@t-0/provider-sdk 1.1.29 → 1.1.30

package/lib/esm/crypto/keys.js

@@ -1,15 +1 @@
-export function parsePublicKey(key) {
-    if (typeof key === 'string') {
-        key = Buffer.from(key.startsWith('0x') ? key.slice(2) : key, 'hex');
-    }
-    if (key.length !== 65 || key[0] !== 0x04) {
-        throw new Error('Public key must be 65 bytes in uncompressed format (0x04 prefix)');
-    }
-    return Buffer.from(key);
-}
-export function publicKeysEqual(a, b) {
-    if (a.length !== b.length) {
-        return false;
-    }
-    return Buffer.from(a).compare(Buffer.from(b)) === 0;
-}
+export * from "../common/crypto/keys.js";

package/lib/esm/crypto/request.d.ts

@@ -1,20 +1 @@
-export declare const DEFAULT_TOLERANCE_MS = 60000;
-export interface CreateVerifierOptions {
-    networkPublicKey: string | Buffer;
-    toleranceMs?: number;
-}
-export interface VerifyRequest {
-    body: Uint8Array;
-    signatureHeader: string;
-    publicKeyHeader: string;
-    timestampHeader: string;
-}
-export type VerifyRequestFailure = 'invalid_timestamp' | 'timestamp_out_of_range' | 'invalid_public_key' | 'unknown_public_key' | 'invalid_signature_format' | 'signature_failed';
-export type VerifyRequestResult = {
-    valid: true;
-} | {
-    valid: false;
-    reason: VerifyRequestFailure;
-};
-export type RequestVerifier = (req: VerifyRequest) => VerifyRequestResult;
-export declare function createRequestVerifier(opts: CreateVerifierOptions): RequestVerifier;
+export * from "../common/crypto/request.js";

package/lib/esm/crypto/request.js

@@ -1,45 +1 @@
-import { verifySignature } from './verify.js';
-import { computeDigest } from './hash.js';
-import { parsePublicKey, publicKeysEqual } from './keys.js';
-export const DEFAULT_TOLERANCE_MS = 60000;
-export function createRequestVerifier(opts) {
-    const networkKey = parsePublicKey(opts.networkPublicKey);
-    const tolerance = opts.toleranceMs ?? DEFAULT_TOLERANCE_MS;
-    return (req) => {
-        const ts = parseInt(req.timestampHeader, 10);
-        if (!Number.isFinite(ts) || ts < 0) {
-            return { valid: false, reason: 'invalid_timestamp' };
-        }
-        if (Math.abs(Date.now() - ts) > tolerance) {
-            return { valid: false, reason: 'timestamp_out_of_range' };
-        }
-        let publicKey;
-        try {
-            publicKey = parsePublicKey(req.publicKeyHeader);
-        }
-        catch {
-            return { valid: false, reason: 'invalid_public_key' };
-        }
-        if (!publicKeysEqual(publicKey, networkKey)) {
-            return { valid: false, reason: 'unknown_public_key' };
-        }
-        let signature;
-        try {
-            const hex = req.signatureHeader.startsWith('0x')
-                ? req.signatureHeader.slice(2)
-                : req.signatureHeader;
-            signature = Buffer.from(hex, 'hex');
-        }
-        catch {
-            return { valid: false, reason: 'invalid_signature_format' };
-        }
-        if (signature.length !== 64 && signature.length !== 65) {
-            return { valid: false, reason: 'invalid_signature_format' };
-        }
-        const digest = computeDigest(req.body, ts);
-        if (!verifySignature(publicKey, digest, signature)) {
-            return { valid: false, reason: 'signature_failed' };
-        }
-        return { valid: true };
-    };
-}
+export * from "../common/crypto/request.js";

package/lib/esm/crypto/verify.d.ts

@@ -1 +1 @@
-export declare function verifySignature(publicKey: Uint8Array, digest: Uint8Array, signature: Uint8Array): boolean;
+export * from "../common/crypto/verify.js";

