enpilink 1.0.2

package/dist/server/admin.js

@@ -0,0 +1,239 @@
+import crypto from "node:crypto";
+import { InvalidTokenError, requireBearerAuth } from "./auth.js";
+import { resolveConfig } from "./config/index.js";
+import { getActiveStorage, setActiveStorage } from "./log-sink.js";
+import { resolveStorageAdapter } from "./storage/index.js";
+/**
+ * Admin / control-plane mounting (M5).
+ *
+ * The admin plane is the devtools static UI + the observability read API + the
+ * config admin API. In DEV (`NODE_ENV !== "production"`) these are mounted
+ * unauthenticated on localhost (today's behavior). In PROD they are OFF by
+ * default and opt-in via `--admin` / `ENPILINK_ADMIN=1`, guarded by
+ * `requireBearerAuth` using `ENPILINK_ADMIN_TOKEN`.
+ *
+ * This module centralizes BOTH the dev and prod mounts so the route surface is
+ * identical and the auth wrapping lives in one place. The console static UI is
+ * imported through a non-literal specifier so core type-checks WITHOUT
+ * `@enpilink/console` being built first (the core↔console workspace cycle).
+ */
+/** Truthy env values that enable the admin plane. */
+const TRUTHY = new Set(["1", "true", "yes", "on"]);
+/**
+ * Whether the prod admin plane is enabled. OFF by default; enable with
+ * `ENPILINK_ADMIN=1` (also accepts `true`/`yes`/`on`, case-insensitive) — or via
+ * the `enpilink start --admin` flag, which sets the same env var.
+ */
+export function adminEnabled() {
+    const raw = process.env.ENPILINK_ADMIN;
+    return raw !== undefined && TRUTHY.has(raw.trim().toLowerCase());
+}
+/**
+ * The raw admin bearer token, read in-process from the env (NOT the masked
+ * config API). Empty / unset → `undefined`. Read via `resolveConfig(null)`'s
+ * raw `values.adminAuthToken` so the single source of truth is the config
+ * schema's env mapping. Never logged, never returned by any HTTP route.
+ */
+export async function readAdminToken() {
+    const { values } = await resolveConfig(null);
+    const token = values.adminAuthToken;
+    if (typeof token !== "string") {
+        return undefined;
+    }
+    const trimmed = token.trim();
+    return trimmed.length > 0 ? trimmed : undefined;
+}
+/**
+ * Error thrown when admin is enabled in prod but no token is configured. The
+ * prod entry should let this propagate so the process exits non-zero with a
+ * clear message — never default-open.
+ */
+export class AdminTokenMissingError extends Error {
+    constructor() {
+        super("Admin mode is enabled (ENPILINK_ADMIN) but no admin token is set. " +
+            "Set ENPILINK_ADMIN_TOKEN to a non-empty secret, or disable admin. " +
+            "Refusing to start an unauthenticated admin plane.");
+        this.name = "AdminTokenMissingError";
+    }
+}
+/**
+ * A minimal OAuth-token verifier that accepts exactly one static bearer token
+ * (the configured admin token) and rejects everything else. On match it returns
+ * a synthetic {@link AuthInfo} with a far-future expiry so `requireBearerAuth`
+ * is satisfied; on mismatch it throws {@link InvalidTokenError} → 401.
+ *
+ * The comparison is constant-time to avoid leaking the token via timing.
+ */
+function adminTokenVerifier(token) {
+    const expected = Buffer.from(token);
+    return {
+        async verifyAccessToken(presented) {
+            const got = Buffer.from(presented);
+            const ok = got.length === expected.length && crypto.timingSafeEqual(got, expected);
+            if (!ok) {
+                throw new InvalidTokenError("Invalid admin token");
+            }
+            return {
+                token: "admin",
+                clientId: "enpilink-admin",
+                scopes: [],
+                // Far-future expiry (epoch seconds): the token is a static shared
+                // secret, not an OAuth access token, so it does not expire on its own.
+                expiresAt: Math.floor(Date.now() / 1000) + 60 * 60 * 24 * 365,
+            };
+        },
+    };
+}
+/** Path prefixes for the admin DATA APIs (guarded). The shell is everything else. */
+const DATA_API_PREFIXES = [
+    "/__enpilink/observability",
+    "/__enpilink/config",
+];
+/** The observability SSE stream route — the one endpoint that needs `?token=`. */
+const STREAM_PATH = "/__enpilink/observability/stream";
+/** Whether `path` belongs to a guarded data API. */
+function isDataApiPath(path) {
+    return DATA_API_PREFIXES.some((prefix) => path === prefix || path.startsWith(`${prefix}/`));
+}
+/**
+ * Remove the `token` query param from a URL (path + querystring), leaving the
+ * rest intact. Used to scrub the SSE bearer from `req.url`/`req.originalUrl`
+ * after promoting it to the Authorization header, so it never reaches logs or
+ * the route handler.
+ */
+function stripTokenParam(url) {
+    const qIdx = url.indexOf("?");
+    if (qIdx === -1) {
+        return url;
+    }
+    const pathPart = url.slice(0, qIdx);
+    const params = new URLSearchParams(url.slice(qIdx + 1));
+    params.delete("token");
+    const rest = params.toString();
+    return rest.length > 0 ? `${pathPart}?${rest}` : pathPart;
+}
+/**
+ * Build the bearer-auth middleware that guards the admin **data APIs** in prod
+ * (`/__enpilink/observability/*` + `/__enpilink/config*`).
+ *
+ * M6.5: this guard is mounted at the app root but enforces auth ONLY on the
+ * data-API paths — the devtools static SPA shell (and everything else,
+ * including `/mcp`) passes straight through unauthenticated, so a browser can
+ * always load the app and render its own token-login screen. The app then
+ * authenticates its own fetch/SSE calls; no data leaks without the token.
+ *
+ * **SSE auth (`?token=`):** browsers' `EventSource` cannot set an
+ * `Authorization` header, so for the observability `/stream` route ONLY we also
+ * accept the bearer via a `?token=` query param. We copy it into the
+ * `Authorization` header (so the SAME constant-time verifier enforces it — no
+ * separate compare path) and then delete the query param so it never reaches
+ * the route handler, logs, or any persisted request line. The header path stays
+ * the primary mechanism for every other route.
+ */
+export function adminAuthMiddleware(token) {
+    const required = requireBearerAuth({ verifier: adminTokenVerifier(token) });
+    return (req, res, next) => {
+        // `req.path` is the full path (guard mounted at root). Only the data APIs
+        // are guarded; the SPA shell, static assets, and `/mcp` pass through.
+        if (!isDataApiPath(req.path)) {
+            next();
+            return;
+        }
+        // SSE-only: promote `?token=` to the Authorization header so EventSource
+        // can authenticate, then strip it from the URL so the secret never lands in
+        // the request log line, `req.query`, or the route handler. Only here, only
+        // where the header path is also enforced (prod admin).
+        if (req.path === STREAM_PATH && !req.headers.authorization) {
+            const queryToken = req.query.token;
+            if (typeof queryToken === "string" && queryToken.length > 0) {
+                req.headers.authorization = `Bearer ${queryToken}`;
+            }
+            // Rewrite req.url / req.originalUrl to drop the `token` param. Express's
+            // `req.query` is derived from `req.url`, so this removes it everywhere
+            // (query object + any downstream logging of the URL).
