@xyo-network/event-kit-protocol 2.1.0 → 2.2.1

package/dist/neutral/admissionTypes.d.ts

@@ -2,34 +2,38 @@ import type { ChainId, DeploymentId, Hash, NormalizedAddress, WakeId, WakeJwtAud
 import type { AdmittedWake } from './types.ts';
 /** Replay records survive token expiry by this amount to cover receiver skew. */
 export declare const EVENT_KIT_REPLAY_RETENTION_SKEW_SECONDS = 60;
-export interface WakeGrantAuthorizationRequest {
-    /** Must match the independently pinned grant viewer. */
-    readonly authorizationChainId: ChainId;
+/** Deployment/queue grant scope only; this port does not establish subscription activation. */
+export interface DeploymentGrantAuthorizationRequest {
     readonly controller: NormalizedAddress;
     readonly deploymentId: DeploymentId;
-    /** Required by D-006's activation adapter to select the accepted tuple's exact grant. */
     readonly exactGrantHash?: Hash;
     readonly expectedHead: number;
-    readonly filterHash: Hash;
     readonly publisher: NormalizedAddress;
     readonly queueId?: string;
-    readonly sourceHash: Hash;
-    readonly subscriptionHash: Hash;
 }
-/** Concrete grant evidence required for every enabled decision. */
-export interface WakeGrantEvidence {
+export interface DeploymentGrantEvidence {
     readonly assertedAtBlock: number;
-    /** Checked for every authorization decision. */
-    readonly authorizationChainId: ChainId;
     readonly controller: NormalizedAddress;
     readonly deploymentId: DeploymentId;
-    readonly filterHash: Hash;
     readonly id: string;
     readonly objectHash?: Hash;
     readonly queueId?: string;
+    readonly target: NormalizedAddress;
+}
+export interface WakeGrantAuthorizationRequest extends DeploymentGrantAuthorizationRequest {
+    /** Must match the independently pinned grant viewer. */
+    readonly authorizationChainId: ChainId;
+    readonly filterHash: Hash;
+    readonly sourceHash: Hash;
+    readonly subscriptionHash: Hash;
+}
+/** Complete evidence is produced only after exact finalized subscription activation. */
+export interface WakeGrantEvidence extends DeploymentGrantEvidence {
+    readonly authorizationChainId: ChainId;
+    readonly authorizationKind: 'activated-subscription';
+    readonly filterHash: Hash;
     readonly sourceHash: Hash;
     readonly subscriptionHash: Hash;
-    readonly target: NormalizedAddress;
 }
 export interface WakeGrantAuthorizationDisabled {
     readonly atBlock: number;
@@ -39,6 +43,17 @@ export interface WakeGrantAuthorizationDisabled {
     /** Optional diagnostics. The core recomputes lag instead of trusting this value. */
     readonly lag?: number;
 }
+export interface DeploymentGrantAuthorizationEnabled {
+    readonly atBlock: number;
+    readonly enabled: true;
+    readonly expectedHead?: number;
+    readonly grant: DeploymentGrantEvidence;
+    readonly lag?: number;
+}
+export type DeploymentGrantAuthorizationDecision = WakeGrantAuthorizationDisabled | DeploymentGrantAuthorizationEnabled;
+export interface DeploymentGrantAuthorizer {
+    authorizePublisher: (request: DeploymentGrantAuthorizationRequest) => Promise<DeploymentGrantAuthorizationDecision>;
+}
 export interface WakeGrantAuthorizationEnabled {
     readonly atBlock: number;
     readonly enabled: true;

package/dist/neutral/admissionTypes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admissionTypes.d.ts","sourceRoot":"","sources":["../../src/admissionTypes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,OAAO,EACP,YAAY,EACZ,IAAI,EACJ,iBAAiB,EACjB,MAAM,EACN,eAAe,EACf,SAAS,EACV,MAAM,gCAAgC,CAAA;AAEvC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAE9C,iFAAiF;AACjF,eAAO,MAAM,uCAAuC,KAAK,CAAA;AAEzD,MAAM,WAAW,6BAA6B;IAC5C,wDAAwD;IACxD,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAA;IACtC,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAA;IACtC,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAA;IACnC,yFAAyF;IACzF,QAAQ,CAAC,cAAc,CAAC,EAAE,IAAI,CAAA;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAA;IACzB,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAA;IACrC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAA;IACzB,QAAQ,CAAC,gBAAgB,EAAE,IAAI,CAAA;CAChC;AAED,mEAAmE;AACnE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,gDAAgD;IAChD,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAA;IACtC,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAA;IACtC,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAA;IACnC,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAA;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,UAAU,CAAC,EAAE,IAAI,CAAA;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAA;IACzB,QAAQ,CAAC,gBAAgB,EAAE,IAAI,CAAA;IAC/B,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAA;CACnC;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAA;IACvB,kFAAkF;IAClF,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,oFAAoF;IACpF,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAA;IACtB,kFAAkF;IAClF,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAA;IACjC,oFAAoF;IACpF,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,MAAM,8BAA8B,GACpC,8BAA8B,GAC9B,6BAA6B,CAAA;AAEnC;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,kBAAkB,EAAE,CAClB,OAAO,EAAE,6BAA6B,KACnC,OAAO,CAAC,8BAA8B,CAAC,CAAA;CAC7C;AAED,+DAA+D;AAC/D,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAA;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAA;IAClC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;IACxB,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAA;IACzB,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAA;IACrC,2DAA2D;IAC3D,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,8DAA8D;AAC9D,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAA;IAClC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAA;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,MAAM,qBAAqB,GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAA;CAAE,GACxB;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAA;CAAE,GACtE;IAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAA;CAAE,GACrC;IAAE,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAA;CAAE,CAAA;AAE5C,MAAM,MAAM,gBAAgB,GACtB;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAA;CAAE,GACrE;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAA;CAAE,GACtE;IAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAA;CAAE,GACrC;IAAE,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAA;CAAE,CAAA;AAE5C;;;;;;;;;GASG;AACH,MAAM,WAAW,eAAe,CAAC,KAAK,GAAG,YAAY;IACnD,gBAAgB,EAAE,CAAC,KAAK,EAAE;QACxB,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAA;QACtC,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAA;QACnC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAA;KACrB,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAA;IAC/B,cAAc,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,OAAO,CAAC,qBAAqB,CAAC,CAAA;CAClF"}
+{"version":3,"file":"admissionTypes.d.ts","sourceRoot":"","sources":["../../src/admissionTypes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,OAAO,EACP,YAAY,EACZ,IAAI,EACJ,iBAAiB,EACjB,MAAM,EACN,eAAe,EACf,SAAS,EACV,MAAM,gCAAgC,CAAA;AAEvC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAE9C,iFAAiF;AACjF,eAAO,MAAM,uCAAuC,KAAK,CAAA;AAEzD,+FAA+F;AAC/F,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAA;IACtC,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAA;IACnC,QAAQ,CAAC,cAAc,CAAC,EAAE,IAAI,CAAA;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAA;IACrC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAA;IACtC,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAA;IACnC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,UAAU,CAAC,EAAE,IAAI,CAAA;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAA;CACnC;AAED,MAAM,WAAW,6BAA8B,SAAQ,mCAAmC;IACxF,wDAAwD;IACxD,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAA;IACtC,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAA;IACzB,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAA;IACzB,QAAQ,CAAC,gBAAgB,EAAE,IAAI,CAAA;CAChC;AAED,wFAAwF;AACxF,MAAM,WAAW,iBAAkB,SAAQ,uBAAuB;IAChE,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAA;IACtC,QAAQ,CAAC,iBAAiB,EAAE,wBAAwB,CAAA;IACpD,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAA;IACzB,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAA;IACzB,QAAQ,CAAC,gBAAgB,EAAE,IAAI,CAAA;CAChC;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAA;IACvB,kFAAkF;IAClF,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,oFAAoF;IACpF,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAA;IACtB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,KAAK,EAAE,uBAAuB,CAAA;IACvC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,MAAM,oCAAoC,GAC5C,8BAA8B,GAAG,mCAAmC,CAAA;AAExE,MAAM,WAAW,yBAAyB;IACxC,kBAAkB,EAAE,CAAC,OAAO,EAAE,mCAAmC,KAAK,OAAO,CAAC,oCAAoC,CAAC,CAAA;CACpH;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAA;IACtB,kFAAkF;IAClF,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAA;IACjC,oFAAoF;IACpF,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,MAAM,8BAA8B,GACpC,8BAA8B,GAC9B,6BAA6B,CAAA;AAEnC;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,kBAAkB,EAAE,CAClB,OAAO,EAAE,6BAA6B,KACnC,OAAO,CAAC,8BAA8B,CAAC,CAAA;CAC7C;AAED,+DAA+D;AAC/D,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAA;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAA;IAClC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;IACxB,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAA;IACzB,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAA;IACrC,2DAA2D;IAC3D,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,8DAA8D;AAC9D,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAA;IAClC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAA;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,MAAM,qBAAqB,GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAA;CAAE,GACxB;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAA;CAAE,GACtE;IAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAA;CAAE,GACrC;IAAE,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAA;CAAE,CAAA;AAE5C,MAAM,MAAM,gBAAgB,GACtB;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAA;CAAE,GACrE;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAA;CAAE,GACtE;IAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAA;CAAE,GACrC;IAAE,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAA;CAAE,CAAA;AAE5C;;;;;;;;;GASG;AACH,MAAM,WAAW,eAAe,CAAC,KAAK,GAAG,YAAY;IACnD,gBAAgB,EAAE,CAAC,KAAK,EAAE;QACxB,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAA;QACtC,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAA;QACnC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAA;KACrB,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAA;IAC/B,cAAc,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,OAAO,CAAC,qBAAqB,CAAC,CAAA;CAClF"}

package/dist/neutral/grantEvidence.d.ts

@@ -1,20 +1,22 @@
-import type { WakeGrantAuthorizer } from './admissionTypes.ts';
+import type { DeploymentGrantAuthorizer } from './admissionTypes.ts';
 import type { StatementGraphGrantReadModel } from './statementGraphPorts.ts';
 export interface DeploymentGrantAuthorizerOptions {
     readonly viewer: StatementGraphGrantReadModel;
 }
 /**
  * Adapts a canonical Statement Graph v2 read model to the evidence-bearing
- * D-002 grant authorization port. Each decision is bound to one stable head.
+ * deployment-only grant authorization port. Each decision is bound to one stable head.
  *
  * v2 is append-only with no lifecycle `state`, so this layer owns two things
  * the protocol used to:
  *
  * - **Aboutness.** The requested publisher must match both the Claim's
  *   `subject` and the grant object's `publisher` field.
- * - **Negation.** A grant is disabled by a further claim, by the *same pinned
- *   controller*, of a revocation object referencing that grant's hash.
