@xyo-network/event-kit-node 0.1.1 → 0.1.2

package/dist/node/index.mjs

@@ -1,3 +1,14 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __decorateClass = (decorators, target, key, kind) => {
+  var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key) : target;
+  for (var i = decorators.length - 1, decorator; i >= 0; i--)
+    if (decorator = decorators[i])
+      result = (kind ? decorator(target, key, result) : decorator(result)) || result;
+  if (kind && result) __defProp(target, key, result);
+  return result;
+};
+
 // src/filesystemCursorStore.ts
 import {
   mkdir,
@@ -765,8 +776,8 @@ function createMemoryHandshakeMutationIntentStore() {
   const intents = /* @__PURE__ */ new Map();
   return {
     async get(rawLookup) {
-      const lookup = parseHandshakeMutationIntentLookup(rawLookup);
-      return intents.get(intentLookupKey(lookup));
+      const lookup2 = parseHandshakeMutationIntentLookup(rawLookup);
+      return intents.get(intentLookupKey(lookup2));
     },
     async getOrCreate(rawIntent) {
       const proposed = await parseHandshakeMutationIntent(rawIntent);
@@ -781,8 +792,8 @@ function createMemoryHandshakeMutationIntentStore() {
     }
   };
 }
-function intentLookupKey(lookup) {
-  const parsed = parseHandshakeMutationIntentLookup(lookup);
+function intentLookupKey(lookup2) {
+  const parsed = parseHandshakeMutationIntentLookup(lookup2);
   return [parsed.chainId, parsed.publisher, parsed.source, parsed.kind, parsed.operationId].join("/");
 }
 function assertSameIntentBinding(left, right) {
@@ -853,22 +864,22 @@ async function assertRevocationIntent(intent) {
 function createFilesystemHandshakeMutationIntentStore(options) {
   const root = PATH9.resolve(options.path);
   function pathFor(rawLookup) {
-    const lookup = parseHandshakeMutationIntentLookup(rawLookup);
+    const lookup2 = parseHandshakeMutationIntentLookup(rawLookup);
     return PATH9.join(
       root,
-      lookup.chainId,
-      lookup.publisher,
-      lookup.source,
-      lookup.kind,
-      `${lookup.operationId}.json`
+      lookup2.chainId,
+      lookup2.publisher,
+      lookup2.source,
+      lookup2.kind,
+      `${lookup2.operationId}.json`
     );
   }
-  async function readIntent(lookup) {
-    const path = pathFor(lookup);
+  async function readIntent(lookup2) {
+    const path = pathFor(lookup2);
     const raw = await readJsonFileStrict(path);
     if (raw === void 0) return void 0;
     const intent = await parseHandshakeMutationIntent(raw);
-    const parsedLookup = parseHandshakeMutationIntentLookup(lookup);
+    const parsedLookup = parseHandshakeMutationIntentLookup(lookup2);
     if (intent.chainId !== parsedLookup.chainId || intent.kind !== parsedLookup.kind || intent.operationId !== parsedLookup.operationId || intent.publisher !== parsedLookup.publisher || intent.source !== parsedLookup.source) {
       throw new Error("handshake mutation intent does not match its immutable path");
     }
@@ -877,8 +888,8 @@ function createFilesystemHandshakeMutationIntentStore(options) {
     return intent;
   }
   return {
-    async get(lookup) {
-      return await readIntent(parseHandshakeMutationIntentLookup(lookup));
+    async get(lookup2) {
+      return await readIntent(parseHandshakeMutationIntentLookup(lookup2));
     },
     async getOrCreate(rawIntent) {
       const proposed = await parseHandshakeMutationIntent(rawIntent);
@@ -906,35 +917,35 @@ import {
 } from "@xyo-network/event-kit-schemas";
 function createFilesystemPublisherEncryptionKeyStore(options) {
   const root = PATH10.resolve(options.path);
-  function parseLookup(lookup) {
+  function parseLookup(lookup2) {
     return {
-      encryptionKey: HashZod2.parse(lookup.encryptionKey),
-      keyId: HandshakeIdZod2.parse(lookup.keyId),
-      publisher: NormalizedAddressZod2.parse(lookup.publisher)
+      encryptionKey: HashZod2.parse(lookup2.encryptionKey),
+      keyId: HandshakeIdZod2.parse(lookup2.keyId),
+      publisher: NormalizedAddressZod2.parse(lookup2.publisher)
     };
   }
-  function pathFor(lookup) {
-    return PATH10.join(root, lookup.publisher, `${lookup.encryptionKey}-${lookup.keyId}.json`);
+  function pathFor(lookup2) {
+    return PATH10.join(root, lookup2.publisher, `${lookup2.encryptionKey}-${lookup2.keyId}.json`);
   }
-  function keyIdPath(lookup) {
-    return PATH10.join(root, lookup.publisher, "key-ids", `${lookup.keyId}.json`);
+  function keyIdPath(lookup2) {
+    return PATH10.join(root, lookup2.publisher, "key-ids", `${lookup2.keyId}.json`);
   }
-  async function readRecord2(lookup) {
-    const path = pathFor(lookup);
+  async function readRecord2(lookup2) {
+    const path = pathFor(lookup2);
     const raw = await readJsonFileStrict(path);
     if (raw === void 0) return void 0;
     const parsed = parsePrivateKeyRecord(raw);
-    if (parsed.publisher !== lookup.publisher || parsed.encryptionKey !== lookup.encryptionKey || parsed.keyId !== lookup.keyId) throw new Error("publisher encryption-key record does not match its immutable path");
-    const keyIdRecord = parseKeyIdRecord(await readJsonFileStrict(keyIdPath(lookup)));
-    if (keyIdRecord.publisher !== lookup.publisher || keyIdRecord.encryptionKey !== lookup.encryptionKey || keyIdRecord.keyId !== lookup.keyId) throw new Error("publisher encryption-key keyId index does not match its immutable path");
+    if (parsed.publisher !== lookup2.publisher || parsed.encryptionKey !== lookup2.encryptionKey || parsed.keyId !== lookup2.keyId) throw new Error("publisher encryption-key record does not match its immutable path");
+    const keyIdRecord = parseKeyIdRecord(await readJsonFileStrict(keyIdPath(lookup2)));
+    if (keyIdRecord.publisher !== lookup2.publisher || keyIdRecord.encryptionKey !== lookup2.encryptionKey || keyIdRecord.keyId !== lookup2.keyId) throw new Error("publisher encryption-key keyId index does not match its immutable path");
     const metadata = await stat2(path);
     if ((metadata.mode & 63) !== 0) throw new Error("publisher encryption-key record permissions are too broad");
     return parsed;
   }
   return {
     async getPrivateKey(rawLookup) {
-      const lookup = parseLookup(rawLookup);
-      const record = await readRecord2(lookup);
+      const lookup2 = parseLookup(rawLookup);
+      const record = await readRecord2(lookup2);
       if (record === void 0) return void 0;
       return Object.freeze({
         encryptionKey: record.encryptionKey,
@@ -944,25 +955,25 @@ function createFilesystemPublisherEncryptionKeyStore(options) {
     },
     async putPrivateKey(input) {
       const record = parsePrivateKeyRecord({ ...input.key, publisher: input.publisher });
-      const lookup = parseLookup(record);
-      const path = pathFor(lookup);
+      const lookup2 = parseLookup(record);
+      const path = pathFor(lookup2);
       const keyIdRecord = {
         encryptionKey: record.encryptionKey,
         keyId: record.keyId,
         publisher: record.publisher
       };
       if (!await publishJsonFile(
-        keyIdPath(lookup),
+        keyIdPath(lookup2),
         keyIdRecord,
         { directoryMode: 448, mode: 384 }
       )) {
-        const existingKeyId = parseKeyIdRecord(await readJsonFileStrict(keyIdPath(lookup)));
+        const existingKeyId = parseKeyIdRecord(await readJsonFileStrict(keyIdPath(lookup2)));
         if (stringifyJson(existingKeyId) !== stringifyJson(keyIdRecord)) {
           throw new Error(`publisher encryption-key keyId collision for ${record.keyId}`);
         }
       }
       if (await publishJsonFile(path, record, { directoryMode: 448, mode: 384 })) return "stored";
-      const existing = await readRecord2(lookup);
+      const existing = await readRecord2(lookup2);
       if (stringifyJson(existing) !== stringifyJson(record)) {
         throw new Error(`publisher encryption-key collision for ${record.encryptionKey}/${record.keyId}`);
       }
@@ -1143,6 +1154,7 @@ function requireTime(value) {
 // src/handshakeClients.ts
 import {
   beginPublisherEndpointChallengeAttempt,
+  canonicalJson,
   completePublisherEndpointChallenge,
   createEncryptedWakeSubscription,
   createPublisherEncryptionKeyRevocation,
@@ -1191,10 +1203,7 @@ function createSynchronizedEventKitHandshakeReader(options) {
   function assertIdentity() {
     const checkpoint = options.replay.snapshot();
     if (checkpoint.chainId !== chainId || checkpoint.network !== options.session.network || checkpoint.publisher !== publisher) {
-      throw new EventKitHandshakeClientError(
-        "identity-mismatch",
-        "Finalized replay identity does not match the pinned Event Kit network and publisher"
-      );
+      throw new EventKitHandshakeClientError("identity-mismatch", "Finalized replay identity does not match the pinned Event Kit network and publisher");
     }
   }
   return Object.freeze({
@@ -1247,10 +1256,7 @@ function createEventKitHandshakePublicationPort(transport) {
       const raw = String(await transport.signer.address());
       const normalized = NormalizedAddressZod3.parse(normalizeAddress(raw));
       if (raw !== normalized) {
-        throw new EventKitHandshakeClientError(
-          "identity-mismatch",
-          "XL1 publication signer address is not canonical lowercase hexadecimal without 0x"
-        );
+        throw new EventKitHandshakeClientError("identity-mismatch", "XL1 publication signer address is not canonical lowercase hexadecimal without 0x");
       }
       return normalized;
     }
@@ -1266,10 +1272,7 @@ function nextBlock(head) {
 function samplePublisherClock(nowSeconds) {
   const sampled = nowSeconds();
   if (!Number.isSafeInteger(sampled) || sampled < 0) {
-    throw new EventKitHandshakeClientError(
-      "challenge-rejected",
-      "Publisher clock must return a nonnegative JSON-safe Unix second"
-    );
+    throw new EventKitHandshakeClientError("challenge-rejected", "Publisher clock must return a nonnegative JSON-safe Unix second");
   }
   return sampled;
 }
@@ -1292,37 +1295,25 @@ function serviceQuery(reader, snapshot, serviceId) {
 }
 function requireService(discovery) {
   if (!discovery.ok) {
-    throw new EventKitHandshakeClientError(
-      "service-unavailable",
-      `Publisher service is unavailable: ${discovery.reason}`
-    );
+    throw new EventKitHandshakeClientError("service-unavailable", `Publisher service is unavailable: ${discovery.reason}`);
   }
   return discovery;
 }
 function requireExpectedService(discovery, expected) {
   const expectedHash = HashZod4.parse(expected);
   if (discovery.service.objectHash !== expectedHash) {
-    throw new EventKitHandshakeClientError(
-      "service-mismatch",
-      "Currently selected publisher service does not match the expected object hash"
-    );
+    throw new EventKitHandshakeClientError("service-mismatch", "Currently selected publisher service does not match the expected object hash");
   }
   return expectedHash;
 }
 function assertPublicationIdentity(publication, reader) {
   if (publication.chainId !== reader.chainId) {
-    throw new EventKitHandshakeClientError(
-      "identity-mismatch",
-      "Publication transport chain ID does not match the synchronized handshake reader"
-    );
+    throw new EventKitHandshakeClientError("identity-mismatch", "Publication transport chain ID does not match the synchronized handshake reader");
   }
 }
 async function assertPublicationSource(publication, expected) {
   if (await publication.source() !== expected) {
-    throw new EventKitHandshakeClientError(
-      "identity-mismatch",
-      "Publication signer does not match the required handshake Claim source"
-    );
+    throw new EventKitHandshakeClientError("identity-mismatch", "Publication signer does not match the required handshake Claim source");
   }
 }
 function intentLookup(reader, kind, operationId, source) {
@@ -1335,15 +1326,13 @@ function intentLookup(reader, kind, operationId, source) {
   };
 }
 function mutationIntentError(error) {
-  return error instanceof HandshakeMutationIntentConflictError ? new EventKitHandshakeClientError("mutation-intent-conflict", error.message) : new EventKitHandshakeClientError(
-    "mutation-intent-unavailable",
-    "Handshake mutation intent storage is unavailable or invalid"
-  );
+  return error instanceof HandshakeMutationIntentConflictError ? new EventKitHandshakeClientError("mutation-intent-conflict", error.message) : new EventKitHandshakeClientError("mutation-intent-unavailable", "Handshake mutation intent storage is unavailable or invalid");
 }
 async function loadMutationIntent(store, reader, kind, operationId, source, requestFingerprint) {
   try {
     const existing = await store.get(intentLookup(reader, kind, operationId, source));
-    if (existing === void 0) return void 0;
+    if (existing === void 0)
+      return void 0;
     if (existing.kind !== kind || existing.requestFingerprint !== requestFingerprint) {
       throw new HandshakeMutationIntentConflictError();
     }
@@ -1362,7 +1351,8 @@ async function persistMutationIntent(store, intent) {
 async function publisherServiceRequestFingerprint(input) {
   return await handshakeMutationRequestFingerprint({
     expiresAtBlock: input.expiresAtBlock ?? null,
-    maxBlocksPerWake: input.maxBlocksPerWake,
+    maxPositionsPerWake: input.maxPositionsPerWake,
+    sources: input.sources,
     maxSubscriptionLifetimeBlocks: input.maxSubscriptionLifetimeBlocks,
