From 78aca249a146b28e937f7f8d66fa628af805742c Mon Sep 17 00:00:00 2001
From: Florian Loitsch <florian@loitsch.com>
Date: Sun, 23 Aug 2026 15:55:19 +0200
Subject: [PATCH 1/3] Collapse hardware ID into device ID

---
 src/cli/broker.toit                           |  4 +-
 src/cli/brokers/broker.toit                   |  2 +-
 src/cli/brokers/http/base.toit                | 13 ++----
 src/cli/brokers/supabase/supabase.toit        |  6 +--
 src/cli/device.toit                           | 21 ++-------
 src/cli/firmware.toit                         | 10 ++---
 src/cli/fleet.toit                            |  8 ++--
 src/service/device.toit                       |  9 +---
 src/service/run/esp32.toit                    |  1 -
 src/service/run/host.toit                     |  1 -
 src/service/run/simulate.toit                 |  2 -
 tests/artemis-server.toit                     | 28 ++++++------
 tests/broker-test.toit                        |  8 ++--
 tests/broker.toit                             | 24 +++++-----
 tests/cmd-device-extract-test.toit            |  1 -
 tests/cmd-fleet-add-device-test.toit          |  2 -
 tests/cmd-fleet-add-devices-test.toit         |  3 +-
 tests/host-hello-test.toit                    |  3 --
 tests/qemu-background-test.toit               |  3 --
 tests/qemu-hello-test.toit                    |  3 --
 tests/qemu-trigger-test.toit                  |  3 --
 tests/serial-full-workflow-test-slow.toit     |  3 --
 .../serial-overridden-trigger-test-slow.toit  |  3 --
 tests/serial-pin-trigger-test-slow.toit       |  3 --
 tests/test-device.toit                        |  5 ---
 tests/utils.toit                              | 44 +++----------------
 tools/http_servers/artemis-server.toit        |  6 +--
 tools/http_servers/public/broker/broker.toit  | 28 +++++-------
 28 files changed, 73 insertions(+), 174 deletions(-)

diff --git a/src/cli/broker.toit b/src/cli/broker.toit
index 6986d1a16..0a24a1754 100644
--- a/src/cli/broker.toit
+++ b/src/cli/broker.toit
@@ -698,13 +698,13 @@ class Broker:
     identity := {
       "device_id": "$device.id",
       "organization_id": "$device.organization-id",
-      "hardware_id": "$device.hardware-id",
+      // Kept so older CLI versions can read the initial state.
+      "hardware_id": "$device.id",
     }
     state := {
       "identity": identity,
     }
     broker-connection_.notify-created
-        --hardware-id=device.hardware-id
         --device-id=device.id
         --state=state
 
diff --git a/src/cli/brokers/broker.toit b/src/cli/brokers/broker.toit
index 8e3c790fc..820657b5e 100644
--- a/src/cli/brokers/broker.toit
+++ b/src/cli/brokers/broker.toit
@@ -135,7 +135,7 @@ interface BrokerCli implements Authenticatable:
     state of the device; until it connects to the broker there is
     (probably) only identity information in it.
   */
-  notify-created --hardware-id/Uuid --device-id/Uuid --state/Map -> none
+  notify-created --device-id/Uuid --state/Map -> none
 
   /**
   Fetches all events of the given $types for all devices in the $device-ids list.
diff --git a/src/cli/brokers/http/base.toit b/src/cli/brokers/http/base.toit
index fde4d0658..95912a633 100644
--- a/src/cli/brokers/http/base.toit
+++ b/src/cli/brokers/http/base.toit
@@ -212,10 +212,7 @@ class BrokerCliHttp implements BrokerCli:
       "path": "/toit-artemis-assets/$scope/firmware/$id",
     }
 
-  notify-created --hardware-id/Uuid --device-id/Uuid --state/Map -> none:
-    // hardware-id is only used by overrides (e.g., the Supabase variant
-    // writing into the auth-side devices table). The on-the-wire
-    // notify-broker-created RPC takes just the device-id and state.
+  notify-created --device-id/Uuid --state/Map -> none:
     send-request_ COMMAND-NOTIFY-BROKER-CREATED_ {
       "_device_id": "$device-id",
       "_state": state,
@@ -411,18 +408,16 @@ class BrokerCliHttp implements BrokerCli:
 A $BrokerCliHttp specialisation for shared-tenancy HTTP deployments.
 
 In a shared-tenancy deployment the broker also owns the auth-side device
-  record; this override sends the hardware-id and the configured scope
-  (organization-id) so the broker can populate that record alongside the
-  broker-side state.
+  record; this override sends the configured scope (organization-id) so the
+  broker can populate that record alongside the broker-side state.
 */
 class BrokerCliHttpShared extends BrokerCliHttp:
   constructor server-config/ServerConfigHttp --id/string:
     super server-config --id=id
 
-  notify-created --hardware-id/Uuid --device-id/Uuid --state/Map -> none:
+  notify-created --device-id/Uuid --state/Map -> none:
     send-request_ COMMAND-NOTIFY-BROKER-CREATED_ {
       "_device_id": "$device-id",
-      "_hardware_id": "$hardware-id",
       "_organization_id": server-config_.scope.to-json,
       "_state": state,
     }
diff --git a/src/cli/brokers/supabase/supabase.toit b/src/cli/brokers/supabase/supabase.toit
index 4f3f55434..54e6bcdfe 100644
--- a/src/cli/brokers/supabase/supabase.toit
+++ b/src/cli/brokers/supabase/supabase.toit
@@ -79,14 +79,14 @@ class BrokerCliSupabase extends BrokerCliHttp:
     the device row in the auth-side `devices` table as part of the
     notify-created handshake.
   */
-  notify-created --hardware-id/Uuid --device-id/Uuid --state/Map -> none:
+  notify-created --device-id/Uuid --state/Map -> none:
     if server-config_.tenancy == TENANCY-SHARED:
       supabase-client_.rest.insert "devices" --no-return-inserted {
-        "id": "$hardware-id",
+        "id": "$device-id",
         "alias": "$device-id",
         "organization_id": server-config_.scope.to-json,
       }
-    super --hardware-id=hardware-id --device-id=device-id --state=state
+    super --device-id=device-id --state=state
 
   extra-headers -> Map:
     bearer/string := supabase-client_.session_
diff --git a/src/cli/device.toit b/src/cli/device.toit
index a1ff959e6..fc639f136 100644
--- a/src/cli/device.toit
+++ b/src/cli/device.toit
@@ -4,16 +4,6 @@ import uuid show Uuid
 import .firmware
 
 class Device:
-  /**
-  The hardware ID of the device.
-
-  On the Artemis server, this is the primary key and simply called "id".
-  The hardware ID is generated by the Artemis server.
-
-  This ID is generally *not* shared with the user.
-  */
-  hardware-id/Uuid
-
   /**
   The device ID.
 
@@ -29,11 +19,10 @@ class Device:
   */
   organization-id/Uuid
 
-  constructor --.hardware-id --.id --.organization-id:
+  constructor --.id --.organization-id:
 
   constructor.from-json-identity identity/Map:
     device := identity["artemis.device"]
-    hardware-id = Uuid.parse device["hardware_id"]
     id = Uuid.parse device["device_id"]
     organization-id = Uuid.parse device["organization_id"]
 
@@ -42,7 +31,8 @@ class Device:
       "artemis.device": {
         "device_id"       : "$id",
         "organization_id" : "$organization-id",
-        "hardware_id"     : "$hardware-id",
+        // Kept so older Artemis service images can read new identities.
+        "hardware_id"     : "$id",
       },
     }
 
@@ -105,22 +95,19 @@ class DeviceDetailed extends Device:
 
     initial-state := reported-state-firmware ? null : state
     local-organization-id := ?
-    local-hardware-id := ?
     local-id := ?
 
     if initial-state:
       identity := initial-state["identity"]
       local-organization-id = Uuid.parse identity["organization_id"]
-      local-hardware-id = Uuid.parse identity["hardware_id"]
       local-id = Uuid.parse identity["device_id"]
     else:
       old-firmware := Firmware.encoded reported-state-firmware["firmware"]
       device := old-firmware.device-specific "artemis.device"
       local-organization-id = Uuid.parse device["organization_id"]
-      local-hardware-id = Uuid.parse device["hardware_id"]
       local-id = Uuid.parse device["device_id"]
 
-    super --hardware-id=local-hardware-id --id=local-id --organization-id=local-organization-id
+    super --id=local-id --organization-id=local-organization-id
 
   pod-id-firmware -> Uuid?:
     return pod-id-from-state_ reported-state-firmware
diff --git a/src/cli/firmware.toit b/src/cli/firmware.toit
index 4e3f9b827..e3c3d6bb0 100644
--- a/src/cli/firmware.toit
+++ b/src/cli/firmware.toit
@@ -45,9 +45,9 @@ class Firmware:
   The device-specific data.
 
