@owlmeans/auth-common 0.1.18-rc.29 → 0.1.18-rc.30

package/README.md

@@ -12,7 +12,7 @@ Predefined authentication protocols, guards, and constants shared between server
 ## Installation
 
 ```bash
-bun add @owlmeans/auth-common@^0.1.18-rc.29
+bun add @owlmeans/auth-common@^0.1.18-rc.30
 ```
 
 ## Usage
@@ -98,7 +98,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills@^0.1.18-rc.28
+npx @owlmeans/agent-skills@^0.1.18-rc.30
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/auth-common",
-  "version": "0.1.18-rc.29",
-  "generatedAt": "2026-09-17T08:16:11.214Z",
+  "version": "0.1.18-rc.30",
+  "generatedAt": "2026-09-19T13:42:56.242Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/auth-common/SKILL.md

@@ -8,7 +8,7 @@ user-invocable: false
 # @owlmeans/auth-common
 
 **Layer:** Core
-**Install:** `"@owlmeans/auth-common": "^0.1.18-rc.29"` in `dependencies`
+**Install:** `"@owlmeans/auth-common": "^0.1.18-rc.30"` in `dependencies`
 
 Everything a server and a browser must agree on to talk authentication: aliases, the shared
 protocol declarations, the signature guard, and the contract for resolving the organization
@@ -128,7 +128,10 @@ depends on the value.
   the matching client-side alias as `DEFAULT_ALIAS`.
 - `GUARD_ED25519` is for service-to-service calls, where the caller signs the request rather than
   presenting a bearer token. Give it a Redis-backed nonce cache (`BED255_CASHE_RESOURCE`) in any
-  deployment that runs more than one replica, or replay protection is per-process only.
+  deployment that runs more than one replica, or replay protection is per-process only. The guard
+  accepts only canonical timestamps inside its symmetric 60-second window and claims the
+  credential-and-nonce pair until that timestamp's absolute expiry; a replay-store error refuses
+  authentication rather than disabling deduplication.
 - An OIDC gate is not required when OIDC is only the login/bootstrap provider. Where the provider
   issues a local bearer token, authorize with a product-specific gate against local identity scopes.
 - The trust resource (`TRUSTED`, from `@owlmeans/config`) is the system's source of truth for known

package/build/guards/basic-ed25519/index.d.ts

@@ -1,4 +1,5 @@
 export type * from './types.js';
 export * from './consts.js';
+export * from './replay.js';
 export * from './service.js';
 //# sourceMappingURL=index.d.ts.map

package/build/guards/basic-ed25519/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/guards/basic-ed25519/index.ts"],"names":[],"mappings":"AACA,mBAAmB,YAAY,CAAA;AAC/B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/guards/basic-ed25519/index.ts"],"names":[],"mappings":"AACA,mBAAmB,YAAY,CAAA;AAC/B,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA"}

package/build/guards/basic-ed25519/index.js

@@ -1,3 +1,4 @@
 export * from './consts.js';
+export * from './replay.js';
 export * from './service.js';
 //# sourceMappingURL=index.js.map

package/build/guards/basic-ed25519/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/guards/basic-ed25519/index.ts"],"names":[],"mappings":"AAEA,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/guards/basic-ed25519/index.ts"],"names":[],"mappings":"AAEA,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA"}

package/build/guards/basic-ed25519/replay.d.ts

@@ -0,0 +1,14 @@
+import type { SignedRequestReplayResource, SignedRequestReplayStore } from './types.js';
+/**
+ * Process-local replay protection used when a deployment has not supplied a shared resource.
+ * A timer removes each claim at its signed expiry, keeping the fallback bounded by the live
+ * replay window rather than by process lifetime.
+ */
+export declare const makeMemorySignedRequestReplayStore: () => SignedRequestReplayStore;
+/**
+ * Adapt a create-once Resource to signed-request replay protection. Redis resources honour the
+ * absolute expiry and make the claim atomic across replicas (`SET NX`); other resource failures
+ * remain failures rather than being mistaken for successful claims.
+ */
+export declare const makeResourceSignedRequestReplayStore: (resource: SignedRequestReplayResource) => SignedRequestReplayStore;
+//# sourceMappingURL=replay.d.ts.map

package/build/guards/basic-ed25519/replay.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"replay.d.ts","sourceRoot":"","sources":["../../../src/guards/basic-ed25519/replay.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,2BAA2B,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAA;AAEvF;;;;GAIG;AACH,eAAO,MAAM,kCAAkC,QAAO,wBAwBrD,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,oCAAoC,aACrC,2BAA2B,KACpC,wBAaD,CAAA"}

