feat(device-plane): add fail-closed deploy foundation

device-plane/services/device-control-core/Dockerfile

@@ -0,0 +1,14 @@
+FROM node:22-alpine
+
+WORKDIR /app
+
+COPY package.json package-lock.json ./
+COPY packages ./packages
+COPY services/device-control-core ./services/device-control-core
+COPY services/device-gateway/package.json ./services/device-gateway/package.json
+
+RUN npm ci --omit=dev --ignore-scripts
+
+USER node
+
+CMD ["node", "services/device-control-core/src/server.mjs"]

device-plane/services/device-control-core/migrations/001_device_plane_foundation.sql

@@ -0,0 +1,99 @@
+begin;
+
+create table if not exists device_model_profiles (
+  profile_ref text primary key,
+  schema_version text not null,
+  vendor text not null,
+  model text not null,
+  device_type text not null,
+  protocol text not null,
+  profile jsonb not null,
+  created_at timestamptz not null default now(),
+  updated_at timestamptz not null default now()
+);
+
+create table if not exists device_contours (
+  id uuid primary key,
+  owner_scope text not null,
+  name text not null,
+  lifecycle_state text not null default 'active'
+    check (lifecycle_state in ('active', 'suspended', 'retired')),
+  created_at timestamptz not null default now(),
+  updated_at timestamptz not null default now(),
+  unique (owner_scope, name)
+);
+
+create table if not exists device_discoveries (
+  id uuid primary key,
+  identifier_kind text not null,
+  identifier_digest text not null,
+  identifier_masked text not null,
+  model_profile_ref text not null references device_model_profiles(profile_ref),
+  protocol text not null,
+  lifecycle_state text not null default 'quarantine'
+    check (lifecycle_state in ('quarantine', 'claimed', 'rejected', 'expired')),
+  first_observed_at timestamptz not null,
+  last_observed_at timestamptz not null,
+  evidence jsonb not null,
+  claimed_device_id uuid,
+  claimed_at timestamptz,
+  claimed_by text,
+  created_at timestamptz not null default now(),
+  updated_at timestamptz not null default now(),
+  unique (identifier_kind, identifier_digest, model_profile_ref)
+);
+
+create index if not exists device_discoveries_state_last_seen_idx
+  on device_discoveries (lifecycle_state, last_observed_at desc);
+
+create table if not exists device_instances (
+  id uuid primary key,
+  contour_id uuid not null references device_contours(id),
+  model_profile_ref text not null references device_model_profiles(profile_ref),
+  display_name text not null,
+  identifier_kind text not null,
+  identifier_digest text not null,
+  identifier_masked text not null,
+  credential_ref text,
+  lifecycle_state text not null default 'claimed'
+    check (lifecycle_state in ('claimed', 'online', 'offline', 'suspended', 'retired')),
+  created_at timestamptz not null default now(),
+  updated_at timestamptz not null default now(),
+  unique (identifier_kind, identifier_digest, model_profile_ref)
+);
+
+alter table device_discoveries
+  drop constraint if exists device_discoveries_claimed_device_fk;
+
+alter table device_discoveries
+  add constraint device_discoveries_claimed_device_fk
+  foreign key (claimed_device_id) references device_instances(id);
+
+create table if not exists device_bindings (
+  id uuid primary key,
+  contour_id uuid not null references device_contours(id),
+  target_kind text not null,
+  target_ref text not null,
+  capabilities text[] not null,
+  lifecycle_state text not null default 'active'
+    check (lifecycle_state in ('active', 'revoked')),
+  created_at timestamptz not null default now(),
+  updated_at timestamptz not null default now(),
+  unique (contour_id, target_kind, target_ref)
+);
+
+create table if not exists device_audit_events (
+  id uuid primary key,
+  event_type text not null,
+  actor_ref text not null,
+  contour_id uuid,
+  device_id uuid,
+  discovery_id uuid,
+  payload jsonb not null,
+  occurred_at timestamptz not null default now()
+);
+
+create index if not exists device_audit_events_device_time_idx
+  on device_audit_events (device_id, occurred_at desc);
+
+commit;

