@xenon-device-management/xenon 2.13.2 → 2.15.0

package/lib/src/app/routers/dashboard.js

@@ -56,6 +56,10 @@ const prisma_1 = require("../../prisma");
 const SessionManager_1 = require("../../sessions/SessionManager");
 const UniversalMjpegProxy_1 = require("../../helpers/UniversalMjpegProxy");
 const web_config_service_1 = require("../../data-service/web-config-service");
+const PluginContext_1 = require("../../PluginContext");
+const labSettings_1 = require("../../services/settings/labSettings");
+const SelfHealingSwitch_1 = require("../../services/settings/SelfHealingSwitch");
+const aiEngineSettings_1 = require("../../services/settings/aiEngineSettings");
 const typedi_1 = require("typedi");
 const scopeGuard_1 = require("../../middleware/scopeGuard");
 const roleGuard_1 = require("../../middleware/roleGuard");
@@ -1099,17 +1103,49 @@ function streamLiveSessionVideo(request, response) {
         }
     });
 }
+/**
+ * The base URL as the dashboard may see it: a user name, password or query
+ * value it carries is masked. Saving one is refused (aiEngineSettings.ts), but
+ * the server's environment can still hold one, and every admin can read this.
+ */
+function maskedBaseUrl(url) {
+    if (!url)
+        return url;
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch (_a) {
+        return url;
+    }
+    // Shown as given unless something needs masking: toString() would add a '/'.
+    if (!parsed.username && !parsed.password && !parsed.search && !parsed.hash)
+        return url;
+    if (parsed.username || parsed.password) {
+        parsed.username = '***';
+        parsed.password = '';
+    }
+    for (const name of [...new Set(parsed.searchParams.keys())]) {
+        parsed.searchParams.set(name, '***');
+    }
+    parsed.hash = '';
+    return parsed.toString();
+}
 function getGlobalConfig(request, response) {
     return __awaiter(this, void 0, void 0, function* () {
         try {
             const dbConfig = yield typedi_1.Container.get(web_config_service_1.WebConfigService).getConfig();
-            // Merge with Environment Config (AI Settings)
+            // What the server runs with: a saved value, else the startup option, else
+            // the default. The pages show this (a saved value alone left them to guess
+            // at what a setting never saved was), and `defaults` for "restore defaults".
+            const effective = (0, labSettings_1.effectiveSettings)(typedi_1.Container.get(PluginContext_1.PluginContext).pluginArgs, dbConfig);
+            // The AI engine settings in effect (aiEngineSettings.ts keeps `config` at
+            // them). Never a key: only whether one is set.
             const { config } = yield Promise.resolve().then(() => __importStar(require('../../config')));
-            // Sanitize keys - return boolean existence only
             const aiConfig = {
                 aiProvider: config.aiProvider,
                 aiModel: config.aiModel,
-                aiBaseUrl: config.aiBaseUrl,
+                aiBaseUrl: maskedBaseUrl(config.aiBaseUrl),
                 geminiModel: config.geminiModel,
                 openaiModel: config.openaiModel,
                 anthropicModel: config.anthropicModel,
@@ -1118,7 +1154,9 @@ function getGlobalConfig(request, response) {
                 openaiSet: !!config.openaiApiKey,
                 anthropicSet: !!config.anthropicApiKey,
             };
-            return response.status(200).json(Object.assign(Object.assign({}, dbConfig), aiConfig));
+            return response
+                .status(200)
+                .json(Object.assign(Object.assign(Object.assign(Object.assign({}, dbConfig), effective), { defaults: (0, labSettings_1.settingsDefaults)() }), aiConfig));
         }
         catch (err) {
             return response.status(500).json({ error: true, message: err.message });
@@ -1127,31 +1165,36 @@ function getGlobalConfig(request, response) {
