@7365admin1/core 3.85.0 → 3.87.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.85.0",
+  "version": "3.87.0",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -13,7 +13,7 @@
     "build": "tsup src/index.ts --format cjs,esm --dts && shx cp -r src/public dist && shx cp -r src/utils/handlebars dist",
     "release": "yarn run build && changeset publish",
     "lint": "tsc",
-    "test": "tsup src/config.ts src/utils/building-map.util.ts src/utils/robot-cloud.util.ts src/utils/robot-adapter.util.ts src/utils/robot-tracking.util.ts src/utils/robot-apps.util.ts src/utils/robot-permission.util.ts src/utils/lift-contract.util.ts src/utils/anpr-revoke.util.ts src/utils/anpr-plate.util.ts src/utils/vehicle-request.util.ts src/utils/camera-view.util.ts src/utils/camera-bulk-import.util.ts src/utils/dashboard-metrics.util.ts src/utils/camera-capability.util.ts src/utils/camera-playback.util.ts src/services/camera-device-http.service.ts src/utils/camera-alert.util.ts src/utils/dahua-protocol.util.ts src/utils/site-name.util.ts src/utils/service-provider-invite.util.ts src/utils/notification-category.util.ts src/utils/hid-card.util.ts src/utils/hid-json.util.ts src/utils/hid-access.util.ts src/models/customer-site.model.ts src/models/site-camera.model.ts src/models/member.model.ts src/models/subscription.model.ts src/utils/session-id.util.ts src/utils/occurrence-query.util.ts src/utils/occurrence-book-create.util.ts src/utils/update-result.util.ts src/utils/hid-amico-authz.util.ts src/utils/promo-code-currency.util.ts src/utils/console-audit.util.ts src/utils/org-suspension.util.ts src/utils/session-revoke.util.ts src/models/hid-amico.model.ts src/models/patrol-email.model.ts src/utils/patrol-email-pdf.util.ts src/utils/visitor-status.util.ts src/utils/self-service-email.util.ts src/utils/hid-secret.util.ts src/models/visitor-invite.model.ts src/models/guard-invite.model.ts src/utils/site-timezone.util.ts src/utils/bulletin-service-apps.util.ts src/models/bulletin-board.model.ts src/utils/vehicle-import.util.ts src/utils/expired-vehicle-sweep.util.ts src/models/vehicle.model.ts src/controllers/chat.controller.ts src/utils/file-owner.util.ts src/utils/console-permission.util.ts src/utils/role-scope.util.ts src/utils/org-default-roles.util.ts src/utils/org-modules.util.ts src/utils/site-modules.util.ts src/utils/resident-app-modules.util.ts src/utils/resident-default-role.util.ts src/utils/invite-role-scope.util.ts src/models/personal-emergency-chain.model.ts src/utils/self-signup-files.util.ts src/models/person.model.ts src/utils/module-gate.util.ts src/utils/member-lookup.util.ts src/utils/notification-access.util.ts src/utils/module-access.util.ts src/services/module-gate.service.ts src/controllers/site.controller.ts src/controllers/organization.controller.ts src/controllers/member.controller.ts src/utils/org-owner-repair.util.ts src/utils/socket-session.util.ts src/utils/people-create-gate.util.ts src/utils/service-app-type.util.ts --format esm --out-dir test/.build --no-dts --silent && node --test test/*.test.mjs",
