@xyo-network/event-kit-node 0.0.1 → 0.1.1

package/dist/node/handshake.mjs

@@ -0,0 +1,1977 @@
+// src/filesystemEventKitReplayCheckpointStore.ts
+import PATH3 from "node:path";
+
+// src/filesystemJson.ts
+import { randomBytes } from "node:crypto";
+import {
+  link,
+  open as open2,
+  rename,
+  unlink
+} from "node:fs/promises";
+import PATH2 from "node:path";
+
+// src/filesystemDurability.ts
+import { mkdir, open } from "node:fs/promises";
+import PATH from "node:path";
+async function writeDurableFile(path, body, mode) {
+  const handle = await open(path, "w", mode);
+  try {
+    await handle.writeFile(body, "utf8");
+    await handle.sync();
+  } finally {
+    await handle.close();
+  }
+}
+async function ensureDurableDirectory(path, mode) {
+  const directory = PATH.resolve(path);
+  const firstCreated = await mkdir(directory, { mode, recursive: true });
+  if (firstCreated === void 0) return;
+  const existingParent = PATH.dirname(PATH.resolve(firstCreated));
+  let cursor = directory;
+  while (true) {
+    await syncDirectory(cursor);
+    if (cursor === existingParent) return;
+    const parent = PATH.dirname(cursor);
+    if (parent === cursor) throw new Error("Created directory is not below its reported existing parent");
+    cursor = parent;
+  }
+}
+async function syncDirectory(path) {
+  let handle;
+  try {
+    handle = await open(path, "r");
+    await handle.sync();
+  } catch (error) {
+    if (!isUnsupportedDirectorySync(error)) throw error;
+  } finally {
+    await handle?.close();
+  }
+}
+function isUnsupportedDirectorySync(error) {
+  const code = errorCode(error);
+  return code === "EISDIR" || code === "EINVAL" || code === "ENOTSUP" || code === "EOPNOTSUPP";
+}
+function errorCode(error) {
+  return typeof error === "object" && error !== null && "code" in error ? error.code : void 0;
+}
+
+// src/filesystemJson.ts
+async function readJsonFileStrict(path) {
+  try {
+    const handle = await open2(path, "r");
+    try {
+      return JSON.parse(await handle.readFile("utf8"), reviveJson);
+    } finally {
+      await handle.close();
+    }
+  } catch (error) {
+    if (errorCode2(error) === "ENOENT") return void 0;
+    throw error;
+  }
+}
+async function replaceJsonFile(path, value, options = {}) {
+  const directory = PATH2.dirname(path);
+  await ensureDurableDirectory(directory, options.directoryMode);
+  const tempPath = PATH2.join(directory, `.${PATH2.basename(path)}.${process.pid}.${suffix()}.tmp`);
+  await writeDurableFile(tempPath, `${stringifyJson(value)}
+`, options.mode);
+  try {
+    await rename(tempPath, path);
+    await syncDirectory(directory);
+  } catch (error) {
+    await unlink(tempPath).catch(ignoreNotFound);
+    throw error;
+  }
+}
+async function publishJsonFile(path, value, options = {}) {
+  const directory = PATH2.dirname(path);
+  await ensureDurableDirectory(directory, options.directoryMode);
+  const tempPath = PATH2.join(directory, `.${PATH2.basename(path)}.${process.pid}.${suffix()}.tmp`);
+  await writeDurableFile(tempPath, `${stringifyJson(value)}
+`, options.mode);
+  try {
+    await link(tempPath, path);
+    await syncDirectory(directory);
+    return true;
+  } catch (error) {
+    if (errorCode2(error) === "EEXIST") return false;
+    throw error;
+  } finally {
+    await unlink(tempPath).catch(ignoreNotFound);
+  }
+}
+function suffix() {
+  return randomBytes(8).toString("hex");
+}
+function stringifyJson(value) {
+  return JSON.stringify(value, replaceJsonValue);
+}
+function replaceJsonValue(_key, candidate) {
+  return typeof candidate === "bigint" ? { $eventKitBigInt: candidate.toString() } : candidate;
+}
+function reviveJson(_key, candidate) {
+  if (typeof candidate === "object" && candidate !== null && Object.keys(candidate).length === 1 && "$eventKitBigInt" in candidate && typeof candidate.$eventKitBigInt === "string" && /^(?:0|[1-9][0-9]*)$/u.test(candidate.$eventKitBigInt)) {
+    return BigInt(candidate.$eventKitBigInt);
+  }
+  return candidate;
+}
+function ignoreNotFound(error) {
+  if (errorCode2(error) !== "ENOENT") throw error;
+}
+function errorCode2(error) {
+  return typeof error === "object" && error !== null && "code" in error ? error.code : void 0;
+}
+
+// src/filesystemEventKitReplayCheckpointStore.ts
+function createFilesystemEventKitReplayCheckpointStore(options) {
+  const path = PATH3.resolve(options.path);
+  let tail = Promise.resolve();
+  return {
+    async load() {
+      await tail;
+      return await readJsonFileStrict(path);
+    },
+    async save(checkpoint) {
+      const save = tail.then(async () => await replaceJsonFile(path, checkpoint));
+      tail = save.catch(() => false);
+      await save;
+    }
+  };
+}
+
+// src/filesystemFinalizedStatementPublicationJournal.ts
+import { createHash } from "node:crypto";
+import PATH4 from "node:path";
+import { isDeepStrictEqual } from "node:util";
+var PublicationPhases = [
+  "signed",
+  "content-written",
+  "content-verified",
+  "broadcast",
+  "included",
+  "finalized"
+];
+var PublicationPhaseSet = new Set(PublicationPhases);
+function sameStrings(left, right) {
+  return left.length === right.length && left.every((value, index) => value === right[index]);
+}
+function assertIntentShape(intent) {
+  if (typeof intent.operationId !== "string" || intent.operationId.length === 0 || intent.operationId.length > 256) {
+    throw new TypeError("publication operationId must be a nonempty string of at most 256 characters");
+  }
+  if (!/^[0-9a-f]{40}$/u.test(intent.source)) {
+    throw new TypeError("publication source must be a canonical 20-byte lowercase hexadecimal address");
+  }
+  if (!/^[0-9a-f]{40}$/u.test(intent.chainId)) {
+    throw new TypeError("publication chainId must be a canonical 20-byte lowercase hexadecimal chain id");
+  }
+  if (![...intent.eventHashes, ...intent.attachmentHashes].every((hash) => /^[0-9a-f]{64}$/u.test(hash))) {
+    throw new TypeError("publication intent hashes must be 32-byte lowercase hexadecimal");
+  }
+}
+function sameIntent(left, right) {
+  return left.operationId === right.operationId && left.source === right.source && left.chainId === right.chainId && sameStrings(left.eventHashes, right.eventHashes) && sameStrings(left.attachmentHashes, right.attachmentHashes);
+}
+function intentFromRecord(record) {
+  return {
+    attachmentHashes: record.attachmentHashes,
+    chainId: record.chainId,
+    eventHashes: record.eventHashes,
+    operationId: record.operationId,
+    source: record.source
+  };
+}
+function publicationDirectory(root, intent) {
+  const key = createHash("sha256").update(stringifyJson({
+    chainId: intent.chainId,
+    operationId: intent.operationId,
+    source: intent.source
+  })).digest("hex");
+  return PATH4.join(root, key);
+}
+function asPublicationRecord(value, path) {
+  if (typeof value !== "object" || value === null) throw new Error(`malformed publication journal record at ${path}`);
+  const record = value;
+  if (!PublicationPhaseSet.has(record.phase)) throw new Error(`unknown publication phase at ${path}`);
+  return record;
+}
+function assertBoundRecord(record, intent, signed) {
+  if (!sameIntent(intentFromRecord(record), intent)) throw new Error("publication journal intent collision");
+  if (!isDeepStrictEqual(record.evidence, signed.evidence)) {
+    throw new Error("publication journal evidence collision");
+  }
+}
+function createFilesystemFinalizedStatementPublicationJournal(options) {
+  const root = PATH4.resolve(options.path);
+  return {
+    async load(intent) {
+      assertIntentShape(intent);
+      const directory = publicationDirectory(root, intent);
+      const intentPath = PATH4.join(directory, "intent.json");
+      const rawSigned = await readJsonFileStrict(intentPath);
+      if (rawSigned === void 0) return void 0;
+      const signed = asPublicationRecord(rawSigned, intentPath);
+      if (signed.phase !== "signed") throw new Error(`publication intent record is not signed at ${intentPath}`);
+      assertBoundRecord(signed, intent, signed);
+      let latest = signed;
+      for (const phase of PublicationPhases.slice(1)) {
+        const path = PATH4.join(directory, `${phase}.json`);
+        const rawRecord = await readJsonFileStrict(path);
+        if (rawRecord === void 0) continue;
+        const record = asPublicationRecord(rawRecord, path);
+        if (record.phase !== phase) throw new Error(`publication phase/path mismatch at ${path}`);
+        assertBoundRecord(record, intent, signed);
+        latest = record;
+      }
+      return latest;
+    },
+    async save(record) {
+      const intent = intentFromRecord(record);
+      assertIntentShape(intent);
+      if (!/^[0-9a-f]{64}$/u.test(record.evidence.transactionHash)) {
+        throw new TypeError("publication transaction hash must be 32-byte lowercase hex");
+      }
+      if (!PublicationPhaseSet.has(record.phase)) throw new TypeError("unknown publication phase");
+      const directory = publicationDirectory(root, intent);
+      const intentPath = PATH4.join(directory, "intent.json");
+      if (record.phase === "signed") {
+        if (await publishJsonFile(intentPath, record)) return;
+        const existing2 = asPublicationRecord(await readJsonFileStrict(intentPath), intentPath);
+        if (!isDeepStrictEqual(existing2, record)) {
+          if (!sameIntent(intentFromRecord(existing2), intent)) throw new Error("publication journal intent collision");
+          throw new Error("publication journal evidence collision");
+        }
+        return;
+      }
+      const rawSigned = await readJsonFileStrict(intentPath);
+      if (rawSigned === void 0) throw new Error("publication journal must bind signed evidence first");
+      const signed = asPublicationRecord(rawSigned, intentPath);
+      if (signed.phase !== "signed") throw new Error(`publication intent record is not signed at ${intentPath}`);
+      assertBoundRecord(record, intent, signed);
+      const path = PATH4.join(directory, `${record.phase}.json`);
+      if (await publishJsonFile(path, record)) return;
+      const existing = asPublicationRecord(await readJsonFileStrict(path), path);
+      if (!isDeepStrictEqual(existing, record)) {
+        throw new Error(`publication journal collision at ${record.operationId}/${record.phase}`);
+      }
+    }
+  };
+}
+
+// src/filesystemHandshakeMutationIntentStore.ts
+import { stat } from "node:fs/promises";
