@xyo-network/event-kit-protocol 0.1.1 → 0.1.3

package/dist/neutral/index.mjs

@@ -1,12 +1,12 @@
 // src/admissionTypes.ts
 var EVENT_KIT_REPLAY_RETENTION_SKEW_SECONDS = 60;
 
-// src/admitAndEnqueue.ts
-async function admitAndEnqueue(input) {
+// src/admissionCore.ts
+async function admitVerifiedWake(input) {
   const attemptResult = createAttempt(input.verified);
   if (!attemptResult.ok) return attemptResult.failure;
   const { attempt } = attemptResult;
-  const wake = toAdmittedWake(input.verified);
+  const { wake } = input;
   const prior = await resolvePriorAttempt(input.inbox, attempt, wake);
   if (!prior.pending) return prior.result;
   if (!isNonnegativeSafeInteger(input.expectedHead)) {
@@ -90,6 +90,10 @@ async function authorize(input) {
   try {
     decision = await input.grants.authorizePublisher({
       controller: route.controller,
+      authorizationChainId: route.authorizationChainId,
+      sourceHash: route.sourceHash,
+      filterHash: route.filterHash,
+      subscriptionHash: route.subscriptionHash,
       deploymentId: route.deploymentId,
       expectedHead: input.expectedHead,
       publisher: input.verified.publisher,
@@ -137,6 +141,10 @@ function validateGrantEvidence(evidence, verified, atBlock) {
   if (!isRecord(evidence)) return reject("grant-view-invalid", ["enabled grant decision omitted evidence"]);
   const requiredFields = [
     "assertedAtBlock",
+    "authorizationChainId",
+    "filterHash",
+    "sourceHash",
+    "subscriptionHash",
     "controller",
     "deploymentId",
     "id",
@@ -154,6 +162,9 @@ function validateGrantEvidence(evidence, verified, atBlock) {
   if (evidence.controller !== verified.route.controller) {
     return reject("grant-view-invalid", ["grant controller does not match the configured controller"]);
   }
+  if (evidence.authorizationChainId !== verified.route.authorizationChainId || evidence.sourceHash !== verified.route.sourceHash || evidence.filterHash !== verified.route.filterHash || evidence.subscriptionHash !== verified.route.subscriptionHash) {
+    return reject("grant-view-invalid", ["grant authorization chain or source does not match the configured route"]);
+  }
   if (evidence.target !== verified.publisher) {
     return reject("grant-view-invalid", ["grant target does not match the verified publisher"]);
   }
@@ -183,6 +194,11 @@ function validateReceipt(receipt, attempt) {
 function snapshotGrantEvidence(evidence) {
   return Object.freeze({
     assertedAtBlock: evidence.assertedAtBlock,
+    authorizationChainId: evidence.authorizationChainId,
+    sourceHash: evidence.sourceHash,
+    filterHash: evidence.filterHash,
+    subscriptionHash: evidence.subscriptionHash,
+    ...evidence.objectHash === void 0 ? {} : { objectHash: evidence.objectHash },
     controller: evidence.controller,
     deploymentId: evidence.deploymentId,
     id: evidence.id,
@@ -199,20 +215,6 @@ function snapshotReceipt(receipt) {
     wakeId: receipt.wakeId
   });
 }
-function toAdmittedWake(verified) {
-  return Object.freeze({
-    audience: verified.audience,
-    deploymentId: verified.deploymentId,
-    event: verified.event,
-    eventHash: verified.eventHash,
-    fromBlock: verified.fromBlock,
-    jti: verified.jwtId,
-    publisher: verified.publisher,
-    ...verified.queueId === void 0 ? {} : { queueId: verified.queueId },
-    toBlock: verified.toBlock,
-    wakeId: verified.wakeId
-  });
-}
 function success(disposition, receipt, wake) {
   return Object.freeze({
     disposition,
@@ -239,6 +241,60 @@ function errorMessage(error) {
   return error instanceof Error ? error.message : String(error);
 }
 
+// src/types.ts
+import {
+  DeploymentIdZod,
+  HashZod,
+  NonnegativeJsonSafeIntegerZod,
+  NormalizedAddressZod,
+  WakeEnvelopeZod,
+  WakeIdZod,
+  WakeJwtAudienceZod,
+  WakeJwtIdZod
+} from "@xyo-network/event-kit-schemas";
+import { PayloadBuilder } from "@xyo-network/sdk";
+import { z } from "zod";
+var AdmittedWakeZod = z.strictObject({
+  audience: WakeJwtAudienceZod,
+  deploymentId: DeploymentIdZod,
+  event: WakeEnvelopeZod,
+  eventHash: HashZod,
+  fromPosition: NonnegativeJsonSafeIntegerZod,
+  toPosition: NonnegativeJsonSafeIntegerZod,
+  jti: WakeJwtIdZod,
+  publisher: NormalizedAddressZod,
+  queueId: z.string().min(1).max(255).optional(),
+  wakeId: WakeIdZod
+}).refine(
+  (wake) => wake.deploymentId === wake.event.deploymentId && wake.queueId === wake.event.queueId && wake.wakeId === wake.event.wakeId && wake.fromPosition === wake.event.fromPosition && wake.toPosition === wake.event.toPosition,
+  "Persisted admission metadata must exactly match its signed envelope"
+);
+async function parseAdmittedWake(value) {
+  const wake = AdmittedWakeZod.parse(value);
+  if (await PayloadBuilder.dataHash(wake.event) !== wake.eventHash) {
+    throw new TypeError("Persisted wake content does not match its admitted event hash");
+  }
+  return wake;
+}
+
+// src/admitAndEnqueue.ts
+async function admitAndEnqueue(input) {
+  const { verified } = input;
+  const wake = AdmittedWakeZod.parse({
+    audience: verified.audience,
+    deploymentId: verified.deploymentId,
+    event: verified.event,
+    eventHash: verified.eventHash,
+    fromPosition: verified.fromPosition,
+    toPosition: verified.toPosition,
+    jti: verified.jwtId,
+    publisher: verified.publisher,
+    ...verified.queueId === void 0 ? {} : { queueId: verified.queueId },
+    wakeId: verified.wakeId
+  });
+  return await admitVerifiedWake({ ...input, wake });
+}
+
 // src/canonicalJson.ts
 var textEncoder = new TextEncoder();
 function hasUnpairedSurrogate(value) {
