@t-0/provider-sdk 1.1.29 → 1.1.30

package/lib/esm/common/crypto/verify.js

@@ -0,0 +1,16 @@
+import { secp256k1 } from '@noble/curves/secp256k1.js';
+export function verifySignature(publicKey, digest, signature) {
+    if (digest.length !== 32) {
+        return false;
+    }
+    if (signature.length !== 64 && signature.length !== 65) {
+        return false;
+    }
+    const sig64 = signature.length === 65 ? signature.subarray(0, 64) : signature;
+    try {
+        return secp256k1.verify(sig64, digest, publicKey, { prehash: false });
+    }
+    catch {
+        return false;
+    }
+}

package/lib/esm/common/health.d.ts

@@ -0,0 +1,21 @@
+import { type ServiceImpl } from "@connectrpc/connect";
+import { Health } from "./health_pb.js";
+/**
+ * Headers carrying the identity of the SDK answering the probe. They ride on
+ * the health response and nowhere else: `HealthCheckResponse` has a single
+ * status field and `check` names its service in the request, so the contract
+ * itself has no room for this — and taxing every callback with headers only the
+ * probe reads would be worse.
+ */
+export declare const SDK_ECOSYSTEM_HEADER = "T0-Sdk-Ecosystem";
+export declare const SDK_VERSION_HEADER = "T0-Sdk-Version";
+/**
+ * Reports SERVING for the services registered on this server and NOT_FOUND for
+ * anything else. The set is frozen at registration; nothing is computed per
+ * request.
+ *
+ * `watch` is absent on purpose: it is server-streaming, and the body-hash
+ * signature scheme these servers run behind has no story for streams. Omitting
+ * it from a partial `ServiceImpl` makes connect-es answer UNIMPLEMENTED.
+ */
+export declare const createHealthServiceImpl: (services: string[], version?: string) => Partial<ServiceImpl<typeof Health>>;

package/lib/esm/common/health.js

@@ -0,0 +1,41 @@
+import { create } from "@bufbuild/protobuf";
+import { Code, ConnectError } from "@connectrpc/connect";
+import { HealthCheckResponse_ServingStatus, HealthCheckResponseSchema, } from "./health_pb.js";
+/**
+ * Headers carrying the identity of the SDK answering the probe. They ride on
+ * the health response and nowhere else: `HealthCheckResponse` has a single
+ * status field and `check` names its service in the request, so the contract
+ * itself has no room for this — and taxing every callback with headers only the
+ * probe reads would be worse.
+ */
+export const SDK_ECOSYSTEM_HEADER = "T0-Sdk-Ecosystem";
+export const SDK_VERSION_HEADER = "T0-Sdk-Version";
+const SDK_ECOSYSTEM = "node";
+/**
+ * Reports SERVING for the services registered on this server and NOT_FOUND for
+ * anything else. The set is frozen at registration; nothing is computed per
+ * request.
+ *
+ * `watch` is absent on purpose: it is server-streaming, and the body-hash
+ * signature scheme these servers run behind has no story for streams. Omitting
+ * it from a partial `ServiceImpl` makes connect-es answer UNIMPLEMENTED.
+ */
+export const createHealthServiceImpl = (services, version) => {
+    const registered = new Set(services);
+    const serving = create(HealthCheckResponseSchema, {
+        status: HealthCheckResponse_ServingStatus.SERVING,
+    });
+    return {
+        check(req, ctx) {
+            ctx.responseHeader.set(SDK_ECOSYSTEM_HEADER, SDK_ECOSYSTEM);
+            if (version) {
+                ctx.responseHeader.set(SDK_VERSION_HEADER, version);
+            }
+            const { service } = req;
+            if (service !== "" && !registered.has(service)) {
+                throw new ConnectError(`unknown service '${service}'`, Code.NotFound);
+            }
+            return serving;
+        },
+    };
+};