+import PATH5 from "node:path";
+
+// src/handshakeMutationIntent.ts
+import {
+  canonicalJsonBytes,
+  handshakeObjectHash
+} from "@xyo-network/event-kit-protocol";
+import {
+  Base64Url32BytesZod,
+  ChainIdZod,
+  EncryptedWakeSubscriptionZod,
+  EndpointChallengeResponseZod,
+  EndpointChallengeZod,
+  HandshakeIdZod,
+  HashZod,
+  NormalizedAddressZod,
+  PublisherEncryptionKeyRevocationZod,
+  PublisherEncryptionKeyZod,
+  PublisherServiceRevocationZod,
+  PublisherServiceZod,
+  WakeGrantObjectZod,
+  WakeGrantRevocationZod,
+  WakeSubscriptionAcceptanceZod,
+  WakeSubscriptionRevocationZod
+} from "@xyo-network/event-kit-schemas";
+import { z } from "zod";
+var HandshakeMutationIntentKinds = [
+  "publisher-encryption-key-retire",
+  "publisher-service-publish",
+  "publisher-service-retire",
+  "publisher-service-rotate-key",
+  "publisher-subscription-accept",
+  "subscriber-grant-revoke",
+  "subscriber-subscription-revoke",
+  "subscriber-subscription-subscribe"
+];
+var HandshakeMutationIntentKindZod = z.enum(HandshakeMutationIntentKinds);
+var HandshakeMutationOperationIdZod = z.union([HandshakeIdZod, HashZod]);
+var WakeSubscriptionPrivateKeyZod = z.strictObject({
+  encryptionKey: HashZod,
+  keyId: HandshakeIdZod,
+  privateKey: Base64Url32BytesZod
+});
+var IntentBaseFields = {
+  chainId: ChainIdZod,
+  operationId: HandshakeMutationOperationIdZod,
+  publisher: NormalizedAddressZod,
+  requestFingerprint: HashZod,
+  source: NormalizedAddressZod,
+  version: z.literal(1)
+};
+var PublisherServicePublishIntentZod = z.strictObject({
+  ...IntentBaseFields,
+  kind: z.literal("publisher-service-publish"),
+  operationId: HandshakeIdZod,
+  encryptionKey: PublisherEncryptionKeyZod,
+  privateKey: WakeSubscriptionPrivateKeyZod,
+  service: PublisherServiceZod
+});
+var PublisherServiceRotateKeyIntentZod = z.strictObject({
+  ...IntentBaseFields,
+  kind: z.literal("publisher-service-rotate-key"),
+  operationId: HandshakeIdZod,
+  encryptionKey: PublisherEncryptionKeyZod,
+  privateKey: WakeSubscriptionPrivateKeyZod,
+  selectedKey: HashZod,
+  selectedService: HashZod,
+  service: PublisherServiceZod
+});
+var SubscriberSubscriptionIntentZod = z.strictObject({
+  ...IntentBaseFields,
+  kind: z.literal("subscriber-subscription-subscribe"),
+  operationId: HandshakeIdZod,
+  encryptionKey: PublisherEncryptionKeyZod,
+  grant: WakeGrantObjectZod,
+  selectedKey: HashZod,
+  selectedService: HashZod,
+  service: PublisherServiceZod,
+  subscription: EncryptedWakeSubscriptionZod
+});
+var PublisherAcceptanceIntentZod = z.strictObject({
+  ...IntentBaseFields,
+  acceptance: WakeSubscriptionAcceptanceZod,
+  challenge: EndpointChallengeZod,
+  kind: z.literal("publisher-subscription-accept"),
+  operationId: HashZod,
+  response: EndpointChallengeResponseZod
+});
+var PublisherServiceRetireIntentZod = z.strictObject({
+  ...IntentBaseFields,
+  kind: z.literal("publisher-service-retire"),
+  operationId: HashZod,
+  revocation: PublisherServiceRevocationZod
+});
+var PublisherEncryptionKeyRetireIntentZod = z.strictObject({
+  ...IntentBaseFields,
+  kind: z.literal("publisher-encryption-key-retire"),
+  operationId: HashZod,
+  revocation: PublisherEncryptionKeyRevocationZod
+});
+var SubscriberGrantRevokeIntentZod = z.strictObject({
+  ...IntentBaseFields,
+  kind: z.literal("subscriber-grant-revoke"),
+  operationId: HashZod,
+  revocation: WakeGrantRevocationZod
+});
+var SubscriberSubscriptionRevokeIntentZod = z.strictObject({
+  ...IntentBaseFields,
+  kind: z.literal("subscriber-subscription-revoke"),
+  operationId: HashZod,
+  revocation: WakeSubscriptionRevocationZod
+});
+var HandshakeMutationIntentZod = z.discriminatedUnion("kind", [
+  PublisherEncryptionKeyRetireIntentZod,
+  PublisherServicePublishIntentZod,
+  PublisherServiceRetireIntentZod,
+  PublisherServiceRotateKeyIntentZod,
+  PublisherAcceptanceIntentZod,
+  SubscriberGrantRevokeIntentZod,
+  SubscriberSubscriptionRevokeIntentZod,
+  SubscriberSubscriptionIntentZod
+]);
+var HandshakeMutationIntentConflictError = class extends Error {
+  constructor(message = "Handshake mutation operation ID is already bound to different intent") {
+    super(message);
+    this.name = "HandshakeMutationIntentConflictError";
+  }
+};
+async function handshakeMutationRequestFingerprint(value) {
+  const canonical = canonicalJsonBytes(value);
+  const digestInput = new Uint8Array(canonical.byteLength);
+  digestInput.set(canonical);
+  const digest = await globalThis.crypto.subtle.digest("SHA-256", digestInput);
+  const hex = Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("");
+  return HashZod.parse(hex);
+}
+function parseHandshakeMutationIntentLookup(value) {
+  return Object.freeze({
+    chainId: ChainIdZod.parse(value.chainId),
+    kind: HandshakeMutationIntentKindZod.parse(value.kind),
+    operationId: HandshakeMutationOperationIdZod.parse(value.operationId),
+    publisher: NormalizedAddressZod.parse(value.publisher),
+    source: NormalizedAddressZod.parse(value.source)
+  });
+}
+async function parseHandshakeMutationIntent(value) {
+  const intent = HandshakeMutationIntentZod.parse(value);
+  await assertIntentIntegrity(intent);
+  return Object.freeze(intent);
+}
+function createMemoryHandshakeMutationIntentStore() {
+  const intents = /* @__PURE__ */ new Map();
+  return {
+    async get(rawLookup) {
+      const lookup = parseHandshakeMutationIntentLookup(rawLookup);
+      return intents.get(intentLookupKey(lookup));
+    },
+    async getOrCreate(rawIntent) {
+      const proposed = await parseHandshakeMutationIntent(rawIntent);
+      const key = intentLookupKey(proposed);
+      const existing = intents.get(key);
+      if (existing === void 0) {
+        intents.set(key, proposed);
+        return Object.freeze({ disposition: "created", intent: proposed });
+      }
+      assertSameIntentBinding(existing, proposed);
+      return Object.freeze({ disposition: "resumed", intent: existing });
+    }
+  };
+}
+function intentLookupKey(lookup) {
+  const parsed = parseHandshakeMutationIntentLookup(lookup);
+  return [parsed.chainId, parsed.publisher, parsed.source, parsed.kind, parsed.operationId].join("/");
+}
+function assertSameIntentBinding(left, right) {
+  const shared = left.version === right.version && left.chainId === right.chainId && left.kind === right.kind && left.operationId === right.operationId && left.publisher === right.publisher && left.source === right.source && left.requestFingerprint === right.requestFingerprint;
+  const bothRotate = left.kind === "publisher-service-rotate-key" && right.kind === "publisher-service-rotate-key";
+  const bothSubscribe = left.kind === "subscriber-subscription-subscribe" && right.kind === "subscriber-subscription-subscribe";
+  const selected = bothRotate || bothSubscribe ? left.selectedService === right.selectedService && left.selectedKey === right.selectedKey : !("selectedService" in left) && !("selectedService" in right);
+  if (!shared || !selected) throw new HandshakeMutationIntentConflictError();
+}
+async function assertIntentIntegrity(intent) {
+  if (intent.kind.startsWith("publisher-") && intent.source !== intent.publisher) {
+    throw new TypeError("Publisher mutation intent source must equal publisher");
+  }
+  if (intent.kind === "publisher-service-publish" || intent.kind === "publisher-service-rotate-key") {
+    await assertPublisherServiceIntent(intent);
+    return;
+  }
+  if (intent.kind === "subscriber-subscription-subscribe") {
+    await assertSubscriberSubscriptionIntent(intent);
+    return;
+  }
+  if (intent.kind === "publisher-subscription-accept") {
+    await assertPublisherAcceptanceIntent(intent);
+    return;
+  }
+  await assertRevocationIntent(intent);
+}
+async function assertPublisherServiceIntent(intent) {
+  const keyHash = await handshakeObjectHash(intent.encryptionKey);
+  if (intent.privateKey.encryptionKey !== keyHash || intent.privateKey.keyId !== intent.encryptionKey.keyId || intent.service.preferredEncryptionKey !== keyHash || intent.service.encryptionKeys.length !== 1 || intent.service.encryptionKeys[0] !== keyHash) {
+    throw new TypeError("Publisher service mutation intent has inconsistent encryption-key artifacts");
+  }
+  if (intent.kind === "publisher-service-publish") {
+    if (intent.service.revision !== 1 || intent.service.supersedes !== void 0) {
+      throw new TypeError("Publisher service root intent must contain a root service revision");
+    }
+  } else if (intent.service.supersedes !== intent.selectedService || intent.service.revision <= 1) {
+    throw new TypeError("Publisher service rotation intent does not extend its selected service");
+  }
+}
+async function assertSubscriberSubscriptionIntent(intent) {
+  const [keyHash, serviceHash, grantHash] = await Promise.all([
+    handshakeObjectHash(intent.encryptionKey),
+    handshakeObjectHash(intent.service),
+    handshakeObjectHash(intent.grant)
+  ]);
+  if (keyHash !== intent.selectedKey || serviceHash !== intent.selectedService || intent.service.preferredEncryptionKey !== keyHash || !intent.service.encryptionKeys.includes(keyHash) || intent.grant.publisher !== intent.publisher || intent.subscription.publisher !== intent.publisher || intent.subscription.service !== serviceHash || intent.subscription.encryptionKey !== keyHash || intent.subscription.keyId !== intent.encryptionKey.keyId || intent.subscription.grant !== grantHash) {
+    throw new TypeError("Subscriber subscription intent has inconsistent public artifacts");
+  }
+}
+async function assertPublisherAcceptanceIntent(intent) {
+  const [challengeHash, responseHash] = await Promise.all([
+    handshakeObjectHash(intent.challenge),
+    handshakeObjectHash(intent.response)
+  ]);
+  if (challengeHash !== intent.operationId || intent.challenge.publisher !== intent.publisher || intent.response.challenge !== challengeHash || intent.acceptance.challenge !== challengeHash || intent.acceptance.response !== responseHash || intent.acceptance.service !== intent.challenge.service || intent.acceptance.encryptionKey !== intent.challenge.encryptionKey || intent.acceptance.grant !== intent.challenge.grant || intent.acceptance.subscription !== intent.challenge.subscription) {
+    throw new TypeError("Publisher acceptance intent has inconsistent public artifacts");
+  }
+}
+async function assertRevocationIntent(intent) {