@@ -301,7 +357,7 @@ import {
   generateHandshakeId,
   MAX_ENDPOINT_CHALLENGE_LIFETIME_SECONDS
 } from "@xyo-network/event-kit-schemas";
-import { PayloadBuilder } from "@xyo-network/sdk";
+import { PayloadBuilder as PayloadBuilder2 } from "@xyo-network/sdk";
 function hashBytes(hash) {
   return Uint8Array.from({ length: 32 }, (_, index) => Number.parseInt(hash.slice(index * 2, index * 2 + 2), 16));
 }
@@ -328,7 +384,7 @@ function equalProof(left, right) {
 }
 async function endpointChallengeHash(challenge) {
   const parsed = EndpointChallengeZod.parse(challenge);
-  return await PayloadBuilder.dataHash(parsed);
+  return await PayloadBuilder2.dataHash(parsed);
 }
 function createEndpointChallenge(input) {
   const lifetimeSeconds = input.lifetimeSeconds ?? MAX_ENDPOINT_CHALLENGE_LIFETIME_SECONDS;
@@ -341,7 +397,7 @@ function createEndpointChallenge(input) {
   if (input.issuedAt > Number.MAX_SAFE_INTEGER - lifetimeSeconds) {
     throw new RangeError("Challenge expiry exceeds the JSON safe-integer range");
   }
-  return EndpointChallengeZod.parse(new PayloadBuilder({ schema: EndpointChallengeSchema }).fields({
+  return EndpointChallengeZod.parse(new PayloadBuilder2({ schema: EndpointChallengeSchema }).fields({
     challengeId: generateHandshakeId(),
     chainId: input.chainId,
     publisher: input.publisher,
@@ -359,7 +415,7 @@ function createEndpointChallenge(input) {
 }
 async function createEndpointChallengeResponse(challenge, secret) {
   const challengeHash = await endpointChallengeHash(challenge);
-  return EndpointChallengeResponseZod.parse(new PayloadBuilder({ schema: EndpointChallengeResponseSchema }).fields({
+  return EndpointChallengeResponseZod.parse(new PayloadBuilder2({ schema: EndpointChallengeResponseSchema }).fields({
     challenge: challengeHash,
     proof: await hmacProof(secret, challengeHash)
   }).build());
@@ -393,11 +449,9 @@ import {
   ENDPOINT_CHALLENGE_HMAC_SHA256_PROFILE,
   EndpointChallengeResponseZod as EndpointChallengeResponseZod2,
   EndpointChallengeZod as EndpointChallengeZod2,
-  FINALIZED_HEAD_EVENT_KIND,
-  FINALIZED_HEAD_FILTER_PROFILE,
   generateGrantId,
   generateHandshakeId as generateHandshakeId2,
-  HashZod as HashZod2,
+  HashZod as HashZod3,
   MAX_SUBSCRIPTION_PLAINTEXT_BYTES as MAX_SUBSCRIPTION_PLAINTEXT_BYTES2,
   PublisherEncryptionKeyRevocationSchema,
   PublisherEncryptionKeyRevocationZod,
@@ -407,6 +461,8 @@ import {
   PublisherServiceRevocationZod,
   PublisherServiceSchema,
   PublisherServiceZod,
+  SOURCE_WAKE_EVENT_KIND,
+  SOURCE_WAKE_FILTER_PROFILE,
   WAKE_SUBSCRIPTION_HPKE_PROFILE as WAKE_SUBSCRIPTION_HPKE_PROFILE3,
   WAKE_WALLET_JWT_DELIVERY_PROFILE,
   WakeGrantObjectSchema,
@@ -423,7 +479,7 @@ import {
   WakeSubscriptionRevocationSchema,
   WakeSubscriptionRevocationZod
 } from "@xyo-network/event-kit-schemas";
-import { PayloadBuilder as PayloadBuilder2 } from "@xyo-network/sdk";
+import { PayloadBuilder as PayloadBuilder3 } from "@xyo-network/sdk";
 
 // src/wakeSubscriptionHpke.ts
 import {
@@ -438,8 +494,8 @@ import {
   canonicalBase64UrlToBytes as canonicalBase64UrlToBytes2,
   EncryptedWakeSubscriptionZod as EncryptedWakeSubscriptionZod2,
   HandshakeIdZod,
-  HashZod,
-  NormalizedAddressZod as NormalizedAddressZod2,
+  HashZod as HashZod2,
+  NormalizedAddressZod as NormalizedAddressZod3,
   WAKE_SUBSCRIPTION_HPKE_PROFILE as WAKE_SUBSCRIPTION_HPKE_PROFILE2,
   WakeSubscriptionCleartextZod as WakeSubscriptionCleartextZod2
 } from "@xyo-network/event-kit-schemas";
@@ -448,7 +504,7 @@ import {
 import {
   EncryptedWakeSubscriptionZod,
   MAX_SUBSCRIPTION_PLAINTEXT_BYTES,
-  NormalizedAddressZod,
+  NormalizedAddressZod as NormalizedAddressZod2,
   WAKE_SUBSCRIPTION_HPKE_PROFILE,
   WakeSubscriptionCleartextZod,
   WakeSubscriptionPlaintextZod
@@ -465,7 +521,7 @@ function cleartextFromEncrypted(subscription) {
   return cleartext;
 }
 function wakeSubscriptionAadBytes(subscription, subscriber) {
-  const parsedSubscriber = NormalizedAddressZod.parse(subscriber);
+  const parsedSubscriber = NormalizedAddressZod2.parse(subscriber);
   const parsedSubscription = "encryption" in subscription ? cleartextFromEncrypted(EncryptedWakeSubscriptionZod.parse(subscription)) : WakeSubscriptionCleartextZod.parse(subscription);
   return canonicalJsonBytes({
     schema: parsedSubscription.schema,
@@ -528,14 +584,14 @@ var WakeSubscriptionDecryptionError = class extends Error {
 };
 function parsePublicKey(value) {
   return {
-    encryptionKey: HashZod.parse(value.encryptionKey),
+    encryptionKey: HashZod2.parse(value.encryptionKey),
     keyId: HandshakeIdZod.parse(value.keyId),
     publicKey: Base64Url32BytesZod2.parse(value.publicKey)
   };
 }
 function parsePrivateKey(value) {
   return {
-    encryptionKey: HashZod.parse(value.encryptionKey),
+    encryptionKey: HashZod2.parse(value.encryptionKey),
     keyId: HandshakeIdZod.parse(value.keyId),
     privateKey: Base64Url32BytesZod2.parse(value.privateKey)
   };
@@ -559,7 +615,7 @@ async function generateWakeSubscriptionEncryptionKeyPair() {
 }
 async function encryptWakeSubscription(input) {
   const subscription = WakeSubscriptionCleartextZod2.parse(input.subscription);
-  const subscriber = NormalizedAddressZod2.parse(input.subscriber);
+  const subscriber = NormalizedAddressZod3.parse(input.subscriber);
   const publisherKey = parsePublicKey(input.publisherKey);
   if (subscription.encryptionKey !== publisherKey.encryptionKey || subscription.keyId !== publisherKey.keyId) {
     throw new TypeError("Subscription key reference does not match the supplied publisher key");
