
       }
       if (filename !== filename.trim()) {
-        throw new WriteRequestError(
+        throw new WriteRequestError4(
           "binary.filename must not have leading or trailing whitespace"
         );
       }
@@ -35182,13 +35485,13 @@ function prepareWrite(params) {
     };
   }
   if (params.data === void 0) {
-    throw new WriteRequestError("Pass data (a JSON object) or binary");
+    throw new WriteRequestError4("Pass data (a JSON object) or binary");
   }
   if (!isRecord4(params.data)) {
-    throw new WriteRequestError("data must be a plain JSON object");
+    throw new WriteRequestError4("data must be a plain JSON object");
   }
   if (params.metadata !== void 0) {
-    throw new WriteRequestError(
+    throw new WriteRequestError4(
       "metadata applies to binary writes; put fields to store inside data"
     );
   }
@@ -35199,12 +35502,12 @@ function prepareWrite(params) {
   try {
     text = JSON.stringify(record);
   } catch (err) {
-    throw new WriteRequestError(
+    throw new WriteRequestError4(
       `data is not JSON-serialisable: ${errorMessage(err)}`
     );
   }
   if (typeof text !== "string" || !text.startsWith("{")) {
-    throw new WriteRequestError("data must serialise to a JSON object");
+    throw new WriteRequestError4("data must serialise to a JSON object");
   }
   const body = new TextEncoder().encode(text);
   return {
@@ -35233,11 +35536,11 @@ async function writeErrorFromResponse(response) {
 async function writeData(params) {
   const { session } = params;
   if (!isWriteSession(session)) {
-    throw new WriteRequestError("session must come from openWriteSession");
+    throw new WriteRequestError4("session must come from openWriteSession");
   }
   const fetchFn = resolveFetch3(params.fetch);
   if (typeof params.scope !== "string" || params.scope.length === 0) {
-    throw new WriteRequestError("scope is required");
+    throw new WriteRequestError4("scope is required");
   }
   const prepared = prepareWrite(params);
   if (Date.now() >= session.expiresAt) {
@@ -35333,6 +35636,21 @@ async function writePersonalServerData(params) {
 
 // src/protocol/derivative-questions.ts
 import { z as z5 } from "zod";
+import {
+  DerivativeComputeUnavailableError,
+  DerivativeCycleError,
+  DerivativeDerivedScopeRequiredError,
+  DerivativeQuestionFailedError,
+  DerivativeQuestionInvalidError,
+  DerivativeQuestionNotFoundError,
+  DerivativeQuestionRejectedError,
+  DerivativeQuestionTimeoutError,
+  DerivativeSourceNotGrantedError,
+  WriteConflictError as WriteConflictError2,
+  WriteForbiddenError as WriteForbiddenError2,
+  WriteRequestError as WriteRequestError5,
+  WriteUnauthorizedError as WriteUnauthorizedError2
+} from "./errors.js";
 var DERIVATIVE_QUESTIONS_PATH = "/v1/derivatives/questions";
 var MAX_QUESTION_SOURCE_SCOPES = 16;
 var MAX_QUESTION_CHARS = 8e3;
@@ -35415,15 +35733,15 @@ function fetchIdOf(fetchFn) {
 }
 function resolveRequest(params) {
   if (typeof params.personalServerUrl !== "string" || params.personalServerUrl.length === 0) {
-    throw new WriteRequestError("personalServerUrl is required");
+    throw new WriteRequestError5("personalServerUrl is required");
   }
   if (typeof params.grantId !== "string" || params.grantId.length === 0) {
-    throw new WriteRequestError(
+    throw new WriteRequestError5(
       "grantId is required; a question call runs under the grant carrying write:<derivedScope>"
     );
   }
   if (params.signer === null || typeof params.signer !== "object") {
-    throw new WriteRequestError(
+    throw new WriteRequestError5(
       "signer must be a viem LocalAccount, a viem WalletClient, or a { signMessage } object"
     );
   }
@@ -35499,13 +35817,13 @@ async function questionErrorFromResponse(response, body) {
   }
   switch (response.status) {
     case 401:
-      return new WriteUnauthorizedError(text, errorCode, details);
+      return new WriteUnauthorizedError2(text, errorCode, details);
