next-evolve 0.3.1 → 0.3.2

package/dist/server/aggregate-route.d.ts

@@ -12,5 +12,12 @@ export type AggregateRouteDeps = {
 };
 /** Delivery ids seen in the last 10 minutes, shared by every signed cloud → app route. */
 export declare function sharedReplayGuard(): ReplayGuard;
+/**
+ * True when a verified call is new: its delivery id and its signed message
+ * (`t` + body) are both unseen. The delivery id isn't covered by the
+ * signature, so checking it alone would let a captured call be replayed under
+ * a fresh id within the signature window (T12.5).
+ */
+export declare function firstDelivery(guard: ReplayGuard, delivery: string | null, t: number, body: string): boolean;
 export declare function handleAggregate(req: Request, deps: AggregateRouteDeps): Promise<Response>;
 export {};

package/dist/server/aggregate-route.js

@@ -1,5 +1,6 @@
 import { runAggregate } from "../aggregate/run.js";
 import { DELIVERY_HEADER, SIGNATURE_HEADER, aggregateRequestSchema, createReplayGuard, isSupportedProtocol, parseSecretKey, signBody, unsupportedProtocolBody, verifyBody } from "@next-evolve/protocol";
+import { createHash } from "node:crypto";
 // src/server/aggregate-route.ts
 const MAX_BODY_BYTES = 262144;
 const KEY = Symbol.for("next-evolve.replay");
@@ -9,6 +10,16 @@ function sharedReplayGuard() {
 	g[KEY] ??= createReplayGuard();
 	return g[KEY];
 }
+/**
+* True when a verified call is new: its delivery id and its signed message
+* (`t` + body) are both unseen. The delivery id isn't covered by the
+* signature, so checking it alone would let a captured call be replayed under
+* a fresh id within the signature window (T12.5).
+*/
+function firstDelivery(guard, delivery, t, body) {
+	if (!delivery || !guard.check(delivery)) return false;
+	return guard.check(`msg:${t}:${createHash("sha256").update(body).digest("base64url")}`);
+}
 const json = (status, body, headers = {}) => Response.json(body, {
 	status,
 	headers
@@ -25,8 +36,7 @@ async function handleAggregate(req, deps) {
 		error: "invalid_signature",
 		reason: sig.reason
 	});
-	const delivery = req.headers.get(DELIVERY_HEADER) ?? "";
-	if (!(deps.replay ?? sharedReplayGuard()).check(delivery)) return json(409, { error: "replayed" });
+	if (!firstDelivery(deps.replay ?? sharedReplayGuard(), req.headers.get(DELIVERY_HEADER), sig.t, body)) return json(409, { error: "replayed" });
 	let parsed;
 	try {
 		parsed = JSON.parse(body);
@@ -65,4 +75,4 @@ async function handleAggregate(req, deps) {
 		}
 	});
 }
-export { handleAggregate, sharedReplayGuard };
+export { firstDelivery, handleAggregate, sharedReplayGuard };

package/dist/server/sync-route.js

@@ -1,5 +1,5 @@
 import { logRateLimited } from "../core/log.js";
-import { sharedReplayGuard } from "./aggregate-route.js";
+import { firstDelivery, sharedReplayGuard } from "./aggregate-route.js";
 import { DELIVERY_HEADER, SIGNATURE_HEADER, SUPPORTED_PROTOCOLS, isSupportedProtocol, parseSecretKey, syncWebhookSchema, unsupportedProtocolBody, verifyBody } from "@next-evolve/protocol";
 // src/server/sync-route.ts
 /** Cache tag on the render-side bundle fetch (spec §7.7). */
@@ -31,7 +31,8 @@ async function handleSync(req, deps) {
 		error: "invalid_signature",
 		reason: sig.reason
 	});
-	if (!(deps.replay ?? sharedReplayGuard()).check(req.headers.get(DELIVERY_HEADER) ?? "")) return json(409, { error: "replayed" });
+	const guard = deps.replay ?? sharedReplayGuard();
+	if (!firstDelivery(guard, req.headers.get(DELIVERY_HEADER), sig.t, body)) return json(409, { error: "replayed" });
 	let parsed;
 	try {
 		parsed = JSON.parse(body);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "next-evolve",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "Self-improving Next.js sites: server-side variants with no flicker, measured in your own Postgres.",
   "license": "MIT",
   "type": "module",