@xyo-network/event-kit-protocol 0.0.1 → 0.1.1

package/dist/neutral/lifecycleSelection.d.ts

@@ -0,0 +1,105 @@
+/**
+ * Finalized lifecycle evidence shared by service and subscription revisions.
+ * Claim sources are already canonical Statement Graph sources; they are
+ * compared exactly and are never inferred from fields inside object bodies.
+ */
+export interface LifecycleRevisionEvidence {
+    readonly claimedAtBlock: number;
+    readonly objectHash: string;
+    readonly revision: number;
+    readonly revokedAtBlock?: number;
+    readonly source: string;
+    readonly supersedes?: string;
+}
+export interface PublisherServiceLifecycleRevision extends LifecycleRevisionEvidence {
+    readonly encryptionKeys: readonly string[];
+    readonly eventKinds: readonly string[];
+    readonly expiresAtBlock?: number;
+    readonly preferredEncryptionKey: string;
+    readonly serviceId: string;
+    readonly validFromBlock: number;
+}
+export interface PublisherEncryptionKeyLifecycle {
+    readonly claimedAtBlock: number;
+    readonly expiresAtBlock?: number;
+    readonly keyId: string;
+    readonly objectHash: string;
+    readonly revokedAtBlock?: number;
+    readonly source: string;
+    readonly validFromBlock: number;
+}
+export interface WakeSubscriptionLifecycleRevision extends LifecycleRevisionEvidence {
+    readonly expiresAtBlock: number;
+    readonly subscriptionId: string;
+}
+export interface PublisherAcceptanceLifecycle {
+    readonly acceptanceBlock: number;
+    readonly objectHash: string;
+    readonly revokedAtBlock?: number;
+    readonly source: string;
+    readonly subscription: string;
+}
+export interface PublisherServiceSelectionInput {
+    readonly eventKind: string;
+    readonly finalizedHead: number;
+    readonly publisherSource: string;
+    readonly serviceId?: string;
+    readonly services: readonly PublisherServiceLifecycleRevision[];
+}
+export interface PublisherServiceSelectionSuccess {
+    readonly ok: true;
+    readonly service: PublisherServiceLifecycleRevision;
+}
+export type PublisherServiceSelectionFailureReason = 'ambiguous-service' | 'invalid-revision-chain' | 'service-not-found';
+export interface PublisherServiceSelectionFailure {
+    readonly ok: false;
+    readonly reason: PublisherServiceSelectionFailureReason;
+}
+export type PublisherServiceSelection = PublisherServiceSelectionFailure | PublisherServiceSelectionSuccess;
+export interface PreferredEncryptionKeyInput {
+    readonly finalizedHead: number;
+    readonly keys: readonly PublisherEncryptionKeyLifecycle[];
+    readonly service: PublisherServiceLifecycleRevision;
+}
+export interface PreferredEncryptionKeySuccess {
+    readonly key: PublisherEncryptionKeyLifecycle;
+    readonly ok: true;
+}
+export type PreferredEncryptionKeyFailureReason = 'ambiguous-key' | 'preferred-key-inactive' | 'preferred-key-not-found' | 'preferred-key-not-referenced';
+export interface PreferredEncryptionKeyFailure {
+    readonly ok: false;
+    readonly reason: PreferredEncryptionKeyFailureReason;
+}
+export type PreferredEncryptionKeyResolution = PreferredEncryptionKeyFailure | PreferredEncryptionKeySuccess;
+export interface SubscriptionActivationInput {
+    readonly acceptances: readonly PublisherAcceptanceLifecycle[];
+    readonly finalizedHead: number;
+    readonly publisherSource: string;
+    readonly subscriberSource: string;
+    readonly subscriptionId: string;
+    readonly subscriptions: readonly WakeSubscriptionLifecycleRevision[];
+}
+export interface SubscriptionActivationSuccess {
+    readonly acceptance: PublisherAcceptanceLifecycle;
+    readonly activeFromBlock: number;
+    readonly ok: true;
+    readonly pendingReplacement: boolean;
+    readonly subscription: WakeSubscriptionLifecycleRevision;
+}
+export type SubscriptionActivationFailureReason = 'ambiguous-acceptance' | 'invalid-revision-chain' | 'subscription-inactive' | 'subscription-not-found' | 'subscription-pending';
+export interface SubscriptionActivationFailure {
+    readonly ok: false;
+    readonly reason: SubscriptionActivationFailureReason;
+}
+export type SubscriptionActivation = SubscriptionActivationFailure | SubscriptionActivationSuccess;
+/** Selects exactly one active service; response order never breaks ambiguity. */
+export declare function selectPublisherService(input: PublisherServiceSelectionInput): PublisherServiceSelection;
+/** Resolves the exact preferred descriptor; another active key is never a fallback. */
+export declare function resolvePreferredEncryptionKey(input: PreferredEncryptionKeyInput): PreferredEncryptionKeyResolution;
+/**
+ * Selects the highest revision whose acceptance cutover has arrived. A newer
+ * pending revision leaves the prior activation in place; after cutover, an
+ * inactive replacement never falls back to an older accepted revision.
+ */
+export declare function selectSubscriptionActivation(input: SubscriptionActivationInput): SubscriptionActivation;
+//# sourceMappingURL=lifecycleSelection.d.ts.map