+    "test": "tsup src/config.ts src/utils/building-map.util.ts src/utils/robot-cloud.util.ts src/utils/robot-adapter.util.ts src/utils/png-encoder.util.ts src/services/demo.adapter.ts src/utils/robot-fault.util.ts src/utils/robot-tracking.util.ts src/utils/robot-apps.util.ts src/utils/robot-permission.util.ts src/utils/lift-contract.util.ts src/utils/anpr-revoke.util.ts src/utils/anpr-plate.util.ts src/utils/vehicle-request.util.ts src/utils/camera-view.util.ts src/utils/camera-bulk-import.util.ts src/utils/dashboard-metrics.util.ts src/utils/camera-capability.util.ts src/utils/camera-playback.util.ts src/services/camera-device-http.service.ts src/utils/camera-alert.util.ts src/utils/dahua-protocol.util.ts src/utils/site-name.util.ts src/utils/service-provider-invite.util.ts src/utils/notification-category.util.ts src/utils/hid-card.util.ts src/utils/hid-json.util.ts src/utils/hid-access.util.ts src/models/customer-site.model.ts src/models/site-camera.model.ts src/models/member.model.ts src/models/subscription.model.ts src/utils/session-id.util.ts src/utils/occurrence-query.util.ts src/utils/occurrence-book-create.util.ts src/utils/update-result.util.ts src/utils/hid-amico-authz.util.ts src/utils/promo-code-currency.util.ts src/utils/console-audit.util.ts src/utils/org-suspension.util.ts src/utils/session-revoke.util.ts src/models/hid-amico.model.ts src/models/patrol-email.model.ts src/utils/patrol-email-pdf.util.ts src/utils/visitor-status.util.ts src/utils/self-service-email.util.ts src/utils/hid-secret.util.ts src/models/visitor-invite.model.ts src/models/guard-invite.model.ts src/utils/site-timezone.util.ts src/utils/bulletin-service-apps.util.ts src/models/bulletin-board.model.ts src/utils/vehicle-import.util.ts src/utils/expired-vehicle-sweep.util.ts src/models/vehicle.model.ts src/controllers/chat.controller.ts src/utils/file-owner.util.ts src/utils/console-permission.util.ts src/utils/role-scope.util.ts src/utils/org-default-roles.util.ts src/utils/org-modules.util.ts src/utils/site-modules.util.ts src/utils/resident-app-modules.util.ts src/utils/resident-default-role.util.ts src/utils/invite-role-scope.util.ts src/models/personal-emergency-chain.model.ts src/utils/self-signup-files.util.ts src/models/person.model.ts src/utils/module-gate.util.ts src/utils/member-lookup.util.ts src/utils/notification-access.util.ts src/utils/module-access.util.ts src/services/module-gate.service.ts src/controllers/site.controller.ts src/controllers/organization.controller.ts src/controllers/member.controller.ts src/utils/org-owner-repair.util.ts src/utils/socket-session.util.ts src/utils/people-create-gate.util.ts src/utils/service-app-type.util.ts --format esm --out-dir test/.build --no-dts --silent && node --test test/*.test.mjs",
     "test:camera": "yarn test",
     "test:e2e": "yarn build && node --test --test-concurrency=1 --test-timeout=600000 \"test/e2e/*.test.mjs\""
   },