package/lib/esm/crypto/verify.js

@@ -1,16 +1 @@
-import { secp256k1 } from '@noble/curves/secp256k1.js';
-export function verifySignature(publicKey, digest, signature) {
-    if (digest.length !== 32) {
-        return false;
-    }
-    if (signature.length !== 64 && signature.length !== 65) {
-        return false;
-    }
-    const sig64 = signature.length === 65 ? signature.subarray(0, 64) : signature;
-    try {
-        return secp256k1.verify(sig64, digest, publicKey, { prehash: false });
-    }
-    catch {
-        return false;
-    }
-}
+export * from "../common/crypto/verify.js";

package/lib/esm/index.d.ts

@@ -1,6 +1,7 @@
 export * from "./crypto/index.js";
 export * from "./client/client.js";
 export * from "./service/service.js";
+export * from "./common/validation.js";
 export * from "./service/validate_response.js";
 export * from "./service/validate.js";
 export * from "./service/node.js";

package/lib/esm/index.js

@@ -1,6 +1,7 @@
 export * from "./crypto/index.js";
 export * from "./client/client.js";
 export * from "./service/service.js";
+export * from "./common/validation.js";
 export * from "./service/validate_response.js";
 export * from "./service/validate.js";
 export * from "./service/node.js";

package/lib/esm/service/health.d.ts

@@ -1,21 +1,4 @@
-import { type ServiceImpl } from "@connectrpc/connect";
-import { Health } from "./health_pb.js";
-/**
- * Headers carrying the identity of the SDK answering the probe. They ride on
- * the health response and nowhere else: `HealthCheckResponse` has a single
- * status field and `check` names its service in the request, so the contract
- * itself has no room for this — and taxing every callback with headers only the
- * probe reads would be worse.
- */
-export declare const SDK_ECOSYSTEM_HEADER = "T0-Sdk-Ecosystem";
-export declare const SDK_VERSION_HEADER = "T0-Sdk-Version";
-/**
- * Reports SERVING for the services registered on this server and NOT_FOUND for
- * anything else. The set is frozen at registration; nothing is computed per
- * request.
- *
- * `watch` is absent on purpose: it is server-streaming, and the body-hash
- * signature scheme these servers run behind has no story for streams. Omitting
- * it from a partial `ServiceImpl` makes connect-es answer UNIMPLEMENTED.
- */
-export declare const createHealthServiceImpl: (services: string[]) => Partial<ServiceImpl<typeof Health>>;
+import type { ServiceImpl } from "@connectrpc/connect";
+import type { Health } from "../common/health_pb.js";
+export { SDK_ECOSYSTEM_HEADER, SDK_VERSION_HEADER } from "../common/health.js";
+export declare const createHealthServiceImpl: (services: string[], version?: string) => Partial<ServiceImpl<typeof Health>>;

package/lib/esm/service/health.js

@@ -1,42 +1,4 @@
-import { create } from "@bufbuild/protobuf";
-import { Code, ConnectError } from "@connectrpc/connect";
-import { HealthCheckResponse_ServingStatus, HealthCheckResponseSchema, } from "./health_pb.js";
+import { createHealthServiceImpl as createHealthServiceImplCommon } from "../common/health.js";
 import { SDK_VERSION } from "../version.js";
-/**
- * Headers carrying the identity of the SDK answering the probe. They ride on
- * the health response and nowhere else: `HealthCheckResponse` has a single
- * status field and `check` names its service in the request, so the contract
- * itself has no room for this — and taxing every callback with headers only the
- * probe reads would be worse.
- */
-export const SDK_ECOSYSTEM_HEADER = "T0-Sdk-Ecosystem";
-export const SDK_VERSION_HEADER = "T0-Sdk-Version";
-const SDK_ECOSYSTEM = "node";
-/**
- * Reports SERVING for the services registered on this server and NOT_FOUND for
- * anything else. The set is frozen at registration; nothing is computed per
- * request.
- *
- * `watch` is absent on purpose: it is server-streaming, and the body-hash
- * signature scheme these servers run behind has no story for streams. Omitting
- * it from a partial `ServiceImpl` makes connect-es answer UNIMPLEMENTED.
- */
-export const createHealthServiceImpl = (services) => {
-    const registered = new Set(services);
-    const serving = create(HealthCheckResponseSchema, {
-        status: HealthCheckResponse_ServingStatus.SERVING,
-    });
-    return {
-        check(req, ctx) {
-            ctx.responseHeader.set(SDK_ECOSYSTEM_HEADER, SDK_ECOSYSTEM);
-            ctx.responseHeader.set(SDK_VERSION_HEADER, SDK_VERSION);
-            const { service } = req;
-            // An empty service name asks about the process as a whole, which is up if
-            // this handler is running at all.
-            if (service !== "" && !registered.has(service)) {
-                throw new ConnectError(`unknown service '${service}'`, Code.NotFound);
-            }
-            return serving;
-        },
-    };
-};
+export { SDK_ECOSYSTEM_HEADER, SDK_VERSION_HEADER } from "../common/health.js";
+export const createHealthServiceImpl = (services, version) => createHealthServiceImplCommon(services, version ?? SDK_VERSION);