     validFromBlock: input.validFromBlock ?? null
   });
@@ -1371,7 +1361,7 @@ async function publisherRotationRequestFingerprint(input) {
   return await handshakeMutationRequestFingerprint({
     expiresAtBlock: input.expiresAtBlock ?? null,
     keyExpiresAtBlock: input.keyExpiresAtBlock ?? null,
-    maxBlocksPerWake: input.maxBlocksPerWake ?? null,
+    maxPositionsPerWake: input.maxPositionsPerWake ?? null,
     maxSubscriptionLifetimeBlocks: input.maxSubscriptionLifetimeBlocks ?? null,
     service: HashZod4.parse(input.service),
     validFromBlock: input.validFromBlock ?? null
@@ -1385,7 +1375,9 @@ async function subscriberSubscriptionRequestFingerprint(input) {
     endpoint: input.endpoint,
     expiresAtBlock: input.expiresAtBlock,
     grantId: input.grantId ?? null,
-    maxBlocksPerWake: input.maxBlocksPerWake ?? null,
+    source: input.source,
+    fromPosition: input.fromPosition,
+    maxPositionsPerWake: input.maxPositionsPerWake ?? null,
     queueId: input.queueId ?? null,
     revision: input.revision ?? null,
     subscriptionId: input.subscriptionId ?? null,
@@ -1428,10 +1420,7 @@ function protocolCandidate(reader, discovery, candidate, keys) {
   };
 }
 function validationError(reason) {
-  return new EventKitHandshakeClientError(
-    "subscription-invalid",
-    `Publisher subscription candidate failed validation: ${reason}`
-  );
+  return new EventKitHandshakeClientError("subscription-invalid", `Publisher subscription candidate failed validation: ${reason}`);
 }
 function challengeError(result) {
   const reason = result.ok ? "unknown" : result.reason;
@@ -1456,7 +1445,8 @@ function createPublisherHandshakeClient(options) {
   }
   async function resolveCandidate(selector) {
     const found = await candidateDiscovery(selector);
-    if (!found.ok) throw new EventKitHandshakeClientError("service-unavailable", `Publisher service is unavailable: ${found.reason}`);
+    if (!found.ok)
+      throw new EventKitHandshakeClientError("service-unavailable", `Publisher service is unavailable: ${found.reason}`);
     const subscriber = NormalizedAddressZod3.parse(selector.subscriber);
     const subscription = selector.subscription === void 0 ? void 0 : HashZod4.parse(selector.subscription);
     const candidates = found.candidates.filter((candidate2) => candidate2.subscriber === subscriber && (subscription === void 0 || candidate2.tuple.subscription.objectHash === subscription));
@@ -1467,10 +1457,9 @@ function createPublisherHandshakeClient(options) {
       throw new EventKitHandshakeClientError("candidate-ambiguous", "More than one finalized acceptance candidate matched");
     }
     const candidate = candidates[0];
-    const validated = await validateAndDecryptPublisherSubscription(
-      protocolCandidate(options.reader, found, candidate, options.keys)
-    );
-    if (!validated.ok) throw validationError(validated.reason);
+    const validated = await validateAndDecryptPublisherSubscription(protocolCandidate(options.reader, found, candidate, options.keys));
+    if (!validated.ok)
+      throw validationError(validated.reason);
     return { candidate, validated };
   }
   async function candidateForChallenge(challenge) {
@@ -1479,10 +1468,7 @@ function createPublisherHandshakeClient(options) {
       subscription: challenge.subscription
     });
     if (!endpointChallengeMatchesPublisherContext(challenge, resolved.validated.context)) {
-      throw new EventKitHandshakeClientError(
-        "challenge-context-invalid",
-        "Endpoint challenge does not match the current finalized subscription candidate"
-      );
+      throw new EventKitHandshakeClientError("challenge-context-invalid", "Endpoint challenge does not match the current finalized subscription candidate");
     }
     return resolved;
   }
@@ -1572,12 +1558,7 @@ function createPublisherHandshakeClient(options) {
       operationId: intent.operationId,
       response: intent.response
     });
-    const reconciliation = await reconcileAcceptance(
-      acceptanceHash,
-      publication,
-      intent.challenge.subscriber,
-      intent.challenge.subscription
-    );
+    const reconciliation = await reconcileAcceptance(acceptanceHash, publication, intent.challenge.subscriber, intent.challenge.subscription);
     return Object.freeze({
       acceptance: Object.freeze({ body: intent.acceptance, objectHash: acceptanceHash }),
       challenge: intent.operationId,
@@ -1598,10 +1579,7 @@ function createPublisherHandshakeClient(options) {
         publisher: options.reader.publisher
       });
     } catch {
-      throw new EventKitHandshakeClientError(
-        "key-custody-failed",
-        "Publisher encryption private key was not durably retained; publication was not attempted"
-      );
+      throw new EventKitHandshakeClientError("key-custody-failed", "Publisher encryption private key was not durably retained; publication was not attempted");
     }
     const [keyHash, serviceHash] = await Promise.all([
       handshakeObjectHash2(intent.encryptionKey),
@@ -1624,19 +1602,19 @@ function createPublisherHandshakeClient(options) {
   const client = {
     async acceptanceCandidates(selector = {}) {
       const found = await candidateDiscovery(selector);
-      if (!found.ok || selector.subscription === void 0) return found;
+      if (!found.ok || selector.subscription === void 0)
+        return found;
       const subscription = HashZod4.parse(selector.subscription);
       return Object.freeze({
         ...found,
-        candidates: found.candidates.filter(
-          (candidate) => candidate.tuple.subscription.objectHash === subscription
-        )
+        candidates: found.candidates.filter((candidate) => candidate.tuple.subscription.objectHash === subscription)
       });
     },
     async beginChallenge(input) {
       const challengeHash = HashZod4.parse(input.challengeHash);
       const record = await options.challenges.get(challengeHash);
-      if (record === void 0) return { kind: "missing" };
+      if (record === void 0)
+        return { kind: "missing" };
       const resolved = await candidateForChallenge(record.challenge);
       const begun = await beginPublisherEndpointChallengeAttempt({
         challengeHash,
@@ -1671,10 +1649,7 @@ function createPublisherHandshakeClient(options) {
         throw new EventKitHandshakeClientError("challenge-not-found", "Endpoint challenge was not found");
       }
       if (record.challenge.subscriber !== subscriber || record.challenge.subscription !== subscription) {
-        throw new EventKitHandshakeClientError(
-          "challenge-context-invalid",
-          "Stored endpoint challenge does not match the caller expected subscriber and subscription"
-        );
+        throw new EventKitHandshakeClientError("challenge-context-invalid", "Stored endpoint challenge does not match the caller expected subscriber and subscription");
       }
       const responseHash = await handshakeObjectHash2(input.response);
       const requestFingerprint = await exactMutationRequestFingerprint({
@@ -1683,20 +1658,10 @@ function createPublisherHandshakeClient(options) {
         subscriber,
         subscription
       });
-      const existing = await loadMutationIntent(
-        options.intents,
-        options.reader,
-        "publisher-subscription-accept",
-        challengeHash,
-        options.reader.publisher,
-        requestFingerprint
-      );
+      const existing = await loadMutationIntent(options.intents, options.reader, "publisher-subscription-accept", challengeHash, options.reader.publisher, requestFingerprint);
       if (existing !== void 0) {
         if (record.state !== "verified" || record.responseHash !== responseHash) {
-          throw new EventKitHandshakeClientError(
-            "mutation-intent-conflict",
-            "Acceptance intent does not match the durable verified challenge decision"
-          );
+          throw new EventKitHandshakeClientError("mutation-intent-conflict", "Acceptance intent does not match the durable verified challenge decision");
         }
         return await publishAcceptanceIntent(existing, "resumed");
       }
@@ -1708,36 +1673,22 @@ function createPublisherHandshakeClient(options) {
         store: options.challenges,
         subscription: resolved.validated
       });
-      if (!completed.ok) throw challengeError(completed);
-      const concurrentlyPersisted = await loadMutationIntent(
-        options.intents,
-        options.reader,
-        "publisher-subscription-accept",
-        challengeHash,
-        options.reader.publisher,
-        requestFingerprint
-      );
-      if (concurrentlyPersisted !== void 0) return await publishAcceptanceIntent(concurrentlyPersisted, "resumed");
+      if (!completed.ok)
+        throw challengeError(completed);
+      const concurrentlyPersisted = await loadMutationIntent(options.intents, options.reader, "publisher-subscription-accept", challengeHash, options.reader.publisher, requestFingerprint);
+      if (concurrentlyPersisted !== void 0)
+        return await publishAcceptanceIntent(concurrentlyPersisted, "resumed");
       let current;
       try {
         current = await candidateForChallenge(record.challenge);
       } catch (error) {
-        const recovered = await loadMutationIntent(
-          options.intents,
-          options.reader,
-          "publisher-subscription-accept",
-          challengeHash,
-          options.reader.publisher,
-          requestFingerprint
-        );
-        if (recovered !== void 0) return await publishAcceptanceIntent(recovered, "resumed");
+        const recovered = await loadMutationIntent(options.intents, options.reader, "publisher-subscription-accept", challengeHash, options.reader.publisher, requestFingerprint);
+        if (recovered !== void 0)
+          return await publishAcceptanceIntent(recovered, "resumed");
         throw error;
       }
       if (!endpointChallengeMatchesPublisherContext(record.challenge, current.validated.context)) {
-        throw new EventKitHandshakeClientError(
-          "challenge-context-invalid",
-          "Endpoint challenge candidate changed before acceptance publication"
-        );
+        throw new EventKitHandshakeClientError("challenge-context-invalid", "Endpoint challenge candidate changed before acceptance publication");
       }
       const resolvedIntent = await persistMutationIntent(options.intents, {
         acceptance: completed.acceptance,
@@ -1779,42 +1730,35 @@ function createPublisherHandshakeClient(options) {
     async publishService(input) {
       await assertPublicationSource(options.publication, options.reader.publisher);
       if (serviceId !== void 0) {
-        throw new EventKitHandshakeClientError(
-          "service-root-requires-fresh-id",
-          "Root service publication requires an unconfigured client so a fresh serviceId is generated"
-        );
+        throw new EventKitHandshakeClientError("service-root-requires-fresh-id", "Root service publication requires an unconfigured client so a fresh serviceId is generated");
       }
       const operationId = HandshakeIdZod3.parse(input.operationId);
       const requestFingerprint = await publisherServiceRequestFingerprint(input);
-      const priorIntent = await loadMutationIntent(
-        options.intents,
-        options.reader,
-        "publisher-service-publish",
-        operationId,
-        options.reader.publisher,
-        requestFingerprint
-      );
-      if (priorIntent !== void 0) return await publishPublisherServiceIntent(priorIntent, "resumed");
+      const priorIntent = await loadMutationIntent(options.intents, options.reader, "publisher-service-publish", operationId, options.reader.publisher, requestFingerprint);
+      if (priorIntent !== void 0)
+        return await publishPublisherServiceIntent(priorIntent, "resumed");
       const current = await snapshot();
       const existing = await discovery(current);
       if (existing.ok) {
-        throw new EventKitHandshakeClientError(
-          "service-already-exists",
-          "An active publisher service already exists; rotate its key to publish a successor"
-        );
+        throw new EventKitHandshakeClientError("service-already-exists", "An active publisher service already exists; rotate its key to publish a successor");
       }
       if (existing.reason !== "service-not-found") {
         throw new EventKitHandshakeClientError("service-unavailable", `Cannot declare service: ${existing.reason}`);
       }
       const validFromBlock = input.validFromBlock ?? nextBlock(current.finalizedHead);
       const generated = await generatePublisherEncryptionKey({ validFromBlock });
-      const service = createPublisherService({
+      const serviceInput = {
         encryptionKeys: [generated.descriptorHash],
         ...input.expiresAtBlock === void 0 ? {} : { expiresAtBlock: input.expiresAtBlock },
-        maxBlocksPerWake: input.maxBlocksPerWake,
         maxSubscriptionLifetimeBlocks: input.maxSubscriptionLifetimeBlocks,
         preferredEncryptionKey: generated.descriptorHash,
         validFromBlock
+      };
+      const service = createPublisherService({
+        ...serviceInput,
+        authorizationChainId: options.reader.chainId,
+        sources: input.sources,
+        maxPositionsPerWake: input.maxPositionsPerWake
