@t-0/provider-sdk 1.1.27 → 1.1.29

package/README.md

@@ -14,10 +14,7 @@ See [starter README](../starter/README.md) for details on the generated project.
 
 ## Installation
 
-The SDK depends on `@buf/grpc_grpc.bufbuild_es`, which is published on the Buf Schema Registry, not npmjs. Point the `@buf` scope at BSR before installing (the starter template already ships this `.npmrc`):
-
 ```bash
-echo '@buf:registry=https://buf.build/gen/npm/v1/' >> .npmrc
 npm install @t-0/provider-sdk
 ```
 
@@ -67,6 +64,39 @@ server.listen(3000);
 
 The middleware chain: `signatureValidation` captures raw request bytes for hashing, `nodeAdapter` bridges ConnectRPC to Node.js HTTP, and `createService` registers your handlers with signature verification.
 
+### Standalone Signature Verification
+
+For frameworks that don't use Node's `http.createServer` (Effect, Koa, Fastify, etc.), use `createRequestVerifier` to verify inbound requests with just the raw body bytes and headers:
+
+```ts
+import { createRequestVerifier, parsePublicKey } from "@t-0/provider-sdk";
+
+const verify = createRequestVerifier({
+  networkPublicKey: process.env.NETWORK_PUBLIC_KEY!,
+});
+
+// In your framework's request handler:
+function handleRequest(rawBody: Uint8Array, headers: Record<string, string>) {
+  const result = verify({
+    body: rawBody,
+    signatureHeader: headers["x-signature"],
+    publicKeyHeader: headers["x-public-key"],
+    timestampHeader: headers["x-signature-timestamp"],
+  });
+
+  if (!result.valid) {
+    // result.reason is one of: 'invalid_timestamp', 'timestamp_out_of_range',
+    // 'invalid_public_key', 'unknown_public_key', 'invalid_signature_format',
+    // 'signature_failed'
+    return errorResponse(result.reason);
+  }
+
+  // Request is authenticated — parse the protobuf body and handle it
+}
+```
+
+The lower-level primitives are also exported individually: `verifySignature`, `computeDigest`, `keccak256`, `parsePublicKey`, `publicKeysEqual`.
+
 ### Network Client
 
 Use `createClient` to call T-0 Network APIs. The client handles request signing automatically:

package/lib/cjs/crypto/hash.d.ts

@@ -0,0 +1,2 @@
+export declare function keccak256(...inputs: Uint8Array[]): Buffer;
+export declare function computeDigest(body: Uint8Array, timestampMs: number): Buffer;

package/lib/cjs/crypto/hash.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.keccak256 = keccak256;
+exports.computeDigest = computeDigest;
+const sha3_js_1 = require("@noble/hashes/sha3.js");
+function keccak256(...inputs) {
+    const h = sha3_js_1.keccak_256.create();
+    for (const input of inputs) {
+        h.update(input);
+    }
+    return Buffer.from(h.digest());
+}
+function computeDigest(body, timestampMs) {
+    const tsBuf = Buffer.alloc(8);
+    tsBuf.writeBigUInt64LE(BigInt(timestampMs));
+    return keccak256(body, tsBuf);
+}

package/lib/cjs/crypto/index.d.ts

@@ -0,0 +1,5 @@
+export { verifySignature } from './verify.js';
+export { keccak256, computeDigest } from './hash.js';
+export { parsePublicKey, publicKeysEqual } from './keys.js';
+export { createRequestVerifier, DEFAULT_TOLERANCE_MS } from './request.js';
+export type { CreateVerifierOptions, VerifyRequest, VerifyRequestResult, VerifyRequestFailure, RequestVerifier } from './request.js';

