@xenon-device-management/xenon 1.7.2 → 1.7.3

package/lib/src/generated/client/package.json

@@ -1,5 +1,5 @@
 {
-  "name": "prisma-client-f9160d8df2e4d6c96a662ee5e57fac84fdeae4219fe48275125ca22e998fe5fa",
+  "name": "prisma-client-6dbaaf845a8b748475630cfe8b405b0da9018b7231b8b50f3d7c7a681a0566d8",
   "main": "index.js",
   "types": "index.d.ts",
   "browser": "index-browser.js",

package/lib/src/generated/client/schema.prisma

@@ -437,3 +437,24 @@ model TeamMember {
   @@id([teamId, userId])
   @@index([userId])
 }
+
+model EventLog {
+  id            String   @id @default(cuid())
+  type          String
+  payload       String // JSON string — portable, no SQLite-isms
+  correlationId String?
+  teamId        String?
+  occurredAt    DateTime @default(now())
+
+  @@index([type, occurredAt])
+  @@index([occurredAt])
+}
+
+model Project {
+  id        String   @id @default(cuid())
+  name      String
+  teamId    String?
+  createdAt DateTime @default(now())
+
+  @@index([teamId])
+}

package/lib/src/generated/client/wasm.js

@@ -465,6 +465,22 @@ exports.Prisma.TeamMemberScalarFieldEnum = {
   createdAt: 'createdAt'
 };
 
+exports.Prisma.EventLogScalarFieldEnum = {
+  id: 'id',
+  type: 'type',
+  payload: 'payload',
+  correlationId: 'correlationId',
+  teamId: 'teamId',
+  occurredAt: 'occurredAt'
+};
+
+exports.Prisma.ProjectScalarFieldEnum = {
+  id: 'id',
+  name: 'name',
+  teamId: 'teamId',
+  createdAt: 'createdAt'
+};
+
 exports.Prisma.SortOrder = {
   asc: 'asc',
   desc: 'desc'
@@ -500,7 +516,9 @@ exports.Prisma.ModelName = {
   User: 'User',
   UserSession: 'UserSession',
   PasswordResetToken: 'PasswordResetToken',
-  TeamMember: 'TeamMember'
+  TeamMember: 'TeamMember',
+  EventLog: 'EventLog',
+  Project: 'Project'
 };
 
