@opendatalabs/personal-server-ts-server 1.8.0 → 1.9.0

package/dist/ui/ps-lite-debug.js

@@ -105697,6 +105697,11 @@ var ServerNotConfiguredError = class extends ProtocolError {
     super(500, "SERVER_NOT_CONFIGURED", "Server is not configured", details);
   }
 };
+var ContentTooLargeError = class extends ProtocolError {
+  constructor(details) {
+    super(413, "CONTENT_TOO_LARGE", "Content too large", details);
+  }
+};
 var LineageInvalidError = class extends ProtocolError {
   constructor(message, details) {
     super(400, "LINEAGE_INVALID", message, details);
@@ -105747,6 +105752,31 @@ var DataDeletedError = class extends ProtocolError {
     super(410, "DATA_DELETED", "Data point has been deleted", details);
   }
 };
+var DerivativeQuestionInvalidError = class extends ProtocolError {
+  constructor(message, details) {
+    super(400, "DERIVATIVE_QUESTION_INVALID", message, details);
+  }
+};
+var DerivativeQuestionNotFoundError = class extends ProtocolError {
+  constructor(details) {
+    super(404, "DERIVATIVE_QUESTION_NOT_FOUND", "Question not found", details);
+  }
+};
+var DerivativeCycleError = class extends ProtocolError {
+  constructor(details) {
+    super(409, "DERIVATIVE_CYCLE", `Registering this question would make "${details.derivedScope}" a transitive source of itself; recompute would never settle`, details);
+  }
+};
+var DerivativeSourceNotGrantedError = class extends ProtocolError {
+  constructor(details) {
+    super(403, "DERIVATIVE_SOURCE_NOT_GRANTED", "The builder's grant does not cover reading every source scope of this question", details);
+  }
+};
+var DerivativeComputeUnavailableError = class extends ProtocolError {
+  constructor(details) {
+    super(503, "DERIVATIVE_COMPUTE_UNAVAILABLE", "This server has no derivative compute configured", details);
+  }
+};
 
 // ../core/dist/sync/data-point-id.js
 function computeDataPointId(ownerAddress, scope) {
@@ -109719,6 +109749,17 @@ var DEFAULTS = {
     enabled: true,
     serverAddr: "frpc.server.vana.org",
     serverPort: 7e3
+  },
+  inference: {
+    // OpenAI-compatible chat completions endpoint the derivative compute
+    // layer calls. Point it at the Vana inference relay (which holds the
+    // provider key) or straight at a provider for local development.
+    baseUrl: "https://inference.phala.com/v1",
+    model: "z-ai/glm-5.2",
+    // Newest-first items kept per source scope when a prompt is assembled.
+    maxSourceItems: 50,
+    // Quiet period after a source scope changes before a recompute starts.
+    recomputeDebounceMs: 5e3
   }
 };
 var StorageBackend = external_exports.enum([
@@ -109772,7 +109813,13 @@ var ServerConfigSchema = external_exports.object({
     enabled: external_exports.boolean().default(DEFAULTS.tunnel.enabled),
     serverAddr: external_exports.string().default(DEFAULTS.tunnel.serverAddr),
     serverPort: external_exports.number().int().min(1).max(65535).default(DEFAULTS.tunnel.serverPort)
-  }).default(DEFAULTS.tunnel)
+  }).default(DEFAULTS.tunnel),
+  inference: external_exports.object({
+    baseUrl: external_exports.url().default(DEFAULTS.inference.baseUrl),
+    model: external_exports.string().min(1).default(DEFAULTS.inference.model),
+    maxSourceItems: external_exports.number().int().min(1).max(1e4).default(DEFAULTS.inference.maxSourceItems),
+    recomputeDebounceMs: external_exports.number().int().min(0).max(36e5).default(DEFAULTS.inference.recomputeDebounceMs)
+  }).default(DEFAULTS.inference)
 });
 
 // ../lite/dist/state.js
@@ -112676,6 +112723,18 @@ function apiLoggerAsLogger(logger) {
     error: (payload, message) => (logger?.error ?? noop)(payload, message ?? "")
   };
 }
+function notifyDataWritten(deps, event) {
+  if (!deps.onDataWritten)
+    return;
+  try {
+    deps.onDataWritten(event);
+  } catch (err2) {
+    deps.logger?.warn?.({
+      scope: event.scope,
+      error: err2 instanceof Error ? err2.message : String(err2)
+    }, "onDataWritten hook failed; record already stored");
+  }
+}
 function notifyNewData(syncManager) {
   if (!syncManager)
     return;
@@ -113040,6 +113099,11 @@ async function handlePersonalServerDataRequest(request2, deps, options = {}) {
           }, "Binary data file ingested");
           await logBuilderWrite();
           notifyNewData(deps.syncManager);
+          notifyDataWritten(deps, {
+            scope: scopeResult.scope,
+            collectedAt: collectedAtValue,
+            lineageSources: lineage2?.sources
+          });
           return jsonResponse(result2.response, { status: 201 });
         }
         const parsed = await parseJsonObjectBody(request2, "Request body must be valid JSON");
@@ -113067,6 +113131,11 @@ async function handlePersonalServerDataRequest(request2, deps, options = {}) {
         }, "Data file ingested");
         await logBuilderWrite();
         notifyNewData(deps.syncManager);
+        notifyDataWritten(deps, {
+          scope: scopeResult.scope,
+          collectedAt: collectedAtValue,
+          lineageSources: lineage?.sources
+        });
         return jsonResponse(result.response, { status: 201 });
       } catch (err2) {
         if (err2 instanceof IngestPersistedError) {
@@ -113293,6 +113362,93 @@ async function handlePersonalServerOauthTokenRequest(request2, deps) {
   });
 }
 
+// ../core/dist/derivatives/types.js
+function questionRegistrationView(registration) {
+  return {
+    questionId: registration.questionId,
+    derivedScope: registration.derivedScope,
+    sourceScopes: [...registration.sourceScopes],
+    question: registration.question,
+    model: registration.model,
+    registeredBy: registration.registeredBy,
+    status: registration.status,
+    error: registration.error,
+    createdAt: registration.createdAt,
+    updatedAt: registration.updatedAt,
+    lastComputedAt: registration.lastComputedAt,
+    derivedVersion: registration.derivedVersion,
+    derivedCollectedAt: registration.derivedCollectedAt
+  };
+}
+
+// ../core/dist/derivatives/store.js
+function clone2(registration) {
+  return {
+    ...registration,
+    sourceScopes: [...registration.sourceScopes],
+    registeredBy: { ...registration.registeredBy }
+  };
+}
+function matchesQuestionFilter(registration, filter) {
+  if (!filter)
+    return true;
+  if (filter.derivedScope && registration.derivedScope !== filter.derivedScope)
+    return false;
+  if (filter.sourceScope && !registration.sourceScopes.includes(filter.sourceScope))
+    return false;
+  if (filter.builder) {
+    const by2 = registration.registeredBy;
+    if (by2.kind !== "builder" || by2.builder.toLowerCase() !== filter.builder.toLowerCase())
+      return false;
+  }
+  return true;
+}
+function sortQuestions(registrations) {
+  return [...registrations].sort((a10, b10) => a10.createdAt.localeCompare(b10.createdAt) || a10.questionId.localeCompare(b10.questionId));
+}
+function createInMemoryQuestionStore(options = {}) {
+  const byId = /* @__PURE__ */ new Map();
+  for (const registration of options.initial ?? []) {
+    byId.set(registration.questionId, clone2(registration));
+  }
+  async function changed() {
+    if (!options.onChange)
+      return;
+    await options.onChange(sortQuestions([...byId.values()]).map(clone2));
+  }
+  return {
+    async list(filter) {
+      return sortQuestions([...byId.values()].filter((registration) => matchesQuestionFilter(registration, filter))).map(clone2);
+    },
+    async get(questionId) {
+      const registration = byId.get(questionId);
+      return registration ? clone2(registration) : null;
+    },
+    async insert(registration) {
+      if (byId.has(registration.questionId)) {
+        throw new Error(`Question ${registration.questionId} is already registered`);
+      }
+      byId.set(registration.questionId, clone2(registration));
+      await changed();
+    },
+    async update(questionId, patch) {
+      const current = byId.get(questionId);
+      if (!current)
+        return null;
+      const next = { ...current, ...patch };
+      byId.set(questionId, next);
+      await changed();
+      return clone2(next);
+    },
+    async delete(questionId) {
+      const existed = byId.delete(questionId);
+      if (existed)
+        await changed();
+      return existed;
+    }
+  };
+}
+
 // ../core/dist/policy/data-read.js
 function parseGrantExpiresAtSeconds(value) {
   if (value === null || value === void 0 || value === "0")
@@ -113382,6 +113538,1084 @@ async function verifyDataReadPolicy(input, ports) {
   return grant;
 }
 
+// ../core/dist/policy/data-write.js
+var WRITE_SCOPE_PREFIX = "write:";
+function isWriteScopeEntry(entry) {
+  return entry.startsWith(WRITE_SCOPE_PREFIX);
+}
+function writeScopePatterns(grantScopes) {
+  return grantScopes.filter(isWriteScopeEntry).map((entry) => entry.slice(WRITE_SCOPE_PREFIX.length)).filter((pattern) => pattern.length > 0);
+}
+function scopeCoveredByWriteGrant(requestedScope, grantScopes) {
+  return writeScopePatterns(grantScopes).some((pattern) => scopeMatchesPattern(requestedScope, pattern));
+}
+async function verifyDataWritePolicy(input, ports) {
+  const available = await ports.runtimeAvailability?.isAvailable();
+  if (available === false) {
+    throw new PsUnavailableError();
+  }
+  const builder = await ports.authSessionVerifier.getBuilder(input.signer);
+  if (!builder) {
+    throw new UnregisteredBuilderError();
+  }
+  if (!input.grantId) {
+    throw new GrantRequiredError({
+      reason: "No grantId bound to the write session"
+    });
+  }
+  const grant = await ports.grantVerifier.getGrant(input.grantId);
+  if (!grant) {
+    throw new GrantRequiredError({
+      reason: "Grant not found",
+      grantId: input.grantId
+    });
+  }
+  if (grant.revokedAt !== null) {
+    throw new GrantRevokedError({ grantId: grant.id });
+  }
+  if (!grant.scopes || writeScopePatterns(grant.scopes).length === 0) {