     case 403:
-      return new WriteForbiddenError(text, errorCode, details);
+      return new WriteForbiddenError2(text, errorCode, details);
     case 404:
       return new DerivativeQuestionNotFoundError(text, errorCode, details);
     case 409:
-      return new WriteConflictError(text, errorCode, details);
+      return new WriteConflictError2(text, errorCode, details);
     default:
       return new DerivativeQuestionRejectedError(
         text,
@@ -35607,22 +35925,22 @@ async function sendQuestionRequest(params, spec, schema) {
 }
 function assertQuestionId(questionId) {
   if (typeof questionId !== "string" || questionId.length === 0) {
-    throw new WriteRequestError("questionId is required");
+    throw new WriteRequestError5("questionId is required");
   }
   return `${DERIVATIVE_QUESTIONS_PATH}/${encodeURIComponent(questionId)}`;
 }
 function registrationBody(params) {
   const { derivedScope, question } = params;
   if (typeof derivedScope !== "string" || derivedScope.length === 0) {
-    throw new WriteRequestError("derivedScope is required");
+    throw new WriteRequestError5("derivedScope is required");
   }
   if (!Array.isArray(params.sourceScopes) || params.sourceScopes.length === 0) {
-    throw new WriteRequestError(
+    throw new WriteRequestError5(
       "sourceScopes must be a non-empty array of scopes"
     );
   }
   if (params.sourceScopes.length > MAX_QUESTION_SOURCE_SCOPES) {
-    throw new WriteRequestError(
+    throw new WriteRequestError5(
       `sourceScopes lists ${params.sourceScopes.length} scopes; the maximum is ${MAX_QUESTION_SOURCE_SCOPES}`,
       { max: MAX_QUESTION_SOURCE_SCOPES, count: params.sourceScopes.length }
     );
@@ -35630,15 +35948,15 @@ function registrationBody(params) {
   const sourceScopes = [];
   for (const scope of params.sourceScopes) {
     if (typeof scope !== "string" || scope.length === 0) {
-      throw new WriteRequestError("sourceScopes entries must be scope strings");
+      throw new WriteRequestError5("sourceScopes entries must be scope strings");
     }
     if (sourceScopes.includes(scope)) {
-      throw new WriteRequestError("sourceScopes must not repeat a scope", {
+      throw new WriteRequestError5("sourceScopes must not repeat a scope", {
         duplicate: scope
       });
     }
     if (scope === derivedScope) {
-      throw new WriteRequestError(
+      throw new WriteRequestError5(
         "derivedScope cannot be one of its own sources",
         { scope }
       );
@@ -35646,17 +35964,17 @@ function registrationBody(params) {
     sourceScopes.push(scope);
   }
   if (typeof question !== "string" || question.trim() === "") {
-    throw new WriteRequestError("question must be a non-empty string");
+    throw new WriteRequestError5("question must be a non-empty string");
   }
   if (question.length > MAX_QUESTION_CHARS) {
-    throw new WriteRequestError(
+    throw new WriteRequestError5(
       `question is ${question.length} characters; the maximum is ${MAX_QUESTION_CHARS}`,
       { max: MAX_QUESTION_CHARS, length: question.length }
     );
   }
   if (params.model !== void 0) {
     if (typeof params.model !== "string" || params.model.length > MAX_QUESTION_MODEL_CHARS || !MODEL_ID_PATTERN.test(params.model)) {
-      throw new WriteRequestError("model must be a provider model id", {
+      throw new WriteRequestError5("model must be a provider model id", {
         model: params.model
       });
     }
@@ -35692,7 +36010,7 @@ async function getQuestion(params) {
 }
 async function listQuestions(params) {
   if (typeof params.derivedScope !== "string" || params.derivedScope.length === 0) {
-    throw new WriteRequestError(
+    throw new WriteRequestError5(
       "derivedScope is required; a builder may only list its own questions on a scope it may write"
     );
   }
@@ -35797,6 +36115,12 @@ async function askPersonalServer(params) {
 
