@xyo-network/event-kit-node 1.0.1 → 2.2.0

package/dist/node/index.mjs

@@ -9,60 +9,93 @@ var __decorateClass = (decorators, target, key, kind) => {
   return result;
 };
 
-// src/filesystemCursorStore.ts
+// src/bestEffortSnapshotWorker.ts
+import { canonicalJson, wakeSourcesEqual } from "@xyo-network/event-kit-protocol";
 import {
-  mkdir,
-  readFile,
-  writeFile
-} from "node:fs/promises";
-import PATH from "node:path";
-function createFilesystemCursorStore(options) {
-  const filePath = PATH.resolve(options.path);
+  HashZod,
+  NonnegativeJsonSafeIntegerZod,
+  WakeSourceZod
+} from "@xyo-network/event-kit-schemas";
+function createBestEffortSnapshotWorker(options) {
+  if (!Number.isSafeInteger(options.maxSnapshotBytes) || options.maxSnapshotBytes < 1)
+    throw new TypeError("Invalid bounded snapshot byte limit");
+  const nowSeconds = options.nowSeconds ?? (() => Math.floor(Date.now() / 1e3));
+  const leaseSeconds = options.leaseSeconds ?? 60;
+  if (!Number.isSafeInteger(leaseSeconds) || leaseSeconds < 1)
+    throw new TypeError("Invalid Best Effort worker lease lifetime");
+  async function processSnapshot(lease, signal) {
+    const source = lease.binding.source;
+    const observed = await options.source.readCurrent({
+      source,
+      signal,
+      maxBytes: options.maxSnapshotBytes
+    });
+    signal.throwIfAborted();
+    const snapshot = await options.source.verifySnapshot({
+      source,
+      signal,
+      snapshot: observed
+    });
+    signal.throwIfAborted();
+    WakeSourceZod.parse(snapshot.source);
+    NonnegativeJsonSafeIntegerZod.parse(snapshot.position);
+    if (snapshot.hash !== void 0) HashZod.parse(snapshot.hash);
+    if (!wakeSourcesEqual(source, snapshot.source) || source.kind !== "utc-interval" && snapshot.hash === void 0)
+      throw new TypeError("Independent snapshot does not match its pinned source");
+    if (Buffer.byteLength(canonicalJson(snapshot.value), "utf8") > options.maxSnapshotBytes)
+      throw new RangeError("Independent snapshot exceeds its configured byte bound");
+    const previous = lease.previousSnapshot;
+    if (previous !== void 0 && (snapshot.position < previous.position || snapshot.position === previous.position && snapshot.hash !== previous.hash))
+      throw new TypeError("Independent snapshot regressed or changed at the committed position");
+    if (!await lease.isCurrent()) return "superseded";
+    await options.application.commitSnapshot({ lease, snapshot });
+    signal.throwIfAborted();
+    return await lease.complete(snapshot) ? "completed" : "superseded";
+  }
   return {
-    async load() {
+    async runOnce(inputSignal) {
+      const controller = new AbortController();
+      const signal = inputSignal ?? controller.signal;
+      signal.throwIfAborted();
+      const now = nowSeconds();
+      await options.inbox.recoverExpired(now);
+      const lease = await options.inbox.claim({ nowSeconds: now, leaseSeconds });
+      if (lease === void 0) return "idle";
+      let failed = false;
+      let failure;
+      let releaseFailed = false;
+      let releaseFailure;
+      let result = "superseded";
       try {
-        const raw = await readFile(filePath, "utf8");
-        const parsed = JSON.parse(raw);
-        return typeof parsed.lastProcessedBlock !== "number" || !Number.isFinite(parsed.lastProcessedBlock) ? void 0 : parsed.lastProcessedBlock;
+        result = await processSnapshot(lease, signal);
       } catch (error) {
-        if (isNotFound(error)) return void 0;
-        throw error;
+        failed = true;
+        failure = error;
       }
-    },
-    async save(lastProcessedBlock) {
-      await mkdir(PATH.dirname(filePath), { recursive: true });
-      const body = { lastProcessedBlock };
-      await writeFile(filePath, `${JSON.stringify(body)}
-`, "utf8");
+      try {
+        await lease.release();
+      } catch (error) {
+        releaseFailed = true;
+        releaseFailure = error;
+      }
+      if (failed && releaseFailed)
+        throw new AggregateError([failure, releaseFailure], "Best Effort snapshot work failed and its lease release also failed", { cause: failure });
+      if (failed) throw failure;
+      if (releaseFailed) throw releaseFailure;
+      return result;
     }
   };
 }
-function isNotFound(error) {
-  return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
-}
 
-// src/filesystemPublisherOutbox.ts
-import { randomBytes as randomBytes2 } from "node:crypto";
-import {
-  mkdir as mkdir3,
-  rename,
-  unlink as unlink2
-} from "node:fs/promises";
+// src/filesystemCursorStore.ts
+import { lstat } from "node:fs/promises";
 import PATH4 from "node:path";
-
-// src/filesystemWakeQueue.ts
-import { randomBytes } from "node:crypto";
-import {
-  link,
-  open as open2,
-  readdir,
-  unlink
-} from "node:fs/promises";
-import PATH3 from "node:path";
+import { NonnegativeJsonSafeIntegerZod as NonnegativeJsonSafeIntegerZod2 } from "@xyo-network/event-kit-schemas";
+import { z } from "zod";
 
 // src/filesystemDurability.ts
-import { mkdir as mkdir2, open } from "node:fs/promises";
-import PATH2 from "node:path";
+import { mkdir, open } from "node:fs/promises";
+import PATH from "node:path";
 async function writeDurableFile(path, body, mode) {
   const handle = await open(path, "w", mode);
   try {
@@ -73,15 +106,15 @@ async function writeDurableFile(path, body, mode) {
   }
 }
 async function ensureDurableDirectory(path, mode) {
-  const directory = PATH2.resolve(path);
-  const firstCreated = await mkdir2(directory, { mode, recursive: true });
+  const directory = PATH.resolve(path);
+  const firstCreated = await mkdir(directory, { mode, recursive: true });
   if (firstCreated === void 0) return;
-  const existingParent = PATH2.dirname(PATH2.resolve(firstCreated));
+  const existingParent = PATH.dirname(PATH.resolve(firstCreated));
   let cursor = directory;
   while (true) {
     await syncDirectory(cursor);
     if (cursor === existingParent) return;
-    const parent = PATH2.dirname(cursor);
+    const parent = PATH.dirname(cursor);
     if (parent === cursor) throw new Error("Created directory is not below its reported existing parent");
     cursor = parent;
   }
@@ -105,140 +138,299 @@ function errorCode(error) {
   return typeof error === "object" && error !== null && "code" in error ? error.code : void 0;
 }
 
-// src/filesystemWakeQueue.ts
-function createFilesystemWakeQueue(options) {
-  const root = PATH3.resolve(options.path);
-  const pendingDir = PATH3.join(root, "pending");
-  const inflightDir = PATH3.join(root, "inflight");
-  const tempDir = PATH3.join(root, "tmp");
-  let sequence = 0;
-  async function ensureDirs() {
-    await ensureDurableDirectory(pendingDir);
-    await ensureDurableDirectory(inflightDir);
-    await ensureDurableDirectory(tempDir);
-  }
-  async function returnToPending(name) {
-    try {
-      await link(PATH3.join(inflightDir, name), PATH3.join(pendingDir, name));
-    } catch (error) {
-      if (!isAlreadyExists(error) && !isNotFound2(error)) throw error;
+// src/filesystemJson.ts
+import { randomBytes } from "node:crypto";
+import {
+  link,
+  open as open2,
+  rename,
+  unlink
+} from "node:fs/promises";
+import PATH2 from "node:path";
+async function readJsonFileStrict(path) {
+  let handle;
+  try {
+    handle = await open2(path, "r");
+  } catch (error) {
+    if (errorCode2(error) === "ENOENT") return void 0;
+    throw error;
+  }
+  try {
+    return JSON.parse(await handle.readFile("utf8"), reviveJson);
+  } finally {
+    await handle.close();
+  }
+}
+async function replaceJsonFile(path, value, options = {}) {
+  const directory = PATH2.dirname(path);
+  await ensureDurableDirectory(directory, options.directoryMode);
+  const tempPath = PATH2.join(directory, `.${PATH2.basename(path)}.${process.pid}.${suffix()}.tmp`);
+  try {
+    await writeDurableFile(tempPath, `${stringifyJson(value)}
+`, options.mode);
+    await rename(tempPath, path);
+    await syncDirectory(directory);
+  } catch (error) {
+    await unlinkIfMissing(tempPath);
+    throw error;
+  }
+}
+async function publishJsonFile(path, value, options = {}) {
+  const directory = PATH2.dirname(path);
+  await ensureDurableDirectory(directory, options.directoryMode);
+  const tempPath = PATH2.join(directory, `.${PATH2.basename(path)}.${process.pid}.${suffix()}.tmp`);
+  try {
+    await writeDurableFile(tempPath, `${stringifyJson(value)}
+`, options.mode);
+    await link(tempPath, path);
+    await syncDirectory(directory);
+    return true;
+  } catch (error) {
+    if (errorCode2(error) === "EEXIST") return false;
+    throw error;
+  } finally {
+    await unlinkIfMissing(tempPath);
+  }
+}
+function suffix() {
+  return randomBytes(8).toString("hex");
+}
+function stringifyJson(value) {
+  return JSON.stringify(value, replaceJsonValue);
+}
+function replaceJsonValue(_key, candidate) {
+  return typeof candidate === "bigint" ? { $eventKitBigInt: candidate.toString() } : candidate;
+}
+function reviveJson(_key, candidate) {
+  return typeof candidate === "object" && candidate !== null && Object.keys(candidate).length === 1 && "$eventKitBigInt" in candidate && typeof candidate.$eventKitBigInt === "string" && /^(?:0|[1-9][0-9]*)$/u.test(candidate.$eventKitBigInt) ? BigInt(candidate.$eventKitBigInt) : candidate;
+}
+async function unlinkIfMissing(path) {
+  try {
+    await unlink(path);
+  } catch (error) {
+    if (errorCode2(error) !== "ENOENT") throw error;
+  }
+}
+function errorCode2(error) {
+  return typeof error === "object" && error !== null && "code" in error ? error.code : void 0;
+}
+
+// src/privateSqlite.ts
+import {
+  closeSync,
+  constants,
+  fstatSync,
+  fsyncSync,
+  lstatSync,
+  mkdirSync,
+  openSync
+} from "node:fs";
+import PATH3 from "node:path";
+import { DatabaseSync } from "node:sqlite";
+var LegacyReceiverStoreError = class extends Error {
+  name = "LegacyReceiverStoreError";
+  constructor(path) {
+    super(`Receiver store requires explicit offline migration: ${path}`);
+  }
+};
+function ensurePrivateDirectory(path) {
+  const created = mkdirSync(path, { recursive: true, mode: 448 });
+  const info = lstatSync(path);
+  if (!info.isDirectory() || info.isSymbolicLink() || (info.mode & 63) !== 0 || process.getuid !== void 0 && info.uid !== process.getuid()) {
+    throw new Error(`Receiver directory must be owned and private (0700): ${path}`);
+  }
+  if (created === void 0) return;
+  const existingParent = PATH3.dirname(PATH3.resolve(created));
+  let cursor = PATH3.resolve(path);
+  for (; ; ) {
+    syncPrivateDirectory(cursor);
+    if (cursor === existingParent) break;
+    cursor = PATH3.dirname(cursor);
+  }
+}
+function syncPrivateDirectory(path) {
+  let descriptor;
+  try {
+    descriptor = openSync(path, "r");
+    fsyncSync(descriptor);
+  } catch (error) {
+    const code = typeof error === "object" && error !== null && "code" in error ? error.code : void 0;
+    if (!["EISDIR", "EINVAL", "ENOTSUP", "EOPNOTSUPP"].includes(String(code))) throw error;
+  } finally {
+    if (descriptor !== void 0) closeSync(descriptor);
+  }
+}
+function checkPrivateStoreFile(path, create = false) {
+  let descriptor;
+  try {
+    descriptor = openSync(path, (create ? constants.O_RDWR : constants.O_RDONLY) | constants.O_NOFOLLOW | (create ? constants.O_CREAT : 0), 384);
+  } catch (error) {
+    if (!create && typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT") return;
+    throw error;
+  }
+  try {
+    const info = fstatSync(descriptor);
+    if (!info.isFile() || (info.mode & 63) !== 0 || process.getuid !== void 0 && info.uid !== process.getuid()) {
+      throw new Error(`Receiver file must be owned and private (0600): ${path}`);
     }
-    await unlinkIfMissing(PATH3.join(inflightDir, name));
+  } finally {
+    closeSync(descriptor);
+  }
+}
+function initializeDatabase(database, file, format) {
+  database.exec("PRAGMA busy_timeout=100");
+  const tables = database.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%'").all();
+  if (tables.length > 0 && tables.every((row) => row.name !== "eventkit_store")) throw new LegacyReceiverStoreError(file);
+  if (tables.some((row) => row.name === "eventkit_store")) {
+    const columns = database.prepare("PRAGMA table_info(eventkit_store)").all();
+    if (columns.every((row) => row.name !== "initialized")) throw new LegacyReceiverStoreError(file);
+    const priorFormat = database.prepare("SELECT format FROM eventkit_store WHERE id=1").get();
+    if (priorFormat?.format !== format) throw new Error("Receiver store format/namespace mismatch");
+  }
+  database.exec("PRAGMA journal_mode=WAL; PRAGMA synchronous=FULL; PRAGMA foreign_keys=ON;");
+  database.exec("BEGIN IMMEDIATE");
+  try {
+    database.exec("CREATE TABLE IF NOT EXISTS eventkit_store (id INTEGER PRIMARY KEY CHECK(id=1), format TEXT NOT NULL, initialized INTEGER NOT NULL DEFAULT 0)");
+    const prior = database.prepare("SELECT format FROM eventkit_store WHERE id=1").get();
+    if (prior !== void 0 && prior.format !== format) throw new Error("Receiver store format/namespace mismatch");
+    database.prepare("INSERT OR IGNORE INTO eventkit_store(id,format) VALUES(1,?)").run(format);
+    database.exec("COMMIT");
+  } catch (error) {
+    database.exec("ROLLBACK");
+    throw error;
+  }
+}
+function openPrivateSqlite(options) {
+  const file = options.path === ":memory:" ? options.path : PATH3.resolve(options.path);
+  if (file !== ":memory:") {
+    ensurePrivateDirectory(PATH3.dirname(file));
+    checkPrivateStoreFile(file, true);
+    checkPrivateStoreFile(`${file}-wal`);
+    checkPrivateStoreFile(`${file}-shm`);
+    checkPrivateStoreFile(`${file}-journal`);
+  }
+  const database = new DatabaseSync(file);
+  let closed = false;
+  try {
+    initializeDatabase(database, file, options.format);
+    if (file !== ":memory:") {
+      checkPrivateStoreFile(file);
+      checkPrivateStoreFile(`${file}-wal`);
+      checkPrivateStoreFile(`${file}-shm`);
+      syncPrivateDirectory(PATH3.dirname(file));
+    }
+  } catch (error) {
+    database.close();
+    throw error;
   }
   return {
-    async append(wake) {
-      await ensureDirs();
-      const name = entryName(wake, sequence += 1);
-      const tempPath = PATH3.join(tempDir, name);
-      await writeDurableFile(tempPath, `${JSON.stringify(wake)}
-`);
+    database,
+    transaction(work) {
+      if (closed) throw new Error("Receiver store is closed");
+      database.exec("BEGIN IMMEDIATE");
       try {
-        await link(tempPath, PATH3.join(pendingDir, name));
-        await syncDirectory(pendingDir);
-      } finally {
-        await unlinkIfMissing(tempPath);
-      }
-    },
-    async claim() {
-      await ensureDirs();
-      const names = (await readdir(pendingDir)).toSorted();
-      for (const name of names) {
-        const inflightPath = PATH3.join(inflightDir, name);
-        const pendingPath = PATH3.join(pendingDir, name);
-        try {
-          await link(pendingPath, inflightPath);
-        } catch (error) {
-          if (isAlreadyExists(error) || isNotFound2(error)) continue;
-          throw error;
+        const result = work();
+        if (result !== null && (typeof result === "object" || typeof result === "function") && "then" in result) {
+          throw new TypeError("Receiver transactions must be synchronous");
         }
-        await unlinkIfMissing(pendingPath);
-        const wake = await readJsonFile(inflightPath);
-        if (wake === void 0) {
-          await unlinkIfMissing(inflightPath);
-          continue;
-        }
-        return {
-          wake,
-          async ack() {
-            await unlinkIfMissing(inflightPath);
-          },
-          async release() {
-            await returnToPending(name);
-          }
-        };
+        database.exec("COMMIT");
+        return result;
+      } catch (error) {
+        database.exec("ROLLBACK");
+        throw error;
       }
-      return void 0;
     },
-    async pendingCount() {
-      await ensureDirs();
-      return (await readdir(pendingDir)).length;
-    },
-    async recoverInflight() {
-      await ensureDirs();
-      const names = await readdir(inflightDir);
-      let recovered = 0;
-      for (const name of names) {
-        await returnToPending(name);
-        recovered += 1;
-      }
-      return recovered;
+    close() {
+      if (closed) return;
+      database.close();
+      closed = true;
     }
   };
 }
-async function readJsonFile(path) {
-  try {
-    const handle = await open2(path, "r");
-    try {
-      const raw = await handle.readFile("utf8");
-      return JSON.parse(raw);
-    } finally {
-      await handle.close();
+
+// src/filesystemCursorStore.ts
+var CursorFileZod = z.strictObject({ lastProcessedBlock: NonnegativeJsonSafeIntegerZod2 });
+function createFilesystemCursorStore(options) {
+  const filePath = PATH4.resolve(options.path);
+  const directory = PATH4.dirname(filePath);
+  return {
+    async load() {
+      if (!await existingPrivateDirectory(directory)) return void 0;
+      checkPrivateStoreFile(filePath);
+      const raw = await readJsonFileStrict(filePath);
+      if (raw === void 0) return void 0;
+      const cursor = CursorFileZod.parse(raw);
+      await syncDirectory(directory);
+      return cursor.lastProcessedBlock;
+    },
+    async save(lastProcessedBlock) {
+      const body = CursorFileZod.parse({ lastProcessedBlock });
+      await ensureDurableDirectory(directory, 448);
+      ensurePrivateDirectory(directory);
+      checkPrivateStoreFile(filePath);
+      await replaceJsonFile(filePath, body, { mode: 384, directoryMode: 448 });
     }
-  } catch {
-    return void 0;
-  }
-}
-function entryName(wake, sequence) {
-  const stamp = String(Date.now()).padStart(15, "0");
-  const ordinal = String(sequence).padStart(6, "0");
-  return `${stamp}-${ordinal}-${randomBytes(6).toString("hex")}-${wake.wakeId}.json`;
+  };
 }
-async function unlinkIfMissing(path) {
+async function existingPrivateDirectory(directory) {
   try {
-    await unlink(path);
+    await lstat(directory);
   } catch (error) {
-    if (!isNotFound2(error)) throw error;
+    if (typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT") return false;
+    throw error;
   }
-}
-function isNotFound2(error) {
-  return errorCode2(error) === "ENOENT";
-}
-function isAlreadyExists(error) {
-  return errorCode2(error) === "EEXIST";
-}
-function errorCode2(error) {
-  return typeof error === "object" && error !== null && "code" in error ? error.code : void 0;
+  ensurePrivateDirectory(directory);
+  return true;
 }
 
 // src/filesystemPublisherOutbox.ts
+import { randomBytes as randomBytes2 } from "node:crypto";
+import {
+  lstat as lstat2,
+  rename as rename2,
+  unlink as unlink2
+} from "node:fs/promises";
+import PATH5 from "node:path";
+import { WakeEnvelopeSchema, WakeEnvelopeZod } from "@xyo-network/event-kit-schemas";
 function createFilesystemPublisherOutbox(options) {
-  const filePath = PATH4.resolve(options.path);
+  const filePath = PATH5.resolve(options.path);
+  const directory = PATH5.dirname(filePath);
   return {
     async clear() {
+      if (!await existingPrivateDirectory2(directory)) return;
+      checkPrivateStoreFile(filePath);
+      let removed = false;
       try {
         await unlink2(filePath);
+        removed = true;
       } catch (error) {
-        if (!isNotFound3(error)) throw error;
+        if (!isNotFound(error)) throw error;
+      }
+      try {
+        await syncDirectory(directory);
+      } catch (error) {
+        if (removed || !isNotFound(error)) throw error;
       }
     },
-    load: async () => await readJsonFile(filePath),
+    async load() {
+      if (!await existingPrivateDirectory2(directory)) return void 0;
+      checkPrivateStoreFile(filePath);
+      const raw = await readJsonFileStrict(filePath);
+      if (raw === void 0) return void 0;
+      const pending = validatePendingWake(raw);
+      await syncDirectory(directory);
+      return pending;
+    },
     async save(pending) {
-      await mkdir3(PATH4.dirname(filePath), { recursive: true });
+      validatePendingWake(pending);
+      await ensureDurableDirectory(directory, 448);
+      ensurePrivateDirectory(directory);
+      checkPrivateStoreFile(filePath);
       const tempPath = `${filePath}.${process.pid}.${randomBytes2(6).toString("hex")}.tmp`;
-      await writeDurableFile(tempPath, `${JSON.stringify(pending)}
-`);
       try {
-        await rename(tempPath, filePath);
+        await writeDurableFile(tempPath, `${JSON.stringify(pending)}
+`, 384);
+        await rename2(tempPath, filePath);
       } catch (error) {
         try {
           await unlink2(tempPath);
@@ -246,254 +438,526 @@ function createFilesystemPublisherOutbox(options) {
         }
         throw error;
       }
+      await syncDirectory(directory);
     }
   };
 }
-function isNotFound3(error) {
+function validatePendingWake(raw) {
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw) || "schema" in raw || "deliveryMode" in raw) {
+    throw new Error("Invalid pending wake record");
+  }
+  WakeEnvelopeZod.parse({
+    ...raw,
+    schema: WakeEnvelopeSchema,
+    deliveryMode: "durable"
+  });
+  return raw;
+}
+function isNotFound(error) {
   return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
 }
+async function existingPrivateDirectory2(directory) {
+  try {
+    await lstat2(directory);
+  } catch (error) {
+    if (isNotFound(error)) return false;
+    throw error;
+  }
+  ensurePrivateDirectory(directory);
+  return true;
+}
 
