feat(device-plane): harden edge channel rotation

device-plane/packages/device-edge-channel-contract/test/contract.test.mjs

@@ -6,6 +6,7 @@ import {
   createChannelEnvelopeDecoder,
   encodeChannelEnvelope,
   nextReconnectDelay,
+  normalizeCertificateIdentities,
   normalizeChannelEnvelope,
 } from "../src/index.mjs";
 
@@ -75,3 +76,31 @@ test("uses bounded jittered exponential reconnect delays", () => {
     random: () => 0,
   }), 15_000);
 });
+
+test("allows exactly one active and at most one staged certificate generation", () => {
+  const activeFingerprint = "AA:".repeat(31) + "AA";
+  const stagedFingerprint = "BB:".repeat(31) + "BB";
+  const identities = normalizeCertificateIdentities([
+    {
+      generationRef: "trust-generation:1",
+      fingerprint: activeFingerprint,
+      status: "active",
+    },
+    {
+      generationRef: "trust-generation:2",
+      fingerprint: stagedFingerprint,
+      status: "staged",
+    },
+  ]);
+  assert.equal(identities.length, 2);
+  assert.equal(identities[0].status, "active");
+  assert.equal(identities[1].status, "staged");
+  assert.throws(() => normalizeCertificateIdentities([
+    { ...identities[0], status: "staged" },
+    identities[1],
+  ]), /active_certificate_identity_invalid/);
+  assert.throws(() => normalizeCertificateIdentities([
+    identities[0],
+    { ...identities[1], status: "active" },
+  ]), /active_certificate_identity_invalid/);
+});