@openenthrium/oe-runtime-sdk 1.7.5

package/src/routes/connectors.js

@@ -0,0 +1,435 @@
+const router = require("express").Router();
+const { authenticate, requireAdmin, requireManagerOrAdmin } = require("../middleware/auth");
+const { canAddConnector, getTierFromDB } = require("../utils/tier");
+const { logActivity }                = require("../utils/activityLog");
+
+const SUPPORTED_TYPES = [
+  "postgresql", "mysql", "mssql", "oracle", "mongodb",
+  "redis", "sqlite", "snowflake", "bigquery", "cockroachdb", "elasticsearch",
+  "rest-api", "gmail", "slack", "jira", "confluence", "notion", "hubspot",
+  "freshdesk", "zendesk", "github", "zoho-mail", "gdrive", "ssh",
+  "onedrive", "dropbox", "box",
+  // Search
+  "perplexity-search", "google-search", "bing-search",
+  // OCR
+  "azure-vision", "google-vision", "aws-textract", "tesseract-ocr",
+  // Image generation
+  "openai-image", "flux", "stable-diffusion", "ideogram",
+  // Speech & audio
+  "elevenlabs", "openai-tts", "azure-speech", "google-tts",
+  // Video generation
+  "runway", "kling", "pika",
+  // Music generation
+  "suno", "udio",
+];
+
+function generateSlug(name) {
+  return (name || "").toLowerCase().replace(/[^a-z0-9]/g, "") || "connector";
+}
+
+// Public-to-all-authenticated: connector type catalog (needed by workspace users too)
+router.get("/connection-masters", authenticate, async (req, res) => {
+  try {
+    const { implementedTypes } = require("../utils/tools/registry");
+    const masters = await req.db.connectionMaster.findMany({
+      orderBy: [{ category: "asc" }, { label: "asc" }],
+    });
+    res.json({ masters: masters.map(m => ({ ...m, implemented: implementedTypes.has(m.key) })) });
+  } catch (err) {
+    res.status(500).json({ error: err.message });
+  }
+});
+
+router.use(authenticate, requireManagerOrAdmin);
+
+const SENSITIVE_AUTH_KEYS = new Set([
+  "password", "privateKey", "apiToken", "apiKey", "botToken", "appPassword",
+  "bearerToken", "integrationToken", "privateAppToken", "personalAccessToken",
+  "keyFileJson", "refreshToken", "accessToken", "clientSecret",
+]);
+
+// List connectors for a workspace
+router.get("/workspaces/:workspaceId/connectors", async (req, res) => {
+  try {
+    const workspaceId = parseInt(req.params.workspaceId);
+    const [connectors, totalConnectors, tier] = await Promise.all([
+      req.db.connector.findMany({
+        where:   { workspaceId },
+        orderBy: { createdAt: "asc" },
+        select:  { id: true, name: true, slug: true, type: true, config: true, authConfig: true, status: true, lastTestedAt: true, createdAt: true }
+      }),
+      req.db.connector.count(),
+      getTierFromDB(req.db),
+    ]);
+    // Return non-sensitive auth fields (host, port, username, email, etc.) for edit pre-fill
+    const sanitized = connectors.map(({ authConfig, ...c }) => {
+      const auth = authConfig ? JSON.parse(authConfig) : {};
+      const publicAuth = Object.fromEntries(Object.entries(auth).filter(([k]) => !SENSITIVE_AUTH_KEYS.has(k)));
+      return { ...c, publicAuth };        // slug is already in ...c
+    });
+    res.json({ connectors: sanitized, totalConnectors, tier: { maxConnectors: isFinite(tier.maxConnectors) ? tier.maxConnectors : null } });
+  } catch (err) {
+    console.error("[connectors] GET failed:", err.message);
+    res.status(500).json({ error: err.message });
+  }
+});
+
+// Check slug availability (legacy — kept for backward compat)
+router.get("/connectors/check-slug", async (req, res) => {
+  const { slug, excludeId } = req.query;
+  if (!slug) return res.json({ available: false });
+  const clean = slug.toLowerCase().replace(/[^a-z0-9]/g, "");
+  if (!clean) return res.json({ available: false });
+  const existing = await req.db.connector.findUnique({ where: { slug: clean }, select: { id: true } });
+  const available = !existing || (excludeId && existing.id === parseInt(excludeId));
