@opendatalabs/vana-sdk 3.21.0 → 3.22.0-pr.207.5c11fe3

package/dist/index.node.cjs

@@ -1186,9 +1186,13 @@ __export(index_node_exports, {
   ContractNotFoundError: () => ContractNotFoundError,
   DATA_ACCESS_OP_TYPE: () => DATA_ACCESS_OP_TYPE,
   DATA_REGISTRY_STATUS_ABI: () => DATA_REGISTRY_STATUS_ABI,
+  DEFAULT_DERIVATIVE_STATUS_POLL_INTERVAL_MS: () => DEFAULT_DERIVATIVE_STATUS_POLL_INTERVAL_MS,
+  DEFAULT_DERIVATIVE_STATUS_TIMEOUT_MS: () => DEFAULT_DERIVATIVE_STATUS_TIMEOUT_MS,
   DEFAULT_QUESTION_POLL_INTERVAL_MS: () => DEFAULT_QUESTION_POLL_INTERVAL_MS,
   DEFAULT_QUESTION_TIMEOUT_MS: () => DEFAULT_QUESTION_TIMEOUT_MS,
+  DERIVATIVE_ERROR_CODES: () => DERIVATIVE_ERROR_CODES,
   DERIVATIVE_QUESTIONS_PATH: () => DERIVATIVE_QUESTIONS_PATH,
+  DERIVATIVE_STATUS_PATH: () => DERIVATIVE_STATUS_PATH,
   DataFileEnvelopeSchema: () => DataFileEnvelopeSchema,
   DataPointDeletedError: () => DataPointDeletedError,
   DataPointNotFoundError: () => DataPointNotFoundError,
@@ -1197,6 +1201,7 @@ __export(index_node_exports, {
   DerivativeComputeUnavailableError: () => DerivativeComputeUnavailableError,
   DerivativeCycleError: () => DerivativeCycleError,
   DerivativeDerivedScopeRequiredError: () => DerivativeDerivedScopeRequiredError,
+  DerivativeErrorCodeSchema: () => DerivativeErrorCodeSchema,
   DerivativeQuestionFailedError: () => DerivativeQuestionFailedError,
   DerivativeQuestionInvalidError: () => DerivativeQuestionInvalidError,
   DerivativeQuestionNotFoundError: () => DerivativeQuestionNotFoundError,
@@ -1204,8 +1209,12 @@ __export(index_node_exports, {
   DerivativeQuestionSchema: () => DerivativeQuestionSchema,
   DerivativeQuestionTimeoutError: () => DerivativeQuestionTimeoutError,
   DerivativeSourceNotGrantedError: () => DerivativeSourceNotGrantedError,
+  DerivativeStatusSchema: () => DerivativeStatusSchema,
   DropboxStorage: () => DropboxStorage,
   ECIESError: () => ECIESError,
+  ENCLAVE_IDENTITY_EVIDENCE_VERSION: () => ENCLAVE_IDENTITY_EVIDENCE_VERSION,
+  ENCLAVE_TRUST_ANCHORS: () => ENCLAVE_TRUST_ANCHORS,
+  ENCLAVE_WALLET_PURPOSE: () => ENCLAVE_WALLET_PURPOSE,
   ESCROW_DEPOSIT_ABI: () => ESCROW_DEPOSIT_ABI2,
   ExpiredTokenError: () => ExpiredTokenError,
   FEE_REGISTRY_ABI: () => FEE_REGISTRY_ABI,
@@ -1227,6 +1236,7 @@ __export(index_node_exports, {
   LineageNodeSchema: () => LineageNodeSchema,
   LineageReadError: () => LineageReadError,
   MASTER_KEY_MESSAGE: () => MASTER_KEY_MESSAGE,
+  MASTER_SIGNATURE_DELIVERY_VERSION: () => MASTER_SIGNATURE_DELIVERY_VERSION,
   MAX_LINEAGE_SOURCES: () => MAX_LINEAGE_SOURCES,
   MAX_QUESTION_CHARS: () => MAX_QUESTION_CHARS,
   MAX_QUESTION_MODEL_CHARS: () => MAX_QUESTION_MODEL_CHARS,
@@ -1264,6 +1274,7 @@ __export(index_node_exports, {
   RedactedLineageNodeSchema: () => RedactedLineageNodeSchema,
   RelayerError: () => RelayerError,
   SCOPE_ACTIONS: () => SCOPE_ACTIONS,
+  SEALED_ENVELOPE_VERSION: () => SEALED_ENVELOPE_VERSION,
   SERVER_REGISTRATION_TYPES: () => SERVER_REGISTRATION_TYPES,
   ScopeSchema: () => ScopeSchema,
   SerializationError: () => SerializationError,
@@ -1276,6 +1287,7 @@ __export(index_node_exports, {
   TOMBSTONE_METADATA_HASH: () => TOMBSTONE_METADATA_HASH,
   TOMBSTONE_METADATA_HASH_PREIMAGE: () => TOMBSTONE_METADATA_HASH_PREIMAGE,
   TransactionPendingError: () => TransactionPendingError,
+  USER_PS_ID_DOMAIN: () => USER_PS_ID_DOMAIN,
   UserRejectedRequestError: () => UserRejectedRequestError,
   VanaError: () => VanaError,
   VanaStorage: () => VanaStorage,
@@ -1294,6 +1306,7 @@ __export(index_node_exports, {
   WriteSessionExpiredError: () => WriteSessionExpiredError,
   WriteTransportError: () => WriteTransportError,
   WriteUnauthorizedError: () => WriteUnauthorizedError,
+  appRootPreimage: () => appRootPreimage,
   askPersonalServer: () => askPersonalServer,
   assertDerivedScopeNaming: () => assertDerivedScopeNaming,
