@xenon-device-management/xenon 1.7.2 → 1.7.4

package/lib/src/generated/client/package.json

@@ -1,5 +1,5 @@
 {
-  "name": "prisma-client-f9160d8df2e4d6c96a662ee5e57fac84fdeae4219fe48275125ca22e998fe5fa",
+  "name": "prisma-client-6dbaaf845a8b748475630cfe8b405b0da9018b7231b8b50f3d7c7a681a0566d8",
   "main": "index.js",
   "types": "index.d.ts",
   "browser": "index-browser.js",

package/lib/src/generated/client/schema.prisma

@@ -437,3 +437,24 @@ model TeamMember {
   @@id([teamId, userId])
   @@index([userId])
 }
+
+model EventLog {
+  id            String   @id @default(cuid())
+  type          String
+  payload       String // JSON string — portable, no SQLite-isms
+  correlationId String?
+  teamId        String?
+  occurredAt    DateTime @default(now())
+
+  @@index([type, occurredAt])
+  @@index([occurredAt])
+}
+
+model Project {
+  id        String   @id @default(cuid())
+  name      String
+  teamId    String?
+  createdAt DateTime @default(now())
+
+  @@index([teamId])
+}

package/lib/src/generated/client/wasm.js

@@ -465,6 +465,22 @@ exports.Prisma.TeamMemberScalarFieldEnum = {
   createdAt: 'createdAt'
 };
 
+exports.Prisma.EventLogScalarFieldEnum = {
+  id: 'id',
+  type: 'type',
+  payload: 'payload',
+  correlationId: 'correlationId',
+  teamId: 'teamId',
+  occurredAt: 'occurredAt'
+};
+
+exports.Prisma.ProjectScalarFieldEnum = {
+  id: 'id',
+  name: 'name',
+  teamId: 'teamId',
+  createdAt: 'createdAt'
+};
+
 exports.Prisma.SortOrder = {
   asc: 'asc',
   desc: 'desc'
@@ -500,7 +516,9 @@ exports.Prisma.ModelName = {
   User: 'User',
   UserSession: 'UserSession',
   PasswordResetToken: 'PasswordResetToken',
-  TeamMember: 'TeamMember'
+  TeamMember: 'TeamMember',
+  EventLog: 'EventLog',
+  Project: 'Project'
 };
 