package/lib/esm/common/health_pb.d.ts

@@ -0,0 +1,157 @@
+import type { GenEnum, GenFile, GenMessage, GenService } from "@bufbuild/protobuf/codegenv2";
+import type { Message } from "@bufbuild/protobuf";
+/**
+ * Describes the file grpc/health/v1/health.proto.
+ */
+export declare const file_grpc_health_v1_health: GenFile;
+/**
+ * @generated from message grpc.health.v1.HealthCheckRequest
+ */
+export type HealthCheckRequest = Message<"grpc.health.v1.HealthCheckRequest"> & {
+    /**
+     * @generated from field: string service = 1;
+     */
+    service: string;
+};
+/**
+ * Describes the message grpc.health.v1.HealthCheckRequest.
+ * Use `create(HealthCheckRequestSchema)` to create a new message.
+ */
+export declare const HealthCheckRequestSchema: GenMessage<HealthCheckRequest>;
+/**
+ * @generated from message grpc.health.v1.HealthCheckResponse
+ */
+export type HealthCheckResponse = Message<"grpc.health.v1.HealthCheckResponse"> & {
+    /**
+     * @generated from field: grpc.health.v1.HealthCheckResponse.ServingStatus status = 1;
+     */
+    status: HealthCheckResponse_ServingStatus;
+};
+/**
+ * Describes the message grpc.health.v1.HealthCheckResponse.
+ * Use `create(HealthCheckResponseSchema)` to create a new message.
+ */
+export declare const HealthCheckResponseSchema: GenMessage<HealthCheckResponse>;
+/**
+ * @generated from enum grpc.health.v1.HealthCheckResponse.ServingStatus
+ */
+export declare enum HealthCheckResponse_ServingStatus {
+    /**
+     * @generated from enum value: UNKNOWN = 0;
+     */
+    UNKNOWN = 0,
+    /**
+     * @generated from enum value: SERVING = 1;
+     */
+    SERVING = 1,
+    /**
+     * @generated from enum value: NOT_SERVING = 2;
+     */
+    NOT_SERVING = 2,
+    /**
+     * Used only by the Watch method.
+     *
+     * @generated from enum value: SERVICE_UNKNOWN = 3;
+     */
+    SERVICE_UNKNOWN = 3
+}
+/**
+ * Describes the enum grpc.health.v1.HealthCheckResponse.ServingStatus.
+ */
+export declare const HealthCheckResponse_ServingStatusSchema: GenEnum<HealthCheckResponse_ServingStatus>;
+/**
+ * @generated from message grpc.health.v1.HealthListRequest
+ */
+export type HealthListRequest = Message<"grpc.health.v1.HealthListRequest"> & {};
+/**
+ * Describes the message grpc.health.v1.HealthListRequest.
+ * Use `create(HealthListRequestSchema)` to create a new message.
+ */
+export declare const HealthListRequestSchema: GenMessage<HealthListRequest>;
+/**
+ * @generated from message grpc.health.v1.HealthListResponse
+ */
+export type HealthListResponse = Message<"grpc.health.v1.HealthListResponse"> & {
+    /**
+     * statuses contains all the services and their respective status.
+     *
+     * @generated from field: map<string, grpc.health.v1.HealthCheckResponse> statuses = 1;
+     */
+    statuses: {
+        [key: string]: HealthCheckResponse;
+    };
+};
+/**
+ * Describes the message grpc.health.v1.HealthListResponse.
+ * Use `create(HealthListResponseSchema)` to create a new message.
+ */
+export declare const HealthListResponseSchema: GenMessage<HealthListResponse>;
+/**
+ * Health is gRPC's mechanism for checking whether a server is able to handle
+ * RPCs. Its semantics are documented in
+ * https://github.com/grpc/grpc/blob/master/doc/health-checking.md.
+ *
+ * @generated from service grpc.health.v1.Health
+ */
+export declare const Health: GenService<{
+    /**
+     * Check gets the health of the specified service. If the requested service
+     * is unknown, the call will fail with status NOT_FOUND. If the caller does
+     * not specify a service name, the server should respond with its overall
+     * health status.
+     *
+     * Clients should set a deadline when calling Check, and can declare the
+     * server unhealthy if they do not receive a timely response.
+     *
+     * @generated from rpc grpc.health.v1.Health.Check
+     */
+    check: {
+        methodKind: "unary";
+        input: typeof HealthCheckRequestSchema;
+        output: typeof HealthCheckResponseSchema;
+    };
+    /**
+     * List provides a non-atomic snapshot of the health of all the available
+     * services.
+     *
+     * The server may respond with a RESOURCE_EXHAUSTED error if too many services
+     * exist.
+     *
+     * Clients should set a deadline when calling List, and can declare the server
+     * unhealthy if they do not receive a timely response.
+     *
+     * Clients should keep in mind that the list of health services exposed by an
+     * application can change over the lifetime of the process.
+     *
+     * @generated from rpc grpc.health.v1.Health.List
+     */
+    list: {
+        methodKind: "unary";
+        input: typeof HealthListRequestSchema;
+        output: typeof HealthListResponseSchema;
+    };
+    /**
+     * Performs a watch for the serving status of the requested service.
+     * The server will immediately send back a message indicating the current
+     * serving status.  It will then subsequently send a new message whenever
+     * the service's serving status changes.
+     *
+     * If the requested service is unknown when the call is received, the
+     * server will send a message setting the serving status to
+     * SERVICE_UNKNOWN but will *not* terminate the call.  If at some
+     * future point, the serving status of the service becomes known, the
+     * server will send a new message with the service's serving status.
+     *
+     * If the call terminates with status UNIMPLEMENTED, then clients
+     * should assume this method is not supported and should not retry the
+     * call.  If the call terminates with any other status (including OK),
+     * clients should retry the call with appropriate exponential backoff.
+     *
+     * @generated from rpc grpc.health.v1.Health.Watch
+     */
+    watch: {
+        methodKind: "server_streaming";
+        input: typeof HealthCheckRequestSchema;
+        output: typeof HealthCheckResponseSchema;
+    };
+}>;