+  const target = intent.kind === "publisher-encryption-key-retire" ? intent.revocation.key : intent.kind === "publisher-service-retire" ? intent.revocation.service : intent.kind === "subscriber-grant-revoke" ? intent.revocation.grant : intent.revocation.subscription;
+  if (target !== intent.operationId) {
+    throw new TypeError("Handshake revocation intent has inconsistent target binding");
+  }
+}
+
+// src/filesystemHandshakeMutationIntentStore.ts
+function createFilesystemHandshakeMutationIntentStore(options) {
+  const root = PATH5.resolve(options.path);
+  function pathFor(rawLookup) {
+    const lookup = parseHandshakeMutationIntentLookup(rawLookup);
+    return PATH5.join(
+      root,
+      lookup.chainId,
+      lookup.publisher,
+      lookup.source,
+      lookup.kind,
+      `${lookup.operationId}.json`
+    );
+  }
+  async function readIntent(lookup) {
+    const path = pathFor(lookup);
+    const raw = await readJsonFileStrict(path);
+    if (raw === void 0) return void 0;
+    const intent = await parseHandshakeMutationIntent(raw);
+    const parsedLookup = parseHandshakeMutationIntentLookup(lookup);
+    if (intent.chainId !== parsedLookup.chainId || intent.kind !== parsedLookup.kind || intent.operationId !== parsedLookup.operationId || intent.publisher !== parsedLookup.publisher || intent.source !== parsedLookup.source) {
+      throw new Error("handshake mutation intent does not match its immutable path");
+    }
+    const metadata = await stat(path);
+    if ((metadata.mode & 63) !== 0) throw new Error("handshake mutation intent permissions are too broad");
+    return intent;
+  }
+  return {
+    async get(lookup) {
+      return await readIntent(parseHandshakeMutationIntentLookup(lookup));
+    },
+    async getOrCreate(rawIntent) {
+      const proposed = await parseHandshakeMutationIntent(rawIntent);
+      const path = pathFor(proposed);
+      const created = await publishJsonFile(path, proposed, { directoryMode: 448, mode: 384 });
+      const winner = await readIntent(proposed);
+      if (winner === void 0) throw new Error("handshake mutation intent winner vanished");
+      assertSameIntentBinding(winner, proposed);
+      return Object.freeze({
+        disposition: created ? "created" : "resumed",
+        intent: winner
+      });
+    }
+  };
+}
+
+// src/filesystemPublisherEncryptionKeyStore.ts
+import { stat as stat2 } from "node:fs/promises";
+import PATH6 from "node:path";
+import {
+  Base64Url32BytesZod as Base64Url32BytesZod2,
+  HandshakeIdZod as HandshakeIdZod2,
+  HashZod as HashZod2,
+  NormalizedAddressZod as NormalizedAddressZod2
+} from "@xyo-network/event-kit-schemas";
+function createFilesystemPublisherEncryptionKeyStore(options) {
+  const root = PATH6.resolve(options.path);
+  function parseLookup(lookup) {
+    return {
+      encryptionKey: HashZod2.parse(lookup.encryptionKey),
+      keyId: HandshakeIdZod2.parse(lookup.keyId),
+      publisher: NormalizedAddressZod2.parse(lookup.publisher)
+    };
+  }
+  function pathFor(lookup) {
+    return PATH6.join(root, lookup.publisher, `${lookup.encryptionKey}-${lookup.keyId}.json`);
+  }
+  function keyIdPath(lookup) {
+    return PATH6.join(root, lookup.publisher, "key-ids", `${lookup.keyId}.json`);
+  }
+  async function readRecord(lookup) {
+    const path = pathFor(lookup);
+    const raw = await readJsonFileStrict(path);
+    if (raw === void 0) return void 0;
+    const parsed = parsePrivateKeyRecord(raw);
+    if (parsed.publisher !== lookup.publisher || parsed.encryptionKey !== lookup.encryptionKey || parsed.keyId !== lookup.keyId) throw new Error("publisher encryption-key record does not match its immutable path");
+    const keyIdRecord = parseKeyIdRecord(await readJsonFileStrict(keyIdPath(lookup)));
+    if (keyIdRecord.publisher !== lookup.publisher || keyIdRecord.encryptionKey !== lookup.encryptionKey || keyIdRecord.keyId !== lookup.keyId) throw new Error("publisher encryption-key keyId index does not match its immutable path");
+    const metadata = await stat2(path);
+    if ((metadata.mode & 63) !== 0) throw new Error("publisher encryption-key record permissions are too broad");
+    return parsed;
+  }
+  return {
+    async getPrivateKey(rawLookup) {
+      const lookup = parseLookup(rawLookup);
+      const record = await readRecord(lookup);
+      if (record === void 0) return void 0;
+      return Object.freeze({
+        encryptionKey: record.encryptionKey,
+        keyId: record.keyId,
+        privateKey: record.privateKey
+      });
+    },
+    async putPrivateKey(input) {
+      const record = parsePrivateKeyRecord({ ...input.key, publisher: input.publisher });
+      const lookup = parseLookup(record);
+      const path = pathFor(lookup);
+      const keyIdRecord = {
+        encryptionKey: record.encryptionKey,
+        keyId: record.keyId,
+        publisher: record.publisher
+      };
+      if (!await publishJsonFile(
+        keyIdPath(lookup),
+        keyIdRecord,
+        { directoryMode: 448, mode: 384 }
+      )) {
+        const existingKeyId = parseKeyIdRecord(await readJsonFileStrict(keyIdPath(lookup)));
+        if (stringifyJson(existingKeyId) !== stringifyJson(keyIdRecord)) {
+          throw new Error(`publisher encryption-key keyId collision for ${record.keyId}`);
+        }
+      }
+      if (await publishJsonFile(path, record, { directoryMode: 448, mode: 384 })) return "stored";
+      const existing = await readRecord(lookup);
+      if (stringifyJson(existing) !== stringifyJson(record)) {
+        throw new Error(`publisher encryption-key collision for ${record.encryptionKey}/${record.keyId}`);
+      }
+      return "duplicate";
+    }
+  };
+}
+function parseKeyIdRecord(value) {
+  if (typeof value !== "object" || value === null) throw new TypeError("invalid publisher encryption-key keyId record");
+  const record = value;
+  const keys = Object.keys(record).toSorted();
+  if (keys.join("|") !== "encryptionKey|keyId|publisher") {
+    throw new TypeError("invalid publisher encryption-key keyId record shape");
+  }
+  return {
+    encryptionKey: HashZod2.parse(record.encryptionKey),
+    keyId: HandshakeIdZod2.parse(record.keyId),
+    publisher: NormalizedAddressZod2.parse(record.publisher)
+  };
+}
+function parsePrivateKeyRecord(value) {
+  if (typeof value !== "object" || value === null) throw new TypeError("invalid publisher encryption-key record");
+  const record = value;
+  const keys = Object.keys(record).toSorted();
+  if (keys.join("|") !== "encryptionKey|keyId|privateKey|publisher") {
+    throw new TypeError("invalid publisher encryption-key record shape");
+  }
+  return {
+    encryptionKey: HashZod2.parse(record.encryptionKey),
+    keyId: HandshakeIdZod2.parse(record.keyId),
+    privateKey: Base64Url32BytesZod2.parse(record.privateKey),
+    publisher: NormalizedAddressZod2.parse(record.publisher)
+  };
+}
+
+// src/filesystemPublisherEndpointChallengeStore.ts
+import PATH7 from "node:path";
+import { endpointChallengeHash } from "@xyo-network/event-kit-protocol";
+import {
+  ChallengeNonceZod,
+  EndpointChallengeZod as EndpointChallengeZod2,
+  HashZod as HashZod3
+} from "@xyo-network/event-kit-schemas";
+function createFilesystemPublisherEndpointChallengeStore(options) {
+  const root = PATH7.resolve(options.path);
+  function statePath(challengeHash, state) {
+    return PATH7.join(root, challengeHash, `${state}.json`);
+  }
+  function noncePath(nonce) {
+    return PATH7.join(root, "nonces", `${nonce}.json`);
+  }
+  async function readState(challengeHash, state) {
+    const raw = await readJsonFileStrict(statePath(challengeHash, state));
+    if (raw === void 0) return void 0;
+    const record = await parseChallengeRecord(raw, state);
+    if (record.challengeHash !== challengeHash) throw new Error("challenge record does not match its immutable path");
+    return record;
+  }
+  async function current(challengeHash) {
+    return await readState(challengeHash, "verified") ?? await readState(challengeHash, "attempted") ?? await readState(challengeHash, "issued");
+  }
+  async function publish(record) {
+    return await publishJsonFile(
+      statePath(record.challengeHash, record.state),
+      record,
+      { directoryMode: 448, mode: 384 }
+    );
+  }
+  return {
+    async beginAttempt(input) {
+      const challengeHash = HashZod3.parse(input.challengeHash);
+      requireTime(input.nowSeconds);
+      const observed = await current(challengeHash);
+      if (observed === void 0) return { kind: "missing" };
+      if (observed.state === "verified") return { kind: "verified", record: observed };
+      if (observed.state === "attempted") return { kind: "already-attempted", record: observed };
+      if (!isLive(observed, input.nowSeconds)) return { kind: "expired", record: observed };
+      const attempted = { ...observed, state: "attempted" };
+      if (await publish(attempted)) return { kind: "started", record: attempted };
+      const winner = await current(challengeHash);
+      if (winner === void 0) throw new Error("challenge attempt winner vanished");
+      return winner.state === "verified" ? { kind: "verified", record: winner } : { kind: "already-attempted", record: winner };
+    },
+    async completeVerified(input) {
+      const challengeHash = HashZod3.parse(input.challengeHash);
+      const responseHash = HashZod3.parse(input.responseHash);
+      requireTime(input.nowSeconds);
+      const observed = await current(challengeHash);
+      if (observed === void 0) return { kind: "missing" };
+      if (observed.state === "verified") {
+        return observed.responseHash === responseHash ? { kind: "duplicate", record: observed } : { kind: "collision", record: observed };
+      }
+      if (observed.state !== "attempted") return { kind: "not-attempted", record: observed };
+      if (!isLive(observed, input.nowSeconds)) return { kind: "expired", record: observed };
+      const verified = {
+        ...observed,
+        responseHash,
+        state: "verified"
+      };
+      if (await publish(verified)) return { kind: "verified", record: verified };
+      const winner = await readState(challengeHash, "verified");
+      if (winner === void 0) throw new Error("verified challenge winner vanished");
+      return winner.responseHash === responseHash ? { kind: "duplicate", record: winner } : { kind: "collision", record: winner };
+    },
