@t-0/provider-sdk 1.1.36 → 1.1.37

package/README.md

@@ -74,55 +74,82 @@ const server = http.createServer(
 `signatureValidation` captures raw request bytes for hashing, `nodeAdapter` bridges the RPC transport to Node.js HTTP, and `createService` registers your handlers with signature verification.
 </details>
 
-### Standalone Signature Verification
+### Standalone Request Decoding
 
-For frameworks that don't use Node's `http.createServer` (Effect, Koa, Fastify, etc.), use `createRequestVerifier` to verify inbound requests with just the raw body bytes and headers:
+For frameworks that don't use Node's `http.createServer` (Hono, Effect, Koa, Fastify, etc.), use `createRequestDecoder` for one-call signature verification + Content-Type-aware decoding + protovalidation. It returns an either-type result: success with the decoded message and a response encoder, or failure with a ready-to-send HTTP error.
 
 ```ts
-import { fromBinary, toBinary } from "@bufbuild/protobuf";
-import { createRequestVerifier, rejectRequest, PayoutRequestSchema, PayoutResponseSchema } from "@t-0/provider-sdk";
+import { createRequestDecoder, PayoutRequestSchema, PayoutResponseSchema } from "@t-0/provider-sdk";
 
-const verify = createRequestVerifier({
+const decode = createRequestDecoder({
   networkPublicKey: process.env.NETWORK_PUBLIC_KEY!,
 });
 
-// In your framework's request handler:
-function handleRequest(rawBody: Uint8Array, headers: Record<string, string>) {
-  const result = verify({
-    body: rawBody,
-    signatureHeader: headers["x-signature"],
-    publicKeyHeader: headers["x-public-key"],
-    timestampHeader: headers["x-signature-timestamp"],
-  });
+// Hono / fetch-shaped framework — route by Connect procedure path:
+app.post("/tzero.v1.payment.ProviderService/PayOut", async (c) => {
+  const body = new Uint8Array(await c.req.arrayBuffer());
+  const result = decode(PayoutRequestSchema, { body, headers: c.req.raw.headers });
 
-  if (!result.valid) {
-    // rejectRequest maps the failure reason to a well-formed HTTP error
-    // with status (400 or 401), Content-Type header, and JSON body.
-    const rejected = rejectRequest(result.reason);
-    return errorResponse(rejected.status, rejected.headers, rejected.body);
+  if (!result.ok) {
+    return new Response(result.error.body, {
+      status: result.error.status,
+      headers: result.error.headers,
+    });
   }
 
-  // Deserialize the Protobuf request (same raw bytes you verified)
-  const request = fromBinary(PayoutRequestSchema, rawBody);
-  const response = handlePayout(request);
+  const response = await handlePayout(result.request);
+
+  // encodeResponse validates + encodes in the matching wire format (JSON or proto)
+  const wire = result.encodeResponse(PayoutResponseSchema, response);
+  return new Response(wire.body, { status: wire.status, headers: wire.headers });
+});
+```
+
+```ts
+// Raw Node http example:
+import http from "node:http";
+import { createRequestDecoder, PayoutRequestSchema, PayoutResponseSchema } from "@t-0/provider-sdk";
+
+const decode = createRequestDecoder({
+  networkPublicKey: process.env.NETWORK_PUBLIC_KEY!,
+});
 
-  // Serialize the Protobuf response
-  return successResponse(toBinary(PayoutResponseSchema, response), {
-    "content-type": "application/proto",
+http.createServer((req, res) => {
+  const chunks: Buffer[] = [];
+  req.on("data", (c) => chunks.push(c));
+  req.on("end", async () => {
+    const body = Buffer.concat(chunks);
+    const result = decode(PayoutRequestSchema, { body, headers: req.headers });
+
+    if (!result.ok) {
+      res.writeHead(result.error.status, result.error.headers);
+      res.end(result.error.body);
+      return;
+    }
+
+    const response = await handlePayout(result.request);
+    const wire = result.encodeResponse(PayoutResponseSchema, response);
+    res.writeHead(wire.status, wire.headers);
+    res.end(wire.body);
   });
-}
+}).listen(3000);
 ```
 