 /**

package/lib/src/middleware/authMiddleware.js

@@ -15,6 +15,8 @@ const typedi_1 = require("typedi");
 const ApiKeyService_1 = require("../services/ApiKeyService");
 const UserSessionService_1 = require("../services/UserSessionService");
 const UserService_1 = require("../services/UserService");
+const JwtKeyService_1 = require("../services/token/JwtKeyService");
+const StreamTicketService_1 = require("../services/token/StreamTicketService");
 const config_1 = require("../config");
 const prisma_1 = require("../prisma");
 const SESSION_COOKIE = 'xenon_dashboard_session';
@@ -70,7 +72,7 @@ function computeTeamIds(opts) {
 }
 function authMiddleware(req, res, next) {
     return __awaiter(this, void 0, void 0, function* () {
-        var _a, _b, _c, _d;
+        var _a, _b, _c, _d, _e, _f, _g, _h;
         if (config_1.config.authDisabled === true) {
             req.auth = {
                 kind: 'api-key',
@@ -114,6 +116,39 @@ function authMiddleware(req, res, next) {
             req.apiKey = { id: row.id, scopes: row.scopes, rateLimit: row.rateLimit, teamId: (_b = row.teamId) !== null && _b !== void 0 ? _b : null };
             return next();
         }
+        // Path 1.5: Authorization: Bearer <hub-issued JWT> (audience xenon-rest).
+        // Live user lookup on every request → revocation is instant on the REST
+        // surface even though the token itself is stateless (spec §7.1).
+        const authHeader = req.headers['authorization'];
+        if (typeof authHeader === 'string' && authHeader.startsWith('Bearer ')) {
+            try {
+                const payload = yield typedi_1.Container.get(JwtKeyService_1.JwtKeyService).verify(authHeader.slice(7), {
+                    audience: 'xenon-rest',
+                });
+                const user = yield userSvc.findById(String(payload.sub));
+                if (!user || user.status !== 'ACTIVE') {
+                    return res.status(401).json({ error: 'invalid token' });
+                }
+                const teamIds = yield computeTeamIds({
+                    role: user.role,
+                    userId: user.id,
+                    apiKeyTeamId: (_c = payload.teamId) !== null && _c !== void 0 ? _c : null,
+                });
+                req.auth = {
+                    kind: 'bearer',
+                    userId: user.id,
+                    role: user.role,
+                    scopes: String((_d = payload.scopes) !== null && _d !== void 0 ? _d : ''),
+                    teamId: (_e = payload.teamId) !== null && _e !== void 0 ? _e : null,
+                    rateLimit: 300,
+                    teamIds,
+                };
+                return next();
+            }
+            catch (_j) {
+                return res.status(401).json({ error: 'invalid token' });
+            }
+        }
         // Path 2: cookie — UserSession first, then ApiKey (legacy issuance path).
         // Both ids are UUIDv4; collision is astronomically unlikely (<1 in 2^128).
         // On collision, UserSession wins and we never look at the ApiKey branch.
@@ -174,15 +209,41 @@ function authMiddleware(req, res, next) {
                     userId: user.id,
                     role: user.role,
                     scopes: row.scopes,
-                    teamId: (_c = row.teamId) !== null && _c !== void 0 ? _c : null,
+                    teamId: (_f = row.teamId) !== null && _f !== void 0 ? _f : null,
                     apiKeyId: row.id,
                     rateLimit: row.rateLimit,
                     teamIds,
                 };
-                req.apiKey = { id: row.id, scopes: row.scopes, rateLimit: row.rateLimit, teamId: (_d = row.teamId) !== null && _d !== void 0 ? _d : null };
+                req.apiKey = { id: row.id, scopes: row.scopes, rateLimit: row.rateLimit, teamId: (_g = row.teamId) !== null && _g !== void 0 ? _g : null };
                 return next();
             }
         }
+        // Path 3: single-use stream ticket — ONLY for GET <control>/:udid/stream.
+        // req.path here is relative to apiRouter's own mount (authMiddleware is
+        // registered directly on apiRouter, before ControlRouter mounts '/control'
+        // onto it), so it is '/control/<udid>/stream' — not the full
+        // '/xenon/api/control/...' external URL. Verified against
+        // src/app/index.ts (apiRouter.use(authMiddleware) at line 223, then
+        // ControlRouter.register(apiRouter) -> parentRouter.use('/control', router)).
+        const ticket = (_h = req.query) === null || _h === void 0 ? void 0 : _h.ticket;
+        const streamMatch = req.method === 'GET' && /^\/control\/([^/]+)\/stream$/.exec(req.path);
+        if (typeof ticket === 'string' && streamMatch) {
+            try {
+                const { actorId } = yield typedi_1.Container.get(StreamTicketService_1.StreamTicketService).redeem(ticket, streamMatch[1]);
+                req.auth = {
+                    kind: 'stream-ticket',
+                    userId: actorId,
+                    role: 'MEMBER',
+                    scopes: 'read',
+                    rateLimit: 300,
+                    teamIds: undefined,
+                };
+                return next();
+            }
+            catch (_k) {
+                return res.status(401).json({ error: 'invalid ticket' });
+            }
+        }
         return res.status(401).json({ error: 'unauthenticated' });
     });
 }

