Documents finding: no replay protection in NIP-98 verification. Token replay within 120s window succeeds (mitigated by JWT issuance being idempotent). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- poll-responses.test.ts: 10 tests covering lifecycle, timeout, duplicate rejection - nip98.test.ts: 7 tests covering valid token, expiry, method, signature, tags - bot-auth.test.ts: 5 tests covering header auth, query params, invalid credentials Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>