3 Commits

Include renames

Author	SHA1	Message	Date
Claude	cb9ff514a0	Signed requests: X-Nonce header; composite: sync skips unconfirmed writes ... - Requests carry a random X-Nonce, signed as ${timestamp}:${nonce}:${path}:${body}. The server rejects a nonce the same key already used within the timestamp window. Identical requests at the same moment (two tabs, parallel reads) are now distinct, replacing the per-process increasing-timestamp workaround. - Composite: a sync no longer reverts keys with local writes the source hasn't confirmed yet (in flight or queued); they briefly disappeared when a sync's scan ran before the write reached the source. Pending keys are reloaded from a persistent queue on start. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017Qxbkp4tA7G5SCWjzWuxmE	2026-10-23 14:50:16 +00:00
Claude	7d755cecae	Signed requests: strictly increasing timestamps per key ... Ed25519 signatures are deterministic, so two identical requests from one key in the same millisecond (e.g. two devices subscribing to the same path, or parallel identical reads) had the same signature, and the server rejected the second as a replay. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017Qxbkp4tA7G5SCWjzWuxmE	2026-10-23 14:36:25 +00:00
Claude	a8c9539ad9	Authenticated, scoped sync: signed requests and per-path subscriptions ... - RequestAuth: clients sign `${timestamp}:${path}:${body}` (as in sync-server-example); headers carry public key, timestamp, signature and algorithm. Pluggable signers/verifiers; Ed25519 via WebCrypto built in. Timestamp window and replay protection. - KVStorageHttpServer requires auth ('none' must be explicit). With auth, every key, scan range and subscription path must be under the caller's public key. - POST /events with { paths }: subscribers only receive (and on resume only replay) changes under their authorized paths. - KVStorageHttp: signer option; subscribe(path)/unsubscribe(path)/close() replace watch(); 401/403 reject instead of retrying. - KVStorageComposite: prefix option scopes sync, cache and subscription. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017Qxbkp4tA7G5SCWjzWuxmE	2026-10-23 10:01:06 +00:00