 // src/filesystemWakeInbox.ts
-import { createHash, randomBytes as randomBytes3 } from "node:crypto";
+import { existsSync as existsSync2, readdirSync as readdirSync2 } from "node:fs";
+import PATH7 from "node:path";
+
+// src/filesystemWakeQueue.ts
+import { randomBytes as randomBytes4 } from "node:crypto";
+import { existsSync, readdirSync } from "node:fs";
 import {
   link as link2,
-  mkdir as mkdir4,
   open as open3,
-  readdir as readdir2,
+  readdir,
   unlink as unlink3
 } from "node:fs/promises";
-import PATH5 from "node:path";
-function createFilesystemWakeInbox(options) {
-  const root = PATH5.resolve(options.path);
-  const tokensDir = PATH5.join(root, "tokens");
-  const wakesDir = PATH5.join(root, "wakes");
-  const tempDir = PATH5.join(root, "tmp");
-  let tail = Promise.resolve();
-  function exclusive(work) {
-    const previous = tail;
-    const run = (async () => {
-      try {
-        await previous;
-      } catch {
+import PATH6 from "node:path";
+import { parseAdmittedWake as parseAdmittedWake2, StaleWakeLeaseError as StaleWakeLeaseError2 } from "@xyo-network/event-kit-protocol";
+
+// src/receiverAuthority.ts
+import { Buffer as Buffer2 } from "node:buffer";
+import { createHash, randomBytes as randomBytes3 } from "node:crypto";
+import { parseAdmittedWake, StaleWakeLeaseError } from "@xyo-network/event-kit-protocol";
+import {
+  HashZod as HashZod2,
+  NonnegativeJsonSafeIntegerZod as NonnegativeJsonSafeIntegerZod3,
+  NormalizedAddressZod,
+  WakeIdZod,
+  WakeJwtAudienceZod,
+  WakeJwtIdZod
+} from "@xyo-network/event-kit-schemas";
+function receiverIdentity(parts) {
+  return createHash("sha256").update(JSON.stringify(parts)).digest("hex");
+}
+function validateAttempt(attempt) {
+  WakeJwtAudienceZod.parse(attempt.audience);
+  NormalizedAddressZod.parse(attempt.publisher);
+  WakeIdZod.parse(attempt.wakeId);
+  WakeJwtIdZod.parse(attempt.jwtId);
+  HashZod2.parse(attempt.eventHash);
+  NonnegativeJsonSafeIntegerZod3.parse(attempt.retainJwtUntil);
+}
+function boundedBody(wake) {
+  const body = JSON.stringify(wake);
+  if (Buffer2.byteLength(body, "utf8") > 65536) throw new RangeError("Receiver work exceeds its 64 KiB bound");
+  return body;
+}
+function sameValues(pairs) {
+  return pairs.every(([actual, expected]) => actual === expected);
+}
+function validateQueueState(row) {
+  if (!Number.isSafeInteger(row.id) || row.id < 1) throw new Error("Invalid persisted queue identity");
+  if (row.state === "completed") {
+    if (row.body !== null || row.lease_token !== null || row.terminal_operation !== "ack" || row.terminal_token === null || !/^[0-9a-f]{32}$/u.test(row.terminal_token)) throw new Error("Invalid persisted completion state");
+    return;
+  }
+  if (typeof row.body !== "string") throw new Error("Active receiver work has no bounded body");
+  if (row.state === "pending" && row.lease_token === null) return;
+  if (row.state === "inflight" && row.lease_token !== null && /^[0-9a-f]{32}$/u.test(row.lease_token)) return;
+  throw new Error("Invalid persisted lease state");
+}
+function openReceiverAuthority(path) {
+  const owner = openPrivateSqlite({ path, format: "event-kit-receiver" });
+  const database = owner.database;
+  const transaction = (work) => owner.transaction(work);
+  const requiredTables = ["receiver_queue", "receiver_wakes", "receiver_tokens"];
+  try {
+    transaction(() => {
+      const existingTables = new Set(database.prepare("SELECT name FROM sqlite_master WHERE type='table'").all().map((row) => row.name));
+      const initialized = database.prepare("SELECT initialized FROM eventkit_store WHERE id=1").get()?.initialized;
+      if (initialized !== 0 && initialized !== 1 || initialized === 1 && requiredTables.some((name) => !existingTables.has(name)) || initialized === 0 && requiredTables.some((name) => existingTables.has(name))) {
+        throw new Error("Incomplete persisted receiver schema; refusing to recreate admission/completion history");
       }
-      return await work();
-    })();
-    tail = Promise.allSettled([run]);
-    return run;
+      if (initialized === 1) return;
+      database.exec(`
+    CREATE TABLE IF NOT EXISTS receiver_queue (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      body TEXT,
+      state TEXT NOT NULL CHECK(state IN ('pending','inflight','completed')),
+      lease_token TEXT,
+      terminal_token TEXT,
+      terminal_operation TEXT,
+      CHECK ((state='inflight' AND lease_token IS NOT NULL) OR (state!='inflight' AND lease_token IS NULL))
+    );
+    CREATE INDEX IF NOT EXISTS receiver_pending ON receiver_queue(state,id);
+    CREATE TABLE IF NOT EXISTS receiver_wakes (
+      identity TEXT PRIMARY KEY,
+      audience TEXT NOT NULL, publisher TEXT NOT NULL, wake_id TEXT NOT NULL,
+      event_hash TEXT NOT NULL, receipt TEXT NOT NULL, authorization TEXT NOT NULL,
+      queue_id INTEGER NOT NULL UNIQUE REFERENCES receiver_queue(id)
+    );
+    CREATE TABLE IF NOT EXISTS receiver_tokens (
+      identity TEXT PRIMARY KEY, wake_identity TEXT NOT NULL REFERENCES receiver_wakes(identity),
+      event_hash TEXT NOT NULL, wake_id TEXT NOT NULL, retain_until INTEGER NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS receiver_token_expiry ON receiver_tokens(retain_until);
+    `);
+      database.prepare("UPDATE eventkit_store SET initialized=1 WHERE id=1").run();
+    });
+  } catch (error) {
+    owner.close();
+    throw error;
   }
-  async function ensureDirs() {
-    await mkdir4(tokensDir, { recursive: true });
-    await mkdir4(wakesDir, { recursive: true });
-    await mkdir4(tempDir, { recursive: true });
+  const boundedRow = `id,state,lease_token,terminal_token,terminal_operation,
+    CASE WHEN length(CAST(body AS BLOB)) <= 65536 THEN body ELSE NULL END AS body`;
+  const pending = database.prepare(`SELECT ${boundedRow} FROM receiver_queue WHERE state='pending' ORDER BY id LIMIT 1`);
+  const getRow = database.prepare(`SELECT ${boundedRow} FROM receiver_queue WHERE id=?`);
+  const insert = database.prepare("INSERT INTO receiver_queue(body,state) VALUES(?,'pending')");
+  const count = database.prepare("SELECT COUNT(*) AS total FROM receiver_queue WHERE state='pending'");
+  const wakeKey = (attempt) => receiverIdentity([attempt.audience, attempt.publisher, attempt.wakeId]);
+  const tokenKey = (attempt) => receiverIdentity([attempt.audience, attempt.publisher, attempt.jwtId]);
+  function validateAssociation(row, wake) {
+    validateQueueState(row);
+    const record = database.prepare("SELECT * FROM receiver_wakes WHERE queue_id=?").get(row.id);
+    if (record === void 0) return;
+    const receipt = JSON.parse(String(record.receipt));
+    const receiptMatches = sameValues([
+      [record.identity, receiverIdentity([String(record.audience), String(record.publisher), String(record.wake_id)])],
+      [receipt.id, record.identity],
+      [receipt.audience, record.audience],
+      [receipt.publisher, record.publisher],
+      [receipt.wakeId, record.wake_id],
+      [receipt.eventHash, record.event_hash]
+    ]);
+    const wakeMatches = wake === void 0 || sameValues([
+      [wake.audience, record.audience],
+      [wake.publisher, record.publisher],
+      [wake.wakeId, record.wake_id],
+      [wake.eventHash, record.event_hash]
+    ]);
+    if (!receiptMatches || !wakeMatches) throw new Error("Queued body does not match its admitted identity/receipt");
   }
-  function tokenPath(attempt) {
-    return PATH5.join(tokensDir, `${digest([attempt.audience, attempt.publisher, attempt.jwtId])}.json`);
+  async function preparedWork(attempt) {
+    const record = database.prepare("SELECT queue_id FROM receiver_wakes WHERE identity=?").get(wakeKey(attempt));
+    if (record === void 0) return void 0;
+    const row = currentRow(Number(record.queue_id));
+    if (row === void 0) throw new Error("Receiver receipt has no work/completion record");
+    const wake = row.body === null ? void 0 : await parseAdmittedWake(JSON.parse(row.body));
+    validateAssociation(row, wake);
+    return { id: row.id, body: row.body };
   }
-  function wakePath(attempt) {
-    return PATH5.join(wakesDir, `${digest([attempt.audience, attempt.publisher, attempt.wakeId])}.json`);
+  class WorkChanged extends Error {
   }
-  async function bindToken(attempt, wake) {
-    const record = {
-      ...wake,
-      jwtId: attempt.jwtId,
-      retainJwtUntil: attempt.retainJwtUntil
-    };
-    await writeRecordExclusive(tempDir, tokenPath(attempt), record);
+  async function validatedTransaction(attempt, work) {
+    for (let tries = 0; tries < 4; tries++) {
+      const prepared = await preparedWork(attempt);
+      try {
+        return transaction(() => work(prepared));
+      } catch (error) {
+        if (!(error instanceof WorkChanged)) throw error;
+      }
+    }
+    throw new Error("Receiver work changed during validation; retry admission");
   }
-  async function matchRecorded(attempt) {
-    const token = await readRecord(tokenPath(attempt));
-    if (token !== void 0) {
-      return token.eventHash === attempt.eventHash && token.wakeId === attempt.wakeId ? { kind: "duplicate", receipt: token.receipt } : { kind: "jwt-id-collision" };
+  function resolve(attempt, prepared) {
+    const token = database.prepare("SELECT * FROM receiver_tokens WHERE identity=?").get(tokenKey(attempt));
+    if (token !== void 0 && (token.event_hash !== attempt.eventHash || token.wake_id !== attempt.wakeId)) return { kind: "jwt-id-collision" };
+    const record = database.prepare("SELECT * FROM receiver_wakes WHERE identity=?").get(wakeKey(attempt));
+    if (record === void 0) {
+      if (token !== void 0) throw new Error("Receiver token points to missing admitted work");
+      return { kind: "new" };
+    }
+    if (record.event_hash !== attempt.eventHash) return { kind: "wake-id-collision" };
+    const receipt = JSON.parse(String(record.receipt));
+    if (!sameValues([
+      [receipt.id, wakeKey(attempt)],
+      [receipt.eventHash, attempt.eventHash],
+      [receipt.publisher, attempt.publisher],
+      [receipt.audience, attempt.audience],
+      [receipt.wakeId, attempt.wakeId]
+    ])) {
+      throw new Error("Receiver receipt does not match its identity");
+    }
+    const row = currentRow(Number(record.queue_id));
+    if (row === void 0) throw new Error("Receiver receipt has no pending/completed work record");
+    validateAssociation(row);
+    if (row.state !== "completed" && (prepared?.id !== row.id || prepared.body !== row.body)) throw new WorkChanged();
+    if (token !== void 0 && (token.wake_identity !== record.identity || !Number.isSafeInteger(token.retain_until) || Number(token.retain_until) < 0)) {
+      throw new Error("Persisted token does not match its admitted work");
     }
-    const wake = await readRecord(wakePath(attempt));
-    if (wake === void 0) return void 0;
-    if (wake.eventHash !== attempt.eventHash) return { kind: "wake-id-collision" };
-    await bindToken(attempt, wake);
-    return { kind: "duplicate", receipt: wake.receipt };
+    database.prepare(`INSERT INTO receiver_tokens(identity,wake_identity,event_hash,wake_id,retain_until) VALUES(?,?,?,?,?)
+      ON CONFLICT(identity) DO UPDATE SET retain_until=MAX(retain_until,excluded.retain_until)`).run(tokenKey(attempt), wakeKey(attempt), attempt.eventHash, attempt.wakeId, attempt.retainJwtUntil);
+    return { kind: "duplicate", receipt };
   }
-  return {
-    resolveAttempt: async (attempt) => await exclusive(async () => {
-      await ensureDirs();
-      return await matchRecorded(attempt) ?? { kind: "new" };
-    }),
-    commitAuthorized: async ({ attempt, wake }) => await exclusive(async () => {
-      await ensureDirs();
-      const recorded = await matchRecorded(attempt);
-      if (recorded !== void 0) return recorded;
-      const receipt = Object.freeze({
-        audience: attempt.audience,
-        eventHash: attempt.eventHash,
-        id: digest([attempt.audience, attempt.publisher, attempt.wakeId]),
-        publisher: attempt.publisher,
-        wakeId: attempt.wakeId
+  const inbox = {
+    async resolveAttempt(attempt) {
+      validateAttempt(attempt);
+      return await validatedTransaction(attempt, (prepared) => resolve(attempt, prepared));
+    },
+    async commitAuthorized(input) {
+      validateAttempt(input.attempt);
+      const wake = await parseAdmittedWake(input.wake);
+      const { attempt, grant } = input;
+      if (attempt.audience !== wake.audience || attempt.publisher !== wake.publisher || attempt.wakeId !== wake.wakeId || attempt.eventHash !== wake.eventHash || attempt.jwtId !== wake.jti || grant.grant.authorizationKind !== "activated-subscription" || grant.grant.target !== wake.publisher || grant.grant.deploymentId !== wake.deploymentId || grant.grant.queueId !== wake.queueId || grant.grant.filterHash !== wake.event.filterHash || grant.grant.authorizationChainId !== wake.event.authorizationChainId || wake.event.deliveryMode !== "durable") {
+        throw new TypeError("Authorized admission does not match its exact wake/identity binding");
+      }
+      return await validatedTransaction(attempt, (prepared) => {
+        const previous = resolve(attempt, prepared);
+        if (previous.kind !== "new") return previous;
+        const receipt = Object.freeze({
+          audience: attempt.audience,
+          eventHash: attempt.eventHash,
+          id: wakeKey(attempt),
+          publisher: attempt.publisher,
+          wakeId: attempt.wakeId
+        });
+        const row = insert.run(boundedBody(wake));
+        database.prepare("INSERT INTO receiver_wakes(identity,audience,publisher,wake_id,event_hash,receipt,authorization,queue_id) VALUES(?,?,?,?,?,?,?,?)").run(
+          wakeKey(attempt),
+          attempt.audience,
+          attempt.publisher,
+          attempt.wakeId,
+          attempt.eventHash,
+          JSON.stringify(receipt),
+          JSON.stringify(grant),
+          row.lastInsertRowid
+        );
+        database.prepare("INSERT INTO receiver_tokens(identity,wake_identity,event_hash,wake_id,retain_until) VALUES(?,?,?,?,?)").run(tokenKey(attempt), wakeKey(attempt), attempt.eventHash, attempt.wakeId, attempt.retainJwtUntil);
+        return { kind: "enqueued", receipt };
       });
-      const record = {
-        audience: attempt.audience,
-        eventHash: attempt.eventHash,
-        publisher: attempt.publisher,
-        receipt,
-        wakeId: attempt.wakeId
+    }
+  };
+  function currentRow(id) {
+    return getRow.get(id);
+  }
+  function rows() {
+    return database.prepare(`SELECT ${boundedRow} FROM receiver_queue WHERE state!='completed' ORDER BY id`).all();
+  }
+  function finish(id, token, operation) {
+    transaction(() => {
+      const row = currentRow(id);
+      if (row?.terminal_token === token && row.terminal_operation === operation) return;
+      if (row?.state !== "inflight" || row.lease_token !== token) throw new StaleWakeLeaseError();
+      if (operation === "ack") database.prepare(`UPDATE receiver_queue
+        SET state='completed',body=NULL,lease_token=NULL,terminal_token=?,terminal_operation='ack'
+        WHERE id=? AND lease_token=?`).run(token, id, token);
+      else database.prepare(`UPDATE receiver_queue
+        SET state='pending',lease_token=NULL,terminal_token=?,terminal_operation='release'
+        WHERE id=? AND lease_token=?`).run(token, id, token);
+    });
+  }
+  async function claim(validate) {
+    for (; ; ) {
+      const row = pending.get();
+      if (row === void 0) return void 0;
+      if (typeof row.body !== "string") throw new Error("Pending receiver work has no body");
+      const wake = await parseAdmittedWake(JSON.parse(row.body));
+      validateAssociation(row, wake);
+      await validate?.(row);
+      const token = randomBytes3(16).toString("hex");
+      const won = transaction(() => database.prepare(`UPDATE receiver_queue SET state='inflight',lease_token=?
+        WHERE id=? AND state='pending' AND body=?`).run(token, row.id, row.body).changes === 1);
+      if (!won) continue;
+      let completed;
+      const complete = (operation) => {
+        if (completed !== void 0) {
+          if (completed !== operation) throw new StaleWakeLeaseError();
+          return;
+        }
+        finish(row.id, token, operation);
+        completed = operation;
       };
-      await options.queue.append(wake);
-      const claimed = await writeRecordExclusive(tempDir, wakePath(attempt), record);
-      if (!claimed) {
-        const winner = await readRecord(wakePath(attempt));
-        if (winner === void 0) throw new Error("wake record vanished during commit");
-        if (winner.eventHash !== attempt.eventHash) return { kind: "wake-id-collision" };
-        await bindToken(attempt, winner);
-        return { kind: "duplicate", receipt: winner.receipt };
-      }
-      await bindToken(attempt, record);
-      return { kind: "enqueued", receipt };
-    }),
-    async pruneExpiredTokens(nowSeconds) {
-      await ensureDirs();
-      let removed = 0;
-      for (const name of await readdir2(tokensDir)) {
-        const path = PATH5.join(tokensDir, name);
-        const token = await readRecord(path);
-        if (token === void 0 || token.retainJwtUntil > nowSeconds) continue;
-        await unlinkIfMissing2(path);
-        removed += 1;
-      }
-      return removed;
-    }
-  };
-}
-async function writeRecordExclusive(tempDir, path, record) {
-  const tempPath = PATH5.join(tempDir, `${PATH5.basename(path)}.${process.pid}.${randomSuffix()}`);
-  await writeDurableFile(tempPath, `${JSON.stringify(record)}
-`);
-  try {
-    await link2(tempPath, path);
-    await syncDirectory(PATH5.dirname(path));
-    return true;
-  } catch (error) {
-    if (isAlreadyExists2(error)) return false;
-    throw error;
-  } finally {
-    await unlinkIfMissing2(tempPath);
+      return {
+        id: row.id,
+        token,
+        wake,
+        async ack() {
+          complete("ack");
+        },
+        async release() {
+          complete("release");
+        }
+      };
+    }
   }
+  const queue = {
+    async append(wake) {
+      const parsed = await parseAdmittedWake(wake);
+      transaction(() => insert.run(boundedBody(parsed)));
+    },
+    claim: () => claim(),
+    pendingCount: async () => Number(count.get()?.total),
+    async recoverInflight(options) {
+      if (options?.consumersStopped !== true) throw new TypeError("Recovery requires all consumers to be stopped");
+      return transaction(() => Number(database.prepare("UPDATE receiver_queue SET state='pending',lease_token=NULL WHERE state='inflight'").run().changes));
+    }
+  };
+  return {
+    queue,
+    inbox,
+    database,
+    claim,
+    currentRow,
+    rows,
+    async append(wake) {
+      const parsed = await parseAdmittedWake(wake);
+      return transaction(() => Number(insert.run(boundedBody(parsed)).lastInsertRowid));
+    },
+    receiptQueueId(receipt) {
+      const row = database.prepare("SELECT queue_id FROM receiver_wakes WHERE identity=?").get(receipt.id);
+      if (row === void 0) throw new Error("Committed receipt has no work/completion record");
+      return Number(row.queue_id);
+    },
+    close: () => owner.close(),
+    pruneExpiredTokens(nowSeconds) {
+      NonnegativeJsonSafeIntegerZod3.parse(nowSeconds);
+      return transaction(() => Number(database.prepare("DELETE FROM receiver_tokens WHERE retain_until<=?").run(nowSeconds).changes));
+    }
+  };
 }
-async function readRecord(path) {
-  try {
-    const handle = await open3(path, "r");
+
+// src/filesystemWakeQueue.ts
+var authorities = /* @__PURE__ */ new WeakMap();
+function filesystemReceiverAuthority(queue) {
+  const authority = authorities.get(queue);
+  if (authority === void 0) throw new TypeError("Filesystem inbox requires its coordinated filesystem receiver queue");
+  return authority;
+}
+function createFilesystemWakeQueue(options) {
+  const root = PATH6.resolve(options.path);
+  const file = PATH6.join(root, "receiver.sqlite");
+  if (!existsSync(file) && ["pending", "inflight", "tmp"].some((name) => {
+    const directory = PATH6.join(root, name);
+    return existsSync(directory) && readdirSync(directory).length > 0;
+  })) throw new LegacyReceiverStoreError(root);
+  ensurePrivateDirectory(root);
+  const pendingDir = PATH6.join(root, "pending");
+  const inflightDir = PATH6.join(root, "inflight");
+  const tempDir = PATH6.join(root, "tmp");
+  for (const directory of [pendingDir, inflightDir, tempDir]) ensurePrivateDirectory(directory);
+  const authority = openReceiverAuthority(file);
+  async function publishProjection(path, body) {
+    if (existsSync(path)) {
+      checkPrivateStoreFile(path);
+      return;
+    }
+    const temporary = PATH6.join(tempDir, `${randomBytes4(16).toString("hex")}.json`);
+    await writeDurableFile(temporary, body, 384);
     try {
-      const raw = await handle.readFile("utf8");
-      return JSON.parse(raw);
+      try {
+        await link2(temporary, path);
+      } catch (error) {
+        if (!hasCode(error, "EEXIST")) throw error;
+      }
+      await syncDirectory(PATH6.dirname(path));
     } finally {
-      await handle.close();
+      await unlinkIfMissing2(temporary);
     }
-  } catch (error) {
-    if (isNotFound4(error)) return void 0;
-    throw error;
   }
-}
-function digest(parts) {
-  return createHash("sha256").update(JSON.stringify(parts)).digest("hex");
-}
-function randomSuffix() {
-  return randomBytes3(8).toString("hex");
-}
-async function unlinkIfMissing2(path) {
-  try {
-    await unlink3(path);
-  } catch (error) {
-    if (!isNotFound4(error)) throw error;
+  async function validateProjection(row) {
+    if (row.body === null) throw new Error("Receiver work has no committed body");
+    const path = PATH6.join(pendingDir, `${row.id}.json`);
+    checkPrivateStoreFile(path);
+    let raw = await readJsonFile(path);
+    if (raw === void 0) {
+      await publishProjection(path, row.body);
+      checkPrivateStoreFile(path);
+      raw = await readJsonFile(path);
+    }
+    checkPrivateStoreFile(path);
+    const projected = await parseAdmittedWake2(raw);
+    if (JSON.stringify(projected) !== row.body) throw new Error("Filesystem projection differs from committed receiver work");
   }
-}
-function isNotFound4(error) {
-  return errorCode3(error) === "ENOENT";
-}
-function isAlreadyExists2(error) {
-  return errorCode3(error) === "EEXIST";
-}
-function errorCode3(error) {
-  return typeof error === "object" && error !== null && "code" in error ? error.code : void 0;
-}
-
-// src/filesystemEventKitReplayCheckpointStore.ts
-import PATH7 from "node:path";
-
-// src/filesystemJson.ts
-import { randomBytes as randomBytes4 } from "node:crypto";
-import {
-  link as link3,
-  open as open4,
-  rename as rename2,
-  unlink as unlink4
-} from "node:fs/promises";
-import PATH6 from "node:path";
-async function readJsonFileStrict(path) {
-  try {
-    const handle = await open4(path, "r");
-    try {
-      return JSON.parse(await handle.readFile("utf8"), reviveJson);
-    } finally {
-      await handle.close();
+  async function repairRow(id) {
+    const row = authority.currentRow(id);
+    if (row === void 0) throw new Error("Receiver work record vanished");
+    if (row.state === "completed") {
+      await unlinkIfMissing2(PATH6.join(pendingDir, `${id}.json`));
+    } else {
+      if (row.body === null) throw new Error("Active receiver work is corrupt");
+      await publishProjection(PATH6.join(pendingDir, `${id}.json`), row.body);
+      if (row.state === "inflight" && row.lease_token !== null) {
+        await publishProjection(PATH6.join(inflightDir, `${id}-${row.lease_token}.json`), row.body);
+      }
     }
-  } catch (error) {
-    if (errorCode4(error) === "ENOENT") return void 0;
-    throw error;
+    await syncDirectory(pendingDir);
+  }
+  async function repairProjections() {
+    for (const row of authority.rows()) {
+      if (row.body === null) throw new Error("Active receiver work is corrupt");
+      await publishProjection(PATH6.join(pendingDir, `${row.id}.json`), row.body);
+      if (row.state === "inflight" && row.lease_token !== null) {
+        await publishProjection(PATH6.join(inflightDir, `${row.id}-${row.lease_token}.json`), row.body);
+      }
+    }
+    for (const name of await readdir(pendingDir)) {
+      const match = /^(\d+)\.json$/u.exec(name);
+      if (match !== null && authority.currentRow(Number(match[1]))?.state === "completed") await unlinkIfMissing2(PATH6.join(pendingDir, name));
+    }
+    for (const name of await readdir(inflightDir)) {
+      const match = /^(\d+)-([0-9a-f]{32})\.json$/u.exec(name);
+      if (match !== null && authority.currentRow(Number(match[1]))?.lease_token !== match[2]) await unlinkIfMissing2(PATH6.join(inflightDir, name));
+    }
+    await syncDirectory(pendingDir);
+    await syncDirectory(inflightDir);
   }
+  const queue = {
+    async append(wake) {
+      const id = await authority.append(wake);
+      await repairRow(id);
+    },
+    async claim() {
+      const leased = await authority.claim(validateProjection);
+      if (leased === void 0) return;
+      try {
+        await repairRow(leased.id);
+        if (authority.currentRow(leased.id)?.lease_token !== leased.token) throw new StaleWakeLeaseError2();
+      } catch (error) {
+        try {
+          await leased.release();
+        } catch (releaseError) {
+          throw new AggregateError([error, releaseError], "Claim projection failed and its lease could not be released", { cause: releaseError });
+        }
+        throw error;
+      }
+      return {
+        wake: leased.wake,
+        async ack() {
+          await leased.ack();
+          await unlinkIfMissing2(PATH6.join(inflightDir, `${leased.id}-${leased.token}.json`));
+          await repairRow(leased.id);
+          await syncDirectory(inflightDir);
+        },
+        async release() {
+          await leased.release();
+          await unlinkIfMissing2(PATH6.join(inflightDir, `${leased.id}-${leased.token}.json`));
+          await repairRow(leased.id);
+          await syncDirectory(inflightDir);
+        }
+      };
+    },
+    pendingCount: authority.queue.pendingCount,
+    async recoverInflight(options2) {
+      const moved = await authority.queue.recoverInflight(options2);
+      await repairProjections();
+      return moved;
+    },
+    close: authority.close,
+    repairProjections,
+    repairRow
+  };
+  authorities.set(queue, authority);
+  return queue;
 }
-async function replaceJsonFile(path, value, options = {}) {
-  const directory = PATH6.dirname(path);
-  await ensureDurableDirectory(directory, options.directoryMode);
-  const tempPath = PATH6.join(directory, `.${PATH6.basename(path)}.${process.pid}.${suffix()}.tmp`);
-  await writeDurableFile(tempPath, `${stringifyJson(value)}
-`, options.mode);
+async function readJsonFile(path) {
+  let handle;
   try {
-    await rename2(tempPath, path);
-    await syncDirectory(directory);
+    handle = await open3(path, "r");
   } catch (error) {
-    await unlinkIfMissing3(tempPath);
+    if (hasCode(error, "ENOENT")) return void 0;
     throw error;
   }
-}
-async function publishJsonFile(path, value, options = {}) {
-  const directory = PATH6.dirname(path);
-  await ensureDurableDirectory(directory, options.directoryMode);
-  const tempPath = PATH6.join(directory, `.${PATH6.basename(path)}.${process.pid}.${suffix()}.tmp`);
-  await writeDurableFile(tempPath, `${stringifyJson(value)}
-`, options.mode);
   try {
-    await link3(tempPath, path);
-    await syncDirectory(directory);
-    return true;
-  } catch (error) {
-    if (errorCode4(error) === "EEXIST") return false;
-    throw error;
+    if ((await handle.stat()).size > 65536) throw new RangeError("Receiver JSON record exceeds its 64 KiB bound");
+    return JSON.parse(await handle.readFile("utf8"));
   } finally {
-    await unlinkIfMissing3(tempPath);
+    await handle.close();
   }
 }
-function suffix() {
-  return randomBytes4(8).toString("hex");
-}
-function stringifyJson(value) {
-  return JSON.stringify(value, replaceJsonValue);
-}
-function replaceJsonValue(_key, candidate) {
-  return typeof candidate === "bigint" ? { $eventKitBigInt: candidate.toString() } : candidate;
-}
-function reviveJson(_key, candidate) {
-  return typeof candidate === "object" && candidate !== null && Object.keys(candidate).length === 1 && "$eventKitBigInt" in candidate && typeof candidate.$eventKitBigInt === "string" && /^(?:0|[1-9][0-9]*)$/u.test(candidate.$eventKitBigInt) ? BigInt(candidate.$eventKitBigInt) : candidate;
-}
-async function unlinkIfMissing3(path) {
+async function unlinkIfMissing2(path) {
   try {
-    await unlink4(path);
+    await unlink3(path);
   } catch (error) {
-    if (errorCode4(error) !== "ENOENT") throw error;
+    if (!hasCode(error, "ENOENT")) throw error;
   }
 }
-function errorCode4(error) {
-  return typeof error === "object" && error !== null && "code" in error ? error.code : void 0;
+function hasCode(error, code) {
+  return typeof error === "object" && error !== null && "code" in error && error.code === code;
+}
+
+// src/filesystemWakeInbox.ts
+function createFilesystemWakeInbox(options) {
+  const root = PATH7.resolve(options.path);
+  if (["tokens", "wakes"].some((name) => {
+    const directory = PATH7.join(root, name);
+    return existsSync2(directory) && readdirSync2(directory).length > 0;
+  })) throw new LegacyReceiverStoreError(root);
+  ensurePrivateDirectory(root);
+  const authority = filesystemReceiverAuthority(options.queue);
+  return {
+    resolveAttempt: authority.inbox.resolveAttempt,
+    async commitAuthorized(input) {
+      const committed = await authority.inbox.commitAuthorized(input);
+      if ("receipt" in committed) await options.queue.repairRow(authority.receiptQueueId(committed.receipt));
+      return committed;
+    },
+    pruneExpiredTokens: async (nowSeconds) => authority.pruneExpiredTokens(nowSeconds)
+  };
 }
 
