@xyo-network/event-kit-protocol 1.0.1 → 2.2.0

package/dist/neutral/index.mjs

@@ -12,7 +12,7 @@ async function admitVerifiedWake(input) {
   if (!isNonnegativeSafeInteger(input.expectedHead)) {
     return reject("grant-view-invalid", ["expectedHead must be a nonnegative safe integer"]);
   }
-  const authorization = await authorize(input);
+  const authorization = await authorizeVerifiedWake(input);
   return authorization.ok ? await commitAuthorizedWake(input.inbox, attempt, authorization.grant, wake) : authorization.failure;
 }
 async function resolvePriorAttempt(inbox, attempt, wake) {
@@ -79,7 +79,7 @@ function createAttempt(verified) {
     ok: true
   };
 }
-async function authorize(input) {
+async function authorizeVerifiedWake(input) {
   const { route } = input.verified;
   let decision;
   try {
@@ -133,6 +133,7 @@ function validateGrantEvidence(evidence, verified, atBlock) {
   if (!isRecord(evidence)) return reject("grant-view-invalid", ["enabled grant decision omitted evidence"]);
   const requiredFields = [
     "assertedAtBlock",
+    "authorizationKind",
     "authorizationChainId",
     "filterHash",
     "sourceHash",
@@ -145,6 +146,9 @@ function validateGrantEvidence(evidence, verified, atBlock) {
   if (requiredFields.some((field) => !Object.hasOwn(evidence, field))) {
     return reject("grant-view-invalid", ["enabled grant evidence requires own canonical fields"]);
   }
+  if (evidence.authorizationKind !== "activated-subscription") {
+    return reject("grant-view-invalid", ["enabled authorization requires finalized subscription activation"]);
+  }
   if (typeof evidence.id !== "string" || evidence.id.length === 0) {
     return reject("grant-view-invalid", ["enabled grant evidence requires a non-empty id"]);
   }
@@ -180,6 +184,7 @@ function validateReceipt(receipt, attempt) {
 function snapshotGrantEvidence(evidence) {
   return Object.freeze({
     assertedAtBlock: evidence.assertedAtBlock,
+    authorizationKind: evidence.authorizationKind,
     authorizationChainId: evidence.authorizationChainId,
     sourceHash: evidence.sourceHash,
     filterHash: evidence.filterHash,
@@ -266,6 +271,7 @@ async function parseAdmittedWake(value) {
 // src/admitAndEnqueue.ts
 async function admitAndEnqueue(input) {
   const { verified } = input;
+  if (verified.route.deliveryMode !== "durable") throw new TypeError("Durable admission requires explicit durable delivery mode");
   const wake = AdmittedWakeZod.parse({
     audience: verified.audience,
     deploymentId: verified.deploymentId,
@@ -281,6 +287,53 @@ async function admitAndEnqueue(input) {
   return await admitVerifiedWake({ ...input, wake });
 }
 
+// src/bestEffortAdmission.ts
+import {
+  HashZod as HashZod3,
+  NonnegativeJsonSafeIntegerZod as NonnegativeJsonSafeIntegerZod3,
+  NormalizedAddressZod as NormalizedAddressZod3,
+  WakeIdZod as WakeIdZod2,
+  WakeJwtAudienceZod as WakeJwtAudienceZod3,
+  WakeJwtIdZod as WakeJwtIdZod2
+} from "@xyo-network/event-kit-schemas";
+import { z as z3 } from "zod";
+
+// src/verifyWakeRequest.ts
+import {
+  ChainIdZod,
+  DeploymentIdZod as DeploymentIdZod2,
+  HashZod as HashZod2,
+  MAX_POSITIONS_PER_SUBSCRIPTION_WAKE,
+  NonnegativeJsonSafeIntegerZod as NonnegativeJsonSafeIntegerZod2,
+  NormalizedAddressZod as NormalizedAddressZod2,
+  PositiveJsonSafeIntegerZod,
+  SOURCE_WAKE_FILTER_PROFILE,
+  validWakeDeliveryTerms,
+  WakeDeliveryTermsFields,
+  WakeEnvelopeZod as WakeEnvelopeZod2,
+  WakeJwtAudienceZod as WakeJwtAudienceZod2,
+  WakeJwtHeaderZod,
+  WakeJwtPayloadZod,
+  WakeJwtSchema,
+  WakeSourceZod as WakeSourceZod2
+} from "@xyo-network/event-kit-schemas";
+import {
+  Account,
+  PayloadBuilder as PayloadBuilder3
+} from "@xyo-network/sdk";
+import { z as z2 } from "zod";
+
+// src/sourceWakeIdentity.ts
+import {
+  SourceWakeSubscriptionFilterZod,
+  WakeSourceSchema,
+  WakeSourceZod
+} from "@xyo-network/event-kit-schemas";
+import {
+  asSchema,
+  PayloadBuilder as PayloadBuilder2
+} from "@xyo-network/sdk";
+
 // src/canonicalJson.ts
 var textEncoder = new TextEncoder();
 function hasUnpairedSurrogate(value) {
@@ -330,6 +383,379 @@ function canonicalJsonBytes(value) {
   return textEncoder.encode(canonicalize(value));
 }
 
+// src/sourceWakeIdentity.ts
+async function wakeSourceHash(source) {
+  return await PayloadBuilder2.dataHash({ schema: WakeSourceSchema, ...WakeSourceZod.parse(source) });
+}
+function wakeSourcesEqual(left, right) {
+  return canonicalJson(WakeSourceZod.parse(left)) === canonicalJson(WakeSourceZod.parse(right));
+}
+async function sourceWakeFilterHash(filter) {
+  const parsed = SourceWakeSubscriptionFilterZod.parse(filter);
+  return await PayloadBuilder2.dataHash({ ...parsed, schema: asSchema(parsed.schema, true) });
+}
+
+// src/verifyWakeRequest.ts
+var EVENT_KIT_MAX_JWT_LIFETIME_SECONDS = 300;
+var EVENT_KIT_MAX_FUTURE_IAT_SECONDS = 60;
+var WakeAdmissionRouteZod = z2.strictObject({
+  ...WakeDeliveryTermsFields,
+  audience: WakeJwtAudienceZod2,
+  authorizationChainId: ChainIdZod,
+  controller: NormalizedAddressZod2,
+  deploymentId: DeploymentIdZod2,
+  queueId: z2.string().min(1).max(255).optional(),
+  source: WakeSourceZod2,
+  filterHash: HashZod2,
+  subscriptionHash: HashZod2,
+  fromPosition: NonnegativeJsonSafeIntegerZod2,
+  maxPositionsPerWake: PositiveJsonSafeIntegerZod.max(MAX_POSITIONS_PER_SUBSCRIPTION_WAKE),
+  maxGrantLagBlocks: NonnegativeJsonSafeIntegerZod2
+}).refine((route) => validWakeDeliveryTerms(route) && (route.deliveryMode !== "best-effort" || route.maxPositionsPerWake === 1), "Invalid explicit delivery terms");
+function verifyEventBinding(event, route, nowSeconds) {
+  if (event.authorizationChainId !== route.authorizationChainId) {
+    return { ok: false, reason: "event-authorization-chain-mismatch" };
+  }
+  if (!wakeSourcesEqual(event.source, route.source)) return { ok: false, reason: "event-source-mismatch" };
+  if (event.filterHash !== route.filterHash) return { ok: false, reason: "event-filter-mismatch" };
+  if (event.deploymentId !== route.deploymentId || event.queueId !== route.queueId) {
+    return { ok: false, reason: "event-target-mismatch" };
+  }
+  if (event.deliveryMode !== route.deliveryMode) return { ok: false, reason: "event-mode-mismatch" };
+  if (route.deliveryMode === "best-effort") {
+    if (event.issuedAt > nowSeconds + EVENT_KIT_MAX_FUTURE_IAT_SECONDS) return { ok: false, reason: "hint-future-issued-at" };
+    if (route.bestEffort === void 0 || nowSeconds > event.issuedAt + route.bestEffort.maxHintAgeSeconds) return { ok: false, reason: "hint-expired" };
+  }
+  if (event.fromPosition < route.fromPosition) return { ok: false, reason: "range-before-floor" };
+  if (event.toPosition - event.fromPosition >= route.maxPositionsPerWake) return { ok: false, reason: "range-too-large" };
+}
+async function verifyWakeRequest(input) {
+  const routeResult = WakeAdmissionRouteZod.safeParse(input.route);
+  if (!routeResult.success || !NonnegativeJsonSafeIntegerZod2.safeParse(input.nowSeconds).success) {
+    return { ok: false, reason: "configuration-invalid" };
+  }
+  const eventResult = WakeEnvelopeZod2.safeParse(input.body);
+  if (!eventResult.success) return malformedWake(input.body, eventResult.error.issues);
+  const route = routeResult.data;
+  if (route.filterHash !== await sourceWakeFilterHash({
+    schema: SOURCE_WAKE_FILTER_PROFILE,
+    deliveryMode: route.deliveryMode,
+    ...route.bestEffort === void 0 ? {} : { bestEffort: route.bestEffort },
+    source: route.source,
+    fromPosition: route.fromPosition,
+    maxPositionsPerWake: route.maxPositionsPerWake
+  })) return { ok: false, reason: "configuration-invalid" };
+  const event = Object.freeze({ ...eventResult.data, source: Object.freeze(eventResult.data.source) });
+  const mismatch = verifyEventBinding(event, route, input.nowSeconds);
+  if (mismatch !== void 0) return mismatch;
+  const jwt = await verifyJwtProfile(input.jwt, route.audience, input.nowSeconds);
+  if (!jwt.ok) return jwt;
+  let eventHash;
+  try {
+    eventHash = await PayloadBuilder3.dataHash(event);
+  } catch {
+    return { ok: false, reason: "event-hash-failed" };
+  }
+  if (eventHash !== jwt.jwt.eventHash) return { ok: false, reason: "event-hash-mismatch" };
+  const sourceHash = await wakeSourceHash(route.source);
+  return Object.freeze({
+    ok: true,