+    async get(rawHash) {
+      return await current(HashZod3.parse(rawHash));
+    },
+    async issue(input) {
+      const challenge = EndpointChallengeZod2.parse(input.challenge);
+      const challengeHash = HashZod3.parse(input.challengeHash);
+      if (await endpointChallengeHash(challenge) !== challengeHash) return { kind: "collision" };
+      const nonceRecord = { challengeHash, nonce: challenge.nonce };
+      if (!await publishJsonFile(
+        noncePath(challenge.nonce),
+        nonceRecord,
+        { directoryMode: 448, mode: 384 }
+      )) {
+        const existingNonce = parseNonceRecord(await readJsonFileStrict(noncePath(challenge.nonce)));
+        if (existingNonce.nonce !== challenge.nonce || existingNonce.challengeHash !== challengeHash) {
+          return { kind: "collision" };
+        }
+      }
+      const issued = {
+        challenge,
+        challengeHash,
+        state: "issued"
+      };
+      if (await publish(issued)) return { kind: "issued", record: issued };
+      const existing = await current(challengeHash);
+      if (existing === void 0) throw new Error("issued challenge winner vanished");
+      return sameChallenge(existing, issued) ? { kind: "duplicate", record: existing } : { kind: "collision" };
+    }
+  };
+}
+function parseNonceRecord(value) {
+  if (typeof value !== "object" || value === null) throw new TypeError("invalid endpoint-challenge nonce record");
+  const record = value;
+  const keys = Object.keys(record).toSorted();
+  if (keys.join("|") !== "challengeHash|nonce") throw new TypeError("invalid endpoint-challenge nonce record shape");
+  return {
+    challengeHash: HashZod3.parse(record.challengeHash),
+    nonce: ChallengeNonceZod.parse(record.nonce)
+  };
+}
+async function parseChallengeRecord(value, expectedState) {
+  if (typeof value !== "object" || value === null) throw new TypeError("invalid endpoint-challenge record");
+  const record = value;
+  const state = record.state;
+  if (state !== expectedState) throw new Error("endpoint-challenge record state does not match its path");
+  const challenge = EndpointChallengeZod2.parse(record.challenge);
+  const challengeHash = HashZod3.parse(record.challengeHash);
+  if (await endpointChallengeHash(challenge) !== challengeHash) throw new Error("endpoint-challenge record hash mismatch");
+  if (expectedState === "verified") {
+    return {
+      challenge,
+      challengeHash,
+      responseHash: HashZod3.parse(record.responseHash),
+      state: expectedState
+    };
+  }
+  if (record.responseHash !== void 0) throw new TypeError("unverified challenge record contains a response hash");
+  return {
+    challenge,
+    challengeHash,
+    state: expectedState
+  };
+}
+function sameChallenge(left, right) {
+  return left.challengeHash === right.challengeHash && stringifyJson(left.challenge) === stringifyJson(right.challenge);
+}
+function isLive(record, nowSeconds) {
+  return record.challenge.issuedAt <= nowSeconds && nowSeconds < record.challenge.expiresAt;
+}
+function requireTime(value) {
+  if (!Number.isSafeInteger(value) || value < 0) throw new TypeError("nowSeconds must be a nonnegative safe integer");
+}
+
+// src/handshakeClients.ts
+import {
+  beginPublisherEndpointChallengeAttempt,
+  completePublisherEndpointChallenge,
+  createEncryptedWakeSubscription,
+  createPublisherEncryptionKeyRevocation,
+  createPublisherService,
+  createPublisherServiceRevocation,
+  createWakeGrant,
+  createWakeGrantRevocation,
+  createWakeSubscriptionPlaintext,
+  createWakeSubscriptionRevocation,
+  endpointChallengeMatchesPublisherContext,
+  generatePublisherEncryptionKey,
+  handshakeObjectHash as handshakeObjectHash2,
+  issuePublisherEndpointChallenge,
+  validateAndDecryptPublisherSubscription,
+  withHandshakeObjectHash
+} from "@xyo-network/event-kit-protocol";
+import {
+  ChainIdZod as ChainIdZod2,
+  HandshakeIdZod as HandshakeIdZod3,
+  HashZod as HashZod4,
+  normalizeAddress,
+  NormalizedAddressZod as NormalizedAddressZod3
+} from "@xyo-network/event-kit-schemas";
+import { createEventKitHandshakeReadModel } from "@xyo-network/event-kit-statement-graph";
+import {
+  assertEventKitNetworkSession,
+  publishPublisherEncryptionKeyRevocation,
+  publishPublisherService,
+  publishPublisherServiceRevocation,
+  publishWakeGrantRevocation,
+  publishWakeSubscription,
+  publishWakeSubscriptionAcceptance,
+  publishWakeSubscriptionRevocation
+} from "@xyo-network/event-kit-xl1";
+var EventKitHandshakeClientError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "EventKitHandshakeClientError";
+    this.code = code;
+  }
+};
+function createSynchronizedEventKitHandshakeReader(options) {
+  const publisher = NormalizedAddressZod3.parse(options.publisher);
+  const chainId = ChainIdZod2.parse(options.session.chainId);
+  function assertIdentity() {
+    const checkpoint = options.replay.snapshot();
+    if (checkpoint.chainId !== chainId || checkpoint.network !== options.session.network || checkpoint.publisher !== publisher) {
+      throw new EventKitHandshakeClientError(
+        "identity-mismatch",
+        "Finalized replay identity does not match the pinned Event Kit network and publisher"
+      );
+    }
+  }
+  return Object.freeze({
+    chainId,
+    publisher,
+    async sync() {
+      await assertEventKitNetworkSession(options.session, options.chain);
+      assertIdentity();
+      const status = await options.replay.sync();
+      await assertEventKitNetworkSession(options.session, options.chain);
+      assertIdentity();
+      return Object.freeze({
+        ...status.blocked === void 0 ? {} : { blocked: status.blocked },
+        finalizedHead: status.finalizedHead,
+        indexedThrough: status.indexedThrough,
+        readModel: createEventKitHandshakeReadModel({
+          body: (hash) => options.replay.body(hash),
+          viewer: options.replay.viewer()
+        })
+      });
+    }
+  });
+}
+function createEventKitHandshakePublicationPort(transport) {
+  const chainId = ChainIdZod2.parse(transport.session.chainId);
+  const port = {
+    chainId,
+    async publishPublisherEncryptionKeyRevocation(input) {
+      return await publishPublisherEncryptionKeyRevocation({ ...transport, ...input });
+    },
+    async publishPublisherService(input) {
+      return await publishPublisherService({ ...transport, ...input });
+    },
+    async publishPublisherServiceRevocation(input) {
+      return await publishPublisherServiceRevocation({ ...transport, ...input });
+    },
+    async publishWakeGrantRevocation(input) {
+      return await publishWakeGrantRevocation({ ...transport, ...input });
+    },
+    async publishWakeSubscription(input) {
+      return await publishWakeSubscription({ ...transport, ...input });
+    },
+    async publishWakeSubscriptionAcceptance(input) {
+      return await publishWakeSubscriptionAcceptance({ ...transport, ...input });
+    },
+    async publishWakeSubscriptionRevocation(input) {
+      return await publishWakeSubscriptionRevocation({ ...transport, ...input });
+    },
+    async source() {
+      const raw = String(await transport.signer.address());
+      const normalized = NormalizedAddressZod3.parse(normalizeAddress(raw));
+      if (raw !== normalized) {
+        throw new EventKitHandshakeClientError(
+          "identity-mismatch",
+          "XL1 publication signer address is not canonical lowercase hexadecimal without 0x"
+        );
+      }
+      return normalized;
+    }
+  };
+  return Object.freeze(port);
+}
+function nextBlock(head) {
+  if (!Number.isSafeInteger(head) || head < 0 || head === Number.MAX_SAFE_INTEGER) {
+    throw new RangeError("finalized head cannot advance to a JSON-safe block number");
+  }
+  return head + 1;
+}
+function samplePublisherClock(nowSeconds) {
+  const sampled = nowSeconds();
+  if (!Number.isSafeInteger(sampled) || sampled < 0) {
+    throw new EventKitHandshakeClientError(
+      "challenge-rejected",
+      "Publisher clock must return a nonnegative JSON-safe Unix second"
+    );
+  }
+  return sampled;
+}
+function readySnapshot(snapshot) {
+  if (snapshot.blocked !== void 0) {
+    throw new EventKitHandshakeClientError("projection-blocked", "Finalized handshake replay is blocked");
+  }
+  if (snapshot.indexedThrough !== snapshot.finalizedHead) {
+    throw new EventKitHandshakeClientError("projection-stale", "Finalized handshake replay is not caught up");
+  }
+  return snapshot;
+}
+function serviceQuery(reader, snapshot, serviceId) {
+  return {
+    chainId: reader.chainId,
+    finalizedHead: snapshot.finalizedHead,
+    publisher: reader.publisher,
+    ...serviceId === void 0 ? {} : { serviceId }
+  };
+}
+function requireService(discovery) {
+  if (!discovery.ok) {
+    throw new EventKitHandshakeClientError(
+      "service-unavailable",
+      `Publisher service is unavailable: ${discovery.reason}`
+    );
+  }
+  return discovery;
+}
+function requireExpectedService(discovery, expected) {
+  const expectedHash = HashZod4.parse(expected);
+  if (discovery.service.objectHash !== expectedHash) {
+    throw new EventKitHandshakeClientError(
+      "service-mismatch",
+      "Currently selected publisher service does not match the expected object hash"
+    );
+  }
+  return expectedHash;
+}
+function assertPublicationIdentity(publication, reader) {
+  if (publication.chainId !== reader.chainId) {
+    throw new EventKitHandshakeClientError(
+      "identity-mismatch",
+      "Publication transport chain ID does not match the synchronized handshake reader"
+    );
+  }
+}
+async function assertPublicationSource(publication, expected) {
+  if (await publication.source() !== expected) {
+    throw new EventKitHandshakeClientError(
+      "identity-mismatch",
+      "Publication signer does not match the required handshake Claim source"
+    );
+  }
+}
+function intentLookup(reader, kind, operationId, source) {
+  return {
+    chainId: reader.chainId,
+    kind,
+    operationId,
+    publisher: reader.publisher,
+    source
+  };
+}
+function mutationIntentError(error) {
+  return error instanceof HandshakeMutationIntentConflictError ? new EventKitHandshakeClientError("mutation-intent-conflict", error.message) : new EventKitHandshakeClientError(
+    "mutation-intent-unavailable",
+    "Handshake mutation intent storage is unavailable or invalid"
+  );
+}
+async function loadMutationIntent(store, reader, kind, operationId, source, requestFingerprint) {