+    throw new ScopeMismatchError({
+      requestedScope: input.requestedScope,
+      reason: "Grant has no write scopes"
+    });
+  }
+  if (grant.expiresAt !== null && grant.expiresAt !== void 0) {
+    const expiresAtSec = parseGrantExpiresAtSeconds(grant.expiresAt);
+    if (expiresAtSec === null) {
+      throw new ScopeMismatchError({
+        requestedScope: input.requestedScope,
+        reason: "Grant expiry is invalid"
+      });
+    }
+    if (expiresAtSec > 0) {
+      const nowSec = Math.floor(Date.now() / 1e3);
+      if (expiresAtSec < nowSec) {
+        throw new GrantExpiredError({
+          expiresAt: expiresAtSec
+        });
+      }
+    }
+  }
+  if (!scopeCoveredByWriteGrant(input.requestedScope, grant.scopes)) {
+    throw new ScopeMismatchError({
+      requestedScope: input.requestedScope,
+      grantedScopes: grant.scopes,
+      reason: "Grant does not authorize writing to this scope"
+    });
+  }
+  if (builder.id.toLowerCase() !== grant.granteeId.toLowerCase()) {
+    throw new InvalidSignatureError3({
+      reason: "Write signer is not the grant builder",
+      expected: grant.granteeId,
+      actual: input.signer
+    });
+  }
+  if (!input.serverOwner) {
+    throw new ServerNotConfiguredError({
+      reason: "serverOwner is required to verify grant ownership"
+    });
+  }
+  if (!grant.grantorAddress || grant.grantorAddress.toLowerCase() !== input.serverOwner.toLowerCase()) {
+    throw new GrantOwnerMismatchError({
+      grantId: grant.id,
+      expected: input.serverOwner,
+      actual: grant.grantorAddress ?? null
+    });
+  }
+  await ports.writeFeeVerifier?.assertWriteAllowed({
+    builder: input.signer,
+    grant,
+    scope: input.requestedScope
+  });
+  return grant;
+}
+
+// ../core/dist/derivatives/registration.js
+var MAX_QUESTION_SOURCE_SCOPES = 16;
+var MAX_QUESTION_CHARS = 8e3;
+var MAX_MODEL_CHARS = 128;
+var MAX_ECHOED_SCOPE_CHARS = 128;
+var MODEL_ID = /^[A-Za-z0-9][A-Za-z0-9._:/-]*$/;
+function isRecord4(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function parseScope(value, field) {
+  if (typeof value !== "string") {
+    throw new DerivativeQuestionInvalidError(`${field} must be a scope string`, {
+      field
+    });
+  }
+  const parsed = parseDataScopeContract(value);
+  if (!parsed.ok) {
+    throw new DerivativeQuestionInvalidError(`${field} is not a valid scope: ${parsed.body.message}`, { field, scope: value.slice(0, MAX_ECHOED_SCOPE_CHARS) });
+  }
+  return parsed.scope;
+}
+function parseQuestionInput(body) {
+  if (!isRecord4(body)) {
+    throw new DerivativeQuestionInvalidError("Body must be a JSON object");
+  }
+  const derivedScope = parseScope(body.derivedScope, "derivedScope");
+  if (!Array.isArray(body.sourceScopes) || body.sourceScopes.length === 0) {
+    throw new DerivativeQuestionInvalidError("sourceScopes must be a non-empty array of scopes", { field: "sourceScopes" });
+  }
+  if (body.sourceScopes.length > MAX_QUESTION_SOURCE_SCOPES) {
+    throw new DerivativeQuestionInvalidError(`sourceScopes lists ${body.sourceScopes.length} scopes; the maximum is ${MAX_QUESTION_SOURCE_SCOPES}`, { field: "sourceScopes", max: MAX_QUESTION_SOURCE_SCOPES });
+  }
+  const sourceScopes = [];
+  for (const entry of body.sourceScopes) {
+    const scope = parseScope(entry, "sourceScopes[]");
+    if (sourceScopes.includes(scope)) {
+      throw new DerivativeQuestionInvalidError("sourceScopes lists the same scope twice", { field: "sourceScopes", duplicate: scope });
+    }
+    if (scope === derivedScope) {
+      throw new DerivativeQuestionInvalidError("derivedScope cannot be one of its own sources", { field: "sourceScopes", scope });
+    }
+    sourceScopes.push(scope);
+  }
+  if (typeof body.question !== "string" || body.question.trim() === "") {
+    throw new DerivativeQuestionInvalidError("question must be a non-empty string", { field: "question" });
+  }
+  if (body.question.length > MAX_QUESTION_CHARS) {
+    throw new DerivativeQuestionInvalidError(`question is ${body.question.length} characters; the maximum is ${MAX_QUESTION_CHARS}`, { field: "question", max: MAX_QUESTION_CHARS });
+  }
+  let model = null;
+  if (body.model !== void 0 && body.model !== null) {
+    if (typeof body.model !== "string" || body.model.length > MAX_MODEL_CHARS || !MODEL_ID.test(body.model)) {
+      throw new DerivativeQuestionInvalidError("model must be a provider model id", { field: "model" });
+    }
+    model = body.model;
+  }
+  assertDerivedScopeNaming(derivedScope, sourceScopes);
+  return { derivedScope, sourceScopes, question: body.question, model };
+}
+function findDerivationCycle(candidate, existing) {
+  const sourcesOf = /* @__PURE__ */ new Map();
+  const add2 = (derived, sources) => {
+    const set2 = sourcesOf.get(derived) ?? /* @__PURE__ */ new Set();
+    for (const source of sources)
+      set2.add(source);
+    sourcesOf.set(derived, set2);
+  };
+  for (const registration of existing) {
+    add2(registration.derivedScope, registration.sourceScopes);
+  }
+  add2(candidate.derivedScope, candidate.sourceScopes);
+  const target = candidate.derivedScope;
+  const visited = /* @__PURE__ */ new Set();
+  const stack = [
+    { scope: target, path: [target] }
+  ];
+  while (stack.length > 0) {
+    const { scope, path } = stack.pop();
+    for (const source of sourcesOf.get(scope) ?? []) {
+      if (source === target)
+        return [...path, source];
+      if (visited.has(source))
+        continue;
+      visited.add(source);
+      stack.push({ scope: source, path: [...path, source] });
+    }
+  }
+  return null;
+}
+async function createQuestionRegistration(input) {
+  const parsed = parseQuestionInput(input.body);
+  const cycle = findDerivationCycle(parsed, await input.store.list());
+  if (cycle) {
+    throw new DerivativeCycleError({
+      derivedScope: parsed.derivedScope,
+      path: cycle
+    });
+  }
+  const at3 = input.now().toISOString();
+  const registration = {
+    questionId: input.questionId,
+    derivedScope: parsed.derivedScope,
+    sourceScopes: parsed.sourceScopes,
+    question: parsed.question,
+    model: parsed.model,
+    registeredBy: input.registeredBy,
+    status: "pending",
+    error: null,
+    createdAt: at3,
+    updatedAt: at3,
+    lastComputedAt: null,
+    derivedVersion: null,
+    derivedCollectedAt: null
+  };
+  await input.store.insert(registration);
+  return registration;
+}
+function uncoveredSourceScopes(sourceScopes, grantScopes) {
+  const readEntries = (grantScopes ?? []).filter((entry) => !isWriteScopeEntry(entry));
+  return sourceScopes.filter((scope) => !scopeCoveredByGrant(scope, readEntries));
+}
+
+// ../core/dist/derivatives/prompt.js
+var DEFAULT_MAX_SOURCE_ITEMS = 50;
+var DEFAULT_MAX_SOURCE_CHARS = 2e5;
+var TIMESTAMP_KEYS = [
+  "collectedAt",
+  "updatedAt",
+  "updated_at",
+  "update_time",
+  "createdAt",
+  "created_at",
+  "create_time",
+  "timestamp",
+  "time",
+  "date",
+  "publishedAt",
+  "published_at"
+];
+var RESERVED_KEYS = /* @__PURE__ */ new Set(["$lineage", "$writtenBy", "$binary"]);
+function isRecord5(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function timestampOf(item) {
+  if (!isRecord5(item))
+    return null;
+  for (const key of TIMESTAMP_KEYS) {
+    const value = item[key];
+    if (typeof value === "number" && Number.isFinite(value)) {
+      return value < 1e12 ? value * 1e3 : value;
+    }
+    if (typeof value === "string") {
+      const parsed = Date.parse(value);
+      if (!Number.isNaN(parsed))
+        return parsed;
+    }
+  }
+  return null;
+}
+function sortNewestFirst(items) {
+  const indexed = items.map((item, index) => ({
+    item,
+    index,
+    at: timestampOf(item)
+  }));
+  const dated = indexed.filter((entry) => entry.at !== null).sort((a10, b10) => b10.at - a10.at || b10.index - a10.index);
+  const undated = indexed.filter((entry) => entry.at === null).reverse();
+  return [...dated, ...undated].map((entry) => entry.item);
+}
+function trimSourceData(data, options = {}) {
+  const maxItems = Math.max(1, options.maxItems ?? DEFAULT_MAX_SOURCE_ITEMS);
+  const maxChars = Math.max(1, options.maxChars ?? DEFAULT_MAX_SOURCE_CHARS);
+  let kept = 0;
+  let total = 0;
+  const trimArray = (items, limit2) => {
+    total += items.length;
+    const sorted = sortNewestFirst(items).slice(0, limit2);
+    kept += sorted.length;
+    return sorted;
+  };
+  const build = (limit2) => {
+    kept = 0;
+    total = 0;
+    if (Array.isArray(data))
+      return trimArray(data, limit2);
+    if (isRecord5(data)) {
+      const out = {};
+      for (const [key, value] of Object.entries(data)) {
+        if (RESERVED_KEYS.has(key))
+          continue;
+        out[key] = Array.isArray(value) ? trimArray(value, limit2) : value;
+      }
+      return out;
+    }
+    return data;
+  };
+  let limit = maxItems;
+  let result = build(limit);
+  let text = JSON.stringify(result) ?? "null";
+  while (text.length > maxChars && limit > 1) {
+    limit = Math.max(1, Math.floor(limit / 2));
+    result = build(limit);
+    text = JSON.stringify(result) ?? "null";
+  }
+  if (text.length > maxChars) {
+    return {
+      data: `${text.slice(0, maxChars)}...[truncated]`,
+      kept,
+      total,
+      truncated: true
+    };
+  }
+  return { data: result, kept, total, truncated: false };
+}
+var SYSTEM_PROMPT = [
+  "You answer a question about a person using ONLY the user data provided in the message.",
+  "Do not use outside knowledge and do not guess; if the data does not support an answer, say so in the answer.",
+  "Respond with a single JSON object and nothing else, with exactly these fields:",
+  '  "answer": string, the answer to the question, written for the person the data belongs to;',
+  '  "evidence": string, a short summary of which parts of the data support the answer.'