package/dist/neutral/lifecycleSelection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lifecycleSelection.d.ts","sourceRoot":"","sources":["../../src/lifecycleSelection.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAC7B;AAED,MAAM,WAAW,iCAAkC,SAAQ,yBAAyB;IAClF,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAA;IAC1C,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;IACtC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAA;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;CAChC;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;CAChC;AAED,MAAM,WAAW,iCAAkC,SAAQ,yBAAyB;IAClF,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;CAChC;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAC9B;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,QAAQ,EAAE,SAAS,iCAAiC,EAAE,CAAA;CAChE;AAED,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;IACjB,QAAQ,CAAC,OAAO,EAAE,iCAAiC,CAAA;CACpD;AAED,MAAM,MAAM,sCAAsC,GAC5C,mBAAmB,GACnB,wBAAwB,GACxB,mBAAmB,CAAA;AAEzB,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAA;IAClB,QAAQ,CAAC,MAAM,EAAE,sCAAsC,CAAA;CACxD;AAED,MAAM,MAAM,yBAAyB,GAAG,gCAAgC,GAAG,gCAAgC,CAAA;AAE3G,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,IAAI,EAAE,SAAS,+BAA+B,EAAE,CAAA;IACzD,QAAQ,CAAC,OAAO,EAAE,iCAAiC,CAAA;CACpD;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,GAAG,EAAE,+BAA+B,CAAA;IAC7C,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;CAClB;AAED,MAAM,MAAM,mCAAmC,GACzC,eAAe,GACf,wBAAwB,GACxB,yBAAyB,GACzB,8BAA8B,CAAA;AAEpC,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAA;IAClB,QAAQ,CAAC,MAAM,EAAE,mCAAmC,CAAA;CACrD;AAED,MAAM,MAAM,gCAAgC,GAAG,6BAA6B,GAAG,6BAA6B,CAAA;AAE5G,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,WAAW,EAAE,SAAS,4BAA4B,EAAE,CAAA;IAC7D,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,aAAa,EAAE,SAAS,iCAAiC,EAAE,CAAA;CACrE;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,UAAU,EAAE,4BAA4B,CAAA;IACjD,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;IACjB,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAA;IACpC,QAAQ,CAAC,YAAY,EAAE,iCAAiC,CAAA;CACzD;AAED,MAAM,MAAM,mCAAmC,GACzC,sBAAsB,GACtB,wBAAwB,GACxB,uBAAuB,GACvB,wBAAwB,GACxB,sBAAsB,CAAA;AAE5B,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAA;IAClB,QAAQ,CAAC,MAAM,EAAE,mCAAmC,CAAA;CACrD;AAED,MAAM,MAAM,sBAAsB,GAAG,6BAA6B,GAAG,6BAA6B,CAAA;AAwIlG,iFAAiF;AACjF,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,8BAA8B,GAAG,yBAAyB,CAmBvG;AAED,uFAAuF;AACvF,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,2BAA2B,GACjC,gCAAgC,CAuBlC;AA8CD;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,2BAA2B,GAAG,sBAAsB,CA+BvG"}

package/dist/neutral/memoryStatementGrantGraph.d.ts

@@ -12,6 +12,8 @@ export interface MemoryStatementGrantGraph extends StatementGraphGrantReadModel
         grant: WakeGrantObject;
         objectHash: string;
         source: string;
+        /** Defaults to `grant.publisher`. */
+        subject?: string;
     }) => void;
     /**
      * Claim a revocation object negating `grant`. There is no revoke verb in v2 —
@@ -23,6 +25,8 @@ export interface MemoryStatementGrantGraph extends StatementGraphGrantReadModel
         grantObjectHash: string;
         objectHash: string;
         source: string;
+        /** Defaults to the subject of the referenced grant Claim. */
+        subject?: string;
     }) => void;
     setHead: (block: number) => void;
 }

package/dist/neutral/memoryStatementGrantGraph.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"memoryStatementGrantGraph.d.ts","sourceRoot":"","sources":["../../src/memoryStatementGrantGraph.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAuB,MAAM,gCAAgC,CAAA;AAO1F,OAAO,KAAK,EAGV,4BAA4B,EAC7B,MAAM,0BAA0B,CAAA;AAEjC,MAAM,WAAW,yBAA0B,SAAQ,4BAA4B;IAC7E;;;OAGG;IACH,KAAK,EAAE,CAAC,KAAK,EAAE;QACb,KAAK,EAAE,MAAM,CAAA;QACb,kDAAkD;QAClD,SAAS,EAAE,MAAM,CAAA;QACjB,KAAK,EAAE,eAAe,CAAA;QACtB,UAAU,EAAE,MAAM,CAAA;QAClB,MAAM,EAAE,MAAM,CAAA;KACf,KAAK,IAAI,CAAA;IACV;;;OAGG;IACH,MAAM,EAAE,CAAC,KAAK,EAAE;QACd,KAAK,EAAE,MAAM,CAAA;QACb,SAAS,EAAE,MAAM,CAAA;QACjB,eAAe,EAAE,MAAM,CAAA;QACvB,UAAU,EAAE,MAAM,CAAA;QAClB,MAAM,EAAE,MAAM,CAAA;KACf,KAAK,IAAI,CAAA;IACV,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAA;CACjC;AAED;;;GAGG;AACH,wBAAgB,+BAA+B,CAAC,WAAW,SAAI,GAAG,yBAAyB,CAmG1F"}
+{"version":3,"file":"memoryStatementGrantGraph.d.ts","sourceRoot":"","sources":["../../src/memoryStatementGrantGraph.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAuB,MAAM,gCAAgC,CAAA;AAO1F,OAAO,KAAK,EAGV,4BAA4B,EAC7B,MAAM,0BAA0B,CAAA;AAEjC,MAAM,WAAW,yBAA0B,SAAQ,4BAA4B;IAC7E;;;OAGG;IACH,KAAK,EAAE,CAAC,KAAK,EAAE;QACb,KAAK,EAAE,MAAM,CAAA;QACb,kDAAkD;QAClD,SAAS,EAAE,MAAM,CAAA;QACjB,KAAK,EAAE,eAAe,CAAA;QACtB,UAAU,EAAE,MAAM,CAAA;QAClB,MAAM,EAAE,MAAM,CAAA;QACd,qCAAqC;QACrC,OAAO,CAAC,EAAE,MAAM,CAAA;KACjB,KAAK,IAAI,CAAA;IACV;;;OAGG;IACH,MAAM,EAAE,CAAC,KAAK,EAAE;QACd,KAAK,EAAE,MAAM,CAAA;QACb,SAAS,EAAE,MAAM,CAAA;QACjB,eAAe,EAAE,MAAM,CAAA;QACvB,UAAU,EAAE,MAAM,CAAA;QAClB,MAAM,EAAE,MAAM,CAAA;QACd,6DAA6D;QAC7D,OAAO,CAAC,EAAE,MAAM,CAAA;KACjB,KAAK,IAAI,CAAA;IACV,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAA;CACjC;AAED;;;GAGG;AACH,wBAAgB,+BAA+B,CAAC,WAAW,SAAI,GAAG,yBAAyB,CAqH1F"}

package/dist/neutral/memoryWakeInbox.d.ts

@@ -24,8 +24,9 @@ export interface MemoryWakeInbox extends AtomicWakeInbox {
  *
  * Writes are ordered so a failing sink cannot consume `jti` or `wakeId` without
  * a recoverable receipt. It is **not** durable: process death between enqueue
- * and record commit redelivers the wake, and no state survives restart. Gate 5
- * requires a durable adapter; this is local evidence only.
+ * and record commit redelivers the wake, and no state survives restart. The
+ * historical core implementation-plan Gate 5 requires a durable adapter; this
+ * is local evidence only.
  */
 export declare function createMemoryWakeInbox(options?: MemoryWakeInboxOptions): MemoryWakeInbox;
 //# sourceMappingURL=memoryWakeInbox.d.ts.map