+  res.json({ available });
+});
+
+// Check name availability (globally unique across all workspaces)
+router.get("/connectors/check-name", async (req, res) => {
+  const { name, excludeId } = req.query;
+  const clean = name?.trim();
+  if (!clean) return res.json({ available: false, suggestion: null });
+  const existing = await req.db.connector.findFirst({ where: { name: clean }, select: { id: true } });
+  const available = !existing || (excludeId && existing.id === parseInt(excludeId));
+  let suggestion = null;
+  if (!available) {
+    let suffix = 1;
+    while (await req.db.connector.findFirst({ where: { name: `${clean}-${suffix}` } })) suffix++;
+    suggestion = `${clean}-${suffix}`;
+  }
+  res.json({ available, suggestion });
+});
+
+// Create connector
+router.post("/workspaces/:workspaceId/connectors", async (req, res) => {
+  const workspaceId = parseInt(req.params.workspaceId);
+  const { name, slug: providedSlug, type, config, authConfig } = req.body;
+
+  if (!name?.trim()) return res.status(400).json({ error: "Name required" });
+  let typeIsValid = SUPPORTED_TYPES.includes(type);
+  if (!typeIsValid) {
+    const master = await req.db.connectionMaster.findUnique({ where: { key: type }, select: { fields: true } });
+    typeIsValid = !!master?.fields;
+  }
+  if (!typeIsValid) return res.status(400).json({ error: `Unsupported connector type: ${type}` });
+
+  const existing = await req.db.connector.count();
+  if (!await canAddConnector(existing, req.db)) {
+    const tier = await getTierFromDB(req.db);
+    return res.status(403).json({ error: `Tier limit reached. Max ${tier.maxConnectors} connector(s) allowed across the instance.` });
+  }
+
+  // Auto-suffix name to keep it globally unique (mysql → mysql-1 → mysql-2 …)
+  let finalName = name.trim();
+  const baseName = finalName;
+  let nameSuffix = 1;
+  while (await req.db.connector.findFirst({ where: { name: finalName } })) {
+    finalName = `${baseName}-${nameSuffix++}`;
+  }
+  const slug = finalName; // slug mirrors name
+
+  const connector = await req.db.connector.create({
+    data: {
+      workspaceId,
+      name:       finalName,
+      slug,
+      type,
+      config:     config     ? JSON.stringify(config)     : null,
+      authConfig: authConfig ? JSON.stringify(authConfig) : null,
+      status:     "active",
+    },
+    select: { id: true, name: true, slug: true, type: true, config: true, status: true, createdAt: true }
+  });
+
+  await logActivity(req.db, req.user, "connector.created", { workspaceId, name: connector.name, type });
+  res.json({ connector });
+});
+
+// Update connector
+router.put("/workspaces/:workspaceId/connectors/:id", async (req, res) => {
+  try {
+    const id = parseInt(req.params.id);
+    const { name, slug, config, authConfig, status } = req.body;
+    const data = {};
+    if (name   !== undefined) data.name   = name.trim();
+    if (slug   !== undefined) data.slug   = slug ? slug.toLowerCase().replace(/[^a-z0-9]/g, "") || null : null;
+    if (config !== undefined) data.config = config ? JSON.stringify(config) : null;
+    if (status !== undefined) data.status = status;
+
+    if (authConfig !== undefined) {
+      if (!authConfig) {
+        data.authConfig = null;
+      } else {
+        // Merge with existing: blank fields in the edit form mean "keep existing"
+        const existing = await req.db.connector.findUnique({ where: { id }, select: { authConfig: true } });
+        const existingAuth = existing?.authConfig ? JSON.parse(existing.authConfig) : {};
+        const merged = { ...existingAuth };
+        for (const [k, v] of Object.entries(authConfig)) {
+          if (v !== "" && v !== null && v !== undefined) merged[k] = v;
+        }
+        data.authConfig = JSON.stringify(merged);
+      }
+    }
+
+    const connector = await req.db.connector.update({
