@xyo-network/event-kit-protocol 1.0.0 → 2.1.0

package/dist/neutral/index.mjs

@@ -12,9 +12,8 @@ async function admitVerifiedWake(input) {
   if (!isNonnegativeSafeInteger(input.expectedHead)) {
     return reject("grant-view-invalid", ["expectedHead must be a nonnegative safe integer"]);
   }
-  const authorization = await authorize(input);
-  if (!authorization.ok) return authorization.failure;
-  return await commitAuthorizedWake(input.inbox, attempt, authorization.grant, wake);
+  const authorization = await authorizeVerifiedWake(input);
+  return authorization.ok ? await commitAuthorizedWake(input.inbox, attempt, authorization.grant, wake) : authorization.failure;
 }
 async function resolvePriorAttempt(inbox, attempt, wake) {
   let resolution;
@@ -33,10 +32,7 @@ async function resolvePriorAttempt(inbox, attempt, wake) {
     const receiptFailure = validateReceipt(resolution.receipt, attempt);
     return completed(receiptFailure ?? success("duplicate", snapshotReceipt(resolution.receipt), wake));
   }
-  if (resolution.kind !== "new") {
-    return completed(reject("inbox-unavailable", ["inbox returned an unknown attempt resolution"]));
-  }
-  return Object.freeze({ pending: true });
+  return resolution.kind === "new" ? Object.freeze({ pending: true }) : completed(reject("inbox-unavailable", ["inbox returned an unknown attempt resolution"]));
 }
 async function commitAuthorizedWake(inbox, attempt, grant, wake) {
   let committed;
@@ -59,8 +55,7 @@ async function commitAuthorizedWake(inbox, attempt, grant, wake) {
     return reject("inbox-unavailable", ["inbox returned an unknown commit result"]);
   }
   const receiptFailure = validateReceipt(committed.receipt, attempt);
-  if (receiptFailure !== void 0) return receiptFailure;
-  return success(committed.kind, snapshotReceipt(committed.receipt), wake);
+  return receiptFailure ?? success(committed.kind, snapshotReceipt(committed.receipt), wake);
 }
 function completed(result) {
   return Object.freeze({ pending: false, result });
@@ -84,7 +79,7 @@ function createAttempt(verified) {
     ok: true
   };
 }
-async function authorize(input) {
+async function authorizeVerifiedWake(input) {
   const { route } = input.verified;
   let decision;
   try {
@@ -132,10 +127,7 @@ function validateGrantView(decision, expectedHead, maxGrantLagBlocks) {
   if (decision.lag !== void 0 && decision.lag !== lag) {
     return reject("grant-view-invalid", ["grant diagnostic lag disagrees with the recomputed lag"]);
   }
-  if (lag > maxGrantLagBlocks) {
-    return reject("grant-view-stale", [`grantLag=${lag} max=${maxGrantLagBlocks}`]);
-  }
-  return void 0;
+  return lag > maxGrantLagBlocks ? reject("grant-view-stale", [`grantLag=${lag} max=${maxGrantLagBlocks}`]) : void 0;
 }
 function validateGrantEvidence(evidence, verified, atBlock) {
   if (!isRecord(evidence)) return reject("grant-view-invalid", ["enabled grant decision omitted evidence"]);
@@ -170,10 +162,7 @@ function validateGrantEvidence(evidence, verified, atBlock) {
   }
   const evidenceHasQueue = Object.hasOwn(evidence, "queueId");
   const routeHasQueue = Object.hasOwn(verified.route, "queueId");
-  if (evidence.deploymentId !== verified.route.deploymentId || evidenceHasQueue !== routeHasQueue || evidence.queueId !== verified.route.queueId) {
-    return reject("grant-view-invalid", ["grant scope does not exactly match the configured route"]);
-  }
-  return void 0;
+  return evidence.deploymentId !== verified.route.deploymentId || evidenceHasQueue !== routeHasQueue || evidence.queueId !== verified.route.queueId ? reject("grant-view-invalid", ["grant scope does not exactly match the configured route"]) : void 0;
 }
 function validateReceipt(receipt, attempt) {
   const requiredFields = [
@@ -186,10 +175,7 @@ function validateReceipt(receipt, attempt) {
   if (!isRecord(receipt) || requiredFields.some((field) => !Object.hasOwn(receipt, field)) || typeof receipt.id !== "string" || receipt.id.length === 0) {
     return reject("inbox-unavailable", ["inbox returned an invalid receipt"]);
   }
-  if (receipt.audience !== attempt.audience || receipt.publisher !== attempt.publisher || receipt.eventHash !== attempt.eventHash || receipt.wakeId !== attempt.wakeId) {
-    return reject("inbox-unavailable", ["inbox receipt is not bound to the verified attempt"]);
-  }
-  return void 0;
+  return receipt.audience !== attempt.audience || receipt.publisher !== attempt.publisher || receipt.eventHash !== attempt.eventHash || receipt.wakeId !== attempt.wakeId ? reject("inbox-unavailable", ["inbox receipt is not bound to the verified attempt"]) : void 0;
 }
 function snapshotGrantEvidence(evidence) {
   return Object.freeze({
@@ -280,6 +266,7 @@ async function parseAdmittedWake(value) {
 // src/admitAndEnqueue.ts
 async function admitAndEnqueue(input) {
   const { verified } = input;
+  if (verified.route.deliveryMode !== "durable") throw new TypeError("Durable admission requires explicit durable delivery mode");
   const wake = AdmittedWakeZod.parse({
     audience: verified.audience,
     deploymentId: verified.deploymentId,
@@ -295,6 +282,53 @@ async function admitAndEnqueue(input) {
   return await admitVerifiedWake({ ...input, wake });
 }
 
+// src/bestEffortAdmission.ts
+import {
+  HashZod as HashZod3,
+  NonnegativeJsonSafeIntegerZod as NonnegativeJsonSafeIntegerZod3,
+  NormalizedAddressZod as NormalizedAddressZod3,
+  WakeIdZod as WakeIdZod2,
+  WakeJwtAudienceZod as WakeJwtAudienceZod3,
+  WakeJwtIdZod as WakeJwtIdZod2
+} from "@xyo-network/event-kit-schemas";
+import { z as z3 } from "zod";
+
+// src/verifyWakeRequest.ts
+import {
+  ChainIdZod,
+  DeploymentIdZod as DeploymentIdZod2,
+  HashZod as HashZod2,
+  MAX_POSITIONS_PER_SUBSCRIPTION_WAKE,
+  NonnegativeJsonSafeIntegerZod as NonnegativeJsonSafeIntegerZod2,
+  NormalizedAddressZod as NormalizedAddressZod2,
+  PositiveJsonSafeIntegerZod,
+  SOURCE_WAKE_FILTER_PROFILE,
+  validWakeDeliveryTerms,
+  WakeDeliveryTermsFields,
+  WakeEnvelopeZod as WakeEnvelopeZod2,
+  WakeJwtAudienceZod as WakeJwtAudienceZod2,
+  WakeJwtHeaderZod,
+  WakeJwtPayloadZod,
+  WakeJwtSchema,
+  WakeSourceZod as WakeSourceZod2
+} from "@xyo-network/event-kit-schemas";
+import {
+  Account,
+  PayloadBuilder as PayloadBuilder3
+} from "@xyo-network/sdk";
+import { z as z2 } from "zod";
+
+// src/sourceWakeIdentity.ts
+import {
+  SourceWakeSubscriptionFilterZod,
+  WakeSourceSchema,
+  WakeSourceZod
+} from "@xyo-network/event-kit-schemas";
+import {
+  asSchema,
+  PayloadBuilder as PayloadBuilder2
+} from "@xyo-network/sdk";
+
 // src/canonicalJson.ts
 var textEncoder = new TextEncoder();
 function hasUnpairedSurrogate(value) {
@@ -344,6 +378,379 @@ function canonicalJsonBytes(value) {
   return textEncoder.encode(canonicalize(value));
 }
 
+// src/sourceWakeIdentity.ts
+async function wakeSourceHash(source) {
+  return await PayloadBuilder2.dataHash({ schema: WakeSourceSchema, ...WakeSourceZod.parse(source) });
+}
+function wakeSourcesEqual(left, right) {
+  return canonicalJson(WakeSourceZod.parse(left)) === canonicalJson(WakeSourceZod.parse(right));
+}
+async function sourceWakeFilterHash(filter) {
+  const parsed = SourceWakeSubscriptionFilterZod.parse(filter);
+  return await PayloadBuilder2.dataHash({ ...parsed, schema: asSchema(parsed.schema, true) });
+}
+
+// src/verifyWakeRequest.ts
+var EVENT_KIT_MAX_JWT_LIFETIME_SECONDS = 300;
+var EVENT_KIT_MAX_FUTURE_IAT_SECONDS = 60;
+var WakeAdmissionRouteZod = z2.strictObject({
+  ...WakeDeliveryTermsFields,
+  audience: WakeJwtAudienceZod2,
+  authorizationChainId: ChainIdZod,
+  controller: NormalizedAddressZod2,
+  deploymentId: DeploymentIdZod2,
+  queueId: z2.string().min(1).max(255).optional(),
+  source: WakeSourceZod2,
+  filterHash: HashZod2,
+  subscriptionHash: HashZod2,
+  fromPosition: NonnegativeJsonSafeIntegerZod2,
+  maxPositionsPerWake: PositiveJsonSafeIntegerZod.max(MAX_POSITIONS_PER_SUBSCRIPTION_WAKE),
+  maxGrantLagBlocks: NonnegativeJsonSafeIntegerZod2
+}).refine((route) => validWakeDeliveryTerms(route) && (route.deliveryMode !== "best-effort" || route.maxPositionsPerWake === 1), "Invalid explicit delivery terms");
+function verifyEventBinding(event, route, nowSeconds) {
+  if (event.authorizationChainId !== route.authorizationChainId) {
+    return { ok: false, reason: "event-authorization-chain-mismatch" };
+  }
+  if (!wakeSourcesEqual(event.source, route.source)) return { ok: false, reason: "event-source-mismatch" };
+  if (event.filterHash !== route.filterHash) return { ok: false, reason: "event-filter-mismatch" };
+  if (event.deploymentId !== route.deploymentId || event.queueId !== route.queueId) {
+    return { ok: false, reason: "event-target-mismatch" };
+  }
+  if (event.deliveryMode !== route.deliveryMode) return { ok: false, reason: "event-mode-mismatch" };
+  if (route.deliveryMode === "best-effort") {
+    if (event.issuedAt > nowSeconds + EVENT_KIT_MAX_FUTURE_IAT_SECONDS) return { ok: false, reason: "hint-future-issued-at" };
+    if (route.bestEffort === void 0 || nowSeconds > event.issuedAt + route.bestEffort.maxHintAgeSeconds) return { ok: false, reason: "hint-expired" };
+  }
+  if (event.fromPosition < route.fromPosition) return { ok: false, reason: "range-before-floor" };