package/lib/src/prisma.js

@@ -36,7 +36,7 @@ const MODEL_DELEGATES = new Set([
     'build', 'session', 'sessionLog', 'log', 'profiling', 'app', 'device',
     'pendingSession', 'cLIArgs', 'webhookConfig', 'webConfig', 'locatorEtalon',
     'lease', 'portLease', 'apiKey', 'selectorState', 'user', 'userSession',
-    'passwordResetToken', 'team', 'teamMember',
+    'passwordResetToken', 'team', 'teamMember', 'eventLog', 'project',
 ]);
 /** Cache of plain-object wrappers, keyed by model name. */
 const _modelWrappers = new Map();

package/lib/src/services/EventLogService.js

@@ -0,0 +1,81 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EventLogService = void 0;
+const typedi_1 = require("typedi");
+const prisma_service_1 = require("../data-service/prisma-service");
+const logger_1 = __importDefault(require("../logger"));
+/**
+ * Transactional-outbox seed (ARB foreclosure guard #1). Append-only log of
+ * every dashboard-visible domain event. Fire-and-forget by design: the
+ * broadcast hot path must gain zero latency and never fail because of the log.
+ */
+let EventLogService = class EventLogService {
+    constructor(prismaService) {
+        this.prismaService = prismaService;
+    }
+    appendSafe(entry) {
+        if (process.env.XENON_EVENT_LOG === 'off')
+            return;
+        setImmediate(() => {
+            var _a, _b, _c;
+            // Serialize defensively: a circular/unserializable payload must degrade
+            // to a placeholder, never throw. The throw would be uncaught here (it
+            // happens while building the .create() args, before the promise/.catch
+            // exists), and the global uncaughtException handler in src/index.ts would
+            // process.exit(1) — a single bad dashboard-event payload cannot be allowed
+            // to crash the whole plugin process.
+            let payloadStr;
+            try {
+                payloadStr = JSON.stringify((_a = entry.payload) !== null && _a !== void 0 ? _a : null);
+            }
+            catch (_d) {
+                payloadStr = JSON.stringify({ _unserializable: true, type: entry.type });
+            }
+            this.prismaService.client.eventLog
+                .create({
+                data: {
+                    type: entry.type,
+                    payload: payloadStr,
+                    correlationId: (_b = entry.correlationId) !== null && _b !== void 0 ? _b : null,
+                    teamId: (_c = entry.teamId) !== null && _c !== void 0 ? _c : null,
+                },
+            })
+                .catch((err) => logger_1.default.debug(`EventLog append failed (non-fatal): ${err === null || err === void 0 ? void 0 : err.message}`));
+        });
+    }
+    prune(retentionDays) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const cutoff = new Date(Date.now() - retentionDays * 24 * 60 * 60 * 1000);
+            const res = yield this.prismaService.client.eventLog.deleteMany({
+                where: { occurredAt: { lt: cutoff } },
+            });
+            return res.count;
+        });
+    }
+};
+exports.EventLogService = EventLogService;
+exports.EventLogService = EventLogService = __decorate([
+    (0, typedi_1.Service)(),
+    __metadata("design:paramtypes", [prisma_service_1.PrismaService])
+], EventLogService);

