@xyo-network/event-kit-node 0.1.0 → 0.1.2

package/dist/node/handshake.mjs

@@ -793,6 +793,7 @@ function requireTime(value) {
 // src/handshakeClients.ts
 import {
   beginPublisherEndpointChallengeAttempt,
+  canonicalJson,
   completePublisherEndpointChallenge,
   createEncryptedWakeSubscription,
   createPublisherEncryptionKeyRevocation,
@@ -841,10 +842,7 @@ function createSynchronizedEventKitHandshakeReader(options) {
   function assertIdentity() {
     const checkpoint = options.replay.snapshot();
     if (checkpoint.chainId !== chainId || checkpoint.network !== options.session.network || checkpoint.publisher !== publisher) {
-      throw new EventKitHandshakeClientError(
-        "identity-mismatch",
-        "Finalized replay identity does not match the pinned Event Kit network and publisher"
-      );
+      throw new EventKitHandshakeClientError("identity-mismatch", "Finalized replay identity does not match the pinned Event Kit network and publisher");
     }
   }
   return Object.freeze({
@@ -897,10 +895,7 @@ function createEventKitHandshakePublicationPort(transport) {
       const raw = String(await transport.signer.address());
       const normalized = NormalizedAddressZod3.parse(normalizeAddress(raw));
       if (raw !== normalized) {
-        throw new EventKitHandshakeClientError(
-          "identity-mismatch",
-          "XL1 publication signer address is not canonical lowercase hexadecimal without 0x"
-        );
+        throw new EventKitHandshakeClientError("identity-mismatch", "XL1 publication signer address is not canonical lowercase hexadecimal without 0x");
       }
       return normalized;
     }
@@ -916,10 +911,7 @@ function nextBlock(head) {
 function samplePublisherClock(nowSeconds) {
   const sampled = nowSeconds();
   if (!Number.isSafeInteger(sampled) || sampled < 0) {
-    throw new EventKitHandshakeClientError(
-      "challenge-rejected",
-      "Publisher clock must return a nonnegative JSON-safe Unix second"
-    );
+    throw new EventKitHandshakeClientError("challenge-rejected", "Publisher clock must return a nonnegative JSON-safe Unix second");
   }
   return sampled;
 }
@@ -942,37 +934,25 @@ function serviceQuery(reader, snapshot, serviceId) {
 }
 function requireService(discovery) {
   if (!discovery.ok) {
-    throw new EventKitHandshakeClientError(
-      "service-unavailable",
-      `Publisher service is unavailable: ${discovery.reason}`
-    );
+    throw new EventKitHandshakeClientError("service-unavailable", `Publisher service is unavailable: ${discovery.reason}`);
   }
   return discovery;
 }
 function requireExpectedService(discovery, expected) {
   const expectedHash = HashZod4.parse(expected);
   if (discovery.service.objectHash !== expectedHash) {
-    throw new EventKitHandshakeClientError(
-      "service-mismatch",
-      "Currently selected publisher service does not match the expected object hash"
-    );
+    throw new EventKitHandshakeClientError("service-mismatch", "Currently selected publisher service does not match the expected object hash");
   }
   return expectedHash;
 }
 function assertPublicationIdentity(publication, reader) {
   if (publication.chainId !== reader.chainId) {
-    throw new EventKitHandshakeClientError(
-      "identity-mismatch",
-      "Publication transport chain ID does not match the synchronized handshake reader"
-    );
+    throw new EventKitHandshakeClientError("identity-mismatch", "Publication transport chain ID does not match the synchronized handshake reader");
   }
 }
 async function assertPublicationSource(publication, expected) {
   if (await publication.source() !== expected) {
-    throw new EventKitHandshakeClientError(
-      "identity-mismatch",
-      "Publication signer does not match the required handshake Claim source"
-    );
+    throw new EventKitHandshakeClientError("identity-mismatch", "Publication signer does not match the required handshake Claim source");
   }
 }
 function intentLookup(reader, kind, operationId, source) {
@@ -985,15 +965,13 @@ function intentLookup(reader, kind, operationId, source) {
   };
 }
 function mutationIntentError(error) {
-  return error instanceof HandshakeMutationIntentConflictError ? new EventKitHandshakeClientError("mutation-intent-conflict", error.message) : new EventKitHandshakeClientError(
-    "mutation-intent-unavailable",
-    "Handshake mutation intent storage is unavailable or invalid"
-  );
+  return error instanceof HandshakeMutationIntentConflictError ? new EventKitHandshakeClientError("mutation-intent-conflict", error.message) : new EventKitHandshakeClientError("mutation-intent-unavailable", "Handshake mutation intent storage is unavailable or invalid");
