@xyo-network/event-kit-protocol 0.0.1

package/dist/neutral/index.mjs

@@ -0,0 +1,802 @@
+// src/admissionTypes.ts
+var EVENT_KIT_REPLAY_RETENTION_SKEW_SECONDS = 60;
+
+// src/admitAndEnqueue.ts
+async function admitAndEnqueue(input) {
+  const attemptResult = createAttempt(input.verified);
+  if (!attemptResult.ok) return attemptResult.failure;
+  const { attempt } = attemptResult;
+  const wake = toAdmittedWake(input.verified);
+  const prior = await resolvePriorAttempt(input.inbox, attempt, wake);
+  if (!prior.pending) return prior.result;
+  if (!isNonnegativeSafeInteger(input.expectedHead)) {
+    return reject("grant-view-invalid", ["expectedHead must be a nonnegative safe integer"]);
+  }
+  const authorization = await authorize(input);
+  if (!authorization.ok) return authorization.failure;
+  return await commitAuthorizedWake(input.inbox, attempt, authorization.grant, wake);
+}
+async function resolvePriorAttempt(inbox, attempt, wake) {
+  let resolution;
+  try {
+    resolution = await inbox.resolveAttempt(attempt);
+  } catch (error) {
+    return completed(reject("inbox-unavailable", [errorMessage(error)]));
+  }
+  if (!isRecord(resolution) || typeof resolution.kind !== "string") {
+    return completed(reject("inbox-unavailable", ["inbox returned an invalid attempt resolution"]));
+  }
+  if (resolution.kind === "jwt-id-collision" || resolution.kind === "wake-id-collision") {
+    return completed(reject(resolution.kind));
+  }
+  if (resolution.kind === "duplicate") {
+    const receiptFailure = validateReceipt(resolution.receipt, attempt);
+    return completed(receiptFailure ?? success("duplicate", snapshotReceipt(resolution.receipt), wake));
+  }
+  if (resolution.kind !== "new") {
+    return completed(reject("inbox-unavailable", ["inbox returned an unknown attempt resolution"]));
+  }
+  return Object.freeze({ pending: true });
+}
+async function commitAuthorizedWake(inbox, attempt, grant, wake) {
+  let committed;
+  try {
+    committed = await inbox.commitAuthorized({
+      attempt,
+      grant,
+      wake
+    });
+  } catch (error) {
+    return reject("inbox-unavailable", [errorMessage(error)]);
+  }
+  if (!isRecord(committed) || typeof committed.kind !== "string") {
+    return reject("inbox-unavailable", ["inbox returned an invalid commit result"]);
+  }
+  if (committed.kind === "jwt-id-collision" || committed.kind === "wake-id-collision") {
+    return reject(committed.kind);
+  }
+  if (committed.kind !== "duplicate" && committed.kind !== "enqueued") {
+    return reject("inbox-unavailable", ["inbox returned an unknown commit result"]);
+  }
+  const receiptFailure = validateReceipt(committed.receipt, attempt);
+  if (receiptFailure !== void 0) return receiptFailure;
+  return success(committed.kind, snapshotReceipt(committed.receipt), wake);
+}
+function completed(result) {
+  return Object.freeze({ pending: false, result });
+}
+function createAttempt(verified) {
+  if (verified.expiresAt > Number.MAX_SAFE_INTEGER - EVENT_KIT_REPLAY_RETENTION_SKEW_SECONDS) {
+    return {
+      failure: reject("inbox-unavailable", ["JWT expiry cannot be represented through the replay-retention window"]),
+      ok: false
+    };
+  }
+  return {
+    attempt: Object.freeze({
+      audience: verified.audience,
+      eventHash: verified.eventHash,
+      jwtId: verified.jwtId,
+      publisher: verified.publisher,
+      retainJwtUntil: verified.expiresAt + EVENT_KIT_REPLAY_RETENTION_SKEW_SECONDS,
+      wakeId: verified.wakeId
+    }),
+    ok: true
+  };
+}
+async function authorize(input) {
+  const { route } = input.verified;
+  let decision;
+  try {
+    decision = await input.grants.authorizePublisher({
+      controller: route.controller,
+      deploymentId: route.deploymentId,
+      expectedHead: input.expectedHead,
+      publisher: input.verified.publisher,
+      ...route.queueId === void 0 ? {} : { queueId: route.queueId }
+    });
+  } catch (error) {