package/lib/esm/service/health_pb.d.ts

@@ -1,157 +1 @@
-import type { GenEnum, GenFile, GenMessage, GenService } from "@bufbuild/protobuf/codegenv2";
-import type { Message } from "@bufbuild/protobuf";
-/**
- * Describes the file grpc/health/v1/health.proto.
- */
-export declare const file_grpc_health_v1_health: GenFile;
-/**
- * @generated from message grpc.health.v1.HealthCheckRequest
- */
-export type HealthCheckRequest = Message<"grpc.health.v1.HealthCheckRequest"> & {
-    /**
-     * @generated from field: string service = 1;
-     */
-    service: string;
-};
-/**
- * Describes the message grpc.health.v1.HealthCheckRequest.
- * Use `create(HealthCheckRequestSchema)` to create a new message.
- */
-export declare const HealthCheckRequestSchema: GenMessage<HealthCheckRequest>;
-/**
- * @generated from message grpc.health.v1.HealthCheckResponse
- */
-export type HealthCheckResponse = Message<"grpc.health.v1.HealthCheckResponse"> & {
-    /**
-     * @generated from field: grpc.health.v1.HealthCheckResponse.ServingStatus status = 1;
-     */
-    status: HealthCheckResponse_ServingStatus;
-};
-/**
- * Describes the message grpc.health.v1.HealthCheckResponse.
- * Use `create(HealthCheckResponseSchema)` to create a new message.
- */
-export declare const HealthCheckResponseSchema: GenMessage<HealthCheckResponse>;
-/**
- * @generated from enum grpc.health.v1.HealthCheckResponse.ServingStatus
- */
-export declare enum HealthCheckResponse_ServingStatus {
-    /**
-     * @generated from enum value: UNKNOWN = 0;
-     */
-    UNKNOWN = 0,
-    /**
-     * @generated from enum value: SERVING = 1;
-     */
-    SERVING = 1,
-    /**
-     * @generated from enum value: NOT_SERVING = 2;
-     */
-    NOT_SERVING = 2,
-    /**
-     * Used only by the Watch method.
-     *
-     * @generated from enum value: SERVICE_UNKNOWN = 3;
-     */
-    SERVICE_UNKNOWN = 3
-}
-/**
- * Describes the enum grpc.health.v1.HealthCheckResponse.ServingStatus.
- */
-export declare const HealthCheckResponse_ServingStatusSchema: GenEnum<HealthCheckResponse_ServingStatus>;
-/**
- * @generated from message grpc.health.v1.HealthListRequest
- */
-export type HealthListRequest = Message<"grpc.health.v1.HealthListRequest"> & {};
-/**
- * Describes the message grpc.health.v1.HealthListRequest.
- * Use `create(HealthListRequestSchema)` to create a new message.
- */
-export declare const HealthListRequestSchema: GenMessage<HealthListRequest>;
-/**
- * @generated from message grpc.health.v1.HealthListResponse
- */
-export type HealthListResponse = Message<"grpc.health.v1.HealthListResponse"> & {
-    /**
-     * statuses contains all the services and their respective status.
-     *
-     * @generated from field: map<string, grpc.health.v1.HealthCheckResponse> statuses = 1;
-     */
-    statuses: {
-        [key: string]: HealthCheckResponse;
-    };
-};
-/**
- * Describes the message grpc.health.v1.HealthListResponse.
- * Use `create(HealthListResponseSchema)` to create a new message.
- */
-export declare const HealthListResponseSchema: GenMessage<HealthListResponse>;
-/**
- * Health is gRPC's mechanism for checking whether a server is able to handle
- * RPCs. Its semantics are documented in
- * https://github.com/grpc/grpc/blob/master/doc/health-checking.md.
- *
- * @generated from service grpc.health.v1.Health
- */
-export declare const Health: GenService<{
-    /**
-     * Check gets the health of the specified service. If the requested service
-     * is unknown, the call will fail with status NOT_FOUND. If the caller does
-     * not specify a service name, the server should respond with its overall
-     * health status.
-     *
-     * Clients should set a deadline when calling Check, and can declare the
-     * server unhealthy if they do not receive a timely response.
-     *
-     * @generated from rpc grpc.health.v1.Health.Check
-     */
-    check: {
-        methodKind: "unary";
-        input: typeof HealthCheckRequestSchema;
-        output: typeof HealthCheckResponseSchema;
-    };
-    /**
-     * List provides a non-atomic snapshot of the health of all the available
-     * services.
-     *
-     * The server may respond with a RESOURCE_EXHAUSTED error if too many services
-     * exist.
-     *
-     * Clients should set a deadline when calling List, and can declare the server
-     * unhealthy if they do not receive a timely response.
-     *
-     * Clients should keep in mind that the list of health services exposed by an
-     * application can change over the lifetime of the process.
-     *
-     * @generated from rpc grpc.health.v1.Health.List
-     */
-    list: {
-        methodKind: "unary";
-        input: typeof HealthListRequestSchema;
-        output: typeof HealthListResponseSchema;
-    };
-    /**
-     * Performs a watch for the serving status of the requested service.
-     * The server will immediately send back a message indicating the current
-     * serving status.  It will then subsequently send a new message whenever
-     * the service's serving status changes.
-     *
-     * If the requested service is unknown when the call is received, the
-     * server will send a message setting the serving status to
-     * SERVICE_UNKNOWN but will *not* terminate the call.  If at some
-     * future point, the serving status of the service becomes known, the
-     * server will send a new message with the service's serving status.
-     *
-     * If the call terminates with status UNIMPLEMENTED, then clients
-     * should assume this method is not supported and should not retry the
-     * call.  If the call terminates with any other status (including OK),
-     * clients should retry the call with appropriate exponential backoff.
-     *
-     * @generated from rpc grpc.health.v1.Health.Watch
-     */
-    watch: {
-        methodKind: "server_streaming";
-        input: typeof HealthCheckRequestSchema;
-        output: typeof HealthCheckResponseSchema;
-    };
-}>;
+export * from "../common/health_pb.js";