 }
 function updateGlobalConfig(request, response) {
     return __awaiter(this, void 0, void 0, function* () {
+        var _a;
         try {
             const payload = request.body;
-            // Handle Runtime AI Config Overrides (Memory only)
-            // Only pass defined values to avoid overwriting env vars (e.g. aiBaseUrl, ollamaModel) with undefined
-            const runtimeOverrides = {};
-            if (payload.aiProvider !== undefined)
-                runtimeOverrides.aiProvider = payload.aiProvider;
-            if (payload.aiModel !== undefined)
-                runtimeOverrides.aiModel = payload.aiModel;
-            if (payload.aiBaseUrl !== undefined)
-                runtimeOverrides.aiBaseUrl = payload.aiBaseUrl;
-            if (payload.geminiModel !== undefined)
-                runtimeOverrides.geminiModel = payload.geminiModel;
-            if (payload.openaiModel !== undefined)
-                runtimeOverrides.openaiModel = payload.openaiModel;
-            if (payload.anthropicModel !== undefined)
-                runtimeOverrides.anthropicModel = payload.anthropicModel;
-            if (payload.ollamaModel !== undefined)
-                runtimeOverrides.ollamaModel = payload.ollamaModel;
-            if (Object.keys(runtimeOverrides).length > 0) {
-                const { updateConfig } = yield Promise.resolve().then(() => __importStar(require('../../config')));
-                updateConfig(runtimeOverrides);
+            // Before anything is saved: a value the cleanup job would act on, such as a
+            // retention window of 0, is refused rather than stored, and so is an AI
+            // provider or address that could not work, now that it outlives a restart.
+            const problem = (_a = (0, labSettings_1.validateSettingsUpdate)(payload !== null && payload !== void 0 ? payload : {})) !== null && _a !== void 0 ? _a : (0, aiEngineSettings_1.validateAiEngineUpdate)(payload !== null && payload !== void 0 ? payload : {});
+            if (problem) {
+                return response
+                    .status(400)
+                    .json({ error: 'invalid_setting', field: problem.field, message: problem.message });
+            }
+            // Saved, then in force for the next AI call. Through 2.14 the AI fields
+            // changed the running server only, and a restart undid them.
+            const aiEngine = (0, aiEngineSettings_1.aiEngineUpdateOf)(payload !== null && payload !== void 0 ? payload : {});
+            yield typedi_1.Container.get(web_config_service_1.WebConfigService).setConfig(Object.assign(Object.assign({}, payload), aiEngine));
+            if (Object.keys(aiEngine).length > 0) {
+                typedi_1.Container.get(aiEngineSettings_1.AiEngineSettings).noteSaved(aiEngine);
+            }
+            // The command interceptor asks at every command and never reads the
+            // database: hand it the saved value, in force from the next command.
+            if (payload.enableSelfHealing !== undefined) {
+                typedi_1.Container.get(SelfHealingSwitch_1.SelfHealingSwitch).set(payload.enableSelfHealing);
+            }
+            // The retention values are read at each cleanup run, so they apply by
+            // themselves. A schedule is a timer: replace it now, not at the next restart.
+            if (payload.buildCleanupSchedule !== undefined) {
+                const { rescheduleCleanupBuilds } = yield Promise.resolve().then(() => __importStar(require('../../device-utils')));
+                yield rescheduleCleanupBuilds(typedi_1.Container.get(PluginContext_1.PluginContext).pluginArgs);
             }
-            // Persist Web Configs to DB
-            yield typedi_1.Container.get(web_config_service_1.WebConfigService).setConfig(payload);
             return response.status(200).json({ success: true });
         }
         catch (err) {