 // src/filesystemEventKitReplayCheckpointStore.ts
+import PATH8 from "node:path";
 function createFilesystemEventKitReplayCheckpointStore(options) {
-  const path = PATH7.resolve(options.path);
+  const path = PATH8.resolve(options.path);
   let tail = Promise.resolve();
   return {
     async load() {
@@ -520,7 +984,7 @@ function createFilesystemEventKitReplayCheckpointStore(options) {
 
 // src/filesystemFinalizedStatementPublicationJournal.ts
 import { createHash as createHash2 } from "node:crypto";
-import PATH8 from "node:path";
+import PATH9 from "node:path";
 import { isDeepStrictEqual } from "node:util";
 var PublicationPhases = [
   "signed",
@@ -566,7 +1030,7 @@ function publicationDirectory(root, intent) {
     operationId: intent.operationId,
     source: intent.source
   })).digest("hex");
-  return PATH8.join(root, key);
+  return PATH9.join(root, key);
 }
 function asPublicationRecord(value, path) {
   if (typeof value !== "object" || value === null) throw new Error(`malformed publication journal record at ${path}`);
@@ -581,12 +1045,12 @@ function assertBoundRecord(record, intent, signed) {
   }
 }
 function createFilesystemFinalizedStatementPublicationJournal(options) {
-  const root = PATH8.resolve(options.path);
+  const root = PATH9.resolve(options.path);
   return {
     async load(intent) {
       assertIntentShape(intent);
       const directory = publicationDirectory(root, intent);
-      const intentPath = PATH8.join(directory, "intent.json");
+      const intentPath = PATH9.join(directory, "intent.json");
       const rawSigned = await readJsonFileStrict(intentPath);
       if (rawSigned === void 0) return void 0;
       const signed = asPublicationRecord(rawSigned, intentPath);
@@ -594,7 +1058,7 @@ function createFilesystemFinalizedStatementPublicationJournal(options) {
       assertBoundRecord(signed, intent, signed);
       let latest = signed;
       for (const phase of PublicationPhases.slice(1)) {
-        const path = PATH8.join(directory, `${phase}.json`);
+        const path = PATH9.join(directory, `${phase}.json`);
         const rawRecord = await readJsonFileStrict(path);
         if (rawRecord === void 0) continue;
         const record = asPublicationRecord(rawRecord, path);
@@ -612,7 +1076,7 @@ function createFilesystemFinalizedStatementPublicationJournal(options) {
       }
       if (!PublicationPhaseSet.has(record.phase)) throw new TypeError("unknown publication phase");
       const directory = publicationDirectory(root, intent);
-      const intentPath = PATH8.join(directory, "intent.json");
+      const intentPath = PATH9.join(directory, "intent.json");
       if (record.phase === "signed") {
         if (await publishJsonFile(intentPath, record)) return;
         const existing2 = asPublicationRecord(await readJsonFileStrict(intentPath), intentPath);
@@ -627,7 +1091,7 @@ function createFilesystemFinalizedStatementPublicationJournal(options) {
       const signed = asPublicationRecord(rawSigned, intentPath);
       if (signed.phase !== "signed") throw new Error(`publication intent record is not signed at ${intentPath}`);
       assertBoundRecord(record, intent, signed);
-      const path = PATH8.join(directory, `${record.phase}.json`);
+      const path = PATH9.join(directory, `${record.phase}.json`);
       if (await publishJsonFile(path, record)) return;
       const existing = asPublicationRecord(await readJsonFileStrict(path), path);
       if (!isDeepStrictEqual(existing, record)) {
@@ -639,7 +1103,7 @@ function createFilesystemFinalizedStatementPublicationJournal(options) {
 
 // src/filesystemHandshakeMutationIntentStore.ts
 import { stat } from "node:fs/promises";
-import PATH9 from "node:path";
+import PATH10 from "node:path";
 
 // src/handshakeMutationIntent.ts
 import {
@@ -653,8 +1117,8 @@ import {
   EndpointChallengeResponseZod,
   EndpointChallengeZod,
   HandshakeIdZod,
-  HashZod,
-  NormalizedAddressZod,
+  HashZod as HashZod3,
+  NormalizedAddressZod as NormalizedAddressZod2,
   PublisherEncryptionKeyRevocationZod,
   PublisherEncryptionKeyZod,
   PublisherServiceRevocationZod,
@@ -664,7 +1128,7 @@ import {
   WakeSubscriptionAcceptanceZod,
   WakeSubscriptionRevocationZod
 } from "@xyo-network/event-kit-schemas";
-import { z } from "zod";
+import { z as z2 } from "zod";
 var HandshakeMutationIntentKinds = [
   "publisher-encryption-key-retire",
   "publisher-service-publish",
@@ -675,83 +1139,83 @@ var HandshakeMutationIntentKinds = [
   "subscriber-subscription-revoke",
   "subscriber-subscription-subscribe"
 ];
-var HandshakeMutationIntentKindZod = z.enum(HandshakeMutationIntentKinds);
-var HandshakeMutationOperationIdZod = z.union([HandshakeIdZod, HashZod]);
-var WakeSubscriptionPrivateKeyZod = z.strictObject({
-  encryptionKey: HashZod,
+var HandshakeMutationIntentKindZod = z2.enum(HandshakeMutationIntentKinds);
+var HandshakeMutationOperationIdZod = z2.union([HandshakeIdZod, HashZod3]);
+var WakeSubscriptionPrivateKeyZod = z2.strictObject({
+  encryptionKey: HashZod3,
   keyId: HandshakeIdZod,
   privateKey: Base64Url32BytesZod
 });
 var IntentBaseFields = {
   chainId: ChainIdZod,
   operationId: HandshakeMutationOperationIdZod,
-  publisher: NormalizedAddressZod,
-  requestFingerprint: HashZod,
-  source: NormalizedAddressZod,
-  version: z.literal(1)
+  publisher: NormalizedAddressZod2,
+  requestFingerprint: HashZod3,
+  source: NormalizedAddressZod2,
+  version: z2.literal(1)
 };
-var PublisherServicePublishIntentZod = z.strictObject({
+var PublisherServicePublishIntentZod = z2.strictObject({
   ...IntentBaseFields,
-  kind: z.literal("publisher-service-publish"),
+  kind: z2.literal("publisher-service-publish"),
   operationId: HandshakeIdZod,
   encryptionKey: PublisherEncryptionKeyZod,
   privateKey: WakeSubscriptionPrivateKeyZod,
   service: PublisherServiceZod
 });
-var PublisherServiceRotateKeyIntentZod = z.strictObject({
+var PublisherServiceRotateKeyIntentZod = z2.strictObject({
   ...IntentBaseFields,
-  kind: z.literal("publisher-service-rotate-key"),
+  kind: z2.literal("publisher-service-rotate-key"),
   operationId: HandshakeIdZod,
   encryptionKey: PublisherEncryptionKeyZod,
   privateKey: WakeSubscriptionPrivateKeyZod,
-  selectedKey: HashZod,
-  selectedService: HashZod,
+  selectedKey: HashZod3,
+  selectedService: HashZod3,
   service: PublisherServiceZod
 });
-var SubscriberSubscriptionIntentZod = z.strictObject({
+var SubscriberSubscriptionIntentZod = z2.strictObject({
   ...IntentBaseFields,
-  kind: z.literal("subscriber-subscription-subscribe"),
+  kind: z2.literal("subscriber-subscription-subscribe"),
   operationId: HandshakeIdZod,
   encryptionKey: PublisherEncryptionKeyZod,
   grant: WakeGrantObjectZod,
-  selectedKey: HashZod,
-  selectedService: HashZod,
+  selectedKey: HashZod3,
+  selectedService: HashZod3,
   service: PublisherServiceZod,
   subscription: EncryptedWakeSubscriptionZod
 });
-var PublisherAcceptanceIntentZod = z.strictObject({
+var PublisherAcceptanceIntentZod = z2.strictObject({
   ...IntentBaseFields,
   acceptance: WakeSubscriptionAcceptanceZod,
   challenge: EndpointChallengeZod,
-  kind: z.literal("publisher-subscription-accept"),
-  operationId: HashZod,
+  kind: z2.literal("publisher-subscription-accept"),
+  operationId: HashZod3,
   response: EndpointChallengeResponseZod
 });
-var PublisherServiceRetireIntentZod = z.strictObject({
+var PublisherServiceRetireIntentZod = z2.strictObject({
   ...IntentBaseFields,
-  kind: z.literal("publisher-service-retire"),
-  operationId: HashZod,
+  kind: z2.literal("publisher-service-retire"),
+  operationId: HashZod3,
   revocation: PublisherServiceRevocationZod
 });
-var PublisherEncryptionKeyRetireIntentZod = z.strictObject({
+var PublisherEncryptionKeyRetireIntentZod = z2.strictObject({
   ...IntentBaseFields,
-  kind: z.literal("publisher-encryption-key-retire"),
-  operationId: HashZod,
+  kind: z2.literal("publisher-encryption-key-retire"),
+  operationId: HashZod3,
   revocation: PublisherEncryptionKeyRevocationZod
 });
-var SubscriberGrantRevokeIntentZod = z.strictObject({
+var SubscriberGrantRevokeIntentZod = z2.strictObject({
   ...IntentBaseFields,
-  kind: z.literal("subscriber-grant-revoke"),
-  operationId: HashZod,
+  kind: z2.literal("subscriber-grant-revoke"),
+  operationId: HashZod3,
   revocation: WakeGrantRevocationZod
 });
-var SubscriberSubscriptionRevokeIntentZod = z.strictObject({
+var SubscriberSubscriptionRevokeIntentZod = z2.strictObject({
   ...IntentBaseFields,
-  kind: z.literal("subscriber-subscription-revoke"),
-  operationId: HashZod,
+  kind: z2.literal("subscriber-subscription-revoke"),
+  operationId: HashZod3,
   revocation: WakeSubscriptionRevocationZod
 });
-var HandshakeMutationIntentZod = z.discriminatedUnion("kind", [
+var HandshakeMutationIntentZod = z2.discriminatedUnion("kind", [
   PublisherEncryptionKeyRetireIntentZod,
   PublisherServicePublishIntentZod,
   PublisherServiceRetireIntentZod,
@@ -771,17 +1235,17 @@ async function handshakeMutationRequestFingerprint(value) {
   const canonical = canonicalJsonBytes(value);
   const digestInput = new Uint8Array(canonical.byteLength);
   digestInput.set(canonical);
-  const digest2 = await globalThis.crypto.subtle.digest("SHA-256", digestInput);
-  const hex = Array.from(new Uint8Array(digest2), (byte) => byte.toString(16).padStart(2, "0")).join("");
-  return HashZod.parse(hex);
+  const digest = await globalThis.crypto.subtle.digest("SHA-256", digestInput);
+  const hex = Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("");
+  return HashZod3.parse(hex);
 }
 function parseHandshakeMutationIntentLookup(value) {
   return Object.freeze({
     chainId: ChainIdZod.parse(value.chainId),
     kind: HandshakeMutationIntentKindZod.parse(value.kind),
     operationId: HandshakeMutationOperationIdZod.parse(value.operationId),
-    publisher: NormalizedAddressZod.parse(value.publisher),
-    source: NormalizedAddressZod.parse(value.source)
+    publisher: NormalizedAddressZod2.parse(value.publisher),
+    source: NormalizedAddressZod2.parse(value.source)
   });
 }
 async function parseHandshakeMutationIntent(value) {
@@ -879,10 +1343,10 @@ async function assertRevocationIntent(intent) {
 
 // src/filesystemHandshakeMutationIntentStore.ts
 function createFilesystemHandshakeMutationIntentStore(options) {
-  const root = PATH9.resolve(options.path);
+  const root = PATH10.resolve(options.path);
   function pathFor(rawLookup) {
     const lookup2 = parseHandshakeMutationIntentLookup(rawLookup);
-    return PATH9.join(
+    return PATH10.join(
       root,
       lookup2.chainId,
       lookup2.publisher,
@@ -923,29 +1387,29 @@ function createFilesystemHandshakeMutationIntentStore(options) {
 
 // src/filesystemPublisherEncryptionKeyStore.ts
 import { stat as stat2 } from "node:fs/promises";
-import PATH10 from "node:path";
+import PATH11 from "node:path";
 import {
   Base64Url32BytesZod as Base64Url32BytesZod2,
   HandshakeIdZod as HandshakeIdZod2,
-  HashZod as HashZod2,
-  NormalizedAddressZod as NormalizedAddressZod2
+  HashZod as HashZod4,
+  NormalizedAddressZod as NormalizedAddressZod3
 } from "@xyo-network/event-kit-schemas";
 function createFilesystemPublisherEncryptionKeyStore(options) {
-  const root = PATH10.resolve(options.path);
+  const root = PATH11.resolve(options.path);
   function parseLookup(lookup2) {
     return {
-      encryptionKey: HashZod2.parse(lookup2.encryptionKey),
+      encryptionKey: HashZod4.parse(lookup2.encryptionKey),
       keyId: HandshakeIdZod2.parse(lookup2.keyId),
-      publisher: NormalizedAddressZod2.parse(lookup2.publisher)
+      publisher: NormalizedAddressZod3.parse(lookup2.publisher)
     };
   }
   function pathFor(lookup2) {
-    return PATH10.join(root, lookup2.publisher, `${lookup2.encryptionKey}-${lookup2.keyId}.json`);
+    return PATH11.join(root, lookup2.publisher, `${lookup2.encryptionKey}-${lookup2.keyId}.json`);
   }
   function keyIdPath(lookup2) {
-    return PATH10.join(root, lookup2.publisher, "key-ids", `${lookup2.keyId}.json`);
+    return PATH11.join(root, lookup2.publisher, "key-ids", `${lookup2.keyId}.json`);
   }
-  async function readRecord2(lookup2) {
+  async function readRecord(lookup2) {
     const path = pathFor(lookup2);
     const raw = await readJsonFileStrict(path);
     if (raw === void 0) return void 0;
@@ -960,7 +1424,7 @@ function createFilesystemPublisherEncryptionKeyStore(options) {
   return {
     async getPrivateKey(rawLookup) {
       const lookup2 = parseLookup(rawLookup);
-      const record = await readRecord2(lookup2);
+      const record = await readRecord(lookup2);
       if (record === void 0) return void 0;
       return Object.freeze({
         encryptionKey: record.encryptionKey,
@@ -988,7 +1452,7 @@ function createFilesystemPublisherEncryptionKeyStore(options) {
         }
       }
       if (await publishJsonFile(path, record, { directoryMode: 448, mode: 384 })) return "stored";
-      const existing = await readRecord2(lookup2);
+      const existing = await readRecord(lookup2);
       if (stringifyJson(existing) !== stringifyJson(record)) {
         throw new Error(`publisher encryption-key collision for ${record.encryptionKey}/${record.keyId}`);
       }
@@ -1004,9 +1468,9 @@ function parseKeyIdRecord(value) {
     throw new TypeError("invalid publisher encryption-key keyId record shape");
   }
   return {
-    encryptionKey: HashZod2.parse(record.encryptionKey),
+    encryptionKey: HashZod4.parse(record.encryptionKey),
     keyId: HandshakeIdZod2.parse(record.keyId),
-    publisher: NormalizedAddressZod2.parse(record.publisher)
+    publisher: NormalizedAddressZod3.parse(record.publisher)
   };
 }
 function parsePrivateKeyRecord(value) {
@@ -1017,28 +1481,28 @@ function parsePrivateKeyRecord(value) {
     throw new TypeError("invalid publisher encryption-key record shape");
   }
   return {
-    encryptionKey: HashZod2.parse(record.encryptionKey),
+    encryptionKey: HashZod4.parse(record.encryptionKey),
     keyId: HandshakeIdZod2.parse(record.keyId),
     privateKey: Base64Url32BytesZod2.parse(record.privateKey),
-    publisher: NormalizedAddressZod2.parse(record.publisher)
+    publisher: NormalizedAddressZod3.parse(record.publisher)
   };
 }
 