package/dist/neutral/memoryWakeInbox.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"memoryWakeInbox.d.ts","sourceRoot":"","sources":["../../src/memoryWakeInbox.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,eAAe,EAKhB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAE9C,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IAC/D,yEAAyE;IACzE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,MAAM,CAAA;CACnC;AAED,MAAM,WAAW,eAAgB,SAAQ,eAAe;IACtD,kDAAkD;IAClD,QAAQ,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,CAAA;IACxC,6CAA6C;IAC7C,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,iDAAiD;IACjD,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;CACjC;AAeD;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,GAAE,sBAA2B,GAAG,eAAe,CAiG3F"}
+{"version":3,"file":"memoryWakeInbox.d.ts","sourceRoot":"","sources":["../../src/memoryWakeInbox.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,eAAe,EAKhB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAE9C,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IAC/D,yEAAyE;IACzE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,MAAM,CAAA;CACnC;AAED,MAAM,WAAW,eAAgB,SAAQ,eAAe;IACtD,kDAAkD;IAClD,QAAQ,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,CAAA;IACxC,6CAA6C;IAC7C,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,iDAAiD;IACjD,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;CACjC;AAeD;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,GAAE,sBAA2B,GAAG,eAAe,CAiG3F"}

package/dist/neutral/publisherHandshakeStores.d.ts

@@ -0,0 +1,97 @@
+import type { EndpointChallenge, HandshakeId, Hash, NormalizedAddress } from '@xyo-network/event-kit-schemas';
+import type { WakeSubscriptionPrivateKey } from './wakeSubscriptionHpke.ts';
+export interface PublisherEncryptionKeyLookup {
+    /** Canonical descriptor object hash named by the subscription. */
+    readonly encryptionKey: Hash;
+    /** Stable key identifier named by both descriptor and subscription. */
+    readonly keyId: HandshakeId;
+    /** Exact publisher whose dedicated key is requested. */
+    readonly publisher: NormalizedAddress;
+}
+/**
+ * Publisher key-custody boundary. Implementations resolve one exact descriptor
+ * identity and MUST NOT try another key after a miss or decrypt failure.
+ */
+export interface PublisherEncryptionKeyStore {
+    getPrivateKey: (lookup: PublisherEncryptionKeyLookup) => Promise<WakeSubscriptionPrivateKey | undefined>;
+}
+export type PublisherEndpointChallengeState = 'attempted' | 'issued' | 'verified';
+export interface PublisherEndpointChallengeRecord {
+    readonly challenge: EndpointChallenge;
+    readonly challengeHash: Hash;
+    readonly responseHash?: Hash;
+    readonly state: PublisherEndpointChallengeState;
+}
+export interface IssuePublisherEndpointChallengeInput {
+    readonly challenge: EndpointChallenge;
+    readonly challengeHash: Hash;
+}
+export type IssuePublisherEndpointChallengeResult = {
+    readonly kind: 'collision';
+} | {
+    readonly kind: 'duplicate';
+    readonly record: PublisherEndpointChallengeRecord;
+} | {
+    readonly kind: 'issued';
+    readonly record: PublisherEndpointChallengeRecord;
+};
+export interface BeginPublisherEndpointChallengeAttemptInput {
+    readonly challengeHash: Hash;
+    readonly nowSeconds: number;
+}
+export type BeginPublisherEndpointChallengeAttemptResult = {
+    readonly kind: 'already-attempted';
+    readonly record: PublisherEndpointChallengeRecord;
+} | {
+    readonly kind: 'expired';
+    readonly record: PublisherEndpointChallengeRecord;
+} | {
+    readonly kind: 'missing';
+} | {
+    readonly kind: 'started';
+    readonly record: PublisherEndpointChallengeRecord;
+} | {
+    readonly kind: 'verified';
+    readonly record: PublisherEndpointChallengeRecord;
+};
+export interface CompletePublisherEndpointChallengeInput {
+    readonly challengeHash: Hash;
+    readonly nowSeconds: number;
+    readonly responseHash: Hash;
+}
+export type CompletePublisherEndpointChallengeResult = {
+    readonly kind: 'collision';
+    readonly record: PublisherEndpointChallengeRecord;
+} | {
+    readonly kind: 'duplicate';
+    readonly record: PublisherEndpointChallengeRecord;
+} | {
+    readonly kind: 'expired';
+    readonly record: PublisherEndpointChallengeRecord;
+} | {
+    readonly kind: 'missing';
+} | {
+    readonly kind: 'not-attempted';
+    readonly record: PublisherEndpointChallengeRecord;
+} | {
+    readonly kind: 'verified';
+    readonly record: PublisherEndpointChallengeRecord;
+};
+/**
+ * Durable, linearizable endpoint-challenge boundary.
+ *
+ * `issue` binds the exact strict challenge body to its canonical hash.
+ * `beginAttempt` atomically grants at most one outbound attempt while the
+ * challenge is live; callers never resend an already-attempted challenge.
+ * `completeVerified` atomically records one exact response hash and rechecks
+ * the exclusive expiry window for a new decision. Once verified, an exact
+ * retry returns `duplicate` even after expiry so crash recovery can resume the
+ * already-authorized acceptance; a different response is a `collision`.
+ */
+export interface PublisherEndpointChallengeStore {
+    beginAttempt: (input: BeginPublisherEndpointChallengeAttemptInput) => Promise<BeginPublisherEndpointChallengeAttemptResult>;
+    completeVerified: (input: CompletePublisherEndpointChallengeInput) => Promise<CompletePublisherEndpointChallengeResult>;
+    get: (challengeHash: Hash) => Promise<PublisherEndpointChallengeRecord | undefined>;
+    issue: (input: IssuePublisherEndpointChallengeInput) => Promise<IssuePublisherEndpointChallengeResult>;
+}
+//# sourceMappingURL=publisherHandshakeStores.d.ts.map