-The lower-level primitives are also exported individually: `verifySignature`, `computeDigest`, `keccak256`, `parsePublicKey`, `publicKeysEqual`. You can also import just the crypto module via the `./crypto` subpath: `import { createRequestVerifier } from "@t-0/provider-sdk/crypto"`.
+The decoder accepts both fetch `Headers` and Node's `Record<string, string | string[] | undefined>`. It normalizes header case internally, detects Content-Type (`application/json` or `application/proto` / `application/protobuf` / `application/x-protobuf`), and the returned `encodeResponse` closure responds in the matching format.
+
+For custom proto registries (e.g. non-network schemas with custom predefined rules), use the generic `createRequestDecoder` from `@t-0/provider-sdk/crypto` and pass your own `registry`.
 
 **Important constraints for standalone integrations:**
 
-- **Raw body bytes only.** Pass the exact wire bytes to the verifier — no body parsers, no auto-decompression, never re-serialized protobuf. Protobuf encoding is not canonical; re-encoding produces different bytes and breaks verification.
-- **Pass `Uint8Array`, not `ArrayBuffer`.** If your framework gives you an `ArrayBuffer` (e.g. `request.arrayBuffer()`), wrap it: `new Uint8Array(buf)`.
-- **Header case.** `NetworkHeaders` enum values are title-case (`X-Signature`), but Node lowercases incoming headers. Look up headers by lowercase name: `headers["x-signature"]`.
-- **Wire format is binary protobuf.** Requests and successful responses use `Content-Type: application/proto`. Deserialize with `fromBinary()`, serialize with `toBinary()` from `@bufbuild/protobuf`. For verification errors, use `rejectRequest(result.reason)` to get the correct HTTP status, headers, and JSON body. Success responses **must** include `Content-Type: application/proto`.
+- **Raw body bytes only.** Pass the exact wire bytes — no body parsers, no auto-decompression, never re-serialized protobuf. Protobuf encoding is not canonical; re-encoding produces different bytes and breaks verification.
 - **Health endpoint.** The T-0 Network probes `/grpc.health.v1.Health/Check` on every endpoint. The probe is signed. Standalone integrations must route this path and return a valid health response. See [`docs/HEALTH_SERVICE.md`](../../docs/HEALTH_SERVICE.md) for the wire contract.
-- **`VerifyRequestFailure` is an open union.** New reason values may be added without a major version bump. Handle unknown reasons as generic failures.
+- **`DecodeRequestFailure` is an open union.** New error shapes may be added without a major version bump. Handle unknown failures as generic errors.
+
+<details>
+<summary>Lower-level primitives</summary>
+
+The individual building blocks are also exported: `createRequestVerifier`, `rejectRequest`, `verifySignature`, `computeDigest`, `keccak256`, `parsePublicKey`, `publicKeysEqual`. You can import just the crypto module via the `./crypto` subpath: `import { createRequestVerifier } from "@t-0/provider-sdk/crypto"`.
+</details>
 
 ### Network Client
 

package/lib/cjs/common/crypto/decode.d.ts

@@ -0,0 +1,41 @@
+import type { DescMessage, MessageShape, Registry } from '@bufbuild/protobuf';
+import type { CreateVerifierOptions, RejectedRequest } from './request.js';
+export interface CreateDecoderOptions extends CreateVerifierOptions {
+    registry?: Registry;
+}
+export type IncomingHeaders = {
+    get(name: string): string | null;
+} | Record<string, string | string[] | undefined>;
+export interface IncomingRequest {
+    body: Uint8Array | ArrayBufferView | ArrayBufferLike;
+    headers: IncomingHeaders;
+}
+export type WireFormat = 'json' | 'proto';
+export interface Violation {
+    field: string;
+    message: string;
+}
+export type DecodeError = 'unsupported_content_type' | 'malformed_body' | 'invalid_request' | 'validation_error';
+export interface WireResponse {
+    status: number;
+    headers: Record<string, string>;
+    body: string | Uint8Array<ArrayBuffer>;
+}
+export type DecodeRequestFailure = RejectedRequest | {
+    status: number;
+    headers: Record<string, string>;
+    body: string;
+    error: DecodeError;
+    violations?: Violation[];
+};
+export type DecodeRequestResult<Desc extends DescMessage> = {
+    ok: true;
+    request: MessageShape<Desc>;
+    format: WireFormat;
+    encodeResponse: <R extends DescMessage>(schema: R, message: MessageShape<R>) => WireResponse;
+} | {
+    ok: false;
+    error: DecodeRequestFailure;
+};
+export type RequestDecoder = <Desc extends DescMessage>(schema: Desc, req: IncomingRequest) => DecodeRequestResult<Desc>;
+export declare function createRequestDecoder(opts: CreateDecoderOptions): RequestDecoder;