 // src/filesystemPublisherEndpointChallengeStore.ts
-import PATH11 from "node:path";
+import PATH12 from "node:path";
 import { endpointChallengeHash } from "@xyo-network/event-kit-protocol";
 import {
   ChallengeNonceZod,
   EndpointChallengeZod as EndpointChallengeZod2,
-  HashZod as HashZod3
+  HashZod as HashZod5
 } from "@xyo-network/event-kit-schemas";
 function createFilesystemPublisherEndpointChallengeStore(options) {
-  const root = PATH11.resolve(options.path);
+  const root = PATH12.resolve(options.path);
   function statePath(challengeHash, state) {
-    return PATH11.join(root, challengeHash, `${state}.json`);
+    return PATH12.join(root, challengeHash, `${state}.json`);
   }
   function noncePath(nonce) {
-    return PATH11.join(root, "nonces", `${nonce}.json`);
+    return PATH12.join(root, "nonces", `${nonce}.json`);
   }
   async function readState(challengeHash, state) {
     const raw = await readJsonFileStrict(statePath(challengeHash, state));
@@ -1059,7 +1523,7 @@ function createFilesystemPublisherEndpointChallengeStore(options) {
   }
   return {
     async beginAttempt(input) {
-      const challengeHash = HashZod3.parse(input.challengeHash);
+      const challengeHash = HashZod5.parse(input.challengeHash);
       requireTime(input.nowSeconds);
       const observed = await current(challengeHash);
       if (observed === void 0) return { kind: "missing" };
@@ -1073,8 +1537,8 @@ function createFilesystemPublisherEndpointChallengeStore(options) {
       return { kind: winner.state === "verified" ? "verified" : "already-attempted", record: winner };
     },
     async completeVerified(input) {
-      const challengeHash = HashZod3.parse(input.challengeHash);
-      const responseHash = HashZod3.parse(input.responseHash);
+      const challengeHash = HashZod5.parse(input.challengeHash);
+      const responseHash = HashZod5.parse(input.responseHash);
       requireTime(input.nowSeconds);
       const observed = await current(challengeHash);
       if (observed === void 0) return { kind: "missing" };
@@ -1093,10 +1557,10 @@ function createFilesystemPublisherEndpointChallengeStore(options) {
       if (winner === void 0) throw new Error("verified challenge winner vanished");
       return { kind: winner.responseHash === responseHash ? "duplicate" : "collision", record: winner };
     },
-    get: async (rawHash) => await current(HashZod3.parse(rawHash)),
+    get: async (rawHash) => await current(HashZod5.parse(rawHash)),
     async issue(input) {
       const challenge = EndpointChallengeZod2.parse(input.challenge);
-      const challengeHash = HashZod3.parse(input.challengeHash);
+      const challengeHash = HashZod5.parse(input.challengeHash);
       if (await endpointChallengeHash(challenge) !== challengeHash) return { kind: "collision" };
       const nonceRecord = { challengeHash, nonce: challenge.nonce };
       if (!await publishJsonFile(
@@ -1127,7 +1591,7 @@ function parseNonceRecord(value) {
   const keys = Object.keys(record).toSorted();
   if (keys.join("|") !== "challengeHash|nonce") throw new TypeError("invalid endpoint-challenge nonce record shape");
   return {
-    challengeHash: HashZod3.parse(record.challengeHash),
+    challengeHash: HashZod5.parse(record.challengeHash),
     nonce: ChallengeNonceZod.parse(record.nonce)
   };
 }
@@ -1137,13 +1601,13 @@ async function parseChallengeRecord(value, expectedState) {
   const state = record.state;
   if (state !== expectedState) throw new Error("endpoint-challenge record state does not match its path");
   const challenge = EndpointChallengeZod2.parse(record.challenge);
-  const challengeHash = HashZod3.parse(record.challengeHash);
+  const challengeHash = HashZod5.parse(record.challengeHash);
   if (await endpointChallengeHash(challenge) !== challengeHash) throw new Error("endpoint-challenge record hash mismatch");
   if (expectedState === "verified") {
     return {
       challenge,
       challengeHash,
-      responseHash: HashZod3.parse(record.responseHash),
+      responseHash: HashZod5.parse(record.responseHash),
       state: expectedState
     };
   }
@@ -1167,7 +1631,7 @@ function requireTime(value) {
 // src/handshakeClients.ts
 import {
   beginPublisherEndpointChallengeAttempt,
-  canonicalJson,
+  canonicalJson as canonicalJson2,
   completePublisherEndpointChallenge,
   createEncryptedWakeSubscription,
   createPublisherEncryptionKeyRevocation,
@@ -1187,9 +1651,9 @@ import {
 import {
   ChainIdZod as ChainIdZod2,
   HandshakeIdZod as HandshakeIdZod3,
-  HashZod as HashZod4,
+  HashZod as HashZod6,
   normalizeAddress,
-  NormalizedAddressZod as NormalizedAddressZod3
+  NormalizedAddressZod as NormalizedAddressZod4
 } from "@xyo-network/event-kit-schemas";
 import { createEventKitHandshakeReadModel } from "@xyo-network/event-kit-statement-graph";
 import {
@@ -1211,7 +1675,7 @@ var EventKitHandshakeClientError = class extends Error {
   }
 };
 function createSynchronizedEventKitHandshakeReader(options) {
-  const publisher = NormalizedAddressZod3.parse(options.publisher);
+  const publisher = NormalizedAddressZod4.parse(options.publisher);
   const chainId = ChainIdZod2.parse(options.session.chainId);
   function assertIdentity() {
     const checkpoint = options.replay.snapshot();
@@ -1253,7 +1717,7 @@ function createEventKitHandshakePublicationPort(transport) {
     publishWakeSubscriptionRevocation: async (input) => await publishWakeSubscriptionRevocation({ ...transport, ...input }),
     async source() {
       const raw = String(await transport.signer.address());
-      const normalized = NormalizedAddressZod3.parse(normalizeAddress(raw));
+      const normalized = NormalizedAddressZod4.parse(normalizeAddress(raw));
       if (raw !== normalized) {
         throw new EventKitHandshakeClientError("identity-mismatch", "XL1 publication signer address is not canonical lowercase hexadecimal without 0x");
       }
@@ -1299,7 +1763,7 @@ function requireService(discovery) {
   return discovery;
 }
 function requireExpectedService(discovery, expected) {
-  const expectedHash = HashZod4.parse(expected);
+  const expectedHash = HashZod6.parse(expected);
   if (discovery.service.objectHash !== expectedHash) {
     throw new EventKitHandshakeClientError("service-mismatch", "Currently selected publisher service does not match the expected object hash");
   }
@@ -1349,6 +1813,8 @@ async function persistMutationIntent(store, intent) {
 }
 async function publisherServiceRequestFingerprint(input) {
   return await handshakeMutationRequestFingerprint({
+    deliveryMode: input.deliveryMode,
+    bestEffort: input.bestEffort ?? null,
     expiresAtBlock: input.expiresAtBlock ?? null,
     maxPositionsPerWake: input.maxPositionsPerWake,
     sources: input.sources,
@@ -1362,12 +1828,14 @@ async function publisherRotationRequestFingerprint(input) {
     keyExpiresAtBlock: input.keyExpiresAtBlock ?? null,
     maxPositionsPerWake: input.maxPositionsPerWake ?? null,
     maxSubscriptionLifetimeBlocks: input.maxSubscriptionLifetimeBlocks ?? null,
-    service: HashZod4.parse(input.service),
+    service: HashZod6.parse(input.service),
     validFromBlock: input.validFromBlock ?? null
   });
 }
 async function subscriberSubscriptionRequestFingerprint(input) {
   return await handshakeMutationRequestFingerprint({
+    deliveryMode: input.deliveryMode,
+    bestEffort: input.bestEffort ?? null,
     audience: input.audience,
     challengeSecret: input.challengeSecret,
     deploymentId: input.deploymentId,
@@ -1392,28 +1860,28 @@ function protocolCandidate(reader, discovery, candidate, keys) {
     finalizedHead: discovery.finalizedHead,
     grant: {
       body: candidate.tuple.grant.body,
-      objectHash: HashZod4.parse(candidate.tuple.grant.objectHash)
+      objectHash: HashZod6.parse(candidate.tuple.grant.objectHash)
     },
     key: {
       body: candidate.key.body,
-      objectHash: HashZod4.parse(candidate.key.objectHash)
+      objectHash: HashZod6.parse(candidate.key.objectHash)
     },
     keys,
     publisher: reader.publisher,
     service: {
       body: candidate.tuple.service.body,
-      objectHash: HashZod4.parse(candidate.tuple.service.objectHash)
+      objectHash: HashZod6.parse(candidate.tuple.service.objectHash)
     },
-    subscriber: NormalizedAddressZod3.parse(candidate.subscriber),
+    subscriber: NormalizedAddressZod4.parse(candidate.subscriber),
     subscription: {
       body: candidate.tuple.subscription.body,
-      objectHash: HashZod4.parse(candidate.tuple.subscription.objectHash)
+      objectHash: HashZod6.parse(candidate.tuple.subscription.objectHash)
     },
     tupleBlock: candidate.tuple.tupleEvent.block,
     tupleObjectHashes: [
-      HashZod4.parse(candidate.tuple.service.objectHash),
-      HashZod4.parse(candidate.tuple.grant.objectHash),
-      HashZod4.parse(candidate.tuple.subscription.objectHash)
+      HashZod6.parse(candidate.tuple.service.objectHash),
+      HashZod6.parse(candidate.tuple.grant.objectHash),
+      HashZod6.parse(candidate.tuple.subscription.objectHash)
     ],
     tupleSubject: reader.publisher
   };
@@ -1438,7 +1906,7 @@ function createPublisherHandshakeClient(options) {
     const current = await snapshot();
     return await current.readModel.acceptanceCandidates({
       ...serviceQuery(options.reader, current, serviceId),
-      ...selector.subscriber === void 0 ? {} : { subscriber: NormalizedAddressZod3.parse(selector.subscriber) },
+      ...selector.subscriber === void 0 ? {} : { subscriber: NormalizedAddressZod4.parse(selector.subscriber) },
       ...selector.subscriptionId === void 0 ? {} : { subscriptionId: HandshakeIdZod3.parse(selector.subscriptionId) }
     });
   }
@@ -1446,8 +1914,8 @@ function createPublisherHandshakeClient(options) {
     const found = await candidateDiscovery(selector);
     if (!found.ok)
       throw new EventKitHandshakeClientError("service-unavailable", `Publisher service is unavailable: ${found.reason}`);
-    const subscriber = NormalizedAddressZod3.parse(selector.subscriber);
-    const subscription = selector.subscription === void 0 ? void 0 : HashZod4.parse(selector.subscription);
+    const subscriber = NormalizedAddressZod4.parse(selector.subscriber);
+    const subscription = selector.subscription === void 0 ? void 0 : HashZod6.parse(selector.subscription);
     const candidates = found.candidates.filter((candidate2) => candidate2.subscriber === subscriber && (subscription === void 0 || candidate2.tuple.subscription.objectHash === subscription));
     if (candidates.length === 0) {
       throw new EventKitHandshakeClientError("candidate-not-found", "No exact finalized acceptance candidate was found");
@@ -1560,7 +2028,7 @@ function createPublisherHandshakeClient(options) {
     const reconciliation = await reconcileAcceptance(acceptanceHash, publication, intent.challenge.subscriber, intent.challenge.subscription);
     return Object.freeze({
       acceptance: Object.freeze({ body: intent.acceptance, objectHash: acceptanceHash }),
-      challenge: intent.operationId,
+      challenge: intent.acceptance.challenge,
       intentDisposition,
       operationId: intent.operationId,
       publication,
@@ -1603,14 +2071,14 @@ function createPublisherHandshakeClient(options) {
       const found = await candidateDiscovery(selector);
       if (!found.ok || selector.subscription === void 0)
         return found;
-      const subscription = HashZod4.parse(selector.subscription);
+      const subscription = HashZod6.parse(selector.subscription);
       return Object.freeze({
         ...found,
         candidates: found.candidates.filter((candidate) => candidate.tuple.subscription.objectHash === subscription)
       });
     },
     async beginChallenge(input) {
-      const challengeHash = HashZod4.parse(input.challengeHash);
+      const challengeHash = HashZod6.parse(input.challengeHash);
       const record = await options.challenges.get(challengeHash);
       if (record === void 0)
         return { kind: "missing" };
@@ -1640,9 +2108,9 @@ function createPublisherHandshakeClient(options) {
     },
     async completeChallengeAndAccept(input) {
       await assertPublicationSource(options.publication, options.reader.publisher);
-      const challengeHash = HashZod4.parse(input.challengeHash);
-      const subscriber = NormalizedAddressZod3.parse(input.subscriber);
-      const subscription = HashZod4.parse(input.subscription);
+      const challengeHash = HashZod6.parse(input.challengeHash);
+      const subscriber = NormalizedAddressZod4.parse(input.subscriber);
+      const subscription = HashZod6.parse(input.subscription);
       const record = await options.challenges.get(challengeHash);
       if (record === void 0) {
         throw new EventKitHandshakeClientError("challenge-not-found", "Endpoint challenge was not found");
@@ -1754,6 +2222,8 @@ function createPublisherHandshakeClient(options) {
         validFromBlock
       };
       const service = createPublisherService({
+        deliveryMode: input.deliveryMode,
+        ...input.bestEffort === void 0 ? {} : { bestEffort: input.bestEffort },
         ...serviceInput,
         authorizationChainId: options.reader.chainId,
         sources: input.sources,
@@ -1775,7 +2245,7 @@ function createPublisherHandshakeClient(options) {
     },
     async retireEncryptionKey(key) {
       await assertPublicationSource(options.publication, options.reader.publisher);
-      const keyHash = HashZod4.parse(key);
+      const keyHash = HashZod6.parse(key);
       const requestFingerprint = await exactMutationRequestFingerprint({ key: keyHash });
       let resolvedIntent = await loadMutationIntent(options.intents, options.reader, "publisher-encryption-key-retire", keyHash, options.reader.publisher, requestFingerprint);
       let intentDisposition = "resumed";
@@ -1813,7 +2283,7 @@ function createPublisherHandshakeClient(options) {
     },
     async retireService(expectedService) {
       await assertPublicationSource(options.publication, options.reader.publisher);
-      const service = HashZod4.parse(expectedService);
+      const service = HashZod6.parse(expectedService);
       const requestFingerprint = await exactMutationRequestFingerprint({ service });
       let resolvedIntent = await loadMutationIntent(options.intents, options.reader, "publisher-service-retire", service, options.reader.publisher, requestFingerprint);
       let intentDisposition = "resumed";
@@ -1869,10 +2339,12 @@ function createPublisherHandshakeClient(options) {
         preferredEncryptionKey: generated.descriptorHash,
         revision: selected.service.body.revision + 1,
         serviceId: selected.service.body.serviceId,
-        supersedes: HashZod4.parse(selected.service.objectHash),
+        supersedes: HashZod6.parse(selected.service.objectHash),
         validFromBlock
       };
       const service = createPublisherService({
+        deliveryMode: selected.service.body.deliveryMode,
+        ...selected.service.body.bestEffort === void 0 ? {} : { bestEffort: selected.service.body.bestEffort },
         ...serviceInput,
         authorizationChainId: options.reader.chainId,
         sources: selected.service.body.events.map((event) => event.source),
@@ -1886,8 +2358,8 @@ function createPublisherHandshakeClient(options) {
         privateKey: generated.privateKey,
         publisher: options.reader.publisher,
         requestFingerprint,
-        selectedKey: HashZod4.parse(selected.key.objectHash),
-        selectedService: HashZod4.parse(selected.service.objectHash),
+        selectedKey: HashZod6.parse(selected.key.objectHash),
+        selectedService: HashZod6.parse(selected.service.objectHash),
         service,
         source: options.reader.publisher,
         version: 1
@@ -1914,7 +2386,7 @@ function tupleHashes(view) {
 }
 function createSubscriberHandshakeClient(options) {
   assertPublicationIdentity(options.publication, options.reader);
-  const subscriber = NormalizedAddressZod3.parse(options.subscriber);
+  const subscriber = NormalizedAddressZod4.parse(options.subscriber);
   const serviceId = options.serviceId === void 0 ? void 0 : HandshakeIdZod3.parse(options.serviceId);
   async function snapshot() {
     return readySnapshot(await options.reader.sync());
@@ -1994,7 +2466,7 @@ function createSubscriberHandshakeClient(options) {
   const client = {
     async revokeGrant(grant) {
       await assertPublicationSource(options.publication, subscriber);
-      const grantHash = HashZod4.parse(grant);
+      const grantHash = HashZod6.parse(grant);
       const requestFingerprint = await exactMutationRequestFingerprint({ grant: grantHash });
       let resolvedIntent = await loadMutationIntent(options.intents, options.reader, "subscriber-grant-revoke", grantHash, subscriber, requestFingerprint);
       let intentDisposition = "resumed";
@@ -2033,7 +2505,7 @@ function createSubscriberHandshakeClient(options) {
     },
     async revokeSubscription(subscription) {
       await assertPublicationSource(options.publication, subscriber);
-      const subscriptionHash = HashZod4.parse(subscription);
+      const subscriptionHash = HashZod6.parse(subscription);
       const requestFingerprint = await exactMutationRequestFingerprint({ subscription: subscriptionHash });
       let resolvedIntent = await loadMutationIntent(options.intents, options.reader, "subscriber-subscription-revoke", subscriptionHash, subscriber, requestFingerprint);
       let intentDisposition = "resumed";
@@ -2075,7 +2547,7 @@ function createSubscriberHandshakeClient(options) {
       return await current.readModel.discoverPublisherService(serviceQuery(options.reader, current, serviceId));
     },
     async subscription(subscription) {
-      const subscriptionHash = HashZod4.parse(subscription);
+      const subscriptionHash = HashZod6.parse(subscription);
       const current = await options.reader.sync();
       const view = await lookupAt(current);
       if (!view.ok)
@@ -2133,12 +2605,12 @@ function createSubscriberHandshakeClient(options) {
         grant: grantHash,
         publisher: options.reader.publisher,
         publisherKey: {
-          encryptionKey: HashZod4.parse(selected.key.objectHash),
+          encryptionKey: HashZod6.parse(selected.key.objectHash),
           keyId: selected.key.body.keyId,
           publicKey: selected.key.body.publicKey
         },
         ...input.revision === void 0 ? {} : { revision: input.revision },
-        service: HashZod4.parse(selected.service.objectHash),
+        service: HashZod6.parse(selected.service.objectHash),
         subscriber,
         ...input.subscriptionId === void 0 ? {} : { subscriptionId: input.subscriptionId },
         ...input.supersedes === void 0 ? {} : { supersedes: input.supersedes }
@@ -2152,8 +2624,8 @@ function createSubscriberHandshakeClient(options) {
         operationId,
         publisher: options.reader.publisher,
         requestFingerprint,
-        selectedKey: HashZod4.parse(selected.key.objectHash),
-        selectedService: HashZod4.parse(selected.service.objectHash),
+        selectedKey: HashZod6.parse(selected.key.objectHash),
+        selectedService: HashZod6.parse(selected.service.objectHash),
         service: selected.service.body,
         source: subscriber,
         subscription,
@@ -2163,30 +2635,570 @@ function createSubscriberHandshakeClient(options) {
     },
     subscriptions: async (subscriptionId) => await lookup2(subscriptionId)
   };
-  return Object.freeze(client);
+  return Object.freeze(client);
+}
+function subscriberPlaintext(service, input, maxPositionsPerWake) {
+  if (input.deliveryMode !== service.deliveryMode || canonicalJson2(input.bestEffort ?? null) !== canonicalJson2(service.bestEffort ?? null))
+    throw new Error("Requested delivery terms do not match exact selected service");
+  const plaintextInput = {
+    audience: input.audience,
+    challengeSecret: input.challengeSecret,
+    deploymentId: input.deploymentId,
+    endpoint: input.endpoint,
+    queueId: input.queueId
+  };
+  const source = input.source;
+  if (service.events.every((event) => canonicalJson2(event.source) !== canonicalJson2(source))) {
+    throw new Error("Requested source is not advertised by the selected service");
+  }
+  return createWakeSubscriptionPlaintext({
+    deliveryMode: input.deliveryMode,
+    ...input.bestEffort === void 0 ? {} : { bestEffort: input.bestEffort },
+    ...plaintextInput,
+    source,
+    fromPosition: input.fromPosition,
+    maxPositionsPerWake
+  });
+}
+
+// src/receiverMigration.ts
+import { randomBytes as randomBytes5 } from "node:crypto";
+import {
+  link as link3,
+  lstat as lstat4,
+  mkdir as mkdir3,
+  mkdtemp,
+  open as open5,
+  realpath,
+  rm,
+  unlink as unlink4
+} from "node:fs/promises";
+import OS from "node:os";
+import PATH15 from "node:path";
+import {
+  HashZod as HashZod8,
+  NormalizedAddressZod as NormalizedAddressZod6,
+  WakeIdZod as WakeIdZod3,
+  WakeJwtAudienceZod as WakeJwtAudienceZod3
+} from "@xyo-network/event-kit-schemas";
+
+// src/receiverMigrationInventory.ts
+import { readFile } from "node:fs/promises";
+import PATH14 from "node:path";
+import { DatabaseSync as DatabaseSync2 } from "node:sqlite";
+import { parseAdmittedWake as parseAdmittedWake3 } from "@xyo-network/event-kit-protocol";
+import {
+  HashZod as HashZod7,
+  NonnegativeJsonSafeIntegerZod as NonnegativeJsonSafeIntegerZod4,
+  NormalizedAddressZod as NormalizedAddressZod5,
+  WakeIdZod as WakeIdZod2,
+  WakeJwtAudienceZod as WakeJwtAudienceZod2,
+  WakeJwtIdZod as WakeJwtIdZod2
+} from "@xyo-network/event-kit-schemas";
+import { z as z3 } from "zod";
+
+// src/receiverMigrationSnapshot.ts
+import { createHash as createHash3 } from "node:crypto";
+import { constants as constants2 } from "node:fs";
+import {
+  lstat as lstat3,
+  mkdir as mkdir2,
+  open as open4,
+  readdir as readdir2
+} from "node:fs/promises";
+import PATH13 from "node:path";
+function migrationRelativePath(root, relative) {
+  if (PATH13.isAbsolute(relative)) throw new TypeError("Migration store paths must be relative");
+  const resolved = PATH13.resolve(root, relative);
+  if (resolved !== root && !resolved.startsWith(`${root}${PATH13.sep}`)) throw new TypeError("Migration path escapes its source store");
+  return resolved;
+}
+async function readExact(path) {
+  const file = await open4(path, constants2.O_RDONLY | constants2.O_NOFOLLOW);
+  try {
+    const before = await file.stat();
+    if (!before.isFile()) throw new TypeError("Migration source must contain ordinary files only");
+    const bytes = await file.readFile();
+    const after = await file.stat();
+    if (before.size !== after.size || before.mtimeMs !== after.mtimeMs || before.ino !== after.ino) {
+      throw new Error("Migration source changed while being copied");
+    }
+    return { bytes, mode: before.mode & 511 };
+  } finally {
+    await file.close();
+  }
+}
+async function snapshotMigrationSource(root, destination) {
+  const files = [];
+  async function visit(relative) {
+    const source = PATH13.join(root, relative);
+    const info = await lstat3(source);
+    if (info.isSymbolicLink()) throw new TypeError("Migration source symlinks are unsupported");
+    if (info.isDirectory()) {
+      if (destination !== void 0) await mkdir2(PATH13.join(destination, relative), { mode: 448 });
+      for (const child of (await readdir2(source)).toSorted()) await visit(PATH13.join(relative, child));
+      if (destination !== void 0) await syncDirectory(PATH13.join(destination, relative));
+      return;
+    }
+    const { bytes, mode } = await readExact(source);
+    files.push({
+      bytes: bytes.length,
+      mode,
+      path: relative,
+      sha256: createHash3("sha256").update(bytes).digest("hex")
+    });
+    if (destination === void 0) return;
+    const target = await open4(PATH13.join(destination, relative), "wx", 384);
+    try {
+      await target.writeFile(bytes);
+      await target.sync();
+    } finally {
+      await target.close();
+    }
+  }
+  await visit("");
+  return files;
+}
+async function verifyMigrationSource(root, files) {
+  const current = await snapshotMigrationSource(root);
+  if (JSON.stringify(current) !== JSON.stringify(files)) throw new Error("Migration source changed; stop every owner and repeat on a new copy");
+}
+
+// src/receiverMigrationInventory.ts
+var ReceiptZod = z3.strictObject({
+  audience: WakeJwtAudienceZod2,
+  eventHash: HashZod7,
+  id: HashZod7,
+  publisher: NormalizedAddressZod5,
+  wakeId: WakeIdZod2
+});
+var recordShape = {
+  audience: WakeJwtAudienceZod2,
+  eventHash: HashZod7,
+  publisher: NormalizedAddressZod5,
+  receipt: ReceiptZod,
+  wakeId: WakeIdZod2
+};
+var WakeRecordZod = z3.strictObject(recordShape);
+var TokenRecordZod = z3.strictObject({
+  ...recordShape,
+  jwtId: WakeJwtIdZod2,
+  retainJwtUntil: NonnegativeJsonSafeIntegerZod4
+});
+function validateMigrationReceipt(receipt) {
+  const parsed = ReceiptZod.parse(receipt);
+  if (parsed.id !== receiverIdentity([parsed.audience, parsed.publisher, parsed.wakeId])) throw new TypeError("Legacy receipt ID does not match its scoped identity");
+  return parsed;
+}
+function validateRecord(record) {
+  const receipt = validateMigrationReceipt(record.receipt);
+  if (receipt.audience !== record.audience || receipt.publisher !== record.publisher || receipt.wakeId !== record.wakeId || receipt.eventHash !== record.eventHash) {
+    throw new TypeError("Legacy receipt does not match its record");
+  }
+}
+function scope(value) {
+  return receiverIdentity([value.audience, value.publisher, value.wakeId]);
+}
+function issue(group, reason) {
+  return {
+    identity: group.identity,
+    paths: [...group.paths],
+    reason
+  };
+}
+function admissionIssue(group, receipt, wake, review) {
+  if (receipt?.id !== group.identity) return issue(group, "Admission receipt is missing or disagrees with reviewed identity");
+  if (review?.action !== "completed" && (wake === void 0 || scope(wake) !== group.identity || wake.eventHash !== receipt.eventHash)) {
+    return issue(group, "Receipt has no exact validated pending body; completion remains unknown");
+  }
+  if (group.tokens.some((token) => token.eventHash !== receipt.eventHash || JSON.stringify(token.receipt) !== JSON.stringify(receipt))) {
+    return issue(group, "Token history conflicts with the reviewed receipt");
+  }
+  return review === void 0 && (group.reasons.length > 0 || group.receipts.some((record) => record.eventHash !== receipt.eventHash) || group.bodies.some((body) => body.wake.eventHash !== receipt.eventHash)) ? issue(group, "Legacy body/receipt mappings disagree; explicit review is required") : void 0;
+}
+function queueIssue(group, receipt, wake, review) {
+  return group.reasons.length > 0 || wake === void 0 || receipt !== void 0 || review?.action === "completed" ? issue(group, "Standalone queue migration cannot infer receipt or completion history") : void 0;
+}
+async function selectEntry(group, review) {
+  const receipt = review?.receipt === void 0 ? group.receipts[0]?.receipt : validateMigrationReceipt(review.receipt);
+  const wake = review?.wake === void 0 ? group.bodies.find((body) => receipt === void 0 || body.wake.eventHash === receipt.eventHash)?.wake : await parseAdmittedWake3(review.wake);
+  const invalid = group.queueOnly ? queueIssue(group, receipt, wake, review) : admissionIssue(group, receipt, wake, review);
+  if (invalid !== void 0) return invalid;
+  const queueOrder = review?.action === "completed" ? void 0 : selectQueueOrder(group, wake, review);
+  return queueOrder !== void 0 && !("kind" in queueOrder) ? queueOrder : migrationEntry(group, receipt, wake, queueOrder, review);
+}
+function migrationEntry(group, receipt, wake, queueOrder, review) {
+  return {
+    evidence: review?.evidence ?? "Exact validated legacy receipt and pending/inflight body; no fresh grant inferred",
+    identity: group.identity,
+    paths: [...group.paths],
+    ...receipt === void 0 ? {} : { receipt },
+    ...queueOrder === void 0 ? {} : { queueOrder },
+    state: review?.action === "completed" ? "completed" : "pending",
+    tokens: group.tokens,
+    ...wake === void 0 ? {} : { wake }
+  };
+}
+function compareQueueOrder(left, right) {
+  if (left.kind === "reviewed-after-known") return right.kind === "reviewed-after-known" ? 0 : 1;
+  if (right.kind === "reviewed-after-known") return -1;
+  if (left.kind === "sqlite-row-id" && right.kind === "sqlite-row-id") return left.id - right.id;
+  if (left.kind === "filesystem-entry-name" && right.kind === "filesystem-entry-name") {
+    return left.name < right.name ? -1 : left.name > right.name ? 1 : 0;
+  }
+  throw new TypeError("Migration cannot combine unrelated source queue orders");
+}
+function selectQueueOrder(group, wake, review) {
+  const matches = group.bodies.filter((body) => body.wake.eventHash === wake.eventHash).toSorted((left, right) => compareQueueOrder(left.order, right.order));
+  const original = matches[0]?.order;
+  if (original !== void 0) return review?.queueOrder === void 0 ? original : issue(group, "Reviewed placement cannot override a matching original queue reference");
+  return review?.queueOrder === void 0 ? issue(group, "Original queue order is unknown; an explicit after-known placement review is required") : { kind: "reviewed-after-known", evidence: review.queueOrder.evidence };
+}
+function compareEntries(left, right) {
+  if (left.state === "completed") return right.state === "completed" ? 0 : 1;
+  return right.state === "completed" ? -1 : compareQueueOrder(left.queueOrder, right.queueOrder);
+}
+function createCollector() {
+  const groups = /* @__PURE__ */ new Map();
+  const groupFor = (identity, path, queueOnly = false) => {
+    let group = groups.get(identity);
+    if (group === void 0) {
+      group = {
+        identity,
+        paths: /* @__PURE__ */ new Set(),
+        bodies: [],
+        receipts: [],
+        reasons: [],
+        tokens: [],
+        queueOnly
+      };
+      groups.set(identity, group);
+    }
+    group.paths.add(path);
+    return group;
+  };
+  return {
+    groups,
+    groupFor,
+    recognized: /* @__PURE__ */ new Set(),
+    invalid(path, reason) {
+      groupFor(`artifact:${path}`, path).reasons.push(reason);
+    }
+  };
+}
+function filesystemKind(queueRelative, inboxRelative) {
+  if (/^(pending|inflight)\/[\w.-]+\.json$/.test(queueRelative)) return "body";
+  if (/^wakes\/[a-f0-9]{64}\.json$/.test(inboxRelative)) return "receipt";
+  return /^tokens\/[a-f0-9]{64}\.json$/.test(inboxRelative) ? "token" : void 0;
+}
+async function readFilesystemRecord(collector, absolute, path, kind) {
+  const raw = JSON.parse(await readFile(absolute, "utf8"));
+  if (kind === "body") {
+    const wake = await parseAdmittedWake3(raw);
+    collector.groupFor(scope(wake), path).bodies.push({
+      order: {
+        kind: "filesystem-entry-name",
+        name: PATH14.basename(path),
+        path
+      },
+      path,
+      wake
+    });
+    return;
+  }
+  const record = kind === "receipt" ? WakeRecordZod.parse(raw) : TokenRecordZod.parse(raw);
+  validateRecord(record);
+  const key = kind === "receipt" ? scope(record) : receiverIdentity([record.audience, record.publisher, record.jwtId]);
+  if (PATH14.basename(path) !== `${key}.json`) throw new TypeError("Legacy record filename disagrees with identity");
+  const group = collector.groupFor(scope(record), path);
+  if (kind === "receipt") group.receipts.push(record);
+  else group.tokens.push(record);
+}
+async function scanFilesystem(source, root, files, collector) {
+  const queueRoot = migrationRelativePath(root, source.queueDirectory);
+  const inboxRoot = migrationRelativePath(root, source.inboxDirectory);
+  for (const file of files) {
+    const absolute = PATH14.join(root, file.path);
+    const kind = filesystemKind(PATH14.relative(queueRoot, absolute), PATH14.relative(inboxRoot, absolute));
+    if (kind === void 0) continue;
+    collector.recognized.add(file.path);
+    try {
+      await readFilesystemRecord(collector, absolute, file.path, kind);
+    } catch {
+      collector.invalid(file.path, "Malformed, corrupt, or incorrectly bound legacy record; exact bytes archived");
+    }
+  }
+}
+async function scanSqlite(source, root, collector) {
+  if (source.scope !== "queue-only") throw new TypeError("SQLite queue migration requires explicit queue-only scope");
+  const file = migrationRelativePath(root, source.databaseFile);
+  for (const name of [source.databaseFile, `${source.databaseFile}-wal`, `${source.databaseFile}-shm`, `${source.databaseFile}-journal`]) collector.recognized.add(PATH14.normalize(name));
+  const database = new DatabaseSync2(file, { readOnly: true });
+  try {
+    const tables = database.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%'").all();
+    if (tables.length !== 1 || tables[0]?.name !== "wake_queue") throw new TypeError("Expected a legacy queue-only SQLite store");
+    for (const row of database.prepare("SELECT id,body,state FROM wake_queue ORDER BY id").all()) {
+      const path = `${source.databaseFile}#wake_queue/${String(row.id)}`;
+      try {
+        if (typeof row.id !== "number" || !Number.isSafeInteger(row.id) || typeof row.body !== "string" || row.state !== "pending" && row.state !== "inflight") throw new TypeError("Invalid legacy queue row");
+        const wake = await parseAdmittedWake3(JSON.parse(row.body));
+        collector.groupFor(`queue:${String(row.id)}`, path, true).bodies.push({
+          order: {
+            kind: "sqlite-row-id",
+            id: row.id,
+            path
+          },
+          path,
+          wake
+        });
+      } catch {
+        collector.invalid(path, "Invalid legacy SQLite queue row; exact database bytes archived");
+      }
+    }
+  } finally {
+    database.close();
+  }
+}
+async function inventoryReceiverMigration(source, copiedRoot, files, reviews) {
+  const collector = createCollector();
+  if (source.kind === "filesystem") await scanFilesystem(source, copiedRoot, files, collector);
+  else await scanSqlite(source, copiedRoot, collector);
+  for (const file of files) {
+    if (!collector.recognized.has(file.path)) collector.invalid(file.path, "Unclassified source artifact; explicit review or quarantine is required");
+  }
+  return await finalizeGroups(collector.groups, reviews);
+}
+function reviewMap(groups, reviews) {
+  const reviewed = /* @__PURE__ */ new Map();
+  for (const review of reviews) {
+    if (!["pending", "completed", "quarantine"].includes(review.action) || review.evidence.trim().length === 0 || reviewed.has(review.identity)) throw new TypeError("Reviews require unique identities, an explicit action and external evidence references");
+    if (!groups.has(review.identity)) throw new TypeError("Review does not correspond to an inventoried identity");
+    if (review.queueOrder !== void 0 && (review.action !== "pending" || review.queueOrder.kind !== "after-known" || review.queueOrder.evidence.trim().length === 0)) throw new TypeError("Queue placement requires a pending review, after-known choice and separate placement evidence");
+    reviewed.set(review.identity, review);
+  }
+  return reviewed;
+}
+async function finalizeGroups(groups, reviews) {
+  const reviewed = reviewMap(groups, reviews);
+  const entries = [];
+  const quarantined = [];
+  const unknown = [];
+  for (const group of groups.values()) {
+    const review = reviewed.get(group.identity);
+    if (review?.action === "quarantine") {
+      quarantined.push(issue(group, review.evidence));
+      continue;
+    }
+    if (group.identity.startsWith("artifact:")) {
+      unknown.push(issue(group, group.reasons.join("; ")));
+      continue;
+    }
+    const selected = await selectEntry(group, review);
+    if ("reason" in selected) unknown.push(selected);
+    else {
+      entries.push(selected);
+      const rejectedBodies = group.bodies.filter((body) => selected.receipt !== void 0 && body.wake.eventHash !== selected.receipt.eventHash);
+      if (rejectedBodies.length > 0) quarantined.push({
+        identity: `reviewed-conflicts:${group.identity}`,
+        paths: rejectedBodies.map((body) => body.path),
+        reason: "Reviewed mapping excluded conflicting bodies; exact bytes remain in the backup"
+      });
+    }
+  }
+  return {
+    entries: entries.toSorted(compareEntries),
+    quarantined,
+    unknown
+  };
+}
+
+// src/receiverMigration.ts
+var rollback = "restore-backup-only-before-new-writers-resume; after-that-repair-forward; reverse-migration-unsupported";
+async function outsideSource(source, destination) {
+  let parent = PATH15.dirname(PATH15.resolve(destination));
+  const suffix2 = [PATH15.basename(destination)];
+  let canonicalParent;
+  for (; ; ) {
+    try {
+      canonicalParent = await realpath(parent);
+      break;
+    } catch (error) {
+      if (typeof error !== "object" || error === null || !("code" in error) || error.code !== "ENOENT") throw error;
+      suffix2.unshift(PATH15.basename(parent));
+      parent = PATH15.dirname(parent);
+    }
+  }
+  const resolved = PATH15.join(canonicalParent, ...suffix2);
+  if (resolved === source || resolved.startsWith(`${source}${PATH15.sep}`)) throw new TypeError("Migration output must be outside the source store");
+  return resolved;
+}
+async function writeReport(path, report) {
+  const file = await open5(path, "wx", 384);
+  try {
+    await file.writeFile(`${JSON.stringify(report, null, 2)}
+`);
+    await file.sync();
+  } finally {
+    await file.close();
+  }
+  await syncDirectory(PATH15.dirname(path));
+}
+function importEntries(database, entries) {
+  database.exec("BEGIN IMMEDIATE");
+  try {
+    for (const entry of entries) {
+      const terminalToken = entry.state === "completed" ? randomBytes5(16).toString("hex") : null;
+      const result = database.prepare("INSERT INTO receiver_queue(body,state,terminal_token,terminal_operation) VALUES(?,?,?,?)").run(entry.state === "completed" ? null : JSON.stringify(entry.wake), entry.state, terminalToken, terminalToken === null ? null : "ack");
+      if (entry.receipt === void 0) continue;
+      const receipt = entry.receipt;
+      database.prepare("INSERT INTO receiver_wakes(identity,audience,publisher,wake_id,event_hash,receipt,authorization,queue_id) VALUES(?,?,?,?,?,?,?,?)").run(
+        receipt.id,
+        receipt.audience,
+        receipt.publisher,
+        receipt.wakeId,
+        receipt.eventHash,
+        JSON.stringify(receipt),
+        JSON.stringify({
+          kind: "legacy-migration",
+          evidence: entry.evidence,
+          artifacts: entry.paths,
+          freshAuthorization: false,
+          ...terminalToken === null ? {} : { completion: { kind: "reviewed-migration-decision", terminalToken } }
+        }),
+        result.lastInsertRowid
+      );
+      for (const token of entry.tokens) {
+        database.prepare("INSERT INTO receiver_tokens(identity,wake_identity,event_hash,wake_id,retain_until) VALUES(?,?,?,?,?)").run(receiverIdentity([token.audience, token.publisher, token.jwtId]), receipt.id, token.eventHash, token.wakeId, token.retainJwtUntil);
+      }
+    }
+    database.exec("COMMIT");
+  } catch (error) {
+    database.exec("ROLLBACK");
+    throw error;
+  }
+}
+async function publishMigratedStore(target, entries, verifySource) {
+  ensurePrivateDirectory(PATH15.dirname(target));
+  const staging = PATH15.join(PATH15.dirname(target), `.receiver-migration-${randomBytes5(8).toString("hex")}`);
+  await mkdir3(staging, { mode: 448 });
+  const file = PATH15.join(staging, "receiver.sqlite");
+  try {
+    const receiver = openReceiverAuthority(file);
+    try {
+      importEntries(receiver.database, entries);
+      receiver.database.exec("PRAGMA wal_checkpoint(TRUNCATE)");
+    } finally {
+      receiver.close();
+    }
+    await verifySource();
+    await link3(file, target);
+    await syncDirectory(PATH15.dirname(target));
+    await unlink4(file);
+  } finally {
+    await rm(staging, { recursive: true, force: true });
+  }
+}
+async function prepareLocations(options) {
+  if (options?.consumersStopped !== true) throw new TypeError("Migration requires every source writer and consumer to be stopped");
+  if (!["filesystem", "sqlite-queue"].includes(options.source.kind)) throw new TypeError("Unknown receiver migration source format");
+  if (options.source.kind === "sqlite-queue" && options.source.scope !== "queue-only") throw new TypeError("SQLite queue migration requires explicit queue-only scope");
+  const sourcePath = await realpath(options.source.path);
+  if (!(await lstat4(options.source.path)).isDirectory()) throw new TypeError("Migration source must be an owned store directory");
+  const backupPath = options.backupPath === void 0 ? void 0 : await outsideSource(sourcePath, options.backupPath);
+  const targetPath = options.targetPath === void 0 ? void 0 : await outsideSource(sourcePath, options.targetPath);
+  if (!options.dryRun && (backupPath === void 0 || targetPath === void 0)) throw new TypeError("Execution requires distinct backupPath and targetPath");
+  if (backupPath !== void 0 && targetPath !== void 0 && (targetPath === backupPath || targetPath.startsWith(`${backupPath}${PATH15.sep}`) || backupPath.startsWith(`${targetPath}${PATH15.sep}`))) {
+    throw new TypeError("Backup and target paths must be separate");
+  }
+  return {
+    backupPath,
+    sourcePath,
+    targetPath
+  };
 }
-function subscriberPlaintext(service, input, maxPositionsPerWake) {
-  const plaintextInput = {
-    audience: input.audience,
-    challengeSecret: input.challengeSecret,
-    deploymentId: input.deploymentId,
-    endpoint: input.endpoint,
-    queueId: input.queueId
+async function prepareCopy(options, paths, scratch) {
+  if (options.dryRun) return await snapshotMigrationSource(paths.sourcePath, PATH15.join(scratch, "source"));
+  await mkdir3(PATH15.dirname(paths.backupPath), { recursive: true, mode: 448 });
+  await mkdir3(paths.backupPath, { mode: 448 });
+  const files = await snapshotMigrationSource(paths.sourcePath, PATH15.join(paths.backupPath, "source"));
+  await syncDirectory(paths.backupPath);
+  await snapshotMigrationSource(PATH15.join(paths.backupPath, "source"), PATH15.join(scratch, "source"));
+  return files;
+}
+function migrationReport(paths, files, plan, options) {
+  const dryRun = options.dryRun === true;
+  const ready = plan.unknown.length === 0;
+  return {
+    ...paths.backupPath === void 0 || dryRun ? {} : { backupPath: paths.backupPath },
+    completedIdentities: plan.entries.filter((entry) => entry.state === "completed").length,
+    executed: ready && !dryRun,
+    files,
+    pendingIdentities: plan.entries.filter((entry) => entry.state === "pending").length,
+    quarantined: plan.quarantined,
+    ready,
+    reviews: (options.reviews ?? []).map((review) => ({
+      action: review.action,
+      evidence: review.evidence,
+      identity: review.identity,
+      ...review.queueOrder === void 0 ? {} : { queueOrder: review.queueOrder }
+    })),
+    rollback,
+    selected: plan.entries.map((entry) => ({
+      ...entry.state === "completed" ? { completionProvenance: "Fresh reviewed migration tombstone; no historical lease or ack inferred" } : {},
+      eventHash: entry.receipt?.eventHash ?? entry.wake?.eventHash,
+      identity: entry.identity,
+      paths: entry.paths,
+      ...entry.queueOrder === void 0 ? {} : { queueOrder: entry.queueOrder },
+      state: entry.state
+    })),
+    sourceBytes: files.reduce((total, file) => total + file.bytes, 0),
+    sourcePath: paths.sourcePath,
+    sourceUnchanged: true,
+    tokenRecords: plan.entries.reduce((total, entry) => total + entry.tokens.length, 0),
+    unknown: plan.unknown,
+    ...paths.targetPath === void 0 || dryRun ? {} : { targetPath: paths.targetPath }
   };
-  const source = input.source;
-  if (service.events.every((event) => canonicalJson(event.source) !== canonicalJson(source))) {
-    throw new Error("Requested source is not advertised by the selected service");
+}
+async function migrateReceiverStore(options) {
+  const paths = await prepareLocations(options);
+  const scratch = await mkdtemp(PATH15.join(OS.tmpdir(), "event-kit-receiver-migration-"));
+  try {
+    const files = await prepareCopy(options, paths, scratch);
+    const verify = async () => {
+      await verifyMigrationSource(paths.sourcePath, files);
+    };
+    await verify();
+    const plan = await inventoryReceiverMigration(options.source, PATH15.join(scratch, "source"), files, options.reviews ?? []);
+    if (!options.dryRun) await writeReport(PATH15.join(paths.backupPath, "migration-plan.json"), { ...migrationReport(paths, files, plan, options), executed: false });
+    if (plan.unknown.length === 0 && !options.dryRun) await publishMigratedStore(paths.targetPath, plan.entries, verify);
+    await verify();
+    const report = migrationReport(paths, files, plan, options);
+    if (!options.dryRun) await writeReport(PATH15.join(paths.backupPath, "migration-report.json"), report);
+    return report;
+  } finally {
+    await rm(scratch, { recursive: true, force: true });
   }
-  return createWakeSubscriptionPlaintext({
-    ...plaintextInput,
-    source,
-    fromPosition: input.fromPosition,
-    maxPositionsPerWake
-  });
+}
+function migrateIdOnlyReducerCheckpoint(checkpoint, mappings) {
+  if (!Number.isSafeInteger(checkpoint.lastProcessedPosition) || checkpoint.lastProcessedPosition < -1) throw new TypeError("Invalid historical checkpoint position");
+  const ids = new Set(checkpoint.appliedWakeIds.map((id) => WakeIdZod3.parse(id)));
+  const records = /* @__PURE__ */ new Map();
+  for (const mapping of mappings) {
+    const record = {
+      audience: WakeJwtAudienceZod3.parse(mapping.audience),
+      eventHash: HashZod8.parse(mapping.eventHash),
+      publisher: NormalizedAddressZod6.parse(mapping.publisher),
+      wakeId: WakeIdZod3.parse(mapping.wakeId)
+    };
+    if (!ids.has(record.wakeId) || records.has(record.wakeId)) throw new TypeError("Checkpoint mapping is extraneous or ambiguous");
+    records.set(record.wakeId, record);
+  }
+  if (records.size !== ids.size) throw new TypeError("Every historical wake ID requires an exact scoped hash mapping");
+  return { appliedWakes: [...ids].map((id) => records.get(id)), lastProcessedPosition: checkpoint.lastProcessedPosition };
 }
 
