@opendatalabs/personal-server-ts-server 1.8.0 → 1.10.0

package/dist/ui/ps-lite-debug.js

@@ -4404,7 +4404,7 @@ function weierstrass(curveDef) {
   function prepSig(msgHash, privateKey, opts = defaultSigOpts) {
     if (["recovered", "canonical"].some((k10) => k10 in opts))
       throw new Error("sign() legacy options not supported");
-    const { hash: hash2, randomBytes: randomBytes4 } = CURVE4;
+    const { hash: hash2, randomBytes: randomBytes5 } = CURVE4;
     let { lowS, prehash, extraEntropy: ent } = opts;
     if (lowS == null)
       lowS = true;
@@ -4416,7 +4416,7 @@ function weierstrass(curveDef) {
     const d10 = normPrivateKeyToScalar(privateKey);
     const seedArgs = [int2octets(d10), int2octets(h1int)];
     if (ent != null && ent !== false) {
-      const e10 = ent === true ? randomBytes4(Fp2.BYTES) : ent;
+      const e10 = ent === true ? randomBytes5(Fp2.BYTES) : ent;
       seedArgs.push(ensureBytes("extraEntropy", e10));
     }
     const seed = concatBytes3(...seedArgs);
@@ -105697,6 +105697,11 @@ var ServerNotConfiguredError = class extends ProtocolError {
     super(500, "SERVER_NOT_CONFIGURED", "Server is not configured", details);
   }
 };
+var ContentTooLargeError = class extends ProtocolError {
+  constructor(details) {
+    super(413, "CONTENT_TOO_LARGE", "Content too large", details);
+  }
+};
 var LineageInvalidError = class extends ProtocolError {
   constructor(message, details) {
     super(400, "LINEAGE_INVALID", message, details);
@@ -105747,6 +105752,31 @@ var DataDeletedError = class extends ProtocolError {
     super(410, "DATA_DELETED", "Data point has been deleted", details);
   }
 };
+var DerivativeQuestionInvalidError = class extends ProtocolError {
+  constructor(message, details) {
+    super(400, "DERIVATIVE_QUESTION_INVALID", message, details);
+  }
+};
+var DerivativeQuestionNotFoundError = class extends ProtocolError {
+  constructor(details) {
+    super(404, "DERIVATIVE_QUESTION_NOT_FOUND", "Question not found", details);
+  }
+};
+var DerivativeCycleError = class extends ProtocolError {
+  constructor(details) {
+    super(409, "DERIVATIVE_CYCLE", `Registering this question would make "${details.derivedScope}" a transitive source of itself; recompute would never settle`, details);
+  }
+};
+var DerivativeSourceNotGrantedError = class extends ProtocolError {
+  constructor(details) {
+    super(403, "DERIVATIVE_SOURCE_NOT_GRANTED", "The builder's grant does not cover reading every source scope of this question", details);
+  }
+};
+var DerivativeComputeUnavailableError = class extends ProtocolError {
+  constructor(details) {
+    super(503, "DERIVATIVE_COMPUTE_UNAVAILABLE", "This server has no derivative compute configured", details);
+  }
+};
 
 // ../core/dist/sync/data-point-id.js
 function computeDataPointId(ownerAddress, scope) {
@@ -109719,6 +109749,21 @@ var DEFAULTS = {
     enabled: true,
     serverAddr: "frpc.server.vana.org",
     serverPort: 7e3
+  },
+  inference: {
+    // OpenAI-compatible chat completions endpoint the derivative compute
+    // layer calls. Point it at the Vana inference relay (which holds the
+    // provider key) or straight at a provider for local development.
+    baseUrl: "https://inference.phala.com/v1",
+    model: "z-ai/glm-5.2",
+    // End to end encryption of prompt and answer to the Phala gateway
+    // (E2EE v2): the relay only sees ciphertext. Set false only for local
+    // development against a provider without ACI attestation.
+    e2ee: true,
+    // Newest-first items kept per source scope when a prompt is assembled.
+    maxSourceItems: 50,
+    // Quiet period after a source scope changes before a recompute starts.
+    recomputeDebounceMs: 5e3
   }
 };
 var StorageBackend = external_exports.enum([
@@ -109772,7 +109817,14 @@ var ServerConfigSchema = external_exports.object({
     enabled: external_exports.boolean().default(DEFAULTS.tunnel.enabled),
     serverAddr: external_exports.string().default(DEFAULTS.tunnel.serverAddr),
     serverPort: external_exports.number().int().min(1).max(65535).default(DEFAULTS.tunnel.serverPort)
-  }).default(DEFAULTS.tunnel)
+  }).default(DEFAULTS.tunnel),
+  inference: external_exports.object({
+    baseUrl: external_exports.url().default(DEFAULTS.inference.baseUrl),
+    model: external_exports.string().min(1).default(DEFAULTS.inference.model),
+    e2ee: external_exports.boolean().default(DEFAULTS.inference.e2ee),
+    maxSourceItems: external_exports.number().int().min(1).max(1e4).default(DEFAULTS.inference.maxSourceItems),
+    recomputeDebounceMs: external_exports.number().int().min(0).max(36e5).default(DEFAULTS.inference.recomputeDebounceMs)
+  }).default(DEFAULTS.inference)
 });
 
 // ../lite/dist/state.js
@@ -112676,6 +112728,18 @@ function apiLoggerAsLogger(logger) {
     error: (payload, message) => (logger?.error ?? noop)(payload, message ?? "")
   };
 }
+function notifyDataWritten(deps, event) {
+  if (!deps.onDataWritten)
+    return;
+  try {
+    deps.onDataWritten(event);
+  } catch (err2) {
+    deps.logger?.warn?.({
+      scope: event.scope,
+      error: err2 instanceof Error ? err2.message : String(err2)
+    }, "onDataWritten hook failed; record already stored");
+  }
+}
 function notifyNewData(syncManager) {
   if (!syncManager)
     return;
@@ -113040,6 +113104,11 @@ async function handlePersonalServerDataRequest(request2, deps, options = {}) {
           }, "Binary data file ingested");
           await logBuilderWrite();
           notifyNewData(deps.syncManager);
+          notifyDataWritten(deps, {
+            scope: scopeResult.scope,
+            collectedAt: collectedAtValue,
+            lineageSources: lineage2?.sources
+          });
           return jsonResponse(result2.response, { status: 201 });
         }
         const parsed = await parseJsonObjectBody(request2, "Request body must be valid JSON");
@@ -113067,6 +113136,11 @@ async function handlePersonalServerDataRequest(request2, deps, options = {}) {
         }, "Data file ingested");
         await logBuilderWrite();
         notifyNewData(deps.syncManager);
+        notifyDataWritten(deps, {
+          scope: scopeResult.scope,
+          collectedAt: collectedAtValue,
+          lineageSources: lineage?.sources
+        });
         return jsonResponse(result.response, { status: 201 });
       } catch (err2) {
         if (err2 instanceof IngestPersistedError) {
@@ -113293,6 +113367,93 @@ async function handlePersonalServerOauthTokenRequest(request2, deps) {
   });
 }
 
+// ../core/dist/derivatives/types.js
+function questionRegistrationView(registration) {
+  return {
+    questionId: registration.questionId,
+    derivedScope: registration.derivedScope,
+    sourceScopes: [...registration.sourceScopes],
+    question: registration.question,
+    model: registration.model,
+    registeredBy: registration.registeredBy,
+    status: registration.status,
+    error: registration.error,
+    createdAt: registration.createdAt,
+    updatedAt: registration.updatedAt,
+    lastComputedAt: registration.lastComputedAt,
+    derivedVersion: registration.derivedVersion,
+    derivedCollectedAt: registration.derivedCollectedAt
+  };
+}
+
+// ../core/dist/derivatives/store.js
+function clone2(registration) {
+  return {
+    ...registration,
+    sourceScopes: [...registration.sourceScopes],
+    registeredBy: { ...registration.registeredBy }
+  };
+}
+function matchesQuestionFilter(registration, filter) {
+  if (!filter)
+    return true;
+  if (filter.derivedScope && registration.derivedScope !== filter.derivedScope)
+    return false;
+  if (filter.sourceScope && !registration.sourceScopes.includes(filter.sourceScope))
+    return false;
+  if (filter.builder) {
+    const by2 = registration.registeredBy;
+    if (by2.kind !== "builder" || by2.builder.toLowerCase() !== filter.builder.toLowerCase())
+      return false;
+  }
+  return true;
+}
+function sortQuestions(registrations) {
+  return [...registrations].sort((a10, b10) => a10.createdAt.localeCompare(b10.createdAt) || a10.questionId.localeCompare(b10.questionId));
+}
+function createInMemoryQuestionStore(options = {}) {
+  const byId = /* @__PURE__ */ new Map();
+  for (const registration of options.initial ?? []) {
+    byId.set(registration.questionId, clone2(registration));
+  }
+  async function changed() {
+    if (!options.onChange)
+      return;
+    await options.onChange(sortQuestions([...byId.values()]).map(clone2));
+  }
+  return {
+    async list(filter) {
+      return sortQuestions([...byId.values()].filter((registration) => matchesQuestionFilter(registration, filter))).map(clone2);
+    },
+    async get(questionId) {
+      const registration = byId.get(questionId);
+      return registration ? clone2(registration) : null;
+    },
+    async insert(registration) {
+      if (byId.has(registration.questionId)) {
+        throw new Error(`Question ${registration.questionId} is already registered`);
+      }
+      byId.set(registration.questionId, clone2(registration));
+      await changed();
+    },
+    async update(questionId, patch) {
+      const current = byId.get(questionId);
+      if (!current)
+        return null;
+      const next = { ...current, ...patch };
+      byId.set(questionId, next);
+      await changed();
+      return clone2(next);
+    },
+    async delete(questionId) {
+      const existed = byId.delete(questionId);
+      if (existed)
+        await changed();
+      return existed;
+    }
+  };
+}
+
 // ../core/dist/policy/data-read.js
 function parseGrantExpiresAtSeconds(value) {
   if (value === null || value === void 0 || value === "0")
@@ -113382,6 +113543,1635 @@ async function verifyDataReadPolicy(input, ports) {
   return grant;
 }
 
+// ../core/dist/policy/data-write.js
+var WRITE_SCOPE_PREFIX = "write:";
+function isWriteScopeEntry(entry) {
+  return entry.startsWith(WRITE_SCOPE_PREFIX);
+}
+function writeScopePatterns(grantScopes) {
+  return grantScopes.filter(isWriteScopeEntry).map((entry) => entry.slice(WRITE_SCOPE_PREFIX.length)).filter((pattern) => pattern.length > 0);
+}
+function scopeCoveredByWriteGrant(requestedScope, grantScopes) {
+  return writeScopePatterns(grantScopes).some((pattern) => scopeMatchesPattern(requestedScope, pattern));
+}
+async function verifyDataWritePolicy(input, ports) {
+  const available = await ports.runtimeAvailability?.isAvailable();
+  if (available === false) {
+    throw new PsUnavailableError();
+  }
+  const builder = await ports.authSessionVerifier.getBuilder(input.signer);
+  if (!builder) {
+    throw new UnregisteredBuilderError();
+  }
+  if (!input.grantId) {
+    throw new GrantRequiredError({
+      reason: "No grantId bound to the write session"
+    });
+  }
+  const grant = await ports.grantVerifier.getGrant(input.grantId);
+  if (!grant) {
+    throw new GrantRequiredError({
+      reason: "Grant not found",
+      grantId: input.grantId
+    });
+  }
+  if (grant.revokedAt !== null) {
+    throw new GrantRevokedError({ grantId: grant.id });
+  }
+  if (!grant.scopes || writeScopePatterns(grant.scopes).length === 0) {
+    throw new ScopeMismatchError({
+      requestedScope: input.requestedScope,
+      reason: "Grant has no write scopes"
+    });
+  }
+  if (grant.expiresAt !== null && grant.expiresAt !== void 0) {
+    const expiresAtSec = parseGrantExpiresAtSeconds(grant.expiresAt);
+    if (expiresAtSec === null) {
+      throw new ScopeMismatchError({
+        requestedScope: input.requestedScope,
+        reason: "Grant expiry is invalid"
+      });
+    }
+    if (expiresAtSec > 0) {