+            req.url = stripTokenParam(req.url);
+            if (typeof req.originalUrl === "string") {
+                req.originalUrl = stripTokenParam(req.originalUrl);
+            }
+        }
+        return required(req, res, next);
+    };
+}
+/**
+ * Ensure there is an active {@link StorageAdapter} backing the admin plane, even
+ * when analytics RECORDING is off (`ENPILINK_ANALYTICS` unset). Analytics gates
+ * whether events are *recorded*; the admin still needs a store to READ/write
+ * config + observability data.
+ *
+ * If analytics already installed a store ({@link getActiveStorage}), reuse it.
+ * Otherwise resolve a fresh adapter (prod default = sqlite via
+ * `resolveStorageAdapter()` / `ENPILINK_DB_PATH`), `init()` it, register it as
+ * the active store, and return it so the caller can close it on shutdown.
+ *
+ * @returns the storage adapter the caller now OWNS (must close on shutdown), or
+ * `null` when an existing analytics store was reused (the server already owns
+ * that one) or when initialization failed.
+ */
+export async function ensureAdminStorage() {
+    const existing = getActiveStorage();
+    if (existing) {
+        // Analytics already set up a store; reuse it. The server owns its lifecycle.
+        return null;
+    }
+    let storage;
+    try {
+        storage = resolveStorageAdapter();
+        await storage.init();
+    }
+    catch (err) {
+        console.error("[enpilink] admin storage init failed:", err instanceof Error ? err.message : err);
+        return null;
+    }
+    setActiveStorage(storage);
+    return storage;
+}
+/** The non-literal specifier keeps the core↔devtools clean-build cycle intact. */
+const DEVTOOLS_SPECIFIER = "@enpilink/console";
+async function loadDevtoolsStaticServer() {
+    const { devtoolsStaticServer } = (await import(DEVTOOLS_SPECIFIER));
+    return devtoolsStaticServer();
+}
+/**
+ * Mount the admin plane (devtools static UI + observability API + config API)
+ * onto `app`.
+ *
+ * **Shell vs data auth (M6.5).** The plane has two halves:
+ *
+ * 1. The **devtools static SPA shell** (HTML/JS/CSS — non-sensitive app code).
+ *    Served WITHOUT auth so an unauthenticated browser can always load the app
+ *    and render its own token-login screen.
+ * 2. The **data APIs** (`/__enpilink/observability/*` + `/__enpilink/config*`),
+ *    which expose real analytics/config data. In prod these are guarded by
+ *    `opts.auth` (a single bearer token); the guard is applied ONLY in front of
+ *    these two routers, never the shell.
+ *
+ * In DEV (`auth` omitted) nothing is guarded — today's localhost behavior. The
+ * net result in prod: a browser with no token gets the app shell + a login
+ * screen, but no data leaks until the token is presented.
+ */
+export async function mountAdmin(app, opts = {}) {
+    const { createObservabilityRouter } = await import("./observability.js");
+    const { createConfigRouter } = await import("./config/index.js");
+    const staticUi = await loadDevtoolsStaticServer();
+    const observability = createObservabilityRouter();
+    const config = createConfigRouter();
+    // 1) Static SPA shell — ALWAYS unauthenticated so the browser can load the
+    //    app and show the login screen. It serves only non-sensitive app assets.
+    app.use(staticUi);
+    // 2) Data-API guard (prod only). Mounted at root, but `adminAuthMiddleware`
+    //    enforces auth ONLY on the `/__enpilink/observability|config` paths — the
+    //    shell above and `/mcp` pass through. It also accepts the SSE `?token=`
+    //    query param for the stream route. In dev (`opts.auth` omitted) there is
+    //    no guard at all.
+    if (opts.auth) {
+        app.use(opts.auth);
+    }
+    app.use(observability);
+    app.use(config);
+}
+//# sourceMappingURL=admin.js.map

package/dist/server/admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.js","sourceRoot":"","sources":["../../src/server/admin.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAGjC,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAG3D;;;;;;;;;;;;;GAaG;AAEH,qDAAqD;AACrD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;AAEnD;;;;GAIG;AACH,MAAM,UAAU,YAAY;IAC1B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IACvC,OAAO,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;AACnE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC;IACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC/C;QACE,KAAK,CACH,oEAAoE;YAClE,oEAAoE;YACpE,mDAAmD,CACtD,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED;;;;;;;GAOG;AACH,SAAS,kBAAkB,CAAC,KAAa;IAGvC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpC,OAAO;QACL,KAAK,CAAC,iBAAiB,CAAC,SAAiB;YACvC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACnC,MAAM,EAAE,GACN,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,MAAM,CAAC,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC1E,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,MAAM,IAAI,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;YACrD,CAAC;YACD,OAAO;gBACL,KAAK,EAAE,OAAO;gBACd,QAAQ,EAAE,gBAAgB;gBAC1B,MAAM,EAAE,EAAE;gBACV,kEAAkE;gBAClE,uEAAuE;gBACvE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG;aAC9D,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,MAAM,iBAAiB,GAAG;IACxB,2BAA2B;IAC3B,oBAAoB;CACZ,CAAC;AAEX,kFAAkF;AAClF,MAAM,WAAW,GAAG,kCAAkC,CAAC;AAEvD,oDAAoD;AACpD,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,iBAAiB,CAAC,IAAI,CAC3B,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CAC7D,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,GAAW;IAClC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC;QAChB,OAAO,GAAG,CAAC;IACb,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;IACxD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACvB,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC/B,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC5D,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,EAAE,QAAQ,EAAE,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC5E,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACxB,0EAA0E;QAC1E,sEAAsE;QACtE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,yEAAyE;QACzE,4EAA4E;QAC5E,2EAA2E;QAC3E,uDAAuD;QACvD,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YAC3D,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC;YACnC,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5D,GAAG,CAAC,OAAO,CAAC,aAAa,GAAG,UAAU,UAAU,EAAE,CAAC;YACrD,CAAC;YACD,yEAAyE;YACzE,uEAAuE;YACvE,sDAAsD;YACtD,GAAG,CAAC,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACnC,IAAI,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;gBACxC,GAAG,CAAC,WAAW,GAAG,eAAe,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;IACpC,IAAI,QAAQ,EAAE,CAAC;QACb,6EAA6E;QAC7E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,OAAO,GAAG,qBAAqB,EAAE,CAAC;QAClC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;IACvB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CACX,uCAAuC,EACvC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CACzC,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC1B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,kFAAkF;AAClF,MAAM,kBAAkB,GAAG,mBAAmB,CAAC;AAE/C,KAAK,UAAU,wBAAwB;IACrC,MAAM,EAAE,oBAAoB,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAEjE,CAAC;IACF,OAAO,oBAAoB,EAAE,CAAC;AAChC,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,GAAY,EACZ,OAAkC,EAAE;IAEpC,MAAM,EAAE,yBAAyB,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IACzE,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAEjE,MAAM,QAAQ,GAAG,MAAM,wBAAwB,EAAE,CAAC;IAClD,MAAM,aAAa,GAAG,yBAAyB,EAAE,CAAC;IAClD,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;IAEpC,2EAA2E;IAC3E,6EAA6E;IAC7E,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAElB,4EAA4E;IAC5E,8EAA8E;IAC9E,4EAA4E;IAC5E,6EAA6E;IAC7E,sBAAsB;IACtB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IACD,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACvB,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAClB,CAAC","sourcesContent":["import crypto from \"node:crypto\";\nimport type { AuthInfo } from \"@modelcontextprotocol/sdk/server/auth/types.js\";\nimport type { Express, RequestHandler } from \"express\";\nimport { InvalidTokenError, requireBearerAuth } from \"./auth.js\";\nimport { resolveConfig } from \"./config/index.js\";\nimport { getActiveStorage, setActiveStorage } from \"./log-sink.js\";\nimport { resolveStorageAdapter } from \"./storage/index.js\";\nimport type { StorageAdapter } from \"./storage/types.js\";\n\n/**\n * Admin / control-plane mounting (M5).