@byok-sdk/cloud-dataplane 0.4.2 → 0.5.0

package/dist/runtime.d.ts

@@ -26,7 +26,7 @@
  */
 export { createByokPool } from './pool';
 export type { ByokPoolOptions } from './pool';
-export { PostgresDeviceDirectory, PostgresInboundDedupStore, PostgresNonceStore, PostgresPairingCodeStore, PostgresProofRequestReceiptStore, PostgresRequestReceiptStore, PostgresTaskAttemptStore, PostgresActivityStore, PostgresApprovalTimelineStore, createPostgresCloudStores, } from './stores/index';
+export { PostgresDeviceDirectory, PostgresInboundDedupStore, PostgresNonceStore, PostgresPairingCodeStore, PostgresProofRequestReceiptStore, PostgresRequestReceiptStore, PostgresTaskAttemptStore, PostgresActivityStore, PostgresApprovalTimelineStore, PostgresDeviceAssertionReplayAuthority, createPostgresCloudStores, } from './stores/index';
 export type { PostgresCloudStoreOptions, PostgresCloudStores, PostgresObjectStorageOptions, } from './stores/index';
 export { DEFAULT_MAX_ATTEMPTS, DEFAULT_PRESIGN_TTL_SECONDS, DEFAULT_RETRY_DELAY_MS, MAX_PRESIGN_TTL_SECONDS, MIN_PRESIGN_TTL_SECONDS, ObjectStoreRequestError, R2_BLOB_ERROR_CODES, R2BlobStoreError, R2CloudBlobStore, R2ObjectMaintenanceStore, } from './stores/index';
 export type { ObjectStoreFetch, R2BlobErrorCode, R2BlobStoreOptions } from './stores/index';

package/dist/runtime.js

@@ -1382,6 +1382,55 @@ var PostgresApprovalTimelineStore = class {
   }
 };
 
+// src/stores/device-assertion-replay.ts
+var PostgresDeviceAssertionReplayAuthority = class {
+  #pool;
+  constructor(pool) {
+    this.#pool = pool;
+  }
+  async consume(input) {
+    if (!Number.isFinite(Date.parse(input.expiresAt))) {
+      throw new Error("device assertion replay expiry is invalid");
+    }
+    const result = await this.#pool.query(
+      `INSERT INTO device_assertion_replay (
+         tenant_id, issuer, product_id, device_id, audience, jti, expires_at
+       )
+       VALUES ($1, $2, $3, $4, $5, $6, $7)
+       ON CONFLICT (tenant_id, issuer, product_id, device_id, audience, jti) DO NOTHING
+       RETURNING jti`,
+      [
+        input.tenantId,
+        input.issuer,
+        input.productId,
+        input.deviceId,
+        input.audience,
+        input.jti,
+        input.expiresAt
+      ]
+    );
+    return result.rowCount === 1;
+  }
+  /** Bounded retention cleanup; callers choose cadence and batch size. */
+  async deleteExpired(before, limit) {
+    if (!Number.isFinite(before.getTime()) || !Number.isSafeInteger(limit) || limit <= 0) {
+      throw new Error("device assertion replay cleanup bounds are invalid");
+    }
+    const result = await this.#pool.query(
+      `DELETE FROM device_assertion_replay
+       WHERE ctid IN (
+         SELECT ctid
+         FROM device_assertion_replay
+         WHERE expires_at <= $1
+         ORDER BY expires_at
+         LIMIT $2
+       )`,
+      [before.toISOString(), limit]
+    );
+    return result.rowCount ?? 0;
+  }
+};
+
 // src/stores/index.ts
 function createPostgresCloudStores(options) {
   const { pool, clock, crypto } = options;
@@ -3304,6 +3353,6 @@ var PostgresTruthCommitter = class {
   }
 };
 
-export { DEFAULT_MAX_ATTEMPTS, DEFAULT_PRESIGN_TTL_SECONDS, DEFAULT_RETRY_DELAY_MS, MAX_PRESIGN_TTL_SECONDS, MIN_PRESIGN_TTL_SECONDS, ObjectStoreRequestError, PostgresActivityStore, PostgresApprovalTimelineStore, PostgresBoardStore, PostgresDeviceDirectory, PostgresInboundDedupStore, PostgresMailboxStore, PostgresNonceStore, PostgresObjectStore, PostgresPairingCodeStore, PostgresPresenceStore, PostgresProofRequestReceiptStore, PostgresQuotaStore, PostgresRequestReceiptStore, PostgresSkillPackStore, PostgresTaskAttemptStore, PostgresTruthCommitter, PostgresTruthStore, R2BlobStoreError, R2CloudBlobStore, R2ObjectMaintenanceStore, R2_BLOB_ERROR_CODES, createByokPool, createPostgresCloudStores, createPostgresCoreStores };
+export { DEFAULT_MAX_ATTEMPTS, DEFAULT_PRESIGN_TTL_SECONDS, DEFAULT_RETRY_DELAY_MS, MAX_PRESIGN_TTL_SECONDS, MIN_PRESIGN_TTL_SECONDS, ObjectStoreRequestError, PostgresActivityStore, PostgresApprovalTimelineStore, PostgresBoardStore, PostgresDeviceAssertionReplayAuthority, PostgresDeviceDirectory, PostgresInboundDedupStore, PostgresMailboxStore, PostgresNonceStore, PostgresObjectStore, PostgresPairingCodeStore, PostgresPresenceStore, PostgresProofRequestReceiptStore, PostgresQuotaStore, PostgresRequestReceiptStore, PostgresSkillPackStore, PostgresTaskAttemptStore, PostgresTruthCommitter, PostgresTruthStore, R2BlobStoreError, R2CloudBlobStore, R2ObjectMaintenanceStore, R2_BLOB_ERROR_CODES, createByokPool, createPostgresCloudStores, createPostgresCoreStores };
 //# sourceMappingURL=runtime.js.map
 //# sourceMappingURL=runtime.js.map