@alwaysai/device-agent 1.5.0 → 2.0.1

package/src/cloud-connection/device-agent-cloud-connection.ts

@@ -1,47 +1,17 @@
-// eslint-disable-next-line
-const awsIot = require('aws-iot-device-sdk');
 import {
-  AppInstallResponsePayload,
-  AppStateControlPayload,
-  AppVersionControlInstallPayload,
-  AppVersionControlUninstallPayload,
-  DeviceActionPayload,
-  ModelsInstallResponsePayload,
-  SignedUrlsRequestPayload,
-  ToCloudMessage,
-  ToDeviceAgentMessage,
-  getToDeviceTopic,
-  buildSignedUrlsRequestMessage,
   buildToClientStatusResponseMessage,
-  StatusResponsePayload,
-  keyMirrors,
-  validateToDeviceAgentMessage,
-  validateSecureTunnelShadowUpdate
+  getToDeviceTopic,
+  keyMirrors
 } from '@alwaysai/device-agent-schemas';
 import { existsSync } from 'fs';
-import {
-  installApp,
-  restartApp,
-  startApp,
-  stopApp,
-  uninstallApp,
-  updateAppCfg,
-  updateModelsWithPresignedUrls
-} from '../application-control';
-import { createAppBackup, rollbackApp } from '../application-control/backup';
-import { reboot } from '../device-control/device-control';
 import { ALWAYSAI_ANALYTICS_PASSTHROUGH } from '../environment';
-import { AgentConfigFile } from '../infrastructure/agent-config';
+import { getBootstrapPrivateKeyFilePath } from '../infrastructure/device-certificate';
+import { migrateFromLegacyCertsAndTokens } from '../infrastructure/legacy-migration/legacy-migration';
+import { requiredConfigFilesPresentAndValid } from '../infrastructure/required-config-checks';
 import { getIoTCoreEndpointUrl } from '../infrastructure/urls';
 import { SecureTunnelHandlerSingleton } from '../secure-tunneling/secure-tunneling';
-import { cloudModeReady } from '../util/cloud-mode-ready';
-import {
-  AWS_ROOT_CERTIFICATE_FILE_PATH,
-  BOOTSTRAP_CERTIFICATES_DIR_PATH,
-  BOOTSTRAP_PRIVATE_KEY_FILE_PATH,
-  DEVICE_CERTIFICATE_FILE_PATH,
-  DEVICE_PRIVATE_KEY_FILE_PATH
-} from '../util/directories';
+import { SecureTunnelMessageHandler } from '../secure-tunneling/secure-tunnel-message-handler';
+import { getDeviceAgentVersion } from '../util/check-for-updates';
 import { getDeviceUuid } from '../util/get-device-id';
 import { logger } from '../util/logger';
 import sleep from '../util/sleep';
@@ -49,716 +19,142 @@ import { bootstrapProvision } from './bootstrap-provision';
 import { LiveUpdatesHandler } from './live-updates-handler';
 import { PassthroughHandler } from './passthrough-handler';
 import { Publisher } from './publisher';
-import { ShadowHandler, ShadowUpdate } from './shadow-handler';
+import { ShadowHandler, ProjectShadowMessageHandler } from './shadow-handler';
+import { JobHandler } from '../jobs/job-handler';
 import { TransactionManager } from './transaction-manager';
-import { exec } from 'child_process';
-import { promisify } from 'util';
-import { pruneModels } from '../application-control/models';
-import { getDeviceAgentVersion } from '../util/check-for-updates';
-
-const exec_promise = promisify(exec);
+import { ConnectionManager } from './connection-manager';
+import { DeviceAgentMessageHandler } from './device-agent-message-handler';
+import { HandlerContext } from './base-message-handler';
 
 export class DeviceAgentCloudConnection {
-  private shadowHandler: ShadowHandler;
-  public publisher: Publisher;
+  private connectionManager: ConnectionManager;
+  private transactionManager: TransactionManager;
   private liveUpdatesHandler: LiveUpdatesHandler;
-  private txnMgr: TransactionManager;
-  private device = awsIot.device;
+  public shadowHandler: ShadowHandler;
+  public publisher: Publisher;
 