+  if (event.toPosition - event.fromPosition >= route.maxPositionsPerWake) return { ok: false, reason: "range-too-large" };
+}
+async function verifyWakeRequest(input) {
+  const routeResult = WakeAdmissionRouteZod.safeParse(input.route);
+  if (!routeResult.success || !NonnegativeJsonSafeIntegerZod2.safeParse(input.nowSeconds).success) {
+    return { ok: false, reason: "configuration-invalid" };
+  }
+  const eventResult = WakeEnvelopeZod2.safeParse(input.body);
+  if (!eventResult.success) return malformedWake(input.body, eventResult.error.issues);
+  const route = routeResult.data;
+  if (route.filterHash !== await sourceWakeFilterHash({
+    schema: SOURCE_WAKE_FILTER_PROFILE,
+    deliveryMode: route.deliveryMode,
+    ...route.bestEffort === void 0 ? {} : { bestEffort: route.bestEffort },
+    source: route.source,
+    fromPosition: route.fromPosition,
+    maxPositionsPerWake: route.maxPositionsPerWake
+  })) return { ok: false, reason: "configuration-invalid" };
+  const event = Object.freeze({ ...eventResult.data, source: Object.freeze(eventResult.data.source) });
+  const mismatch = verifyEventBinding(event, route, input.nowSeconds);
+  if (mismatch !== void 0) return mismatch;
+  const jwt = await verifyJwtProfile(input.jwt, route.audience, input.nowSeconds);
+  if (!jwt.ok) return jwt;
+  let eventHash;
+  try {
+    eventHash = await PayloadBuilder3.dataHash(event);
+  } catch {
+    return { ok: false, reason: "event-hash-failed" };
+  }
+  if (eventHash !== jwt.jwt.eventHash) return { ok: false, reason: "event-hash-mismatch" };
+  const sourceHash = await wakeSourceHash(route.source);
+  return Object.freeze({
+    ok: true,
+    verified: Object.freeze({
+      audience: route.audience,
+      deploymentId: event.deploymentId,
+      event,
+      eventHash,
+      expiresAt: jwt.jwt.expiresAt,
+      fromPosition: event.fromPosition,
+      issuedAt: event.issuedAt,
+      jwtId: jwt.jwt.jwtId,
+      publisher: jwt.jwt.publisher,
+      ...event.queueId === void 0 ? {} : { queueId: event.queueId },
+      route: Object.freeze({
+        ...route,
+        source: Object.freeze(route.source),
+        sourceHash,
+        ...route.bestEffort === void 0 ? {} : { bestEffort: Object.freeze(route.bestEffort) }
+      }),
+      toPosition: event.toPosition,
+      tokenIssuedAt: jwt.jwt.issuedAt,
+      wakeId: event.wakeId
+    })
+  });
+}
+async function verifyJwtProfile(token, audience, nowSeconds) {
+  let verified;
+  try {
+    verified = await Account.verifyJwt(token, { audience, now: nowSeconds });
+  } catch (error) {
+    return reject2("jwt-malformed", [errorMessage2(error)]);
+  }
+  if (!verified.ok) {
+    return Object.hasOwn(verified.payload ?? {}, "nbf") ? reject2("jwt-nbf-not-allowed") : reject2(classifySdkJwtFailure(verified.reasons), verified.reasons);
+  }
+  const wireResult = parseStrictJwtWire(verified.header, verified.payload, audience);
+  if (!wireResult.ok) return wireResult;
+  const { header: strictHeader, payload: strictPayload } = wireResult;
+  if (strictHeader.kid !== strictPayload.iss) return reject2("jwt-identity-invalid");
+  if (strictPayload.exp <= nowSeconds) return reject2("jwt-expired");
+  if (strictPayload.exp - strictPayload.iat > EVENT_KIT_MAX_JWT_LIFETIME_SECONDS) return reject2("jwt-lifetime-invalid");
+  if (strictPayload.iat - nowSeconds > EVENT_KIT_MAX_FUTURE_IAT_SECONDS) return reject2("jwt-future-iat");
+  const jwt = Object.freeze({
+    eventHash: strictPayload.eventHash,
+    expiresAt: strictPayload.exp,
+    issuedAt: strictPayload.iat,
+    jwtId: strictPayload.jti,
+    publisher: strictPayload.iss
+  });
+  return Object.freeze({ jwt, ok: true });
+}
+function parseStrictJwtWire(header, payload, audience) {
+  const headerResult = WakeJwtHeaderZod.safeParse(header);
+  if (!headerResult.success) {
+    return NormalizedAddressZod2.safeParse(header.kid).success ? reject2("jwt-header-invalid", zodDetails(headerResult.error.issues)) : reject2("jwt-identity-invalid");
+  }
+  if (Object.hasOwn(payload, "nbf")) return reject2("jwt-nbf-not-allowed");
+  if (!NormalizedAddressZod2.safeParse(payload.iss).success) return reject2("jwt-identity-invalid");
+  if (payload.schema !== WakeJwtSchema) return reject2("jwt-schema-mismatch");
+  if (payload.aud !== audience) return reject2("jwt-audience-mismatch");
+  if (!isNonnegativeSafeInteger2(payload.iat) || !isNonnegativeSafeInteger2(payload.exp) || payload.exp <= payload.iat) {
+    return reject2("jwt-lifetime-invalid");
+  }
+  const payloadResult = WakeJwtPayloadZod.safeParse(payload);
+  if (!payloadResult.success) return reject2("jwt-claims-invalid", zodDetails(payloadResult.error.issues));
+  return Object.freeze({
+    header: headerResult.data,
+    ok: true,
+    payload: payloadResult.data
+  });
+}
+function classifySdkJwtFailure(reasons) {
+  if (reasons.some((reason) => reason.startsWith("audience mismatch:"))) return "jwt-audience-mismatch";
+  if (reasons.some((reason) => reason.startsWith("expired:"))) return "jwt-expired";
+  if (reasons.some((reason) => reason.startsWith("unsupported alg:") || reason.startsWith("unsupported typ:"))) {
+    return "jwt-header-invalid";
+  }
+  return reasons.some((reason) => reason.startsWith("invalid public key:") || reason.startsWith("public key does not derive to kid:") || reason === "header.kid does not match payload.iss") ? "jwt-identity-invalid" : "jwt-invalid";
+}
+function malformedWake(body, issues) {
+  const details = zodDetails(issues);
+  if (hasInvertedSafeRange(body)) return reject2("range-invalid", details);
+  return reject2(isRecord2(body) && Object.hasOwn(body, "wakeId") && issues.some((issue) => issue.path[0] === "wakeId") ? "wake-id-invalid" : "event-malformed", details);
+}
+function hasInvertedSafeRange(value) {
+  if (!isRecord2(value)) return false;
+  const { fromPosition, toPosition } = value;
+  return typeof fromPosition === "number" && typeof toPosition === "number" && isNonnegativeSafeInteger2(fromPosition) && isNonnegativeSafeInteger2(toPosition) && fromPosition > toPosition;
+}
+function isNonnegativeSafeInteger2(value) {
+  return Number.isSafeInteger(value) && value >= 0;
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function zodDetails(issues) {
+  return issues.map((issue) => {
+    const path = issue.path.map(String).join(".") || "<root>";
+    return `${path}: ${issue.message}`;
+  });
+}
+function reject2(reason, details) {
+  if (details === void 0) return Object.freeze({ ok: false, reason });
+  return Object.freeze({
+    details: Object.freeze([...details]),
+    ok: false,
+    reason
+  });
+}
+function errorMessage2(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+
+// src/bestEffortAdmission.ts
+function hintRetention(input) {
+  const { verified, nowSeconds } = input;
+  const policy = verified.route.bestEffort;
+  if (verified.route.deliveryMode !== "best-effort" || verified.event.deliveryMode !== "best-effort" || policy === void 0 || verified.fromPosition !== verified.toPosition || !Number.isSafeInteger(nowSeconds) || nowSeconds < 0 || !Number.isSafeInteger(input.expectedHead) || input.expectedHead < 0)
+    return { ok: false, reason: "configuration-invalid" };
+  if (verified.issuedAt > nowSeconds + EVENT_KIT_MAX_FUTURE_IAT_SECONDS) return { ok: false, reason: "hint-future-issued-at" };
+  const bodyDeadline = verified.issuedAt + policy.maxHintAgeSeconds;
+  const retainWakeUntil = bodyDeadline + EVENT_KIT_REPLAY_RETENTION_SKEW_SECONDS;
+  const retainJwtUntil = verified.expiresAt + EVENT_KIT_REPLAY_RETENTION_SKEW_SECONDS;
+  if (!Number.isSafeInteger(retainWakeUntil) || !Number.isSafeInteger(retainJwtUntil)) return { ok: false, reason: "configuration-invalid" };
+  return nowSeconds > bodyDeadline ? { ok: false, reason: "hint-expired" } : {
+    ok: true,
+    retainJwtUntil,
+    retainWakeUntil
+  };
+}
+async function admitBestEffortHint(input) {
+  const retention = hintRetention(input);
+  if (!retention.ok) return retention;
+  const { retainJwtUntil, retainWakeUntil } = retention;
+  const { verified, nowSeconds } = input;
+  const authorization = await authorizeVerifiedWake(input);
+  if (!authorization.ok) return authorization.failure;
+  const wake = AdmittedWakeZod.parse({
+    audience: verified.audience,
+    deploymentId: verified.deploymentId,
+    event: verified.event,
+    eventHash: verified.eventHash,
+    fromPosition: verified.fromPosition,
+    toPosition: verified.toPosition,
+    jti: verified.jwtId,
+    publisher: verified.publisher,
+    wakeId: verified.wakeId,
+    ...verified.queueId === void 0 ? {} : { queueId: verified.queueId }
+  });
+  const attempt = {
+    audience: verified.audience,
+    eventHash: verified.eventHash,
+    jwtId: verified.jwtId,
+    publisher: verified.publisher,
+    retainJwtUntil,
+    retainWakeUntil,
+    wakeId: verified.wakeId
+  };
+  try {
+    const committed = await input.inbox.commitAuthorized({
+      attempt,
+      grant: authorization.grant,
+      wake,
+      nowSeconds
+    });
+    if (committed.kind !== "accepted" && committed.kind !== "duplicate") return { ok: false, reason: committed.kind };
+    const acknowledgment = committed.acknowledgment;
