@t-0/provider-sdk 1.1.29 → 1.1.30

package/lib/cjs/service/service.js

@@ -1,88 +1,9 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createService = exports.REQUEST_VALIDITY_MILLIS = void 0;
-const connect_1 = require("@connectrpc/connect");
-const headers_js_1 = __importDefault(require("../common/headers.js"));
-const verify_js_1 = require("../crypto/verify.js");
-const validate_response_js_1 = require("./validate_response.js");
-const health_pb_js_1 = require("./health_pb.js");
-const health_js_1 = require("./health.js");
-exports.REQUEST_VALIDITY_MILLIS = 60000;
-const createSignatureVerification = (networkPublicKey) => (next) => async (req) => {
-    const ts = decodeNum(getHeader(req, headers_js_1.default.SignatureTimestamp));
-    if (Date.now() - ts > 60000) {
-        throw new connect_1.ConnectError(`${headers_js_1.default.SignatureTimestamp} must be within ${exports.REQUEST_VALIDITY_MILLIS} milliseconds from now`, connect_1.Code.InvalidArgument);
-    }
-    const publicKey = decodeHex(getHeader(req, headers_js_1.default.PublicKey));
-    if (networkPublicKey.compare(publicKey) !== 0) {
-        throw new connect_1.ConnectError(`${headers_js_1.default.PublicKey} value is not network public key`, connect_1.Code.Unauthenticated);
-    }
-    const signature = decodeHex(getHeader(req, headers_js_1.default.Signature));
-    const hasher = req.contextValues.get(kHash);
-    const tsBuf = Buffer.alloc(8);
-    tsBuf.writeBigUInt64LE(BigInt(ts)); // 64‑bit little‑endian timestamp
-    const digest = hasher
-        .update(tsBuf)
-        .digest();
-    if (!(0, verify_js_1.verifySignature)(publicKey, digest, signature)) {
-        throw new connect_1.ConnectError(`${headers_js_1.default.Signature} has invalid signature`, connect_1.Code.Unauthenticated);
-    }
-    return await next(req);
-};
-const createService = (networkPublicKey, registerRoutes, options) => {
-    if (typeof networkPublicKey == "string") {
-        networkPublicKey = decodeHex(networkPublicKey);
-    }
-    return {
-        routes: (router) => {
-            const collected = [];
-            const origService = router.service.bind(router);
-            const wrappedRouter = {
-                service: (desc, impl) => {
-                    collected.push(desc.typeName);
-                    origService(desc, impl);
-                },
-            };
-            registerRoutes(wrappedRouter);
-            // Health is the only service this transport mounts on its own — see
-            // docs/HEALTH_SERVICE.md. Same interceptors as everything else, so the
-            // probe is signed like any other call.
-            collected.push(health_pb_js_1.Health.typeName);
-            origService(health_pb_js_1.Health, (0, health_js_1.createHealthServiceImpl)(collected));
-        },
-        interceptors: [createSignatureVerification(networkPublicKey), (0, validate_response_js_1.createValidationInterceptor)(options?.logger)],
-        grpcWeb: false,
-        contextValues: (req) => {
-            return (0, connect_1.createContextValues)().set(kHash, req.hasher);
-        }
-    };
-};
+const service_js_1 = require("../common/service.js");
+const version_js_1 = require("../version.js");
+var service_js_2 = require("../common/service.js");
+Object.defineProperty(exports, "REQUEST_VALIDITY_MILLIS", { enumerable: true, get: function () { return service_js_2.REQUEST_VALIDITY_MILLIS; } });
+const createService = (networkPublicKey, registerRoutes, options) => (0, service_js_1.createService)(networkPublicKey, registerRoutes, { ...options, version: options?.version ?? version_js_1.SDK_VERSION });
 exports.createService = createService;
-const kHash = (0, connect_1.createContextKey)(undefined);
-function getHeader(req, header) {
-    const raw = req.header.get(header);
-    if (!raw) {
-        throw new connect_1.ConnectError(`missing required header '${header}'`, connect_1.Code.InvalidArgument);
-    }
-    return raw;
-}
-function decodeHex(value) {
-    value = value.startsWith('0x') ? value.slice(2) : value;
-    try {
-        return Buffer.from(value, "hex");
-    }
-    catch (e) {
-        throw new connect_1.ConnectError(`invalid header format. '${value}' must be hex encoded`, connect_1.Code.InvalidArgument);
-    }
-}
-function decodeNum(value) {
-    try {
-        return parseInt(value);
-    }
-    catch (e) {
-        throw new connect_1.ConnectError(`invalid header format. '${value}' must be a number`, connect_1.Code.InvalidArgument);
-    }
-}