+    verified: Object.freeze({
+      audience: route.audience,
+      deploymentId: event.deploymentId,
+      event,
+      eventHash,
+      expiresAt: jwt.jwt.expiresAt,
+      fromPosition: event.fromPosition,
+      issuedAt: event.issuedAt,
+      jwtId: jwt.jwt.jwtId,
+      publisher: jwt.jwt.publisher,
+      ...event.queueId === void 0 ? {} : { queueId: event.queueId },
+      route: Object.freeze({
+        ...route,
+        source: Object.freeze(route.source),
+        sourceHash,
+        ...route.bestEffort === void 0 ? {} : { bestEffort: Object.freeze(route.bestEffort) }
+      }),
+      toPosition: event.toPosition,
+      tokenIssuedAt: jwt.jwt.issuedAt,
+      wakeId: event.wakeId
+    })
+  });
+}
+async function verifyJwtProfile(token, audience, nowSeconds) {
+  let verified;
+  try {
+    verified = await Account.verifyJwt(token, { audience, now: nowSeconds });
+  } catch (error) {
+    return reject2("jwt-malformed", [errorMessage2(error)]);
+  }
+  if (!verified.ok) {
+    return Object.hasOwn(verified.payload ?? {}, "nbf") ? reject2("jwt-nbf-not-allowed") : reject2(classifySdkJwtFailure(verified.reasons), verified.reasons);
+  }
+  const wireResult = parseStrictJwtWire(verified.header, verified.payload, audience);
+  if (!wireResult.ok) return wireResult;
+  const { header: strictHeader, payload: strictPayload } = wireResult;
+  if (strictHeader.kid !== strictPayload.iss) return reject2("jwt-identity-invalid");
+  if (strictPayload.exp <= nowSeconds) return reject2("jwt-expired");
+  if (strictPayload.exp - strictPayload.iat > EVENT_KIT_MAX_JWT_LIFETIME_SECONDS) return reject2("jwt-lifetime-invalid");
+  if (strictPayload.iat - nowSeconds > EVENT_KIT_MAX_FUTURE_IAT_SECONDS) return reject2("jwt-future-iat");
+  const jwt = Object.freeze({
+    eventHash: strictPayload.eventHash,
+    expiresAt: strictPayload.exp,
+    issuedAt: strictPayload.iat,
+    jwtId: strictPayload.jti,
+    publisher: strictPayload.iss
+  });
+  return Object.freeze({ jwt, ok: true });
+}
+function parseStrictJwtWire(header, payload, audience) {
+  const headerResult = WakeJwtHeaderZod.safeParse(header);
+  if (!headerResult.success) {
+    return NormalizedAddressZod2.safeParse(header.kid).success ? reject2("jwt-header-invalid", zodDetails(headerResult.error.issues)) : reject2("jwt-identity-invalid");
+  }
+  if (Object.hasOwn(payload, "nbf")) return reject2("jwt-nbf-not-allowed");
+  if (!NormalizedAddressZod2.safeParse(payload.iss).success) return reject2("jwt-identity-invalid");
+  if (payload.schema !== WakeJwtSchema) return reject2("jwt-schema-mismatch");
+  if (payload.aud !== audience) return reject2("jwt-audience-mismatch");
+  if (!isNonnegativeSafeInteger2(payload.iat) || !isNonnegativeSafeInteger2(payload.exp) || payload.exp <= payload.iat) {
+    return reject2("jwt-lifetime-invalid");
+  }
+  const payloadResult = WakeJwtPayloadZod.safeParse(payload);
+  if (!payloadResult.success) return reject2("jwt-claims-invalid", zodDetails(payloadResult.error.issues));
+  return Object.freeze({
+    header: headerResult.data,
+    ok: true,
+    payload: payloadResult.data
+  });
+}
+function classifySdkJwtFailure(reasons) {
+  if (reasons.some((reason) => reason.startsWith("audience mismatch:"))) return "jwt-audience-mismatch";
+  if (reasons.some((reason) => reason.startsWith("expired:"))) return "jwt-expired";
+  if (reasons.some((reason) => reason.startsWith("unsupported alg:") || reason.startsWith("unsupported typ:"))) {
+    return "jwt-header-invalid";
+  }
+  return reasons.some((reason) => reason.startsWith("invalid public key:") || reason.startsWith("public key does not derive to kid:") || reason === "header.kid does not match payload.iss") ? "jwt-identity-invalid" : "jwt-invalid";
+}
+function malformedWake(body, issues) {
+  const details = zodDetails(issues);
+  if (hasInvertedSafeRange(body)) return reject2("range-invalid", details);
+  return reject2(isRecord2(body) && Object.hasOwn(body, "wakeId") && issues.some((issue) => issue.path[0] === "wakeId") ? "wake-id-invalid" : "event-malformed", details);
+}
+function hasInvertedSafeRange(value) {
+  if (!isRecord2(value)) return false;
+  const { fromPosition, toPosition } = value;
+  return typeof fromPosition === "number" && typeof toPosition === "number" && isNonnegativeSafeInteger2(fromPosition) && isNonnegativeSafeInteger2(toPosition) && fromPosition > toPosition;
+}
+function isNonnegativeSafeInteger2(value) {
+  return Number.isSafeInteger(value) && value >= 0;
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function zodDetails(issues) {
+  return issues.map((issue) => {
+    const path = issue.path.map(String).join(".") || "<root>";
+    return `${path}: ${issue.message}`;
+  });
+}
+function reject2(reason, details) {
+  if (details === void 0) return Object.freeze({ ok: false, reason });
+  return Object.freeze({
+    details: Object.freeze([...details]),
+    ok: false,
+    reason
+  });
+}
+function errorMessage2(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+
+// src/bestEffortAdmission.ts
+function hintRetention(input) {
+  const { verified, nowSeconds } = input;
+  const policy = verified.route.bestEffort;
+  if (verified.route.deliveryMode !== "best-effort" || verified.event.deliveryMode !== "best-effort" || policy === void 0 || verified.fromPosition !== verified.toPosition || !Number.isSafeInteger(nowSeconds) || nowSeconds < 0 || !Number.isSafeInteger(input.expectedHead) || input.expectedHead < 0)
+    return { ok: false, reason: "configuration-invalid" };
+  if (verified.issuedAt > nowSeconds + EVENT_KIT_MAX_FUTURE_IAT_SECONDS) return { ok: false, reason: "hint-future-issued-at" };
+  const bodyDeadline = verified.issuedAt + policy.maxHintAgeSeconds;
+  const retainWakeUntil = bodyDeadline + EVENT_KIT_REPLAY_RETENTION_SKEW_SECONDS;
+  const retainJwtUntil = verified.expiresAt + EVENT_KIT_REPLAY_RETENTION_SKEW_SECONDS;
+  if (!Number.isSafeInteger(retainWakeUntil) || !Number.isSafeInteger(retainJwtUntil)) return { ok: false, reason: "configuration-invalid" };
+  return nowSeconds > bodyDeadline ? { ok: false, reason: "hint-expired" } : {
+    ok: true,
+    retainJwtUntil,
+    retainWakeUntil
+  };
+}
+async function admitBestEffortHint(input) {
+  const retention = hintRetention(input);
+  if (!retention.ok) return retention;
+  const { retainJwtUntil, retainWakeUntil } = retention;
+  const { verified, nowSeconds } = input;
+  const authorization = await authorizeVerifiedWake(input);
+  if (!authorization.ok) return authorization.failure;
+  const wake = AdmittedWakeZod.parse({
+    audience: verified.audience,
+    deploymentId: verified.deploymentId,
+    event: verified.event,
+    eventHash: verified.eventHash,
+    fromPosition: verified.fromPosition,
+    toPosition: verified.toPosition,
+    jti: verified.jwtId,
+    publisher: verified.publisher,
+    wakeId: verified.wakeId,
+    ...verified.queueId === void 0 ? {} : { queueId: verified.queueId }
+  });
+  const attempt = {
+    audience: verified.audience,
+    eventHash: verified.eventHash,
+    jwtId: verified.jwtId,
+    publisher: verified.publisher,
+    retainJwtUntil,
+    retainWakeUntil,
+    wakeId: verified.wakeId
+  };
+  try {
+    const committed = await input.inbox.commitAuthorized({
+      attempt,
+      grant: authorization.grant,
+      wake,
+      nowSeconds
+    });
+    if (committed.kind !== "accepted" && committed.kind !== "duplicate") return { ok: false, reason: committed.kind };
+    const acknowledgment = committed.acknowledgment;
+    return acknowledgmentMatches(acknowledgment, attempt, nowSeconds) ? {
+      ok: true,
+      disposition: committed.kind,
+      acknowledgment,
+      wake
+    } : { ok: false, reason: "inbox-unavailable" };
+  } catch {
+    return { ok: false, reason: "inbox-unavailable" };
+  }
+}
+function acknowledgmentMatches(value, attempt, now) {
+  return BestEffortAdmissionAcknowledgmentZod.safeParse(value).success && value.eventHash === attempt.eventHash && value.wakeId === attempt.wakeId && value.acceptedAt <= now && value.expiresAt === attempt.retainWakeUntil;
+}
+var BestEffortAdmissionAcknowledgmentZod = z3.strictObject({
+  admissionId: z3.string().min(1).max(4096),
+  eventHash: HashZod3,
+  wakeId: WakeIdZod2,
+  acceptedAt: NonnegativeJsonSafeIntegerZod3,
+  expiresAt: NonnegativeJsonSafeIntegerZod3