-  private clientId = getDeviceUuid();
-  private host = getIoTCoreEndpointUrl();
-  private port = 8883;
+  private readonly clientId = getDeviceUuid();
+  private readonly host = getIoTCoreEndpointUrl();
+  private readonly port = 8883;
   private readonly toDeviceTopic = getToDeviceTopic(this.clientId);
-  private readonly secureTunnelNotifyTopic = `$aws/things/${this.clientId}/tunnels/notify`;
   private readonly secureTunnelHandler =
     SecureTunnelHandlerSingleton.getInstance();
 
-  private handleAppStateControl = async (
-    payload: AppStateControlPayload
-  ): Promise<boolean> => {
-    const { baseCommand, projectId } = payload;
-    switch (baseCommand) {
-      case keyMirrors.appStateControl.start:
-        await startApp({ projectId });
-        break;
-      case keyMirrors.appStateControl.stop:
-        await stopApp({ projectId });
-        break;
-      case keyMirrors.appStateControl.restart:
-        await restartApp({ projectId });
-        break;
-    }
-    return true;
-  };
-
-  private handleAppVersionControl = async (
-    payload:
-      | AppVersionControlInstallPayload
-      | AppVersionControlUninstallPayload,
-    txId: string
-  ): Promise<boolean> => {
-    switch (payload.baseCommand) {
-      case keyMirrors.appVersionControl.install: {
-        const { projectId, appReleaseHash } = payload;
-
-        const signedUrlsRequestPayload: SignedUrlsRequestPayload = {
-          signedUrlsRequest: {
-            projectId,
-            appReleaseHash
-          }
-        };
-        const message = buildSignedUrlsRequestMessage(
-          this.clientId,
-          signedUrlsRequestPayload,
-          txId
-        );
-        await this.publishCloudRequest(message);
-        return false;
-      }
-      case keyMirrors.appVersionControl.uninstall: {
-        const { projectId } = payload;
-        await this.atomicApplicationUninstall(projectId);
-        return true;
-      }
-      default:
-        logger.warn(
-          `Ignore App Version Control packet: ${JSON.stringify(
-            payload,
-            null,
-            2
-          )}`
-        );
-        return true;
-    }
-  };
-
-  private handleAppInstallCloudResponsePayload = async (
-    payload: AppInstallResponsePayload
-  ): Promise<boolean> => {
-    const {
-      projectId,
-      appReleaseHash,
-      appInstallPayload,
-      modelsInstallPayload
-    } = payload.appInstallResponse;
-    const signedUrlsPayload = {
-      appInstallPayload,
-      modelsInstallPayload
-    };
-    await this.atomicApplicationUpdate(async () => {
-      this.shadowHandler.clearProjectShadow(projectId);
-      await installApp({ projectId, appReleaseHash, signedUrlsPayload });
-    }, projectId);
-    return true;
-  };
-
-  private handleModelsInstallCloudResponsePayload = async (
-    payload: ModelsInstallResponsePayload,
-    txId: string
-  ): Promise<boolean> => {
-    const projectId = payload.modelsInstallResponse.projectId;
-
-    const update = this.txnMgr.getAppCfgUpdateFromTxID(txId);
-    if (update === undefined) {
-      throw new Error(
-        'Unknown error while updating models via application config! No config present for model update.'
-      );
-    }
-    const { appCfgUpdate, envVarUpdate } = update;
-    if (appCfgUpdate) {
-      await this.atomicApplicationUpdate(
-        async () =>
-          await updateModelsWithPresignedUrls({
-            projectId,
-            modelInstallPayloads: payload.modelsInstallResponse.newModels,
-            newAppCfg: appCfgUpdate.newAppCfg
-          }),
-        projectId
-      );
-    }
-
-    if (envVarUpdate) {
-      await this.atomicApplicationUpdate(
-        async () =>
-          await this.shadowHandler.updateProjectEnvVars({
-            projectId,
-            envVars: envVarUpdate.envVars
-          }),
-        projectId,
-        true
-      );
-    }
-
-    return true;
-  };
-
-  private async handleDeviceAction(payload: DeviceActionPayload) {
-    const { system_restart } = keyMirrors.deviceAction;
-    switch (payload.action) {
-      case system_restart: {
-        await reboot();
-        break;
-      }
-      default: {
-        logger.info(
-          `Unrecognized device action requested: '${payload.action}'.`
-        );
-      }
-    }
-  }
-
-  private async publishCloudRequest(message: ToCloudMessage) {
-    this.publisher.publishToCloud(message);
-  }
-
-  private subscribe(topic: string) {
-    logger.info(`Subscribing to ${topic}`);
-    this.device.subscribe(topic);
-  }
-
-  private async atomicApplicationUninstall(projectId: string) {
-    try {
-      await uninstallApp({ projectId });
-      this.shadowHandler.clearProjectShadow(projectId);
-    } catch (e) {
-      logger.error(`Failed to uninstall ${projectId}: ${e.message}`);
-      throw e;
-    }
-  }
-
-  // eslint-disable-next-line
-  private async atomicApplicationUpdate <F extends () => any>(
-    func: F,
-    projectId: string,
-    skipUpdateShadow?: boolean
-  ): Promise<ReturnType<F>> {
-    // First try to create a backup, so that there is one available if something goes wrong in the next try:catch.
-    if (await AgentConfigFile().isAppPresent({ projectId })) {