package/lib/src/services/ServerManager.js

@@ -55,6 +55,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.ServerManager = void 0;
 const typedi_1 = require("typedi");
 const os = __importStar(require("os"));
+const path = __importStar(require("path"));
 const OrphanSweeper_1 = require("./OrphanSweeper");
 const uuid_1 = require("uuid");
 const helpers_1 = require("../helpers");
@@ -79,6 +80,7 @@ const NodeDevices_1 = __importDefault(require("../device-managers/NodeDevices"))
 const config_1 = require("../config");
 const SocketServer_1 = require("./SocketServer");
 const SocketClient_1 = require("./SocketClient");
+const EventLogService_1 = require("./EventLogService");
 const TracingService_1 = require("./TracingService");
 const plugin_1 = require("../plugin");
 let ServerManager = ServerManager_1 = class ServerManager {
@@ -133,6 +135,17 @@ let ServerManager = ServerManager_1 = class ServerManager {
                     logger_1.default.warn(`LeaseOrphanSweeper tick failed: ${(_a = err === null || err === void 0 ? void 0 : err.message) !== null && _a !== void 0 ? _a : err}`);
                 });
             }, 30000);
+            // Daily EventLog prune (transactional-outbox seed): keeps the append-only
+            // log from growing unbounded. Fire-and-forget interval, unref'd so it
+            // never keeps the process alive on its own.
+            const eventLog = typedi_1.Container.get(EventLogService_1.EventLogService);
+            setInterval(() => {
+                const rawRet = Number(process.env.XENON_EVENT_LOG_RETENTION_DAYS);
+                const retentionDays = Number.isFinite(rawRet) && rawRet > 0 ? rawRet : 30;
+                eventLog
+                    .prune(retentionDays)
+                    .catch((err) => { var _a; return logger_1.default.warn(`EventLog prune failed: ${(_a = err === null || err === void 0 ? void 0 : err.message) !== null && _a !== void 0 ? _a : err}`); });
+            }, 24 * 60 * 60 * 1000).unref();
             // Cleanup any remaining zombie sessions (cross-node fallback)
             const { cleanupZombieSessions } = yield Promise.resolve().then(() => __importStar(require('../dashboard/services/session-service')));
             yield cleanupZombieSessions(recoveredSessionIds);
@@ -215,6 +228,29 @@ let ServerManager = ServerManager_1 = class ServerManager {
             yield bootstrapIdentity();
             const { startUserSessionCleanupCron } = yield Promise.resolve().then(() => __importStar(require('./identity/sessionCleanupCron')));
             startUserSessionCleanupCron();
+            // Hub-issued JWT signing key (REST/MCP tokens, stream tickets) — key
+            // material lives next to the SQLite db file so it survives restarts
+            // without a new DB migration. Must finish before /auth/token or
+            // /auth/jwks.json can be mounted (registerRoutes runs right after this).
+            // Non-disruptive by design: a key-material failure (permissions, disk
+            // full, corrupt PEM) only degrades the two token routes — sign()/verify()
+            // throw "not initialized" and jwks() serves an empty set — it must never
+            // abort server boot.
+            try {
+                const { JwtKeyService } = yield Promise.resolve().then(() => __importStar(require('./token/JwtKeyService')));
+                const jwtKeyDir = process.env.XENON_JWT_KEY_DIR || path.dirname(config_1.config.databasePath);
+                yield typedi_1.Container.get(JwtKeyService).init(jwtKeyDir);
+            }
+            catch (err) {
+                logger_1.default.error(`JWT key init failed — /auth/token and /auth/jwks.json will be unavailable: ${err === null || err === void 0 ? void 0 : err.message}`);
+            }
+            // ARB foreclosure guard #2: every recording/proof-bundle artifact path
+            // flows through ArtifactStore so an S3/object-store backend later is an
+            // implementation swap, not a call-site migration. FsArtifactStore is
+            // byte-identical to the legacy path.join(recordingsAssetsPath, ...)
+            // concatenation it replaces.
+            const { FsArtifactStore, ARTIFACT_STORE } = yield Promise.resolve().then(() => __importStar(require('./artifacts/ArtifactStore')));
+            typedi_1.Container.set(ARTIFACT_STORE, new FsArtifactStore(config_1.config.recordingsAssetsPath));
         });
     }
     registerRoutes(expressApp, cliArgs, pluginArgs) {

package/lib/src/services/SocketServer.js

@@ -26,6 +26,7 @@ const logger_1 = __importDefault(require("../logger"));
 const config_1 = require("../config");
 const ApiKeyService_1 = require("./ApiKeyService");
 const prisma_1 = require("../prisma");
+const EventLogService_1 = require("./EventLogService");
 const SocketEvents_1 = require("../enums/SocketEvents");
 const SESSION_COOKIE = 'xenon_dashboard_session';
 function readCookie(cookieHeader, name) {
@@ -169,6 +170,7 @@ let SocketServer = SocketServer_1 = class SocketServer {
         if (this.io) {
             this.io.to('dashboard').emit(event, data);
         }
+        typedi_1.Container.get(EventLogService_1.EventLogService).appendSafe({ type: event, payload: data });
     }
     emitToNodes(event, data) {
         if (this.io) {