+].join("\n");
+function buildQuestionMessages(input) {
+  const sections = input.sources.map((source) => {
+    const note = source.total > source.kept ? ` (newest ${source.kept} of ${source.total} items)` : "";
+    const cut = source.truncated ? " (truncated)" : "";
+    return [
+      `### Scope: ${source.scope}${note}${cut}`,
+      `Collected at: ${source.collectedAt}`,
+      JSON.stringify(source.data)
+    ].join("\n");
+  });
+  const user = [
+    "## Question",
+    input.question,
+    "",
+    "## User data",
+    ...sections,
+    "",
+    "Answer the question as a JSON object with the fields answer and evidence."
+  ].join("\n");
+  return [
+    { role: "system", content: SYSTEM_PROMPT },
+    { role: "user", content: user }
+  ];
+}
+function parseAnswer(content) {
+  const candidates = [content.trim()];
+  const fenced = /```(?:json)?\s*([\s\S]*?)```/i.exec(content);
+  if (fenced?.[1])
+    candidates.unshift(fenced[1].trim());
+  const first = content.indexOf("{");
+  const last2 = content.lastIndexOf("}");
+  if (first !== -1 && last2 > first) {
+    candidates.push(content.slice(first, last2 + 1));
+  }
+  for (const candidate of candidates) {
+    try {
+      const parsed = JSON.parse(candidate);
+      if (isRecord5(parsed) && typeof parsed.answer === "string") {
+        return {
+          answer: parsed.answer,
+          evidence: typeof parsed.evidence === "string" ? parsed.evidence : null
+        };
+      }
+    } catch {
+    }
+  }
+  return { answer: content.trim(), evidence: null };
+}
+
+// ../core/dist/derivatives/inference.js
+var DEFAULT_INFERENCE_BASE_URL = "https://inference.phala.com/v1";
+var DEFAULT_INFERENCE_MODEL = "z-ai/glm-5.2";
+var DEFAULT_INFERENCE_TIMEOUT_MS = 12e4;
+var DEFAULT_INFERENCE_MAX_TOKENS = 2048;
+var DEFAULT_INFERENCE_REQUEST_FIELDS = {
+  provider: { aci_verified: true, zdr: true }
+};
+var InferenceRequestError = class extends Error {
+  status;
+  constructor(message, status2) {
+    super(message);
+    this.status = status2;
+    this.name = "InferenceRequestError";
+  }
+};
+function isRecord6(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function readUsage(value) {
+  if (!isRecord6(value))
+    return void 0;
+  const num2 = (v10) => typeof v10 === "number" ? v10 : void 0;
+  const usage = {
+    promptTokens: num2(value.prompt_tokens),
+    completionTokens: num2(value.completion_tokens),
+    totalTokens: num2(value.total_tokens)
+  };
+  return usage;
+}
+function readContent(body) {
+  if (!isRecord6(body) || !Array.isArray(body.choices))
+    return null;
+  const first = body.choices[0];
+  if (!isRecord6(first) || !isRecord6(first.message))
+    return null;
+  const content = first.message.content;
+  if (typeof content === "string")
+    return content;
+  if (Array.isArray(content)) {
+    const text = content.map((part) => isRecord6(part) && typeof part.text === "string" ? part.text : "").join("");
+    return text;
+  }
+  return null;
+}
+function createOpenAiCompatibleInferenceProvider(options = {}) {
+  const base = (options.baseUrl ?? DEFAULT_INFERENCE_BASE_URL).replace(/\/+$/, "");
+  const defaultModel = options.model ?? DEFAULT_INFERENCE_MODEL;
+  const timeoutMs = options.timeoutMs ?? DEFAULT_INFERENCE_TIMEOUT_MS;
+  const doFetch = options.fetch ?? fetch;
+  const requestFields = options.requestFields ?? DEFAULT_INFERENCE_REQUEST_FIELDS;
+  return {
+    defaultModel,
+    async chat(input) {
+      const headers = new Headers({ "Content-Type": "application/json" });
+      if (options.apiKey) {
+        headers.set("Authorization", `Bearer ${options.apiKey}`);
+      }
+      let messages = input.messages;
+      if (options.encryption) {
+        ({ messages } = await options.encryption.encryptRequest({
+          messages,
+          headers
+        }));
+      }
+      const body = {
+        ...requestFields,
+        model: input.model || defaultModel,
+        messages,
+        max_tokens: input.maxTokens ?? DEFAULT_INFERENCE_MAX_TOKENS
+      };
+      let response;
+      try {
+        response = await doFetch(`${base}/chat/completions`, {
+          method: "POST",
+          headers,
+          body: JSON.stringify(body),
+          signal: AbortSignal.timeout(timeoutMs)
+        });
+      } catch (err2) {
+        const name = err2 instanceof Error ? err2.name : "Error";
+        throw new InferenceRequestError(`inference request failed before a response (${name})`, null);
+      }
+      if (!response.ok) {
+        throw new InferenceRequestError(`inference request failed with status ${response.status}`, response.status);
+      }
+      let parsed;
+      try {
+        parsed = await response.json();
+      } catch {
+        throw new InferenceRequestError("inference response was not JSON", response.status);
+      }
+      let content = readContent(parsed);
+      if (content === null || content.trim() === "") {
+        throw new InferenceRequestError("inference response carried no assistant content", response.status);
+      }
+      if (options.encryption) {
+        content = await options.encryption.decryptResponse({
+          content,
+          headers: response.headers
+        });
+      }
+      const receiptId = response.headers.get("x-receipt-id") ?? void 0;
+      const aciIdentity = response.headers.get("x-aci-identity") ?? void 0;
+      return {
+        content,
+        usage: readUsage(isRecord6(parsed) ? parsed.usage : void 0),
+        ...receiptId ? { receiptId } : {},
+        ...aciIdentity ? { aciIdentity } : {}
+      };
+    }
+  };
+}
+
+// ../core/dist/derivatives/compute.js
+var DEFAULT_RETRY_DELAYS_MS = [1e3, 4e3];
+function isRetryableInferenceError(err2) {
+  return err2 instanceof InferenceRequestError && (err2.status === null || err2.status === 429 || err2.status >= 500);
+}
+async function withRetries(deps, attempt, retryable) {
+  const delays = deps.retryDelaysMs ?? DEFAULT_RETRY_DELAYS_MS;
+  const sleep2 = deps.sleep ?? ((ms3) => new Promise((r10) => setTimeout(r10, ms3)));
+  for (let index = 0; ; index += 1) {
+    try {
+      return await attempt();
+    } catch (err2) {
+      if (index >= delays.length || !retryable(err2))
+        throw err2;
+      await sleep2(delays[index]);
+    }
+  }
+}
+var ComputeFailure = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ComputeFailure";
+  }
+};
+function shortError(err2) {
+  if (err2 instanceof ComputeFailure)
+    return err2.message;
+  if (err2 instanceof InferenceRequestError)
+    return err2.message;
+  if (err2 instanceof ProtocolError)
+    return `${err2.errorCode}: ${err2.message}`;
+  return `compute failed (${err2 instanceof Error ? err2.name : "Error"})`;
+}
+function collectedAtStamp(now, isTaken) {
+  const base = now();
+  base.setUTCMilliseconds(0);
+  for (let bump = 0; bump < 60; bump += 1) {
+    const candidate = new Date(base.getTime() + bump * 1e3).toISOString().replace(/\.\d{3}Z$/, "Z");
+    if (!isTaken(candidate))
+      return candidate;
+  }
+  throw new ComputeFailure("could not allocate a version stamp");
+}
+async function tombstoneMarker(scopeDeletions, scope) {
+  if (!scopeDeletions)
+    return null;
+  const verdict = await scopeDeletions.resolve(scope);
+  if (!verdict.deleted || verdict.version === null)
+    return null;
+  const version4 = Number(verdict.version);
+  return Number.isSafeInteger(version4) ? version4 : null;
+}
+function localScopesById2(storage, serverOwner) {
+  const byId = /* @__PURE__ */ new Map();
+  for (let offset = 0; ; offset += LOCAL_SCOPE_SCAN_PAGE) {
+    const { scopes, total } = storage.listScopes({
+      limit: LOCAL_SCOPE_SCAN_PAGE,
+      offset
+    });
+    for (const summary of scopes) {
+      byId.set(computeDataPointId(serverOwner, summary.scope), summary.scope);
+    }
+    if (scopes.length === 0 || offset + scopes.length >= total)
+      break;
+  }
+  return byId;
+}
+async function assertNoLineageCycle(deps, registration, serverOwner, sourceLineage) {
+  const derivedId = computeDataPointId(serverOwner, registration.derivedScope);
+  let byId = null;
+  const visited = /* @__PURE__ */ new Set();
+  const stack = [];
+  for (const [scope, sources] of sourceLineage) {
+    for (const id2 of sources)
+      stack.push({ id: id2, path: [scope] });
+  }
+  while (stack.length > 0) {
+    const { id: id2, path } = stack.pop();
+    if (id2 === derivedId) {
+      throw new DerivativeCycleError({
+        derivedScope: registration.derivedScope,
+        path: [registration.derivedScope, ...path, registration.derivedScope]
+      });
+    }
+    if (visited.has(id2))
+      continue;
+    visited.add(id2);
+    byId ??= localScopesById2(deps.storage, serverOwner);
+    const scope = byId.get(id2);
+    if (!scope)
+      continue;
+    const entry = deps.storage.findEntry({ scope });
+    if (!entry)
+      continue;
+    let sources = [];
+    try {
+      const envelope = await deps.storage.readEnvelope(scope, entry.collectedAt);
+      sources = readStoredLineage(envelope.data)?.sources ?? [];
+    } catch {
+    }
+    for (const next of sources)
+      stack.push({ id: next, path: [...path, scope] });
+  }
+}
+async function loadSource(deps, scope) {
+  const entry = deps.storage.findEntry({ scope });
+  const deletion = await resolveReadDeletion({ scopeDeletions: deps.scopeDeletions, serverOwner: deps.serverOwner }, scope, entry);
+  if (deletion) {
+    throw new ComputeFailure(`source scope ${scope} is deleted`);
+  }
+  if (!entry) {
+    throw new ComputeFailure(`source scope ${scope} has no local data`);
+  }
+  let envelope;
+  try {
+    envelope = await deps.storage.readEnvelope(scope, entry.collectedAt);
+  } catch {
+    throw new ComputeFailure(`source scope ${scope} could not be read`);
+  }
+  let lineageSources = [];