\n *\n * The admin plane is the devtools static UI + the observability read API + the\n * config admin API. In DEV (`NODE_ENV !== \"production\"`) these are mounted\n * unauthenticated on localhost (today's behavior). In PROD they are OFF by\n * default and opt-in via `--admin` / `ENPILINK_ADMIN=1`, guarded by\n * `requireBearerAuth` using `ENPILINK_ADMIN_TOKEN`.\n *\n * This module centralizes BOTH the dev and prod mounts so the route surface is\n * identical and the auth wrapping lives in one place. The console static UI is\n * imported through a non-literal specifier so core type-checks WITHOUT\n * `@enpilink/console` being built first (the core↔console workspace cycle).\n */\n\n/** Truthy env values that enable the admin plane. */\nconst TRUTHY = new Set([\"1\", \"true\", \"yes\", \"on\"]);\n\n/**\n * Whether the prod admin plane is enabled. OFF by default; enable with\n * `ENPILINK_ADMIN=1` (also accepts `true`/`yes`/`on`, case-insensitive) — or via\n * the `enpilink start --admin` flag, which sets the same env var.\n */\nexport function adminEnabled(): boolean {\n  const raw = process.env.ENPILINK_ADMIN;\n  return raw !== undefined && TRUTHY.has(raw.trim().toLowerCase());\n}\n\n/**\n * The raw admin bearer token, read in-process from the env (NOT the masked\n * config API). Empty / unset → `undefined`. Read via `resolveConfig(null)`'s\n * raw `values.adminAuthToken` so the single source of truth is the config\n * schema's env mapping. Never logged, never returned by any HTTP route.\n */\nexport async function readAdminToken(): Promise<string | undefined> {\n  const { values } = await resolveConfig(null);\n  const token = values.adminAuthToken;\n  if (typeof token !== \"string\") {\n    return undefined;\n  }\n  const trimmed = token.trim();\n  return trimmed.length > 0 ? trimmed : undefined;\n}\n\n/**\n * Error thrown when admin is enabled in prod but no token is configured. The\n * prod entry should let this propagate so the process exits non-zero with a\n * clear message — never default-open.\n */\nexport class AdminTokenMissingError extends Error {\n  constructor() {\n    super(\n      \"Admin mode is enabled (ENPILINK_ADMIN) but no admin token is set. \" +\n        \"Set ENPILINK_ADMIN_TOKEN to a non-empty secret, or disable admin. \" +\n        \"Refusing to start an unauthenticated admin plane.\",\n    );\n    this.name = \"AdminTokenMissingError\";\n  }\n}\n\n/**\n * A minimal OAuth-token verifier that accepts exactly one static bearer token\n * (the configured admin token) and rejects everything else. On match it returns\n * a synthetic {@link AuthInfo} with a far-future expiry so `requireBearerAuth`\n * is satisfied; on mismatch it throws {@link InvalidTokenError} → 401.\n *\n * The comparison is constant-time to avoid leaking the token via timing.\n */\nfunction adminTokenVerifier(token: string): {\n  verifyAccessToken: (presented: string) => Promise<AuthInfo>;\n} {\n  const expected = Buffer.from(token);\n  return {\n    async verifyAccessToken(presented: string): Promise<AuthInfo> {\n      const got = Buffer.from(presented);\n      const ok =\n        got.length === expected.length && crypto.timingSafeEqual(got, expected);\n      if (!ok) {\n        throw new InvalidTokenError(\"Invalid admin token\");\n      }\n      return {\n        token: \"admin\",\n        clientId: \"enpilink-admin\",\n        scopes: [],\n        // Far-future expiry (epoch seconds): the token is a static shared\n        // secret, not an OAuth access token, so it does not expire on its own.\n        expiresAt: Math.floor(Date.now() / 1000) + 60 * 60 * 24 * 365,\n      };\n    },\n  };\n}\n\n/** Path prefixes for the admin DATA APIs (guarded). The shell is everything else. */\nconst DATA_API_PREFIXES = [\n  \"/__enpilink/observability\",\n  \"/__enpilink/config\",\n] as const;\n\n/** The observability SSE stream route — the one endpoint that needs `?token=`. */\nconst STREAM_PATH = \"/__enpilink/observability/stream\";\n\n/** Whether `path` belongs to a guarded data API. */\nfunction isDataApiPath(path: string): boolean {\n  return DATA_API_PREFIXES.some(\n    (prefix) => path === prefix || path.startsWith(`${prefix}/`),\n  );\n}\n\n/**\n * Remove the `token` query param from a URL (path + querystring), leaving the\n * rest intact. Used to scrub the SSE bearer from `req.url`/`req.originalUrl`\n * after promoting it to the Authorization header, so it never reaches logs or\n * the route handler.\n */\nfunction stripTokenParam(url: string): string {\n  const qIdx = url.indexOf(\"?\");\n  if (qIdx === -1) {\n    return url;\n  }\n  const pathPart = url.slice(0, qIdx);\n  const params = new URLSearchParams(url.slice(qIdx + 1));\n  params.delete(\"token\");\n  const rest = params.toString();\n  return rest.length > 0 ? `${pathPart}?${rest}` : pathPart;\n}\n\n/**\n * Build the bearer-auth middleware that guards the admin **data APIs** in prod\n * (`/__enpilink/observability/*` + `/__enpilink/config*`).\n *\n * M6.5: this guard is mounted at the app root but enforces auth ONLY on the\n * data-API paths — the devtools static SPA shell (and everything else,\n * including `/mcp`) passes straight through unauthenticated, so a browser can\n * always load the app and render its own token-login screen. The app then\n * authenticates its own fetch/SSE calls; no data leaks without the token.\n *\n * **SSE auth (`?token=`):** browsers' `EventSource` cannot set an\n * `Authorization` header, so for the observability `/stream` route ONLY we also\n * accept the bearer via a `?token=` query param. We copy it into the\n * `Authorization` header (so the SAME constant-time verifier enforces it — no\n * separate compare path) and then delete the query param so it never reaches\n * the route handler, logs, or any persisted request line. The header path stays\n * the primary mechanism for every other route.\n */\nexport function adminAuthMiddleware(token: string): RequestHandler {\n  const required = requireBearerAuth({ verifier: adminTokenVerifier(token) });\n  return (req, res, next) => {\n    // `req.path` is the full path (guard mounted at root). Only the data APIs\n    // are guarded; the SPA shell, static assets, and `/mcp` pass through.\n    if (!isDataApiPath(req.path)) {\n      next();\n      return;\n    }\n\n    // SSE-only: promote `?token=` to the Authorization header so EventSource\n    // can authenticate, then strip it from the URL so the secret never lands in\n    // the request log line, `req.query`, or the route handler. Only here, only\n    // where the header path is also enforced (prod admin).