 }
 async function loadMutationIntent(store, reader, kind, operationId, source, requestFingerprint) {
   try {
     const existing = await store.get(intentLookup(reader, kind, operationId, source));
-    if (existing === void 0) return void 0;
+    if (existing === void 0)
+      return void 0;
     if (existing.kind !== kind || existing.requestFingerprint !== requestFingerprint) {
       throw new HandshakeMutationIntentConflictError();
     }
@@ -1012,7 +990,8 @@ async function persistMutationIntent(store, intent) {
 async function publisherServiceRequestFingerprint(input) {
   return await handshakeMutationRequestFingerprint({
     expiresAtBlock: input.expiresAtBlock ?? null,
-    maxBlocksPerWake: input.maxBlocksPerWake,
+    maxPositionsPerWake: input.maxPositionsPerWake,
+    sources: input.sources,
     maxSubscriptionLifetimeBlocks: input.maxSubscriptionLifetimeBlocks,
     validFromBlock: input.validFromBlock ?? null
   });
@@ -1021,7 +1000,7 @@ async function publisherRotationRequestFingerprint(input) {
   return await handshakeMutationRequestFingerprint({
     expiresAtBlock: input.expiresAtBlock ?? null,
     keyExpiresAtBlock: input.keyExpiresAtBlock ?? null,
-    maxBlocksPerWake: input.maxBlocksPerWake ?? null,
+    maxPositionsPerWake: input.maxPositionsPerWake ?? null,
     maxSubscriptionLifetimeBlocks: input.maxSubscriptionLifetimeBlocks ?? null,
     service: HashZod4.parse(input.service),
     validFromBlock: input.validFromBlock ?? null
@@ -1035,7 +1014,9 @@ async function subscriberSubscriptionRequestFingerprint(input) {
     endpoint: input.endpoint,
     expiresAtBlock: input.expiresAtBlock,
     grantId: input.grantId ?? null,
-    maxBlocksPerWake: input.maxBlocksPerWake ?? null,
+    source: input.source,
+    fromPosition: input.fromPosition,
+    maxPositionsPerWake: input.maxPositionsPerWake ?? null,
     queueId: input.queueId ?? null,
     revision: input.revision ?? null,
     subscriptionId: input.subscriptionId ?? null,
@@ -1078,10 +1059,7 @@ function protocolCandidate(reader, discovery, candidate, keys) {
   };
 }
 function validationError(reason) {
-  return new EventKitHandshakeClientError(
-    "subscription-invalid",
-    `Publisher subscription candidate failed validation: ${reason}`
-  );
+  return new EventKitHandshakeClientError("subscription-invalid", `Publisher subscription candidate failed validation: ${reason}`);
 }
 function challengeError(result) {
   const reason = result.ok ? "unknown" : result.reason;
@@ -1106,7 +1084,8 @@ function createPublisherHandshakeClient(options) {
   }
   async function resolveCandidate(selector) {
     const found = await candidateDiscovery(selector);
-    if (!found.ok) throw new EventKitHandshakeClientError("service-unavailable", `Publisher service is unavailable: ${found.reason}`);
+    if (!found.ok)
+      throw new EventKitHandshakeClientError("service-unavailable", `Publisher service is unavailable: ${found.reason}`);
     const subscriber = NormalizedAddressZod3.parse(selector.subscriber);
     const subscription = selector.subscription === void 0 ? void 0 : HashZod4.parse(selector.subscription);
     const candidates = found.candidates.filter((candidate2) => candidate2.subscriber === subscriber && (subscription === void 0 || candidate2.tuple.subscription.objectHash === subscription));
@@ -1117,10 +1096,9 @@ function createPublisherHandshakeClient(options) {
       throw new EventKitHandshakeClientError("candidate-ambiguous", "More than one finalized acceptance candidate matched");
     }
     const candidate = candidates[0];
-    const validated = await validateAndDecryptPublisherSubscription(
-      protocolCandidate(options.reader, found, candidate, options.keys)
-    );
-    if (!validated.ok) throw validationError(validated.reason);
+    const validated = await validateAndDecryptPublisherSubscription(protocolCandidate(options.reader, found, candidate, options.keys));
+    if (!validated.ok)
+      throw validationError(validated.reason);
     return { candidate, validated };
   }
   async function candidateForChallenge(challenge) {
@@ -1129,10 +1107,7 @@ function createPublisherHandshakeClient(options) {
       subscription: challenge.subscription
     });
     if (!endpointChallengeMatchesPublisherContext(challenge, resolved.validated.context)) {
-      throw new EventKitHandshakeClientError(
-        "challenge-context-invalid",
-        "Endpoint challenge does not match the current finalized subscription candidate"
-      );
+      throw new EventKitHandshakeClientError("challenge-context-invalid", "Endpoint challenge does not match the current finalized subscription candidate");
     }
     return resolved;