package/lib/esm/service/health_pb.js

@@ -1,87 +1 @@
-// Vendored generated stubs for grpc.health.v1 -- do not edit by hand.
-//
-// Source:   buf.build/grpc/grpc, grpc/health/v1/health.proto
-// Plugin:   buf.build/bufbuild/es:v2.12.0 (kept in step with the root
-//           buf.gen.yaml pin -- plugin and @bufbuild/protobuf runtime must
-//           agree on major).
-//
-// Regenerate with the following, which keeps this header and replaces
-// everything from the gRPC copyright line down. Do not just `mv` the generated
-// file over this one -- that would delete these instructions along with it.
-//
-//   cd node/sdk
-//   buf generate buf.build/grpc/grpc --path grpc/health/v1/health.proto \
-//     --template '{"version":"v2","plugins":[{"remote":"buf.build/bufbuild/es:v2.12.0","out":"gen-health","opt":["target=ts","import_extension=js"]}]}'
-//   sed '/^\/\/ Copyright 2015 The gRPC Authors/,$d' src/service/health_pb.ts > gen-health/header
-//   cat gen-health/header gen-health/grpc/health/v1/health_pb.ts > src/service/health_pb.ts
-//   rm -rf gen-health
-//
-// Vendored rather than depended on: the equivalent package
-// `@buf/grpc_grpc.bufbuild_es` is published only on the Buf Schema Registry, and
-// reaching it needs registry config that a published npm package cannot hand its
-// consumers -- so depending on it 404'd every downstream install. Rationale in
-// docs/HEALTH_SERVICE.md.
-//
-// Lives under src/service/ rather than src/common/gen/ so the transport keeps
-// importing nothing from common/gen.
-import { enumDesc, fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
-/**
- * Describes the file grpc/health/v1/health.proto.
- */
-export const file_grpc_health_v1_health = /*@__PURE__*/ fileDesc("ChtncnBjL2hlYWx0aC92MS9oZWFsdGgucHJvdG8SDmdycGMuaGVhbHRoLnYxIiUKEkhlYWx0aENoZWNrUmVxdWVzdBIPCgdzZXJ2aWNlGAEgASgJIqkBChNIZWFsdGhDaGVja1Jlc3BvbnNlEkEKBnN0YXR1cxgBIAEoDjIxLmdycGMuaGVhbHRoLnYxLkhlYWx0aENoZWNrUmVzcG9uc2UuU2VydmluZ1N0YXR1cyJPCg1TZXJ2aW5nU3RhdHVzEgsKB1VOS05PV04QABILCgdTRVJWSU5HEAESDwoLTk9UX1NFUlZJTkcQAhITCg9TRVJWSUNFX1VOS05PV04QAyITChFIZWFsdGhMaXN0UmVxdWVzdCKuAQoSSGVhbHRoTGlzdFJlc3BvbnNlEkIKCHN0YXR1c2VzGAEgAygLMjAuZ3JwYy5oZWFsdGgudjEuSGVhbHRoTGlzdFJlc3BvbnNlLlN0YXR1c2VzRW50cnkaVAoNU3RhdHVzZXNFbnRyeRILCgNrZXkYASABKAkSMgoFdmFsdWUYAiABKAsyIy5ncnBjLmhlYWx0aC52MS5IZWFsdGhDaGVja1Jlc3BvbnNlOgI4ATL9AQoGSGVhbHRoElAKBUNoZWNrEiIuZ3JwYy5oZWFsdGgudjEuSGVhbHRoQ2hlY2tSZXF1ZXN0GiMuZ3JwYy5oZWFsdGgudjEuSGVhbHRoQ2hlY2tSZXNwb25zZRJNCgRMaXN0EiEuZ3JwYy5oZWFsdGgudjEuSGVhbHRoTGlzdFJlcXVlc3QaIi5ncnBjLmhlYWx0aC52MS5IZWFsdGhMaXN0UmVzcG9uc2USUgoFV2F0Y2gSIi5ncnBjLmhlYWx0aC52MS5IZWFsdGhDaGVja1JlcXVlc3QaIy5ncnBjLmhlYWx0aC52MS5IZWFsdGhDaGVja1Jlc3BvbnNlMAFCcAoRaW8uZ3JwYy5oZWFsdGgudjFCC0hlYWx0aFByb3RvUAFaLGdvb2dsZS5nb2xhbmcub3JnL2dycGMvaGVhbHRoL2dycGNfaGVhbHRoX3YxogIMR3JwY0hlYWx0aFYxqgIOR3JwYy5IZWFsdGguVjFiBnByb3RvMw");