+  try {
+    lineageSources = readStoredLineage(envelope.data)?.sources ?? [];
+  } catch {
+  }
+  const raw = isBinaryEnvelope(envelope) ? {
+    binary: true,
+    note: "binary record; its content is not included in the prompt"
+  } : envelope.data;
+  const trimmed = trimSourceData(raw, {
+    maxItems: deps.maxSourceItems,
+    maxChars: deps.maxSourceChars
+  });
+  return {
+    source: {
+      scope,
+      collectedAt: entry.collectedAt,
+      version: entry.version,
+      data: trimmed.data,
+      kept: trimmed.kept,
+      total: trimmed.total,
+      truncated: trimmed.truncated
+    },
+    lineageSources
+  };
+}
+async function assertGrantStillValid(deps, registration) {
+  if (registration.registeredBy.kind !== "builder")
+    return;
+  if (!deps.writePolicyPorts) {
+    throw new ComputeFailure("builder grant verification is not configured");
+  }
+  if (!deps.serverOwner) {
+    throw new ComputeFailure("server owner is not configured");
+  }
+  const { builder, grantId } = registration.registeredBy;
+  const ports = deps.writePolicyPorts;
+  const serverOwner = deps.serverOwner;
+  const grant = await withRetries(deps, () => verifyDataWritePolicy({
+    signer: builder,
+    grantId,
+    requestedScope: registration.derivedScope,
+    serverOwner
+  }, ports), (err2) => !(err2 instanceof ProtocolError));
+  const uncovered = uncoveredSourceScopes(registration.sourceScopes, grant.scopes ?? []);
+  if (uncovered.length > 0) {
+    throw new DerivativeSourceNotGrantedError({ scopes: uncovered });
+  }
+}
+async function computeQuestion(questionId, deps) {
+  const now = deps.now ?? (() => /* @__PURE__ */ new Date());
+  if (await deps.runtimeAvailability?.isAvailable() === false) {
+    return { status: "skipped", reason: "runtime-unavailable" };
+  }
+  const registration = await deps.store.get(questionId);
+  if (!registration)
+    return { status: "skipped", reason: "unknown-question" };
+  try {
+    if (!deps.serverOwner) {
+      throw new ComputeFailure("server owner is not configured");
+    }
+    const serverOwner = deps.serverOwner;
+    await assertGrantStillValid(deps, registration);
+    assertDerivedScopeNaming(registration.derivedScope, registration.sourceScopes);
+    const sources = [];
+    const sourceLineage = /* @__PURE__ */ new Map();
+    for (const scope of registration.sourceScopes) {
+      const loaded = await loadSource(deps, scope);
+      sources.push(loaded.source);
+      sourceLineage.set(scope, loaded.lineageSources);
+    }
+    await assertNoLineageCycle(deps, registration, serverOwner, sourceLineage);
+    const messages = buildQuestionMessages({
+      question: registration.question,
+      sources
+    });
+    const model = registration.model ?? deps.provider.defaultModel;
+    const reply = await withRetries(deps, () => deps.provider.chat({ model, messages, maxTokens: deps.maxTokens }), isRetryableInferenceError);
+    const parsed = parseAnswer(reply.content);
+    const computedAt = now().toISOString();
+    const lineageIds = registration.sourceScopes.map((scope) => computeDataPointId(serverOwner, scope));
+    const record2 = {
+      questionId: registration.questionId,
+      question: registration.question,
+      answer: parsed.answer,
+      evidence: parsed.evidence,
+      model,
+      computedAt,
+      sources: sources.map((source) => ({
+        scope: source.scope,
+        version: source.version,
+        collectedAt: source.collectedAt
+      })),
+      lineage: lineageIds,
+      ...reply.receiptId || reply.aciIdentity ? {
+        inference: {
+          ...reply.receiptId ? { receiptId: reply.receiptId } : {},
+          ...reply.aciIdentity ? { aciIdentity: reply.aciIdentity } : {}
+        }
+      } : {}
+    };
+    const lineage = {
+      sources: lineageIds,
+      writtenAt: computedAt
+    };
+    const collectedAt2 = collectedAtStamp(now, (candidate) => deps.storage.findEntry({
+      scope: registration.derivedScope,
+      at: candidate
+    })?.collectedAt === candidate);
+    const written = await ingestDataContract({
+      storage: deps.storage,
+      scopeParam: registration.derivedScope,
+      body: record2,
+      collectedAt: collectedAt2,
+      status: deps.syncManager ? "syncing" : "stored",
+      lineage,
+      afterTombstoneVersion: await tombstoneMarker(deps.scopeDeletions, registration.derivedScope)
+    });
+    if (!written.ok) {
+      throw new ComputeFailure(`derived record rejected: ${written.body.error}`);
+    }
+    const entry = deps.storage.findEntry({
+      scope: registration.derivedScope,
+      at: collectedAt2
+    });
+    const updated = await deps.store.update(questionId, {
+      status: "ready",
+      error: null,
+      updatedAt: computedAt,
+      lastComputedAt: computedAt,
+      derivedVersion: entry?.version ?? null,
+      derivedCollectedAt: collectedAt2
+    });
+    if (deps.syncManager?.notifyNewData) {
+      deps.syncManager.notifyNewData();
+    } else if (deps.syncManager?.trigger) {
+      void deps.syncManager.trigger().catch(() => void 0);
+    }
+    try {
+      deps.onDerivedWritten?.({
+        scope: registration.derivedScope,
+        collectedAt: collectedAt2,
+        lineageSources: lineageIds
+      });
+    } catch (err2) {
+      deps.logger?.warn?.({
+        questionId,
+        derivedScope: registration.derivedScope,
+        error: err2 instanceof Error ? err2.name : String(err2)
+      }, "onDerivedWritten hook failed; derivative already written");
+    }
+    deps.logger?.info?.({
+      questionId,
+      derivedScope: registration.derivedScope,
+      sourceScopes: registration.sourceScopes,
+      model,
+      version: entry?.version ?? null,
+      receiptId: reply.receiptId ?? null
+    }, "Derivative question computed");
+    return {
+      status: "ready",
+      registration: updated ?? { ...registration, status: "ready" }
+    };
+  } catch (err2) {
+    const error51 = shortError(err2);
+    const at3 = now().toISOString();
+    const updated = await deps.store.update(questionId, {
+      status: "failed",
+      error: error51,
+      updatedAt: at3
+    });
+    deps.logger?.warn?.({ questionId, derivedScope: registration.derivedScope, error: error51 }, "Derivative question compute failed");
+    return {
+      status: "failed",
+      registration: updated ?? { ...registration, status: "failed", error: error51 },
+      error: error51
+    };
+  }
+}
+
+// ../core/dist/derivatives/scheduler.js
+var defaultTimers = {
+  setTimeout: (callback, ms3) => setTimeout(callback, ms3),
+  clearTimeout: (handle) => clearTimeout(handle)
+};
+function createRecomputeScheduler(options) {
+  const debounceMs = options.debounceMs ?? 5e3;
+  const timers = options.timers ?? defaultTimers;
+  const now = options.now ?? (() => /* @__PURE__ */ new Date());
+  const states = /* @__PURE__ */ new Map();
+  const pending = /* @__PURE__ */ new Set();
+  let stopped = false;
+  function track(promise2) {
+    pending.add(promise2);
+    const done = () => pending.delete(promise2);
+    promise2.then(done, done);
+    return promise2;
+  }
+  function warn(payload, message) {
+    options.logger?.warn?.(payload, message);
+  }
+  function stateFor(questionId) {
+    let state = states.get(questionId);
+    if (!state) {
+      state = { timer: null, running: null, rerun: false };
+      states.set(questionId, state);
+    }
+    return state;
+  }
+  function run(questionId) {
+    if (stopped)
+      return;
+    const state = stateFor(questionId);
+    if (state.running) {
+      state.rerun = true;
+      return;
+    }
+    state.running = track(Promise.resolve().then(() => options.compute(questionId)).then(() => void 0, (err2) => warn({
+      questionId,
+      error: err2 instanceof Error ? err2.name : String(err2)
+    }, "Derivative compute threw")).then(async () => {
+      state.running = null;
+      if (state.rerun) {
+        state.rerun = false;
+        await markStale(questionId);
+        schedule(questionId, 0);
+      } else if (!states.get(questionId)?.timer) {
+        states.delete(questionId);
+      }
+    }));
+  }
+  function schedule(questionId, delayMs) {
+    if (stopped)
+      return;
+    const state = stateFor(questionId);
+    if (state.timer !== null)
+      timers.clearTimeout(state.timer);
+    state.timer = timers.setTimeout(() => {
+      state.timer = null;
+      run(questionId);
+    }, delayMs);
+  }
+  async function markStale(questionId) {
+    const registration = await options.store.get(questionId);
+    if (!registration)
+      return;
+    if (registration.status === "ready" || registration.status === "failed") {
+      await options.store.update(questionId, {
+        status: "stale",
+        updatedAt: now().toISOString()
+      });
+    }
+  }
+  return {
+    markSourceChanged(scope, opts) {
+      if (stopped)
+        return;
+      const lineage = new Set((opts?.lineageSources ?? []).map((id2) => id2.toLowerCase()));
+      void track((async () => {
+        const affected = await options.store.list({ sourceScope: scope });
+        for (const registration of affected) {
+          if (options.serverOwner && lineage.has(computeDataPointId(options.serverOwner, registration.derivedScope))) {
+            continue;
+          }
+          await markStale(registration.questionId);
+          schedule(registration.questionId, debounceMs);
+        }
+      })().catch((err2) => warn({ scope, error: err2 instanceof Error ? err2.name : String(err2) }, "Could not mark derivative questions stale")));
+    },
+    requestRecompute(questionId, opts) {
+      if (stopped)
+        return;
+      void track(markStale(questionId).catch((err2) => warn({
+        questionId,