       });
       const resolvedIntent = await persistMutationIntent(options.intents, {
         chainId: options.reader.chainId,
@@ -1834,23 +1778,13 @@ function createPublisherHandshakeClient(options) {
       await assertPublicationSource(options.publication, options.reader.publisher);
       const keyHash = HashZod4.parse(key);
       const requestFingerprint = await exactMutationRequestFingerprint({ key: keyHash });
-      let resolvedIntent = await loadMutationIntent(
-        options.intents,
-        options.reader,
-        "publisher-encryption-key-retire",
-        keyHash,
-        options.reader.publisher,
-        requestFingerprint
-      );
+      let resolvedIntent = await loadMutationIntent(options.intents, options.reader, "publisher-encryption-key-retire", keyHash, options.reader.publisher, requestFingerprint);
       let intentDisposition = "resumed";
       if (resolvedIntent === void 0) {
         const current = await snapshot();
         const selected = requireService(await discovery(current));
         if (selected.key.objectHash !== keyHash || !selected.service.body.encryptionKeys.includes(keyHash) || selected.service.body.preferredEncryptionKey !== keyHash) {
-          throw new EventKitHandshakeClientError(
-            "key-mismatch",
-            "Encryption key does not match the exact current preferred descriptor evidence"
-          );
+          throw new EventKitHandshakeClientError("key-mismatch", "Encryption key does not match the exact current preferred descriptor evidence");
         }
         const persisted = await persistMutationIntent(options.intents, {
           chainId: options.reader.chainId,
@@ -1882,14 +1816,7 @@ function createPublisherHandshakeClient(options) {
       await assertPublicationSource(options.publication, options.reader.publisher);
       const service = HashZod4.parse(expectedService);
       const requestFingerprint = await exactMutationRequestFingerprint({ service });
-      let resolvedIntent = await loadMutationIntent(
-        options.intents,
-        options.reader,
-        "publisher-service-retire",
-        service,
-        options.reader.publisher,
-        requestFingerprint
-      );
+      let resolvedIntent = await loadMutationIntent(options.intents, options.reader, "publisher-service-retire", service, options.reader.publisher, requestFingerprint);
       let intentDisposition = "resumed";
       if (resolvedIntent === void 0) {
         const current = await snapshot();
@@ -1925,15 +1852,9 @@ function createPublisherHandshakeClient(options) {
       await assertPublicationSource(options.publication, options.reader.publisher);
       const operationId = HandshakeIdZod3.parse(input.operationId);
       const requestFingerprint = await publisherRotationRequestFingerprint(input);
-      const priorIntent = await loadMutationIntent(
-        options.intents,
-        options.reader,
-        "publisher-service-rotate-key",
-        operationId,
-        options.reader.publisher,
-        requestFingerprint
-      );
-      if (priorIntent !== void 0) return await publishPublisherServiceIntent(priorIntent, "resumed");
+      const priorIntent = await loadMutationIntent(options.intents, options.reader, "publisher-service-rotate-key", operationId, options.reader.publisher, requestFingerprint);
+      if (priorIntent !== void 0)
+        return await publishPublisherServiceIntent(priorIntent, "resumed");
       const current = await snapshot();
       const selected = requireService(await discovery(current));
       requireExpectedService(selected, input.service);
@@ -1942,16 +1863,21 @@ function createPublisherHandshakeClient(options) {
         ...input.keyExpiresAtBlock === void 0 ? {} : { expiresAtBlock: input.keyExpiresAtBlock },
         validFromBlock
       });
-      const service = createPublisherService({
+      const serviceInput = {
         encryptionKeys: [generated.descriptorHash],
         ...input.expiresAtBlock === void 0 ? selected.service.body.expiresAtBlock === void 0 ? {} : { expiresAtBlock: selected.service.body.expiresAtBlock } : { expiresAtBlock: input.expiresAtBlock },
-        maxBlocksPerWake: input.maxBlocksPerWake ?? selected.service.body.limits.maxBlocksPerWake,
         maxSubscriptionLifetimeBlocks: input.maxSubscriptionLifetimeBlocks ?? selected.service.body.limits.maxSubscriptionLifetimeBlocks,
         preferredEncryptionKey: generated.descriptorHash,
         revision: selected.service.body.revision + 1,
         serviceId: selected.service.body.serviceId,
         supersedes: HashZod4.parse(selected.service.objectHash),
         validFromBlock
+      };
+      const service = createPublisherService({
+        ...serviceInput,
+        authorizationChainId: options.reader.chainId,
+        sources: selected.service.body.events.map((event) => event.source),
+        maxPositionsPerWake: input.maxPositionsPerWake ?? selected.service.body.limits.maxPositionsPerWake
       });
       const resolvedIntent = await persistMutationIntent(options.intents, {
         chainId: options.reader.chainId,
@@ -1995,11 +1921,9 @@ function createSubscriberHandshakeClient(options) {
     return readySnapshot(await options.reader.sync());
   }
   async function serviceAt(current) {
-    return requireService(
-      await current.readModel.discoverPublisherService(serviceQuery(options.reader, current, serviceId))
-    );
+    return requireService(await current.readModel.discoverPublisherService(serviceQuery(options.reader, current, serviceId)));
   }
-  async function lookup(subscriptionId) {
+  async function lookup2(subscriptionId) {
     const current = await options.reader.sync();
     return await lookupAt(current, subscriptionId);
   }
@@ -2014,29 +1938,21 @@ function createSubscriberHandshakeClient(options) {
     const revision = input.revision ?? 1;
     if (revision === 1) {
       if (input.supersedes !== void 0) {
-        throw new EventKitHandshakeClientError(
-          "subscription-invalid",
-          "Subscription revision 1 must not declare supersedes"
-        );
+        throw new EventKitHandshakeClientError("subscription-invalid", "Subscription revision 1 must not declare supersedes");
       }
-      if (input.subscriptionId === void 0) return;
+      if (input.subscriptionId === void 0)
+        return;
       const view2 = await lookupAt(current, input.subscriptionId);
       if (!view2.ok) {
         throw new EventKitHandshakeClientError("service-unavailable", `Cannot validate subscription identity: ${view2.reason}`);
       }
       if (view2.subscriptions.some((item) => item.subscriptionId === input.subscriptionId)) {
-        throw new EventKitHandshakeClientError(
-          "subscription-invalid",
-          "Subscription revision 1 would duplicate an existing finalized stable identity"
-        );
+        throw new EventKitHandshakeClientError("subscription-invalid", "Subscription revision 1 would duplicate an existing finalized stable identity");
       }
       return;
     }
     if (input.subscriptionId === void 0 || input.supersedes === void 0) {
-      throw new EventKitHandshakeClientError(
-        "subscription-invalid",
-        "A replacement subscription requires subscriptionId and supersedes"
-      );
+      throw new EventKitHandshakeClientError("subscription-invalid", "A replacement subscription requires subscriptionId and supersedes");
     }
     const view = await lookupAt(current, input.subscriptionId);
     if (!view.ok) {
@@ -2044,24 +1960,15 @@ function createSubscriberHandshakeClient(options) {
     }
     const lifecycles = view.subscriptions.filter((item) => item.subscriptionId === input.subscriptionId);
     if (lifecycles.length !== 1) {
-      throw new EventKitHandshakeClientError(
-        "subscription-invalid",
-        "Replacement subscription does not resolve one finalized stable identity"
-      );
+      throw new EventKitHandshakeClientError("subscription-invalid", "Replacement subscription does not resolve one finalized stable identity");
     }
     if (lifecycles[0].state === "rejected") {
-      throw new EventKitHandshakeClientError(
-        "subscription-invalid",
-        "Replacement subscription cannot extend a rejected finalized revision chain"
-      );
+      throw new EventKitHandshakeClientError("subscription-invalid", "Replacement subscription cannot extend a rejected finalized revision chain");
     }
     const highestRevision = Math.max(...lifecycles[0].tuples.map((tuple) => tuple.subscription.body.revision));
     const latest = lifecycles[0].tuples.filter((tuple) => tuple.subscription.body.revision === highestRevision);
     if (latest.length !== 1 || revision !== highestRevision + 1 || latest[0].subscription.objectHash !== input.supersedes) {
-      throw new EventKitHandshakeClientError(
-        "subscription-invalid",
-        "Replacement subscription revision and supersedes must extend the exact finalized chain tip"
-      );
+      throw new EventKitHandshakeClientError("subscription-invalid", "Replacement subscription revision and supersedes must extend the exact finalized chain tip");
     }
   }
   async function publishSubscriberSubscriptionIntent(intent, intentDisposition) {
@@ -2090,23 +1997,13 @@ function createSubscriberHandshakeClient(options) {
       await assertPublicationSource(options.publication, subscriber);
       const grantHash = HashZod4.parse(grant);
       const requestFingerprint = await exactMutationRequestFingerprint({ grant: grantHash });
-      let resolvedIntent = await loadMutationIntent(
-        options.intents,
-        options.reader,
-        "subscriber-grant-revoke",
-        grantHash,
-        subscriber,
-        requestFingerprint
-      );
+      let resolvedIntent = await loadMutationIntent(options.intents, options.reader, "subscriber-grant-revoke", grantHash, subscriber, requestFingerprint);
       let intentDisposition = "resumed";
       if (resolvedIntent === void 0) {
         const current = await snapshot();
         const view = await current.readModel.subscriber({ ...serviceQuery(options.reader, current, serviceId), subscriber });
         if (!view.ok || !tupleHashes(view).grants.has(grantHash)) {
-          throw new EventKitHandshakeClientError(
-            "subscription-not-found",
-            "Grant is not present in this subscriber finalization view"
-          );
+          throw new EventKitHandshakeClientError("subscription-not-found", "Grant is not present in this subscriber finalization view");
         }
         const persisted = await persistMutationIntent(options.intents, {
           chainId: options.reader.chainId,
@@ -2139,23 +2036,13 @@ function createSubscriberHandshakeClient(options) {
       await assertPublicationSource(options.publication, subscriber);
       const subscriptionHash = HashZod4.parse(subscription);
       const requestFingerprint = await exactMutationRequestFingerprint({ subscription: subscriptionHash });
-      let resolvedIntent = await loadMutationIntent(
-        options.intents,
-        options.reader,
-        "subscriber-subscription-revoke",
-        subscriptionHash,
-        subscriber,
-        requestFingerprint
-      );
+      let resolvedIntent = await loadMutationIntent(options.intents, options.reader, "subscriber-subscription-revoke", subscriptionHash, subscriber, requestFingerprint);
       let intentDisposition = "resumed";
       if (resolvedIntent === void 0) {
         const current = await snapshot();
         const view = await current.readModel.subscriber({ ...serviceQuery(options.reader, current, serviceId), subscriber });
         if (!view.ok || !tupleHashes(view).subscriptions.has(subscriptionHash)) {
-          throw new EventKitHandshakeClientError(
-            "subscription-not-found",
-            "Subscription is not present in this subscriber finalization view"
-          );
+          throw new EventKitHandshakeClientError("subscription-not-found", "Subscription is not present in this subscriber finalization view");
         }
         const persisted = await persistMutationIntent(options.intents, {
           chainId: options.reader.chainId,
@@ -2192,19 +2079,18 @@ function createSubscriberHandshakeClient(options) {
       const subscriptionHash = HashZod4.parse(subscription);
       const current = await options.reader.sync();
       const view = await lookupAt(current);
-      if (!view.ok) return view;
+      if (!view.ok)
+        return view;
       const matches = view.subscriptions.flatMap((lifecycle) => lifecycle.tuples.filter((tuple) => tuple.subscription.objectHash === subscriptionHash).map((tuple) => ({ lifecycle, tuple })));
       if (matches.length > 1) {
-        throw new EventKitHandshakeClientError(
-          "subscription-invalid",
-          "Exact subscription hash appears more than once in the subscriber view"
-        );
+        throw new EventKitHandshakeClientError("subscription-invalid", "Exact subscription hash appears more than once in the subscriber view");
       }
-      if (matches.length === 0) return Object.freeze({
-        found: false,
-        lookup: view,
-        ok: true
-      });
+      if (matches.length === 0)
+        return Object.freeze({
+          found: false,
+          lookup: view,
+          ok: true
+        });
       return Object.freeze({
         found: true,
         lifecycle: matches[0].lifecycle,