package/build/guards/basic-ed25519/replay.js

@@ -0,0 +1,49 @@
+import { RecordExists } from '@owlmeans/resource';
+/**
+ * Process-local replay protection used when a deployment has not supplied a shared resource.
+ * A timer removes each claim at its signed expiry, keeping the fallback bounded by the live
+ * replay window rather than by process lifetime.
+ */
+export const makeMemorySignedRequestReplayStore = () => {
+    const claims = new Map();
+    return {
+        claim: async (id, expiresAt) => {
+            const now = Date.now();
+            const current = claims.get(id);
+            if (current != null && current > now) {
+                return false;
+            }
+            const expiry = expiresAt.getTime();
+            claims.set(id, expiry);
+            const timer = setTimeout(() => {
+                if (claims.get(id) === expiry) {
+                    claims.delete(id);
+                }
+            }, Math.max(0, expiry - now));
+            const unref = timer.unref;
+            unref?.call(timer);
+            return true;
+        }
+    };
+};
+/**
+ * Adapt a create-once Resource to signed-request replay protection. Redis resources honour the
+ * absolute expiry and make the claim atomic across replicas (`SET NX`); other resource failures
+ * remain failures rather than being mistaken for successful claims.
+ */
+export const makeResourceSignedRequestReplayStore = (resource) => ({
+    claim: async (id, expiresAt) => {
+        try {
+            await resource.create({ id }, { ttl: expiresAt });
+            return true;
+        }
+        catch (error) {
+            if (error instanceof RecordExists
+                || error?.type === RecordExists.typeName) {
+                return false;
+            }
+            throw error;
+        }
+    }
+});
+//# sourceMappingURL=replay.js.map

package/build/guards/basic-ed25519/replay.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"replay.js","sourceRoot":"","sources":["../../../src/guards/basic-ed25519/replay.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAGjD;;;;GAIG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,GAA6B,EAAE;IAC/E,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAA;IAExC,OAAO;QACL,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE;YAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;YACtB,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YAC9B,IAAI,OAAO,IAAI,IAAI,IAAI,OAAO,GAAG,GAAG,EAAE,CAAC;gBACrC,OAAO,KAAK,CAAA;YACd,CAAC;YAED,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,CAAA;YAClC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;YACtB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,MAAM,EAAE,CAAC;oBAC9B,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;gBACnB,CAAC;YACH,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC,CAAC,CAAA;YAC7B,MAAM,KAAK,GAAI,KAA2C,CAAC,KAAK,CAAA;YAChE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;YAElB,OAAO,IAAI,CAAA;QACb,CAAC;KACF,CAAA;AACH,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAClD,QAAqC,EACX,EAAE,CAAC,CAAC;IAC9B,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE;QAC7B,IAAI,CAAC;YACH,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAA;YACjD,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,YAAY;mBAC3B,KAAmC,EAAE,IAAI,KAAK,YAAY,CAAC,QAAQ,EAAE,CAAC;gBAC1E,OAAO,KAAK,CAAA;YACd,CAAC;YACD,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC;CACF,CAAC,CAAA"}

package/build/guards/basic-ed25519/service.d.ts

@@ -1,8 +1,3 @@
 import type { BasicEd25519Guard, BasicEd25519GuardOptions } from './types.js';
-/**
- * Proper configuration:
- * - One needs to specify opts.cache as a redis resource that stores nonces for a while to
- * avoid requests duplication.
- */
 export declare const makeBasicEd25519Guard: (resource: string, opts?: BasicEd25519GuardOptions) => BasicEd25519Guard;
 //# sourceMappingURL=service.d.ts.map

package/build/guards/basic-ed25519/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/guards/basic-ed25519/service.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAA;AAU7E;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,aAAc,MAAM,SAAS,wBAAwB,KAAG,iBAqHzF,CAAA"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/guards/basic-ed25519/service.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAA;AAa7E,eAAO,MAAM,qBAAqB,aAAc,MAAM,SAAS,wBAAwB,KAAG,iBA+IzF,CAAA"}

