feat(core): add ontology-backed asset and host runtime

2026-08-22 14:47:44 +03:00
parent 6ed4414a97
commit b302b6ba1a
13 changed files with 1959 additions and 89 deletions
@@ -0,0 +1,154 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import {
+  DEVICE_ONTOLOGY_CATALOG_HASH,
+  normalizeOntologyManagementCommand,
+} from "../src/ontology-management.mjs";
+import {
+  ALL_DEVICE_MANAGEMENT_COMMAND_KINDS,
+  normalizeDeviceManagementCommand,
+} from "../src/management-command.mjs";
+
+const projectRef = "project:11111111-1111-4111-8111-111111111111";
+const deviceRef = "device:22222222-2222-4222-8222-222222222222";
+const assetRef = "asset:33333333-3333-4333-8333-333333333333";
+const hostRef = "host:44444444-4444-4444-8444-444444444444";
+const deploymentRef = "deployment:55555555-5555-4555-8555-555555555555";
+
+test("publishes the production ontology catalog contract", () => {
+  assert.equal(DEVICE_ONTOLOGY_CATALOG_HASH, "229c61c02a790906");
+  for (const kind of [
+    "asset.ensure",
+    "asset_binding.ensure",
+    "infrastructure_host.ensure",
+    "health_observation.record",
+  ]) {
+    assert.equal(ALL_DEVICE_MANAGEMENT_COMMAND_KINDS.includes(kind), true);
+  }
+});
+
+test("normalizes an asset and a temporal tracker binding", () => {
+  const asset = normalizeDeviceManagementCommand("asset.ensure", {
+    projectRef,
+    assetKey: "trike-001",
+    displayName: "Trike 001",
+    assetTypeRef: "asset-type:delivery-trike",
+  });
+  const binding = normalizeDeviceManagementCommand("asset_binding.ensure", {
+    projectRef,
+    bindingKey: "trike-001-primary-tracker",
+    deviceRef,
+    assetRef,
+    bindingKind: "tracking",
+    validFrom: "2026-08-22T10:00:00.000Z",
+    provenanceRef: "onboarding:direct-b2",
+  });
+
+  assert.equal(asset.assetKey, "trike-001");
+  assert.equal(binding.deviceId, deviceRef.slice("device:".length));
+  assert.equal(binding.assetId, assetRef.slice("asset:".length));
+  assert.equal(binding.bindingKind, "tracking");
+});
+
+test("normalizes provider-neutral host topology without browser credentials", () => {
+  const host = normalizeOntologyManagementCommand("infrastructure_host.ensure", {
+    projectRef,
+    hostKey: "b2-edge-moscow",
+    displayName: "B2 Edge Moscow",
+    providerRef: "provider:beget",
+    externalRef: "provider-resource:vps-123",
+    managementCredentialRef: "secret-ref:device-core/b2-edge-moscow",
+    lifecycleState: "active",
+  });
+  const deployment = normalizeOntologyManagementCommand(
+    "infrastructure_deployment.ensure",
+    {
+      projectRef,
+      hostRef,
+      deploymentKey: "device-edge-001",
+      displayName: "Device Edge 001",
+      artifactRef: "artifact:device-edge/1.0.0",
+      artifactDigest: `sha256:${"a".repeat(64)}`,
+    },
+  );
+  const service = normalizeOntologyManagementCommand(
+    "infrastructure_service_instance.ensure",
+    {
+      projectRef,
+      hostRef,
+      deploymentRef,
+      serviceKey: "device-edge",
+      displayName: "Device Edge",
+      serviceRole: "device.edge",
+    },
+  );
+
+  assert.equal(host.managementCredentialRef.startsWith("secret-ref:"), true);
+  assert.equal(deployment.hostId, hostRef.slice("host:".length));
+  assert.equal(service.serviceRole, "device.edge");
+  assert.equal("password" in host, false);
+});
+
+test("rejects credential-bearing endpoints and secret-shaped health evidence", () => {
+  assert.throws(
+    () => normalizeOntologyManagementCommand("infrastructure_endpoint.ensure", {
+      projectRef,
+      hostRef,
+      endpointKey: "ssh",
+      purpose: "management",
+      endpointUri: "ssh://root:password@example.test:22/",
+    }),
+    /device_endpoint_uri_invalid/,
+  );
+  assert.throws(
+    () => normalizeOntologyManagementCommand("health_observation.record", {
+      projectRef,
+      subjectKind: "host",
+      subjectRef: hostRef,
+      observedState: "reachable",
+      evidenceClass: "management_probe",
+      sourceRef: "probe:device-core",
+      schemaRef: "schema:health.v1",
+      evidence: { token: "forbidden" },
+      observedAt: "2026-08-22T10:00:00.000Z",
+      expiresAt: "2026-08-22T10:01:00.000Z",
+    }),
+    /forbidden_device_field/,
+  );
+});
+
+test("health is a bounded observation and not a permanent online flag", () => {
+  const command = normalizeOntologyManagementCommand(
+    "health_observation.record",
+    {
+      projectRef,
+      subjectKind: "host",
+      subjectRef: hostRef,
+      observedState: "reachable",
+      evidenceClass: "management_probe",
+      sourceRef: "probe:device-core",
+      schemaRef: "schema:health.v1",
+      evidence: { latencyMs: 42 },
+      observedAt: "2026-08-22T10:00:00.000Z",
+      expiresAt: "2026-08-22T10:01:00.000Z",
+    },
+  );
+  assert.equal(command.observedState, "reachable");
+  assert.equal(command.expiresAt, "2026-08-22T10:01:00.000Z");
+  assert.throws(
+    () => normalizeOntologyManagementCommand("health_observation.record", {
+      projectRef,
+      subjectKind: "host",
+      subjectRef: hostRef,
+      observedState: "reachable",
+      evidenceClass: "management_probe",
+      sourceRef: "probe:device-core",
+      schemaRef: "schema:health.v1",
+      evidence: {},
+      observedAt: command.observedAt,
+      expiresAt: command.observedAt,
+    }),
+    /device_health_freshness_window_invalid/,
+  );
+});