@@ -2217,36 +2103,22 @@ function createSubscriberHandshakeClient(options) {
       await assertPublicationSource(options.publication, subscriber);
       const operationId = HandshakeIdZod3.parse(input.operationId);
       const requestFingerprint = await subscriberSubscriptionRequestFingerprint(input);
-      const priorIntent = await loadMutationIntent(
-        options.intents,
-        options.reader,
-        "subscriber-subscription-subscribe",
-        operationId,
-        subscriber,
-        requestFingerprint
-      );
-      if (priorIntent !== void 0) return await publishSubscriberSubscriptionIntent(priorIntent, "resumed");
+      const priorIntent = await loadMutationIntent(options.intents, options.reader, "subscriber-subscription-subscribe", operationId, subscriber, requestFingerprint);
+      if (priorIntent !== void 0)
+        return await publishSubscriberSubscriptionIntent(priorIntent, "resumed");
       const current = await snapshot();
       const selected = await serviceAt(current);
       if (input.expiresAtBlock - current.finalizedHead <= 3) {
-        throw new EventKitHandshakeClientError(
-          "subscription-invalid",
-          "Requested subscription expiry must leave finalized blocks for tuple publication, acceptance, and activation"
-        );
+        throw new EventKitHandshakeClientError("subscription-invalid", "Requested subscription expiry must leave finalized blocks for tuple publication, acceptance, and activation");
       }
       await validateRevision(current, input);
-      const maxBlocksPerWake = input.maxBlocksPerWake ?? selected.service.body.limits.maxBlocksPerWake;
-      if (maxBlocksPerWake > selected.service.body.limits.maxBlocksPerWake) {
-        throw new EventKitHandshakeClientError(
-          "subscription-invalid",
-          "Requested maxBlocksPerWake exceeds the selected publisher service limit"
-        );
+      const maximum = selected.service.body.limits.maxPositionsPerWake;
+      const maxPositionsPerWake = input.maxPositionsPerWake ?? maximum;
+      if (maxPositionsPerWake > maximum) {
+        throw new EventKitHandshakeClientError("subscription-invalid", "Requested maxPositionsPerWake exceeds the selected publisher service limit");
       }
       if (input.expiresAtBlock > current.finalizedHead + selected.service.body.limits.maxSubscriptionLifetimeBlocks) {
-        throw new EventKitHandshakeClientError(
-          "subscription-invalid",
-          "Requested subscription expiry exceeds the selected publisher service lifetime limit"
-        );
+        throw new EventKitHandshakeClientError("subscription-invalid", "Requested subscription expiry exceeds the selected publisher service lifetime limit");
       }
       const grant = createWakeGrant({
         deploymentId: input.deploymentId,
@@ -2255,19 +2127,11 @@ function createSubscriberHandshakeClient(options) {
         ...input.queueId === void 0 || input.queueId === null ? {} : { queueId: input.queueId }
       });
       const grantHash = await handshakeObjectHash2(grant);
-      const plaintext = createWakeSubscriptionPlaintext({
-        audience: input.audience,
-        challengeSecret: input.challengeSecret,
-        deploymentId: input.deploymentId,
-        endpoint: input.endpoint,
-        maxBlocksPerWake,
-        queueId: input.queueId
-      });
-      const subscription = await createEncryptedWakeSubscription({
+      const plaintext = subscriberPlaintext(selected.service.body, input, maxPositionsPerWake);
+      const subscriptionInput = {
         chainId: options.reader.chainId,
         expiresAtBlock: input.expiresAtBlock,
         grant: grantHash,
-        plaintext,
         publisher: options.reader.publisher,
         publisherKey: {
           encryptionKey: HashZod4.parse(selected.key.objectHash),
@@ -2279,7 +2143,8 @@ function createSubscriberHandshakeClient(options) {
         subscriber,
         ...input.subscriptionId === void 0 ? {} : { subscriptionId: input.subscriptionId },
         ...input.supersedes === void 0 ? {} : { supersedes: input.supersedes }
-      });
+      };
+      const subscription = await createEncryptedWakeSubscription({ ...subscriptionInput, plaintext });
       const resolvedIntent = await persistMutationIntent(options.intents, {
         chainId: options.reader.chainId,
         encryptionKey: selected.key.body,
@@ -2298,20 +2163,1430 @@ function createSubscriberHandshakeClient(options) {
       return await publishSubscriberSubscriptionIntent(resolvedIntent.intent, resolvedIntent.disposition);
     },
     async subscriptions(subscriptionId) {
-      return await lookup(subscriptionId);
+      return await lookup2(subscriptionId);
     }
   };
   return Object.freeze(client);
 }
+function subscriberPlaintext(service, input, maxPositionsPerWake) {
+  const plaintextInput = {
+    audience: input.audience,
+    challengeSecret: input.challengeSecret,
+    deploymentId: input.deploymentId,
+    endpoint: input.endpoint,
+    queueId: input.queueId
+  };
+  const source = input.source;
+  if (!service.events.some((event) => canonicalJson(event.source) === canonicalJson(source))) {
+    throw new Error("Requested source is not advertised by the selected service");
+  }
+  return createWakeSubscriptionPlaintext({
+    ...plaintextInput,
+    source,
+    fromPosition: input.fromPosition,
+    maxPositionsPerWake
+  });
+}
 
-// src/sqliteWakeQueue.ts
-import { mkdir as mkdir5 } from "node:fs/promises";
+// src/runtime/boundedFetch.ts
+import { Buffer as Buffer2 } from "node:buffer";
+
+// src/runtime/abort.ts
+import { clearTimeout, setTimeout } from "node:timers";
+function publisherAbortScope(signals, timeoutMs) {
+  const controller = new AbortController();
+  const abort = () => controller.abort();
+  const timer = timeoutMs === void 0 ? void 0 : setTimeout(abort, timeoutMs);
+  timer?.unref();
+  for (const signal of signals) {
+    if (signal.aborted) controller.abort();
+    else signal.addEventListener("abort", abort, { once: true });
+  }
+  return {
+    signal: controller.signal,
+    dispose() {
+      if (timer !== void 0) clearTimeout(timer);
+      for (const signal of signals) signal.removeEventListener("abort", abort);
+    }
+  };
+}
+
+// src/runtime/boundedFetch.ts
+function createBoundedPublisherFetch(options = {}) {
+  const owner = new AbortController();
+  const timeout = options.requestTimeoutMs ?? 1e4;
+  const maximum = options.maxResponseBytes ?? 16 * 1024 * 1024;
+  const concurrency = options.maxConcurrency ?? 16;
+  if (!Number.isSafeInteger(timeout) || timeout < 100 || timeout > 6e4 || !Number.isSafeInteger(maximum) || maximum < 1 || maximum > 64 * 1024 * 1024 || !Number.isSafeInteger(concurrency) || concurrency < 1 || concurrency > 64)
+    throw new Error("Invalid publisher fetch limits");
+  const active = /* @__PURE__ */ new Set();
+  const nativeFetch = globalThis.fetch.bind(globalThis);
+  const fetchFn = (input, init) => {
+    if (active.size >= concurrency)
+      return Promise.reject(new Error("Publisher HTTP concurrency limit exceeded"));
+    const operation = (async () => {
+      const signals = [
+        owner.signal,
+        ...options.signal === void 0 ? [] : [options.signal],
+        ...init?.signal == null ? [] : [init.signal],
+        ...input instanceof Request ? [input.signal] : []
+      ];
+      const scope = publisherAbortScope(signals, timeout);
+      try {
+        scope.signal.throwIfAborted();
+        const response = await nativeFetch(input, {
+          ...init,
+          redirect: "error",
+          signal: scope.signal
+        });
+        if (response.body === null)
+          return response;
+        const reader = response.body.getReader();
+        const chunks = [];
+        let size = 0;
+        try {
+          for (; ; ) {
+            const chunk = await reader.read();
+            if (chunk.done)
+              break;
+            const bytes = chunk.value;
+            if (!(bytes instanceof Uint8Array)) throw new Error("Publisher HTTP body returned a non-byte chunk");
+            size += bytes.byteLength;
+            if (size > maximum) {
+              await reader.cancel();
+              throw new Error("Publisher HTTP body exceeds its bound");
+            }
+            chunks.push(bytes);
+          }
+        } finally {
+          reader.releaseLock();
+        }
+        const headers = new Headers(response.headers);
+        headers.delete("content-encoding");
+        headers.delete("transfer-encoding");
+        headers.set("content-length", String(size));
+        return new Response(Buffer2.concat(chunks), {
+          status: response.status,
+          statusText: response.statusText,
+          headers
+        });
+      } finally {
+        scope.dispose();
+      }
+    })();
+    active.add(operation);
+    void operation.then(() => active.delete(operation), () => active.delete(operation));
+    return operation;
+  };
+  return {
+    fetchFn,
+    async close() {
+      owner.abort();
+      await Promise.allSettled(active);
+    },
+    get activeRequests() {
+      return active.size;
+    }
+  };
+}
+function createBoundedPublisherEthersTransport(options = {}) {
+  const bounded = createBoundedPublisherFetch(options);
+  const getUrl = async (request2, cancellation) => {
+    const controller = new AbortController();
+    cancellation?.addListener(() => controller.abort());
+    cancellation?.checkSignal();
+    const response = await bounded.fetchFn(request2.url, {
+      body: request2.body === null ? void 0 : Buffer2.from(request2.body),
+      headers: request2.headers,
+      method: request2.method,
+      signal: controller.signal
+    });
+    return {
+      body: new Uint8Array(await response.arrayBuffer()),
+      headers: Object.fromEntries(response.headers),
+      statusCode: response.status,
+      statusMessage: response.statusText
+    };
+  };
+  return {
+    getUrl,
+    async close() {
+      await bounded.close();
+    },
+    get activeRequests() {
+      return bounded.activeRequests;
+    }
+  };
+}
+
+// src/runtime/handshakeDiscovery.ts
+import { decryptWakeSubscription, sourceWakeFilterHash } from "@xyo-network/event-kit-protocol";
+import { EndpointChallengeResponseZod as EndpointChallengeResponseZod2 } from "@xyo-network/event-kit-schemas";
+function createPublisherHandshakeDiscovery(options) {
+  const clock = options.nowSeconds ?? (() => Math.floor(Date.now() / 1e3));
+  const owner = new AbortController();
+  let accepting;
+  let viewing;
+  let status = {
+    authorizationChainId: options.authorizationChainId,
+    keyLoaded: false,
+    activeKeyIds: [],
+    pendingSubscriptions: 0,
+    rejectedSubscriptions: 0,
+    challengeFailures: 0
+  };
+  async function activeView(signal) {
+    signal.throwIfAborted();
+    viewing ??= options.client.subscriptions().finally(() => {
+      viewing = void 0;
+    });
+    const view = await viewing;
+    signal.throwIfAborted();
+    if (!view.ok || view.indexedThrough !== view.finalizedHead)
+      throw new Error("Publisher subscription view is unavailable or stale");
+    status = {
+      ...status,
+      finalizedHead: view.finalizedHead,
+      indexedThrough: view.indexedThrough,
+      pendingSubscriptions: view.subscriptions.filter((item) => item.state === "pending").length,
+      rejectedSubscriptions: view.rejections.length
+    };
+    return view;
+  }
+  async function acceptCandidate(subscriber, subscription, signal) {
+    try {
+      let pending = options.state.get("outbound-challenges", subscription);
+      if (pending !== void 0 && pending.response === void 0 && clock() >= pending.expiresAt)
+        pending = void 0;
+      if (pending === void 0) {
+        const issued = await options.client.issueChallenge({
+          issuedAt: clock(),
+          lifetimeSeconds: 300,
+          subscriber,
+          subscription
+        });
+        pending = {
+          challengeHash: issued.challengeHash,
+          subscriber,
+          subscription,
+          expiresAt: issued.challenge.expiresAt
+        };
+        options.state.set("outbound-challenges", subscription, pending);
+      }
+      if (pending.response === void 0) {
+        const begun = await options.client.beginChallenge({ challengeHash: pending.challengeHash, nowSeconds: clock });
+        if (begun.kind !== "started")
+          return;
+        signal.throwIfAborted();
+        const response2 = await options.transport.post(begun.target.endpoint, begun.challenge, signal);
+        if (response2.status !== 200)
+          throw new Error("Endpoint challenge was rejected");
+        pending = { ...pending, response: EndpointChallengeResponseZod2.parse(response2.body) };
+        options.state.set("outbound-challenges", subscription, pending);
+      }
+      signal.throwIfAborted();
+      const response = pending.response;
+      if (response === void 0)
+        throw new Error("Endpoint proof is unavailable");
+      await options.client.completeChallengeAndAccept({
+        ...pending,
+        response,
+        nowSeconds: clock
+      });
+    } catch {
+      if (signal.aborted)
+        return;
+      const failures = options.state.get("challenge-failures", subscription) ?? 0;
+      options.state.set("challenge-failures", subscription, failures + 1);
