enpilink 1.0.2

package/dist/server/asset-base-url-transform-plugin.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"asset-base-url-transform-plugin.test.js","sourceRoot":"","sources":["../../src/server/asset-base-url-transform-plugin.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,YAAY,GACb,MAAM,sCAAsC,CAAC;AAE9C,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,KAAK,GAAG;YACZ;gBACE,IAAI,EAAE,eAAe;gBACrB,IAAI,EAAE,mCAAmC;gBACzC,QAAQ,EAAE,wEAAwE;aACnF;YACD;gBACE,IAAI,EAAE,eAAe;gBACrB,IAAI,EAAE,mCAAmC;gBACzC,QAAQ,EAAE,wEAAwE;aACnF;YACD;gBACE,IAAI,EAAE,iBAAiB;gBACvB,IAAI,EAAE,mCAAmC;gBACzC,QAAQ,EAAE,wEAAwE;aACnF;SACF,CAAC;QAEF,KAAK,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,KAAK,EAAE,CAAC;YACvC,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;YAC3C,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,IAAI,GAAG;;;;KAIZ,CAAC;QACF,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAE3C,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CACtB,yDAAyD,CAC1D,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CACtB,yDAAyD,CAC1D,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CACtB,2DAA2D,CAC5D,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,IAAI,GAAG;;;;KAIZ,CAAC;QACF,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAE3C,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CACtB,yDAAyD,CAC1D,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAC;QACzD,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,+BAA+B,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,IAAI,GAAG,6BAA6B,CAAC;QAC3C,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAE3C,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,2EAA2E;QAC3E,wEAAwE;QACxE,6DAA6D;QAC7D,8EAA8E;QAC9E,MAAM,KAAK,GAAG;YACZ,sEAAsE;YACtE,yCAAyC;YACzC,yCAAyC;YACzC,8CAA8C;YAC9C,sCAAsC;SACvC,CAAC;QAEF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6FAA6F,EAAE,GAAG,EAAE;QACrG,MAAM,IAAI,GAAG;YACX,iCAAiC;YACjC,+CAA+C;YAC/C,kCAAkC;SACnC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAE3C,oBAAoB;QACpB,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAC5C,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAC;QACtD,2BAA2B;QAC3B,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CACtB,uEAAuE,CACxE,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,CAAC,YAAY,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,CAAC,YAAY,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1D,MAAM,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,CAAC,YAAY,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1D,MAAM,CAAC,YAAY,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1D,MAAM,CAAC,YAAY,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,CAAC,YAAY,CAAC,sCAAsC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnD,MAAM,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClD,MAAM,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClD,MAAM,CAAC,YAAY,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;IAG3C,SAAS,YAAY,CAAC,EAAU,EAAE,IAAY;QAC5C,MAAM,MAAM,GAAG,2BAA2B,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC;QAC9B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;QACjE,OAAO,OAAO,CAAC,IAAI;QACjB,6EAA6E;QAC7E,EAAS,EACT,IAAI,EACJ,EAAE,EACF,EAAE,UAAU,EAAE,IAAI,EAAE,CACF,CAAC;IACvB,CAAC;IAED,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,MAAM,GAAG,YAAY,CACzB,iBAAiB,EACjB,kCAAkC,CACnC,CAAC;QACF,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,SAAS,CAC5B,yDAAyD,CAC1D,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,qEAAqE;IACrE,2EAA2E;IAC3E,iEAAiE;IACjE,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,MAAM,OAAO,GAAG,4GAA4G,CAAC;QAE7H,MAAM,CAAC,YAAY,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC3D,MAAM,CAAC,YAAY,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAClE,MAAM,CAAC,YAAY,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAClE,MAAM,CAAC,YAAY,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC7D,MAAM,CACJ,YAAY,CAAC,sCAAsC,EAAE,OAAO,CAAC,CAC9D,CAAC,QAAQ,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["import { describe, expect, it } from \"vitest\";\nimport {\n  assetBaseUrlTransform,\n  assetBaseUrlTransformPlugin,\n  isCssRequest,\n} from \"./asset-base-url-transform-plugin.js\";\n\ndescribe(\"assetBaseUrlTransform\", () => {\n  it(\"should transform asset paths to use window.enpilink.serverUrl\", () => {\n    const cases = [\n      {\n        desc: \"single-quoted\",\n        code: `const image = '/assets/logo.png';`,\n        expected: `const image = (window.enpilink?.serverUrl ?? \"\") + \"/assets/logo.png\";`,\n      },\n      {\n        desc: \"double-quoted\",\n        code: `const image = \"/assets/logo.png\";`,\n        expected: `const image = (window.enpilink?.serverUrl ?? \"\") + \"/assets/logo.png\";`,\n      },\n      {\n        desc: \"backtick-quoted\",\n        code: \"const image = `/assets/logo.png`;\",\n        expected: `const image = (window.enpilink?.serverUrl ?? \"\") + \"/assets/logo.png\";`,\n      },\n    ];\n\n    for (const { code, expected } of cases) {\n      const result = assetBaseUrlTransform(code);\n      expect(result).toBe(expected);\n    }\n  });\n\n  it(\"should transform multiple asset paths\", () => {\n    const code = `\n      const logo = '/assets/logo.png';\n      const icon = '/assets/icon.svg';\n      const font = '/assets/font.woff2';\n    `;\n    const result = assetBaseUrlTransform(code);\n\n    expect(result).toContain(\n      `(window.enpilink?.serverUrl ?? \"\") + \"/assets/logo.png\"`,\n    );\n    expect(result).toContain(\n      `(window.enpilink?.serverUrl ?? \"\") + \"/assets/icon.svg\"`,\n    );\n    expect(result).toContain(\n      `(window.enpilink?.serverUrl ?? \"\") + \"/assets/font.woff2\"`,\n    );\n  });\n\n  it(\"should not transform already absolute URLs\", () => {\n    const code = `\n      const local = '/assets/logo.png';\n      const http = 'http://example.com/image.png';\n      const https = 'https://example.com/image.png';\n    `;\n    const result = assetBaseUrlTransform(code);\n\n    expect(result).toContain(\n      `(window.enpilink?.serverUrl ?? \"\") + \"/assets/logo.png\"`,\n    );\n    expect(result).toContain(\"http://example.com/image.png\");\n    expect(result).toContain(\"https://example.com/image.png\");\n  });\n\n  it(\"should not transform code without asset paths\", () => {\n    const code = `const text = \"Hello World\";`;\n    const result = assetBaseUrlTransform(code);\n\n    expect(result).toBe(code);\n  });\n\n  it(\"should not transform asset paths inside static `import ... from` clauses\", () => {\n    // Reproducer for #713: a dep does `import * as sprite from './icons.svg'`,\n    // Vite resolves the relative path to absolute, then this transform used\n    // to rewrite the resolved string — producing invalid JS like\n    // `import * as sprite from (expr) + \"...\"` that crashes vite:import-analysis.\n    const cases = [\n      `import * as sprite from \"/Users/me/proj/node_modules/pkg/icons.svg\";`,\n      `import sprite from '/assets/icons.svg';`,\n      `import sprite from \"/assets/icons.svg\";`,\n      `export { default } from \"/assets/icons.svg\";`,\n      `export * from '/assets/sprites.svg';`,\n    ];\n\n    for (const code of cases) {\n      expect(assetBaseUrlTransform(code)).toBe(code);\n    }\n  });\n\n  it(\"should still transform value-position asset paths in files that also have unrelated imports\", () => {\n    const code = [\n      `import { foo } from \"./foo.js\";`,\n      `import * as sprite from \"/assets/sprite.svg\";`,\n      `const logo = \"/assets/logo.png\";`,\n    ].join(\"\\n\");\n    const result = assetBaseUrlTransform(code);\n\n    // Imports untouched\n    expect(result).toContain(`from \"./foo.js\"`);\n    expect(result).toContain(`from \"/assets/sprite.svg\"`);\n    // Value-position rewritten\n    expect(result).toContain(\n      `const logo = (window.enpilink?.serverUrl ?? \"\") + \"/assets/logo.png\";`,\n    );\n  });\n});\n\ndescribe(\"isCssRequest\", () => {\n  it(\"returns true for CSS-family extensions\", () => {\n    expect(isCssRequest(\"/src/styles.css\")).toBe(true);\n    expect(isCssRequest(\"/src/styles.module.css\")).toBe(true);\n    expect(isCssRequest(\"/src/styles.scss\")).toBe(true);\n    expect(isCssRequest(\"/src/styles.sass\")).toBe(true);\n    expect(isCssRequest(\"/src/styles.less\")).toBe(true);\n    expect(isCssRequest(\"/src/styles.styl\")).toBe(true);\n  });\n\n  it(\"returns true for CSS modules with Vite query strings\", () => {\n    expect(isCssRequest(\"/src/styles.css?direct\")).toBe(true);\n    expect(isCssRequest(\"/src/styles.css?inline\")).toBe(true);\n    expect(isCssRequest(\"/src/styles.css?used\")).toBe(true);\n    expect(isCssRequest(\"/src/Foo.vue?vue&type=style&lang.css\")).toBe(true);\n  });\n\n  it(\"returns false for non-CSS modules\", () => {\n    expect(isCssRequest(\"/src/index.tsx\")).toBe(false);\n    expect(isCssRequest(\"/src/utils.ts\")).toBe(false);\n    expect(isCssRequest(\"/src/Logo.svg\")).toBe(false);\n    expect(isCssRequest(\"/src/notes.cssx\")).toBe(false);\n  });\n});\n\ndescribe(\"assetBaseUrlTransformPlugin\", () => {\n  type TransformResult = { code: string; map: null } | null;\n\n  function runTransform(id: string, code: string): TransformResult {\n    const plugin = assetBaseUrlTransformPlugin();\n    const hook = plugin.transform;\n    if (!hook) {\n      throw new Error(\"plugin.transform is not defined\");\n    }\n    const handler = typeof hook === \"function\" ? hook : hook.handler;\n    return handler.call(\n      // biome-ignore lint/suspicious/noExplicitAny: vitest harness for plugin hook\n      {} as any,\n      code,\n      id,\n      { moduleType: \"js\" },\n    ) as TransformResult;\n  }\n\n  it(\"rewrites asset paths in JS modules\", () => {\n    const result = runTransform(\n      \"/src/widget.tsx\",\n      `const logo = \"/assets/logo.png\";`,\n    );\n    expect(result?.code).toContain(\n      `(window.enpilink?.serverUrl ?? \"\") + \"/assets/logo.png\"`,\n    );\n  });\n\n  // Reproducer for #697: CSS imports are served as JS modules with the\n  // stylesheet embedded as a string. Rewriting url(\"/foo.woff2\") inside that\n  // string would produce invalid CSS once the styles are injected.\n  it(\"does not rewrite asset paths when transforming a CSS module\", () => {\n    const cssCode = `__vite__updateStyle(\"style-id\", \"@font-face { src: url(\\\\\"/fonts/Brand.woff2\\\\\") format(\\\\\"woff2\\\\\"); }\");`;\n\n    expect(runTransform(\"/src/fonts.css\", cssCode)).toBeNull();\n    expect(runTransform(\"/src/fonts.css?direct\", cssCode)).toBeNull();\n    expect(runTransform(\"/src/fonts.css?inline\", cssCode)).toBeNull();\n    expect(runTransform(\"/src/styles.scss\", cssCode)).toBeNull();\n    expect(\n      runTransform(\"/src/Foo.vue?vue&type=style&lang.css\", cssCode),\n    ).toBeNull();\n  });\n});\n"]}