   This data contains information such as the device ID, the organization ID,
-    the hardware ID and the wifi configuration. It also contains the "parts"
-    field which describes the individual parts of the firmware, and the sdk
-    version that was used to create the firmware.
+    and the wifi configuration. It also contains the "parts" field which
+    describes the individual parts of the firmware, and the sdk version that
+    was used to create the firmware.
   */
   device-specific-data/ByteArray
   /** A decoded version of the $device-specific-data. */
@@ -98,7 +98,8 @@ class Firmware:
     device-map := {
       "device_id":       "$device.id",
       "organization_id": "$device.organization-id",
-      "hardware_id":     "$device.hardware-id",
+      // Kept so older Artemis service images can read new firmware.
+      "hardware_id":     "$device.id",
     }
     while true:
       device-specific := ubjson.encode {
@@ -124,7 +125,6 @@ class Firmware:
     return Device
         --id=Uuid.parse device-map["device_id"]
         --organization-id=Uuid.parse device-map["organization_id"]
-        --hardware-id=Uuid.parse device-map["hardware_id"]
 
   /** The sdk version that was used for this firmware. */
   sdk-version -> string:
diff --git a/src/cli/fleet.toit b/src/cli/fleet.toit
index 40504453a..a9b13422d 100644
--- a/src/cli/fleet.toit
+++ b/src/cli/fleet.toit
@@ -1094,9 +1094,9 @@ class FleetWithDevices extends Fleet:
   /**
   Provisions a device.
 
-  Mints a fresh hardware-id locally and registers the device with the
-    broker (which, for a shared-tenancy deployment, also creates the
-    corresponding row in the auth provider's device table).
+  Registers the device with the broker. For a shared-tenancy deployment,
+    the broker also creates the corresponding row in the auth provider's
+    device table.
 
   Writes the identity file to $out-path.
   */
@@ -1108,7 +1108,6 @@ class FleetWithDevices extends Fleet:
     broker.ensure-authenticated
 
     device := Device
-        --hardware-id=random-uuid
         --id=device-id
         --organization-id=organization-id
 
@@ -1225,6 +1224,5 @@ class FleetWithDevices extends Fleet:
     identity := read-base64-ubjson identity-path
     device-map := identity["artemis.device"]
     return Device
-        --hardware-id=Uuid.parse device-map["hardware_id"]
         --id=Uuid.parse device-map["device_id"]
         --organization-id=Uuid.parse device-map["organization_id"]
diff --git a/src/service/device.toit b/src/service/device.toit
index 2d11d9437..0898fb747 100644
--- a/src/service/device.toit
+++ b/src/service/device.toit
@@ -41,13 +41,6 @@ class Device:
   */
   id/Uuid
 
-  /**
-  The hardware ID of the device.
-
-  This ID was chosen during provisioning and is globally unique.
-  */
-  hardware-id/Uuid
-
   /**
   The organization ID of the device.
   */
@@ -95,7 +88,7 @@ class Device:
 
   storage_/Storage
 
-  constructor --.id --.hardware-id --.organization-id --.firmware-state/Map --storage/Storage:
+  constructor --.id --.organization-id --.firmware-state/Map --storage/Storage:
     storage_ = storage
     current-state = firmware-state
     load_
diff --git a/src/service/run/esp32.toit b/src/service/run/esp32.toit
index 38d50a65b..20f33d17d 100644
--- a/src/service/run/esp32.toit
+++ b/src/service/run/esp32.toit
@@ -61,7 +61,6 @@ main arguments:
   artemis-device-map := device-specific "artemis.device"
   device := Device
       --id=Uuid.parse artemis-device-map["device_id"]
-      --hardware-id=Uuid.parse artemis-device-map["hardware_id"]
       --organization-id=Uuid.parse artemis-device-map["organization_id"]
       --firmware-state=config
       --storage=storage
diff --git a/src/service/run/host.toit b/src/service/run/host.toit
index be3c33aaf..b04713545 100644
--- a/src/service/run/host.toit
+++ b/src/service/run/host.toit
@@ -45,7 +45,6 @@ main arguments:
   artemis-device-map := device-specific "artemis.device"
   device := Device
       --id=Uuid.parse artemis-device-map["device_id"]
-      --hardware-id=Uuid.parse artemis-device-map["hardware_id"]
       --organization-id=Uuid.parse artemis-device-map["organization_id"]
       --firmware-state=config
       --storage=storage
diff --git a/src/service/run/simulate.toit b/src/service/run/simulate.toit
index b78cea536..ba0556bf4 100644
--- a/src/service/run/simulate.toit
+++ b/src/service/run/simulate.toit
@@ -62,7 +62,6 @@ run-host --pod/Pod --identity-path/string --cli/Cli -> none:
   device-identity := identity["artemis.device"]
 
   artemis-device := artemis-device.Device
-      --hardware-id=Uuid.parse device-identity["hardware_id"]
       --organization-id=Uuid.parse device-identity["organization_id"]
       --id=Uuid.parse device-identity["device_id"]
 
@@ -91,7 +90,6 @@ run-host --pod/Pod --identity-path/string --cli/Cli -> none:
     while true:
       device := Device
           --id=artemis-device.id
-          --hardware-id=artemis-device.hardware-id
           --organization-id=artemis-device.organization-id
           --firmware-state=config
           --storage=storage
diff --git a/tests/artemis-server.toit b/tests/artemis-server.toit
index f2cae3a4c..93893cbc6 100644
--- a/tests/artemis-server.toit
+++ b/tests/artemis-server.toit
@@ -22,14 +22,14 @@ class TestArtemisServer:
 
 interface ArtemisServerBackdoor:
   /**
-  Fetches the information of the device with the given $hardware-id.
+  Fetches the information of the device with the given $device-id.
 
-  Returns a list of [hardware_id, fleet_id, alias]. If no alias exists, uses "" instead.
+  Returns a list of [device_id, fleet_id, alias]. If no alias exists, uses "" instead.
   */
-  fetch-device-information --hardware-id/Uuid -> List
+  fetch-device-information --device-id/Uuid -> List
 
-  /** Whether there exists a '$type'-event for the given $hardware-id. */
-  has-event --hardware-id/Uuid --type/string -> bool
+  /** Whether there exists a '$type'-event for the given $device-id. */
+  has-event --device-id/Uuid --type/string -> bool
 
   /**
   Removes the device with the given $device-id.
@@ -58,18 +58,18 @@ class ToitHttpBackdoor implements ArtemisServerBackdoor:
 
   constructor .server:
 
-  fetch-device-information --hardware-id/Uuid -> List:
-    entry/DeviceEntry := server.devices["$hardware-id"]
+  fetch-device-information --device-id/Uuid -> List:
+    entry/DeviceEntry := server.devices["$device-id"]
     return [
       Uuid.parse entry.id,
       Uuid.parse entry.organization-id,
       Uuid.parse entry.alias,
     ]
 
-  has-event --hardware-id/Uuid --type/string -> bool:
-    hardware-id-string := "$hardware-id"
+  has-event --device-id/Uuid --type/string -> bool:
+    device-id-string := "$device-id"
     server.events.do: | entry/EventEntry |
-      if entry.device-id == hardware-id-string and
+      if entry.device-id == device-id-string and
           entry.data is Map and (entry.data.get "type") == type:
         return true
     return false
@@ -133,9 +133,9 @@ class SupabaseBackdoor implements ArtemisServerBackdoor:
 
   constructor .server-config_ .service-key_:
 
-  fetch-device-information --hardware-id/Uuid -> List:
+  fetch-device-information --device-id/Uuid -> List:
     entry := query_ "devices" [
-      equals "id" "$hardware-id",
+      equals "id" "$device-id",
     ]
     return [
       Uuid.parse entry[0]["id"],
@@ -143,11 +143,11 @@ class SupabaseBackdoor implements ArtemisServerBackdoor:
       Uuid.parse entry[0]["alias"],
     ]
 
-  has-event --hardware-id/Uuid --type/string -> bool:
+  has-event --device-id/Uuid --type/string -> bool:
     // For simplicity just run through all entries.
     // In the test-setup we should not have that many.
     entries := query_ "events" [
-      equals "device_id" "$hardware-id",
+      equals "device_id" "$device-id",
     ]
     if not entries: return false
     entries.do:
diff --git a/tests/broker-test.toit b/tests/broker-test.toit
index d7687c55c..2f4690dfd 100644
--- a/tests/broker-test.toit
+++ b/tests/broker-test.toit
@@ -25,13 +25,11 @@ import .utils
 // that are not already in the database.
 DEVICE1 ::= Device
     --id=random-uuid
-    --hardware-id=random-uuid
     --organization-id=TEST-ORGANIZATION-UUID
     --firmware-state={:}
     --storage=Storage
 DEVICE2 ::= Device
     --id=random-uuid
-    --hardware-id=random-uuid
     --organization-id=TEST-ORGANIZATION-UUID
     --firmware-state={:}
     --storage=Storage
@@ -56,19 +54,19 @@ run-test
       identity := {
         "device_id": "$device.id",
         "organization_id": "$device.organization-id",
-        "hardware_id": "$device.hardware-id",
       }
       state := {
         "identity": identity,
       }
-      broker-cli.notify-created --hardware-id=device.hardware-id --device-id=device.id --state=state
+      broker-cli.notify-created --device-id=device.id --state=state
 
     if broker-name == "http-toit-shared" or broker-name == "supabase-local-artemis":
       // A shared-tenancy broker must populate the auth-side device record
       // as part of notify-created.
       [DEVICE1, DEVICE2].do: | device/Device |
-        auth-record := test-broker.backdoor.get-auth-device --hardware-id=device.hardware-id
+        auth-record := test-broker.backdoor.get-auth-device --device-id=device.id
         expect-not-null auth-record
+        expect-equals "$device.id" auth-record["id"]
         expect-equals "$device.id" auth-record["alias"]
         expect-equals "$device.organization-id" auth-record["organization_id"]
 
diff --git a/tests/broker.toit b/tests/broker.toit
index 2cbd7254c..649352079 100644
--- a/tests/broker.toit
+++ b/tests/broker.toit
@@ -56,16 +56,15 @@ class TestBroker:
 
 interface BrokerBackdoor:
   /**
-  Creates a new device with the given $hardware-id and $device-id (alias)
-    and initial $state.
+  Creates a new device with the given $device-id and initial $state.
 