 // src/protocol/derivative-status.ts
 import { z as z6 } from "zod";
+import {
+  DerivativeQuestionRejectedError as DerivativeQuestionRejectedError2,
+  DerivativeQuestionTimeoutError as DerivativeQuestionTimeoutError2,
+  WriteRequestError as WriteRequestError6,
+  WriteTransportError as WriteTransportError2
+} from "./errors.js";
 var DERIVATIVE_STATUS_PATH = "/v1/derivatives/status";
 var DEFAULT_DERIVATIVE_STATUS_TIMEOUT_MS = 12e4;
 var DEFAULT_DERIVATIVE_STATUS_POLL_INTERVAL_MS = 2e3;
@@ -35827,13 +36151,13 @@ function normalizeBaseUrl3(url) {
 function resolveFetch4(fetchFn) {
   const resolved = fetchFn ?? globalThis.fetch;
   if (resolved === void 0) {
-    throw new WriteRequestError("No fetch implementation available");
+    throw new WriteRequestError6("No fetch implementation available");
   }
   return resolved;
 }
 function requireDerivedScope(derivedScope) {
   if (typeof derivedScope !== "string" || derivedScope.length === 0) {
-    throw new WriteRequestError("derivedScope is required");
+    throw new WriteRequestError6("derivedScope is required");
   }
   return derivedScope;
 }
@@ -35852,7 +36176,7 @@ function sleep4(ms, signal) {
   });
 }
 function timeoutError(latest, timeoutMs) {
-  return new DerivativeQuestionTimeoutError(
+  return new DerivativeQuestionTimeoutError2(
     `Derived scope ${latest.derivedScope} was still ${latest.status} after ${timeoutMs}ms`,
     {
       derivedScope: latest.derivedScope,
@@ -35865,7 +36189,7 @@ function timeoutError(latest, timeoutMs) {
 }
 function abortError2(signal) {
   const reason = signal?.reason;
-  return reason instanceof Error ? reason : new WriteRequestError("Derivative status wait was aborted");
+  return reason instanceof Error ? reason : new WriteRequestError6("Derivative status wait was aborted");
 }
 function isDerivativeStatusSettled(status) {
   if (status.status === "ready") return true;
@@ -35898,7 +36222,7 @@ async function getDerivativeStatus(params) {
       }
     );
   } catch (err) {
-    throw new WriteTransportError(
+    throw new WriteTransportError2(
       `Derivative status read failed: ${err instanceof Error ? err.message : String(err)}`,
       1,
       err
@@ -35913,7 +36237,7 @@ async function getDerivativeStatus(params) {
   try {
     body = await response.json();
   } catch (err) {
-    throw new DerivativeQuestionRejectedError(
+    throw new DerivativeQuestionRejectedError2(
       "Derivative status response is not JSON",
       response.status,
       null,
@@ -35922,7 +36246,7 @@ async function getDerivativeStatus(params) {
   }
   const parsed = DerivativeStatusSchema.safeParse(body);
   if (!parsed.success) {
-    throw new DerivativeQuestionRejectedError(
+    throw new DerivativeQuestionRejectedError2(
       "Derivative status response is not a status view",
       response.status,
       null,
@@ -35956,6 +36280,11 @@ async function waitForDerivativeStatus(params) {
 }
 
 // src/protocol/gateway.ts
+import {
+  DataPointDeletedError as DataPointDeletedError3,
+  DataPointNotFoundError as DataPointNotFoundError2,
+  DataPointVersionConflictError
+} from "./errors.js";
 function withGrantPermissions(grant) {
   const stripped = { ...grant };
   delete stripped.permissions;
@@ -36001,7 +36330,7 @@ function createGatewayClient(baseUrl) {
   }
   async function deletedError(res, details) {
     const body = await readBody(res);
-    return new DataPointDeletedError(
+    return new DataPointDeletedError3(
       `Data point ${details.dataPointId ?? details.scope ?? ""} has been deleted`,
       { ...details, deletedAt: tombstoneDeletedAt(body) }
     );
@@ -36074,7 +36403,7 @@ function createGatewayClient(baseUrl) {
       }
       const record = await unwrapEnvelope(res);
       if (!options?.includeDeleted && isDataPointTombstone(record)) {
-        throw new DataPointDeletedError(
+        throw new DataPointDeletedError3(
           `Data point ${dataPointId} has been deleted`,