 // src/runtime/boundedFetch.ts
-import { Buffer as Buffer2 } from "node:buffer";
+import { Buffer as Buffer3 } from "node:buffer";
 
 // src/runtime/abort.ts
 import { clearTimeout, setTimeout } from "node:timers";
@@ -2228,13 +3240,13 @@ function createBoundedPublisherFetch(options = {}) {
         ...init?.signal == null ? [] : [init.signal],
         ...input instanceof Request ? [input.signal] : []
       ];
-      const scope = publisherAbortScope(signals, timeout);
+      const scope2 = publisherAbortScope(signals, timeout);
       try {
-        scope.signal.throwIfAborted();
+        scope2.signal.throwIfAborted();
         const response = await nativeFetch(input, {
           ...init,
           redirect: "error",
-          signal: scope.signal
+          signal: scope2.signal
         });
         if (response.body === null)
           return response;
@@ -2262,13 +3274,13 @@ function createBoundedPublisherFetch(options = {}) {
         headers.delete("content-encoding");
         headers.delete("transfer-encoding");
         headers.set("content-length", String(size));
-        return new Response(Buffer2.concat(chunks), {
+        return new Response(Buffer3.concat(chunks), {
           status: response.status,
           statusText: response.statusText,
           headers
         });
       } finally {
-        scope.dispose();
+        scope2.dispose();
       }
     })();
     active.add(operation);
@@ -2293,7 +3305,7 @@ function createBoundedPublisherEthersTransport(options = {}) {
     cancellation?.addListener(() => controller.abort());
     cancellation?.checkSignal();
     const response = await bounded.fetchFn(request2.url, {
-      body: request2.body === null ? void 0 : Buffer2.from(request2.body),
+      body: request2.body === null ? void 0 : Buffer3.from(request2.body),
       headers: request2.headers,
       method: request2.method,
       signal: controller.signal
@@ -2317,6 +3329,7 @@ function createBoundedPublisherEthersTransport(options = {}) {
 }
 