package/test/demo-adapter.test.mjs

@@ -0,0 +1,197 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+
+import { createDemoAdapter, DEMO_CAPABILITIES } from "./.build/services/demo.adapter.mjs";
+import { robotTier, commandSupported } from "./.build/utils/robot-adapter.util.mjs";
+import { encodeGreyscalePng } from "./.build/utils/png-encoder.util.mjs";
+import { wallsFromOccupancyGrid } from "./.build/utils/building-map.util.mjs";
+
+/* --------------------------------------------------------------------------
+ * The demo brand has two jobs, and these guard both.
+ *
+ * It makes the work visible: until a vendor supplies credentials, every robot
+ * screen in the platform is empty and no button can be pressed.
+ *
+ * And it proves the vendor-neutral design. It is a second brand written against
+ * the same contract as Ounitech, declaring DIFFERENT capabilities. If the
+ * screens behave differently for the two without being told which is which,
+ * the platform really is brand-agnostic.
+ * ----------------------------------------------------------------------- */
+
+const at = (ms) => createDemoAdapter({ now: () => ms });
+
+test("the demo brand reaches Full Control, where Ounitech reaches none", () => {
+  // The contrast IS the demonstration: same contract, different capabilities,
+  // and the screens draw different controls without being told to.
+  assert.equal(robotTier(DEMO_CAPABILITIES), "full-control");
+
+  const ounitech = { readLocation: true, sendToDock: true, startProcess: true };
+  assert.equal(robotTier(ounitech), "no-interface");
+
+  // So the demo offers pause; Ounitech does not.
+  assert.equal(commandSupported(DEMO_CAPABILITIES, "pause"), true);
+  assert.equal(commandSupported(ounitech, "pause"), false);
+});
+
+test("it lists robots across more than one floor", () => {
+  return at(0).listRobots().then((robots) => {
+    assert.ok(robots.length >= 3);
+    assert.ok(new Set(robots.map((r) => r.floorNo)).size >= 2, "more than one floor");
+  });
+});
+
+test("every demo robot says it is a demo, in its own name", async () => {
+  // A simulated robot appearing in a real estate's list without saying so would
+  // be worse than no demo at all.
+  const robots = await at(0).listRobots();
+  for (const r of robots) {
+    assert.match(r.name, /demo/i, r.name);
+    assert.match(r.robotSn, /^DEMO-/, r.robotSn);
+  }
+  assert.match(at(0).displayName, /demo/i);
+});
+
+test("it reports a KNOWN floor and a real position — unlike Ounitech", async () => {
+  // Which is what lets the 3D layout actually draw the robot.
+  const [robot] = await at(0).listRobots();
+  assert.equal(robot.floorKnown, true);
+  assert.equal(typeof robot.floorNo, "number");
+  assert.ok(robot.position);
+  assert.equal(typeof robot.position.x, "number");
+  assert.equal(typeof robot.position.theta, "number");
+});
+
+test("the robots move as the clock advances", async () => {
+  const [early] = await at(0).listRobots();
+  const [later] = await at(30_000).listRobots();
+  assert.notDeepEqual(early.position, later.position, "a demo robot that never moves is a picture");
+});
+
+test("battery changes over time and stays in range", async () => {
+  const seen = new Set();
+  for (const ms of [0, 600_000, 1_800_000, 3_000_000]) {
+    const [robot] = await at(ms).listRobots();
+    assert.ok(robot.batteryPercent >= 0 && robot.batteryPercent <= 100, String(robot.batteryPercent));
+    seen.add(robot.batteryPercent);
+  }
+  assert.ok(seen.size > 1, "the battery never changed");
+});
+
+test("a command changes what the robot reports, and then wears off", async () => {
+  const adapter = at(1_000_000);
+  const before = await adapter.getRobot("DEMO-0001");
+
+  await adapter.sendCommand("DEMO-0001", { kind: "full" });
+  const during = await at(1_000_000).getRobot("DEMO-0001");
+  assert.equal(during.mode, "WORKING", `was ${before.mode}`);
+
+  // It returns to idle by itself, so the demo needs no resetting between
+  // viewings.
+  const after = await at(1_000_000 + 11 * 60_000).getRobot("DEMO-0001");
+  assert.notEqual(after.mode, "WORKING");
+
+  await adapter.sendCommand("DEMO-0001", { kind: "cancel" });
+});
+
+test("commanding a robot that does not exist is refused by name", async () => {
+  await assert.rejects(
+    () => at(0).sendCommand("NOT-A-ROBOT", { kind: "full" }),
+    /No demo robot with serial NOT-A-ROBOT/,
+  );
+});
+