+    return { failure: reject("grant-unavailable", [errorMessage(error)]), ok: false };
+  }
+  const viewFailure = validateGrantView(decision, input.expectedHead, route.maxGrantLagBlocks);
+  if (viewFailure !== void 0) return { failure: viewFailure, ok: false };
+  if (!decision.enabled) return { failure: reject("grant-missing"), ok: false };
+  const evidenceFailure = validateGrantEvidence(decision.grant, input.verified, decision.atBlock);
+  if (evidenceFailure !== void 0) return { failure: evidenceFailure, ok: false };
+  const grant = Object.freeze({
+    atBlock: decision.atBlock,
+    expectedHead: input.expectedHead,
+    grant: snapshotGrantEvidence(decision.grant),
+    lag: input.expectedHead - decision.atBlock
+  });
+  return { grant, ok: true };
+}
+function validateGrantView(decision, expectedHead, maxGrantLagBlocks) {
+  if (!isRecord(decision) || !Object.hasOwn(decision, "enabled") || typeof decision.enabled !== "boolean" || !Object.hasOwn(decision, "atBlock")) {
+    return reject("grant-view-invalid", ["grant authorizer returned an invalid decision"]);
+  }
+  if (!isNonnegativeSafeInteger(decision.atBlock)) {
+    return reject("grant-view-invalid", ["grant atBlock must be a nonnegative safe integer"]);
+  }
+  if (decision.atBlock > expectedHead) {
+    return reject("grant-view-invalid", ["grant view is ahead of the trusted finalized head"]);
+  }
+  const lag = expectedHead - decision.atBlock;
+  if (decision.expectedHead !== void 0 && decision.expectedHead !== expectedHead) {
+    return reject("grant-view-invalid", ["grant diagnostic expectedHead disagrees with the trusted head"]);
+  }
+  if (decision.lag !== void 0 && decision.lag !== lag) {
+    return reject("grant-view-invalid", ["grant diagnostic lag disagrees with the recomputed lag"]);
+  }
+  if (lag > maxGrantLagBlocks) {
+    return reject("grant-view-stale", [`grantLag=${lag} max=${maxGrantLagBlocks}`]);
+  }
+  return void 0;
+}
+function validateGrantEvidence(evidence, verified, atBlock) {
+  if (!isRecord(evidence)) return reject("grant-view-invalid", ["enabled grant decision omitted evidence"]);
+  const requiredFields = [
+    "assertedAtBlock",
+    "controller",
+    "deploymentId",
+    "id",
+    "target"
+  ];
+  if (requiredFields.some((field) => !Object.hasOwn(evidence, field))) {
+    return reject("grant-view-invalid", ["enabled grant evidence requires own canonical fields"]);
+  }
+  if (typeof evidence.id !== "string" || evidence.id.length === 0) {
+    return reject("grant-view-invalid", ["enabled grant evidence requires a non-empty id"]);
+  }
+  if (!isNonnegativeSafeInteger(evidence.assertedAtBlock) || evidence.assertedAtBlock > atBlock) {
+    return reject("grant-view-invalid", ["grant assertion block must be at or before the evaluated snapshot"]);
+  }
+  if (evidence.controller !== verified.route.controller) {
+    return reject("grant-view-invalid", ["grant controller does not match the configured controller"]);
+  }
+  if (evidence.target !== verified.publisher) {
+    return reject("grant-view-invalid", ["grant target does not match the verified publisher"]);
+  }
+  const evidenceHasQueue = Object.hasOwn(evidence, "queueId");
+  const routeHasQueue = Object.hasOwn(verified.route, "queueId");
+  if (evidence.deploymentId !== verified.route.deploymentId || evidenceHasQueue !== routeHasQueue || evidence.queueId !== verified.route.queueId) {
+    return reject("grant-view-invalid", ["grant scope does not exactly match the configured route"]);
+  }
+  return void 0;
+}
+function validateReceipt(receipt, attempt) {
+  const requiredFields = [
+    "audience",
+    "eventHash",
+    "id",
+    "publisher",
+    "wakeId"
+  ];
+  if (!isRecord(receipt) || requiredFields.some((field) => !Object.hasOwn(receipt, field)) || typeof receipt.id !== "string" || receipt.id.length === 0) {
+    return reject("inbox-unavailable", ["inbox returned an invalid receipt"]);
+  }