-/**
- * Describes the message grpc.health.v1.HealthCheckRequest.
- * Use `create(HealthCheckRequestSchema)` to create a new message.
- */
-export const HealthCheckRequestSchema = /*@__PURE__*/ messageDesc(file_grpc_health_v1_health, 0);
-/**
- * Describes the message grpc.health.v1.HealthCheckResponse.
- * Use `create(HealthCheckResponseSchema)` to create a new message.
- */
-export const HealthCheckResponseSchema = /*@__PURE__*/ messageDesc(file_grpc_health_v1_health, 1);
-/**
- * @generated from enum grpc.health.v1.HealthCheckResponse.ServingStatus
- */
-export var HealthCheckResponse_ServingStatus;
-(function (HealthCheckResponse_ServingStatus) {
-    /**
-     * @generated from enum value: UNKNOWN = 0;
-     */
-    HealthCheckResponse_ServingStatus[HealthCheckResponse_ServingStatus["UNKNOWN"] = 0] = "UNKNOWN";
-    /**
-     * @generated from enum value: SERVING = 1;
-     */
-    HealthCheckResponse_ServingStatus[HealthCheckResponse_ServingStatus["SERVING"] = 1] = "SERVING";
-    /**
-     * @generated from enum value: NOT_SERVING = 2;
-     */
-    HealthCheckResponse_ServingStatus[HealthCheckResponse_ServingStatus["NOT_SERVING"] = 2] = "NOT_SERVING";
-    /**
-     * Used only by the Watch method.
-     *
-     * @generated from enum value: SERVICE_UNKNOWN = 3;
-     */
-    HealthCheckResponse_ServingStatus[HealthCheckResponse_ServingStatus["SERVICE_UNKNOWN"] = 3] = "SERVICE_UNKNOWN";
-})(HealthCheckResponse_ServingStatus || (HealthCheckResponse_ServingStatus = {}));
-/**
- * Describes the enum grpc.health.v1.HealthCheckResponse.ServingStatus.
- */
-export const HealthCheckResponse_ServingStatusSchema = /*@__PURE__*/ enumDesc(file_grpc_health_v1_health, 1, 0);
-/**
- * Describes the message grpc.health.v1.HealthListRequest.
- * Use `create(HealthListRequestSchema)` to create a new message.
- */
-export const HealthListRequestSchema = /*@__PURE__*/ messageDesc(file_grpc_health_v1_health, 2);
-/**
- * Describes the message grpc.health.v1.HealthListResponse.
- * Use `create(HealthListResponseSchema)` to create a new message.
- */
-export const HealthListResponseSchema = /*@__PURE__*/ messageDesc(file_grpc_health_v1_health, 3);
-/**
- * Health is gRPC's mechanism for checking whether a server is able to handle
- * RPCs. Its semantics are documented in
- * https://github.com/grpc/grpc/blob/master/doc/health-checking.md.
- *
- * @generated from service grpc.health.v1.Health
- */
-export const Health = /*@__PURE__*/ serviceDesc(file_grpc_health_v1_health, 0);
+export * from "../common/health_pb.js";