package/lib/cjs/service/validate.d.ts

@@ -1,25 +1 @@
-import type { DescMessage, MessageShape } from "@bufbuild/protobuf";
-/**
- * Shared protovalidate validator instance for the public {@link validate} helper.
- * Construction is cheap, but reusing one instance avoids repeated compilation
- * of the same rules.
- */
-export declare const validator: import("@bufbuild/protovalidate").Validator;
-/**
- * Validates a response message against its buf.validate proto annotations.
- *
- * On success, returns the message unchanged (typed). On failure, throws a
- * {@link ConnectError} with {@link Code.Internal} and a message matching the
- * shape emitted by the SDK's response-validation interceptor — so propagating
- * the error from a handler produces the same wire response as not calling
- * `validate` at all.
- *
- * Intended use:
- * ```ts
- * return validate(PayOutResponseSchema, { result: { case: "accepted", value: {} } });
- * ```
- *
- * Catch the error to convert it into a domain-level failure (e.g. the `Failed`
- * arm of a `oneof result`) instead of an opaque `Code.Internal`.
- */
-export declare function validate<Desc extends DescMessage>(schema: Desc, msg: MessageShape<Desc>): MessageShape<Desc>;
+export * from "../common/validate.js";

package/lib/cjs/service/validate.js

@@ -1,42 +1,17 @@
 "use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.validator = void 0;
-exports.validate = validate;
-const connect_1 = require("@connectrpc/connect");
-const protovalidate_1 = require("@bufbuild/protovalidate");
-/**
- * Shared protovalidate validator instance for the public {@link validate} helper.
- * Construction is cheap, but reusing one instance avoids repeated compilation
- * of the same rules.
- */
-exports.validator = (0, protovalidate_1.createValidator)();
-/**
- * Validates a response message against its buf.validate proto annotations.
- *
- * On success, returns the message unchanged (typed). On failure, throws a
- * {@link ConnectError} with {@link Code.Internal} and a message matching the
- * shape emitted by the SDK's response-validation interceptor — so propagating
- * the error from a handler produces the same wire response as not calling
- * `validate` at all.
- *
- * Intended use:
- * ```ts
- * return validate(PayOutResponseSchema, { result: { case: "accepted", value: {} } });
- * ```
- *
- * Catch the error to convert it into a domain-level failure (e.g. the `Failed`
- * arm of a `oneof result`) instead of an opaque `Code.Internal`.
- */
-function validate(schema, msg) {
-    const result = exports.validator.validate(schema, msg);
-    if (result.kind === "invalid") {
-        const details = result.violations
-            .map((v) => `${v.field?.toString() ?? ""}: ${v.message}`)
-            .join("; ");
-        throw new connect_1.ConnectError(`response validation failed: ${details}`, connect_1.Code.Internal);
-    }
-    if (result.kind === "error") {
-        throw new connect_1.ConnectError(`response validation error: ${result.error.message}`, connect_1.Code.Internal);
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
     }
-    return msg;
-}
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("../common/validate.js"), exports);