           {
             dataPointId,
@@ -36236,7 +36565,7 @@ function createGatewayClient(baseUrl) {
         })
       });
       if (res.status === 404) {
-        throw new DataPointNotFoundError(
+        throw new DataPointNotFoundError2(
           `Data point ${dataPointId} (scope '${params.scope}') is not registered`,
           details
         );
@@ -36378,6 +36707,7 @@ function createGatewayClient(baseUrl) {
 }
 
 // src/protocol/escrow.ts
+import { isHex as isHex3 } from "viem";
 var GENERIC_PAYMENT_TYPES = {
   GenericPayment: [
     { name: "payerAddress", type: "address" },
@@ -36417,6 +36747,26 @@ var ESCROW_DEPOSIT_ABI2 = [
   }
 ];
 var NATIVE_ASSET_ADDRESS = "0x0000000000000000000000000000000000000000";
+var EscrowWithdrawalLifecycleError = class extends Error {
+  constructor(httpStatus, result) {
+    super(result.error);
+    this.httpStatus = httpStatus;
+    this.result = result;
+  }
+  httpStatus;
+  result;
+  name = "EscrowWithdrawalLifecycleError";
+};
+var EscrowWithdrawalRejectionError = class extends Error {
+  constructor(httpStatus, result) {
+    super(result.error);
+    this.httpStatus = httpStatus;
+    this.result = result;
+  }
+  httpStatus;
+  result;
+  name = "EscrowWithdrawalRejectionError";
+};
 function createEscrowGatewayClient(baseUrl) {
   const base = baseUrl.replace(/\/+$/, "");
   async function throwOnError(res, context) {
@@ -36432,6 +36782,27 @@ function createEscrowGatewayClient(baseUrl) {
       );
     }
   }
+  async function throwOnWithdrawError(res) {
+    if (res.ok) return;
+    let body;
+    try {
+      body = await res.json();
+    } catch {
+      throw new Error(
+        `Escrow gateway error (POST /v1/escrow/withdraw): ${res.status} ${res.statusText}`
+      );
+    }
+    if (isEscrowWithdrawalFailureResult(body)) {
+      throw new EscrowWithdrawalLifecycleError(res.status, body);
+    }
+    if (isEscrowWithdrawalRejectedResult(body)) {
+      throw new EscrowWithdrawalRejectionError(res.status, body);
+    }
+    const error = getGatewayErrorMessage(body);
+    throw new Error(
+      `Escrow gateway error (POST /v1/escrow/withdraw): ${res.status} ${res.statusText}${error ? `: ${error}` : ""}`
+    );
+  }
   return {
     async submitDeposit({ txHash }) {
       const res = await fetch(`${base}/v1/escrow/deposit`, {
@@ -36487,9 +36858,108 @@ function createEscrowGatewayClient(baseUrl) {
       });
       await throwOnError(res, "POST /v1/escrow/pay");
       return res.json();
+    },
+    async withdraw({
+      account,
+      asset,
+      amount,
+      withdrawNonce,
+      deadline,
+      signature
+    }) {
+      const res = await fetch(`${base}/v1/escrow/withdraw`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          Authorization: `Web3Signed ${signature}`
+        },
+        body: JSON.stringify({
+          account,
+          asset,
+          amount,
+          withdrawNonce,
+          deadline
+        })
+      });
+      await throwOnWithdrawError(res);
+      return res.json();
+    },
+    async getWithdrawNonce(account) {
+      const res = await fetch(
+        `${base}/v1/escrow/withdraw/nonce?account=${encodeURIComponent(account)}`,
+        { cache: "no-store" }
+      );
+      await throwOnError(res, "GET /v1/escrow/withdraw/nonce");
+      const body = await res.json();
+      if (!isWithdrawNonceResponse(body, account)) {
+        throw new Error(
+          "GET /v1/escrow/withdraw/nonce: invalid response structure"
+        );
+      }
+      return body;
     }
   };
 }
+function getGatewayErrorMessage(body) {
+  if (typeof body === "object" && body !== null && "error" in body && typeof body.error === "string") {
+    return body.error;
+  }
+  return void 0;
+}
+function isEscrowWithdrawalFailureResult(body) {
+  if (typeof body !== "object" || body === null) return false;
+  const value = body;