+        error: err2 instanceof Error ? err2.name : String(err2)
+      }, "Could not mark derivative question stale")).then(() => schedule(questionId, opts?.immediate ? 0 : debounceMs)));
+    },
+    async whenIdle() {
+      const waitForTimers = !options.timers;
+      for (; ; ) {
+        while (pending.size > 0) {
+          await Promise.allSettled([...pending]);
+        }
+        const busy = [...states.values()].some((state) => state.running !== null || waitForTimers && state.timer !== null);
+        if (!busy)
+          return;
+        await new Promise((resolve) => setTimeout(resolve, 5));
+      }
+    },
+    stop() {
+      stopped = true;
+      for (const state of states.values()) {
+        if (state.timer !== null)
+          timers.clearTimeout(state.timer);
+        state.timer = null;
+      }
+    },
+    start() {
+      if (!stopped)
+        return;
+      stopped = false;
+      void track((async () => {
+        for (const registration of await options.store.list()) {
+          if (registration.status === "pending" || registration.status === "stale") {
+            schedule(registration.questionId, 0);
+          }
+        }
+      })().catch((err2) => warn({ error: err2 instanceof Error ? err2.name : String(err2) }, "Could not reschedule derivative questions")));
+    }
+  };
+}
+
+// ../core/dist/derivatives/api.js
+var MAX_QUESTION_BODY_BYTES = 16 * 1024;
+function jsonResponse2(body, init) {
+  const headers = new Headers(init?.headers);
+  headers.set("Content-Type", "application/json");
+  return new Response(JSON.stringify(body), { ...init, headers });
+}
+function errorResponse2(status2, errorCode, message) {
+  return jsonResponse2({ error: { code: status2, errorCode, message } }, { status: status2 });
+}
+function stripBasePath2(pathname, basePath) {
+  if (!basePath || basePath === "/")
+    return pathname;
+  if (pathname === basePath)
+    return "/";
+  if (pathname.startsWith(`${basePath}/`))
+    return pathname.slice(basePath.length);
+  return pathname;
+}
+async function authorizeOwnerOrWriter(deps, request2, scope) {
+  if (deps.auth.authorizeWrite) {
+    return await deps.auth.authorizeWrite({ request: request2, scope }) ?? void 0;
+  }
+  await deps.auth.authorizeOwner(request2);
+  return void 0;
+}
+function sameBuilder(a10, b10) {
+  return a10.toLowerCase() === b10.toLowerCase();
+}
+async function loadForCaller(deps, request2, store, questionId) {
+  const registration = await store.get(questionId);
+  if (!registration) {
+    await deps.auth.authorizeOwner(request2);
+    throw new DerivativeQuestionNotFoundError({ questionId });
+  }
+  const writer = await authorizeOwnerOrWriter(deps, request2, registration.derivedScope);
+  if (writer) {
+    const by2 = registration.registeredBy;
+    if (by2.kind !== "builder" || !sameBuilder(by2.builder, writer.builder)) {
+      await writer.releaseProof?.();
+      throw new DerivativeQuestionNotFoundError({ questionId });
+    }
+  }
+  return { registration, writer };
+}
+async function handlePersonalServerDerivativesRequest(request2, deps, options = {}) {
+  try {
+    const url2 = new URL(request2.url);
+    const pathname = stripBasePath2(url2.pathname, options.basePath);
+    const parts = pathname.split("/").filter(Boolean);
+    if (parts[0] !== "questions" || parts.length > 3) {
+      return errorResponse2(404, "NOT_FOUND", "Not found");
+    }
+    const compute = deps.compute;
+    if (!compute)
+      throw new DerivativeComputeUnavailableError();
+    const { store, scheduler } = compute;
+    const now = deps.now ?? (() => /* @__PURE__ */ new Date());
+    if (parts.length === 1) {
+      if (request2.method === "GET") {
+        const derivedScope = url2.searchParams.get("derivedScope") ?? void 0;
+        if (derivedScope) {
+          const writer = await authorizeOwnerOrWriter(deps, request2, derivedScope);
+          const registrations2 = await store.list({
+            derivedScope,
+            ...writer ? { builder: writer.builder } : {}
+          });
+          return jsonResponse2({
+            questions: registrations2.map(questionRegistrationView)
+          });
+        }
+        await deps.auth.authorizeOwner(request2);
+        const registrations = await store.list();
+        return jsonResponse2({
+          questions: registrations.map(questionRegistrationView)
+        });
+      }
+      if (request2.method === "POST") {
+        const declared = Number(request2.headers.get("content-length") ?? "0");
+        if (declared > MAX_QUESTION_BODY_BYTES) {
+          throw new ContentTooLargeError({ max: MAX_QUESTION_BODY_BYTES });
+        }
+        const bodyBytes = new Uint8Array(await request2.clone().arrayBuffer());
+        if (bodyBytes.byteLength > MAX_QUESTION_BODY_BYTES) {
+          throw new ContentTooLargeError({ max: MAX_QUESTION_BODY_BYTES });
+        }
+        const parsed = await parseJsonObjectBody(request2.clone(), "Request body must be valid JSON");
+        if (!parsed.ok) {
+          return jsonResponse2(parsed.result.body, {
+            status: parsed.result.status
+          });
+        }
+        const rawScope = parsed.body.derivedScope;
+        const scopeForAuth = typeof rawScope === "string" ? rawScope : "";
+        const writer = await authorizeOwnerOrWriter(deps, request2, scopeForAuth);
+        const registeredBy = writer ? {
+          kind: "builder",
+          builder: writer.builder,
+          grantId: writer.grantId
+        } : { kind: "owner" };
+        let registration;
+        try {
+          if (writer) {
+            const input = parseQuestionInput(parsed.body);
+            const uncovered = uncoveredSourceScopes(input.sourceScopes, writer.grantScopes);
+            if (uncovered.length > 0) {
+              throw new DerivativeSourceNotGrantedError({ scopes: uncovered });
+            }
+          }
+          registration = await createQuestionRegistration({
+            body: parsed.body,
+            registeredBy,
+            store,
+            questionId: deps.createQuestionId?.() ?? crypto.randomUUID(),
+            now
+          });
+        } catch (err2) {
+          await writer?.releaseProof?.();
+          throw err2;
+        }
+        deps.logger?.info?.({
+          questionId: registration.questionId,
+          derivedScope: registration.derivedScope,
+          sourceScopes: registration.sourceScopes,
+          registeredBy: registeredBy.kind,
+          ...writer ? { builder: writer.builder, grantId: writer.grantId } : {}
+        }, "Derivative question registered");
+        scheduler.requestRecompute(registration.questionId, {
+          immediate: true
+        });
+        return jsonResponse2(questionRegistrationView(registration), {
+          status: 201
+        });
+      }
+      return errorResponse2(405, "METHOD_NOT_ALLOWED", "Method not allowed");
+    }
+    const questionId = decodeURIComponent(parts[1] ?? "");
+    if (parts.length === 3) {
+      if (parts[2] !== "recompute") {
+        return errorResponse2(404, "NOT_FOUND", "Not found");
+      }
+      if (request2.method !== "POST") {
+        return errorResponse2(405, "METHOD_NOT_ALLOWED", "Method not allowed");
+      }
+      const { registration } = await loadForCaller(deps, request2, store, questionId);
+      scheduler.requestRecompute(questionId, { immediate: true });
+      return jsonResponse2({
+        questionId,
+        status: registration.status === "pending" ? "pending" : "stale",
+        derivedScope: registration.derivedScope
+      }, { status: 202 });
+    }
+    if (request2.method === "GET") {
+      const { registration } = await loadForCaller(deps, request2, store, questionId);
+      return jsonResponse2(questionRegistrationView(registration));
+    }
+    if (request2.method === "DELETE") {
+      const { registration } = await loadForCaller(deps, request2, store, questionId);
+      await store.delete(questionId);
+      deps.logger?.info?.({ questionId, derivedScope: registration.derivedScope }, "Derivative question deleted");
+      return jsonResponse2({ questionId, deleted: true });
+    }
+    return errorResponse2(405, "METHOD_NOT_ALLOWED", "Method not allowed");
+  } catch (err2) {
+    if (err2 instanceof ProtocolError) {
+      return jsonResponse2(err2.toJSON(), { status: err2.code });
+    }
+    return errorResponse2(500, "INTERNAL_ERROR", "Internal server error");
+  }
+}
+
 // ../core/dist/mcp/store.js
 function createInMemoryMcpOAuthAuthorizationStore() {
   const byId = /* @__PURE__ */ new Map();
@@ -124090,7 +125324,7 @@ var Protocol = class {
     const capturedTransport = this._transport;
     const relatedTaskId = request2.params?._meta?.[RELATED_TASK_META_KEY]?.taskId;
     if (handler === void 0) {
-      const errorResponse3 = {
+      const errorResponse4 = {
         jsonrpc: "2.0",
         id: request2.id,
         error: {
@@ -124101,11 +125335,11 @@ var Protocol = class {
       if (relatedTaskId && this._taskMessageQueue) {
         this._enqueueTaskMessage(relatedTaskId, {
           type: "error",
-          message: errorResponse3,
+          message: errorResponse4,
           timestamp: Date.now()
         }, capturedTransport?.sessionId).catch((error51) => this._onerror(new Error(`Failed to enqueue error response: ${error51}`)));
       } else {
-        capturedTransport?.send(errorResponse3).catch((error51) => this._onerror(new Error(`Failed to send an error response: ${error51}`)));
+        capturedTransport?.send(errorResponse4).catch((error51) => this._onerror(new Error(`Failed to send an error response: ${error51}`)));
       }
       return;
     }
@@ -124175,7 +125409,7 @@ var Protocol = class {
       if (abortController.signal.aborted) {
         return;
       }