+}).refine((value) => value.expiresAt > value.acceptedAt, "Acknowledgment expiry must follow admission");
+var JwtSecurityRecordZod = z3.strictObject({
+  audience: WakeJwtAudienceZod3,
+  publisher: NormalizedAddressZod3,
+  jwtId: WakeJwtIdZod2,
+  wakeId: WakeIdZod2,
+  eventHash: HashZod3,
+  expiresAt: NonnegativeJsonSafeIntegerZod3
+});
+var WakeSecurityRecordZod = z3.strictObject({
+  audience: WakeJwtAudienceZod3,
+  publisher: NormalizedAddressZod3,
+  wakeId: WakeIdZod2,
+  eventHash: HashZod3,
+  acknowledgment: BestEffortAdmissionAcknowledgmentZod
+}).refine(
+  (value) => value.wakeId === value.acknowledgment.wakeId && value.eventHash === value.acknowledgment.eventHash,
+  "Security identity must match acknowledgment"
+);
+var BestEffortSecurityStateZod = z3.strictObject({
+  highestNowSeconds: NonnegativeJsonSafeIntegerZod3,
+  jwtRecords: z3.array(JwtSecurityRecordZod).max(65536),
+  wakeRecords: z3.array(WakeSecurityRecordZod).max(65536)
+}).superRefine((value, context) => {
+  const jwtKeys = value.jwtRecords.map((record) => JSON.stringify([record.audience, record.publisher, record.jwtId]));
+  if (value.wakeRecords.some((record) => record.acknowledgment.acceptedAt > value.highestNowSeconds))
+    context.addIssue({ code: "custom", message: "Acknowledgment cannot precede stored admission clock" });
+  const wakeKeys = value.wakeRecords.map((record) => JSON.stringify([record.audience, record.publisher, record.wakeId]));
+  const jwtIdentities = new Set(jwtKeys);
+  const wakeIdentities = new Set(wakeKeys);
+  if (jwtIdentities.size !== jwtKeys.length || wakeIdentities.size !== wakeKeys.length)
+    context.addIssue({ code: "custom", message: "Persisted security identities must be unique" });
+});
+function parseBestEffortSecurityState(value) {
+  return BestEffortSecurityStateZod.parse(value);
+}
+var BestEffortAdmissionAttemptZod = z3.strictObject({
+  audience: WakeJwtAudienceZod3,
+  eventHash: HashZod3,
+  jwtId: WakeJwtIdZod2,
+  publisher: NormalizedAddressZod3,
+  retainJwtUntil: NonnegativeJsonSafeIntegerZod3,
+  retainWakeUntil: NonnegativeJsonSafeIntegerZod3,
+  wakeId: WakeIdZod2
+});
+function createBestEffortSecurityState() {
+  return {
+    highestNowSeconds: 0,
+    jwtRecords: [],
+    wakeRecords: []
+  };
+}
+function securityConflict(attempt, priorJwt, priorWake, jwtCount, wakeCount, maxRecords) {
+  if (priorJwt !== void 0 && (priorJwt.eventHash !== attempt.eventHash || priorJwt.wakeId !== attempt.wakeId))
+    return "jwt-id-collision";
+  if (priorWake !== void 0 && priorWake.eventHash !== attempt.eventHash)
+    return "wake-id-collision";
+  if (priorJwt === void 0 && jwtCount >= maxRecords || priorWake === void 0 && wakeCount >= maxRecords)
+    return "capacity-exceeded";
+}
+function validateTransaction(input, maxRecords) {
+  const attempt = BestEffortAdmissionAttemptZod.parse(input.attempt);
+  const wake = AdmittedWakeZod.parse(input.wake);
+  const nowSeconds = NonnegativeJsonSafeIntegerZod3.parse(input.nowSeconds);
+  if (attempt.audience !== wake.audience || attempt.publisher !== wake.publisher || attempt.jwtId !== wake.jti || attempt.wakeId !== wake.wakeId || attempt.eventHash !== wake.eventHash || wake.event.deliveryMode !== "best-effort" || attempt.retainJwtUntil <= nowSeconds || attempt.retainWakeUntil <= nowSeconds)
+    throw new TypeError("Best Effort transaction attempt does not match admitted hint");
+  if (!Number.isSafeInteger(maxRecords) || maxRecords < 1 || maxRecords > 65536) throw new TypeError("Invalid finite security capacity");
+  return { attempt, nowSeconds };
+}
+function commitBestEffortSecurity(state, input, maxRecords) {
+  state = parseBestEffortSecurityState(state);
+  const { attempt, nowSeconds } = validateTransaction(input, maxRecords);
+  if (nowSeconds < state.highestNowSeconds) return { state, result: { kind: "clock-regressed" } };
+  const jwtRecords = state.jwtRecords.filter((record) => record.expiresAt > nowSeconds).map((record) => ({ ...record }));
+  const wakeRecords = state.wakeRecords.filter((record) => record.acknowledgment.expiresAt > nowSeconds);
+  const priorJwt = jwtRecords.find((record) => record.audience === attempt.audience && record.publisher === attempt.publisher && record.jwtId === attempt.jwtId);
+  const priorWake = wakeRecords.find((record) => record.audience === attempt.audience && record.publisher === attempt.publisher && record.wakeId === attempt.wakeId);
+  const conflict = securityConflict(attempt, priorJwt, priorWake, jwtRecords.length, wakeRecords.length, maxRecords);
+  if (conflict !== void 0) return { state, result: { kind: conflict } };
+  const acknowledgment = priorWake?.acknowledgment ?? {
+    admissionId: JSON.stringify([attempt.audience, attempt.publisher, attempt.wakeId, attempt.eventHash]),
+    eventHash: attempt.eventHash,
+    wakeId: attempt.wakeId,
+    acceptedAt: nowSeconds,
+    expiresAt: attempt.retainWakeUntil
+  };
+  if (priorJwt !== void 0) priorJwt.expiresAt = Math.max(priorJwt.expiresAt, attempt.retainJwtUntil);
+  if (priorJwt === void 0) jwtRecords.push({
+    audience: attempt.audience,
+    publisher: attempt.publisher,
+    jwtId: attempt.jwtId,
+    wakeId: attempt.wakeId,
+    eventHash: attempt.eventHash,
+    expiresAt: attempt.retainJwtUntil
+  });
+  if (priorWake === void 0) wakeRecords.push({
+    audience: attempt.audience,
+    publisher: attempt.publisher,
+    wakeId: attempt.wakeId,
+    eventHash: attempt.eventHash,
+    acknowledgment
+  });
+  return {
+    state: {
+      highestNowSeconds: nowSeconds,
+      jwtRecords,
+      wakeRecords
+    },
+    result: { kind: priorWake === void 0 ? "accepted" : "duplicate", acknowledgment }
+  };
+}
+
 // src/endpointChallenge.ts
 import {
   Base64Url32BytesZod,
@@ -343,7 +769,7 @@ import {
   generateHandshakeId,
   MAX_ENDPOINT_CHALLENGE_LIFETIME_SECONDS
 } from "@xyo-network/event-kit-schemas";
-import { PayloadBuilder as PayloadBuilder2 } from "@xyo-network/sdk";
+import { PayloadBuilder as PayloadBuilder4 } from "@xyo-network/sdk";
 function hashBytes(hash) {
   return Uint8Array.from({ length: 32 }, (_, index) => Number.parseInt(hash.slice(index * 2, index * 2 + 2), 16));
 }
@@ -370,7 +796,7 @@ function equalProof(left, right) {
 }
 async function endpointChallengeHash(challenge) {
   const parsed = EndpointChallengeZod.parse(challenge);
-  return await PayloadBuilder2.dataHash(parsed);
+  return await PayloadBuilder4.dataHash(parsed);
 }
 function createEndpointChallenge(input) {
   const lifetimeSeconds = input.lifetimeSeconds ?? MAX_ENDPOINT_CHALLENGE_LIFETIME_SECONDS;
@@ -383,7 +809,7 @@ function createEndpointChallenge(input) {
   if (input.issuedAt > Number.MAX_SAFE_INTEGER - lifetimeSeconds) {
     throw new RangeError("Challenge expiry exceeds the JSON safe-integer range");
   }
-  const builder = new PayloadBuilder2({ schema: EndpointChallengeSchema });
+  const builder = new PayloadBuilder4({ schema: EndpointChallengeSchema });
   return EndpointChallengeZod.parse(builder.fields({
     challengeId: generateHandshakeId(),
     chainId: input.chainId,
@@ -402,7 +828,7 @@ function createEndpointChallenge(input) {
 }
 async function createEndpointChallengeResponse(challenge, secret) {
   const challengeHash = await endpointChallengeHash(challenge);
-  const builder = new PayloadBuilder2({ schema: EndpointChallengeResponseSchema });
+  const builder = new PayloadBuilder4({ schema: EndpointChallengeResponseSchema });
   return EndpointChallengeResponseZod.parse(builder.fields({
     challenge: challengeHash,
     proof: await hmacProof(secret, challengeHash)
@@ -437,7 +863,7 @@ import {
   EndpointChallengeZod as EndpointChallengeZod2,
   generateGrantId,
   generateHandshakeId as generateHandshakeId2,
-  HashZod as HashZod3,
+  HashZod as HashZod5,
   MAX_SUBSCRIPTION_PLAINTEXT_BYTES as MAX_SUBSCRIPTION_PLAINTEXT_BYTES2,
   PublisherEncryptionKeyRevocationSchema,
   PublisherEncryptionKeyRevocationZod,
@@ -448,7 +874,7 @@ import {
   PublisherServiceSchema,
   PublisherServiceZod,
   SOURCE_WAKE_EVENT_KIND,
-  SOURCE_WAKE_FILTER_PROFILE,
+  SOURCE_WAKE_FILTER_PROFILE as SOURCE_WAKE_FILTER_PROFILE2,
   WAKE_SUBSCRIPTION_HPKE_PROFILE as WAKE_SUBSCRIPTION_HPKE_PROFILE3,
   WAKE_WALLET_JWT_DELIVERY_PROFILE,
   WakeGrantObjectSchema,
@@ -465,7 +891,7 @@ import {
   WakeSubscriptionRevocationSchema,
   WakeSubscriptionRevocationZod