package/lib/src/services/VideoPipelineService.js

@@ -56,6 +56,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.VideoPipelineService = void 0;
 exports.resolveOutputPath = resolveOutputPath;
+exports.buildRecordArgs = buildRecordArgs;
 const typedi_1 = require("typedi");
 const ProcessRegistry_1 = require("./ProcessRegistry");
 const child_process_1 = require("child_process");
@@ -73,6 +74,48 @@ const ResourceIsolationService_1 = require("./ResourceIsolationService");
 function resolveOutputPath(sessionId, override) {
     return (override !== null && override !== void 0 ? override : path_1.default.join(config_1.config.sessionAssetsPath, sessionId, 'video', `${sessionId}.mp4`));
 }
+/**
+ * Build the ffmpeg argv for a single-device MJPEG → mp4 recording.
+ *
+ * Extracted as a pure function so it can be unit-tested without spawning ffmpeg.
+ *
+ * Timing correctness: an HTTP MJPEG stream carries no real timestamps, so the
+ * mjpeg demuxer assumes a fixed 25 fps and stamps frames 1/25 s apart. The
+ * recorded duration then becomes (frames received)/25, which drifts from real
+ * time whenever the source's actual rate differs from 25 fps — a ~12.5 fps
+ * stream records at 2× speed, a >25 fps stream at slow motion. Stamping each
+ * frame with its wall-clock arrival time (`-use_wallclock_as_timestamps`) and
+ * keeping variable frame timing on output (`-vsync vfr`) makes the mp4 duration
+ * track real elapsed time regardless of the source frame rate.
+ */
+function buildRecordArgs(opts) {
+    const args = [
+        '-y',
+        '-loglevel', 'error',
+        '-reconnect', '1',
+        '-reconnect_at_eof', '1',
+        '-reconnect_streamed', '1',
+        '-reconnect_delay_max', '5',
+        '-probesize', '32',
+        '-analyzeduration', '0',
+        // Stamp frames with wall-clock arrival time (must precede -i).
+        '-use_wallclock_as_timestamps', '1',
+        '-f', 'mjpeg',
+        '-i', opts.mjpegUrl,
+        '-pix_fmt', 'yuv420p',
+    ];
+    if (opts.isMac) {
+        args.push('-c:v', 'h264_videotoolbox', '-realtime', '1', '-q:v', '50');
+    }
+    else {
+        args.push('-c:v', 'libx264', '-preset', 'veryfast', '-crf', '25');
+    }
+    // Preserve the (variable) wall-clock timing rather than forcing constant fps.
+    args.push('-vsync', 'vfr');
+    args.push('-movflags', 'frag_keyframe+empty_moov+default_base_moof');
+    args.push(opts.outputPath);
+    return args;
+}
 /**
  * Intelligent Video Pipeline Service
  *
@@ -121,47 +164,8 @@ let VideoPipelineService = class VideoPipelineService {
             logger_1.default.info(`[VideoPipeline] Starting HW-accelerated recording for ${sessionId} from ${mjpegUrl}`);
             // Small settlement delay to allow the source stream to prime
             yield new Promise((r) => setTimeout(r, 500));
-            // 2. Construct FFMPEG Args
-            // -f mjpeg: Input format
-            // -i: Input source
-            // -c:v: Hardware accelerated encoder based on platform
-            // -movflags: fMP4 for instant playback and crash resiliency
-            const args = [
-                '-y',
-                '-loglevel',
-                'error', // Only log errors to keep console clean
-                '-reconnect',
-                '1',