+  try {
+    const existing = await store.get(intentLookup(reader, kind, operationId, source));
+    if (existing === void 0) return void 0;
+    if (existing.kind !== kind || existing.requestFingerprint !== requestFingerprint) {
+      throw new HandshakeMutationIntentConflictError();
+    }
+    return existing;
+  } catch (error) {
+    throw mutationIntentError(error);
+  }
+}
+async function persistMutationIntent(store, intent) {
+  try {
+    return await store.getOrCreate(intent);
+  } catch (error) {
+    throw mutationIntentError(error);
+  }
+}
+async function publisherServiceRequestFingerprint(input) {
+  return await handshakeMutationRequestFingerprint({
+    expiresAtBlock: input.expiresAtBlock ?? null,
+    maxBlocksPerWake: input.maxBlocksPerWake,
+    maxSubscriptionLifetimeBlocks: input.maxSubscriptionLifetimeBlocks,
+    validFromBlock: input.validFromBlock ?? null
+  });
+}
+async function publisherRotationRequestFingerprint(input) {
+  return await handshakeMutationRequestFingerprint({
+    expiresAtBlock: input.expiresAtBlock ?? null,
+    keyExpiresAtBlock: input.keyExpiresAtBlock ?? null,
+    maxBlocksPerWake: input.maxBlocksPerWake ?? null,
+    maxSubscriptionLifetimeBlocks: input.maxSubscriptionLifetimeBlocks ?? null,
+    service: HashZod4.parse(input.service),
+    validFromBlock: input.validFromBlock ?? null
+  });
+}
+async function subscriberSubscriptionRequestFingerprint(input) {
+  return await handshakeMutationRequestFingerprint({
+    audience: input.audience,
+    challengeSecret: input.challengeSecret,
+    deploymentId: input.deploymentId,
+    endpoint: input.endpoint,
+    expiresAtBlock: input.expiresAtBlock,
+    grantId: input.grantId ?? null,
+    maxBlocksPerWake: input.maxBlocksPerWake ?? null,
+    queueId: input.queueId ?? null,
+    revision: input.revision ?? null,
+    subscriptionId: input.subscriptionId ?? null,
+    supersedes: input.supersedes ?? null
+  });
+}
+async function exactMutationRequestFingerprint(value) {
+  return await handshakeMutationRequestFingerprint(value);
+}
+function protocolCandidate(reader, discovery, candidate, keys) {
+  return {
+    chainId: reader.chainId,
+    finalizedHead: discovery.finalizedHead,
+    grant: {
+      body: candidate.tuple.grant.body,
+      objectHash: HashZod4.parse(candidate.tuple.grant.objectHash)
+    },
+    key: {
+      body: candidate.key.body,
+      objectHash: HashZod4.parse(candidate.key.objectHash)
+    },
+    keys,
+    publisher: reader.publisher,
+    service: {
+      body: candidate.tuple.service.body,
+      objectHash: HashZod4.parse(candidate.tuple.service.objectHash)
+    },
+    subscriber: NormalizedAddressZod3.parse(candidate.subscriber),
+    subscription: {
+      body: candidate.tuple.subscription.body,
+      objectHash: HashZod4.parse(candidate.tuple.subscription.objectHash)
+    },
+    tupleBlock: candidate.tuple.tupleEvent.block,
+    tupleObjectHashes: [
+      HashZod4.parse(candidate.tuple.service.objectHash),
+      HashZod4.parse(candidate.tuple.grant.objectHash),
+      HashZod4.parse(candidate.tuple.subscription.objectHash)
+    ],
+    tupleSubject: reader.publisher
+  };
+}
+function validationError(reason) {
+  return new EventKitHandshakeClientError(
+    "subscription-invalid",
+    `Publisher subscription candidate failed validation: ${reason}`
+  );
+}
+function challengeError(result) {
+  const reason = result.ok ? "unknown" : result.reason;
+  return new EventKitHandshakeClientError("challenge-rejected", `Endpoint challenge was rejected: ${reason}`);
+}
+function createPublisherHandshakeClient(options) {
+  assertPublicationIdentity(options.publication, options.reader);
+  const serviceId = options.serviceId === void 0 ? void 0 : HandshakeIdZod3.parse(options.serviceId);
+  async function snapshot() {
+    return readySnapshot(await options.reader.sync());
+  }
+  async function discovery(current) {
+    return await current.readModel.discoverPublisherService(serviceQuery(options.reader, current, serviceId));
+  }
+  async function candidateDiscovery(selector = {}) {
+    const current = await snapshot();
+    return await current.readModel.acceptanceCandidates({
+      ...serviceQuery(options.reader, current, serviceId),
+      ...selector.subscriber === void 0 ? {} : { subscriber: NormalizedAddressZod3.parse(selector.subscriber) },
+      ...selector.subscriptionId === void 0 ? {} : { subscriptionId: HandshakeIdZod3.parse(selector.subscriptionId) }
+    });
+  }
+  async function resolveCandidate(selector) {
+    const found = await candidateDiscovery(selector);
+    if (!found.ok) throw new EventKitHandshakeClientError("service-unavailable", `Publisher service is unavailable: ${found.reason}`);
+    const subscriber = NormalizedAddressZod3.parse(selector.subscriber);
+    const subscription = selector.subscription === void 0 ? void 0 : HashZod4.parse(selector.subscription);
+    const candidates = found.candidates.filter((candidate2) => candidate2.subscriber === subscriber && (subscription === void 0 || candidate2.tuple.subscription.objectHash === subscription));
+    if (candidates.length === 0) {
+      throw new EventKitHandshakeClientError("candidate-not-found", "No exact finalized acceptance candidate was found");
+    }
+    if (candidates.length !== 1) {
+      throw new EventKitHandshakeClientError("candidate-ambiguous", "More than one finalized acceptance candidate matched");
+    }
+    const candidate = candidates[0];
+    const validated = await validateAndDecryptPublisherSubscription(
+      protocolCandidate(options.reader, found, candidate, options.keys)
+    );
+    if (!validated.ok) throw validationError(validated.reason);
+    return { candidate, validated };
+  }
+  async function candidateForChallenge(challenge) {
+    const resolved = await resolveCandidate({
+      subscriber: challenge.subscriber,
+      subscription: challenge.subscription
+    });
+    if (!endpointChallengeMatchesPublisherContext(challenge, resolved.validated.context)) {
+      throw new EventKitHandshakeClientError(
+        "challenge-context-invalid",
+        "Endpoint challenge does not match the current finalized subscription candidate"
+      );
+    }
+    return resolved;
+  }
+  async function reconcileAcceptance(acceptance, publication, subscriber, subscription) {
+    let current;
+    try {
+      current = await options.reader.sync();
+    } catch {
+      return Object.freeze({ reason: "synchronization-failed", status: "unavailable" });
+    }
+    if (current.blocked !== void 0) {
+      return Object.freeze({
+        finalizedHead: current.finalizedHead,
+        indexedThrough: current.indexedThrough,
+        reason: "projection-blocked",
+        status: "unavailable"
+      });
+    }
+    if (current.indexedThrough !== current.finalizedHead) {
+      return Object.freeze({
+        finalizedHead: current.finalizedHead,
+        indexedThrough: current.indexedThrough,
+        reason: "projection-stale",
+        status: "unavailable"
+      });
+    }
+    if (current.finalizedHead < publication.finalizedBlock) {
+      return Object.freeze({
+        finalizedHead: current.finalizedHead,
+        indexedThrough: current.indexedThrough,
+        reason: "publication-not-indexed",
+        status: "unavailable"
+      });
+    }
+    let view;
+    try {
+      view = await current.readModel.publisher(serviceQuery(options.reader, current, serviceId));
+    } catch {
+      return Object.freeze({
+        finalizedHead: current.finalizedHead,
+        indexedThrough: current.indexedThrough,
+        reason: "synchronization-failed",
+        status: "unavailable"
+      });
+    }
+    if (!view.ok) {
+      return Object.freeze({
+        finalizedHead: view.finalizedHead,
+        indexedThrough: view.indexedThrough,
+        reason: view.reason,
+        status: "unavailable"
+      });
+    }
+    const matches = view.subscriptions.filter((item) => item.subscriber === subscriber && item.tuples.some((tuple) => tuple.subscription.objectHash === subscription));
+    if (matches.length === 0) {
+      return Object.freeze({
+        finalizedHead: view.finalizedHead,
+        indexedThrough: view.indexedThrough,
+        status: "not-found"
+      });
+    }
+    if (matches.length !== 1) {
+      return Object.freeze({
+        finalizedHead: view.finalizedHead,
+        indexedThrough: view.indexedThrough,
+        reason: "ambiguous-lifecycle",
+        status: "unavailable"
+      });
+    }
+    const lifecycle = matches[0];
+    const active = lifecycle.state === "active" && lifecycle.selectedSubscription === subscription && lifecycle.acceptance?.objectHash === acceptance;
+    return Object.freeze({
+      finalizedHead: view.finalizedHead,
+      indexedThrough: view.indexedThrough,
+      lifecycle,
+      status: active ? "active" : "not-active"
+    });
+  }
+  async function publishAcceptanceIntent(intent, intentDisposition) {
+    const [acceptanceHash, responseHash] = await Promise.all([
+      handshakeObjectHash2(intent.acceptance),
+      handshakeObjectHash2(intent.response)
+    ]);
+    const publication = await options.publication.publishWakeSubscriptionAcceptance({
+      acceptance: intent.acceptance,
+      challenge: intent.challenge,
+      operationId: intent.operationId,
+      response: intent.response
+    });
+    const reconciliation = await reconcileAcceptance(
+      acceptanceHash,
+      publication,
+      intent.challenge.subscriber,
+      intent.challenge.subscription
+    );
+    return Object.freeze({
+      acceptance: Object.freeze({ body: intent.acceptance, objectHash: acceptanceHash }),
+      challenge: intent.operationId,
+      intentDisposition,
+      operationId: intent.operationId,
+      publication,
+      reconciliation,
+      response: responseHash,
+      subscriber: intent.challenge.subscriber,
+      subscription: intent.challenge.subscription
+    });
+  }
+  async function publishPublisherServiceIntent(intent, intentDisposition) {
+    let keyCustody;
+    try {
+      keyCustody = await options.keys.putPrivateKey({
+        key: intent.privateKey,
+        publisher: options.reader.publisher
+      });
+    } catch {
+      throw new EventKitHandshakeClientError(
+        "key-custody-failed",
+        "Publisher encryption private key was not durably retained; publication was not attempted"
