@byok-sdk/cloud 0.9.0 → 0.10.0

package/dist/auth/plane.d.ts

@@ -29,6 +29,8 @@ export interface PairInput {
     readonly pairingCode: string;
     readonly deviceName: string;
     readonly devicePublicKey: string;
+    /** Optional client-hashed machine identity (protocol §6.1). Carried into registration verbatim; it is never a tenant or product authority. */
+    readonly machineId?: string;
 }
 export interface MintedAccessToken {
     readonly accessToken: string;

package/dist/index.js

@@ -190,7 +190,8 @@ function createAuthPlane(deps) {
         deviceName: input.deviceName,
         devicePublicKey: input.devicePublicKey,
         proofKeyId: DEVICE_IDENTITY_PROOF_KEY_ID,
-        proofKeyEpoch: DEVICE_IDENTITY_PROOF_KEY_EPOCH
+        proofKeyEpoch: DEVICE_IDENTITY_PROOF_KEY_EPOCH,
+        ...input.machineId === void 0 ? {} : { machineId: input.machineId }
       });
     },
     async resolveDevice(deviceId) {
@@ -833,7 +834,12 @@ function pairHandler(deps) {
   return async (c) => {
     const parsed = PairRequestSchema.safeParse(await readJsonBody(c));
     if (!parsed.success) {
-      return c.json({ error: "pairingCode, deviceName, and devicePublicKey are required strings" }, 400);
+      return c.json(
+        {
+          error: "pairingCode, deviceName, and devicePublicKey are required strings; optional machineId must be 64 lowercase hex characters"
+        },
+        400
+      );
     }
     const device = await deps.auth.redeemAndRegister(parsed.data);
     if (device === void 0) return c.json({ error: "invalid pairing code" }, 401);
@@ -3304,8 +3310,19 @@ var InMemoryDeviceDirectory = class {
       devicePublicKey: input.devicePublicKey,
       proofKeyId: input.proofKeyId,
       proofKeyEpoch: input.proofKeyEpoch,
-      revoked: false
+      revoked: false,
+      ...input.machineId === void 0 ? {} : { machineId: input.machineId }
     };
+    if (input.machineId !== void 0) {
+      for (const [key2, existing] of this.#byTenant) {
+        if (existing.revoked) continue;
+        if (existing.deviceId === record.deviceId) continue;
+        if (existing.tenantId !== tenant) continue;
+        if (existing.productId !== input.productId) continue;
+        if (existing.machineId !== input.machineId) continue;
+        this.#byTenant.set(key2, { ...existing, revoked: true });
+      }
+    }
     const key = tenantKey(tenant, record.deviceId);
     this.#byTenant.set(key, record);
     this.#byDeviceId.set(record.deviceId, key);