@byok-sdk/cloud 0.10.1 → 0.11.0

package/dist/stores/in-memory/device-directory.d.ts

@@ -3,9 +3,15 @@
  *
  * Rows live under a `(tenant, deviceId)` composite key, so a cross-tenant read
  * is not "denied" — it addresses a different key space and finds nothing
- * (§12.6.2 layer 3). The pre-tenant index below holds the SAME record objects,
- * so a revocation applied through the composite key is immediately visible to
- * `/byok/challenge` and `/byok/token` with no second copy to keep in sync.
+ * (§12.6.2 layer 3). The pre-tenant index below maps a deviceId to that same
+ * composite key, so a revocation applied through the composite key is
+ * immediately visible to `/byok/challenge` and `/byok/token` with no second
+ * copy to keep in sync — and a deleted row is removed from BOTH in one step.
+ *
+ * Revocation DELETES. `DeviceRecord.revoked` survives as the field every auth
+ * path already reads, but no record this store writes ever carries `true`:
+ * revocation and machine supersession remove the record outright, so "revoked"
+ * and "never registered" are one indistinguishable answer rather than two.
  */
 import { type PresenceStore, type TenantId, type TenantReadiness } from '@byok-sdk/core';
 import type { DeviceDirectory, DeviceRecord, DeviceRegistration } from '../ports';
@@ -13,6 +19,10 @@ export declare class InMemoryDeviceDirectory implements DeviceDirectory {
     #private;
     register(tenant: TenantId, input: DeviceRegistration): Promise<DeviceRecord>;
     get(tenant: TenantId, deviceId: string): Promise<DeviceRecord | undefined>;
+    /**
+     * Revocation removes the registration. A no-op for a device this tenant does
+     * not own: revoking what you cannot address changes nothing.
+     */
     revoke(tenant: TenantId, deviceId: string): Promise<void>;
     recordCapabilities(tenant: TenantId, input: {
         readonly deviceId: string;

package/dist/stores/ports.d.ts

@@ -50,6 +50,12 @@ export interface DeviceRecord {
     readonly proofKeyId: string;
     /** Current proof signing-key rotation generation. */
     readonly proofKeyEpoch: number;
+    /**
+     * Always `false`. Revocation and machine supersession DELETE the record, so
+     * no implementation ever produces a `true` here; the field stays because
+     * every auth path reads it and a missing row must fail exactly as a revoked
+     * one used to.
+     */
     readonly revoked: boolean;
     /**
      * Client-hashed physical machine identity (lowercase hex SHA-256), when the
@@ -65,7 +71,7 @@ export interface DeviceRecord {
      */
     readonly capabilities?: readonly string[];
 }
-/** Everything `POST /byok/pair` knows at registration time. `tenantId` is the store's first parameter; `revoked` is the store's own to set. */
+/** Everything `POST /byok/pair` knows at registration time. `tenantId` is the store's first parameter; `revoked` is the store's own to set (always `false`). */
 export interface DeviceRegistration {
     readonly productId: string;
     readonly deviceId: string;
@@ -75,27 +81,46 @@ export interface DeviceRegistration {
     readonly proofKeyEpoch: number;
     /**
      * Optional client-hashed physical machine identity from `PairRequest`. When
-     * present, `register` revokes this tenant/product's prior non-revoked rows
-     * carrying the same value before inserting, so one physical machine holds
-     * one active device row per product. It names no tenant and no product of
+     * present, `register` DELETES this tenant/product's prior rows carrying the
+     * same value — and the device-scoped state those rows were the only reason
+     * to keep — before inserting, so one physical machine holds one device row
+     * per product. It names no tenant and no product of
      * its own — both still come from the redeemed pairing code's claims — so it
      * can only ever supersede rows the caller already addressed.
      */
     readonly machineId?: string;
 }
 export interface DeviceDirectory {
-    /** Registers the device. With `input.machineId` set this ALSO revokes this tenant/product's prior non-revoked rows carrying that same machine identity — one physical machine, one active row. */
+    /** Registers the device. With `input.machineId` set this ALSO deletes this tenant/product's prior rows carrying that same machine identity — one physical machine, one row. */
     register(tenant: TenantId, input: DeviceRegistration): Promise<DeviceRecord>;
     /** The row `tenant` owns under `deviceId` — `undefined` including when the device exists under a DIFFERENT tenant. */
     get(tenant: TenantId, deviceId: string): Promise<DeviceRecord | undefined>;
+    /**
+     * Deletes the registration and the device-scoped state it owned (presence,
+     * challenge nonces, assertion-replay entries, inbound dedup) — never the
+     * history keyed by the device_id string. A no-op for a device this tenant
+     * cannot address. Afterwards every read answers exactly as it does for a
+     * device that was never registered.
+     *
+     * How far the deletion physically reaches is driver-scoped. The durable
+     * (Postgres) driver deletes the registration and every dependent
+     * device-scoped row in the same transaction, so the state is gone the moment
+     * `revoke` resolves. The in-memory reference directory deletes only the
+     * registration: its sibling stores are separate maps it does not own, so a
+     * presence hint expires on its own `expiresAt` TTL and, until then, is
+     * excluded from every projection by the readiness active-device filter
+     * (`activeDeviceIds`, built from the surviving rows). The observable contract
+     * above holds either way — no read path can see a revoked device.
+     */
     revoke(tenant: TenantId, deviceId: string): Promise<void>;
     list(tenant: TenantId): Promise<readonly DeviceRecord[]>;
-    /** Set-wise tenant observation; revoked devices never contribute presence. */
+    /** Set-wise tenant observation. `revokedDeviceCount` is structurally 0 — a revoked device has no row to count. */
     readiness(tenant: TenantId, presence: PresenceStore): Promise<TenantReadiness>;
     /**
      * Persist a capability snapshot obtained from an authenticated device
-     * message. Implementations may return `undefined` for an unknown/revoked
-     * device; callers must fail closed in that case.
+     * message. Implementations may return `undefined` for an unknown (including
+     * revoked, which is the same absence) device; callers must fail closed in
+     * that case.
      */
     recordCapabilities(tenant: TenantId, input: {
         readonly deviceId: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@byok-sdk/cloud",
-  "version": "0.10.1",
+  "version": "0.11.0",
   "description": "BYOK SDK hosted device surface: stateless frozen-v1 HTTP handlers over tenant-first @byok-sdk/core ports",
   "type": "module",
   "license": "MIT",
@@ -44,8 +44,8 @@
     "clean": "rm -rf dist"
   },
   "dependencies": {
-    "@byok-sdk/core": "0.10.1",
-    "@byok-sdk/protocol": "0.10.1",
+    "@byok-sdk/core": "0.11.0",
+    "@byok-sdk/protocol": "0.11.0",
     "hono": "^4.12.30",
     "zod": "^4.4.3"
   }