package/lib/esm/common/health_pb.js

@@ -0,0 +1,87 @@
+// Vendored generated stubs for grpc.health.v1 -- do not edit by hand.
+//
+// Source:   buf.build/grpc/grpc, grpc/health/v1/health.proto
+// Plugin:   buf.build/bufbuild/es:v2.12.0 (kept in step with the root
+//           buf.gen.yaml pin -- plugin and @bufbuild/protobuf runtime must
+//           agree on major).
+//
+// Regenerate with the following, which keeps this header and replaces
+// everything from the gRPC copyright line down. Do not just `mv` the generated
+// file over this one -- that would delete these instructions along with it.
+//
+//   cd node/sdk
+//   buf generate buf.build/grpc/grpc --path grpc/health/v1/health.proto \
+//     --template '{"version":"v2","plugins":[{"remote":"buf.build/bufbuild/es:v2.12.0","out":"gen-health","opt":["target=ts","import_extension=js"]}]}'
+//   sed '/^\/\/ Copyright 2015 The gRPC Authors/,$d' src/common/health_pb.ts > gen-health/header
+//   cat gen-health/header gen-health/grpc/health/v1/health_pb.ts > src/common/health_pb.ts
+//   rm -rf gen-health
+//
+// Vendored rather than depended on: the equivalent package
+// `@buf/grpc_grpc.bufbuild_es` is published only on the Buf Schema Registry, and
+// reaching it needs registry config that a published npm package cannot hand its
+// consumers -- so depending on it 404'd every downstream install. Rationale in
+// docs/HEALTH_SERVICE.md.
+//
+// Lives under src/common/ (not src/common/gen/) so the buf-regenerated gen/
+// tree stays independent.
+import { enumDesc, fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
+/**
+ * Describes the file grpc/health/v1/health.proto.
+ */
+export const file_grpc_health_v1_health = /*@__PURE__*/ fileDesc("ChtncnBjL2hlYWx0aC92MS9oZWFsdGgucHJvdG8SDmdycGMuaGVhbHRoLnYxIiUKEkhlYWx0aENoZWNrUmVxdWVzdBIPCgdzZXJ2aWNlGAEgASgJIqkBChNIZWFsdGhDaGVja1Jlc3BvbnNlEkEKBnN0YXR1cxgBIAEoDjIxLmdycGMuaGVhbHRoLnYxLkhlYWx0aENoZWNrUmVzcG9uc2UuU2VydmluZ1N0YXR1cyJPCg1TZXJ2aW5nU3RhdHVzEgsKB1VOS05PV04QABILCgdTRVJWSU5HEAESDwoLTk9UX1NFUlZJTkcQAhITCg9TRVJWSUNFX1VOS05PV04QAyITChFIZWFsdGhMaXN0UmVxdWVzdCKuAQoSSGVhbHRoTGlzdFJlc3BvbnNlEkIKCHN0YXR1c2VzGAEgAygLMjAuZ3JwYy5oZWFsdGgudjEuSGVhbHRoTGlzdFJlc3BvbnNlLlN0YXR1c2VzRW50cnkaVAoNU3RhdHVzZXNFbnRyeRILCgNrZXkYASABKAkSMgoFdmFsdWUYAiABKAsyIy5ncnBjLmhlYWx0aC52MS5IZWFsdGhDaGVja1Jlc3BvbnNlOgI4ATL9AQoGSGVhbHRoElAKBUNoZWNrEiIuZ3JwYy5oZWFsdGgudjEuSGVhbHRoQ2hlY2tSZXF1ZXN0GiMuZ3JwYy5oZWFsdGgudjEuSGVhbHRoQ2hlY2tSZXNwb25zZRJNCgRMaXN0EiEuZ3JwYy5oZWFsdGgudjEuSGVhbHRoTGlzdFJlcXVlc3QaIi5ncnBjLmhlYWx0aC52MS5IZWFsdGhMaXN0UmVzcG9uc2USUgoFV2F0Y2gSIi5ncnBjLmhlYWx0aC52MS5IZWFsdGhDaGVja1JlcXVlc3QaIy5ncnBjLmhlYWx0aC52MS5IZWFsdGhDaGVja1Jlc3BvbnNlMAFCcAoRaW8uZ3JwYy5oZWFsdGgudjFCC0hlYWx0aFByb3RvUAFaLGdvb2dsZS5nb2xhbmcub3JnL2dycGMvaGVhbHRoL2dycGNfaGVhbHRoX3YxogIMR3JwY0hlYWx0aFYxqgIOR3JwYy5IZWFsdGguVjFiBnByb3RvMw");