+      );
+    }
+    const [keyHash, serviceHash] = await Promise.all([
+      handshakeObjectHash2(intent.encryptionKey),
+      handshakeObjectHash2(intent.service)
+    ]);
+    const publication = await options.publication.publishPublisherService({
+      encryptionKeys: [intent.encryptionKey],
+      operationId: intent.operationId,
+      service: intent.service
+    });
+    return Object.freeze({
+      encryptionKey: Object.freeze({ body: intent.encryptionKey, objectHash: keyHash }),
+      intentDisposition,
+      keyCustody,
+      operationId: intent.operationId,
+      publication,
+      service: Object.freeze({ body: intent.service, objectHash: serviceHash })
+    });
+  }
+  const client = {
+    async acceptanceCandidates(selector = {}) {
+      const found = await candidateDiscovery(selector);
+      if (!found.ok || selector.subscription === void 0) return found;
+      const subscription = HashZod4.parse(selector.subscription);
+      return Object.freeze({
+        ...found,
+        candidates: found.candidates.filter(
+          (candidate) => candidate.tuple.subscription.objectHash === subscription
+        )
+      });
+    },
+    async beginChallenge(input) {
+      const challengeHash = HashZod4.parse(input.challengeHash);
+      const record = await options.challenges.get(challengeHash);
+      if (record === void 0) return { kind: "missing" };
+      const resolved = await candidateForChallenge(record.challenge);
+      const begun = await beginPublisherEndpointChallengeAttempt({
+        challengeHash,
+        nowSeconds: samplePublisherClock(input.nowSeconds),
+        store: options.challenges
+      });
+      if (begun.kind !== "started") {
+        if (begun.kind === "store-invalid" || begun.kind === "store-unavailable") {
+          throw new EventKitHandshakeClientError("challenge-rejected", `Endpoint challenge store failed: ${begun.kind}`);
+        }
+        return { kind: begun.kind };
+      }
+      return Object.freeze({
+        challenge: begun.record.challenge,
+        challengeHash,
+        kind: "started",
+        subscriber: resolved.validated.context.subscriber,
+        subscription: resolved.validated.context.subscription,
+        target: Object.freeze({
+          audience: resolved.validated.plaintext.audience,
+          endpoint: resolved.validated.plaintext.endpoint
+        })
+      });
+    },
+    async completeChallengeAndAccept(input) {
+      await assertPublicationSource(options.publication, options.reader.publisher);
+      const challengeHash = HashZod4.parse(input.challengeHash);
+      const subscriber = NormalizedAddressZod3.parse(input.subscriber);
+      const subscription = HashZod4.parse(input.subscription);
+      const record = await options.challenges.get(challengeHash);
+      if (record === void 0) {
+        throw new EventKitHandshakeClientError("challenge-not-found", "Endpoint challenge was not found");
+      }
+      if (record.challenge.subscriber !== subscriber || record.challenge.subscription !== subscription) {
+        throw new EventKitHandshakeClientError(
+          "challenge-context-invalid",
+          "Stored endpoint challenge does not match the caller expected subscriber and subscription"
+        );
+      }
+      const responseHash = await handshakeObjectHash2(input.response);
+      const requestFingerprint = await exactMutationRequestFingerprint({
+        challengeHash,
+        responseHash,
+        subscriber,
+        subscription
+      });
+      const existing = await loadMutationIntent(
+        options.intents,
+        options.reader,
+        "publisher-subscription-accept",
+        challengeHash,
+        options.reader.publisher,
+        requestFingerprint
+      );
+      if (existing !== void 0) {
+        if (record.state !== "verified" || record.responseHash !== responseHash) {
+          throw new EventKitHandshakeClientError(
+            "mutation-intent-conflict",
+            "Acceptance intent does not match the durable verified challenge decision"
+          );
+        }
+        return await publishAcceptanceIntent(existing, "resumed");
+      }
+      const resolved = await candidateForChallenge(record.challenge);
+      const completed = await completePublisherEndpointChallenge({
+        challenge: record.challenge,
+        nowSeconds: samplePublisherClock(input.nowSeconds),
+        response: input.response,
+        store: options.challenges,
+        subscription: resolved.validated
+      });
+      if (!completed.ok) throw challengeError(completed);
+      const concurrentlyPersisted = await loadMutationIntent(
+        options.intents,
+        options.reader,
+        "publisher-subscription-accept",
+        challengeHash,
+        options.reader.publisher,
+        requestFingerprint
+      );
+      if (concurrentlyPersisted !== void 0) return await publishAcceptanceIntent(concurrentlyPersisted, "resumed");
+      let current;
+      try {
+        current = await candidateForChallenge(record.challenge);
+      } catch (error) {
+        const recovered = await loadMutationIntent(
+          options.intents,
+          options.reader,
+          "publisher-subscription-accept",
+          challengeHash,
+          options.reader.publisher,
+          requestFingerprint
+        );
+        if (recovered !== void 0) return await publishAcceptanceIntent(recovered, "resumed");
+        throw error;
+      }
+      if (!endpointChallengeMatchesPublisherContext(record.challenge, current.validated.context)) {
+        throw new EventKitHandshakeClientError(
+          "challenge-context-invalid",
+          "Endpoint challenge candidate changed before acceptance publication"
+        );
+      }
+      const resolvedIntent = await persistMutationIntent(options.intents, {
+        acceptance: completed.acceptance,
+        chainId: options.reader.chainId,
+        challenge: record.challenge,
+        kind: "publisher-subscription-accept",
+        operationId: challengeHash,
+        publisher: options.reader.publisher,
+        requestFingerprint,
+        response: input.response,
+        source: options.reader.publisher,
+        version: 1
+      });
+      return await publishAcceptanceIntent(resolvedIntent.intent, resolvedIntent.disposition);
+    },
+    async issueChallenge(input) {
+      const resolved = await resolveCandidate(input);
+      const issued = await issuePublisherEndpointChallenge({
+        issuedAt: input.issuedAt,
+        ...input.lifetimeSeconds === void 0 ? {} : { lifetimeSeconds: input.lifetimeSeconds },
+        store: options.challenges,
+        subscription: resolved.validated
+      });
+      if (!issued.ok) {
+        throw new EventKitHandshakeClientError("challenge-rejected", `Endpoint challenge issue failed: ${issued.reason}`);
+      }
+      return Object.freeze({
+        challenge: issued.challenge,
+        challengeHash: issued.challengeHash,
+        disposition: issued.disposition,
+        subscriber: resolved.validated.context.subscriber,
+        subscription: resolved.validated.context.subscription
+      });
+    },
+    async key() {
+      const current = await options.reader.sync();
+      return await current.readModel.discoverPublisherService(serviceQuery(options.reader, current, serviceId));
+    },
+    async publishService(input) {
+      await assertPublicationSource(options.publication, options.reader.publisher);
+      if (serviceId !== void 0) {
+        throw new EventKitHandshakeClientError(
+          "service-root-requires-fresh-id",
+          "Root service publication requires an unconfigured client so a fresh serviceId is generated"
+        );
+      }
+      const operationId = HandshakeIdZod3.parse(input.operationId);
+      const requestFingerprint = await publisherServiceRequestFingerprint(input);
+      const priorIntent = await loadMutationIntent(
+        options.intents,
+        options.reader,
+        "publisher-service-publish",
+        operationId,
+        options.reader.publisher,
+        requestFingerprint
+      );
+      if (priorIntent !== void 0) return await publishPublisherServiceIntent(priorIntent, "resumed");
+      const current = await snapshot();
+      const existing = await discovery(current);
+      if (existing.ok) {
+        throw new EventKitHandshakeClientError(
+          "service-already-exists",
+          "An active publisher service already exists; rotate its key to publish a successor"
+        );
+      }
+      if (existing.reason !== "service-not-found") {
+        throw new EventKitHandshakeClientError("service-unavailable", `Cannot declare service: ${existing.reason}`);
+      }
+      const validFromBlock = input.validFromBlock ?? nextBlock(current.finalizedHead);
+      const generated = await generatePublisherEncryptionKey({ validFromBlock });
+      const service = createPublisherService({
+        encryptionKeys: [generated.descriptorHash],
+        ...input.expiresAtBlock === void 0 ? {} : { expiresAtBlock: input.expiresAtBlock },
+        maxBlocksPerWake: input.maxBlocksPerWake,
+        maxSubscriptionLifetimeBlocks: input.maxSubscriptionLifetimeBlocks,
+        preferredEncryptionKey: generated.descriptorHash,
+        validFromBlock
+      });
+      const resolvedIntent = await persistMutationIntent(options.intents, {
+        chainId: options.reader.chainId,
+        encryptionKey: generated.descriptor,
+        kind: "publisher-service-publish",
+        operationId,
+        privateKey: generated.privateKey,
+        publisher: options.reader.publisher,
+        requestFingerprint,
+        service,
+        source: options.reader.publisher,
+        version: 1
+      });
+      return await publishPublisherServiceIntent(resolvedIntent.intent, resolvedIntent.disposition);
+    },
+    async retireEncryptionKey(key) {
+      await assertPublicationSource(options.publication, options.reader.publisher);
+      const keyHash = HashZod4.parse(key);
+      const requestFingerprint = await exactMutationRequestFingerprint({ key: keyHash });
+      let resolvedIntent = await loadMutationIntent(
+        options.intents,
+        options.reader,
+        "publisher-encryption-key-retire",
+        keyHash,
+        options.reader.publisher,
+        requestFingerprint
+      );
+      let intentDisposition = "resumed";
+      if (resolvedIntent === void 0) {