 } from "@xyo-network/event-kit-schemas";
-import { PayloadBuilder as PayloadBuilder3 } from "@xyo-network/sdk";
+import { PayloadBuilder as PayloadBuilder5 } from "@xyo-network/sdk";
 
 // src/wakeSubscriptionHpke.ts
 import {
@@ -480,8 +906,8 @@ import {
   canonicalBase64UrlToBytes as canonicalBase64UrlToBytes2,
   EncryptedWakeSubscriptionZod as EncryptedWakeSubscriptionZod2,
   HandshakeIdZod,
-  HashZod as HashZod2,
-  NormalizedAddressZod as NormalizedAddressZod3,
+  HashZod as HashZod4,
+  NormalizedAddressZod as NormalizedAddressZod5,
   WAKE_SUBSCRIPTION_HPKE_PROFILE as WAKE_SUBSCRIPTION_HPKE_PROFILE2,
   WakeSubscriptionCleartextZod as WakeSubscriptionCleartextZod2
 } from "@xyo-network/event-kit-schemas";
@@ -490,7 +916,7 @@ import {
 import {
   EncryptedWakeSubscriptionZod,
   MAX_SUBSCRIPTION_PLAINTEXT_BYTES,
-  NormalizedAddressZod as NormalizedAddressZod2,
+  NormalizedAddressZod as NormalizedAddressZod4,
   WAKE_SUBSCRIPTION_HPKE_PROFILE,
   WakeSubscriptionCleartextZod,
   WakeSubscriptionPlaintextZod
@@ -507,7 +933,7 @@ function cleartextFromEncrypted(subscription) {
   return cleartext;
 }
 function wakeSubscriptionAadBytes(subscription, subscriber) {
-  const parsedSubscriber = NormalizedAddressZod2.parse(subscriber);
+  const parsedSubscriber = NormalizedAddressZod4.parse(subscriber);
   const parsedSubscription = "encryption" in subscription ? cleartextFromEncrypted(EncryptedWakeSubscriptionZod.parse(subscription)) : WakeSubscriptionCleartextZod.parse(subscription);
   return canonicalJsonBytes({
     schema: parsedSubscription.schema,
@@ -522,6 +948,7 @@ function wakeSubscriptionAadBytes(subscription, subscriber) {
     revision: parsedSubscription.revision,
     supersedes: parsedSubscription.supersedes ?? null,
     eventKind: parsedSubscription.eventKind,
+    deliveryMode: parsedSubscription.deliveryMode,
     expiresAtBlock: parsedSubscription.expiresAtBlock,
     profile: WAKE_SUBSCRIPTION_HPKE_PROFILE
   });
@@ -571,14 +998,14 @@ var WakeSubscriptionDecryptionError = class extends Error {
 };
 function parsePublicKey(value) {
   return {
-    encryptionKey: HashZod2.parse(value.encryptionKey),
+    encryptionKey: HashZod4.parse(value.encryptionKey),
     keyId: HandshakeIdZod.parse(value.keyId),
     publicKey: Base64Url32BytesZod2.parse(value.publicKey)
   };
 }
 function parsePrivateKey(value) {
   return {
-    encryptionKey: HashZod2.parse(value.encryptionKey),
+    encryptionKey: HashZod4.parse(value.encryptionKey),
     keyId: HandshakeIdZod.parse(value.keyId),
     privateKey: Base64Url32BytesZod2.parse(value.privateKey)
   };
@@ -602,7 +1029,7 @@ async function generateWakeSubscriptionEncryptionKeyPair() {
 }
 async function encryptWakeSubscription(input) {
   const subscription = WakeSubscriptionCleartextZod2.parse(input.subscription);
-  const subscriber = NormalizedAddressZod3.parse(input.subscriber);
+  const subscriber = NormalizedAddressZod5.parse(input.subscriber);
   const publisherKey = parsePublicKey(input.publisherKey);
   if (subscription.encryptionKey !== publisherKey.encryptionKey || subscription.keyId !== publisherKey.keyId) {
     throw new TypeError("Subscription key reference does not match the supplied publisher key");
@@ -625,7 +1052,7 @@ async function encryptWakeSubscription(input) {
 async function decryptWakeSubscription(input) {
   try {
     const subscription = EncryptedWakeSubscriptionZod2.parse(input.subscription);
-    const subscriber = NormalizedAddressZod3.parse(input.subscriber);
+    const subscriber = NormalizedAddressZod5.parse(input.subscriber);
     const publisherKey = parsePrivateKey(input.publisherKey);
     if (subscription.encryptionKey !== publisherKey.encryptionKey || subscription.keyId !== publisherKey.keyId) throw new TypeError("Key reference mismatch");
     const recipientKey = await suite.kem.deserializePrivateKey(decoded32(publisherKey.privateKey));
@@ -668,13 +1095,13 @@ function parseHandshakePublicObject(value) {
   throw new TypeError("Expected a strict Event Kit handshake public object");
 }
 async function handshakeObjectHash(object) {
-  return HashZod3.parse(await PayloadBuilder3.dataHash(parseHandshakePublicObject(object)));
+  return HashZod5.parse(await PayloadBuilder5.dataHash(parseHandshakePublicObject(object)));
 }
 async function withHandshakeObjectHash(body) {
   return Object.freeze({ body, objectHash: await handshakeObjectHash(body) });
 }
 function createPublisherEncryptionKey(input) {
-  const builder = new PayloadBuilder3({ schema: PublisherEncryptionKeySchema });
+  const builder = new PayloadBuilder5({ schema: PublisherEncryptionKeySchema });
   return PublisherEncryptionKeyZod.parse(builder.fields({
     keyId: input.keyId ?? generateHandshakeId2(),
     profile: WAKE_SUBSCRIPTION_HPKE_PROFILE3,
@@ -706,7 +1133,7 @@ async function generatePublisherEncryptionKey(input) {
   });
 }
 function createPublisherService(input) {
-  const builder = new PayloadBuilder3({ schema: PublisherServiceSchema });
+  const builder = new PayloadBuilder5({ schema: PublisherServiceSchema });
   return PublisherServiceZod.parse(builder.fields({
     authorizationChainId: input.authorizationChainId,
     serviceId: input.serviceId ?? generateHandshakeId2(),
@@ -716,9 +1143,11 @@ function createPublisherService(input) {
     ...input.expiresAtBlock === void 0 ? {} : { expiresAtBlock: input.expiresAtBlock },
     events: input.sources.map((source) => ({
       kind: SOURCE_WAKE_EVENT_KIND,
-      filterProfile: SOURCE_WAKE_FILTER_PROFILE,
+      filterProfile: SOURCE_WAKE_FILTER_PROFILE2,
       source
     })),
+    deliveryMode: input.deliveryMode,
+    ...input.bestEffort === void 0 ? {} : { bestEffort: input.bestEffort },
     deliveryProfile: WAKE_WALLET_JWT_DELIVERY_PROFILE,
     challengeProfile: ENDPOINT_CHALLENGE_HMAC_SHA256_PROFILE,
     encryptionProfile: WAKE_SUBSCRIPTION_HPKE_PROFILE3,
@@ -733,7 +1162,7 @@ function createPublisherService(input) {
   }).build());
 }
 function createWakeGrant(input) {
-  const builder = new PayloadBuilder3({ schema: WakeGrantObjectSchema });
+  const builder = new PayloadBuilder5({ schema: WakeGrantObjectSchema });
   return WakeGrantObjectZod.parse(builder.fields({
     grantId: input.grantId ?? generateGrantId(),
     deploymentId: input.deploymentId,
@@ -748,14 +1177,16 @@ function createWakeSubscriptionPlaintext(input) {
     globalThis.crypto.getRandomValues(secretBytes);
   }
   const challengeSecret = input.challengeSecret ?? bytesToCanonicalBase64Url3(secretBytes);
-  const builder = new PayloadBuilder3({ schema: WakeSubscriptionPlaintextSchema });
+  const builder = new PayloadBuilder5({ schema: WakeSubscriptionPlaintextSchema });
   return WakeSubscriptionPlaintextZod2.parse(builder.fields({
     endpoint: input.endpoint,
     audience: input.audience,
     deploymentId: input.deploymentId,
     queueId: input.queueId ?? null,
     filter: {
-      schema: SOURCE_WAKE_FILTER_PROFILE,
+      schema: SOURCE_WAKE_FILTER_PROFILE2,
+      deliveryMode: input.deliveryMode,
+      ...input.bestEffort === void 0 ? {} : { bestEffort: input.bestEffort },
       source: input.source,
       fromPosition: input.fromPosition,
       maxPositionsPerWake: input.maxPositionsPerWake
@@ -767,7 +1198,7 @@ function createWakeSubscriptionPlaintext(input) {
   }).build());
 }
 async function createEncryptedWakeSubscription(input) {
-  const builder = new PayloadBuilder3({ schema: EncryptedWakeSubscriptionSchema });
+  const builder = new PayloadBuilder5({ schema: EncryptedWakeSubscriptionSchema });
   const cleartext = WakeSubscriptionCleartextZod3.parse(builder.fields({
     subscriptionId: input.subscriptionId ?? generateHandshakeId2(),
     revision: input.revision ?? 1,
@@ -779,6 +1210,7 @@ async function createEncryptedWakeSubscription(input) {
     keyId: input.publisherKey.keyId,
     grant: input.grant,
     eventKind: SOURCE_WAKE_EVENT_KIND,
+    deliveryMode: input.plaintext.filter.deliveryMode,
     expiresAtBlock: input.expiresAtBlock
   }).build());
   return await encryptWakeSubscription({
@@ -789,7 +1221,7 @@ async function createEncryptedWakeSubscription(input) {
   });
 }
 function createWakeSubscriptionAcceptance(input) {
-  const builder = new PayloadBuilder3({ schema: WakeSubscriptionAcceptanceSchema });
+  const builder = new PayloadBuilder5({ schema: WakeSubscriptionAcceptanceSchema });