-      try {
-        await createAppBackup({ projectId });
-      } catch (e) {
-        logger.error(
-          `Could not create a backup for the project: ${projectId}:\n${e.message}\n${e.stack}`
-        );
-      }
-    }
-
-    try {
-      const out: ReturnType<F> = await func();
-      if (!skipUpdateShadow)
-        await this.shadowHandler.updateProjectShadow(projectId);
-      return out;
-    } catch (errorAppUpdate) {
-      logger.error(
-        `Failed to update ${projectId}:\n${JSON.stringify(errorAppUpdate)}}`
-      );
-      // If something goes wrong, first try to rollback
-      try {
-        await rollbackApp({ projectId });
-        logger.error(
-          `Application update failed, rolled back to previous version: ${errorAppUpdate}`
-        );
-      } catch (errorRollbackApp) {
-        // and if that fails, uninstall the app as a last resort.
-        try {
-          await this.atomicApplicationUninstall(projectId);
-        } catch {
-          // atomicApplicationUninstall handles failing, so there's nothing to handle here.
-        }
-        logger.error(
-          `Application update failed, rolled back to previous version: ${errorAppUpdate}`
-        );
-        throw new Error(
-          `Application update and rollback failed, uninstalled the application: ${errorAppUpdate}`
-        );
-      }
-      throw new Error(
-        `Application update failed, rolled the application back: ${errorAppUpdate}`
-      );
-    }
-  }
-
-  private handleProjectShadowConfigUpdate = async (
-    update: ShadowUpdate,
-    txId: string
-  ): Promise<boolean> => {
-    const { projectId, appCfgUpdate, envVarUpdate } = update;
-
-    if (
-      appCfgUpdate?.updatedModels &&
-      Object.keys(appCfgUpdate.updatedModels).length
-    ) {
-      // When there are model updates request signed URLs and wait to apply config changes
-      const { updatedModels } = appCfgUpdate;
-
-      logger.debug(
-        `Requesting presigned urls from cloud for model versions: ${JSON.stringify(
-          updatedModels
-        )}`
-      );
-      const modelsOnlyUrlsRequestPayload: SignedUrlsRequestPayload = {
-        modelsOnlyUrlsRequest: {
-          projectId,
-          models: updatedModels
-        }
-      };
-      const message = buildSignedUrlsRequestMessage(
-        this.clientId,
-        modelsOnlyUrlsRequestPayload,
-        txId
-      );
-      this.publisher.publishToCloud(message);
-
-      this.txnMgr.setAppCfgUpdateToTx(txId, update);
-
-      return false;
-    }
-
-    if (appCfgUpdate) {
-      await this.atomicApplicationUpdate(async () => {
-        await pruneModels({
-          projectId,
-          appCfg: appCfgUpdate.newAppCfg
-        });
-        await updateAppCfg({
-          projectId,
-          newAppCfg: appCfgUpdate.newAppCfg
-        });
-      }, projectId);
-    }
-
-    if (envVarUpdate) {
-      await this.atomicApplicationUpdate(
-        async () =>
-          await this.shadowHandler.updateProjectEnvVars({
-            projectId,
-            envVars: envVarUpdate.envVars
-          }),
-        projectId,
-        true
-      );
-    }
-    return true;
-  };
-
-  private async handleProjectShadowMessage(topic: string, message: any) {
-    const shadowUpdates = await this.shadowHandler.handleProjectShadow({
-      topic,
-      payload: message,
-      clientToken: message.clientToken
-    });
-    if (shadowUpdates.length) {
-      const shadowUpdatePromises: Promise<void>[] = [];
-      for (const shadowUpdate of shadowUpdates) {
-        const projectId = shadowUpdate.projectId;
-        const txId = shadowUpdate.txId;
-        shadowUpdatePromises.push(
-          this.txnMgr
-            .runTransactionStep({
-              func: () =>
-                this.handleProjectShadowConfigUpdate(shadowUpdate, txId),
-              projectId,
-              txId,
-              start: true,
-              stepName: topic
-            })
-            .catch((e: Error) => {
-              logger.error(
-                `There was an issue updating project shadow config: ${JSON.stringify(
-                  e
-                )}`
-              );
-            })
-        );
-      }
-
-      await Promise.all(shadowUpdatePromises);
-    }
-  }
-
-  public async handleSecureTunnelMessage(payload: any): Promise<void> {
-    logger.info(`Received secure tunnel update: ${JSON.stringify(payload)}`);
-    const state = payload.state;
-    if (!state) {
-      logger.debug(`No state found in message: ${JSON.stringify(payload)}`);
-      return;
-    }
-    const valid = validateSecureTunnelShadowUpdate(state);
-    if (!valid) {
-      logger.error(
-        `Error validating message: ${JSON.stringify(
-          { payload, errors: validateSecureTunnelShadowUpdate.errors },
-          null,
-          2
-        )}`
-      );
-      return;
-    }
-    const secureTunnelUpdate =
-      await this.secureTunnelHandler.syncShadowToDeviceState(payload);
-    await this.shadowHandler.updateSecureTunnelShadow(secureTunnelUpdate);
-    return;
-  }
+  constructor() {
+    this.liveUpdatesHandler = new LiveUpdatesHandler();
 