+      const pending = options.state.get("outbound-challenges", subscription);
+      if (pending !== void 0 && clock() >= pending.expiresAt)
+        options.state.remove("outbound-challenges", subscription);
+    }
+  }
+  async function accept(signal) {
+    signal.throwIfAborted();
+    const now = clock();
+    if (now < (options.state.get("challenge-rate", "next-pass") ?? 0))
+      return;
+    options.state.set("challenge-rate", "next-pass", now + 10);
+    const found = await options.client.acceptanceCandidates();
+    if (!found.ok)
+      throw new Error("Publisher acceptance candidates are unavailable");
+    const offset = options.state.get("challenge-rate", "offset") ?? 0;
+    const candidates = found.candidates;
+    let attempted = 0;
+    for (let index = 0; index < Math.min(candidates.length, 128) && attempted < 4; index += 1) {
+      const candidate = candidates[(offset + index) % candidates.length];
+      if (candidate === void 0)
+        break;
+      options.state.set("challenge-rate", "offset", (offset + index + 1) % candidates.length);
+      const next = options.state.get("challenge-controller-rate", candidate.subscriber) ?? 0;
+      if (now < next)
+        continue;
+      options.state.set("challenge-controller-rate", candidate.subscriber, now + 30);
+      attempted += 1;
+      signal.throwIfAborted();
+      await acceptCandidate(candidate.subscriber, candidate.tuple.subscription.objectHash, signal);
+    }
+  }
+  return {
+    async discover(signal) {
+      const view = await activeView(signal);
+      const key = view.hasCurrentAdvertisement ? view.key : void 0;
+      const loaded = key === void 0 ? void 0 : await options.keys.getPrivateKey({
+        encryptionKey: key.objectHash,
+        keyId: key.body.keyId,
+        publisher: options.publisher
+      });
+      status = {
+        ...status,
+        keyLoaded: loaded !== void 0,
+        activeKeyIds: key === void 0 ? [] : [key.body.keyId]
+      };
+      const subscriptions = [];
+      const active = view.subscriptions.filter((item) => item.state === "active");
+      if (active.length > (options.maxSubscriptions ?? 64))
+        throw new Error("Publisher active subscription limit exceeded");
+      for (const lifecycle of active) {
+        if (lifecycle.state !== "active" || lifecycle.activeFromBlock === void 0)
+          continue;
+        try {
+          const tuple = lifecycle.tuples.find((item) => item.subscription.objectHash === lifecycle.selectedSubscription);
+          if (tuple === void 0)
+            throw new Error("Active publisher subscription has no selected tuple");
+          const encrypted = tuple.subscription.body;
+          if (encrypted.chainId !== options.authorizationChainId)
+            throw new Error("Subscription authorization chain mismatch");
+          const publisherKey = await options.keys.getPrivateKey({
+            encryptionKey: encrypted.encryptionKey,
+            keyId: encrypted.keyId,
+            publisher: options.publisher
+          });
+          if (publisherKey === void 0)
+            throw new Error("Subscription encryption key is unavailable");
+          const plaintext = await decryptWakeSubscription({
+            publisherKey,
+            subscriber: tuple.subscriber,
+            subscription: encrypted
+          });
+          options.transport.assertAllowed(plaintext.endpoint);
+          subscriptions.push({
+            subscriptionHash: tuple.subscription.objectHash,
+            authorizationChainId: options.authorizationChainId,
+            controller: tuple.subscriber,
+            audience: plaintext.audience,
+            endpoint: plaintext.endpoint,
+            deploymentId: plaintext.deploymentId,
+            ...plaintext.queueId === null ? {} : { queueId: plaintext.queueId },
+            source: plaintext.filter.source,
+            fromPosition: plaintext.filter.fromPosition,
+            maxPositionsPerWake: plaintext.filter.maxPositionsPerWake,
+            filterHash: await sourceWakeFilterHash(plaintext.filter)
+          });
+        } catch {
+          status = { ...status, rejectedSubscriptions: status.rejectedSubscriptions + 1 };
+        }
+      }
+      return subscriptions;
+    },
+    async isActive(subscription, signal) {
+      const view = await activeView(signal);
+      return view.subscriptions.some((item) => item.state === "active" && item.selectedSubscription === subscription.subscriptionHash && item.tuples.some((tuple) => tuple.subscription.objectHash === subscription.subscriptionHash && tuple.subscriber === subscription.controller));
+    },
+    async acceptPending(signal) {
+      if (accepting === void 0) {
+        const scope = publisherAbortScope([owner.signal, signal]);
+        accepting = accept(scope.signal).finally(() => {
+          scope.dispose();
+          accepting = void 0;
+        });
+      }
+      await accepting;
+    },
+    async close() {
+      await Promise.allSettled([accepting, viewing].filter((item) => item !== void 0));
+    },
+    status() {
+      return { ...status, challengeFailures: options.state.entries("challenge-failures").reduce((sum, item) => sum + item.value, 0) };
+    }
+  };
+}
+
+// src/runtime/httpsTransport.ts
+import { Buffer as Buffer3 } from "node:buffer";
+import { lookup } from "node:dns/promises";
+import { request } from "node:https";
+import { BlockList, isIP } from "node:net";
+import { z as z2 } from "zod";
+
+// src/runtime/sources.ts
+import { createHash as createHash3 } from "node:crypto";
+import { canonicalJson as canonicalJson2 } from "@xyo-network/event-kit-protocol";
+import { completedUtcIntervalPosition, WakeSourceZod } from "@xyo-network/event-kit-schemas";
+import { PayloadBuilder } from "@xyo-network/sdk";
+import { asXL1BlockNumber } from "@xyo-network/xl1-sdk";
+import { FetchRequest, JsonRpcProvider } from "ethers";
+function publisherSourceKey(source) {
+  return createHash3("sha256").update(canonicalJson2(WakeSourceZod.parse(source))).digest("hex");
+}
+async function boundedPublisherOperation(operation, signal, timeoutMs = 1e4) {
+  const scope = publisherAbortScope([signal], timeoutMs);
+  const combined = scope.signal;
+  let rejectAbort;
+  const aborted = new Promise((_resolve, reject) => {
+    rejectAbort = () => reject(new Error("Publisher operation aborted or timed out"));
+    combined.addEventListener("abort", rejectAbort, { once: true });
+  });
+  try {
+    combined.throwIfAborted();
+    return await Promise.race([operation, aborted]);
+  } finally {
+    if (rejectAbort !== void 0)
+      combined.removeEventListener("abort", rejectAbort);
+    scope.dispose();
+  }
+}
+function createXl1PublisherSource(options) {
+  const source = WakeSourceZod.parse(options.source);
+  if (source.kind !== "xl1-finalized")
+    throw new Error("Expected an XL1 finalized source");
+  return {
+    source,
+    async head(signal) {
+      const chainId = String(await boundedPublisherOperation(Promise.resolve(options.viewer.chainId()), signal));
+      if (chainId !== source.chainId)
+        throw new Error("XL1 source chain identity changed");
+      const position = Number(await boundedPublisherOperation(Promise.resolve(options.viewer.finalization.headNumber()), signal));
+      if (!Number.isSafeInteger(position) || position < 0)
+        throw new Error("XL1 finalized head is invalid");
+      const block = await boundedPublisherOperation(Promise.resolve(options.viewer.block.blockByNumber(asXL1BlockNumber(position, true))), signal);
+      if (block?.[0].block !== position || !/^[0-9a-f]{64}$/u.test(block[0]._hash)) {
+        throw new Error("XL1 finalized head block is unavailable or inconsistent");
+      }
+      if (String(block[0].chain) !== source.chainId || await PayloadBuilder.hash(block[0]) !== block[0]._hash) {
+        throw new Error("XL1 finalized head block chain or hash is inconsistent");
+      }
+      return { position, hash: block[0]._hash };
+    }
+  };
+}
+function createEthereumFinalizedPublisherSource(options) {
+  const source = WakeSourceZod.parse(options.source);
+  if (source.kind !== "ethereum-finalized")
+    throw new Error("Expected an Ethereum finalized source");
+  const { chainId, genesisHash } = source;
+  const url = new URL(options.rpcUrl);
+  if (url.protocol !== "https:" || url.username !== "" || url.password !== "" || url.hash !== "") {
+    throw new Error("Ethereum source RPC must use HTTPS without URL credentials or fragments");
+  }
+  const connection = new FetchRequest(url.href);
+  connection.timeout = options.requestTimeoutMs ?? 1e4;
+  const transport = createBoundedPublisherEthersTransport({
+    requestTimeoutMs: options.requestTimeoutMs,
+    maxResponseBytes: 2 * 1024 * 1024,
+    maxConcurrency: 8
+  });
+  connection.getUrlFunc = transport.getUrl;
+  connection.setThrottleParams({ maxAttempts: 1 });
+  const provider = new JsonRpcProvider(connection, void 0, { batchMaxCount: 1, cacheTimeout: -1 });
+  let reading;
+  let closed = false;
+  let closing;
+  const close = () => closing ??= (async () => {
+    closed = true;
+    provider.destroy();
+    await transport.close();
+  })();
+  const onAbort = () => {
+    void close();
+  };
+  async function read() {
+    const requests = [provider.getNetwork(), provider.getBlock(0), provider.getBlock("finalized")];
+    const values = await Promise.all(requests).catch(async (error) => {
+      await Promise.allSettled(requests);
+      throw error;
+    });
+    const [network, genesis, block] = values;
+    if (network.chainId.toString() !== chainId || genesis?.hash?.slice(2).toLowerCase() !== genesisHash) {
+      throw new Error("Ethereum source chain identity mismatch");
+    }
+    if (block?.hash === null || block === null || !/^0x[0-9a-fA-F]{64}$/u.test(block.hash) || !Number.isSafeInteger(block.number) || block.number < 0) throw new Error("Ethereum finalized head is unavailable");
+    return { position: block.number, hash: block.hash.slice(2).toLowerCase() };
+  }
+  return {
+    source,
+    close,
+    async head(signal) {
+      signal.throwIfAborted();
+      if (closed) throw new Error("Ethereum source is closed");
+      signal.addEventListener("abort", onAbort, { once: true });
+      reading ??= read().finally(() => {
+        reading = void 0;
+      });
+      try {
+        return await boundedPublisherOperation(reading, signal, options.requestTimeoutMs ?? 1e4);
+      } finally {
+        signal.removeEventListener("abort", onAbort);
+      }
+    }
+  };
+}
+function createUtcIntervalPublisherSource(options) {
+  const source = WakeSourceZod.parse(options.source);
+  if (source.kind !== "utc-interval")
+    throw new Error("Expected a UTC interval source");
+  const nowSeconds = options.nowSeconds ?? (() => Math.floor(Date.now() / 1e3));
+  return {
+    source,
+    async head(signal) {
+      signal.throwIfAborted();
+      const now = nowSeconds();
+      if (!Number.isSafeInteger(now) || now < 0)
+        throw new Error("UTC interval clock is invalid");
+      return { position: completedUtcIntervalPosition(source, now) ?? -1 };
+    }
+  };
+}
+
+// src/runtime/httpsTransport.ts
+var OptionsZod = z2.strictObject({
+  allowedEndpoints: z2.array(z2.url()).min(1).max(64),
+  endpointHeaders: z2.array(z2.strictObject({
+    endpoint: z2.url(),
+    headers: z2.strictObject({ "x-vercel-protection-bypass": z2.string().min(1).max(4096).regex(/^[\x21-\x7E]+$/u) })
+  })).max(64).default([]),
+  maxResponseBytes: z2.number().int().min(1).max(1048576).default(65536),
+  requestTimeoutMs: z2.number().int().min(100).max(6e4).default(1e4)
+});
+var nonPublicIpv4 = new BlockList();
+for (const [address, prefix] of [
+  ["0.0.0.0", 8],
+  ["10.0.0.0", 8],
+  ["100.64.0.0", 10],
+  ["127.0.0.0", 8],
+  ["169.254.0.0", 16],
+  ["172.16.0.0", 12],
+  ["192.0.0.0", 24],
+  ["192.0.2.0", 24],
+  ["192.88.99.0", 24],
+  ["192.168.0.0", 16],
+  ["198.18.0.0", 15],
+  ["198.51.100.0", 24],
+  ["203.0.113.0", 24],
+  ["224.0.0.0", 4],
+  ["240.0.0.0", 4]
+])
+  nonPublicIpv4.addSubnet(address, prefix, "ipv4");
+var globalIpv6 = new BlockList();
+globalIpv6.addSubnet("2000::", 3, "ipv6");
+var nonPublicIpv6 = new BlockList();
+for (const [address, prefix] of [
+  ["2001::", 23],
+  ["2001:db8::", 32],
+  ["2002::", 16],
+  ["3fff::", 20]
+])
+  nonPublicIpv6.addSubnet(address, prefix, "ipv6");
+function isPublicPublisherAddress(address) {
+  if (isIP(address) === 4)
+    return !nonPublicIpv4.check(address, "ipv4");
+  if (isIP(address) !== 6)
+    return false;
+  return globalIpv6.check(address, "ipv6") && !nonPublicIpv6.check(address, "ipv6");
+}
+function createPublisherHttpsTransport(input) {
+  const parsed = OptionsZod.safeParse(input);
+  if (!parsed.success) throw new Error("Invalid publisher HTTPS transport configuration");
+  const options = parsed.data;
+  const allowed = new Set(options.allowedEndpoints.map((endpoint) => {
+    const url = new URL(endpoint);
+    if (url.href !== endpoint || url.protocol !== "https:" || url.port !== "" && url.port !== "443" || url.username !== "" || url.password !== "" || url.hash !== "")
+      throw new Error("Publisher destinations must be canonical public HTTPS URLs on port 443");
+    const literal = url.hostname.replaceAll(/^\[|\]$/gu, "");
+    if (isIP(literal) !== 0 && !isPublicPublisherAddress(literal))
+      throw new Error("Publisher destination is not public");