+    return acknowledgmentMatches(acknowledgment, attempt, nowSeconds) ? {
+      ok: true,
+      disposition: committed.kind,
+      acknowledgment,
+      wake
+    } : { ok: false, reason: "inbox-unavailable" };
+  } catch {
+    return { ok: false, reason: "inbox-unavailable" };
+  }
+}
+function acknowledgmentMatches(value, attempt, now) {
+  return BestEffortAdmissionAcknowledgmentZod.safeParse(value).success && value.eventHash === attempt.eventHash && value.wakeId === attempt.wakeId && value.acceptedAt <= now && value.expiresAt === attempt.retainWakeUntil;
+}
+var BestEffortAdmissionAcknowledgmentZod = z3.strictObject({
+  admissionId: z3.string().min(1).max(4096),
+  eventHash: HashZod3,
+  wakeId: WakeIdZod2,
+  acceptedAt: NonnegativeJsonSafeIntegerZod3,
+  expiresAt: NonnegativeJsonSafeIntegerZod3
+}).refine((value) => value.expiresAt > value.acceptedAt, "Acknowledgment expiry must follow admission");
+var JwtSecurityRecordZod = z3.strictObject({
+  audience: WakeJwtAudienceZod3,
+  publisher: NormalizedAddressZod3,
+  jwtId: WakeJwtIdZod2,
+  wakeId: WakeIdZod2,
+  eventHash: HashZod3,
+  expiresAt: NonnegativeJsonSafeIntegerZod3
+});
+var WakeSecurityRecordZod = z3.strictObject({
+  audience: WakeJwtAudienceZod3,
+  publisher: NormalizedAddressZod3,
+  wakeId: WakeIdZod2,
+  eventHash: HashZod3,
+  acknowledgment: BestEffortAdmissionAcknowledgmentZod
+}).refine(
+  (value) => value.wakeId === value.acknowledgment.wakeId && value.eventHash === value.acknowledgment.eventHash,
+  "Security identity must match acknowledgment"
+);
+var BestEffortSecurityStateZod = z3.strictObject({
+  highestNowSeconds: NonnegativeJsonSafeIntegerZod3,
+  jwtRecords: z3.array(JwtSecurityRecordZod).max(65536),
+  wakeRecords: z3.array(WakeSecurityRecordZod).max(65536)
+}).superRefine((value, context) => {
+  const jwtKeys = value.jwtRecords.map((record) => JSON.stringify([record.audience, record.publisher, record.jwtId]));
+  if (value.wakeRecords.some((record) => record.acknowledgment.acceptedAt > value.highestNowSeconds))
+    context.addIssue({ code: "custom", message: "Acknowledgment cannot precede stored admission clock" });
+  const wakeKeys = value.wakeRecords.map((record) => JSON.stringify([record.audience, record.publisher, record.wakeId]));
+  const jwtIdentities = new Set(jwtKeys);
+  const wakeIdentities = new Set(wakeKeys);
+  if (jwtIdentities.size !== jwtKeys.length || wakeIdentities.size !== wakeKeys.length)
+    context.addIssue({ code: "custom", message: "Persisted security identities must be unique" });
+});
+function parseBestEffortSecurityState(value) {
+  return BestEffortSecurityStateZod.parse(value);
+}
+var BestEffortAdmissionAttemptZod = z3.strictObject({
+  audience: WakeJwtAudienceZod3,
+  eventHash: HashZod3,
+  jwtId: WakeJwtIdZod2,
+  publisher: NormalizedAddressZod3,
+  retainJwtUntil: NonnegativeJsonSafeIntegerZod3,
+  retainWakeUntil: NonnegativeJsonSafeIntegerZod3,
+  wakeId: WakeIdZod2
+});
+function createBestEffortSecurityState() {
+  return {
+    highestNowSeconds: 0,
+    jwtRecords: [],
+    wakeRecords: []
+  };
+}
+function securityConflict(attempt, priorJwt, priorWake, jwtCount, wakeCount, maxRecords) {
+  if (priorJwt !== void 0 && (priorJwt.eventHash !== attempt.eventHash || priorJwt.wakeId !== attempt.wakeId))
+    return "jwt-id-collision";
+  if (priorWake !== void 0 && priorWake.eventHash !== attempt.eventHash)
+    return "wake-id-collision";
+  if (priorJwt === void 0 && jwtCount >= maxRecords || priorWake === void 0 && wakeCount >= maxRecords)
+    return "capacity-exceeded";
+}
+function validateTransaction(input, maxRecords) {
+  const attempt = BestEffortAdmissionAttemptZod.parse(input.attempt);
+  const wake = AdmittedWakeZod.parse(input.wake);
+  const nowSeconds = NonnegativeJsonSafeIntegerZod3.parse(input.nowSeconds);
+  if (attempt.audience !== wake.audience || attempt.publisher !== wake.publisher || attempt.jwtId !== wake.jti || attempt.wakeId !== wake.wakeId || attempt.eventHash !== wake.eventHash || wake.event.deliveryMode !== "best-effort" || attempt.retainJwtUntil <= nowSeconds || attempt.retainWakeUntil <= nowSeconds)
+    throw new TypeError("Best Effort transaction attempt does not match admitted hint");
+  if (!Number.isSafeInteger(maxRecords) || maxRecords < 1 || maxRecords > 65536) throw new TypeError("Invalid finite security capacity");
+  return { attempt, nowSeconds };
+}
+function commitBestEffortSecurity(state, input, maxRecords) {
+  state = parseBestEffortSecurityState(state);
+  const { attempt, nowSeconds } = validateTransaction(input, maxRecords);
+  if (nowSeconds < state.highestNowSeconds) return { state, result: { kind: "clock-regressed" } };
+  const jwtRecords = state.jwtRecords.filter((record) => record.expiresAt > nowSeconds).map((record) => ({ ...record }));
+  const wakeRecords = state.wakeRecords.filter((record) => record.acknowledgment.expiresAt > nowSeconds);
+  const priorJwt = jwtRecords.find((record) => record.audience === attempt.audience && record.publisher === attempt.publisher && record.jwtId === attempt.jwtId);
+  const priorWake = wakeRecords.find((record) => record.audience === attempt.audience && record.publisher === attempt.publisher && record.wakeId === attempt.wakeId);
+  const conflict = securityConflict(attempt, priorJwt, priorWake, jwtRecords.length, wakeRecords.length, maxRecords);
+  if (conflict !== void 0) return { state, result: { kind: conflict } };
+  const acknowledgment = priorWake?.acknowledgment ?? {
+    admissionId: JSON.stringify([attempt.audience, attempt.publisher, attempt.wakeId, attempt.eventHash]),
+    eventHash: attempt.eventHash,
+    wakeId: attempt.wakeId,
+    acceptedAt: nowSeconds,
+    expiresAt: attempt.retainWakeUntil
+  };
+  if (priorJwt !== void 0) priorJwt.expiresAt = Math.max(priorJwt.expiresAt, attempt.retainJwtUntil);
+  if (priorJwt === void 0) jwtRecords.push({
+    audience: attempt.audience,
+    publisher: attempt.publisher,
+    jwtId: attempt.jwtId,
+    wakeId: attempt.wakeId,
+    eventHash: attempt.eventHash,
+    expiresAt: attempt.retainJwtUntil
+  });
+  if (priorWake === void 0) wakeRecords.push({
+    audience: attempt.audience,
+    publisher: attempt.publisher,
+    wakeId: attempt.wakeId,
+    eventHash: attempt.eventHash,
+    acknowledgment
+  });
+  return {
+    state: {
+      highestNowSeconds: nowSeconds,
+      jwtRecords,
+      wakeRecords
+    },
+    result: { kind: priorWake === void 0 ? "accepted" : "duplicate", acknowledgment }
+  };
+}
+
 // src/endpointChallenge.ts
 import {
   Base64Url32BytesZod,
@@ -357,7 +764,7 @@ import {
   generateHandshakeId,
   MAX_ENDPOINT_CHALLENGE_LIFETIME_SECONDS
 } from "@xyo-network/event-kit-schemas";
-import { PayloadBuilder as PayloadBuilder2 } from "@xyo-network/sdk";
+import { PayloadBuilder as PayloadBuilder4 } from "@xyo-network/sdk";
 function hashBytes(hash) {
   return Uint8Array.from({ length: 32 }, (_, index) => Number.parseInt(hash.slice(index * 2, index * 2 + 2), 16));
 }
@@ -384,7 +791,7 @@ function equalProof(left, right) {
 }
 async function endpointChallengeHash(challenge) {
   const parsed = EndpointChallengeZod.parse(challenge);
-  return await PayloadBuilder2.dataHash(parsed);
+  return await PayloadBuilder4.dataHash(parsed);
 }
 function createEndpointChallenge(input) {
   const lifetimeSeconds = input.lifetimeSeconds ?? MAX_ENDPOINT_CHALLENGE_LIFETIME_SECONDS;
@@ -397,7 +804,7 @@ function createEndpointChallenge(input) {
   if (input.issuedAt > Number.MAX_SAFE_INTEGER - lifetimeSeconds) {
     throw new RangeError("Challenge expiry exceeds the JSON safe-integer range");
   }
-  const builder = new PayloadBuilder2({ schema: EndpointChallengeSchema });
+  const builder = new PayloadBuilder4({ schema: EndpointChallengeSchema });
   return EndpointChallengeZod.parse(builder.fields({
     challengeId: generateHandshakeId(),
     chainId: input.chainId,
@@ -416,7 +823,7 @@ function createEndpointChallenge(input) {
 }
 async function createEndpointChallengeResponse(challenge, secret) {
   const challengeHash = await endpointChallengeHash(challenge);
-  const builder = new PayloadBuilder2({ schema: EndpointChallengeResponseSchema });
+  const builder = new PayloadBuilder4({ schema: EndpointChallengeResponseSchema });
   return EndpointChallengeResponseZod.parse(builder.fields({
     challenge: challengeHash,
     proof: await hmacProof(secret, challengeHash)
@@ -427,8 +834,7 @@ async function verifyEndpointChallengeProof(input) {
     const challenge = EndpointChallengeZod.parse(input.challenge);
     const response = EndpointChallengeResponseZod.parse(input.response);
     const challengeHash = await endpointChallengeHash(challenge);
-    if (response.challenge !== challengeHash) return false;
-    return equalProof(response.proof, await hmacProof(input.secret, challengeHash));
+    return response.challenge === challengeHash && equalProof(response.proof, await hmacProof(input.secret, challengeHash));
   } catch {
     return false;
   }
@@ -436,8 +842,7 @@ async function verifyEndpointChallengeProof(input) {
 async function verifyEndpointChallengeResponse(input) {
   try {
     const challenge = EndpointChallengeZod.parse(input.challenge);