   For a shared-tenancy broker this also writes the device into the
     auth-side devices table.
   */
-  create-device --hardware-id/Uuid --device-id/Uuid --state/Map -> none
+  create-device --device-id/Uuid --state/Map -> none
 
-  /** Returns the auth-side record for the given $hardware-id. */
-  get-auth-device --hardware-id/Uuid -> Map?
+  /** Returns the auth-side record for the given $device-id. */
+  get-auth-device --device-id/Uuid -> Map?
 
   /**
   Removes the device with the given $device-id.
@@ -123,12 +122,11 @@ class ToitHttpBackdoor implements BrokerBackdoor:
 
   constructor .server .server-config_:
 
-  create-device --hardware-id/Uuid --device-id/Uuid --state/Map:
+  create-device --device-id/Uuid --state/Map:
     if server-config_.tenancy == TENANCY-SHARED:
       // Shared-tenancy: the broker also owns the auth-side devices
       // record. Mirror what BrokerCliHttpShared does at notify-created.
       server.insert-auth-device
-          --hardware-id="$hardware-id"
           --device-id="$device-id"
           --organization-id=server-config_.scope.to-json
     server.create-device --device-id="$device-id" --state=state
@@ -142,8 +140,8 @@ class ToitHttpBackdoor implements BrokerBackdoor:
   clear-events -> none:
     server.clear-events
 
-  get-auth-device --hardware-id/Uuid -> Map?:
-    return server.get-auth-device --hardware-id="$hardware-id"
+  get-auth-device --device-id/Uuid -> Map?:
+    return server.get-auth-device --device-id="$device-id"
 
   stop -> none:
     server.stop
@@ -188,13 +186,13 @@ class SupabaseBackdoor implements BrokerBackdoor:
 
   constructor .server-config_ .service-key_:
 
-  create-device --hardware-id/Uuid --device-id/Uuid --state/Map:
+  create-device --device-id/Uuid --state/Map:
     with-backdoor-client_: | client/supabase.Client |
       if server-config_.tenancy == TENANCY-SHARED:
         // Shared-tenancy: the broker also owns the auth-side devices
         // table. Mirror what BrokerCliSupabase does at notify-created.
         client.rest.insert "devices" --no-return-inserted {
-          "id": "$hardware-id",
+          "id": "$device-id",
           "alias": "$device-id",
           "organization_id": server-config_.scope.to-json,
         }
@@ -203,10 +201,10 @@ class SupabaseBackdoor implements BrokerBackdoor:
         "_state": state,
       }
 
-  get-auth-device --hardware-id/Uuid -> Map?:
+  get-auth-device --device-id/Uuid -> Map?:
     with-backdoor-client_: | client/supabase.Client |
       devices := client.rest.select "devices" --filters=[
-        equals "id" "$hardware-id",
+        equals "id" "$device-id",
       ]
       if devices.is-empty: return null
       return devices[0]
diff --git a/tests/cmd-device-extract-test.toit b/tests/cmd-device-extract-test.toit
index 1b6499777..130128377 100644
--- a/tests/cmd-device-extract-test.toit
+++ b/tests/cmd-device-extract-test.toit
@@ -39,7 +39,6 @@ run-test fleet/TestFleet --args/List:
 
     test-device := fleet.tester.create-device
         --alias-id=device-id
-        --hardware-id=device-id  // Not really used anyway.
         --device-config=device-config
     test-device.start
 
diff --git a/tests/cmd-fleet-add-device-test.toit b/tests/cmd-fleet-add-device-test.toit
index ae5c18e0d..29a137b26 100644
--- a/tests/cmd-fleet-add-device-test.toit
+++ b/tests/cmd-fleet-add-device-test.toit
@@ -53,7 +53,6 @@ run-test fleet/TestFleet --args/List:
 
     test-device := fleet.tester.create-device
         --alias-id=tar-device-id
-        --hardware-id=tar-device-id  // Not really used anyway.
         --device-config=device-config
     test-device.start
 
@@ -74,7 +73,6 @@ run-test fleet/TestFleet --args/List:
 
     test-device = fleet.tester.create-device
         --alias-id=new-id
-        --hardware-id=new-id  // Not really used anyway.
         --device-config=device-config
     test-device.start
 
diff --git a/tests/cmd-fleet-add-devices-test.toit b/tests/cmd-fleet-add-devices-test.toit
index 16a506440..2ff0ae6f1 100644
--- a/tests/cmd-fleet-add-devices-test.toit
+++ b/tests/cmd-fleet-add-devices-test.toit
@@ -120,4 +120,5 @@ check-identity-file identity-path/string --id/string:
   identity := ubjson.decode (base64.decode (file.read-contents identity-path))
   expect-equals id identity["artemis.device"]["device_id"]
   expect-equals "$TEST-ORGANIZATION-UUID" identity["artemis.device"]["organization_id"]
-  expect-not-null identity["artemis.device"]["hardware_id"]
+  // Kept as a wire-compatibility alias for older Artemis service images.
+  expect-equals id identity["artemis.device"]["hardware_id"]
diff --git a/tests/host-hello-test.toit b/tests/host-hello-test.toit
index a481fe29c..a0d90ff89 100644
--- a/tests/host-hello-test.toit
+++ b/tests/host-hello-test.toit
@@ -40,9 +40,6 @@ run-test tester/Tester config/TestDeviceConfig:
 
   test-device := tester.create-device
       --alias-id=device-id
-      // We don't know the actual hardware-id.
-      // Cheat by reusing the alias id.
-      --hardware-id=device-id
       --device-config=config
   test-device.start
 
diff --git a/tests/qemu-background-test.toit b/tests/qemu-background-test.toit
index 1175b58c8..d64651ed6 100644
--- a/tests/qemu-background-test.toit
+++ b/tests/qemu-background-test.toit
@@ -85,9 +85,6 @@ run-test tester/Tester synchro-done-latch/monitor.Latch qemu-data/TestDeviceConf
 
   test-device := tester.create-device
       --alias-id=device-id
-      // We don't know the actual hardware-id.
-      // Cheat by reusing the alias id.
-      --hardware-id=device-id
       --device-config=qemu-data
   test-device.start
 
diff --git a/tests/qemu-hello-test.toit b/tests/qemu-hello-test.toit
index 5bea9aed5..11de79bf4 100644
--- a/tests/qemu-hello-test.toit
+++ b/tests/qemu-hello-test.toit
@@ -36,9 +36,6 @@ run-test tester/Tester qemu-data/TestDeviceConfig:
 
   test-device := tester.create-device
       --alias-id=device-id
-      // We don't know the actual hardware-id.
-      // Cheat by reusing the alias id.
-      --hardware-id=device-id
       --device-config=qemu-data
   test-device.start
 
diff --git a/tests/qemu-trigger-test.toit b/tests/qemu-trigger-test.toit
index c112a1db3..3fa7246df 100644
--- a/tests/qemu-trigger-test.toit
+++ b/tests/qemu-trigger-test.toit
@@ -55,9 +55,6 @@ run-test tester/Tester qemu-data/TestDeviceConfig:
 
   test-device := tester.create-device
       --alias-id=device-id
-      // We don't know the actual hardware-id.
-      // Cheat by reusing the alias id.
-      --hardware-id=device-id
       --device-config=qemu-data
   test-device.start
 
diff --git a/tests/serial-full-workflow-test-slow.toit b/tests/serial-full-workflow-test-slow.toit
index f2dadbcad..55de49b6a 100644
--- a/tests/serial-full-workflow-test-slow.toit
+++ b/tests/serial-full-workflow-test-slow.toit
@@ -292,9 +292,6 @@ run-test tester/Tester serial-port/string wifi-ssid/string wifi-password/string:
   test-device := tester.listen-to-serial-device
       --serial-port=serial-port
       --alias-id=Uuid.parse device-id
-      // We don't know the actual hardware-id.
-      // Cheat by reusing the alias id.
-      --hardware-id=Uuid.parse device-id
 
