@xenon-device-management/xenon 2.12.0 → 2.13.0

package/lib/src/generated/client/package.json

@@ -1,5 +1,5 @@
 {
-  "name": "prisma-client-a28196e0a1882c56bf7139825d8dbfc28b79d73db89e92652213deb3f08362bd",
+  "name": "prisma-client-ef3fbf8faed5c4c712a2dce2686e5afc3ad0aa576aedb9c4cd9e5c99cfc0f03c",
   "main": "index.js",
   "types": "index.d.ts",
   "browser": "index-browser.js",

package/lib/src/generated/client/schema.prisma

@@ -205,6 +205,8 @@ model Device {
   batteryLevel                 Int?
   reservationReason            String?
   reservedBy                   String?
+  /// The user who took the reservation; only they or an admin may release or extend it.
+  reservedByUserId             String?
   reservedUntil                Float?
   storageFree                  String?
   tags                         String?

package/lib/src/generated/client/wasm.js

@@ -280,6 +280,7 @@ exports.Prisma.DeviceScalarFieldEnum = {
   batteryLevel: 'batteryLevel',
   reservationReason: 'reservationReason',
   reservedBy: 'reservedBy',
+  reservedByUserId: 'reservedByUserId',
   reservedUntil: 'reservedUntil',
   storageFree: 'storageFree',
   tags: 'tags',

package/lib/src/middleware/csrfMiddleware.js

@@ -14,11 +14,15 @@ const config_1 = require("../config");
 //   - reverse-proxy misconfigurations that strip SameSite enforcement
 //   - older browsers whose SameSite implementation has known gaps
 //
-// Header-authed callers — the (x-xenon-access-key, x-xenon-token) pair —
-// are immune to CSRF by construction: a browser will not attach a custom
-// header without an explicit CORS preflight, and the apiRouter's
-// cors({origin:false}) already refuses preflights. Those requests pass
-// through unchanged.
+// Header-authed callers — the (x-xenon-access-key, x-xenon-token) pair, or
+// an `Authorization: Bearer` token — are immune to CSRF by construction: a
+// browser will not attach either header cross-origin without an explicit CORS
+// preflight, and the apiRouter's cors({origin:false}) already refuses
+// preflights. Those requests pass through unchanged. A bearer request is
+// authenticated by its token alone: authMiddleware answers a bad one 401 and
+// never falls back to the cookie. Through 2.12 bearer callers (SDK, MCP
+// tools) were held to the Origin check, so every state change they sent
+// without a browser's Origin header was refused.
 const STATE_CHANGING_METHODS = new Set(['POST', 'PUT', 'DELETE', 'PATCH']);
 // Comma-separated list of allowed origins, intended for ops running the
 // dashboard behind a reverse proxy on a different host than the Xenon API.
@@ -51,6 +55,10 @@ function csrfMiddleware(req, res, next) {
     if (req.headers['x-xenon-access-key'] || req.headers['x-xenon-hub-token']) {
         return next();
     }
+    const authorization = req.headers.authorization;
+    if (typeof authorization === 'string' && authorization.startsWith('Bearer ')) {
+        return next();
+    }
     // Cookie-authed (or unauthenticated) state-changer. Require Origin or
     // Referer to match the Host we're being served from.
     const host = req.headers.host;

