@byok-sdk/cloud-dataplane 0.9.1 → 0.10.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.js +57 -30
- package/dist/index.js.map +1 -1
- package/dist/runtime.js +57 -30
- package/dist/runtime.js.map +1 -1
- package/dist/sql/0015_device_machine_identity.sql +30 -0
- package/package.json +4 -4
|
@@ -0,0 +1,30 @@
|
|
|
1
|
+
-- 0015_device_machine_identity.sql — one physical machine, one active device row.
|
|
2
|
+
--
|
|
3
|
+
-- Additive only. `machine_id` is the client-hashed physical machine identity
|
|
4
|
+
-- from `PairRequest` (protocol §6.1): lowercase hex SHA-256 of the product id
|
|
5
|
+
-- and an OS-provided machine identifier, never the raw identifier and never a
|
|
6
|
+
-- tenant or product claim. Every device paired before this migration — and
|
|
7
|
+
-- every device that cannot identify its machine — keeps a NULL, which is why
|
|
8
|
+
-- the uniqueness below is partial rather than a plain unique key: NULLs are
|
|
9
|
+
-- not "one shared unidentified machine", they are the absence of the fact.
|
|
10
|
+
--
|
|
11
|
+
-- The index is the invariant, not the application's good behaviour. Two
|
|
12
|
+
-- concurrent pairings from the same machine race on exactly this key, so the
|
|
13
|
+
-- second one either supersedes the first inside its own transaction or fails
|
|
14
|
+
-- outright. `PostgresDeviceDirectory.register` revokes the prior active rows
|
|
15
|
+
-- and inserts in ONE transaction for that reason.
|
|
16
|
+
|
|
17
|
+
ALTER TABLE device
|
|
18
|
+
ADD COLUMN machine_id text;
|
|
19
|
+
|
|
20
|
+
ALTER TABLE device
|
|
21
|
+
ADD CONSTRAINT device_machine_id_shape
|
|
22
|
+
CHECK (machine_id IS NULL OR machine_id ~ '^[0-9a-f]{64}$');
|
|
23
|
+
|
|
24
|
+
-- Tenant-first by construction (§12.6.2 layer 3): the leading column is
|
|
25
|
+
-- `tenant_id`, so this key can never become a cross-tenant lookup path — one
|
|
26
|
+
-- tenant's machine digest addresses a different key space from another's, even
|
|
27
|
+
-- when the same physical machine pairs into both.
|
|
28
|
+
CREATE UNIQUE INDEX device_active_machine_key
|
|
29
|
+
ON device (tenant_id, product_id, machine_id)
|
|
30
|
+
WHERE machine_id IS NOT NULL AND NOT revoked;
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@byok-sdk/cloud-dataplane",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.10.0",
|
|
4
4
|
"description": "BYOK SDK hosted data plane: canonical Postgres + R2 stores, migrations, truth transactions, and maintenance",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"license": "MIT",
|
|
@@ -49,9 +49,9 @@
|
|
|
49
49
|
"clean": "rm -rf dist"
|
|
50
50
|
},
|
|
51
51
|
"dependencies": {
|
|
52
|
-
"@byok-sdk/cloud": "0.
|
|
53
|
-
"@byok-sdk/core": "0.
|
|
54
|
-
"@byok-sdk/protocol": "0.
|
|
52
|
+
"@byok-sdk/cloud": "0.10.0",
|
|
53
|
+
"@byok-sdk/core": "0.10.0",
|
|
54
|
+
"@byok-sdk/protocol": "0.10.0",
|
|
55
55
|
"aws4fetch": "1.0.20",
|
|
56
56
|
"fast-xml-parser": "^5.10.1",
|
|
57
57
|
"pg": "^8.22.0"
|