package/lib/cjs/service/validate_response.d.ts

@@ -1,26 +1,17 @@
 import type { Interceptor } from "@connectrpc/connect";
+import type { Logger } from "../common/validation.js";
+import { createValidationInterceptor } from "../common/validation.js";
+export { createValidationInterceptor, type Logger, type ValidationInterceptorOptions } from "../common/validation.js";
 /**
- * Minimal logger contract accepted by the SDK. Providers may pass `console`
- * directly, or adapt their preferred logger (e.g. pino) with:
- *
- *   { error: (msg, fields) => pinoInstance.error(fields, msg) }
+ * Registry covering the t-0 network provider contract protos. Leaf file
+ * descriptors pull in their full dependency graph, so adding new messages
+ * or fields to existing protos requires only `buf:generate`.
  */
-export interface Logger {
-    error(msg: string, fields?: Record<string, unknown>): void;
-}
+export declare const networkRegistry: import("@bufbuild/protobuf").Registry;
 /**
- * Creates a ConnectRPC interceptor that validates provider responses against
- * buf.validate proto annotations before they are serialized and sent.
- * Also validates incoming requests using the official @connectrpc/validate interceptor.
- *
- * Invalid requests return Code.InvalidArgument; invalid responses return Code.Internal.
- *
- * On invalid responses, a single structured `error`-level line is emitted to
- * the supplied {@link Logger} (default: `console.error` with JSON-encoded
- * fields) before the `Code.Internal` error is thrown. This is the safety net
- * for handler code paths that skipped the public `validate()` helper.
+ * Validation interceptor pre-configured for the t-0 network provider contract.
  */
-export declare function createValidationInterceptor(logger?: Logger): Interceptor;
+export declare function createNetworkValidationInterceptor(logger?: Logger): Interceptor;
 /**
  * @deprecated Use createValidationInterceptor instead.
  */

package/lib/cjs/service/validate_response.js

@@ -1,65 +1,27 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.createResponseValidation = void 0;
-exports.createValidationInterceptor = createValidationInterceptor;
-const connect_1 = require("@connectrpc/connect");
-const protovalidate_1 = require("@bufbuild/protovalidate");
-const validate_1 = require("@connectrpc/validate");
-const version_js_1 = require("../version.js");
-const validator = (0, protovalidate_1.createValidator)();
-const defaultLogger = {
-    error: (msg, fields) => 
-    // eslint-disable-next-line no-console
-    console.error(JSON.stringify({ msg, ...(fields ?? {}) })),
-};
+exports.createResponseValidation = exports.networkRegistry = exports.createValidationInterceptor = void 0;
+exports.createNetworkValidationInterceptor = createNetworkValidationInterceptor;
+const protobuf_1 = require("@bufbuild/protobuf");
+const provider_pb_js_1 = require("../common/gen/tzero/v1/payment/provider_pb.js");
+const network_pb_js_1 = require("../common/gen/tzero/v1/payment/network_pb.js");
+const validation_js_1 = require("../common/validation.js");
+// Re-export everything from the common layer for backward compatibility.
+var validation_js_2 = require("../common/validation.js");
+Object.defineProperty(exports, "createValidationInterceptor", { enumerable: true, get: function () { return validation_js_2.createValidationInterceptor; } });
 /**
- * Creates a ConnectRPC interceptor that validates provider responses against
- * buf.validate proto annotations before they are serialized and sent.
- * Also validates incoming requests using the official @connectrpc/validate interceptor.
- *
- * Invalid requests return Code.InvalidArgument; invalid responses return Code.Internal.
- *
- * On invalid responses, a single structured `error`-level line is emitted to
- * the supplied {@link Logger} (default: `console.error` with JSON-encoded
- * fields) before the `Code.Internal` error is thrown. This is the safety net
- * for handler code paths that skipped the public `validate()` helper.
+ * Registry covering the t-0 network provider contract protos. Leaf file
+ * descriptors pull in their full dependency graph, so adding new messages
+ * or fields to existing protos requires only `buf:generate`.
  */
-function createValidationInterceptor(logger = defaultLogger) {
-    const requestInterceptor = (0, validate_1.createValidateInterceptor)();
-    return (next) => async (req) => {
-        // Validate request (delegates to official interceptor which throws on invalid)
-        const resp = await requestInterceptor(next)(req);
-        // Validate response
-        const schema = req.method.output;
-        const msg = resp.message;
-        const result = validator.validate(schema, msg);
-        if (result.kind === "invalid") {
-            const violations = result.violations.map((v) => ({
-                field: v.field?.toString() ?? "",
-                message: v.message,
-            }));
-            const details = violations.map((v) => `${v.field}: ${v.message}`).join("; ");
-            logger.error("response validation failed", {
-                rpc_method: `${req.service.typeName}/${req.method.name}`,
-                response_type: schema.typeName,
-                violations,
-                sdk_version: version_js_1.SDK_VERSION,
-            });
-            throw new connect_1.ConnectError(`response validation failed: ${details}`, connect_1.Code.Internal);
-        }
-        if (result.kind === "error") {
-            logger.error("response validation error", {
-                rpc_method: `${req.service.typeName}/${req.method.name}`,
-                response_type: schema.typeName,
-                error: result.error.message,
-                sdk_version: version_js_1.SDK_VERSION,
-            });
-            throw new connect_1.ConnectError(`response validation error: ${result.error.message}`, connect_1.Code.Internal);
-        }
-        return resp;
-    };
+exports.networkRegistry = (0, protobuf_1.createRegistry)(provider_pb_js_1.file_tzero_v1_payment_provider, network_pb_js_1.file_tzero_v1_payment_network);
+/**
+ * Validation interceptor pre-configured for the t-0 network provider contract.
+ */
+function createNetworkValidationInterceptor(logger) {
+    return (0, validation_js_1.createValidationInterceptor)({ logger, registry: exports.networkRegistry });
 }
 /**
  * @deprecated Use createValidationInterceptor instead.
  */
-exports.createResponseValidation = createValidationInterceptor;
+exports.createResponseValidation = validation_js_1.createValidationInterceptor;