package/lib/src/app/routers/grid.js

@@ -89,10 +89,12 @@ function getDevices(request, response) {
             const [enriched] = yield (0, device_service_1.enrichDevicesWithTeamNames)([match]);
             return response.json(enriched);
         }
-        /* dashboard-plugin-url is the base url for opening the appium-dashboard-plugin
-         * This value will be attached to all express request via middleware
+        /* dashboard-plugin-url is where this server reaches the appium-dashboard-plugin,
+         * and dashboard-plugin-link the base of the link people open; both from
+         * configuration, never from the request (app/dashboardPluginLink.ts).
          */
         const dashboardPluginUrl = request['dashboard-plugin-url'];
+        const dashboardPluginLink = request['dashboard-plugin-link'];
         if (dashboardPluginUrl) {
             const response = yield InternalHttpClient_1.InternalHttpClient.get(`${dashboardPluginUrl}/api/sessions?start_time=${SERVER_UP_TIME}`);
             const sessions = ((_a = response === null || response === void 0 ? void 0 : response.result) === null || _a === void 0 ? void 0 : _a.rows) || [];
@@ -105,7 +107,7 @@ function getDevices(request, response) {
             });
             devices = devices.map((d) => {
                 var _a;
-                d.dashboard_link = `${dashboardPluginUrl}?device_udid=${d.udid}&start_time=${SERVER_UP_TIME}`;
+                d.dashboard_link = `${dashboardPluginLink}?device_udid=${d.udid}&start_time=${SERVER_UP_TIME}`;
                 d.total_session_count = ((_a = deviceSessionMap[d.udid]) === null || _a === void 0 ? void 0 : _a.length) || 0;
                 return d;
             });
@@ -402,10 +404,33 @@ function updateTags(request, response) {
         if (!udid || !host || !Array.isArray(tags)) {
             return response.status(400).json({ error: 'Missing udid, host, or tags array' });
         }
+        // The tags are saved for the phone (deviceSettings.ts): only for one that
+        // is here. Through 2.13 any udid and host answered 200 and wrote nothing.
+        if (!(yield device_store_1.DeviceStoreFactory.getStore().findDevice({ udid, host }))) {
+            return response.status(404).json({ error: 'Device not found' });
+        }
         yield (0, device_service_1.updateDeviceTags)(udid, host, tags);
         response.status(200).json({ success: true });
     });
 }
+/**
+ * Every phone of this udid that this server knows: those connected now, and
+ * those whose settings are saved while they are away (deviceSettings.ts), so
+ * a phone that is not connected can still be moved, and its team deleted.
+ */
+function phonesOfUdid(udid) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const store = device_store_1.DeviceStoreFactory.getStore();
+        const phones = new Map();
+        for (const phone of [
+            ...(yield store.findDevices({ udid })),
+            ...(yield store.findSavedPhones(udid)),
+        ]) {
+            phones.set(`${phone.udid}\u0000${phone.host}`, { udid: phone.udid, host: phone.host });
+        }
+        return [...phones.values()];
+    });
+}
 function assignDeviceToTeam(request, response) {
     return __awaiter(this, void 0, void 0, function* () {
         const { udid } = request.params;
@@ -415,20 +440,19 @@ function assignDeviceToTeam(request, response) {
             if (!team)
                 return response.status(404).json({ error: 'team not found' });
         }
-        const result = yield prisma_1.prisma.device.updateMany({
-            where: { udid },
-            data: { teamId: teamId || null },
-        });
-        if (result.count === 0)
+        const phones = yield phonesOfUdid(udid);
+        if (phones.length === 0)
             return response.status(404).json({ error: 'device not found' });
-        // Refresh in-memory store so subsequent allocation sees the change immediately.
-        const rows = yield prisma_1.prisma.device.findMany({ where: { udid } });
-        for (const row of rows) {
-            yield store.updateDevice(row.udid, row.host, { teamId: row.teamId });
+        // Through the store, which saves the team for the phone as it writes the
+        // row: a phone keeps it when it disconnects and comes back.
+        for (const phone of phones) {
+            yield device_store_1.DeviceStoreFactory.getStore().updateDevice(phone.udid, phone.host, {
+                teamId: teamId || null,
+            });
         }
         // The live dashboard events follow the new team now, not after the cache's TTL.
         typedi_1.Container.get(DeviceTeamResolver_1.DeviceTeamResolver).note(udid, teamId || null);
-        response.json({ ok: true, updated: result.count });
+        response.json({ ok: true, updated: phones.length });
     });
 }
 /**

