@xenon-device-management/xenon 1.2.0 → 1.3.0

package/lib/src/services/ShutdownCoordinator.js

@@ -0,0 +1,89 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ShutdownCoordinator = void 0;
+const typedi_1 = require("typedi");
+const logger_1 = __importDefault(require("../logger"));
+const SessionManager_1 = require("../sessions/SessionManager");
+const SessionLifecycleService_1 = require("./SessionLifecycleService");
+// Graceful shutdown phase that runs BEFORE the existing infrastructure
+// teardown in index.ts:cleanup(). Active sessions get a bounded chance to
+// archive their video + release ports + mark themselves failed, so we don't
+// leak a half-recorded session and a permanently-busy device every time the
+// hub is redeployed.
+//
+// Bounded by two timeouts:
+//   - per-session: a single hung driver can't block the rest from finishing
+//   - overall: if the fleet is very large, the shutdown still exits in time
+//     for init systems (systemd defaults to 90s before SIGKILL)
+let ShutdownCoordinator = class ShutdownCoordinator {
+    constructor() {
+        this.draining = false;
+        this.logger = logger_1.default.scope('Shutdown');
+    }
+    get isDraining() {
+        return this.draining;
+    }
+    drain(timeoutMs_1) {
+        return __awaiter(this, arguments, void 0, function* (timeoutMs, perSessionTimeoutMs = 10000) {
+            if (this.draining) {
+                this.logger.warn('drain() called while already draining; ignoring');
+                return { attempted: 0, completed: 0 };
+            }
+            this.draining = true;
+            const sessions = SessionManager_1.SESSION_MANAGER.getAllSessions();
+            if (sessions.length === 0) {
+                this.logger.info('No active sessions to drain');
+                return { attempted: 0, completed: 0 };
+            }
+            this.logger.info(`Draining ${sessions.length} active session(s) (overall=${timeoutMs}ms, per-session=${perSessionTimeoutMs}ms)`);
+            const lifecycle = typedi_1.Container.get(SessionLifecycleService_1.SessionLifecycleService);
+            const deadline = Date.now() + timeoutMs;
+            const tasks = sessions.map((session) => __awaiter(this, void 0, void 0, function* () {
+                const id = session.getId();
+                const remaining = Math.max(0, deadline - Date.now());
+                const budget = Math.min(perSessionTimeoutMs, remaining);
+                if (budget <= 0) {
+                    this.logger.warn(`[shutdown] No budget left for session ${id}; skipping`);
+                    return false;
+                }
+                try {
+                    yield Promise.race([
+                        lifecycle.stopSessionForShutdown(id, 'Hub shutdown'),
+                        new Promise((_, reject) => setTimeout(() => reject(new Error('per-session drain timeout')), budget)),
+                    ]);
+                    return true;
+                }
+                catch (err) {
+                    this.logger.warn(`[shutdown] Failed to drain session ${id}: ${err.message}`);
+                    return false;
+                }
+            }));
+            const results = yield Promise.allSettled(tasks);
+            const completed = results.filter((r) => r.status === 'fulfilled' && r.value).length;
+            this.logger.info(`Drain complete: ${completed}/${sessions.length} session(s) finalized`);
+            return { attempted: sessions.length, completed };
+        });
+    }
+};
+exports.ShutdownCoordinator = ShutdownCoordinator;
+exports.ShutdownCoordinator = ShutdownCoordinator = __decorate([
+    (0, typedi_1.Service)()
+], ShutdownCoordinator);

