@t-0/provider-sdk 1.1.29 → 1.1.30

package/README.md

@@ -1,6 +1,6 @@
 # T-0 Provider SDK -- TypeScript
 
-TypeScript SDK for building provider integrations with the T-0 Network. Handles secp256k1 cryptographic signing, signature verification, and provides typed ConnectRPC clients for all T-0 Network APIs.
+TypeScript SDK for building provider integrations with the T-0 Network. All communication is Protobuf-encoded and secp256k1-signed. Provides signature verification for inbound requests and typed clients for all T-0 Network APIs.
 
 ## Quick Start
 
@@ -62,14 +62,15 @@ const server = http.createServer(
 server.listen(3000);
 ```
 
-The middleware chain: `signatureValidation` captures raw request bytes for hashing, `nodeAdapter` bridges ConnectRPC to Node.js HTTP, and `createService` registers your handlers with signature verification.
+The middleware chain: `signatureValidation` captures raw request bytes for hashing, `nodeAdapter` bridges the RPC transport to Node.js HTTP, and `createService` registers your handlers with signature verification.
 
 ### Standalone Signature Verification
 
 For frameworks that don't use Node's `http.createServer` (Effect, Koa, Fastify, etc.), use `createRequestVerifier` to verify inbound requests with just the raw body bytes and headers:
 
 ```ts
-import { createRequestVerifier, parsePublicKey } from "@t-0/provider-sdk";
+import { fromBinary, toBinary } from "@bufbuild/protobuf";
+import { createRequestVerifier, PayoutRequestSchema, PayoutResponseSchema } from "@t-0/provider-sdk";
 
 const verify = createRequestVerifier({
   networkPublicKey: process.env.NETWORK_PUBLIC_KEY!,
@@ -91,11 +92,27 @@ function handleRequest(rawBody: Uint8Array, headers: Record<string, string>) {
     return errorResponse(result.reason);
   }
 
-  // Request is authenticated — parse the protobuf body and handle it
+  // Deserialize the Protobuf request (same raw bytes you verified)
+  const request = fromBinary(PayoutRequestSchema, rawBody);
+  const response = handlePayout(request);
+
+  // Serialize the Protobuf response
+  return successResponse(toBinary(PayoutResponseSchema, response), {
+    "content-type": "application/proto",
+  });
 }
 ```
 
-The lower-level primitives are also exported individually: `verifySignature`, `computeDigest`, `keccak256`, `parsePublicKey`, `publicKeysEqual`.
+The lower-level primitives are also exported individually: `verifySignature`, `computeDigest`, `keccak256`, `parsePublicKey`, `publicKeysEqual`. You can also import just the crypto module via the `./crypto` subpath: `import { createRequestVerifier } from "@t-0/provider-sdk/crypto"`.
+
+**Important constraints for standalone integrations:**
+
+- **Raw body bytes only.** Pass the exact wire bytes to the verifier — no body parsers, no auto-decompression, never re-serialized protobuf. Protobuf encoding is not canonical; re-encoding produces different bytes and breaks verification.
+- **Pass `Uint8Array`, not `ArrayBuffer`.** If your framework gives you an `ArrayBuffer` (e.g. `request.arrayBuffer()`), wrap it: `new Uint8Array(buf)`.
+- **Header case.** `NetworkHeaders` enum values are title-case (`X-Signature`), but Node lowercases incoming headers. Look up headers by lowercase name: `headers["x-signature"]`.
+- **Wire format is binary protobuf.** Requests and successful responses use `Content-Type: application/proto`. Deserialize with `fromBinary()`, serialize with `toBinary()` from `@bufbuild/protobuf`. For errors, return a bare HTTP status code with no body (`401` for auth failures, `403` for permission errors). Success responses **must** include `Content-Type: application/proto`.
+- **Health endpoint.** The T-0 Network probes `/grpc.health.v1.Health/Check` on every endpoint. The probe is signed. Standalone integrations must route this path and return a valid health response. See [`docs/HEALTH_SERVICE.md`](../../docs/HEALTH_SERVICE.md) for the wire contract.
+- **`VerifyRequestFailure` is an open union.** New reason values may be added without a major version bump. Handle unknown reasons as generic failures.