package/lib/src/app/routers/profile.js

@@ -17,6 +17,7 @@ const ApiKeyService_1 = require("../../services/ApiKeyService");
 const UserService_1 = require("../../services/UserService");
 const prisma_1 = require("../../prisma");
 const profileIdentity_1 = require("./profileIdentity");
+const mintedLifetime_1 = require("../../services/token/mintedLifetime");
 const ROLE_SCOPES = {
     SUPER_ADMIN: ['admin'],
     ADMIN: ['devices', 'sessions', 'read'],
@@ -79,10 +80,23 @@ function profileRouter() {
             return res.status(404).json({ error: 'user not found' });
         return res.json({ accessKey: user.accessKey });
     }));
+    // Rotating the access key ends every key pair its owner has, whatever their
+    // scopes, so it takes the person themselves (a dashboard sign-in) or a
+    // credential with the admin scope. Through 2.14 any credential could, a
+    // read-only token included, and cut off every one of its owner's clients.
     r.post('/access-key/rotate', (req, res) => __awaiter(this, void 0, void 0, function* () {
+        var _a;
         const auth = requireAuth(req, res);
         if (!auth)
             return;
+        const credentialScopes = String((_a = auth.scopes) !== null && _a !== void 0 ? _a : '')
+            .split(',')
+            .map((s) => s.trim());
+        if (auth.kind !== 'user-session' && !credentialScopes.includes('admin')) {
+            return res.status(403).json({
+                error: 'rotating the access key needs a dashboard sign-in or a credential with the admin scope',
+            });
+        }
         const userId = yield effectiveUserId(auth.userId);
         if (!userId)
             return res.status(404).json({ error: 'user not found' });
@@ -132,6 +146,13 @@ function profileRouter() {
             }
             expiresAtDate = d;
         }
+        // A token made with a credential that expires (a Bearer token, an API key
+        // with an expiry) ends no later than it. Through 2.14 a 1-hour Bearer
+        // token could make itself a key that never expired.
+        const within = (0, mintedLifetime_1.keyExpiryWithin)(expiresAtDate, auth.credentialExpiresAt);
+        if ('error' in within)
+            return res.status(400).json({ error: within.error });
+        expiresAtDate = within.expiresAt;
         const allowed = (_a = ROLE_SCOPES[auth.role]) !== null && _a !== void 0 ? _a : ROLE_SCOPES.MEMBER;
         if (scopes !== undefined && (!Array.isArray(scopes) || !scopes.every(isScope))) {
             return res.status(400).json({ error: `scopes must be some of ${KNOWN_SCOPES.join(', ')}` });

package/lib/src/app/routers/streamType.js

@@ -9,10 +9,15 @@ exports.resolveStreamType = resolveStreamType;
  * MJPEG path so the recording pipeline (which reads the MJPEG server) is
  * unaffected (spec phase-1 rule). iOS/tvOS always use MJPEG (WDA emits it
  * directly).
+ *
+ * `clientCanPlayH264` is false when the page that starts the stream shows
+ * MJPEG: device control, or a browser without WebCodecs (exposed only on
+ * https and localhost). Starting an H.264 capture for it would run a second
+ * capture beside the screencap loop its `<img>` starts.
  */
-function resolveStreamType(platform, flagOn, recording) {
+function resolveStreamType(platform, flagOn, recording, clientCanPlayH264 = true) {
     const isAndroid = platform === 'android' || platform === 'androidtv' || platform === 'android-tv';
-    if (!isAndroid || !flagOn || recording)
+    if (!isAndroid || !flagOn || recording || !clientCanPlayH264)
         return 'mjpeg';
     return 'h264';
 }