\n    if (req.path === STREAM_PATH && !req.headers.authorization) {\n      const queryToken = req.query.token;\n      if (typeof queryToken === \"string\" && queryToken.length > 0) {\n        req.headers.authorization = `Bearer ${queryToken}`;\n      }\n      // Rewrite req.url / req.originalUrl to drop the `token` param. Express's\n      // `req.query` is derived from `req.url`, so this removes it everywhere\n      // (query object + any downstream logging of the URL).\n      req.url = stripTokenParam(req.url);\n      if (typeof req.originalUrl === \"string\") {\n        req.originalUrl = stripTokenParam(req.originalUrl);\n      }\n    }\n\n    return required(req, res, next);\n  };\n}\n\n/**\n * Ensure there is an active {@link StorageAdapter} backing the admin plane, even\n * when analytics RECORDING is off (`ENPILINK_ANALYTICS` unset). Analytics gates\n * whether events are *recorded*; the admin still needs a store to READ/write\n * config + observability data.\n *\n * If analytics already installed a store ({@link getActiveStorage}), reuse it.\n * Otherwise resolve a fresh adapter (prod default = sqlite via\n * `resolveStorageAdapter()` / `ENPILINK_DB_PATH`), `init()` it, register it as\n * the active store, and return it so the caller can close it on shutdown.\n *\n * @returns the storage adapter the caller now OWNS (must close on shutdown), or\n * `null` when an existing analytics store was reused (the server already owns\n * that one) or when initialization failed.\n */\nexport async function ensureAdminStorage(): Promise<StorageAdapter | null> {\n  const existing = getActiveStorage();\n  if (existing) {\n    // Analytics already set up a store; reuse it. The server owns its lifecycle.\n    return null;\n  }\n  let storage: StorageAdapter;\n  try {\n    storage = resolveStorageAdapter();\n    await storage.init();\n  } catch (err) {\n    console.error(\n      \"[enpilink] admin storage init failed:\",\n      err instanceof Error ? err.message : err,\n    );\n    return null;\n  }\n  setActiveStorage(storage);\n  return storage;\n}\n\n/** The non-literal specifier keeps the core↔devtools clean-build cycle intact. */\nconst DEVTOOLS_SPECIFIER = \"@enpilink/console\";\n\nasync function loadDevtoolsStaticServer(): Promise<RequestHandler> {\n  const { devtoolsStaticServer } = (await import(DEVTOOLS_SPECIFIER)) as {\n    devtoolsStaticServer: () => Promise<RequestHandler>;\n  };\n  return devtoolsStaticServer();\n}\n\n/**\n * Mount the admin plane (devtools static UI + observability API + config API)\n * onto `app`.\n *\n * **Shell vs data auth (M6.5).** The plane has two halves:\n *\n * 1. The **devtools static SPA shell** (HTML/JS/CSS — non-sensitive app code).\n *    Served WITHOUT auth so an unauthenticated browser can always load the app\n *    and render its own token-login screen.\n * 2. The **data APIs** (`/__enpilink/observability/*` + `/__enpilink/config*`),\n *    which expose real analytics/config data. In prod these are guarded by\n *    `opts.auth` (a single bearer token); the guard is applied ONLY in front of\n *    these two routers, never the shell.\n *\n * In DEV (`auth` omitted) nothing is guarded — today's localhost behavior. The\n * net result in prod: a browser with no token gets the app shell + a login\n * screen, but no data leaks until the token is presented.\n */\nexport async function mountAdmin(\n  app: Express,\n  opts: { auth?: RequestHandler } = {},\n): Promise<void> {\n  const { createObservabilityRouter } = await import(\"./observability.js\");\n  const { createConfigRouter } = await import(\"./config/index.js\");\n\n  const staticUi = await loadDevtoolsStaticServer();\n  const observability = createObservabilityRouter();\n  const config = createConfigRouter();\n\n  // 1) Static SPA shell — ALWAYS unauthenticated so the browser can load the\n  //    app and show the login screen. It serves only non-sensitive app assets.\n  app.use(staticUi);\n\n  // 2) Data-API guard (prod only). Mounted at root, but `adminAuthMiddleware`\n  //    enforces auth ONLY on the `/__enpilink/observability|config` paths — the\n  //    shell above and `/mcp` pass through. It also accepts the SSE `?token=`\n  //    query param for the stream route. In dev (`opts.auth` omitted) there is\n  //    no guard at all.\n  if (opts.auth) {\n    app.use(opts.auth);\n  }\n  app.use(observability);\n  app.use(config);\n}\n"]}

package/dist/server/admin.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/server/admin.test.js

@@ -0,0 +1,226 @@
+import http from "node:http";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { AdminTokenMissingError, adminAuthMiddleware, adminEnabled, readAdminToken, } from "./admin.js";
+import { mockEnabled } from "./analytics.js";
+import { setActiveStorage } from "./log-sink.js";
+import { McpServer } from "./server.js";
+// The admin static UI imports @enpilink/console via a non-literal specifier;
+// stub it so these tests don't require the devtools dist (clean-build cycle).
+vi.mock("@enpilink/console", () => ({
+    // Stand in for the static SPA shell: answer `/` with a shell marker, let
+    // everything else fall through to the data routers.
+    devtoolsStaticServer: () => ((req, res, next) => {
+        if (req.path === "/") {
+            res.json({ shell: true });
+            return;
+        }
+        next();
+    }),
+}));
+vi.mock("./viewsDevServer.js", () => ({
+    viewsDevServer: (_httpServer) => ((_req, _res, next) => next()),
+}));
+async function listen(app) {
+    const server = http.createServer(app);
+    await new Promise((resolve) => server.listen(0, resolve));
+    const port = server.address().port;
+    return { port, server };
+}
+let openServer;
+const ORIGINAL_ENV = { ...process.env };
+beforeEach(() => {
+    // Ensure no leftover active storage from another test influences these.
+    setActiveStorage(null);
+});
+afterEach(() => {
+    openServer?.close();
+    openServer = undefined;
+    setActiveStorage(null);
+    process.env = { ...ORIGINAL_ENV };
+});
+const OBS = "/__enpilink/observability/summary";
+describe("adminEnabled", () => {
+    it("is off by default and on for truthy env values", () => {
+        process.env.ENPILINK_ADMIN = undefined;
+        delete process.env.ENPILINK_ADMIN;
+        expect(adminEnabled()).toBe(false);
+        for (const v of ["1", "true", "YES", "On"]) {
+            process.env.ENPILINK_ADMIN = v;
+            expect(adminEnabled()).toBe(true);
+        }
+        process.env.ENPILINK_ADMIN = "0";
+        expect(adminEnabled()).toBe(false);
+    });
+});
+describe("readAdminToken", () => {
+    it("reads the raw token from env, trims, and treats empty as unset", async () => {
+        delete process.env.ENPILINK_ADMIN_TOKEN;
+        expect(await readAdminToken()).toBeUndefined();
+        process.env.ENPILINK_ADMIN_TOKEN = "   ";
+        expect(await readAdminToken()).toBeUndefined();
+        process.env.ENPILINK_ADMIN_TOKEN = "s3cret";
+        expect(await readAdminToken()).toBe("s3cret");
+    });
+});
+describe("mockEnabled is dev-only", () => {
+    it("ignores ENPILINK_MOCK in production", () => {
+        process.env.ENPILINK_MOCK = "1";
+        process.env.NODE_ENV = "production";
+        expect(mockEnabled()).toBe(false);
+        process.env.NODE_ENV = "development";
+        expect(mockEnabled()).toBe(true);
+    });
+});
+describe("adminAuthMiddleware", () => {
+    it("401s without a token and passes with the valid bearer token", async () => {
+        const app = (await import("express")).default();
+        // Guard a DATA-API path (the guard only enforces auth on those).
