feat(device-core): add restricted identity references

device-plane/packages/device-protocol-contract/test/contract.test.mjs

@@ -9,6 +9,8 @@ import {
   hashRestrictedIdentifier,
   normalizeDevicePlaneBinding,
   normalizeDiscoverySignal,
+  normalizeRestrictedIdentifierProjection,
+  normalizeRestrictedIdentifierRecord,
   toSafeDiscoveryView,
 } from "../src/index.mjs";
 
@@ -82,6 +84,32 @@ test("identifier hashing requires a strong process-only pepper", () => {
   );
 });
 
+test("restricted identifier records keep digest internal and expose only a mask", () => {
+  const record = normalizeRestrictedIdentifierRecord({
+    kind: "vendor.serial",
+    digest: `hmac-sha256:${"a".repeat(64)}`,
+    masked: "********ABCD",
+  });
+  const projection = normalizeRestrictedIdentifierProjection({
+    kind: record.kind,
+    masked: record.masked,
+  });
+
+  assert.deepEqual(projection, {
+    kind: "vendor.serial",
+    masked: "********ABCD",
+  });
+  assert.equal("digest" in projection, false);
+  assertSafeProjection({ identifier: projection });
+  assert.throws(
+    () => normalizeRestrictedIdentifierProjection({
+      kind: "vendor.serial",
+      masked: "SERIAL-PLAINTEXT",
+    }),
+    /restricted_identifier_projection_mask_invalid/,
+  );
+});
+
 test("rejects unverified framing and command-shaped discovery input", () => {
   assert.throws(
     () => normalizeDiscoverySignal({