+  return value.success === false && (value.status === "retryable" || value.status === "reorged" || value.status === "failed") && typeof value.error === "string" && isAddressHex(value.account) && isAddressHex(value.asset) && isUint256Decimal(value.amount) && isUint256Decimal(value.withdrawNonce) && isUint256Decimal(value.deadline) && (isHash(value.txHash) || value.txHash === null) && (!("blockNumber" in value) || isBlockNumber(value.blockNumber));
+}
+function isEscrowWithdrawalRejectedResult(body) {
+  if (typeof body !== "object" || body === null) return false;
+  const value = body;
+  return value.success === false && value.status === "rejected" && isWithdrawalRejectionCode(value.code) && typeof value.error === "string" && isAddressHex(value.account) && isAddressHex(value.asset) && isUint256Decimal(value.amount) && isUint256Decimal(value.withdrawNonce) && isUint256Decimal(value.deadline) && optionalUint256Decimal(value.balance) && optionalUint256Decimal(value.authorizedAmount) && optionalUint256Decimal(value.withdrawingAmount) && optionalUint256Decimal(value.availableAmount) && optionalUint256Decimal(value.requestedAmount) && optionalUint256Decimal(value.minimumAmount);
+}
+function isWithdrawalRejectionCode(value) {
+  return value === "below_minimum" || value === "deadline_too_far" || value === "expired" || value === "insufficient_available" || value === "stale_nonce";
+}
+function optionalUint256Decimal(value) {
+  return value === void 0 || isUint256Decimal(value);
+}
+function isAddressHex(value) {
+  return typeof value === "string" && isHex3(value, { strict: true }) && value.length === 42;
+}
+function isHash(value) {
+  return typeof value === "string" && isHex3(value, { strict: true }) && value.length === 66;
+}
+function isUint256Decimal(value) {
+  if (typeof value !== "string" || value.length === 0 || value.length > 78) {
+    return false;
+  }
+  if (!/^(0|[1-9]\d*)$/.test(value)) return false;
+  return BigInt(value) <= 2n ** 256n - 1n;
+}
+function isBlockNumber(value) {
+  return value === null || isUint256Decimal(value);
+}
+function isWithdrawNonceResponse(body, requestedAccount) {
+  if (typeof body !== "object" || body === null) return false;
+  const value = body;
+  if (value.success !== true) return false;
+  if (!isAddressHex(value.account)) return false;
+  if (value.account.toLowerCase() !== requestedAccount.toLowerCase())
+    return false;
+  if (typeof value.chainId !== "string") return false;
+  if (!/^(0|[1-9]\d*)$/.test(value.chainId)) return false;
+  const isLastNull = value.lastWithdrawNonce === null;
+  const lastNonceValid = isLastNull || isUint256Decimal(value.lastWithdrawNonce);
+  if (!lastNonceValid) return false;
+  if (!isUint256Decimal(value.nextWithdrawNonce)) return false;
+  if (isLastNull) {
+    return value.nextWithdrawNonce === "1";
+  }
+  const lastNonce = BigInt(value.lastWithdrawNonce);
+  const nextNonce = BigInt(value.nextWithdrawNonce);
+  const expectedNextNonce = lastNonce + 1n;
+  if (expectedNextNonce > 2n ** 256n - 1n) return false;
+  return nextNonce === expectedNextNonce;
+}
 
 // src/direct/escrow-payment.ts
 var GRANT_OP_TYPE = "grant";
@@ -36526,12 +36996,12 @@ var UINT256_MAX = (1n << 256n) - 1n;
 var ADDRESS_RE = /^0x[0-9a-fA-F]{40}$/;
 var BYTES32_RE = /^0x[0-9a-fA-F]{64}$/;
 var SIGNATURE_RE = /^0x[0-9a-fA-F]{130}$/;
-function isUint256Decimal(value, allowZero) {
+function isUint256Decimal2(value, allowZero) {
   const pattern = allowZero ? /^(0|[1-9]\d*)$/ : /^[1-9]\d*$/;
   return value.length <= UINT256_MAX.toString().length && pattern.test(value) && BigInt(value) <= UINT256_MAX;
 }
 function isValidAccessRecord(record) {
-  return BYTES32_RE.test(record.dataPointId) && isUint256Decimal(record.version, false) && ADDRESS_RE.test(record.accessor) && BYTES32_RE.test(record.recordId) && SIGNATURE_RE.test(record.signature);
+  return BYTES32_RE.test(record.dataPointId) && isUint256Decimal2(record.version, false) && ADDRESS_RE.test(record.accessor) && BYTES32_RE.test(record.recordId) && SIGNATURE_RE.test(record.signature);