+    if (url.hostname === "localhost" || url.hostname.endsWith(".localhost") || url.hostname.endsWith(".local"))
+      throw new Error("Publisher destination is not public");
+    return endpoint;
+  }));
+  const assertAllowed = (endpoint) => {
+    if (!allowed.has(endpoint))
+      throw new Error("Publisher destination is not explicitly allowed");
+  };
+  const endpointHeaders = /* @__PURE__ */ new Map();
+  for (const entry of options.endpointHeaders) {
+    assertAllowed(entry.endpoint);
+    if (endpointHeaders.has(entry.endpoint)) throw new Error("Duplicate publisher endpoint header configuration");
+    endpointHeaders.set(entry.endpoint, entry.headers);
+  }
+  return {
+    assertAllowed,
+    async post(endpoint, body, signal, jwt) {
+      assertAllowed(endpoint);
+      signal.throwIfAborted();
+      const url = new URL(endpoint);
+      const scope = publisherAbortScope([signal], options.requestTimeoutMs);
+      const combined = scope.signal;
+      try {
+        const addresses = await boundedPublisherOperation(lookup(url.hostname.replaceAll(/^\[|\]$/gu, ""), { all: true, verbatim: true }), combined, options.requestTimeoutMs);
+        combined.throwIfAborted();
+        if (addresses.length === 0 || addresses.some((item) => !isPublicPublisherAddress(item.address)))
+          throw new Error("Publisher DNS answer includes a non-public address");
+        const selected = addresses[0];
+        if (selected === void 0)
+          throw new Error("Publisher DNS lookup was empty");
+        const encoded = Buffer3.from(JSON.stringify(body));
+        if (encoded.byteLength > 65536)
+          throw new Error("Publisher request body is too large");
+        return await new Promise((resolve, reject) => {
+          const call = request(url, {
+            agent: false,
+            headers: {
+              ...endpointHeaders.get(endpoint),
+              "content-length": encoded.byteLength,
+              "content-type": "application/json",
+              ...jwt === void 0 ? {} : { authorization: `Bearer ${jwt}` }
+            },
+            lookup(_hostname, lookupOptions, callback) {
+              if (lookupOptions.all)
+                callback(null, [{ address: selected.address, family: selected.family }]);
+              else
+                callback(null, selected.address, selected.family);
+            },
+            method: "POST",
+            rejectUnauthorized: true,
+            signal: combined
+          }, (response) => {
+            const status = response.statusCode ?? 500;
+            if (status >= 300 && status < 400) {
+              response.destroy();
+              reject(new Error("Publisher HTTPS redirects are forbidden"));
+              return;
+            }
+            let size = 0;
+            const chunks = [];
+            response.on("data", (chunk) => {
+              size += chunk.byteLength;
+              if (size > options.maxResponseBytes) {
+                response.destroy();
+                reject(new Error("Publisher HTTPS response is too large"));
+              } else
+                chunks.push(chunk);
+            });
+            response.on("error", () => reject(new Error("Publisher HTTPS response failed")));
+            response.on("end", () => {
+              try {
+                const responseBody = size === 0 ? null : JSON.parse(Buffer3.concat(chunks).toString("utf8"));
+                const retry = Number(response.headers["retry-after"]);
+                resolve({
+                  status,
+                  body: responseBody,
+                  ...Number.isFinite(retry) && retry > 0 ? { retryAfterMs: Math.min(retry * 1e3, 36e5) } : {}
+                });
+              } catch {
+                reject(new Error("Publisher HTTPS response is not JSON"));
+              }
+            });
+          });
+          call.on("error", () => reject(new Error("Publisher HTTPS request failed")));
+          call.end(encoded);
+        });
+      } finally {
+        scope.dispose();
+      }
+    }
+  };
+}
+
+// src/runtime/publisherRuntime.ts
+import { randomBytes as randomBytes6 } from "node:crypto";
+import { isDeepStrictEqual as isDeepStrictEqual2 } from "node:util";
+import { createMemoryLocator, PeriodicActor } from "@ariestools/actor";
+import { creatable } from "@ariestools/sdk";
+import { WakeEnvelopeSchema, WakeEnvelopeZod as WakeEnvelopeZod2 } from "@xyo-network/event-kit-schemas";
+import { z as z3 } from "zod";
+
+// src/runtime/sourceSigner.ts
+import { randomBytes as randomBytes5 } from "node:crypto";
+import {
+  NormalizedAddressZod as NormalizedAddressZod4,
+  WakeEnvelopeZod,
+  WakeJwtSchema
+} from "@xyo-network/event-kit-schemas";
+import { PayloadBuilder as PayloadBuilder2 } from "@xyo-network/sdk";
+function createAccountSourceWakeSigner(options) {
+  const publisher = NormalizedAddressZod4.parse(options.publisher);
+  if (String(options.account.address).replace(/^0x/u, "").toLowerCase() !== publisher)
+    throw new Error("Publisher signing account mismatch");
+  return {
+    async sign(input, audience) {
+      const event = WakeEnvelopeZod.parse(input);
+      const eventHash = await PayloadBuilder2.dataHash(event);
+      const now = options.nowSeconds?.() ?? Math.floor(Date.now() / 1e3);
+      if (!Number.isSafeInteger(now) || now < 0)
+        throw new Error("Publisher signing clock is invalid");
+      const { token: jwt } = await options.account.signJwt({
+        audience,
+        claims: { eventHash, jti: randomBytes5(16).toString("hex") },
+        now,
+        schema: WakeJwtSchema,
+        ttl: 60
+      });
+      return {
+        event,
+        eventHash,
+        jwt,
+        publisher
+      };
+    }
+  };
+}
+
+// src/runtime/publisherRuntime.ts
+function activationReady(status) {
+  return (status?.keyLoaded ?? true) && (status?.pendingSubscriptions ?? 0) === 0;
+}
+function assertDeliveryState(record, subscription) {
+  if (!isDeepStrictEqual2(record.subscription, subscription))
+    throw new Error("Subscription revision changed without a new identity");
+  if (!Number.isSafeInteger(record.cursor) || record.cursor < subscription.fromPosition - 1 || ![record.delivered, record.failures, record.nextAttemptMs].every((value) => Number.isSafeInteger(value) && value >= 0) || !["active", "blocked", "cancelled"].includes(record.state))
+    throw new Error("Persisted publisher delivery state is invalid");
+  if (record.pending !== void 0) {
+    const pending = WakeEnvelopeZod2.parse(record.pending);
+    if (pending.fromPosition !== record.cursor + 1 || pending.toPosition - pending.fromPosition + 1 > subscription.maxPositionsPerWake || pending.authorizationChainId !== subscription.authorizationChainId || pending.deploymentId !== subscription.deploymentId || pending.queueId !== subscription.queueId || pending.filterHash !== subscription.filterHash || !isDeepStrictEqual2(pending.source, subscription.source))
+      throw new Error("Persisted publisher outbox binding is invalid");
+  }
+}
+function makeEvent(subscription, fromPosition, toPosition, now, wakeId = randomBytes6(16).toString("hex")) {
+  return WakeEnvelopeZod2.parse({
+    schema: WakeEnvelopeSchema,
+    authorizationChainId: subscription.authorizationChainId,
+    deploymentId: subscription.deploymentId,
+    filterHash: subscription.filterHash,
+    fromPosition,
+    issuedAt: now,
+    source: subscription.source,
+    toPosition,
+    wakeId,
+    ...subscription.queueId === void 0 ? {} : { queueId: subscription.queueId }
+  });
+}
+var PublisherRuntimeActor = class extends PeriodicActor {
+  async runPass(context) {
+    await this.params.tick(context.signal);
+  }
+};
+PublisherRuntimeActor = __decorateClass([
+  creatable()
+], PublisherRuntimeActor);
+var TimingZod = z3.object({
+  concurrency: z3.number().int().min(1).max(32).default(4),
+  intervalMs: z3.number().int().min(100).max(6e4).default(1e3),
+  maxSubscriptions: z3.number().int().min(1).max(1024).default(64),
+  requestTimeoutMs: z3.number().int().min(100).max(6e4).default(1e4)
+});
+var DeliveryResponseError = class extends Error {
+  retryAfterMs;
+  status;
+  constructor(status, retryAfterMs) {
+    super("Publisher admission failed");
+    this.status = status;
+    this.retryAfterMs = retryAfterMs;
+  }
+  get retryable() {
+    return this.status === 408 || this.status === 429 || this.status >= 500;
+  }
+};
+async function createPersistentEventPublisherRuntime(options) {
+  const timing = TimingZod.parse(options);
+  if (options.sources.length < 1 || options.sources.length > 16)
+    throw new Error("Publisher requires between one and sixteen bounded sources");
+  const clock = options.nowSeconds ?? (() => Math.floor(Date.now() / 1e3));
+  const signer = createAccountSourceWakeSigner({
+    account: options.account,
+    publisher: options.publisher,
+    nowSeconds: clock
+  });
+  const sourceReaders = new Map(options.sources.map((reader) => [publisherSourceKey(reader.source), reader]));
+  if (sourceReaders.size !== options.sources.length)
+    throw new Error("Duplicate publisher source identity");
+  const abort = new AbortController();
+  let running = false;
+  let ready = false;
+  let clockHealthy = true;
+  let passes = 0;
+  let lastError;
+  let sourcesHealthy = false;
+  let stop;
+  const state = options.state;
+  const timed = (promise, signal) => boundedPublisherOperation(promise, signal, timing.requestTimeoutMs);
+  function loadDelivery(subscription, now) {
+    const key = subscription.subscriptionHash;
+    let record = state.get("deliveries", key);
+    if (record === void 0) {
+      makeEvent(subscription, subscription.fromPosition, subscription.fromPosition, now, "0".repeat(32));
+      if (!Number.isSafeInteger(subscription.maxPositionsPerWake) || subscription.maxPositionsPerWake < 1 || subscription.maxPositionsPerWake > 4096) {
+        throw new Error("Invalid source range budget");
+      }
+      record = {
+        subscription,
+        cursor: subscription.fromPosition - 1,
+        delivered: 0,
+        failures: 0,
+        nextAttemptMs: 0,
+        state: "active"
+      };
+      state.set("deliveries", key, record);
+    }
+    assertDeliveryState(record, subscription);
+    return record;
+  }
+  function prepareDelivery(record, now, heads) {
+    if (record.pending !== void 0) return { ...record, pending: record.pending };
+    const subscription = record.subscription;
+    const head = heads.get(publisherSourceKey(subscription.source));
+    if (head === void 0 || head instanceof Error) throw new Error("Configured source is unavailable");
+    if (head.position <= record.cursor) return;
+    const fromPosition = record.cursor + 1;
+    const pending = makeEvent(subscription, fromPosition, Math.min(head.position, fromPosition + subscription.maxPositionsPerWake - 1), now);
+    const prepared = { ...record, pending };
+    state.transaction(() => {
+      const logicalKey = JSON.stringify([subscription.subscriptionHash, pending.fromPosition, pending.toPosition]);
+      if (!state.insert("delivery-events", logicalKey, pending)) throw new Error("Publisher logical range already exists outside its contiguous cursor");
+      state.set("deliveries", subscription.subscriptionHash, prepared);
+    });
+    return prepared;
+  }
+  async function stillActive(record, signal) {
+    if (await timed(options.discovery.isActive(record.subscription, signal), signal)) return true;
+    state.set("deliveries", record.subscription.subscriptionHash, {
+      ...record,
+      pending: void 0,
+      state: "cancelled"
+    });
+    return false;
+  }
+  async function sendDelivery(record, signal, now) {
+    const { pending, subscription } = record;
+    signal.throwIfAborted();
+    const signed = await signer.sign(pending, subscription.audience);
+    signal.throwIfAborted();
+    const attempt = state.get("delivery-attempts", pending.wakeId)?.count ?? 0;
+    state.set("delivery-attempts", pending.wakeId, {
+      count: attempt + 1,
+      startedAt: now,
+      status: "in-flight"
+    });
+    const response = await options.transport.post(subscription.endpoint, signed.event, signal, signed.jwt);
+    state.set("delivery-attempts", pending.wakeId, {
+      count: attempt + 1,
+      startedAt: now,
+      status: response.status
+    });
+    if (response.status !== 200 && response.status !== 202) throw new DeliveryResponseError(response.status, response.retryAfterMs);
+    const receipt = z3.object({ receiptId: z3.string().min(1), wakeId: z3.literal(pending.wakeId) }).safeParse(response.body);
+    if (!receipt.success) throw new Error("Publisher admission did not return a matching durable receipt");
+    signal.throwIfAborted();
+    state.transaction(() => {
+      state.set("delivery-receipts", pending.wakeId, { receiptId: receipt.data.receiptId, receivedAt: now });
+      state.set("deliveries", subscription.subscriptionHash, {
+        subscription,
+        cursor: pending.toPosition,
+        delivered: record.delivered + 1,
+        failures: 0,
+        nextAttemptMs: 0,
+        state: "active"
+      });
+    });
+  }
+  async function deliver(subscription, signal, now, heads) {
+    let record = loadDelivery(subscription, now);
+    if (record.state !== "active" || record.nextAttemptMs > now * 1e3) return;
+    try {