 // src/runtime/handshakeDiscovery.ts
+import { isDeepStrictEqual as isDeepStrictEqual2 } from "node:util";
 import { decryptWakeSubscription, sourceWakeFilterHash } from "@xyo-network/event-kit-protocol";
 import { EndpointChallengeResponseZod as EndpointChallengeResponseZod2 } from "@xyo-network/event-kit-schemas";
 function createPublisherHandshakeDiscovery(options) {
@@ -2332,6 +3345,9 @@ function createPublisherHandshakeDiscovery(options) {
     rejectedSubscriptions: 0,
     challengeFailures: 0
   };
+  function selectedTuple(tuple) {
+    return (options.serviceHash === void 0 || tuple.service.objectHash === options.serviceHash) && (options.deliveryMode === void 0 || tuple.service.body.deliveryMode === options.deliveryMode) && (options.deliveryMode === void 0 || tuple.subscription.body.deliveryMode === options.deliveryMode) && (options.deliveryMode === void 0 || isDeepStrictEqual2(tuple.service.body.bestEffort, options.bestEffort));
+  }
   async function activeView(signal) {
     signal.throwIfAborted();
     viewing ??= (async () => {
@@ -2349,7 +3365,7 @@ function createPublisherHandshakeDiscovery(options) {
       ...status,
       finalizedHead: view.finalizedHead,
       indexedThrough: view.indexedThrough,
-      pendingSubscriptions: view.subscriptions.filter((item) => item.state === "pending").length,
+      pendingSubscriptions: view.subscriptions.filter((item) => item.state === "pending" && item.tuples.some(selectedTuple)).length,
       rejectedSubscriptions: view.rejections.length
     };
     return view;
@@ -2414,7 +3430,7 @@ function createPublisherHandshakeDiscovery(options) {
     if (!found.ok)
       throw new Error("Publisher acceptance candidates are unavailable");
     const offset = options.state.get("challenge-rate", "offset") ?? 0;
-    const candidates = found.candidates;
+    const candidates = found.candidates.filter((candidate) => selectedTuple(candidate.tuple));
     let attempted = 0;
     for (let index = 0; index < Math.min(candidates.length, 128) && attempted < 4; index += 1) {
       const candidate = candidates[(offset + index) % candidates.length];
@@ -2430,30 +3446,40 @@ function createPublisherHandshakeDiscovery(options) {
       await acceptCandidate(candidate.subscriber, candidate.tuple.subscription.objectHash, signal);
     }
   }
+  async function loadScopedKeys(view, active) {
+    const scopedKeys = active.flatMap((item) => item.tuples.filter((tuple) => tuple.subscription.objectHash === item.selectedSubscription).map((tuple) => ({
+      encryptionKey: tuple.subscription.body.encryptionKey,
+      keyId: tuple.subscription.body.keyId,
+      publisher: options.publisher
+    })));
+    if (view.hasCurrentAdvertisement && (options.serviceHash === void 0 || view.service.objectHash === options.serviceHash) && (options.deliveryMode === void 0 || view.service.body.deliveryMode === options.deliveryMode)) {
+      scopedKeys.push({
+        encryptionKey: view.key.objectHash,
+        keyId: view.key.body.keyId,
+        publisher: options.publisher
+      });
+    }
+    const loadedKeys = await Promise.all(scopedKeys.map(async (key) => await options.keys.getPrivateKey(key)));
+    status = {
+      ...status,
+      keyLoaded: scopedKeys.length > 0 && loadedKeys.every((key) => key !== void 0),
+      activeKeyIds: [...new Set(scopedKeys.map((key) => key.keyId))]
+    };
+  }
   return {
     async discover(signal) {
       const view = await activeView(signal);
-      const key = view.hasCurrentAdvertisement ? view.key : void 0;
-      const loaded = key === void 0 ? void 0 : await options.keys.getPrivateKey({
-        encryptionKey: key.objectHash,
-        keyId: key.body.keyId,
-        publisher: options.publisher
-      });
-      status = {
-        ...status,
-        keyLoaded: loaded !== void 0,
-        activeKeyIds: key === void 0 ? [] : [key.body.keyId]
-      };
-      const subscriptions = [];
-      const active = view.subscriptions.filter((item) => item.state === "active");
+      const active = view.subscriptions.filter((item) => item.state === "active" && item.tuples.some((tuple) => tuple.subscription.objectHash === item.selectedSubscription && selectedTuple(tuple)));
+      await loadScopedKeys(view, active);
       if (active.length > (options.maxSubscriptions ?? 64))
         throw new Error("Publisher active subscription limit exceeded");
+      const subscriptions = [];
       for (const lifecycle of active) {
         if (lifecycle.state !== "active" || lifecycle.activeFromBlock === void 0)
           continue;
         try {
           const tuple = lifecycle.tuples.find((item) => item.subscription.objectHash === lifecycle.selectedSubscription);
-          if (tuple === void 0)
+          if (tuple === void 0 || !selectedTuple(tuple))
             throw new Error("Active publisher subscription has no selected tuple");
           const encrypted = tuple.subscription.body;
           if (encrypted.chainId !== options.authorizationChainId)
@@ -2473,6 +3499,9 @@ function createPublisherHandshakeDiscovery(options) {
           options.transport.assertAllowed(plaintext.endpoint);
           subscriptions.push({
             subscriptionHash: tuple.subscription.objectHash,
+            serviceHash: tuple.service.objectHash,
+            deliveryMode: plaintext.filter.deliveryMode,
+            ...plaintext.filter.bestEffort === void 0 ? {} : { bestEffort: plaintext.filter.bestEffort },
             authorizationChainId: options.authorizationChainId,
             controller: tuple.subscriber,
             audience: plaintext.audience,
@@ -2492,16 +3521,16 @@ function createPublisherHandshakeDiscovery(options) {
     },
     async isActive(subscription, signal) {
       const view = await activeView(signal);
-      return view.subscriptions.some((item) => item.state === "active" && item.selectedSubscription === subscription.subscriptionHash && item.tuples.some((tuple) => tuple.subscription.objectHash === subscription.subscriptionHash && tuple.subscriber === subscription.controller));
+      return view.subscriptions.some((item) => item.state === "active" && item.selectedSubscription === subscription.subscriptionHash && item.tuples.some((tuple) => tuple.subscription.objectHash === subscription.subscriptionHash && tuple.subscriber === subscription.controller && selectedTuple(tuple)));
     },
     async acceptPending(signal) {
       if (accepting === void 0) {
-        const scope = publisherAbortScope([owner.signal, signal]);
+        const scope2 = publisherAbortScope([owner.signal, signal]);
         accepting = (async () => {
           try {
-            await accept(scope.signal);
+            await accept(scope2.signal);
           } finally {
-            scope.dispose();
+            scope2.dispose();
             accepting = void 0;
           }
         })();
@@ -2516,25 +3545,25 @@ function createPublisherHandshakeDiscovery(options) {
 }
 
 // src/runtime/httpsTransport.ts
-import { Buffer as Buffer3 } from "node:buffer";
+import { Buffer as Buffer4 } from "node:buffer";
 import { lookup } from "node:dns/promises";
 import { request } from "node:https";
 import { BlockList, isIP } from "node:net";
-import { z as z2 } from "zod";
+import { z as z4 } from "zod";
 
 // src/runtime/sources.ts
-import { createHash as createHash3 } from "node:crypto";
-import { canonicalJson as canonicalJson2 } from "@xyo-network/event-kit-protocol";
-import { completedUtcIntervalPosition, WakeSourceZod } from "@xyo-network/event-kit-schemas";
+import { createHash as createHash4 } from "node:crypto";
+import { canonicalJson as canonicalJson3 } from "@xyo-network/event-kit-protocol";
+import { completedUtcIntervalPosition, WakeSourceZod as WakeSourceZod2 } from "@xyo-network/event-kit-schemas";
 import { PayloadBuilder } from "@xyo-network/sdk";
 import { asXL1BlockNumber } from "@xyo-network/xl1-sdk";
 import { FetchRequest, JsonRpcProvider } from "ethers";
 function publisherSourceKey(source) {
-  return createHash3("sha256").update(canonicalJson2(WakeSourceZod.parse(source))).digest("hex");
+  return createHash4("sha256").update(canonicalJson3(WakeSourceZod2.parse(source))).digest("hex");
 }
 async function boundedPublisherOperation(operation, signal, timeoutMs = 1e4) {
-  const scope = publisherAbortScope([signal], timeoutMs);
-  const combined = scope.signal;
+  const scope2 = publisherAbortScope([signal], timeoutMs);
+  const combined = scope2.signal;
   let rejectAbort;
   const aborted = new Promise((_resolve, reject) => {
     rejectAbort = () => reject(new Error("Publisher operation aborted or timed out"));
@@ -2546,11 +3575,11 @@ async function boundedPublisherOperation(operation, signal, timeoutMs = 1e4) {
   } finally {
     if (rejectAbort !== void 0)
       combined.removeEventListener("abort", rejectAbort);
-    scope.dispose();
+    scope2.dispose();
   }
 }
 function createXl1PublisherSource(options) {
-  const source = WakeSourceZod.parse(options.source);
+  const source = WakeSourceZod2.parse(options.source);
   if (source.kind !== "xl1-finalized")
     throw new Error("Expected an XL1 finalized source");
   return {
@@ -2574,7 +3603,7 @@ function createXl1PublisherSource(options) {
   };
 }
 function createEthereumFinalizedPublisherSource(options) {
-  const source = WakeSourceZod.parse(options.source);
+  const source = WakeSourceZod2.parse(options.source);
   if (source.kind !== "ethereum-finalized")
     throw new Error("Expected an Ethereum finalized source");
   const { chainId, genesisHash } = source;
@@ -2640,7 +3669,7 @@ function createEthereumFinalizedPublisherSource(options) {
   };
 }
 function createUtcIntervalPublisherSource(options) {
-  const source = WakeSourceZod.parse(options.source);
+  const source = WakeSourceZod2.parse(options.source);
   if (source.kind !== "utc-interval")
     throw new Error("Expected a UTC interval source");
   const nowSeconds = options.nowSeconds ?? (() => Math.floor(Date.now() / 1e3));
@@ -2657,14 +3686,14 @@ function createUtcIntervalPublisherSource(options) {
 }
 
 // src/runtime/httpsTransport.ts
-var OptionsZod = z2.strictObject({
-  allowedEndpoints: z2.array(z2.url()).min(1).max(64),
-  endpointHeaders: z2.array(z2.strictObject({
-    endpoint: z2.url(),
-    headers: z2.strictObject({ "x-vercel-protection-bypass": z2.string().min(1).max(4096).regex(/^[\u{21}-\u{7E}]+$/u) })
+var OptionsZod = z4.strictObject({
+  allowedEndpoints: z4.array(z4.url()).min(1).max(64),
+  endpointHeaders: z4.array(z4.strictObject({
+    endpoint: z4.url(),
+    headers: z4.strictObject({ "x-vercel-protection-bypass": z4.string().min(1).max(4096).regex(/^[\u{21}-\u{7E}]+$/u) })
   })).max(64).default([]),
-  maxResponseBytes: z2.number().int().min(1).max(1048576).default(65536),
-  requestTimeoutMs: z2.number().int().min(100).max(6e4).default(1e4)
+  maxResponseBytes: z4.number().int().min(1).max(1048576).default(65536),
+  requestTimeoutMs: z4.number().int().min(100).max(6e4).default(1e4)
 });
 var NON_PUBLIC_IPV4_SUBNETS = [
   ["0.0.0.0", 8],
@@ -2744,8 +3773,8 @@ function createPublisherHttpsTransport(input) {
       assertAllowed(endpoint);
       signal.throwIfAborted();
       const url = new URL(endpoint);
-      const scope = publisherAbortScope([signal], options.requestTimeoutMs);
-      const combined = scope.signal;
+      const scope2 = publisherAbortScope([signal], options.requestTimeoutMs);
+      const combined = scope2.signal;
       try {
         const addresses = await boundedPublisherOperation(lookup(url.hostname.replaceAll(/^\[|\]$/gu, ""), { all: true, verbatim: true }), combined, options.requestTimeoutMs);
         combined.throwIfAborted();
@@ -2754,7 +3783,7 @@ function createPublisherHttpsTransport(input) {
         const selected = addresses[0];
         if (selected === void 0)
           throw new Error("Publisher DNS lookup was empty");
-        const encoded = Buffer3.from(JSON.stringify(body));
+        const encoded = Buffer4.from(JSON.stringify(body));
         if (encoded.byteLength > 65536)
           throw new Error("Publisher request body is too large");
         return await new Promise((resolve, reject) => {
@@ -2795,7 +3824,7 @@ function createPublisherHttpsTransport(input) {
             response.on("error", () => reject(new Error("Publisher HTTPS response failed")));
             response.on("end", () => {
               try {
-                const responseBody = size === 0 ? null : JSON.parse(Buffer3.concat(chunks).toString("utf8"));
+                const responseBody = size === 0 ? null : JSON.parse(Buffer4.concat(chunks).toString("utf8"));
                 const retry = Number(response.headers["retry-after"]);
                 resolve({
                   status,
@@ -2811,42 +3840,152 @@ function createPublisherHttpsTransport(input) {
           call.end(encoded);
         });
       } finally {
-        scope.dispose();
+        scope2.dispose();
       }
     }
   };
 }
 
 // src/runtime/publisherRuntime.ts
-import { randomBytes as randomBytes6 } from "node:crypto";
-import { isDeepStrictEqual as isDeepStrictEqual2 } from "node:util";
+import { isDeepStrictEqual as isDeepStrictEqual4 } from "node:util";
 import { createMemoryLocator, PeriodicActor } from "@ariestools/actor";
 import { creatable } from "@ariestools/sdk";
-import { WakeEnvelopeSchema, WakeEnvelopeZod as WakeEnvelopeZod2 } from "@xyo-network/event-kit-schemas";
-import { z as z3 } from "zod";
+import { BestEffortAdmissionAcknowledgmentZod } from "@xyo-network/event-kit-protocol";
+import { BestEffortDeliveryPolicyZod, WakeDeliveryModeZod } from "@xyo-network/event-kit-schemas";
+import { z as z5 } from "zod";
+
+// src/runtime/publisherDeliveryState.ts
+import { randomBytes as randomBytes6 } from "node:crypto";
+import { isDeepStrictEqual as isDeepStrictEqual3 } from "node:util";
+import { WakeEnvelopeSchema as WakeEnvelopeSchema2, WakeEnvelopeZod as WakeEnvelopeZod2 } from "@xyo-network/event-kit-schemas";
+function assertDeliveryState(record, subscription) {
+  if (!isDeepStrictEqual3(record.subscription, subscription))
+    throw new Error("Subscription revision changed without a new identity");
+  if (!Number.isSafeInteger(record.cursor) || record.cursor < subscription.fromPosition - 1 || [record.delivered, record.failures, record.nextAttemptMs].some((value) => !(Number.isSafeInteger(value) && value >= 0)) || [record.attempts, record.superseded, record.abandoned, record.totalAttempts, record.lastHintAt, record.lastNotifiedAt, record.lastHintTarget].some((value) => value !== void 0 && !(Number.isSafeInteger(value) && value >= 0)) || !["active", "blocked", "cancelled"].includes(record.state))
+    throw new Error("Persisted publisher delivery state is invalid");
+  if (record.pending === void 0) return;
+  const pending = WakeEnvelopeZod2.parse(record.pending);
+  if (subscription.deliveryMode === "durable" && pending.fromPosition !== record.cursor + 1 || pending.deliveryMode !== subscription.deliveryMode || pending.toPosition - pending.fromPosition + 1 > subscription.maxPositionsPerWake || pending.authorizationChainId !== subscription.authorizationChainId || pending.deploymentId !== subscription.deploymentId || pending.queueId !== subscription.queueId || pending.filterHash !== subscription.filterHash || !isDeepStrictEqual3(pending.source, subscription.source))
+    throw new Error("Persisted publisher outbox binding is invalid");
+}
+function makeEvent(subscription, fromPosition, toPosition, now, wakeId = randomBytes6(16).toString("hex")) {
+  return WakeEnvelopeZod2.parse({
+    schema: WakeEnvelopeSchema2,
+    authorizationChainId: subscription.authorizationChainId,
+    deliveryMode: subscription.deliveryMode,
+    deploymentId: subscription.deploymentId,
+    filterHash: subscription.filterHash,
+    fromPosition,
+    issuedAt: now,
+    source: subscription.source,
+    toPosition,
+    wakeId,
+    ...subscription.queueId === void 0 ? {} : { queueId: subscription.queueId }
+  });
+}
+var DeliveryResponseError = class extends Error {
+  retryAfterMs;
+  status;
+  constructor(status, retryAfterMs) {
+    super("Publisher admission failed");
+    this.status = status;
+    this.retryAfterMs = retryAfterMs;
+  }
+  get retryable() {
+    return this.status === 408 || this.status === 429 || this.status >= 500;
+  }
+};
+function prepareBestEffortDelivery(options) {
+  const {
+    bestEffort,
+    first,
+    heads,
+    now,
+    record,
+    state
+  } = options;
+  const subscription = record.subscription;
+  const head = heads.get(publisherSourceKey(subscription.source));
+  const prior = record.pending;
+  const expired = isHintExpired(record, now, bestEffort);
+  if (head === void 0 || head instanceof Error || head.position < subscription.fromPosition) {
+    if (prior !== void 0 && !expired) return { ...record, pending: prior };
+    if (prior !== void 0) state.set("best-effort-deliveries", subscription.subscriptionHash, {
+      ...record,
+      pending: void 0,
+      abandoned: (record.abandoned ?? 0) + 1
+    });
+    return;
+  }
+  const refresh = refreshDue(record, now, bestEffort);
+  if (freshHintRequired(record, head.position, first, refresh, expired)) {
+    const pending = makeEvent(subscription, head.position, head.position, now);
+    const prepared = {
+      ...record,
+      pending,
+      attempts: 0,
+      lastHintAt: now,
+      lastHintTarget: head.position,
+      superseded: (record.superseded ?? 0) + (prior !== void 0 && !expired ? 1 : 0),
+      abandoned: (record.abandoned ?? 0) + (expired ? 1 : 0),
+      nextAttemptMs: 0,
+      state: "active"
+    };
+    state.set("best-effort-deliveries", subscription.subscriptionHash, prepared);
+    return prepared;
+  }
+  if (expired) state.set("best-effort-deliveries", subscription.subscriptionHash, {
+    ...record,
+    pending: void 0,
+    abandoned: (record.abandoned ?? 0) + 1
+  });
+  return prior === void 0 || expired ? void 0 : { ...record, pending: prior };
+}
+function isHintExpired(record, now, policy) {
+  return record.pending !== void 0 && (now > record.pending.issuedAt + policy.maxHintAgeSeconds || (record.attempts ?? 0) >= policy.maxAttempts);
+}
+function refreshDue(record, now, policy) {
+  return now - (record.lastHintAt ?? record.lastNotifiedAt ?? 0) >= policy.refreshIntervalSeconds;
+}
+function freshHintRequired(record, head, first, refresh, expired) {
+  return first || head > (record.pending?.toPosition ?? record.lastHintTarget ?? record.cursor) || refresh && (record.pending === void 0 || expired);
+}
+function failedDelivery(record, current, mode, error, now) {
+  const bestEffort = mode === "best-effort";
+  const wait = error instanceof DeliveryResponseError && error.retryAfterMs !== void 0 ? error.retryAfterMs : Math.min(3e5, 1e3 * 2 ** Math.min(record.failures, 8));
+  return {
+    ...record,
+    failures: record.failures + 1,
+    totalAttempts: bestEffort ? current?.totalAttempts ?? record.totalAttempts ?? 0 : record.totalAttempts,
+    attempts: bestEffort ? current?.attempts ?? record.attempts ?? 0 : record.attempts,
+    state: !bestEffort && error instanceof DeliveryResponseError && !error.retryable ? "blocked" : "active",
+    nextAttemptMs: now * 1e3 + Math.min(36e5, wait),
+    lastError: "delivery-failed"
+  };
+}
 