package/lib/src/services/SocketClient.js

@@ -13,6 +13,7 @@ exports.SocketClient = void 0;
 const socket_io_client_1 = require("socket.io-client");
 const typedi_1 = require("typedi");
 const logger_1 = __importDefault(require("../logger"));
+const config_1 = require("../config");
 const SocketEvents_1 = require("../enums/SocketEvents");
 let SocketClient = class SocketClient {
     constructor() {
@@ -26,11 +27,21 @@ let SocketClient = class SocketClient {
         // Remove wd/hub if present in hubUrl
         const normalizedHubUrl = hubUrl.replace(/\/wd\/hub$/, '');
         logger_1.default.info(`[SocketClient] Connecting to Hub WebSocket: ${normalizedHubUrl}`);
+        // Hub now authenticates every socket handshake. Nodes present the same
+        // shared secret they already use for REST calls; without it the hub will
+        // reject the handshake with "unauthorized". auth-disabled mode on the hub
+        // (XENON_AUTH_DISABLED=true) ignores this field, so it's safe to send
+        // unconditionally.
+        const nodeSecret = config_1.config.nodeSecret;
+        if (!nodeSecret) {
+            logger_1.default.warn('[SocketClient] XENON_NODE_SECRET not set; hub will reject the handshake unless it also has auth disabled.');
+        }
         this.socket = (0, socket_io_client_1.io)(normalizedHubUrl, {
             reconnection: true,
             reconnectionAttempts: Infinity,
             reconnectionDelay: 1000,
             reconnectionDelayMax: 5000,
+            auth: nodeSecret ? { nodeSecret } : undefined,
         });
         this.socket.on('connect', () => {
             var _a, _b, _c;