+        app.use(adminAuthMiddleware("topsecret"));
+        app.get("/__enpilink/observability/summary", (_req, res) => res.json({ ok: true }));
+        const { port, server } = await listen(app);
+        openServer = server;
+        const base = `http://localhost:${port}/__enpilink/observability/summary`;
+        const noAuth = await fetch(base);
+        expect(noAuth.status).toBe(401);
+        const badAuth = await fetch(base, {
+            headers: { Authorization: "Bearer wrong" },
+        });
+        expect(badAuth.status).toBe(401);
+        const ok = await fetch(base, {
+            headers: { Authorization: "Bearer topsecret" },
+        });
+        expect(ok.status).toBe(200);
+        expect(await ok.json()).toEqual({ ok: true });
+    });
+    it("does NOT guard non-data paths (SPA shell, /mcp)", async () => {
+        const app = (await import("express")).default();
+        app.use(adminAuthMiddleware("topsecret"));
+        app.get("/", (_req, res) => res.json({ shell: true }));
+        app.get("/assets/app.js", (_req, res) => res.send("// js"));
+        const { port, server } = await listen(app);
+        openServer = server;
+        // No Authorization header, yet the shell + assets are reachable.
+        const shell = await fetch(`http://localhost:${port}/`);
+        expect(shell.status).toBe(200);
+        const asset = await fetch(`http://localhost:${port}/assets/app.js`);
+        expect(asset.status).toBe(200);
+    });
+    it("accepts the SSE ?token= query param on the stream route only", async () => {
+        const app = (await import("express")).default();
+        app.use(adminAuthMiddleware("topsecret"));
+        // Echo whether the token leaked into the parsed query (it must NOT).
+        app.get("/__enpilink/observability/stream", (req, res) => res.json({ ok: true, tokenInQuery: "token" in req.query }));
+        app.get("/__enpilink/observability/summary", (req, res) => res.json({ ok: true, tokenInQuery: "token" in req.query }));
+        const { port, server } = await listen(app);
+        openServer = server;
+        // Stream with valid ?token= → 200, and token stripped from req.query.
+        const okStream = await fetch(`http://localhost:${port}/__enpilink/observability/stream?token=topsecret`);
+        expect(okStream.status).toBe(200);
+        expect(await okStream.json()).toEqual({ ok: true, tokenInQuery: false });
+        // Wrong ?token= on the stream → 401.
+        const badStream = await fetch(`http://localhost:${port}/__enpilink/observability/stream?token=wrong`);
+        expect(badStream.status).toBe(401);
+        // ?token= is NOT honored on other data routes (header-only there).
+        const summaryViaQuery = await fetch(`http://localhost:${port}/__enpilink/observability/summary?token=topsecret`);
+        expect(summaryViaQuery.status).toBe(401);
+    });
+});
+describe("createApp — prod admin mode", () => {
+    it("does NOT mount the admin plane when admin is disabled", async () => {
+        process.env.NODE_ENV = "production";
+        delete process.env.ENPILINK_ADMIN;
+        const { createApp } = await import("./express.js");
+        const server = new McpServer({ name: "t", version: "0.0.0" });
+        const httpServer = http.createServer();
+        await createApp({ mcpServer: server, httpServer });
+        const { port, server: listening } = await listen(server.express);
+        openServer = listening;
+        const obs = await fetch(`http://localhost:${port}${OBS}`);
+        expect(obs.status).toBe(404);
+        // /mcp still works regardless of admin.
+        const mcp = await fetch(`http://localhost:${port}/mcp`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ jsonrpc: "2.0", method: "initialize", id: 1 }),
+        });
+        expect(mcp.status).not.toBe(404);
+    });
+    it("refuses to start when admin is enabled but no token is set", async () => {
+        process.env.NODE_ENV = "production";
+        process.env.ENPILINK_ADMIN = "1";
+        delete process.env.ENPILINK_ADMIN_TOKEN;
+        const { createApp } = await import("./express.js");
+        const server = new McpServer({ name: "t", version: "0.0.0" });
+        const httpServer = http.createServer();
+        await expect(createApp({ mcpServer: server, httpServer })).rejects.toBeInstanceOf(AdminTokenMissingError);
+    });
+    it("mounts the admin plane behind bearer auth when enabled with a token", async () => {
+        process.env.NODE_ENV = "production";
+        process.env.ENPILINK_ADMIN = "1";
+        process.env.ENPILINK_ADMIN_TOKEN = "letmein";
+        process.env.ENPILINK_STORAGE = "memory"; // never touch disk in tests
+        const { createApp } = await import("./express.js");
+        const server = new McpServer({ name: "t", version: "0.0.0" });
+        const httpServer = http.createServer();
+        await createApp({ mcpServer: server, httpServer });
+        const { port, server: listening } = await listen(server.express);
+        openServer = listening;
+        // SPA shell is reachable WITHOUT auth (so the browser can load the app).
+        const shell = await fetch(`http://localhost:${port}/`);
+        expect(shell.status).toBe(200);
+        expect(await shell.json()).toEqual({ shell: true });
+        // Unauthenticated data API → 401.
+        const unauth = await fetch(`http://localhost:${port}${OBS}`);
+        expect(unauth.status).toBe(401);
+        // Valid bearer → 200.
+        const authed = await fetch(`http://localhost:${port}${OBS}`, {
+            headers: { Authorization: "Bearer letmein" },
+        });
+        expect(authed.status).toBe(200);
+        // SSE stream authenticates via ?token= (EventSource can't set headers).
+        const STREAM = "/__enpilink/observability/stream";
+        const streamUnauth = await fetch(`http://localhost:${port}${STREAM}`);
+        expect(streamUnauth.status).toBe(401);
+        const streamAuthed = await fetch(`http://localhost:${port}${STREAM}?token=letmein`);
+        expect(streamAuthed.status).toBe(200);
+        // Close the open SSE connection so the server can shut down cleanly.
+        await streamAuthed.body?.cancel();
+        // Admin storage was initialized independent of analytics (analytics OFF).
+        expect(server.storage).not.toBeNull();
+        // /mcp still works and is NOT guarded by the admin auth (no 401/404).
+        const mcp = await fetch(`http://localhost:${port}/mcp`, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                Accept: "application/json, text/event-stream",
+            },
+            body: JSON.stringify({
+                jsonrpc: "2.0",
+                method: "initialize",
+                id: 1,
+                params: {
+                    protocolVersion: "2024-11-05",
+                    capabilities: {},
+                    clientInfo: { name: "c", version: "1" },
+                },
+            }),
+        });
+        expect(mcp.status).toBe(200);
+        await server.storage?.close();
+    });
+});
+describe("createApp — dev mode unchanged", () => {
+    it("mounts the admin plane on localhost with NO auth", async () => {
+        delete process.env.NODE_ENV; // dev
+        const { createApp } = await import("./express.js");
+        const server = new McpServer({ name: "t", version: "0.0.0" });
+        const httpServer = http.createServer();
+        await createApp({ mcpServer: server, httpServer });
+        const { port, server: listening } = await listen(server.express);
+        openServer = listening;
+        // No Authorization header, yet the observability route answers (200).