package/lib/cjs/crypto/index.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_TOLERANCE_MS = exports.createRequestVerifier = exports.publicKeysEqual = exports.parsePublicKey = exports.computeDigest = exports.keccak256 = exports.verifySignature = void 0;
+var verify_js_1 = require("./verify.js");
+Object.defineProperty(exports, "verifySignature", { enumerable: true, get: function () { return verify_js_1.verifySignature; } });
+var hash_js_1 = require("./hash.js");
+Object.defineProperty(exports, "keccak256", { enumerable: true, get: function () { return hash_js_1.keccak256; } });
+Object.defineProperty(exports, "computeDigest", { enumerable: true, get: function () { return hash_js_1.computeDigest; } });
+var keys_js_1 = require("./keys.js");
+Object.defineProperty(exports, "parsePublicKey", { enumerable: true, get: function () { return keys_js_1.parsePublicKey; } });
+Object.defineProperty(exports, "publicKeysEqual", { enumerable: true, get: function () { return keys_js_1.publicKeysEqual; } });
+var request_js_1 = require("./request.js");
+Object.defineProperty(exports, "createRequestVerifier", { enumerable: true, get: function () { return request_js_1.createRequestVerifier; } });
+Object.defineProperty(exports, "DEFAULT_TOLERANCE_MS", { enumerable: true, get: function () { return request_js_1.DEFAULT_TOLERANCE_MS; } });

package/lib/cjs/crypto/keys.d.ts

@@ -0,0 +1,2 @@
+export declare function parsePublicKey(key: string | Buffer): Buffer;
+export declare function publicKeysEqual(a: Uint8Array, b: Uint8Array): boolean;

package/lib/cjs/crypto/keys.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parsePublicKey = parsePublicKey;
+exports.publicKeysEqual = publicKeysEqual;
+function parsePublicKey(key) {
+    if (typeof key === 'string') {
+        key = Buffer.from(key.startsWith('0x') ? key.slice(2) : key, 'hex');
+    }
+    if (key.length !== 65 || key[0] !== 0x04) {
+        throw new Error('Public key must be 65 bytes in uncompressed format (0x04 prefix)');
+    }
+    return Buffer.from(key);
+}
+function publicKeysEqual(a, b) {
+    if (a.length !== b.length) {
+        return false;
+    }
+    return Buffer.from(a).compare(Buffer.from(b)) === 0;
+}

package/lib/cjs/crypto/request.d.ts

@@ -0,0 +1,20 @@
+export declare const DEFAULT_TOLERANCE_MS = 60000;
+export interface CreateVerifierOptions {
+    networkPublicKey: string | Buffer;
+    toleranceMs?: number;
+}
+export interface VerifyRequest {
+    body: Uint8Array;
+    signatureHeader: string;
+    publicKeyHeader: string;
+    timestampHeader: string;
+}
+export type VerifyRequestFailure = 'invalid_timestamp' | 'timestamp_out_of_range' | 'invalid_public_key' | 'unknown_public_key' | 'invalid_signature_format' | 'signature_failed';
+export type VerifyRequestResult = {
+    valid: true;
+} | {
+    valid: false;
+    reason: VerifyRequestFailure;
+};
+export type RequestVerifier = (req: VerifyRequest) => VerifyRequestResult;
+export declare function createRequestVerifier(opts: CreateVerifierOptions): RequestVerifier;

package/lib/cjs/crypto/request.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_TOLERANCE_MS = void 0;
+exports.createRequestVerifier = createRequestVerifier;
+const verify_js_1 = require("./verify.js");
+const hash_js_1 = require("./hash.js");
+const keys_js_1 = require("./keys.js");
+exports.DEFAULT_TOLERANCE_MS = 60000;
+function createRequestVerifier(opts) {
+    const networkKey = (0, keys_js_1.parsePublicKey)(opts.networkPublicKey);
+    const tolerance = opts.toleranceMs ?? exports.DEFAULT_TOLERANCE_MS;
+    return (req) => {
+        const ts = parseInt(req.timestampHeader, 10);
+        if (!Number.isFinite(ts) || ts < 0) {
+            return { valid: false, reason: 'invalid_timestamp' };
+        }
+        if (Math.abs(Date.now() - ts) > tolerance) {
+            return { valid: false, reason: 'timestamp_out_of_range' };
+        }
+        let publicKey;
+        try {
+            publicKey = (0, keys_js_1.parsePublicKey)(req.publicKeyHeader);
+        }
+        catch {
+            return { valid: false, reason: 'invalid_public_key' };
+        }
+        if (!(0, keys_js_1.publicKeysEqual)(publicKey, networkKey)) {
+            return { valid: false, reason: 'unknown_public_key' };
+        }
+        let signature;
+        try {
+            const hex = req.signatureHeader.startsWith('0x')
+                ? req.signatureHeader.slice(2)
+                : req.signatureHeader;
+            signature = Buffer.from(hex, 'hex');
+        }
+        catch {
+            return { valid: false, reason: 'invalid_signature_format' };
+        }
+        if (signature.length !== 64 && signature.length !== 65) {
+            return { valid: false, reason: 'invalid_signature_format' };
+        }
+        const digest = (0, hash_js_1.computeDigest)(req.body, ts);
+        if (!(0, verify_js_1.verifySignature)(publicKey, digest, signature)) {
+            return { valid: false, reason: 'signature_failed' };
+        }
+        return { valid: true };
+    };
+}