package/lib/cjs/version.d.ts

@@ -1 +1 @@
-export declare const SDK_VERSION = "1.1.29";
+export declare const SDK_VERSION = "1.1.30";

package/lib/cjs/version.js

@@ -3,4 +3,4 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.SDK_VERSION = void 0;
 // SDK semantic version. Bumped in lockstep with all other SDKs by the
 // release.yaml workflow.
-exports.SDK_VERSION = "1.1.29";
+exports.SDK_VERSION = "1.1.30";

package/lib/esm/client/client.d.ts

@@ -1,16 +1,6 @@
-import { DescService } from "@bufbuild/protobuf";
+import { type Signature } from "../common/client/client.js";
+import type { DescService } from "@bufbuild/protobuf";
 export declare const DEFAULT_ENDPOINT = "https://api.t-0.network";
 export declare function createClient<T extends DescService>(signer: string | Buffer | ((data: Buffer) => Promise<Signature>) | Buffer<ArrayBufferLike>, endpoint: string | undefined, svc: T): import("@connectrpc/connect").Client<T>;
-/**
- * Signature with metadata for particular request
- */
-export interface Signature {
-    signature: Buffer;
-    publicKey: Buffer;
-}
-/**
- * Signature function for signing requests to T-0 API. Accepts any data in string format and return signature
- * with metadata
- */
-export type SignerFunction = (data: Buffer) => Promise<Signature>;
+export type { Signature, SignerFunction } from "../common/client/client.js";
 export default createClient;

package/lib/esm/client/client.js

@@ -1,39 +1,6 @@
-import { createClient as createConnectClient } from "@connectrpc/connect";
-import { createConnectTransport } from "@connectrpc/connect-web";
-import { keccak_256 } from "@noble/hashes/sha3.js";
-import CreateSigner from "./signer.js";
-import NetworkHeaders from "../common/headers.js";
+import { createClient as createClientCommon } from "../common/client/client.js";
 export const DEFAULT_ENDPOINT = "https://api.t-0.network";
 export function createClient(signer, endpoint, svc) {
-    let customFetch;
-    endpoint = endpoint || DEFAULT_ENDPOINT;
-    if (typeof signer === "string" || Buffer.isBuffer(signer)) {
-        signer = CreateSigner(signer);
-    }
-    customFetch = async (r, init) => {
-        if (!init?.body || !((init.body) instanceof Uint8Array)) {
-            throw "unsupported body type";
-        }
-        const ts = Date.now();
-        // 64‑bit little‑endian timestamp
-        const tsBuf = Buffer.alloc(8);
-        tsBuf.writeBigUInt64LE(BigInt(ts));
-        const hash = keccak_256.create()
-            .update(init.body)
-            .update(tsBuf);
-        const hashHex = Buffer.from(hash.digest());
-        const sig = await signer(hashHex);
-        const headers = new Headers(init?.headers);
-        headers.append(NetworkHeaders.Signature, "0x" + sig.signature.toString('hex'));
-        headers.append(NetworkHeaders.PublicKey, "0x" + sig.publicKey.toString('hex'));
-        headers.append(NetworkHeaders.SignatureTimestamp, ts.toString());
-        const modifiedInit = { ...init, headers };
-        return fetch(r, modifiedInit);
-    };
-    const transport = createConnectTransport({
-        baseUrl: endpoint || DEFAULT_ENDPOINT,
-        fetch: customFetch,
-    });
-    return createConnectClient(svc, transport);
+    return createClientCommon(signer, endpoint || DEFAULT_ENDPOINT, svc);
 }
 export default createClient;

