@shelbyb/daywalker-sdk 0.1.3 → 0.1.4

package/README.md

@@ -210,10 +210,12 @@ Inbound tokens may be supplied as `x-api-token: srv_live_...` or `Authorization:
 
 Each outbound request signed by `@shelbyb/daywalker-sdk` includes:
 - `Content-Digest: sha-256=:<base64-encoded-hash>:`
-- `Signature-Input: sig1=("@method" "@path" "@authority" "content-digest");created=<unix_seconds>;keyid="<kid>";alg="ed25519"`
+- `Signature-Input: sig1=("@method" "@path" "@authority" "content-digest");created=<unix_seconds>;keyid="<kid>";alg="ed25519";nonce="<random>"`
 - `Signature: sig1=:<base64-encoded-signature>:`
 - `Authorization: Bearer <DAYWALKER_API_KEY>`
 
+A fresh random `nonce` is generated for every attempt (including retries), so identical requests in the same second still produce unique signatures and never trip replay protection. `validateToken()` also shares one in-flight request between concurrent callers for the same token, and briefly caches failures (`negativeCacheTtlMs`, default 3000ms; 429s and network errors are never cached).
+
 The exact signature base and test cases are verified against [`test-vectors/signing-rfc9421.json`](./test-vectors/signing-rfc9421.json).
 
 ---

package/dist/client.d.ts

@@ -9,6 +9,7 @@ export declare class Daywalker {
     private readonly _rawConfig;
     private _signingKeyPromise?;
     private readonly _cache;
+    private readonly _inflight;
     constructor(config?: DaywalkerConfig);
     get config(): ResolvedConfig;
     toJSON(): Record<string, unknown>;
@@ -31,6 +32,7 @@ export declare class Daywalker {
         forceRefresh?: boolean;
         offlineOnly?: boolean;
     }): Promise<ValidateResult>;
+    private _validateOnline;
     /**
      * Throws DaywalkerAuthError or DaywalkerRateLimitError if token is invalid or rate limited.
      */

package/dist/client.js

@@ -15,11 +15,20 @@ function parseRetryAfter(headerValue) {
     }
     return undefined;
 }
+function generateNonce() {
+    const bytes = new Uint8Array(16);
+    globalThis.crypto.getRandomValues(bytes);
+    let bin = "";
+    for (const b of bytes)
+        bin += String.fromCharCode(b);
+    return btoa(bin).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
 export class Daywalker {
     _config;
     _rawConfig;
     _signingKeyPromise;
     _cache = new Map();
+    _inflight = new Map();
     constructor(config = {}) {
         this._rawConfig = config;
         this._config = resolveConfig(config);
@@ -104,6 +113,7 @@ export class Daywalker {
                     key: signingKey,
                     keyid: this._config.keyId ?? undefined,
                     apiKey: this._config.apiKey ?? undefined,
+                    nonce: generateNonce(),
                 });
                 for (const [k, v] of Object.entries(signedHeaders)) {
                     if (v !== undefined) {
@@ -231,7 +241,25 @@ export class Daywalker {
                 message: "Offline verification requires DAYWALKER_PUBLIC_KEY and a valid JWT token lease",
             };
         }
-        // Online verification
+        // Online verification, deduplicated across concurrent callers
+        const inflightKey = `${cacheKey}`;
+        const pending = this._inflight.get(inflightKey);
+        if (pending)
+            return pending;
+        const run = this._validateOnline(token, serviceSlug, cacheKey).finally(() => {
+            this._inflight.delete(inflightKey);
+        });
+        this._inflight.set(inflightKey, run);
+        return run;
+    }
+    async _validateOnline(token, serviceSlug, cacheKey) {
+        const negTtl = this._config.negativeCacheTtlMs;
+        const fail = (result) => {
+            if (negTtl > 0 && result.error !== "RATE_LIMITED" && result.error !== "NETWORK_ERROR") {
+                this._cache.set(cacheKey, { result, expiresAt: Date.now() + negTtl });
+            }
+            return result;
+        };
         try {
             const validateBody = { token };
             if (serviceSlug) {
@@ -282,12 +310,12 @@ export class Daywalker {
             else if (json.error === "REVOKED" || /revoked/i.test(errMsg)) {
                 error = "REVOKED";
             }
-            return {
+            return fail({
                 ok: false,
                 error,
                 status: res.status,
                 message: redactSecrets(errMsg || `Validation failed with HTTP ${res.status}`),
-            };
+            });
         }
         catch (err) {
             return {

package/dist/config.d.ts

@@ -10,6 +10,7 @@ export interface ResolvedConfig {
     daywalkerPublicKey: string | PublicJwk | null;
     authUrl: string;
     cacheTtlMs: number;
+    negativeCacheTtlMs: number;
     maxRetries: number;
     problems: string[];
 }

package/dist/config.js

@@ -82,6 +82,7 @@ export function resolveConfig(options = {}) {
     const daywalkerPublicKey = options.daywalkerPublicKey ?? (env.DAYWALKER_PUBLIC_KEY ? env.DAYWALKER_PUBLIC_KEY.trim() : null);
     const authUrl = (options.authUrl ?? env.DAYWALKER_AUTH_URL ?? "https://auth.daywalker.dev").replace(/\/+$/, "");
     const cacheTtlMs = options.cacheTtlMs ?? 60_000;
+    const negativeCacheTtlMs = options.negativeCacheTtlMs ?? 3_000;
     const maxRetries = options.maxRetries ?? (options.retry?.maxRetries ?? 3);
     return {
         apiKey,
@@ -94,6 +95,7 @@ export function resolveConfig(options = {}) {
         daywalkerPublicKey,
         authUrl,
         cacheTtlMs,
+        negativeCacheTtlMs,
         maxRetries,
         problems,
     };

package/dist/types.d.ts

@@ -57,6 +57,8 @@ export interface DaywalkerConfig {
     daywalkerPublicKey?: string | PublicJwk;
     authUrl?: string;
     cacheTtlMs?: number;
+    /** Short cache for failed validations (not 429/network errors). Default 3000ms; 0 disables. */
+    negativeCacheTtlMs?: number;
     maxRetries?: number;
     retry?: RetryOptions;
     fetch?: typeof fetch;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shelbyb/daywalker-sdk",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "Validate Daywalker API tokens and make domain-signed calls to Daywalker Auth from any service.",
   "type": "module",
   "main": "./dist/index.js",