next-evolve 0.3.2 → 0.3.3

package/dist/server/aggregate-route.d.ts

@@ -19,5 +19,7 @@ export declare function sharedReplayGuard(): ReplayGuard;
  * a fresh id within the signature window (T12.5).
  */
 export declare function firstDelivery(guard: ReplayGuard, delivery: string | null, t: number, body: string): boolean;
+/** True the first time this signed message (`t` + body) is seen in the replay window. */
+export declare function firstMessage(guard: ReplayGuard, t: number, body: string): boolean;
 export declare function handleAggregate(req: Request, deps: AggregateRouteDeps): Promise<Response>;
 export {};

package/dist/server/aggregate-route.js

@@ -17,7 +17,10 @@ function sharedReplayGuard() {
 * a fresh id within the signature window (T12.5).
 */
 function firstDelivery(guard, delivery, t, body) {
-	if (!delivery || !guard.check(delivery)) return false;
+	return !!delivery && guard.check(delivery) && firstMessage(guard, t, body);
+}
+/** True the first time this signed message (`t` + body) is seen in the replay window. */
+function firstMessage(guard, t, body) {
 	return guard.check(`msg:${t}:${createHash("sha256").update(body).digest("base64url")}`);
 }
 const json = (status, body, headers = {}) => Response.json(body, {
@@ -75,4 +78,4 @@ async function handleAggregate(req, deps) {
 		}
 	});
 }
-export { firstDelivery, handleAggregate, sharedReplayGuard };
+export { firstDelivery, firstMessage, handleAggregate, sharedReplayGuard };

package/dist/server/sync-route.js

@@ -1,5 +1,5 @@
 import { logRateLimited } from "../core/log.js";
-import { firstDelivery, sharedReplayGuard } from "./aggregate-route.js";
+import { firstMessage, sharedReplayGuard } from "./aggregate-route.js";
 import { DELIVERY_HEADER, SIGNATURE_HEADER, SUPPORTED_PROTOCOLS, isSupportedProtocol, parseSecretKey, syncWebhookSchema, unsupportedProtocolBody, verifyBody } from "@next-evolve/protocol";
 // src/server/sync-route.ts
 /** Cache tag on the render-side bundle fetch (spec §7.7). */
@@ -32,7 +32,8 @@ async function handleSync(req, deps) {
 		reason: sig.reason
 	});
 	const guard = deps.replay ?? sharedReplayGuard();
-	if (!firstDelivery(guard, req.headers.get(DELIVERY_HEADER), sig.t, body)) return json(409, { error: "replayed" });
+	const delivery = req.headers.get(DELIVERY_HEADER);
+	if (!delivery || !guard.check(delivery)) return json(409, { error: "replayed" });
 	let parsed;
 	try {
 		parsed = JSON.parse(body);
@@ -49,6 +50,7 @@ async function handleSync(req, deps) {
 		protocol: { supported: SUPPORTED_PROTOCOLS }
 	});
 	if (r.data.site !== site) return json(403, { error: "site_mismatch" });
+	if (!firstMessage(guard, sig.t, body)) return json(409, { error: "replayed" });
 	if (!(!current || r.data.ver > current.ver || r.data.ver === current.ver && r.data.iat > current.iat)) return json(202, {
 		accepted: false,
 		reason: "current"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "next-evolve",
-  "version": "0.3.2",
+  "version": "0.3.3",
   "description": "Self-improving Next.js sites: server-side variants with no flicker, measured in your own Postgres.",
   "license": "MIT",
   "type": "module",