package/dist/neutral/publisherHandshakeStores.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"publisherHandshakeStores.d.ts","sourceRoot":"","sources":["../../src/publisherHandshakeStores.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,iBAAiB,EACjB,WAAW,EACX,IAAI,EACJ,iBAAiB,EAClB,MAAM,gCAAgC,CAAA;AAEvC,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAA;AAE3E,MAAM,WAAW,4BAA4B;IAC3C,kEAAkE;IAClE,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAA;IAC5B,uEAAuE;IACvE,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAA;IAC3B,wDAAwD;IACxD,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAA;CACtC;AAED;;;GAGG;AACH,MAAM,WAAW,2BAA2B;IAC1C,aAAa,EAAE,CAAC,MAAM,EAAE,4BAA4B,KAAK,OAAO,CAAC,0BAA0B,GAAG,SAAS,CAAC,CAAA;CACzG;AAED,MAAM,MAAM,+BAA+B,GAAG,WAAW,GAAG,QAAQ,GAAG,UAAU,CAAA;AAEjF,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAA;IACrC,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAA;IAC5B,QAAQ,CAAC,YAAY,CAAC,EAAE,IAAI,CAAA;IAC5B,QAAQ,CAAC,KAAK,EAAE,+BAA+B,CAAA;CAChD;AAED,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAA;IACrC,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAA;CAC7B;AAED,MAAM,MAAM,qCAAqC,GAC3C;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,gCAAgC,CAAA;CAAE,GACjF;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,gCAAgC,CAAA;CAAE,CAAA;AAEpF,MAAM,WAAW,2CAA2C;IAC1D,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAA;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC5B;AAED,MAAM,MAAM,4CAA4C,GAClD;IAAE,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,gCAAgC,CAAA;CAAE,GACzF;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,gCAAgC,CAAA;CAAE,GAC/E;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,gCAAgC,CAAA;CAAE,GAC/E;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,gCAAgC,CAAA;CAAE,CAAA;AAEtF,MAAM,WAAW,uCAAuC;IACtD,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAA;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAA;CAC5B;AAED,MAAM,MAAM,wCAAwC,GAC9C;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,gCAAgC,CAAA;CAAE,GACjF;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,gCAAgC,CAAA;CAAE,GACjF;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,gCAAgC,CAAA;CAAE,GAC/E;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,gCAAgC,CAAA;CAAE,GACrF;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,gCAAgC,CAAA;CAAE,CAAA;AAEtF;;;;;;;;;;GAUG;AACH,MAAM,WAAW,+BAA+B;IAC9C,YAAY,EAAE,CACZ,KAAK,EAAE,2CAA2C,KAC/C,OAAO,CAAC,4CAA4C,CAAC,CAAA;IAC1D,gBAAgB,EAAE,CAChB,KAAK,EAAE,uCAAuC,KAC3C,OAAO,CAAC,wCAAwC,CAAC,CAAA;IACtD,GAAG,EAAE,CAAC,aAAa,EAAE,IAAI,KAAK,OAAO,CAAC,gCAAgC,GAAG,SAAS,CAAC,CAAA;IACnF,KAAK,EAAE,CAAC,KAAK,EAAE,oCAAoC,KAAK,OAAO,CAAC,qCAAqC,CAAC,CAAA;CACvG"}