-    if (!Number.isSafeInteger(input.nowSeconds) || input.nowSeconds < challenge.issuedAt || input.nowSeconds >= challenge.expiresAt) return false;
-    return await verifyEndpointChallengeProof(input);
+    return Number.isSafeInteger(input.nowSeconds) && input.nowSeconds >= challenge.issuedAt && input.nowSeconds < challenge.expiresAt && await verifyEndpointChallengeProof(input);
   } catch {
     return false;
   }
@@ -453,7 +858,7 @@ import {
   EndpointChallengeZod as EndpointChallengeZod2,
   generateGrantId,
   generateHandshakeId as generateHandshakeId2,
-  HashZod as HashZod3,
+  HashZod as HashZod5,
   MAX_SUBSCRIPTION_PLAINTEXT_BYTES as MAX_SUBSCRIPTION_PLAINTEXT_BYTES2,
   PublisherEncryptionKeyRevocationSchema,
   PublisherEncryptionKeyRevocationZod,
@@ -464,7 +869,7 @@ import {
   PublisherServiceSchema,
   PublisherServiceZod,
   SOURCE_WAKE_EVENT_KIND,
-  SOURCE_WAKE_FILTER_PROFILE,
+  SOURCE_WAKE_FILTER_PROFILE as SOURCE_WAKE_FILTER_PROFILE2,
   WAKE_SUBSCRIPTION_HPKE_PROFILE as WAKE_SUBSCRIPTION_HPKE_PROFILE3,
   WAKE_WALLET_JWT_DELIVERY_PROFILE,
   WakeGrantObjectSchema,
@@ -481,7 +886,7 @@ import {
   WakeSubscriptionRevocationSchema,
   WakeSubscriptionRevocationZod
 } from "@xyo-network/event-kit-schemas";
-import { PayloadBuilder as PayloadBuilder3 } from "@xyo-network/sdk";
+import { PayloadBuilder as PayloadBuilder5 } from "@xyo-network/sdk";
 
 // src/wakeSubscriptionHpke.ts
 import {
@@ -496,8 +901,8 @@ import {
   canonicalBase64UrlToBytes as canonicalBase64UrlToBytes2,
   EncryptedWakeSubscriptionZod as EncryptedWakeSubscriptionZod2,
   HandshakeIdZod,
-  HashZod as HashZod2,
-  NormalizedAddressZod as NormalizedAddressZod3,
+  HashZod as HashZod4,
+  NormalizedAddressZod as NormalizedAddressZod5,
   WAKE_SUBSCRIPTION_HPKE_PROFILE as WAKE_SUBSCRIPTION_HPKE_PROFILE2,
   WakeSubscriptionCleartextZod as WakeSubscriptionCleartextZod2
 } from "@xyo-network/event-kit-schemas";
@@ -506,7 +911,7 @@ import {
 import {
   EncryptedWakeSubscriptionZod,
   MAX_SUBSCRIPTION_PLAINTEXT_BYTES,
-  NormalizedAddressZod as NormalizedAddressZod2,
+  NormalizedAddressZod as NormalizedAddressZod4,
   WAKE_SUBSCRIPTION_HPKE_PROFILE,
   WakeSubscriptionCleartextZod,
   WakeSubscriptionPlaintextZod
@@ -523,7 +928,7 @@ function cleartextFromEncrypted(subscription) {
   return cleartext;
 }
 function wakeSubscriptionAadBytes(subscription, subscriber) {
-  const parsedSubscriber = NormalizedAddressZod2.parse(subscriber);
+  const parsedSubscriber = NormalizedAddressZod4.parse(subscriber);
   const parsedSubscription = "encryption" in subscription ? cleartextFromEncrypted(EncryptedWakeSubscriptionZod.parse(subscription)) : WakeSubscriptionCleartextZod.parse(subscription);
   return canonicalJsonBytes({
     schema: parsedSubscription.schema,
@@ -538,6 +943,7 @@ function wakeSubscriptionAadBytes(subscription, subscriber) {
     revision: parsedSubscription.revision,
     supersedes: parsedSubscription.supersedes ?? null,
     eventKind: parsedSubscription.eventKind,
+    deliveryMode: parsedSubscription.deliveryMode,
     expiresAtBlock: parsedSubscription.expiresAtBlock,
     profile: WAKE_SUBSCRIPTION_HPKE_PROFILE
   });
@@ -587,14 +993,14 @@ var WakeSubscriptionDecryptionError = class extends Error {
 };
 function parsePublicKey(value) {
   return {
-    encryptionKey: HashZod2.parse(value.encryptionKey),
+    encryptionKey: HashZod4.parse(value.encryptionKey),
     keyId: HandshakeIdZod.parse(value.keyId),
     publicKey: Base64Url32BytesZod2.parse(value.publicKey)
   };
 }
 function parsePrivateKey(value) {
   return {
-    encryptionKey: HashZod2.parse(value.encryptionKey),
+    encryptionKey: HashZod4.parse(value.encryptionKey),
     keyId: HandshakeIdZod.parse(value.keyId),
     privateKey: Base64Url32BytesZod2.parse(value.privateKey)
   };
@@ -618,7 +1024,7 @@ async function generateWakeSubscriptionEncryptionKeyPair() {
 }
 async function encryptWakeSubscription(input) {
   const subscription = WakeSubscriptionCleartextZod2.parse(input.subscription);
-  const subscriber = NormalizedAddressZod3.parse(input.subscriber);
+  const subscriber = NormalizedAddressZod5.parse(input.subscriber);
   const publisherKey = parsePublicKey(input.publisherKey);
   if (subscription.encryptionKey !== publisherKey.encryptionKey || subscription.keyId !== publisherKey.keyId) {
     throw new TypeError("Subscription key reference does not match the supplied publisher key");
@@ -641,7 +1047,7 @@ async function encryptWakeSubscription(input) {
 async function decryptWakeSubscription(input) {
   try {
     const subscription = EncryptedWakeSubscriptionZod2.parse(input.subscription);
-    const subscriber = NormalizedAddressZod3.parse(input.subscriber);
+    const subscriber = NormalizedAddressZod5.parse(input.subscriber);
     const publisherKey = parsePrivateKey(input.publisherKey);
     if (subscription.encryptionKey !== publisherKey.encryptionKey || subscription.keyId !== publisherKey.keyId) throw new TypeError("Key reference mismatch");
     const recipientKey = await suite.kem.deserializePrivateKey(decoded32(publisherKey.privateKey));
@@ -684,13 +1090,13 @@ function parseHandshakePublicObject(value) {
   throw new TypeError("Expected a strict Event Kit handshake public object");
 }
 async function handshakeObjectHash(object) {
-  return HashZod3.parse(await PayloadBuilder3.dataHash(parseHandshakePublicObject(object)));
+  return HashZod5.parse(await PayloadBuilder5.dataHash(parseHandshakePublicObject(object)));
 }
 async function withHandshakeObjectHash(body) {
   return Object.freeze({ body, objectHash: await handshakeObjectHash(body) });
 }
 function createPublisherEncryptionKey(input) {
-  const builder = new PayloadBuilder3({ schema: PublisherEncryptionKeySchema });
+  const builder = new PayloadBuilder5({ schema: PublisherEncryptionKeySchema });
   return PublisherEncryptionKeyZod.parse(builder.fields({
     keyId: input.keyId ?? generateHandshakeId2(),
     profile: WAKE_SUBSCRIPTION_HPKE_PROFILE3,
@@ -722,7 +1128,7 @@ async function generatePublisherEncryptionKey(input) {
   });
 }
 function createPublisherService(input) {
-  const builder = new PayloadBuilder3({ schema: PublisherServiceSchema });
+  const builder = new PayloadBuilder5({ schema: PublisherServiceSchema });
   return PublisherServiceZod.parse(builder.fields({
     authorizationChainId: input.authorizationChainId,
     serviceId: input.serviceId ?? generateHandshakeId2(),
@@ -732,9 +1138,11 @@ function createPublisherService(input) {
     ...input.expiresAtBlock === void 0 ? {} : { expiresAtBlock: input.expiresAtBlock },
     events: input.sources.map((source) => ({
       kind: SOURCE_WAKE_EVENT_KIND,
-      filterProfile: SOURCE_WAKE_FILTER_PROFILE,
+      filterProfile: SOURCE_WAKE_FILTER_PROFILE2,
       source
     })),
+    deliveryMode: input.deliveryMode,
+    ...input.bestEffort === void 0 ? {} : { bestEffort: input.bestEffort },
     deliveryProfile: WAKE_WALLET_JWT_DELIVERY_PROFILE,
     challengeProfile: ENDPOINT_CHALLENGE_HMAC_SHA256_PROFILE,
     encryptionProfile: WAKE_SUBSCRIPTION_HPKE_PROFILE3,
@@ -749,7 +1157,7 @@ function createPublisherService(input) {
   }).build());
 }
 function createWakeGrant(input) {
-  const builder = new PayloadBuilder3({ schema: WakeGrantObjectSchema });
+  const builder = new PayloadBuilder5({ schema: WakeGrantObjectSchema });
   return WakeGrantObjectZod.parse(builder.fields({
     grantId: input.grantId ?? generateGrantId(),
     deploymentId: input.deploymentId,
@@ -764,14 +1172,16 @@ function createWakeSubscriptionPlaintext(input) {
     globalThis.crypto.getRandomValues(secretBytes);
   }
   const challengeSecret = input.challengeSecret ?? bytesToCanonicalBase64Url3(secretBytes);
-  const builder = new PayloadBuilder3({ schema: WakeSubscriptionPlaintextSchema });
+  const builder = new PayloadBuilder5({ schema: WakeSubscriptionPlaintextSchema });
   return WakeSubscriptionPlaintextZod2.parse(builder.fields({
     endpoint: input.endpoint,
     audience: input.audience,
     deploymentId: input.deploymentId,
     queueId: input.queueId ?? null,
     filter: {
-      schema: SOURCE_WAKE_FILTER_PROFILE,
+      schema: SOURCE_WAKE_FILTER_PROFILE2,
+      deliveryMode: input.deliveryMode,
+      ...input.bestEffort === void 0 ? {} : { bestEffort: input.bestEffort },
       source: input.source,
       fromPosition: input.fromPosition,
       maxPositionsPerWake: input.maxPositionsPerWake
@@ -783,7 +1193,7 @@ function createWakeSubscriptionPlaintext(input) {
   }).build());
 }
 async function createEncryptedWakeSubscription(input) {
-  const builder = new PayloadBuilder3({ schema: EncryptedWakeSubscriptionSchema });
+  const builder = new PayloadBuilder5({ schema: EncryptedWakeSubscriptionSchema });
   const cleartext = WakeSubscriptionCleartextZod3.parse(builder.fields({
     subscriptionId: input.subscriptionId ?? generateHandshakeId2(),
     revision: input.revision ?? 1,
@@ -795,6 +1205,7 @@ async function createEncryptedWakeSubscription(input) {
     keyId: input.publisherKey.keyId,
     grant: input.grant,
     eventKind: SOURCE_WAKE_EVENT_KIND,
+    deliveryMode: input.plaintext.filter.deliveryMode,
     expiresAtBlock: input.expiresAtBlock
   }).build());
   return await encryptWakeSubscription({