package/lib/cjs/crypto/verify.d.ts

@@ -0,0 +1 @@
+export declare function verifySignature(publicKey: Uint8Array, digest: Uint8Array, signature: Uint8Array): boolean;

package/lib/cjs/crypto/verify.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifySignature = verifySignature;
+const secp256k1_js_1 = require("@noble/curves/secp256k1.js");
+function verifySignature(publicKey, digest, signature) {
+    if (digest.length !== 32) {
+        return false;
+    }
+    if (signature.length !== 64 && signature.length !== 65) {
+        return false;
+    }
+    const sig64 = signature.length === 65 ? signature.subarray(0, 64) : signature;
+    try {
+        return secp256k1_js_1.secp256k1.verify(sig64, digest, publicKey, { prehash: false });
+    }
+    catch {
+        return false;
+    }
+}

package/lib/cjs/index.d.ts

@@ -1,7 +1,10 @@
+export * from "./crypto/index.js";
 export * from "./client/client.js";
 export * from "./service/service.js";
 export * from "./service/validate_response.js";
+export * from "./service/validate.js";
 export * from "./service/node.js";
+export { default as NetworkHeaders } from "./common/headers.js";
 export { connectNodeAdapter as nodeAdapter } from "@connectrpc/connect-node";
 export type { Client, HandlerContext } from "@connectrpc/connect";
 export * from './common/gen/tzero/v1/common/common_pb.js';

package/lib/cjs/index.js

@@ -35,12 +35,19 @@ var __importStar = (this && this.__importStar) || (function () {
         return result;
     };
 })();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PaymentIntentRecipient = exports.PaymentIntentProvider = exports.PaymentIntentBeneficiary = exports.PaymentIntentPayInProvider = exports.PaymentIntentNetwork = exports.nodeAdapter = void 0;
+exports.PaymentIntentRecipient = exports.PaymentIntentProvider = exports.PaymentIntentBeneficiary = exports.PaymentIntentPayInProvider = exports.PaymentIntentNetwork = exports.nodeAdapter = exports.NetworkHeaders = void 0;
+__exportStar(require("./crypto/index.js"), exports);
 __exportStar(require("./client/client.js"), exports);
 __exportStar(require("./service/service.js"), exports);
 __exportStar(require("./service/validate_response.js"), exports);
+__exportStar(require("./service/validate.js"), exports);
 __exportStar(require("./service/node.js"), exports);
+var headers_js_1 = require("./common/headers.js");
+Object.defineProperty(exports, "NetworkHeaders", { enumerable: true, get: function () { return __importDefault(headers_js_1).default; } });
 var connect_node_1 = require("@connectrpc/connect-node");
 Object.defineProperty(exports, "nodeAdapter", { enumerable: true, get: function () { return connect_node_1.connectNodeAdapter; } });
 __exportStar(require("./common/gen/tzero/v1/common/common_pb.js"), exports);

package/lib/cjs/service/health.d.ts

@@ -1,5 +1,5 @@
 import { type ServiceImpl } from "@connectrpc/connect";
-import { Health } from "@buf/grpc_grpc.bufbuild_es/grpc/health/v1/health_pb.js";
+import { Health } from "./health_pb.js";
 /**
  * Headers carrying the identity of the SDK answering the probe. They ride on
  * the health response and nowhere else: `HealthCheckResponse` has a single

