@xenon-device-management/xenon 2.15.0 → 2.17.0

package/lib/src/services/TracingService.js

@@ -38,6 +38,15 @@ var __importStar = (this && this.__importStar) || (function () {
         return result;
     };
 })();
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.TracingService = void 0;
 const api_1 = require("@opentelemetry/api");
@@ -53,15 +62,32 @@ const resources_1 = require("@opentelemetry/resources");
 const semantic_conventions_1 = require("@opentelemetry/semantic-conventions");
 const typedi_1 = require("typedi");
 const logger_1 = __importStar(require("../logger"));
+/** Why a session's span ended, on the span. */
+const SESSION_STOP_REASON = 'xenon.session.stop_reason';
+function failSpan(span, error) {
+    var _a;
+    const exception = error instanceof Error ? error : { message: String((_a = error === null || error === void 0 ? void 0 : error.message) !== null && _a !== void 0 ? _a : error) };
+    span.recordException(exception);
+    span.setStatus({ code: api_1.SpanStatusCode.ERROR, message: exception.message });
+}
 let TracingService = class TracingService {
     constructor() {
         this.sdk = null;
+        // Built here only while tracing is off; with it on, the NodeSDK owns them.
         this.loggerProvider = null;
         this.meterProvider = null;
+        // Whether Xenon's own log export and metric export are configured.
+        this.logsOn = false;
+        this.metricsOn = false;
         this.tracer = api_1.trace.getTracer('xenon-core');
         this.activeSpans = new Map();
+        // Which of activeSpans are sessions' (keyed by session id) rather than
+        // commands' (`<sessionId>:<command>`).
+        this.sessionSpanIds = new Set();
+        this.spanProcessorsInUse = [];
     }
     initialize(opts = { isHub: true }) {
+        var _a;
         if (process.env.OTEL_SDK_DISABLED === 'true') {
             logger_1.default.info('[TracingService] OTEL_SDK_DISABLED=true — OTel disabled.');
             return;
@@ -71,14 +97,56 @@ let TracingService = class TracingService {
             [semantic_conventions_1.ATTR_SERVICE_NAME]: 'xenon',
             service: role,
         });
-        this.initTraces(resource);
-        this.initLogs(resource);
-        this.initMetrics(resource);
+        const spanProcessors = this.spanProcessors();
+        const logRecordProcessors = this.logRecordProcessors();
+        const metricReaders = this.metricReaders();
+        if (spanProcessors.length > 0) {
+            // A NodeSDK that isn't handed log processors and metric readers builds
+            // its own from the standard OTEL_* variables (OTLP exporters at
+            // OTEL_EXPORTER_OTLP_ENDPOINT + /v1/logs and /v1/metrics, which is
+            // Xenon's trace URL) and registers them globally before Xenon could, so
+            // Xenon's settings for logs and metrics did nothing while tracing was
+            // on. It gets Xenon's, or none. With none for logs it still registers
+            // a logger provider, one that exports nothing.
+            this.spanProcessorsInUse = spanProcessors;
+            this.sdk = new sdk_node_1.NodeSDK({
+                resource,
+                spanProcessors,
+                logRecordProcessors,
+                metricReaders,
+            });
+            try {
+                this.sdk.start();
+                logger_1.default.info('[TracingService] Trace SDK started.');
+            }
+            catch (err) {
+                logger_1.default.error(`[TracingService] Failed to start trace SDK: ${err.message}`);
+            }
+        }
+        else {
+            if (logRecordProcessors.length > 0) {
+                this.loggerProvider = new sdk_logs_1.LoggerProvider({ resource, processors: logRecordProcessors });
+                api_logs_1.logs.setGlobalLoggerProvider(this.loggerProvider);
+            }
+            if (metricReaders.length > 0) {
+                this.meterProvider = new sdk_metrics_1.MeterProvider({ resource, readers: metricReaders });
+                api_1.metrics.setGlobalMeterProvider(this.meterProvider);
+            }
+        }
+        if (logRecordProcessors.length > 0) {
+            this.logsOn = true;
+            logger_1.XenonLogger.setOtlpReady(true);
+            logger_1.default.info(`[TracingService] Log OTLP endpoint: ${process.env.OTEL_EXPORTER_OTLP_LOGS_ENDPOINT}. Log SDK started.`);
+        }
+        if (metricReaders.length > 0) {
+            this.metricsOn = true;
+            logger_1.default.info(`[TracingService] Metric OTLP endpoint: ${(_a = process.env.OTEL_EXPORTER_OTLP_METRICS_ENDPOINT) !== null && _a !== void 0 ? _a : '(console-only)'}. Metrics SDK started.`);
+        }
     }
-    initTraces(resource) {
+    spanProcessors() {
         if (process.env.OTEL_TRACES_ENABLED === 'false') {
             logger_1.default.info('[TracingService] OTEL_TRACES_ENABLED=false — trace export disabled.');