   assertValidPkceVerifier: () => assertValidPkceVerifier,
@@ -1307,6 +1320,7 @@ __export(index_node_exports, {
   buildEscrowPaymentHeader: () => buildEscrowPaymentHeader,
   buildGrantPaymentHeader: () => buildGrantPaymentHeader,
   buildMarkDataPointUnavailableRequest: () => buildMarkDataPointUnavailableRequest,
+  buildMasterSignatureDelivery: () => buildMasterSignatureDelivery,
   buildPersonalServerDataReadRequest: () => buildPersonalServerDataReadRequest,
   buildPersonalServerLiteOwnerBindingMessage: () => buildPersonalServerLiteOwnerBindingMessage,
   buildPersonalServerLiteOwnerBindingSignature: () => buildPersonalServerLiteOwnerBindingSignature,
@@ -1339,6 +1353,7 @@ __export(index_node_exports, {
   decryptWithPassword: () => decryptWithPassword,
   deleteDataPoint: () => deleteDataPoint,
   deleteQuestion: () => deleteQuestion,
+  derivativeStatusTarget: () => derivativeStatusTarget,
   deriveDataPointId: () => deriveDataPointId,
   deriveMasterKey: () => deriveMasterKey,
   deriveScopeKey: () => deriveScopeKey,
@@ -1349,6 +1364,7 @@ __export(index_node_exports, {
   encodeDepositTokenData: () => encodeDepositTokenData,
   encodeSetDataPointStatusData: () => encodeSetDataPointStatusData,
   encodeWriteMetadataHeader: () => encodeWriteMetadataHeader,
+  encryptMasterSignatureDelivery: () => encryptMasterSignatureDelivery,
   encryptWithPassword: () => encryptWithPassword,
   escrowContractAddress: () => escrowContractAddress,
   escrowPaymentDomain: () => escrowPaymentDomain,
@@ -1362,6 +1378,7 @@ __export(index_node_exports, {
   getContractAddress: () => getContractAddress,
   getContractController: () => getContractController,
   getContractInfo: () => getContractInfo,
+  getDerivativeStatus: () => getDerivativeStatus,
   getFee: () => getFee,
   getGatewayLineage: () => getGatewayLineage,
   getLineage: () => getLineage,
@@ -1377,10 +1394,12 @@ __export(index_node_exports, {
   isDataPointId: () => isDataPointId,
   isDataPointTombstone: () => isDataPointTombstone,
   isDataPortabilityGatewayConfig: () => isDataPortabilityGatewayConfig,
+  isDerivativeStatusSettled: () => isDerivativeStatusSettled,
   isECIESEncrypted: () => isECIESEncrypted,
   isPlatformSupported: () => isPlatformSupported,
   isRedactedLineageNode: () => isRedactedLineageNode,
   isTombstoneHashes: () => isTombstoneHashes,
+  kmsIssuedPreimage: () => kmsIssuedPreimage,
   listQuestions: () => listQuestions,
   mainnetServices: () => mainnetServices,
   moksha: () => moksha,
@@ -1420,10 +1439,13 @@ __export(index_node_exports, {
   toDirectPaymentReceipt: () => toDirectPaymentReceipt,
   tombstoneDeletedAt: () => tombstoneDeletedAt,
   tryGrantPermissions: () => tryGrantPermissions,
+  userPsId: () => userPsId,
   vanaMainnet: () => vanaMainnet2,
+  verifyEnclaveIdentityEvidence: () => verifyEnclaveIdentityEvidence,
   verifyGrantRegistration: () => verifyGrantRegistration,
   verifyPkceChallenge: () => verifyPkceChallenge,
   verifyWeb3Signed: () => verifyWeb3Signed,
+  waitForDerivativeStatus: () => waitForDerivativeStatus,
   waitForQuestion: () => waitForQuestion,
   writeData: () => writeData,
   writePersonalServerData: () => writePersonalServerData
@@ -31618,13 +31640,13 @@ var NodeCryptoAdapter = class {
    */
   async generateKeyPair() {
     try {
-      const secp256k14 = import_secp256k12.default;
+      const secp256k15 = import_secp256k12.default;
       let privateKey;
       do {
         privateKey = (0, import_crypto2.randomBytes)(32);
-      } while (!secp256k14.privateKeyVerify(privateKey));
+      } while (!secp256k15.privateKeyVerify(privateKey));
       const publicKey = Buffer.from(
-        secp256k14.publicKeyCreate(privateKey, true)
+        secp256k15.publicKeyCreate(privateKey, true)
       );
       return {
         privateKey: privateKey.toString("hex"),
@@ -32634,15 +32656,147 @@ var RECORD_DATA_ACCESS_TYPES = {
   ]
 };
 