@@ -805,7 +1216,7 @@ async function createEncryptedWakeSubscription(input) {
   });
 }
 function createWakeSubscriptionAcceptance(input) {
-  const builder = new PayloadBuilder3({ schema: WakeSubscriptionAcceptanceSchema });
+  const builder = new PayloadBuilder5({ schema: WakeSubscriptionAcceptanceSchema });
   return WakeSubscriptionAcceptanceZod.parse(builder.fields({
     challenge: input.challenge,
     encryptionKey: input.encryptionKey,
@@ -816,47 +1227,45 @@ function createWakeSubscriptionAcceptance(input) {
   }).build());
 }
 function createPublisherServiceRevocation(service) {
-  const builder = new PayloadBuilder3({ schema: PublisherServiceRevocationSchema });
+  const builder = new PayloadBuilder5({ schema: PublisherServiceRevocationSchema });
   return PublisherServiceRevocationZod.parse(builder.fields({ service }).build());
 }
 function createPublisherEncryptionKeyRevocation(key) {
-  const builder = new PayloadBuilder3({ schema: PublisherEncryptionKeyRevocationSchema });
+  const builder = new PayloadBuilder5({ schema: PublisherEncryptionKeyRevocationSchema });
   return PublisherEncryptionKeyRevocationZod.parse(builder.fields({ key }).build());
 }
 function createWakeGrantRevocation(grant) {
-  const builder = new PayloadBuilder3({ schema: WakeGrantRevocationSchema });
+  const builder = new PayloadBuilder5({ schema: WakeGrantRevocationSchema });
   return WakeGrantRevocationZod.parse(builder.fields({ grant }).build());
 }
 function createWakeSubscriptionRevocation(subscription) {
-  const builder = new PayloadBuilder3({ schema: WakeSubscriptionRevocationSchema });
+  const builder = new PayloadBuilder5({ schema: WakeSubscriptionRevocationSchema });
   return WakeSubscriptionRevocationZod.parse(builder.fields({ subscription }).build());
 }
 function createWakeSubscriptionAcceptanceRevocation(acceptance) {
-  const builder = new PayloadBuilder3({ schema: WakeSubscriptionAcceptanceRevocationSchema });
+  const builder = new PayloadBuilder5({ schema: WakeSubscriptionAcceptanceRevocationSchema });
   return WakeSubscriptionAcceptanceRevocationZod.parse(builder.fields({ acceptance }).build());
 }
 
 // src/lifecycleSelection.ts
-function isNonnegativeSafeInteger2(value) {
+function isNonnegativeSafeInteger3(value) {
   return Number.isSafeInteger(value) && value >= 0;
 }
 function isVisible(claimedAtBlock, finalizedHead) {
-  return isNonnegativeSafeInteger2(claimedAtBlock) && claimedAtBlock <= finalizedHead;
+  return isNonnegativeSafeInteger3(claimedAtBlock) && claimedAtBlock <= finalizedHead;
 }
 function isRevoked(revokedAtBlock, finalizedHead) {
   return revokedAtBlock !== void 0 && revokedAtBlock <= finalizedHead;
 }
 function isUnrevokedEvidence(claimedAtBlock, revokedAtBlock, finalizedHead) {
-  return isVisible(claimedAtBlock, finalizedHead) && (revokedAtBlock === void 0 || isNonnegativeSafeInteger2(revokedAtBlock) && revokedAtBlock >= claimedAtBlock) && !isRevoked(revokedAtBlock, finalizedHead);
+  return isVisible(claimedAtBlock, finalizedHead) && (revokedAtBlock === void 0 || isNonnegativeSafeInteger3(revokedAtBlock) && revokedAtBlock >= claimedAtBlock) && !isRevoked(revokedAtBlock, finalizedHead);
 }
 function isInsideExclusiveWindow(finalizedHead, validFromBlock, expiresAtBlock) {
-  if (!isNonnegativeSafeInteger2(validFromBlock) || finalizedHead < validFromBlock) return false;
-  return expiresAtBlock === void 0 || isNonnegativeSafeInteger2(expiresAtBlock) && expiresAtBlock > validFromBlock && finalizedHead < expiresAtBlock;
+  return isNonnegativeSafeInteger3(validFromBlock) && finalizedHead >= validFromBlock && (expiresAtBlock === void 0 || isNonnegativeSafeInteger3(expiresAtBlock) && expiresAtBlock > validFromBlock && finalizedHead < expiresAtBlock);
 }
 function isRevisionShapeValid(revision) {
-  if (!Number.isSafeInteger(revision.revision) || revision.revision < 1) return false;
-  if (!isNonnegativeSafeInteger2(revision.claimedAtBlock)) return false;
-  if (revision.revokedAtBlock !== void 0 && (!isNonnegativeSafeInteger2(revision.revokedAtBlock) || revision.revokedAtBlock < revision.claimedAtBlock)) return false;
+  if (!Number.isSafeInteger(revision.revision) || revision.revision < 1 || !isNonnegativeSafeInteger3(revision.claimedAtBlock)) return false;
+  if (revision.revokedAtBlock !== void 0 && (!isNonnegativeSafeInteger3(revision.revokedAtBlock) || revision.revokedAtBlock < revision.claimedAtBlock)) return false;
   return revision.revision === 1 ? revision.supersedes === void 0 : revision.supersedes !== void 0;
 }
 function resolveLinearChain(revisions, finalizedHead) {
@@ -929,8 +1338,7 @@ function selectPublisherService(input) {
     }
   }
   if (selectable.length === 0) return { ok: false, reason: "service-not-found" };
-  if (selectable.length > 1) return { ok: false, reason: "ambiguous-service" };
-  return { ok: true, service: selectable[0] };
+  return selectable.length > 1 ? { ok: false, reason: "ambiguous-service" } : { ok: true, service: selectable[0] };
 }
 function resolvePreferredEncryptionKey(input) {
   const preferredHash = input.service.preferredEncryptionKey;
@@ -943,10 +1351,7 @@ function resolvePreferredEncryptionKey(input) {
   const key = exact[0];
   const sameStableIdentity = input.keys.filter((candidate) => candidate.source === key.source && candidate.keyId === key.keyId && candidate.objectHash !== key.objectHash && isVisible(candidate.claimedAtBlock, input.finalizedHead));
   if (sameStableIdentity.length > 0) return { ok: false, reason: "ambiguous-key" };
-  if (!isUnrevokedEvidence(key.claimedAtBlock, key.revokedAtBlock, input.finalizedHead) || !isInsideExclusiveWindow(input.finalizedHead, key.validFromBlock, key.expiresAtBlock)) {
-    return { ok: false, reason: "preferred-key-inactive" };
-  }
-  return { ok: true, key };
+  return !isUnrevokedEvidence(key.claimedAtBlock, key.revokedAtBlock, input.finalizedHead) || !isInsideExclusiveWindow(input.finalizedHead, key.validFromBlock, key.expiresAtBlock) ? { ok: false, reason: "preferred-key-inactive" } : { ok: true, key };
 }
 function acceptanceFor(subscription, input) {
   return input.acceptances.filter((acceptance) => acceptance.source === input.publisherSource && acceptance.subscription === subscription.objectHash && isVisible(acceptance.acceptanceBlock, input.finalizedHead));
@@ -955,7 +1360,7 @@ function acceptedSubscription(subscription, input) {
   const acceptances = acceptanceFor(subscription, input);
   if (acceptances.length > 1) return "ambiguous";
   const acceptance = acceptances[0];
-  if (acceptance === void 0 || !isNonnegativeSafeInteger2(acceptance.acceptanceBlock)) return void 0;
+  if (acceptance === void 0 || !isNonnegativeSafeInteger3(acceptance.acceptanceBlock)) return void 0;
   if (!Number.isSafeInteger(subscription.expiresAtBlock) || subscription.expiresAtBlock < 1) return void 0;
   if (acceptance.acceptanceBlock <= subscription.claimedAtBlock || acceptance.acceptanceBlock >= Number.MAX_SAFE_INTEGER) return void 0;
   const activeFromBlock = acceptance.acceptanceBlock + 1;
@@ -991,10 +1396,7 @@ function selectSubscriptionActivation(input) {
   if (selected === void 0) return { ok: false, reason: "subscription-pending" };
   const latest = resolution.chain.at(-1);
   if (!isActiveAcceptedSubscription(selected, input.finalizedHead)) {
-    if (latest?.objectHash !== selected.subscription.objectHash) {
-      return { ok: false, reason: "subscription-pending" };
-    }
-    return { ok: false, reason: "subscription-inactive" };
+    return { ok: false, reason: latest?.objectHash === selected.subscription.objectHash ? "subscription-inactive" : "subscription-pending" };
   }
   return {
     acceptance: selected.acceptance,
@@ -1225,43 +1627,20 @@ function createMemoryWakeQueue() {
 
 // src/publisherSubscription.ts
 import {
-  ChainIdZod,
+  ChainIdZod as ChainIdZod2,
   EncryptedWakeSubscriptionZod as EncryptedWakeSubscriptionZod4,
   EndpointChallengeZod as EndpointChallengeZod3,
-  HashZod as HashZod4,
+  HashZod as HashZod6,
   hasMatchingHandshakeProfile,
-  NormalizedAddressZod as NormalizedAddressZod4,
+  NormalizedAddressZod as NormalizedAddressZod6,
   PublisherEncryptionKeyZod as PublisherEncryptionKeyZod2,
   PublisherServiceZod as PublisherServiceZod2,
   WakeGrantObjectZod as WakeGrantObjectZod2
 } from "@xyo-network/event-kit-schemas";
-
-// src/sourceWakeIdentity.ts
-import {
-  SourceWakeSubscriptionFilterZod,
-  WakeSourceSchema,
-  WakeSourceZod
-} from "@xyo-network/event-kit-schemas";
-import {
-  asSchema,
-  PayloadBuilder as PayloadBuilder4
-} from "@xyo-network/sdk";
-async function wakeSourceHash(source) {
-  return await PayloadBuilder4.dataHash({ schema: WakeSourceSchema, ...WakeSourceZod.parse(source) });
-}
-function wakeSourcesEqual(left, right) {
-  return canonicalJson(WakeSourceZod.parse(left)) === canonicalJson(WakeSourceZod.parse(right));
-}
-async function sourceWakeFilterHash(filter) {
-  const parsed = SourceWakeSubscriptionFilterZod.parse(filter);
-  return await PayloadBuilder4.dataHash({ ...parsed, schema: asSchema(parsed.schema, true) });
-}
-
-// src/publisherSubscription.ts
 function rejectPublisherSubscription(reason) {
   return Object.freeze({ ok: false, reason });
 }
-function isNonnegativeSafeInteger3(value) {