+      const nowSec = Math.floor(Date.now() / 1e3);
+      if (expiresAtSec < nowSec) {
+        throw new GrantExpiredError({
+          expiresAt: expiresAtSec
+        });
+      }
+    }
+  }
+  if (!scopeCoveredByWriteGrant(input.requestedScope, grant.scopes)) {
+    throw new ScopeMismatchError({
+      requestedScope: input.requestedScope,
+      grantedScopes: grant.scopes,
+      reason: "Grant does not authorize writing to this scope"
+    });
+  }
+  if (builder.id.toLowerCase() !== grant.granteeId.toLowerCase()) {
+    throw new InvalidSignatureError3({
+      reason: "Write signer is not the grant builder",
+      expected: grant.granteeId,
+      actual: input.signer
+    });
+  }
+  if (!input.serverOwner) {
+    throw new ServerNotConfiguredError({
+      reason: "serverOwner is required to verify grant ownership"
+    });
+  }
+  if (!grant.grantorAddress || grant.grantorAddress.toLowerCase() !== input.serverOwner.toLowerCase()) {
+    throw new GrantOwnerMismatchError({
+      grantId: grant.id,
+      expected: input.serverOwner,
+      actual: grant.grantorAddress ?? null
+    });
+  }
+  await ports.writeFeeVerifier?.assertWriteAllowed({
+    builder: input.signer,
+    grant,
+    scope: input.requestedScope
+  });
+  return grant;
+}
+
+// ../core/dist/derivatives/registration.js
+var MAX_QUESTION_SOURCE_SCOPES = 16;
+var MAX_QUESTION_CHARS = 8e3;
+var MAX_MODEL_CHARS = 128;
+var MAX_ECHOED_SCOPE_CHARS = 128;
+var MODEL_ID = /^[A-Za-z0-9][A-Za-z0-9._:/-]*$/;
+function isRecord4(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function parseScope(value, field) {
+  if (typeof value !== "string") {
+    throw new DerivativeQuestionInvalidError(`${field} must be a scope string`, {
+      field
+    });
+  }
+  const parsed = parseDataScopeContract(value);
+  if (!parsed.ok) {
+    throw new DerivativeQuestionInvalidError(`${field} is not a valid scope: ${parsed.body.message}`, { field, scope: value.slice(0, MAX_ECHOED_SCOPE_CHARS) });
+  }
+  return parsed.scope;
+}
+function parseQuestionInput(body) {
+  if (!isRecord4(body)) {
+    throw new DerivativeQuestionInvalidError("Body must be a JSON object");
+  }
+  const derivedScope = parseScope(body.derivedScope, "derivedScope");
+  if (!Array.isArray(body.sourceScopes) || body.sourceScopes.length === 0) {
+    throw new DerivativeQuestionInvalidError("sourceScopes must be a non-empty array of scopes", { field: "sourceScopes" });
+  }
+  if (body.sourceScopes.length > MAX_QUESTION_SOURCE_SCOPES) {
+    throw new DerivativeQuestionInvalidError(`sourceScopes lists ${body.sourceScopes.length} scopes; the maximum is ${MAX_QUESTION_SOURCE_SCOPES}`, { field: "sourceScopes", max: MAX_QUESTION_SOURCE_SCOPES });
+  }
+  const sourceScopes = [];
+  for (const entry of body.sourceScopes) {
+    const scope = parseScope(entry, "sourceScopes[]");
+    if (sourceScopes.includes(scope)) {
+      throw new DerivativeQuestionInvalidError("sourceScopes lists the same scope twice", { field: "sourceScopes", duplicate: scope });
+    }
+    if (scope === derivedScope) {
+      throw new DerivativeQuestionInvalidError("derivedScope cannot be one of its own sources", { field: "sourceScopes", scope });
+    }
+    sourceScopes.push(scope);
+  }
+  if (typeof body.question !== "string" || body.question.trim() === "") {
+    throw new DerivativeQuestionInvalidError("question must be a non-empty string", { field: "question" });
+  }
+  if (body.question.length > MAX_QUESTION_CHARS) {
+    throw new DerivativeQuestionInvalidError(`question is ${body.question.length} characters; the maximum is ${MAX_QUESTION_CHARS}`, { field: "question", max: MAX_QUESTION_CHARS });
+  }
+  let model = null;
+  if (body.model !== void 0 && body.model !== null) {
+    if (typeof body.model !== "string" || body.model.length > MAX_MODEL_CHARS || !MODEL_ID.test(body.model)) {
+      throw new DerivativeQuestionInvalidError("model must be a provider model id", { field: "model" });
+    }
+    model = body.model;
+  }
+  assertDerivedScopeNaming(derivedScope, sourceScopes);
+  return { derivedScope, sourceScopes, question: body.question, model };
+}
+function findDerivationCycle(candidate, existing) {
+  const sourcesOf = /* @__PURE__ */ new Map();
+  const add2 = (derived, sources) => {
+    const set2 = sourcesOf.get(derived) ?? /* @__PURE__ */ new Set();
+    for (const source of sources)
+      set2.add(source);
+    sourcesOf.set(derived, set2);
+  };
+  for (const registration of existing) {
+    add2(registration.derivedScope, registration.sourceScopes);
+  }
+  add2(candidate.derivedScope, candidate.sourceScopes);
+  const target = candidate.derivedScope;
+  const visited = /* @__PURE__ */ new Set();
+  const stack = [
+    { scope: target, path: [target] }
+  ];
+  while (stack.length > 0) {
+    const { scope, path } = stack.pop();
+    for (const source of sourcesOf.get(scope) ?? []) {
+      if (source === target)
+        return [...path, source];
+      if (visited.has(source))
+        continue;
+      visited.add(source);
+      stack.push({ scope: source, path: [...path, source] });
+    }
+  }
+  return null;
+}
+async function createQuestionRegistration(input) {
+  const parsed = parseQuestionInput(input.body);
+  const cycle = findDerivationCycle(parsed, await input.store.list());
+  if (cycle) {
+    throw new DerivativeCycleError({
+      derivedScope: parsed.derivedScope,
+      path: cycle
+    });
+  }
+  const at3 = input.now().toISOString();
+  const registration = {
+    questionId: input.questionId,
+    derivedScope: parsed.derivedScope,
+    sourceScopes: parsed.sourceScopes,
+    question: parsed.question,
+    model: parsed.model,
+    registeredBy: input.registeredBy,
+    status: "pending",
+    error: null,
+    createdAt: at3,
+    updatedAt: at3,
+    lastComputedAt: null,
+    derivedVersion: null,
+    derivedCollectedAt: null
+  };
+  await input.store.insert(registration);
+  return registration;
+}
+function uncoveredSourceScopes(sourceScopes, grantScopes) {
+  const readEntries = (grantScopes ?? []).filter((entry) => !isWriteScopeEntry(entry));
+  return sourceScopes.filter((scope) => !scopeCoveredByGrant(scope, readEntries));
+}
+
+// ../core/dist/derivatives/prompt.js
+var DEFAULT_MAX_SOURCE_ITEMS = 50;
+var DEFAULT_MAX_SOURCE_CHARS = 2e5;
+var TIMESTAMP_KEYS = [
+  "collectedAt",
+  "updatedAt",
+  "updated_at",
+  "update_time",
+  "createdAt",
+  "created_at",
+  "create_time",
+  "timestamp",
+  "time",
+  "date",
+  "publishedAt",
+  "published_at"
+];
+var RESERVED_KEYS = /* @__PURE__ */ new Set(["$lineage", "$writtenBy", "$binary"]);
+function isRecord5(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function timestampOf(item) {
+  if (!isRecord5(item))
+    return null;
+  for (const key of TIMESTAMP_KEYS) {
+    const value = item[key];
+    if (typeof value === "number" && Number.isFinite(value)) {
+      return value < 1e12 ? value * 1e3 : value;
+    }
+    if (typeof value === "string") {
+      const parsed = Date.parse(value);
+      if (!Number.isNaN(parsed))
+        return parsed;
+    }
+  }
+  return null;
+}
+function sortNewestFirst(items) {
+  const indexed = items.map((item, index) => ({
+    item,
+    index,
+    at: timestampOf(item)
+  }));
+  const dated = indexed.filter((entry) => entry.at !== null).sort((a10, b10) => b10.at - a10.at || b10.index - a10.index);
+  const undated = indexed.filter((entry) => entry.at === null).reverse();
+  return [...dated, ...undated].map((entry) => entry.item);
+}
+function trimSourceData(data, options = {}) {
+  const maxItems = Math.max(1, options.maxItems ?? DEFAULT_MAX_SOURCE_ITEMS);
+  const maxChars = Math.max(1, options.maxChars ?? DEFAULT_MAX_SOURCE_CHARS);
+  let kept = 0;
+  let total = 0;
+  const trimArray = (items, limit2) => {
+    total += items.length;
+    const sorted = sortNewestFirst(items).slice(0, limit2);
+    kept += sorted.length;
+    return sorted;
+  };
+  const build = (limit2) => {
+    kept = 0;
+    total = 0;
+    if (Array.isArray(data))
+      return trimArray(data, limit2);
+    if (isRecord5(data)) {
+      const out = {};
+      for (const [key, value] of Object.entries(data)) {
+        if (RESERVED_KEYS.has(key))
+          continue;
+        out[key] = Array.isArray(value) ? trimArray(value, limit2) : value;
+      }
+      return out;
+    }
+    return data;
+  };
+  let limit = maxItems;
+  let result = build(limit);
+  let text = JSON.stringify(result) ?? "null";
+  while (text.length > maxChars && limit > 1) {
+    limit = Math.max(1, Math.floor(limit / 2));
+    result = build(limit);
+    text = JSON.stringify(result) ?? "null";
+  }
+  if (text.length > maxChars) {
+    return {
+      data: `${text.slice(0, maxChars)}...[truncated]`,
+      kept,
+      total,
+      truncated: true
+    };
+  }
+  return { data: result, kept, total, truncated: false };
+}
+var SYSTEM_PROMPT = [
+  "You answer a question about a person using ONLY the user data provided in the message.",
+  "Do not use outside knowledge and do not guess; if the data does not support an answer, say so in the answer.",
+  "Respond with a single JSON object and nothing else, with exactly these fields:",
+  '  "answer": string, the answer to the question, written for the person the data belongs to;',
+  '  "evidence": string, a short summary of which parts of the data support the answer.'
+].join("\n");
+function buildQuestionMessages(input) {
+  const sections = input.sources.map((source) => {
+    const note = source.total > source.kept ? ` (newest ${source.kept} of ${source.total} items)` : "";
+    const cut = source.truncated ? " (truncated)" : "";
+    return [
+      `### Scope: ${source.scope}${note}${cut}`,
+      `Collected at: ${source.collectedAt}`,
+      JSON.stringify(source.data)
+    ].join("\n");
+  });
+  const user = [
+    "## Question",
+    input.question,
+    "",
+    "## User data",
+    ...sections,
+    "",
+    "Answer the question as a JSON object with the fields answer and evidence."
+  ].join("\n");
+  return [
+    { role: "system", content: SYSTEM_PROMPT },
+    { role: "user", content: user }
+  ];
+}
+function parseAnswer(content) {
+  const candidates = [content.trim()];
+  const fenced = /```(?:json)?\s*([\s\S]*?)```/i.exec(content);
+  if (fenced?.[1])
+    candidates.unshift(fenced[1].trim());
+  const first = content.indexOf("{");
+  const last2 = content.lastIndexOf("}");
+  if (first !== -1 && last2 > first) {
+    candidates.push(content.slice(first, last2 + 1));
+  }
+  for (const candidate of candidates) {
+    try {
+      const parsed = JSON.parse(candidate);
+      if (isRecord5(parsed) && typeof parsed.answer === "string") {
+        return {
+          answer: parsed.answer,
+          evidence: typeof parsed.evidence === "string" ? parsed.evidence : null
+        };
+      }
+    } catch {
+    }
+  }
+  return { answer: content.trim(), evidence: null };
+}
+
+// ../core/dist/derivatives/inference.js
+var DEFAULT_INFERENCE_BASE_URL = "https://inference.phala.com/v1";
+var DEFAULT_INFERENCE_MODEL = "z-ai/glm-5.2";
+var DEFAULT_INFERENCE_TIMEOUT_MS = 12e4;
+var DEFAULT_INFERENCE_MAX_TOKENS = 2048;
+var DEFAULT_INFERENCE_REQUEST_FIELDS = {
+  provider: { aci_verified: true, zdr: true }
+};
+var InferenceRequestError = class extends Error {
+  status;
+  /** OpenAI-style `error.type` of the rejection, when the body had one. */
+  errorType;
+  /**
+   * Explicit retry hint. When undefined the compute layer falls back to the
+   * status: no response, 429 or 5xx are retried.