 }
 function validateSigningOperation(payerAddress, required) {
   if (!ADDRESS_RE.test(payerAddress)) {
@@ -36543,10 +37013,10 @@ function validateSigningOperation(payerAddress, required) {
   if (!ADDRESS_RE.test(required.asset || NATIVE_ASSET_ADDRESS)) {
     throw new Error("Payment asset must be a 20-byte EVM address");
   }
-  if (!isUint256Decimal(required.amount, true)) {
+  if (!isUint256Decimal2(required.amount, true)) {
     throw new Error("Payment amount must be a canonical uint256 decimal");
   }
-  if (required.paymentNonce !== void 0 && !isUint256Decimal(required.paymentNonce, false)) {
+  if (required.paymentNonce !== void 0 && !isUint256Decimal2(required.paymentNonce, false)) {
     throw new Error("Payment nonce must be a positive uint256 decimal");
   }
   const accessRecord = required.accessRecord;
@@ -36677,7 +37147,7 @@ function paymentResponseMetadataFromHeader(header) {
     const registrationFee = stringField(breakdown, "registrationFee");
     const dataAccessFee = stringField(breakdown, "dataAccessFee");
     const paidAt = stringField(result, "paidAt");
-    if (result?.success !== true || !opType || !opId || !BYTES32_RE.test(opId) || !payerAddress || !ADDRESS_RE.test(payerAddress) || !asset || !ADDRESS_RE.test(asset) || !amount || !isUint256Decimal(amount, true) || !paymentNonce || !isUint256Decimal(paymentNonce, false) || !registrationFee || !isUint256Decimal(registrationFee, true) || !dataAccessFee || !isUint256Decimal(dataAccessFee, true) || typeof breakdown?.registrationPaid !== "boolean" || !paidAt || !isCanonicalIsoTimestamp(paidAt)) {
+    if (result?.success !== true || !opType || !opId || !BYTES32_RE.test(opId) || !payerAddress || !ADDRESS_RE.test(payerAddress) || !asset || !ADDRESS_RE.test(asset) || !amount || !isUint256Decimal2(amount, true) || !paymentNonce || !isUint256Decimal2(paymentNonce, false) || !registrationFee || !isUint256Decimal2(registrationFee, true) || !dataAccessFee || !isUint256Decimal2(dataAccessFee, true) || typeof breakdown?.registrationPaid !== "boolean" || !paidAt || !isCanonicalIsoTimestamp(paidAt)) {
       return void 0;
     }
     return {
@@ -36726,18 +37196,9 @@ async function authorizeEscrowPayment(params) {
   return toDirectPaymentReceipt(result);
 }
 
-// src/direct/errors.ts
-var PersonalServerReadError = class extends VanaError {
-  constructor(message, status, details) {
-    super(message, "DIRECT_PERSONAL_SERVER_READ_ERROR");
-    this.status = status;
-    this.details = details;
-  }
-  status;
-  details;
-};
-
 // src/direct/personal-server-read.ts
+import { PaymentRequiredError, PersonalServerReadError } from "./direct/errors.js";
+import { DataPointDeletedError as DataPointDeletedError4 } from "./errors.js";
 function asRecord2(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
@@ -36767,15 +37228,15 @@ function isBytes32Hex(value) {
   return /^0x[0-9a-fA-F]{64}$/.test(value);
 }
 var UINT256_MAX2 = (1n << 256n) - 1n;
-function isAddressHex(value) {
+function isAddressHex2(value) {
   return /^0x[0-9a-fA-F]{40}$/.test(value);
 }
-function isUint256Decimal2(value, allowZero) {
+function isUint256Decimal3(value, allowZero) {
   const pattern = allowZero ? /^(0|[1-9]\d*)$/ : /^[1-9]\d*$/;
   return value.length <= UINT256_MAX2.toString().length && pattern.test(value) && BigInt(value) <= UINT256_MAX2;
 }
 function isValidDataAccessRecord(record) {
-  return isBytes32Hex(record.dataPointId) && isUint256Decimal2(record.version, false) && isAddressHex(record.accessor) && isBytes32Hex(record.recordId) && /^0x[0-9a-fA-F]{130}$/.test(record.signature);
+  return isBytes32Hex(record.dataPointId) && isUint256Decimal3(record.version, false) && isAddressHex2(record.accessor) && isBytes32Hex(record.recordId) && /^0x[0-9a-fA-F]{130}$/.test(record.signature);
 }
 function parseLegacyGrantOperation(params) {