package/lib/src/services/SocketServer.js

@@ -5,31 +5,74 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
     else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
+var SocketServer_1;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SocketServer = void 0;
 const socket_io_1 = require("socket.io");
 const typedi_1 = require("typedi");
 const logger_1 = __importDefault(require("../logger"));
+const config_1 = require("../config");
+const ApiKeyService_1 = require("./ApiKeyService");
+const nodeSecret_1 = require("../auth/nodeSecret");
 const SocketEvents_1 = require("../enums/SocketEvents");
-let SocketServer = class SocketServer {
+const SESSION_COOKIE = 'xenon_dashboard_session';
+function readCookie(cookieHeader, name) {
+    if (!cookieHeader)
+        return undefined;
+    for (const part of cookieHeader.split(';')) {
+        const eq = part.indexOf('=');
+        if (eq < 0)
+            continue;
+        if (part.slice(0, eq).trim() === name) {
+            return decodeURIComponent(part.slice(eq + 1).trim());
+        }
+    }
+    return undefined;
+}
+let SocketServer = SocketServer_1 = class SocketServer {
     constructor() {
         this.io = null;
         this.nodes = new Map(); // socketId -> nodeHost
     }
     initialize(server) {
         this.io = new socket_io_1.Server(server, {
+            // Same-origin only. Browsers on a different origin are blocked at the
+            // handshake; server-to-server node connections send no Origin header
+            // and are unaffected. Matches the apiRouter cors({origin:false}) policy.
             cors: {
-                origin: '*',
+                origin: false,
                 methods: ['GET', 'POST'],
             },
         });
+        this.io.use((socket, next) => __awaiter(this, void 0, void 0, function* () {
+            try {
+                const principal = yield this.authenticate(socket);
+                socket.data.principal = principal;
+                next();
+            }
+            catch (err) {
+                logger_1.default.warn(`[SocketServer] Handshake rejected for ${socket.id}: ${err.message}`);
+                next(new Error('unauthorized'));
+            }
+        }));
         this.io.on('connection', (socket) => {
             const socketId = socket.id;
-            logger_1.default.info(`[SocketServer] New connection attempt: ${socketId}`);
-            // 1. Mandatory Handshake for Protocol Sync
+            const principal = socket.data.principal;
+            logger_1.default.info(`[SocketServer] New connection: ${socketId} (principal=${principal})`);
+            // Protocol version handshake — still runs after auth so a logged-in
+            // client on the wrong protocol version still gets a clean disconnect.
             socket.on(SocketEvents_1.SocketEvents.HANDSHAKE, (data) => {
                 const { version, host } = data;
                 if (version !== SocketEvents_1.XENON_PROTOCOL_VERSION) {
@@ -40,6 +83,11 @@ let SocketServer = class SocketServer {
                 logger_1.default.info(`[SocketServer] Handshake successful with client ${host || socketId} (v${version})`);
             });
             socket.on(SocketEvents_1.SocketEvents.REGISTER_NODE, (data) => {
+                if (!SocketServer_1.canRegisterAs(principal, 'node')) {
+                    logger_1.default.warn(`[SocketServer] Rejected REGISTER_NODE from principal=${principal} on ${socketId}`);
+                    socket.disconnect();
+                    return;
+                }
                 const { host } = data;
                 this.nodes.set(socketId, host);
                 logger_1.default.info(`[SocketServer] Node registered: ${host} (Socket: ${socketId})`);
@@ -48,6 +96,11 @@ let SocketServer = class SocketServer {
                 this.emitToDashboard(SocketEvents_1.SocketEvents.NODE_CONNECTED, { host });
             });
             socket.on(SocketEvents_1.SocketEvents.REGISTER_DASHBOARD, () => {
+                if (!SocketServer_1.canRegisterAs(principal, 'dashboard')) {
+                    logger_1.default.warn(`[SocketServer] Rejected REGISTER_DASHBOARD from principal=${principal} on ${socketId}`);
+                    socket.disconnect();
+                    return;
+                }
                 logger_1.default.info(`[SocketServer] Dashboard client registered (Socket: ${socketId})`);
                 socket.join('dashboard');
             });
@@ -63,7 +116,57 @@ let SocketServer = class SocketServer {
                 }
             });
         });
-        logger_1.default.info('[SocketServer] WebSocket server initialized');
+        logger_1.default.info('[SocketServer] WebSocket server initialized (auth enabled)');
+    }
+    // Role-based registration guard. A dashboard-authed socket can't join the
+    // 'nodes' broadcast room and a node-authed socket can't subscribe to
+    // dashboard events — keeps a stolen credential of one class from acting
+    // as the other. auth-disabled mode trusts the caller for parity with REST.
+    static canRegisterAs(principal, role) {
+        if (principal === 'auth-disabled')
+            return true;
+        return principal === role;
+    }
+    authenticate(socket) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b;
+            if (config_1.config.authDisabled === true)
+                return 'auth-disabled';
+            const auth = (socket.handshake.auth || {});
+            const headers = socket.handshake.headers || {};
+            // Node path: shared secret. Checked first because nodes never have a
+            // dashboard cookie, so we avoid a pointless ApiKeyService lookup. Accepts
+            // either the current or (during rotation overlap) the previous secret —
+            // validateNodeSecret logs a warn for the previous-match case.
+            const nodeSecret = (typeof auth.nodeSecret === 'string' && auth.nodeSecret) ||
+                ((_a = headers['x-xenon-node-secret']) !== null && _a !== void 0 ? _a : '');
+            if (nodeSecret) {
+                if (!config_1.config.nodeSecret && !config_1.config.nodeSecretPrevious) {
+                    throw new Error('node secret presented but server has none configured');
+                }
+                const outcome = (0, nodeSecret_1.validateNodeSecret)(nodeSecret, {
+                    current: config_1.config.nodeSecret,
+                    previous: config_1.config.nodeSecretPrevious,
+                });
+                if (outcome === 'reject') {
+                    throw new Error('invalid node secret');
+                }
+                return 'node';
+            }
+            // Dashboard path: API key header, or session cookie set by /auth/login.
+            const apiKeyRaw = (typeof auth.apiKey === 'string' && auth.apiKey) ||
+                ((_b = headers['x-xenon-api-key']) !== null && _b !== void 0 ? _b : '') ||
+                readCookie(headers.cookie, SESSION_COOKIE) ||
+                '';
+            if (!apiKeyRaw) {
+                throw new Error('missing credentials (need nodeSecret, apiKey, or dashboard cookie)');
+            }
+            const row = yield typedi_1.Container.get(ApiKeyService_1.ApiKeyService).verify(apiKeyRaw);
+            if (!row) {
+                throw new Error('invalid or revoked API key');
+            }
+            return 'dashboard';
+        });
     }
     emitToDashboard(event, data) {
         if (this.io) {
@@ -82,6 +185,6 @@ let SocketServer = class SocketServer {
     }
 };
 exports.SocketServer = SocketServer;
-exports.SocketServer = SocketServer = __decorate([
+exports.SocketServer = SocketServer = SocketServer_1 = __decorate([
     (0, typedi_1.Service)()
 ], SocketServer);