+/**
+ * Describes the message grpc.health.v1.HealthCheckRequest.
+ * Use `create(HealthCheckRequestSchema)` to create a new message.
+ */
+export const HealthCheckRequestSchema = /*@__PURE__*/ messageDesc(file_grpc_health_v1_health, 0);
+/**
+ * Describes the message grpc.health.v1.HealthCheckResponse.
+ * Use `create(HealthCheckResponseSchema)` to create a new message.
+ */
+export const HealthCheckResponseSchema = /*@__PURE__*/ messageDesc(file_grpc_health_v1_health, 1);
+/**
+ * @generated from enum grpc.health.v1.HealthCheckResponse.ServingStatus
+ */
+export var HealthCheckResponse_ServingStatus;
+(function (HealthCheckResponse_ServingStatus) {
+    /**
+     * @generated from enum value: UNKNOWN = 0;
+     */
+    HealthCheckResponse_ServingStatus[HealthCheckResponse_ServingStatus["UNKNOWN"] = 0] = "UNKNOWN";
+    /**
+     * @generated from enum value: SERVING = 1;
+     */
+    HealthCheckResponse_ServingStatus[HealthCheckResponse_ServingStatus["SERVING"] = 1] = "SERVING";
+    /**
+     * @generated from enum value: NOT_SERVING = 2;
+     */
+    HealthCheckResponse_ServingStatus[HealthCheckResponse_ServingStatus["NOT_SERVING"] = 2] = "NOT_SERVING";
+    /**
+     * Used only by the Watch method.
+     *
+     * @generated from enum value: SERVICE_UNKNOWN = 3;
+     */
+    HealthCheckResponse_ServingStatus[HealthCheckResponse_ServingStatus["SERVICE_UNKNOWN"] = 3] = "SERVICE_UNKNOWN";
+})(HealthCheckResponse_ServingStatus || (HealthCheckResponse_ServingStatus = {}));
+/**
+ * Describes the enum grpc.health.v1.HealthCheckResponse.ServingStatus.
+ */
+export const HealthCheckResponse_ServingStatusSchema = /*@__PURE__*/ enumDesc(file_grpc_health_v1_health, 1, 0);
+/**
+ * Describes the message grpc.health.v1.HealthListRequest.
+ * Use `create(HealthListRequestSchema)` to create a new message.
+ */
+export const HealthListRequestSchema = /*@__PURE__*/ messageDesc(file_grpc_health_v1_health, 2);
+/**
+ * Describes the message grpc.health.v1.HealthListResponse.
+ * Use `create(HealthListResponseSchema)` to create a new message.
+ */
+export const HealthListResponseSchema = /*@__PURE__*/ messageDesc(file_grpc_health_v1_health, 3);
+/**
+ * Health is gRPC's mechanism for checking whether a server is able to handle
+ * RPCs. Its semantics are documented in
+ * https://github.com/grpc/grpc/blob/master/doc/health-checking.md.
+ *
+ * @generated from service grpc.health.v1.Health
+ */
+export const Health = /*@__PURE__*/ serviceDesc(file_grpc_health_v1_health, 0);