package/dist/server/auth.d.ts

@@ -0,0 +1,20 @@
+import { type BearerAuthMiddlewareOptions } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
+import type { RequestHandler } from "express";
+export { InvalidTokenError } from "@modelcontextprotocol/sdk/server/auth/errors.js";
+export { type BearerAuthMiddlewareOptions, requireBearerAuth, } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
+export { type AuthMetadataOptions, mcpAuthMetadataRouter, } from "@modelcontextprotocol/sdk/server/auth/router.js";
+export type { AuthInfo } from "@modelcontextprotocol/sdk/server/auth/types.js";
+/**
+ * Like `requireBearerAuth`, but lets requests through when no
+ * `Authorization` header is present. Used for mixed-auth servers where some
+ * tools are public and others require sign-in: each tool enforces its own
+ * `securitySchemes` against `extra.authInfo`.
+ *
+ * Behavior:
+ * - No `Authorization` header → `next()` without `req.auth`.
+ * - Valid Bearer token → `req.auth` set, same as `requireBearerAuth`.
+ * - Invalid / malformed / expired / insufficient-scope → same error response
+ *   as `requireBearerAuth` (401/403). Sending a bad token is still a client
+ *   error.
+ */
+export declare function optionalBearerAuth(options: BearerAuthMiddlewareOptions): RequestHandler;