+ * - **Negation.** A grant is disabled when the pinned controller has Claim
+ *   membership for the recomputed canonical hash of
+ *   `{ schema: grant.revocation, grant: <object hash> }` under the publisher
+ *   subject. Declared schema and body resolution are not consulted.
  *   Revocations from any other source are ignored.
  */
-export declare function createDeploymentGrantAuthorizer(options: DeploymentGrantAuthorizerOptions): WakeGrantAuthorizer;
+export declare function createDeploymentGrantAuthorizer(options: DeploymentGrantAuthorizerOptions): DeploymentGrantAuthorizer;
 //# sourceMappingURL=grantEvidence.d.ts.map

package/dist/neutral/grantEvidence.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grantEvidence.d.ts","sourceRoot":"","sources":["../../src/grantEvidence.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAGV,mBAAmB,EAEpB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAEV,4BAA4B,EAC7B,MAAM,0BAA0B,CAAA;AAEjC,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,MAAM,EAAE,4BAA4B,CAAA;CAC9C;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,gCAAgC,GACxC,mBAAmB,CAgDrB"}
+{"version":3,"file":"grantEvidence.d.ts","sourceRoot":"","sources":["../../src/grantEvidence.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAGV,yBAAyB,EAE1B,MAAM,qBAAqB,CAAA;AAE5B,OAAO,KAAK,EAEV,4BAA4B,EAC7B,MAAM,0BAA0B,CAAA;AAEjC,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,MAAM,EAAE,4BAA4B,CAAA;CAC9C;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,gCAAgC,GACxC,yBAAyB,CAsD3B"}

package/dist/neutral/index.d.ts

@@ -1,4 +1,4 @@
-export type { AtomicWakeInbox, AuthorizedWakeGrant, WakeAdmissionAttempt, WakeAdmissionReceipt, WakeAttemptResolution, WakeCommitResult, WakeGrantAuthorizationDecision, WakeGrantAuthorizationDisabled, WakeGrantAuthorizationEnabled, WakeGrantAuthorizationRequest, WakeGrantAuthorizer, WakeGrantEvidence, } from './admissionTypes.ts';
+export type { AtomicWakeInbox, AuthorizedWakeGrant, DeploymentGrantAuthorizationDecision, DeploymentGrantAuthorizationEnabled, DeploymentGrantAuthorizationRequest, DeploymentGrantAuthorizer, DeploymentGrantEvidence, WakeAdmissionAttempt, WakeAdmissionReceipt, WakeAttemptResolution, WakeCommitResult, WakeGrantAuthorizationDecision, WakeGrantAuthorizationDisabled, WakeGrantAuthorizationEnabled, WakeGrantAuthorizationRequest, WakeGrantAuthorizer, WakeGrantEvidence, } from './admissionTypes.ts';
 export { EVENT_KIT_REPLAY_RETENTION_SKEW_SECONDS } from './admissionTypes.ts';
 export type { AdmitAndEnqueueFailure, AdmitAndEnqueueFailureReason, AdmitAndEnqueueInput, AdmitAndEnqueueResult, AdmitAndEnqueueSuccess, } from './admitAndEnqueue.ts';
 export { admitAndEnqueue } from './admitAndEnqueue.ts';
@@ -19,8 +19,11 @@ export { createMemoryWakeQueue } from './memoryWakeQueue.ts';
 export type { BeginPublisherEndpointChallengeAttemptInput, BeginPublisherEndpointChallengeAttemptResult, CompletePublisherEndpointChallengeInput, CompletePublisherEndpointChallengeResult, IssuePublisherEndpointChallengeInput, IssuePublisherEndpointChallengeResult, PublisherEncryptionKeyLookup, PublisherEncryptionKeyStore, PublisherEndpointChallengeRecord, PublisherEndpointChallengeState, PublisherEndpointChallengeStore, } from './publisherHandshakeStores.ts';
 export type { BeginPublisherEndpointChallengeAttemptApiInput, BeginPublisherEndpointChallengeAttemptApiResult, CompletePublisherEndpointChallengeApiInput, CompletePublisherEndpointChallengeApiResult, CompletePublisherEndpointChallengeFailure, CompletePublisherEndpointChallengeFailureReason, CompletePublisherEndpointChallengeSuccess, IssuePublisherEndpointChallengeApiInput, IssuePublisherEndpointChallengeApiResult, PublisherEndpointChallengeContext, PublisherSubscriptionCandidate, PublisherSubscriptionValidation, PublisherSubscriptionValidationFailure, PublisherSubscriptionValidationFailureReason, ValidatedPublisherSubscription, } from './publisherSubscription.ts';
 export { beginPublisherEndpointChallengeAttempt, completePublisherEndpointChallenge, endpointChallengeMatchesPublisherContext, issuePublisherEndpointChallenge, validateAndDecryptPublisherSubscription, } from './publisherSubscription.ts';
+export type { RecomputableRevocationKind } from './revocationRecognition.ts';
+export { recomputableRevocationHash } from './revocationRecognition.ts';
 export * from './sourceWakeActivation.ts';
 export * from './sourceWakeIdentity.ts';