+      where:  { id },
+      data,
+      select: { id: true, name: true, slug: true, type: true, config: true, status: true, lastTestedAt: true }
+    });
+    res.json({ connector });
+  } catch (err) {
+    if (err.code === "P2002") {
+      return res.status(400).json({ error: "Slug is already in use by another connector. Choose a different slug." });
+    }
+    console.error("[connectors] PUT failed:", err.message);
+    res.status(500).json({ error: err.message });
+  }
+});
+
+// Test connector connection
+router.post("/workspaces/:workspaceId/connectors/:id/test", async (req, res) => {
+  const id        = parseInt(req.params.id);
+  const connector = await req.db.connector.findUnique({ where: { id } });
+  if (!connector) return res.status(404).json({ error: "Connector not found" });
+
+  const cfg  = connector.config     ? JSON.parse(connector.config)     : {};
+  const auth = connector.authConfig ? JSON.parse(connector.authConfig) : {};
+
+  let success = false;
+  let message = "";
+
+  try {
+    if (connector.type === "postgresql") {
+      const { Pool } = require("pg");
+      const pool = new Pool({
+        connectionString: cfg.url || undefined,
+        host:     cfg.host || "localhost",
+        port:     parseInt(cfg.port || "5432"),
+        database: cfg.database || undefined,
+        user:     auth.username || undefined,
+        password: auth.password || undefined,
+        ssl:      cfg.ssl ? { rejectUnauthorized: false } : false,
+        connectionTimeoutMillis: 8000,
+      });
+      await pool.query("SELECT 1");
+      await pool.end();
+      success = true; message = "Connected successfully.";
+    } else if (connector.type === "mysql") {
+      const mysql = require("mysql2/promise");
+      const TIMEOUT_MS = 8000;
+      const connPromise = mysql.createConnection({
+        host:           cfg.host     || "localhost",
+        port:           parseInt(cfg.port || "3306"),
+        database:       cfg.database || undefined,
+        user:           auth.username || undefined,
+        password:       auth.password || undefined,
+        connectTimeout: TIMEOUT_MS,
+      });
+      const timeoutPromise = new Promise((_, reject) =>
+        setTimeout(() => reject(new Error("Connection timed out")), TIMEOUT_MS)
+      );
+      const conn = await Promise.race([connPromise, timeoutPromise]);
+      await conn.ping();
+      await conn.execute("SELECT 1");
+      await conn.end();
+      success = true; message = "Connected successfully.";
+    } else if (connector.type === "mssql") {
+      const mssql = require("mssql");
+      const pool  = await mssql.connect({
+        server:   cfg.host     || "localhost",
+        port:     parseInt(cfg.port || "1433"),
+        database: cfg.database || undefined,
+        user:     auth.username || undefined,
+        password: auth.password || undefined,
+        options: {
+          encrypt:                cfg.encrypt !== false,
+          trustServerCertificate: cfg.trustServerCertificate || false,
+        },
+        connectionTimeout: 8000,
+        requestTimeout:    8000,
+      });
+      await pool.request().query("SELECT 1 AS ok");
+      await pool.close();
+      success = true; message = "Connected successfully.";
+    } else if (connector.type === "oracle") {
+      const oracledb = require("oracledb");
+      const connectString = cfg.connectString ||
+        `${cfg.host || "localhost"}:${cfg.port || "1521"}/${cfg.serviceName || cfg.sid || "ORCL"}`;
+      const conn = await oracledb.getConnection({
+        user: auth.username || undefined, password: auth.password || undefined, connectString,
+      });
+      await conn.execute("SELECT 1 FROM DUAL");
+      await conn.close();
+      success = true; message = "Connected successfully.";
+    } else if (connector.type === "mongodb") {
+      const { MongoClient } = require("mongodb");