-      const errorResponse3 = {
+      const errorResponse4 = {
         jsonrpc: "2.0",
         id: request2.id,
         error: {
@@ -124187,11 +125421,11 @@ var Protocol = class {
       if (relatedTaskId && this._taskMessageQueue) {
         await this._enqueueTaskMessage(relatedTaskId, {
           type: "error",
-          message: errorResponse3,
+          message: errorResponse4,
           timestamp: Date.now()
         }, capturedTransport?.sessionId);
       } else {
-        await capturedTransport?.send(errorResponse3);
+        await capturedTransport?.send(errorResponse4);
       }
     }).catch((error51) => this._onerror(new Error(`Failed to send response: ${error51}`))).finally(() => {
       if (this._requestHandlerAbortControllers.get(request2.id) === abortController) {
@@ -127814,16 +129048,16 @@ async function collectDiagnosticsWithTimeout(recorder, options, timeoutMs = DIAG
 }
 
 // ../lite/dist/runtime.js
-function jsonResponse2(body, init) {
+function jsonResponse3(body, init) {
   const headers = new Headers(init?.headers);
   headers.set("Content-Type", "application/json");
   return new Response(JSON.stringify(body), { ...init, headers });
 }
 function protocolErrorResponse2(err2) {
-  return jsonResponse2(err2.toJSON(), { status: err2.code });
+  return jsonResponse3(err2.toJSON(), { status: err2.code });
 }
-function errorResponse2(status2, errorCode, message) {
-  return jsonResponse2({
+function errorResponse3(status2, errorCode, message) {
+  return jsonResponse3({
     error: {
       code: status2,
       errorCode,
@@ -127832,7 +129066,7 @@ function errorResponse2(status2, errorCode, message) {
   }, { status: status2 });
 }
 function mcpUnauthorized(origin, message = "MCP authorization required") {
-  return jsonResponse2({
+  return jsonResponse3({
     error: {
       code: 401,
       errorCode: "MCP_AUTH_REQUIRED",
@@ -127881,7 +129115,7 @@ function redirectWithOAuthError(redirectUri, error51, description, state) {
       url2.searchParams.set("state", state);
     return Response.redirect(url2.toString(), 302);
   } catch {
-    return jsonResponse2({
+    return jsonResponse3({
       error: error51,
       error_description: description,
       ...state ? { state } : {}
@@ -128087,11 +129321,11 @@ function createPsLiteRuntime(options) {
       if (err2 instanceof ProtocolError) {
         return protocolErrorResponse2(err2);
       }
-      return errorResponse2(500, "INTERNAL_ERROR", "Internal server error");
+      return errorResponse3(500, "INTERNAL_ERROR", "Internal server error");
     }
   }
   function sendContractResult(result) {
-    return jsonResponse2(result.body, { status: result.status });
+    return jsonResponse3(result.body, { status: result.status });
   }
   function ownerAddress() {
     return options.serverOwner ?? options.identity?.address;
@@ -128099,7 +129333,7 @@ function createPsLiteRuntime(options) {
   async function handleAuthDevice(request2, url2) {
     if (url2.pathname === "/auth/device") {
       if (request2.method !== "POST") {
-        return errorResponse2(405, "METHOD_NOT_ALLOWED", "Method not allowed");
+        return errorResponse3(405, "METHOD_NOT_ALLOWED", "Method not allowed");
       }
       return sendContractResult(initiateDeviceSessionContract({
         sessionStore: deviceSessions,
@@ -128113,7 +129347,7 @@ function createPsLiteRuntime(options) {
     }
     if (url2.pathname === "/auth/device/poll") {
       if (request2.method !== "GET") {
-        return errorResponse2(405, "METHOD_NOT_ALLOWED", "Method not allowed");
+        return errorResponse3(405, "METHOD_NOT_ALLOWED", "Method not allowed");
       }
       return sendContractResult(pollDeviceSessionContract({
         sessionStore: deviceSessions,
@@ -128125,11 +129359,11 @@ function createPsLiteRuntime(options) {
     if (url2.pathname === "/auth/device/approve") {
       const sessionId = url2.searchParams.get("session");
       if (!sessionId) {
-        return request2.method === "GET" ? new Response("Missing session parameter", { status: 400 }) : jsonResponse2({ error: { code: 400, message: "Missing session parameter" } }, { status: 400 });
+        return request2.method === "GET" ? new Response("Missing session parameter", { status: 400 }) : jsonResponse3({ error: { code: 400, message: "Missing session parameter" } }, { status: 400 });
       }
       const session = deviceSessions.get(sessionId);
       if (!session) {
-        return request2.method === "GET" ? new Response("Session expired or invalid", { status: 404 }) : jsonResponse2({ error: { code: 404, message: "Session expired or invalid" } }, { status: 404 });
+        return request2.method === "GET" ? new Response("Session expired or invalid", { status: 404 }) : jsonResponse3({ error: { code: 404, message: "Session expired or invalid" } }, { status: 404 });
       }
       if (request2.method === "GET") {
         return new Response("Device authorization pending", {
@@ -128137,10 +129371,10 @@ function createPsLiteRuntime(options) {
         });
       }
       if (request2.method !== "POST") {
-        return errorResponse2(405, "METHOD_NOT_ALLOWED", "Method not allowed");
+        return errorResponse3(405, "METHOD_NOT_ALLOWED", "Method not allowed");
       }
       if (session.status === "approved") {
-        return jsonResponse2({ status: "already_approved" });
+        return jsonResponse3({ status: "already_approved" });
       }
       await auth.authorizeOwner(request2);
       return sendContractResult(await approveDeviceSessionContract({
@@ -128156,7 +129390,7 @@ function createPsLiteRuntime(options) {
       if (request2.method === "DELETE") {
         const token2 = bearerToken(request2);
         if (!token2) {
-          return jsonResponse2({ error: { code: 401, message: "Missing Bearer token" } }, { status: 401 });
+          return jsonResponse3({ error: { code: 401, message: "Missing Bearer token" } }, { status: 401 });
         }
         return sendContractResult(await revokeDeviceTokenContract({
           tokenStore,
@@ -128164,11 +129398,11 @@ function createPsLiteRuntime(options) {
         }));
       }
       if (request2.method !== "POST") {
-        return errorResponse2(405, "METHOD_NOT_ALLOWED", "Method not allowed");
+        return errorResponse3(405, "METHOD_NOT_ALLOWED", "Method not allowed");
       }
       const token = bearerToken(request2);
       if (!options.accessToken || token !== options.accessToken) {
-        return jsonResponse2({
+        return jsonResponse3({
           error: {
             code: 403,
             message: "Only control-plane tokens can provision Personal Server session tokens"
@@ -128179,10 +129413,10 @@ function createPsLiteRuntime(options) {
       try {
         body = await request2.json();
       } catch {
-        return jsonResponse2({ error: { code: 400, message: "Request body must be valid JSON" } }, { status: 400 });
+        return jsonResponse3({ error: { code: 400, message: "Request body must be valid JSON" } }, { status: 400 });
       }
       if (!body.token || typeof body.token !== "string") {
-        return jsonResponse2({ error: { code: 400, message: "Missing token" } }, { status: 400 });
+        return jsonResponse3({ error: { code: 400, message: "Missing token" } }, { status: 400 });
       }
       return sendContractResult(await provisionDeviceTokenContract({
         tokenStore,
@@ -128198,10 +129432,12 @@ function createPsLiteRuntime(options) {
     activate() {
       active = true;
       options.syncManager?.start?.();
+      options.derivatives?.scheduler.start();
     },
     deactivate() {
       active = false;
       void options.syncManager?.stop?.();
+      options.derivatives?.scheduler.stop();
     },
     isAvailable() {
       return active;
@@ -128235,7 +129471,7 @@ function createPsLiteRuntime(options) {
             accessLogs: accessLogReader.capabilities?.accessLogs ?? "custom",
             config: options.stateCapabilities?.config ?? (options.saveConfig ? "custom" : "indexeddb")
           };
-          return jsonResponse2({
+          return jsonResponse3({
             status: active ? "healthy" : "unavailable",
             runtime: "ps-lite",
             storage: options.storage.kind,
@@ -128253,7 +129489,7 @@ function createPsLiteRuntime(options) {
         }
         if (url2.pathname === "/v1/diagnostics") {
           if (request2.method !== "GET") {
-            return errorResponse2(405, "METHOD_NOT_ALLOWED", "Method not allowed");
+            return errorResponse3(405, "METHOD_NOT_ALLOWED", "Method not allowed");
           }
           try {
             await auth.authorizeOwner(request2);
@@ -128264,7 +129500,7 @@ function createPsLiteRuntime(options) {
             throw err2;
           }
           if (!options.diagnostics) {
-            return jsonResponse2({
+            return jsonResponse3({
               error: {
                 code: 404,
                 errorCode: "DIAGNOSTICS_NOT_CONFIGURED",
@@ -128278,7 +129514,7 @@ function createPsLiteRuntime(options) {
             syncStatus: syncStatus2,
             storage: dataStorage
           });
-          return jsonResponse2(snapshot);
+          return jsonResponse3(snapshot);
         }
         if (!active) {
           return unavailableResponse();
@@ -128313,9 +129549,16 @@ function createPsLiteRuntime(options) {
             // serverOwner is absent the accessRecord is safely omitted.
             serverOwner: options.serverOwner,
             serverSigner: x402ServerSigner,
-            lineageGateway: options.lineageGateway
+            lineageGateway: options.lineageGateway,
+            // Recompute on refresh: a new local version marks every
+            // question that reads the scope stale.