package/lib/src/middleware/rateLimitMiddleware.js

@@ -15,11 +15,25 @@ function categorize(req) {
         return 'heavy';
     return 'control';
 }
-function capacityFor(keyLimit, cat) {
+const USER_READ_MULTIPLIER = 10;
+function capacityFor(keyLimit, cat, perUser) {
     if (cat === 'heavy')
         return Math.max(10, Math.floor(keyLimit / 4));
+    if (cat === 'read' && perUser)
+        return keyLimit * USER_READ_MULTIPLIER;
     return keyLimit;
 }
+/** Whose buckets a request draws from, and their per-minute budget; undefined is unlimited. */
+function limitedCaller(req) {
+    const key = req.apiKey;
+    if (key)
+        return { id: key.id, rateLimit: key.rateLimit, perUser: false };
+    const auth = req.auth;
+    if (auth && (auth.kind === 'user-session' || auth.kind === 'bearer') && auth.userId) {
+        return { id: `user:${auth.userId}`, rateLimit: auth.rateLimit, perUser: true };
+    }
+    return undefined;
+}
 function refill(b) {
     const now = Date.now();
     const elapsed = (now - b.lastRefill) / 1000;
@@ -28,14 +42,14 @@ function refill(b) {
 }
 function rateLimitMiddleware() {
     return function (req, res, next) {
-        const key = req.apiKey;
-        if (!key)
+        const caller = limitedCaller(req);
+        if (!caller)
             return next();
         const category = categorize(req);
-        const bucketKey = `${key.id}:${category}`;
+        const bucketKey = `${caller.id}:${category}`;
         let bucket = buckets.get(bucketKey);
         if (!bucket) {
-            const capacity = capacityFor(key.rateLimit, category);
+            const capacity = capacityFor(caller.rateLimit, category, caller.perUser);
             bucket = {
                 tokens: capacity,
                 lastRefill: Date.now(),

package/lib/src/middleware/roleGuard.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.roleGuard = roleGuard;
+exports.superAdminGuard = superAdminGuard;
 const RANK = {
     SUPER_ADMIN: 3,
     ADMIN: 2,
@@ -25,3 +26,22 @@ function roleGuard(min) {
         next();
     };
 }
+/**
+ * SUPER_ADMIN only, refused in words a tester can act on: the dashboard shows
+ * the `error` of a refused change as it is.
+ */
+function superAdminGuard(message) {
+    return function (req, res, next) {
+        const auth = req.auth;
+        if (!auth) {
+            res.status(401).json({ error: 'unauthenticated' });
+            return;
+        }
+        if (auth.role !== 'SUPER_ADMIN') {
+            // `message` too: the AI Engine page shows a refused test's message.
+            res.status(403).json({ error: message, message });
+            return;
+        }
+        next();
+    };
+}

package/lib/src/services/AIService.js

@@ -323,12 +323,20 @@ Fix: Add a pre-emptive check for the location permission dialog or use the \`aut
     /**
      * Finds coordinates for an element based on a visual description (Tier 4)
      */
-    visualFind(screenshotBase64, description) {
-        return __awaiter(this, void 0, void 0, function* () {
+    /**
+     * `throwOnError`: fail, rather than answer "not found", when no provider is
+     * configured or the call fails. Device control's "Test locator" asks for
+     * it; Appium's ai-icon findElement doesn't.
+     */
+    visualFind(screenshotBase64_1, description_1) {
+        return __awaiter(this, arguments, void 0, function* (screenshotBase64, description, opts = {}) {
             var _a, _b;
             this.initializeProvider();
-            if (!this.isEnabled())
+            if (!this.isEnabled()) {
+                if (opts.throwOnError)
+                    throw new Error('No AI provider is configured');
                 return null;
+            }
             const prompt = `
             Task: Find the center coordinates (X, Y) of the element described as: "${description}"
             Response Format: JSON only, strictly { "x": number, "y": number }. 
@@ -351,6 +359,8 @@ Fix: Add a pre-emptive check for the location permission dialog or use the \`aut
                 else {
                     logger_1.default.warn(`[AIService] visualFind failed: ${err.message}`);
                 }
+                if (opts.throwOnError)
+                    throw err;
                 return null;
             }
         });