   }
@@ -1222,12 +1197,7 @@ function createPublisherHandshakeClient(options) {
       operationId: intent.operationId,
       response: intent.response
     });
-    const reconciliation = await reconcileAcceptance(
-      acceptanceHash,
-      publication,
-      intent.challenge.subscriber,
-      intent.challenge.subscription
-    );
+    const reconciliation = await reconcileAcceptance(acceptanceHash, publication, intent.challenge.subscriber, intent.challenge.subscription);
     return Object.freeze({
       acceptance: Object.freeze({ body: intent.acceptance, objectHash: acceptanceHash }),
       challenge: intent.operationId,
@@ -1248,10 +1218,7 @@ function createPublisherHandshakeClient(options) {
         publisher: options.reader.publisher
       });
     } catch {
-      throw new EventKitHandshakeClientError(
-        "key-custody-failed",
-        "Publisher encryption private key was not durably retained; publication was not attempted"
-      );
+      throw new EventKitHandshakeClientError("key-custody-failed", "Publisher encryption private key was not durably retained; publication was not attempted");
     }
     const [keyHash, serviceHash] = await Promise.all([
       handshakeObjectHash2(intent.encryptionKey),
@@ -1274,19 +1241,19 @@ function createPublisherHandshakeClient(options) {
   const client = {
     async acceptanceCandidates(selector = {}) {
       const found = await candidateDiscovery(selector);
-      if (!found.ok || selector.subscription === void 0) return found;
+      if (!found.ok || selector.subscription === void 0)
+        return found;
       const subscription = HashZod4.parse(selector.subscription);
       return Object.freeze({
         ...found,
-        candidates: found.candidates.filter(
-          (candidate) => candidate.tuple.subscription.objectHash === subscription
-        )
+        candidates: found.candidates.filter((candidate) => candidate.tuple.subscription.objectHash === subscription)
       });
     },
     async beginChallenge(input) {
       const challengeHash = HashZod4.parse(input.challengeHash);
       const record = await options.challenges.get(challengeHash);
-      if (record === void 0) return { kind: "missing" };
+      if (record === void 0)
+        return { kind: "missing" };
       const resolved = await candidateForChallenge(record.challenge);
       const begun = await beginPublisherEndpointChallengeAttempt({
         challengeHash,
@@ -1321,10 +1288,7 @@ function createPublisherHandshakeClient(options) {
         throw new EventKitHandshakeClientError("challenge-not-found", "Endpoint challenge was not found");
       }
       if (record.challenge.subscriber !== subscriber || record.challenge.subscription !== subscription) {
-        throw new EventKitHandshakeClientError(
-          "challenge-context-invalid",
-          "Stored endpoint challenge does not match the caller expected subscriber and subscription"
-        );
+        throw new EventKitHandshakeClientError("challenge-context-invalid", "Stored endpoint challenge does not match the caller expected subscriber and subscription");
       }
       const responseHash = await handshakeObjectHash2(input.response);
       const requestFingerprint = await exactMutationRequestFingerprint({
@@ -1333,20 +1297,10 @@ function createPublisherHandshakeClient(options) {
         subscriber,
         subscription
       });
-      const existing = await loadMutationIntent(
-        options.intents,
-        options.reader,
-        "publisher-subscription-accept",
-        challengeHash,
-        options.reader.publisher,
-        requestFingerprint
-      );
+      const existing = await loadMutationIntent(options.intents, options.reader, "publisher-subscription-accept", challengeHash, options.reader.publisher, requestFingerprint);
       if (existing !== void 0) {
         if (record.state !== "verified" || record.responseHash !== responseHash) {
-          throw new EventKitHandshakeClientError(
-            "mutation-intent-conflict",
-            "Acceptance intent does not match the durable verified challenge decision"
-          );
+          throw new EventKitHandshakeClientError("mutation-intent-conflict", "Acceptance intent does not match the durable verified challenge decision");
         }
         return await publishAcceptanceIntent(existing, "resumed");
       }
@@ -1358,36 +1312,22 @@ function createPublisherHandshakeClient(options) {
         store: options.challenges,
         subscription: resolved.validated
       });
-      if (!completed.ok) throw challengeError(completed);
-      const concurrentlyPersisted = await loadMutationIntent(
-        options.intents,