package/lib/cjs/service/health.js

@@ -3,7 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.createHealthServiceImpl = exports.SDK_VERSION_HEADER = exports.SDK_ECOSYSTEM_HEADER = void 0;
 const protobuf_1 = require("@bufbuild/protobuf");
 const connect_1 = require("@connectrpc/connect");
-const health_pb_js_1 = require("@buf/grpc_grpc.bufbuild_es/grpc/health/v1/health_pb.js");
+const health_pb_js_1 = require("./health_pb.js");
 const version_js_1 = require("../version.js");
 /**
  * Headers carrying the identity of the SDK answering the probe. They ride on
@@ -33,10 +33,6 @@ const createHealthServiceImpl = (services) => {
         check(req, ctx) {
             ctx.responseHeader.set(exports.SDK_ECOSYSTEM_HEADER, SDK_ECOSYSTEM);
             ctx.responseHeader.set(exports.SDK_VERSION_HEADER, version_js_1.SDK_VERSION);
-            // The schema comes from a published .d.ts, whose type brands do not
-            // survive ServiceImpl's generics — connect-es widens the request to
-            // Message<string>. The descriptor is still the real one at runtime, so
-            // this narrows back to what the wire actually carries.
             const { service } = req;
             // An empty service name asks about the process as a whole, which is up if
             // this handler is running at all.

package/lib/cjs/service/health_pb.d.ts

@@ -0,0 +1,157 @@
+import type { GenEnum, GenFile, GenMessage, GenService } from "@bufbuild/protobuf/codegenv2";
+import type { Message } from "@bufbuild/protobuf";
+/**
+ * Describes the file grpc/health/v1/health.proto.
+ */
+export declare const file_grpc_health_v1_health: GenFile;
+/**
+ * @generated from message grpc.health.v1.HealthCheckRequest
+ */
+export type HealthCheckRequest = Message<"grpc.health.v1.HealthCheckRequest"> & {
+    /**
+     * @generated from field: string service = 1;
+     */
+    service: string;
+};
+/**
+ * Describes the message grpc.health.v1.HealthCheckRequest.
+ * Use `create(HealthCheckRequestSchema)` to create a new message.
+ */
+export declare const HealthCheckRequestSchema: GenMessage<HealthCheckRequest>;
+/**
+ * @generated from message grpc.health.v1.HealthCheckResponse
+ */
+export type HealthCheckResponse = Message<"grpc.health.v1.HealthCheckResponse"> & {
+    /**
+     * @generated from field: grpc.health.v1.HealthCheckResponse.ServingStatus status = 1;
+     */
+    status: HealthCheckResponse_ServingStatus;
+};
+/**
+ * Describes the message grpc.health.v1.HealthCheckResponse.
+ * Use `create(HealthCheckResponseSchema)` to create a new message.
+ */
+export declare const HealthCheckResponseSchema: GenMessage<HealthCheckResponse>;
+/**
+ * @generated from enum grpc.health.v1.HealthCheckResponse.ServingStatus
+ */
+export declare enum HealthCheckResponse_ServingStatus {
+    /**
+     * @generated from enum value: UNKNOWN = 0;
+     */
+    UNKNOWN = 0,
+    /**
+     * @generated from enum value: SERVING = 1;
+     */
+    SERVING = 1,
+    /**
+     * @generated from enum value: NOT_SERVING = 2;
+     */
+    NOT_SERVING = 2,
+    /**
+     * Used only by the Watch method.
+     *
+     * @generated from enum value: SERVICE_UNKNOWN = 3;
+     */
+    SERVICE_UNKNOWN = 3
+}
+/**
+ * Describes the enum grpc.health.v1.HealthCheckResponse.ServingStatus.
+ */
+export declare const HealthCheckResponse_ServingStatusSchema: GenEnum<HealthCheckResponse_ServingStatus>;
+/**
+ * @generated from message grpc.health.v1.HealthListRequest
+ */
+export type HealthListRequest = Message<"grpc.health.v1.HealthListRequest"> & {};
+/**
+ * Describes the message grpc.health.v1.HealthListRequest.
+ * Use `create(HealthListRequestSchema)` to create a new message.
+ */
+export declare const HealthListRequestSchema: GenMessage<HealthListRequest>;
+/**
+ * @generated from message grpc.health.v1.HealthListResponse
+ */
+export type HealthListResponse = Message<"grpc.health.v1.HealthListResponse"> & {
+    /**
+     * statuses contains all the services and their respective status.
+     *
+     * @generated from field: map<string, grpc.health.v1.HealthCheckResponse> statuses = 1;
+     */
+    statuses: {
+        [key: string]: HealthCheckResponse;
+    };
+};
+/**
+ * Describes the message grpc.health.v1.HealthListResponse.
+ * Use `create(HealthListResponseSchema)` to create a new message.
+ */
+export declare const HealthListResponseSchema: GenMessage<HealthListResponse>;
+/**
+ * Health is gRPC's mechanism for checking whether a server is able to handle
+ * RPCs. Its semantics are documented in
+ * https://github.com/grpc/grpc/blob/master/doc/health-checking.md.
+ *
+ * @generated from service grpc.health.v1.Health
+ */
+export declare const Health: GenService<{
+    /**
+     * Check gets the health of the specified service. If the requested service
+     * is unknown, the call will fail with status NOT_FOUND. If the caller does
+     * not specify a service name, the server should respond with its overall
+     * health status.
+     *
+     * Clients should set a deadline when calling Check, and can declare the
+     * server unhealthy if they do not receive a timely response.
+     *
+     * @generated from rpc grpc.health.v1.Health.Check
+     */
+    check: {
+        methodKind: "unary";
+        input: typeof HealthCheckRequestSchema;
+        output: typeof HealthCheckResponseSchema;
+    };
+    /**
+     * List provides a non-atomic snapshot of the health of all the available
+     * services.
+     *
+     * The server may respond with a RESOURCE_EXHAUSTED error if too many services
+     * exist.
+     *
+     * Clients should set a deadline when calling List, and can declare the server
+     * unhealthy if they do not receive a timely response.
+     *
+     * Clients should keep in mind that the list of health services exposed by an
+     * application can change over the lifetime of the process.
+     *
+     * @generated from rpc grpc.health.v1.Health.List
+     */
+    list: {
+        methodKind: "unary";
+        input: typeof HealthListRequestSchema;
+        output: typeof HealthListResponseSchema;
+    };
+    /**
+     * Performs a watch for the serving status of the requested service.
+     * The server will immediately send back a message indicating the current
+     * serving status.  It will then subsequently send a new message whenever
+     * the service's serving status changes.
+     *
+     * If the requested service is unknown when the call is received, the
+     * server will send a message setting the serving status to
+     * SERVICE_UNKNOWN but will *not* terminate the call.  If at some
+     * future point, the serving status of the service becomes known, the
+     * server will send a new message with the service's serving status.
+     *
+     * If the call terminates with status UNIMPLEMENTED, then clients
+     * should assume this method is not supported and should not retry the
+     * call.  If the call terminates with any other status (including OK),
+     * clients should retry the call with appropriate exponential backoff.
+     *
+     * @generated from rpc grpc.health.v1.Health.Watch
+     */
+    watch: {
+        methodKind: "server_streaming";
+        input: typeof HealthCheckRequestSchema;
+        output: typeof HealthCheckResponseSchema;
+    };
+}>;