-  /*=================================================================
-                            Public interface
-  =================================================================*/
+    // Initialize & setup the connection
+    this.connectionManager = new ConnectionManager(
+      this.clientId,
+      this.host,
+      this.port
+    );
+    this.connectionManager.setupConnection();
 
-  constructor() {
-    this.device = awsIot.device({
-      keyPath: DEVICE_PRIVATE_KEY_FILE_PATH,
-      certPath: DEVICE_CERTIFICATE_FILE_PATH,
-      caPath: AWS_ROOT_CERTIFICATE_FILE_PATH,
-      clientId: this.clientId,
-      host: this.host,
-      port: this.port,
-      keepalive: 1 // time before re-connect attempt on dropped connection, default is 400 seconds
-    });
-    this.publisher = new Publisher(this.device, this.clientId);
-    this.shadowHandler = new ShadowHandler(this.clientId, this.publisher);
-    this.liveUpdatesHandler = new LiveUpdatesHandler(
-      this.publisher,
+    // Initialize the Publisher, ShadowHandler & Transaction Manager
+    this.publisher = new Publisher(
+      this.connectionManager.getIoTDevice(),
       this.clientId
     );
-    this.txnMgr = new TransactionManager(
+    this.shadowHandler = new ShadowHandler(this.clientId, this.publisher);
+
+    this.transactionManager = new TransactionManager(
       this.publisher,
       this.liveUpdatesHandler
     );
 