-            return;
+            return [];
         }
         const exporters = [];
         if (process.env.XENON_OTEL_DEBUG === 'true') {
@@ -93,52 +161,37 @@ let TracingService = class TracingService {
         }
         if (exporters.length === 0) {
             logger_1.default.info('[TracingService] No trace exporters configured. Spans recorded in-memory only.');
-            return;
+            return [];
         }
         // Pre-existing pre-PR-86 bug: only exporters[0] was wired, so combining
         // XENON_OTEL_DEBUG=true with an OTLP endpoint silently dropped one of the
         // two destinations. Each exporter now gets its own SimpleSpanProcessor.
-        const spanProcessors = exporters.map((e) => new sdk_trace_base_1.SimpleSpanProcessor(e));
-        this.sdk = new sdk_node_1.NodeSDK({
-            resource,
-            spanProcessors,
-        });
-        try {
-            this.sdk.start();
-            logger_1.default.info('[TracingService] Trace SDK started.');
-        }
-        catch (err) {
-            logger_1.default.error(`[TracingService] Failed to start trace SDK: ${err.message}`);
-        }
+        return exporters.map((e) => new sdk_trace_base_1.SimpleSpanProcessor(e));
     }
-    initLogs(resource) {
+    logRecordProcessors() {
         if (process.env.OTEL_LOGS_ENABLED === 'false') {
             logger_1.default.info('[TracingService] OTEL_LOGS_ENABLED=false — log export disabled.');
-            return;
+            return [];
         }
         const endpoint = process.env.OTEL_EXPORTER_OTLP_LOGS_ENDPOINT;
         if (!endpoint)
-            return;
+            return [];
         const processors = [];
         if (process.env.XENON_OTEL_DEBUG === 'true') {
             processors.push(new sdk_logs_1.SimpleLogRecordProcessor(new sdk_logs_1.ConsoleLogRecordExporter()));
         }
         processors.push(new sdk_logs_1.BatchLogRecordProcessor(new exporter_logs_otlp_http_1.OTLPLogExporter({ url: endpoint })));
-        const provider = new sdk_logs_1.LoggerProvider({ resource, processors });
-        api_logs_1.logs.setGlobalLoggerProvider(provider);
-        this.loggerProvider = provider;
-        logger_1.XenonLogger.setOtlpReady(true);
-        logger_1.default.info(`[TracingService] Log OTLP endpoint: ${endpoint}. Log SDK started.`);
+        return processors;
     }
-    initMetrics(resource) {
+    metricReaders() {
         if (process.env.OTEL_METRICS_ENABLED === 'false') {
             logger_1.default.info('[TracingService] OTEL_METRICS_ENABLED=false — metrics export disabled.');
-            return;
+            return [];
         }
         const endpoint = process.env.OTEL_EXPORTER_OTLP_METRICS_ENDPOINT;
         const debug = process.env.XENON_OTEL_DEBUG === 'true';
         if (!endpoint && !debug)
-            return;
+            return [];
         const readers = [];
         if (debug) {
             // 10s interval keeps console output readable during dev sessions.
@@ -154,18 +207,15 @@ let TracingService = class TracingService {
                 exportIntervalMillis: 60000,
             }));
         }
-        const provider = new sdk_metrics_1.MeterProvider({ resource, readers });
-        api_1.metrics.setGlobalMeterProvider(provider);
-        this.meterProvider = provider;
-        logger_1.default.info(`[TracingService] Metric OTLP endpoint: ${endpoint !== null && endpoint !== void 0 ? endpoint : '(console-only)'}. Metrics SDK started.`);
+        return readers;
     }
     getLogger(name = 'xenon-core') {
-        if (!this.loggerProvider)
+        if (!this.logsOn)
             return undefined;
         return api_logs_1.logs.getLogger(name);
     }
     getMeter(name = 'xenon-core') {
-        if (!this.meterProvider)
+        if (!this.metricsOn)
             return undefined;
         return api_1.metrics.getMeter(name);
     }
@@ -177,8 +227,18 @@ let TracingService = class TracingService {
             attributes: Object.assign({ 'xenon.session_id': sessionId }, attributes),
         });
         this.activeSpans.set(sessionId, span);
+        this.sessionSpanIds.add(sessionId);
         return span;
     }
+    /**
+     * Ends a session's span. Every way a session ends calls this (the client's
+     * delete, Appium's new-command timeout, the idle release, the heartbeat
+     * sweeps, a shutdown's drain), so whichever comes second finds nothing.
+     * `failed` for a session that ended failed; `reason` says why it ended.
+     */
+    endSessionSpan(sessionId, ending = {}) {
+        this.endSpan(sessionId, ending.failed ? 'ERROR' : 'OK', ending.reason ? { [SESSION_STOP_REASON]: ending.reason } : {});
+    }
     startCommandSpan(sessionId, commandName, attributes = {}) {
         if (!this.sdk)
             return undefined;
@@ -202,28 +262,34 @@ let TracingService = class TracingService {
         if (!this.sdk)
             return;