-// src/protocol/personal-server-registration.ts
+// src/protocol/identity.ts
+var secp256k14 = __toESM(require("@noble/secp256k1"), 1);
 var import_viem14 = require("viem");
+var import_accounts = require("viem/accounts");
+init_interface();
+var ENCLAVE_IDENTITY_EVIDENCE_VERSION = 1;
+var USER_PS_ID_DOMAIN = "vana.ps-enclave.v1";
+var ENCLAVE_WALLET_PURPOSE = "vana.ps-enclave.wallet.v1";
+var MASTER_SIGNATURE_DELIVERY_VERSION = "vana.ps-enclave.delivery.v1";
+var SEALED_ENVELOPE_VERSION = 1;
+var VANA_MAINNET_CHAIN_ID = 1480;
+var MOKSHA_CHAIN_ID = 14800;
+var KMS_ISSUED_PREFIX = "dstack-kms-issued";
+var PREIMAGE_SEPARATOR = ":";
+var UNCOMPRESSED_PUBLIC_KEY_BYTES = 65;
+var UNCOMPRESSED_PUBLIC_KEY_PREFIX = "04";
+var ENCLAVE_TRUST_ANCHORS = {
+  // filled at fleet provisioning; verify fails closed while empty
+  [VANA_MAINNET_CHAIN_ID]: { kmsRootPubkey: "0x", appIds: [] },
+  // filled at fleet provisioning; verify fails closed while empty
+  [MOKSHA_CHAIN_ID]: { kmsRootPubkey: "0x", appIds: [] }
+};
+function userPsId(chainId, ownerAddress) {
+  const packed = (0, import_viem14.encodePacked)(
+    ["string", "uint256", "address"],
+    [USER_PS_ID_DOMAIN, BigInt(chainId), (0, import_viem14.getAddress)(ownerAddress)]
+  );
+  return (0, import_viem14.keccak256)(packed);
+}
+function appRootPreimage(purpose, publicKey) {
+  const keyHex = publicKey.slice(2).toLowerCase();
+  return (0, import_viem14.keccak256)((0, import_viem14.toBytes)(`${purpose}${PREIMAGE_SEPARATOR}${keyHex}`));
+}
+function kmsIssuedPreimage(appId, appRootPublicKey) {
+  const appIdHex = appId.slice(2).toLowerCase();
+  const prefix = (0, import_viem14.toBytes)(
+    `${KMS_ISSUED_PREFIX}${PREIMAGE_SEPARATOR}${appIdHex}`
+  );
+  const compressed = secp256k14.ProjectivePoint.fromHex(
+    (0, import_viem14.fromHex)(appRootPublicKey, "bytes")
+  ).toRawBytes(true);
+  return (0, import_viem14.keccak256)((0, import_viem14.concat)([prefix, compressed]));
+}
+async function recoverChainKey(hash, signature, link) {
+  try {
+    return (await (0, import_viem14.recoverPublicKey)({ hash, signature })).toLowerCase();
+  } catch {
+    throw new Error(`Invalid enclave signature chain link ${link}`);
+  }
+}
+async function verifyEnclaveIdentityEvidence(evidence, anchors, expected) {
+  if (evidence.v !== ENCLAVE_IDENTITY_EVIDENCE_VERSION) {
+    throw new Error("Unsupported enclave identity evidence version");
+  }
+  if (!Number.isInteger(evidence.epoch) || evidence.epoch < 1) {
+    throw new Error("Invalid enclave identity epoch");
+  }
+  if (evidence.chainId !== expected.chainId) {
+    throw new Error(
+      "Enclave identity chain ID does not match expected chain ID"
+    );
+  }
+  if (!(0, import_viem14.isAddressEqual)(evidence.ownerAddress, expected.ownerAddress)) {
+    throw new Error("Enclave identity owner does not match expected owner");
+  }
+  if (evidence.epoch !== expected.epoch) {
+    throw new Error("Enclave identity epoch does not match expected epoch");
+  }
+  const expectedUserPsId = userPsId(expected.chainId, expected.ownerAddress);
+  if (evidence.userPsId.toLowerCase() !== expectedUserPsId.toLowerCase()) {
+    throw new Error("Enclave userPsId does not match expected identity");
+  }
+  if (evidence.purpose !== ENCLAVE_WALLET_PURPOSE) {
+    throw new Error("Unexpected enclave wallet purpose");
+  }
+  const derivedAddress = (0, import_accounts.publicKeyToAddress)(evidence.publicKey);
+  if ((0, import_viem14.getAddress)(derivedAddress) !== (0, import_viem14.getAddress)(evidence.address)) {
+    throw new Error("Enclave public key does not match its address");
+  }
+  const appRootPublicKey = await recoverChainKey(
+    appRootPreimage(evidence.purpose, evidence.publicKey),
+    evidence.signatureChain[0],
+    0
+  );
+  const kmsRootPublicKey = await recoverChainKey(
+    kmsIssuedPreimage(evidence.appId, appRootPublicKey),
+    evidence.signatureChain[1],
+    1
+  );
+  if (anchors.kmsRootPubkey === "0x") {
+    throw new Error("KMS root trust anchor is not provisioned");
+  }
+  if (kmsRootPublicKey !== anchors.kmsRootPubkey.toLowerCase()) {
+    throw new Error("KMS root public key does not match the trust anchor");
+  }
+  if ((0, import_viem14.keccak256)(kmsRootPublicKey) !== evidence.kmsRootFingerprint.toLowerCase()) {
+    throw new Error("KMS root fingerprint does not match the evidence");
+  }
+  const appId = evidence.appId.toLowerCase();
+  if (!anchors.appIds.some((allowedAppId) => allowedAppId.toLowerCase() === appId)) {
+    throw new Error("Enclave app ID is not trusted");
+  }
+}
+async function buildMasterSignatureDelivery(evidence, masterSignature, now = Math.floor(Date.now() / 1e3)) {
+  deriveMasterKey(masterSignature);
+  const signerAddress = await recoverServerOwner(masterSignature);
+  if (!(0, import_viem14.isAddressEqual)(signerAddress, evidence.ownerAddress)) {
+    throw new Error("Master signature signer does not match evidence owner");
+  }
+  return {
+    v: MASTER_SIGNATURE_DELIVERY_VERSION,
+    userPsId: evidence.userPsId,
+    epoch: evidence.epoch,
+    enclaveAddress: evidence.address,
+    ownerAddress: evidence.ownerAddress,
+    masterSignature,
+    issuedAt: now
+  };
+}
+function assertUncompressedKey(publicKey) {
+  const hex = publicKey.slice(2);
+  if (hex.length !== UNCOMPRESSED_PUBLIC_KEY_BYTES * 2 || !hex.startsWith(UNCOMPRESSED_PUBLIC_KEY_PREFIX) || !/^[0-9a-fA-F]+$/.test(hex)) {
+    throw new Error("Public key must be a 65-byte uncompressed secp256k1 key");
+  }
+}
+async function encryptMasterSignatureDelivery(delivery, publicKey, ecies) {
+  assertUncompressedKey(publicKey);
+  const plaintext = (0, import_viem14.toBytes)(JSON.stringify(delivery));
+  const encrypted = await ecies.encrypt((0, import_viem14.fromHex)(publicKey, "bytes"), plaintext);
+  return `0x${serializeECIES(encrypted)}`;
+}
+
+// src/protocol/personal-server-registration.ts
+var import_viem15 = require("viem");
 var PERSONAL_SERVER_REGISTRATION_DEFAULT_CHAIN_ID = vanaMainnet2.id;
 var PERSONAL_SERVER_REGISTRATION_DEFAULT_VERIFYING_CONTRACT = getContractAddress(
   PERSONAL_SERVER_REGISTRATION_DEFAULT_CHAIN_ID,
   "DataPortabilityServers"
 );
 function assertAddress(value, name) {
-  if (!(0, import_viem14.isAddress)(value)) {
+  if (!(0, import_viem15.isAddress)(value)) {
     throw new Error(`${name} must be a valid EVM address`);
   }
 }
@@ -32728,12 +32882,12 @@ async function buildPersonalServerRegistrationSignature(input) {
 var registerPersonalServerSignature = buildPersonalServerRegistrationSignature;
 