package/lib/src/services/VideoPipelineService.js

@@ -56,6 +56,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.VideoPipelineService = void 0;
 const typedi_1 = require("typedi");
+const ProcessRegistry_1 = require("./ProcessRegistry");
 const child_process_1 = require("child_process");
 const logger_1 = __importDefault(require("../logger"));
 const path_1 = __importDefault(require("path"));
@@ -154,6 +155,7 @@ let VideoPipelineService = class VideoPipelineService {
             const ffmpegProc = (0, child_process_1.spawn)(command, wrappedArgs, {
                 stdio: ['ignore', 'ignore', 'pipe'], // Only capture stderr for errors
             });
+            typedi_1.Container.get(ProcessRegistry_1.ProcessRegistry).track({ kind: 'ffmpeg', sessionId, udid, process: ffmpegProc });
             (_a = ffmpegProc.stderr) === null || _a === void 0 ? void 0 : _a.on('data', (data) => {
                 const msg = data.toString();
                 if (msg.toLowerCase().includes('error')) {

package/lib/src/services/healing/HealingMetrics.js

@@ -0,0 +1,63 @@
+"use strict";
+// In-process counters for healing tier outcomes. Deliberately in-memory:
+// existing DB-backed counters (MetricsService.incrementHealing*) cover
+// session-lifetime totals, but tier-level data ticks on every findElement
+// failure — writing that through SQLite would thrash the DB. Prom scrapes
+// pull the current values; restarts reset counters, which matches Prom's
+// standard reset-semantics anyway.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HEALING_METRICS = void 0;
+class HealingMetricsRegistry {
+    constructor() {
+        // Key: `${tier}:${name}` so the same tier number with a renamed provider
+        // lands in a separate bucket instead of silently merging.
+        this.buckets = new Map();
+        this.skipBuckets = new Map();
+        this.allTiersFailedCount = 0;
+    }
+    record(tier, name, outcome, durationMs) {
+        const key = `${tier}:${name}`;
+        let bucket = this.buckets.get(key);
+        if (!bucket) {
+            bucket = { attempts: 0, successes: 0, failures: 0, durationMsSum: 0 };
+            this.buckets.set(key, bucket);
+        }
+        bucket.attempts++;
+        bucket.durationMsSum += durationMs;
+        if (outcome === 'success')
+            bucket.successes++;
+        else
+            bucket.failures++;
+    }
+    recordAllTiersFailed() {
+        this.allTiersFailedCount++;
+    }
+    recordSkippedRemaining(tier, name) {
+        const key = `${tier}:${name}`;
+        let bucket = this.skipBuckets.get(key);
+        if (!bucket) {
+            bucket = { tier, name, count: 0 };
+            this.skipBuckets.set(key, bucket);
+        }
+        bucket.count++;
+    }
+    skipSnapshot() {
+        return Array.from(this.skipBuckets.values()).sort((a, b) => a.tier - b.tier || a.name.localeCompare(b.name));
+    }
+    snapshot() {
+        const out = [];
+        for (const [key, bucket] of this.buckets) {
+            const sep = key.indexOf(':');
+            const tier = Number(key.slice(0, sep));
+            const name = key.slice(sep + 1);
+            out.push(Object.assign({ tier, name }, bucket));
+        }
+        // Stable order by tier then name — makes the /metrics output deterministic
+        // so alert rules and grafana variables don't see label reshuffling.
+        return out.sort((a, b) => a.tier - b.tier || a.name.localeCompare(b.name));
+    }
+    getAllTiersFailedCount() {
+        return this.allTiersFailedCount;
+    }
+}
+exports.HEALING_METRICS = new HealingMetricsRegistry();