+            onDataWritten: options.derivatives ? (event) => options.derivatives?.scheduler.markSourceChanged(event.scope, { lineageSources: event.lineageSources }) : void 0
           }, { basePath: dataPrefix });
         }
+        const derivativesPrefix = "/v1/derivatives";
+        if (url2.pathname.startsWith(`${derivativesPrefix}/`)) {
+          return handlePersonalServerDerivativesRequest(request2, { auth, compute: options.derivatives ?? null, now }, { basePath: derivativesPrefix });
+        }
         if (url2.pathname.startsWith("/auth/device")) {
           const response = await handleAuthDevice(request2, url2);
           if (response)
@@ -128404,7 +129647,7 @@ function createPsLiteRuntime(options) {
           if (mcpResponse)
             return mcpResponse;
         }
-        return errorResponse2(404, "NOT_FOUND", "Not found");
+        return errorResponse3(404, "NOT_FOUND", "Not found");
       });
     }
   };
@@ -128415,22 +129658,22 @@ async function handleMcpRoute(input) {
   const ownerAuthorizationPrefix = "/v1/mcp/oauth/authorizations";
   if (pathname === "/.well-known/oauth-protected-resource/mcp") {
     if (!resolveMcpApprovalUrl(input.approvalUrl)) {
-      return errorResponse2(404, "MCP_OAUTH_NOT_CONFIGURED", "MCP OAuth is not configured");
+      return errorResponse3(404, "MCP_OAUTH_NOT_CONFIGURED", "MCP OAuth is not configured");
     }
-    return jsonResponse2(protectedResourceMetadata(input.serverOrigin));
+    return jsonResponse3(protectedResourceMetadata(input.serverOrigin));
   }
   if (pathname === "/.well-known/oauth-authorization-server") {
     if (!resolveMcpApprovalUrl(input.approvalUrl)) {
-      return errorResponse2(404, "MCP_OAUTH_NOT_CONFIGURED", "MCP OAuth is not configured");
+      return errorResponse3(404, "MCP_OAUTH_NOT_CONFIGURED", "MCP OAuth is not configured");
     }
-    return jsonResponse2(authorizationServerMetadata(input.serverOrigin));
+    return jsonResponse3(authorizationServerMetadata(input.serverOrigin));
   }
   if (pathname === "/mcp/oauth/register") {
     if (!resolveMcpApprovalUrl(input.approvalUrl)) {
-      return errorResponse2(404, "MCP_OAUTH_NOT_CONFIGURED", "MCP OAuth is not configured");
+      return errorResponse3(404, "MCP_OAUTH_NOT_CONFIGURED", "MCP OAuth is not configured");
     }
     if (input.request.method !== "POST") {
-      return errorResponse2(405, "METHOD_NOT_ALLOWED", "Method not allowed");
+      return errorResponse3(405, "METHOD_NOT_ALLOWED", "Method not allowed");
     }
     let body = {};
     try {
@@ -128438,7 +129681,7 @@ async function handleMcpRoute(input) {
     } catch {
       body = {};
     }
-    return jsonResponse2({
+    return jsonResponse3({
       client_id: `mcp-client-${crypto.randomUUID()}`,
       client_name: body.client_name ?? "Claude",
       redirect_uris: Array.isArray(body.redirect_uris) ? body.redirect_uris : [],
@@ -128449,10 +129692,10 @@ async function handleMcpRoute(input) {
   }
   if (pathname === "/mcp/oauth/authorize") {
     if (!resolveMcpApprovalUrl(input.approvalUrl)) {
-      return errorResponse2(404, "MCP_OAUTH_NOT_CONFIGURED", "MCP OAuth is not configured");
+      return errorResponse3(404, "MCP_OAUTH_NOT_CONFIGURED", "MCP OAuth is not configured");
     }
     if (input.request.method !== "GET") {
-      return errorResponse2(405, "METHOD_NOT_ALLOWED", "Method not allowed");
+      return errorResponse3(405, "METHOD_NOT_ALLOWED", "Method not allowed");
     }
     const responseType = input.url.searchParams.get("response_type");
     const clientId = input.url.searchParams.get("client_id") ?? "";
@@ -128480,7 +129723,7 @@ async function handleMcpRoute(input) {
       });
       const approvalUrl = resolveMcpApprovalUrl(input.approvalUrl);
       if (!approvalUrl) {
-        return errorResponse2(500, "MCP_APPROVAL_URL_MISSING", "MCP OAuth approval URL is not configured");
+        return errorResponse3(500, "MCP_APPROVAL_URL_MISSING", "MCP OAuth approval URL is not configured");
       }
       const approve = new URL(approvalUrl);
       approve.searchParams.set("mcp_authorization", created.authorizationId);
@@ -128493,14 +129736,14 @@ async function handleMcpRoute(input) {
   }
   if (pathname === "/mcp/oauth/token") {
     if (!resolveMcpApprovalUrl(input.approvalUrl)) {
-      return errorResponse2(404, "MCP_OAUTH_NOT_CONFIGURED", "MCP OAuth is not configured");
+      return errorResponse3(404, "MCP_OAUTH_NOT_CONFIGURED", "MCP OAuth is not configured");
     }
     if (input.request.method !== "POST") {
-      return errorResponse2(405, "METHOD_NOT_ALLOWED", "Method not allowed");
+      return errorResponse3(405, "METHOD_NOT_ALLOWED", "Method not allowed");
     }
     const body = await parseFormBody(input.request);
     if (body.get("grant_type") !== "authorization_code") {
-      return jsonResponse2({
+      return jsonResponse3({
         error: "unsupported_grant_type",
         error_description: "Only authorization_code is supported"
       }, { status: 400 });
@@ -128516,13 +129759,13 @@ async function handleMcpRoute(input) {
         connectionStore: input.store,
         now: input.now
       });
-      return jsonResponse2({
+      return jsonResponse3({
         access_token: token.accessToken,
         token_type: "Bearer",
         ...token.scope ? { scope: token.scope } : {}
       });
     } catch (err2) {
-      return jsonResponse2({
+      return jsonResponse3({
         error: err2 instanceof McpOAuthAuthorizationError ? err2.code : "invalid_grant",
         error_description: err2 instanceof Error ? err2.message : String(err2)
       }, { status: 400 });
@@ -128540,28 +129783,28 @@ async function handleMcpRoute(input) {
     const tail = pathname.slice(ownerAuthorizationPrefix.length + 1);
     const [id2, action] = tail.split("/");
     if (!id2) {
-      return errorResponse2(404, "NOT_FOUND", "Not found");
+      return errorResponse3(404, "NOT_FOUND", "Not found");
     }
     if (!action && input.request.method === "GET") {
       const record2 = await input.authorizationStore.getById(id2);
       if (!record2) {
-        return errorResponse2(404, "NOT_FOUND", "Authorization not found");
+        return errorResponse3(404, "NOT_FOUND", "Authorization not found");
       }
-      return jsonResponse2(toMcpOAuthAuthorizationView(record2));
+      return jsonResponse3(toMcpOAuthAuthorizationView(record2));
     }
     if (action === "approve") {
       if (input.request.method !== "POST") {
-        return errorResponse2(405, "METHOD_NOT_ALLOWED", "Method not allowed");
+        return errorResponse3(405, "METHOD_NOT_ALLOWED", "Method not allowed");
       }
       let body = {};
       try {
         body = await input.request.json();
       } catch {
-        return errorResponse2(400, "INVALID_BODY", "Body must be JSON");
+        return errorResponse3(400, "INVALID_BODY", "Body must be JSON");
       }
       if (Array.isArray(body.scopes) && body.scopes.length > 0) {
         if (!input.gateway || !input.gatewayConfig?.url) {
-          return errorResponse2(500, "SERVER_NOT_CONFIGURED", "Gateway config is not configured");
+          return errorResponse3(500, "SERVER_NOT_CONFIGURED", "Gateway config is not configured");
         }
         try {
           const approved = await approveMcpOAuthAuthorizationWithScopes({
@@ -128579,16 +129822,16 @@ async function handleMcpRoute(input) {
             serverSigner: input.serverSigner,
             now: input.now
           });
-          return jsonResponse2({ redirectTo: approved.redirectTo });
+          return jsonResponse3({ redirectTo: approved.redirectTo });
         } catch (err2) {
           if (err2 instanceof McpOAuthAuthorizationError) {
-            return errorResponse2(err2.status, err2.code, err2.message);
+            return errorResponse3(err2.status, err2.code, err2.message);
           }
           throw err2;
         }
       }
       if (!Array.isArray(body.grants) || body.grants.length === 0) {
-        return errorResponse2(400, "GRANTS_REQUIRED", "Approve requires grants or scopes");
+        return errorResponse3(400, "GRANTS_REQUIRED", "Approve requires grants or scopes");
       }
       try {
         const approved = await approveMcpOAuthAuthorization({ authorizationId: id2, grants: body.grants }, {
@@ -128596,15 +129839,15 @@ async function handleMcpRoute(input) {
           authorizationStore: input.authorizationStore,
           now: input.now
         });
-        return jsonResponse2({ redirectTo: approved.redirectTo });
+        return jsonResponse3({ redirectTo: approved.redirectTo });
       } catch (err2) {
         if (err2 instanceof McpOAuthAuthorizationError) {
-          return errorResponse2(err2.status, err2.code, err2.message);
+          return errorResponse3(err2.status, err2.code, err2.message);
         }
         throw err2;
       }
     }
-    return errorResponse2(404, "NOT_FOUND", "Not found");
+    return errorResponse3(404, "NOT_FOUND", "Not found");
   }
   if (pathname === ownerPrefix || pathname.startsWith(`${ownerPrefix}/`)) {
     try {
@@ -128628,41 +129871,41 @@ async function handleMcpRoute(input) {
           publicOrigin: input.serverOrigin,
           now: input.now
         });
-        return jsonResponse2(created, { status: 201 });
+        return jsonResponse3(created, { status: 201 });
       }
       if (input.request.method === "GET") {
         const records = await listMcpConnectionViews(input.store);
-        return jsonResponse2({ connections: records });
+        return jsonResponse3({ connections: records });
       }
-      return errorResponse2(405, "METHOD_NOT_ALLOWED", "Method not allowed");
+      return errorResponse3(405, "METHOD_NOT_ALLOWED", "Method not allowed");
     }
     const tail = pathname.slice(ownerPrefix.length + 1);
     const [id2, action] = tail.split("/");
     if (!id2) {
-      return errorResponse2(404, "NOT_FOUND", "Not found");
+      return errorResponse3(404, "NOT_FOUND", "Not found");
     }
     if (action === "approve") {
       if (input.request.method !== "POST") {