   pos := test-device.wait-for-synchronized --start-at=0
 
diff --git a/tests/serial-overridden-trigger-test-slow.toit b/tests/serial-overridden-trigger-test-slow.toit
index 7874dc3fb..87c2ddeae 100644
--- a/tests/serial-overridden-trigger-test-slow.toit
+++ b/tests/serial-overridden-trigger-test-slow.toit
@@ -95,9 +95,6 @@ run-test fleet/TestFleet serial-port/string wifi-ssid/string wifi-password/strin
   test-device := fleet.listen-to-serial-device
       --serial-port=serial-port
       --alias-id=device-id
-      // We don't know the actual hardware-id.
-      // Cheat by reusing the alias id.
-      --hardware-id=device-id
 
   synchronizer.signal
 
diff --git a/tests/serial-pin-trigger-test-slow.toit b/tests/serial-pin-trigger-test-slow.toit
index 0d3ab78c6..eee8dbe4a 100644
--- a/tests/serial-pin-trigger-test-slow.toit
+++ b/tests/serial-pin-trigger-test-slow.toit
@@ -86,9 +86,6 @@ run-test fleet/TestFleet serial-port/string wifi-ssid/string wifi-password/strin
   test-device := fleet.listen-to-serial-device
       --serial-port=serial-port
       --alias-id=device-id
-      // We don't know the actual hardware-id.
-      // Cheat by reusing the alias id.
-      --hardware-id=device-id
 
   pos := test-device.wait-for "done without closing" --start-at=0
   pos = test-device.wait-for "reason: Trigger - pin 32-1" --start-at=pos
diff --git a/tests/test-device.toit b/tests/test-device.toit
index ba6d02cae..688aa53fb 100644
--- a/tests/test-device.toit
+++ b/tests/test-device.toit
@@ -37,14 +37,12 @@ main args:
     --options=[
       Option "broker-config-json" --required,
       OptionUuid "alias-id" --required,
-      OptionUuid "hardware-id" --required,
       OptionUuid "organization-id" --required,
       Option "encoded-firmware" --required,
     ]
     --run=::
       run
           --alias-id=it["alias-id"]
-          --hardware-id=it["hardware-id"]
           --organization-id=it["organization-id"]
           --encoded-firmware=it["encoded-firmware"]
           --broker-config-json=it["broker-config-json"]
@@ -113,7 +111,6 @@ class Backdoor:
 
 run
     --alias-id/Uuid
-    --hardware-id/Uuid
     --organization-id/Uuid
     --encoded-firmware/string
     --broker-config-json/string:
@@ -128,7 +125,6 @@ run
   storage := Storage
   device := service.Device
       --id=alias-id
-      --hardware-id=hardware-id
       --organization-id=organization-id
       --firmware-state={
         "firmware": encoded-firmware,
@@ -152,4 +148,3 @@ run
     sleep sleep-duration
     watchdog.stop
     watchdog.close
-
diff --git a/tests/utils.toit b/tests/utils.toit
index ea1b704fd..eb2f6103d 100644
--- a/tests/utils.toit
+++ b/tests/utils.toit
@@ -195,7 +195,7 @@ class Tester:
   close:
     test-devices_.do: | device/TestDevice |
       device.close
-      artemis.backdoor.remove-device device.hardware-id
+      artemis.backdoor.remove-device device.id
 
   login:
     run [
@@ -317,14 +317,12 @@ class Tester:
       --organization-id/Uuid=TEST-ORGANIZATION-UUID
       --firmware-token/ByteArray?=null:
     device-description := create-device_ organization-id firmware-token
-    hardware-id/Uuid := device-description["id"]
     alias-id/Uuid := device-description["alias"]
     encoded-firmware := device-description["encoded_firmware"]
 
     result := TestDevicePipe.fake-host
         --broker=broker
         --alias-id=alias-id
-        --hardware-id=hardware-id
         --organization-id=TEST-ORGANIZATION-UUID
         --toit=toit-path_
         --encoded-firmware=encoded-firmware
@@ -334,7 +332,6 @@ class Tester:
 
   create-device -> TestDevice
       --alias-id/Uuid
-      --hardware-id/Uuid
       --device-config/TestDeviceConfig
       --organization-id=TEST-ORGANIZATION-UUID:
     result/TestDevice := ?
@@ -342,7 +339,6 @@ class Tester:
       result = TestDevicePipe.qemu
           --broker=broker
           --alias-id=alias-id
-          --hardware-id=hardware-id
           --organization-id=TEST-ORGANIZATION-UUID
           --image-path=device-config.path
           --qemu-path=qemu-path_
@@ -351,7 +347,6 @@ class Tester:
       result = TestDevicePipe.host
           --broker=broker
           --alias-id=alias-id
-          --hardware-id=hardware-id
           --organization-id=TEST-ORGANIZATION-UUID
           --tar-path=device-config.path
           --tester=this
@@ -363,12 +358,10 @@ class Tester:
 
   listen-to-serial-device -> TestDevicePipe
       --alias-id/Uuid
-      --hardware-id/Uuid
       --serial-port/string:
     result := TestDevicePipe.serial
         --broker=broker
         --alias-id=alias-id
-        --hardware-id=hardware-id
         --organization-id=TEST-ORGANIZATION-UUID
         --serial-port=serial-port
         --toit=toit-path_
@@ -381,14 +374,12 @@ class Tester:
       --organization-id/Uuid=TEST-ORGANIZATION-UUID
       --firmware-token/ByteArray?=null:
     device-description := create-device_ organization-id firmware-token
-    hardware-id/Uuid := device-description["id"]
     alias-id/Uuid := device-description["alias"]
     encoded-firmware := device-description["encoded_firmware"]
 
     result := FakeDevice
         --broker=broker
         --alias-id=alias-id
-        --hardware-id=hardware-id
         --organization-id=TEST-ORGANIZATION-UUID
         --encoded-firmware=encoded-firmware
         --tester=this
@@ -398,7 +389,6 @@ class Tester:
 
   start-fake-device --identity/Map --firmware-token/ByteArray?=null -> FakeDevice:
     device-description := identity["artemis.device"]
-    hardware-id/Uuid := Uuid.parse device-description["hardware_id"]
     alias-id/Uuid := Uuid.parse device-description["device_id"]
     organization-id/Uuid := Uuid.parse device-description["organization_id"]
 
@@ -406,12 +396,10 @@ class Tester:
         --firmware-token=firmware-token
         --device-id=alias-id
         --organization-id=TEST-ORGANIZATION-UUID
-        --hardware-id=hardware-id
 
     result := FakeDevice
         --broker=broker
         --alias-id=alias-id
-        --hardware-id=hardware-id
         --organization-id=organization-id
         --encoded-firmware=encoded-firmware
         --tester=this
@@ -420,18 +408,16 @@ class Tester:
     return result
 
   create-device_ organization-id/Uuid firmware-token/ByteArray?=null -> Map:
-    hardware-id := random-uuid
     alias-id := random-uuid
     initial-state := {
       "identity": {
         "device_id": "$alias-id",
         "organization_id": "$organization-id",
-        "hardware_id": "$hardware-id",
+        "hardware_id": "$alias-id",
       }
     }
 
     broker.backdoor.create-device
-        --hardware-id=hardware-id
         --device-id=alias-id
         --state=initial-state
 
@@ -439,10 +425,9 @@ class Tester:
         --firmware-token=firmware-token
         --device-id=alias-id
         --organization-id=TEST-ORGANIZATION-UUID
-        --hardware-id=hardware-id
 
     return {
-      "id": hardware-id,
+      "id": alias-id,
       "alias": alias-id,
       "encoded_firmware": encoded-firmware,
     }
@@ -456,14 +441,13 @@ class Tester:
     (broker.backdoor as broker-lib.ToitHttpBackdoor).stop
 
 abstract class TestDevice:
-  hardware-id/Uuid
   alias-id/Uuid
   organization-id/Uuid
   broker/TestBroker
   tester/Tester
   pos_/int := 0
 
-  constructor --.broker --.hardware-id --.alias-id --.organization-id --.tester:
+  constructor --.broker --.alias-id --.organization-id --.tester:
 