 // src/personal-server-lite/owner-binding.ts
-var import_viem15 = require("viem");
+var import_viem16 = require("viem");
 var PERSONAL_SERVER_LITE_OWNER_BINDING_VERSION = "vana.ps-lite.owner-binding.v1";
 var PERSONAL_SERVER_LITE_OWNER_BINDING_PURPOSE = "ps-lite-owner";
 var PERSONAL_SERVER_LITE_OWNER_BINDING_PREFIX = `${PERSONAL_SERVER_LITE_OWNER_BINDING_VERSION}:${PERSONAL_SERVER_LITE_OWNER_BINDING_PURPOSE}:`;
 function assertAddress2(value, name) {
-  if (!(0, import_viem15.isAddress)(value)) {
+  if (!(0, import_viem16.isAddress)(value)) {
     throw new Error(`${name} must be a valid EVM address`);
   }
 }
@@ -32783,7 +32937,7 @@ async function buildPersonalServerLiteOwnerBindingSignature(input) {
 var signPersonalServerLiteOwnerBinding = buildPersonalServerLiteOwnerBindingSignature;
 
 // src/account/personal-server-registration.ts
-var import_viem16 = require("viem");
+var import_viem17 = require("viem");
 var ACCOUNT_PERSONAL_SERVER_REGISTRATION_INTENT = "personal_server.server_registration.v1";
 var AccountPersonalServerRegistrationError = class extends Error {
   status;
@@ -32802,7 +32956,7 @@ function trimTrailingSlash(value) {
   return value.replace(/\/+$/, "");
 }
 function assertAddress3(value, name) {
-  if (!(0, import_viem16.isAddress)(value)) {
+  if (!(0, import_viem17.isAddress)(value)) {
     throw new Error(`${name} must be a valid EVM address`);
   }
 }
@@ -33066,7 +33220,7 @@ function accountOwnerBindingError(error) {
 }
 
 // src/protocol/grants.ts
-var import_viem17 = require("viem");
+var import_viem18 = require("viem");
 function isHexString(value) {
   return typeof value === "string" && value.startsWith("0x");
 }
@@ -33111,7 +33265,7 @@ async function verifyGrantRegistration(input) {
   }
   let valid;
   try {
-    valid = await (0, import_viem17.verifyTypedData)({
+    valid = await (0, import_viem18.verifyTypedData)({
       address: input.grantorAddress,
       domain: grantRegistrationDomain(input.gatewayConfig),
       types: GRANT_REGISTRATION_TYPES,
@@ -33146,8 +33300,8 @@ async function verifyGrantRegistration(input) {
 }
 