 // src/runtime/sourceSigner.ts
-import { randomBytes as randomBytes5 } from "node:crypto";
+import { randomBytes as randomBytes7 } from "node:crypto";
 import {
-  NormalizedAddressZod as NormalizedAddressZod4,
-  WakeEnvelopeZod,
+  NormalizedAddressZod as NormalizedAddressZod7,
+  WakeEnvelopeZod as WakeEnvelopeZod3,
   WakeJwtSchema
 } from "@xyo-network/event-kit-schemas";
 import { PayloadBuilder as PayloadBuilder2 } from "@xyo-network/sdk";
 function createAccountSourceWakeSigner(options) {
-  const publisher = NormalizedAddressZod4.parse(options.publisher);
+  const publisher = NormalizedAddressZod7.parse(options.publisher);
   if (String(options.account.address).replace(/^0x/u, "").toLowerCase() !== publisher)
     throw new Error("Publisher signing account mismatch");
   return {
     async sign(input, audience) {
-      const event = WakeEnvelopeZod.parse(input);
+      const event = WakeEnvelopeZod3.parse(input);
       const eventHash = await PayloadBuilder2.dataHash(event);
       const now = options.nowSeconds?.() ?? Math.floor(Date.now() / 1e3);
       if (!Number.isSafeInteger(now) || now < 0)
         throw new Error("Publisher signing clock is invalid");
       const { token: jwt } = await options.account.signJwt({
         audience,
-        claims: { eventHash, jti: randomBytes5(16).toString("hex") },
+        claims: { eventHash, jti: randomBytes7(16).toString("hex") },
         now,
         schema: WakeJwtSchema,
         ttl: 60
@@ -2865,30 +4004,6 @@ function createAccountSourceWakeSigner(options) {
 function activationReady(status) {
   return (status?.keyLoaded ?? true) && (status?.pendingSubscriptions ?? 0) === 0;
 }
-function assertDeliveryState(record, subscription) {
-  if (!isDeepStrictEqual2(record.subscription, subscription))
-    throw new Error("Subscription revision changed without a new identity");
-  if (!Number.isSafeInteger(record.cursor) || record.cursor < subscription.fromPosition - 1 || [record.delivered, record.failures, record.nextAttemptMs].some((value) => !(Number.isSafeInteger(value) && value >= 0)) || !["active", "blocked", "cancelled"].includes(record.state))
-    throw new Error("Persisted publisher delivery state is invalid");
-  if (record.pending === void 0) return;
-  const pending = WakeEnvelopeZod2.parse(record.pending);
-  if (pending.fromPosition !== record.cursor + 1 || pending.toPosition - pending.fromPosition + 1 > subscription.maxPositionsPerWake || pending.authorizationChainId !== subscription.authorizationChainId || pending.deploymentId !== subscription.deploymentId || pending.queueId !== subscription.queueId || pending.filterHash !== subscription.filterHash || !isDeepStrictEqual2(pending.source, subscription.source))
-    throw new Error("Persisted publisher outbox binding is invalid");
-}
-function makeEvent(subscription, fromPosition, toPosition, now, wakeId = randomBytes6(16).toString("hex")) {
-  return WakeEnvelopeZod2.parse({
-    schema: WakeEnvelopeSchema,
-    authorizationChainId: subscription.authorizationChainId,
-    deploymentId: subscription.deploymentId,
-    filterHash: subscription.filterHash,
-    fromPosition,
-    issuedAt: now,
-    source: subscription.source,
-    toPosition,
-    wakeId,
-    ...subscription.queueId === void 0 ? {} : { queueId: subscription.queueId }
-  });
-}
 var PublisherRuntimeActor = class extends PeriodicActor {
   async runPass(context) {
     await this.params.tick(context.signal);
@@ -2897,26 +4012,30 @@ var PublisherRuntimeActor = class extends PeriodicActor {
 PublisherRuntimeActor = __decorateClass([
   creatable()
 ], PublisherRuntimeActor);
-var TimingZod = z3.object({
-  concurrency: z3.number().int().min(1).max(32).default(4),
-  intervalMs: z3.number().int().min(100).max(6e4).default(1e3),
-  maxSubscriptions: z3.number().int().min(1).max(1024).default(64),
-  requestTimeoutMs: z3.number().int().min(100).max(6e4).default(1e4)
+var TimingZod = z5.object({
+  concurrency: z5.number().int().min(1).max(32).default(4),
+  intervalMs: z5.number().int().min(100).max(6e4).default(1e3),
+  maxSubscriptions: z5.number().int().min(1).max(1024).default(64),
+  requestTimeoutMs: z5.number().int().min(100).max(6e4).default(1e4)
 });
-var DeliveryResponseError = class extends Error {
-  retryAfterMs;
-  status;
-  constructor(status, retryAfterMs) {
-    super("Publisher admission failed");
-    this.status = status;
-    this.retryAfterMs = retryAfterMs;
-  }
-  get retryable() {
-    return this.status === 408 || this.status === 429 || this.status >= 500;
-  }
-};
+function runtimeSettings(options) {
+  const deliveryMode = WakeDeliveryModeZod.parse(options.deliveryMode);
+  const bestEffort = options.bestEffort === void 0 ? void 0 : BestEffortDeliveryPolicyZod.parse(options.bestEffort);
+  if (deliveryMode === "best-effort" !== (bestEffort !== void 0)) throw new TypeError("Explicit delivery mode requires its exact policy");
+  return {
+    bestEffort,
+    deliveryMode,
+    deliveryNamespace: deliveryMode === "best-effort" ? "best-effort-deliveries" : "deliveries",
+    timing: TimingZod.parse(options)
+  };
+}
 async function createPersistentEventPublisherRuntime(options) {
-  const timing = TimingZod.parse(options);
+  const {
+    bestEffort,
+    deliveryMode,
+    deliveryNamespace,
+    timing
+  } = runtimeSettings(options);
   if (options.sources.length < 1 || options.sources.length > 16)
     throw new Error("Publisher requires between one and sixteen bounded sources");
   const clock = options.nowSeconds ?? (() => Math.floor(Date.now() / 1e3));
@@ -2928,7 +4047,12 @@ async function createPersistentEventPublisherRuntime(options) {
   const sourceReaders = new Map(options.sources.map((reader) => [publisherSourceKey(reader.source), reader]));
   if (sourceReaders.size !== options.sources.length)
     throw new Error("Duplicate publisher source identity");
+  const state = options.state;
+  const existingMode = state.get("metadata", "runtime-delivery-mode");
+  if (existingMode !== void 0 && existingMode !== deliveryMode) throw new Error("Publisher state delivery mode mismatch; preserve custody and use an explicitly qualified state binding");
+  state.set("metadata", "runtime-delivery-mode", deliveryMode);
   const abort = new AbortController();
+  const seenThisProcess = /* @__PURE__ */ new Set();
   let running = false;
   let ready = false;
   let clockHealthy = true;
@@ -2936,11 +4060,16 @@ async function createPersistentEventPublisherRuntime(options) {
   let lastError;
   let sourcesHealthy = false;
   let stop;
-  const state = options.state;
   const timed = (promise, signal) => boundedPublisherOperation(promise, signal, timing.requestTimeoutMs);
   function loadDelivery(subscription, now) {
+    if (subscription.deliveryMode !== deliveryMode || !isDeepStrictEqual4(subscription.bestEffort, bestEffort))
+      throw new Error("Subscription delivery mode or policy disagrees with runtime");
+    if (deliveryMode === "best-effort" && (subscription.maxPositionsPerWake !== 1 || subscription.serviceHash === void 0)) throw new Error("Best Effort requires point range");
+    if (options.serviceHash !== void 0 && subscription.serviceHash !== options.serviceHash)
+      throw new Error("Subscription does not match the configured exact service descriptor");
     const key = subscription.subscriptionHash;
-    let record = state.get("deliveries", key);
+    if (deliveryMode === "best-effort" && state.get(deliveryNamespace, key) === void 0 && state.entries(deliveryNamespace).length >= timing.maxSubscriptions) throw new Error("Best Effort state capacity exceeded; live records are not evicted");
+    let record = state.get(deliveryNamespace, key);
     if (record === void 0) {
       makeEvent(subscription, subscription.fromPosition, subscription.fromPosition, now, "0".repeat(32));
       if (!Number.isSafeInteger(subscription.maxPositionsPerWake) || subscription.maxPositionsPerWake < 1 || subscription.maxPositionsPerWake > 4096) {
@@ -2954,12 +4083,26 @@ async function createPersistentEventPublisherRuntime(options) {
         nextAttemptMs: 0,
         state: "active"
       };
-      state.set("deliveries", key, record);
+      state.set(deliveryNamespace, key, record);
     }
     assertDeliveryState(record, subscription);
     return record;
   }
   function prepareDelivery(record, now, heads) {
+    if (deliveryMode === "best-effort" && bestEffort !== void 0) {
+      const first = !seenThisProcess.has(record.subscription.subscriptionHash);
+      const head2 = heads.get(publisherSourceKey(record.subscription.source));
+      if (head2 !== void 0 && !(head2 instanceof Error) && head2.position >= record.subscription.fromPosition)
+        seenThisProcess.add(record.subscription.subscriptionHash);
+      return prepareBestEffortDelivery({
+        bestEffort,
+        first,
+        heads,
+        now,
+        record,
+        state
+      });
+    }
     if (record.pending !== void 0) return { ...record, pending: record.pending };
     const subscription = record.subscription;
     const head = heads.get(publisherSourceKey(subscription.source));
@@ -2971,43 +4114,74 @@ async function createPersistentEventPublisherRuntime(options) {
     state.transaction(() => {
       const logicalKey = JSON.stringify([subscription.subscriptionHash, pending.fromPosition, pending.toPosition]);
       if (!state.insert("delivery-events", logicalKey, pending)) throw new Error("Publisher logical range already exists outside its contiguous cursor");
-      state.set("deliveries", subscription.subscriptionHash, prepared);
+      state.set(deliveryNamespace, subscription.subscriptionHash, prepared);
     });
     return prepared;
   }
   async function stillActive(record, signal) {
     if (await timed(options.discovery.isActive(record.subscription, signal), signal)) return true;
-    state.set("deliveries", record.subscription.subscriptionHash, {
+    state.set(deliveryNamespace, record.subscription.subscriptionHash, {
       ...record,
       pending: void 0,
       state: "cancelled"
     });
     return false;
   }
+  function acknowledgeBestEffort(record, body, eventHash, signal, now) {
+    const { pending, subscription } = record;
+    const acknowledgment = BestEffortAdmissionAcknowledgmentZod.safeParse(body);
+    if (!acknowledgment.success || acknowledgment.data.eventHash !== eventHash || acknowledgment.data.wakeId !== pending.wakeId || acknowledgment.data.expiresAt !== pending.issuedAt + (bestEffort?.maxHintAgeSeconds ?? 0) + 60 || acknowledgment.data.acceptedAt < pending.issuedAt - 60 || acknowledgment.data.acceptedAt > now + 60)
+      throw new Error("Publisher did not receive a matching finite acknowledgment");
+    signal.throwIfAborted();
+    state.set(deliveryNamespace, subscription.subscriptionHash, {
+      subscription,
+      cursor: pending.toPosition,
+      delivered: record.delivered + 1,
+      failures: 0,
+      attempts: 0,
+      superseded: record.superseded ?? 0,
+      abandoned: record.abandoned ?? 0,
+      totalAttempts: (record.totalAttempts ?? 0) + 1,
+      lastNotifiedAt: now,
+      lastHintAt: pending.issuedAt,
+      lastHintTarget: pending.toPosition,
+      nextAttemptMs: 0,
+      state: "active"
+    });
+  }
   async function sendDelivery(record, signal, now) {
     const { pending, subscription } = record;
     signal.throwIfAborted();
     const signed = await signer.sign(pending, subscription.audience);
     signal.throwIfAborted();
-    const attempt = state.get("delivery-attempts", pending.wakeId)?.count ?? 0;
-    state.set("delivery-attempts", pending.wakeId, {
+    const attempt = deliveryMode === "best-effort" ? record.attempts ?? 0 : state.get("delivery-attempts", pending.wakeId)?.count ?? 0;
+    if (deliveryMode === "best-effort") state.set(deliveryNamespace, subscription.subscriptionHash, {
+      ...record,
+      attempts: attempt + 1,
+      totalAttempts: (record.totalAttempts ?? 0) + 1
+    });
+    else state.set("delivery-attempts", pending.wakeId, {
       count: attempt + 1,
       startedAt: now,
       status: "in-flight"
     });
     const response = await options.transport.post(subscription.endpoint, signed.event, signal, signed.jwt);
-    state.set("delivery-attempts", pending.wakeId, {
+    if (deliveryMode === "durable") state.set("delivery-attempts", pending.wakeId, {
       count: attempt + 1,
       startedAt: now,
       status: response.status
     });
     if (response.status !== 200 && response.status !== 202) throw new DeliveryResponseError(response.status, response.retryAfterMs);
-    const receipt = z3.object({ receiptId: z3.string().min(1), wakeId: z3.literal(pending.wakeId) }).safeParse(response.body);
+    if (deliveryMode === "best-effort") {
+      acknowledgeBestEffort(record, response.body, signed.eventHash, signal, now);
+      return;
+    }
+    const receipt = z5.object({ receiptId: z5.string().min(1), wakeId: z5.literal(pending.wakeId) }).safeParse(response.body);
     if (!receipt.success) throw new Error("Publisher admission did not return a matching durable receipt");
     signal.throwIfAborted();
     state.transaction(() => {
       state.set("delivery-receipts", pending.wakeId, { receiptId: receipt.data.receiptId, receivedAt: now });
-      state.set("deliveries", subscription.subscriptionHash, {
+      state.set(deliveryNamespace, subscription.subscriptionHash, {
         subscription,
         cursor: pending.toPosition,
         delivered: record.delivered + 1,
@@ -3019,7 +4193,7 @@ async function createPersistentEventPublisherRuntime(options) {
   }
   async function deliver(subscription, signal, now, heads) {
     let record = loadDelivery(subscription, now);
-    if (record.state !== "active" || record.nextAttemptMs > now * 1e3) return;
+    if (deliveryMode === "durable" && (record.state !== "active" || record.nextAttemptMs > now * 1e3)) return;
     try {
       if (!await stillActive(record, signal)) return;
       options.transport.assertAllowed(subscription.endpoint);
@@ -3027,17 +4201,16 @@ async function createPersistentEventPublisherRuntime(options) {
       const prepared = prepareDelivery(record, now, heads);
       if (prepared === void 0) return;
       record = prepared;
+      if (record.nextAttemptMs > now * 1e3) return;
       if (!await stillActive(record, signal)) return;
       await sendDelivery(prepared, signal, now);
     } catch (error) {
       if (signal.aborted) return;
-      state.set("deliveries", subscription.subscriptionHash, {
-        ...record,
-        failures: record.failures + 1,
-        state: error instanceof DeliveryResponseError && !error.retryable ? "blocked" : "active",
-        nextAttemptMs: now * 1e3 + Math.min(36e5, error instanceof DeliveryResponseError && error.retryAfterMs !== void 0 ? error.retryAfterMs : Math.min(3e5, 1e3 * 2 ** Math.min(record.failures, 8))),
-        lastError: "delivery-failed"
-      });
+      state.set(
+        deliveryNamespace,
+        subscription.subscriptionHash,
+        failedDelivery(record, state.get(deliveryNamespace, subscription.subscriptionHash), deliveryMode, error, now)
+      );
     }
   }
   async function readSources(signal) {
@@ -3067,13 +4240,13 @@ async function createPersistentEventPublisherRuntime(options) {
     if (subscriptions.length > timing.maxSubscriptions) throw new Error("Publisher subscription limit exceeded");
     const active = new Set(subscriptions.map((subscription) => subscription.subscriptionHash));
     if (active.size !== subscriptions.length) throw new Error("Duplicate subscription identity");
-    const unavailable = state.entries("deliveries").filter((item) => !active.has(item.key) && item.value.state !== "cancelled");
+    const unavailable = state.entries(deliveryNamespace).filter((item) => !active.has(item.key) && item.value.state !== "cancelled");
     let available = true;
     for (let offset = 0; offset < unavailable.length; offset += timing.concurrency) {
       signal.throwIfAborted();
       const results = await Promise.allSettled(unavailable.slice(offset, offset + timing.concurrency).map(async ({ key, value }) => {
         const stillAuthorized = await timed(options.discovery.isActive(value.subscription, signal), signal);
-        if (!stillAuthorized) state.set("deliveries", key, {
+        if (!stillAuthorized) state.set(deliveryNamespace, key, {
           ...value,
           pending: void 0,
           state: "cancelled"
@@ -3085,8 +4258,8 @@ async function createPersistentEventPublisherRuntime(options) {
     return available;
   }
   async function tick(actorSignal) {
-    const scope = publisherAbortScope([abort.signal, actorSignal]);
-    const signal = scope.signal;
+    const scope2 = publisherAbortScope([abort.signal, actorSignal]);
+    const signal = scope2.signal;
     try {
       signal.throwIfAborted();
       const now = clock();
@@ -3117,7 +4290,7 @@ async function createPersistentEventPublisherRuntime(options) {
       if (!signal.aborted)
         throw error;
     } finally {
-      scope.dispose();
+      scope2.dispose();
     }
   }
   const actor = await PublisherRuntimeActor.create({
@@ -3167,9 +4340,14 @@ async function createPersistentEventPublisherRuntime(options) {
         throw new AggregateError(failures, "Publisher runtime shutdown failed");
     })(),
     status() {
-      const deliveries = state.entries("deliveries").map((item) => item.value);
+      const deliveries = state.entries(deliveryNamespace).map((item) => item.value);
       return {
         running,
+        deliveryMode,
+        ...bestEffort === void 0 ? {} : { bestEffort: Object.freeze({ ...bestEffort }) },
+        superseded: deliveries.reduce((sum, item) => sum + (item.superseded ?? 0), 0),
+        abandoned: deliveries.reduce((sum, item) => sum + (item.abandoned ?? 0), 0),
+        totalAttempts: deliveries.reduce((sum, item) => sum + (item.totalAttempts ?? 0), 0),
         ready: running && ready,
         clockHealthy,
         degraded: !ready || deliveries.some((item) => item.state !== "cancelled" && item.failures > 0),
@@ -3181,10 +4359,15 @@ async function createPersistentEventPublisherRuntime(options) {
         passes,
         ...lastError === void 0 ? {} : { lastError },
         ...options.discovery.status === void 0 ? {} : { handshake: options.discovery.status() },
-        sources: state.entries("source-heads").map((item) => ({ id: item.key, ...item.value })),
-        subscriptions: state.entries("deliveries").map((item) => ({
+        sources: state.entries("source-heads").filter((item) => sourceReaders.has(item.key)).map((item) => ({ id: item.key, ...item.value })),
+        subscriptions: state.entries(deliveryNamespace).map((item) => ({
           id: item.key,
           cursor: item.value.cursor,
+          ...deliveryMode === "best-effort" ? {
+            ...item.value.cursor < item.value.subscription.fromPosition ? {} : { lastAdmissionTarget: item.value.cursor },
+            attempts: item.value.attempts ?? 0,
+            lastHintAt: item.value.lastHintAt
+          } : {},
           state: item.value.state,
           pending: item.value.pending !== void 0,
           failures: item.value.failures
@@ -3275,40 +4458,41 @@ async function openPublisherDataLake(options) {
 }
 
 // src/runtime/sqliteHandshakeStores.ts
-import { isDeepStrictEqual as isDeepStrictEqual3 } from "node:util";
+import { isDeepStrictEqual as isDeepStrictEqual5 } from "node:util";
 import { endpointChallengeHash as endpointChallengeHash2 } from "@xyo-network/event-kit-protocol";
 import {
   Base64Url32BytesZod as Base64Url32BytesZod3,
   EndpointChallengeZod as EndpointChallengeZod3,
   HandshakeIdZod as HandshakeIdZod4,
-  HashZod as HashZod5,
-  NormalizedAddressZod as NormalizedAddressZod5
+  HashZod as HashZod9,
+  NormalizedAddressZod as NormalizedAddressZod8
 } from "@xyo-network/event-kit-schemas";
-import { z as z4 } from "zod";
-var KeyZod = z4.strictObject({
-  encryptionKey: HashZod5,
+import { z as z6 } from "zod";
+var KeyZod = z6.strictObject({
+  encryptionKey: HashZod9,
   keyId: HandshakeIdZod4,
   privateKey: Base64Url32BytesZod3,
-  publisher: NormalizedAddressZod5
+  publisher: NormalizedAddressZod8
 });
 var phases = ["signed", "content-written", "content-verified", "broadcast", "included", "finalized"];
 function requireTime2(value) {
   if (!Number.isSafeInteger(value) || value < 0) throw new Error("Publisher clock is invalid");
 }
 function samePublicationIntent(left, right) {
-  return left.chainId === right.chainId && left.source === right.source && left.operationId === right.operationId && isDeepStrictEqual3(left.eventHashes, right.eventHashes) && isDeepStrictEqual3(left.attachmentHashes, right.attachmentHashes);
+  return left.chainId === right.chainId && left.source === right.source && left.operationId === right.operationId && isDeepStrictEqual5(left.eventHashes, right.eventHashes) && isDeepStrictEqual5(left.attachmentHashes, right.attachmentHashes);
 }
 function publicationKey(intent) {
-  if (!/^[0-9a-f]{40}$/u.test(intent.chainId) || !/^[0-9a-f]{40}$/u.test(intent.source) || intent.operationId.length === 0 || intent.operationId.length > 256 || [...intent.eventHashes, ...intent.attachmentHashes].some((hash) => !HashZod5.safeParse(hash).success)) {
+  if (!/^[0-9a-f]{40}$/u.test(intent.chainId) || !/^[0-9a-f]{40}$/u.test(intent.source) || intent.operationId.length === 0 || intent.operationId.length > 256 || [...intent.eventHashes, ...intent.attachmentHashes].some((hash) => !HashZod9.safeParse(hash).success)) {
     throw new Error("Invalid publication intent");
   }
   return JSON.stringify([intent.chainId, intent.source, intent.operationId]);
 }
-function createSqlitePublisherHandshakeStores(state) {
+function createSqlitePublisherHandshakeStores(state, options = {}) {
+  const replayKey = options.replayNamespace === void 0 ? "checkpoint" : `checkpoint:${z6.string().min(1).max(128).regex(/^[A-Za-z0-9_-]+$/u).parse(options.replayNamespace)}`;
   const replay = {
-    load: async () => state.get("replay", "checkpoint"),
+    load: async () => state.get("replay", replayKey),
     async save(checkpoint) {
-      state.set("replay", "checkpoint", checkpoint);
+      state.set("replay", replayKey, checkpoint);
     }
   };
   const intents = {
@@ -3332,11 +4516,11 @@ function createSqlitePublisherHandshakeStores(state) {
   };
   const keys = {
     async getPrivateKey(input) {
-      const key = `${NormalizedAddressZod5.parse(input.publisher)}:${HandshakeIdZod4.parse(input.keyId)}`;
+      const key = `${NormalizedAddressZod8.parse(input.publisher)}:${HandshakeIdZod4.parse(input.keyId)}`;
       const raw = state.get("encryption-keys", key);
       if (raw === void 0) return;
       const record = KeyZod.parse(raw);
-      if (record.encryptionKey !== HashZod5.parse(input.encryptionKey)) throw new Error("Encryption key identity mismatch");
+      if (record.encryptionKey !== HashZod9.parse(input.encryptionKey)) throw new Error("Encryption key identity mismatch");
       const { publisher: _publisher, ...privateKey } = record;
       return privateKey;
     },
@@ -3346,7 +4530,7 @@ function createSqlitePublisherHandshakeStores(state) {
         const key = `${record.publisher}:${record.keyId}`;
         const prior = state.get("encryption-keys", key);
         if (prior !== void 0) {
-          if (!isDeepStrictEqual3(prior, record)) throw new Error("Encryption key collision");
+          if (!isDeepStrictEqual5(prior, record)) throw new Error("Encryption key collision");
           return "duplicate";
         }
         state.set("encryption-keys", key, record);
@@ -3354,19 +4538,19 @@ function createSqlitePublisherHandshakeStores(state) {
       });
     }
   };
-  const current = (hash) => state.get("challenges", HashZod5.parse(hash));
+  const current = (hash) => state.get("challenges", HashZod9.parse(hash));
   const live = (record, now) => record.challenge.issuedAt <= now && now < record.challenge.expiresAt;
   const challenges = {
     get: async (hash) => current(hash),
     async issue(input) {
       const challenge = EndpointChallengeZod3.parse(input.challenge);
-      const hash = HashZod5.parse(input.challengeHash);
+      const hash = HashZod9.parse(input.challengeHash);
       if (await endpointChallengeHash2(challenge) !== hash) return { kind: "collision" };
       return state.transaction(() => {
         const priorNonce = state.get("challenge-nonces", challenge.nonce);
         if (priorNonce !== void 0 && priorNonce !== hash) return { kind: "collision" };
         const prior = current(hash);
-        if (prior !== void 0) return isDeepStrictEqual3(prior.challenge, challenge) ? { kind: "duplicate", record: prior } : { kind: "collision" };
+        if (prior !== void 0) return isDeepStrictEqual5(prior.challenge, challenge) ? { kind: "duplicate", record: prior } : { kind: "collision" };
         const record = {
           challenge,
           challengeHash: hash,
@@ -3392,7 +4576,7 @@ function createSqlitePublisherHandshakeStores(state) {
     },
     async completeVerified(input) {
       requireTime2(input.nowSeconds);
-      const responseHash = HashZod5.parse(input.responseHash);
+      const responseHash = HashZod9.parse(input.responseHash);
       return state.transaction(() => {
         const record = current(input.challengeHash);
         if (record === void 0) return { kind: "missing" };
@@ -3419,7 +4603,7 @@ function createSqlitePublisherHandshakeStores(state) {
       for (const phase of phases) {
         const record = state.get(`publication:${phase}`, key);
         if (record === void 0) continue;
-        if (record.phase !== phase || !samePublicationIntent(record, intent) || !isDeepStrictEqual3(record.evidence, signed.evidence)) {
+        if (record.phase !== phase || !samePublicationIntent(record, intent) || !isDeepStrictEqual5(record.evidence, signed.evidence)) {
           throw new Error("Publication evidence collision");
         }
         latest = record;
@@ -3428,17 +4612,17 @@ function createSqlitePublisherHandshakeStores(state) {
     },
     async save(record) {
       const key = publicationKey(record);
-      HashZod5.parse(record.evidence.transactionHash);
+      HashZod9.parse(record.evidence.transactionHash);
       if (!phases.includes(record.phase)) throw new Error("Unknown publication phase");
       state.transaction(() => {
         const signed = state.get("publication:signed", key);
         if (signed === void 0 && record.phase !== "signed") throw new Error("Publication must bind signed evidence first");
-        if (signed !== void 0 && (!samePublicationIntent(signed, record) || !isDeepStrictEqual3(signed.evidence, record.evidence))) {
+        if (signed !== void 0 && (!samePublicationIntent(signed, record) || !isDeepStrictEqual5(signed.evidence, record.evidence))) {
           throw new Error("Publication intent or evidence collision");
         }
         const namespace = `publication:${record.phase}`;
         const prior = state.get(namespace, key);
-        if (prior !== void 0 && !isDeepStrictEqual3(prior, record)) throw new Error("Publication phase collision");
+        if (prior !== void 0 && !isDeepStrictEqual5(prior, record)) throw new Error("Publication phase collision");
         if (prior === void 0) state.set(namespace, key, record);
       });
     }
@@ -3453,15 +4637,15 @@ function createSqlitePublisherHandshakeStores(state) {
 }
 