   /**
   Starts the device.
@@ -588,7 +572,6 @@ class FakeDevice extends TestDevice:
 
   constructor
       --broker/TestBroker
-      --hardware-id/Uuid
       --alias-id/Uuid
       --organization-id/Uuid
       --encoded-firmware/string
@@ -599,13 +582,11 @@ class FakeDevice extends TestDevice:
     }
     device_ = Device
         --id=alias-id
-        --hardware-id=hardware-id
         --organization-id=organization-id
         --firmware-state=firmware-state
         --storage=Storage
     super
         --broker=broker
-        --hardware-id=hardware-id
         --alias-id=alias-id
         --organization-id=organization-id
         --tester=tester
@@ -688,7 +669,6 @@ class FakeDevice extends TestDevice:
     // Replace the whole device object.
     device_ = Device
         --id=alias-id
-        --hardware-id=hardware-id
         --organization-id=organization-id
         --firmware-state=pending-state_
         --storage=Storage
@@ -756,7 +736,6 @@ class TestDevicePipe extends TestDevice:
 
   constructor.fake-host
       --broker/TestBroker
-      --hardware-id/Uuid
       --alias-id/Uuid
       --organization-id/Uuid
       --encoded-firmware/string
@@ -776,7 +755,6 @@ class TestDevicePipe extends TestDevice:
     command_ = [
       toit-run,
       "test-device.toit",
-      "--hardware-id=$hardware-id",
       "--alias-id=$alias-id",
       "--organization-id=$organization-id",
       "--encoded-firmware=$encoded-firmware",
@@ -785,14 +763,12 @@ class TestDevicePipe extends TestDevice:
     has-backdoor = true
     super
         --broker=broker
-        --hardware-id=hardware-id
         --alias-id=alias-id
         --organization-id=organization-id
         --tester=tester
 
   constructor.serial
       --broker/TestBroker
-      --hardware-id/Uuid
       --alias-id/Uuid
       --organization-id/Uuid
       --serial-port/string
@@ -812,14 +788,12 @@ class TestDevicePipe extends TestDevice:
     ]
     super
         --broker=broker
-        --hardware-id=hardware-id
         --alias-id=alias-id
         --organization-id=organization-id
         --tester=tester
 
   constructor.qemu
         --broker/TestBroker
-        --hardware-id/Uuid
         --alias-id/Uuid
         --organization-id/Uuid
         --image-path/string
@@ -835,14 +809,12 @@ class TestDevicePipe extends TestDevice:
     ]
     super
         --broker=broker
-        --hardware-id=hardware-id
         --alias-id=alias-id
         --organization-id=organization-id
         --tester=tester
 
   constructor.host
       --broker/TestBroker
-      --hardware-id/Uuid
       --alias-id/Uuid
       --organization-id/Uuid
       --tar-path/string
@@ -853,7 +825,6 @@ class TestDevicePipe extends TestDevice:
     command_ = ["bash", boot-sh]
     super
         --broker=broker
-        --hardware-id=hardware-id
         --alias-id=alias-id
         --organization-id=organization-id
         --tester=tester
@@ -1133,7 +1104,6 @@ with-tester
 build-encoded-firmware -> string
     --device-id/Uuid
     --organization-id/Uuid=TEST-ORGANIZATION-UUID
-    --hardware-id/Uuid=device-id
     --firmware-token/ByteArray=#[random 256, random 256, random 256, random 256]
     --sdk-version/string=TEST-SDK-VERSION
     --pod-id/Uuid=TEST-POD-UUID:
@@ -1141,7 +1111,7 @@ build-encoded-firmware -> string
     "artemis.device": {
       "device_id": "$device-id",
       "organization_id": "$organization-id",
-      "hardware_id": "$hardware-id",
+      "hardware_id": "$device-id",
     },
     "parts": ubjson.encode [{
       "from": 0,
@@ -1163,7 +1133,6 @@ build-encoded-firmware -> string
   return build-encoded-firmware
       --device-id=device.id
       --organization-id=device.organization-id
-      --hardware-id=device.hardware-id
       --sdk-version=sdk-version
       --pod-id=pod-id
 
@@ -1243,7 +1212,6 @@ class TestFleet:
 
     test-device := tester.create-device
         --alias-id=device-id
-        --hardware-id=device-id  // Not really used anyway.
         --device-config=device-config
 
     tester.replacements["$device-id"] = pad-replacement-id name
@@ -1257,11 +1225,9 @@ class TestFleet:
 
   listen-to-serial-device -> TestDevicePipe
       --alias-id/Uuid
-      --hardware-id/Uuid
       --serial-port/string:
     return tester.listen-to-serial-device
         --alias-id=alias-id
-        --hardware-id=hardware-id
         --serial-port=serial-port
 
   /**
diff --git a/tools/http_servers/artemis-server.toit b/tools/http_servers/artemis-server.toit
index ef31d83fb..951808bba 100644
--- a/tools/http_servers/artemis-server.toit
+++ b/tools/http_servers/artemis-server.toit
@@ -132,15 +132,15 @@ class HttpArtemisServer extends HttpServer:
       throw "BAD COMMAND $command"
 
   store-event data/Map:
-    device-id := data["hardware_id"]
+    device-id := data["device_id"]
     if not devices.contains device-id:
       errors.add [DEVICE-NOT-FOUND, device-id]
       throw "Device not found"
     events.add
         EventEntry device-id --data=data["data"]
 
-  remove-device hardware-id/string -> none:
-    devices.remove hardware-id
+  remove-device device-id/string -> none:
+    devices.remove device-id
 
   create-user --email/string --name/string --id/string?=null -> string:
     if not id: id = (Uuid.uuid5 "" "user_id - $Time.monotonic-us").stringify
diff --git a/tools/http_servers/public/broker/broker.toit b/tools/http_servers/public/broker/broker.toit
index b2f31042c..e981a6395 100644
--- a/tools/http_servers/public/broker/broker.toit
+++ b/tools/http_servers/public/broker/broker.toit
@@ -49,8 +49,8 @@ class HttpBroker extends HttpServer:
   events_/Map := {:}  // Map from device-id to list of events.
 
   // Shared-tenancy auth-side device records. Populated when notify-created
-  // includes a hardware-id / organization-id (i.e. the BrokerCliHttpShared
-  // wire shape). Maps hardware-id -> {alias, organization_id}.
+  // includes an organization-id (i.e. the BrokerCliHttpShared wire shape).
+  // Maps device-id -> {id, alias, organization_id}.
   auth-devices_/Map := {:}
 
   /* Pod description related fields. */
@@ -125,31 +125,27 @@ class HttpBroker extends HttpServer:
   notify-created data/Map:
     device-id := data["_device_id"]
     state := data["_state"]
-    hardware-id := data.get "_hardware_id"
     organization-id := data.get "_organization_id"
     if device-states_.contains device-id:
       throw "Device $device-id already exists"
-    if hardware-id:
-      if not organization-id:
-        throw "Missing organization-id for hardware-id $hardware-id"
-      if auth-devices_.contains hardware-id:
-        throw "Device with hardware-id $hardware-id already exists"
-    else if organization-id:
-      throw "Missing hardware-id for organization-id $organization-id"
+    if organization-id and auth-devices_.contains device-id:
+      throw "Auth device $device-id already exists"
 
     device-states_[device-id] = state
-    if hardware-id:
-      auth-devices_[hardware-id] = {
+    if organization-id:
+      auth-devices_[device-id] = {
+        "id": device-id,
         "alias": device-id,
         "organization_id": organization-id,
       }
 
-  get-auth-device --hardware-id/string -> Map?:
-    return auth-devices_.get hardware-id
+  get-auth-device --device-id/string -> Map?:
+    return auth-devices_.get device-id
 
   /** Backdoor for inserting an auth-side device record. */
-  insert-auth-device --hardware-id/string --device-id/string --organization-id/any:
-    auth-devices_[hardware-id] = {
+  insert-auth-device --device-id/string --organization-id/any:
+    auth-devices_[device-id] = {
+      "id": device-id,
       "alias": device-id,
       "organization_id": organization-id,
     }

From e18d881f006b5e883b9cd1fde670a59fba2a728a Mon Sep 17 00:00:00 2001
From: Florian Loitsch <florian@loitsch.com>
Date: Wed, 26 Aug 2026 01:14:42 +0200
Subject: [PATCH 2/3] Clarify legacy broker state compatibility

---
 src/cli/broker.toit | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/cli/broker.toit b/src/cli/broker.toit
index 0a24a1754..c8558fed6 100644
--- a/src/cli/broker.toit
+++ b/src/cli/broker.toit
@@ -698,7 +698,7 @@ class Broker:
     identity := {
       "device_id": "$device.id",
       "organization_id": "$device.organization-id",
-      // Kept so older CLI versions can read the initial state.
+      // Retained while the current broker API persists the legacy state shape.
       "hardware_id": "$device.id",
     }
     state := {

From 79b16c90fbb72abc7b55a6088df7d4dce3fd79b7 Mon Sep 17 00:00:00 2001
From: Florian Loitsch <florian@loitsch.com>
Date: Wed, 26 Aug 2026 01:27:28 +0200
Subject: [PATCH 3/3] Rename alias IDs to device IDs

---
 src/cli/brokers/supabase/supabase.toit        |  1 +
 src/cli/device.toit                           |  1 -
 tests/cmd-config-test.toit                    |  4 +-
 tests/cmd-device-container-test.toit          |  2 +-
 tests/cmd-device-container2-test-slow.toit    |  4 +-
 tests/cmd-device-default-test.toit            |  4 +-
 tests/cmd-device-extract-test.toit            |  2 +-
 tests/cmd-device-show-test.toit               |  4 +-
 tests/cmd-fleet-add-device-test.toit          |  4 +-
 tests/cmd-fleet-migration3-test-slow.toit     |  6 +-
 tests/cmd-max-offline-test.toit               |  6 +-
 tests/host-hello-test.toit                    |  2 +-
 tests/qemu-background-test.toit               |  2 +-
 tests/qemu-hello-test.toit                    |  2 +-
 tests/qemu-trigger-test.toit                  |  2 +-
 tests/serial-full-workflow-test-slow.toit     |  2 +-
 .../serial-overridden-trigger-test-slow.toit  |  2 +-
 tests/serial-pin-trigger-test-slow.toit       |  2 +-
 ...supabase-artemis-broker-policies-test.toit | 18 ++--
 tests/test-client-backdoor-test.toit          |  2 +-
 tests/test-device.toit                        |  8 +-
 tests/utils.toit                              | 87 +++++++++----------
 22 files changed, 85 insertions(+), 82 deletions(-)

diff --git a/src/cli/brokers/supabase/supabase.toit b/src/cli/brokers/supabase/supabase.toit
index 54e6bcdfe..0af339002 100644
--- a/src/cli/brokers/supabase/supabase.toit
+++ b/src/cli/brokers/supabase/supabase.toit
@@ -81,6 +81,7 @@ class BrokerCliSupabase extends BrokerCliHttp:
   */
   notify-created --device-id/Uuid --state/Map -> none:
     if server-config_.tenancy == TENANCY-SHARED:
+      // The existing schema keeps both columns; they now hold the same ID.
       supabase-client_.rest.insert "devices" --no-return-inserted {
         "id": "$device-id",
         "alias": "$device-id",
diff --git a/src/cli/device.toit b/src/cli/device.toit
index fc639f136..c00f87b7b 100644
--- a/src/cli/device.toit
+++ b/src/cli/device.toit
@@ -8,7 +8,6 @@ class Device:
   The device ID.
 