package/lib/cjs/service/health_pb.js

@@ -0,0 +1,90 @@
+"use strict";
+// Vendored generated stubs for grpc.health.v1 -- do not edit by hand.
+//
+// Source:   buf.build/grpc/grpc, grpc/health/v1/health.proto
+// Plugin:   buf.build/bufbuild/es:v2.12.0 (kept in step with the root
+//           buf.gen.yaml pin -- plugin and @bufbuild/protobuf runtime must
+//           agree on major).
+//
+// Regenerate with the following, which keeps this header and replaces
+// everything from the gRPC copyright line down. Do not just `mv` the generated
+// file over this one -- that would delete these instructions along with it.
+//
+//   cd node/sdk
+//   buf generate buf.build/grpc/grpc --path grpc/health/v1/health.proto \
+//     --template '{"version":"v2","plugins":[{"remote":"buf.build/bufbuild/es:v2.12.0","out":"gen-health","opt":["target=ts","import_extension=js"]}]}'
+//   sed '/^\/\/ Copyright 2015 The gRPC Authors/,$d' src/service/health_pb.ts > gen-health/header
+//   cat gen-health/header gen-health/grpc/health/v1/health_pb.ts > src/service/health_pb.ts
+//   rm -rf gen-health
+//
+// Vendored rather than depended on: the equivalent package
+// `@buf/grpc_grpc.bufbuild_es` is published only on the Buf Schema Registry, and
+// reaching it needs registry config that a published npm package cannot hand its
+// consumers -- so depending on it 404'd every downstream install. Rationale in
+// docs/HEALTH_SERVICE.md.
+//
+// Lives under src/service/ rather than src/common/gen/ so the transport keeps
+// importing nothing from common/gen.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Health = exports.HealthListResponseSchema = exports.HealthListRequestSchema = exports.HealthCheckResponse_ServingStatusSchema = exports.HealthCheckResponse_ServingStatus = exports.HealthCheckResponseSchema = exports.HealthCheckRequestSchema = exports.file_grpc_health_v1_health = void 0;
+const codegenv2_1 = require("@bufbuild/protobuf/codegenv2");
+/**
+ * Describes the file grpc/health/v1/health.proto.
+ */
+exports.file_grpc_health_v1_health = (0, codegenv2_1.fileDesc)("ChtncnBjL2hlYWx0aC92MS9oZWFsdGgucHJvdG8SDmdycGMuaGVhbHRoLnYxIiUKEkhlYWx0aENoZWNrUmVxdWVzdBIPCgdzZXJ2aWNlGAEgASgJIqkBChNIZWFsdGhDaGVja1Jlc3BvbnNlEkEKBnN0YXR1cxgBIAEoDjIxLmdycGMuaGVhbHRoLnYxLkhlYWx0aENoZWNrUmVzcG9uc2UuU2VydmluZ1N0YXR1cyJPCg1TZXJ2aW5nU3RhdHVzEgsKB1VOS05PV04QABILCgdTRVJWSU5HEAESDwoLTk9UX1NFUlZJTkcQAhITCg9TRVJWSUNFX1VOS05PV04QAyITChFIZWFsdGhMaXN0UmVxdWVzdCKuAQoSSGVhbHRoTGlzdFJlc3BvbnNlEkIKCHN0YXR1c2VzGAEgAygLMjAuZ3JwYy5oZWFsdGgudjEuSGVhbHRoTGlzdFJlc3BvbnNlLlN0YXR1c2VzRW50cnkaVAoNU3RhdHVzZXNFbnRyeRILCgNrZXkYASABKAkSMgoFdmFsdWUYAiABKAsyIy5ncnBjLmhlYWx0aC52MS5IZWFsdGhDaGVja1Jlc3BvbnNlOgI4ATL9AQoGSGVhbHRoElAKBUNoZWNrEiIuZ3JwYy5oZWFsdGgudjEuSGVhbHRoQ2hlY2tSZXF1ZXN0GiMuZ3JwYy5oZWFsdGgudjEuSGVhbHRoQ2hlY2tSZXNwb25zZRJNCgRMaXN0EiEuZ3JwYy5oZWFsdGgudjEuSGVhbHRoTGlzdFJlcXVlc3QaIi5ncnBjLmhlYWx0aC52MS5IZWFsdGhMaXN0UmVzcG9uc2USUgoFV2F0Y2gSIi5ncnBjLmhlYWx0aC52MS5IZWFsdGhDaGVja1JlcXVlc3QaIy5ncnBjLmhlYWx0aC52MS5IZWFsdGhDaGVja1Jlc3BvbnNlMAFCcAoRaW8uZ3JwYy5oZWFsdGgudjFCC0hlYWx0aFByb3RvUAFaLGdvb2dsZS5nb2xhbmcub3JnL2dycGMvaGVhbHRoL2dycGNfaGVhbHRoX3YxogIMR3JwY0hlYWx0aFYxqgIOR3JwYy5IZWFsdGguVjFiBnByb3RvMw");
