Standalone Device Core application shell for Hub-authenticated device administration. It is intentionally vendor-neutral: adapters and model profiles describe protocol-specific behavior; projects, inventory, collections and access remain shared Device Core concepts.

Runtime boundary

The browser talks only to the Device Manager BFF under /api/device-manager/*.
Launcher consumes the one-time handoff and periodically revalidates the process-local, opaque Device Manager cookie.
The BFF derives the Core actor from that trusted Hub identity. Browser-supplied role, group or owner headers are ignored.
The BFF reads the Core bearer token from NODEDC_DEVICE_CORE_TOKEN_FILE; the token is never embedded into client assets or accepted as a raw environment value.
Device Control Core owns authorization, lifecycle validation, idempotency and persistence.
Query responses contain masked identifiers and bounded metadata only. Identifier and credential digests, external approval proofs, command parameters/transport refs, raw configuration documents and audit payloads stay inside Device Control Core.

The project workspace covers inventory, discovery, collections, adapter/profile metadata, Edges, routes, sessions, bindings, configuration state, the honest command ledger, immutable audit metadata and project grants. Navigation and actions are derived from effective project capabilities. Global adapter/profile/Edge mutation is additionally restricted to a Hub owner.

Command planning and transport intentionally have no Device Manager mutation route yet. The UI never presents sent as success: acknowledged and verified remain different ledger states, and the disabled transport policy is visible in the Commands section.

Hub currently supplies identity and groups but no signed company-membership/owner-scope claim. Therefore an admin may create projects in their personal scope. Existing company projects remain visible through explicit project grants, but company project creation stays closed until Hub extends the handoff contract.

Local source preview

The preview store starts empty and exists only to exercise the shell without a deployed Core. All visible resources must still be created through the same command-shaped BFF endpoints. It is forbidden when NODE_ENV=production.

NODEDC_DEVICE_MANAGER_LOCAL_PREVIEW=1 \
NODEDC_DEVICE_MANAGER_AUTH_REQUIRED=0 \
npm run build --workspace @nodedc/device-manager

NODEDC_DEVICE_MANAGER_LOCAL_PREVIEW=1 \
NODEDC_DEVICE_MANAGER_AUTH_REQUIRED=0 \
npm run serve --workspace @nodedc/device-manager

Production additionally requires:

NODEDC_LAUNCHER_BASE_URL
NODEDC_LAUNCHER_INTERNAL_URL
NODEDC_INTERNAL_ACCESS_TOKEN or NODEDC_PLATFORM_SERVICE_TOKEN
NODEDC_DEVICE_CORE_INTERNAL_URL
NODEDC_DEVICE_CORE_TOKEN_FILE

The application source does not create a Hub service entry, DNS record, reverse proxy, database or deployment artifact. Those remain explicit infrastructure phases.