   return WakeSubscriptionAcceptanceZod.parse(builder.fields({
     challenge: input.challenge,
     encryptionKey: input.encryptionKey,
@@ -800,45 +1232,45 @@ function createWakeSubscriptionAcceptance(input) {
   }).build());
 }
 function createPublisherServiceRevocation(service) {
-  const builder = new PayloadBuilder3({ schema: PublisherServiceRevocationSchema });
+  const builder = new PayloadBuilder5({ schema: PublisherServiceRevocationSchema });
   return PublisherServiceRevocationZod.parse(builder.fields({ service }).build());
 }
 function createPublisherEncryptionKeyRevocation(key) {
-  const builder = new PayloadBuilder3({ schema: PublisherEncryptionKeyRevocationSchema });
+  const builder = new PayloadBuilder5({ schema: PublisherEncryptionKeyRevocationSchema });
   return PublisherEncryptionKeyRevocationZod.parse(builder.fields({ key }).build());
 }
 function createWakeGrantRevocation(grant) {
-  const builder = new PayloadBuilder3({ schema: WakeGrantRevocationSchema });
+  const builder = new PayloadBuilder5({ schema: WakeGrantRevocationSchema });
   return WakeGrantRevocationZod.parse(builder.fields({ grant }).build());
 }
 function createWakeSubscriptionRevocation(subscription) {
-  const builder = new PayloadBuilder3({ schema: WakeSubscriptionRevocationSchema });
+  const builder = new PayloadBuilder5({ schema: WakeSubscriptionRevocationSchema });
   return WakeSubscriptionRevocationZod.parse(builder.fields({ subscription }).build());
 }
 function createWakeSubscriptionAcceptanceRevocation(acceptance) {
-  const builder = new PayloadBuilder3({ schema: WakeSubscriptionAcceptanceRevocationSchema });
+  const builder = new PayloadBuilder5({ schema: WakeSubscriptionAcceptanceRevocationSchema });
   return WakeSubscriptionAcceptanceRevocationZod.parse(builder.fields({ acceptance }).build());
 }
 
 // src/lifecycleSelection.ts
-function isNonnegativeSafeInteger2(value) {
+function isNonnegativeSafeInteger3(value) {
   return Number.isSafeInteger(value) && value >= 0;
 }
 function isVisible(claimedAtBlock, finalizedHead) {
-  return isNonnegativeSafeInteger2(claimedAtBlock) && claimedAtBlock <= finalizedHead;
+  return isNonnegativeSafeInteger3(claimedAtBlock) && claimedAtBlock <= finalizedHead;
 }
 function isRevoked(revokedAtBlock, finalizedHead) {
   return revokedAtBlock !== void 0 && revokedAtBlock <= finalizedHead;
 }
 function isUnrevokedEvidence(claimedAtBlock, revokedAtBlock, finalizedHead) {
-  return isVisible(claimedAtBlock, finalizedHead) && (revokedAtBlock === void 0 || isNonnegativeSafeInteger2(revokedAtBlock) && revokedAtBlock >= claimedAtBlock) && !isRevoked(revokedAtBlock, finalizedHead);
+  return isVisible(claimedAtBlock, finalizedHead) && (revokedAtBlock === void 0 || isNonnegativeSafeInteger3(revokedAtBlock) && revokedAtBlock >= claimedAtBlock) && !isRevoked(revokedAtBlock, finalizedHead);
 }
 function isInsideExclusiveWindow(finalizedHead, validFromBlock, expiresAtBlock) {
-  return isNonnegativeSafeInteger2(validFromBlock) && finalizedHead >= validFromBlock && (expiresAtBlock === void 0 || isNonnegativeSafeInteger2(expiresAtBlock) && expiresAtBlock > validFromBlock && finalizedHead < expiresAtBlock);
+  return isNonnegativeSafeInteger3(validFromBlock) && finalizedHead >= validFromBlock && (expiresAtBlock === void 0 || isNonnegativeSafeInteger3(expiresAtBlock) && expiresAtBlock > validFromBlock && finalizedHead < expiresAtBlock);
 }
 function isRevisionShapeValid(revision) {
-  if (!Number.isSafeInteger(revision.revision) || revision.revision < 1 || !isNonnegativeSafeInteger2(revision.claimedAtBlock)) return false;
-  if (revision.revokedAtBlock !== void 0 && (!isNonnegativeSafeInteger2(revision.revokedAtBlock) || revision.revokedAtBlock < revision.claimedAtBlock)) return false;
+  if (!Number.isSafeInteger(revision.revision) || revision.revision < 1 || !isNonnegativeSafeInteger3(revision.claimedAtBlock)) return false;
+  if (revision.revokedAtBlock !== void 0 && (!isNonnegativeSafeInteger3(revision.revokedAtBlock) || revision.revokedAtBlock < revision.claimedAtBlock)) return false;
   return revision.revision === 1 ? revision.supersedes === void 0 : revision.supersedes !== void 0;
 }
 function resolveLinearChain(revisions, finalizedHead) {
@@ -933,7 +1365,7 @@ function acceptedSubscription(subscription, input) {
   const acceptances = acceptanceFor(subscription, input);
   if (acceptances.length > 1) return "ambiguous";
   const acceptance = acceptances[0];
-  if (acceptance === void 0 || !isNonnegativeSafeInteger2(acceptance.acceptanceBlock)) return void 0;
+  if (acceptance === void 0 || !isNonnegativeSafeInteger3(acceptance.acceptanceBlock)) return void 0;
   if (!Number.isSafeInteger(subscription.expiresAtBlock) || subscription.expiresAtBlock < 1) return void 0;
   if (acceptance.acceptanceBlock <= subscription.claimedAtBlock || acceptance.acceptanceBlock >= Number.MAX_SAFE_INTEGER) return void 0;
   const activeFromBlock = acceptance.acceptanceBlock + 1;
@@ -1161,11 +1593,24 @@ function wakeKey(attempt) {
   return JSON.stringify([attempt.audience, attempt.publisher, attempt.wakeId]);
 }
 
+// src/staleWakeLeaseError.ts
+var StaleWakeLeaseError = class extends Error {
+  code = "stale-wake-lease";
+  name = "StaleWakeLeaseError";
+  constructor(message = "Wake lease is no longer current") {
+    super(message);
+  }
+};
+
 // src/memoryWakeQueue.ts
 function createMemoryWakeQueue() {
   const pending = [];
   const inflight = /* @__PURE__ */ new Map();
   let sequence = 0;
+  function restore(entry) {
+    pending.push(entry);
+    pending.sort((left, right) => left.sequence - right.sequence);
+  }
   return {
     async append(wake) {
       pending.push({ sequence: sequence += 1, wake });
@@ -1173,26 +1618,35 @@ function createMemoryWakeQueue() {
     async claim() {
       const entry = pending.shift();
       if (entry === void 0) return void 0;
-      inflight.set(entry.sequence, entry);
+      const token = /* @__PURE__ */ Symbol("wake-lease");
+      let completed2;
+      inflight.set(entry.sequence, { entry, token });
+      const finish = (operation) => {
+        if (completed2 === operation) return;
+        if (completed2 !== void 0 || inflight.get(entry.sequence)?.token !== token) {
+          throw new StaleWakeLeaseError();
+        }
+        inflight.delete(entry.sequence);
+        if (operation === "release") restore(entry);
+        completed2 = operation;
+      };
       return {
         wake: entry.wake,
         async ack() {
-          inflight.delete(entry.sequence);
+          finish("ack");
         },
         async release() {
-          if (!inflight.delete(entry.sequence)) return;
-          pending.push(entry);
-          pending.sort((left, right) => left.sequence - right.sequence);
+          finish("release");
         }
       };
     },
     inflightCount: async () => inflight.size,
     pendingCount: async () => pending.length,
-    async recoverInflight() {
+    async recoverInflight(options) {
+      if (options?.consumersStopped !== true) throw new TypeError("Recovery requires all consumers to be stopped");
       const recovered = inflight.size;
-      for (const entry of inflight.values()) pending.push(entry);
+      for (const { entry } of inflight.values()) restore(entry);
       inflight.clear();
-      pending.sort((left, right) => left.sequence - right.sequence);
       return recovered;
     }
   };
@@ -1200,43 +1654,20 @@ function createMemoryWakeQueue() {
 
 // src/publisherSubscription.ts
 import {
-  ChainIdZod,
+  ChainIdZod as ChainIdZod2,
   EncryptedWakeSubscriptionZod as EncryptedWakeSubscriptionZod4,
   EndpointChallengeZod as EndpointChallengeZod3,
-  HashZod as HashZod4,
+  HashZod as HashZod6,
   hasMatchingHandshakeProfile,
-  NormalizedAddressZod as NormalizedAddressZod4,
+  NormalizedAddressZod as NormalizedAddressZod6,
   PublisherEncryptionKeyZod as PublisherEncryptionKeyZod2,
   PublisherServiceZod as PublisherServiceZod2,
   WakeGrantObjectZod as WakeGrantObjectZod2
 } from "@xyo-network/event-kit-schemas";
-
-// src/sourceWakeIdentity.ts
-import {
-  SourceWakeSubscriptionFilterZod,
-  WakeSourceSchema,
-  WakeSourceZod
-} from "@xyo-network/event-kit-schemas";
-import {
-  asSchema,
-  PayloadBuilder as PayloadBuilder4
-} from "@xyo-network/sdk";
-async function wakeSourceHash(source) {