package/lib/esm/common/node.d.ts

@@ -0,0 +1,3 @@
+import type * as http from "node:http";
+export type NodeHandlerFn = (request: http.IncomingMessage, response: http.ServerResponse) => void;
+export declare const signatureValidation: (next: NodeHandlerFn) => NodeHandlerFn;

package/lib/esm/common/node.js

@@ -0,0 +1,11 @@
+import { keccak_256 } from "@noble/hashes/sha3.js";
+export const signatureValidation = (next) => (req, resp) => {
+    const hasher = keccak_256.create();
+    req.hasher = hasher;
+    req.on("data", (chunk) => {
+        if (chunk instanceof Buffer) {
+            hasher.update(chunk);
+        }
+    });
+    next(req, resp);
+};

package/lib/esm/common/service.d.ts

@@ -0,0 +1,37 @@
+import { ConnectRouter } from "@connectrpc/connect";
+import type { Interceptor } from "@connectrpc/connect";
+import type { DescService, Registry } from "@bufbuild/protobuf";
+import type { ServiceImpl } from "@connectrpc/connect";
+import { type Logger } from "./validation.js";
+export interface CreateServiceOptions {
+    /**
+     * Logger used by the SDK for error-level events (currently:
+     * response-validation failures from the interceptor safety net). The same
+     * logger will be used for any future server-wide SDK log sites.
+     *
+     * If omitted, the SDK logs to `console.error` with a JSON-encoded payload.
+     */
+    logger?: Logger;
+    /**
+     * Protobuf registry for resolving custom protovalidate predefined-rule
+     * extensions. Pass a registry built with `createRegistry(fileDescriptor)`
+     * when your protos define custom predefined rules.
+     */
+    registry?: Registry;
+    /**
+     * SDK version stamped on health-check responses via the `T0-Sdk-Version`
+     * header. Omit to suppress the header.
+     */
+    version?: string;
+}
+export declare const REQUEST_VALIDITY_MILLIS = 60000;
+interface Router {
+    service: <T extends DescService, I extends ServiceImpl<T>>(service: T, implementation: I) => void;
+}
+export declare const createService: (networkPublicKey: string | Buffer, registerRoutes: (router: Router) => void, options?: CreateServiceOptions) => {
+    routes: (router: ConnectRouter) => void;
+    interceptors: Interceptor[];
+    grpcWeb: boolean;
+    contextValues: (req: any) => import("@connectrpc/connect").ContextValues;
+};
+export {};