package/lib/cjs/common/crypto/decode.js

@@ -0,0 +1,120 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createRequestDecoder = createRequestDecoder;
+const protobuf_1 = require("@bufbuild/protobuf");
+const protovalidate_1 = require("@bufbuild/protovalidate");
+const request_js_1 = require("./request.js");
+const headers_js_1 = __importDefault(require("../headers.js"));
+function getHeader(headers, name) {
+    if (typeof headers.get === 'function') {
+        return headers.get(name) ?? '';
+    }
+    const rec = headers;
+    const lc = name.toLowerCase();
+    for (const key of Object.keys(rec)) {
+        if (key.toLowerCase() === lc) {
+            const v = rec[key];
+            if (Array.isArray(v))
+                return v[0] ?? '';
+            return v ?? '';
+        }
+    }
+    return '';
+}
+function normalizeBody(body) {
+    if (body instanceof Uint8Array)
+        return body;
+    if (ArrayBuffer.isView(body))
+        return new Uint8Array(body.buffer, body.byteOffset, body.byteLength);
+    return new Uint8Array(body);
+}
+function detectFormat(contentType) {
+    const base = contentType.split(';')[0].trim().toLowerCase();
+    if (base === 'application/json')
+        return 'json';
+    if (base === 'application/proto' || base === 'application/protobuf' || base === 'application/x-protobuf')
+        return 'proto';
+    return null;
+}
+function failResponse(status, code, message, error, violations) {
+    return {
+        status,
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(violations ? { code, message, violations } : { code, message }),
+        error,
+        violations,
+    };
+}
+function createRequestDecoder(opts) {
+    const verify = (0, request_js_1.createRequestVerifier)(opts);
+    const validator = (0, protovalidate_1.createValidator)(opts.registry ? { registry: opts.registry } : undefined);
+    const textDecoder = new TextDecoder('utf-8', { fatal: true });
+    return (schema, req) => {
+        const body = normalizeBody(req.body);
+        const sigResult = verify({
+            body,
+            signatureHeader: getHeader(req.headers, headers_js_1.default.Signature),
+            publicKeyHeader: getHeader(req.headers, headers_js_1.default.PublicKey),
+            timestampHeader: getHeader(req.headers, headers_js_1.default.SignatureTimestamp),
+        });
+        if (!sigResult.valid) {
+            return { ok: false, error: (0, request_js_1.rejectRequest)(sigResult.reason) };
+        }
+        const format = detectFormat(getHeader(req.headers, 'content-type'));
+        if (!format) {
+            return { ok: false, error: failResponse(415, 'unsupported_content_type', 'Unsupported Content-Type', 'unsupported_content_type') };
+        }
+        let message;
+        try {
+            if (format === 'json') {
+                message = (0, protobuf_1.fromJsonString)(schema, textDecoder.decode(body), { ignoreUnknownFields: true, registry: opts.registry });
+            }
+            else {
+                message = (0, protobuf_1.fromBinary)(schema, body);
+            }
+        }
+        catch {
+            return { ok: false, error: failResponse(400, 'invalid_argument', 'Malformed request body', 'malformed_body') };
+        }
+        const valResult = validator.validate(schema, message);
+        if (valResult.kind === 'invalid') {
+            const violations = valResult.violations.map(v => ({
+                field: v.field?.toString() ?? '',
+                message: v.message,
+            }));
+            return {
+                ok: false,
+                error: failResponse(400, 'invalid_argument', 'Request validation failed', 'invalid_request', violations),
+            };
+        }
+        if (valResult.kind === 'error') {
+            return { ok: false, error: failResponse(500, 'internal', `Validation error: ${valResult.error.message}`, 'validation_error') };
+        }
+        const encodeResponse = (respSchema, resp) => {
+            const respVal = validator.validate(respSchema, resp);
+            if (respVal.kind === 'invalid' || respVal.kind === 'error') {
+                return {
+                    status: 500,
+                    headers: { 'Content-Type': 'application/json' },
+                    body: JSON.stringify({ code: 'internal', message: 'Response validation failed' }),
+                };
+            }
+            if (format === 'json') {
+                return {
+                    status: 200,
+                    headers: { 'Content-Type': 'application/json' },
+                    body: (0, protobuf_1.toJsonString)(respSchema, resp, { registry: opts.registry }),
+                };
+            }
+            return {
+                status: 200,
+                headers: { 'Content-Type': 'application/proto' },
+                body: (0, protobuf_1.toBinary)(respSchema, resp),
+            };
+        };
+        return { ok: true, request: message, format, encodeResponse };
+    };
+}