         const span = this.activeSpans.get(id);
-        if (span) {
-            if (Object.keys(attributes).length > 0) {
-                span.setAttributes(attributes);
-            }
-            span.setStatus({
-                code: status === 'OK' ? api_1.SpanStatusCode.OK : api_1.SpanStatusCode.ERROR,
-            });
-            span.end();
-            this.activeSpans.delete(id);
-        }
-    }
-    recordError(id, error) {
-        if (!this.sdk)
+        if (!span)
             return;
-        const span = this.activeSpans.get(id);
-        if (span) {
-            span.recordException(error);
-            span.setStatus({
-                code: api_1.SpanStatusCode.ERROR,
-                message: typeof error === 'string' ? error : error.message,
-            });
+        this.activeSpans.delete(id);
+        this.sessionSpanIds.delete(id);
+        if (Object.keys(attributes).length > 0) {
+            span.setAttributes(attributes);
         }
+        span.setStatus({
+            code: status === 'OK' ? api_1.SpanStatusCode.OK : api_1.SpanStatusCode.ERROR,
+        });
+        span.end();
+    }
+    /**
+     * Ends the span a command started: ERROR with the exception when it
+     * `failed`, else OK. By the span itself, not by its id: two commands of the
+     * same name on one session at once (the Inspector reading the page source
+     * while a test does) share `<sessionId>:<command>`, and the second's span
+     * replaced the first's under it, so one command's error went on the other's
+     * span and its own never ended.
+     */
+    endCommandSpan(id, span, failed) {
+        if (failed)
+            failSpan(span, failed.error);
+        else
+            span.setStatus({ code: api_1.SpanStatusCode.OK });
+        span.end();
+        if (this.activeSpans.get(id) === span)
+            this.activeSpans.delete(id);
     }
     getTraceId(sessionId) {
         var _a;
@@ -233,12 +299,57 @@ let TracingService = class TracingService {
         var _a;
         return (_a = this.activeSpans.get(id)) === null || _a === void 0 ? void 0 : _a.spanContext().spanId;
     }
+    /**
+     * shutdown(), waiting no longer than `budgetMs`: an export to a collector
+     * that doesn't answer is held for the exporter's own timeout (10 s), and a
+     * process that is exiting can't wait that long.
+     */
+    shutdownWithin(budgetMs) {
+        return __awaiter(this, void 0, void 0, function* () {
+            let timer;
+            try {
+                yield Promise.race([
+                    this.shutdown(),
+                    new Promise((resolve) => {
+                        timer = setTimeout(resolve, budgetMs);
+                    }),
+                ]);
+            }
+            finally {
+                if (timer)
+                    clearTimeout(timer);
+            }
+        });
+    }
+    /**
+     * Stops every exporter, once what each still holds is sent. A session span
+     * still open belongs to a session this process didn't end: one running on a
+     * node or at a cloud provider, which a hub's shutdown leaves running, or one
+     * whose ending was missed. It ends here, saying so, or it is never exported.
+     */
     shutdown() {
-        var _a, _b, _c;
-        (_a = this.sdk) === null || _a === void 0 ? void 0 : _a.shutdown();
-        logger_1.XenonLogger.setOtlpReady(false);
-        (_b = this.loggerProvider) === null || _b === void 0 ? void 0 : _b.shutdown();
-        (_c = this.meterProvider) === null || _c === void 0 ? void 0 : _c.shutdown();
+        return __awaiter(this, void 0, void 0, function* () {
+            for (const sessionId of [...this.sessionSpanIds]) {
+                const span = this.activeSpans.get(sessionId);
+                this.activeSpans.delete(sessionId);
+                span === null || span === void 0 ? void 0 : span.setAttribute(SESSION_STOP_REASON, 'Xenon shut down while the session was running');
+                span === null || span === void 0 ? void 0 : span.end();
+            }
+            this.sessionSpanIds.clear();
+            // A span processor's shutdown doesn't wait for the exports it started,
+            // and with the NodeSDK's resource detection every export waits on it.
+            yield Promise.allSettled(this.spanProcessorsInUse.map((p) => p.forceFlush()));
+            this.spanProcessorsInUse = [];
+            logger_1.XenonLogger.setOtlpReady(false);
+            const stopping = [this.sdk, this.loggerProvider, this.meterProvider].map((owner) => owner === null || owner === void 0 ? void 0 : owner.shutdown());
+            this.sdk = null;
+            this.loggerProvider = null;
+            this.meterProvider = null;
+            this.logsOn = false;
+            this.metricsOn = false;
+            this.activeSpans.clear();
+            yield Promise.allSettled(stopping);
+        });
     }
 };
 exports.TracingService = TracingService;