 
 ### Network Client
 

package/lib/cjs/client/client.d.ts

@@ -1,16 +1,6 @@
-import { DescService } from "@bufbuild/protobuf";
+import { type Signature } from "../common/client/client.js";
+import type { DescService } from "@bufbuild/protobuf";
 export declare const DEFAULT_ENDPOINT = "https://api.t-0.network";
-export declare function createClient<T extends DescService>(signer: string | Buffer | ((data: Buffer) => Promise<Signature>) | Buffer<ArrayBufferLike>, endpoint: string | undefined, svc: T): import("@connectrpc/connect").Client<T>;
-/**
- * Signature with metadata for particular request
- */
-export interface Signature {
-    signature: Buffer;
-    publicKey: Buffer;
-}
-/**
- * Signature function for signing requests to T-0 API. Accepts any data in string format and return signature
- * with metadata
- */
-export type SignerFunction = (data: Buffer) => Promise<Signature>;
+export declare function createClient<T extends DescService>(signer: string | Buffer | ((data: Buffer) => Promise<Signature>) | Buffer<ArrayBufferLike>, endpoint: string | undefined, svc: T): import("../index.js").Client<T>;
+export type { Signature, SignerFunction } from "../common/client/client.js";
 export default createClient;

package/lib/cjs/client/client.js

@@ -1,46 +1,10 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DEFAULT_ENDPOINT = void 0;
 exports.createClient = createClient;
-const connect_1 = require("@connectrpc/connect");
-const connect_web_1 = require("@connectrpc/connect-web");
-const sha3_js_1 = require("@noble/hashes/sha3.js");
-const signer_js_1 = __importDefault(require("./signer.js"));
-const headers_js_1 = __importDefault(require("../common/headers.js"));
+const client_js_1 = require("../common/client/client.js");
 exports.DEFAULT_ENDPOINT = "https://api.t-0.network";
 function createClient(signer, endpoint, svc) {
-    let customFetch;
-    endpoint = endpoint || exports.DEFAULT_ENDPOINT;
-    if (typeof signer === "string" || Buffer.isBuffer(signer)) {
-        signer = (0, signer_js_1.default)(signer);
-    }
-    customFetch = async (r, init) => {
-        if (!init?.body || !((init.body) instanceof Uint8Array)) {
-            throw "unsupported body type";
-        }
-        const ts = Date.now();
-        // 64‑bit little‑endian timestamp
-        const tsBuf = Buffer.alloc(8);
-        tsBuf.writeBigUInt64LE(BigInt(ts));
-        const hash = sha3_js_1.keccak_256.create()
-            .update(init.body)
-            .update(tsBuf);
-        const hashHex = Buffer.from(hash.digest());
-        const sig = await signer(hashHex);
-        const headers = new Headers(init?.headers);
-        headers.append(headers_js_1.default.Signature, "0x" + sig.signature.toString('hex'));
-        headers.append(headers_js_1.default.PublicKey, "0x" + sig.publicKey.toString('hex'));
-        headers.append(headers_js_1.default.SignatureTimestamp, ts.toString());
-        const modifiedInit = { ...init, headers };
-        return fetch(r, modifiedInit);
-    };
-    const transport = (0, connect_web_1.createConnectTransport)({
-        baseUrl: endpoint || exports.DEFAULT_ENDPOINT,
-        fetch: customFetch,
-    });
-    return (0, connect_1.createClient)(svc, transport);
+    return (0, client_js_1.createClient)(signer, endpoint || exports.DEFAULT_ENDPOINT, svc);
 }
 exports.default = createClient;

package/lib/cjs/client/signer.d.ts

@@ -1,3 +1 @@
-import { Signature } from "./client.js";
-export declare const CreateSigner: (privateKey: string | Buffer) => (data: Buffer) => Promise<Signature>;
-export default CreateSigner;
+export { CreateSigner, default } from "../common/client/signer.js";

package/lib/cjs/client/signer.js

@@ -1,36 +1,9 @@
 "use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.CreateSigner = void 0;
-const secp256k1_js_1 = require("@noble/curves/secp256k1.js");
-const CreateSigner = (privateKey) => {
-    privateKey = parsePrivateKey(privateKey);
-    const publicKey = Buffer.from(secp256k1_js_1.secp256k1.getPublicKey(privateKey, false));
-    return async (data) => {
-        // Ensure hash is 32 bytes