package/lib/cjs/common/crypto/index.d.ts

@@ -3,3 +3,4 @@ export { keccak256, computeDigest } from './hash.js';
 export { parsePublicKey, publicKeysEqual } from './keys.js';
 export { createRequestVerifier, DEFAULT_TOLERANCE_MS, rejectRequest } from './request.js';
 export type { CreateVerifierOptions, VerifyRequest, VerifyRequestResult, VerifyRequestFailure, RequestVerifier, RejectedRequest } from './request.js';
+export type { CreateDecoderOptions, IncomingHeaders, IncomingRequest, WireFormat, DecodeRequestFailure, Violation, WireResponse, DecodeError, DecodeRequestResult, RequestDecoder } from './decode.js';

package/lib/cjs/crypto/index.d.ts

@@ -1 +1,2 @@
 export * from "../common/crypto/index.js";
+export { createRequestDecoder } from "../common/crypto/decode.js";

package/lib/cjs/crypto/index.js

@@ -14,4 +14,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.createRequestDecoder = void 0;
 __exportStar(require("../common/crypto/index.js"), exports);
+var decode_js_1 = require("../common/crypto/decode.js");
+Object.defineProperty(exports, "createRequestDecoder", { enumerable: true, get: function () { return decode_js_1.createRequestDecoder; } });

package/lib/cjs/index.d.ts

@@ -1,4 +1,5 @@
-export * from "./crypto/index.js";
+export { verifySignature, keccak256, computeDigest, parsePublicKey, publicKeysEqual, createRequestVerifier, DEFAULT_TOLERANCE_MS, rejectRequest } from "./crypto/index.js";
+export type { CreateVerifierOptions, VerifyRequest, VerifyRequestResult, VerifyRequestFailure, RequestVerifier, RejectedRequest, CreateDecoderOptions, IncomingHeaders, IncomingRequest, WireFormat, DecodeRequestFailure, Violation, WireResponse, DecodeError, DecodeRequestResult, RequestDecoder } from "./crypto/index.js";
 export * from "./client/client.js";
 export * from "./service/service.js";
 export * from "./common/validation.js";