-        options.reader,
-        "publisher-subscription-accept",
-        challengeHash,
-        options.reader.publisher,
-        requestFingerprint
-      );
-      if (concurrentlyPersisted !== void 0) return await publishAcceptanceIntent(concurrentlyPersisted, "resumed");
+      if (!completed.ok)
+        throw challengeError(completed);
+      const concurrentlyPersisted = await loadMutationIntent(options.intents, options.reader, "publisher-subscription-accept", challengeHash, options.reader.publisher, requestFingerprint);
+      if (concurrentlyPersisted !== void 0)
+        return await publishAcceptanceIntent(concurrentlyPersisted, "resumed");
       let current;
       try {
         current = await candidateForChallenge(record.challenge);
       } catch (error) {
-        const recovered = await loadMutationIntent(
-          options.intents,
-          options.reader,
-          "publisher-subscription-accept",
-          challengeHash,
-          options.reader.publisher,
-          requestFingerprint
-        );
-        if (recovered !== void 0) return await publishAcceptanceIntent(recovered, "resumed");
+        const recovered = await loadMutationIntent(options.intents, options.reader, "publisher-subscription-accept", challengeHash, options.reader.publisher, requestFingerprint);
+        if (recovered !== void 0)
+          return await publishAcceptanceIntent(recovered, "resumed");
         throw error;
       }
       if (!endpointChallengeMatchesPublisherContext(record.challenge, current.validated.context)) {
-        throw new EventKitHandshakeClientError(
-          "challenge-context-invalid",
-          "Endpoint challenge candidate changed before acceptance publication"
-        );
+        throw new EventKitHandshakeClientError("challenge-context-invalid", "Endpoint challenge candidate changed before acceptance publication");
       }
       const resolvedIntent = await persistMutationIntent(options.intents, {
         acceptance: completed.acceptance,
@@ -1429,42 +1369,35 @@ function createPublisherHandshakeClient(options) {
     async publishService(input) {
       await assertPublicationSource(options.publication, options.reader.publisher);
       if (serviceId !== void 0) {
-        throw new EventKitHandshakeClientError(
-          "service-root-requires-fresh-id",
-          "Root service publication requires an unconfigured client so a fresh serviceId is generated"
-        );
+        throw new EventKitHandshakeClientError("service-root-requires-fresh-id", "Root service publication requires an unconfigured client so a fresh serviceId is generated");
       }
       const operationId = HandshakeIdZod3.parse(input.operationId);
       const requestFingerprint = await publisherServiceRequestFingerprint(input);
-      const priorIntent = await loadMutationIntent(
-        options.intents,
-        options.reader,
-        "publisher-service-publish",
-        operationId,
-        options.reader.publisher,
-        requestFingerprint
-      );
-      if (priorIntent !== void 0) return await publishPublisherServiceIntent(priorIntent, "resumed");
+      const priorIntent = await loadMutationIntent(options.intents, options.reader, "publisher-service-publish", operationId, options.reader.publisher, requestFingerprint);
+      if (priorIntent !== void 0)
+        return await publishPublisherServiceIntent(priorIntent, "resumed");
       const current = await snapshot();
       const existing = await discovery(current);
       if (existing.ok) {
-        throw new EventKitHandshakeClientError(
-          "service-already-exists",
-          "An active publisher service already exists; rotate its key to publish a successor"
-        );
+        throw new EventKitHandshakeClientError("service-already-exists", "An active publisher service already exists; rotate its key to publish a successor");
       }
       if (existing.reason !== "service-not-found") {
         throw new EventKitHandshakeClientError("service-unavailable", `Cannot declare service: ${existing.reason}`);
       }
       const validFromBlock = input.validFromBlock ?? nextBlock(current.finalizedHead);
       const generated = await generatePublisherEncryptionKey({ validFromBlock });
-      const service = createPublisherService({
+      const serviceInput = {
         encryptionKeys: [generated.descriptorHash],
         ...input.expiresAtBlock === void 0 ? {} : { expiresAtBlock: input.expiresAtBlock },
-        maxBlocksPerWake: input.maxBlocksPerWake,
         maxSubscriptionLifetimeBlocks: input.maxSubscriptionLifetimeBlocks,
         preferredEncryptionKey: generated.descriptorHash,
         validFromBlock
+      };