package/lib/src/services/healing/HealingOrchestrator.js

@@ -63,6 +63,7 @@ const VisualAiHealingProvider_1 = require("./VisualAiHealingProvider");
 const LlmHealingProvider_1 = require("./LlmHealingProvider");
 const HealEtalonService_1 = require("./HealEtalonService");
 const ResilioTreeHealingProvider_1 = require("./ResilioTreeHealingProvider");
+const HealingMetrics_1 = require("./HealingMetrics");
 let HealingOrchestrator = class HealingOrchestrator {
     constructor(etalonService) {
         this.etalonService = etalonService;
@@ -78,6 +79,7 @@ let HealingOrchestrator = class HealingOrchestrator {
     }
     attemptHealing(sessionId, driver, strategy, selector) {
         return __awaiter(this, void 0, void 0, function* () {
+            var _a;
             this.logger.info(`🚨 Self-Healing triggered for session ${sessionId}. Broken locator: ${strategy}=${selector}`);
             // Preparation: Collect data required for healing
             // Note: We do this once to avoid multiple expensive round-trips
@@ -94,14 +96,19 @@ let HealingOrchestrator = class HealingOrchestrator {
             }
             // Tiered Execution: Try providers in order of cost/complexity
             for (const provider of this.providers) {
+                const tierStart = Date.now();
                 try {
                     this.logger.info(`Attempting Tier ${provider.tier}: ${provider.name}...`);
                     const result = yield provider.heal(context);
+                    HealingMetrics_1.HEALING_METRICS.record(provider.tier, provider.name, result ? 'success' : 'failure', Date.now() - tierStart);
                     if (result) {
                         this.logger.info(`✨ Provider ${provider.name} found a match! Confidence: ${(result.confidence * 100).toFixed(0)}%`);
                         // Tier 1/2 Optimization: Stability Verification Loop
                         // We try all candidates to see which one is the most stable (semantic vs absolute)
+                        let stabilityAttempted = false;
+                        let stabilityVerified = false;
                         if (result.candidateSelectors && result.candidateSelectors.length > 0) {
+                            stabilityAttempted = true;
                             this.logger.debug(`Verifying ${result.candidateSelectors.length} candidate locators for stability...`);
                             for (const candidate of result.candidateSelectors) {
                                 try {
@@ -109,6 +116,7 @@ let HealingOrchestrator = class HealingOrchestrator {
                                     if (elements.length === 1) {
                                         this.logger.info(`🎯 Verified stable & unique locator: ${candidate}`);
                                         result.recommendedSelector = candidate;
+                                        stabilityVerified = true;
                                         break; // Found a unique stable locator
                                     }
                                     else if (elements.length > 1) {
@@ -120,9 +128,16 @@ let HealingOrchestrator = class HealingOrchestrator {
                                 }
                             }
                         }
-                        // Principal Learning: Autonomously update the etalon to prevent future failures
-                        // We only do this if confidence is over 70% to avoid pollution with false positives
-                        if (result.confidence > 0.7 && result.node) {
+                        // Principal Learning: Autonomously update the etalon to prevent future failures.
+                        // Gate on stability: if the provider emitted candidate selectors but none of them
+                        // resolved to a unique element, the structural guess was wrong and we must not
+                        // persist it — that's how lucky LLM/fuzzy-XML guesses poison future sessions.
+                        // Providers that emit no candidates (OCR/Visual) can't be verified this way, so
+                        // they still learn on confidence alone.
+                        if (stabilityAttempted && !stabilityVerified) {
+                            this.logger.warn(`Skipping etalon save for ${selector}: ${result.candidateSelectors.length} candidate locator(s) attempted, none verified unique (provider=${provider.name}, confidence=${result.confidence})`);
+                        }
+                        else if (result.confidence > 0.7 && result.node) {
                             try {
                                 this.logger.info(`🧠 Learning from healing success: updating etalon for ${selector}`);
                                 // Recalculate path for ResilioTree if node is available
@@ -143,16 +158,29 @@ let HealingOrchestrator = class HealingOrchestrator {
                                 yield this.etalonService.saveSignature(strategy, selector, result.node, learnedPath);
                             }
                             catch (learnErr) {
-                                this.logger.debug(`Failed to update etalon after healing: ${learnErr.message}`);
+                                // Warn (not debug) so the loss of learning shows up in default logs —
+                                // a silent failure here means the same selector keeps needing the LLM tier.
+                                this.logger.warn(`Etalon save failed after healing [strategy=${strategy}, selector=${selector}, confidence=${result.confidence}]: ${learnErr.message}`);
                             }
                         }
                         return result;
                     }
                 }
                 catch (err) {
+                    HealingMetrics_1.HEALING_METRICS.record(provider.tier, provider.name, 'failure', Date.now() - tierStart);
                     this.logger.error(`Provider ${provider.name} failed: ${err.message}`);
                 }
+                // Provider-driven short-circuit: a tier can advise that no downstream
+                // tier can plausibly succeed (e.g. missing prerequisites that all
+                // share). Saves an expensive LLM round-trip when upstream context
+                // collection failed.
+                if ((_a = provider.shouldSkipRemaining) === null || _a === void 0 ? void 0 : _a.call(provider, context)) {
+                    this.logger.warn(`Tier ${provider.tier} (${provider.name}) advised skipping remaining tiers for selector=${selector}`);
+                    HealingMetrics_1.HEALING_METRICS.recordSkippedRemaining(provider.tier, provider.name);
+                    break;
+                }
             }
+            HealingMetrics_1.HEALING_METRICS.recordAllTiersFailed();
             this.logger.warn(`❌ All healing tiers failed for selector: ${selector}`);
             return null;
         });