@@ -582,7 +638,7 @@ async function encryptWakeSubscription(input) {
 async function decryptWakeSubscription(input) {
   try {
     const subscription = EncryptedWakeSubscriptionZod2.parse(input.subscription);
-    const subscriber = NormalizedAddressZod2.parse(input.subscriber);
+    const subscriber = NormalizedAddressZod3.parse(input.subscriber);
     const publisherKey = parsePrivateKey(input.publisherKey);
     if (subscription.encryptionKey !== publisherKey.encryptionKey || subscription.keyId !== publisherKey.keyId) throw new TypeError("Key reference mismatch");
     const recipientKey = await suite.kem.deserializePrivateKey(decoded32(publisherKey.privateKey));
@@ -595,7 +651,8 @@ async function decryptWakeSubscription(input) {
       canonicalBase64UrlToBytes2(subscription.encryption.ciphertext) ?? new Uint8Array(),
       wakeSubscriptionAadBytes(subscription, subscriber)
     );
-    return wakeSubscriptionPlaintextFromBytes(new Uint8Array(plaintext));
+    const parsed = wakeSubscriptionPlaintextFromBytes(new Uint8Array(plaintext));
+    return parsed;
   } catch {
     throw new WakeSubscriptionDecryptionError();
   }
@@ -624,13 +681,13 @@ function parseHandshakePublicObject(value) {
   throw new TypeError("Expected a strict Event Kit handshake public object");
 }
 async function handshakeObjectHash(object) {
-  return HashZod2.parse(await PayloadBuilder2.dataHash(parseHandshakePublicObject(object)));
+  return HashZod3.parse(await PayloadBuilder3.dataHash(parseHandshakePublicObject(object)));
 }
 async function withHandshakeObjectHash(body) {
   return Object.freeze({ body, objectHash: await handshakeObjectHash(body) });
 }
 function createPublisherEncryptionKey(input) {
-  return PublisherEncryptionKeyZod.parse(new PayloadBuilder2({ schema: PublisherEncryptionKeySchema }).fields({
+  return PublisherEncryptionKeyZod.parse(new PayloadBuilder3({ schema: PublisherEncryptionKeySchema }).fields({
     keyId: input.keyId ?? generateHandshakeId2(),
     profile: WAKE_SUBSCRIPTION_HPKE_PROFILE3,
     publicKey: input.publicKey,
@@ -661,20 +718,25 @@ async function generatePublisherEncryptionKey(input) {
   });
 }
 function createPublisherService(input) {
-  return PublisherServiceZod.parse(new PayloadBuilder2({ schema: PublisherServiceSchema }).fields({
+  return PublisherServiceZod.parse(new PayloadBuilder3({ schema: PublisherServiceSchema }).fields({
+    authorizationChainId: input.authorizationChainId,
     serviceId: input.serviceId ?? generateHandshakeId2(),
     revision: input.revision ?? 1,
     ...input.supersedes === void 0 ? {} : { supersedes: input.supersedes },
     validFromBlock: input.validFromBlock,
     ...input.expiresAtBlock === void 0 ? {} : { expiresAtBlock: input.expiresAtBlock },
-    events: [{ kind: FINALIZED_HEAD_EVENT_KIND, filterProfile: FINALIZED_HEAD_FILTER_PROFILE }],
+    events: input.sources.map((source) => ({
+      kind: SOURCE_WAKE_EVENT_KIND,
+      filterProfile: SOURCE_WAKE_FILTER_PROFILE,
+      source
+    })),
     deliveryProfile: WAKE_WALLET_JWT_DELIVERY_PROFILE,
     challengeProfile: ENDPOINT_CHALLENGE_HMAC_SHA256_PROFILE,
     encryptionProfile: WAKE_SUBSCRIPTION_HPKE_PROFILE3,
     encryptionKeys: [...input.encryptionKeys],
     preferredEncryptionKey: input.preferredEncryptionKey,
     limits: {
-      maxBlocksPerWake: input.maxBlocksPerWake,
+      maxPositionsPerWake: input.maxPositionsPerWake,
       maxSubscriptionLifetimeBlocks: input.maxSubscriptionLifetimeBlocks,
       maxPlaintextBytes: MAX_SUBSCRIPTION_PLAINTEXT_BYTES2
     },
@@ -682,7 +744,7 @@ function createPublisherService(input) {
   }).build());
 }
 function createWakeGrant(input) {
-  return WakeGrantObjectZod.parse(new PayloadBuilder2({ schema: WakeGrantObjectSchema }).fields({
+  return WakeGrantObjectZod.parse(new PayloadBuilder3({ schema: WakeGrantObjectSchema }).fields({
     grantId: input.grantId ?? generateGrantId(),
     deploymentId: input.deploymentId,
     publisher: input.publisher,
@@ -696,14 +758,16 @@ function createWakeSubscriptionPlaintext(input) {
     globalThis.crypto.getRandomValues(secretBytes);
   }
   const challengeSecret = input.challengeSecret ?? bytesToCanonicalBase64Url3(secretBytes);
-  return WakeSubscriptionPlaintextZod2.parse(new PayloadBuilder2({ schema: WakeSubscriptionPlaintextSchema }).fields({
+  return WakeSubscriptionPlaintextZod2.parse(new PayloadBuilder3({ schema: WakeSubscriptionPlaintextSchema }).fields({
     endpoint: input.endpoint,
     audience: input.audience,
     deploymentId: input.deploymentId,
     queueId: input.queueId ?? null,
     filter: {
-      schema: FINALIZED_HEAD_FILTER_PROFILE,
-      maxBlocksPerWake: input.maxBlocksPerWake
+      schema: SOURCE_WAKE_FILTER_PROFILE,
+      source: input.source,
+      fromPosition: input.fromPosition,
+      maxPositionsPerWake: input.maxPositionsPerWake
     },
     challenge: {
       profile: ENDPOINT_CHALLENGE_HMAC_SHA256_PROFILE,
@@ -713,7 +777,7 @@ function createWakeSubscriptionPlaintext(input) {
 }
 async function createEncryptedWakeSubscription(input) {
   const cleartext = WakeSubscriptionCleartextZod3.parse(
-    new PayloadBuilder2({ schema: EncryptedWakeSubscriptionSchema }).fields({
+    new PayloadBuilder3({ schema: EncryptedWakeSubscriptionSchema }).fields({
       subscriptionId: input.subscriptionId ?? generateHandshakeId2(),
       revision: input.revision ?? 1,
       ...input.supersedes === void 0 ? {} : { supersedes: input.supersedes },
@@ -723,7 +787,7 @@ async function createEncryptedWakeSubscription(input) {
       encryptionKey: input.publisherKey.encryptionKey,