   This ID is the one under which users identify a device.
-  It's also called "alias" in the Artemis server.
   */
   id/Uuid
 
diff --git a/tests/cmd-config-test.toit b/tests/cmd-config-test.toit
index 355302757..af34888e1 100644
--- a/tests/cmd-config-test.toit
+++ b/tests/cmd-config-test.toit
@@ -47,7 +47,7 @@ run-test fleet/TestFleet:
   fake-device := fleet.devices.values[0] as FakeDevice
 
   fleet.run [
-    "device", "default", "$fake-device.alias-id",
+    "device", "default", "$fake-device.device-id",
   ]
 
   fleet.run [
@@ -72,7 +72,7 @@ run-test fleet/TestFleet:
   json-config = fleet.run --json [
     "config", "show"
   ]
-  expect-equals "$fake-device.alias-id" json-config["default-device"]
+  expect-equals "$fake-device.device-id" json-config["default-device"]
   expect-equals "$fake-device.organization-id" json-config["default-org"]
   expect-list-equals RECOVERY-SERVERS json-config["recovery-servers"]
 
diff --git a/tests/cmd-device-container-test.toit b/tests/cmd-device-container-test.toit
index 1693684c2..8b691bf23 100644
--- a/tests/cmd-device-container-test.toit
+++ b/tests/cmd-device-container-test.toit
@@ -22,7 +22,7 @@ run-test fleet/TestFleet:
       """
 
   fleet.run [
-    "device", "default", "$device.alias-id"
+    "device", "default", "$device.device-id"
   ]
 
   fleet.run-gold "200_install"
diff --git a/tests/cmd-device-container2-test-slow.toit b/tests/cmd-device-container2-test-slow.toit
index 86925cfbc..6fde42752 100644
--- a/tests/cmd-device-container2-test-slow.toit
+++ b/tests/cmd-device-container2-test-slow.toit
@@ -21,10 +21,10 @@ run-test fleet/TestFleet:
     main:
       print "Hello world"
     """
-  fleet.run ["device", "-d", "$device.id", "container", "install", "hello", hello-path]
+  fleet.run ["device", "-d", "$device.device-id", "container", "install", "hello", hello-path]
   device.wait-for "Hello world"
 
-  fleet.run ["device", "-d", "$device.id", "container", "uninstall", "hello"]
+  fleet.run ["device", "-d", "$device.device-id", "container", "uninstall", "hello"]
   device.wait-for "[artemis.containers] INFO: uninstall {name: hello"
 
   device.wait-for "[artemis.containers] INFO: image uninstalled"
diff --git a/tests/cmd-device-default-test.toit b/tests/cmd-device-default-test.toit
index 78cdc4ef5..5f9527d08 100644
--- a/tests/cmd-device-default-test.toit
+++ b/tests/cmd-device-default-test.toit
@@ -24,7 +24,7 @@ run-test fleet/TestFleet:
   fleet.run-gold "20-set-default"
       "Set the default device"
       [
-        "device", "default", "$device.id"
+        "device", "default", "$device.device-id"
       ]
 
   fleet.run-gold "30-default-is-set"
@@ -37,4 +37,4 @@ run-test fleet/TestFleet:
       [
         "device", "default"
       ]
-  expect-equals "$device.id" json-output
+  expect-equals "$device.device-id" json-output
diff --git a/tests/cmd-device-extract-test.toit b/tests/cmd-device-extract-test.toit
index 130128377..6f9b7b631 100644
--- a/tests/cmd-device-extract-test.toit
+++ b/tests/cmd-device-extract-test.toit
@@ -38,7 +38,7 @@ run-test fleet/TestFleet --args/List:
         --path=tar-file
 
     test-device := fleet.tester.create-device
-        --alias-id=device-id
+        --device-id=device-id
         --device-config=device-config
     test-device.start
 
diff --git a/tests/cmd-device-show-test.toit b/tests/cmd-device-show-test.toit
index 830b214ac..25d79b11b 100644
--- a/tests/cmd-device-show-test.toit
+++ b/tests/cmd-device-show-test.toit
@@ -19,11 +19,11 @@ run-test fleet/TestFleet:
   fleet.run-gold "110-device-show"
       "Show the given device"
       [
-        "device", "show", "-d", "$fake-device1.alias-id",
+        "device", "show", "-d", "$fake-device1.device-id",
       ]
 
   fleet.run-gold "111-device-show"
       "Show the given device"
       [
-        "device", "show", "$fake-device1.alias-id",
+        "device", "show", "$fake-device1.device-id",
       ]
diff --git a/tests/cmd-fleet-add-device-test.toit b/tests/cmd-fleet-add-device-test.toit
index 29a137b26..dff06bc0b 100644
--- a/tests/cmd-fleet-add-device-test.toit
+++ b/tests/cmd-fleet-add-device-test.toit
@@ -52,7 +52,7 @@ run-test fleet/TestFleet --args/List:
         --path=tar-file
 
     test-device := fleet.tester.create-device
-        --alias-id=tar-device-id
+        --device-id=tar-device-id
         --device-config=device-config
     test-device.start
 
@@ -72,7 +72,7 @@ run-test fleet/TestFleet --args/List:
         --path=tar-file
 
     test-device = fleet.tester.create-device
-        --alias-id=new-id
+        --device-id=new-id
         --device-config=device-config
     test-device.start
 
diff --git a/tests/cmd-fleet-migration3-test-slow.toit b/tests/cmd-fleet-migration3-test-slow.toit
index 3c3624839..d52463380 100644
--- a/tests/cmd-fleet-migration3-test-slow.toit
+++ b/tests/cmd-fleet-migration3-test-slow.toit
@@ -30,9 +30,9 @@ main args:
 
     // Start by updating device2 (which is stopped).
     // We will check that it hasn't changed after device1 is updated.
-    fleet.run ["device", "update", "-d", "$device2.id", "$pod-id"]
+    fleet.run ["device", "update", "-d", "$device2.device-id", "$pod-id"]
 
-    fleet.run ["device", "update", "-d", "$device.id", "$pod-id"]
+    fleet.run ["device", "update", "-d", "$device.device-id", "$pod-id"]
     // Wait for the device to be on the new pod.
     device.wait-to-be-on-pod pod-id
     // Check that the device is on the new broker.
@@ -43,7 +43,7 @@ main args:
 
     // Update the device2 again.
     pod-id2 := fleet.upload-pod "pod2" --format="tar"
-    fleet.run ["device", "update", "-d", "$device2.id", "$pod-id2"]
+    fleet.run ["device", "update", "-d", "$device2.device-id", "$pod-id2"]
     // Start the device2. It should move to the new pod on the new broker.
     device2.start
     device2.wait-to-be-on-pod pod-id2
diff --git a/tests/cmd-max-offline-test.toit b/tests/cmd-max-offline-test.toit
index 8980ef96b..b24f97fe1 100644
--- a/tests/cmd-max-offline-test.toit
+++ b/tests/cmd-max-offline-test.toit
@@ -21,13 +21,13 @@ main args:
         "--fleet-root", tester.tmp-dir,
         "--organization-id", "$device.organization-id",
     ]
-    tester.run ["fleet", "add-existing-device", "--fleet-root", tester.tmp-dir, "$device.alias-id"]
+    tester.run ["fleet", "add-existing-device", "--fleet-root", tester.tmp-dir, "$device.device-id"]
 
     tester.run [
       "--fleet-root", tester.tmp-dir,
       "device",
       "set-max-offline",
-      "--device", "$device.alias-id",
+      "--device", "$device.device-id",
       "1",
     ]
 