package/build/guards/basic-ed25519/service.js

@@ -5,17 +5,21 @@ import { trust } from '../../utils/trusted.js';
 import { AuthenPayloadError, AuthroizationType, AuthRole } from '@owlmeans/auth';
 import { createIdOfLength } from '@owlmeans/basic-ids';
 import { extractAuthToken } from '@owlmeans/auth-common/utils';
+import { makeMemorySignedRequestReplayStore, makeResourceSignedRequestReplayStore } from './replay.js';
 const timeKey = BED255_TIME_HEADER.toLocaleLowerCase();
 const nonceKey = BED255_NONCE_HEADER.toLocaleLowerCase();
-/**
- * Proper configuration:
- * - One needs to specify opts.cache as a redis resource that stores nonces for a while to
- * avoid requests duplication.
- */
 export const makeBasicEd25519Guard = (resource, opts) => {
-    const cache = (context) => context.hasResource(opts?.cache ?? BED255_CASHE_RESOURCE)
-        ? context.resource(opts?.cache ?? BED255_CASHE_RESOURCE)
-        : null;
+    const memoryReplay = makeMemorySignedRequestReplayStore();
+    const replay = (context) => {
+        if (opts?.replay != null) {
+            return opts.replay;
+        }
+        const alias = opts?.cache ?? BED255_CASHE_RESOURCE;
+        if (context.hasResource(alias)) {
+            return makeResourceSignedRequestReplayStore(context.resource(alias));
+        }
+        return memoryReplay;
+    };
     const guard = createService(GUARD_ED25519, {
         authenticated: async (req) => {
             const context = assertContext(guard.ctx);
@@ -54,32 +58,43 @@ export const makeBasicEd25519Guard = (resource, opts) => {
                 const [key, value] = pair.split('=', 2);
                 return { ...result, [key.toLowerCase()]: value };
             }, {});
+            if (typeof signature.credential !== 'string' || signature.credential.length === 0
+                || typeof signature.signature !== 'string' || signature.signature.length === 0) {
+                throw new AuthenPayloadError('signature');
+            }
             const trusted = await trust(context, resource, signature.credential, "id");
             if (trusted.user.credential == null) {
                 return false;
             }
+            const timestamp = req.headers?.[timeKey];
+            const nonce = req.headers?.[nonceKey];
             const payload = {
                 body: req.body ?? {},
-                headers: { [timeKey]: req.headers[timeKey], [nonceKey]: req.headers[nonceKey] }
+                headers: { [timeKey]: timestamp, [nonceKey]: nonce }
             };
             if (!await trusted.key.verify(payload, signature.signature)) {
                 return false;
             }
-            if (typeof req.headers[timeKey] !== 'string') {
+            if (typeof timestamp !== 'string') {
+                throw new AuthenPayloadError('timestamp');
+            }
+            const createdAt = new Date(timestamp);
+            const signedAt = createdAt.getTime();
+            if (!Number.isFinite(signedAt) || createdAt.toISOString() !== timestamp) {
                 throw new AuthenPayloadError('timestamp');
             }
-            const createdAt = new Date(req.headers[timeKey]);
-            if (createdAt.getTime() + BED255_SIG_TTL < Date.now()) {
+            if (Math.abs(Date.now() - signedAt) > BED255_SIG_TTL) {
                 throw new AuthenPayloadError('expired');
             }
-            const nonce = req.headers[nonceKey];
-            if (typeof nonce !== 'string') {
+            if (typeof nonce !== 'string' || nonce.length === 0) {
                 throw new AuthenPayloadError('nonce');
             }
             try {
-                const tried = cache(context);
-                if (tried != null) {
-                    await tried.create({ id: nonce }, { ttl: BED255_SIG_TTL / 1000 });
+                // The replay identity is the signing credential plus its nonce. A nonce used by one
+                // trusted service does not block another, while a captured request can be admitted once.
+                const claimed = await replay(context).claim(`${signature.credential.length}:${signature.credential}${nonce}`, new Date(signedAt + BED255_SIG_TTL));
+                if (!claimed) {
+                    throw new AuthenPayloadError('nonce');
                 }
             }
             catch {