package/lib/cjs/index.js

@@ -39,8 +39,16 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PaymentIntentRecipient = exports.PaymentIntentProvider = exports.PaymentIntentBeneficiary = exports.PaymentIntentPayInProvider = exports.PaymentIntentNetwork = exports.nodeAdapter = exports.NetworkHeaders = void 0;
-__exportStar(require("./crypto/index.js"), exports);
+exports.PaymentIntentRecipient = exports.PaymentIntentProvider = exports.PaymentIntentBeneficiary = exports.PaymentIntentPayInProvider = exports.PaymentIntentNetwork = exports.nodeAdapter = exports.NetworkHeaders = exports.rejectRequest = exports.DEFAULT_TOLERANCE_MS = exports.createRequestVerifier = exports.publicKeysEqual = exports.parsePublicKey = exports.computeDigest = exports.keccak256 = exports.verifySignature = void 0;
+var index_js_1 = require("./crypto/index.js");
+Object.defineProperty(exports, "verifySignature", { enumerable: true, get: function () { return index_js_1.verifySignature; } });
+Object.defineProperty(exports, "keccak256", { enumerable: true, get: function () { return index_js_1.keccak256; } });
+Object.defineProperty(exports, "computeDigest", { enumerable: true, get: function () { return index_js_1.computeDigest; } });
+Object.defineProperty(exports, "parsePublicKey", { enumerable: true, get: function () { return index_js_1.parsePublicKey; } });
+Object.defineProperty(exports, "publicKeysEqual", { enumerable: true, get: function () { return index_js_1.publicKeysEqual; } });
+Object.defineProperty(exports, "createRequestVerifier", { enumerable: true, get: function () { return index_js_1.createRequestVerifier; } });
+Object.defineProperty(exports, "DEFAULT_TOLERANCE_MS", { enumerable: true, get: function () { return index_js_1.DEFAULT_TOLERANCE_MS; } });
+Object.defineProperty(exports, "rejectRequest", { enumerable: true, get: function () { return index_js_1.rejectRequest; } });
 __exportStar(require("./client/client.js"), exports);
 __exportStar(require("./service/service.js"), exports);
 __exportStar(require("./common/validation.js"), exports);

package/lib/cjs/service/validate_response.d.ts

@@ -1,6 +1,8 @@
 import type { Interceptor } from "@connectrpc/connect";
 import type { Logger } from "../common/validation.js";
 import { createValidationInterceptor } from "../common/validation.js";
+import type { RequestDecoder } from "../common/crypto/decode.js";
+import type { CreateVerifierOptions } from "../common/crypto/request.js";
 export { createValidationInterceptor, type Logger, type ValidationInterceptorOptions } from "../common/validation.js";
 /**
  * Registry covering the t-0 network provider contract protos. Leaf file
@@ -12,6 +14,10 @@ export declare const networkRegistry: import("@bufbuild/protobuf").Registry;
  * Validation interceptor pre-configured for the t-0 network provider contract.
  */
 export declare function createNetworkValidationInterceptor(logger?: Logger): Interceptor;
+/**
+ * Request decoder pre-configured for the t-0 network provider contract.
+ */
+export declare function createRequestDecoder(opts: CreateVerifierOptions): RequestDecoder;
 /**
  * @deprecated Use createValidationInterceptor instead.
  */

package/lib/cjs/service/validate_response.js

@@ -2,10 +2,12 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createResponseValidation = exports.networkRegistry = exports.createValidationInterceptor = void 0;
 exports.createNetworkValidationInterceptor = createNetworkValidationInterceptor;
+exports.createRequestDecoder = createRequestDecoder;
 const protobuf_1 = require("@bufbuild/protobuf");
 const provider_pb_js_1 = require("../common/gen/tzero/v1/payment/provider_pb.js");
 const network_pb_js_1 = require("../common/gen/tzero/v1/payment/network_pb.js");
 const validation_js_1 = require("../common/validation.js");
+const decode_js_1 = require("../common/crypto/decode.js");
 // Re-export everything from the common layer for backward compatibility.
 var validation_js_2 = require("../common/validation.js");
 Object.defineProperty(exports, "createValidationInterceptor", { enumerable: true, get: function () { return validation_js_2.createValidationInterceptor; } });
@@ -21,6 +23,12 @@ exports.networkRegistry = (0, protobuf_1.createRegistry)(provider_pb_js_1.file_t
 function createNetworkValidationInterceptor(logger) {
     return (0, validation_js_1.createValidationInterceptor)({ logger, registry: exports.networkRegistry });
 }
+/**
+ * Request decoder pre-configured for the t-0 network provider contract.
+ */
+function createRequestDecoder(opts) {
+    return (0, decode_js_1.createRequestDecoder)({ ...opts, registry: exports.networkRegistry });
+}
 /**
  * @deprecated Use createValidationInterceptor instead.
  */