+  if (receipt.audience !== attempt.audience || receipt.publisher !== attempt.publisher || receipt.eventHash !== attempt.eventHash || receipt.wakeId !== attempt.wakeId) {
+    return reject("inbox-unavailable", ["inbox receipt is not bound to the verified attempt"]);
+  }
+  return void 0;
+}
+function snapshotGrantEvidence(evidence) {
+  return Object.freeze({
+    assertedAtBlock: evidence.assertedAtBlock,
+    controller: evidence.controller,
+    deploymentId: evidence.deploymentId,
+    id: evidence.id,
+    ...evidence.queueId === void 0 ? {} : { queueId: evidence.queueId },
+    target: evidence.target
+  });
+}
+function snapshotReceipt(receipt) {
+  return Object.freeze({
+    audience: receipt.audience,
+    eventHash: receipt.eventHash,
+    id: receipt.id,
+    publisher: receipt.publisher,
+    wakeId: receipt.wakeId
+  });
+}
+function toAdmittedWake(verified) {
+  return Object.freeze({
+    audience: verified.audience,
+    deploymentId: verified.deploymentId,
+    event: verified.event,
+    eventHash: verified.eventHash,
+    fromBlock: verified.fromBlock,
+    jti: verified.jwtId,
+    publisher: verified.publisher,
+    ...verified.queueId === void 0 ? {} : { queueId: verified.queueId },
+    toBlock: verified.toBlock,
+    wakeId: verified.wakeId
+  });
+}
+function success(disposition, receipt, wake) {
+  return Object.freeze({
+    disposition,
+    ok: true,
+    receipt,
+    wake
+  });
+}
+function reject(reason, details) {
+  if (details === void 0) return Object.freeze({ ok: false, reason });
+  return Object.freeze({
+    details: Object.freeze([...details]),
+    ok: false,
+    reason
+  });
+}
+function isNonnegativeSafeInteger(value) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function errorMessage(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+
+// src/memoryStatementGrantGraph.ts
+import {
+  normalizeAddress,
+  WakeGrantObjectSchema,
+  WakeGrantRevocationSchema
+} from "@xyo-network/event-kit-schemas";
+function createMemoryStatementGrantGraph(initialHead = 0) {
+  let head = initialHead;
+  const claims = /* @__PURE__ */ new Map();
+  const objects = /* @__PURE__ */ new Map();
+  function claimKey(source, objectHash) {
+    return `${normalizeAddress(source)}|${objectHash}`;
+  }
+  function materialize(input) {
+    const source = normalizeAddress(input.source);
+    objects.set(input.objectHash, Object.freeze({
+      assurance: "resolved",
+      declaredSchema: input.declaredSchema,
+      objectHash: input.objectHash,
+      params: Object.freeze({ ...input.params })
+    }));
+    const key = claimKey(source, input.objectHash);
+    const existing = claims.get(key);
+    claims.set(key, Object.freeze(existing === void 0 ? {
+      declaredObjectSchema: input.declaredSchema,
+      firstBlock: input.block,
+      firstEventHash: input.eventHash,
+      lastBlock: input.block,
+      objectHash: input.objectHash,
+      source
+    } : { ...existing, lastBlock: Math.max(existing.lastBlock, input.block) }));
+    if (input.block > head) head = input.block;
+  }
+  return {
+    async head() {
+      return head;
+    },
+    setHead(block) {
+      head = block;
+    },
+    async claims(source, query) {
+      const normalizedSource = normalizeAddress(source);
+      const records = [];
+      for (const record of claims.values()) {
+        if (record.source !== normalizedSource) continue;
+        if (query?.objectHash !== void 0 && record.objectHash !== query.objectHash) continue;
+        if (query?.declaredObjectSchemaPrefix !== void 0 && !record.declaredObjectSchema.startsWith(query.declaredObjectSchemaPrefix)) {
+          continue;
+        }
+        records.push(record);
+      }
+      return records;
+    },
+    async object(objectHash) {
+      return objects.get(objectHash);
+    },
+    claim(input) {
+      if (input.grant.schema !== WakeGrantObjectSchema) {
+        throw new Error(`expected ${WakeGrantObjectSchema}`);
+      }
+      const { schema: _schema, ...params } = input.grant;