 /**

package/lib/src/middleware/authMiddleware.js

@@ -15,6 +15,8 @@ const typedi_1 = require("typedi");
 const ApiKeyService_1 = require("../services/ApiKeyService");
 const UserSessionService_1 = require("../services/UserSessionService");
 const UserService_1 = require("../services/UserService");
+const JwtKeyService_1 = require("../services/token/JwtKeyService");
+const StreamTicketService_1 = require("../services/token/StreamTicketService");
 const config_1 = require("../config");
 const prisma_1 = require("../prisma");
 const SESSION_COOKIE = 'xenon_dashboard_session';
@@ -70,7 +72,7 @@ function computeTeamIds(opts) {
 }
 function authMiddleware(req, res, next) {
     return __awaiter(this, void 0, void 0, function* () {
-        var _a, _b, _c, _d;
+        var _a, _b, _c, _d, _e, _f, _g, _h;
         if (config_1.config.authDisabled === true) {
             req.auth = {
                 kind: 'api-key',
@@ -114,6 +116,39 @@ function authMiddleware(req, res, next) {
             req.apiKey = { id: row.id, scopes: row.scopes, rateLimit: row.rateLimit, teamId: (_b = row.teamId) !== null && _b !== void 0 ? _b : null };
             return next();
         }
+        // Path 1.5: Authorization: Bearer <hub-issued JWT> (audience xenon-rest).
+        // Live user lookup on every request → revocation is instant on the REST
+        // surface even though the token itself is stateless (spec §7.1).
+        const authHeader = req.headers['authorization'];
+        if (typeof authHeader === 'string' && authHeader.startsWith('Bearer ')) {
+            try {
+                const payload = yield typedi_1.Container.get(JwtKeyService_1.JwtKeyService).verify(authHeader.slice(7), {
+                    audience: 'xenon-rest',
+                });
+                const user = yield userSvc.findById(String(payload.sub));
+                if (!user || user.status !== 'ACTIVE') {
+                    return res.status(401).json({ error: 'invalid token' });
+                }
+                const teamIds = yield computeTeamIds({
+                    role: user.role,
+                    userId: user.id,
+                    apiKeyTeamId: (_c = payload.teamId) !== null && _c !== void 0 ? _c : null,
+                });
+                req.auth = {
+                    kind: 'bearer',
+                    userId: user.id,
+                    role: user.role,
+                    scopes: String((_d = payload.scopes) !== null && _d !== void 0 ? _d : ''),
+                    teamId: (_e = payload.teamId) !== null && _e !== void 0 ? _e : null,
+                    rateLimit: 300,
+                    teamIds,
+                };
+                return next();
+            }
+            catch (_j) {
+                return res.status(401).json({ error: 'invalid token' });
+            }
+        }
         // Path 2: cookie — UserSession first, then ApiKey (legacy issuance path).
         // Both ids are UUIDv4; collision is astronomically unlikely (<1 in 2^128).
         // On collision, UserSession wins and we never look at the ApiKey branch.
@@ -174,15 +209,41 @@ function authMiddleware(req, res, next) {
                     userId: user.id,
                     role: user.role,
                     scopes: row.scopes,
-                    teamId: (_c = row.teamId) !== null && _c !== void 0 ? _c : null,
+                    teamId: (_f = row.teamId) !== null && _f !== void 0 ? _f : null,
                     apiKeyId: row.id,
                     rateLimit: row.rateLimit,
                     teamIds,
                 };
-                req.apiKey = { id: row.id, scopes: row.scopes, rateLimit: row.rateLimit, teamId: (_d = row.teamId) !== null && _d !== void 0 ? _d : null };
+                req.apiKey = { id: row.id, scopes: row.scopes, rateLimit: row.rateLimit, teamId: (_g = row.teamId) !== null && _g !== void 0 ? _g : null };
                 return next();
             }
         }
+        // Path 3: single-use stream ticket — ONLY for GET <control>/:udid/stream.
+        // req.path here is relative to apiRouter's own mount (authMiddleware is
+        // registered directly on apiRouter, before ControlRouter mounts '/control'
+        // onto it), so it is '/control/<udid>/stream' — not the full
+        // '/xenon/api/control/...' external URL. Verified against
+        // src/app/index.ts (apiRouter.use(authMiddleware) at line 223, then
+        // ControlRouter.register(apiRouter) -> parentRouter.use('/control', router)).
+        const ticket = (_h = req.query) === null || _h === void 0 ? void 0 : _h.ticket;
+        const streamMatch = req.method === 'GET' && /^\/control\/([^/]+)\/stream$/.exec(req.path);
+        if (typeof ticket === 'string' && streamMatch) {
+            try {
+                const { actorId } = yield typedi_1.Container.get(StreamTicketService_1.StreamTicketService).redeem(ticket, streamMatch[1]);
+                req.auth = {
+                    kind: 'stream-ticket',
+                    userId: actorId,
+                    role: 'MEMBER',
+                    scopes: 'read',
+                    rateLimit: 300,
+                    teamIds: undefined,
+                };
+                return next();
+            }
+            catch (_k) {
+                return res.status(401).json({ error: 'invalid ticket' });
+            }
+        }
         return res.status(401).json({ error: 'unauthenticated' });
     });
 }

package/lib/src/prisma.js

@@ -36,7 +36,7 @@ const MODEL_DELEGATES = new Set([
     'build', 'session', 'sessionLog', 'log', 'profiling', 'app', 'device',
     'pendingSession', 'cLIArgs', 'webhookConfig', 'webConfig', 'locatorEtalon',
     'lease', 'portLease', 'apiKey', 'selectorState', 'user', 'userSession',
-    'passwordResetToken', 'team', 'teamMember',
+    'passwordResetToken', 'team', 'teamMember', 'eventLog', 'project',
 ]);
 /** Cache of plain-object wrappers, keyed by model name. */
 const _modelWrappers = new Map();