 // src/protocol/fee-registry.ts
-var import_viem18 = require("viem");
-var FEE_REGISTRY_ABI = (0, import_viem18.parseAbi)([
+var import_viem19 = require("viem");
+var FEE_REGISTRY_ABI = (0, import_viem19.parseAbi)([
   "struct Fee { uint256 amount; address asset; address payee; bool enabled; }",
   "function fees(bytes32 operation) view returns (Fee)",
   "function operationKey(string name) pure returns (bytes32)"
@@ -33230,7 +33384,7 @@ async function getOpFee(client, config, opType, opts) {
 }
 
 // src/protocol/escrow-deposit.ts
-var import_viem19 = require("viem");
+var import_viem20 = require("viem");
 var ESCROW_DEPOSIT_ABI = [
   {
     type: "function",
@@ -33255,14 +33409,14 @@ function escrowContractAddress(config) {
   return config.contracts.dataPortabilityEscrow;
 }
 function encodeDepositNativeData(input) {
-  return (0, import_viem19.encodeFunctionData)({
+  return (0, import_viem20.encodeFunctionData)({
     abi: ESCROW_DEPOSIT_ABI,
     functionName: "depositNative",
     args: [input.account]
   });
 }
 function encodeDepositTokenData(input) {
-  return (0, import_viem19.encodeFunctionData)({
+  return (0, import_viem20.encodeFunctionData)({
     abi: ESCROW_DEPOSIT_ABI,
     functionName: "depositToken",
     args: [input.account, input.token, input.amount]
@@ -33283,7 +33437,7 @@ function buildDepositTokenRequest(config, input) {
 }
 
 // src/protocol/data-point-status.ts
-var import_viem20 = require("viem");
+var import_viem21 = require("viem");
 var DataPointStatus = /* @__PURE__ */ ((DataPointStatus2) => {
   DataPointStatus2[DataPointStatus2["None"] = 0] = "None";
   DataPointStatus2[DataPointStatus2["Active"] = 1] = "Active";
@@ -33307,7 +33461,7 @@ function dataRegistryContractAddress(config) {
   return config.contracts.dataRegistry;
 }
 function encodeSetDataPointStatusData(input) {
-  return (0, import_viem20.encodeFunctionData)({
+  return (0, import_viem21.encodeFunctionData)({
     abi: DATA_REGISTRY_STATUS_ABI,
     functionName: "setStatus",
     args: [input.scope, input.status]
@@ -33327,10 +33481,10 @@ function buildMarkDataPointUnavailableRequest(config, input) {
 }
 
 // src/protocol/data-point-deletion.ts
-var import_viem22 = require("viem");
+var import_viem23 = require("viem");
 
 // src/protocol/lineage.ts
-var import_viem21 = require("viem");
+var import_viem22 = require("viem");
 var import_zod = require("zod");
 
 // src/protocol/personal-server-error-body.ts
@@ -33408,13 +33562,13 @@ function isDataPointId(value) {
   return typeof value === "string" && DATA_POINT_ID_PATTERN.test(value);
 }
 function deriveDataPointId(ownerAddress, scope) {
-  if (!(0, import_viem21.isAddress)(ownerAddress, { strict: false })) {
+  if (!(0, import_viem22.isAddress)(ownerAddress, { strict: false })) {
     throw new Error(
       `ownerAddress is not an EVM address: ${String(ownerAddress)}`
     );
   }
-  return (0, import_viem21.keccak256)(
-    (0, import_viem21.encodeAbiParameters)(
+  return (0, import_viem22.keccak256)(
+    (0, import_viem22.encodeAbiParameters)(
       [
         { name: "ownerAddress", type: "address" },
         { name: "scope", type: "string" }
@@ -33640,7 +33794,7 @@ var TOMBSTONE_METADATA_HASH_PREIMAGE = "vana.data-point.tombstone.metadata.v1";
 var TOMBSTONE_DATA_HASH = "0x30c45ee72fe56d1927701316925ab7ceacd3b6f9267061735d59396f075c6222";
 var TOMBSTONE_METADATA_HASH = "0xc5255a141acd6a2ae55971b62c0a85977c2511989dc114ad2abc2b7644f57d90";
 function computeTombstoneHash(preimage) {
-  return (0, import_viem22.keccak256)((0, import_viem22.stringToBytes)(preimage));
+  return (0, import_viem23.keccak256)((0, import_viem23.stringToBytes)(preimage));
 }
 function isTombstoneHashes(dataHash, metadataHash) {
   return typeof dataHash === "string" && typeof metadataHash === "string" && dataHash.toLowerCase() === TOMBSTONE_DATA_HASH && metadataHash.toLowerCase() === TOMBSTONE_METADATA_HASH;
@@ -33659,12 +33813,12 @@ function tombstoneDeletedAt(value) {
   return typeof deletedAt === "string" ? deletedAt : null;
 }
 function assertAddress4(value, name) {
-  if (!(0, import_viem22.isAddress)(value)) {
+  if (!(0, import_viem23.isAddress)(value)) {
     throw new Error(`${name} must be a valid EVM address`);
   }
 }
 function assertUint256(value, name) {
-  if (value < 0n || value > import_viem22.maxUint256) {
+  if (value < 0n || value > import_viem23.maxUint256) {
     throw new Error(`${name} must fit in uint256, got ${value}`);
   }
 }
@@ -33767,7 +33921,7 @@ async function deleteDataPoint(input) {
     }
     currentVersion = parseExpectedVersion(record.expectedVersion);
   }
-  if (currentVersion < 0n || currentVersion >= import_viem22.maxUint256) {
+  if (currentVersion < 0n || currentVersion >= import_viem23.maxUint256) {
     throw new Error(
       `currentVersion ${currentVersion} cannot be incremented to a uint256 tombstone version`
     );
@@ -34075,12 +34229,12 @@ function tryGrantPermissions(scopes) {
 