package/lib/src/services/NotificationService.js

@@ -66,38 +66,46 @@ let NotificationService = class NotificationService {
                     }
                 }
                 catch (err) {
-                    logger_1.default.error(`Failed to process webhook config ${config.id}: ${err}`);
+                    logger_1.default.error(`Webhook ${config.id} (${config.url}) failed for ${eventType}: ${err}`);
                 }
             }
         });
     }
+    /**
+     * Sends a sample event to a webhook the way a real one would be sent, and
+     * fails if the delivery does: "Send test" used to say it worked whatever
+     * happened, and ignored the webhook's type.
+     */
+    sendTest(url_1) {
+        return __awaiter(this, arguments, void 0, function* (url, type = 'slack', payloadTemplate) {
+            yield this.sendToWebhook({ url, type, payloadTemplate: payloadTemplate !== null && payloadTemplate !== void 0 ? payloadTemplate : null }, 'device_new', { udid: 'test-device-udid', name: 'Test Device', host: '127.0.0.1' });
+        });
+    }
+    /** Delivers one event. Throws when the webhook refuses or can't be reached. */
     sendToWebhook(config, eventType, payload) {
         return __awaiter(this, void 0, void 0, function* () {
             // Principal Logic: Use custom template if defined
             if (config.payloadTemplate) {
                 const substitutedBody = this.substituteTemplate(config.payloadTemplate, Object.assign({ eventType }, payload));
+                // JSON if the template renders to JSON, otherwise sent as text. Only
+                // the parse may fall back: one catch around both used to post again,
+                // as text, when the JSON delivery itself failed.
+                let body;
                 try {
-                    // Try to parse as JSON first
-                    const jsonBody = JSON.parse(substitutedBody);
-                    yield axios_1.default.post(config.url, jsonBody);
+                    body = JSON.parse(substitutedBody);
                 }
-                catch (e) {
-                    // Fallback to sending as plain text or simple object
-                    yield axios_1.default.post(config.url, { text: substitutedBody });
+                catch (_a) {
+                    body = { text: substitutedBody };
                 }
+                yield axios_1.default.post(config.url, body);
                 return;
             }
             if (config.type === 'slack') {
                 yield this.sendSlackMessage(config.url, eventType, payload);
             }
             else {
-                // Generic webhook fallback
-                try {
-                    yield axios_1.default.post(config.url, { event: eventType, payload });
-                }
-                catch (err) {
-                    logger_1.default.error(`Webhook failed for ${config.url}: ${err}`);
-                }
+                // Generic webhook
+                yield axios_1.default.post(config.url, { event: eventType, payload });
             }
         });
     }
@@ -154,13 +162,8 @@ let NotificationService = class NotificationService {
                             },
                         ],
                     };
-                    try {
-                        yield axios_1.default.post(url, body);
-                        logger_1.default.info(`Selector Health digest sent to ${url}`);
-                    }
-                    catch (err) {
-                        logger_1.default.error(`Failed to send digest to ${url}: ${err}`);
-                    }
+                    yield axios_1.default.post(url, body);
+                    logger_1.default.info(`Selector Health digest sent to ${url}`);
                     return;
                 }
                 default:
@@ -181,13 +184,10 @@ let NotificationService = class NotificationService {
                     },
                 ],
             };
-            try {
-                yield axios_1.default.post(url, body);
-                logger_1.default.info(`Slack notification sent to ${url}`);
-            }
-            catch (err) {
-                logger_1.default.error(`Failed to send Slack notification: ${err}`);
-            }
+            // A failure is the caller's: dispatchEvent logs it and goes on to the
+            // next webhook; sendTest reports it.
+            yield axios_1.default.post(url, body);
+            logger_1.default.info(`Slack notification sent to ${url}`);
         });
     }
 };