device-plane/services/device-control-core/package.json

@@ -0,0 +1,16 @@
+{
+  "name": "@nodedc/device-control-core",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "start": "node src/server.mjs",
+    "test": "node --test test/*.test.mjs"
+  },
+  "dependencies": {
+    "pg": "^8.18.0"
+  },
+  "engines": {
+    "node": ">=20"
+  }
+}

device-plane/services/device-control-core/src/app.mjs

@@ -0,0 +1,152 @@
+import { timingSafeEqual } from "node:crypto";
+import { createServer } from "node:http";
+
+import {
+  assertSafeProjection,
+  hashRestrictedIdentifier,
+  normalizeDiscoverySignal,
+  toSafeDiscoveryView,
+} from "../../../packages/device-protocol-contract/src/index.mjs";
+
+export function createControlCoreApp({
+  repository,
+  gatewayToken = "",
+  identifierPepper = "",
+  discoveryIngestEnabled = false,
+} = {}) {
+  if (!repository || typeof repository.health !== "function") {
+    throw new TypeError("device_repository_required");
+  }
+  if (discoveryIngestEnabled) {
+    if (typeof repository.upsertQuarantineDiscovery !== "function") {
+      throw new TypeError("device_discovery_repository_required");
+    }
+    if (typeof gatewayToken !== "string" || gatewayToken.length < 32) {
+      throw new TypeError("device_gateway_token_invalid");
+    }
+    if (typeof identifierPepper !== "string" || identifierPepper.length < 32) {
+      throw new TypeError("device_identifier_pepper_invalid");
+    }
+  }
+
+  const server = createServer(async (request, response) => {
+    response.setHeader("Content-Type", "application/json; charset=utf-8");
+    response.setHeader("Cache-Control", "no-store");
+    response.setHeader("X-Content-Type-Options", "nosniff");
+
+    try {
+      const requestUrl = new URL(
+        request.url || "/",
+        `http://${request.headers.host || "127.0.0.1"}`,
+      );
+
+      if (request.method === "GET" && requestUrl.pathname === "/healthz") {
+        const database = await repository.health();
+        return writeJson(response, 200, {
+          ok: true,
+          service: "nodedc-device-control-core",
+          database,
+          discoveryIngest: discoveryIngestEnabled ? "enabled" : "disabled",
+          commandTransport: "disabled",
+        });
+      }
+
+      if (
+        request.method === "POST"
+        && requestUrl.pathname === "/internal/v1/device-discoveries:observe"
+      ) {
+        if (!discoveryIngestEnabled) {
+          return writeJson(response, 404, {
+            ok: false,
+            error: "device_discovery_ingest_disabled",
+          });
+        }
+        if (!matchesBearer(request.headers.authorization, gatewayToken)) {
+          return writeJson(response, 401, {
+            ok: false,
+            error: "device_gateway_auth_required",
+          });
+        }
+
+        const input = await readJsonBody(request, 32 * 1024);
+        const signal = normalizeDiscoverySignal(input);
+        const identifierDigest = hashRestrictedIdentifier(
+          signal.identifier,
+          identifierPepper,
+        );
+        const safeView = assertSafeProjection(toSafeDiscoveryView(signal));
+        const discovery = await repository.upsertQuarantineDiscovery({
+          identifierDigest,
+          safeView,
+        });
+        return writeJson(response, discovery.created ? 201 : 200, {
+          ok: true,
+          created: discovery.created,
+          discovery: assertSafeProjection(discovery.value),
+        });
+      }
+
+      return writeJson(response, 404, {
+        ok: false,
+        error: "device_control_core_route_not_found",
+      });
+    } catch (error) {
+      const status = Number(error?.statusCode || 400);
+      return writeJson(
+        response,
+        Number.isInteger(status) && status >= 400 && status < 600
+          ? status
+          : 500,
+        {
+          ok: false,
+          error: safeErrorCode(error),
+        },
+      );
+    }
+  });
+
+  return server;
+}
+
+function matchesBearer(header, expected) {
+  if (typeof header !== "string" || !header.startsWith("Bearer ")) return false;
+  const actual = Buffer.from(header.slice("Bearer ".length), "utf8");
+  const required = Buffer.from(expected, "utf8");
+  return (
+    actual.length === required.length
+    && required.length > 0
+    && timingSafeEqual(actual, required)
+  );
+}
+
+async function readJsonBody(request, maxBytes) {
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of request) {
+    size += chunk.length;
+    if (size > maxBytes) {
+      const error = new Error("device_request_body_too_large");
+      error.statusCode = 413;
+      throw error;
+    }
+    chunks.push(chunk);
+  }
+  if (size === 0) throw new TypeError("device_request_body_required");
+  try {
+    return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+  } catch {
+    throw new TypeError("device_request_json_invalid");
+  }
+}
+
+function writeJson(response, status, body) {
+  response.statusCode = status;
+  return response.end(`${JSON.stringify(body)}\n`);
+}
+
+function safeErrorCode(error) {
+  const value = error instanceof Error ? error.message : "device_control_error";
+  return /^[a-z0-9_:-]{1,128}$/.test(value)
+    ? value
+    : "device_control_error";
+}