+   */
+  retryable;
+  constructor(message, status2, options = {}) {
+    super(message);
+    this.status = status2;
+    this.name = "InferenceRequestError";
+    this.errorType = options.errorType ?? null;
+    this.retryable = options.retryable;
+  }
+};
+function isRecord6(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function readUsage(value) {
+  if (!isRecord6(value))
+    return void 0;
+  const num2 = (v10) => typeof v10 === "number" ? v10 : void 0;
+  const usage = {
+    promptTokens: num2(value.prompt_tokens),
+    completionTokens: num2(value.completion_tokens),
+    totalTokens: num2(value.total_tokens)
+  };
+  return usage;
+}
+function readContent(body) {
+  if (!isRecord6(body) || !Array.isArray(body.choices))
+    return null;
+  const first = body.choices[0];
+  if (!isRecord6(first) || !isRecord6(first.message))
+    return null;
+  const index = typeof first.index === "number" ? first.index : 0;
+  const field = `choices.${index}.message.content`;
+  const id2 = typeof body.id === "string" ? body.id : "";
+  const content = first.message.content;
+  if (typeof content === "string")
+    return { content, field, id: id2 };
+  if (Array.isArray(content)) {
+    const text = content.map((part) => isRecord6(part) && typeof part.text === "string" ? part.text : "").join("");
+    return { content: text, field, id: id2 };
+  }
+  return null;
+}
+async function readErrorType(response) {
+  try {
+    const body = await response.json();
+    if (isRecord6(body) && isRecord6(body.error)) {
+      return typeof body.error.type === "string" ? body.error.type : null;
+    }
+  } catch {
+  }
+  return null;
+}
+function createOpenAiCompatibleInferenceProvider(options = {}) {
+  const base = (options.baseUrl ?? DEFAULT_INFERENCE_BASE_URL).replace(/\/+$/, "");
+  const defaultModel = options.model ?? DEFAULT_INFERENCE_MODEL;
+  const timeoutMs = options.timeoutMs ?? DEFAULT_INFERENCE_TIMEOUT_MS;
+  const doFetch = options.fetch ?? fetch;
+  const requestFields = options.requestFields ?? DEFAULT_INFERENCE_REQUEST_FIELDS;
+  const encryption = options.encryption;
+  async function send(input) {
+    const headers = new Headers({ "Content-Type": "application/json" });
+    if (options.apiKey) {
+      headers.set("Authorization", `Bearer ${options.apiKey}`);
+    }
+    const model = input.model || defaultModel;
+    let messages = input.messages;
+    let encrypted = null;
+    if (encryption) {
+      encrypted = await encryption.encryptRequest({
+        model,
+        messages,
+        headers
+      });
+      messages = encrypted.messages;
+    }
+    const body = {
+      ...requestFields,
+      model,
+      messages,
+      max_tokens: input.maxTokens ?? DEFAULT_INFERENCE_MAX_TOKENS
+    };
+    let response;
+    try {
+      response = await doFetch(`${base}/chat/completions`, {
+        method: "POST",
+        headers,
+        body: JSON.stringify(body),
+        signal: AbortSignal.timeout(timeoutMs)
+      });
+    } catch (err2) {
+      const name = err2 instanceof Error ? err2.name : "Error";
+      throw new InferenceRequestError(`inference request failed before a response (${name})`, null);
+    }
+    if (!response.ok) {
+      const errorType = await readErrorType(response);
+      const retry = await encryption?.onRejected?.({
+        status: response.status,
+        errorType,
+        headers: response.headers
+      }) === true;
+      return {
+        ok: false,
+        retry,
+        error: new InferenceRequestError(`inference request failed with status ${response.status}${errorType ? ` (${errorType})` : ""}`, response.status, { errorType })
+      };
+    }
+    let parsed;
+    try {
+      parsed = await response.json();
+    } catch {
+      throw new InferenceRequestError("inference response was not JSON", response.status);
+    }
+    const choice = readContent(parsed);
+    if (choice === null) {
+      throw new InferenceRequestError("inference response carried no assistant content", response.status);
+    }
+    let content = choice.content;
+    if (encrypted) {
+      content = await encrypted.decryptResponse({
+        content,
+        field: choice.field,
+        id: choice.id,
+        headers: response.headers
+      });
+    }
+    if (content.trim() === "") {
+      throw new InferenceRequestError("inference response carried no assistant content", response.status);
+    }
+    const receiptId = response.headers.get("x-receipt-id") ?? void 0;
+    const aciIdentity = response.headers.get("x-aci-identity") ?? void 0;
+    return {
+      ok: true,
+      result: {
+        content,
+        usage: readUsage(isRecord6(parsed) ? parsed.usage : void 0),
+        ...receiptId ? { receiptId } : {},
+        ...aciIdentity ? { aciIdentity } : {}
+      }
+    };
+  }
+  return {
+    defaultModel,
+    async chat(input) {
+      const first = await send(input);
+      if (first.ok)
+        return first.result;
+      if (!first.retry)
+        throw first.error;
+      const second = await send(input);
+      if (second.ok)
+        return second.result;
+      throw second.error;
+    }
+  };
+}
+
+// ../core/dist/derivatives/compute.js
+var DEFAULT_RETRY_DELAYS_MS = [1e3, 4e3];
+function isRetryableInferenceError(err2) {
+  if (!(err2 instanceof InferenceRequestError))
+    return false;
+  if (err2.retryable !== void 0)
+    return err2.retryable;
+  return err2.status === null || err2.status === 429 || err2.status >= 500;
+}
+async function withRetries(deps, attempt, retryable) {
+  const delays = deps.retryDelaysMs ?? DEFAULT_RETRY_DELAYS_MS;
+  const sleep2 = deps.sleep ?? ((ms3) => new Promise((r10) => setTimeout(r10, ms3)));
+  for (let index = 0; ; index += 1) {
+    try {
+      return await attempt();
+    } catch (err2) {
+      if (index >= delays.length || !retryable(err2))
+        throw err2;
+      await sleep2(delays[index]);
+    }
+  }
+}
+var ComputeFailure = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ComputeFailure";
+  }
+};
+function shortError(err2) {
+  if (err2 instanceof ComputeFailure)
+    return err2.message;
+  if (err2 instanceof InferenceRequestError)
+    return err2.message;
+  if (err2 instanceof ProtocolError)
+    return `${err2.errorCode}: ${err2.message}`;
+  return `compute failed (${err2 instanceof Error ? err2.name : "Error"})`;
+}
+function collectedAtStamp(now, isTaken) {
+  const base = now();
+  base.setUTCMilliseconds(0);
+  for (let bump = 0; bump < 60; bump += 1) {
+    const candidate = new Date(base.getTime() + bump * 1e3).toISOString().replace(/\.\d{3}Z$/, "Z");
+    if (!isTaken(candidate))
+      return candidate;
+  }
+  throw new ComputeFailure("could not allocate a version stamp");
+}
+async function tombstoneMarker(scopeDeletions, scope) {
+  if (!scopeDeletions)
+    return null;
+  const verdict = await scopeDeletions.resolve(scope);
+  if (!verdict.deleted || verdict.version === null)
+    return null;
+  const version4 = Number(verdict.version);
+  return Number.isSafeInteger(version4) ? version4 : null;
+}
+function localScopesById2(storage, serverOwner) {
+  const byId = /* @__PURE__ */ new Map();
+  for (let offset = 0; ; offset += LOCAL_SCOPE_SCAN_PAGE) {
+    const { scopes, total } = storage.listScopes({
+      limit: LOCAL_SCOPE_SCAN_PAGE,
+      offset
+    });
+    for (const summary of scopes) {
+      byId.set(computeDataPointId(serverOwner, summary.scope), summary.scope);
+    }
+    if (scopes.length === 0 || offset + scopes.length >= total)
+      break;
+  }
+  return byId;
+}
+async function assertNoLineageCycle(deps, registration, serverOwner, sourceLineage) {
+  const derivedId = computeDataPointId(serverOwner, registration.derivedScope);
+  let byId = null;
+  const visited = /* @__PURE__ */ new Set();
+  const stack = [];
+  for (const [scope, sources] of sourceLineage) {
+    for (const id2 of sources)
+      stack.push({ id: id2, path: [scope] });
+  }
+  while (stack.length > 0) {
+    const { id: id2, path } = stack.pop();
+    if (id2 === derivedId) {
+      throw new DerivativeCycleError({
+        derivedScope: registration.derivedScope,
+        path: [registration.derivedScope, ...path, registration.derivedScope]
+      });
+    }
+    if (visited.has(id2))
+      continue;
+    visited.add(id2);
+    byId ??= localScopesById2(deps.storage, serverOwner);
+    const scope = byId.get(id2);
+    if (!scope)
+      continue;
+    const entry = deps.storage.findEntry({ scope });
+    if (!entry)
+      continue;
+    let sources = [];
+    try {
+      const envelope = await deps.storage.readEnvelope(scope, entry.collectedAt);
+      sources = readStoredLineage(envelope.data)?.sources ?? [];
+    } catch {
+    }
+    for (const next of sources)
+      stack.push({ id: next, path: [...path, scope] });
+  }
+}
+async function loadSource(deps, scope) {
+  const entry = deps.storage.findEntry({ scope });
+  const deletion = await resolveReadDeletion({ scopeDeletions: deps.scopeDeletions, serverOwner: deps.serverOwner }, scope, entry);
+  if (deletion) {
+    throw new ComputeFailure(`source scope ${scope} is deleted`);
+  }
+  if (!entry) {
+    throw new ComputeFailure(`source scope ${scope} has no local data`);
+  }
+  let envelope;
+  try {
+    envelope = await deps.storage.readEnvelope(scope, entry.collectedAt);
+  } catch {
+    throw new ComputeFailure(`source scope ${scope} could not be read`);
+  }
+  let lineageSources = [];
+  try {
+    lineageSources = readStoredLineage(envelope.data)?.sources ?? [];
+  } catch {
+  }
+  const raw = isBinaryEnvelope(envelope) ? {
+    binary: true,
+    note: "binary record; its content is not included in the prompt"
+  } : envelope.data;
+  const trimmed = trimSourceData(raw, {
+    maxItems: deps.maxSourceItems,
+    maxChars: deps.maxSourceChars
+  });
+  return {
+    source: {
+      scope,
+      collectedAt: entry.collectedAt,
+      version: entry.version,
+      data: trimmed.data,
+      kept: trimmed.kept,
+      total: trimmed.total,
+      truncated: trimmed.truncated
+    },
+    lineageSources
+  };
+}
+async function assertGrantStillValid(deps, registration) {
+  if (registration.registeredBy.kind !== "builder")
+    return;
+  if (!deps.writePolicyPorts) {
+    throw new ComputeFailure("builder grant verification is not configured");
+  }
+  if (!deps.serverOwner) {
+    throw new ComputeFailure("server owner is not configured");
+  }
+  const { builder, grantId } = registration.registeredBy;
+  const ports = deps.writePolicyPorts;
+  const serverOwner = deps.serverOwner;
+  const grant = await withRetries(deps, () => verifyDataWritePolicy({
+    signer: builder,
+    grantId,
+    requestedScope: registration.derivedScope,
+    serverOwner
+  }, ports), (err2) => !(err2 instanceof ProtocolError));
+  const uncovered = uncoveredSourceScopes(registration.sourceScopes, grant.scopes ?? []);
+  if (uncovered.length > 0) {
+    throw new DerivativeSourceNotGrantedError({ scopes: uncovered });
+  }
+}
+async function computeQuestion(questionId, deps) {
+  const now = deps.now ?? (() => /* @__PURE__ */ new Date());
+  if (await deps.runtimeAvailability?.isAvailable() === false) {
+    return { status: "skipped", reason: "runtime-unavailable" };
+  }
+  const registration = await deps.store.get(questionId);
+  if (!registration)
+    return { status: "skipped", reason: "unknown-question" };
+  try {
+    if (!deps.serverOwner) {
+      throw new ComputeFailure("server owner is not configured");
+    }
+    const serverOwner = deps.serverOwner;
+    await assertGrantStillValid(deps, registration);
+    assertDerivedScopeNaming(registration.derivedScope, registration.sourceScopes);
+    const sources = [];
+    const sourceLineage = /* @__PURE__ */ new Map();
+    for (const scope of registration.sourceScopes) {
+      const loaded = await loadSource(deps, scope);
+      sources.push(loaded.source);
+      sourceLineage.set(scope, loaded.lineageSources);
+    }
+    await assertNoLineageCycle(deps, registration, serverOwner, sourceLineage);
+    const messages = buildQuestionMessages({
+      question: registration.question,
+      sources
+    });
+    const model = registration.model ?? deps.provider.defaultModel;
+    const reply = await withRetries(deps, () => deps.provider.chat({ model, messages, maxTokens: deps.maxTokens }), isRetryableInferenceError);
+    const parsed = parseAnswer(reply.content);
+    const computedAt = now().toISOString();
+    const lineageIds = registration.sourceScopes.map((scope) => computeDataPointId(serverOwner, scope));
+    const record2 = {
+      questionId: registration.questionId,
+      question: registration.question,
+      answer: parsed.answer,
+      evidence: parsed.evidence,
+      model,
+      computedAt,
+      sources: sources.map((source) => ({
+        scope: source.scope,
+        version: source.version,
+        collectedAt: source.collectedAt
+      })),
+      lineage: lineageIds,
+      ...reply.receiptId || reply.aciIdentity ? {
+        inference: {
+          ...reply.receiptId ? { receiptId: reply.receiptId } : {},
+          ...reply.aciIdentity ? { aciIdentity: reply.aciIdentity } : {}
+        }
+      } : {}
+    };
+    const lineage = {
+      sources: lineageIds,
+      writtenAt: computedAt
+    };
+    const collectedAt2 = collectedAtStamp(now, (candidate) => deps.storage.findEntry({
+      scope: registration.derivedScope,
+      at: candidate
+    })?.collectedAt === candidate);
+    const written = await ingestDataContract({
+      storage: deps.storage,
+      scopeParam: registration.derivedScope,
+      body: record2,
+      collectedAt: collectedAt2,
+      status: deps.syncManager ? "syncing" : "stored",