package/lib/src/services/bug-report/BugReportService.js

@@ -79,9 +79,15 @@ let BugReportService = class BugReportService {
             const warnings = [];
             const window = (0, window_1.resolveWindow)(session, opts.mode, (_a = opts.windowSec) !== null && _a !== void 0 ? _a : types_1.SLICE_DEFAULT_SEC);
             const logs = yield this.collectLogs(opts.sessionId, window.startedAt, window.endedAt);
-            const harText = (0, har_collector_1.collectHar)(opts.sessionId, config_1.config.sessionAssetsPath);
-            if (!harText)
+            const harText = opts.includeNetwork
+                ? (0, har_collector_1.collectHar)(opts.sessionId, config_1.config.sessionAssetsPath)
+                : null;
+            if (!opts.includeNetwork) {
+                warnings.push('network capture left out: only admins can download it');
+            }
+            else if (!harText) {
                 warnings.push('no network capture for this session');
+            }
             const aiSummary = (_b = session.ai_analysis) !== null && _b !== void 0 ? _b : null;
             const tmpDir = yield fs.promises.mkdtemp(path.join(os.tmpdir(), 'xenon-bugreport-'));
             const cleanups = [

package/lib/src/services/lease/LeaseService.js

@@ -104,12 +104,45 @@ function defaultNodePairAuthProvider() {
 function teamScope(callerTeamIds) {
     return callerTeamIds === undefined ? {} : { callerTeamIds };
 }
-/** The client's filters without a team list, which only the credential may set. */
+/**
+ * The client's filters as a device-store filter, without a team list, which
+ * only the credential may set. `sdk` is the OS version (`platformVersion`,
+ * which wins when both are sent). `deviceName` isn't a store filter: see
+ * nameMatches.
+ */
 function clientFilters(filters) {
     const out = Object.assign({}, filters);
     delete out.callerTeamIds;
+    delete out.deviceName;
+    delete out.sdk;
+    // The availability fields are the lease's to decide, never the client's.
+    delete out.busy;
+    delete out.userBlocked;
+    delete out.offline;
+    if (typeof filters.sdk === 'string' && filters.sdk !== '' && out.platformVersion === undefined) {
+        out.platformVersion = filters.sdk;
+    }
     return out;
 }
+/** `filters.deviceName`: the device's name, ignoring case. */
+function nameMatches(deviceName) {
+    if (typeof deviceName !== 'string' || deviceName === '')
+        return () => true;
+    const wanted = deviceName.toLowerCase();
+    return (device) => typeof device.name === 'string' && device.name.toLowerCase() === wanted;
+}
+/**
+ * Whether a lease may take a matching device now. Session allocation skips
+ * the same devices: blocked by an admin, reserved, or failing its health
+ * check. Busy and already-leased devices are skipped by the lock itself.
+ */
+function leasable(device, now) {
+    if (device.busy || device.userBlocked || device.offline)
+        return false;
+    if (device.reservedUntil && now < device.reservedUntil)
+        return false;
+    return device.healthStatus !== 'Unhealthy';
+}
 // What a token for an unknown lease id is compared against: a real hash's
 // length, of a random token nobody holds.
 const UNKNOWN_LEASE_TOKEN_HASH = (0, leaseToken_1.hashToken)((0, leaseToken_1.generateToken)());
@@ -146,23 +179,41 @@ let LeaseService = class LeaseService {
     }
     create(req) {
         return __awaiter(this, void 0, void 0, function* () {
+            var _a;
             const durationMs = Math.max(MIN_DURATION_MS, Math.min(req.durationMs, MAX_LEASE_MS));
             const heartbeatSeconds = Math.max(MIN_HEARTBEAT_SECONDS, Math.min(req.heartbeatSeconds, MAX_HEARTBEAT_SECONDS));
-            // Step 1: atomic find + lock, among the phones the caller can see.
-            const teams = teamScope(req.callerTeamIds);
-            const device = yield this.store.findAndLockDevice(Object.assign(Object.assign({}, clientFilters(req.filters)), teams));
-            if (!device) {
-                // Distinguish "no device matches the filter" (404) from "matching
-                // devices exist but are all busy or already leased" (409). Spec §4.2.
-                // Counted within the caller's teams too, so the answer can't reveal
-                // that another team has a phone of this platform.
-                const anyMatching = yield this.store.getDevices(Object.assign({ platform: req.filters.platform }, teams));
-                if (anyMatching && anyMatching.length > 0) {
-                    throw new AllMatchingBusy(`all devices matching ${JSON.stringify(req.filters)} are busy`);
+            // Step 1: the devices matching every filter, among the phones the caller