+        const obs = await fetch(`http://localhost:${port}${OBS}`);
+        expect(obs.status).toBe(200);
+    });
+});
+//# sourceMappingURL=admin.test.js.map

package/dist/server/admin.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.test.js","sourceRoot":"","sources":["../../src/server/admin.test.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzE,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,YAAY,EACZ,cAAc,GACf,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,6EAA6E;AAC7E,8EAA8E;AAC9E,EAAE,CAAC,IAAI,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC,CAAC;IAClC,yEAAyE;IACzE,oDAAoD;IACpD,oBAAoB,EAAE,GAAG,EAAE,CACzB,CAAC,CACC,GAAqB,EACrB,GAAmC,EACnC,IAAgB,EAChB,EAAE;QACF,IAAI,GAAG,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;YACrB,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1B,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAA8B;CAClC,CAAC,CAAC,CAAC;AACJ,EAAE,CAAC,IAAI,CAAC,qBAAqB,EAAE,GAAG,EAAE,CAAC,CAAC;IACpC,cAAc,EAAE,CAAC,WAAoB,EAAE,EAAE,CACvC,CAAC,CAAC,IAAa,EAAE,IAAa,EAAE,IAAgB,EAAE,EAAE,CAClD,IAAI,EAAE,CAAmB;CAC9B,CAAC,CAAC,CAAC;AAEJ,KAAK,UAAU,MAAM,CAAC,GAA4C;IAChE,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAChE,MAAM,IAAI,GAAI,MAAM,CAAC,OAAO,EAAuB,CAAC,IAAI,CAAC;IACzD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC1B,CAAC;AAED,IAAI,UAAmC,CAAC;AACxC,MAAM,YAAY,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;AAExC,UAAU,CAAC,GAAG,EAAE;IACd,wEAAwE;IACxE,gBAAgB,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC,CAAC,CAAC;AAEH,SAAS,CAAC,GAAG,EAAE;IACb,UAAU,EAAE,KAAK,EAAE,CAAC;IACpB,UAAU,GAAG,SAAS,CAAC;IACvB,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvB,OAAO,CAAC,GAAG,GAAG,EAAE,GAAG,YAAY,EAAE,CAAC;AACpC,CAAC,CAAC,CAAC;AAEH,MAAM,GAAG,GAAG,mCAAmC,CAAC;AAEhD,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,OAAO,CAAC,GAAG,CAAC,cAAc,GAAG,SAAS,CAAC;QACvC,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;QAClC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;YAC3C,OAAO,CAAC,GAAG,CAAC,cAAc,GAAG,CAAC,CAAC;YAC/B,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,cAAc,GAAG,GAAG,CAAC;QACjC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;QACxC,MAAM,CAAC,MAAM,cAAc,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,KAAK,CAAC;QACzC,MAAM,CAAC,MAAM,cAAc,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,QAAQ,CAAC;QAC5C,MAAM,CAAC,MAAM,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,OAAO,CAAC,GAAG,CAAC,aAAa,GAAG,GAAG,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,QAAQ,GAAG,YAAY,CAAC;QACpC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClC,OAAO,CAAC,GAAG,CAAC,QAAQ,GAAG,aAAa,CAAC;QACrC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QAChD,iEAAiE;QACjE,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC,CAAC;QAC1C,GAAG,CAAC,GAAG,CAAC,mCAAmC,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CACzD,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CACvB,CAAC;QACF,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3C,UAAU,GAAG,MAAM,CAAC;QAEpB,MAAM,IAAI,GAAG,oBAAoB,IAAI,mCAAmC,CAAC;QACzE,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEhC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE;YAChC,OAAO,EAAE,EAAE,aAAa,EAAE,cAAc,EAAE;SAC3C,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEjC,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE;YAC3B,OAAO,EAAE,EAAE,aAAa,EAAE,kBAAkB,EAAE;SAC/C,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QAChD,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC,CAAC;QAC1C,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACvD,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5D,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3C,UAAU,GAAG,MAAM,CAAC;QAEpB,iEAAiE;QACjE,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,oBAAoB,IAAI,GAAG,CAAC,CAAC;QACvD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,oBAAoB,IAAI,gBAAgB,CAAC,CAAC;QACpE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QAChD,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC,CAAC;QAC1C,qEAAqE;QACrE,GAAG,CAAC,GAAG,CAAC,kCAAkC,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CACvD,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC,CAC3D,CAAC;QACF,GAAG,CAAC,GAAG,CAAC,mCAAmC,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CACxD,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC,CAC3D,CAAC;QACF,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3C,UAAU,GAAG,MAAM,CAAC;QAEpB,sEAAsE;QACtE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,oBAAoB,IAAI,kDAAkD,CAC3E,CAAC;QACF,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;QAEzE,qCAAqC;QACrC,MAAM,SAAS,GAAG,MAAM,KAAK,CAC3B,oBAAoB,IAAI,8CAA8C,CACvE,CAAC;QACF,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEnC,mEAAmE;QACnE,MAAM,eAAe,GAAG,MAAM,KAAK,CACjC,oBAAoB,IAAI,mDAAmD,CAC5E,CAAC;QACF,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;IAC3C,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,OAAO,CAAC,GAAG,CAAC,QAAQ,GAAG,YAAY,CAAC;QACpC,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;QAClC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAC9D,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACvC,MAAM,SAAS,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;QACnD,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACjE,UAAU,GAAG,SAAS,CAAC;QAEvB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,oBAAoB,IAAI,GAAG,GAAG,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAE7B,wCAAwC;QACxC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,oBAAoB,IAAI,MAAM,EAAE;YACtD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;SACtE,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,OAAO,CAAC,GAAG,CAAC,QAAQ,GAAG,YAAY,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,cAAc,GAAG,GAAG,CAAC;QACjC,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;QACxC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAC9D,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACvC,MAAM,MAAM,CACV,SAAS,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAC7C,CAAC,OAAO,CAAC,cAAc,CAAC,sBAAsB,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,OAAO,CAAC,GAAG,CAAC,QAAQ,GAAG,YAAY,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,cAAc,GAAG,GAAG,CAAC;QACjC,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,SAAS,CAAC;QAC7C,OAAO,CAAC,GAAG,CAAC,gBAAgB,GAAG,QAAQ,CAAC,CAAC,4BAA4B;QACrE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAC9D,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACvC,MAAM,SAAS,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;QACnD,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACjE,UAAU,GAAG,SAAS,CAAC;QAEvB,yEAAyE;QACzE,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,oBAAoB,IAAI,GAAG,CAAC,CAAC;QACvD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAEpD,kCAAkC;QAClC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,oBAAoB,IAAI,GAAG,GAAG,EAAE,CAAC,CAAC;QAC7D,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEhC,sBAAsB;QACtB,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,oBAAoB,IAAI,GAAG,GAAG,EAAE,EAAE;YAC3D,OAAO,EAAE,EAAE,aAAa,EAAE,gBAAgB,EAAE;SAC7C,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEhC,wEAAwE;QACxE,MAAM,MAAM,GAAG,kCAAkC,CAAC;QAClD,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,oBAAoB,IAAI,GAAG,MAAM,EAAE,CAAC,CAAC;QACtE,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,YAAY,GAAG,MAAM,KAAK,CAC9B,oBAAoB,IAAI,GAAG,MAAM,gBAAgB,CAClD,CAAC;QACF,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtC,qEAAqE;QACrE,MAAM,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAElC,0EAA0E;QAC