+      if (!await stillActive(record, signal)) return;
+      options.transport.assertAllowed(subscription.endpoint);
+      if (!sourceReaders.has(publisherSourceKey(subscription.source))) throw new Error("Subscription source is not configured");
+      const prepared = prepareDelivery(record, now, heads);
+      if (prepared === void 0) return;
+      record = prepared;
+      if (!await stillActive(record, signal)) return;
+      await sendDelivery(prepared, signal, now);
+    } catch (error) {
+      if (signal.aborted) return;
+      state.set("deliveries", subscription.subscriptionHash, {
+        ...record,
+        failures: record.failures + 1,
+        state: error instanceof DeliveryResponseError && !error.retryable ? "blocked" : "active",
+        nextAttemptMs: now * 1e3 + Math.min(36e5, error instanceof DeliveryResponseError && error.retryAfterMs !== void 0 ? error.retryAfterMs : Math.min(3e5, 1e3 * 2 ** Math.min(record.failures, 8))),
+        lastError: "delivery-failed"
+      });
+    }
+  }
+  async function readSources(signal) {
+    const heads = /* @__PURE__ */ new Map();
+    const results = await Promise.allSettled([...sourceReaders].map(async ([key, reader]) => {
+      const head = await timed(reader.head(signal), signal);
+      if (!Number.isSafeInteger(head.position) || head.position < -1)
+        throw new Error("Source head is invalid");
+      const previous = state.get("source-heads", key);
+      if (previous !== void 0 && (head.position < previous.position || head.position === previous.position && head.hash !== previous.hash)) {
+        throw new Error("Finalized source regressed or changed hash");
+      }
+      signal.throwIfAborted();
+      state.set("source-heads", key, head);
+      heads.set(key, head);
+    }));
+    sourcesHealthy = results.every((item) => item.status === "fulfilled");
+    for (const [index, result] of results.entries())
+      if (result.status === "rejected") {
+        const key = [...sourceReaders.keys()][index];
+        if (key !== void 0)
+          heads.set(key, new Error("Source read failed"));
+      }
+    return heads;
+  }
+  async function reconcileDeliveries(subscriptions, signal) {
+    if (subscriptions.length > timing.maxSubscriptions) throw new Error("Publisher subscription limit exceeded");
+    const active = new Set(subscriptions.map((subscription) => subscription.subscriptionHash));
+    if (active.size !== subscriptions.length) throw new Error("Duplicate subscription identity");
+    const unavailable = state.entries("deliveries").filter((item) => !active.has(item.key) && item.value.state !== "cancelled");
+    let available = true;
+    for (let offset = 0; offset < unavailable.length; offset += timing.concurrency) {
+      signal.throwIfAborted();
+      const results = await Promise.allSettled(unavailable.slice(offset, offset + timing.concurrency).map(async ({ key, value }) => {
+        const stillAuthorized = await timed(options.discovery.isActive(value.subscription, signal), signal);
+        if (!stillAuthorized) state.set("deliveries", key, {
+          ...value,
+          pending: void 0,
+          state: "cancelled"
+        });
+        return stillAuthorized;
+      }));
+      available = available && results.every((result) => result.status === "fulfilled" && !result.value);
+    }
+    return available;
+  }
+  async function tick(actorSignal) {
+    const scope = publisherAbortScope([abort.signal, actorSignal]);
+    const signal = scope.signal;
+    try {
+      signal.throwIfAborted();
+      const now = clock();
+      const prior = state.get("runtime", "highest-wall-clock") ?? 0;
+      clockHealthy = Number.isSafeInteger(now) && now >= prior;
+      if (!clockHealthy)
+        throw new Error("Publisher clock moved backwards");
+      state.set("runtime", "highest-wall-clock", now);
+      const subscriptions = await timed(options.discovery.discover(signal), signal);
+      const subscriptionsAvailable = await reconcileDeliveries(subscriptions, signal);
+      const heads = await readSources(signal);
+      for (let offset = 0; offset < subscriptions.length; offset += timing.concurrency) {
+        signal.throwIfAborted();
+        const outcomes = await Promise.allSettled(subscriptions.slice(offset, offset + timing.concurrency).map((subscription) => deliver(subscription, signal, now, heads)));
+        const failed = outcomes.find((result) => result.status === "rejected");
+        if (failed?.status === "rejected")
+          throw failed.reason;
+      }
+      if (options.discovery.acceptPending !== void 0)
+        await timed(options.discovery.acceptPending(signal), signal);
+      const discoveryStatus = options.discovery.status?.();
+      ready = subscriptionsAvailable && sourcesHealthy && activationReady(discoveryStatus);
+      lastError = subscriptionsAvailable ? void 0 : "publisher-subscription-unavailable";
+      passes += 1;
+    } catch (error) {
+      ready = false;
+      lastError = clockHealthy ? "publisher-pass-failed" : "publisher-clock-unhealthy";
+      if (!signal.aborted)
+        throw error;
+    } finally {
+      scope.dispose();
+    }
+  }
+  const actor = await PublisherRuntimeActor.create({
+    locator: createMemoryLocator({}),
+    intervalMs: timing.intervalMs,
+    firstRun: "immediate",
+    readiness: "immediate",
+    tick
+  });
+  return {
+    async start() {
+      if (stop !== void 0)
+        throw new Error("Publisher is stopped");
+      if (!running) {
+        await actor.start();
+        running = true;
+      }
+    },
+    async runOnce() {
+      if (stop !== void 0)
+        throw new Error("Publisher is stopped");
+      await actor.runOnce();
+    },
+    stop() {
+      return stop ??= (async () => {
+        abort.abort();
+        const failures = [];
+        try {
+          await actor.stop();
+        } catch (error) {
+          failures.push(error);
+        }
+        try {
+          await options.discovery.close?.();
+        } catch (error) {
+          failures.push(error);
+        }
+        for (const source of options.sources)
+          try {
+            await source.close?.();
+          } catch (error) {
+            failures.push(error);
+          }
+        running = false;
+        ready = false;
+        if (failures.length > 0)
+          throw new AggregateError(failures, "Publisher runtime shutdown failed");
+      })();
+    },
+    status() {
+      const deliveries = state.entries("deliveries").map((item) => item.value);
+      return {
+        running,
+        ready: running && ready,
+        clockHealthy,
+        degraded: !ready || deliveries.some((item) => item.state !== "cancelled" && item.failures > 0),
+        publisher: options.publisher,
+        activeSubscriptions: deliveries.filter((item) => item.state === "active").length,
+        pendingDeliveries: deliveries.filter((item) => item.pending !== void 0).length,
+        delivered: deliveries.reduce((sum, item) => sum + item.delivered, 0),
+        failures: deliveries.reduce((sum, item) => sum + item.failures, 0),
+        passes,
+        ...lastError === void 0 ? {} : { lastError },
+        ...options.discovery.status === void 0 ? {} : { handshake: options.discovery.status() },
+        sources: state.entries("source-heads").map((item) => ({ id: item.key, ...item.value })),
+        subscriptions: state.entries("deliveries").map((item) => ({
+          id: item.key,
+          cursor: item.value.cursor,
+          state: item.value.state,
+          pending: item.value.pending !== void 0,
+          failures: item.value.failures
+        }))
+      };
+    }
+  };
+}
+
+// src/runtime/restGateway.ts
+import { FetchJsonClient } from "@ariestools/sdk";
+import {
+  baseConfigFactoryLocator,
+  basicRestRunnerLocator,
+  basicRestViewerLocator,
+  creatableProvider,
+  releaseProviderFactoryLocator,
+  RestDataLakeRunner,
+  RestDataLakeViewer,
+  XyoGatewayMoniker,
+  XyoGatewayRunnerMoniker
+} from "@xyo-network/xl1-sdk";
+async function openPublisherRestGateway(options) {
+  const rest = {
+    finalized: { type: "rest", baseUrl: options.finalizedUrl },
+    chainState: { type: "rest", baseUrl: options.chainStateUrl },
+    index: { type: "rest", baseUrl: options.indexUrl ?? options.finalizedUrl }
+  };
+  const locator = options.account === void 0 ? await basicRestViewerLocator("event-kit-publisher-read", rest, void 0, { fetchFn: options.fetchFn, primeCaches: "off" }) : await basicRestRunnerLocator("event-kit-publisher-write", rest, void 0, {
+    fetchFn: options.fetchFn,
+    primeCaches: "off",
+    rpcUrl: options.rpcUrl,
+    signerAccount: options.account
+  });
+  try {
+    const gateway = options.account === void 0 ? await locator.getInstance(XyoGatewayMoniker) : await locator.getInstance(XyoGatewayRunnerMoniker);
+    let stopping;
+    return Object.freeze({ gateway, stop: () => stopping ??= releaseProviderFactoryLocator(locator) });
+  } catch (error) {
+    await releaseProviderFactoryLocator(locator);
+    throw error;
+  }
+}
+var BoundedRestDataLakeViewer = class extends RestDataLakeViewer {
+  get client() {
+    if (this.context.fetchFn === void 0)
+      throw new Error("Publisher datalake requires its bounded fetch transport");
+    return new FetchJsonClient({ fetcher: this.context.fetchFn });
+  }
+};
+BoundedRestDataLakeViewer = __decorateClass([
+  creatableProvider()
+], BoundedRestDataLakeViewer);
+var BoundedRestDataLakeRunner = class extends RestDataLakeRunner {
+  get client() {
+    if (this.context.fetchFn === void 0)
+      throw new Error("Publisher datalake requires its bounded fetch transport");
+    return new FetchJsonClient({ fetcher: this.context.fetchFn });
+  }
+};
+BoundedRestDataLakeRunner = __decorateClass([
+  creatableProvider()
+], BoundedRestDataLakeRunner);
+async function openPublisherDataLake(options) {
+  const locator = await baseConfigFactoryLocator({
+    connections: { "event-kit-lake": { type: "rest", baseUrl: options.url } },
+    providerBindings: { DataLakeViewer: { connection: "event-kit-lake" }, DataLakeRunner: { connection: "event-kit-lake" } }
+  });
+  locator.context.fetchFn = options.fetchFn;
+  locator.register(BoundedRestDataLakeViewer.factory(BoundedRestDataLakeViewer.dependencies));
+  if (options.writable)
+    locator.register(BoundedRestDataLakeRunner.factory(BoundedRestDataLakeRunner.dependencies));
+  locator.freeze();
+  try {
+    const reader = await locator.getInstance(BoundedRestDataLakeViewer.defaultMoniker);
+    const writer = options.writable ? await locator.getInstance(BoundedRestDataLakeRunner.defaultMoniker) : void 0;
+    return {
+      reader,
+      writer,
+      async close() {
+        await releaseProviderFactoryLocator(locator);
+      }
+    };
+  } catch (error) {
+    await releaseProviderFactoryLocator(locator);
+    throw error;
+  }
+}
+
+// src/runtime/sqliteHandshakeStores.ts
+import { isDeepStrictEqual as isDeepStrictEqual3 } from "node:util";
+import { endpointChallengeHash as endpointChallengeHash2 } from "@xyo-network/event-kit-protocol";
+import {
+  Base64Url32BytesZod as Base64Url32BytesZod3,
+  EndpointChallengeZod as EndpointChallengeZod3,
+  HandshakeIdZod as HandshakeIdZod4,
+  HashZod as HashZod5,
+  NormalizedAddressZod as NormalizedAddressZod5
+} from "@xyo-network/event-kit-schemas";
+import { z as z4 } from "zod";
+var KeyZod = z4.strictObject({
+  encryptionKey: HashZod5,
+  keyId: HandshakeIdZod4,
+  privateKey: Base64Url32BytesZod3,
+  publisher: NormalizedAddressZod5
+});
+var phases = ["signed", "content-written", "content-verified", "broadcast", "included", "finalized"];
+function requireTime2(value) {
+  if (!Number.isSafeInteger(value) || value < 0) throw new Error("Publisher clock is invalid");
+}
+function samePublicationIntent(left, right) {
+  return left.chainId === right.chainId && left.source === right.source && left.operationId === right.operationId && isDeepStrictEqual3(left.eventHashes, right.eventHashes) && isDeepStrictEqual3(left.attachmentHashes, right.attachmentHashes);
+}
+function publicationKey(intent) {
+  if (!/^[0-9a-f]{40}$/u.test(intent.chainId) || !/^[0-9a-f]{40}$/u.test(intent.source) || intent.operationId.length === 0 || intent.operationId.length > 256 || ![...intent.eventHashes, ...intent.attachmentHashes].every((hash) => HashZod5.safeParse(hash).success)) {
+    throw new Error("Invalid publication intent");
+  }
+  return JSON.stringify([intent.chainId, intent.source, intent.operationId]);
+}
+function createSqlitePublisherHandshakeStores(state) {
+  const replay = {
+    async load() {
+      return state.get("replay", "checkpoint");
+    },
+    async save(checkpoint) {
+      state.set("replay", "checkpoint", checkpoint);
+    }
+  };
+  const intents = {
+    async get(lookup2) {
+      const value = state.get("intents", intentLookupKey(lookup2));
+      return value === void 0 ? void 0 : await parseHandshakeMutationIntent(value);
+    },
+    async getOrCreate(raw) {
+      const proposed = await parseHandshakeMutationIntent(raw);
+      return state.transaction(() => {
+        const key = intentLookupKey(proposed);
+        const winner = state.get("intents", key);
+        if (winner !== void 0) {
+          assertSameIntentBinding(winner, proposed);
+          return { disposition: "resumed", intent: winner };
+        }
+        state.set("intents", key, proposed);