package/dist/neutral/publisherSubscription.d.ts

@@ -0,0 +1,127 @@
+import type { ChainId, EncryptedWakeSubscription, EndpointChallenge, EndpointChallengeResponse, Hash, NormalizedAddress, PublisherEncryptionKey, PublisherService, WakeGrantObject, WakeSubscriptionAcceptance, WakeSubscriptionPlaintext } from '@xyo-network/event-kit-schemas';
+import type { HashedHandshakeObject } from './handshakeConstruction.ts';
+import type { BeginPublisherEndpointChallengeAttemptResult, PublisherEncryptionKeyStore, PublisherEndpointChallengeStore } from './publisherHandshakeStores.ts';
+/**
+ * Finalized, publisher-scoped read-model output for one exact subscriber
+ * fan-out Claim. The caller remains responsible for finalized Claim authority,
+ * service/key selection, lifecycle revocations, and revalidation before
+ * publishing acceptance; this boundary independently recomputes immutable
+ * body hashes and enforces publisher-private constraints.
+ */
+export interface PublisherSubscriptionCandidate {
+    readonly chainId: ChainId;
+    readonly finalizedHead: number;
+    readonly grant: HashedHandshakeObject<WakeGrantObject>;
+    readonly key: HashedHandshakeObject<PublisherEncryptionKey>;
+    readonly keys: PublisherEncryptionKeyStore;
+    readonly publisher: NormalizedAddress;
+    readonly service: HashedHandshakeObject<PublisherService>;
+    /** Finalized fan-out Claim source; this is the subscriber identity used in HPKE AAD. */
+    readonly subscriber: NormalizedAddress;
+    readonly subscription: HashedHandshakeObject<EncryptedWakeSubscription>;
+    /** Finalized block containing the exact service/grant/subscription fan-out Claim. */
+    readonly tupleBlock: number;
+    /** All object hashes in that one fan-out Claim. */
+    readonly tupleObjectHashes: readonly Hash[];
+    /** Publisher subject under which the finalized fan-out Claim was discovered. */
+    readonly tupleSubject: NormalizedAddress;
+}
+export type PublisherSubscriptionValidationFailureReason = 'body-hash-mismatch' | 'decryption-failed' | 'grant-binding-invalid' | 'grant-scope-invalid' | 'key-binding-invalid' | 'key-inactive' | 'key-store-unavailable' | 'malformed-candidate' | 'private-key-not-found' | 'service-inactive' | 'service-limit-invalid' | 'subscription-binding-invalid' | 'subscription-expiry-invalid' | 'tuple-binding-invalid';
+export interface PublisherSubscriptionValidationFailure {
+    readonly ok: false;
+    readonly reason: PublisherSubscriptionValidationFailureReason;
+}
+export interface PublisherEndpointChallengeContext {
+    readonly chainId: ChainId;
+    readonly encryptionKey: Hash;
+    readonly eventKind: EncryptedWakeSubscription['eventKind'];
+    readonly grant: Hash;
+    readonly keyId: EncryptedWakeSubscription['keyId'];
+    readonly publisher: NormalizedAddress;
+    readonly service: Hash;
+    readonly subscriber: NormalizedAddress;
+    readonly subscription: Hash;
+}
+export interface ValidatedPublisherSubscription {
+    readonly context: PublisherEndpointChallengeContext;
+    readonly finalizedHead: number;
+    readonly grant: HashedHandshakeObject<WakeGrantObject>;
+    readonly key: HashedHandshakeObject<PublisherEncryptionKey>;
+    readonly ok: true;
+    readonly plaintext: WakeSubscriptionPlaintext;
+    readonly service: HashedHandshakeObject<PublisherService>;
+    readonly subscription: HashedHandshakeObject<EncryptedWakeSubscription>;
+    readonly tupleBlock: number;
+}
+export type PublisherSubscriptionValidation = PublisherSubscriptionValidationFailure | ValidatedPublisherSubscription;
+export interface IssuePublisherEndpointChallengeApiInput {
+    readonly issuedAt: number;
+    readonly lifetimeSeconds?: number;
+    readonly store: PublisherEndpointChallengeStore;
+    readonly subscription: ValidatedPublisherSubscription;
+}
+export type IssuePublisherEndpointChallengeApiResult = {
+    readonly ok: false;
+    readonly reason: 'challenge-collision' | 'challenge-store-invalid' | 'challenge-store-unavailable';
+} | {
+    readonly challenge: EndpointChallenge;
+    readonly challengeHash: Hash;
+    readonly disposition: 'duplicate' | 'issued';
+    readonly ok: true;
+};
+export interface BeginPublisherEndpointChallengeAttemptApiInput {
+    readonly challengeHash: Hash;
+    readonly nowSeconds: number;
+    readonly store: PublisherEndpointChallengeStore;
+}
+export type BeginPublisherEndpointChallengeAttemptApiResult = BeginPublisherEndpointChallengeAttemptResult | {
+    readonly kind: 'store-invalid' | 'store-unavailable';
+};
+export interface CompletePublisherEndpointChallengeApiInput {
+    readonly challenge: EndpointChallenge;
+    /**
+     * Publisher-local Unix second for the one-time proof-verification and
+     * acceptance decision. Finalized replay cannot and does not re-evaluate this
+     * value from XL1 block time.
+     */
+    readonly nowSeconds: number;
+    readonly response: EndpointChallengeResponse;
+    readonly store: PublisherEndpointChallengeStore;
+    readonly subscription: ValidatedPublisherSubscription;
+}
+export type CompletePublisherEndpointChallengeFailureReason = 'challenge-context-invalid' | 'challenge-expired' | 'challenge-not-attempted' | 'challenge-not-found' | 'challenge-response-collision' | 'challenge-store-invalid' | 'challenge-store-unavailable' | 'invalid-proof';
+export interface CompletePublisherEndpointChallengeFailure {
+    readonly ok: false;
+    readonly reason: CompletePublisherEndpointChallengeFailureReason;
+}
+export interface CompletePublisherEndpointChallengeSuccess {
+    readonly acceptance: WakeSubscriptionAcceptance;
+    readonly acceptanceHash: Hash;
+    readonly challengeHash: Hash;
+    readonly disposition: 'duplicate' | 'verified';
+    readonly ok: true;
+    readonly responseHash: Hash;
+}
+export type CompletePublisherEndpointChallengeApiResult = CompletePublisherEndpointChallengeFailure | CompletePublisherEndpointChallengeSuccess;
+/**
+ * Validate one read-model-qualified finalized public tuple, resolve exactly
+ * one dedicated private key, decrypt once, and enforce the private grant and
+ * filter scope. No algorithm, key, service, or AAD fallback is attempted after
+ * failure. Callers must resolve the finalized lifecycle again after challenge
+ * and before publishing acceptance.
+ */
+export declare function validateAndDecryptPublisherSubscription(candidate: PublisherSubscriptionCandidate): Promise<PublisherSubscriptionValidation>;
+/** Exact challenge tuple comparison; every context field is mandatory. */
+export declare function endpointChallengeMatchesPublisherContext(challenge: EndpointChallenge, context: PublisherEndpointChallengeContext): boolean;
+/** Create and durably issue a fresh challenge for one validated tuple. */
+export declare function issuePublisherEndpointChallenge(input: IssuePublisherEndpointChallengeApiInput): Promise<IssuePublisherEndpointChallengeApiResult>;
+/** Claim the one permitted outbound challenge attempt before any HTTP call. */
+export declare function beginPublisherEndpointChallengeAttempt(input: BeginPublisherEndpointChallengeAttemptApiInput): Promise<BeginPublisherEndpointChallengeAttemptApiResult>;
+/**
+ * Verify exact tuple context and proof in its Unix-time window, atomically
+ * consume the durable challenge, then construct the exact publisher acceptance
+ * object. Publishing that object attests to this in-window decision; later
+ * finalization does not re-run a wall-clock check.
+ */
+export declare function completePublisherEndpointChallenge(input: CompletePublisherEndpointChallengeApiInput): Promise<CompletePublisherEndpointChallengeApiResult>;
+//# sourceMappingURL=publisherSubscription.d.ts.map