+        const current = await snapshot();
+        const selected = requireService(await discovery(current));
+        if (selected.key.objectHash !== keyHash || !selected.service.body.encryptionKeys.includes(keyHash) || selected.service.body.preferredEncryptionKey !== keyHash) {
+          throw new EventKitHandshakeClientError(
+            "key-mismatch",
+            "Encryption key does not match the exact current preferred descriptor evidence"
+          );
+        }
+        const persisted = await persistMutationIntent(options.intents, {
+          chainId: options.reader.chainId,
+          kind: "publisher-encryption-key-retire",
+          operationId: keyHash,
+          publisher: options.reader.publisher,
+          requestFingerprint,
+          revocation: createPublisherEncryptionKeyRevocation(keyHash),
+          source: options.reader.publisher,
+          version: 1
+        });
+        resolvedIntent = persisted.intent;
+        intentDisposition = persisted.disposition;
+      }
+      const revocation = await withHandshakeObjectHash(resolvedIntent.revocation);
+      const publication = await options.publication.publishPublisherEncryptionKeyRevocation({
+        operationId: keyHash,
+        revocation: resolvedIntent.revocation
+      });
+      return Object.freeze({
+        intentDisposition,
+        key: keyHash,
+        operationId: keyHash,
+        publication,
+        revocation
+      });
+    },
+    async retireService(expectedService) {
+      await assertPublicationSource(options.publication, options.reader.publisher);
+      const service = HashZod4.parse(expectedService);
+      const requestFingerprint = await exactMutationRequestFingerprint({ service });
+      let resolvedIntent = await loadMutationIntent(
+        options.intents,
+        options.reader,
+        "publisher-service-retire",
+        service,
+        options.reader.publisher,
+        requestFingerprint
+      );
+      let intentDisposition = "resumed";
+      if (resolvedIntent === void 0) {
+        const current = await snapshot();
+        const selected = requireService(await discovery(current));
+        requireExpectedService(selected, service);
+        const persisted = await persistMutationIntent(options.intents, {
+          chainId: options.reader.chainId,
+          kind: "publisher-service-retire",
+          operationId: service,
+          publisher: options.reader.publisher,
+          requestFingerprint,
+          revocation: createPublisherServiceRevocation(service),
+          source: options.reader.publisher,
+          version: 1
+        });
+        resolvedIntent = persisted.intent;
+        intentDisposition = persisted.disposition;
+      }
+      const revocation = await withHandshakeObjectHash(resolvedIntent.revocation);
+      const publication = await options.publication.publishPublisherServiceRevocation({
+        operationId: service,
+        revocation: resolvedIntent.revocation
+      });
+      return Object.freeze({
+        intentDisposition,
+        operationId: service,
+        publication,
+        revocation,
+        service
+      });
+    },
+    async rotateEncryptionKey(input) {
+      await assertPublicationSource(options.publication, options.reader.publisher);
+      const operationId = HandshakeIdZod3.parse(input.operationId);
+      const requestFingerprint = await publisherRotationRequestFingerprint(input);
+      const priorIntent = await loadMutationIntent(
+        options.intents,
+        options.reader,
+        "publisher-service-rotate-key",
+        operationId,
+        options.reader.publisher,
+        requestFingerprint
+      );
+      if (priorIntent !== void 0) return await publishPublisherServiceIntent(priorIntent, "resumed");
+      const current = await snapshot();
+      const selected = requireService(await discovery(current));
+      requireExpectedService(selected, input.service);
+      const validFromBlock = input.validFromBlock ?? nextBlock(current.finalizedHead);
+      const generated = await generatePublisherEncryptionKey({
+        ...input.keyExpiresAtBlock === void 0 ? {} : { expiresAtBlock: input.keyExpiresAtBlock },
+        validFromBlock
+      });
+      const service = createPublisherService({
+        encryptionKeys: [generated.descriptorHash],
+        ...input.expiresAtBlock === void 0 ? selected.service.body.expiresAtBlock === void 0 ? {} : { expiresAtBlock: selected.service.body.expiresAtBlock } : { expiresAtBlock: input.expiresAtBlock },
+        maxBlocksPerWake: input.maxBlocksPerWake ?? selected.service.body.limits.maxBlocksPerWake,
+        maxSubscriptionLifetimeBlocks: input.maxSubscriptionLifetimeBlocks ?? selected.service.body.limits.maxSubscriptionLifetimeBlocks,
+        preferredEncryptionKey: generated.descriptorHash,
+        revision: selected.service.body.revision + 1,
+        serviceId: selected.service.body.serviceId,
+        supersedes: HashZod4.parse(selected.service.objectHash),
+        validFromBlock
+      });
+      const resolvedIntent = await persistMutationIntent(options.intents, {
+        chainId: options.reader.chainId,
+        encryptionKey: generated.descriptor,
+        kind: "publisher-service-rotate-key",
+        operationId,
+        privateKey: generated.privateKey,
+        publisher: options.reader.publisher,
+        requestFingerprint,
+        selectedKey: HashZod4.parse(selected.key.objectHash),
+        selectedService: HashZod4.parse(selected.service.objectHash),
+        service,
+        source: options.reader.publisher,
+        version: 1
+      });
+      return await publishPublisherServiceIntent(resolvedIntent.intent, resolvedIntent.disposition);
+    },
+    async service() {
+      const current = await options.reader.sync();
+      return await current.readModel.discoverPublisherService(serviceQuery(options.reader, current, serviceId));
+    },
+    async subscriptions() {
+      const current = await options.reader.sync();
+      return await current.readModel.publisher(serviceQuery(options.reader, current, serviceId));
+    }
+  };
+  return Object.freeze(client);
+}
+function tupleHashes(view) {
+  const tuples = view.subscriptions.flatMap((subscription) => subscription.tuples);
+  return {
+    grants: new Set(tuples.map((tuple) => tuple.grant.objectHash)),
+    subscriptions: new Set(tuples.map((tuple) => tuple.subscription.objectHash))
+  };
+}
+function createSubscriberHandshakeClient(options) {
+  assertPublicationIdentity(options.publication, options.reader);
+  const subscriber = NormalizedAddressZod3.parse(options.subscriber);
+  const serviceId = options.serviceId === void 0 ? void 0 : HandshakeIdZod3.parse(options.serviceId);
+  async function snapshot() {
+    return readySnapshot(await options.reader.sync());
+  }
+  async function serviceAt(current) {
+    return requireService(
+      await current.readModel.discoverPublisherService(serviceQuery(options.reader, current, serviceId))
+    );
+  }
+  async function lookup(subscriptionId) {
+    const current = await options.reader.sync();
+    return await lookupAt(current, subscriptionId);
+  }
+  async function lookupAt(current, subscriptionId) {
+    return await current.readModel.subscriber({
+      ...serviceQuery(options.reader, current, serviceId),
+      subscriber,
+      ...subscriptionId === void 0 ? {} : { subscriptionId: HandshakeIdZod3.parse(subscriptionId) }
+    });
+  }
+  async function validateRevision(current, input) {
+    const revision = input.revision ?? 1;
+    if (revision === 1) {
+      if (input.supersedes !== void 0) {
+        throw new EventKitHandshakeClientError(
+          "subscription-invalid",
+          "Subscription revision 1 must not declare supersedes"
+        );
+      }
+      if (input.subscriptionId === void 0) return;
+      const view2 = await lookupAt(current, input.subscriptionId);
+      if (!view2.ok) {
+        throw new EventKitHandshakeClientError("service-unavailable", `Cannot validate subscription identity: ${view2.reason}`);
+      }
+      if (view2.subscriptions.some((item) => item.subscriptionId === input.subscriptionId)) {
+        throw new EventKitHandshakeClientError(
+          "subscription-invalid",
+          "Subscription revision 1 would duplicate an existing finalized stable identity"
+        );
+      }
+      return;
+    }
+    if (input.subscriptionId === void 0 || input.supersedes === void 0) {
+      throw new EventKitHandshakeClientError(
+        "subscription-invalid",
+        "A replacement subscription requires subscriptionId and supersedes"
+      );
+    }
+    const view = await lookupAt(current, input.subscriptionId);
+    if (!view.ok) {
+      throw new EventKitHandshakeClientError("service-unavailable", `Cannot validate subscription revision: ${view.reason}`);
+    }
+    const lifecycles = view.subscriptions.filter((item) => item.subscriptionId === input.subscriptionId);
+    if (lifecycles.length !== 1) {
+      throw new EventKitHandshakeClientError(
+        "subscription-invalid",
+        "Replacement subscription does not resolve one finalized stable identity"
+      );
+    }
+    if (lifecycles[0].state === "rejected") {
+      throw new EventKitHandshakeClientError(
+        "subscription-invalid",
+        "Replacement subscription cannot extend a rejected finalized revision chain"
+      );
+    }
+    const highestRevision = Math.max(...lifecycles[0].tuples.map((tuple) => tuple.subscription.body.revision));
+    const latest = lifecycles[0].tuples.filter((tuple) => tuple.subscription.body.revision === highestRevision);
+    if (latest.length !== 1 || revision !== highestRevision + 1 || latest[0].subscription.objectHash !== input.supersedes) {
+      throw new EventKitHandshakeClientError(
+        "subscription-invalid",
+        "Replacement subscription revision and supersedes must extend the exact finalized chain tip"
+      );
+    }
+  }
+  async function publishSubscriberSubscriptionIntent(intent, intentDisposition) {
+    const [grantHash, subscriptionHash] = await Promise.all([
+      handshakeObjectHash2(intent.grant),
+      handshakeObjectHash2(intent.subscription)
+    ]);
+    const publication = await options.publication.publishWakeSubscription({
+      encryptionKey: intent.encryptionKey,
+      grant: intent.grant,
+      operationId: intent.operationId,
+      service: intent.service,