package/lib/src/services/EventLogService.js

@@ -0,0 +1,81 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EventLogService = void 0;
+const typedi_1 = require("typedi");
+const prisma_service_1 = require("../data-service/prisma-service");
+const logger_1 = __importDefault(require("../logger"));
+/**
+ * Transactional-outbox seed (ARB foreclosure guard #1). Append-only log of
+ * every dashboard-visible domain event. Fire-and-forget by design: the
+ * broadcast hot path must gain zero latency and never fail because of the log.
+ */
+let EventLogService = class EventLogService {
+    constructor(prismaService) {
+        this.prismaService = prismaService;
+    }
+    appendSafe(entry) {
+        if (process.env.XENON_EVENT_LOG === 'off')
+            return;
+        setImmediate(() => {
+            var _a, _b, _c;
+            // Serialize defensively: a circular/unserializable payload must degrade
+            // to a placeholder, never throw. The throw would be uncaught here (it
+            // happens while building the .create() args, before the promise/.catch
+            // exists), and the global uncaughtException handler in src/index.ts would
+            // process.exit(1) — a single bad dashboard-event payload cannot be allowed
+            // to crash the whole plugin process.
+            let payloadStr;
+            try {
+                payloadStr = JSON.stringify((_a = entry.payload) !== null && _a !== void 0 ? _a : null);
+            }
+            catch (_d) {
+                payloadStr = JSON.stringify({ _unserializable: true, type: entry.type });
+            }
+            this.prismaService.client.eventLog
+                .create({
+                data: {
+                    type: entry.type,
+                    payload: payloadStr,
+                    correlationId: (_b = entry.correlationId) !== null && _b !== void 0 ? _b : null,
+                    teamId: (_c = entry.teamId) !== null && _c !== void 0 ? _c : null,
+                },
+            })
+                .catch((err) => logger_1.default.debug(`EventLog append failed (non-fatal): ${err === null || err === void 0 ? void 0 : err.message}`));
+        });
+    }
+    prune(retentionDays) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const cutoff = new Date(Date.now() - retentionDays * 24 * 60 * 60 * 1000);
+            const res = yield this.prismaService.client.eventLog.deleteMany({
+                where: { occurredAt: { lt: cutoff } },
+            });
+            return res.count;
+        });
+    }
+};
+exports.EventLogService = EventLogService;
+exports.EventLogService = EventLogService = __decorate([
+    (0, typedi_1.Service)(),
+    __metadata("design:paramtypes", [prisma_service_1.PrismaService])
+], EventLogService);

package/lib/src/services/ServerManager.js

@@ -55,6 +55,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.ServerManager = void 0;
 const typedi_1 = require("typedi");
 const os = __importStar(require("os"));
+const path = __importStar(require("path"));
 const OrphanSweeper_1 = require("./OrphanSweeper");
 const uuid_1 = require("uuid");
 const helpers_1 = require("../helpers");
@@ -79,6 +80,7 @@ const NodeDevices_1 = __importDefault(require("../device-managers/NodeDevices"))
 const config_1 = require("../config");
 const SocketServer_1 = require("./SocketServer");
 const SocketClient_1 = require("./SocketClient");
+const EventLogService_1 = require("./EventLogService");
 const TracingService_1 = require("./TracingService");
 const plugin_1 = require("../plugin");
 let ServerManager = ServerManager_1 = class ServerManager {
@@ -133,6 +135,17 @@ let ServerManager = ServerManager_1 = class ServerManager {
                     logger_1.default.warn(`LeaseOrphanSweeper tick failed: ${(_a = err === null || err === void 0 ? void 0 : err.message) !== null && _a !== void 0 ? _a : err}`);
                 });
             }, 30000);
+            // Daily EventLog prune (transactional-outbox seed): keeps the append-only
+            // log from growing unbounded. Fire-and-forget interval, unref'd so it
+            // never keeps the process alive on its own.
+            const eventLog = typedi_1.Container.get(EventLogService_1.EventLogService);
+            setInterval(() => {
+                const rawRet = Number(process.env.XENON_EVENT_LOG_RETENTION_DAYS);
+                const retentionDays = Number.isFinite(rawRet) && rawRet > 0 ? rawRet : 30;
+                eventLog
+                    .prune(retentionDays)
+                    .catch((err) => { var _a; return logger_1.default.warn(`EventLog prune failed: ${(_a = err === null || err === void 0 ? void 0 : err.message) !== null && _a !== void 0 ? _a : err}`); });
+            }, 24 * 60 * 60 * 1000).unref();
             // Cleanup any remaining zombie sessions (cross-node fallback)
             const { cleanupZombieSessions } = yield Promise.resolve().then(() => __importStar(require('../dashboard/services/session-service')));
             yield cleanupZombieSessions(recoveredSessionIds);
@@ -215,6 +228,29 @@ let ServerManager = ServerManager_1 = class ServerManager {
             yield bootstrapIdentity();
             const { startUserSessionCleanupCron } = yield Promise.resolve().then(() => __importStar(require('./identity/sessionCleanupCron')));
             startUserSessionCleanupCron();
+            // Hub-issued JWT signing key (REST/MCP tokens, stream tickets) — key
+            // material lives next to the SQLite db file so it survives restarts
+            // without a new DB migration. Must finish before /auth/token or
+            // /auth/jwks.json can be mounted (registerRoutes runs right after this).
+            // Non-disruptive by design: a key-material failure (permissions, disk
+            // full, corrupt PEM) only degrades the two token routes — sign()/verify()
+            // throw "not initialized" and jwks() serves an empty set — it must never
+            // abort server boot.
+            try {
+                const { JwtKeyService } = yield Promise.resolve().then(() => __importStar(require('./token/JwtKeyService')));
+                const jwtKeyDir = process.env.XENON_JWT_KEY_DIR || path.dirname(config_1.config.databasePath);
+                yield typedi_1.Container.get(JwtKeyService).init(jwtKeyDir);
+            }
+            catch (err) {
+                logger_1.default.error(`JWT key init failed — /auth/token and /auth/jwks.json will be unavailable: ${err === null || err === void 0 ? void 0 : err.message}`);
+            }
+            // ARB foreclosure guard #2: every recording/proof-bundle artifact path
+            // flows through ArtifactStore so an S3/object-store backend later is an
+            // implementation swap, not a call-site migration. FsArtifactStore is
+            // byte-identical to the legacy path.join(recordingsAssetsPath, ...)
+            // concatenation it replaces.
+            const { FsArtifactStore, ARTIFACT_STORE } = yield Promise.resolve().then(() => __importStar(require('./artifacts/ArtifactStore')));
+            typedi_1.Container.set(ARTIFACT_STORE, new FsArtifactStore(config_1.config.recordingsAssetsPath));
         });
     }
     registerRoutes(expressApp, cliArgs, pluginArgs) {