       keyId: input.publisherKey.keyId,
       grant: input.grant,
-      eventKind: FINALIZED_HEAD_EVENT_KIND,
+      eventKind: SOURCE_WAKE_EVENT_KIND,
       expiresAtBlock: input.expiresAtBlock
     }).build()
   );
@@ -735,7 +799,7 @@ async function createEncryptedWakeSubscription(input) {
   });
 }
 function createWakeSubscriptionAcceptance(input) {
-  return WakeSubscriptionAcceptanceZod.parse(new PayloadBuilder2({ schema: WakeSubscriptionAcceptanceSchema }).fields({
+  return WakeSubscriptionAcceptanceZod.parse(new PayloadBuilder3({ schema: WakeSubscriptionAcceptanceSchema }).fields({
     challenge: input.challenge,
     encryptionKey: input.encryptionKey,
     grant: input.grant,
@@ -745,22 +809,22 @@ function createWakeSubscriptionAcceptance(input) {
   }).build());
 }
 function createPublisherServiceRevocation(service) {
-  return PublisherServiceRevocationZod.parse(new PayloadBuilder2({ schema: PublisherServiceRevocationSchema }).fields({ service }).build());
+  return PublisherServiceRevocationZod.parse(new PayloadBuilder3({ schema: PublisherServiceRevocationSchema }).fields({ service }).build());
 }
 function createPublisherEncryptionKeyRevocation(key) {
   return PublisherEncryptionKeyRevocationZod.parse(
-    new PayloadBuilder2({ schema: PublisherEncryptionKeyRevocationSchema }).fields({ key }).build()
+    new PayloadBuilder3({ schema: PublisherEncryptionKeyRevocationSchema }).fields({ key }).build()
   );
 }
 function createWakeGrantRevocation(grant) {
-  return WakeGrantRevocationZod.parse(new PayloadBuilder2({ schema: WakeGrantRevocationSchema }).fields({ grant }).build());
+  return WakeGrantRevocationZod.parse(new PayloadBuilder3({ schema: WakeGrantRevocationSchema }).fields({ grant }).build());
 }
 function createWakeSubscriptionRevocation(subscription) {
-  return WakeSubscriptionRevocationZod.parse(new PayloadBuilder2({ schema: WakeSubscriptionRevocationSchema }).fields({ subscription }).build());
+  return WakeSubscriptionRevocationZod.parse(new PayloadBuilder3({ schema: WakeSubscriptionRevocationSchema }).fields({ subscription }).build());
 }
 function createWakeSubscriptionAcceptanceRevocation(acceptance) {
   return WakeSubscriptionAcceptanceRevocationZod.parse(
-    new PayloadBuilder2({ schema: WakeSubscriptionAcceptanceRevocationSchema }).fields({ acceptance }).build()
+    new PayloadBuilder3({ schema: WakeSubscriptionAcceptanceRevocationSchema }).fields({ acceptance }).build()
   );
 }
 
@@ -1161,12 +1225,36 @@ import {
   ChainIdZod,
   EncryptedWakeSubscriptionZod as EncryptedWakeSubscriptionZod4,
   EndpointChallengeZod as EndpointChallengeZod3,
-  HashZod as HashZod3,
-  NormalizedAddressZod as NormalizedAddressZod3,
+  HashZod as HashZod4,
+  hasMatchingHandshakeProfile,
+  NormalizedAddressZod as NormalizedAddressZod4,
   PublisherEncryptionKeyZod as PublisherEncryptionKeyZod2,
   PublisherServiceZod as PublisherServiceZod2,
   WakeGrantObjectZod as WakeGrantObjectZod2
 } from "@xyo-network/event-kit-schemas";
+
+// src/sourceWakeIdentity.ts
+import {
+  SourceWakeSubscriptionFilterZod,
+  WakeSourceSchema,
+  WakeSourceZod
+} from "@xyo-network/event-kit-schemas";
+import {
+  asSchema,
+  PayloadBuilder as PayloadBuilder4
+} from "@xyo-network/sdk";
+async function wakeSourceHash(source) {
+  return await PayloadBuilder4.dataHash({ schema: WakeSourceSchema, ...WakeSourceZod.parse(source) });
+}
+function wakeSourcesEqual(left, right) {
+  return canonicalJson(WakeSourceZod.parse(left)) === canonicalJson(WakeSourceZod.parse(right));
+}
+async function sourceWakeFilterHash(filter) {
+  const parsed = SourceWakeSubscriptionFilterZod.parse(filter);
+  return await PayloadBuilder4.dataHash({ ...parsed, schema: asSchema(parsed.schema, true) });
+}
+
+// src/publisherSubscription.ts
 function rejectPublisherSubscription(reason) {
   return Object.freeze({ ok: false, reason });
 }
@@ -1201,12 +1289,12 @@ function parsePublisherSubscriptionCandidate(candidate) {
       chainId: ChainIdZod.parse(candidate.chainId),
       grant: WakeGrantObjectZod2.parse(candidate.grant.body),
       key: PublisherEncryptionKeyZod2.parse(candidate.key.body),
-      publisher: NormalizedAddressZod3.parse(candidate.publisher),
+      publisher: NormalizedAddressZod4.parse(candidate.publisher),
       service: PublisherServiceZod2.parse(candidate.service.body),
-      subscriber: NormalizedAddressZod3.parse(candidate.subscriber),
+      subscriber: NormalizedAddressZod4.parse(candidate.subscriber),
       subscription: EncryptedWakeSubscriptionZod4.parse(candidate.subscription.body),
-      tupleObjectHashes: candidate.tupleObjectHashes.map((hash) => HashZod3.parse(hash)),
-      tupleSubject: NormalizedAddressZod3.parse(candidate.tupleSubject)
+      tupleObjectHashes: candidate.tupleObjectHashes.map((hash) => HashZod4.parse(hash)),
+      tupleSubject: NormalizedAddressZod4.parse(candidate.tupleSubject)
     };
   } catch {
     return void 0;
@@ -1225,6 +1313,7 @@ async function bodyHashesAreValid(candidate, parsed) {
   return canonicalHashes[0] === candidate.service.objectHash && canonicalHashes[1] === candidate.key.objectHash && canonicalHashes[2] === candidate.grant.objectHash && canonicalHashes[3] === candidate.subscription.objectHash;
 }
 function publicBindingFailure(candidate, parsed) {
+  if (!hasMatchingHandshakeProfile(parsed.service, parsed.subscription, parsed.chainId)) return "subscription-binding-invalid";
   if (!hasExactGrantBinding(parsed.grant, parsed.publisher)) return "grant-binding-invalid";
   if (!hasExactSubscriptionBinding(candidate, parsed.subscription)) return "subscription-binding-invalid";