package/lib/cjs/version.d.ts

@@ -1 +1 @@
-export declare const SDK_VERSION = "1.1.36";
+export declare const SDK_VERSION = "1.1.37";

package/lib/cjs/version.js

@@ -3,4 +3,4 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.SDK_VERSION = void 0;
 // SDK semantic version. Bumped in lockstep with all other SDKs by the
 // release.yaml workflow.
-exports.SDK_VERSION = "1.1.36";
+exports.SDK_VERSION = "1.1.37";

package/lib/esm/common/crypto/decode.d.ts

@@ -0,0 +1,41 @@
+import type { DescMessage, MessageShape, Registry } from '@bufbuild/protobuf';
+import type { CreateVerifierOptions, RejectedRequest } from './request.js';
+export interface CreateDecoderOptions extends CreateVerifierOptions {
+    registry?: Registry;
+}
+export type IncomingHeaders = {
+    get(name: string): string | null;
+} | Record<string, string | string[] | undefined>;
+export interface IncomingRequest {
+    body: Uint8Array | ArrayBufferView | ArrayBufferLike;
+    headers: IncomingHeaders;
+}
+export type WireFormat = 'json' | 'proto';
+export interface Violation {
+    field: string;
+    message: string;
+}
+export type DecodeError = 'unsupported_content_type' | 'malformed_body' | 'invalid_request' | 'validation_error';
+export interface WireResponse {
+    status: number;
+    headers: Record<string, string>;
+    body: string | Uint8Array<ArrayBuffer>;
+}
+export type DecodeRequestFailure = RejectedRequest | {
+    status: number;
+    headers: Record<string, string>;
+    body: string;
+    error: DecodeError;
+    violations?: Violation[];
+};
+export type DecodeRequestResult<Desc extends DescMessage> = {
+    ok: true;
+    request: MessageShape<Desc>;
+    format: WireFormat;
+    encodeResponse: <R extends DescMessage>(schema: R, message: MessageShape<R>) => WireResponse;
+} | {
+    ok: false;
+    error: DecodeRequestFailure;
+};
+export type RequestDecoder = <Desc extends DescMessage>(schema: Desc, req: IncomingRequest) => DecodeRequestResult<Desc>;
+export declare function createRequestDecoder(opts: CreateDecoderOptions): RequestDecoder;