-        if (data.length !== 32) {
-            throw new Error('Message hash must be 32 bytes');
-        }
-        // Sign the hash
-        const signature = secp256k1_js_1.secp256k1.sign(data, privateKey, { prehash: false });
-        return {
-            signature: Buffer.from(signature),
-            publicKey: publicKey,
-        };
-    };
-};
-exports.CreateSigner = CreateSigner;
-const parsePrivateKey = (privateKey) => {
-    if (typeof privateKey == 'string') {
-        privateKey = privateKey.replace(/^0x/, '');
-        if (!/^[0-9a-fA-F]{64}$/.test(privateKey)) {
-            throw new Error('Private key must be 64 hex characters');
-        }
-        privateKey = Buffer.from(privateKey, 'hex');
-    }
-    // Validate private key
-    if (!secp256k1_js_1.secp256k1.utils.isValidSecretKey(privateKey)) {
-        throw new Error('Invalid private key');
-    }
-    return privateKey;
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
 };
-exports.default = exports.CreateSigner;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.default = exports.CreateSigner = void 0;
+var signer_js_1 = require("../common/client/signer.js");
+Object.defineProperty(exports, "CreateSigner", { enumerable: true, get: function () { return signer_js_1.CreateSigner; } });
+Object.defineProperty(exports, "default", { enumerable: true, get: function () { return __importDefault(signer_js_1).default; } });

package/lib/cjs/common/client/client.d.ts

@@ -0,0 +1,14 @@
+import { DescService } from "@bufbuild/protobuf";
+export declare function createClient<T extends DescService>(signer: string | Buffer | ((data: Buffer) => Promise<Signature>) | Buffer<ArrayBufferLike>, endpoint: string, svc: T): import("@connectrpc/connect").Client<T>;
+/**
+ * Signature with metadata for particular request
+ */
+export interface Signature {
+    signature: Buffer;
+    publicKey: Buffer;
+}
+/**
+ * Signature function for signing requests to T-0 API. Accepts any data in string format and return signature
+ * with metadata
+ */
+export type SignerFunction = (data: Buffer) => Promise<Signature>;

package/lib/cjs/common/client/client.js

@@ -0,0 +1,42 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createClient = createClient;
+const connect_1 = require("@connectrpc/connect");
+const connect_web_1 = require("@connectrpc/connect-web");
+const sha3_js_1 = require("@noble/hashes/sha3.js");
+const signer_js_1 = __importDefault(require("./signer.js"));
+const headers_js_1 = __importDefault(require("../headers.js"));
+function createClient(signer, endpoint, svc) {
+    let customFetch;
+    if (typeof signer === "string" || Buffer.isBuffer(signer)) {
+        signer = (0, signer_js_1.default)(signer);
+    }
+    customFetch = async (r, init) => {
+        if (!init?.body || !((init.body) instanceof Uint8Array)) {
+            throw "unsupported body type";
+        }
+        const ts = Date.now();
+        // 64‑bit little‑endian timestamp
+        const tsBuf = Buffer.alloc(8);
+        tsBuf.writeBigUInt64LE(BigInt(ts));
+        const hash = sha3_js_1.keccak_256.create()
+            .update(init.body)
+            .update(tsBuf);
+        const hashHex = Buffer.from(hash.digest());
+        const sig = await signer(hashHex);
+        const headers = new Headers(init?.headers);
+        headers.append(headers_js_1.default.Signature, "0x" + sig.signature.toString('hex'));
+        headers.append(headers_js_1.default.PublicKey, "0x" + sig.publicKey.toString('hex'));
+        headers.append(headers_js_1.default.SignatureTimestamp, ts.toString());
+        const modifiedInit = { ...init, headers };
+        return fetch(r, modifiedInit);
+    };
+    const transport = (0, connect_web_1.createConnectTransport)({
+        baseUrl: endpoint,
+        fetch: customFetch,
+    });
+    return (0, connect_1.createClient)(svc, transport);
+}

package/lib/cjs/common/client/signer.d.ts

@@ -0,0 +1,3 @@
+import type { Signature } from "./client.js";
+export declare const CreateSigner: (privateKey: string | Buffer) => (data: Buffer) => Promise<Signature>;