+      const service = createPublisherService({
+        ...serviceInput,
+        authorizationChainId: options.reader.chainId,
+        sources: input.sources,
+        maxPositionsPerWake: input.maxPositionsPerWake
       });
       const resolvedIntent = await persistMutationIntent(options.intents, {
         chainId: options.reader.chainId,
@@ -1484,23 +1417,13 @@ function createPublisherHandshakeClient(options) {
       await assertPublicationSource(options.publication, options.reader.publisher);
       const keyHash = HashZod4.parse(key);
       const requestFingerprint = await exactMutationRequestFingerprint({ key: keyHash });
-      let resolvedIntent = await loadMutationIntent(
-        options.intents,
-        options.reader,
-        "publisher-encryption-key-retire",
-        keyHash,
-        options.reader.publisher,
-        requestFingerprint
-      );
+      let resolvedIntent = await loadMutationIntent(options.intents, options.reader, "publisher-encryption-key-retire", keyHash, options.reader.publisher, requestFingerprint);
       let intentDisposition = "resumed";
       if (resolvedIntent === void 0) {
         const current = await snapshot();
         const selected = requireService(await discovery(current));
         if (selected.key.objectHash !== keyHash || !selected.service.body.encryptionKeys.includes(keyHash) || selected.service.body.preferredEncryptionKey !== keyHash) {
-          throw new EventKitHandshakeClientError(
-            "key-mismatch",
-            "Encryption key does not match the exact current preferred descriptor evidence"
-          );
+          throw new EventKitHandshakeClientError("key-mismatch", "Encryption key does not match the exact current preferred descriptor evidence");
         }
         const persisted = await persistMutationIntent(options.intents, {
           chainId: options.reader.chainId,
@@ -1532,14 +1455,7 @@ function createPublisherHandshakeClient(options) {
       await assertPublicationSource(options.publication, options.reader.publisher);
       const service = HashZod4.parse(expectedService);
       const requestFingerprint = await exactMutationRequestFingerprint({ service });
-      let resolvedIntent = await loadMutationIntent(
-        options.intents,
-        options.reader,
-        "publisher-service-retire",
-        service,
-        options.reader.publisher,
-        requestFingerprint
-      );
+      let resolvedIntent = await loadMutationIntent(options.intents, options.reader, "publisher-service-retire", service, options.reader.publisher, requestFingerprint);
       let intentDisposition = "resumed";
       if (resolvedIntent === void 0) {
         const current = await snapshot();
@@ -1575,15 +1491,9 @@ function createPublisherHandshakeClient(options) {
       await assertPublicationSource(options.publication, options.reader.publisher);
       const operationId = HandshakeIdZod3.parse(input.operationId);
       const requestFingerprint = await publisherRotationRequestFingerprint(input);
-      const priorIntent = await loadMutationIntent(
-        options.intents,
-        options.reader,
-        "publisher-service-rotate-key",
-        operationId,
-        options.reader.publisher,
-        requestFingerprint
-      );
-      if (priorIntent !== void 0) return await publishPublisherServiceIntent(priorIntent, "resumed");
+      const priorIntent = await loadMutationIntent(options.intents, options.reader, "publisher-service-rotate-key", operationId, options.reader.publisher, requestFingerprint);
+      if (priorIntent !== void 0)
+        return await publishPublisherServiceIntent(priorIntent, "resumed");
       const current = await snapshot();
       const selected = requireService(await discovery(current));
       requireExpectedService(selected, input.service);
@@ -1592,16 +1502,21 @@ function createPublisherHandshakeClient(options) {
         ...input.keyExpiresAtBlock === void 0 ? {} : { expiresAtBlock: input.keyExpiresAtBlock },
         validFromBlock
       });
-      const service = createPublisherService({
+      const serviceInput = {
         encryptionKeys: [generated.descriptorHash],
         ...input.expiresAtBlock === void 0 ? selected.service.body.expiresAtBlock === void 0 ? {} : { expiresAtBlock: selected.service.body.expiresAtBlock } : { expiresAtBlock: input.expiresAtBlock },
-        maxBlocksPerWake: input.maxBlocksPerWake ?? selected.service.body.limits.maxBlocksPerWake,
         maxSubscriptionLifetimeBlocks: input.maxSubscriptionLifetimeBlocks ?? selected.service.body.limits.maxSubscriptionLifetimeBlocks,
         preferredEncryptionKey: generated.descriptorHash,
         revision: selected.service.body.revision + 1,
