next-evolve 0.3.1 → 0.3.3

package/dist/server/aggregate-route.d.ts

@@ -12,5 +12,14 @@ export type AggregateRouteDeps = {
 };
 /** Delivery ids seen in the last 10 minutes, shared by every signed cloud → app route. */
 export declare function sharedReplayGuard(): ReplayGuard;
+/**
+ * True when a verified call is new: its delivery id and its signed message
+ * (`t` + body) are both unseen. The delivery id isn't covered by the
+ * signature, so checking it alone would let a captured call be replayed under
+ * a fresh id within the signature window (T12.5).
+ */
+export declare function firstDelivery(guard: ReplayGuard, delivery: string | null, t: number, body: string): boolean;
+/** True the first time this signed message (`t` + body) is seen in the replay window. */
+export declare function firstMessage(guard: ReplayGuard, t: number, body: string): boolean;
 export declare function handleAggregate(req: Request, deps: AggregateRouteDeps): Promise<Response>;
 export {};

package/dist/server/aggregate-route.js

@@ -1,5 +1,6 @@
 import { runAggregate } from "../aggregate/run.js";
 import { DELIVERY_HEADER, SIGNATURE_HEADER, aggregateRequestSchema, createReplayGuard, isSupportedProtocol, parseSecretKey, signBody, unsupportedProtocolBody, verifyBody } from "@next-evolve/protocol";
+import { createHash } from "node:crypto";
 // src/server/aggregate-route.ts
 const MAX_BODY_BYTES = 262144;
 const KEY = Symbol.for("next-evolve.replay");
@@ -9,6 +10,19 @@ function sharedReplayGuard() {
 	g[KEY] ??= createReplayGuard();
 	return g[KEY];
 }
+/**
+* True when a verified call is new: its delivery id and its signed message
+* (`t` + body) are both unseen. The delivery id isn't covered by the
+* signature, so checking it alone would let a captured call be replayed under
+* a fresh id within the signature window (T12.5).
+*/
+function firstDelivery(guard, delivery, t, body) {
+	return !!delivery && guard.check(delivery) && firstMessage(guard, t, body);
+}
+/** True the first time this signed message (`t` + body) is seen in the replay window. */
+function firstMessage(guard, t, body) {
+	return guard.check(`msg:${t}:${createHash("sha256").update(body).digest("base64url")}`);
+}
 const json = (status, body, headers = {}) => Response.json(body, {
 	status,
 	headers
@@ -25,8 +39,7 @@ async function handleAggregate(req, deps) {
 		error: "invalid_signature",
 		reason: sig.reason
 	});
-	const delivery = req.headers.get(DELIVERY_HEADER) ?? "";
-	if (!(deps.replay ?? sharedReplayGuard()).check(delivery)) return json(409, { error: "replayed" });
+	if (!firstDelivery(deps.replay ?? sharedReplayGuard(), req.headers.get(DELIVERY_HEADER), sig.t, body)) return json(409, { error: "replayed" });
 	let parsed;
 	try {
 		parsed = JSON.parse(body);
@@ -65,4 +78,4 @@ async function handleAggregate(req, deps) {
 		}
 	});
 }
-export { handleAggregate, sharedReplayGuard };
+export { firstDelivery, firstMessage, handleAggregate, sharedReplayGuard };

package/dist/server/sync-route.js

@@ -1,5 +1,5 @@
 import { logRateLimited } from "../core/log.js";
-import { sharedReplayGuard } from "./aggregate-route.js";
+import { firstMessage, sharedReplayGuard } from "./aggregate-route.js";
 import { DELIVERY_HEADER, SIGNATURE_HEADER, SUPPORTED_PROTOCOLS, isSupportedProtocol, parseSecretKey, syncWebhookSchema, unsupportedProtocolBody, verifyBody } from "@next-evolve/protocol";
 // src/server/sync-route.ts
 /** Cache tag on the render-side bundle fetch (spec §7.7). */
@@ -31,7 +31,9 @@ async function handleSync(req, deps) {
 		error: "invalid_signature",
 		reason: sig.reason
 	});
-	if (!(deps.replay ?? sharedReplayGuard()).check(req.headers.get(DELIVERY_HEADER) ?? "")) return json(409, { error: "replayed" });
+	const guard = deps.replay ?? sharedReplayGuard();
+	const delivery = req.headers.get(DELIVERY_HEADER);
+	if (!delivery || !guard.check(delivery)) return json(409, { error: "replayed" });
 	let parsed;
 	try {
 		parsed = JSON.parse(body);
@@ -48,6 +50,7 @@ async function handleSync(req, deps) {
 		protocol: { supported: SUPPORTED_PROTOCOLS }
 	});
 	if (r.data.site !== site) return json(403, { error: "site_mismatch" });
+	if (!firstMessage(guard, sig.t, body)) return json(409, { error: "replayed" });
 	if (!(!current || r.data.ver > current.ver || r.data.ver === current.ver && r.data.iat > current.iat)) return json(202, {
 		accepted: false,
 		reason: "current"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "next-evolve",
-  "version": "0.3.1",
+  "version": "0.3.3",
   "description": "Self-improving Next.js sites: server-side variants with no flicker, measured in your own Postgres.",
   "license": "MIT",
   "type": "module",