package/lib/esm/service/node.d.ts

@@ -1,3 +1 @@
-import type * as http from "node:http";
-export type NodeHandlerFn = (request: http.IncomingMessage, response: http.ServerResponse) => void;
-export declare const signatureValidation: (next: NodeHandlerFn) => NodeHandlerFn;
+export * from "../common/node.js";

package/lib/esm/service/node.js

@@ -1,11 +1 @@
-import { keccak_256 } from "@noble/hashes/sha3.js";
-export const signatureValidation = (next) => (req, resp) => {
-    const hasher = keccak_256.create();
-    req.hasher = hasher;
-    req.on("data", (chunk) => {
-        if (chunk instanceof Buffer) {
-            hasher.update(chunk);
-        }
-    });
-    next(req, resp);
-};
+export * from "../common/node.js";

package/lib/esm/service/service.d.ts

@@ -1,26 +1,12 @@
-import { ConnectRouter } from "@connectrpc/connect";
-import type { Interceptor } from "@connectrpc/connect";
-import type { DescService } from "@bufbuild/protobuf";
-import type { ServiceImpl } from "@connectrpc/connect";
-import { type Logger } from "./validate_response.js";
-export interface CreateServiceOptions {
-    /**
-     * Logger used by the SDK for error-level events (currently:
-     * response-validation failures from the interceptor safety net). The same
-     * logger will be used for any future server-wide SDK log sites.
-     *
-     * If omitted, the SDK logs to `console.error` with a JSON-encoded payload.
-     */
-    logger?: Logger;
-}
-export declare const REQUEST_VALIDITY_MILLIS = 60000;
+import { type CreateServiceOptions } from "../common/service.js";
+export type { CreateServiceOptions } from "../common/service.js";
+export { REQUEST_VALIDITY_MILLIS } from "../common/service.js";
 interface Router {
-    service: <T extends DescService, I extends ServiceImpl<T>>(service: T, implementation: I) => void;
+    service: <T extends import("@bufbuild/protobuf").DescService, I extends import("@connectrpc/connect").ServiceImpl<T>>(service: T, implementation: I) => void;
 }
 export declare const createService: (networkPublicKey: string | Buffer, registerRoutes: (router: Router) => void, options?: CreateServiceOptions) => {
-    routes: (router: ConnectRouter) => void;
-    interceptors: Interceptor[];
+    routes: (router: import("@connectrpc/connect").ConnectRouter) => void;
+    interceptors: import("@connectrpc/connect").Interceptor[];
     grpcWeb: boolean;
     contextValues: (req: any) => import("@connectrpc/connect").ContextValues;
 };
-export {};

package/lib/esm/service/service.js

@@ -1,81 +1,4 @@
-import { Code, ConnectError, createContextKey, createContextValues } from "@connectrpc/connect";
-import NetworkHeaders from "../common/headers.js";
-import { verifySignature } from '../crypto/verify.js';
-import { createValidationInterceptor } from "./validate_response.js";
-import { Health } from "./health_pb.js";
-import { createHealthServiceImpl } from "./health.js";
-export const REQUEST_VALIDITY_MILLIS = 60000;
-const createSignatureVerification = (networkPublicKey) => (next) => async (req) => {
-    const ts = decodeNum(getHeader(req, NetworkHeaders.SignatureTimestamp));
-    if (Date.now() - ts > 60000) {