+function isNonnegativeSafeInteger4(value) {
   return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
 }
 function isActiveAt(value, block) {
@@ -1278,7 +1657,7 @@ function hasExactQueueScope(grant, plaintext) {
   return plaintext.deploymentId === grant.deploymentId && plaintext.queueId === grantQueue;
 }
 function hasExactSubscriptionBinding(candidate, subscription) {
-  return subscription.chainId === candidate.chainId && subscription.publisher === candidate.publisher && subscription.service === candidate.service.objectHash && subscription.encryptionKey === candidate.key.objectHash && subscription.keyId === candidate.key.body.keyId && subscription.grant === candidate.grant.objectHash;
+  return subscription.deliveryMode === candidate.service.body.deliveryMode && subscription.chainId === candidate.chainId && subscription.publisher === candidate.publisher && subscription.service === candidate.service.objectHash && subscription.encryptionKey === candidate.key.objectHash && subscription.keyId === candidate.key.body.keyId && subscription.grant === candidate.grant.objectHash;
 }
 function hasExactKeyBinding(service, key, subscription) {
   return service.encryptionKeys.includes(key.objectHash) && service.preferredEncryptionKey === key.objectHash && key.body.keyId === subscription.keyId && key.objectHash === subscription.encryptionKey;
@@ -1289,22 +1668,22 @@ function expiryWithinServicePolicy(subscription, service, tupleBlock) {
 function parsePublisherSubscriptionCandidate(candidate) {
   try {
     return {
-      chainId: ChainIdZod.parse(candidate.chainId),
+      chainId: ChainIdZod2.parse(candidate.chainId),
       grant: WakeGrantObjectZod2.parse(candidate.grant.body),
       key: PublisherEncryptionKeyZod2.parse(candidate.key.body),
-      publisher: NormalizedAddressZod4.parse(candidate.publisher),
+      publisher: NormalizedAddressZod6.parse(candidate.publisher),
       service: PublisherServiceZod2.parse(candidate.service.body),
-      subscriber: NormalizedAddressZod4.parse(candidate.subscriber),
+      subscriber: NormalizedAddressZod6.parse(candidate.subscriber),
       subscription: EncryptedWakeSubscriptionZod4.parse(candidate.subscription.body),
-      tupleObjectHashes: candidate.tupleObjectHashes.map((hash) => HashZod4.parse(hash)),
-      tupleSubject: NormalizedAddressZod4.parse(candidate.tupleSubject)
+      tupleObjectHashes: candidate.tupleObjectHashes.map((hash) => HashZod6.parse(hash)),
+      tupleSubject: NormalizedAddressZod6.parse(candidate.tupleSubject)
     };
   } catch {
     return void 0;
   }
 }
 function tupleBindingIsValid(candidate, parsed) {
-  return isNonnegativeSafeInteger3(candidate.tupleBlock) && isNonnegativeSafeInteger3(candidate.finalizedHead) && candidate.finalizedHead >= candidate.tupleBlock && parsed.tupleSubject === parsed.publisher && occursExactlyOnce(parsed.tupleObjectHashes, candidate.service.objectHash) && occursExactlyOnce(parsed.tupleObjectHashes, candidate.grant.objectHash) && occursExactlyOnce(parsed.tupleObjectHashes, candidate.subscription.objectHash);
+  return isNonnegativeSafeInteger4(candidate.tupleBlock) && isNonnegativeSafeInteger4(candidate.finalizedHead) && candidate.finalizedHead >= candidate.tupleBlock && parsed.tupleSubject === parsed.publisher && occursExactlyOnce(parsed.tupleObjectHashes, candidate.service.objectHash) && occursExactlyOnce(parsed.tupleObjectHashes, candidate.grant.objectHash) && occursExactlyOnce(parsed.tupleObjectHashes, candidate.subscription.objectHash);
 }
 async function bodyHashesAreValid(candidate, parsed) {
   const canonicalHashes = await Promise.all([
@@ -1323,8 +1702,7 @@ function publicBindingFailure(candidate, parsed) {
   if (!hasExactKeyBinding(parsed.service, hashedKey, parsed.subscription)) return "key-binding-invalid";
   if (!isActiveAt(parsed.service, candidate.tupleBlock) || !isActiveAt(parsed.service, candidate.finalizedHead)) return "service-inactive";
   if (!isActiveAt(parsed.key, candidate.tupleBlock) || !isActiveAt(parsed.key, candidate.finalizedHead)) return "key-inactive";
-  if (!expiryWithinServicePolicy(parsed.subscription, parsed.service, candidate.tupleBlock) || parsed.subscription.expiresAtBlock - candidate.finalizedHead <= 2) return "subscription-expiry-invalid";
-  return void 0;
+  return !expiryWithinServicePolicy(parsed.subscription, parsed.service, candidate.tupleBlock) || parsed.subscription.expiresAtBlock - candidate.finalizedHead <= 2 ? "subscription-expiry-invalid" : void 0;
 }
 async function decryptCandidate(candidate, parsed) {
   let privateKey;
@@ -1388,19 +1766,14 @@ async function validateAndDecryptPublisherSubscription(candidate) {
   if (!hasExactQueueScope(parsed.grant, decrypted.plaintext)) {
     return rejectPublisherSubscription("grant-scope-invalid");
   }
-  if (!filterWithinServicePolicy(parsed.service, decrypted.plaintext)) {
-    return rejectPublisherSubscription("service-limit-invalid");
-  }
-  return validatedPublisherSubscription(candidate, parsed, decrypted.plaintext);
+  return filterWithinServicePolicy(parsed.service, decrypted.plaintext) ? validatedPublisherSubscription(candidate, parsed, decrypted.plaintext) : rejectPublisherSubscription("service-limit-invalid");
 }
 function endpointChallengeMatchesPublisherContext(challenge, context) {
   const parsed = EndpointChallengeZod3.safeParse(challenge);
-  if (!parsed.success) return false;
-  return parsed.data.chainId === context.chainId && parsed.data.publisher === context.publisher && parsed.data.subscriber === context.subscriber && parsed.data.service === context.service && parsed.data.encryptionKey === context.encryptionKey && parsed.data.keyId === context.keyId && parsed.data.subscription === context.subscription && parsed.data.grant === context.grant && parsed.data.eventKind === context.eventKind;
+  return parsed.success && parsed.data.chainId === context.chainId && parsed.data.publisher === context.publisher && parsed.data.subscriber === context.subscriber && parsed.data.service === context.service && parsed.data.encryptionKey === context.encryptionKey && parsed.data.keyId === context.keyId && parsed.data.subscription === context.subscription && parsed.data.grant === context.grant && parsed.data.eventKind === context.eventKind;
 }
 async function challengeRecordMatches(record, challenge, challengeHash, responseHash) {
-  if (record.challengeHash !== challengeHash || await endpointChallengeHash(record.challenge) !== challengeHash || await endpointChallengeHash(challenge) !== challengeHash) return false;
-  return responseHash === void 0 || record.responseHash === responseHash;
+  return record.challengeHash === challengeHash && await endpointChallengeHash(record.challenge) === challengeHash && await endpointChallengeHash(challenge) === challengeHash && (responseHash === void 0 || record.responseHash === responseHash);
 }
 async function issuePublisherEndpointChallenge(input) {
   const context = input.subscription.context;
@@ -1428,10 +1801,10 @@ async function issuePublisherEndpointChallenge(input) {
   }
 }
 async function beginPublisherEndpointChallengeAttempt(input) {
-  if (!isNonnegativeSafeInteger3(input.nowSeconds)) return { kind: "store-invalid" };
+  if (!isNonnegativeSafeInteger4(input.nowSeconds)) return { kind: "store-invalid" };
   try {
     const result = await input.store.beginAttempt({
-      challengeHash: HashZod4.parse(input.challengeHash),
+      challengeHash: HashZod6.parse(input.challengeHash),
       nowSeconds: input.nowSeconds
     });
     if (!["already-attempted", "expired", "missing", "started", "verified"].includes(result.kind)) {
@@ -1440,11 +1813,10 @@ async function beginPublisherEndpointChallengeAttempt(input) {
     if (result.kind !== "missing" && !await challengeRecordMatches(
       result.record,
       result.record.challenge,
-      HashZod4.parse(input.challengeHash)
+      HashZod6.parse(input.challengeHash)
     )) return { kind: "store-invalid" };
     if ((result.kind === "started" || result.kind === "already-attempted") && result.record.state !== "attempted") return { kind: "store-invalid" };
-    if (result.kind === "verified" && result.record.state !== "verified") return { kind: "store-invalid" };
-    return result;
+    return result.kind === "verified" && result.record.state !== "verified" ? { kind: "store-invalid" } : result;
   } catch {
     return { kind: "store-unavailable" };
   }
@@ -1461,16 +1833,13 @@ async function validateChallengeCompletion(input, result, challengeHash, respons
   if (result.kind === "expired") return completeFailure("challenge-expired");
   if (result.kind === "not-attempted") return completeFailure("challenge-not-attempted");
   if (result.kind === "collision") return completeFailure("challenge-response-collision");
-  if (result.kind !== "duplicate" && result.kind !== "verified" || !await challengeRecordMatches(result.record, input.challenge, challengeHash, responseHash)) {
-    return completeFailure("challenge-store-invalid");
-  }
-  return result;
+  return result.kind !== "duplicate" && result.kind !== "verified" || !await challengeRecordMatches(result.record, input.challenge, challengeHash, responseHash) ? completeFailure("challenge-store-invalid") : result;
 }
