feat(device-edge): open bounded tracker ingress

device-plane/services/device-edge-channel/test/vps-runtime-config.test.mjs

@@ -0,0 +1,32 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+
+import {
+  normalizeTrackerIngressConfiguration,
+} from "../../../vps/edge-process/device-edge-runtime.mjs";
+
+test("VPS tracker ingress resolves one allowlisted profile within bounded limits", () => {
+  const config = normalizeTrackerIngressConfiguration({}, "edge:moscow-vps-1");
+
+  assert.equal(config.protocolProfileRef, "arusnavi.b2.internal.v1");
+  assert.equal(config.tcpHost, "0.0.0.0");
+  assert.equal(config.tcpPort, 9921);
+  assert.equal(config.maxConcurrentSessions, 128);
+  assert.equal(config.maxSessionsPerAddress, 16);
+  assert.equal(config.maxConnectionsPerMinutePerAddress, 60);
+  assert.equal(config.maxAggregateBufferedBytes, 32 * 1024 * 1024);
+});
+
+test("VPS tracker ingress rejects hidden bind and non-allowlisted adapters", () => {
+  assert.throws(() => normalizeTrackerIngressConfiguration({
+    DEVICE_GATEWAY_TCP_HOST: "127.0.0.1",
+  }, "edge:moscow-vps-1"), /public_host_invalid/);
+
+  assert.throws(() => normalizeTrackerIngressConfiguration({
+    DEVICE_GATEWAY_PROTOCOL_PROFILE_REF: "vendor.unknown.v1",
+  }, "edge:moscow-vps-1"), /profile_not_allowlisted/);
+
+  assert.throws(() => normalizeTrackerIngressConfiguration({
+    DEVICE_GATEWAY_MAX_SESSIONS: "129",
+  }, "edge:moscow-vps-1"), /session_limit_invalid/);
+});

device-plane/services/device-gateway/src/runtime.mjs

@@ -139,6 +139,9 @@ export function createDeviceGatewayRuntime(options = {}) {
     },
     status() {
       return {
+        adapter: config.adapter?.adapterRef ?? "disabled",
+        protocolProfile: config.profile?.profileRef ?? "disabled",
+        framing: config.profile?.framing?.status ?? "disabled",
         activeSessions: sessions.size,
         totalAccepted,
         totalRejected,