+            // can see. None is "no device matches" (404); some, but none free, is
+            // "all busy" (409). Spec §4.2. Counted within the caller's teams, so the
+            // answer can't reveal that another team has such a phone. Through 2.12 only
+            // the platform was counted, so an unknown udid answered 409, and `sdk`
+            // and `deviceName` were dropped.
+            const filters = Object.assign(Object.assign({}, clientFilters(req.filters)), teamScope(req.callerTeamIds));
+            const matching = ((_a = (yield this.store.getDevices(filters))) !== null && _a !== void 0 ? _a : []).filter(nameMatches(req.filters.deviceName));
+            if (matching.length === 0) {
+                // A fixed sentence, so a hidden phone and an unknown udid answer alike.
+                throw new NoMatchingDevice('No device matches the filters');
+            }
+            // Step 2: lock the first free one atomically. Through 2.12 the lock took
+            // a blocked, reserved or unhealthy device as readily as any other.
+            const lockedAt = Date.now();
+            let device = null;
+            for (const candidate of matching.filter((d) => leasable(d, lockedAt))) {
+                const locked = yield this.store.findAndLockDevice(Object.assign(Object.assign({}, filters), { udid: [candidate.udid], filterByHost: candidate.host }));
+                if (!locked)
+                    continue;
+                if (locked.udid === candidate.udid && locked.host === candidate.host) {
+                    device = locked;
+                    break;
                 }
-                throw new NoMatchingDevice(`no device matching ${JSON.stringify(req.filters)}`);
+                // The host filter is a substring match: another row of that udid was
+                // locked. Give it back.
+                yield this.store.updateDevice(locked.udid, locked.host, { busy: false });
+            }
+            if (!device) {
+                throw new AllMatchingBusy(`all devices matching ${JSON.stringify(req.filters)} are busy`);
             }
-            // Step 2: port RPC (or local-call if device.host == this host)
+            // Step 3: port RPC (or local-call if device.host == this host)
             let ports;
             try {
                 const purposes = String(device.platform).toLowerCase() === 'android'
@@ -182,7 +233,7 @@ let LeaseService = class LeaseService {
                 yield this.store.updateDevice(device.udid, device.host, { busy: false });
                 throw new DeviceUnhealthy(`port allocation failed: ${err.message}`, err);
             }
-            // Step 3: build token + insert lease row
+            // Step 4: build token + insert lease row
             const token = (0, leaseToken_1.generateToken)();
             const tokenHash = (0, leaseToken_1.hashToken)(token);
             const now = Date.now();
@@ -212,7 +263,7 @@ let LeaseService = class LeaseService {
                 yield this.db.portLease.deleteMany({ where: { port: { in: Object.values(ports) } } });
                 throw err;
             }
-            // Step 4: build the cap bag now that we have lease.id, persist + return.
+            // Step 5: build the cap bag now that we have lease.id, persist + return.
             // If this update fails (rare, transient DB error), roll the lease back so
             // we don't leave a zombie row with capabilityBag='' that would crash on
             // any later JSON.parse in authorizeSessionUse().
@@ -222,7 +273,7 @@ let LeaseService = class LeaseService {
                     where: { id: lease.id },
                     data: { capabilityBag: JSON.stringify(bag) },
                 });
-                // Step 5: backfill leaseId on the PortLease rows
+                // Step 6: backfill leaseId on the PortLease rows
                 yield this.db.portLease.updateMany({
                     where: { port: { in: Object.values(ports) } },
                     data: { leaseId: lease.id },
@@ -232,15 +283,15 @@ let LeaseService = class LeaseService {
                 try {
                     yield this.db.lease.delete({ where: { id: lease.id } });
                 }
-                catch (_a) { }
+                catch (_b) { }
                 try {
                     yield this.db.portLease.deleteMany({ where: { port: { in: Object.values(ports) } } });
                 }
-                catch (_b) { }
+                catch (_c) { }
                 try {
                     yield this.store.updateDevice(device.udid, device.host, { busy: false });
                 }
-                catch (_c) { }
+                catch (_d) { }
                 throw err;
             }
             return {