package/dist/server/auth.js

@@ -0,0 +1,28 @@
+import { requireBearerAuth, } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
+export { InvalidTokenError } from "@modelcontextprotocol/sdk/server/auth/errors.js";
+export { requireBearerAuth, } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
+export { mcpAuthMetadataRouter, } from "@modelcontextprotocol/sdk/server/auth/router.js";
+/**
+ * Like `requireBearerAuth`, but lets requests through when no
+ * `Authorization` header is present. Used for mixed-auth servers where some
+ * tools are public and others require sign-in: each tool enforces its own
+ * `securitySchemes` against `extra.authInfo`.
+ *
+ * Behavior:
+ * - No `Authorization` header → `next()` without `req.auth`.
+ * - Valid Bearer token → `req.auth` set, same as `requireBearerAuth`.
+ * - Invalid / malformed / expired / insufficient-scope → same error response
+ *   as `requireBearerAuth` (401/403). Sending a bad token is still a client
+ *   error.
+ */
+export function optionalBearerAuth(options) {
+    const required = requireBearerAuth(options);
+    return (req, res, next) => {
+        if (!req.headers.authorization) {
+            next();
+            return;
+        }
+        return required(req, res, next);
+    };
+}
+//# sourceMappingURL=auth.js.map

package/dist/server/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/server/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,iBAAiB,GAClB,MAAM,gEAAgE,CAAC;AAIxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iDAAiD,CAAC;AACpF,OAAO,EAEL,iBAAiB,GAClB,MAAM,gEAAgE,CAAC;AACxE,OAAO,EAEL,qBAAqB,GACtB,MAAM,iDAAiD,CAAC;AAGzD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAoC;IAEpC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACxB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YAC/B,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QACD,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import {\n  type BearerAuthMiddlewareOptions,\n  requireBearerAuth,\n} from \"@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js\";\n\nimport type { RequestHandler } from \"express\";\n\nexport { InvalidTokenError } from \"@modelcontextprotocol/sdk/server/auth/errors.js\";\nexport {\n  type BearerAuthMiddlewareOptions,\n  requireBearerAuth,\n} from \"@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js\";\nexport {\n  type AuthMetadataOptions,\n  mcpAuthMetadataRouter,\n} from \"@modelcontextprotocol/sdk/server/auth/router.js\";\nexport type { AuthInfo } from \"@modelcontextprotocol/sdk/server/auth/types.js\";\n\n/**\n * Like `requireBearerAuth`, but lets requests through when no\n * `Authorization` header is present. Used for mixed-auth servers where some\n * tools are public and others require sign-in: each tool enforces its own\n * `securitySchemes` against `extra.authInfo`.\n *\n * Behavior:\n * - No `Authorization` header → `next()` without `req.auth`.\n * - Valid Bearer token → `req.auth` set, same as `requireBearerAuth`.\n * - Invalid / malformed / expired / insufficient-scope → same error response\n *   as `requireBearerAuth` (401/403). Sending a bad token is still a client\n *   error.\n */\nexport function optionalBearerAuth(\n  options: BearerAuthMiddlewareOptions,\n): RequestHandler {\n  const required = requireBearerAuth(options);\n  return (req, res, next) => {\n    if (!req.headers.authorization) {\n      next();\n      return;\n    }\n    return required(req, res, next);\n  };\n}\n"]}

package/dist/server/build-manifest.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/server/build-manifest.test.js

@@ -0,0 +1,27 @@
+import { describe, expect, it } from "vitest";
+import { __setBuildManifest, McpServer } from "./index.js";
+function manifestOf(server) {
+    return server.viteManifest;
+}
+function makeServer() {
+    return new McpServer({ name: "test", version: "0.0.1" }, { capabilities: {} });
+}
+describe("__setBuildManifest", () => {
+    it("primes the Vite manifest for the next McpServer constructed", () => {
+        const manifest = {
+            "src/views/index.tsx": { file: "assets/index-DEADBEEF.js" },
+        };
+        __setBuildManifest(manifest);
+        // viteManifest is private; reach into it to lock the contract that the
+        // generated `dist/__entry.js` relies on.
+        expect(manifestOf(makeServer())).toEqual(manifest);
+    });
+    it("is consume-once: a second McpServer built without re-priming gets no manifest", () => {
+        __setBuildManifest({
+            "src/views/index.tsx": { file: "assets/index-CAFEBABE.js" },
+        });
+        makeServer(); // consumes the primed manifest
+        expect(manifestOf(makeServer())).toBeNull();
+    });
+});
+//# sourceMappingURL=build-manifest.test.js.map

package/dist/server/build-manifest.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-manifest.test.js","sourceRoot":"","sources":["../../src/server/build-manifest.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE3D,SAAS,UAAU,CACjB,MAAiB;IAEjB,OACE,MAGD,CAAC,YAAY,CAAC;AACjB,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,IAAI,SAAS,CAClB,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,EAClC,EAAE,YAAY,EAAE,EAAE,EAAE,CACrB,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,MAAM,QAAQ,GAAG;YACf,qBAAqB,EAAE,EAAE,IAAI,EAAE,0BAA0B,EAAE;SAC5D,CAAC;QACF,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QAE7B,uEAAuE;QACvE,yCAAyC;QACzC,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+EAA+E,EAAE,GAAG,EAAE;QACvF,kBAAkB,CAAC;YACjB,qBAAqB,EAAE,EAAE,IAAI,EAAE,0BAA0B,EAAE;SAC5D,CAAC,CAAC;QAEH,UAAU,EAAE,CAAC,CAAC,+BAA+B;QAC7C,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["import { describe, expect, it } from \"vitest\";\nimport { __setBuildManifest, McpServer } from \"./index.js\";\n\nfunction manifestOf(\n  server: McpServer,\n): Record<string, { file: string }> | null {\n  return (\n    server as unknown as {\n      viteManifest: Record<string, { file: string }> | null;\n    }\n  ).viteManifest;\n}\n\nfunction makeServer(): McpServer {\n  return new McpServer(\n    { name: \"test\", version: \"0.0.1\" },\n    { capabilities: {} },\n  );\n}\n\ndescribe(\"__setBuildManifest\", () => {\n  it(\"primes the Vite manifest for the next McpServer constructed\", () => {\n    const manifest = {\n      \"src/views/index.tsx\": { file: \"assets/index-DEADBEEF.js\" },\n    };\n    __setBuildManifest(manifest);\n\n    // viteManifest is private; reach into it to lock the contract that the\n    // generated `dist/__entry.js` relies on.\n    expect(manifestOf(makeServer())).toEqual(manifest);\n  });\n\n  it(\"is consume-once: a second McpServer built without re-priming gets no manifest\", () => {\n    __setBuildManifest({\n      \"src/views/index.tsx\": { file: \"assets/index-CAFEBABE.js\" },\n    });\n\n    makeServer(); // consumes the primed manifest\n    expect(manifestOf(makeServer())).toBeNull();\n  });\n});\n"]}

package/dist/server/config/config.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/server/config/config.test.js