package/lib/src/services/SocketServer.js

@@ -26,6 +26,7 @@ const logger_1 = __importDefault(require("../logger"));
 const config_1 = require("../config");
 const ApiKeyService_1 = require("./ApiKeyService");
 const prisma_1 = require("../prisma");
+const EventLogService_1 = require("./EventLogService");
 const SocketEvents_1 = require("../enums/SocketEvents");
 const SESSION_COOKIE = 'xenon_dashboard_session';
 function readCookie(cookieHeader, name) {
@@ -169,6 +170,7 @@ let SocketServer = SocketServer_1 = class SocketServer {
         if (this.io) {
             this.io.to('dashboard').emit(event, data);
         }
+        typedi_1.Container.get(EventLogService_1.EventLogService).appendSafe({ type: event, payload: data });
     }
     emitToNodes(event, data) {
         if (this.io) {

package/lib/src/services/artifacts/ArtifactStore.js

@@ -0,0 +1,60 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ARTIFACT_STORE = exports.FsArtifactStore = void 0;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+class FsArtifactStore {
+    constructor(rootDir) {
+        this.rootDir = rootDir;
+    }
+    resolve(...segments) {
+        // Byte-identical to the legacy `path.join(config.recordingsAssetsPath, ...)`
+        // this replaced — including under a RELATIVE root (e.g. a relative
+        // XENON_RECORDINGS_ASSETS_PATH override): path.join stays relative,
+        // path.resolve would silently absolutize it. path.resolve is used ONLY
+        // to compute an absolute form for the traversal guard, never for the
+        // returned value.
+        const joined = path_1.default.join(this.rootDir, ...segments);
+        const absRoot = path_1.default.resolve(this.rootDir);
+        const abs = path_1.default.resolve(joined);
+        if (abs !== absRoot && !abs.startsWith(absRoot + path_1.default.sep)) {
+            throw new Error(`artifact path escapes store root: ${joined}`);
+        }
+        return joined;
+    }
+    ensureDir(...segments) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const dir = this.resolve(...segments);
+            yield fs_1.default.promises.mkdir(dir, { recursive: true });
+            return dir;
+        });
+    }
+    createReadStream(relPath) {
+        return fs_1.default.createReadStream(this.resolve(relPath));
+    }
+    exists(relPath) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                yield fs_1.default.promises.access(this.resolve(relPath));
+                return true;
+            }
+            catch (_a) {
+                return false;
+            }
+        });
+    }
+}
+exports.FsArtifactStore = FsArtifactStore;
+exports.ARTIFACT_STORE = 'artifact-store'; // TypeDI token