+export { StaleWakeLeaseError } from './staleWakeLeaseError.ts';
 export type { StatementGrantClaim, StatementGrantClaimQuery, StatementGrantObject, StatementGraphGrantReadModel, } from './statementGraphPorts.ts';
 export type { StatementGraphWakeGrantAuthorizerOptions } from './statementGraphWakeGrantAuthorizer.ts';
 export { createStatementGraphWakeGrantAuthorizer } from './statementGraphWakeGrantAuthorizer.ts';
@@ -28,7 +31,7 @@ export type { AdmittedWake } from './types.ts';
 export { AdmittedWakeZod, parseAdmittedWake } from './types.ts';
 export type { VerifiedWakeRequest, VerifyWakeRequestFailure, VerifyWakeRequestInput, VerifyWakeRequestRejectionReason, VerifyWakeRequestResult, VerifyWakeRequestSuccess, WakeAdmissionRoute, } from './verifyWakeRequest.ts';
 export { EVENT_KIT_MAX_FUTURE_IAT_SECONDS, EVENT_KIT_MAX_JWT_LIFETIME_SECONDS, verifyWakeRequest, WakeAdmissionRouteZod, } from './verifyWakeRequest.ts';
-export type { LeasedWake, WakeHandler, WakeQueue, } from './wakeQueue.ts';
+export type { LeasedWake, RecoverInflightOptions, WakeHandler, WakeQueue, } from './wakeQueue.ts';
 export { drainQueue } from './wakeQueue.ts';
 export { wakeSubscriptionAadBytes, wakeSubscriptionPlaintextBytes, wakeSubscriptionPlaintextFromBytes, } from './wakeSubscriptionEncoding.ts';
 export type { DecryptWakeSubscriptionInput, EncryptWakeSubscriptionInput, WakeSubscriptionEncryptionKeyPair, WakeSubscriptionPrivateKey, WakeSubscriptionPublicKey, } from './wakeSubscriptionHpke.ts';

package/dist/neutral/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,gBAAgB,EAChB,8BAA8B,EAC9B,8BAA8B,EAC9B,6BAA6B,EAC7B,6BAA6B,EAC7B,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,uCAAuC,EAAE,MAAM,qBAAqB,CAAA;AAC7E,YAAY,EACV,sBAAsB,EACtB,4BAA4B,EAC5B,oBAAoB,EACpB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,cAAc,0BAA0B,CAAA;AACxC,OAAO,EACL,aAAa,EACb,kBAAkB,GACnB,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,4BAA4B,EAC5B,oCAAoC,GACrC,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EACL,uBAAuB,EACvB,+BAA+B,EAC/B,qBAAqB,EACrB,+BAA+B,GAChC,MAAM,wBAAwB,CAAA;AAC/B,YAAY,EACV,oCAAoC,EACpC,iCAAiC,EACjC,2BAA2B,EAC3B,oBAAoB,EACpB,qCAAqC,EACrC,oCAAoC,EACpC,6BAA6B,EAC7B,+BAA+B,EAC/B,mCAAmC,EACnC,qBAAqB,GACtB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EACL,+BAA+B,EAC/B,4BAA4B,EAC5B,sCAAsC,EACtC,sBAAsB,EACtB,gCAAgC,EAChC,eAAe,EACf,yBAAyB,EACzB,gCAAgC,EAChC,0CAA0C,EAC1C,+BAA+B,EAC/B,gCAAgC,EAChC,8BAA8B,EAC9B,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,4BAA4B,CAAA;AACnC,YAAY,EACV,yBAAyB,EACzB,6BAA6B,EAC7B,mCAAmC,EACnC,2BAA2B,EAC3B,gCAAgC,EAChC,6BAA6B,EAC7B,4BAA4B,EAC5B,+BAA+B,EAC/B,iCAAiC,EACjC,yBAAyB,EACzB,gCAAgC,EAChC,sCAAsC,EACtC,8BAA8B,EAC9B,gCAAgC,EAChC,sBAAsB,EACtB,6BAA6B,EAC7B,mCAAmC,EACnC,2BAA2B,EAC3B,6BAA6B,EAC7B,iCAAiC,GAClC,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACL,6BAA6B,EAC7B,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,yBAAyB,CAAA;AAChC,YAAY,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAA;AAC/E,OAAO,EAAE,+BAA+B,EAAE,MAAM,gCAAgC,CAAA;AAChF,YAAY,EACV,eAAe,EACf,sBAAsB,GACvB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAC5D,YAAY,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAC5D,YAAY,EACV,2CAA2C,EAC3C,4CAA4C,EAC5C,uCAAuC,EACvC,wCAAwC,EACxC,oCAAoC,EACpC,qCAAqC,EACrC,4BAA4B,EAC5B,2BAA2B,EAC3B,gCAAgC,EAChC,+BAA+B,EAC/B,+BAA+B,GAChC,MAAM,+BAA+B,CAAA;AACtC,YAAY,EACV,8CAA8C,EAC9C,+CAA+C,EAC/C,0CAA0C,EAC1C,2CAA2C,EAC3C,yCAAyC,EACzC,+CAA+C,EAC/C,yCAAyC,EACzC,uCAAuC,EACvC,wCAAwC,EACxC,iCAAiC,EACjC,8BAA8B,EAC9B,+BAA+B,EAC/B,sCAAsC,EACtC,4CAA4C,EAC5C,8BAA8B,GAC/B,MAAM,4BAA4B,CAAA;AACnC,OAAO,EACL,sCAAsC,EACtC,kCAAkC,EAClC,wCAAwC,EACxC,+BAA+B,EAC/B,uCAAuC,GACxC,MAAM,4BAA4B,CAAA;AACnC,cAAc,2BAA2B,CAAA;AACzC,cAAc,yBAAyB,CAAA;AACvC,YAAY,EACV,mBAAmB,EACnB,wBAAwB,EACxB,oBAAoB,EACpB,4BAA4B,GAC7B,MAAM,0BAA0B,CAAA;AACjC,YAAY,EAAE,wCAAwC,EAAE,MAAM,wCAAwC,CAAA;AACtG,OAAO,EAAE,uCAAuC,EAAE,MAAM,wCAAwC,CAAA;AAChG,YAAY,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAC9C,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAC/D,YAAY,EACV,mBAAmB,EACnB,wBAAwB,EACxB,sBAAsB,EACtB,gCAAgC,EAChC,uBAAuB,EACvB,wBAAwB,EACxB,kBAAkB,GACnB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EACL,gCAAgC,EAChC,kCAAkC,EAClC,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,wBAAwB,CAAA;AAC/B,YAAY,EACV,UAAU,EACV,WAAW,EACX,SAAS,GACV,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,kCAAkC,GACnC,MAAM,+BAA+B,CAAA;AACtC,YAAY,EACV,