+test("an unknown serial returns null rather than a stranger's robot", async () => {
+  assert.equal(await at(0).getRobot("DEMO-9999"), null);
+});
+
+/* --------------------------------------------------------- the floor plans */
+
+test("the plans carry the scale and areas the map screens need", async () => {
+  const maps = await at(0).getMaps();
+  assert.ok(maps.length >= 2, "more than one level");
+  for (const m of maps) {
+    // 1px = 5cm, traffic_editor's default and Ounitech's own resolution.
+    assert.equal(m.resolution, 0.05);
+    assert.ok(m.areaList.length >= 1);
+    assert.ok(m.backgroundFileKey);
+  }
+});
+
+test("the generated plan is a real PNG a browser will accept", async () => {
+  const files = await at(0).getMapImages("DEMO-0001", ["demo/L1.png"]);
+  const url = files[0].url;
+  assert.match(url, /^data:image\/png;base64,/);
+
+  // The 8-byte PNG signature, so this is decodable rather than merely base64.
+  const bytes = Buffer.from(url.split(",")[1], "base64");
+  assert.deepEqual([...bytes.subarray(0, 8)], [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]);
+  assert.equal(bytes.subarray(12, 16).toString("ascii"), "IHDR");
+  assert.equal(bytes.subarray(bytes.length - 8, bytes.length - 4).toString("ascii"), "IEND");
+});
+
+test("a data URI is used so the canvas is not tainted", async () => {
+  // The layout is built by reading these pixels BACK. A cross-origin image
+  // would throw on getImageData, which looks like a broken floor plan.
+  const files = await at(0).getMapImages("DEMO-0001", ["demo/L1.png", "demo/L2.png"]);
+  assert.equal(files.length, 2);
+  for (const f of files) assert.ok(f.url.startsWith("data:"));
+});
+
+test("the two levels are genuinely different plans", async () => {
+  const [l1, l2] = await at(0).getMapImages("DEMO-0001", ["demo/L1.png", "demo/L2.png"]);
+  assert.notEqual(l1.url, l2.url, "both floors rendered the same picture");
+});
+
+test("THE POINT: the generated plan yields a 3D layout", () => {
+  // End to end, with no vendor and no network: a plan becomes walls.
+  const width = 60, height = 40;
+  const px = new Uint8Array(width * height).fill(255);
+  for (let x = 0; x < width; x++) { px[x] = 0; px[(height - 1) * width + x] = 0; }
+  for (let y = 0; y < height; y++) { px[y * width] = 0; px[y * width + width - 1] = 0; }
+
+  const png = encodeGreyscalePng(px, width, height);
+  assert.ok(png.length > 0);
+
+  const { walls } = wallsFromOccupancyGrid({ data: px, width, height }, { minRunPx: 5 });
+  assert.equal(walls.length, 4, "a closed room is four walls");
+});
+
+/* -------------------------------------------------------- the PNG encoder */
+
+test("the encoder refuses an impossible image rather than emitting a broken one", () => {
+  assert.throws(() => encodeGreyscalePng(new Uint8Array(4), 0, 4), /positive size/);
+  assert.throws(() => encodeGreyscalePng(new Uint8Array(2), 10, 10), /one byte per pixel/);
+});
+
+/* ------------------------------------------------ faults and spot cleaning */
+
+import { demoFault, DEMO_FAULT_ROBOT } from "./.build/services/demo.adapter.mjs";
+
+test("one demo robot faults two minutes in every thirty, keyed by when it started", async () => {
+  const windowStart = 30 * 60_000 * 1000;
+  const inside = await at(windowStart + 60_000).getRobot(DEMO_FAULT_ROBOT);
+  assert.equal(inside.mode, "MAINTENANCE");
+  assert.equal(inside.fault.code, "DEMO_BRUSH_JAM");
+  assert.equal(inside.fault.since, windowStart);
+  assert.match(inside.fault.message, /simulated/);
+
+  const after = await at(windowStart + 3 * 60_000).getRobot(DEMO_FAULT_ROBOT);
+  assert.equal(after.fault, null);
+  // Only the one robot, so a fleet screen is not a wall of red.
+  assert.equal(demoFault("DEMO-0001", windowStart), null);
+});
+
+test("the demo brand supports spot cleaning, and parks the robot on the spot", async () => {
+  assert.equal(commandSupported(DEMO_CAPABILITIES, "spot"), true);
+  const t = 5 * 60_000; // outside any fault window, battery well above flat
+  const demo = at(t);
+  await demo.sendCommand("DEMO-0001", {
+    kind: "spot",
+    points: [{ x: 90, y: 50 }, { x: 110, y: 50 }, { x: 110, y: 70 }, { x: 90, y: 70 }],
+  });
+  const robot = await demo.getRobot("DEMO-0001");
+  assert.equal(robot.mode, "WORKING");
+  // Pixels to metres at 0.05 m/px, y flipped (180 px tall plan).
+  assert.ok(Math.abs(robot.position.x - 5) < 1e-9);
+  assert.ok(Math.abs(robot.position.y - (180 - 60) * 0.05) < 1e-9);
+});