@@ -0,0 +1,214 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import express from "express";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { MemoryStorageAdapter } from "../storage/memory.js";
+import { MASKED, resolveConfig, validateRuntimeWrite } from "./resolve.js";
+import { createConfigRouter } from "./router.js";
+/** A throwaway dir with no enpilink.config.* so file source never interferes. */
+let cwd;
+beforeEach(() => {
+    cwd = fs.mkdtempSync(path.join(os.tmpdir(), "enpi-cfg-"));
+});
+afterEach(() => {
+    fs.rmSync(cwd, { recursive: true, force: true });
+    // Clean any env we set.
+    for (const k of Object.keys(process.env)) {
+        if (k.startsWith("ENPILINK_CFG_") || k === "ENPILINK_ANALYTICS") {
+            delete process.env[k];
+        }
+    }
+});
+describe("resolveConfig precedence", () => {
+    it("defaults when no source supplies a value", async () => {
+        const { settings } = await resolveConfig(null, cwd);
+        const s = settings.find((x) => x.key === "analytics.sampleRate");
+        expect(s?.value).toBe(1);
+        expect(s?.source).toBe("default");
+        expect(s?.envLocked).toBe(false);
+    });
+    it("db beats default for runtime keys", async () => {
+        const storage = new MemoryStorageAdapter();
+        await storage.setConfig("analytics.sampleRate", 0.25, "tester");
+        const { settings, values } = await resolveConfig(storage, cwd);
+        const s = settings.find((x) => x.key === "analytics.sampleRate");
+        expect(s?.source).toBe("db");
+        expect(s?.value).toBe(0.25);
+        expect(values["analytics.sampleRate"]).toBe(0.25);
+    });
+    it("file beats db", async () => {
+        const storage = new MemoryStorageAdapter();
+        await storage.setConfig("analytics.sampleRate", 0.25);
+        fs.writeFileSync(path.join(cwd, "enpilink.config.json"), JSON.stringify({ "analytics.sampleRate": 0.5 }));
+        const { settings } = await resolveConfig(storage, cwd);
+        const s = settings.find((x) => x.key === "analytics.sampleRate");
+        expect(s?.source).toBe("file");
+        expect(s?.value).toBe(0.5);
+        expect(s?.envLocked).toBe(true); // file pins it → read-only in UI
+    });
+    it("env beats file and db", async () => {
+        const storage = new MemoryStorageAdapter();
+        await storage.setConfig("analytics.sampleRate", 0.25);
+        fs.writeFileSync(path.join(cwd, "enpilink.config.json"), JSON.stringify({ "analytics.sampleRate": 0.5 }));
+        process.env.ENPILINK_CFG_ANALYTICS_SAMPLE_RATE = "0.75";
+        const { settings } = await resolveConfig(storage, cwd);
+        const s = settings.find((x) => x.key === "analytics.sampleRate");
+        expect(s?.source).toBe("env");
+        expect(s?.value).toBe(0.75);
+        expect(s?.envLocked).toBe(true);
+    });
+    it("coerces env booleans/numbers to typed values", async () => {
+        process.env.ENPILINK_CFG_FLAGS_LIVE_LOGS = "false";
+        process.env.ENPILINK_CFG_RETENTION_EVENTS = "1234";
+        const { values } = await resolveConfig(null, cwd);
+        expect(values["flags.liveLogs"]).toBe(false);
+        expect(values["retention.events"]).toBe(1234);
+    });
+});
+describe("secret masking", () => {
+    it("never returns a secret value in plaintext", async () => {
+        process.env.ENPILINK_ADMIN_TOKEN = "super-secret-xyz";
+        const { settings } = await resolveConfig(null, cwd);
+        const s = settings.find((x) => x.key === "adminAuthToken");
+        expect(s?.secret).toBe(true);
+        expect(s?.envLocked).toBe(true);
+        expect(s?.value).toBe(MASKED);
+        expect(JSON.stringify(settings)).not.toContain("super-secret-xyz");
+        delete process.env.ENPILINK_ADMIN_TOKEN;
+    });
+    it("unset secret reports null, not masked", async () => {
+        const { settings } = await resolveConfig(null, cwd);
+        const s = settings.find((x) => x.key === "adminAuthToken");
+        expect(s?.value).toBeNull();
+    });
+    it("bootstrap keys are always env-locked", async () => {
+        const { settings } = await resolveConfig(null, cwd);
+        for (const key of ["storage", "dbPath", "port", "admin"]) {
+            const s = settings.find((x) => x.key === key);
+            expect(s?.tier).toBe("bootstrap");
+            expect(s?.envLocked).toBe(true);
+        }
+    });
+});
+describe("validateRuntimeWrite", () => {
+    it("accepts a valid runtime value", () => {
+        const r = validateRuntimeWrite("analytics.sampleRate", 0.3);
+        expect(r.ok).toBe(true);
+        if (r.ok) {
+            expect(r.value).toBe(0.3);
+        }
+    });
+    it("coerces a stringy boolean for a flag", () => {
+        const r = validateRuntimeWrite("flags.liveLogs", "true");
+        expect(r.ok).toBe(true);
+        if (r.ok) {
+            expect(r.value).toBe(true);
+        }
+    });
+    it("rejects out-of-range", () => {
+        const r = validateRuntimeWrite("analytics.sampleRate", 5);
+        expect(r.ok).toBe(false);
+    });
+    it("rejects bootstrap key", () => {
+        expect(validateRuntimeWrite("port", 8080).ok).toBe(false);
+    });
+    it("rejects secret key", () => {
+        expect(validateRuntimeWrite("adminAuthToken", "x").ok).toBe(false);
+    });
+});
+// --- Router integration tests ---
+async function request(app, method, url, body) {
+    const { createServer } = await import("node:http");
+    const server = createServer(app);
+    await new Promise((r) => server.listen(0, r));
+    const addr = server.address();
+    const port = typeof addr === "object" && addr ? addr.port : 0;
+    try {
+        const res = await fetch(`http://127.0.0.1:${port}${url}`, {
+            method,
+            headers: body ? { "content-type": "application/json" } : undefined,
+            body: body ? JSON.stringify(body) : undefined,
+        });
+        return { status: res.status, json: await res.json().catch(() => null) };
+    }
+    finally {
+        await new Promise((r) => server.close(() => r()));
+    }
+}
+function appWith(storage) {
+    const app = express();
+    app.use(express.json());
+    app.use(createConfigRouter(() => storage));
+    return app;
+}
+describe("config router", () => {
+    it("GET /config returns settings; never 500 with no storage", async () => {
+        const app = appWith(null);
+        const { status, json } = await request(app, "GET", "/__enpilink/config");
+        expect(status).toBe(200);
+        const settings = json.settings;
+        expect(Array.isArray(settings)).toBe(true);
+        expect(settings.length).toBeGreaterThan(0);
+    });
+    it("PUT a runtime key persists + writes an audit row", async () => {
+        const storage = new MemoryStorageAdapter();
+        const app = appWith(storage);
+        const { status, json } = await request(app, "PUT", "/__enpilink/config/analytics.sampleRate", { value: 0.4 });
+        expect(status).toBe(200);
+        expect(json.ok).toBe(true);
+        expect(await storage.getConfig("analytics.sampleRate")).toBe(0.4);
+        const audit = await storage.getConfigAudit();
+        expect(audit[0]).toMatchObject({
+            key: "analytics.sampleRate",
+            newValue: 0.4,
+        });
+    });
+    it("PUT rejects a bootstrap key (403)", async () => {
+        const storage = new MemoryStorageAdapter();
+        const app = appWith(storage);
+        const { status } = await request(app, "PUT", "/__enpilink/config/port", {
+            value: 9999,
+        });
+        expect(status).toBe(403);
+    });
+    it("PUT rejects a secret key (403)", async () => {
+        const storage = new MemoryStorageAdapter();
+        const app = appWith(storage);
+        const { status } = await request(app, "PUT", "/__enpilink/config/adminAuthToken", { value: "x" });
+        expect(status).toBe(403);
+    });
+    it("PUT rejects an unknown key (404)", async () => {
+        const app = appWith(new MemoryStorageAdapter());
+        const { status } = await request(app, "PUT", "/__enpilink/config/nope", {
+            value: 1,
+        });
+        expect(status).toBe(404);
+    });
+    it("PUT rejects an out-of-range runtime value (400)", async () => {
+        const app = appWith(new MemoryStorageAdapter());
+        const { status } = await request(app, "PUT", "/__enpilink/config/analytics.sampleRate", { value: 99 });
+        expect(status).toBe(400);
+    });
+    it("PUT with no storage → 409 (nowhere to persist)", async () => {
+        const app = appWith(null);
+        const { status } = await request(app, "PUT", "/__enpilink/config/flags.liveLogs", { value: false });
+        expect(status).toBe(409);
+    });
+    it("GET /config/audit surfaces entries", async () => {
+        const storage = new MemoryStorageAdapter();
+        await storage.setConfig("flags.liveLogs", false, "tester");
+        const app = appWith(storage);
+        const { status, json } = await request(app, "GET", "/__enpilink/config/audit");
+        expect(status).toBe(200);
+        const audit = json.audit;
+        expect(audit[0]?.key).toBe("flags.liveLogs");
+    });
+    it("GET /config/audit with no storage → empty, never 500", async () => {
+        const app = appWith(null);
+        const { status, json } = await request(app, "GET", "/__enpilink/config/audit");
+        expect(status).toBe(200);
+        expect(json.audit).toEqual([]);
+    });
+});
+//# sourceMappingURL=config.test.js.map