4BAA4B,EAC5B,4BAA4B,EAC5B,iCAAiC,EACjC,0BAA0B,EAC1B,yBAAyB,GAC1B,MAAM,2BAA2B,CAAA;AAClC,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,yCAAyC,EACzC,+BAA+B,GAChC,MAAM,2BAA2B,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,oCAAoC,EACpC,mCAAmC,EACnC,mCAAmC,EACnC,yBAAyB,EACzB,uBAAuB,EACvB,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,gBAAgB,EAChB,8BAA8B,EAC9B,8BAA8B,EAC9B,6BAA6B,EAC7B,6BAA6B,EAC7B,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,uCAAuC,EAAE,MAAM,qBAAqB,CAAA;AAC7E,YAAY,EACV,sBAAsB,EACtB,4BAA4B,EAC5B,oBAAoB,EACpB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,cAAc,0BAA0B,CAAA;AACxC,OAAO,EACL,aAAa,EACb,kBAAkB,GACnB,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,4BAA4B,EAC5B,oCAAoC,GACrC,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EACL,uBAAuB,EACvB,+BAA+B,EAC/B,qBAAqB,EACrB,+BAA+B,GAChC,MAAM,wBAAwB,CAAA;AAC/B,YAAY,EACV,oCAAoC,EACpC,iCAAiC,EACjC,2BAA2B,EAC3B,oBAAoB,EACpB,qCAAqC,EACrC,oCAAoC,EACpC,6BAA6B,EAC7B,+BAA+B,EAC/B,mCAAmC,EACnC,qBAAqB,GACtB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EACL,+BAA+B,EAC/B,4BAA4B,EAC5B,sCAAsC,EACtC,sBAAsB,EACtB,gCAAgC,EAChC,eAAe,EACf,yBAAyB,EACzB,gCAAgC,EAChC,0CAA0C,EAC1C,+BAA+B,EAC/B,gCAAgC,EAChC,8BAA8B,EAC9B,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,4BAA4B,CAAA;AACnC,YAAY,EACV,yBAAyB,EACzB,6BAA6B,EAC7B,mCAAmC,EACnC,2BAA2B,EAC3B,gCAAgC,EAChC,6BAA6B,EAC7B,4BAA4B,EAC5B,+BAA+B,EAC/B,iCAAiC,EACjC,yBAAyB,EACzB,gCAAgC,EAChC,sCAAsC,EACtC,8BAA8B,EAC9B,gCAAgC,EAChC,sBAAsB,EACtB,6BAA6B,EAC7B,mCAAmC,EACnC,2BAA2B,EAC3B,6BAA6B,EAC7B,iCAAiC,GAClC,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACL,6BAA6B,EAC7B,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,yBAAyB,CAAA;AAChC,YAAY,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAA;AAC/E,OAAO,EAAE,+BAA+B,EAAE,MAAM,gCAAgC,CAAA;AAChF,YAAY,EACV,eAAe,EACf,sBAAsB,GACvB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAC5D,YAAY,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAC5D,YAAY,EACV,2CAA2C,EAC3C,4CAA4C,EAC5C,uCAAuC,EACvC,wCAAwC,EACxC,oCAAoC,EACpC,qCAAqC,EACrC,4BAA4B,EAC5B,2BAA2B,EAC3B,gCAAgC,EAChC,+BAA+B,EAC/B,+BAA+B,GAChC,MAAM,+BAA+B,CAAA;AACtC,YAAY,EACV,8CAA8C,EAC9C,+CAA+C,EAC/C,0CAA0C,EAC1C,2CAA2C,EAC3C,yCAAyC,EACzC,+CAA+C,EAC/C,yCAAyC,EACzC,uCAAuC,EACvC,wCAAwC,EACxC,iCAAiC,EACjC,8BAA8B,EAC9B,+BAA+B,EAC/B,sCAAsC,EACtC,4CAA4C,EAC5C,8BAA8B,GAC/B,MAAM,4BAA4B,CAAA;AACnC,OAAO,EACL,sCAAsC,EACtC,kCAAkC,EAClC,wCAAwC,EACxC,+BAA+B,EAC/B,uCAAuC,GACxC,MAAM,4BAA4B,CAAA;AACnC,YAAY,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAA;AAC5E,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAA;AACvE,cAAc,2BAA2B,CAAA;AACzC,cAAc,yBAAyB,CAAA;AACvC,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAC9D,YAAY,EACV,mBAAmB,EACnB,wBAAwB,EACxB,oBAAoB,EACpB,4BAA4B,GAC7B,MAAM,0BAA0B,CAAA;AACjC,YAAY,EAAE,wCAAwC,EAAE,MAAM,wCAAwC,CAAA;AACtG,OAAO,EAAE,uCAAuC,EAAE,MAAM,wCAAwC,CAAA;AAChG,YAAY,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAC9C,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAC/D,YAAY,EACV,mBAAmB,EACnB,wBAAwB,EACxB,sBAAsB,EACtB,gCAAgC,EAChC,uBAAuB,EACvB,wBAAwB,EACxB,kBAAkB,GACnB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EACL,gCAAgC,EAChC,kCAAkC,EAClC,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,wBAAwB,CAAA;AAC/B,YAAY,EACV,UAAU,EACV,sBAAsB,EACtB,WAAW,EACX,SAAS,GACV,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,kCAAkC,GACnC,MAAM,+BAA+B,CAAA;AACtC,YAAY,EACV,4BAA4B,EAC5B,4BAA4B,EAC5B,iCAAiC,EACjC,0BAA0B,EAC1B,yBAAyB,GAC1B,MAAM,2BAA2B,CAAA;AAClC,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,yCAAyC,EACzC,+BAA+B,GAChC,MAAM,2BAA2B,CAAA"}

package/dist/neutral/index.mjs

@@ -133,6 +133,7 @@ function validateGrantEvidence(evidence, verified, atBlock) {
   if (!isRecord(evidence)) return reject("grant-view-invalid", ["enabled grant decision omitted evidence"]);
   const requiredFields = [
     "assertedAtBlock",
+    "authorizationKind",
     "authorizationChainId",
     "filterHash",
     "sourceHash",
@@ -145,6 +146,9 @@ function validateGrantEvidence(evidence, verified, atBlock) {
   if (requiredFields.some((field) => !Object.hasOwn(evidence, field))) {
     return reject("grant-view-invalid", ["enabled grant evidence requires own canonical fields"]);
   }
+  if (evidence.authorizationKind !== "activated-subscription") {
+    return reject("grant-view-invalid", ["enabled authorization requires finalized subscription activation"]);
+  }