-        throw new ConnectError(`${NetworkHeaders.SignatureTimestamp} must be within ${REQUEST_VALIDITY_MILLIS} milliseconds from now`, Code.InvalidArgument);
-    }
-    const publicKey = decodeHex(getHeader(req, NetworkHeaders.PublicKey));
-    if (networkPublicKey.compare(publicKey) !== 0) {
-        throw new ConnectError(`${NetworkHeaders.PublicKey} value is not network public key`, Code.Unauthenticated);
-    }
-    const signature = decodeHex(getHeader(req, NetworkHeaders.Signature));
-    const hasher = req.contextValues.get(kHash);
-    const tsBuf = Buffer.alloc(8);
-    tsBuf.writeBigUInt64LE(BigInt(ts)); // 64‑bit little‑endian timestamp
-    const digest = hasher
-        .update(tsBuf)
-        .digest();
-    if (!verifySignature(publicKey, digest, signature)) {
-        throw new ConnectError(`${NetworkHeaders.Signature} has invalid signature`, Code.Unauthenticated);
-    }
-    return await next(req);
-};
-export const createService = (networkPublicKey, registerRoutes, options) => {
-    if (typeof networkPublicKey == "string") {
-        networkPublicKey = decodeHex(networkPublicKey);
-    }
-    return {
-        routes: (router) => {
-            const collected = [];
-            const origService = router.service.bind(router);
-            const wrappedRouter = {
-                service: (desc, impl) => {
-                    collected.push(desc.typeName);
-                    origService(desc, impl);
-                },
-            };
-            registerRoutes(wrappedRouter);
-            // Health is the only service this transport mounts on its own — see
-            // docs/HEALTH_SERVICE.md. Same interceptors as everything else, so the
-            // probe is signed like any other call.
-            collected.push(Health.typeName);
-            origService(Health, createHealthServiceImpl(collected));
-        },
-        interceptors: [createSignatureVerification(networkPublicKey), createValidationInterceptor(options?.logger)],
-        grpcWeb: false,
-        contextValues: (req) => {
-            return createContextValues().set(kHash, req.hasher);
-        }
-    };
-};
-const kHash = createContextKey(undefined);
-function getHeader(req, header) {
-    const raw = req.header.get(header);
-    if (!raw) {
-        throw new ConnectError(`missing required header '${header}'`, Code.InvalidArgument);
-    }
-    return raw;
-}
-function decodeHex(value) {
-    value = value.startsWith('0x') ? value.slice(2) : value;
-    try {
-        return Buffer.from(value, "hex");
-    }
-    catch (e) {
-        throw new ConnectError(`invalid header format. '${value}' must be hex encoded`, Code.InvalidArgument);
-    }
-}
-function decodeNum(value) {
-    try {
-        return parseInt(value);
-    }
-    catch (e) {
-        throw new ConnectError(`invalid header format. '${value}' must be a number`, Code.InvalidArgument);
-    }
-}
+import { createService as createServiceCommon } from "../common/service.js";
+import { SDK_VERSION } from "../version.js";
+export { REQUEST_VALIDITY_MILLIS } from "../common/service.js";
+export const createService = (networkPublicKey, registerRoutes, options) => createServiceCommon(networkPublicKey, registerRoutes, { ...options, version: options?.version ?? SDK_VERSION });