+/**
+ * Describes the message grpc.health.v1.HealthCheckRequest.
+ * Use `create(HealthCheckRequestSchema)` to create a new message.
+ */
+exports.HealthCheckRequestSchema = (0, codegenv2_1.messageDesc)(exports.file_grpc_health_v1_health, 0);
+/**
+ * Describes the message grpc.health.v1.HealthCheckResponse.
+ * Use `create(HealthCheckResponseSchema)` to create a new message.
+ */
+exports.HealthCheckResponseSchema = (0, codegenv2_1.messageDesc)(exports.file_grpc_health_v1_health, 1);
+/**
+ * @generated from enum grpc.health.v1.HealthCheckResponse.ServingStatus
+ */
+var HealthCheckResponse_ServingStatus;
+(function (HealthCheckResponse_ServingStatus) {
+    /**
+     * @generated from enum value: UNKNOWN = 0;
+     */
+    HealthCheckResponse_ServingStatus[HealthCheckResponse_ServingStatus["UNKNOWN"] = 0] = "UNKNOWN";
+    /**
+     * @generated from enum value: SERVING = 1;
+     */
+    HealthCheckResponse_ServingStatus[HealthCheckResponse_ServingStatus["SERVING"] = 1] = "SERVING";
+    /**
+     * @generated from enum value: NOT_SERVING = 2;
+     */
+    HealthCheckResponse_ServingStatus[HealthCheckResponse_ServingStatus["NOT_SERVING"] = 2] = "NOT_SERVING";
+    /**
+     * Used only by the Watch method.
+     *
+     * @generated from enum value: SERVICE_UNKNOWN = 3;
+     */
+    HealthCheckResponse_ServingStatus[HealthCheckResponse_ServingStatus["SERVICE_UNKNOWN"] = 3] = "SERVICE_UNKNOWN";
+})(HealthCheckResponse_ServingStatus || (exports.HealthCheckResponse_ServingStatus = HealthCheckResponse_ServingStatus = {}));
+/**
+ * Describes the enum grpc.health.v1.HealthCheckResponse.ServingStatus.
+ */
+exports.HealthCheckResponse_ServingStatusSchema = (0, codegenv2_1.enumDesc)(exports.file_grpc_health_v1_health, 1, 0);
+/**
+ * Describes the message grpc.health.v1.HealthListRequest.
+ * Use `create(HealthListRequestSchema)` to create a new message.
+ */
+exports.HealthListRequestSchema = (0, codegenv2_1.messageDesc)(exports.file_grpc_health_v1_health, 2);
+/**
+ * Describes the message grpc.health.v1.HealthListResponse.
+ * Use `create(HealthListResponseSchema)` to create a new message.
+ */
+exports.HealthListResponseSchema = (0, codegenv2_1.messageDesc)(exports.file_grpc_health_v1_health, 3);
+/**
+ * Health is gRPC's mechanism for checking whether a server is able to handle
+ * RPCs. Its semantics are documented in
+ * https://github.com/grpc/grpc/blob/master/doc/health-checking.md.
+ *
+ * @generated from service grpc.health.v1.Health
+ */
+exports.Health = (0, codegenv2_1.serviceDesc)(exports.file_grpc_health_v1_health, 0);