 // src/protocol/personal-server-write.ts
 var import_sha26 = require("@noble/hashes/sha2");
-var import_viem24 = require("viem");
+var import_viem25 = require("viem");
 var import_zod4 = require("zod");
 
 // src/protocol/write-request.ts
 var import_sha25 = require("@noble/hashes/sha2");
-var import_viem23 = require("viem");
+var import_viem24 = require("viem");
 function normalizeBaseUrl2(url) {
   return url.replace(/\/+$/, "");
 }
@@ -34147,14 +34301,14 @@ function freshProofNonce() {
     return webCrypto.randomUUID();
   }
   if (typeof webCrypto?.getRandomValues === "function") {
-    return (0, import_viem23.bytesToHex)(webCrypto.getRandomValues(new Uint8Array(16)));
+    return (0, import_viem24.bytesToHex)(webCrypto.getRandomValues(new Uint8Array(16)));
   }
   throw new WriteRequestError(
     "No secure random source available to build a proof nonce; provide a crypto global"
   );
 }
 function proofKeyFor(parts) {
-  return (0, import_viem23.bytesToHex)(
+  return (0, import_viem24.bytesToHex)(
     (0, import_sha25.sha256)(
       new TextEncoder().encode(
         JSON.stringify([
@@ -34162,7 +34316,7 @@ function proofKeyFor(parts) {
           parts.method,
           parts.uri,
           parts.grantId,
-          parts.signedBytes ? (0, import_viem23.bytesToHex)((0, import_sha25.sha256)(parts.signedBytes)) : ""
+          parts.signedBytes ? (0, import_viem24.bytesToHex)((0, import_sha25.sha256)(parts.signedBytes)) : ""
         ])
       )
     )
@@ -34349,7 +34503,7 @@ function binaryWriteSignedBytes(input) {
     mimeType: normalizeBinaryMimeType(input.contentType),
     ...input.filename ? { filename: input.filename } : {},
     sizeBytes: input.bytes.length,
-    contentHash: (0, import_viem24.bytesToHex)((0, import_sha26.sha256)(input.bytes)),
+    contentHash: (0, import_viem25.bytesToHex)((0, import_sha26.sha256)(input.bytes)),
     encoding: "base64",
     content: toBase64(input.bytes),
     ...metadata !== void 0 ? { metadata } : {}
@@ -34397,7 +34551,7 @@ function normalizeLineage(lineage, derivedScope) {
   for (const entry of lineage) {
     let id;
     if (isLineagePair(entry)) {
-      if (!(0, import_viem24.isAddress)(entry.ownerAddress, { strict: false })) {
+      if (!(0, import_viem25.isAddress)(entry.ownerAddress, { strict: false })) {
         throw new WriteRequestError(
           "lineage source ownerAddress must be an EVM address",
           { ownerAddress: entry.ownerAddress }
@@ -34662,6 +34816,13 @@ var QUESTION_STATUSES = [
   "failed",
   "stale"
 ];
+var DERIVATIVE_ERROR_CODES = [
+  "inference_unavailable",
+  "source_missing",
+  "grant_invalid",
+  "internal"
+];
+var DerivativeErrorCodeSchema = import_zod5.z.enum(DERIVATIVE_ERROR_CODES);
 var QuestionStatusSchema = import_zod5.z.enum(QUESTION_STATUSES);
 var QuestionRegisteredBySchema = import_zod5.z.union([
   import_zod5.z.object({ kind: import_zod5.z.literal("owner") }),
@@ -34683,6 +34844,14 @@ var DerivativeQuestionSchema = import_zod5.z.object({
   status: QuestionStatusSchema,
   /** A short reason, set only while `status` is `failed`. */
   error: nullableString,
+  /**
+   * The coarse failure class behind `error`, set only while `status` is
+   * `failed`. `null` from a Personal Server that predates the class
+   * (`personal-server-ts` before the status route).
+   */
+  errorCode: DerivativeErrorCodeSchema.nullish().transform(
+    (value) => value ?? null
+  ),
   createdAt: import_zod5.z.string(),
   updatedAt: nullableString,
   /** When the last compute finished, or `null` while `pending`. */
@@ -34815,6 +34984,7 @@ async function questionErrorFromResponse(response, body) {
       );
   }
 }
+var personalServerErrorFromQuestionResponse = questionErrorFromResponse;
 async function sendOnce(params, resolved, session, spec, bodyBytes) {
   return sendWithFreshProof(
     spec.label,
@@ -35094,6 +35264,166 @@ async function askPersonalServer(params) {
   return { registration, record };
 }
 