package/lib/esm/service/validate.d.ts

@@ -1,25 +1 @@
-import type { DescMessage, MessageShape } from "@bufbuild/protobuf";
-/**
- * Shared protovalidate validator instance for the public {@link validate} helper.
- * Construction is cheap, but reusing one instance avoids repeated compilation
- * of the same rules.
- */
-export declare const validator: import("@bufbuild/protovalidate").Validator;
-/**
- * Validates a response message against its buf.validate proto annotations.
- *
- * On success, returns the message unchanged (typed). On failure, throws a
- * {@link ConnectError} with {@link Code.Internal} and a message matching the
- * shape emitted by the SDK's response-validation interceptor — so propagating
- * the error from a handler produces the same wire response as not calling
- * `validate` at all.
- *
- * Intended use:
- * ```ts
- * return validate(PayOutResponseSchema, { result: { case: "accepted", value: {} } });
- * ```
- *
- * Catch the error to convert it into a domain-level failure (e.g. the `Failed`
- * arm of a `oneof result`) instead of an opaque `Code.Internal`.
- */
-export declare function validate<Desc extends DescMessage>(schema: Desc, msg: MessageShape<Desc>): MessageShape<Desc>;
+export * from "../common/validate.js";

package/lib/esm/service/validate.js

@@ -1,38 +1 @@
-import { Code, ConnectError } from "@connectrpc/connect";
-import { createValidator } from "@bufbuild/protovalidate";
-/**
- * Shared protovalidate validator instance for the public {@link validate} helper.
- * Construction is cheap, but reusing one instance avoids repeated compilation
- * of the same rules.
- */
-export const validator = createValidator();
-/**
- * Validates a response message against its buf.validate proto annotations.
- *
- * On success, returns the message unchanged (typed). On failure, throws a
- * {@link ConnectError} with {@link Code.Internal} and a message matching the
- * shape emitted by the SDK's response-validation interceptor — so propagating
- * the error from a handler produces the same wire response as not calling
- * `validate` at all.
- *
- * Intended use:
- * ```ts
- * return validate(PayOutResponseSchema, { result: { case: "accepted", value: {} } });
- * ```
- *
- * Catch the error to convert it into a domain-level failure (e.g. the `Failed`
- * arm of a `oneof result`) instead of an opaque `Code.Internal`.
- */
-export function validate(schema, msg) {
-    const result = validator.validate(schema, msg);
-    if (result.kind === "invalid") {
-        const details = result.violations
-            .map((v) => `${v.field?.toString() ?? ""}: ${v.message}`)
-            .join("; ");
-        throw new ConnectError(`response validation failed: ${details}`, Code.Internal);
-    }
-    if (result.kind === "error") {
-        throw new ConnectError(`response validation error: ${result.error.message}`, Code.Internal);
-    }
-    return msg;
-}
+export * from "../common/validate.js";