+export default CreateSigner;

package/lib/cjs/common/client/signer.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CreateSigner = void 0;
+const secp256k1_js_1 = require("@noble/curves/secp256k1.js");
+const CreateSigner = (privateKey) => {
+    privateKey = parsePrivateKey(privateKey);
+    const publicKey = Buffer.from(secp256k1_js_1.secp256k1.getPublicKey(privateKey, false));
+    return async (data) => {
+        // Ensure hash is 32 bytes
+        if (data.length !== 32) {
+            throw new Error('Message hash must be 32 bytes');
+        }
+        // Sign the hash
+        const signature = secp256k1_js_1.secp256k1.sign(data, privateKey, { prehash: false });
+        return {
+            signature: Buffer.from(signature),
+            publicKey: publicKey,
+        };
+    };
+};
+exports.CreateSigner = CreateSigner;
+const parsePrivateKey = (privateKey) => {
+    if (typeof privateKey == 'string') {
+        privateKey = privateKey.replace(/^0x/, '');
+        if (!/^[0-9a-fA-F]{64}$/.test(privateKey)) {
+            throw new Error('Private key must be 64 hex characters');
+        }
+        privateKey = Buffer.from(privateKey, 'hex');
+    }
+    // Validate private key
+    if (!secp256k1_js_1.secp256k1.utils.isValidSecretKey(privateKey)) {
+        throw new Error('Invalid private key');
+    }
+    return privateKey;
+};
+exports.default = exports.CreateSigner;

package/lib/cjs/common/crypto/hash.d.ts

@@ -0,0 +1,2 @@
+export declare function keccak256(...inputs: Uint8Array[]): Buffer;
+export declare function computeDigest(body: Uint8Array, timestampMs: number): Buffer;

package/lib/cjs/common/crypto/hash.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.keccak256 = keccak256;
+exports.computeDigest = computeDigest;
+const sha3_js_1 = require("@noble/hashes/sha3.js");
+function keccak256(...inputs) {
+    const h = sha3_js_1.keccak_256.create();
+    for (const input of inputs) {
+        h.update(input);
+    }
+    return Buffer.from(h.digest());
+}
+function computeDigest(body, timestampMs) {
+    const tsBuf = Buffer.alloc(8);
+    tsBuf.writeBigUInt64LE(BigInt(timestampMs));
+    return keccak256(body, tsBuf);
+}

package/lib/cjs/common/crypto/index.d.ts

@@ -0,0 +1,5 @@
+export { verifySignature } from './verify.js';
+export { keccak256, computeDigest } from './hash.js';
+export { parsePublicKey, publicKeysEqual } from './keys.js';
+export { createRequestVerifier, DEFAULT_TOLERANCE_MS } from './request.js';
+export type { CreateVerifierOptions, VerifyRequest, VerifyRequestResult, VerifyRequestFailure, RequestVerifier } from './request.js';

package/lib/cjs/common/crypto/index.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_TOLERANCE_MS = exports.createRequestVerifier = exports.publicKeysEqual = exports.parsePublicKey = exports.computeDigest = exports.keccak256 = exports.verifySignature = void 0;
+var verify_js_1 = require("./verify.js");
+Object.defineProperty(exports, "verifySignature", { enumerable: true, get: function () { return verify_js_1.verifySignature; } });
+var hash_js_1 = require("./hash.js");
+Object.defineProperty(exports, "keccak256", { enumerable: true, get: function () { return hash_js_1.keccak256; } });
+Object.defineProperty(exports, "computeDigest", { enumerable: true, get: function () { return hash_js_1.computeDigest; } });
+var keys_js_1 = require("./keys.js");
+Object.defineProperty(exports, "parsePublicKey", { enumerable: true, get: function () { return keys_js_1.parsePublicKey; } });
+Object.defineProperty(exports, "publicKeysEqual", { enumerable: true, get: function () { return keys_js_1.publicKeysEqual; } });
+var request_js_1 = require("./request.js");
+Object.defineProperty(exports, "createRequestVerifier", { enumerable: true, get: function () { return request_js_1.createRequestVerifier; } });
+Object.defineProperty(exports, "DEFAULT_TOLERANCE_MS", { enumerable: true, get: function () { return request_js_1.DEFAULT_TOLERANCE_MS; } });

package/lib/cjs/common/crypto/keys.d.ts

@@ -0,0 +1,2 @@
+export declare function parsePublicKey(key: string | Buffer): Buffer;