-  return await PayloadBuilder4.dataHash({ schema: WakeSourceSchema, ...WakeSourceZod.parse(source) });
-}
-function wakeSourcesEqual(left, right) {
-  return canonicalJson(WakeSourceZod.parse(left)) === canonicalJson(WakeSourceZod.parse(right));
-}
-async function sourceWakeFilterHash(filter) {
-  const parsed = SourceWakeSubscriptionFilterZod.parse(filter);
-  return await PayloadBuilder4.dataHash({ ...parsed, schema: asSchema(parsed.schema, true) });
-}
-
-// src/publisherSubscription.ts
 function rejectPublisherSubscription(reason) {
   return Object.freeze({ ok: false, reason });
 }
-function isNonnegativeSafeInteger3(value) {
+function isNonnegativeSafeInteger4(value) {
   return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
 }
 function isActiveAt(value, block) {
@@ -1253,7 +1684,7 @@ function hasExactQueueScope(grant, plaintext) {
   return plaintext.deploymentId === grant.deploymentId && plaintext.queueId === grantQueue;
 }
 function hasExactSubscriptionBinding(candidate, subscription) {
-  return subscription.chainId === candidate.chainId && subscription.publisher === candidate.publisher && subscription.service === candidate.service.objectHash && subscription.encryptionKey === candidate.key.objectHash && subscription.keyId === candidate.key.body.keyId && subscription.grant === candidate.grant.objectHash;
+  return subscription.deliveryMode === candidate.service.body.deliveryMode && subscription.chainId === candidate.chainId && subscription.publisher === candidate.publisher && subscription.service === candidate.service.objectHash && subscription.encryptionKey === candidate.key.objectHash && subscription.keyId === candidate.key.body.keyId && subscription.grant === candidate.grant.objectHash;
 }
 function hasExactKeyBinding(service, key, subscription) {
   return service.encryptionKeys.includes(key.objectHash) && service.preferredEncryptionKey === key.objectHash && key.body.keyId === subscription.keyId && key.objectHash === subscription.encryptionKey;
@@ -1264,22 +1695,22 @@ function expiryWithinServicePolicy(subscription, service, tupleBlock) {
 function parsePublisherSubscriptionCandidate(candidate) {
   try {
     return {
-      chainId: ChainIdZod.parse(candidate.chainId),
+      chainId: ChainIdZod2.parse(candidate.chainId),
       grant: WakeGrantObjectZod2.parse(candidate.grant.body),
       key: PublisherEncryptionKeyZod2.parse(candidate.key.body),
-      publisher: NormalizedAddressZod4.parse(candidate.publisher),
+      publisher: NormalizedAddressZod6.parse(candidate.publisher),
       service: PublisherServiceZod2.parse(candidate.service.body),
-      subscriber: NormalizedAddressZod4.parse(candidate.subscriber),
+      subscriber: NormalizedAddressZod6.parse(candidate.subscriber),
       subscription: EncryptedWakeSubscriptionZod4.parse(candidate.subscription.body),
-      tupleObjectHashes: candidate.tupleObjectHashes.map((hash) => HashZod4.parse(hash)),
-      tupleSubject: NormalizedAddressZod4.parse(candidate.tupleSubject)
+      tupleObjectHashes: candidate.tupleObjectHashes.map((hash) => HashZod6.parse(hash)),
+      tupleSubject: NormalizedAddressZod6.parse(candidate.tupleSubject)
     };
   } catch {
     return void 0;
   }
 }
 function tupleBindingIsValid(candidate, parsed) {
-  return isNonnegativeSafeInteger3(candidate.tupleBlock) && isNonnegativeSafeInteger3(candidate.finalizedHead) && candidate.finalizedHead >= candidate.tupleBlock && parsed.tupleSubject === parsed.publisher && occursExactlyOnce(parsed.tupleObjectHashes, candidate.service.objectHash) && occursExactlyOnce(parsed.tupleObjectHashes, candidate.grant.objectHash) && occursExactlyOnce(parsed.tupleObjectHashes, candidate.subscription.objectHash);
+  return isNonnegativeSafeInteger4(candidate.tupleBlock) && isNonnegativeSafeInteger4(candidate.finalizedHead) && candidate.finalizedHead >= candidate.tupleBlock && parsed.tupleSubject === parsed.publisher && occursExactlyOnce(parsed.tupleObjectHashes, candidate.service.objectHash) && occursExactlyOnce(parsed.tupleObjectHashes, candidate.grant.objectHash) && occursExactlyOnce(parsed.tupleObjectHashes, candidate.subscription.objectHash);
 }
 async function bodyHashesAreValid(candidate, parsed) {
   const canonicalHashes = await Promise.all([
@@ -1397,10 +1828,10 @@ async function issuePublisherEndpointChallenge(input) {
   }
 }
 async function beginPublisherEndpointChallengeAttempt(input) {
-  if (!isNonnegativeSafeInteger3(input.nowSeconds)) return { kind: "store-invalid" };
+  if (!isNonnegativeSafeInteger4(input.nowSeconds)) return { kind: "store-invalid" };
   try {
     const result = await input.store.beginAttempt({
-      challengeHash: HashZod4.parse(input.challengeHash),
+      challengeHash: HashZod6.parse(input.challengeHash),
       nowSeconds: input.nowSeconds
     });
     if (!["already-attempted", "expired", "missing", "started", "verified"].includes(result.kind)) {
@@ -1409,7 +1840,7 @@ async function beginPublisherEndpointChallengeAttempt(input) {
     if (result.kind !== "missing" && !await challengeRecordMatches(
       result.record,
       result.record.challenge,
-      HashZod4.parse(input.challengeHash)
+      HashZod6.parse(input.challengeHash)
     )) return { kind: "store-invalid" };
     if ((result.kind === "started" || result.kind === "already-attempted") && result.record.state !== "attempted") return { kind: "store-invalid" };
     return result.kind === "verified" && result.record.state !== "verified" ? { kind: "store-invalid" } : result;
@@ -1435,7 +1866,7 @@ async function completePublisherEndpointChallenge(input) {
   if (!endpointChallengeMatchesPublisherContext(input.challenge, input.subscription.context)) {
     return completeFailure("challenge-context-invalid");
   }
-  if (!isNonnegativeSafeInteger3(input.nowSeconds)) return completeFailure("challenge-expired");
+  if (!isNonnegativeSafeInteger4(input.nowSeconds)) return completeFailure("challenge-expired");
   const insideDecisionWindow = input.challenge.issuedAt <= input.nowSeconds && input.nowSeconds < input.challenge.expiresAt;
   const proofInput = {
     challenge: input.challenge,
@@ -1485,33 +1916,33 @@ async function completePublisherEndpointChallenge(input) {
 }
 function filterWithinServicePolicy(service, plaintext) {
   const filter = plaintext.filter;
-  return filter.maxPositionsPerWake <= service.limits.maxPositionsPerWake && service.events.some((event) => wakeSourcesEqual(event.source, filter.source));
+  return service.deliveryMode === filter.deliveryMode && JSON.stringify(service.bestEffort) === JSON.stringify(filter.bestEffort) && filter.maxPositionsPerWake <= service.limits.maxPositionsPerWake && service.events.some((event) => wakeSourcesEqual(event.source, filter.source));
 }
 
 // src/sourceWakeActivation.ts
 import {
-  ChainIdZod as ChainIdZod2,
-  DeploymentIdZod as DeploymentIdZod2,
-  HashZod as HashZod5,
-  NonnegativeJsonSafeIntegerZod as NonnegativeJsonSafeIntegerZod2,
-  NormalizedAddressZod as NormalizedAddressZod5,
-  PositiveJsonSafeIntegerZod
+  ChainIdZod as ChainIdZod3,
+  DeploymentIdZod as DeploymentIdZod3,
+  HashZod as HashZod7,
+  NonnegativeJsonSafeIntegerZod as NonnegativeJsonSafeIntegerZod4,
+  NormalizedAddressZod as NormalizedAddressZod7,
+  PositiveJsonSafeIntegerZod as PositiveJsonSafeIntegerZod2
 } from "@xyo-network/event-kit-schemas";
-import { z as z2 } from "zod";
-var SourceWakeSubscriptionActivationZod = z2.strictObject({
-  atBlock: NonnegativeJsonSafeIntegerZod2,
-  activeFromBlock: NonnegativeJsonSafeIntegerZod2,
-  expiresAtBlock: PositiveJsonSafeIntegerZod,
-  authorizationChainId: ChainIdZod2,
-  controller: NormalizedAddressZod5,
-  publisher: NormalizedAddressZod5,
-  deploymentId: DeploymentIdZod2,
-  queueId: z2.string().min(1).max(255).optional(),
-  sourceHash: HashZod5,
-  filterHash: HashZod5,
-  subscriptionHash: HashZod5,
-  serviceHash: HashZod5,
-  grantHash: HashZod5
+import { z as z4 } from "zod";
+var SourceWakeSubscriptionActivationZod = z4.strictObject({
+  atBlock: NonnegativeJsonSafeIntegerZod4,
+  activeFromBlock: NonnegativeJsonSafeIntegerZod4,
+  expiresAtBlock: PositiveJsonSafeIntegerZod2,
+  authorizationChainId: ChainIdZod3,
+  controller: NormalizedAddressZod7,
+  publisher: NormalizedAddressZod7,
+  deploymentId: DeploymentIdZod3,
+  queueId: z4.string().min(1).max(255).optional(),
+  sourceHash: HashZod7,