+// src/protocol/derivative-status.ts
+var import_zod6 = require("zod");
+var DERIVATIVE_STATUS_PATH = "/v1/derivatives/status";
+var DEFAULT_DERIVATIVE_STATUS_TIMEOUT_MS = 12e4;
+var DEFAULT_DERIVATIVE_STATUS_POLL_INTERVAL_MS = 2e3;
+var nullable = (schema) => schema.nullish().transform((value) => value ?? null);
+var DerivativeStatusSchema = import_zod6.z.object({
+  derivedScope: import_zod6.z.string().min(1),
+  status: QuestionStatusSchema,
+  /** When the last compute finished, or `null` if none ever has. */
+  lastComputedAt: nullable(import_zod6.z.string()),
+  /** Local version of the derived record the last compute wrote. */
+  derivedVersion: nullable(import_zod6.z.number()),
+  derivedCollectedAt: nullable(import_zod6.z.string()),
+  /** The failure class; `null` unless `status` is `failed`. */
+  errorCode: nullable(DerivativeErrorCodeSchema),
+  /**
+   * Seconds until the Personal Server's next automatic retry, or `null` when
+   * none is pending or running — the terminal signature. Poll on this cadence
+   * rather than guessing one.
+   */
+  retryAfterSeconds: nullable(import_zod6.z.number())
+});
+function derivativeStatusTarget(derivedScope) {
+  return `${DERIVATIVE_STATUS_PATH}?derivedScope=${encodeURIComponent(derivedScope)}`;
+}
+function normalizeBaseUrl3(url) {
+  return url.replace(/\/+$/, "");
+}
+function resolveFetch3(fetchFn) {
+  const resolved = fetchFn ?? globalThis.fetch;
+  if (resolved === void 0) {
+    throw new WriteRequestError("No fetch implementation available");
+  }
+  return resolved;
+}
+function requireDerivedScope(derivedScope) {
+  if (typeof derivedScope !== "string" || derivedScope.length === 0) {
+    throw new WriteRequestError("derivedScope is required");
+  }
+  return derivedScope;
+}
+function sleep3(ms, signal) {
+  if (ms <= 0) return Promise.resolve();
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    const onAbort = () => {
+      clearTimeout(timer);
+      reject(abortError2(signal));
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
+function timeoutError(latest, timeoutMs) {
+  return new DerivativeQuestionTimeoutError(
+    `Derived scope ${latest.derivedScope} was still ${latest.status} after ${timeoutMs}ms`,
+    {
+      derivedScope: latest.derivedScope,
+      status: latest.status,
+      errorCode: latest.errorCode,
+      retryAfterSeconds: latest.retryAfterSeconds,
+      timeoutMs
+    }
+  );
+}
+function abortError2(signal) {
+  const reason = signal?.reason;
+  return reason instanceof Error ? reason : new WriteRequestError("Derivative status wait was aborted");
+}
+function isDerivativeStatusSettled(status) {
+  if (status.status === "ready") return true;
+  return status.status === "failed" && status.retryAfterSeconds === null;
+}
+async function getDerivativeStatus(params) {
+  const derivedScope = requireDerivedScope(params.derivedScope);
+  const fetchFn = resolveFetch3(params.fetch);
+  const baseUrl = normalizeBaseUrl3(params.personalServerUrl);
+  const signer = resolveWriteSigner(params.signer, { account: params.account });
+  const headers = new Headers(params.headers);
+  headers.set(
+    "Authorization",
+    await buildWeb3SignedHeader({
+      signMessage: signer.signMessage,
+      aud: params.audience ?? baseUrl,
+      method: "GET",
+      uri: DERIVATIVE_STATUS_PATH,
+      grantId: params.grantId
+    })
+  );
+  let response;
+  try {
+    response = await fetchFn(
+      `${baseUrl}${derivativeStatusTarget(derivedScope)}`,
+      {
+        method: "GET",
+        headers,
+        ...params.signal ? { signal: params.signal } : {}
+      }
+    );
+  } catch (err) {
+    throw new WriteTransportError(
+      `Derivative status read failed: ${err instanceof Error ? err.message : String(err)}`,
+      1,
+      err
+    );
+  }
+  if (!response.ok) {
+    throw await personalServerErrorFromQuestionResponse(
+      response
+    );
+  }
+  let body;
+  try {
+    body = await response.json();
+  } catch (err) {
+    throw new DerivativeQuestionRejectedError(
+      "Derivative status response is not JSON",
+      response.status,
+      null,
+      { cause: err instanceof Error ? err.message : String(err) }
+    );
+  }
+  const parsed = DerivativeStatusSchema.safeParse(body);
+  if (!parsed.success) {
+    throw new DerivativeQuestionRejectedError(
+      "Derivative status response is not a status view",
+      response.status,
+      null,
+      { issues: parsed.error.issues }
+    );
+  }
+  return parsed.data;
+}
+async function waitForDerivativeStatus(params) {
+  const timeoutMs = Math.max(
+    0,
+    params.timeoutMs ?? DEFAULT_DERIVATIVE_STATUS_TIMEOUT_MS