+        return { disposition: "created", intent: proposed };
+      });
+    }
+  };
+  const keys = {
+    async getPrivateKey(input) {
+      const key = `${NormalizedAddressZod5.parse(input.publisher)}:${HandshakeIdZod4.parse(input.keyId)}`;
+      const raw = state.get("encryption-keys", key);
+      if (raw === void 0) return;
+      const record = KeyZod.parse(raw);
+      if (record.encryptionKey !== HashZod5.parse(input.encryptionKey)) throw new Error("Encryption key identity mismatch");
+      const { publisher: _publisher, ...privateKey } = record;
+      return privateKey;
+    },
+    async putPrivateKey(input) {
+      const record = KeyZod.parse({ ...input.key, publisher: input.publisher });
+      return state.transaction(() => {
+        const key = `${record.publisher}:${record.keyId}`;
+        const prior = state.get("encryption-keys", key);
+        if (prior !== void 0) {
+          if (!isDeepStrictEqual3(prior, record)) throw new Error("Encryption key collision");
+          return "duplicate";
+        }
+        state.set("encryption-keys", key, record);
+        return "stored";
+      });
+    }
+  };
+  const current = (hash) => state.get("challenges", HashZod5.parse(hash));
+  const live = (record, now) => record.challenge.issuedAt <= now && now < record.challenge.expiresAt;
+  const challenges = {
+    async get(hash) {
+      return current(hash);
+    },
+    async issue(input) {
+      const challenge = EndpointChallengeZod3.parse(input.challenge);
+      const hash = HashZod5.parse(input.challengeHash);
+      if (await endpointChallengeHash2(challenge) !== hash) return { kind: "collision" };
+      return state.transaction(() => {
+        const priorNonce = state.get("challenge-nonces", challenge.nonce);
+        if (priorNonce !== void 0 && priorNonce !== hash) return { kind: "collision" };
+        const prior = current(hash);
+        if (prior !== void 0) return isDeepStrictEqual3(prior.challenge, challenge) ? { kind: "duplicate", record: prior } : { kind: "collision" };
+        const record = {
+          challenge,
+          challengeHash: hash,
+          state: "issued"
+        };
+        state.set("challenge-nonces", challenge.nonce, hash);
+        state.set("challenges", hash, record);
+        return { kind: "issued", record };
+      });
+    },
+    async beginAttempt(input) {
+      requireTime2(input.nowSeconds);
+      return state.transaction(() => {
+        const record = current(input.challengeHash);
+        if (record === void 0) return { kind: "missing" };
+        if (record.state === "verified") return { kind: "verified", record };
+        if (record.state === "attempted") return { kind: "already-attempted", record };
+        if (!live(record, input.nowSeconds)) return { kind: "expired", record };
+        const attempted = { ...record, state: "attempted" };
+        state.set("challenges", input.challengeHash, attempted);
+        return { kind: "started", record: attempted };
+      });
+    },
+    async completeVerified(input) {
+      requireTime2(input.nowSeconds);
+      const responseHash = HashZod5.parse(input.responseHash);
+      return state.transaction(() => {
+        const record = current(input.challengeHash);
+        if (record === void 0) return { kind: "missing" };
+        if (record.state === "verified") return { kind: record.responseHash === responseHash ? "duplicate" : "collision", record };
+        if (record.state !== "attempted") return { kind: "not-attempted", record };
+        if (!live(record, input.nowSeconds)) return { kind: "expired", record };
+        const verified = {
+          ...record,
+          responseHash,
+          state: "verified"
+        };
+        state.set("challenges", input.challengeHash, verified);
+        return { kind: "verified", record: verified };
+      });
+    }
+  };
+  const journal = {
+    async load(intent) {
+      const key = publicationKey(intent);
+      const signed = state.get("publication:signed", key);
+      if (signed === void 0) return;
+      if (!samePublicationIntent(signed, intent)) throw new Error("Publication intent collision");
+      let latest = signed;
+      for (const phase of phases) {
+        const record = state.get(`publication:${phase}`, key);
+        if (record === void 0) continue;
+        if (record.phase !== phase || !samePublicationIntent(record, intent) || !isDeepStrictEqual3(record.evidence, signed.evidence)) {
+          throw new Error("Publication evidence collision");
+        }
+        latest = record;
+      }
+      return latest;
+    },
+    async save(record) {
+      const key = publicationKey(record);
+      HashZod5.parse(record.evidence.transactionHash);
+      if (!phases.includes(record.phase)) throw new Error("Unknown publication phase");
+      state.transaction(() => {
+        const signed = state.get("publication:signed", key);
+        if (signed === void 0 && record.phase !== "signed") throw new Error("Publication must bind signed evidence first");
+        if (signed !== void 0 && (!samePublicationIntent(signed, record) || !isDeepStrictEqual3(signed.evidence, record.evidence))) {
+          throw new Error("Publication intent or evidence collision");
+        }
+        const namespace = `publication:${record.phase}`;
+        const prior = state.get(namespace, key);
+        if (prior !== void 0 && !isDeepStrictEqual3(prior, record)) throw new Error("Publication phase collision");
+        if (prior === void 0) state.set(namespace, key, record);
+      });
+    }
+  };
+  return {
+    challenges,
+    intents,
+    journal,
+    keys,
+    replay
+  };
+}
+
+// src/runtime/sqlitePublisherState.ts
+import { randomBytes as randomBytes7 } from "node:crypto";
+import { constants } from "node:fs";
+import {
+  lstat,
+  mkdir as mkdir5,
+  open as open5
+} from "node:fs/promises";
+import { hostname } from "node:os";
 import PATH12 from "node:path";
+function decode(value) {
+  return JSON.parse(value, (_key, candidate) => {
+    if (typeof candidate === "object" && candidate !== null && Object.keys(candidate).length === 1 && "$eventKitBigInt" in candidate && typeof candidate.$eventKitBigInt === "string" && /^(?:0|[1-9][0-9]*)$/u.test(candidate.$eventKitBigInt))
+      return BigInt(candidate.$eventKitBigInt);
+    return candidate;
+  });
+}
+function processExists(pid) {
+  if (!Number.isSafeInteger(pid) || pid < 1)
+    throw new Error("Invalid publisher owner record");
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    if (typeof error === "object" && error !== null && "code" in error && error.code === "ESRCH")
+      return false;
+    return true;
+  }
+}
+async function openSqlitePublisherState(options) {
+  if (options.path === ":memory:" || options.identity.length === 0)
+    throw new Error("Persistent publisher needs a file and an identity");
+  const path = PATH12.resolve(options.path);
+  const directory = PATH12.dirname(path);
+  await mkdir5(directory, { recursive: true, mode: 448 });
+  const metadata = await lstat(directory);
+  if (!metadata.isDirectory() || (metadata.mode & 63) !== 0)
+    throw new Error("Publisher state directory must be a real directory with 0700 permissions");
+  const file = await open5(path, constants.O_CREAT | constants.O_RDWR | constants.O_NOFOLLOW, 384);
+  try {
+    const metadata2 = await file.stat();
+    if (!metadata2.isFile() || (metadata2.mode & 63) !== 0)
+      throw new Error("Publisher database permissions must be 0600");
+    await file.sync();
+  } finally {
+    await file.close();
+  }
+  const { DatabaseSync: DatabaseSync2 } = await import("node:sqlite");
+  const database = new DatabaseSync2(path);
+  const token = randomBytes7(16).toString("hex");
+  let closed = false;
+  let inTransaction = false;
+  const transaction = (work) => {
+    if (closed)
+      throw new Error("Publisher state is closed");
+    if (inTransaction)
+      return work();
+    database.exec("BEGIN IMMEDIATE");
+    inTransaction = true;
+    try {
+      const result = work();
+      if (result instanceof Promise)
+        throw new Error("Publisher state transactions must be synchronous");
+      database.exec("COMMIT");
+      return result;
+    } catch (error) {
+      database.exec("ROLLBACK");
+      throw error;
+    } finally {
+      inTransaction = false;
+    }
+  };
+  try {
+    database.exec(`
+      PRAGMA journal_mode = WAL;
+      PRAGMA synchronous = FULL;
+      PRAGMA busy_timeout = 5000;
+      CREATE TABLE IF NOT EXISTS publisher_records (namespace TEXT NOT NULL, key TEXT NOT NULL, value TEXT NOT NULL, PRIMARY KEY(namespace, key));
+      CREATE TABLE IF NOT EXISTS publisher_owner (id INTEGER PRIMARY KEY CHECK(id = 1), host TEXT NOT NULL, pid INTEGER NOT NULL, token TEXT NOT NULL);
+    `);
+    transaction(() => {
+      const prior = database.prepare("SELECT host, pid, token FROM publisher_owner WHERE id = 1").get();
+      if (prior !== void 0 && (prior.host !== hostname() || processExists(prior.pid))) {
+        throw new Error("Publisher database already has an active owner; a shared or multi-host database is not supported");
+      }
+      const binding = database.prepare("SELECT value FROM publisher_records WHERE namespace = ? AND key = ?").get("metadata", "identity");
+      if (binding !== void 0 && decode(binding.value) !== options.identity)
+        throw new Error("Publisher database identity mismatch");
+      database.prepare("INSERT OR IGNORE INTO publisher_records(namespace,key,value) VALUES (?,?,?)").run("metadata", "identity", stringifyJson(options.identity));
+      database.prepare("INSERT OR REPLACE INTO publisher_owner(id,host,pid,token) VALUES (1,?,?,?)").run(hostname(), process.pid, token);
+    });
+  } catch (error) {
+    database.close();
+    throw error;
+  }
+  const read = database.prepare("SELECT value FROM publisher_records WHERE namespace = ? AND key = ?");
+  const list = database.prepare("SELECT key, value FROM publisher_records WHERE namespace = ? ORDER BY key");
+  const write = database.prepare("INSERT INTO publisher_records(namespace,key,value) VALUES (?,?,?) ON CONFLICT(namespace,key) DO UPDATE SET value = excluded.value");
+  const insert = database.prepare("INSERT OR IGNORE INTO publisher_records(namespace,key,value) VALUES (?,?,?)");
+  const remove = database.prepare("DELETE FROM publisher_records WHERE namespace = ? AND key = ?");
+  const assertOpen = () => {
+    if (closed)
+      throw new Error("Publisher state is closed");
+  };
+  return {
+    path,
+    get(namespace, key) {
+      assertOpen();
+      const row = read.get(namespace, key);
+      return row === void 0 ? void 0 : decode(row.value);
+    },
+    entries(namespace) {
+      assertOpen();
+      return list.all(namespace).map((row) => ({ key: row.key, value: decode(row.value) }));
+    },
+    set(namespace, key, value) {
+      assertOpen();
+      write.run(namespace, key, stringifyJson(value));
+    },
+    insert(namespace, key, value) {
+      assertOpen();
+      return insert.run(namespace, key, stringifyJson(value)).changes === 1;
+    },
+    remove(namespace, key) {
+      assertOpen();
+      remove.run(namespace, key);
+    },
+    transaction,
+    close() {
+      if (closed)
+        return;
+      transaction(() => {
+        database.prepare("DELETE FROM publisher_owner WHERE id = 1 AND token = ?").run(token);
+      });
+      database.close();
+      closed = true;
+    }
+  };
+}
+
+// src/sqliteWakeQueue.ts
+import { mkdir as mkdir6 } from "node:fs/promises";
+import PATH13 from "node:path";
 import { DatabaseSync } from "node:sqlite";
 async function createSqliteWakeQueue(options) {
   const inMemory = options.path === ":memory:";
-  const file = inMemory ? options.path : PATH12.resolve(options.path);
-  if (!inMemory) await mkdir5(PATH12.dirname(file), { recursive: true });
+  const file = inMemory ? options.path : PATH13.resolve(options.path);
+  if (!inMemory) await mkdir6(PATH13.dirname(file), { recursive: true });
   const database = new DatabaseSync(file);
   database.exec(`
     PRAGMA journal_mode = WAL;
@@ -2377,6 +3652,11 @@ export {
   HandshakeMutationIntentKinds,
   HandshakeMutationIntentZod,
   assertSameIntentBinding,
+  boundedPublisherOperation,
+  createAccountSourceWakeSigner,
+  createBoundedPublisherEthersTransport,
+  createBoundedPublisherFetch,
+  createEthereumFinalizedPublisherSource,
   createEventKitHandshakePublicationPort,
   createFilesystemCursorStore,
   createFilesystemEventKitReplayCheckpointStore,
@@ -2388,13 +3668,24 @@ export {
   createFilesystemWakeInbox,
   createFilesystemWakeQueue,
   createMemoryHandshakeMutationIntentStore,
+  createPersistentEventPublisherRuntime,
   createPublisherHandshakeClient,
+  createPublisherHandshakeDiscovery,
+  createPublisherHttpsTransport,
+  createSqlitePublisherHandshakeStores,
   createSqliteWakeQueue,
   createSubscriberHandshakeClient,
   createSynchronizedEventKitHandshakeReader,
+  createUtcIntervalPublisherSource,
+  createXl1PublisherSource,
   handshakeMutationRequestFingerprint,
   intentLookupKey,
+  isPublicPublisherAddress,
+  openPublisherDataLake,
+  openPublisherRestGateway,
+  openSqlitePublisherState,
   parseHandshakeMutationIntent,
-  parseHandshakeMutationIntentLookup
+  parseHandshakeMutationIntentLookup,
+  publisherSourceKey
 };
 //# sourceMappingURL=index.mjs.map