@byok-sdk/cloud 0.10.1 → 0.10.2

package/dist/index.js

@@ -3310,17 +3310,18 @@ var InMemoryDeviceDirectory = class {
       devicePublicKey: input.devicePublicKey,
       proofKeyId: input.proofKeyId,
       proofKeyEpoch: input.proofKeyEpoch,
+      // Always false, and there is no writer that sets it true — see the file
+      // header. The field stays because every auth path reads it.
       revoked: false,
       ...input.machineId === void 0 ? {} : { machineId: input.machineId }
     };
     if (input.machineId !== void 0) {
-      for (const [key2, existing] of this.#byTenant) {
-        if (existing.revoked) continue;
+      for (const [key2, existing] of [...this.#byTenant]) {
         if (existing.deviceId === record.deviceId) continue;
         if (existing.tenantId !== tenant) continue;
         if (existing.productId !== input.productId) continue;
         if (existing.machineId !== input.machineId) continue;
-        this.#byTenant.set(key2, { ...existing, revoked: true });
+        this.#forget(key2, existing.deviceId);
       }
     }
     const key = tenantKey(tenant, record.deviceId);
@@ -3331,11 +3332,24 @@ var InMemoryDeviceDirectory = class {
   async get(tenant, deviceId) {
     return this.#byTenant.get(tenantKey(tenant, deviceId));
   }
+  /**
+   * Revocation removes the registration. A no-op for a device this tenant does
+   * not own: revoking what you cannot address changes nothing.
+   */
   async revoke(tenant, deviceId) {
     const key = tenantKey(tenant, deviceId);
-    const record = this.#byTenant.get(key);
-    if (record === void 0) return;
-    this.#byTenant.set(key, { ...record, revoked: true });
+    if (!this.#byTenant.has(key)) return;
+    this.#forget(key, deviceId);
+  }
+  /**
+   * Drops a record from the composite map and, only when it still points here,
+   * from the pre-tenant index. A re-registration under the same deviceId has
+   * already re-pointed that index, and a stale delete would blind
+   * `/byok/challenge` to a device that is currently paired.
+   */
+  #forget(key, deviceId) {
+    this.#byTenant.delete(key);
+    if (this.#byDeviceId.get(deviceId) === key) this.#byDeviceId.delete(deviceId);
   }
   async recordCapabilities(tenant, input) {
     const key = tenantKey(tenant, input.deviceId);