package/dist/neutral/publisherSubscription.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"publisherSubscription.d.ts","sourceRoot":"","sources":["../../src/publisherSubscription.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,OAAO,EACP,yBAAyB,EACzB,iBAAiB,EACjB,yBAAyB,EACzB,IAAI,EACJ,iBAAiB,EACjB,sBAAsB,EACtB,gBAAgB,EAChB,eAAe,EACf,0BAA0B,EAC1B,yBAAyB,EAC1B,MAAM,gCAAgC,CAAA;AAkBvC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAA;AAKvE,OAAO,KAAK,EACV,4CAA4C,EAE5C,2BAA2B,EAE3B,+BAA+B,EAChC,MAAM,+BAA+B,CAAA;AAGtC;;;;;;GAMG;AACH,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAC,eAAe,CAAC,CAAA;IACtD,QAAQ,CAAC,GAAG,EAAE,qBAAqB,CAAC,sBAAsB,CAAC,CAAA;IAC3D,QAAQ,CAAC,IAAI,EAAE,2BAA2B,CAAA;IAC1C,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAA;IACrC,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC,gBAAgB,CAAC,CAAA;IACzD,wFAAwF;IACxF,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAA;IACtC,QAAQ,CAAC,YAAY,EAAE,qBAAqB,CAAC,yBAAyB,CAAC,CAAA;IACvE,qFAAqF;IACrF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,mDAAmD;IACnD,QAAQ,CAAC,iBAAiB,EAAE,SAAS,IAAI,EAAE,CAAA;IAC3C,gFAAgF;IAChF,QAAQ,CAAC,YAAY,EAAE,iBAAiB,CAAA;CACzC;AAED,MAAM,MAAM,4CAA4C,GAClD,oBAAoB,GACpB,mBAAmB,GACnB,uBAAuB,GACvB,qBAAqB,GACrB,qBAAqB,GACrB,cAAc,GACd,uBAAuB,GACvB,qBAAqB,GACrB,uBAAuB,GACvB,kBAAkB,GAClB,uBAAuB,GACvB,8BAA8B,GAC9B,6BAA6B,GAC7B,uBAAuB,CAAA;AAE7B,MAAM,WAAW,sCAAsC;IACrD,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAA;IAClB,QAAQ,CAAC,MAAM,EAAE,4CAA4C,CAAA;CAC9D;AAED,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAA;IAC5B,QAAQ,CAAC,SAAS,EAAE,yBAAyB,CAAC,WAAW,CAAC,CAAA;IAC1D,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAA;IACpB,QAAQ,CAAC,KAAK,EAAE,yBAAyB,CAAC,OAAO,CAAC,CAAA;IAClD,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAA;IACrC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAA;IACtC,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAA;CAC5B;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,OAAO,EAAE,iCAAiC,CAAA;IACnD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAC,eAAe,CAAC,CAAA;IACtD,QAAQ,CAAC,GAAG,EAAE,qBAAqB,CAAC,sBAAsB,CAAC,CAAA;IAC3D,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;IACjB,QAAQ,CAAC,SAAS,EAAE,yBAAyB,CAAA;IAC7C,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC,gBAAgB,CAAC,CAAA;IACzD,QAAQ,CAAC,YAAY,EAAE,qBAAqB,CAAC,yBAAyB,CAAC,CAAA;IACvE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC5B;AAED,MAAM,MAAM,+BAA+B,GACrC,sCAAsC,GACtC,8BAA8B,CAAA;AAEpC,MAAM,WAAW,uCAAuC;IACtD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,KAAK,EAAE,+BAA+B,CAAA;IAC/C,QAAQ,CAAC,YAAY,EAAE,8BAA8B,CAAA;CACtD;AAED,MAAM,MAAM,wCAAwC,GAC9C;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,qBAAqB,GAAG,yBAAyB,GAAG,6BAA6B,CAAA;CAAE,GAC1H;IACA,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAA;IACrC,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAA;IAC5B,QAAQ,CAAC,WAAW,EAAE,WAAW,GAAG,QAAQ,CAAA;IAC5C,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;CAClB,CAAA;AAEL,MAAM,WAAW,8CAA8C;IAC7D,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAA;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,KAAK,EAAE,+BAA+B,CAAA;CAChD;AAED,MAAM,MAAM,+CAA+C,GACrD,4CAA4C,GAC5C;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,GAAG,mBAAmB,CAAA;CAAE,CAAA;AAE9D,MAAM,WAAW,0CAA0C;IACzD,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAA;IACrC;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,QAAQ,EAAE,yBAAyB,CAAA;IAC5C,QAAQ,CAAC,KAAK,EAAE,+BAA+B,CAAA;IAC/C,QAAQ,CAAC,YAAY,EAAE,8BAA8B,CAAA;CACtD;AAED,MAAM,MAAM,+CAA+C,GACrD,2BAA2B,GAC3B,mBAAmB,GACnB,yBAAyB,GACzB,qBAAqB,GACrB,8BAA8B,GAC9B,yBAAyB,GACzB,6BAA6B,GAC7B,eAAe,CAAA;AAErB,MAAM,WAAW,yCAAyC;IACxD,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAA;IAClB,QAAQ,CAAC,MAAM,EAAE,+CAA+C,CAAA;CACjE;AAED,MAAM,WAAW,yCAAyC;IACxD,QAAQ,CAAC,UAAU,EAAE,0BAA0B,CAAA;IAC/C,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAA;IAC7B,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAA;IAC5B,QAAQ,CAAC,WAAW,EAAE,WAAW,GAAG,UAAU,CAAA;IAC9C,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;IACjB,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAA;CAC5B;AAED,MAAM,MAAM,2CAA2C,GACjD,yCAAyC,GACzC,yCAAyC,CAAA;AA6M/C;;;;;;GAMG;AACH,wBAAsB,uCAAuC,CAC3D,SAAS,EAAE,8BAA8B,GACxC,OAAO,CAAC,+BAA+B,CAAC,CAgB1C;AAED,0EAA0E;AAC1E,wBAAgB,wCAAwC,CACtD,SAAS,EAAE,iBAAiB,EAC5B,OAAO,EAAE,iCAAiC,GACzC,OAAO,CAYT;AAcD,0EAA0E;AAC1E,wBAAsB,+BAA+B,CACnD,KAAK,EAAE,uCAAuC,GAC7C,OAAO,CAAC,wCAAwC,CAAC,CAuBnD;AAED,+EAA+E;AAC/E,wBAAsB,sCAAsC,CAC1D,KAAK,EAAE,8CAA8C,GACpD,OAAO,CAAC,+CAA+C,CAAC,CAuB1D;AAsCD;;;;;GAKG;AACH,wBAAsB,kCAAkC,CACtD,KAAK,EAAE,0CAA0C,GAChD,OAAO,CAAC,2CAA2C,CAAC,CAwDtD"}

package/dist/neutral/statementGraphPorts.d.ts

@@ -7,7 +7,7 @@
  * preserves the fields below. Do not claim direct structural assignment.
  */
 /**
- * One materialized `(source, objectHash)` claim.
+ * One materialized `(source, subject, objectHash)` claim.
  *
  * `firstBlock`/`firstEventHash` are frozen at materialization; a redundant
  * claim advances only `lastBlock`. Authorization reads `firstBlock`, so
@@ -21,6 +21,7 @@ export interface StatementGrantClaim {
     readonly lastBlock: number;
     readonly objectHash: string;
     readonly source: string;
+    readonly subject: string;
 }
 export interface StatementGrantObject {
     readonly assurance: string;
@@ -32,9 +33,11 @@ export interface StatementGrantObject {
 export interface StatementGrantClaimQuery {
     readonly declaredObjectSchemaPrefix?: string;
     readonly objectHash?: string;
+    /** Event Kit publisher address the Claim is about. */
+    readonly subject?: string;
 }
 export interface StatementGraphGrantReadModel {
-    /** Claims made **by** `source`. v2 has no `target`, so there is no incoming direction. */
+    /** Claims made **by** `source`, optionally narrowed by their aboutness subject. */
     claims: (source: string, query?: StatementGrantClaimQuery) => Promise<readonly StatementGrantClaim[]>;
     head: () => Promise<number>;
     object: (objectHash: string) => Promise<StatementGrantObject | undefined>;