package/lib/cjs/service/service.d.ts

@@ -2,11 +2,22 @@ import { ConnectRouter } from "@connectrpc/connect";
 import type { Interceptor } from "@connectrpc/connect";
 import type { DescService } from "@bufbuild/protobuf";
 import type { ServiceImpl } from "@connectrpc/connect";
+import { type Logger } from "./validate_response.js";
+export interface CreateServiceOptions {
+    /**
+     * Logger used by the SDK for error-level events (currently:
+     * response-validation failures from the interceptor safety net). The same
+     * logger will be used for any future server-wide SDK log sites.
+     *
+     * If omitted, the SDK logs to `console.error` with a JSON-encoded payload.
+     */
+    logger?: Logger;
+}
 export declare const REQUEST_VALIDITY_MILLIS = 60000;
 interface Router {
     service: <T extends DescService, I extends ServiceImpl<T>>(service: T, implementation: I) => void;
 }
-export declare const createService: (networkPublicKey: string | Buffer, registerRoutes: (router: Router) => void) => {
+export declare const createService: (networkPublicKey: string | Buffer, registerRoutes: (router: Router) => void, options?: CreateServiceOptions) => {
     routes: (router: ConnectRouter) => void;
     interceptors: Interceptor[];
     grpcWeb: boolean;