+export declare function publicKeysEqual(a: Uint8Array, b: Uint8Array): boolean;

package/lib/cjs/common/crypto/keys.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parsePublicKey = parsePublicKey;
+exports.publicKeysEqual = publicKeysEqual;
+function parsePublicKey(key) {
+    if (typeof key === 'string') {
+        const hex = key.startsWith('0x') ? key.slice(2) : key;
+        if (!/^[0-9a-fA-F]*$/.test(hex) || hex.length % 2 !== 0) {
+            throw new Error('Public key contains invalid hex characters');
+        }
+        key = Buffer.from(hex, 'hex');
+    }
+    if (key.length !== 65 || key[0] !== 0x04) {
+        throw new Error('Public key must be 65 bytes in uncompressed format (0x04 prefix)');
+    }
+    return Buffer.from(key);
+}
+function publicKeysEqual(a, b) {
+    if (a.length !== b.length) {
+        return false;
+    }
+    return Buffer.from(a).compare(Buffer.from(b)) === 0;
+}

package/lib/cjs/common/crypto/request.d.ts

@@ -0,0 +1,20 @@
+export declare const DEFAULT_TOLERANCE_MS = 60000;
+export interface CreateVerifierOptions {
+    networkPublicKey: string | Buffer;
+    toleranceMs?: number;
+}
+export interface VerifyRequest {
+    body: Uint8Array | ArrayBufferView | ArrayBufferLike;
+    signatureHeader: string;
+    publicKeyHeader: string;
+    timestampHeader: string;
+}
+export type VerifyRequestFailure = 'invalid_timestamp' | 'timestamp_out_of_range' | 'invalid_public_key' | 'unknown_public_key' | 'invalid_signature_format' | 'signature_failed';
+export type VerifyRequestResult = {
+    valid: true;
+} | {
+    valid: false;
+    reason: VerifyRequestFailure;
+};
+export type RequestVerifier = (req: VerifyRequest) => VerifyRequestResult;
+export declare function createRequestVerifier(opts: CreateVerifierOptions): RequestVerifier;

package/lib/cjs/common/crypto/request.js

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_TOLERANCE_MS = void 0;
+exports.createRequestVerifier = createRequestVerifier;
+const verify_js_1 = require("./verify.js");
+const hash_js_1 = require("./hash.js");
+const keys_js_1 = require("./keys.js");
+exports.DEFAULT_TOLERANCE_MS = 60000;
+function createRequestVerifier(opts) {
+    const networkKey = (0, keys_js_1.parsePublicKey)(opts.networkPublicKey);
+    const tolerance = opts.toleranceMs ?? exports.DEFAULT_TOLERANCE_MS;
+    return (req) => {
+        const ts = parseInt(req.timestampHeader, 10);
+        if (!Number.isFinite(ts) || ts < 0) {
+            return { valid: false, reason: 'invalid_timestamp' };
+        }
+        if (Math.abs(Date.now() - ts) > tolerance) {
+            return { valid: false, reason: 'timestamp_out_of_range' };
+        }
+        let publicKey;
+        try {
+            publicKey = (0, keys_js_1.parsePublicKey)(req.publicKeyHeader);
+        }
+        catch {
+            return { valid: false, reason: 'invalid_public_key' };
+        }
+        if (!(0, keys_js_1.publicKeysEqual)(publicKey, networkKey)) {
+            return { valid: false, reason: 'unknown_public_key' };
+        }
+        const sigHex = req.signatureHeader.startsWith('0x')
+            ? req.signatureHeader.slice(2)
+            : req.signatureHeader;
+        if (!/^[0-9a-fA-F]*$/.test(sigHex) || sigHex.length % 2 !== 0) {
+            return { valid: false, reason: 'invalid_signature_format' };
+        }
+        const signature = Buffer.from(sigHex, 'hex');
+        if (signature.length !== 64 && signature.length !== 65) {
+            return { valid: false, reason: 'invalid_signature_format' };
+        }
+        const body = req.body instanceof Uint8Array
+            ? req.body
+            : ArrayBuffer.isView(req.body)
+                ? new Uint8Array(req.body.buffer, req.body.byteOffset, req.body.byteLength)
+                : new Uint8Array(req.body);
+        const digest = (0, hash_js_1.computeDigest)(body, ts);
+        if (!(0, verify_js_1.verifySignature)(publicKey, digest, signature)) {
+            return { valid: false, reason: 'signature_failed' };
+        }
+        return { valid: true };
+    };
+}