device-plane/services/device-control-core/src/database-config.mjs

@@ -0,0 +1,73 @@
+import { readFile } from "node:fs/promises";
+
+export async function resolveDeviceDatabaseUrl(
+  environment = process.env,
+  readSecret = readFile,
+) {
+  const explicit = optionalValue(environment.DEVICE_DATABASE_URL);
+  if (explicit) return explicit;
+
+  const host = restrictedValue(
+    environment.DEVICE_DATABASE_HOST,
+    /^[A-Za-z0-9.-]{1,253}$/,
+    "device_database_host_invalid",
+  );
+  const port = parsePort(environment.DEVICE_DATABASE_PORT, 5432);
+  const database = restrictedValue(
+    environment.DEVICE_DATABASE_NAME,
+    /^[A-Za-z_][A-Za-z0-9_-]{0,62}$/,
+    "device_database_name_invalid",
+  );
+  const user = restrictedValue(
+    environment.DEVICE_DATABASE_USER,
+    /^[A-Za-z_][A-Za-z0-9_-]{0,62}$/,
+    "device_database_user_invalid",
+  );
+  const passwordFile = requiredValue(
+    environment.DEVICE_DATABASE_PASSWORD_FILE,
+    "device_database_password_file_required",
+  );
+  const password = (await readSecret(passwordFile, "utf8")).trim();
+  if (password.length < 32 || password.length > 512) {
+    throw new Error("device_database_password_invalid");
+  }
+
+  return [
+    "postgresql://",
+    encodeURIComponent(user),
+    ":",
+    encodeURIComponent(password),
+    "@",
+    host,
+    ":",
+    String(port),
+    "/",
+    encodeURIComponent(database),
+    "?sslmode=disable",
+  ].join("");
+}
+
+function optionalValue(value) {
+  if (typeof value !== "string") return "";
+  return value.trim();
+}
+
+function requiredValue(value, errorCode) {
+  const normalized = optionalValue(value);
+  if (!normalized) throw new Error(errorCode);
+  return normalized;
+}
+
+function restrictedValue(value, pattern, errorCode) {
+  const normalized = requiredValue(value, errorCode);
+  if (!pattern.test(normalized)) throw new Error(errorCode);
+  return normalized;
+}
+
+function parsePort(value, fallback) {
+  const parsed = Number(value || fallback);
+  if (!Number.isSafeInteger(parsed) || parsed < 1 || parsed > 65535) {
+    throw new Error("device_database_port_invalid");
+  }
+  return parsed;
+}