+      materialize({
+        block: input.block,
+        declaredSchema: WakeGrantObjectSchema,
+        eventHash: input.eventHash,
+        objectHash: input.objectHash,
+        params: {
+          ...params,
+          permissions: Object.freeze([...params.permissions])
+        },
+        source: input.source
+      });
+    },
+    revoke(input) {
+      const revocation = { grant: input.grantObjectHash };
+      materialize({
+        block: input.block,
+        declaredSchema: WakeGrantRevocationSchema,
+        eventHash: input.eventHash,
+        objectHash: input.objectHash,
+        params: revocation,
+        source: input.source
+      });
+    }
+  };
+}
+
+// src/memoryWakeInbox.ts
+function createMemoryWakeInbox(options = {}) {
+  const tokenRecords = /* @__PURE__ */ new Map();
+  const wakeRecords = /* @__PURE__ */ new Map();
+  const queued = [];
+  let receiptSequence = 0;
+  let tail = Promise.resolve();
+  function exclusive(work) {
+    const run = tail.then(work, work);
+    tail = Promise.allSettled([run]);
+    return run;
+  }
+  function pruneExpiredTokens() {
+    const { nowSeconds } = options;
+    if (nowSeconds === void 0) return;
+    const now = nowSeconds();
+    for (const [key, binding] of tokenRecords) {
+      if (binding.retainJwtUntil <= now) tokenRecords.delete(key);
+    }
+  }
+  function matchRecorded(attempt) {
+    const tokenBinding = tokenRecords.get(tokenKey(attempt));
+    if (tokenBinding !== void 0) {
+      return tokenBinding.eventHash === attempt.eventHash && tokenBinding.wakeId === attempt.wakeId ? { kind: "duplicate", receipt: tokenBinding.receipt } : { kind: "jwt-id-collision" };
+    }
+    const wakeBinding = wakeRecords.get(wakeKey(attempt));
+    if (wakeBinding === void 0) return void 0;
+    if (wakeBinding.eventHash !== attempt.eventHash) return { kind: "wake-id-collision" };
+    tokenRecords.set(tokenKey(attempt), { ...wakeBinding, retainJwtUntil: attempt.retainJwtUntil });
+    return { kind: "duplicate", receipt: wakeBinding.receipt };
+  }
+  return {
+    get queued() {
+      return queued;
+    },
+    get tokenRecordCount() {
+      return tokenRecords.size;
+    },
+    get wakeRecordCount() {
+      return wakeRecords.size;
+    },
+    async resolveAttempt(attempt) {
+      return await exclusive(async () => {
+        pruneExpiredTokens();
+        return matchRecorded(attempt) ?? { kind: "new" };
+      });
+    },
+    async commitAuthorized({ attempt, wake }) {
+      return await exclusive(async () => {
+        pruneExpiredTokens();
+        const recorded = matchRecorded(attempt);
+        if (recorded !== void 0) return recorded;
+        const receipt = Object.freeze({
+          audience: attempt.audience,
+          eventHash: attempt.eventHash,
+          id: `receipt-${receiptSequence += 1}`,
+          publisher: attempt.publisher,
+          wakeId: attempt.wakeId
+        });
+        await options.enqueue?.(wake);
+        queued.push(wake);
+        const binding = {
+          eventHash: attempt.eventHash,
+          receipt,
+          wakeId: attempt.wakeId
+        };
+        tokenRecords.set(tokenKey(attempt), { ...binding, retainJwtUntil: attempt.retainJwtUntil });
+        wakeRecords.set(wakeKey(attempt), binding);
+        return { kind: "enqueued", receipt };
+      });
+    }
+  };
+}
+function tokenKey(attempt) {
+  return JSON.stringify([attempt.audience, attempt.publisher, attempt.jwtId]);
+}
+function wakeKey(attempt) {
+  return JSON.stringify([attempt.audience, attempt.publisher, attempt.wakeId]);
+}
+
+// src/memoryWakeQueue.ts
+function createMemoryWakeQueue() {
+  const pending = [];
+  const inflight = /* @__PURE__ */ new Map();
+  let sequence = 0;
+  return {
+    async append(wake) {
+      pending.push({ sequence: sequence += 1, wake });
+    },
+    async claim() {
+      const entry = pending.shift();
+      if (entry === void 0) return void 0;
+      inflight.set(entry.sequence, entry);