         serviceId: selected.service.body.serviceId,
         supersedes: HashZod4.parse(selected.service.objectHash),
         validFromBlock
+      };
+      const service = createPublisherService({
+        ...serviceInput,
+        authorizationChainId: options.reader.chainId,
+        sources: selected.service.body.events.map((event) => event.source),
+        maxPositionsPerWake: input.maxPositionsPerWake ?? selected.service.body.limits.maxPositionsPerWake
       });
       const resolvedIntent = await persistMutationIntent(options.intents, {
         chainId: options.reader.chainId,
@@ -1645,9 +1560,7 @@ function createSubscriberHandshakeClient(options) {
     return readySnapshot(await options.reader.sync());
   }
   async function serviceAt(current) {
-    return requireService(
-      await current.readModel.discoverPublisherService(serviceQuery(options.reader, current, serviceId))
-    );
+    return requireService(await current.readModel.discoverPublisherService(serviceQuery(options.reader, current, serviceId)));
   }
   async function lookup(subscriptionId) {
     const current = await options.reader.sync();
@@ -1664,29 +1577,21 @@ function createSubscriberHandshakeClient(options) {
     const revision = input.revision ?? 1;
     if (revision === 1) {
       if (input.supersedes !== void 0) {
-        throw new EventKitHandshakeClientError(
-          "subscription-invalid",
-          "Subscription revision 1 must not declare supersedes"
-        );
+        throw new EventKitHandshakeClientError("subscription-invalid", "Subscription revision 1 must not declare supersedes");
       }
-      if (input.subscriptionId === void 0) return;
+      if (input.subscriptionId === void 0)
+        return;
       const view2 = await lookupAt(current, input.subscriptionId);
       if (!view2.ok) {
         throw new EventKitHandshakeClientError("service-unavailable", `Cannot validate subscription identity: ${view2.reason}`);
       }
       if (view2.subscriptions.some((item) => item.subscriptionId === input.subscriptionId)) {
-        throw new EventKitHandshakeClientError(
-          "subscription-invalid",
-          "Subscription revision 1 would duplicate an existing finalized stable identity"
-        );
+        throw new EventKitHandshakeClientError("subscription-invalid", "Subscription revision 1 would duplicate an existing finalized stable identity");
       }
       return;
     }
     if (input.subscriptionId === void 0 || input.supersedes === void 0) {
-      throw new EventKitHandshakeClientError(
-        "subscription-invalid",
-        "A replacement subscription requires subscriptionId and supersedes"
-      );
+      throw new EventKitHandshakeClientError("subscription-invalid", "A replacement subscription requires subscriptionId and supersedes");
     }
     const view = await lookupAt(current, input.subscriptionId);
     if (!view.ok) {
@@ -1694,24 +1599,15 @@ function createSubscriberHandshakeClient(options) {
     }
     const lifecycles = view.subscriptions.filter((item) => item.subscriptionId === input.subscriptionId);
     if (lifecycles.length !== 1) {
-      throw new EventKitHandshakeClientError(
-        "subscription-invalid",
-        "Replacement subscription does not resolve one finalized stable identity"
-      );
+      throw new EventKitHandshakeClientError("subscription-invalid", "Replacement subscription does not resolve one finalized stable identity");
     }
     if (lifecycles[0].state === "rejected") {
-      throw new EventKitHandshakeClientError(
-        "subscription-invalid",
-        "Replacement subscription cannot extend a rejected finalized revision chain"
-      );
+      throw new EventKitHandshakeClientError("subscription-invalid", "Replacement subscription cannot extend a rejected finalized revision chain");
     }
     const highestRevision = Math.max(...lifecycles[0].tuples.map((tuple) => tuple.subscription.body.revision));
     const latest = lifecycles[0].tuples.filter((tuple) => tuple.subscription.body.revision === highestRevision);
     if (latest.length !== 1 || revision !== highestRevision + 1 || latest[0].subscription.objectHash !== input.supersedes) {
-      throw new EventKitHandshakeClientError(
-        "subscription-invalid",
-        "Replacement subscription revision and supersedes must extend the exact finalized chain tip"
-      );
+      throw new EventKitHandshakeClientError("subscription-invalid", "Replacement subscription revision and supersedes must extend the exact finalized chain tip");
     }
   }
   async function publishSubscriberSubscriptionIntent(intent, intentDisposition) {