package/build/guards/basic-ed25519/service.js.map

@@ -1 +1 @@
-{"version":3,"file":"service.js","sourceRoot":"","sources":["../../../src/guards/basic-ed25519/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACjD,OAAO,EACL,mBAAmB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,aAAa,EAC7E,cAAc,EACf,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAA;AAG9C,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAEhF,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAEtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAE9D,MAAM,OAAO,GAAG,kBAAkB,CAAC,iBAAiB,EAAE,CAAA;AACtD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,iBAAiB,EAAE,CAAA;AAExD;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,QAAgB,EAAE,IAA+B,EAAqB,EAAE;IAE5G,MAAM,KAAK,GAAG,CAAC,OAAgB,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,IAAI,qBAAqB,CAAC;QAC3F,CAAC,CAAC,OAAO,CAAC,QAAQ,CAA2B,IAAI,EAAE,KAAK,IAAI,qBAAqB,CAAC;QAClF,CAAC,CAAC,IAAI,CAAA;IAER,MAAM,KAAK,GAAsB,aAAa,CAAoB,aAAa,EAAE;QAC/E,aAAa,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE;YACzB,MAAM,OAAO,GAAG,aAAa,CAAkB,KAAK,CAAC,GAAG,CAAC,CAAA;YACzD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YAEzF,qBAAqB;YACrB,IAAI,GAAG,IAAI,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;gBAChD,IAAI,GAAG,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;oBACxB,GAAG,CAAC,OAAO,GAAG,EAAE,CAAA;gBAClB,CAAC;gBACD,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;gBAC/C,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAA;gBAE5C,MAAM,OAAO,GAAG;oBACd,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE;oBACpB,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;iBAChF,CAAA;gBAED,MAAM,KAAK,GAAG;oBACZ,iBAAiB,CAAC,qBAAqB,CAAC,WAAW,EAAE;oBACnD,CAAC,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBAChC,CAAC,WAAW,EAAE,MAAM,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;iBAClD,CAAA;gBAED,OAAO,KAAK,CAAC,GAAG,CACd,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CACpD,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACb,CAAC;YAED,OAAO,IAAI,CAAA;QACb,CAAC;QAED,KAAK,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE,CACjB,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,CAAC,qBAAqB,CAAC,IAAI,IAAI;QAExE,MAAM,EAAE,KAAK,EAAK,GAAoB,EAAE,GAA2B,EAAE,EAAE;YACrE,MAAM,OAAO,GAAG,aAAa,CAAkB,KAAK,CAAC,GAAG,CAAC,CAAA;YACzD,MAAM,aAAa,GAAG,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,CAAC,qBAAqB,CAAC,CAAA;YACpF,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;gBAC1B,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;gBACpE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBACxB,OAAO,MAAM,CAAA;gBACf,CAAC;gBACD,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;gBACvC,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,EAAE,KAAK,EAAE,CAAA;YAClD,CAAC,EAAE,EAA+C,CAAC,CAAA;YAEnD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;YAC1E,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;gBACpC,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,MAAM,OAAO,GAAG;gBACd,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE;gBACpB,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;aAChF,CAAA;YAED,IAAI,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC5D,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,IAAI,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAC7C,MAAM,IAAI,kBAAkB,CAAC,WAAW,CAAC,CAAA;YAC3C,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAA;YAEhD,IAAI,SAAS,CAAC,OAAO,EAAE,GAAG,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBACtD,MAAM,IAAI,kBAAkB,CAAC,SAAS,CAAC,CAAA;YACzC,CAAC;YAED,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;YACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,MAAM,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAA;YACvC,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAA;gBAC5B,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;oBAClB,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,cAAc,GAAG,IAAI,EAAE,CAAC,CAAA;gBACnE,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAA;YACvC,CAAC;YAED,GAAG,CAAC,OAAO,CAAC;gBACV,KAAK,EAAE,aAAa;gBACpB,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;gBACvB,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;gBAC1B,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU;gBACnC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;gBAC5D,IAAI,EAAE,iBAAiB,CAAC,qBAAqB;gBAC7C,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO;gBAC3B;;mBAEG;gBACH,IAAI,EAAE,QAAQ,CAAC,OAAO;gBACtB,MAAM,EAAE,KAAK;gBACb,SAAS,EAAE,IAAI,IAAI,EAAE;aACtB,CAAC,CAAA;YAEF,OAAO,IAAS,CAAA;QAClB,CAAC;KACF,EAAE,KAAK,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE;QACrB,KAAK,CAAC,WAAW,GAAG,IAAI,CAAA;IAC1B,CAAC,CAAC,CAAA;IAEF,OAAO,KAAK,CAAA;AACd,CAAC,CAAA"}