+      return {
+        wake: entry.wake,
+        async ack() {
+          inflight.delete(entry.sequence);
+        },
+        async release() {
+          if (!inflight.delete(entry.sequence)) return;
+          pending.push(entry);
+          pending.sort((left, right) => left.sequence - right.sequence);
+        }
+      };
+    },
+    async inflightCount() {
+      return inflight.size;
+    },
+    async pendingCount() {
+      return pending.length;
+    },
+    async recoverInflight() {
+      const recovered = inflight.size;
+      for (const entry of inflight.values()) pending.push(entry);
+      inflight.clear();
+      pending.sort((left, right) => left.sequence - right.sequence);
+      return recovered;
+    }
+  };
+}
+
+// src/statementGraphWakeGrantAuthorizer.ts
+import {
+  asWakeGrantObject,
+  asWakeGrantRevocation,
+  DeploymentIdZod,
+  HashZod,
+  NormalizedAddressZod,
+  WakeGrantObjectSchema as WakeGrantObjectSchema2,
+  WakeGrantRevocationSchema as WakeGrantRevocationSchema2
+} from "@xyo-network/event-kit-schemas";
+function createStatementGraphWakeGrantAuthorizer(options) {
+  const { viewer } = options;
+  return Object.freeze({
+    async authorizePublisher(request) {
+      assertValidRequest(request);
+      const atBlock = await readHead(viewer);
+      if (atBlock > request.expectedHead) {
+        throw new Error(`Statement Graph head ${atBlock} is ahead of expected head ${request.expectedHead}`);
+      }
+      const claims = await viewer.claims(request.controller, { declaredObjectSchemaPrefix: WakeGrantObjectSchema2 });
+      const revokedGrantHashes = await readRevocations(viewer, request.controller, atBlock);
+      let evidence;
+      for (const claim of claims) {
+        evidence = await resolveEvidence(viewer, claim, request, atBlock, revokedGrantHashes);
+        if (evidence !== void 0) break;
+      }
+      const completedAtBlock = await readHead(viewer);
+      if (completedAtBlock !== atBlock) {
+        throw new Error(`Statement Graph head changed during authorization [${atBlock} -> ${completedAtBlock}]`);
+      }
+      const lag = request.expectedHead - atBlock;
+      if (evidence === void 0) {
+        return Object.freeze({
+          atBlock,
+          enabled: false,
+          expectedHead: request.expectedHead,
+          lag
+        });
+      }
+      return Object.freeze({
+        atBlock,
+        enabled: true,
+        expectedHead: request.expectedHead,
+        grant: evidence,
+        lag
+      });
+    }
+  });
+}
+async function readRevocations(viewer, controller, atBlock) {
+  const revoked = /* @__PURE__ */ new Set();
+  const claims = await viewer.claims(controller, { declaredObjectSchemaPrefix: WakeGrantRevocationSchema2 });
+  for (const claim of claims) {
+    if (!isLiveClaim(claim, controller, WakeGrantRevocationSchema2, atBlock)) continue;
+    const object = await viewer.object(claim.objectHash);
+    if (object?.assurance !== "resolved") continue;
+    if (object.declaredSchema !== WakeGrantRevocationSchema2 || object.objectHash !== claim.objectHash) continue;
+    if (!isRecord2(object.params) || Object.hasOwn(object.params, "schema")) continue;
+    const revocation = asWakeGrantRevocation({ ...object.params, schema: object.declaredSchema });
+    if (revocation !== void 0) revoked.add(revocation.grant);
+  }
+  return revoked;
+}
+async function resolveEvidence(viewer, claim, request, atBlock, revokedGrantHashes) {
+  if (!isLiveClaim(claim, request.controller, WakeGrantObjectSchema2, atBlock)) return void 0;
+  if (revokedGrantHashes.has(claim.objectHash)) return void 0;
+  const object = await viewer.object(claim.objectHash);
+  const grant = parseExactGrantObject(object, claim.objectHash);
+  if (grant === void 0) return void 0;
+  if (grant.publisher !== request.publisher) return void 0;
+  if (grant.deploymentId !== request.deploymentId) return void 0;
+  if (grant.queueId !== request.queueId) return void 0;