package/lib/src/services/healing/OcrHealingProvider.js

@@ -22,6 +22,13 @@ class OcrHealingProvider {
         this.tier = types_1.HealingTier.TIER_3_LOCAL_OCR;
         this.logger = logger_1.default.scope('OcrHealing');
     }
+    // Visual AI (tier 4) also needs a screenshot, and LLM (tier 5) needs a
+    // pageSource. If the context has neither, the remaining tiers can't do
+    // better than we did, so tell the orchestrator to give up — saves an
+    // LLM round-trip when context collection actually failed upstream.
+    shouldSkipRemaining(context) {
+        return !context.screenshotBase64 && !context.pageSource;
+    }
     heal(context) {
         return __awaiter(this, void 0, void 0, function* () {
             if (!context.screenshotBase64) {

package/lib/test/unit/ApiKeyService.test.js

@@ -0,0 +1,101 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const chai_1 = require("chai");
+const sinon_1 = __importDefault(require("sinon"));
+const ApiKeyService_1 = require("../../src/services/ApiKeyService");
+const prisma_1 = require("../../src/prisma");
+const fs_1 = __importDefault(require("fs"));
+describe('ApiKeyService', () => {
+    afterEach(() => sinon_1.default.restore());
+    it('creates a bootstrap key when the table is empty', () => __awaiter(void 0, void 0, void 0, function* () {
+        sinon_1.default.stub(prisma_1.prisma.apiKey, 'count').resolves(0);
+        const create = sinon_1.default.stub(prisma_1.prisma.apiKey, 'create').resolves({});
+        const writeStub = sinon_1.default.stub(fs_1.default, 'writeFileSync');
+        sinon_1.default.stub(fs_1.default, 'mkdirSync');
+        const svc = new ApiKeyService_1.ApiKeyService();
+        const key = yield svc.bootstrapIfEmpty('/tmp/test-bootstrap.txt');
+        (0, chai_1.expect)(key).to.be.a('string').with.lengthOf(64);
+        (0, chai_1.expect)(create.calledOnce).to.be.true;
+        (0, chai_1.expect)(create.firstCall.args[0].data.scopes).to.equal('admin');
+        (0, chai_1.expect)(writeStub.calledOnce).to.be.true;
+        (0, chai_1.expect)(writeStub.firstCall.args[0]).to.equal('/tmp/test-bootstrap.txt');
+    }));
+    it('returns null when keys already exist', () => __awaiter(void 0, void 0, void 0, function* () {
+        sinon_1.default.stub(prisma_1.prisma.apiKey, 'count').resolves(1);
+        const svc = new ApiKeyService_1.ApiKeyService();
+        const key = yield svc.bootstrapIfEmpty('/tmp/test-bootstrap.txt');
+        (0, chai_1.expect)(key).to.be.null;
+    }));
+    it('verify returns the key row for a valid raw key', () => __awaiter(void 0, void 0, void 0, function* () {
+        const raw = 'a'.repeat(64);
+        const hash = (yield Promise.resolve().then(() => __importStar(require('crypto'))))
+            .createHash('sha256')
+            .update(raw)
+            .digest('hex');
+        sinon_1.default
+            .stub(prisma_1.prisma.apiKey, 'findUnique')
+            .resolves({ id: 'k1', keyHash: hash, scopes: 'read', rateLimit: 300, revokedAt: null });
+        sinon_1.default.stub(prisma_1.prisma.apiKey, 'update').resolves({});
+        const svc = new ApiKeyService_1.ApiKeyService();
+        const row = yield svc.verify(raw);
+        (0, chai_1.expect)(row === null || row === void 0 ? void 0 : row.id).to.equal('k1');
+    }));
+    it('verify rejects revoked keys', () => __awaiter(void 0, void 0, void 0, function* () {
+        const raw = 'a'.repeat(64);
+        const hash = (yield Promise.resolve().then(() => __importStar(require('crypto'))))
+            .createHash('sha256')
+            .update(raw)
+            .digest('hex');
+        sinon_1.default
+            .stub(prisma_1.prisma.apiKey, 'findUnique')
+            .resolves({ id: 'k1', keyHash: hash, scopes: 'read', rateLimit: 300, revokedAt: new Date() });
+        const svc = new ApiKeyService_1.ApiKeyService();
+        const row = yield svc.verify(raw);
+        (0, chai_1.expect)(row).to.be.null;
+    }));
+});