package/dist/server/config/config.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.test.js","sourceRoot":"","sources":["../../../src/server/config/config.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAE5D,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAC3E,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjD,iFAAiF;AACjF,IAAI,GAAW,CAAC;AAEhB,UAAU,CAAC,GAAG,EAAE;IACd,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC;AAC5D,CAAC,CAAC,CAAC;AACH,SAAS,CAAC,GAAG,EAAE;IACb,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,wBAAwB;IACxB,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,oBAAoB,EAAE,CAAC;YAChE,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACpD,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,sBAAsB,CAAC,CAAC;QACjE,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACzB,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAClC,MAAM,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;QACjD,MAAM,OAAO,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC3C,MAAM,OAAO,CAAC,SAAS,CAAC,sBAAsB,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QAChE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC/D,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,sBAAsB,CAAC,CAAC;QACjE,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,eAAe,EAAE,KAAK,IAAI,EAAE;QAC7B,MAAM,OAAO,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC3C,MAAM,OAAO,CAAC,SAAS,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;QACtD,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,sBAAsB,CAAC,EACtC,IAAI,CAAC,SAAS,CAAC,EAAE,sBAAsB,EAAE,GAAG,EAAE,CAAC,CAChD,CAAC;QACF,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACvD,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,sBAAsB,CAAC,CAAC;QACjE,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/B,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3B,MAAM,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,iCAAiC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uBAAuB,EAAE,KAAK,IAAI,EAAE;QACrC,MAAM,OAAO,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC3C,MAAM,OAAO,CAAC,SAAS,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;QACtD,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,sBAAsB,CAAC,EACtC,IAAI,CAAC,SAAS,CAAC,EAAE,sBAAsB,EAAE,GAAG,EAAE,CAAC,CAChD,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,kCAAkC,GAAG,MAAM,CAAC;QACxD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACvD,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,sBAAsB,CAAC,CAAC;QACjE,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,OAAO,CAAC,GAAG,CAAC,4BAA4B,GAAG,OAAO,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,6BAA6B,GAAG,MAAM,CAAC;QACnD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAClD,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,kBAAkB,CAAC;QACtD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACpD,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,gBAAgB,CAAC,CAAC;QAC3D,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QACnE,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACpD,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,gBAAgB,CAAC,CAAC;QAC3D,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACpD,KAAK,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;YACzD,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;YAC9C,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAClC,MAAM,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,GAAG,oBAAoB,CAAC,sBAAsB,EAAE,GAAG,CAAC,CAAC;QAC5D,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;YACT,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,CAAC,GAAG,oBAAoB,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;QACzD,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;YACT,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE;QAC9B,MAAM,CAAC,GAAG,oBAAoB,CAAC,sBAAsB,EAAE,CAAC,CAAC,CAAC;QAC1D,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,uBAAuB,EAAE,GAAG,EAAE;QAC/B,MAAM,CAAC,oBAAoB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,oBAAoB,EAAE,GAAG,EAAE;QAC5B,MAAM,CAAC,oBAAoB,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,mCAAmC;AAEnC,KAAK,UAAU,OAAO,CACpB,GAAoB,EACpB,MAAc,EACd,GAAW,EACX,IAAc;IAEd,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,oBAAoB,IAAI,GAAG,GAAG,EAAE,EAAE;YACxD,MAAM;YACN,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,SAAS;YAClE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;SAC9C,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;IAC1E,CAAC;YAAS,CAAC;QACT,MAAM,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,OAA8B;IAC7C,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACxB,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3C,OAAO,GAAG,CAAC;AACb,CAAC;AAED,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1B,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,oBAAoB,CAAC,CAAC;QACzE,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,QAAQ,GAAI,IAAgC,CAAC,QAAQ,CAAC;QAC5D,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,OAAO,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAC7B,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CACpC,GAAG,EACH,KAAK,EACL,yCAAyC,EACzC,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,CAAE,IAAwB,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChD,MAAM,CAAC,MAAM,OAAO,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClE,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,cAAc,EAAE,CAAC;QAC7C,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;YAC7B,GAAG,EAAE,sBAAsB;YAC3B,QAAQ,EAAE,GAAG;SACd,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;QACjD,MAAM,OAAO,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAC7B,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,yBAAyB,EAAE;YACtE,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;QAC9C,MAAM,OAAO,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAC7B,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAC9B,GAAG,EACH,KAAK,EACL,mCAAmC,EACnC,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;QAChD,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,oBAAoB,EAAE,CAAC,CAAC;QAChD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,yBAAyB,EAAE;YACtE,KAAK,EAAE,CAAC;SACT,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,oBAAoB,EAAE,CAAC,CAAC;QAChD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAC9B,GAAG,EACH,KAAK,EACL,yCAAyC,EACzC,EAAE,KAAK,EAAE,EAAE,EAAE,CACd,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1B,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAC9B,GAAG,EACH,KAAK,EACL,mCAAmC,EACnC,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,OAAO,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC3C,MAAM,OAAO,CAAC,SAAS,CAAC,gBAAgB,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC3D,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAC7B,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CACpC,GAAG,EACH,KAAK,EACL,0BAA0B,CAC3B,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,KAAK,GAAI,IAA0C,CAAC,KAAK,CAAC;QAChE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1B,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CACpC,GAAG,EACH,KAAK,EACL,0BAA0B,CAC3B,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,CAAE,IAA6B,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["import fs from \"node:fs\";\nimport os from \"node:os\";\nimport path from \"node:path\";\nimport express from \"express\";\nimport { afterEach, beforeEach, describe, expect, it } from \"vitest\";\nimport { MemoryStorageAdapter } from \"../storage/memory.js\";\nimport type { StorageAdapter } from \"../storage/types.js\";\nimport { MASKED, resolveConfig, validateRuntimeWrite } from \"./resolve.js\";\nimport { createConfigRouter } from \"./router.js\";\n\n/** A throwaway dir with no enpilink.config.* so file source never interferes. */\nlet cwd: string;\n\nbeforeEach(() => {\n  cwd = fs.mkdtempSync(path.join(os.tmpdir(), \"enpi-cfg-\"));\n});\nafterEach(() => {\n  fs.rmSync(cwd, { recursive: true, force: true });\n  // Clean any env we set.