+      subscription: intent.subscription
+    });
+    return Object.freeze({
+      grant: Object.freeze({ body: intent.grant, objectHash: grantHash }),
+      intentDisposition,
+      operationId: intent.operationId,
+      publication,
+      service: intent.selectedService,
+      subscription: Object.freeze({ body: intent.subscription, objectHash: subscriptionHash })
+    });
+  }
+  const client = {
+    async revokeGrant(grant) {
+      await assertPublicationSource(options.publication, subscriber);
+      const grantHash = HashZod4.parse(grant);
+      const requestFingerprint = await exactMutationRequestFingerprint({ grant: grantHash });
+      let resolvedIntent = await loadMutationIntent(
+        options.intents,
+        options.reader,
+        "subscriber-grant-revoke",
+        grantHash,
+        subscriber,
+        requestFingerprint
+      );
+      let intentDisposition = "resumed";
+      if (resolvedIntent === void 0) {
+        const current = await snapshot();
+        const view = await current.readModel.subscriber({ ...serviceQuery(options.reader, current, serviceId), subscriber });
+        if (!view.ok || !tupleHashes(view).grants.has(grantHash)) {
+          throw new EventKitHandshakeClientError(
+            "subscription-not-found",
+            "Grant is not present in this subscriber finalization view"
+          );
+        }
+        const persisted = await persistMutationIntent(options.intents, {
+          chainId: options.reader.chainId,
+          kind: "subscriber-grant-revoke",
+          operationId: grantHash,
+          publisher: options.reader.publisher,
+          requestFingerprint,
+          revocation: createWakeGrantRevocation(grantHash),
+          source: subscriber,
+          version: 1
+        });
+        resolvedIntent = persisted.intent;
+        intentDisposition = persisted.disposition;
+      }
+      const revocation = await withHandshakeObjectHash(resolvedIntent.revocation);
+      const publication = await options.publication.publishWakeGrantRevocation({
+        operationId: grantHash,
+        publisher: options.reader.publisher,
+        revocation: resolvedIntent.revocation
+      });
+      return Object.freeze({
+        grant: grantHash,
+        intentDisposition,
+        operationId: grantHash,
+        publication,
+        revocation
+      });
+    },
+    async revokeSubscription(subscription) {
+      await assertPublicationSource(options.publication, subscriber);
+      const subscriptionHash = HashZod4.parse(subscription);
+      const requestFingerprint = await exactMutationRequestFingerprint({ subscription: subscriptionHash });
+      let resolvedIntent = await loadMutationIntent(
+        options.intents,
+        options.reader,
+        "subscriber-subscription-revoke",
+        subscriptionHash,
+        subscriber,
+        requestFingerprint
+      );
+      let intentDisposition = "resumed";
+      if (resolvedIntent === void 0) {
+        const current = await snapshot();
+        const view = await current.readModel.subscriber({ ...serviceQuery(options.reader, current, serviceId), subscriber });
+        if (!view.ok || !tupleHashes(view).subscriptions.has(subscriptionHash)) {
+          throw new EventKitHandshakeClientError(
+            "subscription-not-found",
+            "Subscription is not present in this subscriber finalization view"
+          );
+        }
+        const persisted = await persistMutationIntent(options.intents, {
+          chainId: options.reader.chainId,
+          kind: "subscriber-subscription-revoke",
+          operationId: subscriptionHash,
+          publisher: options.reader.publisher,
+          requestFingerprint,
+          revocation: createWakeSubscriptionRevocation(subscriptionHash),
+          source: subscriber,
+          version: 1
+        });
+        resolvedIntent = persisted.intent;
+        intentDisposition = persisted.disposition;
+      }
+      const revocation = await withHandshakeObjectHash(resolvedIntent.revocation);
+      const publication = await options.publication.publishWakeSubscriptionRevocation({
+        operationId: subscriptionHash,
+        publisher: options.reader.publisher,
+        revocation: resolvedIntent.revocation
+      });
+      return Object.freeze({
+        intentDisposition,
+        operationId: subscriptionHash,
+        publication,
+        revocation,
+        subscription: subscriptionHash
+      });
+    },
+    async service() {
+      const current = await options.reader.sync();
+      return await current.readModel.discoverPublisherService(serviceQuery(options.reader, current, serviceId));
+    },
+    async subscription(subscription) {
+      const subscriptionHash = HashZod4.parse(subscription);
+      const current = await options.reader.sync();
+      const view = await lookupAt(current);
+      if (!view.ok) return view;
+      const matches = view.subscriptions.flatMap((lifecycle) => lifecycle.tuples.filter((tuple) => tuple.subscription.objectHash === subscriptionHash).map((tuple) => ({ lifecycle, tuple })));
+      if (matches.length > 1) {
+        throw new EventKitHandshakeClientError(
+          "subscription-invalid",
+          "Exact subscription hash appears more than once in the subscriber view"
+        );
+      }
+      if (matches.length === 0) return Object.freeze({
+        found: false,
+        lookup: view,
+        ok: true
+      });
+      return Object.freeze({
+        found: true,
+        lifecycle: matches[0].lifecycle,
+        lookup: view,
+        ok: true,
+        tuple: matches[0].tuple
+      });
+    },
+    async subscribe(input) {
+      await assertPublicationSource(options.publication, subscriber);
+      const operationId = HandshakeIdZod3.parse(input.operationId);
+      const requestFingerprint = await subscriberSubscriptionRequestFingerprint(input);
+      const priorIntent = await loadMutationIntent(
+        options.intents,
+        options.reader,
+        "subscriber-subscription-subscribe",
+        operationId,
+        subscriber,
+        requestFingerprint
+      );
+      if (priorIntent !== void 0) return await publishSubscriberSubscriptionIntent(priorIntent, "resumed");
+      const current = await snapshot();
+      const selected = await serviceAt(current);
+      if (input.expiresAtBlock - current.finalizedHead <= 3) {
+        throw new EventKitHandshakeClientError(
+          "subscription-invalid",
+          "Requested subscription expiry must leave finalized blocks for tuple publication, acceptance, and activation"
+        );
+      }
+      await validateRevision(current, input);
+      const maxBlocksPerWake = input.maxBlocksPerWake ?? selected.service.body.limits.maxBlocksPerWake;
+      if (maxBlocksPerWake > selected.service.body.limits.maxBlocksPerWake) {
+        throw new EventKitHandshakeClientError(
+          "subscription-invalid",
+          "Requested maxBlocksPerWake exceeds the selected publisher service limit"
+        );
+      }
+      if (input.expiresAtBlock > current.finalizedHead + selected.service.body.limits.maxSubscriptionLifetimeBlocks) {
+        throw new EventKitHandshakeClientError(
+          "subscription-invalid",
+          "Requested subscription expiry exceeds the selected publisher service lifetime limit"
+        );
+      }
+      const grant = createWakeGrant({
+        deploymentId: input.deploymentId,
+        ...input.grantId === void 0 ? {} : { grantId: input.grantId },
+        publisher: options.reader.publisher,
+        ...input.queueId === void 0 || input.queueId === null ? {} : { queueId: input.queueId }
+      });
+      const grantHash = await handshakeObjectHash2(grant);
+      const plaintext = createWakeSubscriptionPlaintext({
+        audience: input.audience,
+        challengeSecret: input.challengeSecret,
+        deploymentId: input.deploymentId,
+        endpoint: input.endpoint,
+        maxBlocksPerWake,
+        queueId: input.queueId
+      });
+      const subscription = await createEncryptedWakeSubscription({
+        chainId: options.reader.chainId,
+        expiresAtBlock: input.expiresAtBlock,
+        grant: grantHash,
+        plaintext,
+        publisher: options.reader.publisher,
+        publisherKey: {
+          encryptionKey: HashZod4.parse(selected.key.objectHash),
+          keyId: selected.key.body.keyId,
+          publicKey: selected.key.body.publicKey
+        },
+        ...input.revision === void 0 ? {} : { revision: input.revision },
+        service: HashZod4.parse(selected.service.objectHash),
+        subscriber,
+        ...input.subscriptionId === void 0 ? {} : { subscriptionId: input.subscriptionId },
+        ...input.supersedes === void 0 ? {} : { supersedes: input.supersedes }
+      });
+      const resolvedIntent = await persistMutationIntent(options.intents, {
+        chainId: options.reader.chainId,
+        encryptionKey: selected.key.body,
+        grant,
+        kind: "subscriber-subscription-subscribe",
+        operationId,
+        publisher: options.reader.publisher,
+        requestFingerprint,
+        selectedKey: HashZod4.parse(selected.key.objectHash),
+        selectedService: HashZod4.parse(selected.service.objectHash),
+        service: selected.service.body,
+        source: subscriber,
+        subscription,
+        version: 1
+      });
+      return await publishSubscriberSubscriptionIntent(resolvedIntent.intent, resolvedIntent.disposition);
+    },
+    async subscriptions(subscriptionId) {
+      return await lookup(subscriptionId);
+    }
+  };
+  return Object.freeze(client);
+}
+export {
+  EventKitHandshakeClientError,
+  HandshakeMutationIntentConflictError,
+  HandshakeMutationIntentKinds,
+  HandshakeMutationIntentZod,
+  assertSameIntentBinding,
+  createEventKitHandshakePublicationPort,
+  createFilesystemEventKitReplayCheckpointStore,
+  createFilesystemFinalizedStatementPublicationJournal,
+  createFilesystemHandshakeMutationIntentStore,
+  createFilesystemPublisherEncryptionKeyStore,
+  createFilesystemPublisherEndpointChallengeStore,
+  createMemoryHandshakeMutationIntentStore,
+  createPublisherHandshakeClient,
+  createSubscriberHandshakeClient,
+  createSynchronizedEventKitHandshakeReader,
+  handshakeMutationRequestFingerprint,
+  intentLookupKey,
+  parseHandshakeMutationIntent,
+  parseHandshakeMutationIntentLookup
+};
+//# sourceMappingURL=handshake.mjs.map