+  filterHash: HashZod7,
+  subscriptionHash: HashZod7,
+  serviceHash: HashZod7,
+  grantHash: HashZod7
 }).refine(
   (value) => value.activeFromBlock <= value.atBlock && value.atBlock < value.expiresAtBlock,
   "Subscription must be active at the exact finalized authorization snapshot"
@@ -1519,17 +1950,17 @@ var SourceWakeSubscriptionActivationZod = z2.strictObject({
 
 // src/statementGraphWakeGrantAuthorizer.ts
 import {
-  ChainIdZod as ChainIdZod3,
-  WakeSourceZod as WakeSourceZod2
+  ChainIdZod as ChainIdZod4,
+  WakeSourceZod as WakeSourceZod3
 } from "@xyo-network/event-kit-schemas";
 
 // src/grantEvidence.ts
 import {
   asWakeGrantObject,
   asWakeGrantRevocation,
-  DeploymentIdZod as DeploymentIdZod3,
-  HashZod as HashZod6,
-  NormalizedAddressZod as NormalizedAddressZod6,
+  DeploymentIdZod as DeploymentIdZod4,
+  HashZod as HashZod8,
+  NormalizedAddressZod as NormalizedAddressZod8,
   WakeGrantObjectSchema as WakeGrantObjectSchema3,
   WakeGrantRevocationSchema as WakeGrantRevocationSchema3
 } from "@xyo-network/event-kit-schemas";
@@ -1585,7 +2016,7 @@ async function readRevocations(viewer, controller, subject, atBlock) {
   for (const claim of claims) {
     if (!isLiveClaim(claim, controller, subject, WakeGrantRevocationSchema3, atBlock)) continue;
     const object = await viewer.object(claim.objectHash);
-    if (object?.assurance !== "resolved" || object.declaredSchema !== WakeGrantRevocationSchema3 || object.objectHash !== claim.objectHash || !isRecord2(object.params) || Object.hasOwn(object.params, "schema")) continue;
+    if (object?.assurance !== "resolved" || object.declaredSchema !== WakeGrantRevocationSchema3 || object.objectHash !== claim.objectHash || !isRecord3(object.params) || Object.hasOwn(object.params, "schema")) continue;
     const revocation = asWakeGrantRevocation({ ...object.params, schema: object.declaredSchema });
     if (revocation !== void 0) revoked.add(revocation.grant);
   }
@@ -1604,10 +2035,6 @@ async function resolveEvidence(viewer, claim, request, atBlock, revokedGrantHash
   if (!grant.permissions.includes("enqueue")) return void 0;
   return Object.freeze({
     assertedAtBlock: claim.firstBlock,
-    authorizationChainId: request.authorizationChainId,
-    sourceHash: request.sourceHash,
-    filterHash: request.filterHash,
-    subscriptionHash: request.subscriptionHash,
     controller: request.controller,
     deploymentId: grant.deploymentId,
     id: claim.firstEventHash,
@@ -1617,55 +2044,55 @@ async function resolveEvidence(viewer, claim, request, atBlock, revokedGrantHash
   });
 }
 function isLiveClaim(claim, controller, subject, declaredObjectSchema, atBlock) {
-  return claim.source === controller && claim.subject === subject && claim.declaredObjectSchema === declaredObjectSchema && isNonnegativeSafeInteger4(claim.firstBlock) && claim.firstBlock <= atBlock && isNonnegativeSafeInteger4(claim.lastBlock) && claim.lastBlock >= claim.firstBlock && HashZod6.safeParse(claim.firstEventHash).success && HashZod6.safeParse(claim.objectHash).success;
+  return claim.source === controller && claim.subject === subject && claim.declaredObjectSchema === declaredObjectSchema && isNonnegativeSafeInteger5(claim.firstBlock) && claim.firstBlock <= atBlock && isNonnegativeSafeInteger5(claim.lastBlock) && claim.lastBlock >= claim.firstBlock && HashZod8.safeParse(claim.firstEventHash).success && HashZod8.safeParse(claim.objectHash).success;
 }
 function parseExactGrantObject(object, expectedObjectHash) {
   if (object?.assurance !== "resolved") return void 0;
   if (object.declaredSchema !== WakeGrantObjectSchema3 || object.objectHash !== expectedObjectHash) return void 0;
-  if (!isRecord2(object.params) || Object.hasOwn(object.params, "schema")) return void 0;
+  if (!isRecord3(object.params) || Object.hasOwn(object.params, "schema")) return void 0;
   return asWakeGrantObject({
     ...object.params,
     schema: object.declaredSchema
   });
 }
 function assertValidRequest(request) {
-  if (request.exactGrantHash !== void 0 && !HashZod6.safeParse(request.exactGrantHash).success) {
+  if (request.exactGrantHash !== void 0 && !HashZod8.safeParse(request.exactGrantHash).success) {
     throw new TypeError("Exact grant hash must be canonical lowercase hexadecimal");
   }
-  if (!NormalizedAddressZod6.safeParse(request.controller).success) {
+  if (!NormalizedAddressZod8.safeParse(request.controller).success) {
     throw new TypeError("Grant controller must be a normalized address");
   }
-  if (!NormalizedAddressZod6.safeParse(request.publisher).success) {
+  if (!NormalizedAddressZod8.safeParse(request.publisher).success) {
     throw new TypeError("Grant publisher must be a normalized address");
   }
-  if (!DeploymentIdZod3.safeParse(request.deploymentId).success) {
+  if (!DeploymentIdZod4.safeParse(request.deploymentId).success) {
     throw new TypeError("Grant deploymentId must contain 1 to 255 characters");
   }
   if (request.queueId !== void 0 && (request.queueId.length === 0 || request.queueId.length > 255)) {
     throw new TypeError("Grant queueId must contain 1 to 255 characters when configured");
   }
-  if (!isNonnegativeSafeInteger4(request.expectedHead)) {
+  if (!isNonnegativeSafeInteger5(request.expectedHead)) {
     throw new RangeError("Grant expectedHead must be a nonnegative safe integer");
   }
 }
 async function readHead(viewer) {
   const head = await viewer.head();
-  if (!isNonnegativeSafeInteger4(head)) {
+  if (!isNonnegativeSafeInteger5(head)) {
     throw new RangeError("Statement Graph head must be a nonnegative safe integer");
   }
   return head;
 }
-function isNonnegativeSafeInteger4(value) {
+function isNonnegativeSafeInteger5(value) {
   return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
 }
-function isRecord2(value) {
+function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
 // src/statementGraphWakeGrantAuthorizer.ts
 function createStatementGraphWakeGrantAuthorizer(options) {
-  const authorizationChainId = ChainIdZod3.parse(options.authorizationChainId);
-  const source = WakeSourceZod2.parse(options.source);
+  const authorizationChainId = ChainIdZod4.parse(options.authorizationChainId);
+  const source = WakeSourceZod3.parse(options.source);
   const grants = createDeploymentGrantAuthorizer({ viewer: options.viewer });
   return Object.freeze({
     async authorizePublisher(request) {
@@ -1687,6 +2114,7 @@ function createStatementGraphWakeGrantAuthorizer(options) {
         ...decision,
         grant: Object.freeze({
           ...decision.grant,
+          authorizationKind: "activated-subscription",
           authorizationChainId,
           sourceHash,
           filterHash: activation.filterHash,
@@ -1697,190 +2125,6 @@ function createStatementGraphWakeGrantAuthorizer(options) {
   });
 }
 
-// src/verifyWakeRequest.ts
-import {
-  ChainIdZod as ChainIdZod4,
-  DeploymentIdZod as DeploymentIdZod4,
-  HashZod as HashZod7,
-  MAX_POSITIONS_PER_SUBSCRIPTION_WAKE,
-  NonnegativeJsonSafeIntegerZod as NonnegativeJsonSafeIntegerZod3,
-  NormalizedAddressZod as NormalizedAddressZod7,
-  PositiveJsonSafeIntegerZod as PositiveJsonSafeIntegerZod2,
-  SOURCE_WAKE_FILTER_PROFILE as SOURCE_WAKE_FILTER_PROFILE2,
-  WakeEnvelopeZod as WakeEnvelopeZod2,
-  WakeJwtAudienceZod as WakeJwtAudienceZod2,
-  WakeJwtHeaderZod,
-  WakeJwtPayloadZod,
-  WakeJwtSchema,
-  WakeSourceZod as WakeSourceZod3
-} from "@xyo-network/event-kit-schemas";
-import {
-  Account,
-  PayloadBuilder as PayloadBuilder5
-} from "@xyo-network/sdk";
-import { z as z3 } from "zod";
-var EVENT_KIT_MAX_JWT_LIFETIME_SECONDS = 300;
-var EVENT_KIT_MAX_FUTURE_IAT_SECONDS = 60;
-var WakeAdmissionRouteZod = z3.strictObject({
-  audience: WakeJwtAudienceZod2,
-  authorizationChainId: ChainIdZod4,
-  controller: NormalizedAddressZod7,
-  deploymentId: DeploymentIdZod4,
-  queueId: z3.string().min(1).max(255).optional(),
-  source: WakeSourceZod3,
-  filterHash: HashZod7,
-  subscriptionHash: HashZod7,
-  fromPosition: NonnegativeJsonSafeIntegerZod3,
-  maxPositionsPerWake: PositiveJsonSafeIntegerZod2.max(MAX_POSITIONS_PER_SUBSCRIPTION_WAKE),
-  maxGrantLagBlocks: NonnegativeJsonSafeIntegerZod3
-});
-async function verifyWakeRequest(input) {
-  const routeResult = WakeAdmissionRouteZod.safeParse(input.route);
-  if (!routeResult.success || !NonnegativeJsonSafeIntegerZod3.safeParse(input.nowSeconds).success) {