-    this.subscribe(this.toDeviceTopic);
-    this.subscribe(this.secureTunnelNotifyTopic);
-    for (const topic of this.shadowHandler.projectShadowTopics) {
-      this.subscribe(topic);
-    }
-    this.subscribe(this.shadowHandler.shadowTopics.secureTunnel.updateDelta);
-    this.subscribe(this.shadowHandler.shadowTopics.secureTunnel.deleteAccepted);
-  }
-
-  public getClientId(): string {
-    return this.clientId;
-  }
-
-  public getToDeviceTopic() {
-    return this.toDeviceTopic;
-  }
-
-  public isCmdInProgress(projectId: string): boolean {
-    return this.txnMgr.isOngoingTransactionForProjectID(projectId);
-  }
-
-  public async updateProjectShadow(projectId: string) {
-    await this.shadowHandler.updateProjectShadow(projectId);
-  }
+    // Construct a HandlerContext used by all the message handlers
+    const handlerContext: HandlerContext = {
+      clientId: this.clientId,
+      txnMgr: this.transactionManager,
+      publisher: this.publisher,
+      shadowHandler: this.shadowHandler,
+      liveUpdatesHandler: this.liveUpdatesHandler,
+      secureTunnelHandler: this.secureTunnelHandler
+    };
 
-  public async handleDeviceAgentMessage({
-    topic,
-    message
-  }: {
-    topic: string;
-    message: ToDeviceAgentMessage;
-  }) {
-    const valid = validateToDeviceAgentMessage(message);
-    if (!valid) {
-      logger.error(
-        `Error validating message: ${JSON.stringify(
-          { topic, message, errors: validateToDeviceAgentMessage.errors },
-          null,
-          2
-        )}`
+    // Instantiate & register message handlers for Project Shadow topics
+    const projectShadowMessageHandler = new ProjectShadowMessageHandler(
+      handlerContext
+    );
+    this.shadowHandler.projectShadowTopics.forEach((topic) => {
+      this.connectionManager.registerHandler(
+        topic,
+        projectShadowMessageHandler
       );
-      // TODO: Send generic error response
-      return;
-    }
-    const txId = message.txId;
-    const {
-      app_state_control,
-      app_version_control,
-      live_state_updates,
-      app_install_response,
-      models_install_response,
-      status_response,
-      device_action
-    } = keyMirrors.toDeviceAgentMessageType;
-    switch (message.messageType) {
-      case app_state_control: {
-        // txId sent from cloud, just need to continue it
-        const payload = message.payload;
-        const projectId = payload.projectId;
-
-        try {
-          await this.txnMgr.runTransactionStep({
-            func: () => this.handleAppStateControl(message.payload),
-            projectId,
-            txId,
-            start: true,
-            stepName: payload.baseCommand
-          });
-        } catch (e) {
-          logger.error(
-            `Error processing application state control request: ${e}!`
-          );
-        }
-
-        break;
-      }
-      case app_version_control: {
-        // txId sent from cloud, just need to continue it
-        const payload = message.payload;
-        const projectId = payload.projectId;
-        try {
-          await this.txnMgr.runTransactionStep({
-            func: () => this.handleAppVersionControl(payload, txId),
-            projectId,
-            txId,
-            start: true,
-            stepName: payload.baseCommand
-          });
-        } catch (e) {
-          logger.error(`Error processing application install request: ${e}!`);
-        }
-
-        break;
-      }
-      case live_state_updates: {
-        const payload = message.payload;
-        // TODO: Send response?
-        void this.liveUpdatesHandler.handleToggles(payload, txId);
-        break;
-      }
-      case app_install_response: {
-        const payload = message.payload;
-        const { projectId } = payload.appInstallResponse;
-        if (txId !== this.txnMgr.getTransactionFromProject(projectId)) {
-          throw new Error(
-            `App install response received a message for a transaction ID ${txId} that is not currently underway (${this.txnMgr.getTransactionFromProject(
-              projectId
-            )})!`
-          );
-        }
-        await this.txnMgr.runTransactionStep({
-          func: () => this.handleAppInstallCloudResponsePayload(payload),
-          projectId,
-          txId,
-          start: false,
-          stepName: message.messageType
-        });
-        break;
-      }
-      case models_install_response: {
-        // This message doesn't have appReleaseHash in it's payload, but
-        // atomicCmd should be able to read it from the installed app
-        const payload = message.payload;
-        const { projectId } = payload.modelsInstallResponse;
-        if (txId !== this.txnMgr.getTransactionFromProject(projectId)) {
-          throw new Error(
-            `Model install response received a message for a transaction ID ${txId} that is not currently underway (${this.txnMgr.getTransactionFromProject(
-              projectId
-            )})!`
-          );
-        }
-        await this.txnMgr.runTransactionStep({
-          func: () =>
-            this.handleModelsInstallCloudResponsePayload(payload, txId),
-          projectId,
-          txId,
-          start: false,
-          stepName: message.messageType
-        });
-        break;
-      }
-      case status_response: {
-        const { failure } = keyMirrors.statusResponse;
-        if (message.payload.status === failure) {
-          this.txnMgr.completeTransaction(txId);
+    });
 