 async function completePublisherEndpointChallenge(input) {
   if (!endpointChallengeMatchesPublisherContext(input.challenge, input.subscription.context)) {
     return completeFailure("challenge-context-invalid");
   }
-  if (!isNonnegativeSafeInteger3(input.nowSeconds)) return completeFailure("challenge-expired");
+  if (!isNonnegativeSafeInteger4(input.nowSeconds)) return completeFailure("challenge-expired");
   const insideDecisionWindow = input.challenge.issuedAt <= input.nowSeconds && input.nowSeconds < input.challenge.expiresAt;
   const proofInput = {
     challenge: input.challenge,
@@ -1520,33 +1889,33 @@ async function completePublisherEndpointChallenge(input) {
 }
 function filterWithinServicePolicy(service, plaintext) {
   const filter = plaintext.filter;
-  return filter.maxPositionsPerWake <= service.limits.maxPositionsPerWake && service.events.some((event) => wakeSourcesEqual(event.source, filter.source));
+  return service.deliveryMode === filter.deliveryMode && JSON.stringify(service.bestEffort) === JSON.stringify(filter.bestEffort) && filter.maxPositionsPerWake <= service.limits.maxPositionsPerWake && service.events.some((event) => wakeSourcesEqual(event.source, filter.source));
 }
 
 // src/sourceWakeActivation.ts
 import {
-  ChainIdZod as ChainIdZod2,
-  DeploymentIdZod as DeploymentIdZod2,
-  HashZod as HashZod5,
-  NonnegativeJsonSafeIntegerZod as NonnegativeJsonSafeIntegerZod2,
-  NormalizedAddressZod as NormalizedAddressZod5,
-  PositiveJsonSafeIntegerZod
+  ChainIdZod as ChainIdZod3,
+  DeploymentIdZod as DeploymentIdZod3,
+  HashZod as HashZod7,
+  NonnegativeJsonSafeIntegerZod as NonnegativeJsonSafeIntegerZod4,
+  NormalizedAddressZod as NormalizedAddressZod7,
+  PositiveJsonSafeIntegerZod as PositiveJsonSafeIntegerZod2
 } from "@xyo-network/event-kit-schemas";
-import { z as z2 } from "zod";
-var SourceWakeSubscriptionActivationZod = z2.strictObject({
-  atBlock: NonnegativeJsonSafeIntegerZod2,
-  activeFromBlock: NonnegativeJsonSafeIntegerZod2,
-  expiresAtBlock: PositiveJsonSafeIntegerZod,
-  authorizationChainId: ChainIdZod2,
-  controller: NormalizedAddressZod5,
-  publisher: NormalizedAddressZod5,
-  deploymentId: DeploymentIdZod2,
-  queueId: z2.string().min(1).max(255).optional(),
-  sourceHash: HashZod5,
-  filterHash: HashZod5,
-  subscriptionHash: HashZod5,
-  serviceHash: HashZod5,
-  grantHash: HashZod5
+import { z as z4 } from "zod";
+var SourceWakeSubscriptionActivationZod = z4.strictObject({
+  atBlock: NonnegativeJsonSafeIntegerZod4,
+  activeFromBlock: NonnegativeJsonSafeIntegerZod4,
+  expiresAtBlock: PositiveJsonSafeIntegerZod2,
+  authorizationChainId: ChainIdZod3,
+  controller: NormalizedAddressZod7,
+  publisher: NormalizedAddressZod7,
+  deploymentId: DeploymentIdZod3,
+  queueId: z4.string().min(1).max(255).optional(),
+  sourceHash: HashZod7,
+  filterHash: HashZod7,
+  subscriptionHash: HashZod7,
+  serviceHash: HashZod7,
+  grantHash: HashZod7
 }).refine(
   (value) => value.activeFromBlock <= value.atBlock && value.atBlock < value.expiresAtBlock,
   "Subscription must be active at the exact finalized authorization snapshot"
@@ -1554,17 +1923,17 @@ var SourceWakeSubscriptionActivationZod = z2.strictObject({
 
 // src/statementGraphWakeGrantAuthorizer.ts
 import {
-  ChainIdZod as ChainIdZod3,
-  WakeSourceZod as WakeSourceZod2
+  ChainIdZod as ChainIdZod4,
+  WakeSourceZod as WakeSourceZod3
 } from "@xyo-network/event-kit-schemas";
 
 // src/grantEvidence.ts
 import {
   asWakeGrantObject,
   asWakeGrantRevocation,
-  DeploymentIdZod as DeploymentIdZod3,
-  HashZod as HashZod6,
-  NormalizedAddressZod as NormalizedAddressZod6,
+  DeploymentIdZod as DeploymentIdZod4,
+  HashZod as HashZod8,
+  NormalizedAddressZod as NormalizedAddressZod8,
   WakeGrantObjectSchema as WakeGrantObjectSchema3,
   WakeGrantRevocationSchema as WakeGrantRevocationSchema3
 } from "@xyo-network/event-kit-schemas";
@@ -1620,9 +1989,7 @@ async function readRevocations(viewer, controller, subject, atBlock) {
   for (const claim of claims) {
     if (!isLiveClaim(claim, controller, subject, WakeGrantRevocationSchema3, atBlock)) continue;
     const object = await viewer.object(claim.objectHash);
-    if (object?.assurance !== "resolved") continue;
-    if (object.declaredSchema !== WakeGrantRevocationSchema3 || object.objectHash !== claim.objectHash) continue;
-    if (!isRecord2(object.params) || Object.hasOwn(object.params, "schema")) continue;
+    if (object?.assurance !== "resolved" || object.declaredSchema !== WakeGrantRevocationSchema3 || object.objectHash !== claim.objectHash || !isRecord3(object.params) || Object.hasOwn(object.params, "schema")) continue;
     const revocation = asWakeGrantRevocation({ ...object.params, schema: object.declaredSchema });
     if (revocation !== void 0) revoked.add(revocation.grant);
   }
@@ -1654,61 +2021,55 @@ async function resolveEvidence(viewer, claim, request, atBlock, revokedGrantHash
   });
 }
 function isLiveClaim(claim, controller, subject, declaredObjectSchema, atBlock) {
-  if (claim.source !== controller) return false;
-  if (claim.subject !== subject) return false;
-  if (claim.declaredObjectSchema !== declaredObjectSchema) return false;
-  if (!isNonnegativeSafeInteger4(claim.firstBlock) || claim.firstBlock > atBlock) return false;
-  if (!isNonnegativeSafeInteger4(claim.lastBlock) || claim.lastBlock < claim.firstBlock) return false;
-  if (!HashZod6.safeParse(claim.firstEventHash).success) return false;
-  return HashZod6.safeParse(claim.objectHash).success;
+  return claim.source === controller && claim.subject === subject && claim.declaredObjectSchema === declaredObjectSchema && isNonnegativeSafeInteger5(claim.firstBlock) && claim.firstBlock <= atBlock && isNonnegativeSafeInteger5(claim.lastBlock) && claim.lastBlock >= claim.firstBlock && HashZod8.safeParse(claim.firstEventHash).success && HashZod8.safeParse(claim.objectHash).success;
 }
 function parseExactGrantObject(object, expectedObjectHash) {
   if (object?.assurance !== "resolved") return void 0;
   if (object.declaredSchema !== WakeGrantObjectSchema3 || object.objectHash !== expectedObjectHash) return void 0;
-  if (!isRecord2(object.params) || Object.hasOwn(object.params, "schema")) return void 0;
+  if (!isRecord3(object.params) || Object.hasOwn(object.params, "schema")) return void 0;
   return asWakeGrantObject({
     ...object.params,
     schema: object.declaredSchema
   });
 }
 function assertValidRequest(request) {
-  if (request.exactGrantHash !== void 0 && !HashZod6.safeParse(request.exactGrantHash).success) {
+  if (request.exactGrantHash !== void 0 && !HashZod8.safeParse(request.exactGrantHash).success) {
     throw new TypeError("Exact grant hash must be canonical lowercase hexadecimal");
   }
-  if (!NormalizedAddressZod6.safeParse(request.controller).success) {
+  if (!NormalizedAddressZod8.safeParse(request.controller).success) {
     throw new TypeError("Grant controller must be a normalized address");
   }
-  if (!NormalizedAddressZod6.safeParse(request.publisher).success) {
+  if (!NormalizedAddressZod8.safeParse(request.publisher).success) {
     throw new TypeError("Grant publisher must be a normalized address");
   }
-  if (!DeploymentIdZod3.safeParse(request.deploymentId).success) {
+  if (!DeploymentIdZod4.safeParse(request.deploymentId).success) {
     throw new TypeError("Grant deploymentId must contain 1 to 255 characters");
   }
   if (request.queueId !== void 0 && (request.queueId.length === 0 || request.queueId.length > 255)) {
     throw new TypeError("Grant queueId must contain 1 to 255 characters when configured");
   }
-  if (!isNonnegativeSafeInteger4(request.expectedHead)) {
+  if (!isNonnegativeSafeInteger5(request.expectedHead)) {
     throw new RangeError("Grant expectedHead must be a nonnegative safe integer");
   }
 }
 async function readHead(viewer) {
   const head = await viewer.head();
-  if (!isNonnegativeSafeInteger4(head)) {
+  if (!isNonnegativeSafeInteger5(head)) {
     throw new RangeError("Statement Graph head must be a nonnegative safe integer");
   }
   return head;
 }
-function isNonnegativeSafeInteger4(value) {
+function isNonnegativeSafeInteger5(value) {
   return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
 }
-function isRecord2(value) {
+function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
 // src/statementGraphWakeGrantAuthorizer.ts
 function createStatementGraphWakeGrantAuthorizer(options) {
-  const authorizationChainId = ChainIdZod3.parse(options.authorizationChainId);
-  const source = WakeSourceZod2.parse(options.source);
+  const authorizationChainId = ChainIdZod4.parse(options.authorizationChainId);
+  const source = WakeSourceZod3.parse(options.source);
   const grants = createDeploymentGrantAuthorizer({ viewer: options.viewer });
   return Object.freeze({
     async authorizePublisher(request) {
@@ -1740,196 +2101,6 @@ function createStatementGraphWakeGrantAuthorizer(options) {
   });
 }
 
-// src/verifyWakeRequest.ts
-import {
-  ChainIdZod as ChainIdZod4,
-  DeploymentIdZod as DeploymentIdZod4,
-  HashZod as HashZod7,
-  MAX_POSITIONS_PER_SUBSCRIPTION_WAKE,
-  NonnegativeJsonSafeIntegerZod as NonnegativeJsonSafeIntegerZod3,
-  NormalizedAddressZod as NormalizedAddressZod7,