package/lib/src/services/recording/RecordingOrchestrator.js

@@ -57,11 +57,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.RecordingOrchestrator = exports.RecordingError = void 0;
 exports.compositeOutputPath = compositeOutputPath;
 const typedi_1 = require("typedi");
-const path = __importStar(require("path"));
 const fs = __importStar(require("fs"));
 const uuid_1 = require("uuid");
 const api_1 = require("@opentelemetry/api");
-const config_1 = require("../../config");
 const VideoPipelineService_1 = require("../VideoPipelineService");
 const event_manager_1 = require("../../dashboard/event-manager");
 const busy_precheck_1 = require("./busy-precheck");
@@ -72,6 +70,7 @@ const device_store_1 = require("../../data-service/device-store");
 const manualLock_1 = require("./manualLock");
 const attributes_1 = require("../telemetry/attributes");
 const logger_1 = __importDefault(require("../../logger"));
+const ArtifactStore_1 = require("../artifacts/ArtifactStore");
 const recLog = logger_1.default.scope('RecordingOrchestrator');
 // Lazy-init OTel instruments. Module-load order vs. TracingService init does
 // not matter — the OTel API returns Noop instruments until a real
@@ -111,7 +110,7 @@ function ensureOtelInstruments() {
  * stay clear of per-recording-id folders.
  */
 function compositeOutputPath(groupId) {
-    return path.join(config_1.config.recordingsAssetsPath, '_groups', groupId, 'composite.mp4');
+    return typedi_1.Container.get(ArtifactStore_1.ARTIFACT_STORE).resolve('_groups', groupId, 'composite.mp4');
 }
 class RecordingError extends Error {
     constructor(code, busyDevices, limit, active) {
@@ -242,7 +241,7 @@ let RecordingOrchestrator = class RecordingOrchestrator {
                 const id = recordingIds[i];
                 const udid = udids[i];
                 const host = deviceHosts[udid];
-                const filePath = path.join(config_1.config.recordingsAssetsPath, id, 'video', `${id}.mp4`);
+                const filePath = typedi_1.Container.get(ArtifactStore_1.ARTIFACT_STORE).resolve(id, 'video', `${id}.mp4`);
                 try {
                     yield this.store.create({
                         groupId,
@@ -524,7 +523,7 @@ let RecordingOrchestrator = class RecordingOrchestrator {
                 this.gate.release(recordingId);
                 throw new RecordingError('device_busy', [{ udid, reason: 'unknown' }]);
             }
-            const filePath = path.join(config_1.config.recordingsAssetsPath, recordingId, 'video', `${recordingId}.mp4`);
+            const filePath = typedi_1.Container.get(ArtifactStore_1.ARTIFACT_STORE).resolve(recordingId, 'video', `${recordingId}.mp4`);
             try {
                 yield this.store.create({
                     groupId,