package/dist/neutral/statementGraphPorts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"statementGraphPorts.d.ts","sourceRoot":"","sources":["../../src/statementGraphPorts.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,0EAA0E;IAC1E,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAA;IACrC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,mFAAmF;IACnF,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,IAAI,CAAA;CAC1D;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,0BAA0B,CAAC,EAAE,MAAM,CAAA;IAC5C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAC7B;AAED,MAAM,WAAW,4BAA4B;IAC3C,0FAA0F;IAC1F,MAAM,EAAE,CACN,MAAM,EAAE,MAAM,EACd,KAAK,CAAC,EAAE,wBAAwB,KAC7B,OAAO,CAAC,SAAS,mBAAmB,EAAE,CAAC,CAAA;IAC5C,IAAI,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;IAC3B,MAAM,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAA;CAC1E"}
+{"version":3,"file":"statementGraphPorts.d.ts","sourceRoot":"","sources":["../../src/statementGraphPorts.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,0EAA0E;IAC1E,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAA;IACrC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,mFAAmF;IACnF,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,IAAI,CAAA;CAC1D;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,0BAA0B,CAAC,EAAE,MAAM,CAAA;IAC5C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,sDAAsD;IACtD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,4BAA4B;IAC3C,mFAAmF;IACnF,MAAM,EAAE,CACN,MAAM,EAAE,MAAM,EACd,KAAK,CAAC,EAAE,wBAAwB,KAC7B,OAAO,CAAC,SAAS,mBAAmB,EAAE,CAAC,CAAA;IAC5C,IAAI,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;IAC3B,MAAM,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAA;CAC1E"}

package/dist/neutral/statementGraphWakeGrantAuthorizer.d.ts

@@ -7,11 +7,11 @@ export interface StatementGraphWakeGrantAuthorizerOptions {
  * Adapts a canonical Statement Graph v2 read model to the evidence-bearing
  * D-002 grant authorization port. Each decision is bound to one stable head.
  *
- * v2 is append-only with no `target` and no lifecycle `state`, so this layer
- * owns two things the protocol used to:
+ * v2 is append-only with no lifecycle `state`, so this layer owns two things
+ * the protocol used to:
  *
- * - **Aboutness.** The publisher a grant enables is read from the grant
- *   object's `publisher` param, not from a claim edge.
+ * - **Aboutness.** The requested publisher must match both the Claim's
+ *   `subject` and the grant object's `publisher` field.
  * - **Negation.** A grant is disabled by a further claim, by the *same pinned
  *   controller*, of a revocation object referencing that grant's hash.
  *   Revocations from any other source are ignored.

package/dist/neutral/statementGraphWakeGrantAuthorizer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"statementGraphWakeGrantAuthorizer.d.ts","sourceRoot":"","sources":["../../src/statementGraphWakeGrantAuthorizer.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAGV,mBAAmB,EAEpB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAEV,4BAA4B,EAC7B,MAAM,0BAA0B,CAAA;AAEjC,MAAM,WAAW,wCAAwC;IACvD,QAAQ,CAAC,MAAM,EAAE,4BAA4B,CAAA;CAC9C;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,uCAAuC,CACrD,OAAO,EAAE,wCAAwC,GAChD,mBAAmB,CA4CrB"}
+{"version":3,"file":"statementGraphWakeGrantAuthorizer.d.ts","sourceRoot":"","sources":["../../src/statementGraphWakeGrantAuthorizer.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAGV,mBAAmB,EAEpB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAEV,4BAA4B,EAC7B,MAAM,0BAA0B,CAAA;AAEjC,MAAM,WAAW,wCAAwC;IACvD,QAAQ,CAAC,MAAM,EAAE,4BAA4B,CAAA;CAC9C;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,uCAAuC,CACrD,OAAO,EAAE,wCAAwC,GAChD,mBAAmB,CA+CrB"}

package/dist/neutral/wakeSubscriptionEncoding.d.ts

@@ -0,0 +1,12 @@
+import type { EncryptedWakeSubscription, NormalizedAddress, WakeSubscriptionCleartext, WakeSubscriptionPlaintext } from '@xyo-network/event-kit-schemas';
+/**
+ * Canonical HPKE additional authenticated data. `subscriber` is the finalized
+ * Statement Graph claim source and therefore cannot be inferred from the
+ * subscription body itself.
+ */
+export declare function wakeSubscriptionAadBytes(subscription: WakeSubscriptionCleartext | EncryptedWakeSubscription, subscriber: NormalizedAddress): Uint8Array;
+/** Validate and encode the encrypted subscription plaintext as canonical JCS UTF-8. */
+export declare function wakeSubscriptionPlaintextBytes(plaintext: WakeSubscriptionPlaintext): Uint8Array;
+/** Decode only strict UTF-8 whose bytes are already the canonical plaintext encoding. */
+export declare function wakeSubscriptionPlaintextFromBytes(encoded: Uint8Array): WakeSubscriptionPlaintext;
+//# sourceMappingURL=wakeSubscriptionEncoding.d.ts.map

package/dist/neutral/wakeSubscriptionEncoding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wakeSubscriptionEncoding.d.ts","sourceRoot":"","sources":["../../src/wakeSubscriptionEncoding.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,yBAAyB,EACzB,iBAAiB,EACjB,yBAAyB,EACzB,yBAAyB,EAC1B,MAAM,gCAAgC,CAAA;AA0BvC;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,YAAY,EAAE,yBAAyB,GAAG,yBAAyB,EACnE,UAAU,EAAE,iBAAiB,GAC5B,UAAU,CAsBZ;AAED,uFAAuF;AACvF,wBAAgB,8BAA8B,CAAC,SAAS,EAAE,yBAAyB,GAAG,UAAU,CAO/F;AAED,yFAAyF;AACzF,wBAAgB,kCAAkC,CAAC,OAAO,EAAE,UAAU,GAAG,yBAAyB,CAUjG"}