package/lib/cjs/service/service.js

@@ -6,9 +6,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.createService = exports.REQUEST_VALIDITY_MILLIS = void 0;
 const connect_1 = require("@connectrpc/connect");
 const headers_js_1 = __importDefault(require("../common/headers.js"));
-const secp256k1_js_1 = require("@noble/curves/secp256k1.js");
+const verify_js_1 = require("../crypto/verify.js");
 const validate_response_js_1 = require("./validate_response.js");
-const health_pb_js_1 = require("@buf/grpc_grpc.bufbuild_es/grpc/health/v1/health_pb.js");
+const health_pb_js_1 = require("./health_pb.js");
 const health_js_1 = require("./health.js");
 exports.REQUEST_VALIDITY_MILLIS = 60000;
 const createSignatureVerification = (networkPublicKey) => (next) => async (req) => {
@@ -20,29 +20,19 @@ const createSignatureVerification = (networkPublicKey) => (next) => async (req)
     if (networkPublicKey.compare(publicKey) !== 0) {
         throw new connect_1.ConnectError(`${headers_js_1.default.PublicKey} value is not network public key`, connect_1.Code.Unauthenticated);
     }
-    let signature = decodeHex(getHeader(req, headers_js_1.default.Signature));
-    if (signature.length === 65) {
-        signature = signature.subarray(0, 64);
-    }
+    const signature = decodeHex(getHeader(req, headers_js_1.default.Signature));
     const hasher = req.contextValues.get(kHash);
     const tsBuf = Buffer.alloc(8);
     tsBuf.writeBigUInt64LE(BigInt(ts)); // 64‑bit little‑endian timestamp
-    const hash = hasher
+    const digest = hasher
         .update(tsBuf)
         .digest();
-    let signatureValid = false;
-    try {
-        signatureValid = secp256k1_js_1.secp256k1.verify(signature, hash, publicKey, { prehash: false });
-    }
-    catch (e) {
-        throw new connect_1.ConnectError(`${headers_js_1.default.Signature} has invalid signature or public key format: ${e}`, connect_1.Code.Unauthenticated);
-    }
-    if (!signatureValid) {
+    if (!(0, verify_js_1.verifySignature)(publicKey, digest, signature)) {
         throw new connect_1.ConnectError(`${headers_js_1.default.Signature} has invalid signature`, connect_1.Code.Unauthenticated);
     }
     return await next(req);
 };
-const createService = (networkPublicKey, registerRoutes) => {
+const createService = (networkPublicKey, registerRoutes, options) => {
     if (typeof networkPublicKey == "string") {
         networkPublicKey = decodeHex(networkPublicKey);
     }
@@ -63,7 +53,7 @@ const createService = (networkPublicKey, registerRoutes) => {
             collected.push(health_pb_js_1.Health.typeName);
             origService(health_pb_js_1.Health, (0, health_js_1.createHealthServiceImpl)(collected));
         },
-        interceptors: [createSignatureVerification(networkPublicKey), (0, validate_response_js_1.createValidationInterceptor)()],
+        interceptors: [createSignatureVerification(networkPublicKey), (0, validate_response_js_1.createValidationInterceptor)(options?.logger)],
         grpcWeb: false,
         contextValues: (req) => {
             return (0, connect_1.createContextValues)().set(kHash, req.hasher);

package/lib/cjs/service/validate.d.ts

@@ -0,0 +1,25 @@
+import type { DescMessage, MessageShape } from "@bufbuild/protobuf";
+/**
+ * Shared protovalidate validator instance for the public {@link validate} helper.
+ * Construction is cheap, but reusing one instance avoids repeated compilation
+ * of the same rules.
+ */
+export declare const validator: import("@bufbuild/protovalidate").Validator;
+/**
+ * Validates a response message against its buf.validate proto annotations.
+ *
+ * On success, returns the message unchanged (typed). On failure, throws a
+ * {@link ConnectError} with {@link Code.Internal} and a message matching the
+ * shape emitted by the SDK's response-validation interceptor — so propagating
+ * the error from a handler produces the same wire response as not calling
+ * `validate` at all.
+ *
+ * Intended use:
+ * ```ts
+ * return validate(PayOutResponseSchema, { result: { case: "accepted", value: {} } });
+ * ```
+ *
+ * Catch the error to convert it into a domain-level failure (e.g. the `Failed`
+ * arm of a `oneof result`) instead of an opaque `Code.Internal`.
+ */
+export declare function validate<Desc extends DescMessage>(schema: Desc, msg: MessageShape<Desc>): MessageShape<Desc>;