package/lib/esm/client/signer.d.ts

@@ -1,3 +1 @@
-import { Signature } from "./client.js";
-export declare const CreateSigner: (privateKey: string | Buffer) => (data: Buffer) => Promise<Signature>;
-export default CreateSigner;
+export { CreateSigner, default } from "../common/client/signer.js";

package/lib/esm/client/signer.js

@@ -1,32 +1 @@
-import { secp256k1 } from '@noble/curves/secp256k1.js';
-export const CreateSigner = (privateKey) => {
-    privateKey = parsePrivateKey(privateKey);
-    const publicKey = Buffer.from(secp256k1.getPublicKey(privateKey, false));
-    return async (data) => {
-        // Ensure hash is 32 bytes
-        if (data.length !== 32) {
-            throw new Error('Message hash must be 32 bytes');
-        }
-        // Sign the hash
-        const signature = secp256k1.sign(data, privateKey, { prehash: false });
-        return {
-            signature: Buffer.from(signature),
-            publicKey: publicKey,
-        };
-    };
-};
-const parsePrivateKey = (privateKey) => {
-    if (typeof privateKey == 'string') {
-        privateKey = privateKey.replace(/^0x/, '');
-        if (!/^[0-9a-fA-F]{64}$/.test(privateKey)) {
-            throw new Error('Private key must be 64 hex characters');
-        }
-        privateKey = Buffer.from(privateKey, 'hex');
-    }
-    // Validate private key
-    if (!secp256k1.utils.isValidSecretKey(privateKey)) {
-        throw new Error('Invalid private key');
-    }
-    return privateKey;
-};
-export default CreateSigner;
+export { CreateSigner, default } from "../common/client/signer.js";

package/lib/esm/common/client/client.d.ts

@@ -0,0 +1,14 @@
+import { DescService } from "@bufbuild/protobuf";
+export declare function createClient<T extends DescService>(signer: string | Buffer | ((data: Buffer) => Promise<Signature>) | Buffer<ArrayBufferLike>, endpoint: string, svc: T): import("@connectrpc/connect").Client<T>;
+/**
+ * Signature with metadata for particular request
+ */
+export interface Signature {
+    signature: Buffer;
+    publicKey: Buffer;
+}
+/**
+ * Signature function for signing requests to T-0 API. Accepts any data in string format and return signature
+ * with metadata
+ */
+export type SignerFunction = (data: Buffer) => Promise<Signature>;

package/lib/esm/common/client/client.js

@@ -0,0 +1,36 @@
+import { createClient as createConnectClient } from "@connectrpc/connect";
+import { createConnectTransport } from "@connectrpc/connect-web";
+import { keccak_256 } from "@noble/hashes/sha3.js";
+import CreateSigner from "./signer.js";
+import NetworkHeaders from "../headers.js";
+export function createClient(signer, endpoint, svc) {
+    let customFetch;
+    if (typeof signer === "string" || Buffer.isBuffer(signer)) {
+        signer = CreateSigner(signer);
+    }
+    customFetch = async (r, init) => {
+        if (!init?.body || !((init.body) instanceof Uint8Array)) {
+            throw "unsupported body type";
+        }
+        const ts = Date.now();
+        // 64‑bit little‑endian timestamp
+        const tsBuf = Buffer.alloc(8);
+        tsBuf.writeBigUInt64LE(BigInt(ts));
+        const hash = keccak_256.create()
+            .update(init.body)
+            .update(tsBuf);
+        const hashHex = Buffer.from(hash.digest());
+        const sig = await signer(hashHex);
+        const headers = new Headers(init?.headers);
+        headers.append(NetworkHeaders.Signature, "0x" + sig.signature.toString('hex'));
+        headers.append(NetworkHeaders.PublicKey, "0x" + sig.publicKey.toString('hex'));
+        headers.append(NetworkHeaders.SignatureTimestamp, ts.toString());
+        const modifiedInit = { ...init, headers };
+        return fetch(r, modifiedInit);
+    };
+    const transport = createConnectTransport({
+        baseUrl: endpoint,
+        fetch: customFetch,
+    });
+    return createConnectClient(svc, transport);
+}