package/test/e2e/harness.mjs

@@ -874,10 +874,12 @@ function buildApp(nsu, core) {
   // mirrors iservice365-API-core/src/routes/robot.route.ts
   const robots = express.Router();
   {
-    const { createRobot, getRobots } = core.useRobotController();
+    const { createRobot, getRobots, updateRobot, deleteRobot } = core.useRobotController();
 
     robots.post("/", requireAuth, createRobot);
     robots.get("/organization/:organization/site/:site", requireAuth, getRobots);
+    robots.patch("/:id([0-9a-fA-F]{24})", requireAuth, updateRobot);
+    robots.delete("/:id([0-9a-fA-F]{24})", requireAuth, deleteRobot);
   }
 
   // mirrors iservice365-API-core/src/routes/attendance-settings.route.ts

package/test/e2e/robot-scope.e2e.test.mjs

@@ -290,6 +290,73 @@ describe("robots and their credentials are scoped to their estate", { concurrenc
     assert.deepEqual(stranger.body, insider.body);
   });
 
+  // ---- edit and remove: the estate comes off the STORED robot ---------------
+
+  const seeded = async (name) => (await byName(name))._id;
+  const audits = async (action, target) =>
+    await h.db.collection("console-audit").find({ action, target: String(target) }).toArray();
+
+  record("14. an outsider cannot EDIT or REMOVE another estate's robot by quoting its id", async () => {
+    const robotB = await seeded("rb-seeded-b");
+    const edit = await h.api(`/robots/${robotB}`, {
+      method: "PATCH", sid: outsiderSid, body: { name: "rb-hijacked" },
+    });
+    const remove = await h.api(`/robots/${robotB}`, { method: "DELETE", sid: outsiderSid });
+
+    assert.equal(edit.status, 404);
+    assert.equal(remove.status, 404);
+    const stored = await h.db.collection(COLL).findOne({ _id: robotB });
+    assert.equal(stored.name, "rb-seeded-b");
+    assert.ok(!stored.deletedAt);
+  });
+
+  record("15. the estate's own manager edits a robot, and it is audited without credentials", async () => {
+    const robotB = await seeded("rb-seeded-b");
+    const res = await h.api(`/robots/${robotB}`, {
+      method: "PATCH", sid: managerSid, body: { name: "rb-renamed-b", robotSn: "SN-1" },
+    });
+    assert.equal(res.status, 200);
+
+    const stored = await h.db.collection(COLL).findOne({ _id: robotB });
+    assert.equal(stored.name, "rb-renamed-b");
+    assert.equal(stored.robotSn, "SN-1");
+
+    const [row] = await audits("robot.updated", robotB);
+    assert.equal(row?.after?.name, "rb-renamed-b");
+    assert.equal(row?.before?.name, "rb-seeded-b");
+    assert.equal(JSON.stringify(row).includes("e2e-fake"), false);
+  });
+
+  record("16. an empty edit is a 400", async () => {
+    const robotB = await seeded("rb-renamed-b");
+    const res = await h.api(`/robots/${robotB}`, { method: "PATCH", sid: managerSid, body: {} });
+    assert.equal(res.status, 400);
+  });
+
+  record("17. a removed robot stops listing and answers as not found, and the row stays", async () => {
+    const robotB = await seeded("rb-renamed-b");
+    const remove = await h.api(`/robots/${robotB}`, { method: "DELETE", sid: managerSid });
+    assert.equal(remove.status, 200);
+
+    const list = await h.api(listUrl(id.orgB, id.siteB), { sid: managerSid });
+    assert.equal((list.body?.items ?? []).some((r) => r.name === "rb-renamed-b"), false);
+
+    const again = await h.api(`/robots/${robotB}`, { method: "DELETE", sid: managerSid });
+    assert.equal(again.status, 404);
+
+    const stored = await h.db.collection(COLL).findOne({ _id: robotB });
+    assert.ok(stored.deletedAt, "soft delete keeps the row");
+    assert.equal((await audits("robot.removed", robotB)).length, 1);
+  });
+
+  record("18. creating a robot writes an audit row, without credentials", async () => {
+    const robot = await byName("rb-allowed");
+    const [row] = await audits("robot.added", robot._id);
+    assert.equal(row?.after?.name, "rb-allowed");
+    assert.equal(String(row?.org), String(id.orgB));
+    assert.equal(JSON.stringify(row).includes("e2e-fake"), false);
+  });
+
   record("13. no session is still a 401 on both routes", async () => {
     const list = await h.api(listUrl(id.orgB, id.siteB));
     const create = await h.api("/robots", {
@@ -299,6 +366,9 @@ describe("robots and their credentials are scoped to their estate", { concurrenc
 