device-plane/services/device-control-core/src/postgres-repository.mjs

@@ -0,0 +1,128 @@
+import { randomUUID } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+import pg from "pg";
+
+import { ARUSNAVI_B2_MODEL_PROFILE } from "../../../packages/arusnavi-b2-adapter/src/index.mjs";
+
+const { Pool } = pg;
+const serviceRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+
+export class PostgresDeviceRepository {
+  constructor({ databaseUrl, poolSize = 10 } = {}) {
+    if (typeof databaseUrl !== "string" || databaseUrl.trim() === "") {
+      throw new TypeError("device_database_url_required");
+    }
+    this.pool = new Pool({
+      connectionString: databaseUrl,
+      max: normalizePoolSize(poolSize),
+    });
+  }
+
+  async migrate() {
+    const sql = await readFile(
+      resolve(serviceRoot, "migrations/001_device_plane_foundation.sql"),
+      "utf8",
+    );
+    await this.pool.query(sql);
+    await this.pool.query(
+      `insert into device_model_profiles (
+        profile_ref,
+        schema_version,
+        vendor,
+        model,
+        device_type,
+        protocol,
+        profile
+      ) values ($1, $2, $3, $4, $5, $6, $7::jsonb)
+      on conflict (profile_ref) do update set
+        schema_version = excluded.schema_version,
+        profile = excluded.profile,
+        updated_at = now()`,
+      [
+        ARUSNAVI_B2_MODEL_PROFILE.profileRef,
+        ARUSNAVI_B2_MODEL_PROFILE.schemaVersion,
+        ARUSNAVI_B2_MODEL_PROFILE.vendor,
+        ARUSNAVI_B2_MODEL_PROFILE.model,
+        ARUSNAVI_B2_MODEL_PROFILE.deviceType,
+        ARUSNAVI_B2_MODEL_PROFILE.protocol,
+        JSON.stringify(ARUSNAVI_B2_MODEL_PROFILE),
+      ],
+    );
+  }
+
+  async health() {
+    await this.pool.query("select 1");
+    return "ready";
+  }
+
+  async upsertQuarantineDiscovery({ identifierDigest, safeView }) {
+    const result = await this.pool.query(
+      `insert into device_discoveries (
+        id,
+        identifier_kind,
+        identifier_digest,
+        identifier_masked,
+        model_profile_ref,
+        protocol,
+        lifecycle_state,
+        first_observed_at,
+        last_observed_at,
+        evidence
+      ) values ($1, $2, $3, $4, $5, $6, 'quarantine', $7, $7, $8::jsonb)
+      on conflict (identifier_kind, identifier_digest, model_profile_ref)
+      do update set
+        last_observed_at = greatest(
+          device_discoveries.last_observed_at,
+          excluded.last_observed_at
+        ),
+        evidence = excluded.evidence,
+        updated_at = now()
+      returning id, lifecycle_state, model_profile_ref, protocol,
+        identifier_kind, identifier_masked, first_observed_at,
+        last_observed_at, (xmax = 0) as created`,
+      [
+        randomUUID(),
+        safeView.identifier.kind,
+        identifierDigest,
+        safeView.identifier.masked,
+        safeView.modelProfileRef,
+        safeView.protocol,
+        safeView.observedAt,
+        JSON.stringify(safeView.evidence),
+      ],
+    );
+    const row = result.rows[0];
+    return {
+      created: row.created === true,
+      value: {
+        schemaVersion: "nodedc.device.discovery-view.v1",
+        discoveryRef: `discovery:${row.id}`,
+        modelProfileRef: row.model_profile_ref,
+        protocol: row.protocol,
+        observedAt: new Date(row.last_observed_at).toISOString(),
+        lifecycleState: row.lifecycle_state,
+        identifier: {
+          kind: row.identifier_kind,
+          masked: row.identifier_masked,
+        },
+        evidence: safeView.evidence,
+        commandTransport: "disabled",
+      },
+    };
+  }
+
+  async close() {
+    await this.pool.end();
+  }
+}
+
+function normalizePoolSize(value) {
+  const parsed = Number(value);
+  if (!Number.isSafeInteger(parsed) || parsed < 1 || parsed > 50) {
+    throw new TypeError("device_database_pool_size_invalid");
+  }
+  return parsed;
+}