   const { challengeGrantId, challengeOpId, challengeOpType, grantId } = params;
@@ -36826,7 +37287,7 @@ function parseCanonicalDataAccessAccept(value) {
   const accessRecord = parseAccessRecord(accept?.accessRecord);
   const acceptAsset = stringField2(accept, "asset");
   const acceptAmount = stringField2(accept, "amount");
-  if (!network || !payerAddress || !isAddressHex(payerAddress) || !opId || !isBytes32Hex(opId) || !asset || !isAddressHex(asset) || !amount || !isUint256Decimal2(amount, true) || !paymentNonce || !isUint256Decimal2(paymentNonce, false) || !accessRecord || !isValidDataAccessRecord(accessRecord) || payerAddress.toLowerCase() !== accessRecord.accessor.toLowerCase() || opId.toLowerCase() !== accessRecord.recordId.toLowerCase() || !acceptAsset || acceptAsset.toLowerCase() !== asset.toLowerCase() || acceptAmount !== amount) {
+  if (!network || !payerAddress || !isAddressHex2(payerAddress) || !opId || !isBytes32Hex(opId) || !asset || !isAddressHex2(asset) || !amount || !isUint256Decimal3(amount, true) || !paymentNonce || !isUint256Decimal3(paymentNonce, false) || !accessRecord || !isValidDataAccessRecord(accessRecord) || payerAddress.toLowerCase() !== accessRecord.accessor.toLowerCase() || opId.toLowerCase() !== accessRecord.recordId.toLowerCase() || !acceptAsset || acceptAsset.toLowerCase() !== asset.toLowerCase() || acceptAmount !== amount) {
     return null;
   }
   return {
@@ -36911,7 +37372,7 @@ async function parsePersonalServerPaymentRequired(res, grantId) {
     const acceptAmount = stringField2(accept, "amount");
     const accessRecord2 = parseAccessRecord(accept.accessRecord);
     const hasAccessRecord = accept.accessRecord !== void 0;
-    if (!network || !payerAddress || !isAddressHex(payerAddress) || !opId || !isBytes32Hex(opId) || !asset || !isAddressHex(asset) || !amount || !isUint256Decimal2(amount, true) || !paymentNonce || !isUint256Decimal2(paymentNonce, false) || !acceptAsset || acceptAsset.toLowerCase() !== asset.toLowerCase() || acceptAmount !== amount || hasAccessRecord && (!accessRecord2 || !isValidDataAccessRecord(accessRecord2) || accessRecord2.accessor.toLowerCase() !== payerAddress.toLowerCase()) || amount === "0" && !accessRecord2) {
+    if (!network || !payerAddress || !isAddressHex2(payerAddress) || !opId || !isBytes32Hex(opId) || !asset || !isAddressHex2(asset) || !amount || !isUint256Decimal3(amount, true) || !paymentNonce || !isUint256Decimal3(paymentNonce, false) || !acceptAsset || acceptAsset.toLowerCase() !== asset.toLowerCase() || acceptAmount !== amount || hasAccessRecord && (!accessRecord2 || !isValidDataAccessRecord(accessRecord2) || accessRecord2.accessor.toLowerCase() !== payerAddress.toLowerCase()) || amount === "0" && !accessRecord2) {
       throw new PersonalServerReadError(
         "Personal Server grant payment challenge was untrusted or incomplete",
         402
@@ -37027,14 +37488,11 @@ export {
   AccountPersonalServerLiteOwnerBindingError,
   AccountPersonalServerRegistrationError,
   BUILDER_REGISTRATION_TYPES,
-  BlockchainError,
   BrowserPlatformAdapter,
-  BuilderUnknownError,
   CLAIM_POLL_FLOOR_MS,
   CONTRACTS,
   CallbackStorage,
   ContractFactory,
-  ContractNotFoundError,
   DATA_ACCESS_OP_TYPE,
   DATA_REGISTRY_STATUS_ABI,
   DEFAULT_DERIVATIVE_STATUS_POLL_INTERVAL_MS,
@@ -37047,21 +37505,9 @@ export {
   DERIVATIVE_QUESTIONS_PATH,
   DERIVATIVE_STATUS_PATH,
   DataFileEnvelopeSchema,
-  DataPointDeletedError,
-  DataPointNotFoundError,
   DataPointStatus,
-  DataPointVersionConflictError,
-  DerivativeComputeUnavailableError,
-  DerivativeCycleError,
-  DerivativeDerivedScopeRequiredError,
   DerivativeErrorCodeSchema,
-  DerivativeQuestionFailedError,
-  DerivativeQuestionInvalidError,
-  DerivativeQuestionNotFoundError,
-  DerivativeQuestionRejectedError,
   DerivativeQuestionSchema,
-  DerivativeQuestionTimeoutError,
-  DerivativeSourceNotGrantedError,
   DerivativeStatusSchema,
   DropboxStorage,