package/lib/src/services/omni-vision/OmniVisionService.js

@@ -382,8 +382,13 @@ let OmniVisionService = OmniVisionService_1 = class OmniVisionService {
     /**
      * Proactive OCR Search: Finds elements matching text even if not in XML
      */
-    findByText(driver, text) {
-        return __awaiter(this, void 0, void 0, function* () {
+    /**
+     * `throwOnError`: fail instead of answering "no match" when the screenshot
+     * or OCR fails. Device control's "Test locator" asks for it; an Appium
+     * findElement doesn't, and turns the empty list into NoSuchElement.
+     */
+    findByText(driver_1, text_1) {
+        return __awaiter(this, arguments, void 0, function* (driver, text, opts = {}) {
             this.logger.info(`Searching for text: "${text}" via proactive OCR...`);
             try {
                 const screenshot = yield driver.getScreenshot();
@@ -412,6 +417,8 @@ let OmniVisionService = OmniVisionService_1 = class OmniVisionService {
             }
             catch (err) {
                 this.logger.error(`OCR proactive search failed: ${err.message}`);
+                if (opts.throwOnError)
+                    throw err;
                 return [];
             }
         });
@@ -419,12 +426,12 @@ let OmniVisionService = OmniVisionService_1 = class OmniVisionService {
     /**
      * AI-based visual find for icons or specific descriptions
      */
-    findByIcon(driver, iconDescription) {
-        return __awaiter(this, void 0, void 0, function* () {
+    findByIcon(driver_1, iconDescription_1) {
+        return __awaiter(this, arguments, void 0, function* (driver, iconDescription, opts = {}) {
             this.logger.info(`Searching for: "${iconDescription}" via AI Vision...`);
             try {
                 const screenshot = yield driver.getScreenshot();
-                const coordinates = yield AIService_1.AI_SERVICE.visualFind(screenshot, iconDescription);
+                const coordinates = yield AIService_1.AI_SERVICE.visualFind(screenshot, iconDescription, opts);
                 if (coordinates) {
                     const el = {
                         id: `omni_ai_${Date.now()}`,
@@ -442,6 +449,8 @@ let OmniVisionService = OmniVisionService_1 = class OmniVisionService {
             }
             catch (err) {
                 this.logger.error(`AI proactive find failed: ${err.message}`);
+                if (opts.throwOnError)
+                    throw err;
             }
             return null;
         });

package/lib/src/services/recording/RecordingOrchestrator.js

@@ -519,7 +519,7 @@ let RecordingOrchestrator = class RecordingOrchestrator {
      */
     stop(groupId) {
         return __awaiter(this, void 0, void 0, function* () {
-            var _a, _b;
+            var _a, _b, _c, _d;
             ensureOtelInstruments();
             const span = api_1.trace.getTracer('xenon.recording').startSpan('xenon.recording.stop', {
                 attributes: { [attributes_1.ATTR.RECORDING_GROUP_ID]: groupId },
@@ -538,6 +538,20 @@ let RecordingOrchestrator = class RecordingOrchestrator {
                 const recordings = yield this.store.listGroup(groupId);
                 const out = [];
                 for (const r of recordings) {
+                    // A phone whose recording already ended (its source ended, or this
+                    // is a second stop), or that handleSourceEnded is finalizing now, is
+                    // reported as it stands. Finalizing it again overwrote its end,
+                    // duration and fail_reason, and let go of the phone a second time.
+                    if (r.status === 'STOPPED' || r.status === 'FAILED' || this.finalizing.has(r.id)) {
+                        out.push({
+                            id: r.id,
+                            udid: r.device_udid,
+                            status: r.status,
+                            durationMs: (_b = r.duration_ms) !== null && _b !== void 0 ? _b : undefined,
+                            sizeBytes: (_c = r.size_bytes) !== null && _c !== void 0 ? _c : undefined,
+                        });
+                        continue;
+                    }
                     // Claim it so an ffmpeg exit landing mid-stop doesn't finalize the same
                     // row from handleSourceEnded at the same time.
                     this.finalizing.add(r.id);
@@ -555,7 +569,7 @@ let RecordingOrchestrator = class RecordingOrchestrator {
             }
             catch (err) {
                 span.recordException(err);
-                span.setStatus({ code: api_1.SpanStatusCode.ERROR, message: (_b = err === null || err === void 0 ? void 0 : err.message) !== null && _b !== void 0 ? _b : 'unknown' });
+                span.setStatus({ code: api_1.SpanStatusCode.ERROR, message: (_d = err === null || err === void 0 ? void 0 : err.message) !== null && _d !== void 0 ? _d : 'unknown' });
                 throw err;
             }
             finally {