package/lib/esm/common/crypto/decode.js

@@ -0,0 +1,114 @@
+import { fromJsonString, fromBinary, toJsonString, toBinary } from '@bufbuild/protobuf';
+import { createValidator } from '@bufbuild/protovalidate';
+import { createRequestVerifier, rejectRequest } from './request.js';
+import NetworkHeaders from '../headers.js';
+function getHeader(headers, name) {
+    if (typeof headers.get === 'function') {
+        return headers.get(name) ?? '';
+    }
+    const rec = headers;
+    const lc = name.toLowerCase();
+    for (const key of Object.keys(rec)) {
+        if (key.toLowerCase() === lc) {
+            const v = rec[key];
+            if (Array.isArray(v))
+                return v[0] ?? '';
+            return v ?? '';
+        }
+    }
+    return '';
+}
+function normalizeBody(body) {
+    if (body instanceof Uint8Array)
+        return body;
+    if (ArrayBuffer.isView(body))
+        return new Uint8Array(body.buffer, body.byteOffset, body.byteLength);
+    return new Uint8Array(body);
+}
+function detectFormat(contentType) {
+    const base = contentType.split(';')[0].trim().toLowerCase();
+    if (base === 'application/json')
+        return 'json';
+    if (base === 'application/proto' || base === 'application/protobuf' || base === 'application/x-protobuf')
+        return 'proto';
+    return null;
+}
+function failResponse(status, code, message, error, violations) {
+    return {
+        status,
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(violations ? { code, message, violations } : { code, message }),
+        error,
+        violations,
+    };
+}
+export function createRequestDecoder(opts) {
+    const verify = createRequestVerifier(opts);
+    const validator = createValidator(opts.registry ? { registry: opts.registry } : undefined);
+    const textDecoder = new TextDecoder('utf-8', { fatal: true });
+    return (schema, req) => {
+        const body = normalizeBody(req.body);
+        const sigResult = verify({
+            body,
+            signatureHeader: getHeader(req.headers, NetworkHeaders.Signature),
+            publicKeyHeader: getHeader(req.headers, NetworkHeaders.PublicKey),
+            timestampHeader: getHeader(req.headers, NetworkHeaders.SignatureTimestamp),
+        });
+        if (!sigResult.valid) {
+            return { ok: false, error: rejectRequest(sigResult.reason) };
+        }
+        const format = detectFormat(getHeader(req.headers, 'content-type'));
+        if (!format) {
+            return { ok: false, error: failResponse(415, 'unsupported_content_type', 'Unsupported Content-Type', 'unsupported_content_type') };
+        }
+        let message;
+        try {
+            if (format === 'json') {
+                message = fromJsonString(schema, textDecoder.decode(body), { ignoreUnknownFields: true, registry: opts.registry });
+            }
+            else {
+                message = fromBinary(schema, body);
+            }
+        }
+        catch {
+            return { ok: false, error: failResponse(400, 'invalid_argument', 'Malformed request body', 'malformed_body') };
+        }
+        const valResult = validator.validate(schema, message);
+        if (valResult.kind === 'invalid') {
+            const violations = valResult.violations.map(v => ({
+                field: v.field?.toString() ?? '',
+                message: v.message,
+            }));
+            return {
+                ok: false,
+                error: failResponse(400, 'invalid_argument', 'Request validation failed', 'invalid_request', violations),
+            };
+        }
+        if (valResult.kind === 'error') {
+            return { ok: false, error: failResponse(500, 'internal', `Validation error: ${valResult.error.message}`, 'validation_error') };
+        }
+        const encodeResponse = (respSchema, resp) => {
+            const respVal = validator.validate(respSchema, resp);
+            if (respVal.kind === 'invalid' || respVal.kind === 'error') {
+                return {
+                    status: 500,
+                    headers: { 'Content-Type': 'application/json' },
+                    body: JSON.stringify({ code: 'internal', message: 'Response validation failed' }),
+                };
+            }
+            if (format === 'json') {
+                return {
+                    status: 200,
+                    headers: { 'Content-Type': 'application/json' },
+                    body: toJsonString(respSchema, resp, { registry: opts.registry }),
+                };
+            }
+            return {
+                status: 200,
+                headers: { 'Content-Type': 'application/proto' },
+                body: toBinary(respSchema, resp),
+            };
+        };
+        return { ok: true, request: message, format, encodeResponse };
+    };
+}

package/lib/esm/common/crypto/index.d.ts

@@ -3,3 +3,4 @@ export { keccak256, computeDigest } from './hash.js';
 export { parsePublicKey, publicKeysEqual } from './keys.js';
 export { createRequestVerifier, DEFAULT_TOLERANCE_MS, rejectRequest } from './request.js';
 export type { CreateVerifierOptions, VerifyRequest, VerifyRequestResult, VerifyRequestFailure, RequestVerifier, RejectedRequest } from './request.js';
+export type { CreateDecoderOptions, IncomingHeaders, IncomingRequest, WireFormat, DecodeRequestFailure, Violation, WireResponse, DecodeError, DecodeRequestResult, RequestDecoder } from './decode.js';

package/lib/esm/crypto/index.d.ts

@@ -1 +1,2 @@
 export * from "../common/crypto/index.js";
+export { createRequestDecoder } from "../common/crypto/decode.js";

package/lib/esm/crypto/index.js

@@ -1 +1,2 @@
 export * from "../common/crypto/index.js";
+export { createRequestDecoder } from "../common/crypto/decode.js";