package/lib/esm/common/service.js

@@ -0,0 +1,78 @@
+import { Code, ConnectError, createContextKey, createContextValues } from "@connectrpc/connect";
+import NetworkHeaders from "./headers.js";
+import { verifySignature } from './crypto/verify.js';
+import { createValidationInterceptor } from "./validation.js";
+import { Health } from "./health_pb.js";
+import { createHealthServiceImpl } from "./health.js";
+export const REQUEST_VALIDITY_MILLIS = 60000;
+const createSignatureVerification = (networkPublicKey) => (next) => async (req) => {
+    const ts = decodeNum(getHeader(req, NetworkHeaders.SignatureTimestamp));
+    if (Date.now() - ts > 60000) {
+        throw new ConnectError(`${NetworkHeaders.SignatureTimestamp} must be within ${REQUEST_VALIDITY_MILLIS} milliseconds from now`, Code.InvalidArgument);
+    }
+    const publicKey = decodeHex(getHeader(req, NetworkHeaders.PublicKey));
+    if (networkPublicKey.compare(publicKey) !== 0) {
+        throw new ConnectError(`${NetworkHeaders.PublicKey} value is not network public key`, Code.Unauthenticated);
+    }
+    const signature = decodeHex(getHeader(req, NetworkHeaders.Signature));
+    const hasher = req.contextValues.get(kHash);
+    const tsBuf = Buffer.alloc(8);
+    tsBuf.writeBigUInt64LE(BigInt(ts)); // 64‑bit little‑endian timestamp
+    const digest = hasher
+        .update(tsBuf)
+        .digest();
+    if (!verifySignature(publicKey, digest, signature)) {
+        throw new ConnectError(`${NetworkHeaders.Signature} has invalid signature`, Code.Unauthenticated);
+    }
+    return await next(req);
+};
+export const createService = (networkPublicKey, registerRoutes, options) => {
+    if (typeof networkPublicKey == "string") {
+        networkPublicKey = decodeHex(networkPublicKey);
+    }
+    return {
+        routes: (router) => {
+            const collected = [];
+            const origService = router.service.bind(router);
+            const wrappedRouter = {
+                service: (desc, impl) => {
+                    collected.push(desc.typeName);
+                    origService(desc, impl);
+                },
+            };
+            registerRoutes(wrappedRouter);
+            collected.push(Health.typeName);
+            origService(Health, createHealthServiceImpl(collected, options?.version));
+        },
+        interceptors: [createSignatureVerification(networkPublicKey), createValidationInterceptor({ logger: options?.logger, registry: options?.registry })],
+        grpcWeb: false,
+        contextValues: (req) => {
+            return createContextValues().set(kHash, req.hasher);
+        }
+    };
+};
+const kHash = createContextKey(undefined);
+function getHeader(req, header) {
+    const raw = req.header.get(header);
+    if (!raw) {
+        throw new ConnectError(`missing required header '${header}'`, Code.InvalidArgument);
+    }
+    return raw;
+}
+function decodeHex(value) {
+    value = value.startsWith('0x') ? value.slice(2) : value;
+    try {
+        return Buffer.from(value, "hex");
+    }
+    catch (e) {
+        throw new ConnectError(`invalid header format. '${value}' must be hex encoded`, Code.InvalidArgument);
+    }
+}
+function decodeNum(value) {
+    try {
+        return parseInt(value);
+    }
+    catch (e) {
+        throw new ConnectError(`invalid header format. '${value}' must be a number`, Code.InvalidArgument);
+    }
+}