\n  for (const k of Object.keys(process.env)) {\n    if (k.startsWith(\"ENPILINK_CFG_\") || k === \"ENPILINK_ANALYTICS\") {\n      delete process.env[k];\n    }\n  }\n});\n\ndescribe(\"resolveConfig precedence\", () => {\n  it(\"defaults when no source supplies a value\", async () => {\n    const { settings } = await resolveConfig(null, cwd);\n    const s = settings.find((x) => x.key === \"analytics.sampleRate\");\n    expect(s?.value).toBe(1);\n    expect(s?.source).toBe(\"default\");\n    expect(s?.envLocked).toBe(false);\n  });\n\n  it(\"db beats default for runtime keys\", async () => {\n    const storage = new MemoryStorageAdapter();\n    await storage.setConfig(\"analytics.sampleRate\", 0.25, \"tester\");\n    const { settings, values } = await resolveConfig(storage, cwd);\n    const s = settings.find((x) => x.key === \"analytics.sampleRate\");\n    expect(s?.source).toBe(\"db\");\n    expect(s?.value).toBe(0.25);\n    expect(values[\"analytics.sampleRate\"]).toBe(0.25);\n  });\n\n  it(\"file beats db\", async () => {\n    const storage = new MemoryStorageAdapter();\n    await storage.setConfig(\"analytics.sampleRate\", 0.25);\n    fs.writeFileSync(\n      path.join(cwd, \"enpilink.config.json\"),\n      JSON.stringify({ \"analytics.sampleRate\": 0.5 }),\n    );\n    const { settings } = await resolveConfig(storage, cwd);\n    const s = settings.find((x) => x.key === \"analytics.sampleRate\");\n    expect(s?.source).toBe(\"file\");\n    expect(s?.value).toBe(0.5);\n    expect(s?.envLocked).toBe(true); // file pins it → read-only in UI\n  });\n\n  it(\"env beats file and db\", async () => {\n    const storage = new MemoryStorageAdapter();\n    await storage.setConfig(\"analytics.sampleRate\", 0.25);\n    fs.writeFileSync(\n      path.join(cwd, \"enpilink.config.json\"),\n      JSON.stringify({ \"analytics.sampleRate\": 0.5 }),\n    );\n    process.env.ENPILINK_CFG_ANALYTICS_SAMPLE_RATE = \"0.75\";\n    const { settings } = await resolveConfig(storage, cwd);\n    const s = settings.find((x) => x.key === \"analytics.sampleRate\");\n    expect(s?.source).toBe(\"env\");\n    expect(s?.value).toBe(0.75);\n    expect(s?.envLocked).toBe(true);\n  });\n\n  it(\"coerces env booleans/numbers to typed values\", async () => {\n    process.env.ENPILINK_CFG_FLAGS_LIVE_LOGS = \"false\";\n    process.env.ENPILINK_CFG_RETENTION_EVENTS = \"1234\";\n    const { values } = await resolveConfig(null, cwd);\n    expect(values[\"flags.liveLogs\"]).toBe(false);\n    expect(values[\"retention.events\"]).toBe(1234);\n  });\n});\n\ndescribe(\"secret masking\", () => {\n  it(\"never returns a secret value in plaintext\", async () => {\n    process.env.ENPILINK_ADMIN_TOKEN = \"super-secret-xyz\";\n    const { settings } = await resolveConfig(null, cwd);\n    const s = settings.find((x) => x.key === \"adminAuthToken\");\n    expect(s?.secret).toBe(true);\n    expect(s?.envLocked).toBe(true);\n    expect(s?.value).toBe(MASKED);\n    expect(JSON.stringify(settings)).not.toContain(\"super-secret-xyz\");\n    delete process.env.ENPILINK_ADMIN_TOKEN;\n  });\n\n  it(\"unset secret reports null, not masked\", async () => {\n    const { settings } = await resolveConfig(null, cwd);\n    const s = settings.find((x) => x.key === \"adminAuthToken\");\n    expect(s?.value).toBeNull();\n  });\n\n  it(\"bootstrap keys are always env-locked\", async () => {\n    const { settings } = await resolveConfig(null, cwd);\n    for (const key of [\"storage\", \"dbPath\", \"port\", \"admin\"]) {\n      const s = settings.find((x) => x.key === key);\n      expect(s?.tier).toBe(\"bootstrap\");\n      expect(s?.envLocked).toBe(true);\n    }\n  });\n});\n\ndescribe(\"validateRuntimeWrite\", () => {\n  it(\"accepts a valid runtime value\", () => {\n    const r = validateRuntimeWrite(\"analytics.sampleRate\", 0.3);\n    expect(r.ok).toBe(true);\n    if (r.ok) {\n      expect(r.value).toBe(0.3);\n    }\n  });\n  it(\"coerces a stringy boolean for a flag\", () => {\n    const r = validateRuntimeWrite(\"flags.liveLogs\", \"true\");\n    expect(r.ok).toBe(true);\n    if (r.ok) {\n      expect(r.value).toBe(true);\n    }\n  });\n  it(\"rejects out-of-range\", () => {\n    const r = validateRuntimeWrite(\"analytics.sampleRate\", 5);\n    expect(r.ok).toBe(false);\n  });\n  it(\"rejects bootstrap key\", () => {\n    expect(validateRuntimeWrite(\"port\", 8080).ok).toBe(false);\n  });\n  it(\"rejects secret key\", () => {\n    expect(validateRuntimeWrite(\"adminAuthToken\", \"x\").ok).toBe(false);\n  });\n});\n\n// --- Router integration tests ---\n\nasync function request(\n  app: express.Express,\n  method: string,\n  url: string,\n  body?: unknown,\n): Promise<{ status: number; json: unknown }> {\n  const { createServer } = await import(\"node:http\");\n  const server = createServer(app);\n  await new Promise<void>((r) => server.listen(0, r));\n  const addr = server.address();\n  const port = typeof addr === \"object\" && addr ? addr.port : 0;\n  try {\n    const res = await fetch(`http://127.0.0.1:${port}${url}`, {\n      method,\n      headers: body ? { \"content-type\": \"application/json\" } : undefined,\n      body: body ? JSON.stringify(body) : undefined,\n    });\n    return { status: res.status, json: await res.json().catch(() => null) };\n  } finally {\n    await new Promise<void>((r) => server.close(() => r()));\n  }\n}\n\nfunction appWith(storage: StorageAdapter | null): express.Express {\n  const app = express();\n  app.use(express.json());\n  app.use(createConfigRouter(() => storage));\n  return app;\n}\n\ndescribe(\"config router\", () => {\n  it(\"GET /config returns settings; never 500 with no storage\", async () => {\n    const app = appWith(null);\n    const { status, json } = await request(app, \"GET\", \"/__enpilink/config\");\n    expect(status).toBe(200);\n    const settings = (json as { settings: unknown[] }).settings;\n    expect(Array.isArray(settings)).toBe(true);\n    expect(settings.length).toBeGreaterThan(0);\n  });\n\n  it(\"PUT a runtime key persists + writes an audit row\", async () => {\n    const storage = new MemoryStorageAdapter();\n    const app = appWith(storage);\n    const { status, json } = await request(\n      app,\n      \"PUT\",\n      \"/__enpilink/config/analytics.sampleRate\",\n      { value: 0.4 },\n    );\n    expect(status).toBe(200);\n    expect((json as { ok: boolean }).ok).toBe(true);\n    expect(await storage.getConfig(\"analytics.sampleRate\")).toBe(0.4);\n    const audit = await storage.getConfigAudit();\n    expect(audit[0]).toMatchObject({\n      key: \"analytics.sampleRate\",\n      newValue: 0.4,\n    });\n  });\n\n  it(\"PUT rejects a bootstrap key (403)\", async () => {\n    const storage = new MemoryStorageAdapter();\n    const app = appWith(storage);\n    const { status } = await request(app, \"PUT\", \"/__enpilink/config/port\", {\n      value: 9999,\n    });\n    expect(status).toBe(403);\n  });\n\n  it(\"PUT rejects a secret key (403)\", async () => {\n    const storage = new MemoryStorageAdapter();\n    const app = appWith(storage);\n    const { status } = await request(\n      app,\n      \"PUT\",\n      \"/__enpilink/config/adminAuthToken\",\n      { value: \"x\" },\n    );\n    expect(status).toBe(403);\n  });\n\n  it(\"PUT rejects an unknown key (404)\", async () => {\n    const app = appWith(new MemoryStorageAdapter());\n    const { status } = await request(app, \"PUT\", \"/__enpilink/config/nope\", {\n      value: 1,\n    });\n    expect(status).toBe(404);\n  });\n\n  it(\"PUT rejects an out-of-range runtime value (400)\", async () => {\n    const app = appWith(new MemoryStorageAdapter());\n    const { status } = await request(\n      app,\n      \"PUT\",\n      \"/__enpilink/config/analytics.sampleRate\",\n      { value: 99 },\n    );\n    expect(status).toBe(400);\n  });\n\n  it(\"PUT with no storage → 409 (nowhere to persist)\", async () => {\n    const app = appWith(null);\n    const { status } = await request(\n      app,\n      \"PUT\",\n      \"/__enpilink/config/flags.liveLogs\",\n      { value: false },\n    );\n    expect(status).toBe(409);\n  });\n\n  it(\"GET /config/audit surfaces entries\", async () => {\n    const storage = new MemoryStorageAdapter();\n    await storage.setConfig(\"flags.liveLogs\", false, \"tester\");\n    const app = appWith(storage);\n    const { status, json } = await request(\n      app,\n      \"GET\",\n      \"/__enpilink/config/audit\",\n    );\n    expect(status).toBe(200);\n    const audit = (json as { audit: Array<{ key: string }> }).audit;\n    expect(audit[0]?.key).toBe(\"flags.liveLogs\");\n  });\n\n  it(\"GET /config/audit with no storage → empty, never 500\", async () => {\n    const app = appWith(null);\n    const { status, json } = await request(\n      app,\n      \"GET\",\n      \"/__enpilink/config/audit\",\n    );\n    expect(status).toBe(200);\n    expect((json as { audit: unknown[] }).audit).toEqual([]);\n  });\n});\n"]}