+      lineage,
+      afterTombstoneVersion: await tombstoneMarker(deps.scopeDeletions, registration.derivedScope)
+    });
+    if (!written.ok) {
+      throw new ComputeFailure(`derived record rejected: ${written.body.error}`);
+    }
+    const entry = deps.storage.findEntry({
+      scope: registration.derivedScope,
+      at: collectedAt2
+    });
+    const updated = await deps.store.update(questionId, {
+      status: "ready",
+      error: null,
+      updatedAt: computedAt,
+      lastComputedAt: computedAt,
+      derivedVersion: entry?.version ?? null,
+      derivedCollectedAt: collectedAt2
+    });
+    if (deps.syncManager?.notifyNewData) {
+      deps.syncManager.notifyNewData();
+    } else if (deps.syncManager?.trigger) {
+      void deps.syncManager.trigger().catch(() => void 0);
+    }
+    try {
+      deps.onDerivedWritten?.({
+        scope: registration.derivedScope,
+        collectedAt: collectedAt2,
+        lineageSources: lineageIds
+      });
+    } catch (err2) {
+      deps.logger?.warn?.({
+        questionId,
+        derivedScope: registration.derivedScope,
+        error: err2 instanceof Error ? err2.name : String(err2)
+      }, "onDerivedWritten hook failed; derivative already written");
+    }
+    deps.logger?.info?.({
+      questionId,
+      derivedScope: registration.derivedScope,
+      sourceScopes: registration.sourceScopes,
+      model,
+      version: entry?.version ?? null,
+      receiptId: reply.receiptId ?? null
+    }, "Derivative question computed");
+    return {
+      status: "ready",
+      registration: updated ?? { ...registration, status: "ready" }
+    };
+  } catch (err2) {
+    const error51 = shortError(err2);
+    const at3 = now().toISOString();
+    const updated = await deps.store.update(questionId, {
+      status: "failed",
+      error: error51,
+      updatedAt: at3
+    });
+    deps.logger?.warn?.({ questionId, derivedScope: registration.derivedScope, error: error51 }, "Derivative question compute failed");
+    return {
+      status: "failed",
+      registration: updated ?? { ...registration, status: "failed", error: error51 },
+      error: error51
+    };
+  }
+}
+
+// ../core/dist/derivatives/scheduler.js
+var defaultTimers = {
+  setTimeout: (callback, ms3) => setTimeout(callback, ms3),
+  clearTimeout: (handle) => clearTimeout(handle)
+};
+function createRecomputeScheduler(options) {
+  const debounceMs = options.debounceMs ?? 5e3;
+  const timers = options.timers ?? defaultTimers;
+  const now = options.now ?? (() => /* @__PURE__ */ new Date());
+  const states = /* @__PURE__ */ new Map();
+  const pending = /* @__PURE__ */ new Set();
+  let stopped = false;
+  function track(promise2) {
+    pending.add(promise2);
+    const done = () => pending.delete(promise2);
+    promise2.then(done, done);
+    return promise2;
+  }
+  function warn(payload, message) {
+    options.logger?.warn?.(payload, message);
+  }
+  function stateFor(questionId) {
+    let state = states.get(questionId);
+    if (!state) {
+      state = { timer: null, running: null, rerun: false };
+      states.set(questionId, state);
+    }
+    return state;
+  }
+  function run(questionId) {
+    if (stopped)
+      return;
+    const state = stateFor(questionId);
+    if (state.running) {
+      state.rerun = true;
+      return;
+    }
+    state.running = track(Promise.resolve().then(() => options.compute(questionId)).then(() => void 0, (err2) => warn({
+      questionId,
+      error: err2 instanceof Error ? err2.name : String(err2)
+    }, "Derivative compute threw")).then(async () => {
+      state.running = null;
+      if (state.rerun) {
+        state.rerun = false;
+        await markStale(questionId);
+        schedule(questionId, 0);
+      } else if (!states.get(questionId)?.timer) {
+        states.delete(questionId);
+      }
+    }));
+  }
+  function schedule(questionId, delayMs) {
+    if (stopped)
+      return;
+    const state = stateFor(questionId);
+    if (state.timer !== null)
+      timers.clearTimeout(state.timer);
+    state.timer = timers.setTimeout(() => {
+      state.timer = null;
+      run(questionId);
+    }, delayMs);
+  }
+  async function markStale(questionId) {
+    const registration = await options.store.get(questionId);
+    if (!registration)
+      return;
+    if (registration.status === "ready" || registration.status === "failed") {
+      await options.store.update(questionId, {
+        status: "stale",
+        updatedAt: now().toISOString()
+      });
+    }
+  }
+  return {
+    markSourceChanged(scope, opts) {
+      if (stopped)
+        return;
+      const lineage = new Set((opts?.lineageSources ?? []).map((id2) => id2.toLowerCase()));
+      void track((async () => {
+        const affected = await options.store.list({ sourceScope: scope });
+        for (const registration of affected) {
+          if (options.serverOwner && lineage.has(computeDataPointId(options.serverOwner, registration.derivedScope))) {
+            continue;
+          }
+          await markStale(registration.questionId);
+          schedule(registration.questionId, debounceMs);
+        }
+      })().catch((err2) => warn({ scope, error: err2 instanceof Error ? err2.name : String(err2) }, "Could not mark derivative questions stale")));
+    },
+    requestRecompute(questionId, opts) {
+      if (stopped)
+        return;
+      void track(markStale(questionId).catch((err2) => warn({
+        questionId,
+        error: err2 instanceof Error ? err2.name : String(err2)
+      }, "Could not mark derivative question stale")).then(() => schedule(questionId, opts?.immediate ? 0 : debounceMs)));
+    },
+    async whenIdle() {
+      const waitForTimers = !options.timers;
+      for (; ; ) {
+        while (pending.size > 0) {
+          await Promise.allSettled([...pending]);
+        }
+        const busy = [...states.values()].some((state) => state.running !== null || waitForTimers && state.timer !== null);
+        if (!busy)
+          return;
+        await new Promise((resolve) => setTimeout(resolve, 5));
+      }
+    },
+    stop() {
+      stopped = true;
+      for (const state of states.values()) {
+        if (state.timer !== null)
+          timers.clearTimeout(state.timer);
+        state.timer = null;
+      }
+    },
+    start() {
+      if (!stopped)
+        return;
+      stopped = false;
+      void track((async () => {
+        for (const registration of await options.store.list()) {
+          if (registration.status === "pending" || registration.status === "stale") {
+            schedule(registration.questionId, 0);
+          }
+        }
+      })().catch((err2) => warn({ error: err2 instanceof Error ? err2.name : String(err2) }, "Could not reschedule derivative questions")));
+    }
+  };
+}
+
+// ../core/dist/derivatives/api.js
+var MAX_QUESTION_BODY_BYTES = 16 * 1024;
+function jsonResponse2(body, init) {
+  const headers = new Headers(init?.headers);
+  headers.set("Content-Type", "application/json");
+  return new Response(JSON.stringify(body), { ...init, headers });
+}
+function errorResponse2(status2, errorCode, message) {
+  return jsonResponse2({ error: { code: status2, errorCode, message } }, { status: status2 });
+}
+function stripBasePath2(pathname, basePath) {
+  if (!basePath || basePath === "/")
+    return pathname;
+  if (pathname === basePath)
+    return "/";
+  if (pathname.startsWith(`${basePath}/`))
+    return pathname.slice(basePath.length);
+  return pathname;
+}
+async function authorizeOwnerOrWriter(deps, request2, scope) {
+  if (deps.auth.authorizeWrite) {
+    return await deps.auth.authorizeWrite({ request: request2, scope }) ?? void 0;
+  }
+  await deps.auth.authorizeOwner(request2);
+  return void 0;
+}
+function sameBuilder(a10, b10) {
+  return a10.toLowerCase() === b10.toLowerCase();
+}
+async function loadForCaller(deps, request2, store, questionId) {
+  const registration = await store.get(questionId);
+  if (!registration) {
+    await deps.auth.authorizeOwner(request2);
+    throw new DerivativeQuestionNotFoundError({ questionId });
+  }
+  const writer = await authorizeOwnerOrWriter(deps, request2, registration.derivedScope);
+  if (writer) {
+    const by2 = registration.registeredBy;
+    if (by2.kind !== "builder" || !sameBuilder(by2.builder, writer.builder)) {
+      await writer.releaseProof?.();
+      throw new DerivativeQuestionNotFoundError({ questionId });
+    }
+  }
+  return { registration, writer };
+}
+async function handlePersonalServerDerivativesRequest(request2, deps, options = {}) {
+  try {
+    const url2 = new URL(request2.url);
+    const pathname = stripBasePath2(url2.pathname, options.basePath);
+    const parts = pathname.split("/").filter(Boolean);
+    if (parts[0] !== "questions" || parts.length > 3) {
+      return errorResponse2(404, "NOT_FOUND", "Not found");
+    }
+    const compute = deps.compute;
+    if (!compute)
+      throw new DerivativeComputeUnavailableError();
+    const { store, scheduler } = compute;
+    const now = deps.now ?? (() => /* @__PURE__ */ new Date());
+    if (parts.length === 1) {
+      if (request2.method === "GET") {
+        const derivedScope = url2.searchParams.get("derivedScope") ?? void 0;
+        if (derivedScope) {
+          const writer = await authorizeOwnerOrWriter(deps, request2, derivedScope);
+          const registrations2 = await store.list({
+            derivedScope,
+            ...writer ? { builder: writer.builder } : {}
+          });
+          return jsonResponse2({
+            questions: registrations2.map(questionRegistrationView)
+          });
+        }
+        await deps.auth.authorizeOwner(request2);
+        const registrations = await store.list();
+        return jsonResponse2({
+          questions: registrations.map(questionRegistrationView)
+        });
+      }
+      if (request2.method === "POST") {
+        const declared = Number(request2.headers.get("content-length") ?? "0");
+        if (declared > MAX_QUESTION_BODY_BYTES) {
+          throw new ContentTooLargeError({ max: MAX_QUESTION_BODY_BYTES });
+        }
+        const bodyBytes = new Uint8Array(await request2.clone().arrayBuffer());
+        if (bodyBytes.byteLength > MAX_QUESTION_BODY_BYTES) {
+          throw new ContentTooLargeError({ max: MAX_QUESTION_BODY_BYTES });
+        }
+        const parsed = await parseJsonObjectBody(request2.clone(), "Request body must be valid JSON");
+        if (!parsed.ok) {
+          return jsonResponse2(parsed.result.body, {
+            status: parsed.result.status
+          });
+        }
+        const rawScope = parsed.body.derivedScope;
+        const scopeForAuth = typeof rawScope === "string" ? rawScope : "";
+        const writer = await authorizeOwnerOrWriter(deps, request2, scopeForAuth);
+        const registeredBy = writer ? {
+          kind: "builder",
+          builder: writer.builder,
+          grantId: writer.grantId
+        } : { kind: "owner" };
+        let registration;
+        try {
+          if (writer) {
+            const input = parseQuestionInput(parsed.body);
+            const uncovered = uncoveredSourceScopes(input.sourceScopes, writer.grantScopes);
+            if (uncovered.length > 0) {
+              throw new DerivativeSourceNotGrantedError({ scopes: uncovered });
+            }
+          }
+          registration = await createQuestionRegistration({
+            body: parsed.body,
+            registeredBy,
+            store,
+            questionId: deps.createQuestionId?.() ?? crypto.randomUUID(),
+            now
+          });
+        } catch (err2) {
+          await writer?.releaseProof?.();
+          throw err2;
+        }
+        deps.logger?.info?.({
+          questionId: registration.questionId,
+          derivedScope: registration.derivedScope,
+          sourceScopes: registration.sourceScopes,
+          registeredBy: registeredBy.kind,
+          ...writer ? { builder: writer.builder, grantId: writer.grantId } : {}
+        }, "Derivative question registered");
+        scheduler.requestRecompute(registration.questionId, {
+          immediate: true
+        });
+        return jsonResponse2(questionRegistrationView(registration), {
+          status: 201
+        });
+      }
+      return errorResponse2(405, "METHOD_NOT_ALLOWED", "Method not allowed");
+    }
+    const questionId = decodeURIComponent(parts[1] ?? "");
+    if (parts.length === 3) {
+      if (parts[2] !== "recompute") {
+        return errorResponse2(404, "NOT_FOUND", "Not found");
+      }
+      if (request2.method !== "POST") {
+        return errorResponse2(405, "METHOD_NOT_ALLOWED", "Method not allowed");
+      }
+      const { registration } = await loadForCaller(deps, request2, store, questionId);
+      scheduler.requestRecompute(questionId, { immediate: true });
+      return jsonResponse2({
+        questionId,
+        status: registration.status === "pending" ? "pending" : "stale",
+        derivedScope: registration.derivedScope
+      }, { status: 202 });
+    }
+    if (request2.method === "GET") {
+      const { registration } = await loadForCaller(deps, request2, store, questionId);
+      return jsonResponse2(questionRegistrationView(registration));
+    }
+    if (request2.method === "DELETE") {
+      const { registration } = await loadForCaller(deps, request2, store, questionId);
+      await store.delete(questionId);
+      deps.logger?.info?.({ questionId, derivedScope: registration.derivedScope }, "Derivative question deleted");
+      return jsonResponse2({ questionId, deleted: true });
+    }
+    return errorResponse2(405, "METHOD_NOT_ALLOWED", "Method not allowed");
+  } catch (err2) {