-    return { ok: false, reason: "configuration-invalid" };
-  }
-  const eventResult = WakeEnvelopeZod2.safeParse(input.body);
-  if (!eventResult.success) return malformedWake(input.body, eventResult.error.issues);
-  const route = routeResult.data;
-  if (route.filterHash !== await sourceWakeFilterHash({
-    schema: SOURCE_WAKE_FILTER_PROFILE2,
-    source: route.source,
-    fromPosition: route.fromPosition,
-    maxPositionsPerWake: route.maxPositionsPerWake
-  })) return { ok: false, reason: "configuration-invalid" };
-  const event = Object.freeze({ ...eventResult.data, source: Object.freeze(eventResult.data.source) });
-  if (event.authorizationChainId !== route.authorizationChainId) {
-    return { ok: false, reason: "event-authorization-chain-mismatch" };
-  }
-  if (!wakeSourcesEqual(event.source, route.source)) return { ok: false, reason: "event-source-mismatch" };
-  if (event.filterHash !== route.filterHash) return { ok: false, reason: "event-filter-mismatch" };
-  if (event.deploymentId !== route.deploymentId || event.queueId !== route.queueId) {
-    return { ok: false, reason: "event-target-mismatch" };
-  }
-  if (event.fromPosition < route.fromPosition) return { ok: false, reason: "range-before-floor" };
-  if (event.toPosition - event.fromPosition >= route.maxPositionsPerWake) return { ok: false, reason: "range-too-large" };
-  const jwt = await verifyJwtProfile(input.jwt, route.audience, input.nowSeconds);
-  if (!jwt.ok) return jwt;
-  let eventHash;
-  try {
-    eventHash = await PayloadBuilder5.dataHash(event);
-  } catch {
-    return { ok: false, reason: "event-hash-failed" };
-  }
-  if (eventHash !== jwt.jwt.eventHash) return { ok: false, reason: "event-hash-mismatch" };
-  const sourceHash = await wakeSourceHash(route.source);
-  return Object.freeze({
-    ok: true,
-    verified: Object.freeze({
-      audience: route.audience,
-      deploymentId: event.deploymentId,
-      event,
-      eventHash,
-      expiresAt: jwt.jwt.expiresAt,
-      fromPosition: event.fromPosition,
-      issuedAt: event.issuedAt,
-      jwtId: jwt.jwt.jwtId,
-      publisher: jwt.jwt.publisher,
-      ...event.queueId === void 0 ? {} : { queueId: event.queueId },
-      route: Object.freeze({
-        ...route,
-        source: Object.freeze(route.source),
-        sourceHash
-      }),
-      toPosition: event.toPosition,
-      tokenIssuedAt: jwt.jwt.issuedAt,
-      wakeId: event.wakeId
-    })
-  });
-}
-async function verifyJwtProfile(token, audience, nowSeconds) {
-  let verified;
-  try {
-    verified = await Account.verifyJwt(token, { audience, now: nowSeconds });
-  } catch (error) {
-    return reject2("jwt-malformed", [errorMessage2(error)]);
-  }
-  if (!verified.ok) {
-    return Object.hasOwn(verified.payload ?? {}, "nbf") ? reject2("jwt-nbf-not-allowed") : reject2(classifySdkJwtFailure(verified.reasons), verified.reasons);
-  }
-  const wireResult = parseStrictJwtWire(verified.header, verified.payload, audience);
-  if (!wireResult.ok) return wireResult;
-  const { header: strictHeader, payload: strictPayload } = wireResult;
-  if (strictHeader.kid !== strictPayload.iss) return reject2("jwt-identity-invalid");
-  if (strictPayload.exp <= nowSeconds) return reject2("jwt-expired");
-  if (strictPayload.exp - strictPayload.iat > EVENT_KIT_MAX_JWT_LIFETIME_SECONDS) return reject2("jwt-lifetime-invalid");
-  if (strictPayload.iat - nowSeconds > EVENT_KIT_MAX_FUTURE_IAT_SECONDS) return reject2("jwt-future-iat");
-  const jwt = Object.freeze({
-    eventHash: strictPayload.eventHash,
-    expiresAt: strictPayload.exp,
-    issuedAt: strictPayload.iat,
-    jwtId: strictPayload.jti,
-    publisher: strictPayload.iss
-  });
-  return Object.freeze({ jwt, ok: true });
-}
-function parseStrictJwtWire(header, payload, audience) {
-  const headerResult = WakeJwtHeaderZod.safeParse(header);
-  if (!headerResult.success) {
-    return NormalizedAddressZod7.safeParse(header.kid).success ? reject2("jwt-header-invalid", zodDetails(headerResult.error.issues)) : reject2("jwt-identity-invalid");
-  }
-  if (Object.hasOwn(payload, "nbf")) return reject2("jwt-nbf-not-allowed");
-  if (!NormalizedAddressZod7.safeParse(payload.iss).success) return reject2("jwt-identity-invalid");
-  if (payload.schema !== WakeJwtSchema) return reject2("jwt-schema-mismatch");
-  if (payload.aud !== audience) return reject2("jwt-audience-mismatch");
-  if (!isNonnegativeSafeInteger5(payload.iat) || !isNonnegativeSafeInteger5(payload.exp) || payload.exp <= payload.iat) {
-    return reject2("jwt-lifetime-invalid");
-  }
-  const payloadResult = WakeJwtPayloadZod.safeParse(payload);
-  if (!payloadResult.success) return reject2("jwt-claims-invalid", zodDetails(payloadResult.error.issues));
-  return Object.freeze({
-    header: headerResult.data,
-    ok: true,
-    payload: payloadResult.data
-  });
-}
-function classifySdkJwtFailure(reasons) {
-  if (reasons.some((reason) => reason.startsWith("audience mismatch:"))) return "jwt-audience-mismatch";
-  if (reasons.some((reason) => reason.startsWith("expired:"))) return "jwt-expired";
-  if (reasons.some((reason) => reason.startsWith("unsupported alg:") || reason.startsWith("unsupported typ:"))) {
-    return "jwt-header-invalid";
-  }
-  return reasons.some((reason) => reason.startsWith("invalid public key:") || reason.startsWith("public key does not derive to kid:") || reason === "header.kid does not match payload.iss") ? "jwt-identity-invalid" : "jwt-invalid";
-}
-function malformedWake(body, issues) {
-  const details = zodDetails(issues);
-  if (hasInvertedSafeRange(body)) return reject2("range-invalid", details);
-  return reject2(isRecord3(body) && Object.hasOwn(body, "wakeId") && issues.some((issue) => issue.path[0] === "wakeId") ? "wake-id-invalid" : "event-malformed", details);
-}
-function hasInvertedSafeRange(value) {
-  if (!isRecord3(value)) return false;
-  const { fromPosition, toPosition } = value;
-  return typeof fromPosition === "number" && typeof toPosition === "number" && isNonnegativeSafeInteger5(fromPosition) && isNonnegativeSafeInteger5(toPosition) && fromPosition > toPosition;
-}
-function isNonnegativeSafeInteger5(value) {
-  return Number.isSafeInteger(value) && value >= 0;
-}
-function isRecord3(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function zodDetails(issues) {
-  return issues.map((issue) => {
-    const path = issue.path.map(String).join(".") || "<root>";
-    return `${path}: ${issue.message}`;
-  });
-}
-function reject2(reason, details) {
-  if (details === void 0) return Object.freeze({ ok: false, reason });
-  return Object.freeze({
-    details: Object.freeze([...details]),
-    ok: false,
-    reason
-  });
-}
-function errorMessage2(error) {
-  return error instanceof Error ? error.message : String(error);
-}
-
 // src/wakeQueue.ts
 async function drainQueue(queue, handler) {
   let handled = 0;
@@ -1890,7 +2134,11 @@ async function drainQueue(queue, handler) {
     try {
       await handler(leased.wake);
     } catch (error) {
-      await leased.release();
+      try {
+        await leased.release();
+      } catch (releaseError) {
+        throw new AggregateError([error, releaseError], "Wake handler and lease release both failed", { cause: releaseError });
+      }
       throw error;
     }
     await leased.ack();
@@ -1899,17 +2147,23 @@ async function drainQueue(queue, handler) {
 }
 export {
   AdmittedWakeZod,
+  BestEffortAdmissionAcknowledgmentZod,
+  BestEffortSecurityStateZod,
   EVENT_KIT_MAX_FUTURE_IAT_SECONDS,
   EVENT_KIT_MAX_JWT_LIFETIME_SECONDS,
   EVENT_KIT_REPLAY_RETENTION_SKEW_SECONDS,
   SourceWakeSubscriptionActivationZod,
+  StaleWakeLeaseError,
   WakeAdmissionRouteZod,
   WakeSubscriptionDecryptionError,
   admitAndEnqueue,
+  admitBestEffortHint,
   beginPublisherEndpointChallengeAttempt,
   canonicalJson,
   canonicalJsonBytes,
+  commitBestEffortSecurity,
   completePublisherEndpointChallenge,
+  createBestEffortSecurityState,
   createEncryptedWakeSubscription,
   createEndpointChallenge,
   createEndpointChallengeResponse,
@@ -1937,6 +2191,7 @@ export {
   handshakeObjectHash,
   issuePublisherEndpointChallenge,
   parseAdmittedWake,
+  parseBestEffortSecurityState,
   resolvePreferredEncryptionKey,
   selectPublisherService,
   selectSubscriptionActivation,