   const hashedKey = { body: parsed.key, objectHash: candidate.key.objectHash };
@@ -1296,7 +1385,7 @@ async function validateAndDecryptPublisherSubscription(candidate) {
   if (!hasExactQueueScope(parsed.grant, decrypted.plaintext)) {
     return rejectPublisherSubscription("grant-scope-invalid");
   }
-  if (decrypted.plaintext.filter.maxBlocksPerWake > parsed.service.limits.maxBlocksPerWake) {
+  if (!filterWithinServicePolicy(parsed.service, decrypted.plaintext)) {
     return rejectPublisherSubscription("service-limit-invalid");
   }
   return validatedPublisherSubscription(candidate, parsed, decrypted.plaintext);
@@ -1311,11 +1400,13 @@ async function challengeRecordMatches(record, challenge, challengeHash, response
   return responseHash === void 0 || record.responseHash === responseHash;
 }
 async function issuePublisherEndpointChallenge(input) {
-  const challenge = createEndpointChallenge({
-    ...input.subscription.context,
+  const context = input.subscription.context;
+  const common = {
+    ...context,
     issuedAt: input.issuedAt,
     ...input.lifetimeSeconds === void 0 ? {} : { lifetimeSeconds: input.lifetimeSeconds }
-  });
+  };
+  const challenge = createEndpointChallenge(common);
   const challengeHash = await endpointChallengeHash(challenge);
   try {
     const result = await input.store.issue({ challenge, challengeHash });
@@ -1337,7 +1428,7 @@ async function beginPublisherEndpointChallengeAttempt(input) {
   if (!isNonnegativeSafeInteger3(input.nowSeconds)) return { kind: "store-invalid" };
   try {
     const result = await input.store.beginAttempt({
-      challengeHash: HashZod3.parse(input.challengeHash),
+      challengeHash: HashZod4.parse(input.challengeHash),
       nowSeconds: input.nowSeconds
     });
     if (!["already-attempted", "expired", "missing", "started", "verified"].includes(result.kind)) {
@@ -1346,7 +1437,7 @@ async function beginPublisherEndpointChallengeAttempt(input) {
     if (result.kind !== "missing" && !await challengeRecordMatches(
       result.record,
       result.record.challenge,
-      HashZod3.parse(input.challengeHash)
+      HashZod4.parse(input.challengeHash)
     )) return { kind: "store-invalid" };
     if ((result.kind === "started" || result.kind === "already-attempted") && result.record.state !== "attempted") return { kind: "store-invalid" };
     if (result.kind === "verified" && result.record.state !== "verified") return { kind: "store-invalid" };
@@ -1424,18 +1515,57 @@ async function completePublisherEndpointChallenge(input) {
     return completeFailure("challenge-store-unavailable");
   }
 }
+function filterWithinServicePolicy(service, plaintext) {
+  const filter = plaintext.filter;
+  return filter.maxPositionsPerWake <= service.limits.maxPositionsPerWake && service.events.some((event) => wakeSourcesEqual(event.source, filter.source));
+}
+
+// src/sourceWakeActivation.ts
+import {
+  ChainIdZod as ChainIdZod2,
+  DeploymentIdZod as DeploymentIdZod2,
+  HashZod as HashZod5,
+  NonnegativeJsonSafeIntegerZod as NonnegativeJsonSafeIntegerZod2,
+  NormalizedAddressZod as NormalizedAddressZod5,
+  PositiveJsonSafeIntegerZod
+} from "@xyo-network/event-kit-schemas";
+import { z as z2 } from "zod";
+var SourceWakeSubscriptionActivationZod = z2.strictObject({
+  atBlock: NonnegativeJsonSafeIntegerZod2,
+  activeFromBlock: NonnegativeJsonSafeIntegerZod2,
+  expiresAtBlock: PositiveJsonSafeIntegerZod,
+  authorizationChainId: ChainIdZod2,
+  controller: NormalizedAddressZod5,
+  publisher: NormalizedAddressZod5,
+  deploymentId: DeploymentIdZod2,
+  queueId: z2.string().min(1).max(255).optional(),
+  sourceHash: HashZod5,
+  filterHash: HashZod5,
+  subscriptionHash: HashZod5,
+  serviceHash: HashZod5,
+  grantHash: HashZod5
+}).refine(
+  (value) => value.activeFromBlock <= value.atBlock && value.atBlock < value.expiresAtBlock,
+  "Subscription must be active at the exact finalized authorization snapshot"
+);
 
 // src/statementGraphWakeGrantAuthorizer.ts
+import {
+  ChainIdZod as ChainIdZod3,
+  WakeSourceZod as WakeSourceZod2
+} from "@xyo-network/event-kit-schemas";
+
+// src/grantEvidence.ts
 import {
   asWakeGrantObject,
   asWakeGrantRevocation,
-  DeploymentIdZod,
-  HashZod as HashZod4,
-  NormalizedAddressZod as NormalizedAddressZod4,
+  DeploymentIdZod as DeploymentIdZod3,
+  HashZod as HashZod6,
+  NormalizedAddressZod as NormalizedAddressZod6,
   WakeGrantObjectSchema as WakeGrantObjectSchema3,
   WakeGrantRevocationSchema as WakeGrantRevocationSchema3
 } from "@xyo-network/event-kit-schemas";
-function createStatementGraphWakeGrantAuthorizer(options) {
+function createDeploymentGrantAuthorizer(options) {
   const { viewer } = options;
   return Object.freeze({
     async authorizePublisher(request) {
@@ -1446,6 +1576,7 @@ function createStatementGraphWakeGrantAuthorizer(options) {
       }
       const claims = await viewer.claims(request.controller, {
         declaredObjectSchemaPrefix: WakeGrantObjectSchema3,
+        ...request.exactGrantHash === void 0 ? {} : { objectHash: request.exactGrantHash },
         subject: request.publisher
       });
       const revokedGrantHashes = await readRevocations(viewer, request.controller, request.publisher, atBlock);
@@ -1497,6 +1628,7 @@ async function readRevocations(viewer, controller, subject, atBlock) {
 async function resolveEvidence(viewer, claim, request, atBlock, revokedGrantHashes) {
   if (!isLiveClaim(claim, request.controller, request.publisher, WakeGrantObjectSchema3, atBlock)) return void 0;
   if (revokedGrantHashes.has(claim.objectHash)) return void 0;