   ECIESError,
@@ -37069,42 +37515,35 @@ export {
   ENCLAVE_TRUST_ANCHORS,
   ENCLAVE_WALLET_PURPOSE,
   ESCROW_DEPOSIT_ABI2 as ESCROW_DEPOSIT_ABI,
-  ExpiredTokenError,
+  EscrowWithdrawalLifecycleError,
+  EscrowWithdrawalRejectionError,
+  ExpiredTokenError2 as ExpiredTokenError,
   FEE_REGISTRY_ABI,
   GENERIC_PAYMENT_TYPES,
   GRANT_OP_TYPE,
   GRANT_REGISTRATION_TYPES,
   GRANT_REVOCATION_TYPES,
   GoogleDriveStorage,
-  GrantInvalidError,
   InMemoryTokenStore,
   IngestResponseSchema,
-  InvalidConfigurationError,
   InvalidScopeEntryError,
-  InvalidSignatureError,
+  InvalidSignatureError2 as InvalidSignatureError,
   IpfsStorage,
   JOB_OPERATIONS,
   JOB_PROTOCOL_VERSION,
+  JOB_RESULT_CHUNK_BYTES,
+  JOB_RESULT_FORMAT_VERSION,
   JOB_STATES,
   JobEnvelopeError,
-  JobIdTakenError,
-  JobNotFoundError,
-  JobRejectedError,
-  JobRequestTooLargeError,
-  JobTimeoutError,
-  JobTransportError,
-  JobsClientError,
   LINEAGE_FIELD,
   LINEAGE_KEY,
   LineageEntrySchema,
   LineageGraphSchema,
   LineageNodeSchema,
-  LineageReadError,
   MASTER_KEY_MESSAGE,
   MASTER_SIGNATURE_DELIVERY_MAX_AGE_SECONDS,
   MASTER_SIGNATURE_DELIVERY_VERSION,
   MAX_ATTEMPTS,
-  MAX_INLINE_RESULT_BYTES,
   MAX_JOB_DEADLINE_SECONDS,
   MAX_LEASE_SECONDS,
   MAX_LINEAGE_SOURCES,
@@ -37112,15 +37551,12 @@ export {
   MAX_QUESTION_MODEL_CHARS,
   MAX_QUESTION_SOURCE_SCOPES,
   MAX_WAIT_SECONDS,
-  MissingAuthError,
+  MissingAuthError2 as MissingAuthError,
   NATIVE_ASSET_ADDRESS,
   NATIVE_VANA_ASSET,
-  NetworkError,
   NodeECIESUint8Provider as NodeECIESProvider,
   NodePlatformAdapter,
-  NonceError,
   OAuthClient,
-  OwnerNotReadyError,
   PERSONAL_SERVER_LITE_OWNER_BINDING_PREFIX,
   PERSONAL_SERVER_LITE_OWNER_BINDING_PURPOSE,
   PERSONAL_SERVER_LITE_OWNER_BINDING_VERSION,
@@ -37129,9 +37565,6 @@ export {
   PKCE_CHALLENGE_PATTERN,
   PKCE_VERIFIER_PATTERN,
   PSError,
-  PermissionError,
-  PersonalServerError,
-  PersonalServerWriteError,
   PinataStorage,
   QUESTION_STATUSES,
   QuestionDeleteResultSchema,
@@ -37142,42 +37575,26 @@ export {
   RECORD_DATA_ACCESS_TYPES,
   REGISTRATION_KIND_FOR_OP,
   RESERVED_WRITE_KEYS,
-  ReadOnlyError,
   RedactedLineageNodeSchema,
-  RelayerError,
   SCOPE_ACTIONS,
   SEALED_ENVELOPE_VERSION,
   SERVER_REGISTRATION_TYPES,
   ScopeSchema,
-  SerializationError,
-  ServerUrlMismatchError,
-  SignatureError,
   StorageError,
   StorageManager,
   TOMBSTONE_DATA_HASH,
   TOMBSTONE_DATA_HASH_PREIMAGE,
   TOMBSTONE_METADATA_HASH,
   TOMBSTONE_METADATA_HASH_PREIMAGE,
-  TransactionPendingError,
   USER_PS_ID_DOMAIN,
-  UserRejectedRequestError,
-  VanaError,
   VanaStorage,
+  WITHDRAW_AUTHORIZATION_TYPES,
   WRITER_ATTRIBUTION_KEY,
   WRITE_CONTENT_DISPOSITION_HEADER,
   WRITE_FILENAME_HEADER,
   WRITE_METADATA_HEADER,
   WRITE_SESSION_PATH,
   WRITE_SIGNATURE_HEADER,
-  WriteConflictError,
-  WriteForbiddenError,
-  WriteLineageError,
-  WriteRejectedError,
-  WriteRequestError,
-  WriteSessionError,
-  WriteSessionExpiredError,
-  WriteTransportError,
-  WriteUnauthorizedError,
   appRootPreimage,
   askPersonalServer,
   assertDerivedScopeNaming,
@@ -37200,6 +37617,7 @@ export {
   buildPersonalServerRegistrationTypedData,
   buildSetDataPointStatusRequest,
   buildWeb3SignedHeader,
+  buildWithdrawAuthorizationTypedData,
   builderRegistrationDomain,
   canonicalJobRequestBytes,
   chains,
@@ -37282,6 +37700,7 @@ export {
   normalizeBinaryMimeType,
   openJobRequest,
   openJobResult,
+  openJobResultStream,
   openWriteSession,
   parsePSError,
   parsePersonalServerPaymentRequired,
@@ -37307,6 +37726,7 @@ export {
   scopeToPathSegments,
   sealJobRequest,
   sealJobResult,
+  sealJobResultStream,
   serializeECIES,
   serverRegistrationDomain,
   sessionCoversScope,
@@ -37325,6 +37745,7 @@ export {
   verifyWeb3Signed,
   waitForDerivativeStatus,
   waitForQuestion,
+  withdrawAuthorizationDomain,
   writeData,
   writePersonalServerData
 };