feat(device-plane): add universal adapter acceptance boundary

device-plane/services/device-control-core/src/app.mjs

@@ -5,9 +5,12 @@ import {
   assertSafeProjection,
   hashRestrictedIdentifier,
   maskRestrictedIdentifier,
+  normalizeAdapterAcceptance,
+  normalizeAdapterMessage,
   normalizeDiscoverySignal,
   normalizeRestrictedIdentifier,
   toSafeDiscoveryView,
+  toSafeAdapterMessageView,
 } from "../../../packages/device-protocol-contract/src/index.mjs";
 import {
   normalizeManagementActor,
@@ -64,6 +67,9 @@ export function createControlCoreApp({
     if (typeof repository.upsertQuarantineDiscovery !== "function") {
       throw new TypeError("device_discovery_repository_required");
     }
+    if (typeof repository.acceptAdapterMessage !== "function") {
+      throw new TypeError("device_gateway_message_repository_required");
+    }
     if (typeof gatewayToken !== "string" || gatewayToken.length < 32) {
       throw new TypeError("device_gateway_token_invalid");
     }
@@ -249,6 +255,55 @@ export function createControlCoreApp({
         });
       }
 
+      if (
+        request.method === "POST"
+        && requestUrl.pathname === "/internal/v1/gateway/messages:accept"
+      ) {
+        if (!discoveryIngestEnabled) {
+          return writeJson(response, 404, {
+            ok: false,
+            error: "device_gateway_message_ingest_disabled",
+          });
+        }
+        if (!matchesBearer(request.headers.authorization, gatewayToken)) {
+          return writeJson(response, 401, {
+            ok: false,
+            error: "device_gateway_auth_required",
+          });
+        }
+
+        const input = await readJsonBody(request, 1024 * 1024);
+        const message = normalizeAdapterMessage(input);
+        const identifierDigest = hashRestrictedIdentifier(
+          message.identifier,
+          identifierPepper,
+        );
+        const safeView = assertSafeProjection(toSafeAdapterMessageView(message));
+        const requestDigest = gatewayMessageRequestDigest({
+          edgeRef: safeView.edgeRef,
+          adapterRef: safeView.adapterRef,
+          protocolProfileRef: safeView.protocolProfileRef,
+          protocol: safeView.protocol,
+          routeRef: safeView.routeRef ?? null,
+          idempotencyKey: safeView.idempotencyKey,
+          identifierKind: safeView.identifier.kind,
+          identifierDigest,
+          payloadSchemaRef: safeView.payloadSchemaRef,
+          payload: safeView.payload,
+        });
+        const acceptance = normalizeAdapterAcceptance(
+          await repository.acceptAdapterMessage({
+            identifierDigest,
+            requestDigest,
+            safeView,
+          }),
+        );
+        return writeJson(response, acceptance.replayed ? 200 : 201, {
+          ok: true,
+          acceptance,
+        });
+      }
+
       return writeJson(response, 404, {
         ok: false,
         error: "device_control_core_route_not_found",
@@ -366,6 +421,12 @@ function managementRequestDigest(value) {
     .digest("hex")}`;
 }
 
+function gatewayMessageRequestDigest(value) {
+  return `sha256:${createHash("sha256")
+    .update(JSON.stringify(value), "utf8")
+    .digest("hex")}`;
+}
+
 function matchesBearer(header, expected) {
   if (typeof header !== "string" || !header.startsWith("Bearer ")) return false;
   const actual = Buffer.from(header.slice("Bearer ".length), "utf8");