device-plane/services/device-control-core/src/server.mjs

@@ -0,0 +1,107 @@
+import { readFile } from "node:fs/promises";
+
+import { createControlCoreApp } from "./app.mjs";
+import { resolveDeviceDatabaseUrl } from "./database-config.mjs";
+import { PostgresDeviceRepository } from "./postgres-repository.mjs";
+
+const config = await readConfig();
+const repository = new PostgresDeviceRepository({
+  databaseUrl: config.databaseUrl,
+  poolSize: config.databasePoolSize,
+});
+
+await repository.migrate();
+
+const server = createControlCoreApp({
+  repository,
+  gatewayToken: config.gatewayToken,
+  identifierPepper: config.identifierPepper,
+  discoveryIngestEnabled: config.discoveryIngestEnabled,
+});
+
+server.listen(config.port, config.host, () => {
+  console.log(JSON.stringify({
+    event: "device_control_core_started",
+    host: config.host,
+    port: config.port,
+    discoveryIngest: config.discoveryIngestEnabled,
+    commandTransport: "disabled",
+  }));
+});
+
+process.on("SIGTERM", shutdown);
+process.on("SIGINT", shutdown);
+
+async function shutdown() {
+  server.close(async () => {
+    await repository.close();
+    process.exit(0);
+  });
+}
+
+async function readConfig() {
+  const discoveryIngestEnabled = parseBoolean(
+    process.env.DEVICE_DISCOVERY_INGEST_ENABLED,
+    false,
+  );
+  return {
+    host: String(process.env.HOST || "127.0.0.1").trim(),
+    port: parsePort(process.env.PORT, 18120),
+    databaseUrl: await resolveDeviceDatabaseUrl(process.env),
+    databasePoolSize: parsePositiveInt(
+      process.env.DEVICE_DATABASE_POOL_SIZE,
+      10,
+    ),
+    discoveryIngestEnabled,
+    gatewayToken: discoveryIngestEnabled
+      ? await readRequiredSecretFile(
+          process.env.DEVICE_GATEWAY_CORE_TOKEN_FILE,
+          "device_gateway_core_token_file_required",
+        )
+      : "",
+    identifierPepper: discoveryIngestEnabled
+      ? await readRequiredSecretFile(
+          process.env.DEVICE_IDENTIFIER_PEPPER_FILE,
+          "device_identifier_pepper_file_required",
+        )
+      : "",
+  };
+}
+
+async function readRequiredSecretFile(path, errorCode) {
+  const normalized = requiredValue(path, errorCode);
+  const value = (await readFile(normalized, "utf8")).trim();
+  if (value.length < 32) throw new Error(errorCode);
+  return value;
+}
+
+function requiredValue(value, errorCode) {
+  if (typeof value !== "string" || value.trim() === "") {
+    throw new Error(errorCode);
+  }
+  return value.trim();
+}
+
+function parsePort(value, fallback) {
+  const parsed = Number(value || fallback);
+  if (!Number.isSafeInteger(parsed) || parsed < 1 || parsed > 65535) {
+    throw new Error("device_control_port_invalid");
+  }
+  return parsed;
+}
+
+function parsePositiveInt(value, fallback) {
+  const parsed = Number(value || fallback);
+  if (!Number.isSafeInteger(parsed) || parsed < 1) {
+    throw new Error("device_positive_integer_invalid");
+  }
+  return parsed;
+}
+
+function parseBoolean(value, fallback) {
+  if (value === undefined || value === null || value === "") return fallback;
+  const normalized = String(value).trim().toLowerCase();
+  if (["1", "true", "yes", "on"].includes(normalized)) return true;
+  if (["0", "false", "no", "off"].includes(normalized)) return false;
+  throw new Error("device_boolean_invalid");
+}