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../../src/guards/basic-ed25519/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACjD,OAAO,EACL,mBAAmB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,aAAa,EAC7E,cAAc,EACf,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAA;AAG9C,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAEhF,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAC9D,OAAO,EACL,kCAAkC,EAAE,oCAAoC,EACzE,MAAM,aAAa,CAAA;AAGpB,MAAM,OAAO,GAAG,kBAAkB,CAAC,iBAAiB,EAAE,CAAA;AACtD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,iBAAiB,EAAE,CAAA;AAExD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,QAAgB,EAAE,IAA+B,EAAqB,EAAE;IAC5G,MAAM,YAAY,GAAG,kCAAkC,EAAE,CAAA;IAEzD,MAAM,MAAM,GAAG,CAAC,OAAgB,EAA4B,EAAE;QAC5D,IAAI,IAAI,EAAE,MAAM,IAAI,IAAI,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,MAAM,CAAA;QACpB,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,qBAAqB,CAAA;QAClD,IAAI,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,oCAAoC,CACzC,OAAO,CAAC,QAAQ,CAA8B,KAAK,CAAC,CACrD,CAAA;QACH,CAAC;QACD,OAAO,YAAY,CAAA;IACrB,CAAC,CAAA;IAED,MAAM,KAAK,GAAsB,aAAa,CAAoB,aAAa,EAAE;QAC/E,aAAa,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE;YACzB,MAAM,OAAO,GAAG,aAAa,CAAkB,KAAK,CAAC,GAAG,CAAC,CAAA;YACzD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YAEzF,qBAAqB;YACrB,IAAI,GAAG,IAAI,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;gBAChD,IAAI,GAAG,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;oBACxB,GAAG,CAAC,OAAO,GAAG,EAAE,CAAA;gBAClB,CAAC;gBACD,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;gBAC/C,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAA;gBAE5C,MAAM,OAAO,GAAG;oBACd,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE;oBACpB,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;iBAChF,CAAA;gBAED,MAAM,KAAK,GAAG;oBACZ,iBAAiB,CAAC,qBAAqB,CAAC,WAAW,EAAE;oBACnD,CAAC,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBAChC,CAAC,WAAW,EAAE,MAAM,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;iBAClD,CAAA;gBAED,OAAO,KAAK,CAAC,GAAG,CACd,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CACpD,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACb,CAAC;YAED,OAAO,IAAI,CAAA;QACb,CAAC;QAED,KAAK,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE,CACjB,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,CAAC,qBAAqB,CAAC,IAAI,IAAI;QAExE,MAAM,EAAE,KAAK,EAAK,GAAoB,EAAE,GAA2B,EAAE,EAAE;YACrE,MAAM,OAAO,GAAG,aAAa,CAAkB,KAAK,CAAC,GAAG,CAAC,CAAA;YACzD,MAAM,aAAa,GAAG,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,CAAC,qBAAqB,CAAC,CAAA;YACpF,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;gBAC1B,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;gBACpE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBACxB,OAAO,MAAM,CAAA;gBACf,CAAC;gBACD,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;gBACvC,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,EAAE,KAAK,EAAE,CAAA;YAClD,CAAC,EAAE,EAA+C,CAAC,CAAA;YAEnD,IAAI,OAAO,SAAS,CAAC,UAAU,KAAK,QAAQ,IAAI,SAAS,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;mBAC5E,OAAO,SAAS,CAAC,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACjF,MAAM,IAAI,kBAAkB,CAAC,WAAW,CAAC,CAAA;YAC3C,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;YAC1E,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;gBACpC,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAA;YACxC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAA;YAErC,MAAM,OAAO,GAAG;gBACd,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE;gBACpB,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE;aACrD,CAAA;YAED,IAAI,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC5D,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAClC,MAAM,IAAI,kBAAkB,CAAC,WAAW,CAAC,CAAA;YAC3C,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,CAAA;YACrC,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,EAAE,CAAA;YACpC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,WAAW,EAAE,KAAK,SAAS,EAAE,CAAC;gBACxE,MAAM,IAAI,kBAAkB,CAAC,WAAW,CAAC,CAAA;YAC3C,CAAC;YAED,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,GAAG,cAAc,EAAE,CAAC;gBACrD,MAAM,IAAI,kBAAkB,CAAC,SAAS,CAAC,CAAA;YACzC,CAAC;YAED,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACpD,MAAM,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAA;YACvC,CAAC;YAED,IAAI,CAAC;gBACH,oFAAoF;gBACpF,yFAAyF;gBACzF,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CACzC,GAAG,SAAS,CAAC,UAAU,CAAC,MAAM,IAAI,SAAS,CAAC,UAAU,GAAG,KAAK,EAAE,EAChE,IAAI,IAAI,CAAC,QAAQ,GAAG,cAAc,CAAC,CACpC,CAAA;gBACD,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAA;gBACvC,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAA;YACvC,CAAC;YAED,GAAG,CAAC,OAAO,CAAC;gBACV,KAAK,EAAE,aAAa;gBACpB,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;gBACvB,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;gBAC1B,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU;gBACnC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;gBAC5D,IAAI,EAAE,iBAAiB,CAAC,qBAAqB;gBAC7C,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO;gBAC3B;;mBAEG;gBACH,IAAI,EAAE,QAAQ,CAAC,OAAO;gBACtB,MAAM,EAAE,KAAK;gBACb,SAAS,EAAE,IAAI,IAAI,EAAE;aACtB,CAAC,CAAA;YAEF,OAAO,IAAS,CAAA;QAClB,CAAC;KACF,EAAE,KAAK,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE;QACrB,KAAK,CAAC,WAAW,GAAG,IAAI,CAAA;IAC1B,CAAC,CAAC,CAAA;IAEF,OAAO,KAAK,CAAA;AACd,CAAC,CAAA"}