package/lib/src/services/UserService.js

@@ -24,6 +24,7 @@ const bcrypt_1 = __importDefault(require("bcrypt"));
 const crypto_1 = __importDefault(require("crypto"));
 const logger_1 = __importDefault(require("../logger"));
 const prisma_1 = require("../prisma");
+const identityChanges_1 = require("./identity/identityChanges");
 const ACCESS_KEY_PREFIX = 'xen_';
 const ACCESS_KEY_LEN = 12;
 const PASSWORD_MIN = 8;
@@ -92,14 +93,18 @@ let UserService = class UserService {
             return prisma_1.prisma.user.findUnique({ where: { id } });
         });
     }
+    // The old access key's (accessKey, token) pairs stop working, a node's
+    // socket's included.
     rotateAccessKey(userId) {
         return __awaiter(this, void 0, void 0, function* () {
             const accessKey = this.generateAccessKey();
-            return prisma_1.prisma.user.update({
+            const updated = yield prisma_1.prisma.user.update({
                 where: { id: userId },
                 data: { accessKey },
                 select: { id: true, accessKey: true },
             });
+            yield (0, identityChanges_1.identityChanged)(userId);
+            return updated;
         });
     }
     changePassword(userId, oldPassword, newPassword) {
@@ -163,18 +168,23 @@ let UserService = class UserService {
                 data.role = patch.role;
             if (patch.status !== undefined)
                 data.status = patch.status;
-            return prisma_1.prisma.user.update({ where: { id: userId }, data });
+            const updated = yield prisma_1.prisma.user.update({ where: { id: userId }, data });
+            yield (0, identityChanges_1.identityChanged)(userId);
+            return updated;
         });
     }
     setRole(userId, role) {
         return __awaiter(this, void 0, void 0, function* () {
-            return prisma_1.prisma.user.update({ where: { id: userId }, data: { role } });
+            const updated = yield prisma_1.prisma.user.update({ where: { id: userId }, data: { role } });
+            yield (0, identityChanges_1.identityChanged)(userId);
+            return updated;
         });
     }
     deactivateUser(userId) {
         return __awaiter(this, void 0, void 0, function* () {
             yield prisma_1.prisma.user.update({ where: { id: userId }, data: { status: 'INACTIVE' } });
             yield prisma_1.prisma.userSession.deleteMany({ where: { userId } });
+            yield (0, identityChanges_1.identityChanged)(userId);
         });
     }
     deleteUser(userId) {
@@ -184,6 +194,7 @@ let UserService = class UserService {
             // relying on cascade semantics for security-critical cleanup.
             yield prisma_1.prisma.userSession.deleteMany({ where: { userId } });
             yield prisma_1.prisma.user.delete({ where: { id: userId } });
+            yield (0, identityChanges_1.identityChanged)(userId);
         });
     }
 };