     assert.equal(list.status, 401);
     assert.equal(create.status, 401);
+    const robotA = await seeded("rb-seeded-a");
+    assert.equal((await h.api(`/robots/${robotA}`, { method: "PATCH", body: { name: "x" } })).status, 401);
+    assert.equal((await h.api(`/robots/${robotA}`, { method: "DELETE" })).status, 401);
   });
 });
 

package/test/robot-adapter.test.mjs

@@ -3,12 +3,13 @@ import { test } from "node:test";
 
 import {
   ROBOT_CAPABILITIES,
-  clearRobotAdapters,
+  adapterForRobot,
+  clearRobotBrands,
   commandSupported,
   missingForTier,
-  registerRobotAdapter,
+  registerRobotBrand,
   registeredRobotBrands,
-  robotAdapterFor,
+  robotBrandFor,
   robotTier,
   supports,
   uncontrollableFleetWarning,
@@ -128,6 +129,15 @@ test("each command maps to the capability it actually needs", () => {
   assert.equal(commandSupported(caps("navigateToPoint"), "navigate"), true);
 });
 
+test("a spot clean needs spotClean, not just startProcess - a click needs a verified frame", () => {
+  assert.equal(commandSupported(caps("startProcess"), "spot"), false);
+  assert.equal(commandSupported(caps("spotClean"), "spot"), true);
+});
+
+test("spotClean is ours, not Open-RMF's, and moves no brand's tier", () => {
+  assert.equal(robotTier(caps("readLocation", "spotClean")), robotTier(caps("readLocation")));
+});
+
 test("an unknown command kind is refused, not defaulted", () => {
   for (const kind of ["selfDestruct", "", null, undefined, "constructor"]) {
     assert.equal(commandSupported(ALL, kind), false, String(kind));
@@ -136,44 +146,94 @@ test("an unknown command kind is refused, not defaulted", () => {
 
 /* --------------------------------------------------------------- registry */
 
-test("an adapter is found by brand, and never by fallback", () => {
-  clearRobotAdapters();
-  const a = { brand: "brand-a", displayName: "Brand A", capabilities: ALL, listRobots: async () => [], getRobot: async () => null };
-  registerRobotAdapter(a);
+const brand = (over = {}) => ({
+  brand: "brand-a",
+  displayName: "Brand A",
+  capabilities: ALL,
+  create: () => ({ brand: "brand-a", displayName: "Brand A", capabilities: ALL,
+    listRobots: async () => [], getRobot: async () => null }),
+  ...over,
+});
 