package/build/guards/basic-ed25519/types.d.ts

@@ -1,7 +1,23 @@
 import type { GuardService } from '@owlmeans/entrypoint';
+import type { ResourceRecord, WriteOptions } from '@owlmeans/resource';
+import type { BasicResource } from '@owlmeans/context';
 export interface BasicEd25519Guard extends GuardService {
 }
 export interface BasicEd25519GuardOptions {
+    /**
+     * Legacy resource alias. A Redis resource registered under this alias gives replay protection
+     * shared by every replica; when it is absent the guard falls back to its process-local store.
+     */
     cache?: string;
+    /** Explicit replay store, for consumers that do not register a Resource on the context. */
+    replay?: SignedRequestReplayStore;
+}
+/** A create-once claim over one signed request identity. */
+export interface SignedRequestReplayStore {
+    claim: (id: string, expiresAt: Date) => Promise<boolean>;
+}
+/** The small Resource surface needed by the Redis-compatible replay adapter. */
+export interface SignedRequestReplayResource extends BasicResource {
+    create: (record: Partial<ResourceRecord>, opts?: WriteOptions) => Promise<ResourceRecord>;
 }
 //# sourceMappingURL=types.d.ts.map

package/build/guards/basic-ed25519/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/guards/basic-ed25519/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAExD,MAAM,WAAW,iBAAkB,SAAQ,YAAY;CACtD;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,CAAC,EAAE,MAAM,CAAA;CACf"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/guards/basic-ed25519/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACtE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEtD,MAAM,WAAW,iBAAkB,SAAQ,YAAY;CACtD;AAED,MAAM,WAAW,wBAAwB;IACvC;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,2FAA2F;IAC3F,MAAM,CAAC,EAAE,wBAAwB,CAAA;CAClC;AAED,4DAA4D;AAC5D,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CACzD;AAED,gFAAgF;AAChF,MAAM,WAAW,2BAA4B,SAAQ,aAAa;IAChE,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,cAAc,CAAC,EAAE,IAAI,CAAC,EAAE,YAAY,KAAK,OAAO,CAAC,cAAc,CAAC,CAAA;CAC1F"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/auth-common",
-  "version": "0.1.18-rc.29",
+  "version": "0.1.18-rc.30",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -29,19 +29,19 @@
     }
   },
   "dependencies": {
-    "@owlmeans/auth": "^0.1.18-rc.27",
-    "@owlmeans/auth-common": "^0.1.18-rc.29",
-    "@owlmeans/basic-ids": "^0.1.18-rc.26",
-    "@owlmeans/basic-keys": "^0.1.18-rc.30",
-    "@owlmeans/client-entrypoint": "^0.1.18-rc.29",
-    "@owlmeans/context": "^0.1.18-rc.25",
-    "@owlmeans/entrypoint": "^0.1.18-rc.28",
-    "@owlmeans/resource": "^0.1.18-rc.27",
-    "@owlmeans/route": "^0.1.18-rc.26"
+    "@owlmeans/auth": "^0.1.18-rc.28",
+    "@owlmeans/auth-common": "^0.1.18-rc.30",
+    "@owlmeans/basic-ids": "^0.1.18-rc.27",
+    "@owlmeans/basic-keys": "^0.1.18-rc.31",
+    "@owlmeans/client-entrypoint": "^0.1.18-rc.30",
+    "@owlmeans/context": "^0.1.18-rc.26",
+    "@owlmeans/entrypoint": "^0.1.18-rc.29",
+    "@owlmeans/resource": "^0.1.18-rc.28",
+    "@owlmeans/route": "^0.1.18-rc.27"
   },
   "devDependencies": {
     "@owlmeans/dep-config": "workspace:*",
-    "@owlmeans/test-auth": "^0.1.18-rc.28",
+    "@owlmeans/test-auth": "^0.1.18-rc.29",
     "@types/bun": "^1.4.0",
     "nodemon": "^3.1.14",
     "typescript": "^7.0.2"

package/src/guards/basic-ed25519/index.ts

@@ -1,4 +1,5 @@
 
 export type * from './types.js'
 export * from './consts.js'
+export * from './replay.js'
 export * from './service.js'

package/src/guards/basic-ed25519/replay.ts

@@ -0,0 +1,55 @@
+import { RecordExists } from '@owlmeans/resource'
+import type { SignedRequestReplayResource, SignedRequestReplayStore } from './types.js'
+
+/**
+ * Process-local replay protection used when a deployment has not supplied a shared resource.
+ * A timer removes each claim at its signed expiry, keeping the fallback bounded by the live
+ * replay window rather than by process lifetime.
+ */
+export const makeMemorySignedRequestReplayStore = (): SignedRequestReplayStore => {
+  const claims = new Map<string, number>()
+
+  return {
+    claim: async (id, expiresAt) => {
+      const now = Date.now()
+      const current = claims.get(id)
+      if (current != null && current > now) {
+        return false
+      }
+
+      const expiry = expiresAt.getTime()
+      claims.set(id, expiry)
+      const timer = setTimeout(() => {
+        if (claims.get(id) === expiry) {
+          claims.delete(id)
+        }
+      }, Math.max(0, expiry - now))
+      const unref = (timer as unknown as { unref?: () => void }).unref
+      unref?.call(timer)
+
+      return true
+    }
+  }
+}
+
+/**
+ * Adapt a create-once Resource to signed-request replay protection. Redis resources honour the
+ * absolute expiry and make the claim atomic across replicas (`SET NX`); other resource failures
+ * remain failures rather than being mistaken for successful claims.
+ */
+export const makeResourceSignedRequestReplayStore = (
+  resource: SignedRequestReplayResource
+): SignedRequestReplayStore => ({
+  claim: async (id, expiresAt) => {
+    try {
+      await resource.create({ id }, { ttl: expiresAt })
+      return true
+    } catch (error) {
+      if (error instanceof RecordExists
+        || (error as { type?: unknown } | null)?.type === RecordExists.typeName) {
+        return false
+      }
+      throw error
+    }
+  }
+})

package/src/guards/basic-ed25519/service.ts

@@ -11,22 +11,30 @@ import type { BasicEd25519Guard, BasicEd25519GuardOptions } from './types.js'
 import { AuthenPayloadError, AuthroizationType, AuthRole } from '@owlmeans/auth'
 import type { Auth } from '@owlmeans/auth'
 import { createIdOfLength } from '@owlmeans/basic-ids'
-import type { Resource, ResourceRecord } from '@owlmeans/resource'
 import { extractAuthToken } from '@owlmeans/auth-common/utils'
+import {
+  makeMemorySignedRequestReplayStore, makeResourceSignedRequestReplayStore
+} from './replay.js'
+import type { SignedRequestReplayResource, SignedRequestReplayStore } from './types.js'
 
 const timeKey = BED255_TIME_HEADER.toLocaleLowerCase()
 const nonceKey = BED255_NONCE_HEADER.toLocaleLowerCase()
 