package/lib/src/services/UserSessionService.js

@@ -22,6 +22,7 @@ exports.UserSessionService = void 0;
 const typedi_1 = require("typedi");
 const prisma_1 = require("../prisma");
 const logger_1 = __importDefault(require("../logger"));
+const identityChanges_1 = require("./identity/identityChanges");
 const DEFAULT_TTL_MS = 24 * 60 * 60 * 1000;
 let UserSessionService = class UserSessionService {
     constructor() {
@@ -38,13 +39,20 @@ let UserSessionService = class UserSessionService {
             });
         });
     }
-    resolve(sessionId) {
-        return __awaiter(this, void 0, void 0, function* () {
+    /**
+     * The sign-in, if it exists and hasn't expired. A use of it renews it
+     * (sliding TTL); `renew: false` only looks, for a check that isn't a use: a
+     * socket's re-check must not keep a sign-in alive for as long as a tab is open.
+     */
+    resolve(sessionId_1) {
+        return __awaiter(this, arguments, void 0, function* (sessionId, { renew = true } = {}) {
             const row = yield prisma_1.prisma.userSession.findUnique({ where: { id: sessionId } });
             if (!row)
                 return null;
             if (row.expiresAt.getTime() < Date.now())
                 return null;
+            if (!renew)
+                return row;
             const newExpiresAt = new Date(Date.now() + this.ttlMs());
             // Fire-and-forget sliding-TTL update; failures must not block auth, but
             // log them at debug level so chronic write issues are diagnosable.
@@ -62,13 +70,15 @@ let UserSessionService = class UserSessionService {
     // which is fine. Other errors get logged for diagnosis but don't bubble.
     revoke(sessionId) {
         return __awaiter(this, void 0, void 0, function* () {
-            yield prisma_1.prisma.userSession.delete({ where: { id: sessionId } }).catch((e) => {
+            const row = yield prisma_1.prisma.userSession.delete({ where: { id: sessionId } }).catch((e) => {
                 var _a;
                 const code = e === null || e === void 0 ? void 0 : e.code;
                 if (code === 'P2025')
-                    return;
+                    return null;
                 this.log.warn(`revoke: unexpected delete error for session ${sessionId}: ${(_a = e === null || e === void 0 ? void 0 : e.message) !== null && _a !== void 0 ? _a : e}`);
+                return null;
             });
+            yield (0, identityChanges_1.identityChanged)(row === null || row === void 0 ? void 0 : row.userId);
         });
     }
     revokeAllForUserExcept(userId, keepSessionId) {
@@ -78,6 +88,7 @@ let UserSessionService = class UserSessionService {
             });
             if (r.count > 0) {
                 this.log.info(`revoked ${r.count} sessions for user ${userId} (kept ${keepSessionId})`);
+                yield (0, identityChanges_1.identityChanged)(userId);
             }
             return r.count;
         });
@@ -87,6 +98,7 @@ let UserSessionService = class UserSessionService {
             const r = yield prisma_1.prisma.userSession.deleteMany({ where: { userId } });
             if (r.count > 0) {
                 this.log.info(`revoked all ${r.count} sessions for user ${userId}`);
+                yield (0, identityChanges_1.identityChanged)(userId);
             }
             return r.count;
         });

package/lib/src/services/healing/HealingOrchestrator.js

@@ -65,7 +65,9 @@ const isHealingTierList = (raw) => Array.isArray(raw) && raw.every((t) => Number
 // - not set (or null): every tier (undefined);
 // - a list of tier numbers 1 to 5: exactly those, and [] none;
 // - anything else ("1,2", ["1","2"], [1, 6], ...): LOCAL_HEALING_TIERS.
-// Through 2.14 anything else, and [], ran every tier, the AI ones included.
+// Through 2.14 [], or a value that wasn't a list or had no numbers in it, ran
+// every tier, the AI ones included; a list that held some numbers ran those
+// and skipped the rest ([1, 6] ran tier 1, [6] none).
 function coerceHealingTiersCap(raw) {
     if (raw === undefined || raw === null)
         return undefined;

package/lib/src/services/identity/identityChanges.js

@@ -0,0 +1,41 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.onIdentityChanged = onIdentityChanged;
+exports.identityChanged = identityChanged;
+const logger_1 = __importDefault(require("../../logger"));
+const listeners = new Set();
+/** Returns the function that stops listening. */
+function onIdentityChanged(listener) {
+    listeners.add(listener);
+    return () => {
+        listeners.delete(listener);
+    };
+}
+/** Never rejects: a listener's failure is logged and the write it follows stands. */
+function identityChanged(userId) {
+    return __awaiter(this, void 0, void 0, function* () {
+        if (!userId)
+            return;
+        yield Promise.all(Array.from(listeners, (listener) => __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            try {
+                yield listener(userId);
+            }
+            catch (err) {
+                logger_1.default.warn(`[Identity] A change to user ${userId} was not applied to a live connection: ${(_a = err === null || err === void 0 ? void 0 : err.message) !== null && _a !== void 0 ? _a : err}`);
+            }
+        })));
+    });
+}