+  );
+  const pollIntervalMs = Math.max(
+    0,
+    params.pollIntervalMs ?? DEFAULT_DERIVATIVE_STATUS_POLL_INTERVAL_MS
+  );
+  const deadline = Date.now() + timeoutMs;
+  for (; ; ) {
+    if (params.signal?.aborted) throw abortError2(params.signal);
+    const latest = await getDerivativeStatus(params);
+    if (isDerivativeStatusSettled(latest)) return latest;
+    const remaining = deadline - Date.now();
+    if (remaining <= 0) throw timeoutError(latest, timeoutMs);
+    const waitMs = latest.retryAfterSeconds === null ? pollIntervalMs : latest.retryAfterSeconds * 1e3;
+    if (waitMs > remaining) {
+      throw timeoutError(latest, timeoutMs);
+    }
+    await sleep3(waitMs, params.signal);
+  }
+}
+
 // src/protocol/gateway.ts
 function withGrantPermissions(grant) {
   const stripped = { ...grant };
@@ -36175,9 +36505,13 @@ async function parsePSError(response) {
   ContractNotFoundError,
   DATA_ACCESS_OP_TYPE,
   DATA_REGISTRY_STATUS_ABI,
+  DEFAULT_DERIVATIVE_STATUS_POLL_INTERVAL_MS,
+  DEFAULT_DERIVATIVE_STATUS_TIMEOUT_MS,
   DEFAULT_QUESTION_POLL_INTERVAL_MS,
   DEFAULT_QUESTION_TIMEOUT_MS,
+  DERIVATIVE_ERROR_CODES,
   DERIVATIVE_QUESTIONS_PATH,
+  DERIVATIVE_STATUS_PATH,
   DataFileEnvelopeSchema,
   DataPointDeletedError,
   DataPointNotFoundError,
@@ -36186,6 +36520,7 @@ async function parsePSError(response) {
   DerivativeComputeUnavailableError,
   DerivativeCycleError,
   DerivativeDerivedScopeRequiredError,
+  DerivativeErrorCodeSchema,
   DerivativeQuestionFailedError,
   DerivativeQuestionInvalidError,
   DerivativeQuestionNotFoundError,
@@ -36193,8 +36528,12 @@ async function parsePSError(response) {
   DerivativeQuestionSchema,
   DerivativeQuestionTimeoutError,
   DerivativeSourceNotGrantedError,
+  DerivativeStatusSchema,
   DropboxStorage,
   ECIESError,
+  ENCLAVE_IDENTITY_EVIDENCE_VERSION,
+  ENCLAVE_TRUST_ANCHORS,
+  ENCLAVE_WALLET_PURPOSE,
   ESCROW_DEPOSIT_ABI,
   ExpiredTokenError,
   FEE_REGISTRY_ABI,
@@ -36216,6 +36555,7 @@ async function parsePSError(response) {
   LineageNodeSchema,
   LineageReadError,
   MASTER_KEY_MESSAGE,
+  MASTER_SIGNATURE_DELIVERY_VERSION,
   MAX_LINEAGE_SOURCES,
   MAX_QUESTION_CHARS,
   MAX_QUESTION_MODEL_CHARS,
@@ -36253,6 +36593,7 @@ async function parsePSError(response) {
   RedactedLineageNodeSchema,
   RelayerError,
   SCOPE_ACTIONS,
+  SEALED_ENVELOPE_VERSION,
   SERVER_REGISTRATION_TYPES,
   ScopeSchema,
   SerializationError,
@@ -36265,6 +36606,7 @@ async function parsePSError(response) {
   TOMBSTONE_METADATA_HASH,
   TOMBSTONE_METADATA_HASH_PREIMAGE,
   TransactionPendingError,
+  USER_PS_ID_DOMAIN,
   UserRejectedRequestError,
   VanaError,
   VanaStorage,
@@ -36283,6 +36625,7 @@ async function parsePSError(response) {
   WriteSessionExpiredError,
   WriteTransportError,
   WriteUnauthorizedError,
+  appRootPreimage,
   askPersonalServer,
   assertDerivedScopeNaming,
   assertValidPkceVerifier,
@@ -36296,6 +36639,7 @@ async function parsePSError(response) {
   buildEscrowPaymentHeader,
   buildGrantPaymentHeader,
   buildMarkDataPointUnavailableRequest,
+  buildMasterSignatureDelivery,
   buildPersonalServerDataReadRequest,
   buildPersonalServerLiteOwnerBindingMessage,
   buildPersonalServerLiteOwnerBindingSignature,
@@ -36328,6 +36672,7 @@ async function parsePSError(response) {
   decryptWithPassword,
   deleteDataPoint,
   deleteQuestion,
+  derivativeStatusTarget,
   deriveDataPointId,
   deriveMasterKey,
   deriveScopeKey,
@@ -36338,6 +36683,7 @@ async function parsePSError(response) {
   encodeDepositTokenData,
   encodeSetDataPointStatusData,
   encodeWriteMetadataHeader,
+  encryptMasterSignatureDelivery,
   encryptWithPassword,
   escrowContractAddress,
   escrowPaymentDomain,
@@ -36351,6 +36697,7 @@ async function parsePSError(response) {
   getContractAddress,
   getContractController,
   getContractInfo,
+  getDerivativeStatus,
   getFee,
   getGatewayLineage,
   getLineage,
@@ -36366,10 +36713,12 @@ async function parsePSError(response) {
   isDataPointId,
   isDataPointTombstone,
   isDataPortabilityGatewayConfig,
+  isDerivativeStatusSettled,
   isECIESEncrypted,
   isPlatformSupported,
   isRedactedLineageNode,
   isTombstoneHashes,
+  kmsIssuedPreimage,
   listQuestions,
   mainnetServices,
   moksha,
@@ -36409,10 +36758,13 @@ async function parsePSError(response) {
   toDirectPaymentReceipt,
   tombstoneDeletedAt,
   tryGrantPermissions,
+  userPsId,
   vanaMainnet,
+  verifyEnclaveIdentityEvidence,
   verifyGrantRegistration,
   verifyPkceChallenge,
   verifyWeb3Signed,
+  waitForDerivativeStatus,
   waitForQuestion,
   writeData,
   writePersonalServerData