-/**
- * Proper configuration:
- * - One needs to specify opts.cache as a redis resource that stores nonces for a while to
- * avoid requests duplication.
- */
 export const makeBasicEd25519Guard = (resource: string, opts?: BasicEd25519GuardOptions): BasicEd25519Guard => {
+  const memoryReplay = makeMemorySignedRequestReplayStore()
 
-  const cache = (context: Context) => context.hasResource(opts?.cache ?? BED255_CASHE_RESOURCE)
-    ? context.resource<Resource<ResourceRecord>>(opts?.cache ?? BED255_CASHE_RESOURCE)
-    : null
+  const replay = (context: Context): SignedRequestReplayStore => {
+    if (opts?.replay != null) {
+      return opts.replay
+    }
+    const alias = opts?.cache ?? BED255_CASHE_RESOURCE
+    if (context.hasResource(alias)) {
+      return makeResourceSignedRequestReplayStore(
+        context.resource<SignedRequestReplayResource>(alias)
+      )
+    }
+    return memoryReplay
+  }
 
   const guard: BasicEd25519Guard = createService<BasicEd25519Guard>(GUARD_ED25519, {
     authenticated: async req => {
@@ -78,39 +86,55 @@ export const makeBasicEd25519Guard = (resource: string, opts?: BasicEd25519Guard
         return { ...result, [key.toLowerCase()]: value }
       }, {} as { credential: string, signature: string })
 
+      if (typeof signature.credential !== 'string' || signature.credential.length === 0
+        || typeof signature.signature !== 'string' || signature.signature.length === 0) {
+        throw new AuthenPayloadError('signature')
+      }
+
       const trusted = await trust(context, resource, signature.credential, "id")
       if (trusted.user.credential == null) {
         return false as T
       }
 
+      const timestamp = req.headers?.[timeKey]
+      const nonce = req.headers?.[nonceKey]
+
       const payload = {
         body: req.body ?? {},
-        headers: { [timeKey]: req.headers[timeKey], [nonceKey]: req.headers[nonceKey] }
+        headers: { [timeKey]: timestamp, [nonceKey]: nonce }
       }
 
       if (!await trusted.key.verify(payload, signature.signature)) {
         return false as T
       }
 
-      if (typeof req.headers[timeKey] !== 'string') {
+      if (typeof timestamp !== 'string') {
         throw new AuthenPayloadError('timestamp')
       }
 
-      const createdAt = new Date(req.headers[timeKey])
+      const createdAt = new Date(timestamp)
+      const signedAt = createdAt.getTime()
+      if (!Number.isFinite(signedAt) || createdAt.toISOString() !== timestamp) {
+        throw new AuthenPayloadError('timestamp')
+      }
 
-      if (createdAt.getTime() + BED255_SIG_TTL < Date.now()) {
+      if (Math.abs(Date.now() - signedAt) > BED255_SIG_TTL) {
         throw new AuthenPayloadError('expired')
       }
 
-      const nonce = req.headers[nonceKey]
-      if (typeof nonce !== 'string') {
+      if (typeof nonce !== 'string' || nonce.length === 0) {
         throw new AuthenPayloadError('nonce')
       }
 
       try {
-        const tried = cache(context)
-        if (tried != null) {
-          await tried.create({ id: nonce }, { ttl: BED255_SIG_TTL / 1000 })
+        // The replay identity is the signing credential plus its nonce. A nonce used by one
+        // trusted service does not block another, while a captured request can be admitted once.
+        const claimed = await replay(context).claim(
+          `${signature.credential.length}:${signature.credential}${nonce}`,
+          new Date(signedAt + BED255_SIG_TTL)
+        )
+        if (!claimed) {
+          throw new AuthenPayloadError('nonce')
         }
       } catch {
         throw new AuthenPayloadError('nonce')

package/src/guards/basic-ed25519/types.ts

@@ -1,9 +1,26 @@
 import type { GuardService } from '@owlmeans/entrypoint'
+import type { ResourceRecord, WriteOptions } from '@owlmeans/resource'
+import type { BasicResource } from '@owlmeans/context'
 
 export interface BasicEd25519Guard extends GuardService {
 }
 
 export interface BasicEd25519GuardOptions {
+  /**
+   * Legacy resource alias. A Redis resource registered under this alias gives replay protection
+   * shared by every replica; when it is absent the guard falls back to its process-local store.
+   */
   cache?: string
+  /** Explicit replay store, for consumers that do not register a Resource on the context. */
+  replay?: SignedRequestReplayStore
 }
 