1E,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAEtC,sEAAsE;QACtE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,oBAAoB,IAAI,MAAM,EAAE;YACtD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,qCAAqC;aAC9C;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,YAAY;gBACpB,EAAE,EAAE,CAAC;gBACL,MAAM,EAAE;oBACN,eAAe,EAAE,YAAY;oBAC7B,YAAY,EAAE,EAAE;oBAChB,UAAU,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE;iBACxC;aACF,CAAC;SACH,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAE7B,MAAM,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;IAChC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gCAAgC,EAAE,GAAG,EAAE;IAC9C,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM;QACnC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAC9D,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACvC,MAAM,SAAS,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;QACnD,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACjE,UAAU,GAAG,SAAS,CAAC;QAEvB,sEAAsE;QACtE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,oBAAoB,IAAI,GAAG,GAAG,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["import http from \"node:http\";\nimport type { RequestHandler } from \"express\";\nimport { afterEach, beforeEach, describe, expect, it, vi } from \"vitest\";\nimport {\n  AdminTokenMissingError,\n  adminAuthMiddleware,\n  adminEnabled,\n  readAdminToken,\n} from \"./admin.js\";\nimport { mockEnabled } from \"./analytics.js\";\nimport { setActiveStorage } from \"./log-sink.js\";\nimport { McpServer } from \"./server.js\";\n\n// The admin static UI imports @enpilink/console via a non-literal specifier;\n// stub it so these tests don't require the devtools dist (clean-build cycle).\nvi.mock(\"@enpilink/console\", () => ({\n  // Stand in for the static SPA shell: answer `/` with a shell marker, let\n  // everything else fall through to the data routers.\n  devtoolsStaticServer: () =>\n    ((\n      req: { path: string },\n      res: { json: (b: unknown) => void },\n      next: () => void,\n    ) => {\n      if (req.path === \"/\") {\n        res.json({ shell: true });\n        return;\n      }\n      next();\n    }) as unknown as RequestHandler,\n}));\nvi.mock(\"./viewsDevServer.js\", () => ({\n  viewsDevServer: (_httpServer: unknown) =>\n    ((_req: unknown, _res: unknown, next: () => void) =>\n      next()) as RequestHandler,\n}));\n\nasync function listen(app: Parameters<typeof http.createServer>[1]) {\n  const server = http.createServer(app);\n  await new Promise<void>((resolve) => server.listen(0, resolve));\n  const port = (server.address() as { port: number }).port;\n  return { port, server };\n}\n\nlet openServer: http.Server | undefined;\nconst ORIGINAL_ENV = { ...process.env };\n\nbeforeEach(() => {\n  // Ensure no leftover active storage from another test influences these.\n  setActiveStorage(null);\n});\n\nafterEach(() => {\n  openServer?.close();\n  openServer = undefined;\n  setActiveStorage(null);\n  process.env = { ...ORIGINAL_ENV };\n});\n\nconst OBS = \"/__enpilink/observability/summary\";\n\ndescribe(\"adminEnabled\", () => {\n  it(\"is off by default and on for truthy env values\", () => {\n    process.env.ENPILINK_ADMIN = undefined;\n    delete process.env.ENPILINK_ADMIN;\n    expect(adminEnabled()).toBe(false);\n    for (const v of [\"1\", \"true\", \"YES\", \"On\"]) {\n      process.env.ENPILINK_ADMIN = v;\n      expect(adminEnabled()).toBe(true);\n    }\n    process.env.ENPILINK_ADMIN = \"0\";\n    expect(adminEnabled()).toBe(false);\n  });\n});\n\ndescribe(\"readAdminToken\", () => {\n  it(\"reads the raw token from env, trims, and treats empty as unset\", async () => {\n    delete process.env.ENPILINK_ADMIN_TOKEN;\n    expect(await readAdminToken()).toBeUndefined();\n    process.env.ENPILINK_ADMIN_TOKEN = \"   \";\n    expect(await readAdminToken()).toBeUndefined();\n    process.env.ENPILINK_ADMIN_TOKEN = \"s3cret\";\n    expect(await readAdminToken()).toBe(\"s3cret\");\n  });\n});\n\ndescribe(\"mockEnabled is dev-only\", () => {\n  it(\"ignores ENPILINK_MOCK in production\", () => {\n    process.env.ENPILINK_MOCK = \"1\";\n    process.env.NODE_ENV = \"production\";\n    expect(mockEnabled()).toBe(false);\n    process.env.NODE_ENV = \"development\";\n    expect(mockEnabled()).toBe(true);\n  });\n});\n\ndescribe(\"adminAuthMiddleware\", () => {\n  it(\"401s without a token and passes with the valid bearer token\", async () => {\n    const app = (await import(\"express\")).default();\n    // Guard a DATA-API path (the guard only enforces auth on those).\n    app.use(adminAuthMiddleware(\"topsecret\"));\n    app.get(\"/__enpilink/observability/summary\", (_req, res) =>\n      res.json({ ok: true }),\n    );\n    const { port, server } = await listen(app);\n    openServer = server;\n\n    const base = `http://localhost:${port}/__enpilink/observability/summary`;\n    const noAuth = await fetch(base);\n    expect(noAuth.status).toBe(401);\n\n    const badAuth = await fetch(base, {\n      headers: { Authorization: \"Bearer wrong\" },\n    });\n    expect(badAuth.status).toBe(401);\n\n    const ok = await fetch(base, {\n      headers: { Authorization: \"Bearer topsecret\" },\n    });\n    expect(ok.status).toBe(200);\n    expect(await ok.json()).toEqual({ ok: true });\n  });\n\n  it(\"does NOT guard non-data paths (SPA shell, /mcp)\", async () => {\n    const app = (await import(\"express\")).default();\n    app.use(adminAuthMiddleware(\"topsecret\"));\n    app.get(\"/\", (_req, res) => res.json({ shell: true }));\n    app.get(\"/assets/app.js\", (_req, res) => res.send(\"// js\"));\n    const { port, server } = await listen(app);\n    openServer = server;\n\n    // No Authorization header, yet the shell + assets are reachable.\n    const shell = await fetch(`http://localhost:${port}/`);\n    expect(shell.status).toBe(200);\n    const asset = await fetch(`http://localhost:${port}/assets/app.js`);\n    expect(asset.status).toBe(200);\n  });\n\n  it(\"accepts the SSE ?token= query param on the stream route only\", async () => {\n    const app = (await import(\"express\")).default();\n    app.use(adminAuthMiddleware(\"topsecret\"));\n    // Echo whether the token leaked into the parsed query (it must NOT).\n    app.get(\"/__enpilink/observability/stream\", (req, res) =>\n      res.json({ ok: true, tokenInQuery: \"token\" in req.query }),\n    );\n    app.get(\"/__enpilink/observability/summary\", (req, res) =>\n      res.json({ ok: true, tokenInQuery: \"token\" in req.query }),\n    );\n    const { port, server } = await listen(app);\n    openServer = server;\n\n    // Stream with valid ?token= → 200, and token stripped from req.query.\n    const okStream = await fetch(\n      `http://localhost:${port}/__enpilink/observability/stream?token=topsecret`,\n    );\n    expect(okStream.status).toBe(200);\n    expect(await okStream.json()).toEqual({ ok: true, tokenInQuery: false });\n\n    // Wrong ?token= on the stream → 401.\n    const badStream = await fetch(\n      `http://localhost:${port}/__enpilink/observability/stream?token=wrong`,\n    );\n    expect(badStream.status).toBe(401);\n\n    // ?token= is NOT honored on other data routes (header-only there).