package/lib/esm/common/validate.d.ts

@@ -0,0 +1,25 @@
+import type { DescMessage, MessageShape } from "@bufbuild/protobuf";
+/**
+ * Shared protovalidate validator instance for the public {@link validate} helper.
+ * Construction is cheap, but reusing one instance avoids repeated compilation
+ * of the same rules.
+ */
+export declare const validator: import("@bufbuild/protovalidate").Validator;
+/**
+ * Validates a response message against its buf.validate proto annotations.
+ *
+ * On success, returns the message unchanged (typed). On failure, throws a
+ * {@link ConnectError} with {@link Code.Internal} and a message matching the
+ * shape emitted by the SDK's response-validation interceptor — so propagating
+ * the error from a handler produces the same wire response as not calling
+ * `validate` at all.
+ *
+ * Intended use:
+ * ```ts
+ * return validate(PayOutResponseSchema, { result: { case: "accepted", value: {} } });
+ * ```
+ *
+ * Catch the error to convert it into a domain-level failure (e.g. the `Failed`
+ * arm of a `oneof result`) instead of an opaque `Code.Internal`.
+ */
+export declare function validate<Desc extends DescMessage>(schema: Desc, msg: MessageShape<Desc>): MessageShape<Desc>;

package/lib/esm/common/validate.js

@@ -0,0 +1,38 @@
+import { Code, ConnectError } from "@connectrpc/connect";
+import { createValidator } from "@bufbuild/protovalidate";
+/**
+ * Shared protovalidate validator instance for the public {@link validate} helper.
+ * Construction is cheap, but reusing one instance avoids repeated compilation
+ * of the same rules.
+ */
+export const validator = createValidator();
+/**
+ * Validates a response message against its buf.validate proto annotations.
+ *
+ * On success, returns the message unchanged (typed). On failure, throws a
+ * {@link ConnectError} with {@link Code.Internal} and a message matching the
+ * shape emitted by the SDK's response-validation interceptor — so propagating
+ * the error from a handler produces the same wire response as not calling
+ * `validate` at all.
+ *
+ * Intended use:
+ * ```ts
+ * return validate(PayOutResponseSchema, { result: { case: "accepted", value: {} } });
+ * ```
+ *
+ * Catch the error to convert it into a domain-level failure (e.g. the `Failed`
+ * arm of a `oneof result`) instead of an opaque `Code.Internal`.
+ */
+export function validate(schema, msg) {
+    const result = validator.validate(schema, msg);
+    if (result.kind === "invalid") {
+        const details = result.violations
+            .map((v) => `${v.field?.toString() ?? ""}: ${v.message}`)
+            .join("; ");
+        throw new ConnectError(`response validation failed: ${details}`, Code.Internal);
+    }
+    if (result.kind === "error") {
+        throw new ConnectError(`response validation error: ${result.error.message}`, Code.Internal);
+    }
+    return msg;
+}

package/lib/esm/common/validation.d.ts

@@ -0,0 +1,26 @@
+import type { Interceptor } from "@connectrpc/connect";
+import type { Registry } from "@bufbuild/protobuf";
+/**
+ * Minimal logger contract accepted by the SDK. Providers may pass `console`
+ * directly, or adapt their preferred logger (e.g. pino) with:
+ *
+ *   { error: (msg, fields) => pinoInstance.error(fields, msg) }
+ */
+export interface Logger {
+    error(msg: string, fields?: Record<string, unknown>): void;
+}
+export interface ValidationInterceptorOptions {
+    logger?: Logger;
+    registry?: Registry;
+}
+/**
+ * Creates a ConnectRPC interceptor that validates requests and responses
+ * against buf.validate proto annotations.
+ *
+ * Invalid requests return Code.InvalidArgument; invalid responses return
+ * Code.Internal.
+ *
+ * Pass a `registry` when your protos define custom predefined rules
+ * (proto2 `extend buf.validate.*Rules`).
+ */
+export declare function createValidationInterceptor(loggerOrOptions?: Logger | ValidationInterceptorOptions): Interceptor;