device-plane/services/device-control-core/test/app.test.mjs

@@ -0,0 +1,143 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import {
+  DEVICE_DISCOVERY_SIGNAL_SCHEMA,
+} from "../../../packages/device-protocol-contract/src/index.mjs";
+import { createControlCoreApp } from "../src/app.mjs";
+
+const gatewayToken = "test-only-gateway-token-with-32-bytes";
+const identifierPepper = "test-only-identifier-pepper-with-32-bytes";
+const fakeImei = "000000000000001";
+
+test("health reports database readiness and disabled command transport", async () => {
+  const runtime = await startTestServer({
+    repository: {
+      health: async () => "ready",
+    },
+  });
+  try {
+    const response = await fetch(`${runtime.baseUrl}/healthz`);
+    assert.equal(response.status, 200);
+    assert.deepEqual(await response.json(), {
+      ok: true,
+      service: "nodedc-device-control-core",
+      database: "ready",
+      discoveryIngest: "disabled",
+      commandTransport: "disabled",
+    });
+  } finally {
+    await runtime.close();
+  }
+});
+
+test("discovery ingest is closed by default", async () => {
+  const runtime = await startTestServer({
+    repository: {
+      health: async () => "ready",
+    },
+  });
+  try {
+    const response = await fetch(
+      `${runtime.baseUrl}/internal/v1/device-discoveries:observe`,
+      {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: "{}",
+      },
+    );
+    assert.equal(response.status, 404);
+    assert.equal(
+      (await response.json()).error,
+      "device_discovery_ingest_disabled",
+    );
+  } finally {
+    await runtime.close();
+  }
+});
+
+test("authenticated ingest stores only digest and returns a masked view", async () => {
+  let stored;
+  const runtime = await startTestServer({
+    discoveryIngestEnabled: true,
+    gatewayToken,
+    identifierPepper,
+    repository: {
+      health: async () => "ready",
+      upsertQuarantineDiscovery: async (value) => {
+        stored = value;
+        return {
+          created: true,
+          value: {
+            ...value.safeView,
+            discoveryRef: "discovery:test-001",
+          },
+        };
+      },
+    },
+  });
+  try {
+    const unauthorized = await fetch(
+      `${runtime.baseUrl}/internal/v1/device-discoveries:observe`,
+      {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(fakeSignal()),
+      },
+    );
+    assert.equal(unauthorized.status, 401);
+
+    const response = await fetch(
+      `${runtime.baseUrl}/internal/v1/device-discoveries:observe`,
+      {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${gatewayToken}`,
+          "Content-Type": "application/json",
+        },
+        body: JSON.stringify(fakeSignal()),
+      },
+    );
+    assert.equal(response.status, 201);
+    const body = await response.json();
+    const serialized = JSON.stringify(body);
+    assert.equal(serialized.includes(fakeImei), false);
+    assert.equal(body.discovery.identifier.masked, "***********0001");
+    assert.match(stored.identifierDigest, /^hmac-sha256:[a-f0-9]{64}$/);
+    assert.equal(JSON.stringify(stored).includes(fakeImei), false);
+  } finally {
+    await runtime.close();
+  }
+});
+
+function fakeSignal() {
+  return {
+    schemaVersion: DEVICE_DISCOVERY_SIGNAL_SCHEMA,
+    sessionRef: "session:test-001",
+    modelProfileRef: "arusnavi.b2.internal.v1",
+    protocol: "INTERNAL",
+    observedAt: "2026-07-25T00:00:00.000Z",
+    identifier: { kind: "imei", value: fakeImei },
+    evidence: {
+      transport: "tcp",
+      bytesObserved: 128,
+      framingStatus: "verified",
+      specificationRef: "arusnavi.internal.framing.test-v1",
+    },
+  };
+}
+
+async function startTestServer(options) {
+  const server = createControlCoreApp(options);
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", resolve);
+  });
+  const address = server.address();
+  return {
+    baseUrl: `http://127.0.0.1:${address.port}`,
+    close: () => new Promise((resolve, reject) => {
+      server.close((error) => (error ? reject(error) : resolve()));
+    }),
+  };
+}