+  if (!grant.permissions.includes("enqueue")) return void 0;
+  return Object.freeze({
+    assertedAtBlock: claim.firstBlock,
+    controller: request.controller,
+    deploymentId: grant.deploymentId,
+    id: claim.firstEventHash,
+    ...grant.queueId === void 0 ? {} : { queueId: grant.queueId },
+    target: grant.publisher
+  });
+}
+function isLiveClaim(claim, controller, declaredObjectSchema, atBlock) {
+  if (claim.source !== controller) return false;
+  if (claim.declaredObjectSchema !== declaredObjectSchema) return false;
+  if (!isNonnegativeSafeInteger2(claim.firstBlock) || claim.firstBlock > atBlock) return false;
+  if (!isNonnegativeSafeInteger2(claim.lastBlock) || claim.lastBlock < claim.firstBlock) return false;
+  if (!HashZod.safeParse(claim.firstEventHash).success) return false;
+  return HashZod.safeParse(claim.objectHash).success;
+}
+function parseExactGrantObject(object, expectedObjectHash) {
+  if (object?.assurance !== "resolved") return void 0;
+  if (object.declaredSchema !== WakeGrantObjectSchema2 || object.objectHash !== expectedObjectHash) return void 0;
+  if (!isRecord2(object.params) || Object.hasOwn(object.params, "schema")) return void 0;
+  return asWakeGrantObject({
+    ...object.params,
+    schema: object.declaredSchema
+  });
+}
+function assertValidRequest(request) {
+  if (!NormalizedAddressZod.safeParse(request.controller).success) {
+    throw new TypeError("Grant controller must be a normalized address");
+  }
+  if (!NormalizedAddressZod.safeParse(request.publisher).success) {
+    throw new TypeError("Grant publisher must be a normalized address");
+  }
+  if (!DeploymentIdZod.safeParse(request.deploymentId).success) {
+    throw new TypeError("Grant deploymentId must contain 1 to 255 characters");
+  }
+  if (request.queueId !== void 0 && (request.queueId.length === 0 || request.queueId.length > 255)) {
+    throw new TypeError("Grant queueId must contain 1 to 255 characters when configured");
+  }
+  if (!isNonnegativeSafeInteger2(request.expectedHead)) {
+    throw new RangeError("Grant expectedHead must be a nonnegative safe integer");
+  }
+}
+async function readHead(viewer) {
+  const head = await viewer.head();
+  if (!isNonnegativeSafeInteger2(head)) {
+    throw new RangeError("Statement Graph head must be a nonnegative safe integer");
+  }
+  return head;
+}
+function isNonnegativeSafeInteger2(value) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+// src/verifyWakeRequest.ts
+import {
+  DeploymentIdZod as DeploymentIdZod2,
+  NormalizedAddressZod as NormalizedAddressZod2,
+  WakeEnvelopeZod,
+  WakeIdRegExp,
+  WakeJwtAudienceZod,
+  WakeJwtHeaderZod,
+  WakeJwtPayloadZod,
+  WakeJwtSchema
+} from "@xyo-network/event-kit-schemas";
+import { Account, PayloadBuilder } from "@xyo-network/sdk";
+var EVENT_KIT_MAX_JWT_LIFETIME_SECONDS = 300;
+var EVENT_KIT_MAX_FUTURE_IAT_SECONDS = 60;
+async function verifyWakeRequest(input) {
+  const { nowSeconds } = input;
+  const route = snapshotRoute(input.route);
+  const configurationFailure = validateConfiguration(route, nowSeconds);
+  if (configurationFailure !== void 0) return configurationFailure;
+  const parsed = WakeEnvelopeZod.safeParse(input.body);
+  if (!parsed.success) {
+    const details = parsed.error.issues.map((issue) => `${issue.path.join(".") || "<root>"}: ${issue.message}`);
+    if (hasInvertedSafeRange(input.body)) return reject2("range-invalid", details);
+    if (isRecord3(input.body) && Object.hasOwn(input.body, "wakeId") && parsed.error.issues.some((issue) => issue.path[0] === "wakeId")) {
+      return reject2("wake-id-invalid", details);
+    }
+    return reject2(
+      "event-malformed",
+      details
+    );
+  }
+  const event = parsed.data;
+  if (!WakeIdRegExp.test(event.wakeId)) return reject2("wake-id-invalid");
+  if (!hasSafeEventNumbers(event)) return reject2("event-malformed", ["wake numeric fields must be nonnegative safe integers"]);