+      const { buildUri } = require("../utils/tools/adapters/mongodb");
+      const uri    = buildUri(cfg, auth);
+      const client = new MongoClient(uri, { serverSelectionTimeoutMS: 8000, connectTimeoutMS: 8000 });
+      await client.connect();
+      await client.db(cfg.database || "admin").command({ ping: 1 });
+      await client.close();
+      success = true; message = "Connected successfully.";
+    } else if (connector.type === "gmail") {
+      const { google }  = require("googleapis");
+      const { makeOAuth2Client } = require("../utils/tools/adapters/gmail");
+      if (!auth.refreshToken) throw new Error("Not connected — please reconnect via the Integrations tab.");
+      const oauth2 = await makeOAuth2Client(req.db);
+      oauth2.setCredentials({ access_token: auth.accessToken, refresh_token: auth.refreshToken, expiry_date: auth.expiresAt });
+      const gmail = google.gmail({ version: "v1", auth: oauth2 });
+      const profile = await gmail.users.getProfile({ userId: "me" });
+      success = true; message = `Connected as ${profile.data.emailAddress}`;
+    } else if (connector.type === "gdrive") {
+      const { google }  = require("googleapis");
+      const { makeOAuth2Client } = require("../utils/tools/adapters/gmail");
+      if (!auth.refreshToken) throw new Error("Not connected — please reconnect via the Integrations tab.");
+      const oauth2 = await makeOAuth2Client(req.db, connector.workspaceId);
+      oauth2.setCredentials({ access_token: auth.accessToken, refresh_token: auth.refreshToken, expiry_date: auth.expiresAt });
+      const drive = google.drive({ version: "v3", auth: oauth2 });
+      const res = await drive.about.get({ fields: "user" });
+      success = true; message = `Connected as ${res.data.user.emailAddress}`;
+    } else if (["slack","jira","confluence","notion","hubspot","freshdesk","zendesk","github"].includes(connector.type)) {
+      const { ADAPTERS } = require("../utils/tools/registry");
+      const adapter = ADAPTERS[connector.type];
+      const ok = await adapter.testConnection(auth);
+      if (!ok) throw new Error("Connection test failed — check your credentials.");
+      success = true; message = "Connected successfully.";
+    } else if (connector.type === "zoho-mail") {
+      const nodemailer = require("nodemailer");
+      const port = parseInt(auth.smtpPort || "465");
+      const transport = nodemailer.createTransport({
+        host:   auth.smtpHost || "smtp.zoho.com",
+        port,
+        secure: port === 465,
+        auth: { user: auth.email, pass: auth.appPassword },
+        connectionTimeout: 8000,
+      });
+      await transport.verify();
+      success = true; message = `Connected as ${auth.email}`;
+    } else if (connector.type === "ssh") {
+      const { Client } = require("ssh2");
+      await new Promise((resolve, reject) => {
+        const conn = new Client();
+        const timer = setTimeout(() => { conn.end(); reject(new Error("Connection timed out")); }, 10000);
+        conn.on("ready", () => { clearTimeout(timer); conn.end(); resolve(); });
+        conn.on("error", err => { clearTimeout(timer); reject(err); });
+        const cfg2 = { host: auth.host || cfg.host, port: parseInt(auth.port || cfg.port || "22"), username: auth.username || cfg.username };
+        if (auth.privateKey || cfg.privateKey) cfg2.privateKey = auth.privateKey || cfg.privateKey;
+        conn.connect(cfg2);
+      });
+      success = true; message = `Connected to ${auth.host || cfg.host} as ${auth.username || cfg.username}`;
+    } else if (connector.type === "redis") {
+      const Redis = require("ioredis");
+      const client = new Redis({
+        host: cfg.host || "localhost",
+        port: parseInt(cfg.port || "6379"),
+        password: auth.password || undefined,
+        db: parseInt(cfg.db || "0"),
+        tls: cfg.tls ? {} : undefined,