-  assert.equal(robotAdapterFor("brand-a"), a);
-  // Falling back to the only registered adapter would send one brand's robot a
+const robot = (over = {}) => ({
+  name: "Cleaner 02", brand: "brand-a", appKey: "k", appToken: "s", ...over,
+});
+
+test("a brand is found by name, and never by fallback", () => {
+  clearRobotBrands();
+  registerRobotBrand(brand());
+
+  assert.equal(robotBrandFor("brand-a")?.brand, "brand-a");
+  // Falling back to the only registered brand would send one brand's robot a
   // command in a protocol it does not speak.
-  assert.equal(robotAdapterFor("brand-b"), null);
-  assert.equal(robotAdapterFor(""), null);
-  assert.equal(robotAdapterFor(null), null);
-  assert.equal(robotAdapterFor(undefined), null);
-  assert.equal(robotAdapterFor(42), null);
+  assert.equal(robotBrandFor("brand-b"), null);
+  for (const bad of ["", null, undefined, 42]) {
+    assert.equal(robotBrandFor(bad), null, String(bad));
+  }
 });
 
-test("an adapter without a brand is refused at registration", () => {
-  clearRobotAdapters();
-  assert.throws(() => registerRobotAdapter({ displayName: "x" }), /must name its brand/);
-  assert.throws(() => registerRobotAdapter(null), /must name its brand/);
+test("a brand without a name or a factory is refused at registration", () => {
+  clearRobotBrands();
+  assert.throws(() => registerRobotBrand({ displayName: "x" }), /must name itself/);
+  assert.throws(() => registerRobotBrand(null), /must name itself/);
+  // A brand registered with no way to build an adapter would fail later, at the
+  // moment somebody tried to use a robot - not here, where it is fixable.
+  assert.throws(
+    () => registerRobotBrand({ brand: "x", displayName: "X", capabilities: {} }),
+    /no way to build an adapter/,
+  );
 });
 
-test("the brand list reports each brand's tier, for a settings picker", () => {
-  clearRobotAdapters();
-  registerRobotAdapter({ brand: "good", displayName: "Good", capabilities: ALL, listRobots: async () => [], getRobot: async () => null });
-  registerRobotAdapter({ brand: "poor", displayName: "Poor", capabilities: caps("readLocation"), listRobots: async () => [], getRobot: async () => null });
+test("an adapter is built per robot, from THAT robot's credentials", () => {
+  clearRobotBrands();
+  let seen = null;
+  registerRobotBrand(brand({ create: (c) => { seen = c; return { brand: "brand-a",
+    displayName: "Brand A", capabilities: ALL, listRobots: async () => [],
+    getRobot: async () => null }; } }));
 
-  assert.deepEqual(registeredRobotBrands().sort((x, y) => x.brand.localeCompare(y.brand)), [
-    { brand: "good", displayName: "Good", tier: "full-control" },
-    { brand: "poor", displayName: "Poor", tier: "no-interface" },
-  ]);
+  adapterForRobot(robot({ appKey: "estate-1-id", appToken: "estate-1-secret" }));
+  assert.deepEqual(seen, { appid: "estate-1-id", secret: "estate-1-secret" });
+
+  // One estate's credentials must never sign another estate's request, which is
+  // why the adapter is constructed per robot rather than per brand.
+  adapterForRobot(robot({ appKey: "estate-2-id", appToken: "estate-2-secret" }));
+  assert.deepEqual(seen, { appid: "estate-2-id", secret: "estate-2-secret" });
 });
 