@@ -1740,23 +1636,13 @@ function createSubscriberHandshakeClient(options) {
       await assertPublicationSource(options.publication, subscriber);
       const grantHash = HashZod4.parse(grant);
       const requestFingerprint = await exactMutationRequestFingerprint({ grant: grantHash });
-      let resolvedIntent = await loadMutationIntent(
-        options.intents,
-        options.reader,
-        "subscriber-grant-revoke",
-        grantHash,
-        subscriber,
-        requestFingerprint
-      );
+      let resolvedIntent = await loadMutationIntent(options.intents, options.reader, "subscriber-grant-revoke", grantHash, subscriber, requestFingerprint);
       let intentDisposition = "resumed";
       if (resolvedIntent === void 0) {
         const current = await snapshot();
         const view = await current.readModel.subscriber({ ...serviceQuery(options.reader, current, serviceId), subscriber });
         if (!view.ok || !tupleHashes(view).grants.has(grantHash)) {
-          throw new EventKitHandshakeClientError(
-            "subscription-not-found",
-            "Grant is not present in this subscriber finalization view"
-          );
+          throw new EventKitHandshakeClientError("subscription-not-found", "Grant is not present in this subscriber finalization view");
         }
         const persisted = await persistMutationIntent(options.intents, {
           chainId: options.reader.chainId,
@@ -1789,23 +1675,13 @@ function createSubscriberHandshakeClient(options) {
       await assertPublicationSource(options.publication, subscriber);
       const subscriptionHash = HashZod4.parse(subscription);
       const requestFingerprint = await exactMutationRequestFingerprint({ subscription: subscriptionHash });
-      let resolvedIntent = await loadMutationIntent(
-        options.intents,
-        options.reader,
-        "subscriber-subscription-revoke",
-        subscriptionHash,
-        subscriber,
-        requestFingerprint
-      );
+      let resolvedIntent = await loadMutationIntent(options.intents, options.reader, "subscriber-subscription-revoke", subscriptionHash, subscriber, requestFingerprint);
       let intentDisposition = "resumed";
       if (resolvedIntent === void 0) {
         const current = await snapshot();
         const view = await current.readModel.subscriber({ ...serviceQuery(options.reader, current, serviceId), subscriber });
         if (!view.ok || !tupleHashes(view).subscriptions.has(subscriptionHash)) {
-          throw new EventKitHandshakeClientError(
-            "subscription-not-found",
-            "Subscription is not present in this subscriber finalization view"
-          );
+          throw new EventKitHandshakeClientError("subscription-not-found", "Subscription is not present in this subscriber finalization view");
         }
         const persisted = await persistMutationIntent(options.intents, {
           chainId: options.reader.chainId,
@@ -1842,19 +1718,18 @@ function createSubscriberHandshakeClient(options) {
       const subscriptionHash = HashZod4.parse(subscription);
       const current = await options.reader.sync();
       const view = await lookupAt(current);
-      if (!view.ok) return view;
+      if (!view.ok)
+        return view;
       const matches = view.subscriptions.flatMap((lifecycle) => lifecycle.tuples.filter((tuple) => tuple.subscription.objectHash === subscriptionHash).map((tuple) => ({ lifecycle, tuple })));
       if (matches.length > 1) {
-        throw new EventKitHandshakeClientError(
-          "subscription-invalid",
-          "Exact subscription hash appears more than once in the subscriber view"
-        );
+        throw new EventKitHandshakeClientError("subscription-invalid", "Exact subscription hash appears more than once in the subscriber view");
       }
-      if (matches.length === 0) return Object.freeze({
-        found: false,
-        lookup: view,
-        ok: true
-      });
+      if (matches.length === 0)
+        return Object.freeze({
+          found: false,
+          lookup: view,
+          ok: true
+        });
       return Object.freeze({
         found: true,
         lifecycle: matches[0].lifecycle,
@@ -1867,36 +1742,22 @@ function createSubscriberHandshakeClient(options) {
       await assertPublicationSource(options.publication, subscriber);
       const operationId = HandshakeIdZod3.parse(input.operationId);
       const requestFingerprint = await subscriberSubscriptionRequestFingerprint(input);
-      const priorIntent = await loadMutationIntent(
-        options.intents,
-        options.reader,
-        "subscriber-subscription-subscribe",
-        operationId,
-        subscriber,
-        requestFingerprint
-      );