-                '-reconnect_at_eof',
-                '1',
-                '-reconnect_streamed',
-                '1',
-                '-reconnect_delay_max',
-                '5',
-                '-probesize',
-                '32', // Fast startup for MJPEG
-                '-analyzeduration',
-                '0',
-                '-f',
-                'mjpeg',
-                '-i',
-                mjpegUrl,
-                '-pix_fmt',
-                'yuv420p',
-            ];
-            if (this.isMac) {
-                args.push('-c:v', 'h264_videotoolbox');
-                args.push('-realtime', '1'); // VideoToolbox optimization
-                args.push('-q:v', '50'); // High quality/efficiency balance
-            }
-            else {
-                args.push('-c:v', 'libx264');
-                args.push('-preset', 'veryfast');
-                args.push('-crf', '25');
-            }
-            // Instant Playback Flags (fMP4)
-            args.push('-movflags', 'frag_keyframe+empty_moov+default_base_moof');
-            args.push(outputPath);
+            // 2. Construct FFMPEG Args (see buildRecordArgs for the timing rationale).
+            const args = buildRecordArgs({ mjpegUrl, outputPath, isMac: this.isMac });
             // 3. Wrap with Resource Isolation (Economy)
             const isolationService = typedi_1.Container.get(ResourceIsolationService_1.ResourceIsolationService);
             const { command, args: wrappedArgs } = isolationService.wrapSpawn('ffmpeg', args, 'Economy');
@@ -248,9 +252,11 @@ let VideoPipelineService = class VideoPipelineService {
                 '-loglevel',
                 'error',
             ];
-            // Per-input args: mjpeg + reconnect.
+            // Per-input args: mjpeg + reconnect. `-use_wallclock_as_timestamps` stamps
+            // each input's frames with real arrival time so the composite duration
+            // tracks wall-clock (see buildRecordArgs for the full rationale).
             for (const inp of inputs) {
-                args.push('-reconnect', '1', '-reconnect_at_eof', '1', '-reconnect_streamed', '1', '-reconnect_delay_max', '5', '-probesize', '32', '-analyzeduration', '0', '-f', 'mjpeg', '-i', `http://127.0.0.1:${inp.mjpegPort}`);
+                args.push('-reconnect', '1', '-reconnect_at_eof', '1', '-reconnect_streamed', '1', '-reconnect_delay_max', '5', '-probesize', '32', '-analyzeduration', '0', '-use_wallclock_as_timestamps', '1', '-f', 'mjpeg', '-i', `http://127.0.0.1:${inp.mjpegPort}`);
             }
             // Build the filtergraph: scale+pad each input to a uniform cell, then stack.
             const filterParts = [];
@@ -267,6 +273,8 @@ let VideoPipelineService = class VideoPipelineService {
             else {
                 args.push('-c:v', 'libx264', '-preset', 'veryfast', '-crf', '25');
             }
+            // Preserve wall-clock frame timing rather than forcing constant fps.
+            args.push('-vsync', 'vfr');
             args.push('-movflags', 'frag_keyframe+empty_moov+default_base_moof');
             args.push(outputPath);
             logger_1.default.info(`[VideoPipeline] Composite [${groupId}] starting: ${inputs.length} inputs, layout=${layout}, ${cellW}×${cellH}/cell → ${outputPath}`);