   if (typeof evidence.id !== "string" || evidence.id.length === 0) {
     return reject("grant-view-invalid", ["enabled grant evidence requires a non-empty id"]);
   }
@@ -180,6 +184,7 @@ function validateReceipt(receipt, attempt) {
 function snapshotGrantEvidence(evidence) {
   return Object.freeze({
     assertedAtBlock: evidence.assertedAtBlock,
+    authorizationKind: evidence.authorizationKind,
     authorizationChainId: evidence.authorizationChainId,
     sourceHash: evidence.sourceHash,
     filterHash: evidence.filterHash,
@@ -1588,11 +1593,24 @@ function wakeKey(attempt) {
   return JSON.stringify([attempt.audience, attempt.publisher, attempt.wakeId]);
 }
 
+// src/staleWakeLeaseError.ts
+var StaleWakeLeaseError = class extends Error {
+  code = "stale-wake-lease";
+  name = "StaleWakeLeaseError";
+  constructor(message = "Wake lease is no longer current") {
+    super(message);
+  }
+};
+
 // src/memoryWakeQueue.ts
 function createMemoryWakeQueue() {
   const pending = [];
   const inflight = /* @__PURE__ */ new Map();
   let sequence = 0;
+  function restore(entry) {
+    pending.push(entry);
+    pending.sort((left, right) => left.sequence - right.sequence);
+  }
   return {
     async append(wake) {
       pending.push({ sequence: sequence += 1, wake });
@@ -1600,26 +1618,35 @@ function createMemoryWakeQueue() {
     async claim() {
       const entry = pending.shift();
       if (entry === void 0) return void 0;
-      inflight.set(entry.sequence, entry);
+      const token = /* @__PURE__ */ Symbol("wake-lease");
+      let completed2;
+      inflight.set(entry.sequence, { entry, token });
+      const finish = (operation) => {
+        if (completed2 === operation) return;
+        if (completed2 !== void 0 || inflight.get(entry.sequence)?.token !== token) {
+          throw new StaleWakeLeaseError();
+        }
+        inflight.delete(entry.sequence);
+        if (operation === "release") restore(entry);
+        completed2 = operation;
+      };
       return {
         wake: entry.wake,
         async ack() {
-          inflight.delete(entry.sequence);
+          finish("ack");
         },
         async release() {
-          if (!inflight.delete(entry.sequence)) return;
-          pending.push(entry);
-          pending.sort((left, right) => left.sequence - right.sequence);
+          finish("release");
         }
       };
     },
     inflightCount: async () => inflight.size,
     pendingCount: async () => pending.length,
-    async recoverInflight() {
+    async recoverInflight(options) {
+      if (options?.consumersStopped !== true) throw new TypeError("Recovery requires all consumers to be stopped");
       const recovered = inflight.size;
-      for (const entry of inflight.values()) pending.push(entry);
+      for (const { entry } of inflight.values()) restore(entry);
       inflight.clear();
-      pending.sort((left, right) => left.sequence - right.sequence);
       return recovered;
     }
   };
@@ -1892,11 +1919,59 @@ function filterWithinServicePolicy(service, plaintext) {
   return service.deliveryMode === filter.deliveryMode && JSON.stringify(service.bestEffort) === JSON.stringify(filter.bestEffort) && filter.maxPositionsPerWake <= service.limits.maxPositionsPerWake && service.events.some((event) => wakeSourcesEqual(event.source, filter.source));
 }
 
+// src/revocationRecognition.ts
+import {
+  HashZod as HashZod7,
+  PublisherEncryptionKeyRevocationSchema as PublisherEncryptionKeyRevocationSchema2,
+  PublisherEncryptionKeyRevocationZod as PublisherEncryptionKeyRevocationZod2,
+  PublisherServiceRevocationSchema as PublisherServiceRevocationSchema2,
+  PublisherServiceRevocationZod as PublisherServiceRevocationZod2,
+  WakeGrantRevocationSchema as WakeGrantRevocationSchema3,
+  WakeGrantRevocationZod as WakeGrantRevocationZod2,
+  WakeSubscriptionAcceptanceRevocationSchema as WakeSubscriptionAcceptanceRevocationSchema2,
+  WakeSubscriptionAcceptanceRevocationZod as WakeSubscriptionAcceptanceRevocationZod2,
+  WakeSubscriptionRevocationSchema as WakeSubscriptionRevocationSchema2,
+  WakeSubscriptionRevocationZod as WakeSubscriptionRevocationZod2
+} from "@xyo-network/event-kit-schemas";
+import { PayloadBuilder as PayloadBuilder6 } from "@xyo-network/sdk";
+async function recomputableRevocationHash(kind, targetHash) {
+  return await PayloadBuilder6.dataHash(revocationPayload(kind, HashZod7.parse(targetHash)));