-          const failureStatusResponsePayload: StatusResponsePayload = {
-            status: keyMirrors.statusResponse.failure,
-            message: message.payload.message
-          };
-          // Send final status message
-          const failureStatusResponseMessage =
-            buildToClientStatusResponseMessage(
-              this.clientId,
-              failureStatusResponsePayload,
-              txId
-            );
-          this.publisher.publishToClient(failureStatusResponseMessage);
-        }
-        break;
-      }
-      case device_action: {
-        try {
-          const statusResponsePayload: StatusResponsePayload = {
-            status: keyMirrors.statusResponse.in_progress
-          };
-          const statusResponseMessage = buildToClientStatusResponseMessage(
-            this.clientId,
-            statusResponsePayload,
+    // Instantiate & register message handlers for to-device and secureTunnel topics
+    this.connectionManager.registerHandler(
+      this.toDeviceTopic,
+      new DeviceAgentMessageHandler(
+        handlerContext,
+        (txId: string, errorMsg: string) => {
+          const msg = buildToClientStatusResponseMessage(
+            this.publisher.getClientId(),
+            {
+              status: keyMirrors.statusResponse.failure,
+              message: errorMsg
+            },
             txId
           );
-          this.publisher.publishToClient(statusResponseMessage);
-
-          await this.handleDeviceAction(message.payload);
-
-          const successStatusResponsePayload: StatusResponsePayload = {
-            status: keyMirrors.statusResponse.success
-          };
-          const successStatusResponseMessage =
-            buildToClientStatusResponseMessage(
-              this.clientId,
-              successStatusResponsePayload,
-              txId
-            );
-          this.publisher.publishToClient(successStatusResponseMessage);
-        } catch (e) {
-          logger.error(
-            `There was a problem performing device action '${message.payload.action}': ${e.message}`
+          this.publisher.publishToClient(msg);
+        },
+        (txId: string) => {
+          const msg = buildToClientStatusResponseMessage(
+            this.publisher.getClientId(),
+            { status: keyMirrors.statusResponse.success },
+            txId
           );
-          const failureStatusResponsePayload: StatusResponsePayload = {
-            status: keyMirrors.statusResponse.failure,
-            message: e.message
-          };
-          const failureStatusResponseMessage =
-            buildToClientStatusResponseMessage(
-              this.clientId,
-              failureStatusResponsePayload,
-              txId
-            );
-          this.publisher.publishToClient(failureStatusResponseMessage);
+          this.publisher.publishToClient(msg);
         }
-        break;
-      }
-      default:
-        logger.error(
-          `Invalid client message: '${JSON.stringify(
-            { topic, message, txId },
-            null,
-            2
-          )}'`
-        );
-    }
-  }
+      )
+    );
 