+    if (err2 instanceof ProtocolError) {
+      return jsonResponse2(err2.toJSON(), { status: err2.code });
+    }
+    return errorResponse2(500, "INTERNAL_ERROR", "Internal server error");
+  }
+}
+
+// ../core/dist/derivatives/e2ee/jcs.js
+function canonicalizeJson(value) {
+  if (value === null)
+    return "null";
+  switch (typeof value) {
+    case "boolean":
+      return value ? "true" : "false";
+    case "number":
+      if (!Number.isFinite(value)) {
+        throw new TypeError("JCS: non-finite number");
+      }
+      return JSON.stringify(value);
+    case "string":
+      return JSON.stringify(value);
+    case "object": {
+      if (Array.isArray(value)) {
+        return `[${value.map((item) => canonicalizeJson(item)).join(",")}]`;
+      }
+      const record2 = value;
+      const keys = Object.keys(record2).sort();
+      const members = [];
+      for (const key of keys) {
+        const member = record2[key];
+        if (member === void 0) {
+          throw new TypeError(`JCS: undefined member "${key}"`);
+        }
+        members.push(`${JSON.stringify(key)}:${canonicalizeJson(member)}`);
+      }
+      return `{${members.join(",")}}`;
+    }
+    default:
+      throw new TypeError(`JCS: unsupported value of type ${typeof value}`);
+  }
+}
+var encoder3 = new TextEncoder();
+function canonicalJsonBytes(value) {
+  return encoder3.encode(canonicalizeJson(value));
+}
+
+// ../core/dist/derivatives/e2ee/aad.js
+var E2EE_REQUEST_AAD_PURPOSE = "aci.e2ee.request.v2";
+var E2EE_RESPONSE_AAD_PURPOSE = "aci.e2ee.response.v2";
+function requestFieldAad(context, field) {
+  return canonicalJsonBytes({
+    purpose: E2EE_REQUEST_AAD_PURPOSE,
+    algo: context.algo,
+    model: context.model,
+    field,
+    nonce: context.nonce,
+    ts: context.ts
+  });
+}
+function responseFieldAad(context, field, id2) {
+  return canonicalJsonBytes({
+    purpose: E2EE_RESPONSE_AAD_PURPOSE,
+    algo: context.algo,
+    model: context.model,
+    id: id2,
+    field,
+    nonce: context.nonce,
+    ts: context.ts
+  });
+}
+
+// ../core/dist/derivatives/e2ee/suite.js
+var E2EE_ALGO_X25519 = "x25519-aes-256-gcm-hkdf-sha256";
+var E2EE_HKDF_INFO_X25519 = "aci.e2ee.v2.x25519";
+var X25519_PUBLIC_KEY_BYTES = 32;
+var AES_GCM_NONCE_BYTES = 12;
+var AES_GCM_TAG_BYTES = 16;
+var E2eeCipherError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "E2eeCipherError";
+  }
+};
+function subtle() {
+  const api = globalThis.crypto?.subtle;
+  if (!api)
+    throw new E2eeCipherError("WebCrypto is not available");
+  return api;
+}
+function randomBytes4(length) {
+  const bytes2 = new Uint8Array(length);
+  globalThis.crypto.getRandomValues(bytes2);
+  return bytes2;
+}
+function bytesToHex6(bytes2) {
+  let out = "";
+  for (const byte of bytes2)
+    out += byte.toString(16).padStart(2, "0");
+  return out;
+}
+function hexToBytes4(hex3) {
+  const clean2 = hex3.startsWith("0x") || hex3.startsWith("0X") ? hex3.slice(2) : hex3;
+  if (clean2.length % 2 !== 0 || !/^[0-9a-fA-F]*$/.test(clean2)) {
+    throw new E2eeCipherError("malformed hex");
+  }
+  const out = new Uint8Array(clean2.length / 2);
+  for (let i10 = 0; i10 < out.length; i10 += 1) {
+    out[i10] = parseInt(clean2.slice(i10 * 2, i10 * 2 + 2), 16);
+  }
+  return out;
+}
+function parseX25519PublicKey(hex3) {
+  const bytes2 = hexToBytes4(hex3);
+  if (bytes2.length !== X25519_PUBLIC_KEY_BYTES) {
+    throw new E2eeCipherError("X25519 public key must be 32 bytes");
+  }
+  return bytes2;
+}
+function concat2(...parts) {
+  const total = parts.reduce((sum, part) => sum + part.length, 0);
+  const out = new Uint8Array(total);
+  let offset = 0;
+  for (const part of parts) {
+    out.set(part, offset);
+    offset += part.length;
+  }
+  return out;
+}
+function toBuffer(bytes2) {
+  const out = new ArrayBuffer(bytes2.byteLength);
+  new Uint8Array(out).set(bytes2);
+  return out;
+}
+async function generateX25519KeyPair() {
+  const pair = await subtle().generateKey({ name: "X25519" }, false, [
+    "deriveBits"
+  ]);
+  const raw = await subtle().exportKey("raw", pair.publicKey);
+  return { privateKey: pair.privateKey, publicKey: new Uint8Array(raw) };
+}
+async function deriveFieldKey(privateKey, peerPublicKey, usage) {
+  const api = subtle();
+  const peer = await api.importKey("raw", toBuffer(peerPublicKey), { name: "X25519" }, false, []);
+  const shared = await api.deriveBits({ name: "X25519", public: peer }, privateKey, X25519_PUBLIC_KEY_BYTES * 8);
+  const ikm = await api.importKey("raw", shared, "HKDF", false, ["deriveKey"]);
+  return api.deriveKey({
+    name: "HKDF",
+    hash: "SHA-256",
+    salt: new Uint8Array(0),
+    info: new TextEncoder().encode(E2EE_HKDF_INFO_X25519)
+  }, ikm, { name: "AES-GCM", length: 256 }, false, [usage]);
+}
+async function encryptField(input) {
+  const ephemeral = input.ephemeral ?? await generateX25519KeyPair();
+  const nonce = input.nonce ?? randomBytes4(AES_GCM_NONCE_BYTES);
+  if (nonce.length !== AES_GCM_NONCE_BYTES) {
+    throw new E2eeCipherError("AES-GCM nonce must be 12 bytes");
+  }
+  const key = await deriveFieldKey(ephemeral.privateKey, input.recipientPublicKey, "encrypt");
+  const sealed = await subtle().encrypt({
+    name: "AES-GCM",
+    iv: toBuffer(nonce),
+    additionalData: toBuffer(input.aad),
+    tagLength: AES_GCM_TAG_BYTES * 8
+  }, key, new TextEncoder().encode(input.plaintext));
+  return bytesToHex6(concat2(ephemeral.publicKey, nonce, new Uint8Array(sealed)));
+}
+async function decryptField(input) {
+  let bytes2;
+  try {
+    bytes2 = hexToBytes4(input.wire);
+  } catch {
+    throw new E2eeCipherError("ciphertext is not hex");
+  }
+  const minimum = X25519_PUBLIC_KEY_BYTES + AES_GCM_NONCE_BYTES + AES_GCM_TAG_BYTES;
+  if (bytes2.length < minimum) {
+    throw new E2eeCipherError("ciphertext is too short");
+  }
+  const ephemeralPublicKey = bytes2.subarray(0, X25519_PUBLIC_KEY_BYTES);
+  const nonce = bytes2.subarray(X25519_PUBLIC_KEY_BYTES, X25519_PUBLIC_KEY_BYTES + AES_GCM_NONCE_BYTES);
+  const sealed = bytes2.subarray(X25519_PUBLIC_KEY_BYTES + AES_GCM_NONCE_BYTES);
+  let key;
+  try {
+    key = await deriveFieldKey(input.privateKey, ephemeralPublicKey, "decrypt");
+  } catch {
+    throw new E2eeCipherError("key agreement failed");
+  }
+  let opened;
+  try {
+    opened = await subtle().decrypt({
+      name: "AES-GCM",
+      iv: toBuffer(nonce),
+      additionalData: toBuffer(input.aad),
+      tagLength: AES_GCM_TAG_BYTES * 8
+    }, key, toBuffer(sealed));
+  } catch {
+    throw new E2eeCipherError("authentication failed");
+  }
+  return new TextDecoder().decode(opened);
+}
+
+// ../core/dist/derivatives/e2ee/attestation.js
+var ACI_API_VERSION = "aci/1";
+var ACI_REPORT_DATA_PURPOSE = "aci.report_data.v1";
+var E2EE_VERSION = "2";
+var PHALA_GATEWAY_BASE_URL = "https://inference.phala.com/v1";
+var MAX_KEYSET_LIFETIME_S = 400 * 24 * 3600;
+var DEFAULT_FETCH_TIMEOUT_MS = 15e3;
+var E2eeAttestationError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "E2eeAttestationError";
+  }
+};
+function isRecord7(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+async function sha256Hex2(bytes2) {
+  const buffer = new ArrayBuffer(bytes2.byteLength);
+  new Uint8Array(buffer).set(bytes2);
+  const digest = await globalThis.crypto.subtle.digest("SHA-256", buffer);
+  return bytesToHex6(new Uint8Array(digest));
+}
+async function workloadKeysetDigest(keyset) {
+  return `sha256:${await sha256Hex2(canonicalJsonBytes(keyset))}`;
+}
+async function reportDataFor(keysetDigest, nonce) {
+  const nonceJson = nonce === null ? "null" : `"${nonce}"`;
+  const statement = `{"keyset_digest":"${keysetDigest}","nonce":${nonceJson},"purpose":"${ACI_REPORT_DATA_PURPOSE}"}`;
+  return sha256Hex2(new TextEncoder().encode(statement));
+}
+function parseReport(body) {
+  if (!isRecord7(body) || typeof body.api_version !== "string" || typeof body.workload_keyset_digest !== "string" || !isRecord7(body.attestation) || typeof body.attestation.tee_type !== "string" || typeof body.attestation.report_data !== "string" || !isRecord7(body.attestation.workload_keyset)) {
+    throw new E2eeAttestationError("malformed_report", "attestation report is missing required fields");
+  }
+  const keyset = body.attestation.workload_keyset;
+  if (typeof keyset.not_after !== "number" || !Array.isArray(keyset.e2ee_public_keys)) {
+    throw new E2eeAttestationError("malformed_report", "workload keyset is missing not_after or e2ee_public_keys");
+  }
+  return body;
+}
+async function verifyAciReportBinding(report, nonce, nowSeconds) {
+  if (report.api_version !== ACI_API_VERSION) {
+    throw new E2eeAttestationError("malformed_report", `unsupported attestation api_version ${report.api_version}`);
+  }
+  if (report.attestation.tee_type !== "tdx") {
+    throw new E2eeAttestationError("malformed_report", `unsupported tee_type ${report.attestation.tee_type}`);
+  }
+  const versions = report.service_capabilities?.supported_e2ee_versions;
+  if (!Array.isArray(versions) || !versions.includes(E2EE_VERSION)) {
+    throw new E2eeAttestationError("e2ee_unsupported", "service does not advertise E2EE version 2");
+  }
+  const keyset = report.attestation.workload_keyset;
+  const digest = await workloadKeysetDigest(keyset);
+  if (digest !== report.workload_keyset_digest) {
+    throw new E2eeAttestationError("keyset_digest_mismatch", "workload_keyset_digest does not match the embedded keyset");
+  }
+  const expectedReportData = await reportDataFor(digest, nonce);
+  const reportData = report.attestation.report_data.toLowerCase();
+  if (reportData !== expectedReportData) {
+    throw new E2eeAttestationError("report_data_mismatch", "report_data does not bind the keyset digest and our nonce");
+  }
+  const quoteReportData = report.attestation.evidence?.quote_report_data;
+  if (typeof quoteReportData === "string") {
+    const slot = quoteReportData.toLowerCase();
+    if (slot.length !== 128 || !slot.startsWith(reportData) || !/^0+$/.test(slot.slice(64))) {
+      throw new E2eeAttestationError("report_data_mismatch", "quote report-data slot does not carry report_data zero-padded");
+    }
+  }
+  if (!(nowSeconds < keyset.not_after)) {
+    throw new E2eeAttestationError("keyset_expired", "workload keyset has expired");
+  }
+  if (keyset.not_after - nowSeconds > MAX_KEYSET_LIFETIME_S) {
+    throw new E2eeAttestationError("keyset_expired", "workload keyset not_after is implausibly far in the future");
+  }
+  return digest;
+}
+function selectX25519Key(keyset, expectedKeyId) {
+  for (const entry of keyset.e2ee_public_keys) {
+    if (!isRecord7(entry) || entry.algo !== E2EE_ALGO_X25519)
+      continue;
+    if (typeof entry.public_key !== "string")
+      continue;
+    if (expectedKeyId !== void 0 && entry.key_id !== expectedKeyId) {
+      continue;
+    }
+    let publicKey;
+    try {
+      publicKey = parseX25519PublicKey(entry.public_key);
+    } catch {
+      throw new E2eeAttestationError("no_e2ee_key", "the X25519 E2EE key in the keyset is malformed");
+    }
+    return { entry, publicKey };
+  }
+  throw new E2eeAttestationError("no_e2ee_key", expectedKeyId ? `keyset has no ${E2EE_ALGO_X25519} key with key_id ${expectedKeyId}` : `keyset has no ${E2EE_ALGO_X25519} key`);
+}
+function attestationUrl(baseUrl, nonce) {
+  return `${baseUrl.replace(/\/+$/, "")}/aci/attestation?nonce=${nonce}`;
+}
+async function fetchReport(doFetch, url2, timeoutMs) {
+  let response;
+  try {
+    response = await doFetch(url2, {
+      method: "GET",
+      headers: { Accept: "application/json" },
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+  } catch (err2) {
+    const name = err2 instanceof Error ? err2.name : "Error";
+    throw new E2eeAttestationError("fetch_failed", `attestation fetch failed before a response (${name})`);
+  }
+  if (!response.ok) {
+    return { status: response.status, body: null };
+  }
+  try {
+    return { status: response.status, body: await response.json() };
+  } catch {
+    throw new E2eeAttestationError("malformed_report", "attestation response was not JSON");
+  }
+}
+async function fetchGatewayE2eeKey(options) {
+  const doFetch = options.fetch ?? fetch;
+  const clock = options.clock ?? Date.now;
+  const random = options.random ?? randomBytes4;
+  const timeoutMs = options.timeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
+  const nonce = bytesToHex6(random(32));
+  const fallback = options.fallbackBaseUrl === void 0 ? PHALA_GATEWAY_BASE_URL : options.fallbackBaseUrl;
+  let source = options.baseUrl;
+  let fetched = await fetchReport(doFetch, attestationUrl(source, nonce), timeoutMs);
+  if ((fetched.status === 404 || fetched.status === 405) && fallback !== null && fallback.replace(/\/+$/, "") !== source.replace(/\/+$/, "")) {
+    source = fallback;
+    fetched = await fetchReport(doFetch, attestationUrl(source, nonce), timeoutMs);
+  }
+  if (fetched.body === null) {
+    throw new E2eeAttestationError("fetch_failed", `attestation fetch failed with status ${fetched.status}`);
+  }
+  const report = parseReport(fetched.body);
+  const nowSeconds = Math.floor(clock() / 1e3);
+  const keysetDigest = await verifyAciReportBinding(report, nonce, nowSeconds);
+  const { entry, publicKey } = selectX25519Key(report.attestation.workload_keyset, options.expectedKeyId);
+  if (options.verifyEvidence) {
+    try {
+      await options.verifyEvidence(report);
+    } catch (err2) {
+      const reason = err2 instanceof Error ? err2.message : String(err2);
+      throw new E2eeAttestationError("evidence_rejected", `attestation evidence rejected: ${reason}`);
+    }
+  }
+  return {
+    algo: entry.algo,
+    keyId: entry.key_id,