package/lib/esm/common/validation.js

@@ -0,0 +1,54 @@
+import { Code, ConnectError } from "@connectrpc/connect";
+import { createValidator } from "@bufbuild/protovalidate";
+import { createValidateInterceptor } from "@connectrpc/validate";
+const defaultLogger = {
+    error: (msg, fields) => 
+    // eslint-disable-next-line no-console
+    console.error(JSON.stringify({ msg, ...(fields ?? {}) })),
+};
+/**
+ * Creates a ConnectRPC interceptor that validates requests and responses
+ * against buf.validate proto annotations.
+ *
+ * Invalid requests return Code.InvalidArgument; invalid responses return
+ * Code.Internal.
+ *
+ * Pass a `registry` when your protos define custom predefined rules
+ * (proto2 `extend buf.validate.*Rules`).
+ */
+export function createValidationInterceptor(loggerOrOptions) {
+    const opts = loggerOrOptions && typeof loggerOrOptions.error === "function"
+        ? { logger: loggerOrOptions }
+        : loggerOrOptions ?? {};
+    const logger = opts.logger ?? defaultLogger;
+    const validator = createValidator(opts.registry ? { registry: opts.registry } : undefined);
+    const requestInterceptor = createValidateInterceptor({ validator });
+    return (next) => async (req) => {
+        const resp = await requestInterceptor(next)(req);
+        const schema = req.method.output;
+        const msg = resp.message;
+        const result = validator.validate(schema, msg);
+        if (result.kind === "invalid") {
+            const violations = result.violations.map((v) => ({
+                field: v.field?.toString() ?? "",
+                message: v.message,
+            }));
+            const details = violations.map((v) => `${v.field}: ${v.message}`).join("; ");
+            logger.error("response validation failed", {
+                rpc_method: `${req.service.typeName}/${req.method.name}`,
+                response_type: schema.typeName,
+                violations,
+            });
+            throw new ConnectError(`response validation failed: ${details}`, Code.Internal);
+        }
+        if (result.kind === "error") {
+            logger.error("response validation error", {
+                rpc_method: `${req.service.typeName}/${req.method.name}`,
+                response_type: schema.typeName,
+                error: result.error.message,
+            });
+            throw new ConnectError(`response validation error: ${result.error.message}`, Code.Internal);
+        }
+        return resp;
+    };
+}

package/lib/esm/crypto/hash.d.ts

@@ -1,2 +1 @@
-export declare function keccak256(...inputs: Uint8Array[]): Buffer;
-export declare function computeDigest(body: Uint8Array, timestampMs: number): Buffer;
+export * from "../common/crypto/hash.js";

package/lib/esm/crypto/hash.js

@@ -1,13 +1 @@
-import { keccak_256 } from '@noble/hashes/sha3.js';
-export function keccak256(...inputs) {
-    const h = keccak_256.create();
-    for (const input of inputs) {
-        h.update(input);
-    }
-    return Buffer.from(h.digest());
-}
-export function computeDigest(body, timestampMs) {
-    const tsBuf = Buffer.alloc(8);
-    tsBuf.writeBigUInt64LE(BigInt(timestampMs));
-    return keccak256(body, tsBuf);
-}
+export * from "../common/crypto/hash.js";

package/lib/esm/crypto/index.d.ts

@@ -1,5 +1 @@
-export { verifySignature } from './verify.js';
-export { keccak256, computeDigest } from './hash.js';
-export { parsePublicKey, publicKeysEqual } from './keys.js';
-export { createRequestVerifier, DEFAULT_TOLERANCE_MS } from './request.js';
-export type { CreateVerifierOptions, VerifyRequest, VerifyRequestResult, VerifyRequestFailure, RequestVerifier } from './request.js';
+export * from "../common/crypto/index.js";

package/lib/esm/crypto/index.js

@@ -1,4 +1 @@
-export { verifySignature } from './verify.js';
-export { keccak256, computeDigest } from './hash.js';
-export { parsePublicKey, publicKeysEqual } from './keys.js';
-export { createRequestVerifier, DEFAULT_TOLERANCE_MS } from './request.js';
+export * from "../common/crypto/index.js";

package/lib/esm/crypto/keys.d.ts

@@ -1,2 +1 @@
-export declare function parsePublicKey(key: string | Buffer): Buffer;
-export declare function publicKeysEqual(a: Uint8Array, b: Uint8Array): boolean;
+export * from "../common/crypto/keys.js";