+  if (request.exactGrantHash !== void 0 && claim.objectHash !== request.exactGrantHash) return void 0;
   const object = await viewer.object(claim.objectHash);
   const grant = parseExactGrantObject(object, claim.objectHash);
   if (grant === void 0) return void 0;
@@ -1506,9 +1638,14 @@ async function resolveEvidence(viewer, claim, request, atBlock, revokedGrantHash
   if (!grant.permissions.includes("enqueue")) return void 0;
   return Object.freeze({
     assertedAtBlock: claim.firstBlock,
+    authorizationChainId: request.authorizationChainId,
+    sourceHash: request.sourceHash,
+    filterHash: request.filterHash,
+    subscriptionHash: request.subscriptionHash,
     controller: request.controller,
     deploymentId: grant.deploymentId,
     id: claim.firstEventHash,
+    ...request.exactGrantHash === void 0 ? {} : { objectHash: claim.objectHash },
     ...grant.queueId === void 0 ? {} : { queueId: grant.queueId },
     target: grant.publisher
   });
@@ -1519,8 +1656,8 @@ function isLiveClaim(claim, controller, subject, declaredObjectSchema, atBlock)
   if (claim.declaredObjectSchema !== declaredObjectSchema) return false;
   if (!isNonnegativeSafeInteger4(claim.firstBlock) || claim.firstBlock > atBlock) return false;
   if (!isNonnegativeSafeInteger4(claim.lastBlock) || claim.lastBlock < claim.firstBlock) return false;
-  if (!HashZod4.safeParse(claim.firstEventHash).success) return false;
-  return HashZod4.safeParse(claim.objectHash).success;
+  if (!HashZod6.safeParse(claim.firstEventHash).success) return false;
+  return HashZod6.safeParse(claim.objectHash).success;
 }
 function parseExactGrantObject(object, expectedObjectHash) {
   if (object?.assurance !== "resolved") return void 0;
@@ -1532,13 +1669,16 @@ function parseExactGrantObject(object, expectedObjectHash) {
   });
 }
 function assertValidRequest(request) {
-  if (!NormalizedAddressZod4.safeParse(request.controller).success) {
+  if (request.exactGrantHash !== void 0 && !HashZod6.safeParse(request.exactGrantHash).success) {
+    throw new TypeError("Exact grant hash must be canonical lowercase hexadecimal");
+  }
+  if (!NormalizedAddressZod6.safeParse(request.controller).success) {
     throw new TypeError("Grant controller must be a normalized address");
   }
-  if (!NormalizedAddressZod4.safeParse(request.publisher).success) {
+  if (!NormalizedAddressZod6.safeParse(request.publisher).success) {
     throw new TypeError("Grant publisher must be a normalized address");
   }
-  if (!DeploymentIdZod.safeParse(request.deploymentId).success) {
+  if (!DeploymentIdZod3.safeParse(request.deploymentId).success) {
     throw new TypeError("Grant deploymentId must contain 1 to 255 characters");
   }
   if (request.queueId !== void 0 && (request.queueId.length === 0 || request.queueId.length > 255)) {
@@ -1562,98 +1702,136 @@ function isRecord2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
+// src/statementGraphWakeGrantAuthorizer.ts
+function createStatementGraphWakeGrantAuthorizer(options) {
+  const authorizationChainId = ChainIdZod3.parse(options.authorizationChainId);
+  const source = WakeSourceZod2.parse(options.source);
+  const grants = createDeploymentGrantAuthorizer({ viewer: options.viewer });
+  return Object.freeze({
+    async authorizePublisher(request) {
+      const sourceHash = await wakeSourceHash(source);
+      if (request.authorizationChainId !== authorizationChainId || request.sourceHash !== sourceHash) {
+        throw new TypeError("Grant request does not match the independently pinned authorization chain and source");
+      }
+      const read = await options.activation.read(request);
+      if (read === void 0) return { enabled: false, atBlock: request.expectedHead };
+      const activation = SourceWakeSubscriptionActivationZod.parse(read);
+      if (activation.atBlock !== request.expectedHead || activation.authorizationChainId !== authorizationChainId || activation.sourceHash !== sourceHash || activation.filterHash !== request.filterHash || activation.subscriptionHash !== request.subscriptionHash || activation.controller !== request.controller || activation.publisher !== request.publisher || activation.deploymentId !== request.deploymentId || activation.queueId !== request.queueId) {
+        throw new TypeError("Finalized subscription activation does not match the exact admission binding");
+      }
+      const decision = await grants.authorizePublisher({ ...request, exactGrantHash: activation.grantHash });
+      if (decision.atBlock !== activation.atBlock) {
+        throw new TypeError("Grant and active subscription snapshots do not identify the same finalized authorization head");
+      }
+      return decision.enabled ? Object.freeze({
+        ...decision,
+        grant: Object.freeze({
+          ...decision.grant,
+          authorizationChainId,
+          sourceHash,
+          filterHash: activation.filterHash,
+          subscriptionHash: activation.subscriptionHash
+        })
+      }) : decision;
+    }
+  });
+}
+
 // src/verifyWakeRequest.ts
 import {
-  DeploymentIdZod as DeploymentIdZod2,
-  NormalizedAddressZod as NormalizedAddressZod5,
-  WakeEnvelopeZod,
-  WakeIdRegExp,
-  WakeJwtAudienceZod,
+  ChainIdZod as ChainIdZod4,
+  DeploymentIdZod as DeploymentIdZod4,
+  HashZod as HashZod7,
+  MAX_POSITIONS_PER_SUBSCRIPTION_WAKE,
+  NonnegativeJsonSafeIntegerZod as NonnegativeJsonSafeIntegerZod3,
+  NormalizedAddressZod as NormalizedAddressZod7,
+  PositiveJsonSafeIntegerZod as PositiveJsonSafeIntegerZod2,
+  SOURCE_WAKE_FILTER_PROFILE as SOURCE_WAKE_FILTER_PROFILE2,