package/lib/src/app/routers/users.js

@@ -141,8 +141,11 @@ function usersRouter() {
         });
     }));
     // Admin-issued password reset. Replaces relaying a link out of the server
-    // log: with SMTP the link is emailed to the user as before; without it the
-    // link is returned once, to the admin who asked, and never logged.
+    // log: with SMTP and XENON_PUBLIC_URL the link is emailed to the user;
+    // otherwise it is returned once, to the admin who asked, and never logged.
+    // An emailed link points at XENON_PUBLIC_URL only, never the request's
+    // Host: the admin's request could name any host, and the user would get a
+    // genuine Xenon email sending their token there.
     r.post('/:id/reset-link', (req, res) => __awaiter(this, void 0, void 0, function* () {
         const auth = getAuth(req);
         const targetId = req.params.id;
@@ -168,10 +171,11 @@ function usersRouter() {
         const resetSvc = typedi_1.Container.get(PasswordResetService_1.PasswordResetService);
         const emailSvc = typedi_1.Container.get(EmailService_1.EmailService);
         const { raw } = yield resetSvc.createToken(target.id);
-        const link = (0, passwordResetLink_1.buildResetLink)(req, raw);
+        const publicBase = (0, passwordResetLink_1.resetLinkBase)();
         const expiresAt = new Date(Date.now() + resetSvc.ttlMs()).toISOString();
-        if (emailSvc.hasSmtp()) {
-            yield emailSvc.send((0, passwordResetLink_1.resetEmail)(target, link));
+        if (emailSvc.hasSmtp() && publicBase) {
+            const link = (0, passwordResetLink_1.buildResetLink)(publicBase, raw);
+            yield emailSvc.send((0, passwordResetLink_1.resetEmail)(target, link, resetSvc.ttlMs()));
             auditLog.info(`${auth.userId} emailed a password-reset link to user ${target.id}`);
             return res.json({ emailed: true, expiresAt });
         }
@@ -179,6 +183,7 @@ function usersRouter() {
         auditLog.warn(`${auth.userId} issued a password-reset link for user ${target.id} (returned to the admin)`);
         // The body is a credential: keep it out of browser and proxy caches.
         res.set('Cache-Control', 'no-store');
+        const link = (0, passwordResetLink_1.buildResetLink)(publicBase !== null && publicBase !== void 0 ? publicBase : (0, passwordResetLink_1.requestBase)(req), raw);
         return res.json({ emailed: false, link, expiresAt });
     }));
     r.delete('/:id', (req, res) => __awaiter(this, void 0, void 0, function* () {

package/lib/src/app/routers/webhook.js

@@ -14,6 +14,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 const express_1 = require("express");
 const NotificationService_1 = require("../../services/NotificationService");
+const webhookEvents_1 = require("../../services/webhookEvents");
 const typedi_1 = require("typedi");
 const logger_1 = __importDefault(require("../../logger"));
 const scopeGuard_1 = require("../../middleware/scopeGuard");
@@ -63,17 +64,20 @@ function deleteConfig(req, res) {
         }
     });
 }
-// Sends a sample event the way the webhook's real events go out (its type
-// and template), and says whether it was delivered.
+// Sends a sample of an event the way the webhook's real events go out (its
+// type and template), and says whether it was delivered.
 function testWebhook(req, res) {
     return __awaiter(this, void 0, void 0, function* () {
         var _a, _b;
-        const { url, type, payloadTemplate } = (_a = req.body) !== null && _a !== void 0 ? _a : {};
+        const { url, type, payloadTemplate, event } = (_a = req.body) !== null && _a !== void 0 ? _a : {};
         if (!url || typeof url !== 'string') {
             return res.status(400).json({ error: 'url is required' });
         }
+        if (event !== undefined && !(0, webhookEvents_1.isEventType)(event)) {
+            return res.status(400).json({ error: `event must be one of: ${webhookEvents_1.EVENT_TYPES.join(', ')}` });
+        }
         try {
-            yield typedi_1.Container.get(NotificationService_1.NotificationService).sendTest(url, type || 'slack', payloadTemplate);
+            yield typedi_1.Container.get(NotificationService_1.NotificationService).sendTest(url, type || 'slack', payloadTemplate, event);
             res.json({ success: true });
         }
         catch (err) {

package/lib/src/app/swagger.js

@@ -75,6 +75,8 @@ Appium's WebDriver API (\`POST /session\` and the session's commands, under Appi
 - \`accessKey\` and \`token\`;
 - \`sessionToken\`, minted by \`POST /api/auth/token\`.
 