package/lib/cjs/common/crypto/verify.d.ts

@@ -0,0 +1 @@
+export declare function verifySignature(publicKey: Uint8Array, digest: Uint8Array, signature: Uint8Array): boolean;

package/lib/cjs/common/crypto/verify.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifySignature = verifySignature;
+const secp256k1_js_1 = require("@noble/curves/secp256k1.js");
+function verifySignature(publicKey, digest, signature) {
+    if (digest.length !== 32) {
+        return false;
+    }
+    if (signature.length !== 64 && signature.length !== 65) {
+        return false;
+    }
+    const sig64 = signature.length === 65 ? signature.subarray(0, 64) : signature;
+    try {
+        return secp256k1_js_1.secp256k1.verify(sig64, digest, publicKey, { prehash: false });
+    }
+    catch {
+        return false;
+    }
+}

package/lib/cjs/common/health.d.ts

@@ -0,0 +1,21 @@
+import { type ServiceImpl } from "@connectrpc/connect";
+import { Health } from "./health_pb.js";
+/**
+ * Headers carrying the identity of the SDK answering the probe. They ride on
+ * the health response and nowhere else: `HealthCheckResponse` has a single
+ * status field and `check` names its service in the request, so the contract
+ * itself has no room for this — and taxing every callback with headers only the
+ * probe reads would be worse.
+ */
+export declare const SDK_ECOSYSTEM_HEADER = "T0-Sdk-Ecosystem";
+export declare const SDK_VERSION_HEADER = "T0-Sdk-Version";
+/**
+ * Reports SERVING for the services registered on this server and NOT_FOUND for
+ * anything else. The set is frozen at registration; nothing is computed per
+ * request.
+ *
+ * `watch` is absent on purpose: it is server-streaming, and the body-hash
+ * signature scheme these servers run behind has no story for streams. Omitting
+ * it from a partial `ServiceImpl` makes connect-es answer UNIMPLEMENTED.
+ */
+export declare const createHealthServiceImpl: (services: string[], version?: string) => Partial<ServiceImpl<typeof Health>>;

package/lib/cjs/common/health.js

@@ -0,0 +1,45 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createHealthServiceImpl = exports.SDK_VERSION_HEADER = exports.SDK_ECOSYSTEM_HEADER = void 0;
+const protobuf_1 = require("@bufbuild/protobuf");
+const connect_1 = require("@connectrpc/connect");
+const health_pb_js_1 = require("./health_pb.js");
+/**
+ * Headers carrying the identity of the SDK answering the probe. They ride on
+ * the health response and nowhere else: `HealthCheckResponse` has a single
+ * status field and `check` names its service in the request, so the contract
+ * itself has no room for this — and taxing every callback with headers only the
+ * probe reads would be worse.
+ */
+exports.SDK_ECOSYSTEM_HEADER = "T0-Sdk-Ecosystem";
+exports.SDK_VERSION_HEADER = "T0-Sdk-Version";
+const SDK_ECOSYSTEM = "node";
+/**
+ * Reports SERVING for the services registered on this server and NOT_FOUND for
+ * anything else. The set is frozen at registration; nothing is computed per
+ * request.
+ *
+ * `watch` is absent on purpose: it is server-streaming, and the body-hash
+ * signature scheme these servers run behind has no story for streams. Omitting
+ * it from a partial `ServiceImpl` makes connect-es answer UNIMPLEMENTED.
+ */
+const createHealthServiceImpl = (services, version) => {
+    const registered = new Set(services);
+    const serving = (0, protobuf_1.create)(health_pb_js_1.HealthCheckResponseSchema, {
+        status: health_pb_js_1.HealthCheckResponse_ServingStatus.SERVING,
+    });
+    return {
+        check(req, ctx) {
+            ctx.responseHeader.set(exports.SDK_ECOSYSTEM_HEADER, SDK_ECOSYSTEM);
+            if (version) {
+                ctx.responseHeader.set(exports.SDK_VERSION_HEADER, version);
+            }
+            const { service } = req;
+            if (service !== "" && !registered.has(service)) {
+                throw new connect_1.ConnectError(`unknown service '${service}'`, connect_1.Code.NotFound);
+            }
+            return serving;
+        },
+    };
+};
+exports.createHealthServiceImpl = createHealthServiceImpl;