-  public async handleMessage(topic: string, message: any) {
-    logger.debug(
-      `Received message: ${JSON.stringify({ topic, message }, null, 2)}`
+    const secureTunnelMessageHandler = new SecureTunnelMessageHandler(
+      handlerContext
+    );
+    this.connectionManager.registerHandler(
+      secureTunnelMessageHandler.getNotifyTopic(),
+      secureTunnelMessageHandler
     );
-    // ProjectShadow messages
-    if (this.shadowHandler.projectShadowTopics.includes(topic)) {
-      await this.handleProjectShadowMessage(topic, message);
-    } else if (topic === this.toDeviceTopic) {
-      await this.handleDeviceAgentMessage({
-        topic,
-        message
-      });
-      // SecureTunnelNotify messages
-    } else if (topic === this.secureTunnelNotifyTopic) {
-      await this.secureTunnelHandler.secureTunnelNotifyHandler(message);
-      // SecureTunnel messages
-    } else if (
-      topic === this.shadowHandler.shadowTopics.secureTunnel.updateDelta
-    ) {
-      await this.handleSecureTunnelMessage(message);
-    } else if (
-      topic === this.shadowHandler.shadowTopics.secureTunnel.deleteAccepted
-    ) {
-      logger.info(`Received secure tunnel deleteAccepted: ${message}`);
-      await this.secureTunnelHandler.destroy();
-    } else {
-      logger.error(`Unexpected topic, ignoring! ${topic}`);
-    }
-  }
 
-  public async setupHandlers() {
-    this.device.on('connect', (connack: any) => {
-      logger.info('Device Agent has connected to the cloud');
-      // FIXME: EI-709 Skip this request for now to prevent kicking off another
-      // shadow update process if IoT Core disconnect occurs during app config update
-      //this.shadowHandler.getShadowUpdates();
-      void this.shadowHandler.updateSystemInfoShadow();
-    });
+    this.connectionManager.registerHandler(
+      this.shadowHandler.shadowTopics.secureTunnel.updateDelta,
+      secureTunnelMessageHandler
+    );
+    this.connectionManager.registerHandler(
+      this.shadowHandler.shadowTopics.secureTunnel.deleteAccepted,
+      secureTunnelMessageHandler
+    );
 
-    this.device.on('disconnect', () => {
-      logger.warn('Device Agent has been disconnected from the cloud');
-    });
+    const jobHandler = new JobHandler(handlerContext);
 
-    this.device.on('reconnect', () => {
-      logger.info(
-        `Device Agent attempting to re-connect ${new Date().toLocaleString()}`
-      );
-    });
+    const JOB_HANDLER_TOPICS = jobHandler.getJobTopic();
 
-    this.device.on('error', function (error) {
-      const errorString = error.message.toString();
-      logger.error(`${errorString}`);
-    });
+    this.connectionManager.registerHandler(
+      JOB_HANDLER_TOPICS.NOTIFY_NEXT,
+      jobHandler
+    );
 
-    this.device.on('message', async (topic: string, payload: string) => {
-      try {
-        const jsonPacket = JSON.parse(payload);
-        await this.handleMessage(topic, jsonPacket);
-      } catch (e) {
-        logger.error(`Error parsing message: ${e.message}`);
-      }
-    });
+    this.connectionManager.registerHandler(
+      JOB_HANDLER_TOPICS.START_NEXT_ACCEPTED,
+      jobHandler
+    );
 
-    this.device.on('offline', () => {
-      logger.warn(`Device Agent is offline ${new Date().toLocaleString()}`);
-      void this.logConnectionInfo();
-    });
+    // Initialize job
+    this.publisher.publish(JOB_HANDLER_TOPICS.START_NEXT, JSON.stringify({}));
   }
 