package/lib/test/helpers/expressRoutes.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mountPath = mountPath;
+exports.routesOf = routesOf;
+/** '/api', '/control/:udid' or '' from a `use()` layer's regexp. */
+function mountPath(layer) {
+    if (layer.regexp.fast_slash)
+        return '';
+    let n = 0;
+    return layer.regexp.source
+        .replace(/^\^/, '')
+        .replace(/\\\/\?\(\?=\\\/\|\$\)$/i, '')
+        .replace(/\(\?:\(\[\^\\\/\]\+\?\)\)/g, () => { var _a, _b; return `:${(_b = (_a = layer.keys[n++]) === null || _a === void 0 ? void 0 : _a.name) !== null && _b !== void 0 ? _b : 'param'}`; })
+        .replace(/\\\//g, '/')
+        .replace(/\\\./g, '.')
+        .replace(/\\-/g, '-');
+}
+function join(a, b) {
+    const joined = `${a}/${b}`.replace(/\/+/g, '/');
+    return joined.length > 1 ? joined.replace(/\/$/, '') : joined;
+}
+function routesOf(router, prefix = '') {
+    const out = new Set();
+    const walk = (stack, at) => {
+        var _a;
+        for (const layer of stack) {
+            if (layer.route) {
+                const path = join(at, String(layer.route.path));
+                for (const [method, on] of Object.entries(layer.route.methods)) {
+                    if (on && method !== '_all')
+                        out.add(`${method.toUpperCase()} ${path}`);
+                }
+            }
+            else if ((_a = layer.handle) === null || _a === void 0 ? void 0 : _a.stack) {
+                walk(layer.handle.stack, join(at, mountPath(layer)));
+            }
+        }
+    };
+    walk(router.stack, prefix);
+    return out;
+}

package/lib/test/integration/team-visibility-control.spec.js

@@ -214,12 +214,12 @@ describe('team boundary on /control (integration)', function () {
         it('gets 404 on screenshot', () => __awaiter(this, void 0, void 0, function* () {
             const res = yield screenshot(alice, TEAM_B_UDID);
             (0, chai_1.expect)(res.status).to.equal(404);
-            (0, chai_1.expect)(res.text).to.equal('Device not found');
+            (0, chai_1.expect)(res.body).to.deep.equal({ error: 'not_found', message: 'Device not found' });
         }));
         it('gets 404 on tap', () => __awaiter(this, void 0, void 0, function* () {
             const res = yield tap(alice, TEAM_B_UDID);
             (0, chai_1.expect)(res.status).to.equal(404);
-            (0, chai_1.expect)(res.text).to.equal('Device not found');
+            (0, chai_1.expect)(res.body).to.deep.equal({ error: 'not_found', message: 'Device not found' });
         }));
         it('gets 404 on stream/ticket, and no ticket', () => __awaiter(this, void 0, void 0, function* () {
             const res = yield ticket(alice, TEAM_B_UDID);