+  if (event.deploymentId !== route.deploymentId || event.queueId !== route.queueId) {
+    return reject2("event-target-mismatch");
+  }
+  if (event.fromBlock > event.toBlock) return reject2("range-invalid");
+  if (event.toBlock - event.fromBlock >= route.maxBlocksPerWake) {
+    return reject2("range-too-large", [`maxBlocksPerWake=${route.maxBlocksPerWake}`]);
+  }
+  const jwtResult = await verifyJwtProfile(input.jwt, route.audience, nowSeconds);
+  if (!jwtResult.ok) return jwtResult;
+  let eventHash;
+  try {
+    eventHash = await PayloadBuilder.dataHash(event);
+  } catch (error) {
+    return reject2("event-hash-failed", [errorMessage2(error)]);
+  }
+  if (eventHash !== jwtResult.jwt.eventHash) return reject2("event-hash-mismatch");
+  const frozenEvent = Object.freeze({ ...event });
+  const verified = Object.freeze({
+    audience: route.audience,
+    deploymentId: event.deploymentId,
+    event: frozenEvent,
+    eventHash,
+    expiresAt: jwtResult.jwt.expiresAt,
+    fromBlock: event.fromBlock,
+    issuedAt: event.issuedAt,
+    jwtId: jwtResult.jwt.jwtId,
+    publisher: jwtResult.jwt.publisher,
+    ...event.queueId === void 0 ? {} : { queueId: event.queueId },
+    route,
+    toBlock: event.toBlock,
+    tokenIssuedAt: jwtResult.jwt.issuedAt,
+    wakeId: event.wakeId
+  });
+  return Object.freeze({ ok: true, verified });
+}
+function validateConfiguration(route, nowSeconds) {
+  if (!WakeJwtAudienceZod.safeParse(route.audience).success) {
+    return reject2("configuration-invalid", ["audience must not be empty"]);
+  }
+  if (!DeploymentIdZod2.safeParse(route.deploymentId).success) {
+    return reject2("configuration-invalid", ["deploymentId must contain 1 to 255 characters"]);
+  }
+  if (route.queueId !== void 0 && (route.queueId.length === 0 || route.queueId.length > 255)) {
+    return reject2("configuration-invalid", ["queueId must contain 1 to 255 characters when configured"]);
+  }
+  if (!NormalizedAddressZod2.safeParse(route.controller).success) {
+    return reject2("configuration-invalid", ["controller must be a normalized 40-character lowercase-hex address"]);
+  }
+  if (!isNonnegativeSafeInteger3(nowSeconds)) {
+    return reject2("configuration-invalid", ["nowSeconds must be a nonnegative safe integer"]);
+  }
+  if (!Number.isSafeInteger(route.maxBlocksPerWake) || route.maxBlocksPerWake < 1) {
+    return reject2("configuration-invalid", ["maxBlocksPerWake must be a positive safe integer"]);
+  }
+  if (!isNonnegativeSafeInteger3(route.maxGrantLagBlocks)) {
+    return reject2("configuration-invalid", ["maxGrantLagBlocks must be a nonnegative safe integer"]);
+  }
+  return void 0;
+}
+async function verifyJwtProfile(token, audience, nowSeconds) {
+  let verified;
+  try {
+    verified = await Account.verifyJwt(token, { audience, now: nowSeconds });
+  } catch (error) {
+    return reject2("jwt-malformed", [errorMessage2(error)]);
+  }
+  if (!verified.ok) {
+    if (Object.hasOwn(verified.payload ?? {}, "nbf")) return reject2("jwt-nbf-not-allowed");
+    return reject2(classifySdkJwtFailure(verified.reasons), verified.reasons);
+  }
+  const wireResult = parseStrictJwtWire(verified.header, verified.payload, audience);
+  if (!wireResult.ok) return wireResult;
+  const { header: strictHeader, payload: strictPayload } = wireResult;
+  if (strictHeader.kid !== strictPayload.iss) return reject2("jwt-identity-invalid");
+  if (strictPayload.exp <= nowSeconds) return reject2("jwt-expired");
+  if (strictPayload.exp - strictPayload.iat > EVENT_KIT_MAX_JWT_LIFETIME_SECONDS) return reject2("jwt-lifetime-invalid");
+  if (strictPayload.iat - nowSeconds > EVENT_KIT_MAX_FUTURE_IAT_SECONDS) return reject2("jwt-future-iat");
+  const jwt = Object.freeze({
+    eventHash: strictPayload.eventHash,
+    expiresAt: strictPayload.exp,
+    issuedAt: strictPayload.iat,
+    jwtId: strictPayload.jti,
+    publisher: strictPayload.iss
+  });
+  return Object.freeze({ jwt, ok: true });