-      if (priorIntent !== void 0) return await publishSubscriberSubscriptionIntent(priorIntent, "resumed");
+      const priorIntent = await loadMutationIntent(options.intents, options.reader, "subscriber-subscription-subscribe", operationId, subscriber, requestFingerprint);
+      if (priorIntent !== void 0)
+        return await publishSubscriberSubscriptionIntent(priorIntent, "resumed");
       const current = await snapshot();
       const selected = await serviceAt(current);
       if (input.expiresAtBlock - current.finalizedHead <= 3) {
-        throw new EventKitHandshakeClientError(
-          "subscription-invalid",
-          "Requested subscription expiry must leave finalized blocks for tuple publication, acceptance, and activation"
-        );
+        throw new EventKitHandshakeClientError("subscription-invalid", "Requested subscription expiry must leave finalized blocks for tuple publication, acceptance, and activation");
       }
       await validateRevision(current, input);
-      const maxBlocksPerWake = input.maxBlocksPerWake ?? selected.service.body.limits.maxBlocksPerWake;
-      if (maxBlocksPerWake > selected.service.body.limits.maxBlocksPerWake) {
-        throw new EventKitHandshakeClientError(
-          "subscription-invalid",
-          "Requested maxBlocksPerWake exceeds the selected publisher service limit"
-        );
+      const maximum = selected.service.body.limits.maxPositionsPerWake;
+      const maxPositionsPerWake = input.maxPositionsPerWake ?? maximum;
+      if (maxPositionsPerWake > maximum) {
+        throw new EventKitHandshakeClientError("subscription-invalid", "Requested maxPositionsPerWake exceeds the selected publisher service limit");
       }
       if (input.expiresAtBlock > current.finalizedHead + selected.service.body.limits.maxSubscriptionLifetimeBlocks) {
-        throw new EventKitHandshakeClientError(
-          "subscription-invalid",
-          "Requested subscription expiry exceeds the selected publisher service lifetime limit"
-        );
+        throw new EventKitHandshakeClientError("subscription-invalid", "Requested subscription expiry exceeds the selected publisher service lifetime limit");
       }
       const grant = createWakeGrant({
         deploymentId: input.deploymentId,
@@ -1905,19 +1766,11 @@ function createSubscriberHandshakeClient(options) {
         ...input.queueId === void 0 || input.queueId === null ? {} : { queueId: input.queueId }
       });
       const grantHash = await handshakeObjectHash2(grant);
-      const plaintext = createWakeSubscriptionPlaintext({
-        audience: input.audience,
-        challengeSecret: input.challengeSecret,
-        deploymentId: input.deploymentId,
-        endpoint: input.endpoint,
-        maxBlocksPerWake,
-        queueId: input.queueId
-      });
-      const subscription = await createEncryptedWakeSubscription({
+      const plaintext = subscriberPlaintext(selected.service.body, input, maxPositionsPerWake);
+      const subscriptionInput = {
         chainId: options.reader.chainId,
         expiresAtBlock: input.expiresAtBlock,
         grant: grantHash,
-        plaintext,
         publisher: options.reader.publisher,
         publisherKey: {
           encryptionKey: HashZod4.parse(selected.key.objectHash),
@@ -1929,7 +1782,8 @@ function createSubscriberHandshakeClient(options) {
         subscriber,
         ...input.subscriptionId === void 0 ? {} : { subscriptionId: input.subscriptionId },
         ...input.supersedes === void 0 ? {} : { supersedes: input.supersedes }
-      });
+      };
+      const subscription = await createEncryptedWakeSubscription({ ...subscriptionInput, plaintext });
       const resolvedIntent = await persistMutationIntent(options.intents, {
         chainId: options.reader.chainId,
         encryptionKey: selected.key.body,
@@ -1953,6 +1807,25 @@ function createSubscriberHandshakeClient(options) {
   };
   return Object.freeze(client);
 }
+function subscriberPlaintext(service, input, maxPositionsPerWake) {
+  const plaintextInput = {
+    audience: input.audience,
+    challengeSecret: input.challengeSecret,
+    deploymentId: input.deploymentId,
+    endpoint: input.endpoint,
+    queueId: input.queueId
+  };
+  const source = input.source;
+  if (!service.events.some((event) => canonicalJson(event.source) === canonicalJson(source))) {
+    throw new Error("Requested source is not advertised by the selected service");
+  }
+  return createWakeSubscriptionPlaintext({
+    ...plaintextInput,
+    source,
+    fromPosition: input.fromPosition,
+    maxPositionsPerWake
+  });
+}
 export {
   EventKitHandshakeClientError,
   HandshakeMutationIntentConflictError,