package/lib/src/services/artifacts/ArtifactStore.js

@@ -0,0 +1,60 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ARTIFACT_STORE = exports.FsArtifactStore = void 0;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+class FsArtifactStore {
+    constructor(rootDir) {
+        this.rootDir = rootDir;
+    }
+    resolve(...segments) {
+        // Byte-identical to the legacy `path.join(config.recordingsAssetsPath, ...)`
+        // this replaced — including under a RELATIVE root (e.g. a relative
+        // XENON_RECORDINGS_ASSETS_PATH override): path.join stays relative,
+        // path.resolve would silently absolutize it. path.resolve is used ONLY
+        // to compute an absolute form for the traversal guard, never for the
+        // returned value.
+        const joined = path_1.default.join(this.rootDir, ...segments);
+        const absRoot = path_1.default.resolve(this.rootDir);
+        const abs = path_1.default.resolve(joined);
+        if (abs !== absRoot && !abs.startsWith(absRoot + path_1.default.sep)) {
+            throw new Error(`artifact path escapes store root: ${joined}`);
+        }
+        return joined;
+    }
+    ensureDir(...segments) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const dir = this.resolve(...segments);
+            yield fs_1.default.promises.mkdir(dir, { recursive: true });
+            return dir;
+        });
+    }
+    createReadStream(relPath) {
+        return fs_1.default.createReadStream(this.resolve(relPath));
+    }
+    exists(relPath) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                yield fs_1.default.promises.access(this.resolve(relPath));
+                return true;
+            }
+            catch (_a) {
+                return false;
+            }
+        });
+    }
+}
+exports.FsArtifactStore = FsArtifactStore;
+exports.ARTIFACT_STORE = 'artifact-store'; // TypeDI token

package/lib/src/services/recording/RecordingOrchestrator.js

@@ -57,11 +57,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.RecordingOrchestrator = exports.RecordingError = void 0;
 exports.compositeOutputPath = compositeOutputPath;
 const typedi_1 = require("typedi");
-const path = __importStar(require("path"));
 const fs = __importStar(require("fs"));
 const uuid_1 = require("uuid");
 const api_1 = require("@opentelemetry/api");
-const config_1 = require("../../config");
 const VideoPipelineService_1 = require("../VideoPipelineService");
 const event_manager_1 = require("../../dashboard/event-manager");
 const busy_precheck_1 = require("./busy-precheck");
@@ -72,6 +70,7 @@ const device_store_1 = require("../../data-service/device-store");
 const manualLock_1 = require("./manualLock");
 const attributes_1 = require("../telemetry/attributes");
 const logger_1 = __importDefault(require("../../logger"));
+const ArtifactStore_1 = require("../artifacts/ArtifactStore");
 const recLog = logger_1.default.scope('RecordingOrchestrator');
 // Lazy-init OTel instruments. Module-load order vs. TracingService init does
 // not matter — the OTel API returns Noop instruments until a real
@@ -111,7 +110,7 @@ function ensureOtelInstruments() {
  * stay clear of per-recording-id folders.
  */
 function compositeOutputPath(groupId) {
-    return path.join(config_1.config.recordingsAssetsPath, '_groups', groupId, 'composite.mp4');
+    return typedi_1.Container.get(ArtifactStore_1.ARTIFACT_STORE).resolve('_groups', groupId, 'composite.mp4');
 }
 class RecordingError extends Error {
     constructor(code, busyDevices, limit, active) {
@@ -242,7 +241,7 @@ let RecordingOrchestrator = class RecordingOrchestrator {
                 const id = recordingIds[i];
                 const udid = udids[i];
                 const host = deviceHosts[udid];
-                const filePath = path.join(config_1.config.recordingsAssetsPath, id, 'video', `${id}.mp4`);
+                const filePath = typedi_1.Container.get(ArtifactStore_1.ARTIFACT_STORE).resolve(id, 'video', `${id}.mp4`);
                 try {
                     yield this.store.create({
                         groupId,
@@ -524,7 +523,7 @@ let RecordingOrchestrator = class RecordingOrchestrator {
                 this.gate.release(recordingId);
                 throw new RecordingError('device_busy', [{ udid, reason: 'unknown' }]);
             }
-            const filePath = path.join(config_1.config.recordingsAssetsPath, recordingId, 'video', `${recordingId}.mp4`);
+            const filePath = typedi_1.Container.get(ArtifactStore_1.ARTIFACT_STORE).resolve(recordingId, 'video', `${recordingId}.mp4`);
             try {
                 yield this.store.create({
                     groupId,