package/lib/test/unit/PortAllocator.test.js

@@ -24,13 +24,17 @@ function makeAllocator(overrides) {
 describe('PortAllocator', () => {
     let createStub;
     let findManyStub;
+    let findFirstStub;
     let deleteManyStub;
     let deleteStub;
+    let updateStub;
     beforeEach(() => {
         createStub = sinon_1.default.stub(prisma_1.prisma.portLease, 'create');
         findManyStub = sinon_1.default.stub(prisma_1.prisma.portLease, 'findMany').resolves([]);
+        findFirstStub = sinon_1.default.stub(prisma_1.prisma.portLease, 'findFirst').resolves(null);
         deleteManyStub = sinon_1.default.stub(prisma_1.prisma.portLease, 'deleteMany').resolves({ count: 0 });
         deleteStub = sinon_1.default.stub(prisma_1.prisma.portLease, 'delete').resolves({});
+        updateStub = sinon_1.default.stub(prisma_1.prisma.portLease, 'update').resolves({});
     });
     afterEach(() => sinon_1.default.restore());
     it('allocates first free port in the configured range', () => __awaiter(void 0, void 0, void 0, function* () {
@@ -66,6 +70,16 @@ describe('PortAllocator', () => {
             (0, chai_1.expect)(err.message).to.match(/wda/);
         }
     }));
+    it('reuses an existing lease when the same (purpose, udid) acquires again', () => __awaiter(void 0, void 0, void 0, function* () {
+        findFirstStub.resolves({ port: 8101 });
+        const allocator = makeAllocator({ wda: [8100, 8102] });
+        allocator.isOsFree = () => __awaiter(void 0, void 0, void 0, function* () { return true; });
+        const port = yield allocator.acquire('wda', 'udid-1');
+        (0, chai_1.expect)(port).to.equal(8101);
+        (0, chai_1.expect)(createStub.called, 'should not create a new lease').to.be.false;
+        (0, chai_1.expect)(updateStub.calledOnce, 'should refresh the existing lease').to.be.true;
+        (0, chai_1.expect)(updateStub.firstCall.args[0].where.port).to.equal(8101);
+    }));
     it('releaseForUdid deletes all leases for that UDID', () => __awaiter(void 0, void 0, void 0, function* () {
         deleteManyStub.resolves({ count: 2 });
         const allocator = makeAllocator({ wda: [8100, 8102] });