package/lib/esm/common/client/signer.d.ts

@@ -0,0 +1,3 @@
+import type { Signature } from "./client.js";
+export declare const CreateSigner: (privateKey: string | Buffer) => (data: Buffer) => Promise<Signature>;
+export default CreateSigner;

package/lib/esm/common/client/signer.js

@@ -0,0 +1,32 @@
+import { secp256k1 } from '@noble/curves/secp256k1.js';
+export const CreateSigner = (privateKey) => {
+    privateKey = parsePrivateKey(privateKey);
+    const publicKey = Buffer.from(secp256k1.getPublicKey(privateKey, false));
+    return async (data) => {
+        // Ensure hash is 32 bytes
+        if (data.length !== 32) {
+            throw new Error('Message hash must be 32 bytes');
+        }
+        // Sign the hash
+        const signature = secp256k1.sign(data, privateKey, { prehash: false });
+        return {
+            signature: Buffer.from(signature),
+            publicKey: publicKey,
+        };
+    };
+};
+const parsePrivateKey = (privateKey) => {
+    if (typeof privateKey == 'string') {
+        privateKey = privateKey.replace(/^0x/, '');
+        if (!/^[0-9a-fA-F]{64}$/.test(privateKey)) {
+            throw new Error('Private key must be 64 hex characters');
+        }
+        privateKey = Buffer.from(privateKey, 'hex');
+    }
+    // Validate private key
+    if (!secp256k1.utils.isValidSecretKey(privateKey)) {
+        throw new Error('Invalid private key');
+    }
+    return privateKey;
+};
+export default CreateSigner;

package/lib/esm/common/crypto/hash.d.ts

@@ -0,0 +1,2 @@
+export declare function keccak256(...inputs: Uint8Array[]): Buffer;
+export declare function computeDigest(body: Uint8Array, timestampMs: number): Buffer;

package/lib/esm/common/crypto/hash.js

@@ -0,0 +1,13 @@
+import { keccak_256 } from '@noble/hashes/sha3.js';
+export function keccak256(...inputs) {
+    const h = keccak_256.create();
+    for (const input of inputs) {
+        h.update(input);
+    }
+    return Buffer.from(h.digest());
+}
+export function computeDigest(body, timestampMs) {
+    const tsBuf = Buffer.alloc(8);
+    tsBuf.writeBigUInt64LE(BigInt(timestampMs));
+    return keccak256(body, tsBuf);
+}

package/lib/esm/common/crypto/index.d.ts

@@ -0,0 +1,5 @@
+export { verifySignature } from './verify.js';
+export { keccak256, computeDigest } from './hash.js';
+export { parsePublicKey, publicKeysEqual } from './keys.js';
+export { createRequestVerifier, DEFAULT_TOLERANCE_MS } from './request.js';
+export type { CreateVerifierOptions, VerifyRequest, VerifyRequestResult, VerifyRequestFailure, RequestVerifier } from './request.js';

package/lib/esm/common/crypto/index.js

@@ -0,0 +1,4 @@
+export { verifySignature } from './verify.js';
+export { keccak256, computeDigest } from './hash.js';
+export { parsePublicKey, publicKeysEqual } from './keys.js';
+export { createRequestVerifier, DEFAULT_TOLERANCE_MS } from './request.js';

package/lib/esm/common/crypto/keys.d.ts

@@ -0,0 +1,2 @@
+export declare function parsePublicKey(key: string | Buffer): Buffer;
+export declare function publicKeysEqual(a: Uint8Array, b: Uint8Array): boolean;