\n    const summaryViaQuery = await fetch(\n      `http://localhost:${port}/__enpilink/observability/summary?token=topsecret`,\n    );\n    expect(summaryViaQuery.status).toBe(401);\n  });\n});\n\ndescribe(\"createApp — prod admin mode\", () => {\n  it(\"does NOT mount the admin plane when admin is disabled\", async () => {\n    process.env.NODE_ENV = \"production\";\n    delete process.env.ENPILINK_ADMIN;\n    const { createApp } = await import(\"./express.js\");\n    const server = new McpServer({ name: \"t\", version: \"0.0.0\" });\n    const httpServer = http.createServer();\n    await createApp({ mcpServer: server, httpServer });\n    const { port, server: listening } = await listen(server.express);\n    openServer = listening;\n\n    const obs = await fetch(`http://localhost:${port}${OBS}`);\n    expect(obs.status).toBe(404);\n\n    // /mcp still works regardless of admin.\n    const mcp = await fetch(`http://localhost:${port}/mcp`, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/json\" },\n      body: JSON.stringify({ jsonrpc: \"2.0\", method: \"initialize\", id: 1 }),\n    });\n    expect(mcp.status).not.toBe(404);\n  });\n\n  it(\"refuses to start when admin is enabled but no token is set\", async () => {\n    process.env.NODE_ENV = \"production\";\n    process.env.ENPILINK_ADMIN = \"1\";\n    delete process.env.ENPILINK_ADMIN_TOKEN;\n    const { createApp } = await import(\"./express.js\");\n    const server = new McpServer({ name: \"t\", version: \"0.0.0\" });\n    const httpServer = http.createServer();\n    await expect(\n      createApp({ mcpServer: server, httpServer }),\n    ).rejects.toBeInstanceOf(AdminTokenMissingError);\n  });\n\n  it(\"mounts the admin plane behind bearer auth when enabled with a token\", async () => {\n    process.env.NODE_ENV = \"production\";\n    process.env.ENPILINK_ADMIN = \"1\";\n    process.env.ENPILINK_ADMIN_TOKEN = \"letmein\";\n    process.env.ENPILINK_STORAGE = \"memory\"; // never touch disk in tests\n    const { createApp } = await import(\"./express.js\");\n    const server = new McpServer({ name: \"t\", version: \"0.0.0\" });\n    const httpServer = http.createServer();\n    await createApp({ mcpServer: server, httpServer });\n    const { port, server: listening } = await listen(server.express);\n    openServer = listening;\n\n    // SPA shell is reachable WITHOUT auth (so the browser can load the app).\n    const shell = await fetch(`http://localhost:${port}/`);\n    expect(shell.status).toBe(200);\n    expect(await shell.json()).toEqual({ shell: true });\n\n    // Unauthenticated data API → 401.\n    const unauth = await fetch(`http://localhost:${port}${OBS}`);\n    expect(unauth.status).toBe(401);\n\n    // Valid bearer → 200.\n    const authed = await fetch(`http://localhost:${port}${OBS}`, {\n      headers: { Authorization: \"Bearer letmein\" },\n    });\n    expect(authed.status).toBe(200);\n\n    // SSE stream authenticates via ?token= (EventSource can't set headers).\n    const STREAM = \"/__enpilink/observability/stream\";\n    const streamUnauth = await fetch(`http://localhost:${port}${STREAM}`);\n    expect(streamUnauth.status).toBe(401);\n    const streamAuthed = await fetch(\n      `http://localhost:${port}${STREAM}?token=letmein`,\n    );\n    expect(streamAuthed.status).toBe(200);\n    // Close the open SSE connection so the server can shut down cleanly.\n    await streamAuthed.body?.cancel();\n\n    // Admin storage was initialized independent of analytics (analytics OFF).\n    expect(server.storage).not.toBeNull();\n\n    // /mcp still works and is NOT guarded by the admin auth (no 401/404).\n    const mcp = await fetch(`http://localhost:${port}/mcp`, {\n      method: \"POST\",\n      headers: {\n        \"Content-Type\": \"application/json\",\n        Accept: \"application/json, text/event-stream\",\n      },\n      body: JSON.stringify({\n        jsonrpc: \"2.0\",\n        method: \"initialize\",\n        id: 1,\n        params: {\n          protocolVersion: \"2024-11-05\",\n          capabilities: {},\n          clientInfo: { name: \"c\", version: \"1\" },\n        },\n      }),\n    });\n    expect(mcp.status).toBe(200);\n\n    await server.storage?.close();\n  });\n});\n\ndescribe(\"createApp — dev mode unchanged\", () => {\n  it(\"mounts the admin plane on localhost with NO auth\", async () => {\n    delete process.env.NODE_ENV; // dev\n    const { createApp } = await import(\"./express.js\");\n    const server = new McpServer({ name: \"t\", version: \"0.0.0\" });\n    const httpServer = http.createServer();\n    await createApp({ mcpServer: server, httpServer });\n    const { port, server: listening } = await listen(server.express);\n    openServer = listening;\n\n    // No Authorization header, yet the observability route answers (200).\n    const obs = await fetch(`http://localhost:${port}${OBS}`);\n    expect(obs.status).toBe(200);\n  });\n});\n"]}

package/dist/server/analytics.d.ts

@@ -0,0 +1,60 @@
+import type { McpMiddlewareEntry, McpMiddlewareFn } from "./middleware.js";
+import { type OtelSink } from "./otel.js";
+import type { StorageAdapter } from "./storage/types.js";
+/**
+ * Analytics + log capture (M2). Opt-in, env-gated, zero overhead when off.
+ *
+ * When enabled, a single {@link StorageAdapter} is resolved + `init()`ed at
+ * server startup and shared in-process: the analytics middleware writes
+ * `tool_call` events to it, the log sink mirrors server logs to it, and (M3)
+ * the observability API reads from the very same instance via the
+ * `server.storage` getter or {@link getActiveStorage}.
+ *
+ * Gating: OFF unless `ENPILINK_ANALYTICS` is `1` or `true` (case-insensitive).
+ * When OFF, no adapter is resolved or initialized (so no `enpilink.db` is
+ * created), no middleware is registered, and there is zero network activity.
+ */
+/** Options for {@link installAnalytics}. */
+export interface InstallAnalyticsOptions {
+    /**
+     * Inject a clock for deterministic tests. Defaults to `Date.now`.
+     */
+    now?: () => number;
+}
+/**
+ * Whether analytics is enabled. OFF by default; enable with
+ * `ENPILINK_ANALYTICS=1` (also accepts `true`/`yes`/`on`, case-insensitive).
+ */
+export declare function analyticsEnabled(): boolean;
+/**
+ * Whether the `--mock` demo seed is enabled (`ENPILINK_MOCK`=1/true/yes/on).
+ * Mock mode is opt-in only and IMPLIES analytics-on + in-memory storage for the
+ * session, so the Dashboard renders full demo data with NO real traffic. It
+ * NEVER touches disk and is never on by default.
+ */
+export declare function mockEnabled(): boolean;
+/**
+ * Build the analytics middleware entry. Times each request around `next()`,
+ * records a `tool_call`-typed event (capturing the tool name for `tools/call`),
+ * and ALWAYS swallows storage errors so a storage failure can never break or
+ * slow a tool call. Recording is fire-and-forget (non-blocking).
+ */
+export declare function createAnalyticsMiddleware(storage: StorageAdapter, now?: () => number, otel?: OtelSink | null): McpMiddlewareFn;
+/**
+ * Install analytics on a server, ONLY when enabled (`ENPILINK_ANALYTICS`).
+ *
+ * When enabled: resolves a {@link StorageAdapter} via `resolveStorageAdapter()`
+ * (`ENPILINK_STORAGE` / `ENPILINK_DB_PATH`), `init()`s it, registers it as the
+ * active storage for the log sink + `getActiveStorage()`, and returns the
+ * built analytics middleware entry to splice into the chain.
+ *
+ * When disabled: resolves/initializes NOTHING and returns `null` — zero
+ * overhead, zero network, no `enpilink.db` created.
+ *
+ * @returns the active storage + middleware entry, or `null` when disabled.
+ */
+export declare function installAnalytics(opts?: InstallAnalyticsOptions): Promise<{
+    storage: StorageAdapter;
+    entry: McpMiddlewareEntry;
+    otel: OtelSink | null;
+} | null>;