+        connectTimeout: 8000,
+        lazyConnect: true,
+      });
+      await client.connect();
+      await client.ping();
+      await client.quit();
+      success = true; message = "Connected successfully.";
+    } else if (connector.type === "sqlite") {
+      const Database = require("better-sqlite3");
+      const db = new Database(cfg.filename || ":memory:", { timeout: 8000 });
+      db.prepare("SELECT 1").get();
+      db.close();
+      success = true; message = `Connected to ${cfg.filename || ":memory:"}`;
+    } else if (connector.type === "cockroachdb") {
+      const { Pool } = require("pg");
+      const pool = new Pool({
+        host:     cfg.host     || "localhost",
+        port:     parseInt(cfg.port || "26257"),
+        database: cfg.database || "defaultdb",
+        user:     auth.username || undefined,
+        password: auth.password || undefined,
+        ssl:      cfg.ssl ? { rejectUnauthorized: false } : false,
+        connectionTimeoutMillis: 8000,
+      });
+      await pool.query("SELECT 1");
+      await pool.end();
+      success = true; message = "Connected successfully.";
+    } else if (connector.type === "snowflake") {
+      const snowflake = require("snowflake-sdk");
+      await new Promise((resolve, reject) => {
+        const c = snowflake.createConnection({
+          account:   cfg.account,
+          username:  auth.username,
+          password:  auth.password,
+          database:  cfg.database,
+          schema:    cfg.schema   || "PUBLIC",
+          warehouse: cfg.warehouse,
+          role:      cfg.role     || undefined,
+        });
+        c.connect(err => {
+          if (err) { reject(err); return; }
+          c.execute({ sqlText: "SELECT 1", complete: (err2) => { c.destroy(() => {}); err2 ? reject(err2) : resolve(); } });
+        });
+      });
+      success = true; message = "Connected successfully.";
+    } else if (connector.type === "bigquery") {
+      const { BigQuery } = require("@google-cloud/bigquery");
+      const credentials = auth.keyFileJson ? JSON.parse(auth.keyFileJson) : undefined;
+      const bq = new BigQuery({ projectId: cfg.projectId, credentials });
+      await bq.query({ query: "SELECT 1", timeoutMs: 8000 });
+      success = true; message = `Connected to project ${cfg.projectId}`;
+    } else if (connector.type === "elasticsearch") {
+      const { Client } = require("@elastic/elasticsearch");
+      const esAuth = auth.apiKey
+        ? { auth: { apiKey: auth.apiKey } }
+        : (auth.username ? { auth: { username: auth.username, password: auth.password || "" } } : {});
+      const esClient = new Client({ node: cfg.node || "http://localhost:9200", ...esAuth, requestTimeout: 8000 });
+      const info = await esClient.info();
+      await esClient.close();
+      success = true; message = `Connected — Elasticsearch ${info.version?.number || ""}`;
+    } else if (connector.type === "onedrive") {
+      if (!auth.refreshToken && !auth.accessToken) throw new Error("Not connected — complete OAuth flow first.");
+      const { data } = await require("axios").get("https://graph.microsoft.com/v1.0/me/drive", { headers: { Authorization: `Bearer ${auth.accessToken}` }, timeout: 8000 });
+      success = true; message = `Connected to OneDrive (${data.owner?.user?.displayName || data.driveType || "personal"})`;
+    } else if (connector.type === "dropbox") {
+      if (!auth.accessToken) throw new Error("Not connected — complete OAuth flow first.");
+      const { data } = await require("axios").post("https://api.dropboxapi.com/2/users/get_current_account", null, { headers: { Authorization: `Bearer ${auth.accessToken}` }, timeout: 8000 });
+      success = true; message = `Connected as ${data.email || data.name?.display_name || "Dropbox user"}`;
+    } else if (connector.type === "box") {
+      if (!auth.accessToken) throw new Error("Not connected — complete OAuth flow first.");