package/lib/src/services/interceptor/CertManager.js

@@ -41,13 +41,19 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         step((generator = generator.apply(thisArg, _arguments || [])).next());
     });
 };
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CertManager = void 0;
+exports.caSerialNumber = caSerialNumber;
+exports.subjectHashOld = subjectHashOld;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
-const child_process_1 = require("child_process");
 const crypto_1 = require("crypto");
 const node_forge_1 = require("node-forge");
+const logger_1 = __importDefault(require("../../logger"));
+const logger = logger_1.default.scope('CertManager');
 class CertManager {
     constructor(dir) {
         this.dir = dir;
@@ -71,6 +77,12 @@ class CertManager {
             if (!fs.existsSync(this.certPath) || !fs.existsSync(this.keyPath)) {
                 this.generateCa();
             }
+            else if (!loadsInOpenSsl(this.certPath)) {
+                // Through 2.15 the serial had illegal leading zeros, so OpenSSL, Go and
+                // a phone's BoringSSL refused the CA. It never worked; make a new one.
+                logger.warn(`Replacing the interceptor CA at ${this.certPath}: it can't be loaded`);
+                this.generateCa();
+            }
             const subjectHash = this.computeAndroidHash(this.certPath);
             return { certPath: this.certPath, keyPath: this.keyPath, subjectHash };
         });
@@ -83,7 +95,7 @@ class CertManager {
         const keys = node_forge_1.pki.rsa.generateKeyPair(2048);
         const cert = node_forge_1.pki.createCertificate();
         cert.publicKey = keys.publicKey;
-        cert.serialNumber = Date.now().toString(16).padStart(16, '0');
+        cert.serialNumber = caSerialNumber();
         const now = new Date();
         cert.validity.notBefore = new Date(now.getTime() - 24 * 60 * 60 * 1000);
         cert.validity.notAfter = new Date(now.getTime() + 10 * 365 * 24 * 60 * 60 * 1000);
@@ -112,20 +124,42 @@ class CertManager {
         fs.writeFileSync(this.publicKeyPath, node_forge_1.pki.publicKeyToPem(keys.publicKey), 'utf8');
     }
     computeAndroidHash(certPath) {
-        try {
-            const out = (0, child_process_1.execSync)(`openssl x509 -inform PEM -subject_hash_old -noout -in "${certPath}"`, {
-                encoding: 'utf8',
-                timeout: 5000,
-                stdio: ['ignore', 'pipe', 'ignore'],
-            }).trim();
-            if (/^[0-9a-f]{8}$/.test(out))
-                return out;
-        }
-        catch (e) {
-            /* openssl unavailable — fall through */
-        }
-        const pem = fs.readFileSync(certPath, 'utf8');
-        return (0, crypto_1.createHash)('sha1').update(pem).digest('hex').slice(0, 8);
+        return subjectHashOld(fs.readFileSync(certPath, 'utf8'));
     }
 }
 exports.CertManager = CertManager;
+/**
+ * 16 random bytes, positive and minimally encoded as DER wants: the first
+ * byte is 0x01..0x7f (no leading zero, no sign bit), as node-forge writes the
+ * hex as the INTEGER's bytes unchanged.
+ */
+function caSerialNumber() {
+    const bytes = (0, crypto_1.randomBytes)(16);
+    bytes[0] = bytes[0] & 0x7f || 0x01;
+    return bytes.toString('hex');
+}
+function loadsInOpenSsl(certPath) {
+    try {
+        new crypto_1.X509Certificate(fs.readFileSync(certPath));
+        return true;
+    }
+    catch (_a) {
+        return false;
+    }
+}
+/**
+ * OpenSSL's `x509 -subject_hash_old`, the name Android files a system CA
+ * under: MD5 of the subject's DER as the certificate holds it, the first four
+ * bytes read little-endian.
+ */
+function subjectHashOld(pem) {
+    const der = node_forge_1.pki.pemToDer(pem).getBytes();
+    const tbs = node_forge_1.asn1.fromDer(der).value[0];
+    const fields = tbs.value;
+    const hasVersion = fields[0].tagClass === node_forge_1.asn1.Class.CONTEXT_SPECIFIC;
+    const subject = fields[hasVersion ? 5 : 4];
+    const digest = (0, crypto_1.createHash)('md5')
+        .update(Buffer.from(node_forge_1.asn1.toDer(subject).getBytes(), 'binary'))
+        .digest();
+    return digest.readUInt32LE(0).toString(16).padStart(8, '0');
+}