package/lib/src/services/token/JwtKeyService.js

@@ -0,0 +1,137 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.JwtKeyService = void 0;
+const typedi_1 = require("typedi");
+const jose = __importStar(require("jose"));
+const crypto_1 = require("crypto");
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const KEY_FILE = 'xenon-jwt-private.pem';
+const ISSUER = process.env.XENON_JWT_ISSUER || 'xenon-hub';
+/**
+ * RS256 signing key for hub-issued JWTs (REST/MCP tokens, stream tickets).
+ * Key material lives on disk (0600), never in the database. `kid` is derived
+ * from the public key so it is stable across restarts; rotation = drop a new
+ * PEM in place, old tokens fail verification (acceptable: TTLs are short).
+ */
+let JwtKeyService = class JwtKeyService {
+    constructor() {
+        // Boot degrades gracefully if key material is unavailable (bad perms, full
+        // disk, corrupt PEM): the server still comes up, and only the token routes
+        // fail. sign()/verify() throw a clear error; jwks() serves an empty set.
+        this.initialized = false;
+    }
+    init(keyDir) {
+        return __awaiter(this, void 0, void 0, function* () {
+            fs_1.default.mkdirSync(keyDir, { recursive: true });
+            const keyPath = path_1.default.join(keyDir, KEY_FILE);
+            let pkcs8;
+            if (fs_1.default.existsSync(keyPath)) {
+                pkcs8 = fs_1.default.readFileSync(keyPath, 'utf8');
+            }
+            else {
+                const { privateKey } = yield jose.generateKeyPair('RS256', { extractable: true });
+                pkcs8 = yield jose.exportPKCS8(privateKey);
+                fs_1.default.writeFileSync(keyPath, pkcs8, { mode: 0o600 });
+            }
+            this.privateKey = yield jose.importPKCS8(pkcs8, 'RS256');
+            // Public JWK derived from the private key; strip private fields.
+            const fullJwk = yield jose.exportJWK(this.privateKey);
+            this.publicJwk = { kty: fullJwk.kty, n: fullJwk.n, e: fullJwk.e };
+            this.publicKey = yield jose.importJWK(Object.assign(Object.assign({}, this.publicJwk), { alg: 'RS256' }), 'RS256');
+            this.kid = (0, crypto_1.createHash)('sha256')
+                .update(`${fullJwk.n}.${fullJwk.e}`)
+                .digest('base64url')
+                .slice(0, 16);
+            this.initialized = true;
+        });
+    }
+    sign(claims, opts) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!this.initialized)
+                throw new Error('JWT key service not initialized');
+            const jwt = new jose.SignJWT(claims)
+                .setProtectedHeader({ alg: 'RS256', kid: this.kid })
+                .setIssuer(ISSUER)
+                .setAudience(opts.audience)
+                .setIssuedAt()
+                .setExpirationTime(Math.floor(Date.now() / 1000) + opts.ttlSeconds);
+            if (opts.jti)
+                jwt.setJti(opts.jti);
+            return jwt.sign(this.privateKey);
+        });
+    }
+    verify(token, opts) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!this.initialized)
+                throw new Error('JWT key service not initialized');
+            const { payload } = yield jose.jwtVerify(token, this.publicKey, {
+                issuer: ISSUER,
+                audience: opts.audience,
+                clockTolerance: 60, // spec §7.1: ±60 s skew, mirrors appium-mcp-auth
+            });
+            return payload;
+        });
+    }
+    jwks() {
+        // Empty JWKS when uninitialized — valid JSON, honest about having no keys.
+        if (!this.initialized)
+            return { keys: [] };
+        return { keys: [Object.assign(Object.assign({}, this.publicJwk), { kid: this.kid, use: 'sig', alg: 'RS256' })] };
+    }
+};
+exports.JwtKeyService = JwtKeyService;
+exports.JwtKeyService = JwtKeyService = __decorate([
+    (0, typedi_1.Service)()
+], JwtKeyService);

package/lib/src/services/token/StreamTicketService.js

@@ -0,0 +1,61 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StreamTicketService = void 0;
+const typedi_1 = require("typedi");
+const crypto_1 = require("crypto");
+const JwtKeyService_1 = require("./JwtKeyService");
+const TICKET_TTL_SEC = 60;
+/** Single-use, udid-bound, 60 s tokens for the webview <img> MJPEG path. */
+let StreamTicketService = class StreamTicketService {
+    constructor() {
+        // jti -> expiry epoch-ms. Pruned on each redeem; bounded by 60 s TTL.
+        this.used = new Map();
+    }
+    mint(udid, actorId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return typedi_1.Container.get(JwtKeyService_1.JwtKeyService).sign({ udid, actorId }, { audience: 'xenon-stream', ttlSeconds: TICKET_TTL_SEC, jti: (0, crypto_1.randomUUID)() });
+        });
+    }
+    redeem(ticket, udid) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const payload = yield typedi_1.Container.get(JwtKeyService_1.JwtKeyService).verify(ticket, { audience: 'xenon-stream' });
+            if (payload.udid !== udid)
+                throw new Error('ticket udid mismatch');
+            const jti = String(payload.jti);
+            const now = Date.now();
+            for (const [k, exp] of this.used)
+                if (exp < now)
+                    this.used.delete(k);
+            if (this.used.has(jti))
+                throw new Error('ticket already used');
+            // Evict the anti-replay entry only once the JWT itself is genuinely
+            // unverifiable. JwtKeyService.verify() honors clockTolerance:60, so the
+            // token stays acceptable until exp + 60s. Keying eviction off redeem-time
+            // + TTL (mint..mint+60) would drop the jti at mint+60 while verify() still
+            // accepts a replay up to mint+120 — a ~60s single-use bypass. Key off the
+            // token's own exp claim plus the same tolerance so memory outlives it.
+            const evictAt = (typeof payload.exp === 'number' ? payload.exp * 1000 : now + TICKET_TTL_SEC * 1000) + 60000; // token exp + clockTolerance (mirrors JwtKeyService.verify)
+            this.used.set(jti, evictAt);
+            return { actorId: String(payload.actorId) };
+        });
+    }
+};
+exports.StreamTicketService = StreamTicketService;
+exports.StreamTicketService = StreamTicketService = __decorate([
+    (0, typedi_1.Service)()
+], StreamTicketService);