+/** A create-once claim over one signed request identity. */
+export interface SignedRequestReplayStore {
+  claim: (id: string, expiresAt: Date) => Promise<boolean>
+}
+
+/** The small Resource surface needed by the Redis-compatible replay adapter. */
+export interface SignedRequestReplayResource extends BasicResource {
+  create: (record: Partial<ResourceRecord>, opts?: WriteOptions) => Promise<ResourceRecord>
+}

package/tests/basic-ed25519.spec.ts

@@ -0,0 +1,99 @@
+import { describe, expect, test } from 'bun:test'
+import { AuthenPayloadError, AuthroizationType } from '@owlmeans/auth'
+import {
+  BED255_NONCE_HEADER, BED255_SIG_TTL, BED255_TIME_HEADER, makeBasicEd25519Guard,
+  makeResourceSignedRequestReplayStore
+} from '@owlmeans/auth-common'
+import type { SignedRequestReplayResource } from '@owlmeans/auth-common'
+import type { AbstractRequest, AbstractResponse } from '@owlmeans/entrypoint'
+import type { Auth } from '@owlmeans/auth'
+import { RecordExists } from '@owlmeans/resource'
+import { makeTrustFixture, TRUSTED_ALIAS } from './context.js'
+
+const timeKey = BED255_TIME_HEADER.toLowerCase()
+const nonceKey = BED255_NONCE_HEADER.toLowerCase()
+
+const request = async (timestamp: string, nonce: string) => {
+  const fixture = makeTrustFixture({ withSecret: true, name: 'auth-common-tests' })
+  const body = { action: 'publish' }
+  const signature = await fixture.authKey.sign({
+    body,
+    headers: { [timeKey]: timestamp, [nonceKey]: nonce }
+  })
+  const req = {
+    alias: 'signed', body, headers: {
+      [timeKey]: timestamp,
+      [nonceKey]: nonce,
+      authorization: `${AuthroizationType.Ed25519BasicSignature.toUpperCase()} `
+        + `Credential=${fixture.authRecord.id} Signature=${signature}`,
+    }, params: {}, query: {}, path: '/signed'
+  } satisfies AbstractRequest
+  const guard = makeBasicEd25519Guard(TRUSTED_ALIAS)
+  fixture.ctx.registerService(guard)
+
+  return { fixture, guard, req }
+}
+
+const handle = async (
+  guard: ReturnType<typeof makeBasicEd25519Guard>, req: AbstractRequest
+): Promise<Auth | undefined> => {
+  let value: Auth | undefined
+  const response: AbstractResponse<Auth> = {
+    resolve: resolved => { value = resolved },
+    reject: error => { throw error }
+  }
+  await guard.handle(req, response)
+  return value
+}
+
+describe('@owlmeans/auth-common — signed request freshness and replay protection', () => {
+  test('accepts a canonical current timestamp once and rejects the replay by default', async () => {
+    const signed = await request(new Date().toISOString(), 'one-use-nonce')
+
+    expect((await handle(signed.guard, signed.req))?.userId).toBe(signed.fixture.authRecord.id)
+    await expect(handle(signed.guard, signed.req)).rejects.toBeInstanceOf(AuthenPayloadError)
+  })
+
+  test('rejects parseable but non-canonical timestamps', async () => {
+    const signed = await request(new Date().toUTCString(), 'non-canonical')
+
+    await expect(handle(signed.guard, signed.req)).rejects.toBeInstanceOf(AuthenPayloadError)
+  })
+
+  test('rejects timestamps outside the symmetric 60-second window', async () => {
+    const past = await request(new Date(Date.now() - BED255_SIG_TTL - 1_000).toISOString(), 'past')
+    const future = await request(new Date(Date.now() + BED255_SIG_TTL + 1_000).toISOString(), 'future')
+
+    await expect(handle(past.guard, past.req)).rejects.toBeInstanceOf(AuthenPayloadError)
+    await expect(handle(future.guard, future.req)).rejects.toBeInstanceOf(AuthenPayloadError)
+  })
+
+  test('rejects authentication when an injected replay store fails', async () => {
+    const signed = await request(new Date().toISOString(), 'store-failure')
+    const guard = makeBasicEd25519Guard(TRUSTED_ALIAS, {
+      replay: { claim: async () => { throw new Error('store unavailable') } }
+    })
+    signed.fixture.ctx.registerService(guard)
+
+    await expect(handle(guard, signed.req)).rejects.toBeInstanceOf(AuthenPayloadError)
+  })
+
+  test('adapts a create-once resource and forwards the absolute signed expiry', async () => {
+    let claimed = false
+    let observedExpiry: Date | undefined
+    const resource = {
+      create: async (record: { id?: string }, opts?: { ttl?: number | Date }) => {
+        if (claimed) throw new RecordExists(record.id ?? '')
+        claimed = true
+        observedExpiry = opts?.ttl as Date
+        return record
+      }
+    } as SignedRequestReplayResource
+    const replay = makeResourceSignedRequestReplayStore(resource)
+    const expiresAt = new Date(Date.now() + BED255_SIG_TTL)
+
+    expect(await replay.claim('service:nonce', expiresAt)).toBe(true)
+    expect(observedExpiry).toBe(expiresAt)
+    expect(await replay.claim('service:nonce', expiresAt)).toBe(false)
+  })
+})