package/lib/esm/common/crypto/keys.js

@@ -0,0 +1,19 @@
+export function parsePublicKey(key) {
+    if (typeof key === 'string') {
+        const hex = key.startsWith('0x') ? key.slice(2) : key;
+        if (!/^[0-9a-fA-F]*$/.test(hex) || hex.length % 2 !== 0) {
+            throw new Error('Public key contains invalid hex characters');
+        }
+        key = Buffer.from(hex, 'hex');
+    }
+    if (key.length !== 65 || key[0] !== 0x04) {
+        throw new Error('Public key must be 65 bytes in uncompressed format (0x04 prefix)');
+    }
+    return Buffer.from(key);
+}
+export function publicKeysEqual(a, b) {
+    if (a.length !== b.length) {
+        return false;
+    }
+    return Buffer.from(a).compare(Buffer.from(b)) === 0;
+}

package/lib/esm/common/crypto/request.d.ts

@@ -0,0 +1,20 @@
+export declare const DEFAULT_TOLERANCE_MS = 60000;
+export interface CreateVerifierOptions {
+    networkPublicKey: string | Buffer;
+    toleranceMs?: number;
+}
+export interface VerifyRequest {
+    body: Uint8Array | ArrayBufferView | ArrayBufferLike;
+    signatureHeader: string;
+    publicKeyHeader: string;
+    timestampHeader: string;
+}
+export type VerifyRequestFailure = 'invalid_timestamp' | 'timestamp_out_of_range' | 'invalid_public_key' | 'unknown_public_key' | 'invalid_signature_format' | 'signature_failed';
+export type VerifyRequestResult = {
+    valid: true;
+} | {
+    valid: false;
+    reason: VerifyRequestFailure;
+};
+export type RequestVerifier = (req: VerifyRequest) => VerifyRequestResult;
+export declare function createRequestVerifier(opts: CreateVerifierOptions): RequestVerifier;

package/lib/esm/common/crypto/request.js

@@ -0,0 +1,47 @@
+import { verifySignature } from './verify.js';
+import { computeDigest } from './hash.js';
+import { parsePublicKey, publicKeysEqual } from './keys.js';
+export const DEFAULT_TOLERANCE_MS = 60000;
+export function createRequestVerifier(opts) {
+    const networkKey = parsePublicKey(opts.networkPublicKey);
+    const tolerance = opts.toleranceMs ?? DEFAULT_TOLERANCE_MS;
+    return (req) => {
+        const ts = parseInt(req.timestampHeader, 10);
+        if (!Number.isFinite(ts) || ts < 0) {
+            return { valid: false, reason: 'invalid_timestamp' };
+        }
+        if (Math.abs(Date.now() - ts) > tolerance) {
+            return { valid: false, reason: 'timestamp_out_of_range' };
+        }
+        let publicKey;
+        try {
+            publicKey = parsePublicKey(req.publicKeyHeader);
+        }
+        catch {
+            return { valid: false, reason: 'invalid_public_key' };
+        }
+        if (!publicKeysEqual(publicKey, networkKey)) {
+            return { valid: false, reason: 'unknown_public_key' };
+        }
+        const sigHex = req.signatureHeader.startsWith('0x')
+            ? req.signatureHeader.slice(2)
+            : req.signatureHeader;
+        if (!/^[0-9a-fA-F]*$/.test(sigHex) || sigHex.length % 2 !== 0) {
+            return { valid: false, reason: 'invalid_signature_format' };
+        }
+        const signature = Buffer.from(sigHex, 'hex');
+        if (signature.length !== 64 && signature.length !== 65) {
+            return { valid: false, reason: 'invalid_signature_format' };
+        }
+        const body = req.body instanceof Uint8Array
+            ? req.body
+            : ArrayBuffer.isView(req.body)
+                ? new Uint8Array(req.body.buffer, req.body.byteOffset, req.body.byteLength)
+                : new Uint8Array(req.body);
+        const digest = computeDigest(body, ts);
+        if (!verifySignature(publicKey, digest, signature)) {
+            return { valid: false, reason: 'signature_failed' };
+        }
+        return { valid: true };
+    };
+}

package/lib/esm/common/crypto/verify.d.ts

@@ -0,0 +1 @@
+export declare function verifySignature(publicKey: Uint8Array, digest: Uint8Array, signature: Uint8Array): boolean;