+    publicKey,
+    publicKeyHex: entry.public_key,
+    keysetDigest,
+    notAfter: report.attestation.workload_keyset.not_after,
+    source,
+    report
+  };
+}
+
+// ../core/dist/derivatives/e2ee/phala.js
+var E2EE_HEADER_VERSION = "X-E2EE-Version";
+var E2EE_HEADER_CLIENT_PUB_KEY = "X-Client-Pub-Key";
+var E2EE_HEADER_MODEL_PUB_KEY = "X-Model-Pub-Key";
+var E2EE_HEADER_NONCE = "X-E2EE-Nonce";
+var E2EE_HEADER_TIMESTAMP = "X-E2EE-Timestamp";
+var ACI_HEADER_KEYSET_DIGEST = "X-ACI-Keyset-Digest";
+var DEFAULT_E2EE_KEY_TTL_MS = 5 * 6e4;
+function keyFetchError(err2) {
+  if (err2 instanceof E2eeAttestationError) {
+    return new InferenceRequestError(`e2ee key fetch failed (${err2.code}): ${err2.message}`, null, {
+      errorType: `e2ee_attestation_${err2.code}`,
+      retryable: err2.code === "fetch_failed"
+    });
+  }
+  const name = err2 instanceof Error ? err2.name : "Error";
+  return new InferenceRequestError(`e2ee key fetch failed (${name})`, null, {
+    retryable: false
+  });
+}
+function createPhalaE2eeEncryption(options) {
+  const clock = options.clock ?? Date.now;
+  const ttlMs = options.keyTtlMs ?? DEFAULT_E2EE_KEY_TTL_MS;
+  let cached2 = null;
+  let inFlight = null;
+  const fetchKey = async () => {
+    const key = await fetchGatewayE2eeKey({
+      baseUrl: options.baseUrl,
+      fetch: options.fetch,
+      clock,
+      expectedKeyId: options.expectedKeyId,
+      verifyEvidence: options.verifyEvidence,
+      fallbackBaseUrl: options.fallbackAttestationBaseUrl
+    });
+    options.logger?.info?.({
+      keyId: key.keyId,
+      algo: key.algo,
+      keysetDigest: key.keysetDigest,
+      notAfter: key.notAfter,
+      source: key.source,
+      evidenceVerified: Boolean(options.verifyEvidence)
+    }, "E2EE gateway key verified");
+    return key;
+  };
+  const getKey = async () => {
+    const now = clock();
+    if (cached2 && now - cached2.fetchedAt < ttlMs && Math.floor(now / 1e3) < cached2.key.notAfter) {
+      return cached2.key;
+    }
+    if (!inFlight) {
+      inFlight = fetchKey().then((key) => {
+        cached2 = { key, fetchedAt: clock() };
+        return key;
+      }).finally(() => {
+        inFlight = null;
+      });
+    }
+    try {
+      return await inFlight;
+    } catch (err2) {
+      throw keyFetchError(err2);
+    }
+  };
+  const invalidateKey = () => {
+    cached2 = null;
+  };
+  return {
+    invalidateKey,
+    currentKey: () => cached2?.key ?? null,
+    async encryptRequest({ model, messages, headers }) {
+      if (typeof model !== "string" || model === "") {
+        throw new InferenceRequestError("e2ee requires a non-empty request model", null, { errorType: "e2ee_invalid_payload_model", retryable: false });
+      }
+      const gatewayKey = await getKey();
+      const client = await generateX25519KeyPair();
+      const context = {
+        algo: gatewayKey.algo,
+        model,
+        nonce: bytesToHex6(randomBytes4(32)),
+        ts: Math.floor(clock() / 1e3)
+      };
+      headers.set(E2EE_HEADER_VERSION, "2");
+      headers.set(E2EE_HEADER_CLIENT_PUB_KEY, bytesToHex6(client.publicKey));
+      headers.set(E2EE_HEADER_MODEL_PUB_KEY, gatewayKey.publicKeyHex);
+      headers.set(E2EE_HEADER_NONCE, context.nonce);
+      headers.set(E2EE_HEADER_TIMESTAMP, String(context.ts));
+      const encrypted = [];
+      for (let index = 0; index < messages.length; index += 1) {
+        const message = messages[index];
+        let content;
+        try {
+          content = await encryptField({
+            plaintext: message.content,
+            recipientPublicKey: gatewayKey.publicKey,
+            aad: requestFieldAad(context, `messages.${index}.content`)
+          });
+        } catch (err2) {
+          const name = err2 instanceof Error ? err2.name : "Error";
+          throw new InferenceRequestError(`e2ee request encryption failed (${name})`, null, { retryable: false });
+        }
+        encrypted.push({ ...message, content });
+      }
+      const request2 = {
+        messages: encrypted,
+        async decryptResponse({ content, field, id: id2, headers: response }) {
+          const served = response.get(ACI_HEADER_KEYSET_DIGEST);
+          if (served && served !== gatewayKey.keysetDigest) {
+            options.logger?.warn?.({ pinned: gatewayKey.keysetDigest, served }, "E2EE keyset digest changed; refetching the attestation report");
+            invalidateKey();
+          }
+          try {
+            return await decryptField({
+              wire: content,
+              privateKey: client.privateKey,
+              aad: responseFieldAad(context, field, id2)
+            });
+          } catch (err2) {
+            const detail = err2 instanceof E2eeCipherError ? err2.message : "unexpected error";
+            throw new InferenceRequestError(`e2ee response decryption failed for ${field} (${detail})`, null, { errorType: "e2ee_decryption_failed", retryable: false });
+          }
+        }
+      };
+      return request2;
+    },
+    async onRejected({ errorType }) {
+      if (errorType === "e2ee_model_key_mismatch") {
+        options.logger?.warn?.({ keyId: cached2?.key.keyId ?? null }, "E2EE model key rejected by the gateway; refetching the attestation report");
+        invalidateKey();
+        return true;
+      }
+      return false;
+    }
+  };
+}
+
 // ../core/dist/mcp/store.js
 function createInMemoryMcpOAuthAuthorizationStore() {
   const byId = /* @__PURE__ */ new Map();
@@ -124090,7 +125880,7 @@ var Protocol = class {
     const capturedTransport = this._transport;
     const relatedTaskId = request2.params?._meta?.[RELATED_TASK_META_KEY]?.taskId;
     if (handler === void 0) {
-      const errorResponse3 = {
+      const errorResponse4 = {
         jsonrpc: "2.0",
         id: request2.id,
         error: {
@@ -124101,11 +125891,11 @@ var Protocol = class {
       if (relatedTaskId && this._taskMessageQueue) {
         this._enqueueTaskMessage(relatedTaskId, {
           type: "error",
-          message: errorResponse3,
+          message: errorResponse4,
           timestamp: Date.now()
         }, capturedTransport?.sessionId).catch((error51) => this._onerror(new Error(`Failed to enqueue error response: ${error51}`)));
       } else {
-        capturedTransport?.send(errorResponse3).catch((error51) => this._onerror(new Error(`Failed to send an error response: ${error51}`)));
+        capturedTransport?.send(errorResponse4).catch((error51) => this._onerror(new Error(`Failed to send an error response: ${error51}`)));
       }
       return;
     }
@@ -124175,7 +125965,7 @@ var Protocol = class {
       if (abortController.signal.aborted) {
         return;
       }
-      const errorResponse3 = {
+      const errorResponse4 = {
         jsonrpc: "2.0",
         id: request2.id,
         error: {
@@ -124187,11 +125977,11 @@ var Protocol = class {
       if (relatedTaskId && this._taskMessageQueue) {
         await this._enqueueTaskMessage(relatedTaskId, {
           type: "error",
-          message: errorResponse3,
+          message: errorResponse4,
           timestamp: Date.now()
         }, capturedTransport?.sessionId);
       } else {
-        await capturedTransport?.send(errorResponse3);
+        await capturedTransport?.send(errorResponse4);
       }
     }).catch((error51) => this._onerror(new Error(`Failed to send response: ${error51}`))).finally(() => {
       if (this._requestHandlerAbortControllers.get(request2.id) === abortController) {
@@ -126729,7 +128519,7 @@ var WebStandardStreamableHTTPServerTransport = class {
    * Only sends if eventStore is configured (opt-in for resumability) and
    * the client's protocol version supports empty SSE data (>= 2025-11-25).
    */
-  async writePrimingEvent(controller, encoder3, streamId, protocolVersion) {
+  async writePrimingEvent(controller, encoder4, streamId, protocolVersion) {
     if (!this._eventStore) {
       return;
     }
@@ -126748,7 +128538,7 @@ data:
 
 `;
     }
-    controller.enqueue(encoder3.encode(primingEvent));
+    controller.enqueue(encoder4.encode(primingEvent));
   }
   /**
    * Handles GET requests for SSE stream
@@ -126777,7 +128567,7 @@ data:
       this.onerror?.(new Error("Conflict: Only one SSE stream is allowed per session"));
       return this.createJsonErrorResponse(409, -32e3, "Conflict: Only one SSE stream is allowed per session");
     }
-    const encoder3 = new TextEncoder();
+    const encoder4 = new TextEncoder();
     let streamController;
     const readable = new ReadableStream({
       start: (controller) => {
@@ -126797,7 +128587,7 @@ data:
     }
     this._streamMapping.set(this._standaloneSseStreamId, {
       controller: streamController,
-      encoder: encoder3,
+      encoder: encoder4,
       cleanup: () => {
         this._streamMapping.delete(this._standaloneSseStreamId);
         try {
@@ -126838,7 +128628,7 @@ data:
       if (this.sessionId !== void 0) {
         headers["mcp-session-id"] = this.sessionId;
       }
-      const encoder3 = new TextEncoder();
+      const encoder4 = new TextEncoder();
       let streamController;
       const readable = new ReadableStream({
         start: (controller) => {
@@ -126849,7 +128639,7 @@ data:
       });
       const replayedStreamId = await this._eventStore.replayEventsAfter(lastEventId, {
         send: async (eventId, message) => {
-          const success2 = this.writeSSEEvent(streamController, encoder3, message, eventId);
+          const success2 = this.writeSSEEvent(streamController, encoder4, message, eventId);
           if (!success2) {
             this.onerror?.(new Error("Failed replay events"));
             try {
@@ -126861,7 +128651,7 @@ data:
       });
       this._streamMapping.set(replayedStreamId, {
         controller: streamController,
-        encoder: encoder3,
+        encoder: encoder4,
         cleanup: () => {
           this._streamMapping.delete(replayedStreamId);
           try {
@@ -126879,7 +128669,7 @@ data:
   /**
    * Writes an event to an SSE stream via controller with proper formatting
    */
-  writeSSEEvent(controller, encoder3, message, eventId) {
+  writeSSEEvent(controller, encoder4, message, eventId) {
     try {
       let eventData = `event: message
 `;
@@ -126890,7 +128680,7 @@ data:
       eventData += `data: ${JSON.stringify(message)}
 
 `;
-      controller.enqueue(encoder3.encode(eventData));
+      controller.enqueue(encoder4.encode(eventData));
       return true;
     } catch (error51) {
       this.onerror?.(error51);
@@ -127012,7 +128802,7 @@ data:
           }
         });
       }
-      const encoder3 = new TextEncoder();
+      const encoder4 = new TextEncoder();
       let streamController;
       const readable = new ReadableStream({
         start: (controller) => {
@@ -127034,7 +128824,7 @@ data:
         if (isJSONRPCRequest(message)) {
           this._streamMapping.set(streamId, {
             controller: streamController,
-            encoder: encoder3,
+            encoder: encoder4,
             cleanup: () => {
               this._streamMapping.delete(streamId);
               try {
@@ -127046,7 +128836,7 @@ data:
           this._requestToStreamMapping.set(message.id, streamId);
         }
       }
-      await this.writePrimingEvent(streamController, encoder3, streamId, clientProtocolVersion);
+      await this.writePrimingEvent(streamController, encoder4, streamId, clientProtocolVersion);
       for (const message of messages) {
         let closeSSEStream;
         let closeStandaloneSSEStream;
@@ -127814,16 +129604,16 @@ async function collectDiagnosticsWithTimeout(recorder, options, timeoutMs = DIAG
 }
 
 // ../lite/dist/runtime.js
-function jsonResponse2(body, init) {
+function jsonResponse3(body, init) {
   const headers = new Headers(init?.headers);
   headers.set("Content-Type", "application/json");
   return new Response(JSON.stringify(body), { ...init, headers });
 }
 function protocolErrorResponse2(err2) {
-  return jsonResponse2(err2.toJSON(), { status: err2.code });
+  return jsonResponse3(err2.toJSON(), { status: err2.code });
 }
-function errorResponse2(status2, errorCode, message) {
-  return jsonResponse2({
+function errorResponse3(status2, errorCode, message) {
+  return jsonResponse3({
     error: {
       code: status2,
       errorCode,
@@ -127832,7 +129622,7 @@ function errorResponse2(status2, errorCode, message) {
   }, { status: status2 });
 }
 function mcpUnauthorized(origin, message = "MCP authorization required") {
-  return jsonResponse2({
+  return jsonResponse3({
     error: {
       code: 401,
       errorCode: "MCP_AUTH_REQUIRED",
@@ -127881,7 +129671,7 @@ function redirectWithOAuthError(redirectUri, error51, description, state) {
       url2.searchParams.set("state", state);
     return Response.redirect(url2.toString(), 302);
   } catch {
-    return jsonResponse2({
+    return jsonResponse3({
       error: error51,
       error_description: description,
       ...state ? { state } : {}
@@ -128087,11 +129877,11 @@ function createPsLiteRuntime(options) {
       if (err2 instanceof ProtocolError) {
         return protocolErrorResponse2(err2);
       }
-      return errorResponse2(500, "INTERNAL_ERROR", "Internal server error");
+      return errorResponse3(500, "INTERNAL_ERROR", "Internal server error");
     }
   }
   function sendContractResult(result) {
-    return jsonResponse2(result.body, { status: result.status });
+    return jsonResponse3(result.body, { status: result.status });
   }
   function ownerAddress() {
     return options.serverOwner ?? options.identity?.address;
@@ -128099,7 +129889,7 @@ function createPsLiteRuntime(options) {
   async function handleAuthDevice(request2, url2) {