+Either names the session's owner only while that user exists and is active, and a session token needs the \`sessions\` scope, as a key does. A key or token that doesn't check out counts as none: with \`XENON_REQUIRE_SESSION_TOKEN\` the session is refused, without it the session runs with no owner.
+
 A leased device also takes \`leaseId\` and \`leaseToken\`, which the lease's \`appiumCapabilities\` already carry. Xenon removes these credentials before the driver or any stored record sees them.
 
 ## Live streams

package/lib/src/app/ws/h264StreamWs.js

@@ -12,6 +12,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.STREAM_ENDED = void 0;
 exports.encodeWsFrame = encodeWsFrame;
 exports.parseH264WsPath = parseH264WsPath;
 exports.attachH264Ws = attachH264Ws;
@@ -29,6 +30,12 @@ const nodeSocketRelay_1 = require("./nodeSocketRelay");
  * so it is not put on the wire).
  */
 const TYPE_CODE = { config: 0, key: 1, delta: 2 };
+/**
+ * The close code for a stream whose capture stopped under its viewer, as the
+ * logcat socket uses it for an upstream that died. The player then shows MJPEG
+ * without asking stream/start: there is no H.264 capture left to end.
+ */
+exports.STREAM_ENDED = 1012;
 function encodeWsFrame(p) {
     return Buffer.concat([Buffer.from([TYPE_CODE[p.type]]), p.data]);
 }
@@ -139,7 +146,9 @@ function attachH264Ws(server, deps) {
                 if (p.type === 'delta' && ws.bufferedAmount > maxBuffered)
                     return;
                 ws.send(encodeWsFrame(p));
-            });
+            }, 
+            // The capture stopped under this viewer (a recording, a stream/stop).
+            () => ws.close(exports.STREAM_ENDED, 'stream ended'));
             logger_1.default.info(`[${parsed.udid}] H.264 WS client connected`);
         }));
     }