package/lib/esm/index.d.ts

@@ -1,4 +1,5 @@
-export * from "./crypto/index.js";
+export { verifySignature, keccak256, computeDigest, parsePublicKey, publicKeysEqual, createRequestVerifier, DEFAULT_TOLERANCE_MS, rejectRequest } from "./crypto/index.js";
+export type { CreateVerifierOptions, VerifyRequest, VerifyRequestResult, VerifyRequestFailure, RequestVerifier, RejectedRequest, CreateDecoderOptions, IncomingHeaders, IncomingRequest, WireFormat, DecodeRequestFailure, Violation, WireResponse, DecodeError, DecodeRequestResult, RequestDecoder } from "./crypto/index.js";
 export * from "./client/client.js";
 export * from "./service/service.js";
 export * from "./common/validation.js";

package/lib/esm/index.js

@@ -1,4 +1,4 @@
-export * from "./crypto/index.js";
+export { verifySignature, keccak256, computeDigest, parsePublicKey, publicKeysEqual, createRequestVerifier, DEFAULT_TOLERANCE_MS, rejectRequest } from "./crypto/index.js";
 export * from "./client/client.js";
 export * from "./service/service.js";
 export * from "./common/validation.js";

package/lib/esm/service/validate_response.d.ts

@@ -1,6 +1,8 @@
 import type { Interceptor } from "@connectrpc/connect";
 import type { Logger } from "../common/validation.js";
 import { createValidationInterceptor } from "../common/validation.js";
+import type { RequestDecoder } from "../common/crypto/decode.js";
+import type { CreateVerifierOptions } from "../common/crypto/request.js";
 export { createValidationInterceptor, type Logger, type ValidationInterceptorOptions } from "../common/validation.js";
 /**
  * Registry covering the t-0 network provider contract protos. Leaf file
@@ -12,6 +14,10 @@ export declare const networkRegistry: import("@bufbuild/protobuf").Registry;
  * Validation interceptor pre-configured for the t-0 network provider contract.
  */
 export declare function createNetworkValidationInterceptor(logger?: Logger): Interceptor;
+/**
+ * Request decoder pre-configured for the t-0 network provider contract.
+ */
+export declare function createRequestDecoder(opts: CreateVerifierOptions): RequestDecoder;
 /**
  * @deprecated Use createValidationInterceptor instead.
  */

package/lib/esm/service/validate_response.js

@@ -2,6 +2,7 @@ import { createRegistry } from "@bufbuild/protobuf";
 import { file_tzero_v1_payment_provider } from "../common/gen/tzero/v1/payment/provider_pb.js";
 import { file_tzero_v1_payment_network } from "../common/gen/tzero/v1/payment/network_pb.js";
 import { createValidationInterceptor } from "../common/validation.js";
+import { createRequestDecoder as createBaseRequestDecoder } from "../common/crypto/decode.js";
 // Re-export everything from the common layer for backward compatibility.
 export { createValidationInterceptor } from "../common/validation.js";
 /**
@@ -16,6 +17,12 @@ export const networkRegistry = createRegistry(file_tzero_v1_payment_provider, fi
 export function createNetworkValidationInterceptor(logger) {
     return createValidationInterceptor({ logger, registry: networkRegistry });
 }
+/**
+ * Request decoder pre-configured for the t-0 network provider contract.
+ */
+export function createRequestDecoder(opts) {
+    return createBaseRequestDecoder({ ...opts, registry: networkRegistry });
+}
 /**
  * @deprecated Use createValidationInterceptor instead.
  */

package/lib/esm/version.d.ts

@@ -1 +1 @@
-export declare const SDK_VERSION = "1.1.36";
+export declare const SDK_VERSION = "1.1.37";

package/lib/esm/version.js

@@ -1,3 +1,3 @@
 // SDK semantic version. Bumped in lockstep with all other SDKs by the
 // release.yaml workflow.
-export const SDK_VERSION = "1.1.36";
+export const SDK_VERSION = "1.1.37";