device-plane/services/device-control-core/test/database-config.test.mjs

@@ -0,0 +1,50 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import { resolveDeviceDatabaseUrl } from "../src/database-config.mjs";
+
+test("builds the database URL from a file-backed password", async () => {
+  const password = "test-only-database-password-with-32-bytes";
+  const url = await resolveDeviceDatabaseUrl(
+    {
+      DEVICE_DATABASE_HOST: "device-postgres",
+      DEVICE_DATABASE_PORT: "5432",
+      DEVICE_DATABASE_NAME: "device_plane",
+      DEVICE_DATABASE_USER: "device_plane",
+      DEVICE_DATABASE_PASSWORD_FILE: "/run/test/postgres-password",
+    },
+    async (path, encoding) => {
+      assert.equal(path, "/run/test/postgres-password");
+      assert.equal(encoding, "utf8");
+      return `${password}\n`;
+    },
+  );
+
+  assert.equal(
+    url,
+    `postgresql://device_plane:${encodeURIComponent(password)}@device-postgres:5432/device_plane?sslmode=disable`,
+  );
+});
+
+test("rejects a short file-backed database password", async () => {
+  await assert.rejects(
+    resolveDeviceDatabaseUrl(
+      {
+        DEVICE_DATABASE_HOST: "device-postgres",
+        DEVICE_DATABASE_NAME: "device_plane",
+        DEVICE_DATABASE_USER: "device_plane",
+        DEVICE_DATABASE_PASSWORD_FILE: "/run/test/postgres-password",
+      },
+      async () => "too-short",
+    ),
+    /device_database_password_invalid/,
+  );
+});
+
+test("keeps an explicit database URL as a compatibility-only boundary", async () => {
+  const explicit = "postgresql://local:test@127.0.0.1:5432/device_plane";
+  assert.equal(
+    await resolveDeviceDatabaseUrl({ DEVICE_DATABASE_URL: explicit }),
+    explicit,
+  );
+});

device-plane/services/device-control-core/test/migration.test.mjs

@@ -0,0 +1,32 @@
+import assert from "node:assert/strict";
+import { readFile } from "node:fs/promises";
+import test from "node:test";
+
+const migrationUrl = new URL(
+  "../migrations/001_device_plane_foundation.sql",
+  import.meta.url,
+);
+
+test("foundation migration keeps restricted identifiers hashed and DB private", async () => {
+  const sql = await readFile(migrationUrl, "utf8");
+  assert.match(sql, /identifier_digest text not null/);
+  assert.match(sql, /identifier_masked text not null/);
+  assert.doesNotMatch(sql, /imei\s+text/i);
+  assert.doesNotMatch(sql, /password\s+text/i);
+  assert.doesNotMatch(sql, /raw_packet/i);
+});
+
+test("foundation migration has quarantine, contour, binding and audit tables", async () => {
+  const sql = await readFile(migrationUrl, "utf8");
+  for (const table of [
+    "device_model_profiles",
+    "device_contours",
+    "device_discoveries",
+    "device_instances",
+    "device_bindings",
+    "device_audit_events",
+  ]) {
+    assert.match(sql, new RegExp(`create table if not exists ${table}`));
+  }
+  assert.match(sql, /default 'quarantine'/);
+});