+}
+function parseStrictJwtWire(header, payload, audience) {
+  const headerResult = WakeJwtHeaderZod.safeParse(header);
+  if (!headerResult.success) {
+    if (!NormalizedAddressZod2.safeParse(header.kid).success) return reject2("jwt-identity-invalid");
+    return reject2("jwt-header-invalid", zodDetails(headerResult.error.issues));
+  }
+  if (Object.hasOwn(payload, "nbf")) return reject2("jwt-nbf-not-allowed");
+  if (!NormalizedAddressZod2.safeParse(payload.iss).success) return reject2("jwt-identity-invalid");
+  if (payload.schema !== WakeJwtSchema) return reject2("jwt-schema-mismatch");
+  if (payload.aud !== audience) return reject2("jwt-audience-mismatch");
+  if (!isNonnegativeSafeInteger3(payload.iat) || !isNonnegativeSafeInteger3(payload.exp) || payload.exp <= payload.iat) {
+    return reject2("jwt-lifetime-invalid");
+  }
+  const payloadResult = WakeJwtPayloadZod.safeParse(payload);
+  if (!payloadResult.success) return reject2("jwt-claims-invalid", zodDetails(payloadResult.error.issues));
+  return Object.freeze({
+    header: headerResult.data,
+    ok: true,
+    payload: payloadResult.data
+  });
+}
+function classifySdkJwtFailure(reasons) {
+  if (reasons.some((reason) => reason.startsWith("audience mismatch:"))) return "jwt-audience-mismatch";
+  if (reasons.some((reason) => reason.startsWith("expired:"))) return "jwt-expired";
+  if (reasons.some((reason) => reason.startsWith("unsupported alg:") || reason.startsWith("unsupported typ:"))) {
+    return "jwt-header-invalid";
+  }
+  if (reasons.some((reason) => reason.startsWith("invalid public key:") || reason.startsWith("public key does not derive to kid:") || reason === "header.kid does not match payload.iss")) {
+    return "jwt-identity-invalid";
+  }
+  return "jwt-invalid";
+}
+function hasSafeEventNumbers(event) {
+  return isNonnegativeSafeInteger3(event.fromBlock) && isNonnegativeSafeInteger3(event.toBlock) && isNonnegativeSafeInteger3(event.issuedAt);
+}
+function hasInvertedSafeRange(value) {
+  if (!isRecord3(value)) return false;
+  const { fromBlock, toBlock } = value;
+  return typeof fromBlock === "number" && typeof toBlock === "number" && isNonnegativeSafeInteger3(fromBlock) && isNonnegativeSafeInteger3(toBlock) && fromBlock > toBlock;
+}
+function isNonnegativeSafeInteger3(value) {
+  return Number.isSafeInteger(value) && value >= 0;
+}
+function isRecord3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function snapshotRoute(route) {
+  return Object.freeze({
+    audience: route.audience,
+    controller: route.controller,
+    deploymentId: route.deploymentId,
+    maxBlocksPerWake: route.maxBlocksPerWake,
+    maxGrantLagBlocks: route.maxGrantLagBlocks,
+    ...route.queueId === void 0 ? {} : { queueId: route.queueId }
+  });
+}
+function zodDetails(issues) {
+  return issues.map((issue) => {
+    const path = issue.path.map(String).join(".") || "<root>";
+    return `${path}: ${issue.message}`;
+  });
+}
+function reject2(reason, details) {
+  if (details === void 0) return Object.freeze({ ok: false, reason });
+  return Object.freeze({
+    details: Object.freeze([...details]),
+    ok: false,
+    reason
+  });
+}
+function errorMessage2(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+
+// src/wakeQueue.ts
+async function drainQueue(queue, handler) {
+  let handled = 0;
+  for (; ; ) {
+    const leased = await queue.claim();
+    if (leased === void 0) return handled;
+    try {
+      await handler(leased.wake);
+    } catch (error) {
+      await leased.release();
+      throw error;
+    }
+    await leased.ack();
+    handled += 1;
+  }
+}
+export {
+  EVENT_KIT_MAX_FUTURE_IAT_SECONDS,
+  EVENT_KIT_MAX_JWT_LIFETIME_SECONDS,
+  EVENT_KIT_REPLAY_RETENTION_SKEW_SECONDS,
+  admitAndEnqueue,
+  createMemoryStatementGrantGraph,
+  createMemoryWakeInbox,
+  createMemoryWakeQueue,
+  createStatementGraphWakeGrantAuthorizer,
+  drainQueue,
+  verifyWakeRequest
+};
+//# sourceMappingURL=index.mjs.map