-  PositiveJsonSafeIntegerZod as PositiveJsonSafeIntegerZod2,
-  SOURCE_WAKE_FILTER_PROFILE as SOURCE_WAKE_FILTER_PROFILE2,
-  WakeEnvelopeZod as WakeEnvelopeZod2,
-  WakeJwtAudienceZod as WakeJwtAudienceZod2,
-  WakeJwtHeaderZod,
-  WakeJwtPayloadZod,
-  WakeJwtSchema,
-  WakeSourceZod as WakeSourceZod3
-} from "@xyo-network/event-kit-schemas";
-import {
-  Account,
-  PayloadBuilder as PayloadBuilder5
-} from "@xyo-network/sdk";
-import { z as z3 } from "zod";
-var EVENT_KIT_MAX_JWT_LIFETIME_SECONDS = 300;
-var EVENT_KIT_MAX_FUTURE_IAT_SECONDS = 60;
-var WakeAdmissionRouteZod = z3.strictObject({
-  audience: WakeJwtAudienceZod2,
-  authorizationChainId: ChainIdZod4,
-  controller: NormalizedAddressZod7,
-  deploymentId: DeploymentIdZod4,
-  queueId: z3.string().min(1).max(255).optional(),
-  source: WakeSourceZod3,
-  filterHash: HashZod7,
-  subscriptionHash: HashZod7,
-  fromPosition: NonnegativeJsonSafeIntegerZod3,
-  maxPositionsPerWake: PositiveJsonSafeIntegerZod2.max(MAX_POSITIONS_PER_SUBSCRIPTION_WAKE),
-  maxGrantLagBlocks: NonnegativeJsonSafeIntegerZod3
-});
-async function verifyWakeRequest(input) {
-  const routeResult = WakeAdmissionRouteZod.safeParse(input.route);
-  if (!routeResult.success || !NonnegativeJsonSafeIntegerZod3.safeParse(input.nowSeconds).success) {
-    return { ok: false, reason: "configuration-invalid" };
-  }
-  const eventResult = WakeEnvelopeZod2.safeParse(input.body);
-  if (!eventResult.success) return malformedWake(input.body, eventResult.error.issues);
-  const route = routeResult.data;
-  if (route.filterHash !== await sourceWakeFilterHash({
-    schema: SOURCE_WAKE_FILTER_PROFILE2,
-    source: route.source,
-    fromPosition: route.fromPosition,
-    maxPositionsPerWake: route.maxPositionsPerWake
-  })) return { ok: false, reason: "configuration-invalid" };
-  const event = Object.freeze({ ...eventResult.data, source: Object.freeze(eventResult.data.source) });
-  if (event.authorizationChainId !== route.authorizationChainId) {
-    return { ok: false, reason: "event-authorization-chain-mismatch" };
-  }
-  if (!wakeSourcesEqual(event.source, route.source)) return { ok: false, reason: "event-source-mismatch" };
-  if (event.filterHash !== route.filterHash) return { ok: false, reason: "event-filter-mismatch" };
-  if (event.deploymentId !== route.deploymentId || event.queueId !== route.queueId) {
-    return { ok: false, reason: "event-target-mismatch" };
-  }
-  if (event.fromPosition < route.fromPosition) return { ok: false, reason: "range-before-floor" };
-  if (event.toPosition - event.fromPosition >= route.maxPositionsPerWake) return { ok: false, reason: "range-too-large" };
-  const jwt = await verifyJwtProfile(input.jwt, route.audience, input.nowSeconds);
-  if (!jwt.ok) return jwt;
-  let eventHash;
-  try {
-    eventHash = await PayloadBuilder5.dataHash(event);
-  } catch {
-    return { ok: false, reason: "event-hash-failed" };
-  }
-  if (eventHash !== jwt.jwt.eventHash) return { ok: false, reason: "event-hash-mismatch" };
-  const sourceHash = await wakeSourceHash(route.source);
-  return Object.freeze({
-    ok: true,
-    verified: Object.freeze({
-      audience: route.audience,
-      deploymentId: event.deploymentId,
-      event,
-      eventHash,
-      expiresAt: jwt.jwt.expiresAt,
-      fromPosition: event.fromPosition,
-      issuedAt: event.issuedAt,
-      jwtId: jwt.jwt.jwtId,
-      publisher: jwt.jwt.publisher,
-      ...event.queueId === void 0 ? {} : { queueId: event.queueId },
-      route: Object.freeze({
-        ...route,
-        source: Object.freeze(route.source),
-        sourceHash
-      }),
-      toPosition: event.toPosition,
-      tokenIssuedAt: jwt.jwt.issuedAt,
-      wakeId: event.wakeId
-    })
-  });
-}
-async function verifyJwtProfile(token, audience, nowSeconds) {
-  let verified;
-  try {
-    verified = await Account.verifyJwt(token, { audience, now: nowSeconds });
-  } catch (error) {
-    return reject2("jwt-malformed", [errorMessage2(error)]);
-  }
-  if (!verified.ok) {
-    if (Object.hasOwn(verified.payload ?? {}, "nbf")) return reject2("jwt-nbf-not-allowed");
-    return reject2(classifySdkJwtFailure(verified.reasons), verified.reasons);
-  }
-  const wireResult = parseStrictJwtWire(verified.header, verified.payload, audience);
-  if (!wireResult.ok) return wireResult;
-  const { header: strictHeader, payload: strictPayload } = wireResult;
-  if (strictHeader.kid !== strictPayload.iss) return reject2("jwt-identity-invalid");
-  if (strictPayload.exp <= nowSeconds) return reject2("jwt-expired");
-  if (strictPayload.exp - strictPayload.iat > EVENT_KIT_MAX_JWT_LIFETIME_SECONDS) return reject2("jwt-lifetime-invalid");
-  if (strictPayload.iat - nowSeconds > EVENT_KIT_MAX_FUTURE_IAT_SECONDS) return reject2("jwt-future-iat");
-  const jwt = Object.freeze({
-    eventHash: strictPayload.eventHash,
-    expiresAt: strictPayload.exp,
-    issuedAt: strictPayload.iat,
-    jwtId: strictPayload.jti,
-    publisher: strictPayload.iss
-  });
-  return Object.freeze({ jwt, ok: true });
-}
-function parseStrictJwtWire(header, payload, audience) {
-  const headerResult = WakeJwtHeaderZod.safeParse(header);
-  if (!headerResult.success) {
-    if (!NormalizedAddressZod7.safeParse(header.kid).success) return reject2("jwt-identity-invalid");
-    return reject2("jwt-header-invalid", zodDetails(headerResult.error.issues));
-  }
-  if (Object.hasOwn(payload, "nbf")) return reject2("jwt-nbf-not-allowed");
-  if (!NormalizedAddressZod7.safeParse(payload.iss).success) return reject2("jwt-identity-invalid");
-  if (payload.schema !== WakeJwtSchema) return reject2("jwt-schema-mismatch");
-  if (payload.aud !== audience) return reject2("jwt-audience-mismatch");
-  if (!isNonnegativeSafeInteger5(payload.iat) || !isNonnegativeSafeInteger5(payload.exp) || payload.exp <= payload.iat) {
-    return reject2("jwt-lifetime-invalid");
-  }
-  const payloadResult = WakeJwtPayloadZod.safeParse(payload);
-  if (!payloadResult.success) return reject2("jwt-claims-invalid", zodDetails(payloadResult.error.issues));
-  return Object.freeze({
-    header: headerResult.data,
-    ok: true,
-    payload: payloadResult.data
-  });
-}
-function classifySdkJwtFailure(reasons) {
-  if (reasons.some((reason) => reason.startsWith("audience mismatch:"))) return "jwt-audience-mismatch";
-  if (reasons.some((reason) => reason.startsWith("expired:"))) return "jwt-expired";
-  if (reasons.some((reason) => reason.startsWith("unsupported alg:") || reason.startsWith("unsupported typ:"))) {
-    return "jwt-header-invalid";
-  }
-  if (reasons.some((reason) => reason.startsWith("invalid public key:") || reason.startsWith("public key does not derive to kid:") || reason === "header.kid does not match payload.iss")) {
-    return "jwt-identity-invalid";
-  }
-  return "jwt-invalid";
-}
-function malformedWake(body, issues) {
-  const details = zodDetails(issues);
-  if (hasInvertedSafeRange(body)) return reject2("range-invalid", details);
-  if (isRecord3(body) && Object.hasOwn(body, "wakeId") && issues.some((issue) => issue.path[0] === "wakeId")) return reject2("wake-id-invalid", details);
-  return reject2("event-malformed", details);
-}
-function hasInvertedSafeRange(value) {
-  if (!isRecord3(value)) return false;
-  const { fromPosition, toPosition } = value;
-  return typeof fromPosition === "number" && typeof toPosition === "number" && isNonnegativeSafeInteger5(fromPosition) && isNonnegativeSafeInteger5(toPosition) && fromPosition > toPosition;
-}
-function isNonnegativeSafeInteger5(value) {
-  return Number.isSafeInteger(value) && value >= 0;
-}
-function isRecord3(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function zodDetails(issues) {
-  return issues.map((issue) => {
-    const path = issue.path.map(String).join(".") || "<root>";
-    return `${path}: ${issue.message}`;
-  });
-}
-function reject2(reason, details) {
-  if (details === void 0) return Object.freeze({ ok: false, reason });
-  return Object.freeze({
-    details: Object.freeze([...details]),
-    ok: false,
-    reason
-  });
-}
-function errorMessage2(error) {
-  return error instanceof Error ? error.message : String(error);
-}
-
 // src/wakeQueue.ts
 async function drainQueue(queue, handler) {
   let handled = 0;
@@ -1948,6 +2119,8 @@ async function drainQueue(queue, handler) {
 }
 export {
   AdmittedWakeZod,
+  BestEffortAdmissionAcknowledgmentZod,
+  BestEffortSecurityStateZod,
   EVENT_KIT_MAX_FUTURE_IAT_SECONDS,
   EVENT_KIT_MAX_JWT_LIFETIME_SECONDS,
   EVENT_KIT_REPLAY_RETENTION_SKEW_SECONDS,
@@ -1955,10 +2128,13 @@ export {
   WakeAdmissionRouteZod,
   WakeSubscriptionDecryptionError,
   admitAndEnqueue,
+  admitBestEffortHint,
   beginPublisherEndpointChallengeAttempt,
   canonicalJson,
   canonicalJsonBytes,
+  commitBestEffortSecurity,
   completePublisherEndpointChallenge,
+  createBestEffortSecurityState,
   createEncryptedWakeSubscription,
   createEndpointChallenge,
   createEndpointChallengeResponse,
@@ -1986,6 +2162,7 @@ export {
   handshakeObjectHash,
   issuePublisherEndpointChallenge,
   parseAdmittedWake,
+  parseBestEffortSecurityState,
   resolvePreferredEncryptionKey,
   selectPublisherService,
   selectSubscriptionActivation,