-  public async logConnectionInfo() {
-    try {
-      /**
-       * We're using the 'netcat' or 'nc' command to test the connection to the IoT Core endpoint.
-       * This command doesn't always exit (see below), so
-       * we use timeout to break out of the prompt
-       * and catch the resulting error/parse the resulting stderr
-       *
-       * Sample command for current host and port:
-       * nc -zv -w 1 a3tzi5g7sq5zsj-ats.iot.us-west-2.amazonaws.com 8883
-       *
-       * Sample output when port is not blocked and host is reachable:
-       * $ nc  -zv -w 1 a3tzi5g7sq5zsj-ats.iot.us-west-2.amazonaws.com 443
-       * Connection to a3tzi5g7sq5zsj-ats.iot.us-west-2.amazonaws.com 443 port [tcp/https] succeeded!
-       *
-       *
-       * Sample output when port is blocked (will repeatedly try until ctrl-C out):
-       * $ nc -zv -w 1 a3tzi5g7sq5zsj-ats.iot.us-west-2.amazonaws.com 8883
-       * nc: connect to a3tzi5g7sq5zsj-ats.iot.us-west-2.amazonaws.com port 8883 (tcp) timed out: Operation now in progress
-       * nc: connect to a3tzi5g7sq5zsj-ats.iot.us-west-2.amazonaws.com port 8883 (tcp) timed out: Operation now in progress
-       * nc: connect to a3tzi5g7sq5zsj-ats.iot.us-west-2.amazonaws.com port 8883 (tcp) timed out: Operation now in progress
-       * ^C
-       *
-       *
-       * Sample command/output when the port isn't enable on that host:
-       * $ nc -zv -w 1 localhost 8883
-       * nc: connect to localhost port 8883 (tcp) failed: Connection refused
-       */
-      await exec_promise(`nc -zv -w 1 ${this.host} ${this.port}`, {
-        timeout: 2000
-      });
-    } catch (err) {
-      const output = JSON.stringify(err['stderr']);
-      if (output.indexOf('not known') !== -1) {
-        logger.warn(
-          'Iot Core endpoint appears to be unreachable, internet connection may be unstable or the host may be down.'
-        );
-      } else if (output.indexOf('timed out') !== -1) {
-        logger.warn(
-          `Internet connection appears fine, however the endpoint was not reachable on the current connection port: ${this.port}\nPlease check if a firewall is in place.`
-        );
-      } else if (output.indexOf('refused') !== -1) {
-        logger.warn(
-          `The connection was refused, likely ${this.host} is not running a service on ${this.port}.`
-        );
-      } else {
-        logger.warn(
-          `Output from checking connection to ${this.host} on ${this.port}: ${output}`
-        );
-      }
-    }
+  /*=================================================================
+                            Public interface
+  =================================================================*/
+  public getClientId(): string {
+    return this.clientId;
+  }
+
+  public isCmdInProgress(projectId: string): boolean {
+    return this.transactionManager.isOngoingTransactionForProjectID(projectId);
   }
 
   public async stop() {
@@ -766,7 +162,10 @@ export class DeviceAgentCloudConnection {
     // lost since we aren't waiting for responses so sleep for a short time to
     // receive them
     await sleep(1000);
-    this.device.end();
+    this.connectionManager.disconnect();
+  }
+  public async handleMessage(topic: string, message: any) {
+    this.connectionManager.dispatch(topic, message);
   }
 }
 
@@ -774,20 +173,28 @@ export async function runDeviceAgentCloudInterface() {
   logger.info(
     `Starting alwaysAI Device Agent v${await getDeviceAgentVersion()}`
   );
-  if (cloudModeReady()) {
+  if (existsSync(getBootstrapPrivateKeyFilePath())) {
+    await bootstrapProvision();
+    return;
+  }
+
+  const filesAlreadyMigrated = await requiredConfigFilesPresentAndValid();
+  if (!filesAlreadyMigrated) {
+    logger.debug('Attempting configuration file migration.');
+    await migrateFromLegacyCertsAndTokens();
+  }
+
+  if (await requiredConfigFilesPresentAndValid()) {
     const deviceAgent = new DeviceAgentCloudConnection();
-    await deviceAgent.setupHandlers();
     if (ALWAYSAI_ANALYTICS_PASSTHROUGH === true) {
+      const shadowHandler = deviceAgent.shadowHandler;
       const publisher = deviceAgent.publisher;
-      const passthroughHandler = new PassthroughHandler(publisher);
+      const passthroughHandler = new PassthroughHandler(
+        publisher,
+        shadowHandler
+      );
       await passthroughHandler.setup();
     }
-  } else if (existsSync(BOOTSTRAP_PRIVATE_KEY_FILE_PATH())) {
-    await bootstrapProvision();
-  } else if (existsSync(BOOTSTRAP_CERTIFICATES_DIR_PATH())) {
-    throw new Error(
-      "Device has not been created using 'aai-agent device init' or there has been an issue with device initialization"
-    );
   } else {
     throw new Error(
       "Set device agent to local mode and retry the 'aai-agent device init' command"