+      const { data } = await require("axios").get("https://api.box.com/2.0/users/me", { headers: { Authorization: `Bearer ${auth.accessToken}` }, timeout: 8000 });
+      success = true; message = `Connected as ${data.login || data.name || "Box user"}`;
+    } else if (connector.type === "rest-api") {
+      const axios = require("axios");
+      const baseUrl = (cfg.baseUrl || "").replace(/\/$/, "");
+      if (!baseUrl) throw new Error("Base URL not configured");
+      const headers = {};
+      if (auth.apiKey)      headers[auth.headerName || "X-API-Key"] = auth.apiKey;
+      if (auth.bearerToken) headers["Authorization"] = `Bearer ${auth.bearerToken}`;
+      await axios.get(baseUrl + (cfg.healthPath || "/"), { headers, timeout: 8000 });
+      success = true; message = "API reachable.";
+    }
+  } catch (err) {
+    message = err.message || err.errors?.[0]?.message || err.code || String(err) || "Connection failed";
+  }
+
+  await req.db.connector.update({
+    where: { id },
+    data:  { status: success ? "active" : "error", lastTestedAt: new Date() }
+  });
+
+  res.json({ success, message });
+});
+
+// Delete connector
+router.delete("/workspaces/:workspaceId/connectors/:id", async (req, res) => {
+  const id        = parseInt(req.params.id);
+  const connector = await req.db.connector.findUnique({ where: { id }, select: { name: true, type: true } });
+  if (!connector) return res.status(404).json({ error: "Not found" });
+  await req.db.connector.delete({ where: { id } });
+  await logActivity(req.db, req.user, "connector.deleted", { name: connector.name, type: connector.type });
+  res.json({ success: true });
+});
+
+
+module.exports = router;

package/src/routes/dashboard.js

@@ -0,0 +1,244 @@
+const router = require("express").Router();
+const { authenticate, requireCommercial } = require("../middleware/auth");
+const { getTierFromDB, getAgentRunsThisMonth } = require("../utils/tier");
+
+const EMBEDDING_RATES = {
+  "text-embedding-3-small": 0.02  / 1_000_000,
+  "text-embedding-3-large": 0.13  / 1_000_000,
+  "text-embedding-ada-002": 0.10  / 1_000_000,
+};
+
+const LLM_RATES = {
+  "gpt-4o":                     { in: 2.50  / 1e6, out: 10.00 / 1e6 },
+  "gpt-4o-mini":                { in: 0.15  / 1e6, out:  0.60 / 1e6 },
+  "gpt-4-turbo":                { in: 10.00 / 1e6, out: 30.00 / 1e6 },
+  "claude-3-5-sonnet-20241022": { in: 3.00  / 1e6, out: 15.00 / 1e6 },
+  "claude-3-5-haiku-20241022":  { in: 0.80  / 1e6, out:  4.00 / 1e6 },
+  "claude-3-opus-20240229":     { in: 15.00 / 1e6, out: 75.00 / 1e6 },
+  "claude-3-haiku-20240307":    { in: 0.25  / 1e6, out:  1.25 / 1e6 },
+};
+
+function calcEmbeddingCost(tokens, model) {
+  return (tokens || 0) * (EMBEDDING_RATES[model] || 0.10 / 1_000_000);
+}
+
+function calcLLMCost(inputTokens, outputTokens, model) {
+  const r = LLM_RATES[model] || { in: 2.50 / 1e6, out: 10.00 / 1e6 };
+  return (inputTokens || 0) * r.in + (outputTokens || 0) * r.out;
+}
+
+function last30Days() {
+  return Array.from({ length: 30 }, (_, i) => {
+    const d = new Date();
+    d.setDate(d.getDate() - (29 - i));
+    return d.toISOString().slice(0, 10);
+  });
+}
+
+function groupByDay(items, dateField) {
+  const map = {};
+  for (const item of items) {
+    const day = new Date(item[dateField]).toISOString().slice(0, 10);
+    map[day] = (map[day] || 0) + 1;
+  }
+  return last30Days().map(d => ({ date: d, count: map[d] || 0 }));
+}
+
+function statusSeries(counts) {
+  return [
+    { name: "Ready",   value: counts.ready   || 0, color: "#22c55e" },
+    { name: "Failed",  value: counts.failed  || 0, color: "#ef4444" },
+    { name: "Partial", value: counts.partial || 0, color: "#f59e0b" },
+    { name: "Active",  value: (counts.ingesting || 0) + (counts.queued || 0), color: "#6366f1" },
+  ].filter(s => s.value > 0);
+}
+