+}
+function revocationPayload(kind, target) {
+  switch (kind) {
+    case "acceptance":
+      return WakeSubscriptionAcceptanceRevocationZod2.parse({
+        acceptance: target,
+        schema: WakeSubscriptionAcceptanceRevocationSchema2
+      });
+    case "grant":
+      return WakeGrantRevocationZod2.parse({
+        grant: target,
+        schema: WakeGrantRevocationSchema3
+      });
+    case "key":
+      return PublisherEncryptionKeyRevocationZod2.parse({
+        key: target,
+        schema: PublisherEncryptionKeyRevocationSchema2
+      });
+    case "service":
+      return PublisherServiceRevocationZod2.parse({
+        schema: PublisherServiceRevocationSchema2,
+        service: target
+      });
+    case "subscription":
+      return WakeSubscriptionRevocationZod2.parse({
+        schema: WakeSubscriptionRevocationSchema2,
+        subscription: target
+      });
+  }
+}
+
 // src/sourceWakeActivation.ts
 import {
   ChainIdZod as ChainIdZod3,
   DeploymentIdZod as DeploymentIdZod3,
-  HashZod as HashZod7,
+  HashZod as HashZod8,
   NonnegativeJsonSafeIntegerZod as NonnegativeJsonSafeIntegerZod4,
   NormalizedAddressZod as NormalizedAddressZod7,
   PositiveJsonSafeIntegerZod as PositiveJsonSafeIntegerZod2
@@ -1911,11 +1986,11 @@ var SourceWakeSubscriptionActivationZod = z4.strictObject({
   publisher: NormalizedAddressZod7,
   deploymentId: DeploymentIdZod3,
   queueId: z4.string().min(1).max(255).optional(),
-  sourceHash: HashZod7,
-  filterHash: HashZod7,
-  subscriptionHash: HashZod7,
-  serviceHash: HashZod7,
-  grantHash: HashZod7
+  sourceHash: HashZod8,
+  filterHash: HashZod8,
+  subscriptionHash: HashZod8,
+  serviceHash: HashZod8,
+  grantHash: HashZod8
 }).refine(
   (value) => value.activeFromBlock <= value.atBlock && value.atBlock < value.expiresAtBlock,
   "Subscription must be active at the exact finalized authorization snapshot"
@@ -1930,12 +2005,10 @@ import {
 // src/grantEvidence.ts
 import {
   asWakeGrantObject,
-  asWakeGrantRevocation,
   DeploymentIdZod as DeploymentIdZod4,
-  HashZod as HashZod8,
+  HashZod as HashZod9,
   NormalizedAddressZod as NormalizedAddressZod8,
-  WakeGrantObjectSchema as WakeGrantObjectSchema3,
-  WakeGrantRevocationSchema as WakeGrantRevocationSchema3
+  WakeGrantObjectSchema as WakeGrantObjectSchema3
 } from "@xyo-network/event-kit-schemas";
 function createDeploymentGrantAuthorizer(options) {
   const { viewer } = options;
@@ -1951,7 +2024,13 @@ function createDeploymentGrantAuthorizer(options) {
         ...request.exactGrantHash === void 0 ? {} : { objectHash: request.exactGrantHash },
         subject: request.publisher
       });
-      const revokedGrantHashes = await readRevocations(viewer, request.controller, request.publisher, atBlock);
+      const revokedGrantHashes = await readRevocations(
+        viewer,
+        request.controller,
+        request.publisher,
+        atBlock,
+        claims
+      );
       let evidence;
       for (const claim of claims) {
         evidence = await resolveEvidence(viewer, claim, request, atBlock, revokedGrantHashes);
@@ -1980,21 +2059,24 @@ function createDeploymentGrantAuthorizer(options) {
     }
   });
 }
-async function readRevocations(viewer, controller, subject, atBlock) {
+async function readRevocations(viewer, controller, subject, atBlock, grantClaims) {
   const revoked = /* @__PURE__ */ new Set();
-  const claims = await viewer.claims(controller, {
-    declaredObjectSchemaPrefix: WakeGrantRevocationSchema3,
-    subject
-  });
-  for (const claim of claims) {
-    if (!isLiveClaim(claim, controller, subject, WakeGrantRevocationSchema3, atBlock)) continue;
-    const object = await viewer.object(claim.objectHash);
-    if (object?.assurance !== "resolved" || object.declaredSchema !== WakeGrantRevocationSchema3 || object.objectHash !== claim.objectHash || !isRecord3(object.params) || Object.hasOwn(object.params, "schema")) continue;
-    const revocation = asWakeGrantRevocation({ ...object.params, schema: object.declaredSchema });
-    if (revocation !== void 0) revoked.add(revocation.grant);
+  for (const claim of grantClaims) {
+    if (!isLiveClaim(claim, controller, subject, WakeGrantObjectSchema3, atBlock)) continue;
+    if (await controllerRevokedGrant(viewer, controller, subject, claim.objectHash, atBlock)) {
+      revoked.add(claim.objectHash);
+    }
   }
   return revoked;
 }