package/lib/src/config.js

@@ -32,14 +32,20 @@ var __importStar = (this && this.__importStar) || (function () {
         return result;
     };
 })();
-var _a;
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.config = void 0;
+exports.config = exports.DEFAULT_MAX_CONCURRENT_RECORDINGS = void 0;
 exports.updateConfig = updateConfig;
 exports.resolveAuthDisabled = resolveAuthDisabled;
+exports.resolveMaxConcurrentRecordings = resolveMaxConcurrentRecordings;
+exports.resolveRecordingsAssetsPath = resolveRecordingsAssetsPath;
+exports.recordingConfigFrom = recordingConfigFrom;
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const basePath = path.join(os.homedir(), '.cache', 'xenon');
+/** Where free-form recordings go unless the option or the environment says otherwise. */
+const DEFAULT_RECORDINGS_ASSETS_PATH = path.join(basePath, 'assets', 'sessions', 'recordings');
+/** The server-wide cap on simultaneous free-form recordings, unless set. */
+exports.DEFAULT_MAX_CONCURRENT_RECORDINGS = 4;
 exports.config = {
     cacheDir: basePath,
     databaseProvider: process.env.XENON_DB_PROVIDER || 'sqlite',
@@ -81,15 +87,15 @@ exports.config = {
     userSessionTtlMs: Number(process.env.XENON_USER_SESSION_TTL_MS) || 24 * 60 * 60 * 1000,
     smtpUrl: process.env.XENON_SMTP_URL,
     smtpFrom: process.env.XENON_SMTP_FROM,
+    publicUrl: process.env.XENON_PUBLIC_URL,
     resetTokenTtlMs: Number(process.env.XENON_RESET_TOKEN_TTL_MS) || 60 * 60 * 1000,
     // Opt-in since 1.20.7: it writes the raw reset link (a credential) to the
     // server log. Without SMTP, admins issue links from the Users page instead.
     passwordResetLogFallback: process.env.XENON_PASSWORD_RESET_LOG_FALLBACK === 'true',
     resetRateLimitAttempts: Number(process.env.XENON_RESET_RATE_LIMIT_ATTEMPTS) || 3,
     resetRateLimitWindowMs: Number(process.env.XENON_RESET_RATE_LIMIT_WINDOW_MS) || 15 * 60 * 1000,
-    recordingsAssetsPath: process.env.XENON_RECORDINGS_ASSETS_PATH ||
-        path.join(basePath, 'assets', 'sessions', 'recordings'),
-    maxConcurrentRecordings: Number((_a = process.env.XENON_MAX_CONCURRENT_RECORDINGS) !== null && _a !== void 0 ? _a : 4),
+    recordingsAssetsPath: resolveRecordingsAssetsPath(undefined, process.env.XENON_RECORDINGS_ASSETS_PATH),
+    maxConcurrentRecordings: resolveMaxConcurrentRecordings(undefined, process.env.XENON_MAX_CONCURRENT_RECORDINGS),
 };
 function updateConfig(newConfig) {
     Object.assign(exports.config, newConfig);
@@ -113,3 +119,43 @@ function updateConfig(newConfig) {
 function resolveAuthDisabled(pluginArgValue, envDisabled) {
     return pluginArgValue === true || envDisabled === true;
 }
+function wholeNumberAtLeastOne(value) {
+    return typeof value === 'number' && Number.isInteger(value) && value >= 1 ? value : undefined;
+}
+function nonBlankString(value) {
+    return typeof value === 'string' && value.trim() !== '' ? value.trim() : undefined;
+}
+/**
+ * The cap on simultaneous free-form recordings: the `maxConcurrentRecordings`
+ * plugin option when it is set, else XENON_MAX_CONCURRENT_RECORDINGS, else 4.
+ * Both options are `schema.json` options Appium accepts, but only the variable
+ * was ever read. A value that is not a whole number of at least 1 is ignored,
+ * so the next source answers: the variable used to be taken as `Number(env)`,
+ * and `many` made that NaN, which no recording count exceeds (no cap at all).
+ * Pure, so the precedence is testable without booting a server.
+ */
+function resolveMaxConcurrentRecordings(optionValue, envValue) {
+    var _a, _b;
+    const fromEnv = (envValue === null || envValue === void 0 ? void 0 : envValue.trim()) ? Number(envValue) : undefined;
+    return ((_b = (_a = wholeNumberAtLeastOne(optionValue)) !== null && _a !== void 0 ? _a : wholeNumberAtLeastOne(fromEnv)) !== null && _b !== void 0 ? _b : exports.DEFAULT_MAX_CONCURRENT_RECORDINGS);
+}
+/**
+ * Where free-form recordings are stored: the `recordingsAssetsPath` plugin
+ * option when it is set, else XENON_RECORDINGS_ASSETS_PATH, else
+ * `~/.cache/xenon/assets/sessions/recordings`. A blank value counts as unset.
+ */
+function resolveRecordingsAssetsPath(optionValue, envValue) {
+    var _a, _b;
+    return (_b = (_a = nonBlankString(optionValue)) !== null && _a !== void 0 ? _a : nonBlankString(envValue)) !== null && _b !== void 0 ? _b : DEFAULT_RECORDINGS_ASSETS_PATH;
+}
+/**
+ * The part of `config` the recording plugin options set, from the options the
+ * server started with and the environment as it is now. Applied at boot,
+ * before the artifact store and the concurrency gate read them.
+ */
+function recordingConfigFrom(pluginArgs, env = process.env) {
+    return {
+        maxConcurrentRecordings: resolveMaxConcurrentRecordings(pluginArgs.maxConcurrentRecordings, env.XENON_MAX_CONCURRENT_RECORDINGS),
+        recordingsAssetsPath: resolveRecordingsAssetsPath(pluginArgs.recordingsAssetsPath, env.XENON_RECORDINGS_ASSETS_PATH),
+    };
+}