 // src/runtime/sqlitePublisherState.ts
-import { randomBytes as randomBytes7 } from "node:crypto";
-import { constants } from "node:fs";
+import { randomBytes as randomBytes8 } from "node:crypto";
+import { constants as constants3 } from "node:fs";
 import {
-  lstat,
-  mkdir as mkdir5,
-  open as open5
+  lstat as lstat5,
+  mkdir as mkdir4,
+  open as open6
 } from "node:fs/promises";
 import { hostname } from "node:os";
-import PATH12 from "node:path";
+import PATH16 from "node:path";
 function decode(value) {
   return JSON.parse(value, (_key, candidate) => {
     return typeof candidate === "object" && candidate !== null && Object.keys(candidate).length === 1 && "$eventKitBigInt" in candidate && typeof candidate.$eventKitBigInt === "string" && /^(?:0|[1-9][0-9]*)$/u.test(candidate.$eventKitBigInt) ? BigInt(candidate.$eventKitBigInt) : candidate;
@@ -3482,13 +4666,13 @@ function processExists(pid) {
 async function openSqlitePublisherState(options) {
   if (options.path === ":memory:" || options.identity.length === 0)
     throw new Error("Persistent publisher needs a file and an identity");
-  const path = PATH12.resolve(options.path);
-  const directory = PATH12.dirname(path);
-  await mkdir5(directory, { recursive: true, mode: 448 });
-  const metadata = await lstat(directory);
+  const path = PATH16.resolve(options.path);
+  const directory = PATH16.dirname(path);
+  await mkdir4(directory, { recursive: true, mode: 448 });
+  const metadata = await lstat5(directory);
   if (!metadata.isDirectory() || (metadata.mode & 63) !== 0)
     throw new Error("Publisher state directory must be a real directory with 0700 permissions");
-  const file = await open5(path, constants.O_CREAT | constants.O_RDWR | constants.O_NOFOLLOW, 384);
+  const file = await open6(path, constants3.O_CREAT | constants3.O_RDWR | constants3.O_NOFOLLOW, 384);
   try {
     const metadata2 = await file.stat();
     if (!metadata2.isFile() || (metadata2.mode & 63) !== 0)
@@ -3497,9 +4681,9 @@ async function openSqlitePublisherState(options) {
   } finally {
     await file.close();
   }
-  const { DatabaseSync: DatabaseSync2 } = await import("node:sqlite");
-  const database = new DatabaseSync2(path);
-  const token = randomBytes7(16).toString("hex");
+  const { DatabaseSync: DatabaseSync3 } = await import("node:sqlite");
+  const database = new DatabaseSync3(path);
+  const token = randomBytes8(16).toString("hex");
   let closed = false;
   let inTransaction = false;
   const transaction = (work) => {
@@ -3590,67 +4774,362 @@ async function openSqlitePublisherState(options) {
   };
 }
 
-// src/sqliteWakeQueue.ts
-import { mkdir as mkdir6 } from "node:fs/promises";
-import PATH13 from "node:path";
-import { DatabaseSync } from "node:sqlite";
-async function createSqliteWakeQueue(options) {
-  const inMemory = options.path === ":memory:";
-  const file = inMemory ? options.path : PATH13.resolve(options.path);
-  if (!inMemory) await mkdir6(PATH13.dirname(file), { recursive: true });
-  const database = new DatabaseSync(file);
-  database.exec(`
-    PRAGMA journal_mode = WAL;
-    PRAGMA synchronous = FULL;
-    CREATE TABLE IF NOT EXISTS wake_queue (
-      id INTEGER PRIMARY KEY AUTOINCREMENT,
-      body TEXT NOT NULL,
-      state TEXT NOT NULL DEFAULT 'pending'
-    );
-    CREATE INDEX IF NOT EXISTS wake_queue_state ON wake_queue (state, id);
-  `);
-  const insert = database.prepare("INSERT INTO wake_queue (body) VALUES (?)");
-  const nextPending = database.prepare(
-    "SELECT id, body FROM wake_queue WHERE state = 'pending' ORDER BY id LIMIT 1"
-  );
-  const lease = database.prepare(
-    "UPDATE wake_queue SET state = 'inflight' WHERE id = ? AND state = 'pending'"
-  );
-  const remove = database.prepare("DELETE FROM wake_queue WHERE id = ?");
-  const restore = database.prepare(
-    "UPDATE wake_queue SET state = 'pending' WHERE id = ? AND state = 'inflight'"
-  );
-  const countPending = database.prepare(
-    "SELECT COUNT(*) AS total FROM wake_queue WHERE state = 'pending'"
-  );
-  const recoverAll = database.prepare(
-    "UPDATE wake_queue SET state = 'pending' WHERE state = 'inflight'"
-  );
+// src/sqliteBestEffortInbox.ts
+import { createHash as createHash5, randomBytes as randomBytes9 } from "node:crypto";
+import {
+  canonicalJson as canonicalJson4,
+  commitBestEffortSecurity,
+  createBestEffortSecurityState,
+  parseAdmittedWake as parseAdmittedWake4,
+  parseBestEffortSecurityState,
+  wakeSourceHash
+} from "@xyo-network/event-kit-protocol";
+import {
+  ChainIdZod as ChainIdZod3,
+  DeploymentIdZod,
+  HashZod as HashZod10,
+  NonnegativeJsonSafeIntegerZod as NonnegativeJsonSafeIntegerZod5,
+  NormalizedAddressZod as NormalizedAddressZod9,
+  WakeJwtAudienceZod as WakeJwtAudienceZod4,
+  WakeSourceZod as WakeSourceZod3
+} from "@xyo-network/event-kit-schemas";
+import { z as z7 } from "zod";
+var BindingZod = z7.strictObject({
+  audience: WakeJwtAudienceZod4,
+  authorizationChainId: ChainIdZod3,
+  consumerId: z7.string().min(1).max(255),
+  controller: NormalizedAddressZod9,
+  deploymentId: DeploymentIdZod,
+  filterHash: HashZod10,
+  publisher: NormalizedAddressZod9,
+  queueId: z7.string().min(1).max(255).optional(),
+  source: WakeSourceZod3,
+  subscriptionHash: HashZod10
+});
+var SnapshotPositionZod = z7.strictObject({
+  position: NonnegativeJsonSafeIntegerZod5,
+  hash: HashZod10.optional()
+});
+var TargetZod = z7.strictObject({
+  binding: BindingZod,
+  completedGeneration: NonnegativeJsonSafeIntegerZod5,
+  generation: NonnegativeJsonSafeIntegerZod5,
+  id: HashZod10,
+  requestedPosition: NonnegativeJsonSafeIntegerZod5,
+  fence: NonnegativeJsonSafeIntegerZod5,
+  previousSnapshot: SnapshotPositionZod.optional(),
+  lease: z7.strictObject({
+    expiresAt: NonnegativeJsonSafeIntegerZod5,
+    token: z7.string().regex(/^[0-9a-f]{32}$/u)
+  }).optional()
+}).refine(
+  (target) => target.generation > 0 && target.completedGeneration <= target.generation && (target.lease === void 0 || target.fence > 0 && target.generation > target.completedGeneration) && (target.previousSnapshot === void 0 || target.binding.source.kind === "utc-interval" || target.previousSnapshot.hash !== void 0),
+  "Invalid Best Effort dirty generation"
+);
+var CatalogZod = z7.strictObject({
+  id: HashZod10,
+  binding: z7.string(),
+  target_hash: HashZod10,
+  fence: NonnegativeJsonSafeIntegerZod5,
+  generation: NonnegativeJsonSafeIntegerZod5
+}).refine((record) => record.generation > 0, "Invalid Best Effort catalog generation");
+function bindingId(binding) {
+  return createHash5("sha256").update(canonicalJson4(binding)).digest("hex");
+}
+function targetHash(body) {
+  return createHash5("sha256").update(body).digest("hex");
+}
+function parseCatalog(value) {
+  const record = CatalogZod.parse(value);
+  const binding = BindingZod.parse(JSON.parse(record.binding));
+  if (record.id !== bindingId(binding) || record.binding !== canonicalJson4(binding))
+    throw new TypeError("Persisted Best Effort catalog changed exact binding");
+  return record;
+}
+function parseTarget(body, expectedId) {
+  if (typeof body !== "string") throw new TypeError("Malformed persisted Best Effort target");
+  const parsed = TargetZod.parse(JSON.parse(body));
+  if (parsed.id !== expectedId || bindingId(parsed.binding) !== expectedId)
+    throw new TypeError("Persisted Best Effort target changed exact scope");
+  return parsed;
+}
+function publicTarget(target) {
   return {
-    async append(wake) {
-      insert.run(JSON.stringify(wake));
-    },
-    async claim() {
-      for (; ; ) {
-        const row = nextPending.get();
-        if (row === void 0) return void 0;
-        if (lease.run(row.id).changes !== 1) continue;
+    binding: target.binding,
+    completedGeneration: target.completedGeneration,
+    generation: target.generation,
+    id: target.id,
+    requestedPosition: target.requestedPosition
+  };
+}
+function increment(value) {
+  if (!Number.isSafeInteger(value + 1)) throw new RangeError("Best Effort fence/generation exhausted");
+  return value + 1;
+}
+async function createSqliteBestEffortInbox(options) {
+  const consumerId = z7.string().min(1).max(255).parse(options.consumerId);
+  const maxTargets = options.maxTargets ?? 1024;
+  if (!Number.isSafeInteger(options.maxSecurityRecords) || options.maxSecurityRecords < 1 || options.maxSecurityRecords > 65536)
+    throw new TypeError("Invalid finite Best Effort security capacity");
+  if (!Number.isSafeInteger(maxTargets) || maxTargets < 1 || maxTargets > 65536)
+    throw new TypeError("Invalid finite Best Effort target capacity");
+  const nowSeconds = options.nowSeconds ?? (() => Math.floor(Date.now() / 1e3));
+  const connection = openPrivateSqlite({ path: options.path, format: "event-kit-best-effort-inbox" });
+  const { database } = connection;
+  const transaction = (work) => connection.transaction(work);
+  try {
+    const settings = canonicalJson4({
+      consumerId,
+      maxSecurityRecords: options.maxSecurityRecords,
+      maxTargets
+    });
+    transaction(() => {
+      const marker = database.prepare("SELECT initialized FROM eventkit_store WHERE id = 1").get();
+      if (marker?.initialized !== 0 && marker?.initialized !== 1)
+        throw new TypeError("Invalid Best Effort store initialization authority");
+      const tables = database.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%'").all();
+      const names = new Set(tables.map((row) => row.name));
+      if (marker.initialized === 1) {
+        if (["best_effort_security", "best_effort_targets", "best_effort_settings", "best_effort_catalog"].some((name) => !names.has(name)))
+          throw new TypeError("Initialized Best Effort store lost authoritative tables; restore its custody before reopening");
+        const previous = database.prepare("SELECT body FROM best_effort_settings WHERE id = 1").get();
+        if (previous === void 0) throw new TypeError("Missing immutable Best Effort store settings");
+        if (previous.body !== settings) throw new TypeError("Best Effort store consumer or capacity binding changed");
+        return;
+      }
+      if (tables.some((row) => row.name !== "eventkit_store"))
+        throw new TypeError("Uninitialized Best Effort bootstrap contains unexpected custody");
+      database.exec(`
+        CREATE TABLE best_effort_security (id INTEGER PRIMARY KEY CHECK (id = 1), body TEXT NOT NULL);
+        CREATE TABLE best_effort_targets (id TEXT PRIMARY KEY, body TEXT NOT NULL);
+        CREATE TABLE best_effort_settings (id INTEGER PRIMARY KEY CHECK (id = 1), body TEXT NOT NULL, catalog_count INTEGER NOT NULL);
+        CREATE TABLE best_effort_catalog (id TEXT PRIMARY KEY, binding TEXT NOT NULL, target_hash TEXT NOT NULL, fence INTEGER NOT NULL, generation INTEGER NOT NULL);
+      `);
+      database.prepare("INSERT INTO best_effort_settings (id, body, catalog_count) VALUES (1, ?, 0)").run(settings);
+      database.prepare("INSERT INTO best_effort_security (id, body) VALUES (1, ?)").run(JSON.stringify(createBestEffortSecurityState()));
+      database.prepare("UPDATE eventkit_store SET initialized = 1 WHERE id = 1").run();
+    });
+    const readSecurity = () => {
+      const row = database.prepare("SELECT body FROM best_effort_security WHERE id = 1").get();
+      if (typeof row?.body !== "string") throw new TypeError("Missing persisted Best Effort security state");
+      const parsed = parseBestEffortSecurityState(JSON.parse(row.body));
+      if (parsed.jwtRecords.length > options.maxSecurityRecords || parsed.wakeRecords.length > options.maxSecurityRecords)
+        throw new TypeError("Persisted Best Effort security exceeds its configured bound");
+      return parsed;
+    };
+    const readCatalog = (id) => {
+      const row = database.prepare("SELECT id, binding, target_hash, fence, generation FROM best_effort_catalog WHERE id = ?").get(id);
+      return row === void 0 ? void 0 : parseCatalog(row);
+    };
+    const verifiedTarget = (body, catalog) => {
+      const target = parseTarget(body, catalog.id);
+      if (target.binding.consumerId !== consumerId) throw new TypeError("Persisted Best Effort target changed consumer");
+      if (typeof body !== "string" || catalog.target_hash !== targetHash(body) || catalog.binding !== canonicalJson4(target.binding) || catalog.fence !== target.fence || catalog.generation !== target.generation)
+        throw new TypeError("Persisted Best Effort target differs from its permanent catalog authority");
+      return target;
+    };
+    const readTargets = () => {
+      const setting = database.prepare("SELECT catalog_count FROM best_effort_settings WHERE id = 1").get();
+      const expectedCount = NonnegativeJsonSafeIntegerZod5.parse(setting?.catalog_count);
+      if (expectedCount > maxTargets) throw new TypeError("Persisted Best Effort catalog capacity exceeded");
+      const catalogs = database.prepare("SELECT id, binding, target_hash, fence, generation FROM best_effort_catalog ORDER BY id").all().map(parseCatalog);
+      const rows = database.prepare("SELECT id, body FROM best_effort_targets ORDER BY id").all();
+      if (catalogs.length !== expectedCount || rows.length !== expectedCount)
+        throw new TypeError("Persisted Best Effort binding catalog lost authoritative target custody");
+      const byId = new Map(catalogs.map((catalog) => [catalog.id, catalog]));
+      return rows.map((row) => {
+        if (typeof row.id !== "string") throw new TypeError("Malformed persisted Best Effort target identity");
+        const catalog = byId.get(row.id);
+        if (catalog === void 0) throw new TypeError("Persisted Best Effort target lost permanent binding custody");
+        return verifiedTarget(row.body, catalog);
+      });
+    };
+    const readTarget = (id) => {
+      const row = database.prepare("SELECT body FROM best_effort_targets WHERE id = ?").get(id);
+      const catalog = readCatalog(id);
+      if (row === void 0 && catalog === void 0) return;
+      if (row === void 0 || catalog === void 0)
+        throw new TypeError("Persisted Best Effort binding lost its authoritative target/catalog custody");
+      return verifiedTarget(row.body, catalog);
+    };
+    const saveTarget = (target) => {
+      const catalog = readCatalog(target.id);
+      const body = JSON.stringify(target);
+      const binding = canonicalJson4(target.binding);
+      if (catalog === void 0) {
+        if (database.prepare("SELECT id FROM best_effort_targets WHERE id = ?").get(target.id) !== void 0)
+          throw new TypeError("Existing Best Effort target lost its permanent binding catalog");
+        database.prepare("INSERT INTO best_effort_catalog (id, binding, target_hash, fence, generation) VALUES (?, ?, ?, ?, ?)").run(target.id, binding, targetHash(body), target.fence, target.generation);
+        database.prepare("UPDATE best_effort_settings SET catalog_count = catalog_count + 1 WHERE id = 1").run();
+      } else {
+        if (catalog.binding !== binding || target.fence < catalog.fence || target.generation < catalog.generation)
+          throw new TypeError("Best Effort target mutation would regress permanent binding authority");
+        database.prepare("UPDATE best_effort_catalog SET target_hash = ?, fence = ?, generation = ? WHERE id = ?").run(targetHash(body), target.fence, target.generation, target.id);
+      }
+      database.prepare("INSERT INTO best_effort_targets (id, body) VALUES (?, ?) ON CONFLICT(id) DO UPDATE SET body = excluded.body").run(target.id, body);
+    };
+    transaction(() => {
+      const security = readSecurity();
+      const targets = readTargets();
+      if (security.jwtRecords.length > options.maxSecurityRecords || security.wakeRecords.length > options.maxSecurityRecords || targets.length > maxTargets || targets.some((target) => target.binding.consumerId !== consumerId))
+        throw new TypeError("Persisted Best Effort state exceeds its exact bound");
+    });
+    async function requestWork(target) {
+      if (target.generation === target.completedGeneration || options.requestWork === void 0) return false;
+      try {
+        await options.requestWork(publicTarget(target));
+        return true;
+      } catch {
+        return false;
+      }
+    }
+    const currentTarget = (captured) => {
+      const current = readTarget(captured.id);
+      const now = NonnegativeJsonSafeIntegerZod5.parse(nowSeconds());
+      return current?.lease?.token === captured.lease?.token && current?.fence === captured.fence && current?.generation === captured.generation && current.lease !== void 0 && current.lease.expiresAt > now ? current : void 0;
+    };
+    return {
+      async commitAuthorized(input) {
+        input = structuredClone(input);
+        const wake = await parseAdmittedWake4(input.wake);
+        const grant = input.grant.grant;
+        if (grant.authorizationKind !== "activated-subscription" || grant.target !== wake.publisher || grant.authorizationChainId !== wake.event.authorizationChainId || grant.deploymentId !== wake.deploymentId || grant.filterHash !== wake.event.filterHash || grant.queueId !== wake.queueId || grant.sourceHash !== await wakeSourceHash(wake.event.source))
+          throw new TypeError("Best Effort grant does not match its exact admitted profile");
+        const binding = BindingZod.parse({
+          consumerId,
+          audience: wake.audience,
+          authorizationChainId: wake.event.authorizationChainId,
+          controller: grant.controller,
+          deploymentId: wake.deploymentId,
+          filterHash: wake.event.filterHash,
+          publisher: wake.publisher,
+          source: wake.event.source,
+          subscriptionHash: grant.subscriptionHash,
+          ...wake.queueId === void 0 ? {} : { queueId: wake.queueId }
+        });
+        const id = bindingId(binding);
+        const committed = transaction(() => {
+          const authority = { security: readSecurity(), targets: readTargets() };
+          const next = commitBestEffortSecurity(authority.security, { ...input, wake }, options.maxSecurityRecords);
+          if (next.result.kind !== "accepted" && next.result.kind !== "duplicate") return { result: next.result };
+          const previous = authority.targets.find((target2) => target2.id === id);
+          if (previous === void 0 && next.result.kind === "duplicate")
+            throw new TypeError("Persisted duplicate lost its authoritative Best Effort target");
+          if (previous === void 0 && authority.targets.length >= maxTargets)
+            return { result: { kind: "capacity-exceeded" } };
+          const target = previous === void 0 ? {
+            binding,
+            id,
+            completedGeneration: 0,
+            generation: 1,
+            fence: 0,
+            requestedPosition: wake.toPosition
+          } : next.result.kind === "duplicate" ? previous : {
+            ...previous,
+            generation: increment(previous.generation),
+            requestedPosition: Math.max(previous.requestedPosition, wake.toPosition)
+          };
+          database.prepare("UPDATE best_effort_security SET body = ? WHERE id = 1").run(JSON.stringify(next.state));
+          saveTarget(target);
+          return { result: next.result, target };
+        });
+        if (committed.target !== void 0) await requestWork(committed.target);
+        return committed.result;
+      },
+      dirtyTargets: async () => transaction(() => readTargets().filter((target) => target.generation > target.completedGeneration).map(publicTarget)),
+      async repairDirty() {
+        let failed = 0;
+        let scheduled = 0;
+        const targets = transaction(() => readTargets());
+        for (const target of targets) {
+          if (options.requestWork === void 0 || target.generation === target.completedGeneration) continue;
+          if (await requestWork(target)) scheduled += 1;
+          else failed += 1;
+        }
+        return { failed, scheduled };
+      },
+      async recoverExpired(now) {
+        NonnegativeJsonSafeIntegerZod5.parse(now);
+        return transaction(() => {
+          let recovered = 0;
+          for (const target of readTargets()) {
+            if (target.lease === void 0 || target.lease.expiresAt > now) continue;
+            saveTarget({ ...target, lease: void 0 });
+            recovered += 1;
+          }
+          return recovered;
+        });
+      },
+      async claim(input) {
+        NonnegativeJsonSafeIntegerZod5.parse(input.nowSeconds);
+        if (!Number.isSafeInteger(input.leaseSeconds) || input.leaseSeconds < 1 || !Number.isSafeInteger(input.nowSeconds + input.leaseSeconds))
+          throw new TypeError("Invalid Best Effort worker lease lifetime");
+        const captured = transaction(() => {
+          const target = readTargets().find((item) => item.generation > item.completedGeneration && item.lease === void 0);
+          if (target === void 0) return;
+          const claimed = {
+            ...target,
+            fence: increment(target.fence),
+            lease: { token: randomBytes9(16).toString("hex"), expiresAt: input.nowSeconds + input.leaseSeconds }
+          };
+          saveTarget(claimed);
+          return claimed;
+        });
+        if (captured?.lease === void 0) return void 0;
         return {
-          wake: JSON.parse(row.body),
-          async ack() {
-            remove.run(row.id);
+          ...publicTarget(captured),
+          fence: captured.fence,
+          leaseToken: captured.lease.token,
+          ...captured.previousSnapshot === void 0 ? {} : { previousSnapshot: captured.previousSnapshot },
+          isCurrent: async () => transaction(() => currentTarget(captured) !== void 0),
+          async complete(snapshot) {
+            const position = SnapshotPositionZod.parse({ position: snapshot.position, ...snapshot.hash === void 0 ? {} : { hash: snapshot.hash } });
+            return transaction(() => {
+              const current = currentTarget(captured);
+              if (current === void 0) return false;
+              if (current.binding.source.kind !== "utc-interval" && position.hash === void 0)
+                throw new TypeError("Finalized snapshot completion requires its verified hash");
+              const previous = current.previousSnapshot;
+              if (previous !== void 0 && (position.position < previous.position || position.position === previous.position && position.hash !== previous.hash))
+                throw new TypeError("Best Effort completion regressed its committed snapshot");
+              saveTarget({
+                ...current,
+                completedGeneration: current.generation,
+                previousSnapshot: position,
+                lease: void 0
+              });
+              return true;
+            });
           },
           async release() {
-            restore.run(row.id);
+            transaction(() => {
+              const current = readTarget(captured.id);
+              if (current?.lease?.token === captured.lease?.token && current?.fence === captured.fence)
+                saveTarget({ ...current, lease: void 0 });
+            });
           }
         };
-      }
-    },
-    close() {
-      database.close();
-    },
-    pendingCount: async () => Number(countPending.get().total),
-    recoverInflight: async () => Number(recoverAll.run().changes)
+      },
+      close: () => connection.close()
+    };
+  } catch (error) {
+    connection.close();
+    throw error;
+  }
+}
+
+// src/sqliteWakeQueue.ts
+async function createSqliteWakeQueue(options) {
+  const authority = openReceiverAuthority(options.path);
+  return { ...authority.queue, close: authority.close };
+}
+async function createSqliteWakeReceiver(options) {
+  const authority = openReceiverAuthority(options.path);
+  return {
+    queue: authority.queue,
+    inbox: authority.inbox,
+    close: authority.close,
+    pruneExpiredTokens: async (nowSeconds) => authority.pruneExpiredTokens(nowSeconds)
   };
 }
 export {
@@ -3661,6 +5140,7 @@ export {
   assertSameIntentBinding,
   boundedPublisherOperation,
   createAccountSourceWakeSigner,
+  createBestEffortSnapshotWorker,
   createBoundedPublisherEthersTransport,
   createBoundedPublisherFetch,
   createEthereumFinalizedPublisherSource,
@@ -3679,8 +5159,10 @@ export {
   createPublisherHandshakeClient,
   createPublisherHandshakeDiscovery,
   createPublisherHttpsTransport,
+  createSqliteBestEffortInbox,
   createSqlitePublisherHandshakeStores,
   createSqliteWakeQueue,
+  createSqliteWakeReceiver,
   createSubscriberHandshakeClient,
   createSynchronizedEventKitHandshakeReader,
   createUtcIntervalPublisherSource,
@@ -3688,6 +5170,8 @@ export {
   handshakeMutationRequestFingerprint,
   intentLookupKey,
   isPublicPublisherAddress,
+  migrateIdOnlyReducerCheckpoint,
+  migrateReceiverStore,
   openPublisherDataLake,
   openPublisherRestGateway,
   openSqlitePublisherState,