+// Manager stats — scoped to user's workspaces (admin sees all)
+router.get("/manager", authenticate, async (req, res) => {
+  const db = req.db;
+
+  let workspaceIds;
+  if (req.user.role === "admin") {
+    const all = await db.workspace.findMany({ select: { id: true } });
+    workspaceIds = all.map(w => w.id);
+  } else {
+    const memberships = await db.workspaceUser.findMany({
+      where: { userId: req.user.id },
+      select: { workspaceId: true }
+    });
+    workspaceIds = memberships.map(m => m.workspaceId);
+  }
+
+  const thirtyDaysAgo = new Date();
+  thirtyDaysAgo.setDate(thirtyDaysAgo.getDate() - 29);
+
+  const agentIds = (await db.agent.findMany({ where: { workspaceId: { in: workspaceIds } }, select: { id: true } })).map(a => a.id);
+
+  const [workspaces, documents, agentRuns] = await Promise.all([
+    db.workspace.findMany({
+      where: { id: { in: workspaceIds } },
+      include: { _count: { select: { documents: true, chats: true } } }
+    }),
+    db.document.findMany({
+      where: { workspaceId: { in: workspaceIds } },
+      select: { status: true, chunkCount: true, createdAt: true }
+    }),
+    agentIds.length ? db.agentRun.findMany({
+      where: { agentId: { in: agentIds }, startedAt: { gte: thirtyDaysAgo } },
+      select: { startedAt: true, status: true }
+    }) : Promise.resolve([]),
+  ]);
+
+  const statusCounts = {};
+  let totalVectors = 0;
+  for (const d of documents) {
+    statusCounts[d.status] = (statusCounts[d.status] || 0) + 1;
+    totalVectors += d.chunkCount || 0;
+  }
+
+  res.json({
+    workspaceCount:   workspaces.length,
+    documentCount:    documents.length,
+    vectorCount:      totalVectors,
+    activeIngestions: (statusCounts.ingesting || 0) + (statusCounts.queued || 0),
+    agentRunCount:    agentRuns.length,
+    agentRunSuccess:  agentRuns.filter(r => r.status === "success").length,
+    agentRunErrors:   agentRuns.filter(r => r.status === "error").length,
+    agentRunsByTrigger: [
+      { name: "Runs", value: agentRuns.length, color: "#6366f1" },
+    ].filter(s => s.value > 0),
+    documentsByStatus:  statusSeries(statusCounts),
+    agentRunActivity:   groupByDay(agentRuns, "startedAt"),
+    docsByWorkspace: workspaces
+      .map(ws => ({
+        name:      ws.name.length > 18 ? ws.name.slice(0, 18) + "…" : ws.name,
+        documents: ws._count.documents,
+        chats:     ws._count.chats,
+      }))
+      .sort((a, b) => b.documents - a.documents)
+      .slice(0, 8),
+    ingestActivity: groupByDay(
+      documents.filter(d => new Date(d.createdAt) >= thirtyDaysAgo),
+      "createdAt"
+    ),
+  });
+});
+
+// Admin stats — platform-wide
+router.get("/admin", authenticate, async (req, res) => {
+  if (req.user.role !== "admin") return res.status(403).json({ error: "Admin only" });
+  const db = req.db;
+
+  const thirtyDaysAgo = new Date();
+  thirtyDaysAgo.setDate(thirtyDaysAgo.getDate() - 29);
+
+  const tier = await getTierFromDB(db);
+
+  const [users, workspaces, documents, recentUserChats, allAssistantChats, agentRunsThisMonth, recentAgentRuns] = await Promise.all([
+    db.user.findMany({ select: { id: true, role: true, createdAt: true } }),
+    db.workspace.findMany({
+      select: { id: true, name: true, _count: { select: { documents: true, chats: true } } }
+    }),
+    db.document.findMany({
+      select: { status: true, chunkCount: true, embeddingTokens: true, embeddingModel: true, createdAt: true, size: true }
+    }),
+    db.chat.findMany({
+      where: { role: "user", createdAt: { gte: thirtyDaysAgo } },
+      select: { createdAt: true }
+    }),
+    db.chat.findMany({
+      where: { role: "assistant" },
+      select: { inputTokens: true, outputTokens: true, model: true }
+    }),
+    getAgentRunsThisMonth(db),
+    db.agentRun.findMany({
+      where: { startedAt: { gte: thirtyDaysAgo } },
+      select: { startedAt: true, status: true }