+  WakeEnvelopeZod as WakeEnvelopeZod2,
+  WakeJwtAudienceZod as WakeJwtAudienceZod2,
   WakeJwtHeaderZod,
   WakeJwtPayloadZod,
-  WakeJwtSchema
+  WakeJwtSchema,
+  WakeSourceZod as WakeSourceZod3
 } from "@xyo-network/event-kit-schemas";
-import { Account, PayloadBuilder as PayloadBuilder3 } from "@xyo-network/sdk";
+import {
+  Account,
+  PayloadBuilder as PayloadBuilder5
+} from "@xyo-network/sdk";
+import { z as z3 } from "zod";
 var EVENT_KIT_MAX_JWT_LIFETIME_SECONDS = 300;
 var EVENT_KIT_MAX_FUTURE_IAT_SECONDS = 60;
+var WakeAdmissionRouteZod = z3.strictObject({
+  audience: WakeJwtAudienceZod2,
+  authorizationChainId: ChainIdZod4,
+  controller: NormalizedAddressZod7,
+  deploymentId: DeploymentIdZod4,
+  queueId: z3.string().min(1).max(255).optional(),
+  source: WakeSourceZod3,
+  filterHash: HashZod7,
+  subscriptionHash: HashZod7,
+  fromPosition: NonnegativeJsonSafeIntegerZod3,
+  maxPositionsPerWake: PositiveJsonSafeIntegerZod2.max(MAX_POSITIONS_PER_SUBSCRIPTION_WAKE),
+  maxGrantLagBlocks: NonnegativeJsonSafeIntegerZod3
+});
 async function verifyWakeRequest(input) {
-  const { nowSeconds } = input;
-  const route = snapshotRoute(input.route);
-  const configurationFailure = validateConfiguration(route, nowSeconds);
-  if (configurationFailure !== void 0) return configurationFailure;
-  const parsed = WakeEnvelopeZod.safeParse(input.body);
-  if (!parsed.success) {
-    const details = parsed.error.issues.map((issue) => `${issue.path.join(".") || "<root>"}: ${issue.message}`);
-    if (hasInvertedSafeRange(input.body)) return reject2("range-invalid", details);
-    if (isRecord3(input.body) && Object.hasOwn(input.body, "wakeId") && parsed.error.issues.some((issue) => issue.path[0] === "wakeId")) {
-      return reject2("wake-id-invalid", details);
-    }
-    return reject2(
-      "event-malformed",
-      details
-    );
-  }
-  const event = parsed.data;
-  if (!WakeIdRegExp.test(event.wakeId)) return reject2("wake-id-invalid");
-  if (!hasSafeEventNumbers(event)) return reject2("event-malformed", ["wake numeric fields must be nonnegative safe integers"]);
+  const routeResult = WakeAdmissionRouteZod.safeParse(input.route);
+  if (!routeResult.success || !NonnegativeJsonSafeIntegerZod3.safeParse(input.nowSeconds).success) {
+    return { ok: false, reason: "configuration-invalid" };
+  }
+  const eventResult = WakeEnvelopeZod2.safeParse(input.body);
+  if (!eventResult.success) return malformedWake(input.body, eventResult.error.issues);
+  const route = routeResult.data;
+  if (route.filterHash !== await sourceWakeFilterHash({
+    schema: SOURCE_WAKE_FILTER_PROFILE2,
+    source: route.source,
+    fromPosition: route.fromPosition,
+    maxPositionsPerWake: route.maxPositionsPerWake
+  })) return { ok: false, reason: "configuration-invalid" };
+  const event = Object.freeze({ ...eventResult.data, source: Object.freeze(eventResult.data.source) });
+  if (event.authorizationChainId !== route.authorizationChainId) {
+    return { ok: false, reason: "event-authorization-chain-mismatch" };
+  }
+  if (!wakeSourcesEqual(event.source, route.source)) return { ok: false, reason: "event-source-mismatch" };
+  if (event.filterHash !== route.filterHash) return { ok: false, reason: "event-filter-mismatch" };
   if (event.deploymentId !== route.deploymentId || event.queueId !== route.queueId) {
-    return reject2("event-target-mismatch");
+    return { ok: false, reason: "event-target-mismatch" };
   }
-  if (event.fromBlock > event.toBlock) return reject2("range-invalid");
-  if (event.toBlock - event.fromBlock >= route.maxBlocksPerWake) {
-    return reject2("range-too-large", [`maxBlocksPerWake=${route.maxBlocksPerWake}`]);
-  }
-  const jwtResult = await verifyJwtProfile(input.jwt, route.audience, nowSeconds);
-  if (!jwtResult.ok) return jwtResult;
+  if (event.fromPosition < route.fromPosition) return { ok: false, reason: "range-before-floor" };
+  if (event.toPosition - event.fromPosition >= route.maxPositionsPerWake) return { ok: false, reason: "range-too-large" };
+  const jwt = await verifyJwtProfile(input.jwt, route.audience, input.nowSeconds);
+  if (!jwt.ok) return jwt;
   let eventHash;
   try {
-    eventHash = await PayloadBuilder3.dataHash(event);
-  } catch (error) {
-    return reject2("event-hash-failed", [errorMessage2(error)]);
-  }
-  if (eventHash !== jwtResult.jwt.eventHash) return reject2("event-hash-mismatch");
-  const frozenEvent = Object.freeze({ ...event });
-  const verified = Object.freeze({
-    audience: route.audience,
-    deploymentId: event.deploymentId,
-    event: frozenEvent,
-    eventHash,
-    expiresAt: jwtResult.jwt.expiresAt,
-    fromBlock: event.fromBlock,
-    issuedAt: event.issuedAt,
-    jwtId: jwtResult.jwt.jwtId,
-    publisher: jwtResult.jwt.publisher,
-    ...event.queueId === void 0 ? {} : { queueId: event.queueId },
-    route,
-    toBlock: event.toBlock,
-    tokenIssuedAt: jwtResult.jwt.issuedAt,
-    wakeId: event.wakeId
-  });
-  return Object.freeze({ ok: true, verified });
-}
-function validateConfiguration(route, nowSeconds) {
-  if (!WakeJwtAudienceZod.safeParse(route.audience).success) {
-    return reject2("configuration-invalid", ["audience must not be empty"]);
-  }
-  if (!DeploymentIdZod2.safeParse(route.deploymentId).success) {
-    return reject2("configuration-invalid", ["deploymentId must contain 1 to 255 characters"]);
-  }
-  if (route.queueId !== void 0 && (route.queueId.length === 0 || route.queueId.length > 255)) {
-    return reject2("configuration-invalid", ["queueId must contain 1 to 255 characters when configured"]);
-  }