@@ -42,7 +42,7 @@ main args:
       "--fleet-root", tester.tmp-dir,
       "device",
       "set-max-offline",
-      "--device", "$device.alias-id",
+      "--device", "$device.device-id",
       "3m",
     ]
 
diff --git a/tests/host-hello-test.toit b/tests/host-hello-test.toit
index a0d90ff89..83070697d 100644
--- a/tests/host-hello-test.toit
+++ b/tests/host-hello-test.toit
@@ -39,7 +39,7 @@ run-test tester/Tester config/TestDeviceConfig:
   device-id := config.device-id
 
   test-device := tester.create-device
-      --alias-id=device-id
+      --device-id=device-id
       --device-config=config
   test-device.start
 
diff --git a/tests/qemu-background-test.toit b/tests/qemu-background-test.toit
index d64651ed6..e4a67a1e2 100644
--- a/tests/qemu-background-test.toit
+++ b/tests/qemu-background-test.toit
@@ -84,7 +84,7 @@ run-test tester/Tester synchro-done-latch/monitor.Latch qemu-data/TestDeviceConf
   lan-ip := get-lan-ip
 
   test-device := tester.create-device
-      --alias-id=device-id
+      --device-id=device-id
       --device-config=qemu-data
   test-device.start
 
diff --git a/tests/qemu-hello-test.toit b/tests/qemu-hello-test.toit
index 11de79bf4..fe5144724 100644
--- a/tests/qemu-hello-test.toit
+++ b/tests/qemu-hello-test.toit
@@ -35,7 +35,7 @@ run-test tester/Tester qemu-data/TestDeviceConfig:
   device-id := qemu-data.device-id
 
   test-device := tester.create-device
-      --alias-id=device-id
+      --device-id=device-id
       --device-config=qemu-data
   test-device.start
 
diff --git a/tests/qemu-trigger-test.toit b/tests/qemu-trigger-test.toit
index 3fa7246df..1ee5ff41c 100644
--- a/tests/qemu-trigger-test.toit
+++ b/tests/qemu-trigger-test.toit
@@ -54,7 +54,7 @@ run-test tester/Tester qemu-data/TestDeviceConfig:
   device-id := qemu-data.device-id
 
   test-device := tester.create-device
-      --alias-id=device-id
+      --device-id=device-id
       --device-config=qemu-data
   test-device.start
 
diff --git a/tests/serial-full-workflow-test-slow.toit b/tests/serial-full-workflow-test-slow.toit
index 55de49b6a..5ffe65adb 100644
--- a/tests/serial-full-workflow-test-slow.toit
+++ b/tests/serial-full-workflow-test-slow.toit
@@ -291,7 +291,7 @@ run-test tester/Tester serial-port/string wifi-ssid/string wifi-password/string:
 
   test-device := tester.listen-to-serial-device
       --serial-port=serial-port
-      --alias-id=Uuid.parse device-id
+      --device-id=Uuid.parse device-id
 
   pos := test-device.wait-for-synchronized --start-at=0
 
diff --git a/tests/serial-overridden-trigger-test-slow.toit b/tests/serial-overridden-trigger-test-slow.toit
index 87c2ddeae..e91c432e7 100644
--- a/tests/serial-overridden-trigger-test-slow.toit
+++ b/tests/serial-overridden-trigger-test-slow.toit
@@ -94,7 +94,7 @@ run-test fleet/TestFleet serial-port/string wifi-ssid/string wifi-password/strin
 
   test-device := fleet.listen-to-serial-device
       --serial-port=serial-port
-      --alias-id=device-id
+      --device-id=device-id
 
   synchronizer.signal
 
diff --git a/tests/serial-pin-trigger-test-slow.toit b/tests/serial-pin-trigger-test-slow.toit
index eee8dbe4a..1066190d5 100644
--- a/tests/serial-pin-trigger-test-slow.toit
+++ b/tests/serial-pin-trigger-test-slow.toit
@@ -85,7 +85,7 @@ run-test fleet/TestFleet serial-port/string wifi-ssid/string wifi-password/strin
 
   test-device := fleet.listen-to-serial-device
       --serial-port=serial-port
-      --alias-id=device-id
+      --device-id=device-id
 
   pos := test-device.wait-for "done without closing" --start-at=0
   pos = test-device.wait-for "reason: Trigger - pin 32-1" --start-at=pos
diff --git a/tests/supabase-artemis-broker-policies-test.toit b/tests/supabase-artemis-broker-policies-test.toit
index aa27606a8..b532f18a1 100644
--- a/tests/supabase-artemis-broker-policies-test.toit
+++ b/tests/supabase-artemis-broker-policies-test.toit
@@ -29,18 +29,24 @@ main args:
     organization-id := organization["id"]
 
     // Add the devices into the Artemis database.
-    device1 := client1.rest.insert "devices" {
+    device-id1 := "$(random-uuid)"
+    client1.rest.insert "devices" --no-return-inserted {
+      "id": "$device-id1",
+      "alias": "$device-id1",
       "organization_id": organization-id,
     }
-    device-id1 := device1["alias"]
-    device2 := client1.rest.insert "devices" {
+    device-id2 := "$(random-uuid)"
+    client1.rest.insert "devices" --no-return-inserted {
+      "id": "$device-id2",
+      "alias": "$device-id2",
       "organization_id": organization-id,
     }
-    device-id2 := device2["alias"]
-    device3 := client1.rest.insert "devices" {
+    device-id3 := "$(random-uuid)"
+    client1.rest.insert "devices" --no-return-inserted {
+      "id": "$device-id3",
+      "alias": "$device-id3",
       "organization_id": organization-id,
     }
-    device-id3 := device3["alias"]
 
     run-shared-test
         --client1=client1
diff --git a/tests/test-client-backdoor-test.toit b/tests/test-client-backdoor-test.toit
index 793d0649e..77f038f8d 100644
--- a/tests/test-client-backdoor-test.toit
+++ b/tests/test-client-backdoor-test.toit
@@ -14,7 +14,7 @@ main args:
     device.wait-until-connected
 
     expect device.has-backdoor
-    expect-equals device.id device.backdoor.device-id
+    expect-equals device.device-id device.backdoor.device-id
 
     device.backdoor.set-storage --ram "test-key" "test-value"
     expect-equals "test-value" (device.backdoor.get-storage --ram "test-key")
diff --git a/tests/test-device.toit b/tests/test-device.toit
index 688aa53fb..28d2026f6 100644
--- a/tests/test-device.toit
+++ b/tests/test-device.toit
@@ -36,13 +36,13 @@ main args:
   cmd := Command "root"
     --options=[
       Option "broker-config-json" --required,
-      OptionUuid "alias-id" --required,
+      OptionUuid "device-id" --required,
       OptionUuid "organization-id" --required,
       Option "encoded-firmware" --required,
     ]
     --run=::
       run
-          --alias-id=it["alias-id"]
+          --device-id=it["device-id"]
           --organization-id=it["organization-id"]
           --encoded-firmware=it["encoded-firmware"]
           --broker-config-json=it["broker-config-json"]
@@ -110,7 +110,7 @@ class Backdoor:
       writer.out.write (json.encode "ok")
 
 run
-    --alias-id/Uuid
+    --device-id/Uuid
     --organization-id/Uuid
     --encoded-firmware/string
     --broker-config-json/string:
@@ -124,7 +124,7 @@ run
 
   storage := Storage
   device := service.Device
-      --id=alias-id
+      --id=device-id
       --organization-id=organization-id
       --firmware-state={
         "firmware": encoded-firmware,
diff --git a/tests/utils.toit b/tests/utils.toit
index eb2f6103d..f595e0a5f 100644
--- a/tests/utils.toit
+++ b/tests/utils.toit
@@ -195,7 +195,7 @@ class Tester:
   close:
     test-devices_.do: | device/TestDevice |
       device.close
-      artemis.backdoor.remove-device device.id
+      artemis.backdoor.remove-device device.device-id
 
   login:
     run [
@@ -317,12 +317,12 @@ class Tester:
       --organization-id/Uuid=TEST-ORGANIZATION-UUID
       --firmware-token/ByteArray?=null:
     device-description := create-device_ organization-id firmware-token
-    alias-id/Uuid := device-description["alias"]
+    device-id/Uuid := device-description["device_id"]
     encoded-firmware := device-description["encoded_firmware"]
 
     result := TestDevicePipe.fake-host
         --broker=broker
-        --alias-id=alias-id
+        --device-id=device-id
         --organization-id=TEST-ORGANIZATION-UUID
         --toit=toit-path_
         --encoded-firmware=encoded-firmware
@@ -331,14 +331,14 @@ class Tester:
     return result
 
   create-device -> TestDevice
-      --alias-id/Uuid
+      --device-id/Uuid
       --device-config/TestDeviceConfig
       --organization-id=TEST-ORGANIZATION-UUID:
     result/TestDevice := ?
     if device-config.format == "image":
       result = TestDevicePipe.qemu
           --broker=broker
-          --alias-id=alias-id
+          --device-id=device-id
           --organization-id=TEST-ORGANIZATION-UUID
           --image-path=device-config.path
           --qemu-path=qemu-path_
@@ -346,7 +346,7 @@ class Tester:
     else if device-config.format == "tar":
       result = TestDevicePipe.host
           --broker=broker
-          --alias-id=alias-id
+          --device-id=device-id
           --organization-id=TEST-ORGANIZATION-UUID
           --tar-path=device-config.path
           --tester=this
@@ -357,11 +357,11 @@ class Tester:
     return result
 