+async function controllerRevokedGrant(viewer, controller, subject, grantHash, atBlock) {
+  const objectHash = await recomputableRevocationHash("grant", grantHash);
+  const claims = await viewer.claims(controller, { objectHash, subject });
+  return claims.some((claim) => isRevocationMembership(claim, controller, subject, objectHash, atBlock));
+}
+function isRevocationMembership(claim, controller, subject, objectHash, atBlock) {
+  return claim.source === controller && claim.subject === subject && claim.objectHash === objectHash && isNonnegativeSafeInteger5(claim.firstBlock) && claim.firstBlock <= atBlock && isNonnegativeSafeInteger5(claim.lastBlock) && claim.lastBlock >= claim.firstBlock && HashZod9.safeParse(claim.firstEventHash).success && HashZod9.safeParse(claim.objectHash).success;
+}
 async function resolveEvidence(viewer, claim, request, atBlock, revokedGrantHashes) {
   if (!isLiveClaim(claim, request.controller, request.publisher, WakeGrantObjectSchema3, atBlock)) return void 0;
   if (revokedGrantHashes.has(claim.objectHash)) return void 0;
@@ -2008,10 +2090,6 @@ async function resolveEvidence(viewer, claim, request, atBlock, revokedGrantHash
   if (!grant.permissions.includes("enqueue")) return void 0;
   return Object.freeze({
     assertedAtBlock: claim.firstBlock,
-    authorizationChainId: request.authorizationChainId,
-    sourceHash: request.sourceHash,
-    filterHash: request.filterHash,
-    subscriptionHash: request.subscriptionHash,
     controller: request.controller,
     deploymentId: grant.deploymentId,
     id: claim.firstEventHash,
@@ -2021,7 +2099,7 @@ async function resolveEvidence(viewer, claim, request, atBlock, revokedGrantHash
   });
 }
 function isLiveClaim(claim, controller, subject, declaredObjectSchema, atBlock) {
-  return claim.source === controller && claim.subject === subject && claim.declaredObjectSchema === declaredObjectSchema && isNonnegativeSafeInteger5(claim.firstBlock) && claim.firstBlock <= atBlock && isNonnegativeSafeInteger5(claim.lastBlock) && claim.lastBlock >= claim.firstBlock && HashZod8.safeParse(claim.firstEventHash).success && HashZod8.safeParse(claim.objectHash).success;
+  return claim.source === controller && claim.subject === subject && claim.declaredObjectSchema === declaredObjectSchema && isNonnegativeSafeInteger5(claim.firstBlock) && claim.firstBlock <= atBlock && isNonnegativeSafeInteger5(claim.lastBlock) && claim.lastBlock >= claim.firstBlock && HashZod9.safeParse(claim.firstEventHash).success && HashZod9.safeParse(claim.objectHash).success;
 }
 function parseExactGrantObject(object, expectedObjectHash) {
   if (object?.assurance !== "resolved") return void 0;
@@ -2033,7 +2111,7 @@ function parseExactGrantObject(object, expectedObjectHash) {
   });
 }
 function assertValidRequest(request) {
-  if (request.exactGrantHash !== void 0 && !HashZod8.safeParse(request.exactGrantHash).success) {
+  if (request.exactGrantHash !== void 0 && !HashZod9.safeParse(request.exactGrantHash).success) {
     throw new TypeError("Exact grant hash must be canonical lowercase hexadecimal");
   }
   if (!NormalizedAddressZod8.safeParse(request.controller).success) {
@@ -2091,6 +2169,7 @@ function createStatementGraphWakeGrantAuthorizer(options) {
         ...decision,
         grant: Object.freeze({
           ...decision.grant,
+          authorizationKind: "activated-subscription",
           authorizationChainId,
           sourceHash,
           filterHash: activation.filterHash,
@@ -2110,7 +2189,11 @@ async function drainQueue(queue, handler) {
     try {
       await handler(leased.wake);
     } catch (error) {
-      await leased.release();
+      try {
+        await leased.release();
+      } catch (releaseError) {
+        throw new AggregateError([error, releaseError], "Wake handler and lease release both failed", { cause: releaseError });
+      }
       throw error;
     }
     await leased.ack();
@@ -2125,6 +2208,7 @@ export {
   EVENT_KIT_MAX_JWT_LIFETIME_SECONDS,
   EVENT_KIT_REPLAY_RETENTION_SKEW_SECONDS,
   SourceWakeSubscriptionActivationZod,
+  StaleWakeLeaseError,
   WakeAdmissionRouteZod,
   WakeSubscriptionDecryptionError,
   admitAndEnqueue,
@@ -2163,6 +2247,7 @@ export {
   issuePublisherEndpointChallenge,
   parseAdmittedWake,
   parseBestEffortSecurityState,
+  recomputableRevocationHash,
   resolvePreferredEncryptionKey,
   selectPublisherService,
   selectSubscriptionActivation,