-        return errorResponse2(405, "METHOD_NOT_ALLOWED", "Method not allowed");
+        return errorResponse3(405, "METHOD_NOT_ALLOWED", "Method not allowed");
       }
       let body = {};
       try {
         body = await input.request.json();
       } catch {
-        return errorResponse2(400, "INVALID_BODY", "Body must be JSON");
+        return errorResponse3(400, "INVALID_BODY", "Body must be JSON");
       }
       if (!Array.isArray(body.grants) || body.grants.length === 0) {
-        return errorResponse2(400, "GRANTS_REQUIRED", "Approve requires at least one grant \u2014 mint grants in the consent flow first");
+        return errorResponse3(400, "GRANTS_REQUIRED", "Approve requires at least one grant \u2014 mint grants in the consent flow first");
       }
       try {
         const updated = await approveMcpConnection({ connectionId: id2, grants: body.grants }, { store: input.store, now: input.now });
-        return jsonResponse2(toMcpConnectionView(updated));
+        return jsonResponse3(toMcpConnectionView(updated));
       } catch (err2) {
         if (err2 instanceof McpConnectionNotFoundError) {
-          return errorResponse2(404, "NOT_FOUND", err2.message);
+          return errorResponse3(404, "NOT_FOUND", err2.message);
         }
         if (err2 instanceof McpConnectionStateError) {
-          return errorResponse2(409, "INVALID_STATE", err2.message);
+          return errorResponse3(409, "INVALID_STATE", err2.message);
         }
         throw err2;
       }
@@ -128674,22 +129917,22 @@ async function handleMcpRoute(input) {
             store: input.store,
             now: input.now
           });
-          return jsonResponse2(toMcpConnectionView(updated));
+          return jsonResponse3(toMcpConnectionView(updated));
         } catch (err2) {
           if (err2 instanceof McpConnectionNotFoundError) {
-            return errorResponse2(404, "NOT_FOUND", err2.message);
+            return errorResponse3(404, "NOT_FOUND", err2.message);
           }
           throw err2;
         }
       }
-      return errorResponse2(405, "METHOD_NOT_ALLOWED", "Method not allowed");
+      return errorResponse3(405, "METHOD_NOT_ALLOWED", "Method not allowed");
     }
-    return errorResponse2(404, "NOT_FOUND", "Not found");
+    return errorResponse3(404, "NOT_FOUND", "Not found");
   }
   async function handleMcpToken(rawToken, options) {
     if (!rawToken) {
       if (!options.oauthChallenge) {
-        return errorResponse2(401, "INVALID_TOKEN", "Missing MCP connection token");
+        return errorResponse3(401, "INVALID_TOKEN", "Missing MCP connection token");
       }
       return mcpUnauthorized(input.serverOrigin);
     }
@@ -128697,7 +129940,7 @@ async function handleMcpRoute(input) {
     const record2 = await input.store.getByTokenHash(tokenHash);
     if (!record2) {
       if (!options.oauthChallenge) {
-        return errorResponse2(401, "INVALID_TOKEN", "Unknown or revoked MCP connection");
+        return errorResponse3(401, "INVALID_TOKEN", "Unknown or revoked MCP connection");
       }
       return mcpUnauthorized(input.serverOrigin, "Unknown or revoked MCP connection");
     }
@@ -128741,10 +129984,10 @@ async function handleMcpRoute(input) {
       throw err2;
     }
     if (input.request.method !== "GET") {
-      return errorResponse2(405, "METHOD_NOT_ALLOWED", "Method not allowed");
+      return errorResponse3(405, "METHOD_NOT_ALLOWED", "Method not allowed");
     }
     const snapshot = input.activityRecorder ? input.activityRecorder.snapshot() : { events: [], running: 0, total: 0 };
-    return jsonResponse2(snapshot);
+    return jsonResponse3(snapshot);
   }
   if (pathname === "/mcp") {
     return handleMcpToken(bearerToken(input.request), {
@@ -128755,7 +129998,7 @@ async function handleMcpRoute(input) {
   if (pathname.startsWith(mcpPrefix)) {
     const rawToken = decodeURIComponent(pathname.slice(mcpPrefix.length));
     if (!rawToken || rawToken.includes("/")) {
-      return errorResponse2(404, "NOT_FOUND", "Not found");
+      return errorResponse3(404, "NOT_FOUND", "Not found");
     }
     return handleMcpToken(rawToken, { oauthChallenge: false });
   }
@@ -129402,6 +130645,24 @@ async function downloadOne(deps, record2) {
   }
   diagnostics?.onIndexEnd(record2.id, envelope.scope);
   logger.info({ dataPointId: record2.id, scope: envelope.scope, path: relativePath }, "Downloaded and indexed data point");
+  if (deps.onDataPointIndexed) {
+    try {
+      let lineageSources;
+      try {
+        lineageSources = readStoredLineage(envelope.data)?.sources;
+      } catch {
+      }
+      deps.onDataPointIndexed({
+        scope: envelope.scope,
+        dataPointId: record2.id,
+        version: Number(record2.expectedVersion),
+        collectedAt: envelope.collectedAt,
+        lineageSources
+      });
+    } catch (err2) {
+      logger.warn({ scope: envelope.scope, error: err2.message }, "onDataPointIndexed hook failed; data point already indexed");
+    }
+  }
   return {
     dataPointId: record2.id,
     scope: envelope.scope,
@@ -130481,7 +131742,8 @@ async function createPsLiteSyncManager(options) {
     logger,
     diagnostics: downloadDiagnostics,
     dataPointFeed,
-    scopeDeletions
+    scopeDeletions,
+    onDataPointIndexed: options.onDataPointIndexed
   }, {
     deleteData,
     pendingBlobDeletions,
@@ -130509,6 +131771,58 @@ async function createPsLiteSyncManager(options) {
   return { syncManager, serverOwner, dataPointFeed, scopeDeletions };
 }
 
+// ../lite/dist/derivatives.js
+var QUESTIONS_KEY = "derivative-questions-v1";
+async function createPsLiteQuestionStore(stateStore) {
+  const saved = await stateStore.get(QUESTIONS_KEY);
+  const initial = saved?.version === 1 ? saved.questions : [];
+  return createInMemoryQuestionStore({
+    initial,
+    onChange: (questions) => stateStore.set(QUESTIONS_KEY, {
+      version: 1,
+      questions
+    })
+  });
+}
+function psLiteInferenceConfigured(config2) {
+  return config2.inference.baseUrl.replace(/\/+$/, "") !== DEFAULT_INFERENCE_BASE_URL.replace(/\/+$/, "");
+}
+function createPsLiteDerivativeCompute(options) {
+  const provider = options.provider ?? createOpenAiCompatibleInferenceProvider({
+    baseUrl: options.config.inference.baseUrl,
+    model: options.config.inference.model
+  });
+  const logger = options.logger ? {
+    info: (payload, message) => options.logger?.info(payload, message),
+    warn: (payload, message) => options.logger?.warn(payload, message)
+  } : void 0;
+  const scheduler = createRecomputeScheduler({
+    store: options.store,
+    debounceMs: options.config.inference.recomputeDebounceMs,
+    serverOwner: options.serverOwner,
+    now: options.now,
+    logger,
+    compute: (questionId) => computeQuestion(questionId, {
+      // A -> B -> C: a question reading this derived scope recomputes.
+      onDerivedWritten: (event) => scheduler.markSourceChanged(event.scope, {
+        lineageSources: event.lineageSources
+      }),
+      runtimeAvailability: options.runtimeAvailability,
+      storage: options.storage,
+      store: options.store,
+      provider,
+      serverOwner: options.serverOwner,
+      maxSourceItems: options.config.inference.maxSourceItems,
+      syncManager: options.syncManager?.() ?? null,
+      scopeDeletions: options.scopeDeletions?.(),
+      writePolicyPorts: options.writePolicyPorts,
+      now: options.now,
+      logger
+    })
+  });
+  return { store: options.store, scheduler, provider };
+}
+
 // ../lite/dist/persistence.js
 function assertCompletePsLitePersistenceBundle(bundle) {
   if (!bundle || typeof bundle !== "object") {
@@ -130573,6 +131887,29 @@ async function createIndexedDbPsLiteRuntime(options) {
   });
   let syncManager = options.syncManager ?? null;
   let scopeDeletions = options.scopeDeletions;
+  let runtimeRef = null;
+  let derivatives = options.derivatives ?? null;
+  if (derivatives === null && options.derivatives === void 0 && (options.inferenceProvider || psLiteInferenceConfigured(config2))) {
+    derivatives = createPsLiteDerivativeCompute({
+      config: config2,
+      storage,
+      store: await createPsLiteQuestionStore(stateStore),
+      serverOwner,
+      syncManager: () => syncManager,
+      scopeDeletions: () => scopeDeletions,
+      writePolicyPorts: {
+        authSessionVerifier: gateway,
+        grantVerifier: gateway
+      },
+      runtimeAvailability: {
+        isAvailable: () => runtimeRef?.isAvailable() ?? Boolean(options.active)
+      },
+      provider: options.inferenceProvider,
+      logger: options.logger
+    });
+  } else if (derivatives === null && options.derivatives === void 0) {
+    options.logger?.warn({ baseUrl: config2.inference.baseUrl }, "Derivative compute disabled: inference.baseUrl is the direct-provider default; point it at the Vana inference relay");
+  }
   if (!syncManager && config2.sync.enabled) {
     const sync = await createPsLiteSyncManager({
       config: config2,
@@ -130586,12 +131923,14 @@ async function createIndexedDbPsLiteRuntime(options) {
       scopeDeletions,
       diagnostics,
       logger: options.logger,
-      lineageGateway
+      lineageGateway,
+      onDataPointIndexed: (event) => derivatives?.scheduler.markSourceChanged(event.scope, {
+        lineageSources: event.lineageSources
+      })
     });
     syncManager = sync.syncManager;
     scopeDeletions = sync.scopeDeletions;
   }
-  let runtimeRef = null;
   const auth = options.auth ?? createWeb3SignedPsLiteAuth({
     origin: () => options.runtimeOrigin ?? config2.server.origin,
     ownerAddress: serverOwner,
@@ -130621,6 +131960,7 @@ async function createIndexedDbPsLiteRuntime(options) {
     scopeDeletions,
     diagnostics,
     lineageGateway,
+    derivatives,
     saveConfig: async (nextConfig) => {
       const saved = await savePsLiteConfig(stateStore, nextConfig);
       Object.assign(config2, saved);
@@ -130643,7 +131983,8 @@ async function createIndexedDbPsLiteRuntime(options) {
     storage,
     tokenStore,
     accessLogStore,
-    syncManager
+    syncManager,
+    derivatives
   };
 }