-test("re-registering a brand replaces it rather than duplicating", () => {
-  clearRobotAdapters();
-  const base = { brand: "x", displayName: "One", capabilities: {}, listRobots: async () => [], getRobot: async () => null };
-  registerRobotAdapter(base);
-  registerRobotAdapter({ ...base, displayName: "Two" });
+test("an unknown brand is refused BY NAME, not with a null dereference", () => {
+  clearRobotBrands();
+  registerRobotBrand(brand());
+  assert.throws(() => adapterForRobot(robot({ brand: "unregistered" })),
+    /No robot adapter is registered for the brand "unregistered"/);
+  assert.throws(() => adapterForRobot(robot({ brand: "" })),
+    /does not say which brand it is/);
+});
+
+test("a robot with no credentials is refused before any call is attempted", () => {
+  clearRobotBrands();
+  registerRobotBrand(brand());
+  assert.throws(() => adapterForRobot(robot({ appKey: "" })), /no cloud credentials/);
+  assert.throws(() => adapterForRobot(robot({ appToken: "   " })), /no cloud credentials/);
+});
 
+test("the brand list reports each brand's tier, for a settings picker", () => {
+  clearRobotBrands();
+  registerRobotBrand(brand({ brand: "good", displayName: "Good", capabilities: ALL }));
+  registerRobotBrand(brand({ brand: "poor", displayName: "Poor", capabilities: caps("readLocation") }));
+
+  assert.deepEqual(
+    registeredRobotBrands().sort((x, y) => x.brand.localeCompare(y.brand)),
+    [
+      { brand: "good", displayName: "Good", tier: "full-control" },
+      { brand: "poor", displayName: "Poor", tier: "no-interface" },
+    ],
+  );
+});
+
+test("re-registering a brand replaces it rather than duplicating", () => {
+  clearRobotBrands();
+  registerRobotBrand(brand({ displayName: "One" }));
+  registerRobotBrand(brand({ displayName: "Two" }));
   assert.equal(registeredRobotBrands().length, 1);
-  assert.equal(robotAdapterFor("x").displayName, "Two");
+  assert.equal(robotBrandFor("brand-a").displayName, "Two");
 });

package/test/robot-fault.test.mjs

@@ -0,0 +1,39 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+
+import {
+  claimFaultOnce,
+  robotFaultKey,
+  robotFaultNotifyEnabled,
+  robotFaultText,
+} from "./.build/utils/robot-fault.util.mjs";
+
+test("the same fault occurrence is claimed once per process", async () => {
+  const local = new Set();
+  const key = robotFaultKey("r1", { code: "JAM", since: 10 });
+  assert.equal(await claimFaultOnce(key, { local }), true);
+  assert.equal(await claimFaultOnce(key, { local }), false);
+  // A second occurrence of the same fault notifies again.
+  assert.equal(await claimFaultOnce(robotFaultKey("r1", { code: "JAM", since: 20 }), { local }), true);
+});
+
+test("another instance holding the claim suppresses it; an unreachable store does not", async () => {
+  assert.equal(await claimFaultOnce("k1", { local: new Set(), claimShared: async () => false }), false);
+  assert.equal(await claimFaultOnce("k2", { local: new Set(), claimShared: async () => null }), true);
+  assert.equal(
+    await claimFaultOnce("k3", { local: new Set(), claimShared: async () => { throw new Error("down"); } }),
+    true,
+  );
+});
+
+test("ROBOT_FAULT_NOTIFY=off silences it; anything else leaves it on", () => {
+  assert.equal(robotFaultNotifyEnabled({}), true);
+  assert.equal(robotFaultNotifyEnabled({ ROBOT_FAULT_NOTIFY: " OFF " }), false);
+  assert.equal(robotFaultNotifyEnabled({ ROBOT_FAULT_NOTIFY: "on" }), true);
+});
+
+test("the text names the robot and the fault", () => {
+  const { body } = robotFaultText("Cleaner 02", { code: "JAM", message: "Side brush jammed" });
+  assert.match(body, /Cleaner 02/);
+  assert.match(body, /Side brush jammed/);
+});