     if (url2.pathname === "/auth/device") {
       if (request2.method !== "POST") {
-        return errorResponse2(405, "METHOD_NOT_ALLOWED", "Method not allowed");
+        return errorResponse3(405, "METHOD_NOT_ALLOWED", "Method not allowed");
       }
       return sendContractResult(initiateDeviceSessionContract({
         sessionStore: deviceSessions,
@@ -128113,7 +129903,7 @@ function createPsLiteRuntime(options) {
     }
     if (url2.pathname === "/auth/device/poll") {
       if (request2.method !== "GET") {
-        return errorResponse2(405, "METHOD_NOT_ALLOWED", "Method not allowed");
+        return errorResponse3(405, "METHOD_NOT_ALLOWED", "Method not allowed");
       }
       return sendContractResult(pollDeviceSessionContract({
         sessionStore: deviceSessions,
@@ -128125,11 +129915,11 @@ function createPsLiteRuntime(options) {
     if (url2.pathname === "/auth/device/approve") {
       const sessionId = url2.searchParams.get("session");
       if (!sessionId) {
-        return request2.method === "GET" ? new Response("Missing session parameter", { status: 400 }) : jsonResponse2({ error: { code: 400, message: "Missing session parameter" } }, { status: 400 });
+        return request2.method === "GET" ? new Response("Missing session parameter", { status: 400 }) : jsonResponse3({ error: { code: 400, message: "Missing session parameter" } }, { status: 400 });
       }
       const session = deviceSessions.get(sessionId);
       if (!session) {
-        return request2.method === "GET" ? new Response("Session expired or invalid", { status: 404 }) : jsonResponse2({ error: { code: 404, message: "Session expired or invalid" } }, { status: 404 });
+        return request2.method === "GET" ? new Response("Session expired or invalid", { status: 404 }) : jsonResponse3({ error: { code: 404, message: "Session expired or invalid" } }, { status: 404 });
       }
       if (request2.method === "GET") {
         return new Response("Device authorization pending", {
@@ -128137,10 +129927,10 @@ function createPsLiteRuntime(options) {
         });
       }
       if (request2.method !== "POST") {
-        return errorResponse2(405, "METHOD_NOT_ALLOWED", "Method not allowed");
+        return errorResponse3(405, "METHOD_NOT_ALLOWED", "Method not allowed");
       }
       if (session.status === "approved") {
-        return jsonResponse2({ status: "already_approved" });
+        return jsonResponse3({ status: "already_approved" });
       }
       await auth.authorizeOwner(request2);
       return sendContractResult(await approveDeviceSessionContract({
@@ -128156,7 +129946,7 @@ function createPsLiteRuntime(options) {
       if (request2.method === "DELETE") {
         const token2 = bearerToken(request2);
         if (!token2) {
-          return jsonResponse2({ error: { code: 401, message: "Missing Bearer token" } }, { status: 401 });
+          return jsonResponse3({ error: { code: 401, message: "Missing Bearer token" } }, { status: 401 });
         }
         return sendContractResult(await revokeDeviceTokenContract({
           tokenStore,
@@ -128164,11 +129954,11 @@ function createPsLiteRuntime(options) {
         }));
       }
       if (request2.method !== "POST") {
-        return errorResponse2(405, "METHOD_NOT_ALLOWED", "Method not allowed");
+        return errorResponse3(405, "METHOD_NOT_ALLOWED", "Method not allowed");
       }
       const token = bearerToken(request2);
       if (!options.accessToken || token !== options.accessToken) {
-        return jsonResponse2({
+        return jsonResponse3({
           error: {
             code: 403,
             message: "Only control-plane tokens can provision Personal Server session tokens"
@@ -128179,10 +129969,10 @@ function createPsLiteRuntime(options) {
       try {
         body = await request2.json();
       } catch {
-        return jsonResponse2({ error: { code: 400, message: "Request body must be valid JSON" } }, { status: 400 });
+        return jsonResponse3({ error: { code: 400, message: "Request body must be valid JSON" } }, { status: 400 });
       }
       if (!body.token || typeof body.token !== "string") {
-        return jsonResponse2({ error: { code: 400, message: "Missing token" } }, { status: 400 });
+        return jsonResponse3({ error: { code: 400, message: "Missing token" } }, { status: 400 });
       }
       return sendContractResult(await provisionDeviceTokenContract({
         tokenStore,
@@ -128198,10 +129988,12 @@ function createPsLiteRuntime(options) {
     activate() {
       active = true;
       options.syncManager?.start?.();
+      options.derivatives?.scheduler.start();
     },
     deactivate() {
       active = false;
       void options.syncManager?.stop?.();
+      options.derivatives?.scheduler.stop();
     },
     isAvailable() {
       return active;
@@ -128235,7 +130027,7 @@ function createPsLiteRuntime(options) {
             accessLogs: accessLogReader.capabilities?.accessLogs ?? "custom",
             config: options.stateCapabilities?.config ?? (options.saveConfig ? "custom" : "indexeddb")
           };
-          return jsonResponse2({
+          return jsonResponse3({
             status: active ? "healthy" : "unavailable",
             runtime: "ps-lite",
             storage: options.storage.kind,
@@ -128253,7 +130045,7 @@ function createPsLiteRuntime(options) {
         }
         if (url2.pathname === "/v1/diagnostics") {
           if (request2.method !== "GET") {
-            return errorResponse2(405, "METHOD_NOT_ALLOWED", "Method not allowed");
+            return errorResponse3(405, "METHOD_NOT_ALLOWED", "Method not allowed");
           }
           try {
             await auth.authorizeOwner(request2);
@@ -128264,7 +130056,7 @@ function createPsLiteRuntime(options) {
             throw err2;
           }
           if (!options.diagnostics) {
-            return jsonResponse2({
+            return jsonResponse3({
               error: {
                 code: 404,
                 errorCode: "DIAGNOSTICS_NOT_CONFIGURED",
@@ -128278,7 +130070,7 @@ function createPsLiteRuntime(options) {
             syncStatus: syncStatus2,
             storage: dataStorage
           });
-          return jsonResponse2(snapshot);
+          return jsonResponse3(snapshot);
         }
         if (!active) {
           return unavailableResponse();
@@ -128313,9 +130105,16 @@ function createPsLiteRuntime(options) {
             // serverOwner is absent the accessRecord is safely omitted.
             serverOwner: options.serverOwner,
             serverSigner: x402ServerSigner,
-            lineageGateway: options.lineageGateway
+            lineageGateway: options.lineageGateway,
+            // Recompute on refresh: a new local version marks every
+            // question that reads the scope stale.
+            onDataWritten: options.derivatives ? (event) => options.derivatives?.scheduler.markSourceChanged(event.scope, { lineageSources: event.lineageSources }) : void 0
           }, { basePath: dataPrefix });
         }
+        const derivativesPrefix = "/v1/derivatives";
+        if (url2.pathname.startsWith(`${derivativesPrefix}/`)) {
+          return handlePersonalServerDerivativesRequest(request2, { auth, compute: options.derivatives ?? null, now }, { basePath: derivativesPrefix });
+        }
         if (url2.pathname.startsWith("/auth/device")) {
           const response = await handleAuthDevice(request2, url2);
           if (response)
@@ -128404,7 +130203,7 @@ function createPsLiteRuntime(options) {
           if (mcpResponse)
             return mcpResponse;
         }
-        return errorResponse2(404, "NOT_FOUND", "Not found");
+        return errorResponse3(404, "NOT_FOUND", "Not found");
       });
     }
   };
@@ -128415,22 +130214,22 @@ async function handleMcpRoute(input) {
   const ownerAuthorizationPrefix = "/v1/mcp/oauth/authorizations";
   if (pathname === "/.well-known/oauth-protected-resource/mcp") {
     if (!resolveMcpApprovalUrl(input.approvalUrl)) {
-      return errorResponse2(404, "MCP_OAUTH_NOT_CONFIGURED", "MCP OAuth is not configured");
+      return errorResponse3(404, "MCP_OAUTH_NOT_CONFIGURED", "MCP OAuth is not configured");
     }
-    return jsonResponse2(protectedResourceMetadata(input.serverOrigin));
+    return jsonResponse3(protectedResourceMetadata(input.serverOrigin));
   }
   if (pathname === "/.well-known/oauth-authorization-server") {
     if (!resolveMcpApprovalUrl(input.approvalUrl)) {
-      return errorResponse2(404, "MCP_OAUTH_NOT_CONFIGURED", "MCP OAuth is not configured");
+      return errorResponse3(404, "MCP_OAUTH_NOT_CONFIGURED", "MCP OAuth is not configured");
     }
-    return jsonResponse2(authorizationServerMetadata(input.serverOrigin));
+    return jsonResponse3(authorizationServerMetadata(input.serverOrigin));
   }
   if (pathname === "/mcp/oauth/register") {
     if (!resolveMcpApprovalUrl(input.approvalUrl)) {
-      return errorResponse2(404, "MCP_OAUTH_NOT_CONFIGURED", "MCP OAuth is not configured");
+      return errorResponse3(404, "MCP_OAUTH_NOT_CONFIGURED", "MCP OAuth is not configured");
     }
     if (input.request.method !== "POST") {
-      return errorResponse2(405, "METHOD_NOT_ALLOWED", "Method not allowed");
+      return errorResponse3(405, "METHOD_NOT_ALLOWED", "Method not allowed");
     }
     let body = {};
     try {
@@ -128438,7 +130237,7 @@ async function handleMcpRoute(input) {
     } catch {
       body = {};
     }
-    return jsonResponse2({
+    return jsonResponse3({
       client_id: `mcp-client-${crypto.randomUUID()}`,
       client_name: body.client_name ?? "Claude",
       redirect_uris: Array.isArray(body.redirect_uris) ? body.redirect_uris : [],
@@ -128449,10 +130248,10 @@ async function handleMcpRoute(input) {
   }
   if (pathname === "/mcp/oauth/authorize") {
     if (!resolveMcpApprovalUrl(input.approvalUrl)) {
-      return errorResponse2(404, "MCP_OAUTH_NOT_CONFIGURED", "MCP OAuth is not configured");
+      return errorResponse3(404, "MCP_OAUTH_NOT_CONFIGURED", "MCP OAuth is not configured");
     }
     if (input.request.method !== "GET") {
-      return errorResponse2(405, "METHOD_NOT_ALLOWED", "Method not allowed");
+      return errorResponse3(405, "METHOD_NOT_ALLOWED", "Method not allowed");
     }
     const responseType = input.url.searchParams.get("response_type");
     const clientId = input.url.searchParams.get("client_id") ?? "";
@@ -128480,7 +130279,7 @@ async function handleMcpRoute(input) {
       });
       const approvalUrl = resolveMcpApprovalUrl(input.approvalUrl);
       if (!approvalUrl) {
-        return errorResponse2(500, "MCP_APPROVAL_URL_MISSING", "MCP OAuth approval URL is not configured");
+        return errorResponse3(500, "MCP_APPROVAL_URL_MISSING", "MCP OAuth approval URL is not configured");
       }
       const approve = new URL(approvalUrl);
       approve.searchParams.set("mcp_authorization", created.authorizationId);
@@ -128493,14 +130292,14 @@ async function handleMcpRoute(input) {
   }
   if (pathname === "/mcp/oauth/token") {
     if (!resolveMcpApprovalUrl(input.approvalUrl)) {
-      return errorResponse2(404, "MCP_OAUTH_NOT_CONFIGURED", "MCP OAuth is not configured");
+      return errorResponse3(404, "MCP_OAUTH_NOT_CONFIGURED", "MCP OAuth is not configured");
     }
     if (input.request.method !== "POST") {
-      return errorResponse2(405, "METHOD_NOT_ALLOWED", "Method not allowed");
+      return errorResponse3(405, "METHOD_NOT_ALLOWED", "Method not allowed");
     }
     const body = await parseFormBody(input.request);
     if (body.get("grant_type") !== "authorization_code") {
-      return jsonResponse2({
+      return jsonResponse3({
         error: "unsupported_grant_type",
         error_description: "Only authorization_code is supported"
       }, { status: 400 });
@@ -128516,13 +130315,13 @@ async function handleMcpRoute(input) {
         connectionStore: input.store,
         now: input.now
       });
-      return jsonResponse2({
+      return jsonResponse3({
         access_token: token.accessToken,
         token_type: "Bearer",
         ...token.scope ? { scope: token.scope } : {}
       });
     } catch (err2) {
-      return jsonResponse2({
+      return jsonResponse3({
         error: err2 instanceof McpOAuthAuthorizationError ? err2.code : "invalid_grant",
         error_description: err2 instanceof Error ? err2.message : String(err2)
       }, { status: 400 });
@@ -128540,28 +130339,28 @@ async function handleMcpRoute(input) {
     const tail = pathname.slice(ownerAuthorizationPrefix.length + 1);
     const [id2, action] = tail.split("/");
     if (!id2) {
-      return errorResponse2(404, "NOT_FOUND", "Not found");
+      return errorResponse3(404, "NOT_FOUND", "Not found");
     }
     if (!action && input.request.method === "GET") {
       const record2 = await input.authorizationStore.getById(id2);
       if (!record2) {
-        return errorResponse2(404, "NOT_FOUND", "Authorization not found");
+        return errorResponse3(404, "NOT_FOUND", "Authorization not found");
       }
-      return jsonResponse2(toMcpOAuthAuthorizationView(record2));
+      return jsonResponse3(toMcpOAuthAuthorizationView(record2));
     }
     if (action === "approve") {
       if (input.request.method !== "POST") {
-        return errorResponse2(405, "METHOD_NOT_ALLOWED", "Method not allowed");
+        return errorResponse3(405, "METHOD_NOT_ALLOWED", "Method not allowed");
       }
       let body = {};
       try {
         body = await input.request.json();
       } catch {
-        return errorResponse2(400, "INVALID_BODY", "Body must be JSON");
+        return errorResponse3(400, "INVALID_BODY", "Body must be JSON");