package/dist/neutral/wakeSubscriptionHpke.d.ts

@@ -0,0 +1,52 @@
+import type { Base64Url32Bytes, EncryptedWakeSubscription, HandshakeId, Hash, NormalizedAddress, WakeSubscriptionCleartext, WakeSubscriptionPlaintext } from '@xyo-network/event-kit-schemas';
+export interface WakeSubscriptionEncryptionKeyPair {
+    /** Raw 32-byte X25519 private key encoded as canonical unpadded base64url. */
+    privateKey: Base64Url32Bytes;
+    /** Raw 32-byte X25519 public key encoded as canonical unpadded base64url. */
+    publicKey: Base64Url32Bytes;
+}
+export interface WakeSubscriptionPublicKey {
+    /** Canonical hash of the publisher-authored key descriptor. */
+    encryptionKey: Hash;
+    /** Stable key identifier copied from that descriptor. */
+    keyId: HandshakeId;
+    /** Raw X25519 public key from that descriptor. */
+    publicKey: Base64Url32Bytes;
+}
+export interface WakeSubscriptionPrivateKey {
+    /** Canonical hash of the publisher-authored key descriptor. */
+    encryptionKey: Hash;
+    /** Stable key identifier copied from that descriptor. */
+    keyId: HandshakeId;
+    /** Raw X25519 private key held off-chain by the publisher. */
+    privateKey: Base64Url32Bytes;
+}
+export interface EncryptWakeSubscriptionInput {
+    plaintext: WakeSubscriptionPlaintext;
+    publisherKey: WakeSubscriptionPublicKey;
+    subscriber: NormalizedAddress;
+    subscription: WakeSubscriptionCleartext;
+}
+export interface DecryptWakeSubscriptionInput {
+    publisherKey: WakeSubscriptionPrivateKey;
+    subscriber: NormalizedAddress;
+    subscription: EncryptedWakeSubscription;
+}
+/** Deliberately carries no low-level cause that could become a decryption oracle. */
+export declare class WakeSubscriptionDecryptionError extends Error {
+    readonly name = "WakeSubscriptionDecryptionError";
+    constructor();
+}
+/** Generate a dedicated X25519 encryption key; never reuse the publisher signing key. */
+export declare function generateWakeSubscriptionEncryptionKeyPair(): Promise<WakeSubscriptionEncryptionKeyPair>;
+/**
+ * One-shot RFC 9180 Base-mode encryption with X25519/HKDF-SHA256/AES-128-GCM.
+ * Ephemeral key material is always generated inside the HPKE implementation.
+ */
+export declare function encryptWakeSubscription(input: EncryptWakeSubscriptionInput): Promise<EncryptedWakeSubscription>;
+/**
+ * One-shot decryption. All malformed inputs, key mismatches, authentication
+ * failures, and noncanonical plaintexts collapse to the same public error.
+ */
+export declare function decryptWakeSubscription(input: DecryptWakeSubscriptionInput): Promise<WakeSubscriptionPlaintext>;
+//# sourceMappingURL=wakeSubscriptionHpke.d.ts.map

package/dist/neutral/wakeSubscriptionHpke.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wakeSubscriptionHpke.d.ts","sourceRoot":"","sources":["../../src/wakeSubscriptionHpke.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EACV,gBAAgB,EAChB,yBAAyB,EACzB,WAAW,EACX,IAAI,EACJ,iBAAiB,EACjB,yBAAyB,EACzB,yBAAyB,EAC1B,MAAM,gCAAgC,CAAA;AA0CvC,MAAM,WAAW,iCAAiC;IAChD,8EAA8E;IAC9E,UAAU,EAAE,gBAAgB,CAAA;IAC5B,6EAA6E;IAC7E,SAAS,EAAE,gBAAgB,CAAA;CAC5B;AAED,MAAM,WAAW,yBAAyB;IACxC,+DAA+D;IAC/D,aAAa,EAAE,IAAI,CAAA;IACnB,yDAAyD;IACzD,KAAK,EAAE,WAAW,CAAA;IAClB,kDAAkD;IAClD,SAAS,EAAE,gBAAgB,CAAA;CAC5B;AAED,MAAM,WAAW,0BAA0B;IACzC,+DAA+D;IAC/D,aAAa,EAAE,IAAI,CAAA;IACnB,yDAAyD;IACzD,KAAK,EAAE,WAAW,CAAA;IAClB,8DAA8D;IAC9D,UAAU,EAAE,gBAAgB,CAAA;CAC7B;AAED,MAAM,WAAW,4BAA4B;IAC3C,SAAS,EAAE,yBAAyB,CAAA;IACpC,YAAY,EAAE,yBAAyB,CAAA;IACvC,UAAU,EAAE,iBAAiB,CAAA;IAC7B,YAAY,EAAE,yBAAyB,CAAA;CACxC;AAED,MAAM,WAAW,4BAA4B;IAC3C,YAAY,EAAE,0BAA0B,CAAA;IACxC,UAAU,EAAE,iBAAiB,CAAA;IAC7B,YAAY,EAAE,yBAAyB,CAAA;CACxC;AAED,qFAAqF;AACrF,qBAAa,+BAAgC,SAAQ,KAAK;IACxD,SAAkB,IAAI,qCAAoC;;CAK3D;AAwBD,yFAAyF;AACzF,wBAAsB,yCAAyC,IAAI,OAAO,CAAC,iCAAiC,CAAC,CAW5G;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,4BAA4B,GAClC,OAAO,CAAC,yBAAyB,CAAC,CA0BpC;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,4BAA4B,GAClC,OAAO,CAAC,yBAAyB,CAAC,CAwBpC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xyo-network/event-kit-protocol",
-  "version": "0.0.1",
+  "version": "0.1.1",
   "description": "Wallet-JWT Payload verification and admission contracts for XL1 Event Kit",
   "keywords": [
     "xyo",
@@ -17,7 +17,7 @@
     "url": "git+https://github.com/XYOracleNetwork/event-kit.git",
     "directory": "packages/protocol"
   },
-  "license": "UNLICENSED",
+  "license": "LGPL-3.0-only",
   "sideEffects": false,
   "type": "module",
   "exports": {
@@ -33,27 +33,28 @@
     "README.md"
   ],
   "dependencies": {
-    "@xyo-network/event-kit-schemas": "~0.0.1"
+    "@hpke/core": "~1.9.0",
+    "@xyo-network/event-kit-schemas": "~0.1.1"
   },
   "devDependencies": {
     "@ariestools/sdk": "~8.1.9",
-    "@ariestools/toolchain": "~9.1.0",
-    "@ariestools/tsconfig": "~9.1.0",
+    "@ariestools/toolchain": "~9.1.2",
+    "@ariestools/tsconfig": "~9.1.2",
     "@opentelemetry/api": "~1.9.1",
-    "@xyo-network/sdk": "~7.2.3",
-    "@xyo-network/sdk-protocol": "~7.2.4",
-    "eslint": "~10.8.1",
+    "@xyo-network/sdk": "~7.3.1",
+    "@xyo-network/sdk-protocol": "~7.3.3",
+    "eslint": "~10.9.1",
     "eslint-import-resolver-typescript": "~4.4.5",
     "typescript": "~6.0.3",
-    "vite": "~8.2.1",
+    "vite": "~8.2.2",
     "vitest": "~4.1.11",
     "zod": "~4.4.3"
   },
   "peerDependencies": {
     "@ariestools/sdk": "^8.1",
     "@opentelemetry/api": "^1.9",
-    "@xyo-network/sdk": "^7.2",
-    "@xyo-network/sdk-protocol": "^7.2",
+    "@xyo-network/sdk": "^7.3",
+    "@xyo-network/sdk-protocol": "^7.3",
     "zod": "^4.4"
   },
   "engines": {