package/dist/server/config/index.d.ts

@@ -0,0 +1,3 @@
+export { type ConfigSource, loadConfigFile, MASKED, type ResolvedConfig, type ResolvedSetting, resolveConfig, validateRuntimeWrite, } from "./resolve.js";
+export { createConfigRouter } from "./router.js";
+export { allKeyMeta, BOOTSTRAP_KEYS, type BootstrapConfig, type BootstrapKey, bootstrapSchema, type Config, type ConfigKey, configSchema, ENV_VARS, isBootstrapKey, isKnownKey, isRuntimeKey, isSecretKey, type KeyMeta, keyMeta, RUNTIME_KEYS, type RuntimeConfig, type RuntimeKey, runtimeSchema, SECRET_KEYS, } from "./schema.js";

package/dist/server/config/index.js

@@ -0,0 +1,4 @@
+export { loadConfigFile, MASKED, resolveConfig, validateRuntimeWrite, } from "./resolve.js";
+export { createConfigRouter } from "./router.js";
+export { allKeyMeta, BOOTSTRAP_KEYS, bootstrapSchema, configSchema, ENV_VARS, isBootstrapKey, isKnownKey, isRuntimeKey, isSecretKey, keyMeta, RUNTIME_KEYS, runtimeSchema, SECRET_KEYS, } from "./schema.js";
+//# sourceMappingURL=index.js.map

package/dist/server/config/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/server/config/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,cAAc,EACd,MAAM,EAGN,aAAa,EACb,oBAAoB,GACrB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EACL,UAAU,EACV,cAAc,EAGd,eAAe,EAGf,YAAY,EACZ,QAAQ,EACR,cAAc,EACd,UAAU,EACV,YAAY,EACZ,WAAW,EAEX,OAAO,EACP,YAAY,EAGZ,aAAa,EACb,WAAW,GACZ,MAAM,aAAa,CAAC","sourcesContent":["export {\n  type ConfigSource,\n  loadConfigFile,\n  MASKED,\n  type ResolvedConfig,\n  type ResolvedSetting,\n  resolveConfig,\n  validateRuntimeWrite,\n} from \"./resolve.js\";\nexport { createConfigRouter } from \"./router.js\";\nexport {\n  allKeyMeta,\n  BOOTSTRAP_KEYS,\n  type BootstrapConfig,\n  type BootstrapKey,\n  bootstrapSchema,\n  type Config,\n  type ConfigKey,\n  configSchema,\n  ENV_VARS,\n  isBootstrapKey,\n  isKnownKey,\n  isRuntimeKey,\n  isSecretKey,\n  type KeyMeta,\n  keyMeta,\n  RUNTIME_KEYS,\n  type RuntimeConfig,\n  type RuntimeKey,\n  runtimeSchema,\n  SECRET_KEYS,\n} from \"./schema.js\";\n"]}

package/dist/server/config/resolve.d.ts

@@ -0,0 +1,73 @@
+import type { StorageAdapter } from "../storage/types.js";
+import { type Config, type ConfigKey } from "./schema.js";
+/**
+ * Config resolution (M4). Merges sources with precedence
+ * **env > file (`enpilink.config.{json,ts}`) > db (runtime only) > default**
+ * and reports, per key, which source supplied the value and whether the key is
+ * secret / env-locked (read-only).
+ *
+ * Secrets (e.g. `adminAuthToken`) are NEVER read from the DB and NEVER returned
+ * in plaintext — {@link resolveConfig} masks them to a placeholder and flags
+ * `secret: true`. Bootstrap keys and any key pinned by env/file are
+ * `envLocked: true` (the admin UI must render them read-only).
+ */
+export type ConfigSource = "env" | "file" | "db" | "default";
+/** A masked placeholder returned in place of any secret value. */
+export declare const MASKED = "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022";
+/** A single resolved setting as exposed by the config API. */
+export interface ResolvedSetting {
+    key: ConfigKey;
+    /** Tier: `bootstrap` (env/file only) or `runtime` (DB-editable). */
+    tier: "bootstrap" | "runtime";
+    /** The resolved value, or {@link MASKED} when secret. */
+    value: unknown;
+    /** Which source supplied the value. */
+    source: ConfigSource;
+    /** Whether this key is a secret (never returned in plaintext). */
+    secret: boolean;
+    /**
+     * Whether this key is read-only in the admin UI. True for all bootstrap keys,
+     * and for any runtime key pinned via env or file (the DB value is shadowed).
+     */
+    envLocked: boolean;
+    /** The env var that drives / can pin this key. */
+    env: string;
+}
+/** The full resolved config plus per-key reporting. */
+export interface ResolvedConfig {
+    /** Effective typed values (secrets present in-process, masked only at the API). */
+    values: Config;
+    /** Per-key source + secret/env-lock reporting. */
+    settings: ResolvedSetting[];
+}
+/**
+ * Load the optional config file (JSON only — a `.ts` file is acknowledged but
+ * not executed here to avoid a runtime transpile dependency; M6 can add TS
+ * loading). Returns a flat partial keyed by {@link ConfigKey}. Never throws —
+ * a malformed/absent file yields `{}`.
+ */
+export declare function loadConfigFile(cwd?: string): {
+    source: "file" | null;
+    values: Partial<Record<ConfigKey, unknown>>;
+};
+/**
+ * Resolve all config. Reads the DB (runtime keys only) when a storage adapter
+ * is provided; secrets are never read from the DB. Falls back to defaults when
+ * there is no storage. Never throws on a storage error — it degrades to
+ * file/env/default.
+ *
+ * @param storage active storage adapter, or `null` when analytics/admin is off.
+ */
+export declare function resolveConfig(storage: StorageAdapter | null, cwd?: string): Promise<ResolvedConfig>;
+/**
+ * Validate + coerce a single RUNTIME, non-secret value before persisting.
+ * Returns the coerced value or an error string. Rejects unknown/bootstrap/
+ * secret keys (those are handled by the caller with a clear 4xx).
+ */
+export declare function validateRuntimeWrite(key: string, rawValue: unknown): {
+    ok: true;
+    value: unknown;
+} | {
+    ok: false;
+    error: string;
+};