       }
       if (Array.isArray(body.scopes) && body.scopes.length > 0) {
         if (!input.gateway || !input.gatewayConfig?.url) {
-          return errorResponse2(500, "SERVER_NOT_CONFIGURED", "Gateway config is not configured");
+          return errorResponse3(500, "SERVER_NOT_CONFIGURED", "Gateway config is not configured");
         }
         try {
           const approved = await approveMcpOAuthAuthorizationWithScopes({
@@ -128579,16 +130378,16 @@ async function handleMcpRoute(input) {
             serverSigner: input.serverSigner,
             now: input.now
           });
-          return jsonResponse2({ redirectTo: approved.redirectTo });
+          return jsonResponse3({ redirectTo: approved.redirectTo });
         } catch (err2) {
           if (err2 instanceof McpOAuthAuthorizationError) {
-            return errorResponse2(err2.status, err2.code, err2.message);
+            return errorResponse3(err2.status, err2.code, err2.message);
           }
           throw err2;
         }
       }
       if (!Array.isArray(body.grants) || body.grants.length === 0) {
-        return errorResponse2(400, "GRANTS_REQUIRED", "Approve requires grants or scopes");
+        return errorResponse3(400, "GRANTS_REQUIRED", "Approve requires grants or scopes");
       }
       try {
         const approved = await approveMcpOAuthAuthorization({ authorizationId: id2, grants: body.grants }, {
@@ -128596,15 +130395,15 @@ async function handleMcpRoute(input) {
           authorizationStore: input.authorizationStore,
           now: input.now
         });
-        return jsonResponse2({ redirectTo: approved.redirectTo });
+        return jsonResponse3({ redirectTo: approved.redirectTo });
       } catch (err2) {
         if (err2 instanceof McpOAuthAuthorizationError) {
-          return errorResponse2(err2.status, err2.code, err2.message);
+          return errorResponse3(err2.status, err2.code, err2.message);
         }
         throw err2;
       }
     }
-    return errorResponse2(404, "NOT_FOUND", "Not found");
+    return errorResponse3(404, "NOT_FOUND", "Not found");
   }
   if (pathname === ownerPrefix || pathname.startsWith(`${ownerPrefix}/`)) {
     try {
@@ -128628,41 +130427,41 @@ async function handleMcpRoute(input) {
           publicOrigin: input.serverOrigin,
           now: input.now
         });
-        return jsonResponse2(created, { status: 201 });
+        return jsonResponse3(created, { status: 201 });
       }
       if (input.request.method === "GET") {
         const records = await listMcpConnectionViews(input.store);
-        return jsonResponse2({ connections: records });
+        return jsonResponse3({ connections: records });
       }
-      return errorResponse2(405, "METHOD_NOT_ALLOWED", "Method not allowed");
+      return errorResponse3(405, "METHOD_NOT_ALLOWED", "Method not allowed");
     }
     const tail = pathname.slice(ownerPrefix.length + 1);
     const [id2, action] = tail.split("/");
     if (!id2) {
-      return errorResponse2(404, "NOT_FOUND", "Not found");
+      return errorResponse3(404, "NOT_FOUND", "Not found");
     }
     if (action === "approve") {
       if (input.request.method !== "POST") {
-        return errorResponse2(405, "METHOD_NOT_ALLOWED", "Method not allowed");
+        return errorResponse3(405, "METHOD_NOT_ALLOWED", "Method not allowed");
       }
       let body = {};
       try {
         body = await input.request.json();
       } catch {
-        return errorResponse2(400, "INVALID_BODY", "Body must be JSON");
+        return errorResponse3(400, "INVALID_BODY", "Body must be JSON");
       }
       if (!Array.isArray(body.grants) || body.grants.length === 0) {
-        return errorResponse2(400, "GRANTS_REQUIRED", "Approve requires at least one grant \u2014 mint grants in the consent flow first");
+        return errorResponse3(400, "GRANTS_REQUIRED", "Approve requires at least one grant \u2014 mint grants in the consent flow first");
       }
       try {
         const updated = await approveMcpConnection({ connectionId: id2, grants: body.grants }, { store: input.store, now: input.now });
-        return jsonResponse2(toMcpConnectionView(updated));
+        return jsonResponse3(toMcpConnectionView(updated));
       } catch (err2) {
         if (err2 instanceof McpConnectionNotFoundError) {
-          return errorResponse2(404, "NOT_FOUND", err2.message);
+          return errorResponse3(404, "NOT_FOUND", err2.message);
         }
         if (err2 instanceof McpConnectionStateError) {
-          return errorResponse2(409, "INVALID_STATE", err2.message);
+          return errorResponse3(409, "INVALID_STATE", err2.message);
         }
         throw err2;
       }
@@ -128674,22 +130473,22 @@ async function handleMcpRoute(input) {
             store: input.store,
             now: input.now
           });
-          return jsonResponse2(toMcpConnectionView(updated));
+          return jsonResponse3(toMcpConnectionView(updated));
         } catch (err2) {
           if (err2 instanceof McpConnectionNotFoundError) {
-            return errorResponse2(404, "NOT_FOUND", err2.message);
+            return errorResponse3(404, "NOT_FOUND", err2.message);
           }
           throw err2;
         }
       }
-      return errorResponse2(405, "METHOD_NOT_ALLOWED", "Method not allowed");
+      return errorResponse3(405, "METHOD_NOT_ALLOWED", "Method not allowed");
     }
-    return errorResponse2(404, "NOT_FOUND", "Not found");
+    return errorResponse3(404, "NOT_FOUND", "Not found");
   }
   async function handleMcpToken(rawToken, options) {
     if (!rawToken) {
       if (!options.oauthChallenge) {
-        return errorResponse2(401, "INVALID_TOKEN", "Missing MCP connection token");
+        return errorResponse3(401, "INVALID_TOKEN", "Missing MCP connection token");
       }
       return mcpUnauthorized(input.serverOrigin);
     }
@@ -128697,7 +130496,7 @@ async function handleMcpRoute(input) {
     const record2 = await input.store.getByTokenHash(tokenHash);
     if (!record2) {
       if (!options.oauthChallenge) {
-        return errorResponse2(401, "INVALID_TOKEN", "Unknown or revoked MCP connection");
+        return errorResponse3(401, "INVALID_TOKEN", "Unknown or revoked MCP connection");
       }
       return mcpUnauthorized(input.serverOrigin, "Unknown or revoked MCP connection");
     }
@@ -128741,10 +130540,10 @@ async function handleMcpRoute(input) {
       throw err2;
     }
     if (input.request.method !== "GET") {
-      return errorResponse2(405, "METHOD_NOT_ALLOWED", "Method not allowed");
+      return errorResponse3(405, "METHOD_NOT_ALLOWED", "Method not allowed");
     }
     const snapshot = input.activityRecorder ? input.activityRecorder.snapshot() : { events: [], running: 0, total: 0 };
-    return jsonResponse2(snapshot);
+    return jsonResponse3(snapshot);
   }
   if (pathname === "/mcp") {
     return handleMcpToken(bearerToken(input.request), {
@@ -128755,7 +130554,7 @@ async function handleMcpRoute(input) {
   if (pathname.startsWith(mcpPrefix)) {
     const rawToken = decodeURIComponent(pathname.slice(mcpPrefix.length));
     if (!rawToken || rawToken.includes("/")) {
-      return errorResponse2(404, "NOT_FOUND", "Not found");
+      return errorResponse3(404, "NOT_FOUND", "Not found");
     }
     return handleMcpToken(rawToken, { oauthChallenge: false });
   }
@@ -129402,6 +131201,24 @@ async function downloadOne(deps, record2) {
   }
   diagnostics?.onIndexEnd(record2.id, envelope.scope);
   logger.info({ dataPointId: record2.id, scope: envelope.scope, path: relativePath }, "Downloaded and indexed data point");
+  if (deps.onDataPointIndexed) {
+    try {
+      let lineageSources;
+      try {
+        lineageSources = readStoredLineage(envelope.data)?.sources;
+      } catch {
+      }
+      deps.onDataPointIndexed({
+        scope: envelope.scope,
+        dataPointId: record2.id,
+        version: Number(record2.expectedVersion),
+        collectedAt: envelope.collectedAt,
+        lineageSources
+      });
+    } catch (err2) {
+      logger.warn({ scope: envelope.scope, error: err2.message }, "onDataPointIndexed hook failed; data point already indexed");
+    }
+  }
   return {
     dataPointId: record2.id,
     scope: envelope.scope,
@@ -130481,7 +132298,8 @@ async function createPsLiteSyncManager(options) {
     logger,
     diagnostics: downloadDiagnostics,
     dataPointFeed,
-    scopeDeletions
+    scopeDeletions,
+    onDataPointIndexed: options.onDataPointIndexed
   }, {
     deleteData,
     pendingBlobDeletions,
@@ -130509,6 +132327,65 @@ async function createPsLiteSyncManager(options) {
   return { syncManager, serverOwner, dataPointFeed, scopeDeletions };
 }
 
+// ../lite/dist/derivatives.js
+var QUESTIONS_KEY = "derivative-questions-v1";
+async function createPsLiteQuestionStore(stateStore) {
+  const saved = await stateStore.get(QUESTIONS_KEY);
+  const initial = saved?.version === 1 ? saved.questions : [];
+  return createInMemoryQuestionStore({
+    initial,
+    onChange: (questions) => stateStore.set(QUESTIONS_KEY, {
+      version: 1,
+      questions
+    })
+  });
+}
+function psLiteInferenceConfigured(config2) {
+  return config2.inference.baseUrl.replace(/\/+$/, "") !== DEFAULT_INFERENCE_BASE_URL.replace(/\/+$/, "");
+}
+function createPsLiteDerivativeCompute(options) {
+  const logger = options.logger ? {
+    info: (payload, message) => options.logger?.info(payload, message),
+    warn: (payload, message) => options.logger?.warn(payload, message)
+  } : void 0;
+  const provider = options.provider ?? createOpenAiCompatibleInferenceProvider({
+    baseUrl: options.config.inference.baseUrl,
+    model: options.config.inference.model,
+    // E2EE v2 to the Phala gateway (WebCrypto only, so it runs in the
+    // browser): the relay sees ciphertext. `inference.e2ee: false` turns
+    // it off for local development against a provider without ACI.
+    encryption: options.config.inference.e2ee ? createPhalaE2eeEncryption({
+      baseUrl: options.config.inference.baseUrl,
+      logger
+    }) : void 0
+  });
+  const scheduler = createRecomputeScheduler({
+    store: options.store,
+    debounceMs: options.config.inference.recomputeDebounceMs,
+    serverOwner: options.serverOwner,
+    now: options.now,
+    logger,
+    compute: (questionId) => computeQuestion(questionId, {
+      // A -> B -> C: a question reading this derived scope recomputes.
+      onDerivedWritten: (event) => scheduler.markSourceChanged(event.scope, {
+        lineageSources: event.lineageSources
+      }),
+      runtimeAvailability: options.runtimeAvailability,
+      storage: options.storage,
+      store: options.store,
+      provider,
+      serverOwner: options.serverOwner,
+      maxSourceItems: options.config.inference.maxSourceItems,
+      syncManager: options.syncManager?.() ?? null,
+      scopeDeletions: options.scopeDeletions?.(),
+      writePolicyPorts: options.writePolicyPorts,
+      now: options.now,
+      logger
+    })
+  });
+  return { store: options.store, scheduler, provider };
+}
+
 // ../lite/dist/persistence.js
 function assertCompletePsLitePersistenceBundle(bundle) {
   if (!bundle || typeof bundle !== "object") {
@@ -130573,6 +132450,29 @@ async function createIndexedDbPsLiteRuntime(options) {
   });
   let syncManager = options.syncManager ?? null;
   let scopeDeletions = options.scopeDeletions;
+  let runtimeRef = null;
+  let derivatives = options.derivatives ?? null;
+  if (derivatives === null && options.derivatives === void 0 && (options.inferenceProvider || psLiteInferenceConfigured(config2))) {
+    derivatives = createPsLiteDerivativeCompute({
+      config: config2,
+      storage,
+      store: await createPsLiteQuestionStore(stateStore),
+      serverOwner,
+      syncManager: () => syncManager,
+      scopeDeletions: () => scopeDeletions,
+      writePolicyPorts: {
+        authSessionVerifier: gateway,
+        grantVerifier: gateway
+      },
+      runtimeAvailability: {
+        isAvailable: () => runtimeRef?.isAvailable() ?? Boolean(options.active)
+      },
+      provider: options.inferenceProvider,
+      logger: options.logger
+    });
+  } else if (derivatives === null && options.derivatives === void 0) {
+    options.logger?.warn({ baseUrl: config2.inference.baseUrl }, "Derivative compute disabled: inference.baseUrl is the direct-provider default; point it at the Vana inference relay");
+  }
   if (!syncManager && config2.sync.enabled) {
     const sync = await createPsLiteSyncManager({
       config: config2,
@@ -130586,12 +132486,14 @@ async function createIndexedDbPsLiteRuntime(options) {
       scopeDeletions,
       diagnostics,
       logger: options.logger,
-      lineageGateway
+      lineageGateway,
+      onDataPointIndexed: (event) => derivatives?.scheduler.markSourceChanged(event.scope, {
+        lineageSources: event.lineageSources
+      })
     });
     syncManager = sync.syncManager;
     scopeDeletions = sync.scopeDeletions;
   }
-  let runtimeRef = null;
   const auth = options.auth ?? createWeb3SignedPsLiteAuth({
     origin: () => options.runtimeOrigin ?? config2.server.origin,
     ownerAddress: serverOwner,
@@ -130621,6 +132523,7 @@ async function createIndexedDbPsLiteRuntime(options) {
     scopeDeletions,
     diagnostics,
     lineageGateway,
+    derivatives,
     saveConfig: async (nextConfig) => {
       const saved = await savePsLiteConfig(stateStore, nextConfig);
       Object.assign(config2, saved);
@@ -130643,7 +132546,8 @@ async function createIndexedDbPsLiteRuntime(options) {
     storage,
     tokenStore,
     accessLogStore,
-    syncManager
+    syncManager,
+    derivatives
   };
 }