   listen-to-serial-device -> TestDevicePipe
-      --alias-id/Uuid
+      --device-id/Uuid
       --serial-port/string:
     result := TestDevicePipe.serial
         --broker=broker
-        --alias-id=alias-id
+        --device-id=device-id
         --organization-id=TEST-ORGANIZATION-UUID
         --serial-port=serial-port
         --toit=toit-path_
@@ -374,12 +374,12 @@ class Tester:
       --organization-id/Uuid=TEST-ORGANIZATION-UUID
       --firmware-token/ByteArray?=null:
     device-description := create-device_ organization-id firmware-token
-    alias-id/Uuid := device-description["alias"]
+    device-id/Uuid := device-description["device_id"]
     encoded-firmware := device-description["encoded_firmware"]
 
     result := FakeDevice
         --broker=broker
-        --alias-id=alias-id
+        --device-id=device-id
         --organization-id=TEST-ORGANIZATION-UUID
         --encoded-firmware=encoded-firmware
         --tester=this
@@ -389,17 +389,17 @@ class Tester:
 
   start-fake-device --identity/Map --firmware-token/ByteArray?=null -> FakeDevice:
     device-description := identity["artemis.device"]
-    alias-id/Uuid := Uuid.parse device-description["device_id"]
+    device-id/Uuid := Uuid.parse device-description["device_id"]
     organization-id/Uuid := Uuid.parse device-description["organization_id"]
 
     encoded-firmware := build-encoded-firmware
         --firmware-token=firmware-token
-        --device-id=alias-id
+        --device-id=device-id
         --organization-id=TEST-ORGANIZATION-UUID
 
     result := FakeDevice
         --broker=broker
-        --alias-id=alias-id
+        --device-id=device-id
         --organization-id=organization-id
         --encoded-firmware=encoded-firmware
         --tester=this
@@ -408,27 +408,26 @@ class Tester:
     return result
 
   create-device_ organization-id/Uuid firmware-token/ByteArray?=null -> Map:
-    alias-id := random-uuid
+    device-id := random-uuid
     initial-state := {
       "identity": {
-        "device_id": "$alias-id",
+        "device_id": "$device-id",
         "organization_id": "$organization-id",
-        "hardware_id": "$alias-id",
+        "hardware_id": "$device-id",
       }
     }
 
     broker.backdoor.create-device
-        --device-id=alias-id
+        --device-id=device-id
         --state=initial-state
 
     encoded-firmware := build-encoded-firmware
         --firmware-token=firmware-token
-        --device-id=alias-id
+        --device-id=device-id
         --organization-id=TEST-ORGANIZATION-UUID
 
     return {
-      "id": alias-id,
-      "alias": alias-id,
+      "device_id": device-id,
       "encoded_firmware": encoded-firmware,
     }
 
@@ -441,13 +440,13 @@ class Tester:
     (broker.backdoor as broker-lib.ToitHttpBackdoor).stop
 
 abstract class TestDevice:
-  alias-id/Uuid
+  device-id/Uuid
   organization-id/Uuid
   broker/TestBroker
   tester/Tester
   pos_/int := 0
 
-  constructor --.broker --.alias-id --.organization-id --.tester:
+  constructor --.broker --.device-id --.organization-id --.tester:
 
   /**
   Starts the device.
@@ -493,8 +492,6 @@ abstract class TestDevice:
   */
   abstract update-output-pos -> none
 
-  id -> Uuid: return alias-id
-
   wait-for-synchronized --start-at/int=pos_ --update-pos/bool=true -> int:
     new-pos := wait-for "[artemis.synchronize] INFO: synchronized"
         --start-at=start-at
@@ -513,7 +510,7 @@ abstract class TestDevice:
     while true:
       for i := 0; i < status.size; i++:
         status-line := status[i]
-        if status-line["device-id"] != "$id":
+        if status-line["device-id"] != "$device-id":
           continue
         if status-line["broker"] == broker.name:
           return status
@@ -530,7 +527,7 @@ abstract class TestDevice:
     while true:
       for i := 0; i < status.size; i++:
         status-line := status[i]
-        if status-line["device-id"] != "$id":
+        if status-line["device-id"] != "$device-id":
           continue
         if status-line["pod-id"] == "$pod-id":
           return status
@@ -541,7 +538,7 @@ abstract class TestDevice:
   get-current-broker --status=get-status_:
     for i := 0; i < status.size; i++:
       status-line := status[i]
-      if status-line["device-id"] != "$id":
+      if status-line["device-id"] != "$device-id":
         continue
       return status-line["broker"]
     unreachable
@@ -559,7 +556,7 @@ abstract class TestDevice:
       // Wait until the device has reported its state.
       with-timeout timeout:
         while true:
-          state := broker.backdoor.get-state alias-id
+          state := broker.backdoor.get-state device-id
           // The initial state has the field "identity" in it.
           if not state.contains "identity": break
           sleep --ms=100
@@ -572,7 +569,7 @@ class FakeDevice extends TestDevice:
 
   constructor
       --broker/TestBroker
-      --alias-id/Uuid
+      --device-id/Uuid
       --organization-id/Uuid
       --encoded-firmware/string
       --tester/Tester:
@@ -581,13 +578,13 @@ class FakeDevice extends TestDevice:
       "firmware": encoded-firmware
     }
     device_ = Device
-        --id=alias-id
+        --id=device-id
         --organization-id=organization-id
         --firmware-state=firmware-state
         --storage=Storage
     super
         --broker=broker
-        --alias-id=alias-id
+        --device-id=device-id
         --organization-id=organization-id
         --tester=tester
 
@@ -668,7 +665,7 @@ class FakeDevice extends TestDevice:
     // We can't change the firmware state (final variable).
     // Replace the whole device object.
     device_ = Device
-        --id=alias-id
+        --id=device-id
         --organization-id=organization-id
         --firmware-state=pending-state_
         --storage=Storage
@@ -736,7 +733,7 @@ class TestDevicePipe extends TestDevice:
 
   constructor.fake-host
       --broker/TestBroker
-      --alias-id/Uuid
+      --device-id/Uuid
       --organization-id/Uuid
       --encoded-firmware/string
       --toit/string
@@ -755,7 +752,7 @@ class TestDevicePipe extends TestDevice:
     command_ = [
       toit-run,
       "test-device.toit",
-      "--alias-id=$alias-id",
+      "--device-id=$device-id",
       "--organization-id=$organization-id",
       "--encoded-firmware=$encoded-firmware",
       "--broker-config-json=$encoded-broker-config",
@@ -763,13 +760,13 @@ class TestDevicePipe extends TestDevice:
     has-backdoor = true
     super
         --broker=broker
-        --alias-id=alias-id
+        --device-id=device-id
         --organization-id=organization-id
         --tester=tester
 
   constructor.serial
       --broker/TestBroker
-      --alias-id/Uuid
+      --device-id/Uuid
       --organization-id/Uuid
       --serial-port/string
       --toit/string
@@ -788,13 +785,13 @@ class TestDevicePipe extends TestDevice:
     ]
     super
         --broker=broker
-        --alias-id=alias-id
+        --device-id=device-id
         --organization-id=organization-id
         --tester=tester
 
   constructor.qemu
         --broker/TestBroker
-        --alias-id/Uuid
+        --device-id/Uuid
         --organization-id/Uuid
         --image-path/string
         --qemu-path/string
@@ -809,13 +806,13 @@ class TestDevicePipe extends TestDevice:
     ]
     super
         --broker=broker
-        --alias-id=alias-id
+        --device-id=device-id
         --organization-id=organization-id
         --tester=tester
 
   constructor.host
       --broker/TestBroker
-      --alias-id/Uuid
+      --device-id/Uuid
       --organization-id/Uuid
       --tar-path/string
       --tester/Tester:
@@ -825,7 +822,7 @@ class TestDevicePipe extends TestDevice:
     command_ = ["bash", boot-sh]
     super
         --broker=broker
-        --alias-id=alias-id
+        --device-id=device-id
         --organization-id=organization-id
         --tester=tester
 
@@ -1179,7 +1176,7 @@ class TestFleet:
   */
   constructor --.id --.tester --.fleet-dir --.args --devices/List:
     devices.do: | device/FakeDevice |
-      this.devices[device.alias-id] = device
+      this.devices[device.device-id] = device
 
   close:
     devices.do: | _ device/TestDevice |
@@ -1211,7 +1208,7 @@ class TestFleet:
         --path=tar-file
 
     test-device := tester.create-device
-        --alias-id=device-id
+        --device-id=device-id
         --device-config=device-config
 
     tester.replacements["$device-id"] = pad-replacement-id name
@@ -1224,10 +1221,10 @@ class TestFleet:
     return test-device as TestDevicePipe
 
   listen-to-serial-device -> TestDevicePipe
-      --alias-id/Uuid
+      --device-id/Uuid
       --serial-port/string:
     return tester.listen-to-serial-device
-        --alias-id=alias-id
+        --device-id=device-id
         --serial-port=serial-port
 
   /**