-  if (!NormalizedAddressZod5.safeParse(route.controller).success) {
-    return reject2("configuration-invalid", ["controller must be a normalized 40-character lowercase-hex address"]);
-  }
-  if (!isNonnegativeSafeInteger5(nowSeconds)) {
-    return reject2("configuration-invalid", ["nowSeconds must be a nonnegative safe integer"]);
-  }
-  if (!Number.isSafeInteger(route.maxBlocksPerWake) || route.maxBlocksPerWake < 1) {
-    return reject2("configuration-invalid", ["maxBlocksPerWake must be a positive safe integer"]);
-  }
-  if (!isNonnegativeSafeInteger5(route.maxGrantLagBlocks)) {
-    return reject2("configuration-invalid", ["maxGrantLagBlocks must be a nonnegative safe integer"]);
+    eventHash = await PayloadBuilder5.dataHash(event);
+  } catch {
+    return { ok: false, reason: "event-hash-failed" };
   }
-  return void 0;
+  if (eventHash !== jwt.jwt.eventHash) return { ok: false, reason: "event-hash-mismatch" };
+  const sourceHash = await wakeSourceHash(route.source);
+  return Object.freeze({
+    ok: true,
+    verified: Object.freeze({
+      audience: route.audience,
+      deploymentId: event.deploymentId,
+      event,
+      eventHash,
+      expiresAt: jwt.jwt.expiresAt,
+      fromPosition: event.fromPosition,
+      issuedAt: event.issuedAt,
+      jwtId: jwt.jwt.jwtId,
+      publisher: jwt.jwt.publisher,
+      ...event.queueId === void 0 ? {} : { queueId: event.queueId },
+      route: Object.freeze({
+        ...route,
+        source: Object.freeze(route.source),
+        sourceHash
+      }),
+      toPosition: event.toPosition,
+      tokenIssuedAt: jwt.jwt.issuedAt,
+      wakeId: event.wakeId
+    })
+  });
 }
 async function verifyJwtProfile(token, audience, nowSeconds) {
   let verified;
@@ -1685,11 +1863,11 @@ async function verifyJwtProfile(token, audience, nowSeconds) {
 function parseStrictJwtWire(header, payload, audience) {
   const headerResult = WakeJwtHeaderZod.safeParse(header);
   if (!headerResult.success) {
-    if (!NormalizedAddressZod5.safeParse(header.kid).success) return reject2("jwt-identity-invalid");
+    if (!NormalizedAddressZod7.safeParse(header.kid).success) return reject2("jwt-identity-invalid");
     return reject2("jwt-header-invalid", zodDetails(headerResult.error.issues));
   }
   if (Object.hasOwn(payload, "nbf")) return reject2("jwt-nbf-not-allowed");
-  if (!NormalizedAddressZod5.safeParse(payload.iss).success) return reject2("jwt-identity-invalid");
+  if (!NormalizedAddressZod7.safeParse(payload.iss).success) return reject2("jwt-identity-invalid");
   if (payload.schema !== WakeJwtSchema) return reject2("jwt-schema-mismatch");
   if (payload.aud !== audience) return reject2("jwt-audience-mismatch");
   if (!isNonnegativeSafeInteger5(payload.iat) || !isNonnegativeSafeInteger5(payload.exp) || payload.exp <= payload.iat) {
@@ -1714,13 +1892,16 @@ function classifySdkJwtFailure(reasons) {
   }
   return "jwt-invalid";
 }
-function hasSafeEventNumbers(event) {
-  return isNonnegativeSafeInteger5(event.fromBlock) && isNonnegativeSafeInteger5(event.toBlock) && isNonnegativeSafeInteger5(event.issuedAt);
+function malformedWake(body, issues) {
+  const details = zodDetails(issues);
+  if (hasInvertedSafeRange(body)) return reject2("range-invalid", details);
+  if (isRecord3(body) && Object.hasOwn(body, "wakeId") && issues.some((issue) => issue.path[0] === "wakeId")) return reject2("wake-id-invalid", details);
+  return reject2("event-malformed", details);
 }
 function hasInvertedSafeRange(value) {
   if (!isRecord3(value)) return false;
-  const { fromBlock, toBlock } = value;
-  return typeof fromBlock === "number" && typeof toBlock === "number" && isNonnegativeSafeInteger5(fromBlock) && isNonnegativeSafeInteger5(toBlock) && fromBlock > toBlock;
+  const { fromPosition, toPosition } = value;
+  return typeof fromPosition === "number" && typeof toPosition === "number" && isNonnegativeSafeInteger5(fromPosition) && isNonnegativeSafeInteger5(toPosition) && fromPosition > toPosition;
 }
 function isNonnegativeSafeInteger5(value) {
   return Number.isSafeInteger(value) && value >= 0;
@@ -1728,16 +1909,6 @@ function isNonnegativeSafeInteger5(value) {
 function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function snapshotRoute(route) {
-  return Object.freeze({
-    audience: route.audience,
-    controller: route.controller,
-    deploymentId: route.deploymentId,
-    maxBlocksPerWake: route.maxBlocksPerWake,
-    maxGrantLagBlocks: route.maxGrantLagBlocks,
-    ...route.queueId === void 0 ? {} : { queueId: route.queueId }
-  });
-}
 function zodDetails(issues) {
   return issues.map((issue) => {
     const path = issue.path.map(String).join(".") || "<root>";
@@ -1773,9 +1944,12 @@ async function drainQueue(queue, handler) {
   }
 }
 export {
+  AdmittedWakeZod,
   EVENT_KIT_MAX_FUTURE_IAT_SECONDS,
   EVENT_KIT_MAX_JWT_LIFETIME_SECONDS,
   EVENT_KIT_REPLAY_RETENTION_SKEW_SECONDS,
+  SourceWakeSubscriptionActivationZod,
+  WakeAdmissionRouteZod,
   WakeSubscriptionDecryptionError,
   admitAndEnqueue,
   beginPublisherEndpointChallengeAttempt,
@@ -1808,12 +1982,16 @@ export {
   generateWakeSubscriptionEncryptionKeyPair,
   handshakeObjectHash,
   issuePublisherEndpointChallenge,
+  parseAdmittedWake,
   resolvePreferredEncryptionKey,
   selectPublisherService,
   selectSubscriptionActivation,
+  sourceWakeFilterHash,
   validateAndDecryptPublisherSubscription,
   verifyEndpointChallengeResponse,
   verifyWakeRequest,
+  wakeSourceHash,
+  wakeSourcesEqual,
   wakeSubscriptionAadBytes,
   wakeSubscriptionPlaintextBytes,
   wakeSubscriptionPlaintextFromBytes,