+    }),
+  ]);
+
+  // Document stats
+  const statusCounts = {};
+  let totalVectors = 0, totalEmbedTokens = 0, totalEmbedCost = 0, totalStorageBytes = 0;
+  for (const d of documents) {
+    statusCounts[d.status] = (statusCounts[d.status] || 0) + 1;
+    totalVectors     += d.chunkCount || 0;
+    totalEmbedTokens += d.embeddingTokens || 0;
+    totalEmbedCost   += calcEmbeddingCost(d.embeddingTokens, d.embeddingModel);
+    totalStorageBytes += d.size || 0;
+  }
+  const storageUsedGb = totalStorageBytes / (1024 ** 3);
+
+  // LLM stats
+  let llmInputTokens = 0, llmOutputTokens = 0, llmCost = 0;
+  for (const c of allAssistantChats) {
+    llmInputTokens  += c.inputTokens  || 0;
+    llmOutputTokens += c.outputTokens || 0;
+    llmCost         += calcLLMCost(c.inputTokens, c.outputTokens, c.model);
+  }
+
+  res.json({
+    // Summary counts
+    userCount:        users.length,
+    workspaceCount:   workspaces.length,
+    documentCount:    documents.length,
+    vectorCount:      totalVectors,
+    chatCount:        allAssistantChats.length,
+    activeIngestions: (statusCounts.ingesting || 0) + (statusCounts.queued || 0),
+    // Cost
+    embeddingTokens:  totalEmbedTokens,
+    embeddingCostUsd: totalEmbedCost,
+    llmInputTokens,
+    llmOutputTokens,
+    llmCostUsd:       llmCost,
+    totalCostUsd:     totalEmbedCost + llmCost,
+    // Charts
+    documentsByStatus: statusSeries(statusCounts),
+    usersByRole: [
+      { name: "Admin",   value: users.filter(u => u.role === "admin").length,   color: "#6366f1" },
+      { name: "Manager", value: users.filter(u => u.role === "manager").length, color: "#f59e0b" },
+      { name: "User",    value: users.filter(u => u.role === "user").length,    color: "#22c55e" },
+    ].filter(u => u.value > 0),
+    topWorkspaces: workspaces
+      .sort((a, b) => b._count.chats - a._count.chats)
+      .slice(0, 8)
+      .map(ws => ({
+        name:      ws.name.length > 16 ? ws.name.slice(0, 16) + "…" : ws.name,
+        chats:     ws._count.chats,
+        documents: ws._count.documents,
+      })),
+    // Usage vs limits — commercial only; null means unlimited (Infinity can't serialize to JSON)
+    usage: (process.env.LICENSE_TYPE === "enterprise" && process.env.LICENSE_EDITION === "Open Enthrium Commercial" && process.env.LICENSE_PRICE === "custom") ? {
+      tierName:             tier.name,
+      workspaceCount:       workspaces.length,
+      workspaceLimit:       isFinite(tier.maxWorkspaces)        ? tier.maxWorkspaces        : null,
+      userCount:            users.length,
+      userLimit:            isFinite(tier.maxUsers)             ? tier.maxUsers             : null,
+      connectorCount:       0,
+      connectorLimit:       null,
+      agentRunsThisMonth,
+      agentRunsLimit:       isFinite(tier.maxAgentRunsPerMonth) ? tier.maxAgentRunsPerMonth : null,
+      storageUsedGb:        parseFloat(storageUsedGb.toFixed(3)),
+      storageUsedBytes:     totalStorageBytes,
+      storageLimitGb:       isFinite(tier.ingestionSpaceGb)     ? tier.ingestionSpaceGb     : null,
+    } : null,
+    agentRunCount:    recentAgentRuns.length,
+    agentRunSuccess:  recentAgentRuns.filter(r => r.status === "success").length,
+    agentRunErrors:   recentAgentRuns.filter(r => r.status === "error").length,
+    agentRunsByTrigger: [
+      { name: "Runs", value: recentAgentRuns.length, color: "#6366f1" },
+    ].filter(s => s.value > 0),
+    chatActivity:     groupByDay(recentUserChats, "createdAt"),
+    agentRunActivity: groupByDay(recentAgentRuns, "startedAt"),
+    ingestActivity:   groupByDay(
+      documents.filter(d => new Date(d.createdAt) >= thirtyDaysAgo),
+      "createdAt"
+    ),
+    userGrowth: groupByDay(
+      users.filter(u => new Date(u.createdAt) >= thirtyDaysAgo),
+      "createdAt"
+    ),
+  });
+});
+
+module.exports = router;